About molander

@LarsAtConsigas    I know this is an old post, replying to benefit other users. We ran into the same issue, talked to Support and this is expected behavior. If you add "?v=panosurl" to the end of the Minemeld URL then you will get a list better formated to use on the firewall. For example it will convert "*cdn.onenote.net" to two entries; "onenote.net" and "*.onenote.net". ... View more

Ran into the same problem, creating an application override solved the problem. Policies > Application Override   Source: Clients Destination: File Server Protocol/Application TCP 139, 445 Application: ms-ds-smbv3   Software Version 8.1.0 VM License VM-100 ... View more

I had added that feature when I took the screenshot but did not actually push it to the git repo. If you re-download the script the feature will be in. Everything else should be the same.   https://github.com/marcusit/PaltoShell   ... View more

Try using the "all time" option, and save the results which will create a spreadsheet that you can filter by connection date. I use that myself for reporting on VPN users.   I might be able to add that feature in if I get some free cycles. ... View more

I seem to be able to a query with just the "Operational Request" API right (Device > Admin Roles > <custom role> > "XML API" tab). I can't guarantee that more permissions will not be needed. ... View more

You might not have the correct API permissions on the firewall. I have not had a chance to pinpoint exactly what permissions are needed as I have superuser rights, and no lower account to test with. You can create custom admin roles and grant API permissions under Device > Admin Roles. You would then tie this role to your administrative account. ... View more

@vsys_remowrote: To me this sounds like the TLS version does not mat or the server/client where you run the script does not trust the firewall certificate. As far as I know by default powershell only connects to trusted certs and I am sure that by default TLS1.0 (and only 1.0) is used.   By adding this line you can force TLS1.2: [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; This might be correct. You can check for cert errors by going to the firewall GUI and see if you receive a cert warning.  You can do some testing by just running this code snippet: $fw_hostname = "Your firweall hostname or IP here" $pass = Get-Credential -Credential $env:userdomain\$env:username $plainpass = $pass.GetNetworkCredential().Password $key_url = "https://"+$fw_hostname+"/api/?type=keygen&user="+$env:username+"&password="+$plainpass $KeyClient = New-Object System.Net.WebClient $KeyClient.DownloadString($key_url) Be sure to change the first line. You should get text output similar to below: <response status = 'success'><result><key>YOUR API KEY</key></result></response>   Finally you can test it in a browser too, to make sure you are able to generate an API key: https://<FIREWALL HOSTNAME OR IP>/api/?type=keygen&user=<YOUR FW USERNAME>&password=<YOUR FW PASSWORD> ... View more

Are you running PowerShell version 4 or higher? You can check my running "$psversiontable.PSVersion" in PowerShell. You would also need Microsoft .NET Framework. Not sure on version, but it works with 4.6.01590. ... View more

I noticed that I had left a static variable in the function to generate a new API key (line 82). I updated the code on GitHub, so if you download the script again it should work for you now.   The authentication comes from the script itself, it stores the credentials in a variable that it then passess to the firewall to be able to generate the API key. ... View more

We were seeing various issues with authentication and various traffic breaking on our 7050 HA pairs. Reverted the App and Threat content version to 726 which resolved all issues. ... View more