Package: pa-license-check
Palo Alto License CheckSimple script to be integrated into Icinga to alert the NOC team when firewall is set to expire in 60 days, 3 days or has already expired.
This was built as a solution where Palo Altos Panorama is not configured or to costly.Installation##Using PIPThis package is uploaded to the PyPI and can be run as a command line programpipinstallpa-license-checkThis will install a CLI tool called 'palicensecheck'. It will allow you to do the followingCreate an INI file that it uses to read the firewallAdds new clients to the INI FileChecks the licensing status and returns an exit code##Using PoetryYou can install this by cloning the repo in Github and then using Poetry to install all the dependencies and setup the enviroment.
You can use this for development purposes if you wish to do so.Clone the projectNavigate to the root of the project directoryUsing Poetry run the following command
2. To install poetryplease see their page for further instructionspoetryinstallHow it worksThe primary purpose for this script was as a stop gap between implementing Panorama and the lack of system expiration date from the SNMP MIBs that are included
in Monitoring Software like LibreNMS.The script makes an API call to the chosen firewall and parses through the XML its returned. It grabs the feature name and the expiration date.
It checks the expiration date against the current date. If the firewall expiration date is greater than 60 days, it returns a system code of 0 which indicates
no errors. If the expiration date is within 60 days, it returns a system code of 1, prompting a warning. If the Expiration date is within 3 days, it returns a system code of 2,
which indicates critical error. This will help give us visibility into the Palo Altos to ensure no firewall goes expired and without support from the vendor.60 days was chosen to allow ample time for Support or the Provisioning team to request a renewal quote and proceed through the Kissflow process.Custom Exit CodesThe script utilizes a "Cusom Exit Code" to keep track of various states. This is not to be confused with the system exit codes, which are used to tell Icinga what severity.
This is strictly for keeping track within the function itself! I decided to Document it in case anyone wanted to expand on this.CustomExitCode is 0; Everything is ok
CustomExitCode is 1; Warning, Hit 60 days
CustomExitCode is 2; Warning, Coutning down from 60 days
CustomExitCode is 3; Error, we are less than 3 days from expiration
CustomExitCode is 4; We are past expiration dateRunning the scriptGenerating INI FileOn the first initial run, you'll need to build the INI file. You can easily do this by runningpalicensecheckcreate-ini-fileIt will then ask you a series of questionsplease enter the firewall you wish to monitor
hank.kingofthe.hill
please enter the Firewall Key
wah5eeGhee7thah2waechohshai6ah6iphugh4ahpoophaeva0aeTutah6ohSooPopane
Please enter the clients name, I.E. ACME
StriklandIt will then create the INI file in the root directory of the script
Which will look like this.[strikland]
key = wah5eeGhee7thah2waechohshai6ah6iphugh4ahpoophaeva0aeTutah6ohSooPopane
fw = hank.kingofthe.hillAdding clients to the INI fileYou can easily add new clients to the INI file by running the following commandpalicensecheckadd-client-iniIt will then walk you through a series of questions to help build the file.pleaseenterthefirewallyouwishtomonitor
thatherton.fueles.demo
pleaseentertheFirewallKey
oogoo1eec0ef0ong2ix0sheingughae8oongiebaicee3que0ShaD6rau0Looch9
Pleaseentertheclientsname,I.E.ACME
thatherton
fw_key.inifileappendedwithnewinformationhere we can see the expanded file[strikland]
key = wah5eeGhee7thah2waechohshai6ah6iphugh4ahpoophaeva0aeTutah6ohSooPopane
fw = hank.kingofthe.hill
[thatherton]
key = oogoo1eec0ef0ong2ix0sheingughae8oongiebaicee3que0ShaD6rau0Looch9
fw = thatherton.fueles.demoChecking the license StatusTo run the script and check the status, simply run the following commandpalicensecheckcheck-license--clientstriklandIts important to remember that the argument after the --client parammustmatch the group name in your INI file.To DoI cobbled this together to what it is today in a few hours time updating it.
Please let me know if there are bugs, issues or any features you would like added.Testing against various firewallsImplement API Automatic Key creation for easier deploymentNeed to adjust some error catching