Commit and Push to Devices - via API call to Panorama

[DanParker]

Hi all,

I am trying to develop a proof-of-concept script, where our SOC will push an a shared address object to Panorama, with a tag "SOC_IDENT_HIGHRISK". These objects will then be dynamically added to a security group to which block rules are applied.

The issue I am having is with the final step "push to devices", referred to as "commit-all" on the API. The object gets created and I can watch the Panorama commit complete. 

I use the following Python to try and do the commit-all:

baseURL = 'https://192.168.70.51/api/'

apiKeyBase64 = '<api key>'

#Push to firewalls

cmd3 = "<commit-all></commit-all>"

result3 = requests.get(baseURL,params={'type': type,'cmd': cmd3,'key': apiKeyBase64},verify=False)

print(result3.content)

This returns the following error:

"<response status = 'error' code = '400'><result><msg>Illegal cmd. Use type [commit] instead</msg></result></response>"

I understood that commit was to xcommit object to Panorama and commit-all is synonymous with "Push to Devices", unless I have misunderstood? Can anyone advise on what the issue might be please?

[TomYoung]

Hi @DanParker ,

You are correct that the configuration 'commit' command commits to Panorama, and the operational 'commit-all' command pushes to devices.  The solution to this discussion confirms this -> https://live.paloaltonetworks.com/t5/automation-api-discussions/trying-to-do-commit-and-then-push-fr....

What is interesting is that for 'commit-all' you have to specify the device-group or template/template-stack.  I cannot find an option to push all.  That lines up with this doc -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClqeCAC.

What I am saying is this:  The XML API lines up with the CLI.  If the CLI requires a parameter, the XML API does also.  Your error is equivalent to 'invalid syntax' on the CLI.  The good news is that you can run the 'cli debug on' command to give you the URL syntax needed when you run a CLI command.  (It does not work for GUI operations.)  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api...  I have heard the debug goes way when the session is closed.

So, you can run the 'commit-all' commands from the CLI with 'debug cli on' and get the XML syntax you need.  You will have to do it for every device-group and template-stack.  The 'include-template' may save you some steps.

Thanks,

Tom

Edit:  I just saw this -> https://pan.dev/ansible/docs/panos/guides/panorama-push/.