Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- 5G
- IoT Security
- Prisma SD-WAN
Network Security
- Prisma Access
- Prisma SaaS
- Prisma Cloud
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
- LIVEcommunity
- ›
- About RogerMccarrick
About RogerMccarrick
Announcements
Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
01-15-2021
20Posts
2Likes
3Solutions
Jan 15, 2021Last Visited
User
Activity
User
Profile
Latest posts by RogerMccarrick
| Subject | Views | Posted |
|---|---|---|
| 1906 | 12-16-2020 06:47 AM | |
| 1979 | 12-14-2020 03:14 PM | |
| 227 | 10-01-2018 07:30 AM | |
| 611 | 09-27-2018 11:05 PM | |
| 612 | 09-27-2018 02:20 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 2 | 07-26-2018 09:41 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 |
User Badges
Public Statistics
| Date Registered | 07-25-2018 05:03 PM |
| Date Last Visited | 01-15-2021 01:15 PM |
| Total Messages Posted | 23 |
| Total Likes Received | 2 |
12-14-2020
03:14 PM
How do you do source address contains 10.20.30? I don't only want to find 10.20.30.1 ... I want to find 10.20.30.x ... anything in that /24. thanks Roger
... View more
10-01-2018
07:30 AM
I'm taking over a Panorama from someone else and there are a lot of devices in it that are no longer connected, all showing as disconnected. They were all migrated over to a new Panorama without properly removing them from this one. When I try to remove a device, it fails due to other references. It would be ok to track down the references if there was only a handful of devices but there ar 95. Is there a way to force remove devices from the Panorama? thanks.
... View more
09-27-2018
11:05 PM
Solved this with action=edit instead of action=set
... View more
09-27-2018
02:20 PM
For scripting purpose I need to be able to set egress-max values in QoS with the API. First I created a QoS profile, TRUST-QOS, and set the egress-max to 20 In powershell, I have the following: $paURL = "https://" + $PAIP + "//api/?key=" + $apiKey +
"&type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/network/qos/profile/entry[@name='TRUST-QOS']/aggregate-bandwidth/egress-max&element=<egress-max>30</egress-max>"
Invoke-WebRequest -uri $panURL This is supposed to set the value to 30. The reply I get is : set failed, may need to override template object first This Palo Alto is new (it's a VM), not yet licenced or connected to a Panorama. However I can set the value in the GUI or on the CLI with : set network qos profile TRUST-QOS aggregate-bandwidth egress-max 30 Overrides are for templates but as this is not connected to a panorama and has no template. Any idea why I get this message with the API? I am able to do many other configurations with the API. thanks.
... View more
08-28-2018
04:40 PM
Thanks. It was a network problem. All is good. The IP does update.
... View more
08-27-2018
11:26 PM
My PA is already connected to the Panorama. I had to change the Management IP address. The PA lost connection to the Panorama. The Panorama shows the PA with old IP and status Disconnected. Is there a way to update the IP of the PA on the Panorama, or for the PA to push its new IP to the Panorama? thanks Roger
... View more
08-22-2018
04:50 PM
Alo, how do you change it to partial to only commit changes of the user? thanks Roger
... View more
08-22-2018
04:44 PM
Thanks very much. I just came across the template push. Trying it shortly. Sometime the syntax seems inconsistent, like: <device-group><entry name="DEVICEGROUPNAME"/></device-group> vs <template-stack><name>TEMPLATESTACKNAME</name></template-stack> in one it's entry name=, and in the other it's <name>. But thanks again. Roger
... View more
08-22-2018
03:11 PM
I am trying to commit changes to a Panorama and then have changes pushed to the firewall making API calls from a powershell script. Using the API I can: add the firewall to the panorama add the firewall to an existing template in the panorama create a new device group on the panorama and add the firewall to it Add rules (policies) to the device group. Commit changes. But I can't seem to push that template and policies to the firewall with the API. Here is the powershell code I use to commit. # Commit to Panorama
Write-Host -foreground "Green" " Committing changes to Panorama"
Write-Host ""
$pancomURL = "https://panorama//api/?key=" + $panKey + "&type=commit&cmd=<commit></commit>"
Invoke-WebRequest -uri $pancomURL Here is what I try to push the changes: # Push to device from Panorama
Write-Host -foreground "Green" " Pushing changes from Panorama to Palo Alto"
Write-Host ""
$pancomURL = "https://panorama//api/?key=" + $panKey +
"&type=commit&action=all&cmd=<commit-all><shared-policy><device-group><entry name='" + $gpid + "'/></device-group></shared-policy></commit-all>"
Invoke-WebRequest -uri $pancomURL What is the correct syntax for the pushing to the firewall using the API? thanks Roger
... View more
08-04-2018
05:03 PM
This works https://FW_IP/api/?type=config&action=set&key=API_KEY&xpath=/config/mgt-config/devices&element=<entry name='SERIAL_NUMBER'/>
... View more
08-04-2018
02:15 PM
Getting closer, but not quite api/?type=config&action=set&key=LUFRPT0zAndSoOn AndSoOn AndSoOn &xpath=/config/mgt-config/devices/entry/[@name=' 12345678012345 '] <response status =" error " code =" 12 " > <msg> <line> Invalid target object in set handler </line> </msg> </response> any ideas? Thanks
... View more
08-03-2018
05:07 PM
I am trying to add a PA-VM to the Panorama using the Panorama API. I try: https://1.0.20.30.40//api/?key=LUFRPT0zAndSoOn AndSoOn AndSoOn =&type=config&action=set&xpath=/config/devices/entry[@name='all']&element=<serial>12345678012345</serial> and I get : StatusCode : 200 StatusDescription : OK Content : <response status="error" code="12"><msg><line>At most 1 occurrence is allowed for devices/entry</line></msg></response> To show devices the the commad is: /api/?type=op&cmd=<show><devices><all></all></devices></show> or /api/?type=op&cmd=<show><devices><connected></connected></devices></show> What is the correct API call to add a serial number to the Panorama? thanks Roger
... View more
08-02-2018
10:39 AM
Thanks for the command. It worked. Each time I deploy a PA, I want to do all (or as much as I can) (of) the deployment with a single powershell script doing API calls to configure the PA. Each PA has an apiadmin account, specifically for doing API calls for future configurations. And each PA will have to have a different API-Key. So I have to change the password of the apiadmin account (without manually logging in) to something different on each PA to achieve this. I will store all API keys in a database. When I deploy a new PA, it is a clone of the template, all passwords and keys are the same for each one. I am using the script to automate changing passwords and generating new API keys. So from powershell script: deploy new PA from VMware template, has known password for apiadmin account. generate random password. send api call to new PA to get hash of that new password api call to with that hash to change the apiadmin password (the command you showed me). api call to PA using apiadmin and new password to generate new API key for apiadmin store new PA name and apiadmin API key in database. I do all the api calls using the default admin account, and then when done change the password and key of the admin account. thanks for your help.
... View more
08-02-2018
10:23 AM
The article at https://www.paloaltonetworks.com/documentation/80/virtualization/virtualization/bootstrap-the-vm-series-firewall/generate-the-vm-auth-key-on-panorama, shows how to generate a vm-auth-code on the Panorama and then add it to a bootstrap file when deploying a new PA-VM. Can the vm-auth-code be added to a PA-VM that is already powered on, via the cli or API? I deploy my PAs from a VMWare template, not by importing an OVA with bootstrap ISO attached. thanks Roger
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-15-2021
01:15 PM
|
Latest Tags
No tags yet
Latest Blogs
Latest Posts
Copyright 2007 - 2021 - Palo Alto Networks
