03-28-2017 12:11 AM
I'm trying to write a reporting tool that will go throguh various device groups and identify rules that have certain keywords (change numbers in my case) in the description.
I'm querying panorama configuration and using rest api directly from python (e.g. requests module or pan.xapi)
For example, this query works perfectly for me and as a result I get two rules returned back, if description contains only one string CHG99646:
03-30-2017 02:01 AM
Unfortinately, PANOS doesn't provide API features to search for objects and such. The XPath is oringally designed to name a 'path' in the XML rather than doing searches.
Why does it take so long to get the condicate config ? Bandwidth issue or PANOS is too slow ? It should be instant almost
03-30-2017 02:08 AM
Config is 18MB in size
End request, returned XML in 28.5243420601
Size in bytes: 18714100
Converting XML to DICT
Finished conversion 44.2015681267
And palo alto Panorama is located on the other side of the world (accessing it over WAN)
What is your config size that you are normally downloading when you say it is almost instant?
Even if it was instant I still have about 18 seconds to convert XML to Dictionary but I could live with that (if only was instant as you say 🙂 🙂 )
03-30-2017 02:14 AM
I quit using XML to dictionary/json/arrays a long time ago : it's way too slow. I parse XML directly with libxml and alike.
In your case, to solve your bandwidth issues, I would have a middleware/application-proxy that would be excuted in the same datacenter as the firewall/panorama. This mini-API of yours would be able to acess the firewall without any bandwidth or latency constraint and would then just return the pieces of interest to you.
03-30-2017 02:17 AM
client requests MiddleAPI.getAllRulesMatchingX ->
MiddleAPI requests PAN_API.getFullConfigDump
MiddleAPI parse XML, filters records of interest, add a 'loc' property
MiddleAPI sends answer to client
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!