Dynamic Address Group (DAG) PAN-OS / DAGPusher prototype

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Dynamic Address Group (DAG) PAN-OS / DAGPusher prototype

L4 Transporter


Hi guys,


I'm trying to use the the DAGPusher prototype but, unhappily, I'm dealing with some problems. May be some of you could help me with it.


My scenario:


I use a generic miner to extract IPv4 (/32) from a specific location (that is working). Then it is sent to the DAGPusher node (that is working). Now I want to push them to Firewall/Panorama (it is not working).


My configuration:


In my local DAGPusher prototype, I use the configuration showed in figure 1 (green arrow). You can see that I only set the "tag_prefix":"agencias" parameter.


The status tab (figure 3) in the node cloned from this prototype, I have the indicators been received. Fine! And the Handled_Device tab show the Firewall destination (figure 2). Although I have multiplus devices and manage all of them through Panorama I choose to test DAGPusher with only one of them, at first.


Monitoring the traffic log I can see that my MM VM is trying to communicate with the device, and this traffic is allowed.


In Panorama I created a shared DAG with only one match: 'agencias' (figure 3).




At this point my DAG is not populated. Through the CLI, using the command "show object registered-ip all" I got nothing.
Could you guys identify something wrong? The syntax and the tags I used are corrects?
The fact that I created a shared DAG in Panorama could be the problem? Can I populate a shared DAG only in one Firewall?



Thank you in advanced.
Best regards.


Hi @xhoms


I executed the procedure, but you explicited lines with a successful registration and unregistration IP. Wich logs should I observe to get the details of a failed attempt to register an IP?


Best regards.

The solution is to create "tags" that associate to the vsys under the address group. This is created in each vsys.







  • 16 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!