How can we limit the Panorama XML API access ?

[ManojManoj]

How can we limit the Panorama XML API access ?

How can we limit the Panorama XML API access ? We are using this XML API for Terraform and ansible automation. We want to give only access to few device group and we don't want to give access to all device group. please advice how can we achieve this. We checked in Admin roles in Panorama and we don't see much options to restrict to specific device group

Our request is - how can we restrict the API access to only certain device group.
Wiki pages in the palo website doesn't have any information about how can we limit only to certain device group.

I'm elaborating more with example here.

device group - INETFW1
device group - INETFW1
device group - SNETFW1
device group - SNETFW2

we want to give only API XML access to INETFW1 and SNETFW1 device group ? how can we achieve this?

what we need to have is a custom privilege to be restricted on to specific device group in Panorama XML API access.
Please let us know how can we limit the panorama XML API access to specific device group?

[PavelK]

Hello @ManojManoj

thanks for posting.

This should be possible with Access Domains combined with Admin Roles. Here is documentation for reference: Access Domains.

Kind Regards

Pavel

[ManojManoj]

Hi @Pavel,

Please don't blindly answer without understanding the question mentioned here.
Our requirement is to restrict the access via API and not via web gui or other ways.
Did you check it in your lab system Panorama for restricting XML API access before you comment about this?
Did you have previous experience dealing this XML API access restriction in Panorama?

thanks

[PavelK]

Hello @ManojManoj

thank you for reply.

I read your post carefully before replying to you. I have been using access domain in the past only for GUI access. By reading your post the access domain came to my mind as possible solution. I checked the API documentation and this parameter is passed in the API call therefore I deemed this as possible:

The answer to your second question, no, I have not verified it in the lab.

Kind Regards

Pavel

[jeremyafaulkner]

Hello, did you find a solution to this? I'm trying to do the same thing to limit an admin account's XML API access to specific device groups. Unfortunately, it looks like using an Access Domain with "Device Group and Template" doesn't provide access to XML API. From what I see, it only provides access to Web GUI and REST API. Did you find a workaround for this? Thanks!