How to create multiple policy objects using Panorama

[SunilGajjar]

Is there any quick way to configure multiple policy objects on Panorama? especially looking to configure hundreds of fqdn objects to push them to firewalls managed through panorama so using GUI is quite a lot of work.

e.g. for standalone PA, it is quick using CLI commands

[Chacko42 · Accepted solution]

You could build up a cli-script or you can use the xml-api

https://live.paloaltonetworks.com/t5/Management-Articles/Add-a-Shared-Address-Object-Using-XML-API-t...

[SunilGajjar]

Thanks for your reply. It looks to be a good solution for Shared objects.

Is there any similar method to create it for a specific Device Group?

[Chacko42]

Unfortunately I currently got no panorama at hand, but you can have a look for the api-calls at https://<panorama-ip/api

Maybe there is a "device group" branch on the same level as the "shared" branch.

[Remo · Accepted solution]

https://{panorama-ip}/api/?key={API-key}&type=config&action=set&xpath=/config/device-group[@name='{devicegroup-name}']/address/entry[@name='{object-name}'] &element=<ip-netmask>{ip-address/mask}</ip-netmask>

[kiwi]

@SunilGajjar,

As Chacko42 & vsys_remo pointed out using XML_API can be an excellent way to do this.

If you're unfamiliar with how XML API works then check out the following XML API use case examples explained on the Live Community Blog (these might not match your exact use case but can definitely help you getting started with XML API) :

Export-the-security-rulebase-using-XML-API

XML-API-Use-Case-to-Add-amp-Delete-TS-Agents

The-Power-of-XML-API

Cheers !

-Kiwi.

[SunilGajjar]

@kiwi@Remo@Chacko42

Thanks for your replies.

[SunilGajjar]

@Chacko42

I have drilled it down through Panorama API browser to find out Devicegroup related Xpath at: /config/devices/entry[@name='{localhost.localdomain}']/device-group/entry[@name='{device-group name}]

It successfully worked using below API call (replace relevant values for variables within brackets {}):

https://{panorama-ip}/api/?key={API-Key}&type=config&action=set&xpath=/config/devices/entry[@name='{localhost.localdomain}']/device-group/entry[@name='{device-group name}']/address/entry[@name='{address-object-name}'] &element=<ip-netmask>{ip-address/mask}</ip-netmask>