Manage policies using CLI from a computer

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Manage policies using CLI from a computer

L3 Networker

Hi,

We need to programmatically toggle our PA500's  GUI setting "Policies / Captive Portal / My_CP_Policy / Action" between "no-captive-portal" and "web-form" from a windows server.

I assume that this is possible using CLI remotely, but where can I find documentation how to setup everything for a task like this?

Thanks a lot for help on this

regards Tor

1 accepted solution

Accepted Solutions

If you're just going to do it manually from the CLI, you can just go to configure mode and use the following command "set rulebase captive-portal rules MY_CP_Policy action no-captive-portal" (command will vary a bit if you have enabled vsys on your device).

Then trigger a commit.

If you are going to use the API, you could easily find the restapi url using the API-browser at https://firewallIIP/api

It will be somehting like this: /api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/captive-portal/rules/entry[@name='MY_CP_Policy']/action/member[@name='no-captive-portal']

View solution in original post

5 REPLIES 5

Cyber Elite
Cyber Elite

Hi Tor

you could accomplish this with an API or an expect script, but would you mind elaborating on why you need to toggle the setting for a single policy, maybe there's a different way to achieve what you need Smiley Happy

Finding API Commands

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

This is for a high school environment.  We switch on user auth for network access when some classes are having tests or exams.  Memberships in certain AD user groups govern the network access (intranet only, LMS site on internet etc) according to policies.

However I don't want to bug my users with the CP login dialog unless some class is really needing to restrict access.  That's why I need to switch the CP policy action between web form and none.

If you're just going to do it manually from the CLI, you can just go to configure mode and use the following command "set rulebase captive-portal rules MY_CP_Policy action no-captive-portal" (command will vary a bit if you have enabled vsys on your device).

Then trigger a commit.

If you are going to use the API, you could easily find the restapi url using the API-browser at https://firewallIIP/api

It will be somehting like this: /api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/captive-portal/rules/entry[@name='MY_CP_Policy']/action/member[@name='no-captive-portal']

L6 Presenter

Hello IKT,

Please refer bellow CLI guide, it has all required configuration command.

https://live.paloaltonetworks.com/docs/DOC-6601

Let me know for additional queries.

Regards,

hardik Shah

L6 Presenter

I think API will be the best solution for that.

  • 1 accepted solution
  • 2684 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!