Certificates not appearing in XML running configuration

[GGarolla]

Dear colleagues,

I am having trouble with the custom Nagios plugin check_paloalto, specifically with the "certificates" check.

The rest of the checks are working fine.

Basically, the "certificates" check leverages the API calls and parse the XML running configuration file to find the certificates. The issue is that my firewalls (which are managed by Panorama, which in turn pushes the certificates from a template) do not present the certificate part in the XML configuration file. I verified it by calling the same API in the browser.

My goal is having a Nagios check that is triggered when a certificate is near the expiration date, since we are using them for SSL Inspection and other reasons.

Panorama and firewalls are running PAN-OS 10.1.10, and Nagios is running version 5.9.3.

Is there any reason why this happens?

Many thanks!

[aleksandar.astardzhiev]

Hi @GGarolla ,

What you are experiance is by design. Configuration pushed by Panorama is not stored in firewall local configuration, but it is stored separately as "panorama pushed" config.

I don't have access to FW right now, but there are CLI operation commands that allow you to list/view the panorama pushed config, I am sure there should be XML API call for those as well.

However in the link you shared is mentioned that  Nagios is using the Rest API (note that PAN FWs supprot XML and REST, but they are different). REST was introduced fairly recently and it has its limitations, some commands/actions are available only under XML API.

[GGarolla]

Thanks for your response, Aleksandar.

I will investigate the REST API and maybe I will try to customize the check in order to check if I can use the XML API to review the Panorama pushed configuration