Package: pan-analyzer
Palo Alto Firewall AnalyzerPython3 scripts for reviewing and fixing Palo Alto Firewall configurationsThis repository contains the scriptpan_analyzer, which can detects and fix Palo Alto Network firewall configuration issues, as well as several other helper scripts.The validators are designed to have as few false positives as possible. If there is a false positive, pleasereport an issue!pan_analyzer QuickstartInstall the package withpip install pan_analyzerRun all validators on an XML configuration file downloaded with Panorama -> Setup -> Operations -> "Export Panorama configuration version":pan_analyzer --xml 12345.xmlUsing pan_analyzerThe first time you launch pan_analyzer, it will create aPAN_CONFIG.cfgfile
in"~\.pan_policy_analyzer\and instruct you to edit it.
The second time you launch the analyzer it will detect that "API_KEY.txt" is not present,
and will prompt you for credentials and save the retrieved API key to "API_KEY.txt"Run all validators on all device groups:pan_analyzerRun a single validator on all device groups:pan_analyzer --validator UnusedServicesRun a single validator on a single device group:pan_analyzer --device-group my_device_group --validator UnusedServicesRun all validators on an XML configuration file downloaded with "Export Panorama configuration version":pan_analyzer --xml 12345.xmlRun all validators on an XML configuration file downloaded with "Export Panorama configuration version" and choose type output file (formats support txt (text) and json (json)):pan_analyzer --xml 12345.xml --output textpan_analyzer --xml 12345.xml --output jsonIf you're not sure where to start, I recommend downloading an XML file from:Panorama -> Setup -> Operations -> Export Panorama configuration versionand running:pan_analyzer.py --xml 12345.xmlCommon WorkflowsThere are a few common workflows to clean the firewall configuration:Consolidate Service ObjectsConsolidate Service objects so there is only one object for each Service:Delete unused Service objects:python pan_analyzer --fixer DeleteUnusedServicesCheck if any Service objects have misleading names:python pan_analyzer --validator MisleadingServicesConsolidate service objects in use:python pan_analyzer --fixer ConsolidateServicesDelete the now-unused Service objects:python pan_analyzer --fixer DeleteUnusedServicesDefine a convention in the config file, then rename to fit the naming convention:python pan_analyzer --fixer RenameUnconventionallyNamedServicesConsolidate Address ObjectsConsolidate Address objects so there is only one object for each target:Delete unused Address objects:python pan_analyzer --fixer DeleteUnusedAddressesDelete Address objects with FQDNs that don't resolve:python pan_analyzer --validator BadHostnameCheck if any Address objects have IPs in FQDNs:python pan_analyzer --validator FQDNContainsIPCheck if any Address objects have misleading names:python pan_analyzer --validator MisleadingAddressesReplace Address objects using IPs with FQDNs:python pan_analyzer --fixer FixIPWithResolvingFQDNConsolidate Address objects in use:python pan_analyzer --fixer ConsolidateAddressesDelete the now-unused Address objects:python pan_analyzer --fixer DeleteUnusedAddressesMake all FQDN objects use FQDNs:python pan_analyzer --fixer FixUnqualifiedFQDNDefine a convention in the config file, then rename objects to fit a naming convention:python pan_analyzer --fixer RenameUnconventionallyNamedAddressesKnown IssuesThe validators for checking zones (ExtaZones, MissingZones, and ExtraRules) all
require looking up the zones for address objects on the firewall. This requires many API
requests and can take a very long time. Given that PA recommends limiting the number of
concurrent API calls to five, and that's shared among the web UI, these calls are not
parallelized. Because of these concerns, the default configuration skips those validators.Other scriptsIn addition topan_analyzer, several other scripts are included in this package:pan_categorization_lookup- Looks up categorization for either a single URL or a file with a list of URLspan_disable_rules- Takes a textfile with a list of security rules and disables them (useful for disabling rules found with PolicyOptimizer)pan_dump_active_sessions- Dumps all active sessions from all firewallspan_run_command- Runs a single command on a single firewallpan_zone_lookup- Looks up Zone for a single IP on all firewallsLicenseThis project is in the worldwidepublic domain.This project is in the public domain within the United States, and
copyright and related rights in the work worldwide are waived through
theCC0 1.0 Universal public domain
dedication.All contributions to this project will be released under the CC0
dedication. By submitting a pull request, you are agreeing to comply
with this waiver of copyright interest.