About MichaelPrensky

Hopefully I am putting this post in the right place.   Please feel free to let me know if I should place it elsewhere.    I work at a place where we deploy a lot firewalls.  At the moment, it is a bunch of the PA-220r devices, but we work with the PA-850s and soon to be, some virtual firewalls.  I am looking for some advice as to how other companies automate their firewall builds.   Most all of our config is stored in a template, so once it gets to Panorama, we push down as much as we can.  So, here is the issue.   I need to automate the build process for all those things that are not part of a template, but are local to each specific firewall.    Here are some examples of the types of configs I am talking about: Bring up the OS to the company standard Config the SMTP policy, so the return address of emails is the host name + @domain.com Register the device on PA site Config the host name for device Install the SSL Cert and create the TLS profile The config is not really all that difficult, but it is time consuming.   When you are setting up 20 or 30 firewalls, mistakes can be made.  So, I want to see how other companies are doing their build process and what types of automation is leveraged.   Thanks for all the help,   Michael ... View more

I have a question and I am hoping I am not the first person to have asked it, and that there is a script out there somewhere.   I am trying to get the device state from multiple firewalls and need to somehow put it in a script.   I do leverage the scheduled config export from Panorama, but that only gets me so far in a complete disaster.  If the endpoint is completely off the map, the restoral process is much easier with a device state export.     So, in an environment, where you have 20+ firewalls, automation is key.  So, I have played with PowerAlto (PowerShell), and other scripting methods and have not really seen an easy way to connect to a firewall, pull a device state and then move on to the next one.   Any advice on scripting or other methods to go out and get 20+ device state exports on an automated schedule would be extremely helpful.  Thank you.   Michael     ... View more

Is there a concept of shared objects at multiple levels in Panorama ?  For example, I can have a top level setting at the shared level which says password length is 15 characters and I want that to go to all firewalls.  What I need, is a second shared level beneath that (like at the template stack level) that says anything in "This template stack" has a particular "zone protection profile."  I know that you can add multiple templates to a template stack, but what I am trying to do is use some type of shared setting.    In my case, each "zone" will be different depending on the template being used, but behind the scenes, the "zone protection profile" is the same across all templates.     Everything I have read, says you have to copy the setting for "zone protection profile" for each template you plan on using it with.  I was just hoping I could put the "zone protection profile" settings at a lower shared area that could be utilized by multiple templates. Michael ... View more