func (p *PaloAlto) DeviceGroupNATPolicy(group string) (*NATPolicy, error) {
	var policy NATPolicy
	if p.DeviceType != "panorama" {
		return nil, errors.New("you can only view device group NAT policies on a panorama")
	}
	xpath := fmt.Sprintf("/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='%s']/*/nat/rules", group)
	_, natPolicyData, errs := r.Get(p.URI).Query(fmt.Sprintf("type=config&action=get&xpath=%s&key=%s", xpath, p.Key)).End()
	if errs != nil {
		return nil, errs[0]
	}
	if err := xml.Unmarshal([]byte(natPolicyData), &policy); err != nil {
		return nil, err
	}
	if policy.Status != "success" {
		return nil, fmt.Errorf("error code %s: %s", policy.Code, errorCodes[policy.Code])
	}
	if len(policy.Rules) == 0 {
		return nil, errors.New("there are no rules created")
	}
	return &policy, nil
}
DeviceGroupNATPolicy returns information about the NAT policy on a given device group.
package panos
import (
	"encoding/xml"
	"errors"
	"fmt"
)
type Policy struct {
	IncludedRules string
	Pre           []Rule
	Post          []Rule
	Local         []Rule
}
type policyRules struct {
	XMLName xml.Name `xml:"response"`
	Status  string   `xml:"status,attr"`
	Code    string   `xml:"code,attr"`
	Rules   []Rule   `xml:"result>rules>entry"`
}
type Rule struct {
	Name                 string   `xml:"name,attr"`
	Tag                  []string `xml:"tag>member,omitempty"`
	From                 []string `xml:"from>member,omitempty"`
	To                   []string `xml:"to>member,omitempty"`
	Source               []string `xml:"source>member,omitempty"`
	Destination          []string `xml:"destination>member,omitempty"`
	SourceUser           []string `xml:"source-user>member,omitempty"`
	Application          []string `xml:"application>member,omitempty"`
	Service              []string `xml:"service>member,omitempty"`
	HIPProfiles          []string `xml:"hip-profiles>member,omitempty"`
	Category             []string `xml:"category>member,omitempty"`
	Action               string   `xml:"action,omitempty"`
	LogStart             string   `xml:"log-start,omitempty"`
	LogEnd               string   `xml:"log-end,omitempty"`
	LogSetting           string   `xml:"log-setting,omitempty"`
	Disabled             string   `xml:"disabled,omitempty"`
	URLFilteringProfile  string   `xml:"profile-setting>profiles>url-filtering>member,omitempty"`
	FileBlockingProfile  string   `xml:"profile-setting>profiles>file-blocking>member,omitempty"`
	AntiVirusProfile     string   `xml:"profile-setting>profiles>virus>member,omitempty"`
	AntiSpywareProfile   string   `xml:"profile-setting>profiles>spyware>member,omitempty"`
	VulnerabilityProfile string   `xml:"profile-setting>profiles>vulnerability>member,omitempty"`
	WildfireProfile      string   `xml:"profile-setting>profiles>wildfire-analysis>member,omitempty"`
	SecurityProfileGroup string   `xml:"profile-setting>group>member,omitempty"`
	Description          string   `xml:"description,omitempty"`
}
type RuleContent struct {
	Name string
	Tag []string
	From []string
	To []string
	Source []string
	Destination []string
	SourceUser []string
	Application []string
	Service []string
	HIPProfiles []string
	Category []string
	Action string
	LogStart string
	LogEnd string
	LogSetting string
	Disabled string
	URLFilteringProfile string
	FileBlockingProfile string
	AntiVirusProfile string
	AntiSpywareProfile string
	VulnerabilityProfile string
	WildfireProfile string
	SecurityProfileGroup string
	Description string
}
type NATPolicy struct {
	XMLName xml.Name  `xml:"response"`
	Status  string    `xml:"status,attr"`
	Code    string    `xml:"code,attr"`
	Rules   []NATRule `xml:"result>rules>entry"`
}
type NATRule struct {
	Name                            string   `xml:"name,attr"`
	From                            []string `xml:"from>member"`
	To                              []string `xml:"to>member"`
	Source                          []string `xml:"source>member"`
	Destination                     []string `xml:"destination>member"`
	Service                         []string `xml:"service>member"`
	SrcDynamicInterfaceIP           string   `xml:"source-translation>dynamic-ip-and-port>interface-address>ip"`
	SrcDynamicInterface             string   `xml:"source-translation>dynamic-ip-and-port>interface-address>interface"`
	SrcDynamicIPAndPortTranslatedIP string   `xml:"source-translation>dynamic-ip-and-port>translated-address>member"`
	SrcDynamicTranslatedIP          []string `xml:"source-translation>dynamic-ip>translated-address>member"`
	DestinationTransltedIP          string   `xml:"destination-translation>translated-address"`
	SrcStaticTranslatedIP           string   `xml:"source-translation>static-ip>translated-address"`
	BiDirectional                   string   `xml:"source-translation>static-ip>bi-directional"`
}
func (p *PaloAlto) Policy(devicegroup ...string) (*Policy, error) {
	var policy Policy
	var prePolicy policyRules
	var postPolicy policyRules
	var localPolicy policyRules
	switch p.DeviceType {
	case "panos":
		xpath := "/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules"
		if len(devicegroup[0]) > 0 {
			return nil, errors.New("you do not need to specify a device-group when connected to a fireawll")
		}
		_, localPolicyData, errs := r.Get(p.URI).Query(fmt.Sprintf("type=config&action=get&xpath=%s&key=%s", xpath, p.Key)).End()
		if errs != nil {
			return nil, errs[0]
		}
		if err := xml.Unmarshal([]byte(localPolicyData), &localPolicy); err != nil {
			return nil, err
		}
		if localPolicy.Status != "success" {
			return nil, fmt.Errorf("error code %s: %s", localPolicy.Code, errorCodes[localPolicy.Code])
		}
		if len(localPolicy.Rules) == 0 {
			return nil, errors.New("there are no rules created")
		}
		policy.IncludedRules = "local"
		policy.Local = localPolicy.Rules
	case "panorama":
		if len(devicegroup) == 0 {
			return nil, errors.New("you must specify a device-group when viewing policies on a Panorama device")
		}
		preXpath := fmt.Sprintf("/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='%s']/pre-rulebase/security/rules", devicegroup[0])
		postXpath := fmt.Sprintf("/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='%s']/post-rulebase/security/rules", devicegroup[0])
		_, prePolicyData, errs := r.Get(p.URI).Query(fmt.Sprintf("type=config&action=get&xpath=%s&key=%s", preXpath, p.Key)).End()
		if errs != nil {
			return nil, errs[0]
		}
		if err := xml.Unmarshal([]byte(prePolicyData), &prePolicy); err != nil {
			return nil, err
		}
		_, postPolicyData, errs := r.Get(p.URI).Query(fmt.Sprintf("type=config&action=get&xpath=%s&key=%s", postXpath, p.Key)).End()
		if errs != nil {
			return nil, errs[0]
		}
		if err := xml.Unmarshal([]byte(postPolicyData), &postPolicy); err != nil {
			return nil, err
		}
		if len(prePolicy.Rules) == 0 && len(postPolicy.Rules) == 0 {
			return nil, fmt.Errorf("there are no rules created, or the device-group %s does not exist", devicegroup[0])
		}
		if len(prePolicy.Rules) > 0 && len(postPolicy.Rules) > 0 {
			policy.IncludedRules = "both"
		}
		if len(prePolicy.Rules) > 0 && len(postPolicy.Rules) == 0 {
			policy.IncludedRules = "pre"
		}
		if len(prePolicy.Rules) == 0 && len(postPolicy.Rules) > 0 {
			policy.IncludedRules = "post"
		}
		if prePolicy.Status != "success" {
			return nil, fmt.Errorf("error code %s: %s", prePolicy.Code, errorCodes[prePolicy.Code])
		}
		if postPolicy.Status != "success" {
			return nil, fmt.Errorf("error code %s: %s", postPolicy.Code, errorCodes[postPolicy.Code])
		}
		policy.Pre = prePolicy.Rules
		policy.Post = postPolicy.Rules
	}
	return &policy, nil
}
func (p *PaloAlto) NATPolicy() (*NATPolicy, error) {
	var policy NATPolicy
	if p.DeviceType != "panos" {
		return nil, errors.New("you can only view NAT policies on a firewall")
	}
	xpath := "/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/nat/rules"
	_, natPolicyData, errs := r.Get(p.URI).Query(fmt.Sprintf("type=config&action=get&xpath=%s&key=%s", xpath, p.Key)).End()
	if errs != nil {
		return nil, errs[0]
	}
	if err := xml.Unmarshal([]byte(natPolicyData), &policy); err != nil {
		return nil, err
	}
	if policy.Status != "success" {
		return nil, fmt.Errorf("error code %s: %s", policy.Code, errorCodes[policy.Code])
	}
	if len(policy.Rules) == 0 {
		return nil, errors.New("there are no rules created")
	}
	return &policy, nil
}