Package: prisma-access-sase
prisma-access-sasePrisma Access SASEImport that handles Prisma Access SASE based off v1 API callsLicenseGNURequirementsActive Prisma Accesspython >=3.8InstallationGithub:Download files to a local directory and run:python-mpipinstall.pip install prisma-access-saseSetupRequires configuraitons to be on the system to work properly. You can define them via one of 3 methodsRequires the following manditory ENV Variables:Required:TGS="TGS VALUE"CLIENT_ID="CLIENT ID"CLIENT_SECRET="CLIENT SECRET"Optional:CERT:"true"Through a YAML config file located here ~/.confg/.prismasasethis can be run via using the prisma_yaml_script script that comes with the installation:# prisma_yaml_scriptRunningYAMLConfigs
PleaseinputClientID:<account_id>
PleaseinputClientSecret:<account_secret>
PleaseenterTSGID:<TSG>
Pleaseentercustomcertlocation('true'|'false'|<custom_cert_location>):trueWhen the config is initiated it reads in the YAML configs as your default which you can use as your variables. Otherwise you need to provide the athorization. Authorization is still based on an object and once that object is created you can pass it around and it has a self wrapper that will confirm the token is still valid and reauth if it is not to handle work that may surpass the 15 min timer tied to each auth token.Basic UsageModule will set a 15min timmer once imported and will check that timmer each time a command is run to confirm that the token is still viable. If it is not, the token will be refreshed upon the next execution of an api call.Example(showing defaults only):>>>fromprismasase.configimportAuth>>>fromprismasaseimportconfig>>>fromprismasase.restapiimportprisma_request>>>auth=Auth(tsg_id=config.TSG,client_id=config.CLIENT_ID,client_secret=config.CLIENT_SECRET,verify=config.CERT)>>>ike_gateways=prisma_request(token=auth,url_type='ike-gateways',method='GET',params={'folder':'Remote Networks'})>>>ike_gateways{'data':[],'offset':0,'total':0,'limit':200}>>>ipsec_crypto_profiles=prisma_request(token=auth,url_type='ipsec-crypto-profiles',method='GET',params={'folder':'Remote Networks'})>>>ipsec_crypto_profiles{"data":[{"id":"d0ea9697-8294-4e8b-9d9f-ac13435648d6","name":"CloudGenix-IPSec-Crypto-Default","folder":"Remote Networks","esp":{"authentication":["sha512"],"encryption":["aes-256-cbc"]},"lifetime":{"hours":1},"dh_group":"group20"},{"id":"947cca45-511d-4143-949d-d9f22630c4e6","name":"Citrix-IPSec-Crypto-Default","folder":"Remote Networks","esp":{"authentication":["sha256"],"encryption":["aes-256-cbc"]},"lifetime":{"hours":1},"dh_group":"group2"},{"id":"51d2b086-5d27-423d-b158-59d250a96e44","name":"Riverbed-IPSec-Crypto-Default","folder":"Remote Networks","esp":{"authentication":["sha512"],"encryption":["aes-256-cbc"]},"lifetime":{"hours":1},"dh_group":"group2"},{"id":"eeafe642-ead6-4cc1-b8bb-760a1821ce11","name":"SilverPeak-IPSec-Crypto-Default","folder":"Remote Networks","esp":{"authentication":["sha512"],"encryption":["aes-256-cbc"]},"lifetime":{"hours":1},"dh_group":"group14"},{"id":"fb1eb3f6-1ac0-4e51-af63-8b7e788bd052","name":"CiscoISR-IPSec-Crypto-Default","folder":"Remote Networks","esp":{"authentication":["sha256"],"encryption":["aes-128-cbc"]},"lifetime":{"hours":1},"dh_group":"group5"},{"id":"d847a6fe-d0fd-4404-882f-03000d10c7c8","name":"CiscoASA-IPSec-Crypto-Default","folder":"Remote Networks","esp":{"authentication":["sha512","sha384","sha256","sha1","md5"],"encryption":["aes-256-gcm","aes-128-gcm","aes-256-cbc","aes-192-cbc","3des","des"]},"lifetime":{"hours":1},"dh_group":"group2"},{"id":"06ec0156-92d8-439d-8fa7-43ee1283fa2f","name":"Viptela-IPSec-default","folder":"Remote Networks","esp":{"authentication":["sha256"],"encryption":["aes-256-cbc"]},"lifetime":{"hours":1},"dh_group":"group2"},{"id":"24115df4-b9a7-481d-9c42-64f975cb38e6","name":"Suite-B-GCM-128","folder":"Remote Networks","esp":{"authentication":["none"],"encryption":["aes-128-gcm"]},"lifetime":{"hours":1},"dh_group":"group19"},{"id":"94b7f66e-29be-45fd-bd7f-59dfe9821301","name":"Suite-B-GCM-256","folder":"Remote Networks","esp":{"authentication":["none"],"encryption":["aes-256-gcm"]},"lifetime":{"hours":1},"dh_group":"group20"},{"id":"48ac8901-1c86-48ed-b6f6-6272583ea009","name":"Velocloud-IPSec-default","folder":"Remote Networks","esp":{"authentication":["sha256"],"encryption":["aes-128-cbc"]},"lifetime":{"hours":1},"dh_group":"group5"},{"id":"cebad880-df04-48ad-86d3-28b95ae46c36","name":"PaloAlto-Networks-IPSec-Crypto","folder":"Remote Networks","esp":{"authentication":["sha256"],"encryption":["aes-128-cbc","3des"]},"lifetime":{"hours":1},"dh_group":"group2"},{"id":"96d21005-7edc-4a63-ae85-2327874a6b2d","name":"Others-IPSec-Crypto-Default","folder":"Remote Networks","esp":{"authentication":["sha512","sha384","sha256","sha1","md5"],"encryption":["aes-256-gcm","aes-128-gcm","aes-256-cbc","aes-192-cbc","aes-128-cbc","3des","des"]},"lifetime":{"hours":1},"dh_group":"group2"}],"offset":0,"total":12,"limit":200}Similarly you can POST commands changing the method and attaching json data to the command. Response should be the same.ImportFormat requirements:remote_network_nameregionspn_nameike_crypto_profileipsec_crypto_profilepre_shared_keylocal_fqdnpeer_fqdntunnel_monitormonitor_ipstatic_enabledstatic_routingbgp_enabledbgp_peer_asbgp_peer_ipbgp_local_ipnewyork-01us-east-1us-east-ashIKE-defaultIPSec-defaultThisIsMyKey2022local@example.compeer-1@example.comTRUE192.168.102.2TRUE"192.168.100.0/24,192.168.101.0/24"TRUE64512192.168.102.2192.168.102.1boston-01us-east-1us-east-ashIKE-defaultIPSec-defaultThisIsMyKey2022local@example.compeer-2@example.comTRUE192.168.202.2TRUE"192.168.200.0/24,192.168.201.0/24"TRUE64512192.168.202.2192.168.202.1Service SetupDescription:This section shows you all that encompasses the ability to create a service objectOn Boarding a new Site (Remote Network)You can now onboard a new site ensuring your settings are passed correctly. The Service Setup folder has all the required calls needed to create a new or update any existing profiles that you are referencing. You do not have to pass a pre-shared key if you do not want to as that will create one for you using a secrets package. You can see it inside the utilities that comes with the packageNOTE:There is a limit on names and they need to be <= 31 characters. There is a utilities check built in that will confirm the length and raise an exception if lenght is too long depending on the differnt limitations.NOTE:pre_shared_key is now required to be passed.Example Create a Secret and name checks:fromprismasaseimportutilitiespre_shared_key=utilities.gen_pre_shared_key(length=32)print(pre_shared_key)# Prints out#  'eKc9GK0op93VWBJHn0czI6Pf4zFsIL_7qABdHWC7DUs'utilities.check_name_length("ike-proto-gen-config-value-soemthing")# above will return False which will error eventually raise an error that user will need to handle in the naming conventionExample of creating/onboarding a new remote site:fromprismasase.configimportAuthfromprismasaseimportservice_setupfromprismasase.utilitiesimportgen_pre_shared_key"""Generate a random pre-shared-key for use if you do not want to supply one; warning you will get a hash return value so ensure you store locally; I use a crytography program that stores the password secretly in a table using a secret key stored in a vault."""pre_shared_key=gen_pre_shared_key(length=26)# generate an auth object (if you do not a pass one then the defaults will be used yet only one tenant can be used)auth=Auth(tsg_id='12345678',client_id='serviceaccount@prissmasasee',client_secret='secret password',verify=True,timeout=120)"""Note building out full list of possible varibles that can always be passed usinga settings config **settings if you have the dictionary created forall the required variables. This is going to be built out in future release"""new_network=service_setup.remote_networks.create_remote_network(remote_network_name="savannah01",region="us-southeast",spn_name="us-southeast-whitebeam",ike_crypto_profile="ike-crypto-profile-cisco",ipsec_crypto_profile="ipsec-crypto-prof-cisco",peer_id_type="ufqdn",local_id_type="ufqdn",pre_shared_key=pre_shared_key,local_id_value="sase@prisma.com",peer_id_value="savannah01@example.com",tunnel_monitor="true",monitor_ip="192.168.105.2",static_enabled="true",static_routing="192.168.130.0/24,192.168.231.0/24",bgp_enabled="false",peer_address_type="dynamic",auth=auth)Below would be the output if running in an interactive shell:INFO:Verifiedregion='us-southeast'andspn_name='us-southeast-whitebeam'exist
INFO:CreatingIKEGateway:ike-gw-savannah01
INFO:CreatingIPSecTunnelipsec-tunnel-savannah01
INFO:CreatedRemoteNetworkRETURN:{"status":"success","message":{"ike_gateway":{"id":"e8a1de19-3cda-40c9-b879-fab8583944c8","name":"ike-gwy-savannah01","folder":"Remote Networks","authentication":{"pre_shared_key":{"key":"-AQ==Jb9PA0IE/5FTjhet18MVeOV3j4o=nuLiIdAstF7fZGURc2wBQim0Mtwu4EiUvCYdfNXHWyx+MZv9fWxNY7T88O0L0FVO"}},"local_id":{"type":"ufqdn","id":"sase@prisma.com"},"peer_address":{"dynamic":{}},"peer_id":{"type":"ufqdn","id":"savanah01@example.com"},"protocol_common":{"fragmentation":{"enable":false},"nat_traversal":{"enable":true},"passive_mode":true},"protocol":{"ikev1":{"ike_crypto_profile":"ike-crypto-profile-cisco","dpd":{"enable":true}},"ikev2":{"ike_crypto_profile":"ike-crypto-profile-cisco","dpd":{"enable":true}},"version":"ikev2-preferred"},"local_address":{"interface":"vlan"}},"ipsec_tunnel":{"id":"3ccd79a7-9050-4e1b-a057-712c99453980","name":"ipsec-tunnel-savannah01","folder":"Remote Networks","anti_replay":true,"auto_key":{"ike_gateway":[{"name":"ike-gwy-savannah01"}],"ipsec_crypto_profile":"ipsec-crypto-prof-cisco"},"copy_tos":false,"enable_gre_encapsulation":false,"tunnel_monitor":{"destination_ip":"192.168.105.2","enable":true},"tunnel_interface":"tunnel"},"remote_network":{"id":"54b45db0-455b-49ec-9220-f03ed64b02f3","name":"savannah01","folder":"Remote Networks","ipsec_tunnel":"ipsec-tunnel-savannah01","license_type":"FWAAS-AGGREGATE","region":"us-southeast","spn_name":"us-southeast-whitebeam","subnets":["192.168.130.0/24","192.168.231.0/24"],"ecmp_load_balancing":"disable"}}}Configuration ManagementDescription:Configuraiton Management structure found under:fromprismasase.config_mgmtimportconfigurationsConfiguration RollbackYou can useconfig_manage_rollback()to roll back all current pending configurations>>>configuration.config_manage_rollback(){'success':True,'message':'There are no changes to revert.'}CommitCommiting all the cofigurations requires you to know all your folders that you own. If you don't you can run a command similar to the one listed before to get a list of all services. Otherwise you can specify this command.NOTE:the timeout is default set to 2700 seconds and you can adjust this but depending on the amount of configuration changes and nodes that this has to push to there are a few jobs that are running that this SDK is checking on. The best would be to build this as an async api where you can just get the job id from this SDK and check on it's progress otherwise direcly you are just waiting for it to finish. I set a timmer in the jobs to display how long it takes for each.>>>fromprismasase.config_mgmtimptconfiguration
>>>response=configuration.config_commit(folders=['Remote Networks','Service Connections'],description='commiting test configuration from sdk')INFO:pushingcandiateconfigforRemoteNetworks,ServiceConnections
INFO:response={"success":true,"job_id":"187","message":"CommitAndPush job enqueued with jobid 187"}INFO:Pushedsuccessfullyjob_id='187'|message='CommitAndPush job enqueued with jobid 187'INFO:Pushreturnedsuccess
INFO:AdditionaljobsearchreturnedJobs189,188
INFO:Checkingonjob_id189INFO:Pushreturnedsuccess
INFO:Checkingonjob_id188INFO:Pushreturnedsuccess
INFO:GatheringCurrentCommitversionfortenant1234567890INFO:CurrentRunningconfigurationsare62INFO:FinalResponse:{"status":"success","message":"CommitAndPush job enqueued with jobid 187","parent_job":"187","version_info":[{"device":"Remote Networks","version":62,"date":"2022-11-06T14:38:54.000Z"},{"device":"Service Connections","version":62,"date":"2022-11-06T14:38:54.000Z"}],"job_id":{"187":{"details":"{\"info\":[\"Configuration committed successfully\"],\"errors\":[],\"warnings\":[],\"description\":\"commiting test configuration from sdk\"}","end_ts":"2022-11-06 14:38:58","id":"187","insert_ts":"2022-11-06 14:37:20","job_result":"2","job_status":"2","job_type":"53","last_update":"2022-11-06 14:39:00","opaque_int":"0","opaque_str":"","owner":"cfgserv","parent_id":"0","percent":"100","result_i":"2","result_str":"OK","session_id":"","start_ts":"2022-11-06 14:37:20","status_i":"2","status_str":"FIN","summary":"","type_i":"53","type_str":"CommitAndPush","uname":"APIGateway@ProdInternal.com","total_time":"122"},"189":{"details":"{\"status\":\"ACT\",\"info\":[\"Your Prisma Access infrastructure is being provisioned. Go to the Prisma Access Dashboard for real-time status information.\"],\"errors\":[],\"description\":\"Service Connections configuration pushed to cloud\",\"warnings\":[],\"result\":\"PEND\"}","end_ts":"2022-11-06 14:41:36","id":"189","insert_ts":"2022-11-06 14:39:11","job_result":"2","job_status":"2","job_type":"22","last_update":"2022-11-06 14:41:36","opaque_int":"","opaque_str":"","owner":"gpcs-ext","parent_id":"187","percent":"100","result_i":"2","result_str":"OK","session_id":"","start_ts":"2022-11-06 14:39:11","status_i":"2","status_str":"FIN","summary":"Configuration push finished","type_i":"22","type_str":"CommitAll","uname":"APIGateway@ProdInternal.com","total_time":"155"},"188":{"details":"{\"status\":\"FIN\",\"info\":[\"Warnings seen in:\\n  Region: US Southeast  \\nWarning: Authentication rulebase is defined but captive-portal setting is not set!\\n(Module: device)\\n\\u00a0\\nGo to the Prisma Access Dashboard for real-time status information.\"],\"errors\":[],\"description\":\"Remote Networks configuration pushed to cloud\",\"warnings\":[],\"result\":\"OK\"}","end_ts":"2022-11-06 14:42:17","id":"188","insert_ts":"2022-11-06 14:38:55","job_result":"2","job_status":"2","job_type":"22","last_update":"2022-11-06 14:42:17","opaque_int":"","opaque_str":"","owner":"gpcs-ext","parent_id":"187","percent":"100","result_i":"2","result_str":"OK","session_id":"","start_ts":"2022-11-06 14:38:56","status_i":"2","status_str":"FIN","summary":"Configuration push finished","type_i":"22","type_str":"CommitAll","uname":"APIGateway@ProdInternal.com","total_time":"31"}}}ObjectsDescription:This is the folder structure that handles all the Objects throughout the configurations for Prisma Access SASEAddress ObjectsCreating an Address and manipulating an address use the addresses import. You are allowed to list out tags to tag an address and will get information on the action as well as returns on them.fromprismasase.policy_objectsimportaddresses# Note i'm not setting the auth token becuase i'm using the default, but remember to pass an auth if you are not using the default yaml template config# create a new address with a tag. tags are confirmed to exist or will raise an errorresponse=addresses.addresses_create(name='svr-test-network',folder='Shared',tag=['server_network'],ip_netmask='192.168.0.0/24')# get address by IDresponse=addresses.addresses_get_address_by_id(address_id="13b64f23-f290-4caf-8386-74d66b068e49",folder="Shared")# delete addressresponse=addresses.addresses_delete(address_id="13b64f23-f290-4caf-8386-74d66b068e49",folder="Shared")CREATE Address Returns:{"id":"13b64f23-f290-4caf-8386-74d66b068e49","name":"svr-test-network","folder":"Shared","ip_netmask":"192.168.0.0/24","tag":["server_network"]}Get address by ID:{"id":"13b64f23-f290-4caf-8386-74d66b068e49","name":"svr-test-network","folder":"Shared","ip_netmask":"192.168.0.0/24","tag":["server_network"]}Delete Address returns:{"id":"13b64f23-f290-4caf-8386-74d66b068e49","name":"svr-test-network","folder":"Shared","ip_netmask":"192.168.0.0/24","tag":["server_network"]}Caveats and known issuesThis is a PREVIEW release; still under worksDELETE and PUT actions are still under testingDoing a push would require additional seetings see how to handle prisma_request()VersionVersionBuildChanges0.0.1b1Initial Release.0.0.4a2fixed issues with re-auth0.0.4finalfixed dependencies0.0.5a1build ability to create remote networks0.0.5a2built out ipsec and ike functionality0.1.5b1adjusted format of entire project based on how SASE Docs are created to better organize the calls0.1.5b2fixed some issues with erroring and started to build out messaging if interacting directly0.1.5b3final release test before production merged some missing files from last merger0.1.5finalProduction release0.1.6a1created baseline files and config management structure0.1.6a2fixed issues with package names0.1.6a5fixed issues with unable to commit due to how the IKE data was getting formated; strange issue with api call0.1.6a6merged feature to support tags0.1.6a7added ability to specify folder location for generizing loction defaults it to Remote Networks for reverse compatability0.1.6a8fixes issues with config checks and monitors both parent push and all children pushed in configuration to return a response with all the information for each job0.2.1a1Changed entire initial build on how the tenants are read in. If yaml exists you can use that, but you now have to specify the auth in each request to manage mulitple tenants; you can leave it alone and not pass the auth and an auth will be generated off the init config if you are only managing a single tenant based on the standad inputs.0.2.1a3fixed issues with auth in config management moved auth to utilities file and reorg structure; also fixed issue with reading in yaml config file when using yaml for self contained config outside of pushing in the auth credentials0.2.1a4fixed a few bugs around auth that was carried over from previous changes; found issue with autotagging that doesnot want to work, but fixed tagging through Addresses so DAGs could be used for auto tagging for now, added ability to retrieve address by ID; adds address edit function; fixes issue with address get by id0.2.1a5Fixed api calls to use auth.verify instead of config.CERT, which was legacy way; added addtional config url endpoints for future support0.2.1a6streamlined passing variables as they go through remote object creation0.2.1a7added address delete via old method Palo Alto decided to change their api calls; found out they support the old structure and there were just a few issues where the new calls were released before they released the support. They should be fixing that0.2.1a8adjusted pre-shared key to force to be supplied and passed the encrypted value back to keep the pre-shared-key secured; removed debugging0.2.1finaltested in production environment; creates remte netoworks; adds, removes, and edits addressses; checks for tags that exist; runs standard commit push; adds support for multiple types see notes on release0.2.2a1vulnerability in wheel updating dependency to 0.38.0 to fix vulnerability0.2.2a2added versioning to config_management return json response and updated readme with more examples0.2.2a3added autotag method correcting the payload; complex call that needs to be looked at for updating as the filter has to be adjusted each change0.2.2rc1released hot fix for bool issues inside of remote network0.2.2finalincludes hotfix for monitor and addresses_edit missing 'url_type' and updates to help creating a Remote Network adjusting for a bool or string variable getting passed; cannot add the type to continue support for python < 3.100.2.3a1raise an error if address delete called and address doesnot exist0.2.3a2fixed issue with config due to duplicate naming conventions, adjusted all the imports; added address raise error if doesnot exist0.2.4hotfixfixes issue with two auths passed when running a config_commit()0.2.5hotfixresolves issue with config commit with show_run not passing the correct auth causing duplicate values; updated the commit response so that it will return a failure if any subjob fails0.2.6a1updates to ike list where it will search every ike in that folder to find a value with a name; adds ike delete and ike list functions0.2.6a2adds delete function for remote id, ike gateway id, ipsec tunnel id0.2.6finaladds delete functions and a few updates to auto tagging0.2.7hotfixmissing url_type in remote networks delete0.2.8finaladjusted requirements due to some confilicts in ohter projectsKnown Bugs/Futue FeaturesNames longer than 31 characters will just fail this is a limitation need to put in a verification on all names to confirm to standardsBGP doesn't seem to work, but this looks more like a Prisma Access side issue; need to find out from PaloConfiguration Management Bugs:get configuration by version doesn't work as it still only pulls the list of configurations. This seems like an api issue with Palo AltoNo configuration changes are shown and no way to check diff remotely using config management. Again issue with the way the Pan API's are implemented.Configuration doesn't allow you to pull to even see if there are changes nor does it show the staged congfig changes that are being pushed. Therefore you cannot determine what folders to push to. Another API limitationWhen pushing configuration the job that gets returned is the parent job id and will return a pass if any job passes, but does not report the individual failures. This is a limitation with the SASE API which needs to evaluate all sub jobs.Error messages are difficult toget as summary of job does not provide error.Load configuration or previous configuration continues to get access deny error. Which requires super user permissions.No way to restore, just push an old configuration.Even with full permission Loading any configuration continually reports success, but message always reads: "Config loaded from <config_id>. Migration of old configuration was not successful. Some features may not work as expected and/or parts of configuration may have been lost." leading to nothing actually being done.No way to get Configuration Status or Last Good Config easilyissues with how IKE api calls are made. When done according to documenation it does not work; I copied a duplicate configuration that should not work, but actually works. Compared original to new code and difference is location of key,value pairs plus duplicate keys, which goes against a proper dictionary creation and could possibly cause issues. I think there should be an error returned if the profiles are not sent correctly, but I'm not getting them and the API endpoint is just selecting it's own.Address get by ID issue... requires a folder param when looking at ID but not documented.Future FeaturesGet more details on possible variablesCreate a bulk function that can onboard multiple sites all at once, but will need to handle errors to ensure that if one exists that one is skipped and noted in the responseBuild out the config management section that will include reverting configurations viewing and pushing staged commitsAdd support for different types of tunnels; currently only supports dynamic tunnels with ufqdn as the inputUpdates to response when successfulpublish commit version when commit push succeedsfind a way to get a diffUpdates to be able to run as a cli script as well as a imported packageCurrent Enahancementsversion 0.2.8Updted requirements to be friendlier with other other installations.version 0.2.7Hotfix for missing url in ike delete functionVersion 0.2.6Adds delete functionsVersion 0.2.5 -hotfixfixes issue withVersion 0.2.3 -hotfixHotfix for issue with passing two auth's in config_commit() function when calling show_run functionVersion 0.2.2Hot fix for monitor adddressHot fix for missing 'url_type' in address_editAdjust variables being passed to accept both bool or string on required vars and converts them to boolAdded correct payload for autotag methodAdded return of versioning from commit push methodAddressed wheel vulnerability in 0.37.xVersion 0.2.1Leverage pre-shared-key to create a keyMust supply a pre-shared-key when creating a tunnel and that key returns encrypted. It is up to the user to be able to track the actual keyAdded a default auth using local yaml config, but able to pass different auth tenants that can than be used throughout each call and will refresh if that object is still in use after 15 minutes.Added supports for different types of IKE Gateways supporting using peer_id_value, peer_id_type, local_id_value, and local_id_type.Added support for different peer-address types using peer_address_type; you can now specify the different types if dynamic is chosen than no peer_address is required as that defaults to empty Object. Otherwise the peer_address needs to be supplied depending on the type chosen. Please read Pan Docs.Additional features for Addresse Objects and Tags supported just didn't provide examples import the modules and use as needed.For more infoGet help and additional Prisma Access Documentation athttps://pan.dev/sase/