Export license expiration info from Panorama for managed devices?

[mgentile]

I'd like to be able export the license expiration information from Panorama for all my managed devices.  This would be helpful for creating bills of materials and getting current data for financial planning with real, live data.  The support portal's asset management system isn't as useful because I can't remove old devices!

Here is an example of the data I want to get. 

I can't copy/paste the data from Panorama, and I can't find a CLI command to provide this data either.  The closest I can get is request batch software info, but that doesn't show the dates!

Anyone have ideas or suggestions?

[BenjAudy.MTL]

Hi,

Maybe you could create a group in the portal and add the old devices to it? When you would export the assets from the portal, the device group would tell you if the device is still active.

Benjamin

[yarinbenado]

Are you open to using an external tool to achieve this?

[reaper · Accepted solution]

You should be able to use the API call for request batch license info which will return dates:

Rest API Url
/api/?type=op&cmd=<request><batch><license><info></info></license></batch></request>

which should return something like:

<response status="success">
<result>
<devices>
<entry>
<serial-no>000XXXXXXX</serial-no>
<devicename>PA-5050</devicename>
<licenses>
<entry name="GlobalProtect Portal">
<type>SUB</type>
<feature-description>GlobalProtect Portal License</feature-description>
</entry>
<entry name="GlobalProtect Gateway">
<type>SUB</type>
<feature-description>GlobalProtect Gateway License</feature-description>
<expiry-date>10/1/2016</expiry-date>
</entry>
<entry name="Threat Prevention">
<type>SUB</type>
<feature-description>Threat Prevention</feature-description>
<expiry-date>10/1/2016</expiry-date>
</entry>
<entry name="Standard">
<type>SUP</type>
<feature-description>
10 x 5 phone support; repair and replace hardware service
</feature-description>
<expiry-date>10/1/2016</expiry-date>
</entry>
<entry name="PAN-DB URL Filtering">
<type>SUB</type>
<feature-description>Palo Alto Networks URL Filtering License</feature-description>
<expiry-date>3/23/2017</expiry-date>
</entry>
<entry name="WildFire License">
<type>SUB</type>
<feature-description>
WildFire signature feed, integrated WildFire logs, WildFire API
</feature-description>
<expiry-date>6/11/2016</expiry-date>
</entry>
</licenses>
</entry>

[mgentile]

You're right!  The API output provides a lot more detail than the CLI command.  This is exactly the info I need.  Thanks!

[mgentile]

@yarinbenado Yes, I currently have a tool that collects, analyzes, and monitors my firewall's configurations.  If only it included this info as well... 🙂

[yarinbenado]

What do you use @mgentile?