About cpainchaud

  client requests MiddleAPI.getAllRulesMatchingX ->    MiddleAPI requests PAN_API.getFullConfigDump   MiddleAPI parse XML, filters records of interest, add a 'loc' property   MiddleAPI sends answer to client ... View more

I quit using XML to dictionary/json/arrays a long time ago : it's way too slow. I parse XML directly with libxml and alike.   In your case, to solve your bandwidth issues, I would have a middleware/application-proxy that would be excuted in the same datacenter as the firewall/panorama. This mini-API of yours would be able to acess the firewall without any bandwidth or latency constraint and would then just return the pieces of interest to you. ... View more

Unfortinately, PANOS doesn't provide API features to search for objects and such. The XPath is oringally designed to name a 'path' in the XML rather than doing searches.   Why does it take so long to get the condicate config ? Bandwidth issue or PANOS is too slow ? It should be instant almost ... View more

this 'loc' property is added by PANOS, it's not part of XPath at all.   The fact it displaying in one case but not another is a mystery to me : it's not even a 'documented' feature of PANOS.   You will find yourself quickly limited with XPath because it doesn't fit all purposes.   I would usually script that : download the candidate config -> parse what I want (you can use XPath inside python as well if you don't want to code navigate through Xml tree by yourself.   Can I ask what kind of action you would like to do after you foudn the rules you need ? ... View more

you are welcome! Remember it's just standard XPath 1.0 so you can google for more examples of syntaxes   Concerning my PHP lib: it's a set of utilities that are ready to run (no scripting skills involved, just invoke them) and a framework for devs. You might want to have a look if you dont want to reinvent the wheel.   cheers ! ... View more

Hi,    The API is not designed for that. It has limited support for XPath and pulling data locally is probably the only way.     There are as well exisiting utilities which can do what you are looking for already, like one of mine here: https://live.paloaltonetworks.com/t5/API-Articles/rules-edit-php-to-manage-edit-export-rules-from-CLI/ta-p/53321 ... View more

this is really weird , I would open a TAC case ... View more

I am afraid you cannot make this setup work with 2 VRs in same VSYS.   You should deploy 2 VSYS, each of them with their own VR. Then you can make NAT rules between the 2 VSYS. ... View more

API keys are encrypted version of login+password , so they cannot be revoked , you need to change the password.   I could be wrong but after cache dies ( a few minutes/hours ) then the api key should not work anymore ... View more

yes ... View more

https://live.paloaltonetworks.com/t5/API-Articles/Simple-export-of-rules-as-Excel-or-HTML/ta-p/65082 ... View more