About CLIq

 as a further response... seems the panorama has not been designed for such a use-case as without a valid license you cannot even enter most of the configuration... was hoping that the licensing could be taken care of manually after the "automatic config restore" ... View more

@reaper i dont need the gui but a network connection for this Thanks, I wanted to see if there was any possibility as I doubt the feature request will be taken into consideration as this is not meant for production... anyways, will try. Thanks ... View more

@reaper Thanks but like I mentioned above, I need to do this without GUI and without network connections. I can script it and I have access to the hypervisor and console of the Panorama. so far the only option I see is to use the export as set commands (although i am not sure if a "show" will give you the complete panorama config as it does not if its in xml format) and then restore it the same way by entering those set commands... unfortunately the login prompt is **bleep**... so difficult to login with a script as you cannot know when the authdaemon is started. any comments anyone? better idea? confirm any part of my hypothesis? ... View more

@reaper yes, that does not seem to show the complete configuration and cannot be used to restore panorama with a file. anyways it seems that panorama does not support something like bootstrapping... so basically I guess I am asking what the best way would be to automate backup and restore of panorama... i was thinking about using set commands but then there is the problem of not being able to detect when you are able to login... if I script it and it keeps saying invalid credentials... i cant differentiate that from actually not being able to login... has anyone even ever tried that and will the "show" with set commands actually restore the complete panorama configuration if entered on a "fresh" panorama? ... View more

Thanks @jdelio but that doesnt help me unfortunately, seems more like its not possible although i dont understand why panorama does not have the same command to output the config in xml format... ... View more

yes but that doesnt work for me... I need a solution via console or rather without network connectivity. This is not for a production system, its for a lab software   For the firewall I save the output from the console in a file and automate the bootstrapping so you can easily backup/restore configs in seconds, works well so far actually (I tried to do it with saving and restoring the set commands but trying to automate the login is a pain for several reasons, 1.) password after 9.0.4 cannot be admin/admin anymore 2.) console keeps telling you incorrect login and there is no consistent way of telling when thats true or if the authentication daemon still needs time to start ... View more

ok, i assume this is a bug with all images then and will open a support case 🙂 ... View more

@OtakarKlier its a fresh kvm image, so yes. bootstrap works fine but no messages appear even if i try to cause it by e.g. not putting values inside init-cfg or missing folders, etc. i simpy get no console logs from bootstrap, no matter if successful or not... i would like to monitor the console to confirm a successful bootstrap EDIT: to be clear, I dont have issues with the actual bootstrap process, i got that to work but I would like to verify console logs to make sure it was successful (automatic checks from the console during boot) ... View more

@BPry  I am bootstrapping on Linux KVM (VM-Series Firewalls), which is on a local machine, so no cloud service but the console doesnt show any bootstrap related logs, though of course there are many other logs shown during boot. ... View more

@btorresgil well, its ok for labs as workaround but for production I would expect a role that would be restricted as much as possible so not much damage could be done with that user. ... View more

Hi @btorresgil @panguyen @gfreeman  ok, so the deploy of this is done automatically and only when a new cert has been issued... but this stores a superuser account name and password in cleartext... should be mentioned or better yet store only the api key accessible only by the user executing the command or something like that.. final solution should be somewhat secure, an exposed DMZ-host which might have a vulnerability giving superuser access to the firewall which can then open up access to the rest of the network? 😞 must be a better way EDIT: giving API access for import and commit seems to be enough (still allows to import new config and gain full access this way but...)... now if it were possible to only store the api-key and store this in a safe way it would at least be an interim solution until something can be created that allows nothing but import certificates 😛 ... View more

@gfreeman  any update here?   1) I have a webserver behind the Palo for which I want to enable inbound ssl decryption, I use letsencrypt certs for this. 2.) endgoal is only to not have to reimport the cert into palo every x weeks, an integration into the autocertbot would be good 3) yes 4) standalone script or better tied into certbot ... View more