Email config audit on change.

[RobinClayton]

On our old firewalls we used KIWI CATTOOLS to pick up configs hourly and compare them for differences, this sort of works on the Palo but each night it seems to generate strange changes in the configs.

Ideally I would want to send out the config audit on commit, the emails that normaly come through are more or less useless and unreadable.

Or can I automate it hourly to send out a config Audit?

Thanks

Rob

[BPry]

@RobinClayton,

I don't believe this is possible through the API itself. I've setup a fairly basic process of automating this myself that I've outlined below that works fairly well. The API however won't actually do the compare to the best of my knowledge, and that feature is actually just baked into the GUI. What the API can do for you is provide the XML file for the different config versions; so if for example you ran '<show><config><audit><info></info></audit>,/config></show>' to get what version number gets assigned to which config; you could then run the '<show><config><audit><version>number</version></audit></config></show>' to pull that XML config down. You could then use the different config versions to actually run a compare.

Personally I do this:

I use a script for all commits that will pull the running-config right before it issues the commit command, saving it to a folder as 'pre-commit.xml'. The script then issues the commit, I've included a 60 second wait in the script, then it pulls the running-config once the commit finishes and saves it as 'post-commit.xml'. 

Then I simply utilize another program within that script to actually run an XML compare, which then gets sent to my email. This way I don't have to worry about what config version I'm on or anything like that; I simply run an XML compare using whatever program via the same script against pre-commit.xml and post-commit.xml.