Using API to update Permitted IP Addresses list

[JDBailey]

We use the Permitted IP Addresses list (Panorama>Setup>Interfaces) to restrict access to Panorama to our public IPs. The problem we run into is that some of our devices use cellular as backup (new public IP every two days) or worse--Starlink (who change your public IP several times per day).

Since this list only uses IP, not DNS, I can't just use a dynamic DNS entries. My solution is to update the list manually every time I need to push a config. I'd like to use a script that makes API calls, but I can't find any documentation for the API calls that gets to anything in the Panorama>Setup area. Any idea where these commands might be hiding? Or is the API limited to only select commands? Maybe I need to just script accessing the CLI and editing it there, but I'm not sure I've seen those commands either...

[TomYoung · Accepted solution]

Hi @JDBailey ,

The XPath you are looking for is shown below.

/api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/permitted-ip/entry[@name='172.16.0.0/12']

That example adds 172.16.0.0/12 with no description to the Permitted IP Addresses of the Panorama management interface.

There are a few ways to find an XML Path.

1. Dig through the API browser.  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api...
2. Use the CLI.  https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-ap...  This one is very cool.  Remember that the API and CLI are very similar.
3. If you have no idea where it is in the CLI, configure it in the GUI with a unique description and type 'show | match <unique-description>' in configuration mode.  Make sure to type 'set cli config-output-format set' in operational mode 1st.
4. With practice, get used to the XML tree the same as you did CLI commands.  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-cli-quick-start/use-the-cli/load-configurations/...

Thanks,

Tom

PS The CLI command is 'set deviceconfig system permitted-ip 172.16.0.0/12'.

[JDBailey]

Thank you! I've been looking for this for years, but every time I start my search some network emergency pulled me away. I'll give it a test and if it works, I'll accept the solution. Wasn't expecting a reply this week, honestly. You've made my week!