Need help with scripting to palo alto using ssh

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L0 Member

Need help with scripting to palo alto using ssh

Hi all!

I'm trying to creating a script for a customer i Windows Batch (*.bat) that needs to login to a Palo Alto Firewall, run a few commands and then login to another firewall and so on. 

 

This is a strict environment so no internet connection is available. 
The goal is to login to upload the anti-virus and content offline-packs (Dynamic Updates )to a couple of Palo Alto devices from an SCP source.

 

I have made the script that can log into a Palo Alto using Puttys command line tool "plink.exe" and execute commands from a text file. The problem is that the SCP-server is requiring a password that outputs a prompt that is shown in the session window that I don't know how to send characters to. 

 

I have not find a way to solve this....

 

Is there any good Windows Batch programmer here that can help me out or is there another way to simply upload the Dynamic Updates file to a destination on the firewall or do I really need to trigger the update from within the Palo Alto itself?

 

I would appreciate any help I can get. 

Thanks

Highlighted
L0 Member

Current status:
-----------------------------------------------------
- Plink cannot connect to Palo


Troubleshooting steps:
-----------------------------------------------------
- it can login but cannot execute

Options:
- Python
- API

- we need to use fw.expect with Python, be careful about 2.0 or 3.0 Python (commands different)

Discussion & Observations:
-----------------------------------------------------
- Palo doesn't have full bash CLI that is why Plink is not working

Tips for your firewall:
-----------------------------------------------------
- Scripting is not supported by brake and fix team
- Please contact your SE or RE, but I will try my best to assist

Please see KB:
-----------------------------------------------------
https://github.com/kevinsteves/pan-python
http://pandevice.readthedocs.io/

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-panorama-api.html
https://X.X.X.X/api (put Panoram IP) redirects to https://X.X.X.X/php/rest/browse.php

Next steps:
-----------------------------------------------------
- Please see example at
https://live.paloaltonetworks.com/t5/API-Articles/Scripts-Expect-scripts-for-Operational-and-Config-...

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!