panos

package module
v0.0.0-...-70bc7b1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 30, 2017 License: MIT Imports: 12 Imported by: 0

README

go-panos

GoDoc Travis-CI license

A Go package that interacts with Palo Alto devices using their XML API. For official package documentation, please visit the Godoc page.

This API allows you to do the following:

  • List various types of objects: address, service, custom-url-category, device-groups, policies, tags, templates, managed devices (Panorama), etc..
  • Create, rename, and delete objects
  • Create multiple address objects at once by using a CSV file.
    • You can also specify which device-group you want the object to be created under, as well as tag them.
  • Create, apply, and remove tags from objects
  • Edit/modify address, service groups and custom-url-categories
  • Create templates, template stacks and assign devices and templates to them (Panorama)
  • Commit configurations and commit to device-groups (Panorama)
  • Apply a log forwarding or security profile to an entire policy or individual rules.
  • Manipulate the configuration using Xpath functions.

The following features are currently available only on the local firewall:

  • Create interfaces (including sub-interfaces), zones, vlans, virtual-wires, virtual-routers and static routes.
    • Delete operation on the above as well.
  • Add and remove interfaces to zones, vlans and virtual-routers.
  • Test URL's to see what they are being categorized under.
  • Test route lookup.

Installation

go get -u github.com/scottdware/go-panos

Usage

import "github.com/scottdware/go-panos"

Establishing A Session

There are two ways you can authenticate to a device: username and password, or using the API key. Here is an example of both methods.

// Username and password
creds := panos.AuthMethod{
    Credentials: []string{"admin", "password"},
}

pan, err := panos.NewSession("pan-firewall.company.com", &creds)
if err != nil {
    fmt.Println(err)
}

// API key
creds := panos.AuthMethod{
    APIKey: "Awholemessofrandomcharactersandnumbers1234567890=",
}

pan, err := panos.NewSession("panorama.company.com", &creds)
if err != nil {
    fmt.Println(err)
}

Configuration Using Xpath

Outside of the built in functions that make working with the configuration simpler, there are also functions that allow you to modify any part of the configuration using Xpath. The following configuration actions are supported:

show, get, set, edit, delete, rename, override, move, clone, multi-move, multi-clone

NOTE: For specific examples of how to use xpath values when using these actions, visit the PAN-OS XML API configuration API.

The above actions are used in the following go-panos functions:

XpathConfig(), XpathGetConfig(), XpathClone(), XpathMove(), XpathMulti()

NOTE: These functions are more suited for "power users," as there is a lot more that you have to know in regards to Xpath and XML.

Handling Shared objects on Panorama

By default, when you establish a session to a Panorama server, all object creation will be in the device-group you specify. If you want to create them as shared, you need to first tell your session that shared objects will be preferred by doing the following:

// Establish a session
creds := panos.AuthMethod{
    Credentials: []string{"admin", "password"},
}

pan, err := panos.NewSession("panorama.company.com", &creds)
if err != nil {
    fmt.Println(err)
}

// Enable shared object creation
pan.SetShared(true)

// Create an address object
pan.CreateAddress("test-ipv4-obj", "ip", "1.1.1.2/32", "A test object")

// Turn off shared object creation
pan.SetShared(false)

Examples

Establish a session to a Panorama device

creds := panos.AuthMethod{
    Credentials: []string{"admin", "password"},
}

pan, err := panos.NewSession("panorama.company.com", &creds)
if err != nil {
    fmt.Println(err)
}

// Add a device to Panorama.
pan.AddDevice("00102345678")

// Create a device-group on Panorama, and add the device from above.
pan.CreateDeviceGroup("Some-DeviceGroup", "", "00102345678")

Create address objects via CSV

This example shows you how to create multiple address objects using a CSV file. You can also do object overrides by creating an object in a parent device-group, then creating the same object in a child device-group. Tagging objects upon creating is supported as well.

The CSV file should be organized with the following columns: name,type,address,description,device-group,tag. The type field must be one of the following values: ip, range, or fqdn. the description field is optional, as is the tag field.

Let's assume we have a CSV file called web-servers.csv that looks like the following:

web-server,ip,10.1.1.1,,Corporate,web-servers
web-server,ip,10.5.5.10,,Branch-Office

Whereas the Corporate device-group is a parent of Branch-Office.

// Connect to Panorama
creds := panos.AuthMethod{
    Credentials: []string{"admin", "password"},
}

pan, err := panos.NewSession("panorama.company.com", &creds)
if err != nil {
    fmt.Println(err)
}

pan.CreateAddressFromCsv("web-servers.csv")

This will create the web-server object (10.1.1.1) on the Corporate device-group, and the same web-server object with an object-override IP of 10.5.5.10 on the Branch-Office device-group.

Documentation

Overview

Package panos interacts with Palo Alto and Panorama devices using the XML API.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type ARPEntry 

type ARPEntry struct {
	Status     string `xml:"status"`
	IPAddress  string `xml:"ip"`
	MACAddress string `xml:"mac"`
	TTL        int    `xml:"ttl"`
	Interface  string `xml:"interface"`
	Port       string `xml:"port"`
}

ARPEntry contains information about each individual ARP entry.

type ARPTable 

type ARPTable struct {
	XMLName        xml.Name   `xml:"response"`
	MaxEntries     int        `xml:"result>max"`
	TotalEntries   int        `xml:"result>total"`
	DefaultTimeout int        `xml:"result>timeout"`
	Entries        []ARPEntry `xml:"result>entries>entry"`
}

ARPTable contains information about all of the ARP entries on the device.

type Address 

type Address struct {
	Name        string `xml:"name,attr"`
	IPAddress   string `xml:"ip-netmask,omitempty"`
	IPRange     string `xml:"ip-range,omitempty"`
	FQDN        string `xml:"fqdn,omitempty"`
	Description string `xml:"description,omitempty"`
}

Address contains information about each individual address object.

type AddressGroup 

type AddressGroup struct {
	Name          string
	Type          string
	Members       []string
	DynamicFilter string
	Description   string
}

AddressGroup contains information about each individual address group.

type AddressGroups 

type AddressGroups struct {
	Groups []AddressGroup
}

AddressGroups contains a slice of all address groups.

type AddressObjects 

type AddressObjects struct {
	XMLName   xml.Name  `xml:"response"`
	Status    string    `xml:"status,attr"`
	Code      string    `xml:"code,attr"`
	Addresses []Address `xml:"result>address>entry"`
}

AddressObjects contains a slice of all address objects.

type AuthMethod 

type AuthMethod struct {
	Credentials []string
	APIKey      string
}

AuthMethod defines how we want to authenticate to the device. If using a username and password to authenticate, the Credentials field must contain the username and password , respectively (i.e. []string{"admin", "password"}). If you are using the API key for authentication, provide the entire key for the APIKey field.

type CustomURL 

type CustomURL struct {
	Name        string   `xml:"name,attr"`
	Description string   `xml:"description,omitempty"`
	Members     []string `xml:"list>member,omitempty"`
}

CustomURL contains information about each individual custom URL category object.

type DeviceGroup 

type DeviceGroup struct {
	Name    string   `xml:"name,attr"`
	Devices []Serial `xml:"devices>entry"`
}

DeviceGroup contains information about each individual device-group.

type DeviceGroups 

type DeviceGroups struct {
	XMLName xml.Name      `xml:"response"`
	Status  string        `xml:"status,attr"`
	Code    string        `xml:"code,attr"`
	Groups  []DeviceGroup `xml:"result>device-group>entry"`
}

DeviceGroups lists all of the device-group's in Panorama.

type Devices 

type Devices struct {
	XMLName xml.Name `xml:"response"`
	Status  string   `xml:"status,attr"`
	Code    string   `xml:"code,attr"`
	Devices []Serial `xml:"result>devices>entry"`
}

Devices lists all of the devices in Panorama.

type Job 

type Job struct {
	ID            int      `xml:"id"`
	User          string   `xml:"user"`
	Type          string   `xml:"type"`
	Status        string   `xml:"status"`
	Queued        string   `xml:"queued"`
	Stoppable     string   `xml:"stoppable"`
	Result        string   `xml:"result"`
	Description   string   `xml:"description,omitempty"`
	QueuePosition int      `xml:"positionInQ"`
	Progress      string   `xml:"progress"`
	Details       []string `xml:"details>line"`
	Warnings      string   `xml:"warnings,omitempty"`
	StartTime     string   `xml:"tdeq"`
	EndTime       string   `xml:"tfin"`
}

Job holds information about each individual job.

type Jobs 

type Jobs struct {
	XMLName xml.Name `xml:"response"`
	Status  string   `xml:"status,attr"`
	Code    string   `xml:"code,attr"`
	Jobs    []Job    `xml:"result>job"`
}

Jobs holds information about all jobs on the device.

type PaloAlto 

type PaloAlto struct {
	Host            string
	Key             string
	URI             string
	Platform        string
	Model           string
	Serial          string
	SoftwareVersion string
	DeviceType      string
	Panorama        bool
	Shared          bool
}

PaloAlto is a container for our session state.

func NewSession 

func NewSession(host string, authmethod *AuthMethod) (*PaloAlto, error)

NewSession sets up our connection to the Palo Alto firewall or Panorama device. The authmethod parameter is used to define two ways of authenticating to the device. One is via username / password, the other is with the API key if you already have generated it. Please see the documentation for the AuthMethod struct for further details.

func (*PaloAlto) ARPTable 

func (p *PaloAlto) ARPTable(option ...string) (*ARPTable, error)

ARPTable will gather all of the ARP entires on the device. Without any parameters, it will return all ARP entries. You can specify an interface name for the option parameter if you choose to only view the ARP entries for that specific interface (i.e. "ethernet1/1.200" or "ethernet1/21"). Status codes are as follows: s - static, c - complete, e - expiring, i - incomplete.

func (*PaloAlto) AddDevice 

func (p *PaloAlto) AddDevice(serial string, devicegroup ...string) error

AddDevice will add a new device to a Panorama. If you specify the optional devicegroup parameter, it will also add the device to the given device-group.

func (*PaloAlto) AddInterfaceToVirtualRouter 

func (p *PaloAlto) AddInterfaceToVirtualRouter(vr, ifname string) error

AddInterfaceToVirtualRouter will add an interface or interfaces to the given virtual-router. Separate multiple interfaces using a comma, i.e.: "ethernet1/2, ethernet1/3"

func (*PaloAlto) AddInterfaceToVlan 

func (p *PaloAlto) AddInterfaceToVlan(vlan, ifname string) error

AddInterfaceToVlan will add an interface or interfaces to the given vlan. Separate multiple interfaces using a comma, i.e.: "ethernet1/2, ethernet1/3"

func (*PaloAlto) AddInterfaceToZone 

func (p *PaloAlto) AddInterfaceToZone(name, zonetype, ifname string) error

AddInterfaceToZone adds an interface or interfaces to the given zone. zonetype must be one of: tap, vwire, layer2, layer3. Separate multiple interfaces using a comma, i.e.: "ethernet1/2, ethernet1/3"

func (*PaloAlto) AddressGroups 

func (p *PaloAlto) AddressGroups(devicegroup ...string) (*AddressGroups, error)

AddressGroups returns information about all of the address groups. You can (optionally) specify a device-group when ran against a Panorama device. If no device-group is specified, then all address groups are returned, including shared objects if run against a Panorama device.

func (*PaloAlto) Addresses 

func (p *PaloAlto) Addresses(devicegroup ...string) (*AddressObjects, error)

Addresses returns information about all of the address objects. You can (optionally) specify a device-group when ran against a Panorama device. If no device-group is specified, then all objects are returned, including shared objects if run against a Panorama device.

func (*PaloAlto) ApplyLogForwardingProfile 

func (p *PaloAlto) ApplyLogForwardingProfile(logprofile, devicegroup string, rule ...string) error

ApplyLogForwardingProfile will apply a Log Forwarding profile to every rule in the policy for the given device-group. If you wish to apply it to a single rule, instead of every rule in the policy, you can optionally specify the rule name as the last parameter. For policies with a large number of rules, this process may take a few minutes to complete.

func (*PaloAlto) ApplySecurityProfile 

func (p *PaloAlto) ApplySecurityProfile(secprofiles *SecurityProfiles, devicegroup string, rule ...string) error

ApplySecurityProfile will apply the following security profiles: URL Filtering, File-Blocking, Antivirus, Anti-Spyware, Vulnerability, Wildfire to every rule in the policy for the given device-group. If you wish to apply it to a single rule, instead of every rule in the policy, you can optionally specify the rule name as the last parameter. You can also specify a security group profile instead of individual profiles. This is done by ONLY populating the "Group" field in the SecurityProfiles struct. For policies with a large number of rules, this process may take a few minutes to complete.

func (*PaloAlto) AssignTemplate 

func (p *PaloAlto) AssignTemplate(name, devices string, stack bool) error

AssignTemplate will assign devices to the given template. Devices must be serial numbers, and each serial must be separated by a comma, i.e.: "010101010101, 020202020202." If you are assigning devices to a template stack, then specify "true" for the stack parameter, otherwise specifying "false" will only assign devices to a single template. Template stacks are ONLY available on Panorama version 7.0.0 and higher.

func (*PaloAlto) Commit 

func (p *PaloAlto) Commit() error

Commit issues a commit on the device. When issuing a commit against a Panorama device, the configuration will only be committed to Panorama, and not an individual device-group.

func (*PaloAlto) CommitAll 

func (p *PaloAlto) CommitAll(devicegroup string, devices ...string) error

CommitAll issues a commit to a Panorama device, with the given devicegroup. You can (optionally) specify individual devices within that device group by adding each serial number as an additional parameter.

func (*PaloAlto) CreateAddress 

func (p *PaloAlto) CreateAddress(name, addrtype, address, description string, devicegroup ...string) error

CreateAddress will add a new address object to the device. Addrtype should be one of: ip, range, or fqdn. If creating an address object on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) CreateAddressFromCsv 

func (p *PaloAlto) CreateAddressFromCsv(file string) error

CreateAddressFromCsv takes a CSV file with the following format: name,type,address,description,device-group,tag. Name is what you want the address object to be called. Type is one of: ip, range, or fqdn. Address is the IP address of the object. Description is optional, just leave the field blank if you do not want one. Device-group is the name of the device-group where you want the address object created under. Tag is the name of the tag that you wish to apply to the object. If you are creating shared objects in Panorama, or you are creating objects on a local device, then you can leave the device-group field blank.

func (*PaloAlto) CreateAddressGroup 

func (p *PaloAlto) CreateAddressGroup(name string, members []string, description string, devicegroup ...string) error

CreateAddressGroup will create a new static address group on the device. You can specify members to add by using a []string variable (i.e. members := []string{"server1", "server2"}). If creating an address group on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) CreateDeviceGroup 

func (p *PaloAlto) CreateDeviceGroup(name, description string, devices []string) error

CreateDeviceGroup will create a new device-group on a Panorama device. You can add devices as well by specifying the serial numbers in a string slice ([]string). Specify "nil" if you do not wish to add any.

func (*PaloAlto) CreateDynamicAddressGroup 

func (p *PaloAlto) CreateDynamicAddressGroup(name, criteria, description string, devicegroup ...string) error

CreateDynamicAddressGroup will create a new dynamic address group on the device. The filter must be written like so: 'vm-servers' and 'some tag' or 'pcs' - using the tags as the match criteria. If creating dynamic address group on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) CreateExternalDynamicList 

func (p *PaloAlto) CreateExternalDynamicList(listtype string, name string, url string, recurrance *Recurrance, devicegroup ...string) error

CreateExternalDynamicList will create an external dynamic list on the device. Listtype must be one of: ip, domain, or url. Configuring the recurrance requires you to use the Recurrance struct when passing the configuration for this parameter - please see the documentation for that struct. If creating an EDL on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) CreateInterface 

func (p *PaloAlto) CreateInterface(iftype, ifname, comment string, ipaddr ...string) error

CreateInterface creates the given interface type specified in the "iftype" parameter: tap, vwire, layer2, layer3, vlan, loopback or tunnel. If adding a sub-interface, be sure to append the VLAN tag to the interface name like so: ethernet1/1.700. The (optional) ipaddr parameter allows you to assign an IP address to a layer 3/vlan/loopback or tunnel interface, or an IP classifier to a virtual-wire sub-interface. You do not need to specify the ipaddr parameter on a "tap" or "layer2" interface type. Note that you must specify the subnet mask in CIDR notation when including an IP address, i.e.: 1.1.1.1/24.

func (*PaloAlto) CreateLayer3Interface 

func (p *PaloAlto) CreateLayer3Interface(ifname, ipaddress string, comment ...string) error

CreateLayer3Interface adds a new layer-3 interface or sub-interface to the device. If adding a sub-interface, be sure to append the VLAN tag to the interface name like so: ethernet1/1.700. You must specify the subnet mask in CIDR notation when specifying the IP address, i.e.: 1.1.1.1/32.

func (*PaloAlto) CreateService 

func (p *PaloAlto) CreateService(name, protocol, port, description string, devicegroup ...string) error

CreateService adds a new service object to the device. Port can be a single port number, range (1-65535), or comma separated (80, 8080, 443). If creating a service on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) CreateServiceGroup 

func (p *PaloAlto) CreateServiceGroup(name string, members []string, devicegroup ...string) error

CreateServiceGroup will create a new service group on the device. You can specify members to add by using a []string variable (i.e. members := []string{"tcp-service1", "udp-service1"}). If creating a service group on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) CreateStaticRoute 

func (p *PaloAlto) CreateStaticRoute(vr, name, destination, nexthop string, metric ...int) error

CreateStaticRoute adds a new static route to a given virtual-router. For the destination, you must include the mask, i.e. "192.168.0.0/24" or "0.0.0.0/0." For nexthop, you can also specify an interface instead of an IP address. You can optionally specify a metric for the route (default metric is 10).

func (*PaloAlto) CreateTag 

func (p *PaloAlto) CreateTag(name, color, comments string, devicegroup ...string) error

CreateTag will add a new tag to the device. You can use the following colors: Red, Green, Blue, Yellow, Copper, Orange, Purple, Gray, Light Green, Cyan, Light Gray, Blue Gray, Lime, Black, Gold, Brown. If creating a tag on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) CreateTemplate 

func (p *PaloAlto) CreateTemplate(name, description string, devices ...string) error

CreateTemplate adds a new template to Panorama. If you wish to associate devices, then separate their serial numbers with a comma, i.e.: "0101010101, 0202020202."

func (*PaloAlto) CreateTemplateStack 

func (p *PaloAlto) CreateTemplateStack(name, description, templates string, devices ...string) error

CreateTemplateStack adds a new template stack to Panorama. If you are assigning multiple templates to the stack, the values for the templates parameter must be separated by a comma, i.e.: "user_template, object_template". If you wish to associate devices, then separate their serial numbers with a comma, just like you would template names. This is ONLY available on Panorama version 7.0.0 and higher.

func (*PaloAlto) CreateURLCategory 

func (p *PaloAlto) CreateURLCategory(name string, urls []string, description string, devicegroup ...string) error

CreateURLCategory creates a custom URL category to be used in a policy. When specifying multiple URL's, use a []string variable for the url parameter (i.e. members := []string{"www.*.com", "*.somesite.net"}). If creating a URL category on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) CreateVirtualRouter 

func (p *PaloAlto) CreateVirtualRouter(name string) error

CreateVirtualRouter will add a new virtual-router to the device.

func (*PaloAlto) CreateVlan 

func (p *PaloAlto) CreateVlan(name string, vlaninterface ...string) error

CreateVlan will add a new layer 2 vlan to the device. Optionally, if you wish to assign a vlan interface to the vlan, specify the interface name as the last parameter. Otherwise, only specify the name of the vlan when creating it.

func (*PaloAlto) CreateVwire 

func (p *PaloAlto) CreateVwire(name, interface1, interface2, tagallowed string) error

CreateVwire creates a virtual-wire on the device. For the tagallowed parameter, enter integers (e.g. 10) or ranges (100-200) separated by commas (e.g. 1-10,15,20-30). Integer values can be between 0 and 4094.

func (*PaloAlto) CreateZone 

func (p *PaloAlto) CreateZone(name, zonetype string, userid bool) error

CreateZone will add a new zone to the device. Zonetype must be one of: tap, vwire, layer2, layer3. If you wish to enable user-id on the zone, specify "true" for the userid parameter, "false" if not.

func (*PaloAlto) DeleteAddress 

func (p *PaloAlto) DeleteAddress(name string, devicegroup ...string) error

DeleteAddress will remove an address object from the device. If deleting an address object on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) DeleteAddressGroup 

func (p *PaloAlto) DeleteAddressGroup(name string, devicegroup ...string) error

DeleteAddressGroup will remove an address group from the device. If deleting an address group on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) DeleteDeviceGroup 

func (p *PaloAlto) DeleteDeviceGroup(name string) error

DeleteDeviceGroup will delete the given device-group from Panorama.

func (*PaloAlto) DeleteExternalDynamicList 

func (p *PaloAlto) DeleteExternalDynamicList(name string, devicegroup ...string) error

DeleteExternalDynamicList removes an external dynamic list from the device. If deleting an EDL on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) DeleteInterface 

func (p *PaloAlto) DeleteInterface(iftype, ifname string) error

DeleteInterface removes an interface or sub-interface from the device. You must specify the interface type in the iftype parameter: tap, vwire, layer2, layer3, vlan, loopback or tunnel.

func (*PaloAlto) DeleteService 

func (p *PaloAlto) DeleteService(name string, devicegroup ...string) error

DeleteService will remove a service object from the device. If deleting a service on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) DeleteServiceGroup 

func (p *PaloAlto) DeleteServiceGroup(name string, devicegroup ...string) error

DeleteServiceGroup will remove a service group from the device. If deleting a service group on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) DeleteStaticRoute 

func (p *PaloAlto) DeleteStaticRoute(vr, name string) error

DeleteStaticRoute will remove a static route from the device.

func (*PaloAlto) DeleteTag 

func (p *PaloAlto) DeleteTag(name string, devicegroup ...string) error

DeleteTag will remove a tag from the device. If deleting a tag on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) DeleteTemplate 

func (p *PaloAlto) DeleteTemplate(name string, stack bool) error

DeleteTemplate removes the given template from Panorama. If you wish to delete a template stack, then specify "true" for the stack parameter, otherwise specifying "false" will only delete single templates. Template stacks are ONLY available on Panorama version 7.0.0 and higher.

func (*PaloAlto) DeleteURLCategory 

func (p *PaloAlto) DeleteURLCategory(name string, devicegroup ...string) error

DeleteURLCategory removes a custom URL category from the device. If deleting a URL category on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) DeleteVirtualRouter 

func (p *PaloAlto) DeleteVirtualRouter(vr string) error

DeleteVirtualRouter removes a virtual-router from the device.

func (*PaloAlto) DeleteVlan 

func (p *PaloAlto) DeleteVlan(vlan string) error

DeleteVlan removes a vlan from the device.

func (*PaloAlto) DeleteVwire 

func (p *PaloAlto) DeleteVwire(name string) error

DeleteVwire removes a virtual-wire from the device.

func (*PaloAlto) DeleteZone 

func (p *PaloAlto) DeleteZone(name string) error

DeleteZone will remove a zone from the device.

func (*PaloAlto) DeviceGroups 

func (p *PaloAlto) DeviceGroups() (*DeviceGroups, error)

DeviceGroups returns information about all of the device-groups in Panorama, and what devices are linked to them.

func (*PaloAlto) Devices 

func (p *PaloAlto) Devices() (*Devices, error)

Devices returns information about all of the devices that are managed by Panorama.

func (*PaloAlto) EditGroup 

func (p *PaloAlto) EditGroup(objecttype, action, object, group string, devicegroup ...string) error

EditGroup will add or remove objects from the specified group type (i.e., "address" or "service"). Action must be "add" or "remove." If editing a group on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) EditURLCategory 

func (p *PaloAlto) EditURLCategory(action, url, name string, devicegroup ...string) error

EditURLCategory adds or removes URL's from the given custom URL category. Action must be "add" or "remove." If editing a URL category on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) Jobs 

func (p *PaloAlto) Jobs(status interface{}) (*Jobs, error)

Jobs returns information about every job on the device. Status can be one of: all, pending, or processed. If you want information about a specific job, specify the job ID instead of one of the other options.

func (*PaloAlto) Policy 

func (p *PaloAlto) Policy(devicegroup string) (*Policy, error)

Policy returns information about the security policies for the given device-group. If you have pre and/or post rules, then both of them will be returned. They are separated under a "Pre" and "Post" field in the returned "Policy" struct.

func (*PaloAlto) RemoveDevice 

func (p *PaloAlto) RemoveDevice(serial string, devicegroup ...string) error

RemoveDevice will remove a device from Panorama. If you specify the optional devicegroup parameter, it will only remove the device from the given device-group.

func (*PaloAlto) RemoveInterfaceFromVirtualRouter 

func (p *PaloAlto) RemoveInterfaceFromVirtualRouter(vr, ifname string) error

RemoveInterfaceFromVirtualRouter removes a given interface from the specified virtual-router.

func (*PaloAlto) RemoveInterfaceFromVlan 

func (p *PaloAlto) RemoveInterfaceFromVlan(vlan, ifname string) error

RemoveInterfaceFromVlan removes a given interface from the specified vlan.

func (*PaloAlto) RemoveInterfaceFromZone 

func (p *PaloAlto) RemoveInterfaceFromZone(name, zonetype, ifname string) error

RemoveInterfaceFromZone removes an interface from the specified zone.

func (*PaloAlto) RemoveTag 

func (p *PaloAlto) RemoveTag(tag, object string, devicegroup ...string) error

RemoveTag will remove a single tag from an address/service object. If removing a tag on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) RenameObject 

func (p *PaloAlto) RenameObject(oldname, newname string, devicegroup ...string) error

RenameObject will rename the given object from oldname to the newname. You can rename the following object types: address, address-groups, service, service-groups, tags. If renaming objects on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) RestartSystem 

func (p *PaloAlto) RestartSystem() error

RestartSystem will issue a system restart to the device.

func (*PaloAlto) ServiceGroups 

func (p *PaloAlto) ServiceGroups(devicegroup ...string) (*ServiceGroups, error)

ServiceGroups returns information about all of the service groups. You can (optionally) specify a device-group when ran against a Panorama device. If no device-group is specified, then all service groups are returned, including shared objects if ran against a Panorama device.

func (*PaloAlto) Services 

func (p *PaloAlto) Services(devicegroup ...string) (*ServiceObjects, error)

Services returns information about all of the service objects. You can (optionally) specify a device-group when ran against a Panorama device. If no device-group is specified, then all objects are returned, including shared objects if ran against a Panorama device.

func (*PaloAlto) SetPanoramaServer 

func (p *PaloAlto) SetPanoramaServer(primary string, secondary ...string) error

SetPanoramaServer will configure a device to be managed by the given Panorama server's primary IP address. You can optionally add a second Panorama server by specifying an IP address for the "secondary" parameter.

func (*PaloAlto) SetShared 

func (p *PaloAlto) SetShared(shared bool)

SetShared will set Panorama's device-group to shared for all subsequent configuration changes. For example, if you set this to "true" and then create address or service objects, they will all be shared objects. Set this back to "false" to return to normal mode.

func (*PaloAlto) TagObject 

func (p *PaloAlto) TagObject(tag, object string, devicegroup ...string) error

TagObject will apply the given tag to the specified address or service object(s). You can specify multiple tags by separating them with a comma, i.e. "servers, vm". If you have address/service objects with the same name, then the tag(s) will be applied to all that match. If tagging objects on a Panorama device, specify the device-group as the last parameter.

func (*PaloAlto) Tags 

func (p *PaloAlto) Tags() (*Tags, error)

Tags returns information about all tags on the system.

func (*PaloAlto) TemplateStacks 

func (p *PaloAlto) TemplateStacks() (*TemplateStacks, error)

TemplateStacks returns information about all of the template stacks in Panorama, and what templates, devices are assigned to them. This is ONLY available on Panorama version 7.0.0 and higher.

func (*PaloAlto) Templates 

func (p *PaloAlto) Templates() (*Templates, error)

Templates returns information about all of the templates in Panorama, and what devices they are applied to.

func (*PaloAlto) TestRouteLookup 

func (p *PaloAlto) TestRouteLookup(vr, destination string) (string, error)

TestRouteLookup will lookup the given destination IP in the virtual-router "vr" and check the routing (fib) table and display the results.

func (*PaloAlto) TestURL 

func (p *PaloAlto) TestURL(url string) ([]string, error)

TestURL will verify what category the given URL falls under. It will return two results in a string slice ([]string). The first one is from the Base db categorization, and the second is from the Cloud db categorization. If you specify a URL with a wildcard, such as *.paloaltonetworks.com, it will not return a result.

func (*PaloAlto) URLCategory 

func (p *PaloAlto) URLCategory(devicegroup ...string) (*URLCategory, error)

URLCategory returns a list of all custom URL category objects. You can (optionally) specify a device-group when ran against a Panorama device. If no device-group is specified, then all objects are returned.

func (*PaloAlto) XpathClone 

func (p *PaloAlto) XpathClone(xpath, from, newname string) error

XpathClone allows you to clone an existing part of the devices configuration. Use the xpath parameter to specify the location of the object to be cloned. Use the from parameter to specify the source object, and the newname parameter to provide a name for the cloned object.

func (*PaloAlto) XpathConfig 

func (p *PaloAlto) XpathConfig(action, xpath string, element ...string) error

XpathConfig allows you to configure the device using an Xpath expression for the given xpath parameter. The element parameter can either be an XML file or an XML string when configuring the device. The action parameter can be one of: set, edit, rename, override or delete. Set actions add, update, or merge configuration nodes, while edit actions replace configuration nodes - use the edit action with caution! If you are renaming an object, specify the new name for the object in the element parameter. If you are deleting a part of the configuration, you do not need the element parameter. For all other actions you will need to provide it.

func (*PaloAlto) XpathGetConfig 

func (p *PaloAlto) XpathGetConfig(configtype, xpath string) (string, error)

XpathGetConfig allows you to view the active or candidate configuration at the location specified in the xpath parameter.

func (*PaloAlto) XpathMove 

func (p *PaloAlto) XpathMove(xpath, where string, destination ...string) error

XpathMove allows you to move the location of an existing configuration object. Use the xpath parameter to specify the location of the object to be moved, and the where parameter to specify type of move. You can optionally use the destination parameter to specify the destination path.

func (*PaloAlto) XpathMulti 

func (p *PaloAlto) XpathMulti(action, xpath, element string) error

XpathMulti allows you to move and clone addresses across device groups and virtual systems. The element parameter can be either an XML file or XML string. The action parameter must be one of: clone or move. The xpath parameter is for the destination where the addresses will be moved to. The element parameter must include in the XML the xpath for the source and the list of objects within the specified source.

type Policy 

type Policy struct {
	Pre  []Rule
	Post []Rule
}

Policy lists all of the security rules for a given device-group.

type Recurrance 

type Recurrance struct {
	Method     string
	DayOfWeek  string
	DayOfMonth int
	Hour       string
}

Recurrance contains the information for external dynamic lists when it comes to how often they are downloaded. Method must be one of: five-minute, hourly, daily, weekly, monthly. DayOfWeek is the name of the day, such as "tuesday." DayOfMonth is specified as a number, ranging from 1-31. Hour must be in 23-hour format, such as "03" for 3 am. The hourly and five-minute methods do not require any additional fields. DayOfWeek and DayOfMonth both require the Hour field as well.

type Rule 

type Rule struct {
	Name                 string   `xml:"name,attr"`
	From                 string   `xml:"from>member"`
	To                   string   `xml:"to>member"`
	Source               []string `xml:"source>member"`
	Destination          []string `xml:"destination>member"`
	SourceUser           []string `xml:"source-user>member"`
	Application          []string `xml:"application>member"`
	Service              []string `xml:"service>member"`
	Category             []string `xml:"category>member"`
	Action               string   `xml:"action"`
	LogStart             string   `xml:"log-start"`
	LogEnd               string   `xml:"log-end"`
	Tag                  []string `xml:"tag>member"`
	LogSetting           string   `xml:"log-setting"`
	URLFilteringProfile  string   `xml:"profile-setting>profiles>url-filtering>member"`
	FileBlockingProfile  string   `xml:"profile-setting>profiles>file-blocking>member"`
	AntiVirusProfile     string   `xml:"profile-setting>profiles>virus>member"`
	AntiSpywareProfile   string   `xml:"profile-setting>profiles>spyware>member"`
	VulnerabilityProfile string   `xml:"profile-setting>profiles>vulnerability>member"`
	WildfireProfile      string   `xml:"profile-setting>profiles>wildfire-analysis>member"`
	SecurityProfileGroup string   `xml:"profile-setting>group>member"`
}

Rule contains information about each individual security rule.

type SecurityProfiles 

type SecurityProfiles struct {
	URLFiltering  string
	FileBlocking  string
	AntiVirus     string
	AntiSpyware   string
	Vulnerability string
	Wildfire      string
	Group         string
}

SecurityProfiles contains a list of security profiles to apply to a rule. If you have a security group then you can just specify that and omit the individual ones.

type Serial 

type Serial struct {
	Serial string `xml:"name,attr"`
}

Serial contains the serial number of each device in the device-group.

type Service 

type Service struct {
	Name        string `xml:"name,attr"`
	TCPPort     string `xml:"protocol>tcp>port,omitempty"`
	UDPPort     string `xml:"protocol>udp>port,omitempty"`
	Description string `xml:"description,omitempty"`
}

Service contains information about each individual service object.

type ServiceGroup 

type ServiceGroup struct {
	Name        string   `xml:"name,attr"`
	Members     []string `xml:"members>member,omitempty"`
	Description string   `xml:"description,omitempty"`
}

ServiceGroup contains information about each individual service group.

type ServiceGroups 

type ServiceGroups struct {
	XMLName xml.Name       `xml:"response"`
	Status  string         `xml:"status,attr"`
	Code    string         `xml:"code,attr"`
	Groups  []ServiceGroup `xml:"result>service-group>entry"`
}

ServiceGroups contains a slice of all service groups.

type ServiceObjects 

type ServiceObjects struct {
	XMLName  xml.Name  `xml:"response"`
	Status   string    `xml:"status,attr"`
	Code     string    `xml:"code,attr"`
	Services []Service `xml:"result>service>entry"`
}

ServiceObjects contains a slice of all service objects.

type Tag 

type Tag struct {
	Name     string
	Color    string
	Comments string
}

Tag contains information about each individual tag.

type Tags 

type Tags struct {
	Tags []Tag
}

Tags contains information about all tags on the system.

type Template 

type Template struct {
	Name        string   `xml:"name,attr"`
	Description string   `xml:"description"`
	Devices     []Serial `xml:"devices>entry"`
}

Template contains information about each individual template.

type TemplateStack 

type TemplateStack struct {
	Name        string   `xml:"name,attr"`
	Description string   `xml:"description"`
	Members     []string `xml:"templates>member"`
	Devices     []Serial `xml:"devices>entry"`
}

TemplateStack contains information about each individual template stack.

type TemplateStacks 

type TemplateStacks struct {
	XMLName   xml.Name        `xml:"response"`
	Status    string          `xml:"status,attr"`
	Code      string          `xml:"code,attr"`
	Templates []TemplateStack `xml:"result>template-stack>entry"`
}

TemplateStacks lists all of the template stacks in Panorama.

type Templates 

type Templates struct {
	XMLName   xml.Name   `xml:"response"`
	Status    string     `xml:"status,attr"`
	Code      string     `xml:"code,attr"`
	Templates []Template `xml:"result>template>entry"`
}

Templates lists all of the templates in Panorama.

type URLCategory 

type URLCategory struct {
	XMLName xml.Name    `xml:"response"`
	Status  string      `xml:"status,attr"`
	Code    string      `xml:"code,attr"`
	URLs    []CustomURL `xml:"result>custom-url-category>entry"`
}

URLCategory contains a slice of all custom URL category objects.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.