08-01-2023 12:53 AM
So after many exchanges with support, many tries and debugging, here is what I learned about the concurent API call:
They is something on the documentation (https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/pan-os/10-1/pan-os-panorama-api/pan...) and the limitation is concurent request to five when login:
"
When multiple login or logout events are generated at the same time, make sure to
follow these guidelines to ensure optimal firewall performance:
• Design your application to queue events and perform batch API updates instead of
sending single event or mapping updates.
• Limit the number of concurrent API calls to five. This limit ensures that there is no
performance impact to the firewall web interface as the management plane web
server handles requests from both the API and the web interface.
"
This is not a guidelines but an hard limit where "there no option to exceed the limits".
Also this limit is not only for login "- Is this limit only for login? NO"
It's not 5 per seconds but 5 concurent (I prefer to clarify because it was the TAC that was giving us 5 per second).
I managed to go to more than 5 API request per second without any problems.
Our solution was to generate the API key once and us it for authentication every time instead of the user's username and password, as this generated a lot of requests and load on the panorama.
For the moment this solves our problem or we were waiting for the limit, to be followed in the future.
But we hope that such a low hardcoded limit can be modified.
It's a bit annoying that the documentation isn't clearer on this point, and it didn't seem very clear to the TACs either.
Antoine
