Package: panw-utils
panw-utilsPalo Alto Networks UtilitiesFree software: MIT licenseDocumentation:https://panw-utils.readthedocs.io.Featurespanw-utilsReturns a list of available commandsget-panw-api-keyReturns the current API key, suitable for piping to pbcopy (macOS) or clip.exe (Windows)Command line optionsPlatform independentSave default user and firewallUpdate saved settingsReceives pipeline input (stdin)Uses a default firewall if one not providedPrompts for required parameters if none providedMulti-threadedget-panw-firewallsReturns a list of firewalls including management address and serial numberOutput can be pasted directly into ExcelTerse output option for piping to other commandsCommand line optionsPlatform independentSave API key and default Panorama hostUpdate saved settingsOverride/supply API key on the command lineget-panw-interfacesReturns a list of firewalls interfacesOutput can be pasted directly into ExcelTerse output option for piping to other commandsCommand line optionsPlatform independentSave API key and default firewallUpdate saved settingsOverride/supply API key on the command lineFilter on interface propertiesMulti-threadedget-panw-configReturns the firewall configuration (set/XML format)Command line optionsPlatform independentSave key based auth preference, default user and default firewallUpdate saved settingsMulti-threadedrun-panw-cmdExecutes arbitrary CLI commandsCommand line optionsPlatform independentSave key based auth preference, default user and default firewallUpdate saved settingsMulti-threadedUsageTo return a list of firewalls use theget-panw-firewallscommand:$ get-panw-firewalls
Host                                MgmtIP          Serial          Model           Uptime                  SwVersion
==============================      =============== ============    ========        ====================    =========
fw01.domain.com                     1.1.1.1         013999999999    PA-5220         208 days, 6:49:53       8.0.9
fw02.domain.com                     1.1.1.2         013999999998    PA-5220         208 days, 7:27:28       8.0.9To return a list of firewall hostnames use theget-panw-firewallscommand (suitable for piping to other commands):$ get-panw-firewalls -t
fw01.domain.com
fw02.domain.comTo return a list of firewall interfaces use theget-panw-interfacescommand:$ get-panw-interfaces fw01.domain.com
Firewall                    Interface               State   IpAddress
=========================   ====================    =====   ====================
fw01.domain.com             ethernet1/1             up      N/A
fw01.domain.com             ethernet1/12            up      N/A
fw01.domain.com             ethernet1/2             up      172.17.111.251/24
fw01.domain.com             ethernet1/21            up      N/A
fw01.domain.com             ethernet1/22            up      N/A
fw01.domain.com             ethernet1/5             up      172.19.222.206/28
fw01.domain.com             ethernet1/7             up      N/A
fw01.domain.com             ha1-a                   up      1.1.1.1/30
fw01.domain.com             ha1-b                   up      1.1.1.9/30
fw01.domain.com             hsci-a                  up      1.1.1.5/30
fw01.domain.com             hsci-b                  up      N/A
fw01.domain.com             tunnel                  up      N/A
fw01.domain.com             tunnel.1800             up      N/A
fw01.domain.com             vlan                    up      N/A

$ get-panw-firewalls -t | get-panw-interfaces
Firewall                    Interface               State   IpAddress
=========================   ====================    =====   ====================
fw01.domain.com             ethernet1/1             up      N/A
fw01.domain.com             ethernet1/12            up      N/A
fw01.domain.com             ethernet1/2             up      172.17.111.251/24
fw01.domain.com             ethernet1/21            up      N/A
fw01.domain.com             ethernet1/22            up      N/A
fw01.domain.com             ethernet1/5             up      172.19.222.206/28
fw01.domain.com             ethernet1/7             up      N/A
fw02.domain.com             ethernet1/1             up      N/A
fw02.domain.com             ethernet1/12            up      N/A
fw02.domain.com             ethernet1/2             up      172.17.111.251/24
fw02.domain.com             ethernet1/21            up      N/A
fw02.domain.com             ethernet1/22            up      N/A
fw02.domain.com             ethernet1/5             up      172.19.222.206/28
fw02.domain.com             ethernet1/7             up      N/ATo return the firewall configuration use theget-panw-configcommand:$ get-panw-config
============================
= fw01.domain.com =
============================
<response status="success"><result><config version="8.0.0" urldb="paloaltonetworks">
  <mgt-config>
    <users>
      <entry name="admin">
        <phash>xxxxx</phash>
        <permissions>
          <role-based>
            <superuser>yes</superuser>
          </role-based>
        </permissions>
      </entry>
      <entry name="user1">
        <permissions>
          <role-based>
            <superuser>yes</superuser>
          </role-based>
        </permissions>
        <phash>xxxxx</phash>
      </entry>
<--- Output truncated --->To return the configuration of multiple firewalls pipe the output ofget-panw-firewalls-tto theget-panw-configcommand:$ get-panw-firewalls -t | get-panw-config
============================
= fw01.domain.com =
============================
<response status="success"><result><config version="8.0.0" urldb="paloaltonetworks">
  <mgt-config>
    <users>
      <entry name="admin">
        <phash>xxxxx</phash>
        <permissions>
          <role-based>
            <superuser>yes</superuser>
          </role-based>
        </permissions>
      </entry>
      <entry name="user1">
        <permissions>
          <role-based>
            <superuser>yes</superuser>
          </role-based>
        </permissions>
        <phash>xxxxx</phash>
      </entry>
<--- Output truncated --->

============================
= fw02.domain.com =
============================
<response status="success"><result><config version="8.0.0" urldb="paloaltonetworks">
  <mgt-config>
    <users>
      <entry name="admin">
        <phash>xxxxx</phash>
        <permissions>
          <role-based>
            <superuser>yes</superuser>
          </role-based>
        </permissions>
      </entry>
      <entry name="user1">
        <permissions>
          <role-based>
            <superuser>yes</superuser>
          </role-based>
        </permissions>
        <phash>xxxxx</phash>
      </entry>
<--- Output truncated --->To return a portion of the firewall configuration use theget-panw-configcommand with the--xpathoption:get-panw-config --xpath "/config/mgt-config/users"
============================
= fw01.domain.com =
============================
<response status="success"><result><users>
  <entry name="admin">
    <phash>xxxxx</phash>
    <permissions>
      <role-based>
        <superuser>yes</superuser>
      </role-based>
    </permissions>
  </entry>
</users></result></response>To return the set configuration of multiple firewalls pipe the output ofget-panw-firewalls-tto theget-panw-configcommand:$ get-panw-firewalls -t | get-panw-config --format set | egrep "^=|virtual-router"
Collecting set configuration via ssh ...
============================
= fw01.domain.com =
============================
set network virtual-router default protocol bgp enable no
set network virtual-router default protocol bgp dampening-profile default cutoff 1.25
set network virtual-router default protocol bgp dampening-profile default reuse 0.5
set network virtual-router default protocol bgp dampening-profile default max-hold-time 900
set network virtual-router default protocol bgp dampening-profile default decay-half-life-reachable 300
set network virtual-router default protocol bgp dampening-profile default decay-half-life-unreachable 900
set network virtual-router default protocol bgp dampening-profile default enable yes
set network virtual-router default interface [ ethernet1/1 ]
set network virtual-router default routing-table ip static-route "Default Route" nexthop ip-address 192.168.197.254
set network virtual-router default routing-table ip static-route "Default Route" path-monitor enable no
set network virtual-router default routing-table ip static-route "Default Route" path-monitor failure-condition any
set network virtual-router default routing-table ip static-route "Default Route" path-monitor hold-time 2
set network virtual-router default routing-table ip static-route "Default Route" metric 10
set network virtual-router default routing-table ip static-route "Default Route" destination 0.0.0.0/0
set network virtual-router default routing-table ip static-route "Default Route" route-table unicast
============================
= fw02.domain.com =
============================
set network virtual-router default protocol bgp enable no
set network virtual-router default protocol bgp dampening-profile default cutoff 1.25
set network virtual-router default protocol bgp dampening-profile default reuse 0.5
set network virtual-router default protocol bgp dampening-profile default max-hold-time 900
set network virtual-router default protocol bgp dampening-profile default decay-half-life-reachable 300
set network virtual-router default protocol bgp dampening-profile default decay-half-life-unreachable 900
set network virtual-router default protocol bgp dampening-profile default enable yes
set network virtual-router default interface [ ethernet1/1 ]
set network virtual-router default routing-table ip static-route "Default Route" nexthop ip-address 10.69.26.62
set network virtual-router default routing-table ip static-route "Default Route" path-monitor enable no
set network virtual-router default routing-table ip static-route "Default Route" path-monitor failure-condition any
set network virtual-router default routing-table ip static-route "Default Route" path-monitor hold-time 2
set network virtual-router default routing-table ip static-route "Default Route" metric 10
set network virtual-router default routing-table ip static-route "Default Route" destination 0.0.0.0/0
set network virtual-router default routing-table ip static-route "Default Route" route-table unicastTo ping all interfaces in an “up” state with a 1 second timeout, count 1, filter HA subnets:$ get-panw-firewalls -t | grep fw01.domain.com | get-panw-interfaces --if-state up -t | grep -v 1.1.1. | xargs -n1 ping -c 1 -t 1
PING 10.170.196.241 (10.170.196.241): 56 data bytes
64 bytes from 10.170.196.241: icmp_seq=0 ttl=57 time=63.845 ms

--- 10.170.196.241 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 63.845/63.845/63.845/0.000 ms
PING 10.170.118.254 (10.170.118.254): 56 data bytes
64 bytes from 10.170.118.254: icmp_seq=0 ttl=57 time=63.471 ms

--- 10.170.118.254 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 63.471/63.471/63.471/0.000 ms
PING 10.171.119.254 (10.171.119.254): 56 data bytes
64 bytes from 10.171.119.254: icmp_seq=0 ttl=57 time=63.862 ms

--- 10.171.119.254 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 63.862/63.862/63.862/0.000 ms
PING 10.170.111.254 (10.170.111.254): 56 data bytes
64 bytes from 10.170.111.254: icmp_seq=0 ttl=57 time=63.931 ms

--- 10.170.111.254 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 63.931/63.931/63.931/0.000 ms
PING 10.170.92.126 (10.170.92.126): 56 data bytes
64 bytes from 10.170.92.126: icmp_seq=0 ttl=57 time=63.768 ms

--- 10.170.92.126 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 63.768/63.768/63.768/0.000 msHistory0.0.1 (2019-02-16)First release on PyPI.0.1.5 (2019-02-17)Update README.rst.Update descriptions.Implement helper command (panw-utils).0.1.6 (2019-02-17)Fix bug in saved settings update0.1.11 (2019-02-17)Configure Travis CI0.2.0 (2019-03-07)Added get-panw-config0.3.0 (2019-04-07)Implement concurrencyRedirect headers to sys.stderr to make grep friendlyAdd model, uptime and  software version to output0.4.0 (2019-04-12)Migrate from multi-processing to multi-threading0.5.0 (2019-04-13)Added run-panw-cmd0.6.0 (2020-09-14)Added status, MAC address, zone, virtual router and comment to get-panw-interfaces outputBumped requirements versions0.7.0 (2020-09-14)Convert get-panw-interfaces operational state to link state