About cpainchaud

cpainchaud · ‎03-30-2017

client requests MiddleAPI.getAllRulesMatchingX -> MiddleAPI requests PAN_API.getFullConfigDump MiddleAPI parse XML, filters records of interest, add a 'loc' property MiddleAPI sends answer to client

cpainchaud · ‎03-30-2017

I quit using XML to dictionary/json/arrays a long time ago : it's way too slow. I parse XML directly with libxml and alike. In your case, to solve your bandwidth issues, I would have a middleware/application-proxy that would be excuted in the same datacenter as the firewall/panorama. This mini-API of yours would be able to acess the firewall without any bandwidth or latency constraint and would then just return the pieces of interest to you.

cpainchaud · ‎03-30-2017

Unfortinately, PANOS doesn't provide API features to search for objects and such. The XPath is oringally designed to name a 'path' in the XML rather than doing searches. Why does it take so long to get the condicate config ? Bandwidth issue or PANOS is too slow ? It should be instant almost

cpainchaud · ‎03-30-2017

this 'loc' property is added by PANOS, it's not part of XPath at all. The fact it displaying in one case but not another is a mystery to me : it's not even a 'documented' feature of PANOS. You will find yourself quickly limited with XPath because it doesn't fit all purposes. I would usually script that : download the candidate config -> parse what I want (you can use XPath inside python as well if you don't want to code navigate through Xml tree by yourself. Can I ask what kind of action you would like to do after you foudn the rules you need ?

cpainchaud · ‎03-28-2017

you are welcome! Remember it's just standard XPath 1.0 so you can google for more examples of syntaxes Concerning my PHP lib: it's a set of utilities that are ready to run (no scripting skills involved, just invoke them) and a framework for devs. You might want to have a look if you dont want to reinvent the wheel. cheers !

cpainchaud · ‎03-28-2017

What I mean is that PAN is using Xpath, so you can use what Xpath has available: In your case, something like that should work : [contains(text(),'whatYouWantHere')] concerning your other question about Global Find and such : it's not exposed to through API unfortunatly. But it's somethign available on my project if you dont mind using it and/or developping in PHP 😉

cpainchaud · ‎03-28-2017

Hi, The API is not designed for that. It has limited support for XPath and pulling data locally is probably the only way. There are as well exisiting utilities which can do what you are looking for already, like one of mine here: https://live.paloaltonetworks.com/t5/API-Articles/rules-edit-php-to-manage-edit-export-rules-from-CLI/ta-p/53321

cpainchaud · ‎02-02-2017

thx for helpng @BPry . @clyde.franklin managed to fix it : he didnt input the right path in /etc/php.ini. It'snow resolved 🙂

cpainchaud · ‎12-23-2016

this is really weird , I would open a TAC case

cpainchaud · ‎12-23-2016

I am afraid you cannot make this setup work with 2 VRs in same VSYS. You should deploy 2 VSYS, each of them with their own VR. Then you can make NAT rules between the 2 VSYS.

cpainchaud · ‎12-19-2016

API keys are encrypted version of login+password , so they cannot be revoked , you need to change the password. I could be wrong but after cache dies ( a few minutes/hours ) then the api key should not work anymore

cpainchaud · ‎12-19-2016

these are predefined and will be found in api xpath=/config/predefined

cpainchaud · ‎12-02-2016

yes

cpainchaud · ‎12-02-2016

https://live.paloaltonetworks.com/t5/API-Articles/Simple-export-of-rules-as-Excel-or-HTML/ta-p/65082

cpainchaud · ‎11-16-2016

Hi, You should check our API guide. The part that interests you is here : https://www.paloaltonetworks.com/documentation/71/pan-os/xml-api/pan-os-xml-api-request-types/edit-configuration#32090

cpainchaud · ‎11-16-2016

you should open a TAC case because this command should create an error message. You need to fix the XPATH as you forget an 'entry' for the rule: /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name...

cpainchaud · ‎11-16-2016

'Delete' allows to delete one and only 1 entry. you can use 'edit' to rewrite entirely the content of a node.

cpainchaud · ‎10-25-2016

active-directory doesn't cover necessarily cover all authentication(s) stuff, rpc or ntp. that could be too broad you want to add kerberos, some netbios, dns and ntp as well in your rule.

cpainchaud · ‎10-24-2016

no python from me 😛 text search and replace would work as long as you dont have any other part of the text file using same text string

cpainchaud · ‎10-24-2016

sure https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-What-is-Application-Dependency/ta-p/54270

cpainchaud · ‎10-24-2016

you can use this script to do it : https://live.paloaltonetworks.com/t5/API-Articles/rules-edit-php-to-manage-edit-export-rules-from-CLI/ta-p/53321

cpainchaud · ‎10-24-2016

yes, look at applications depencies.

cpainchaud · ‎10-13-2016

you are right, switch ACL to use application-default and it will stop passing traffic.

cpainchaud · ‎10-12-2016

you have too many unknown users, the queue of IP waiting to go through WMI is full so agents warns you it ignored them. as a best practice, you should not /cannot rely on WMI probing as a primary source of ID in very large networks. you should also exclude non-user networks from userid in Zone settings to minimize this queue

cpainchaud · ‎05-25-2016

Hi, Try this utlity https://live.paloaltonetworks.com/t5/API-Articles/rules-edit-php-to-manage-edit-export-rules-from-CLI/ta-p/53321 with 'action=clone:true,-appid'

cpainchaud · ‎05-11-2016

ECMP is not link/load sharing , what I read here is all but the use case of ECMP

cpainchaud · ‎04-14-2016

You may want to look at the very bottom of this article: https://live.paloaltonetworks.com/t5/API-Articles/rules-edit-php-to-manage-edit-export-rules-from-CLI/ta-p/53321

cpainchaud · ‎03-16-2016

yes, the same way they count tunnels, they count any item from the configuration file

cpainchaud · ‎12-16-2015

unless Github provides a list of their public IPs and you limit your rule to them, then you will have to allow SSH globally unfortunatly. Doesn't Github have a SSL/HTTP fallback method ?

cpainchaud · ‎12-14-2015

drag&drop zone in Query textbox will also do the trick

Date Registered	‎02-20-2013 09:22 AM
Date Last Visited	‎09-18-2017 09:37 AM
Total Messages Posted	208
Total Likes Received	42

Online Status	Offline
Date Last Visited	‎09-18-2017 09:37 AM

Strata

Prisma

Cortex

About cpainchaud