About RogerMccarrick

For scripting purpose I need to be able to set egress-max values in QoS with the API. First I created a QoS profile, TRUST-QOS,  and set the egress-max to 20 In powershell, I have the following:     $paURL = "https://" + $PAIP + "//api/?key=" + $apiKey + "&type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/network/qos/profile/entry[@name='TRUST-QOS']/aggregate-bandwidth/egress-max&element=<egress-max>30</egress-max>" Invoke-WebRequest -uri $panURL   This is supposed to set the value to 30. The reply I get is :       set failed, may need to override template object first   This Palo Alto is new (it's a VM), not yet licenced or connected to a Panorama. However I can set the value in the GUI or on the CLI with :   set network qos profile TRUST-QOS aggregate-bandwidth egress-max 30 Overrides are for templates but as this is not connected to a panorama and has no template. Any idea why I get this message with the API? I am able to do many other configurations with the API. thanks. ... View more

My PA is already connected to the Panorama. I had to change the Management IP address.  The PA lost connection to the Panorama. The Panorama shows the PA with old IP and status Disconnected. Is there a way to update the IP of the PA on the Panorama, or for the PA to push its new IP to the Panorama?   thanks   Roger ... View more

I am trying to commit changes to a Panorama and then have changes pushed to the firewall making API calls from a powershell script.   Using the API I can: add the firewall to the panorama add the firewall to an existing template in the panorama create a new device group on the panorama and add the firewall to it Add rules (policies) to the device group. Commit changes. But I can't seem to push that template and policies to the firewall with the API. Here is the powershell code I use to commit.   # Commit to Panorama Write-Host -foreground "Green" " Committing changes to Panorama" Write-Host "" $pancomURL = "https://panorama//api/?key=" + $panKey + "&type=commit&cmd=<commit></commit>" Invoke-WebRequest -uri $pancomURL Here is what I try to push the changes:   # Push to device from Panorama Write-Host -foreground "Green" " Pushing changes from Panorama to Palo Alto" Write-Host "" $pancomURL = "https://panorama//api/?key=" + $panKey + "&type=commit&action=all&cmd=<commit-all><shared-policy><device-group><entry name='" + $gpid + "'/></device-group></shared-policy></commit-all>" Invoke-WebRequest -uri $pancomURL What is the correct syntax for the pushing to the firewall using the API? thanks Roger ... View more

I am trying to add a PA-VM to the Panorama using the Panorama API.   I try:   https://1.0.20.30.40//api/?key=LUFRPT0zAndSoOn AndSoOn AndSoOn =&type=config&action=set&xpath=/config/devices/entry[@name='all']&element=<serial>12345678012345</serial>   and I get :   StatusCode : 200 StatusDescription : OK Content : <response status="error" code="12"><msg><line>At most 1 occurrence is allowed for devices/entry</line></msg></response>     To show devices the the commad is:   /api/?type=op&cmd=<show><devices><all></all></devices></show> or /api/?type=op&cmd=<show><devices><connected></connected></devices></show>   What is the correct API call to add a serial number to the Panorama?   thanks Roger         ... View more

I'm working on a script to deploy new Palo Alto firewalls in vmware from template, using powershell. I'm doing this with API calls in the powershell code.   for instance, change hostname:   $hnURL = "https://myPA//api/?key=" + $apiKey + "&type=config&action=edit&xpath=/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/hostname&element=<hostname>$myHostname</hostname>" Invoke-WebRequest -uri $hnURL   I want to do something similar to add a new user "apiadmin", and password. I have googled and found how to add a user on the CLI, but I'm hoping to be able to do it via the API.   Any help would be much appreciated.   Roger   ... View more

Trying to deactivate a PA-VM firewall with the API.   First I add the Licencing API key to the PA with the firewall API:   In order to hide my real values, let's use:   myfirewall.corp as my firewall cxvzvxvcxvczc as my firewall's API key dgshgdjsgdjsgj as my licensing portal API key.   So for the deactivation process, I'm gonna add the  licensing portal API key to my firewall, and then deactivate. I can add this API key via the cli or via the firewall API. I want to do everything with the API.   # Add deactivation key https://myfirewall.corp//api/?key=cxvzvxvcxvczc&type=op&cmd=<request><license><api-key><set><key>dgshgdjsgdjsgj</key></set></api-key></license></request>   this works. I can successfully use the CLI on the firewall to check that the key was added.   request license api-key show API key: dgshgdjsgdjsgj   Next, I want to deactivate. I try the following:   # Deactivate https://myfirewall.corp//api/?key=cxvzvxvcxvczc&type=op&cmd=<request><license><deactivate><VM-Capacity><mode>auto</mode></VM-Capacity></deactivate></license></request>   The response I get is:   This XML file does not appear to have any style information associated with it. The document tree is shown below. <response status="error"> <msg> <line> (null) Error:Invalid or missing deactivation token Device doesn't belong to this support account. </line> </msg> </response>   I do not want to log into the firewall GUI to deactivate, I'm trying to script this. How do I deactivate using the API. I followed the API browser on my firewall in order to get the above command, and it gave me :   Rest API Url /api/?type=op&cmd=<request><license><deactivate><VM-Capacity><mode></mode></VM-Capacity></deactivate></license></request>   The mode choices it gave me are auto or manual. So I added "auto" between the  <mode></mode> tags.   Any ideas what I'm doing wrong?  Google searches show me how to delete one key feature at a time, on the CLI, but I'm trying to deactivate the whole Palo Alto VM with an API call.   thanks Roger ... View more