Manage policies using CLI from a computer

Reply
Highlighted
L3 Networker

Manage policies using CLI from a computer

Hi,

We need to programmatically toggle our PA500's  GUI setting "Policies / Captive Portal / My_CP_Policy / Action" between "no-captive-portal" and "web-form" from a windows server.

I assume that this is possible using CLI remotely, but where can I find documentation how to setup everything for a task like this?

Thanks a lot for help on this

regards Tor


Accepted Solutions
Highlighted
L4 Transporter

Re: Manage policies using CLI from a computer

If you're just going to do it manually from the CLI, you can just go to configure mode and use the following command "set rulebase captive-portal rules MY_CP_Policy action no-captive-portal" (command will vary a bit if you have enabled vsys on your device).

Then trigger a commit.

If you are going to use the API, you could easily find the restapi url using the API-browser at https://firewallIIP/api

It will be somehting like this: /api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/captive-portal/rules/entry[@name='MY_CP_Policy']/action/member[@name='no-captive-portal']

View solution in original post


All Replies
Highlighted
L7 Applicator

Re: Manage policies using CLI from a computer

Hi Tor

you could accomplish this with an API or an expect script, but would you mind elaborating on why you need to toggle the setting for a single policy, maybe there's a different way to achieve what you need :smileyhappy:

Finding API Commands

reaper - PANgurus.com
I drink and I know things
Highlighted
L3 Networker

Re: Manage policies using CLI from a computer

This is for a high school environment.  We switch on user auth for network access when some classes are having tests or exams.  Memberships in certain AD user groups govern the network access (intranet only, LMS site on internet etc) according to policies.

However I don't want to bug my users with the CP login dialog unless some class is really needing to restrict access.  That's why I need to switch the CP policy action between web form and none.

Highlighted
L4 Transporter

Re: Manage policies using CLI from a computer

If you're just going to do it manually from the CLI, you can just go to configure mode and use the following command "set rulebase captive-portal rules MY_CP_Policy action no-captive-portal" (command will vary a bit if you have enabled vsys on your device).

Then trigger a commit.

If you are going to use the API, you could easily find the restapi url using the API-browser at https://firewallIIP/api

It will be somehting like this: /api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/captive-portal/rules/entry[@name='MY_CP_Policy']/action/member[@name='no-captive-portal']

View solution in original post

Highlighted
L6 Presenter

Re: Manage policies using CLI from a computer

Hello IKT,

Please refer bellow CLI guide, it has all required configuration command.

https://live.paloaltonetworks.com/docs/DOC-6601

Let me know for additional queries.

Regards,

hardik Shah

Highlighted
L6 Presenter

Re: Manage policies using CLI from a computer

I think API will be the best solution for that.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!