09-26-2014 02:12 AM
Hi,
We need to programmatically toggle our PA500's GUI setting "Policies / Captive Portal / My_CP_Policy / Action" between "no-captive-portal" and "web-form" from a windows server.
I assume that this is possible using CLI remotely, but where can I find documentation how to setup everything for a task like this?
Thanks a lot for help on this
regards Tor
09-26-2014 05:26 AM
If you're just going to do it manually from the CLI, you can just go to configure mode and use the following command "set rulebase captive-portal rules MY_CP_Policy action no-captive-portal" (command will vary a bit if you have enabled vsys on your device).
Then trigger a commit.
If you are going to use the API, you could easily find the restapi url using the API-browser at https://firewallIIP/api
It will be somehting like this: /api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/captive-portal/rules/entry[@name='MY_CP_Policy']/action/member[@name='no-captive-portal']
09-26-2014 02:38 AM
Hi Tor
you could accomplish this with an API or an expect script, but would you mind elaborating on why you need to toggle the setting for a single policy, maybe there's a different way to achieve what you need 
09-26-2014 03:04 AM
This is for a high school environment. We switch on user auth for network access when some classes are having tests or exams. Memberships in certain AD user groups govern the network access (intranet only, LMS site on internet etc) according to policies.
However I don't want to bug my users with the CP login dialog unless some class is really needing to restrict access. That's why I need to switch the CP policy action between web form and none.
09-26-2014 05:26 AM
If you're just going to do it manually from the CLI, you can just go to configure mode and use the following command "set rulebase captive-portal rules MY_CP_Policy action no-captive-portal" (command will vary a bit if you have enabled vsys on your device).
Then trigger a commit.
If you are going to use the API, you could easily find the restapi url using the API-browser at https://firewallIIP/api
It will be somehting like this: /api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/captive-portal/rules/entry[@name='MY_CP_Policy']/action/member[@name='no-captive-portal']
09-26-2014 07:49 AM
Hello IKT,
Please refer bellow CLI guide, it has all required configuration command.
https://live.paloaltonetworks.com/docs/DOC-6601
Let me know for additional queries.
Regards,
hardik Shah
09-26-2014 08:15 AM
I think API will be the best solution for that.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
