Expedition Read Only Panorama API User?

[TylerDoyle]

Hello,

I would like to have our InfoSec team use Expedition to audit/report/track changes on our firewalls. What's the best way to set them up so they can use Expedition, but not have any rights to modify or push changes to Panorama or the firewalls? Expedition v. 1.1.35.

I've setup a Panorama user with XML API rights, but have found the user requires at least the "Operational Requests" and "Configuration" roles in order to download the firewall config files for analysis. Per this page, the "Configuration" role can also modify Panorama and the firewall configs, which we don't want to allow. https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-web-interface-help/panorama-web-interface/panora...

Maybe there's a way within Expedition to limit this type of access? Or a different set of RBAC roles? Ideally, I'd be able to give InfoSec a Panorama read-only API key and they'd be admins/super-users in Expedition, as they will be the ones primarily using the tool.

Thanks in advance for any suggestions.

[dgildelaig]

The best would be to have the limitations based on the API keys, so that Panorama won't allow changes to be pushed using that API key.

That said, Expedition has some internal controls to set limitations on user roles.

How can you use them?
Create a user for those auditors with the "viewer" role assigned within the project.

When retreiving the API keys from panorama, specify that the keys are only for "admin". Notice that then, the "viewer" users won't have an API key assigned.

So, your auditors will be able to see the config in Expedition, but won't have credentials to make a push.

Notice that you would require an "admin" user to pull the config.

[TylerDoyle]

Thanks for your reply and thoughts.

I will see if there's a secure way to automate the admin-task of pulling the most recent XML configs from the firewalls into Expedition. That ability + using the RBAC setup inside Expedition sounds like it might accomplish what we're aiming for.