Perhaps all serious admins of Palo Alto firewalls have heard about the REST API that PAN provides with their firewalls. Not all of them have tried to automate their work though :).

You may not need to work with API on a daily basis to perform routine firewall changes but if you happen to get involved with firewall migrations, bulk network changes and the like then the API is a must have!

I absolutely love it. You may actually be not very good at scripting but rest assured that the bicycle of PAN API scripting has already been invited for you. The bicycle is called PAN-Configurator and you can get it from GitHub. If the link ever changes the new one is likely to be referenced on PAN web site here.
PAN-configurator is a PHP library aimed to free you from XML as such (the native format of PAN firewalls’ configuration) and focus on the actual configuration tasks. Apart from various classes and functions the library contains a number of ready to use scripts which you can call from your own scripts and batch files.

Keys

High level sequence of steps to get started with PAN-configurator is as follows:

  1. Create a new Admin role for XML API (I would not recommend to allow Commit for this role)
  2. Create a new user and assign it the role above
  3. Generate API key

    http(s)://hostname/api/?type=keygen&user=username&password=password

  4. Now you can use the key to make API calls from your scripts or to run the scripts from PAN-Configurator.

One of the most useful scripts withing PAN-configurator is the rules-edit.php

To use it you basically need to:

Re: API Rest: Generate an API key linked to a specific user So you can assign a custom role to a user, and that will limit what they have access to. But if you're always getting the same API key back, then there is either a problem with your script (maybe using a static variable or something instead of what you specify) or a huge problem with your firewall / PAN-OS. Any API keys that were generated using the previous credentials would no longer be valid. If you want the firewall to generate a unique API key, change the master key on your firewall in order to generate a unique API key.

  1. define input mode – you can make changes to the candidate config directly on the firewall or you can export running-config from your firewall, work with that file offline and then import it back on to the firewall and commit the changes;
  2. define filter – this is how you define what firewall rules your change will be applied to; definition of filters is very similar to filters in firewall GUI
  3. define action – this is actually what to do with the rules which were selected by the filter

Re: API to create Address Group There are two types of address groups in the Palo Alto Networks firewalls; dynamic and static. By default, the firewall creates a static address group if you do not explicitly select dynamic. Generate API keys on a WildFire appliance that you will use on an external system to submit samples to the appliance, query reports, or retrieve samples and Packet Captures (PCAPS) from the appliance. Dec 28, 2012 My role as a Systems Engineer here at lockstep revolves mostly around networking and firewall design and implementation. However, in addition to that, I do a lot of automation scripting. I script almost entirely in powershell, so I wanted to find a way to talk to the Palo Alto firewalls from powershell. The first option.

Download microsoft office 2010 professional plus key generator free trial. Microsoft Office 2010 Professional Plus Product Key Generator 2020. Microsoft Office 2010 Professional Plus Product Key is probably one of the most recognized office tools. Millions of people use Microsoft Office 2010 application tool.

Here are some examples (taken from the PAN web page referenced above):

  • Users are unable to generate API keys or use basic authentication when using XML API. T he users may get one of the following errors: – Invalid Credentials – Missing value for parameter password – Unable to resolve hostname (running from cURL from command line) The same username and password would work for the SSH and web interface logins.
  • API’s are very important to Palo Alto Networks. Security automation is key to the success of any organization in preventing cyber attacks. So Palo Alto Networks products have comprehensive APIs to enable automation. In this lab we’ll focus on the PAN-OS API, which is the API for the Palo Alto Networks Next-generation Firewall and Panorama Management Center. When connecting to the PAN-OS API.

rules-edit.php in=api://fw1.mycompany.com actions=enableLogStart 'filter=(to has dmz) and (dst has.only Webfarms)'

rules-edit.php in=config.xml actions=service-Set-AppDefault 'filter=!(app is.any) and (service is.any)'

It’s worth noting that you may fail to make changes directly on the entry-level firewalls which run latest codebases (i.e. PA2020 on 6.x firmware is likely to struggle and the option with config export/import may be the only one that works for you).

Play with these scripts and you will be amazed at how much you can do in no time at all. Luckily there is also a “Display” action that allows you to try any filter before you make actual change.

And, by the way, despite the fact that PAN-Configurator is still a Beta, I would say it’s already quite mature and its author is not a random Palo Alto enthusiast but a technical lead from PAN EMEA Professional Services – Christophe Painchaud who does firewall migrations and similar jobs pretty much on a daily basis.

Thank you Chris!

Created On 09/25/18 20:36 PM - Last Updated 04/24/19 00:05 AM
Symptom

Users are unable to generate API keys or use basic authentication when using XML API. The users may get one of the following errors:
– Invalid Credentials
– Missing value for parameter password
– Unable to resolve hostname (running from cURL from command line)
The same username and password would work for the SSH and web interface logins.
Example:
$ curl -k 'http://10.129.80.155/api/?type=keygen&user=user01&password=user#01'
<response status = 'error' code = '403'><result><msg>Invalid credentials.</msg></result></response>
Or you may get a missing parameter error:
Example:
$ curl -k 'http://10.129.80.155/api/?type=keygen&user=user02&password=#02user'
<response status = 'error' code = '400'><result><msg>Missing value for parameter &quot;password&quot;.</msg></result></response>
Or when using basic authentication, you would get unable to resolve host name:
$curl -k 'http://user01:user#01@10.129.80.155//api/?type=op&cmd=<show><system><info></info></system></show>'
curl: (6) Could not resolve host: user01 <<<<<<
https://198.51.100.1/api/?type=keygen&user=apiuser&password=&apiuser (ran in browser)


https://198.51.100.1/api/?type=keygen&user=apiuser&password=api#user (ran in browser)

Cause
In all the cases the password contains special characters. The API key generation will fail when the password contains special characters such as # and &. This is not a PAN-OS specific issue. This is due to the way browsers and cURL handle special characters. This is because these are reserved characters used as general or sub delimiters.
RFC defining list of delimiters: https://tools.ietf.org/html/rfc3986#section-2.2
RFC: https://tools.ietf.org/html/rfc3986#section-3.5
In section 3.5: A fragment identifier component is indicated by the presence of a number sign '#' character and terminated by the end of the URL. Now, look at cURL official documents: https://curl.haxx.se/.
Curl supports fragments fine when a URL is passed to it, but the fragment part is never actually sent over the wire, so it doesn't make a difference to cURL's operations whether it is present or not. Hence, the '#' is never sent across the wire, resulting in such behavior.
When these are used without URL encoding, you can see that the browser does not actually send the entire URL (password in this case). In the below examples, HTTP was enabled for demonstration purposes, and the ease of packet captures show the HTTP payload.
Example 1: username: user2 and password: user&2
Browser:
Packet capture taken at the client sending the GET request:
If you look at the password section, the browser truncates the password at 'user.'
Example 2: username: user3 and password user#3
Browser:
Packet capture taken at the client sending the GET request:
If you look at the password section, the browser truncates the password at 'user.' Hence, the issue is due to the interpretation of special characters by browsers and cURL.
Resolution

Palo Alto Firewall Api


Here is a quick reference of reserved character set:

Palo Alto Generate Api Keys

If the data for a URI component would conflict with a reserved character's purpose as a delimiter, then the conflicting data must be URI encoded. In this case, if the password contains reserved characters, they have to be encoded and then used as input.
For instance, if the password contains special characters such as '#' and '&,' use the URL encode %23 and %26 respectively.

Palo Alto Api Key

Example API Request:
https://198.51.100.1/api/?type=keygen&user=apiuser&password=api%23user

May 03, 2019  RegCure Pro 2019 Crack + Serial Key Free Download Latest Version. After installation, you can through all the details. You can click on the “Fix All” button to let RegCure Pro Keygen fix all issues. RegCure pro crack provides a fantastic feature for you that fix all system issues as well as it removes malware and viruses from your PC. Jan 19, 2020  RegCure Pro 4.6.17 Crack + Keygen Free Download: RegCure Pro is that registry cleaner which is intended for tidying and furthermore accelerating the execution of your PC, to evacuate spyware and infections, and numerous more things which a PC may require. Mar 01, 2020  RegCure Pro 2020 License Key Crack + Keygen RegCure Pro License Key is a Registry Cleaner from ParetoLogic.It can to get rid of errors and enhance the computer’s functionality and adjust its. Regcure pro license key generator download. Aug 30, 2017  RegCure Pro License Keys With Crack. The RegCure pro license key is designed that helps in restoring the system to peak performance. The software provides better way mainly for computer users of all the experience levels and it has the ability to rectify the repairs encountered for the system without taking it into the computer shop. Downloading and installing RegCure Pro License Key Generator, you need at least 20MB free of charge on your hard drive. An Internet connection is required to keep upgrading, and, then, download the input file. Access the administrator account to allow this program to make any changes to your PC.

Palo Alto Generate Api Key In Computer


Palo Alto Generate Api Key In Excel

Additional Information
For additional information, here are some articles for reference:
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/get-your-api-key
For easy encode and decode of URIs:
https://www.url-encode-decode.com/
For the list of all special character encoding for HTML:
https://www.w3schools.com/tags/ref_urlencode.asp

Attachments