About btorresgil

"Yes this can be done through the API"   Are there any examples of how this could be done available? ... View more

Thank you very much, this would work out super, we do what to automate the entire vsys/vr and bgp router configs. So it is not done manually.   ... View more

Thanks for the options.  I forgot about API and will go that route as we're still on 7.1 and not yet an AutoFocus subscriber. ... View more

this is awesome, thanks! ... View more

this is great, will spend time wrapping my head around this.     Thank you!   EDIT: after looking at some of this I was not even aware of this library, wow this is really great.  Thank you again for sharing!   ... View more

Great, that's just what I need. Thanks! ... View more

For additional information for anyone reading this later, different versions of PAN-OS handle this differently.  The most recent PAN-OS versions generate the same API key across different devices, unless those devices have a different master key.  So it comes down to some best practices.  It is a best practice to have different master keys on each firewall which would mean different API keys, even for admins with the same username and password.   So as nswift suggested, it is also a best practice to regenerate the API key in your situation.  Although in some cases you'll get the same API key, there are other factors besides username and password that could make the API key different. ... View more

You can use 'edit' or 'set.  Edit will replace the existing config, Set will add to it.  Keep in mind when you use Edit you have to specify the element you're replacing.  Here are examples of set and edit used to modify the 'fqdn' of the address object:   action=set xpath=/config/devices/entry/vsys/entry/address/entry[@name='test'] element=<fqdn>test.domain.edu</fqdn> or action=edit xpath=/config/devices/entry/vsys/entry/address/entry[@name='test']/fqdn element=<fqdn>test.domain.edu</fqdn>   For an example like this, set and edit are basically the same, but if you were performing set or edit on the address object, then they are different because set is non-destrictive and will merge the existing config with the new element, while edit is destrictive and will replace the existing address object with the new element.   Since you're using pan-python, you might also be interested in a new library from Palo Alto Networks called the Device Framework.  It allows you to interact with the API without having touch XML or XPaths.  Everything is object oriented so you just create and modify objects in python like you would on the firewall GUI or CLI.   With the Device Framework, the above address object could be created easily using this code.  No XML, XPaths, or API-Key required:   from pandevice import firewall, objects fw = firewall.Firewall('10.0.0.1', 'admin', 'yourpassword') address_obj = objects.AddressObject('test', 'test.domain.edu', 'fqdn') fw.add(address_obj) address_obj.create()   More information about the Palo Alto Networks Device Framework is available here:   Documentation http://pandevice.readthedocs.io/en/latest/readme.html Intro Presentation http://paloaltonetworks.github.io/pandevice/ ... View more

Thanks, I'll have to look into pandevice more. I keep hearing that it's really nice and easier to use.  ... View more