About jsilvia

jsilvia · ‎11-13-2012

Yeah, took me another hour of digging, but I eventually found it. The trick was to get a full copy of the config downloaded locally and view it in Notepad++ in XML mode, then I started collapsing the config elements so that I was only viewing from levels 1 through 5 - and thats when I could see the path.... <devices> <entry name="localhost.localdomain"> <device-group> <entry name="DMZ"> <pre-rulebase> <nat> XML and I definitely have a love/hate relationship.

jsilvia · ‎11-12-2012

So I'm wanting to get the XML out of the firewall for specific DMZ's so that I can assemble IPAM updates from the XML. Right now, if I ssh into Panorama, go into config mode, and issue this command: show device-group DMZ pre-rulebase nat rules Then I get the output I want, however, doing it interactively isn't what I want - what I'd like to do is convert this into an API call, so I can fetch this with a URL... Using the API browser however, I cannot seem to duplicate this..export

jsilvia · ‎11-21-2011

Currently my reports can only output in the default behavior offered - PDF's are sent automatically - however, some groups within the company that specifically manage risk want to add automation to the mitigation process - and doing that would be much easier if the reports could be emailed out in CSV format. Is it possible to email reports out of panorama in CSV format instead of PDF? What about pulling them as needed using the API in CSV or XML?

jsilvia · ‎10-31-2011

My stuff draws prettier pictures though! I'll look into making the signature too. Thanks!

jsilvia · ‎10-31-2011

I seem to have dug it out with some outside vendor help - turns out the query language is a query without parenthesis. I was ultimately able to perform this: scp export log traffic query "packets eq 1 and zone.dst eq inet" to user@hiddenip:filename.csv end-time equal 2011/10/22@00:00:00 start-time equal 2011/10/21@00:00:00

jsilvia · ‎10-31-2011

I'm on version 4.0.5 - connected to my Panorama server. + action action + app app + csv-output csv-output + direction direction + dport dport + dst dst + dstuser dstuse r + end-time end-time + from from + query query + receive_time receive_time + rule rule + sport sport + src src + srcuser srcuser + start-time start-time + to to | Pipe through a command <Enter> Finish input > show log traffic Understand that I'm trying to pull as much log history as I can out of the box so that I can perform external analysis - PA's log analysis doesn't provide what I need - and in my Check Point past I was able to export the desired columns, then process in excel and visualize in ggobi - this can help find the needles hiding in the haystack of the network - in my case, infected needles that are performing outbound infection sweeps on port 80 - by searching for one packet sessions I can get these - however, by the time I can pull these from the GUI, I'll probably loose most of todays logs just trying to get to them!

jsilvia · ‎10-31-2011

I'm trying to perform a complex log export operation from the command line, as the web GUI seems to be drastically underpowered and slow to respond (hours to see, longer to export in CSV), and from the command line I can't perform queries using terms to extract data in a date range, or figure out how to do that. Ideally, I'd love to execure the query: "( port.dst eq 80 ) and ( zone.dst eq inet ) and (packets eq 1) and (time_generated geq '2011/10/21 00:00:00') and (time_generated leq '2011/10/22 00:00:00')" and save the output in a CSV file that I can download via SCP. There is an option for "query" show in the CLI guide - if this permits me to an actual web query, that would be ideal, however, I cannot seem to implement or even find any examples of how the query feature is used. Please note that this underscores one of my major complaints with this product - the documentation tends to follow a very Linux "Man Page" approach - the documentation is accurate in it's presentation of the commands, but provides no examples of syntax to help people actually use the features. Am I on the right track?

jsilvia · ‎11-04-2010

This is definitely a big help - now how do I get more information on building my xpath variable? xpath=devices/entry/vsys/entry/rulebase/security As I'm wanting the running NAt policy from vsys FEDMZ, I figure this gets me close: xpath=devices/entry/FEDMZ/entry/running/nat-policy or something like this... help!

jsilvia · ‎11-03-2010

I've been working on automated scripts to export my firewall configurations, gather the NAT translations and reformat the exported data into the XML format used by my IPAM system. I've managed to automate this on our Check Points by parsing the objects.C file directly from our firewall managers - however, chopping through the PA config isn't quite as trivial - until I took the advance admin class and learned about the nice little command "show running nat-policy" My ultimate method for making this work would be use SSH with the remote command to hopefully run this command and output the XML ready for transformation. Can anyone recommend a strategy for remotely executing the command "show running nat-policy" so that I can process it? Thanks.

Member Since	‎11-03-2010 11:52 AM
Date Last Visited	‎08-18-2015 09:06 AM
Posts	9

Online Status	Offline
Date Last Visited	‎08-18-2015 09:06 AM

About jsilvia

Re: Exporting NAT configuration

Exporting NAT configuration

Emailing of CSV reports?

Re: How do I use the query feature of the CLI show log traffic command?

Re: How do I use the query feature of the CLI show log traffic command?

Re: Exporting NAT configuration

Exporting NAT configuration

Emailing of CSV reports?

Re: How do I use the query feature of the CLI show log traffic command?

Re: How do I use the query feature of the CLI show log traffic command?

Re: How do I use the query feature of the CLI show log traffic command?

How do I use the query feature of the CLI show log traffic command?

Re: Exporting translations for an IPAM system

Exporting translations for an IPAM system

Network Security

Cloud Security

Security Operations

About jsilvia