Adding Multiple Individual IP addresses at one time.

[garethdoyle]

In our environment we use tags on individual IP addresses for a few different things and then have policies in place to take those actions based on those tags.

Sometimes we have requests come in with a lot of indivudla IP addresses that we have to add and tag in multiple VSYS's. This is tedious and time consuming because the only way I know how to do it is manually, one at a time, adding each address and tagging it.

Is it possible to add multiple IP addresses and tag them at one time? I wouldn't mind doing it in individual VSYS's if needed.

Thanks.

[rmfalconer]

You can use the CLI to add addresses and set a tag on them. You still have to create the script but can paste them all at once.

set vsys vsys2 address rf tag test fqdn rf.myco.local

set vsys vsys3 address rf1 tag test1 fqdn rf1.myco.local

[garethdoyle]

I'm looking for exactly something like that, but that command doesn't work for me...

In order to hop into the right vsys I have to use this command:

set system setting target-vsys vsys2

From there I don't see anything similar to what you have.

What version of of PanOS are you running?

[rmfalconer]

I'm on 7.1.6 but it looks like you aren't in config mode.

I prefer the set based CLI so the first command I run is:

set cli config-output-format set

Then type 'configure' to get to config mode, which is shown by the # symbol after the hostname. 

user@firewall#

Then you can paste the config.

[garethdoyle]

I only have the following commands available in configure mode:

check
edit  
exit  
find  
quit  
run   
show  
top   
up   

[rmfalconer]

It looks like your account permissions in the CLI have been restricted. Admin roles can have different permissions for GUI and CLI.

Does your login account have a specific profile attached to it?

[garethdoyle]

This was tried on a fully privileged account. I wonder if maybe that is just not available in PanOS 7.0.x

[BPry]

@garethdoyle,

The listed options that you have would not be consistent with a fully privileged account on any version of the os. The 'set' command has been around since the beginning and without it you aren't going to be able to do any of this in the CLI as it appears your CLI is restricted. You may be allowed to change everything you want in the GUI, but it appears CLI is most definitely limited. 

[garethdoyle]

Thanks for that, there may be something else at play.

As a separate question, would a PA-200 have this functionality?

Thanks.

[rmfalconer]

I just created a user with the devicereader CLI permissions and I see the exact options you do in config mode.

Yes, the set commands work on any hardware version. 

[garethdoyle]

When I test in my PA-200 as the admin account I don't see these commands either. Also running 7.0.x ... Interestingly weird.

[rmfalconer]

Is the admin account Dynamic or Role Based?

[garethdoyle]

I'm not sure what that means.. It is the default admin account and even still has the default admin/admin password.

[rmfalconer]

On the admin account, there is a section for 'Administrator Type'. The choices are Dynamic or Role Based.