About joaovictor

Hi Market, you can use PANOS Python Module to do this task. It can be an alternative way. After i knew this module, i didn´t spend time trying use the Rest-API. However, there are some configuration that are more efficient through Rest-API. Anyway, hope that the following suggestions work for you:     #Import Modules from panos import base from panos import firewall from panos import panorama from panos import policies from panos import objects from panos import network from panos import device   #Credentials username = 'admin' password = 'admin' device_name = 'panoramalab.mylab.com'   #You need to instanciate a panorama login object: pano = panorama.Panorama(device_name, username, password)   #You can use the bellow script to pull all Templates: templates_pan = panorama.Template.refreshall(pano)   #You can use the bellow script to pull all DeviceGroups from Panorama: device_grp_pan = panorama.DeviceGroup.refreshall(pano)   #Optional step: You will receive a list with Templates or Devicegroup python objects: print(templates_pan) print(device_grp_pan)   #Optional step: #Since that the objects are an iterable object, you can do a 'for' through each object in the list: for template in templates_pan: '''You can use the "about" method to verify some Template parameters''' print(template.about())   #Optional step: #Since that the objects are an iterable object, you can do a 'for' through each object in the list: for dg in device_grp_pan: '''You can use the "about" method to verify some Device-Group parameters''' print(dg.about())   #Optional step: print(template_definition.about()) print(dg_definition.about())   #Since that we want to get Shared address, we have two options to get address from Shared DG: #Method 1: addresses = objects.AddressObject.refreshall(pano)   #And you can verify the addresses as below: for addr in addresses: print(addr.about())   #Method 2: #Define the device group 'Shared' source_dg = panorama.DeviceGroup('Shared') pano.add(source_dg)   #Define the Destination Device-Group: destination_df = panorama.DeviceGroup('Asimov_DG') pano.add(destination_dg)   #Get address objects from Shared: addresses = objects.AddressObject.refreshall(pano) for addr in addresses: print(addr.about())   #So since that you have the address from Shared DG, you can remove from the Shared DG: #First, ensure that the object is not being used by any other device-group or address-group #Or You will receive a similar error as below: '''PanDeviceXapiError: 20.20.20.1 cannot be deleted because of references from: shared -> address-group -> test -> static shared -> address-group -> Test-1 -> static '''   for addr in addresses: delete_srv = objects.AddressObject(**addr.about()) pano.add(delete_srv) #Use method "delete" to delete address #You´re not commiting anything, if required you can do a rollback in the own panorama delete_srv.delete() print(f'[-] Object below removed from DG: {source_dg.name}') print(addr.about()) print('*'*60)   #To apply the addresses in the destination DG, you can do this through another FOR: for addr in addresses: apply_in_dg = objects.AddressObject(**addr.about()) destination_dg.add(apply_in_dg) apply_in_dg.create() print(f'The following address is deployed in the Device-Group: {destination_dg.name}') print(addr.about())   #OR, you can do delete from Shared and include in the Dedicated DG at once: for addr in addresses: address_object = objects.AddressObject(**addr.about()) pano.add(address_object) #Use method "delete" to delete address #You´re not commiting anything, if required you can do a rollback in the own panorama address_object.delete() print(f'[-] Object below removed from DG: {source_dg.name}') print(addr.about()) print('*'*60) destination_dg.add(address_object) address_object.create() print(f'The following address is deployed in the Device-Group: {destination_dg.name}') print(addr.about())     ... View more

Talking about your script, follow:   from panos.panorama import Panorama from panos.firewall import Firewall from panos.device import SystemSettings fw = Firewall("fw.mylab.com", "admin", "admin") sys_setting = SystemSettings(panorama="192.168.254.1") fw.add(sys_setting) sys_setting.create() fw.commit() ... View more

Hi Armen, i hope that the script below be useful to you: #Import Modules: from panos import base from panos import firewall from panos import panorama from panos import policies from panos import objects from panos import network from panos import device import getpass   #Credentials username = input('Admin: ') password = getpass.getpass('Type your password: ') device_name = input('Type Panorama address or name: ') #You need to instanciate a panorama login object: pano = panorama.Panorama(device_name, username, password) #You can use the bellow script to pull all Templates: templates_pan = panorama.Template.refreshall(pano) #You can use the bellow script to pull all DeviceGroups from Panorama: device_grp_pan = panorama.DeviceGroup.refreshall(pano)     #You will receive a list with Templates or Devicegroup python objects: print(templates_pan) print(device_grp_pan)   #Since that the objects are an iterable object, you can do a 'for' through each object in the list: for template in templates_pan: '''You can use the "about" method to verify some Template parameters''' print(template.about())   #Since that the objects are an iterable object, you can do a 'for' through each object in the list: for dg in device_grp_pan: '''You can use the "about" method to verify some Device-Group parameters''' print(dg.about())   #Once you have the template/device group, you can set a template/device-group that you want to configure: template_definition = panorama.Template('Asimov_office_template') pano.add(template_definition) #Once you have the template/device group, you can set a template/device-group that you want to configure: dg_definition = panorama.DeviceGroup('Asimov_office_dg') pano.add(dg_definition)   Ok, from this point you can start push configuration to Template/Device Groups defined above: #For example, lets push a network interface configuration: interface_to_be_created = {'tag': 999, 'ip': ['172.16.0.1/24'], 'comment': 'Testing-Python', 'name': 'ae1.999'} interface_obj = network.Layer3Subinterface(**interface_to_be_created) template_definition.add(interface_obj) interface_obj.create() ... View more

Hello, i know that this topic is old, but let me try help showing the script that i use. Would be there a more efficient way, but this one is working fine to me:   1- Import tclasses:   from panos import firewall from panos import objects import getpass     2- provide the login credentials:   api_user = 'admin' api_password = getpass.getpass('Type your password: ') device = 'firewall_name_or_ip'   3- fw instance object:   fw = firewall.Firewall(device, api_username=api_user, api_password=api_password)     4- Pull the actual objects from the firewall:   objects.AddressObject.refreshall(fw)     5- (optional) Search and find the address object or address group that you want to replace some attribute: Address Objects:   to_replace_value = fw.find('isaacasimov', objects.AddressObject)   If required, you can see whats the attributes are configured in the objects:   print(to_replace_value.about())   Output:  {'value': '10.10.10.10', 'type': 'ip-netmask', 'description': 'Multivac', 'tag': None, 'name': 'isaacasimov'} Address Groups:   groups = objects.AddressGroup.refreshall(fw) to_replace_members = fw.find('Foundation', objects.AddressGroup)   Output:  {'static_value': ['FOUNDATION', 'FOUNDATION_AND_EMPIRE', 'SECOND_FOUNDATION', ' RENDEZVOUSWITHRAMA '], 'dynamic_value': None, 'description': None, 'tag': None, 'name': 'Foundation'} 6- Ok the goal is replace, or edit an value, so: - to change/replace a value in address object, it´s not required to remove the value, just choose the attribute to be changed, and include the new value:   to_replace_value.value = '10.40.40.0/24'   - to change/replace a value in address object group, i use to pull the actual members, keep in a variable:   members_list = to_replace_members.static_value print(members_list) Output: ['FOUNDATION', 'FOUNDATION_AND_EMPIRE', 'SECOND_FOUNDATION', 'RENDEZVOUSWITHRAMA']   If you want to remove some item from the list, you can use the list methods: members_list.remove('RENDEZVOUSWITHRAMA') #from A. Clarke 🙂 or   del members_list[-1] #If you know the index of the item.     Or if you just want to include a new one address in the address group object, use the list methods to include a new item in the list:   members_list.append('new_item')   OR if you need include more than one item:   new_items = ['new_item1', 'new_item2', 'new_item3'] members_list.extend(new_items)     So now, finally you set new address:   to_replace_members.static_value = members_list     To ensure that the static_value is changed:   print(to_replace_members.about())       ... View more

Hello, Good and excelent news!!! I can retrieve the proxies-ids. And also, now i learned how to retrieve static routes from specific vrouter, and l3 interface from specific aggregate interface. Bellow follow the script for the three cases. I hope no one lose half night sleep, as i did.     from panos import firewall from panos import network ######## fw credentials ########### api_user = 'admin' api_password = 'admin' firewall_ip = 'fw.abc.com' fw_device = firewall.Firewall(firewall_ip, api_username=api_user, api_password=api_password) ######## Pull proxy-Id from a specific VPN ######################## ipsec = network.IpsecTunnel(name='VPN-123') fw_device.add(ipsec) proxy = network.IpsecTunnelIpv4ProxyId.refreshall(ipsec) for p in proxy: print(p.about()) ##### Pull static routes from a specific vrouter ######## vr = network.VirtualRouter(name='vr-customer-1') fw_device.add(vr) static_routes = network.StaticRoute.refreshall(vr) for route in static_routes: print(route.about()) ##### Pull l3 interfaces from an specific AGGREGATE INTERFACE ##### ae = network.AggregateInterface(name='ae2') fw_device.add(ae) sub = network.Layer3Subinterface.refreshall(ae) for s in sub: print(s.about()) ##### Also you can get a list of configured vrouter/vpn/interface as bellow: ##### '''This will return a list of the VPN Tunnels configured in your firewall ''' tunnels = network.IpsecTunnel.refreshall(fw_device) '''Once you have a list of vpn names, you can iterate over it: ''' for tunnel in tunnels: ipsec = network.IpsecTunnel(name=tunnel) fw_device.add(ipsec) proxy = network.IpsecTunnelIpv4ProxyId.refreshall(ipsec) print(f'Pulling proxy id configuration from tunnel {tunnel}') for p in proxy: print(p.about()) print('*' * 60)   ... View more

HI @gfreeman  thanks for your response.    I´m starting in this journey of Palo Alto SDK. I saw in the documentation that there is an hierarchy between the classes. My problem is not retrieve the actual vpn in use, i can do this. My problem is how can i get the PROXY ID of each vpn. This is not working, i tried a lot of scripts that make sense, however it didn´t worked. tunnels = network.IpsecTunnel() fw_device.add(tunnels) proxy = network.IpsecTunnelIpv4ProxyId.refreshall(tunnels) vpn = fw_device.find('VPN-123', network.IpsecTunnelIpv4ProxyId) print(vpn) [Output]: None   ################################ tunnels = network.IpsecTunnel.refreshall(fw_device) for tunnel in tunnels: #fw_device.add(tunnels) proxy = network.IpsecTunnelIpv4ProxyId.refreshall(fw_device) vpn = fw_device.find(tunnel, network.IpsecTunnelIpv4ProxyId) print(vpn) ** for each tunnel in tunnels, i receive None as output       However i have 2 proxies-ids configured for 'VPN-123'.   If someone knows how can i get the proxies ids, i would be very grateful.   Thanks, João Victor ... View more

Thanks for you response @SutareMayur  ... View more