About BobbyWilloughby

BobbyWilloughby · ‎04-07-2021

figured out how to delete the Monitoring Definition for an Account/Region https:// {{panorama}} /api?key= {{key}} &type=config&action=delete&xpath=/config/devices/entry[@name='localhost.localdomain']/plugins/aws/monitoring-definition/entry[@name='BobbyTest'] and how to delete all VPCs associated with an Account/Region https:// {{panorama}} /api?key= {{key}} &type=config&action=delete&xpath=/config/devices/entry[@name='localhost.localdomain']/plugins/aws/monitoring-definition/entry[@name='BobbyTest']/vpc-ids/member But still need to be able to delete an individual VPC member from the Monitoring Definition

BobbyWilloughby · ‎04-07-2021

I am trying to automate the addition/deletion of AWS Monitoring Definitions for the AWS Plug in for Panorama. I am able to add Monitoring Definitions using the following in Postman: https:// {{panorama}} /api?key= {{key}} &type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/plugins/aws/monitoring-definition&element=<entry name='BobbyTest'><vpc-ids><member>vpc-xxxxxxxxxxx</member></vpc-ids><role-arn>arn:aws:iam::111111111111:role/panorama</role-arn><iam-role>panorama-ec2-RO</iam-role><description>gatewayTESTTESTTEST</description><endpoint-url>ec2.eu-west-1.amazonaws.com</endpoint-url><notify-group>Inspection_Firewall_DGs</notify-group><enable>yes</enable></entry> But when I try to delete an individual VPC from a monitoring definition or delete a definition for a specific Account/Region, the API deletes ALL the monitoring definitions. The Postman URL I am trying to use is: https:// {{panorama}} /api?key= {{key}} &type=config&action=delete&xpath=/config/devices/entry[@name='localhost.localdomain']/plugins/aws/monitoring-definition&element=<entry name='BobbyTest'><vpc-ids><member>vpc-xxxxxxxxxxx</member></vpc-ids><role-arn>arn:aws:iam::111111111111:role/panorama</role-arn><iam-role>panorama-ec2-RO</iam-role><description>gatewayTESTTESTTEST</description><endpoint-url>ec2.eu-west-1.amazonaws.com</endpoint-url><notify-group>Inspection_Firewall_DGs</notify-group><enable>yes</enable></entry> But is seems that no matter what information I provide in the "element", the action deletes all the definitions. How do I delete a VPC from the list of VPCs in a specific Account/Region definition? How do I delete a specific Account/Region definition? Thanks in advance, Bobby

BobbyWilloughby · ‎04-05-2021

Thanks. I was afraid that was the case. For future reference, I am able to us the API without pandevice as follows to make the updates needed. https:// {{panorama}} /api?key= {{key}} &type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/plugins/aws/monitoring-definition&element=<entry name={my_name}><vpc-ids><member>{my_vpc}</member></vpc-ids><role-arn>arn:aws:iam::{my_account}:role/panorama</role-arn><iam-role>{my_role}</iam-role><description>{my_description}</description><endpoint-url>{my_aws_endpoint_url}</endpoint-url><notify-group>{my_device_group}</notify-group><enable>{my_enable_flag}</enable></entry> --Thanks, Bobby

BobbyWilloughby · ‎03-30-2021

I am trying to automate the MONITORING-DEFNITIONS in the AWS Plugin in Panorama. Will the PANOS python library allow me to make updated to the PLUGINs via API?

BobbyWilloughby · ‎01-05-2021

Thanks. My Palo Alto SE was able to point me in the right direction to use the PanDevice Operations framework to accomplish this check as well. Here is a working snippet of code for future reference. If you do not put the double-quotes around the job-id number you will get a 400 error, invalid request. if commit_needed: pan_admin_list = [pan_username] pano2 = panorama.PanoramaCommit( "Automated Commit" , pan_admin_list) job_id = pano.commit( cmd = pano2) print ( '[INFO] Commit JobID is %s ' % job_id) pano_job_cmd = 'show jobs id "' + job_id + '"' job_complete = False while not job_complete: response = pano.op( cmd = pano_job_cmd, xml = True ) job_as_xml = ElementTree.XML(response) job_as_dict = XmlDictConfig(job_as_xml) job = job_as_dict[ 'result' ][ 'job' ] if job[ 'id' ] == str (job_id): print ( '[DEBUG] Found correct job ID' ) if job[ 'type' ] == "Commit" : print ( '[DEBUG] It is a COMMIT job... thats good' ) if job[ 'progress' ] == '100' : print ( '[DEBUG] Job Finished, 100%' ) if job[ 'status' ] == 'FIN' : print ( '[DEBUG] Job Finished' ) if job[ 'result' ] == 'OK' : print ( '[DEBUG] Job Finished, 100 Percent and Results are OK' ) job_complete = True break else : print ( '[DEBUG] Job Finished, 100 Percent and Results are not OK: %s ' % job[ 'result' ]) else : print ( '[DEBUG] Job progress is 100 Percent but status is not FIN: %s ' % job[ 'status' ]) else : print ( '[DEBUG] Job progress is not 100 Percent yet ... %s ' % job[ 'progress' ]) else : print ( '[DEBUG] Job is not a COMMIT job : %s ' % job[ 'type' ]) if not job_complete: time.sleep( 5 ) # # At this point the COMMIT job is complete. If it fails to complete, the Lambda will time out as we will never hit this code # # # PUSH the changes to the firewalls by Device Group # # print ( '[INFO] Pushing changes to Device Groups' ) # # ******* Need to come up with a way to process the different device groups without hardcoding them. # for dg in [ "dg_1" , "dg_2" ]: pano2 = panorama.PanoramaCommitAll( "device group" , dg) job_id = pano.commit( cmd = pano2) print ( '[INFO] Commit JobID is %s ' % job_id)

BobbyWilloughby · ‎12-30-2020

I am trying to use a Python AWS Lamdba function to commit/commit-all changes after the lambda function has made the appropriate updates to the Panorama. My problem is that the commit-all API call happens too soon after the commit API call and the commit-all does not have any committed changes to process. How can I wait for the commit job to complete prior to issuing the commit-all API? Code I am using.... import panos from panos import panorama from panos.panorama import Panorama from panos import objects pano = panorama.Panorama.create_from_device(pan_ip_addr, pan_username, pan_password) < Python makes changes to shared objects> # # Commit changes for my user only # pan_admin_list = [pan_username] pano2 = panorama.PanoramaCommit( "Automated Commit" , pan_admin_list) job_id = pano.commit( cmd = pano2) print ( '[INFO] Commit JobID is %s ' % job_id) # # PUSH the changes to the firewalls # pano2 = panorama.PanoramaCommitAll( "device group" , "dg_awseuwestinspeat" ) job_id = pano.commit( cmd = pano2) print ( '[INFO] Commit JobID is %s ' % job_id) pano2 = panorama.PanoramaCommitAll( "device group" , "dg_awsuseastinspeat" ) job_id = pano.commit( cmd = pano2) print ( '[INFO] Commit JobID is %s ' % job_id) What happens in the Panorama System log is this... Commit Job Enqueued JobId=206 Partial Commit JobId=206 Commit Job Started Processing JobId=206 CommitAll Job Enqueued JobId=207 CommitAll Job Started JobId=207 CommitAll Job Successed JobId 207 Commit Job Successful JobId 206 How do I tell the Python API to wait on the successful COMMIT prior to executing the CommitAll? Thanks, Bobby

BobbyWilloughby · ‎10-07-2020

I am relatively new to using PANOS/PANDEVICE libraries in Python with Panorama. I am trying to figure out how to get a list of AddressObjects associated with a specific Static AddressGroup in the "Shared" DeviceGroup. object_name = "H-i-061d40e4013db52ae" pano_device_group = panorama.DeviceGroup( 'shared' ) pano.add(pano_device_group) object_list = pano.add(objects.AddressGroup( name = object_name)).refreshall(pano_device_group) This just returns a list of all AddressGroups defined in the shared DeviceGroup.... Someone rescue me please....

Member Since	‎03-20-2013 07:46 AM
Date Last Visited	‎12-16-2022 11:16 AM
Posts	7

Online Status	Offline
Date Last Visited	‎12-16-2022 11:16 AM

About BobbyWilloughby

Re: Using Rest API to delete an AWS Monitoring Definition in Panorama

Using Rest API to delete an AWS Monitoring Definition in Panorama

Re: PANDEVICE and Panorama Plugin for AWS

PANDEVICE and Panorama Plugin for AWS

Re: Using Python to perform a Commit/Commit-all on Panorama

Using Python to perform a Commit/Commit-all on Panorama

PANDEVICE in Python to query details of a specific Static Address Group

Re: PANDEVICE in Python to query details of a specific Static Address Group