About dsouthard

Hi Lee, not sure what point release of 6 you're on, but i upgraded from 5 to 6.0.4 today and had the same error message when attempting to add members to address-groups (which broke all my auto-blocking code lol) - in that instance i found  i was missing a  <static> keyword around the member entry (ill raise a support call on monday with my reseller as an FYI), but in your case, im afraid i dont get the same error and the api call completes successfully.. https://x.x.x.x/api/?type=config&action=set&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Rule 1-1-1-1-1']&element=<from><member>inside</member></from>&key=hiddenkeyhere <response status="success" code="20"><msg>command succeeded</msg></response> cheers damian ... View more

Hi, Not sure if this helps, but what we've done in this scenario is implement a little javascript heartbeat function on the (captive portal) destination server such that users close the page to trigger a logout() function (via window.onbeforeunload), which in turn clears the user-ip mapping in the palo via the restful api call.. https://HOSTNAME/api/?type=op&cmd= <clear><user-cache><ip>USER_IP</ip></user-cache></clear>&key=APIKEY I wont post any example code here as what weve used is a little more convoluted (in that we use websockets to push messages via an AMQP broker that has workers proxying api calls to the palo) but please let me know if you want further details.. cheers damian ... View more

Hi Don, We came across a similar requirement as we operate in a mixed device environment and as such use android/ios devices with Xauth-psk (using the native OS client) as opposed to certificates and accept the tradeoff between risk/functionality. Just in case it gives you ideas on how to solve your second interface issue, we use the single portal instance configured with multiple gateways (bound to loopbacks) such that a windows/mac device wishing to run the globalprotect client can point at the portal and receive its configuration, whilst other devices can point at the address of their gateway to establish the IPSec tunnel and obtain appropriate IP addressing/policies etc. cheers damian ... View more

I  know the joys of 'old' objects - thats essentially why i had to write  some scripts to clean up my netscreen configs - however as we ran out of  time for our migration and needed to get something into production  quickly, im about to write some more stuff to clean up my palo ;O) As  an example to clarify the manual approach of mangling an input file  with a text editor to get the right format, have a quick look at the  palo document below on importing firewall configurations into panorama -  the first few steps give the general idea...this kind of approach has  saved my arse many times for many different firewall types over the  years ;O) https://live.paloaltonetworks.com/docs/DOC-1742 in  either case (CLI or API), youll likely need some form of text based  input that you can manipulate - are you able to generate such a file and  if so, do you want to post a line or two as an example so people can  determine if they have anything that will help you parse it? cheers damian ... View more

the XML API is a great feature so im sure youre right and there'll be tons of people with scripts laying around that may help you out (i may even be one of them lol) - have you got a little more detail about what format the input is (as im guessing if you were trying to migrate from another vendor such as netscreen/cisco/checkpoint support would have passed you on to the migration tool) - so are you looking at reading in from a csv/newline seperated file/xml doc/db table or something? Have you also tried the simple approach of mangling the text with find/replace in a text editor to get it into the appropriate format (using the cli admin guide as your reference (e.g set address "address-name" ip-netmask (or ip-range/fqdn and with optional descritpion field) ip/mask (or fqdn))) and then cutting/pasting into the device via the command line? cheers damian ... View more