salt.modules.panos¶

Module to provide Palo Alto compatibility to Salt

codeauthor: Spencer Ervin <spencer_ervin@hotmail.com>
maturity: new
depends: none
platform: unix

New in version 2018.3.0.

Configuration¶

This module accepts connection configuration details either as parameters, or as configuration settings in pillar as a Salt proxy. Options passed into opts will be ignored if options are passed into pillar.

About¶

This execution module was designed to handle connections to a Palo Alto based firewall. This module adds support to send connections directly to the device through the XML API or through a brokered connection to Panorama.

salt.modules.panos.add_config_lock()¶

Prevent other users from changing configuration until the lock is released.

CLI Example:

salt '*' panos.add_config_lock

salt.modules.panos.check_antivirus()¶

Get anti-virus information from PaloAlto Networks server

CLI Example:

salt '*' panos.check_antivirus

salt.modules.panos.check_software()¶

Get software information from PaloAlto Networks server.

CLI Example:

salt '*' panos.check_software

salt.modules.panos.clear_commit_tasks()¶

Clear all commit tasks.

CLI Example:

salt '*' panos.clear_commit_tasks

salt.modules.panos.commit()¶

Commits the candidate configuration to the running configuration.

CLI Example:

salt '*' panos.commit

salt.modules.panos.deactivate_license(key_name=None)¶

Deactivates an installed license. Required version 7.0.0 or greater.

key_name(str): The file name of the license key installed.

CLI Example:

salt '*' panos.deactivate_license key_name=License_File_Name.key

salt.modules.panos.delete_license(key_name=None)¶

Remove license keys on disk.

key_name(str): The file name of the license key to be deleted.

CLI Example:

salt '*' panos.delete_license key_name=License_File_Name.key

salt.modules.panos.download_antivirus()¶

Download the most recent anti-virus package.

CLI Example:

salt '*' panos.download_antivirus

salt.modules.panos.download_software_file(filename=None, synch=False)¶

Download software packages by filename.

Parameters

filename (str) -- The filename of the PANOS file to download.
synch (bool) -- If true then the file will synch to the peer unit.

CLI Example:

salt '*' panos.download_software_file PanOS_5000-8.0.0
salt '*' panos.download_software_file PanOS_5000-8.0.0 True

salt.modules.panos.download_software_version(version=None, synch=False)¶

Download software packages by version number.

Parameters

version (str) -- The version of the PANOS file to download.
synch (bool) -- If true then the file will synch to the peer unit.

CLI Example:

salt '*' panos.download_software_version 8.0.0
salt '*' panos.download_software_version 8.0.0 True

salt.modules.panos.fetch_license(auth_code=None)¶

Get new license(s) using from the Palo Alto Network Server.

auth_code: The license authorization code.

CLI Example:

salt '*' panos.fetch_license
salt '*' panos.fetch_license auth_code=foobar

salt.modules.panos.get_address(address=None, vsys='1')¶

Get the candidate configuration for the specified get_address object. This will not return address objects that are marked as pre-defined objects.

address(str): The name of the address object.

vsys(str): The string representation of the VSYS ID.

CLI Example:

salt '*' panos.get_address myhost
salt '*' panos.get_address myhost 3

salt.modules.panos.get_address_group(addressgroup=None, vsys='1')¶

Get the candidate configuration for the specified address group. This will not return address groups that are marked as pre-defined objects.

addressgroup(str): The name of the address group.

vsys(str): The string representation of the VSYS ID.

CLI Example:

salt '*' panos.get_address_group foobar
salt '*' panos.get_address_group foobar 3

salt.modules.panos.get_admins_active()¶

Show active administrators.

CLI Example:

salt '*' panos.get_admins_active

salt.modules.panos.get_admins_all()¶

Show all administrators.

CLI Example:

salt '*' panos.get_admins_all

salt.modules.panos.get_antivirus_info()¶

Show information about available anti-virus packages.

CLI Example:

salt '*' panos.get_antivirus_info

salt.modules.panos.get_arp()¶

Show ARP information.

CLI Example:

salt '*' panos.get_arp

salt.modules.panos.get_cli_idle_timeout()¶

Show timeout information for this administrative session.

CLI Example:

salt '*' panos.get_cli_idle_timeout

salt.modules.panos.get_cli_permissions()¶

Show cli administrative permissions.

CLI Example:

salt '*' panos.get_cli_permissions

salt.modules.panos.get_disk_usage()¶

Report filesystem disk space usage.

CLI Example:

salt '*' panos.get_disk_usage

salt.modules.panos.get_dns_server_config()¶

Get the DNS server configuration from the candidate configuration.

CLI Example:

salt '*' panos.get_dns_server_config

salt.modules.panos.get_domain_config()¶

Get the domain name configuration from the candidate configuration.

CLI Example:

salt '*' panos.get_domain_config

salt.modules.panos.get_dos_blocks()¶

Show the DoS block-ip table.

CLI Example:

salt '*' panos.get_dos_blocks

salt.modules.panos.get_fqdn_cache()¶

Print FQDNs used in rules and their IPs.

CLI Example:

salt '*' panos.get_fqdn_cache

salt.modules.panos.get_ha_config()¶

Get the high availability configuration.

CLI Example:

salt '*' panos.get_ha_config

salt.modules.panos.get_ha_link()¶

Show high-availability link-monitoring state.

CLI Example:

salt '*' panos.get_ha_link

salt.modules.panos.get_ha_path()¶

Show high-availability path-monitoring state.

CLI Example:

salt '*' panos.get_ha_path

salt.modules.panos.get_ha_state()¶

Show high-availability state information.

CLI Example:

salt '*' panos.get_ha_state

salt.modules.panos.get_ha_transitions()¶

Show high-availability transition statistic information.

CLI Example:

salt '*' panos.get_ha_transitions

salt.modules.panos.get_hostname()¶

Get the hostname of the device.

CLI Example:

salt '*' panos.get_hostname

salt.modules.panos.get_interface_counters(name='all')¶

Get the counter statistics for interfaces.

Parameters: name (str) -- The name of the interface to view. By default, all interface statistics are viewed.

CLI Example:

salt '*' panos.get_interface_counters
salt '*' panos.get_interface_counters ethernet1/1

salt.modules.panos.get_interfaces(name='all')¶

Show interface information.

Parameters: name (str) -- The name of the interface to view. By default, all interface statistics are viewed.

CLI Example:

salt '*' panos.get_interfaces
salt '*' panos.get_interfaces ethernet1/1

salt.modules.panos.get_job(jid=None)¶

List all a single job by ID.

jid: The ID of the job to retrieve.

CLI Example:

salt '*' panos.get_job jid=15

salt.modules.panos.get_jobs(state='all')¶

List all jobs on the device.

state: The state of the jobs to display. Valid options are all, pending, or processed. Pending jobs are jobs that are currently in a running or waiting state. Processed jobs are jobs that have completed execution.

CLI Example:

salt '*' panos.get_jobs
salt '*' panos.get_jobs state=pending

salt.modules.panos.get_lacp()¶

Show LACP state.

CLI Example:

salt '*' panos.get_lacp

salt.modules.panos.get_license_info()¶

Show information about owned license(s).

CLI Example:

salt '*' panos.get_license_info

salt.modules.panos.get_license_tokens()¶

Show license token files for manual license deactivation.

CLI Example:

salt '*' panos.get_license_tokens

salt.modules.panos.get_lldp_config()¶

Show lldp config for interfaces.

CLI Example:

salt '*' panos.get_lldp_config

salt.modules.panos.get_lldp_counters()¶

Show lldp counters for interfaces.

CLI Example:

salt '*' panos.get_lldp_counters

salt.modules.panos.get_lldp_local()¶

Show lldp local info for interfaces.

CLI Example:

salt '*' panos.get_lldp_local

salt.modules.panos.get_lldp_neighbors()¶

Show lldp neighbors info for interfaces.

CLI Example:

salt '*' panos.get_lldp_neighbors

salt.modules.panos.get_local_admins()¶

Show all local administrator accounts.

CLI Example:

salt '*' panos.get_local_admins

salt.modules.panos.get_logdb_quota()¶

Report the logdb quotas.

CLI Example:

salt '*' panos.get_logdb_quota

salt.modules.panos.get_master_key()¶

Get the master key properties.

CLI Example:

salt '*' panos.get_master_key

salt.modules.panos.get_ntp_config()¶

Get the NTP configuration from the candidate configuration.

CLI Example:

salt '*' panos.get_ntp_config

salt.modules.panos.get_ntp_servers()¶

Get list of configured NTP servers.

CLI Example:

salt '*' panos.get_ntp_servers

salt.modules.panos.get_operational_mode()¶

Show device operational mode setting.

CLI Example:

salt '*' panos.get_operational_mode

salt.modules.panos.get_panorama_status()¶

Show panorama connection status.

CLI Example:

salt '*' panos.get_panorama_status

salt.modules.panos.get_permitted_ips()¶

Get the IP addresses that are permitted to establish management connections to the device.

CLI Example:

salt '*' panos.get_permitted_ips

salt.modules.panos.get_platform()¶

Get the platform model information and limitations.

CLI Example:

salt '*' panos.get_platform

salt.modules.panos.get_predefined_application(application=None)¶

Get the configuration for the specified pre-defined application object. This will only return pre-defined application objects.

application(str): The name of the pre-defined application object.

CLI Example:

salt '*' panos.get_predefined_application saltstack

salt.modules.panos.get_security_rule(rulename=None, vsys='1')¶

Get the candidate configuration for the specified security rule.

rulename(str): The name of the security rule.

vsys(str): The string representation of the VSYS ID.

CLI Example:

salt '*' panos.get_security_rule rule01
salt '*' panos.get_security_rule rule01 3

salt.modules.panos.get_service(service=None, vsys='1')¶

Get the candidate configuration for the specified service object. This will not return services that are marked as pre-defined objects.

service(str): The name of the service object.

vsys(str): The string representation of the VSYS ID.

CLI Example:

salt '*' panos.get_service tcp-443
salt '*' panos.get_service tcp-443 3

salt.modules.panos.get_service_group(servicegroup=None, vsys='1')¶

Get the candidate configuration for the specified service group. This will not return service groups that are marked as pre-defined objects.

servicegroup(str): The name of the service group.

vsys(str): The string representation of the VSYS ID.

CLI Example:

salt '*' panos.get_service_group foobar
salt '*' panos.get_service_group foobar 3

salt.modules.panos.get_session_info()¶

Show device session statistics.

CLI Example:

salt '*' panos.get_session_info

salt.modules.panos.get_snmp_config()¶

Get the SNMP configuration from the device.

CLI Example:

salt '*' panos.get_snmp_config

salt.modules.panos.get_software_info()¶

Show information about available software packages.

CLI Example:

salt '*' panos.get_software_info

salt.modules.panos.get_system_date_time()¶

Get the system date/time.

CLI Example:

salt '*' panos.get_system_date_time

salt.modules.panos.get_system_files()¶

List important files in the system.

CLI Example:

salt '*' panos.get_system_files

salt.modules.panos.get_system_info()¶

Get the system information.

CLI Example:

salt '*' panos.get_system_info

salt.modules.panos.get_system_services()¶

Show system services.

CLI Example:

salt '*' panos.get_system_services

salt.modules.panos.get_system_state(mask=None)¶

Show the system state variables.

mask: Filters by a subtree or a wildcard.

CLI Example:

salt '*' panos.get_system_state
salt '*' panos.get_system_state mask=cfg.ha.config.enabled
salt '*' panos.get_system_state mask=cfg.ha.*

salt.modules.panos.get_uncommitted_changes()¶

Retrieve a list of all uncommitted changes on the device. Requires PANOS version 8.0.0 or greater.

CLI Example:

salt '*' panos.get_uncommitted_changes

salt.modules.panos.get_users_config()¶

Get the local administrative user account configuration.

CLI Example:

salt '*' panos.get_users_config

salt.modules.panos.get_vlans()¶

Show all VLAN information.

CLI Example:

salt '*' panos.get_vlans

salt.modules.panos.get_xpath(xpath='')¶

Retrieve a specified xpath from the candidate configuration.

xpath(str): The specified xpath in the candidate configuration.

CLI Example:

salt '*' panos.get_xpath /config/shared/service

salt.modules.panos.get_zone(zone='', vsys='1')¶

Get the candidate configuration for the specified zone.

zone(str): The name of the zone.

vsys(str): The string representation of the VSYS ID.

CLI Example:

salt '*' panos.get_zone trust
salt '*' panos.get_zone trust 2

salt.modules.panos.get_zones(vsys='1')¶

Get all the zones in the candidate configuration.

vsys(str): The string representation of the VSYS ID.

CLI Example:

salt '*' panos.get_zones
salt '*' panos.get_zones 2

salt.modules.panos.install_antivirus(version=None, latest=False, synch=False, skip_commit=False)¶

Install anti-virus packages.

Parameters

version (str) -- The version of the PANOS file to install.
latest (bool) -- If true, the latest anti-virus file will be installed. The specified version option will be ignored.
synch (bool) -- If true, the anti-virus will synch to the peer unit.
skip_commit (bool) -- If true, the install will skip committing to the device.

CLI Example:

salt '*' panos.install_antivirus 8.0.0

salt.modules.panos.install_license()¶

Install the license key(s).

CLI Example:

salt '*' panos.install_license

salt.modules.panos.install_software(version=None)¶

Upgrade to a software package by version.

Parameters: version (str) -- The version of the PANOS file to install.

CLI Example:

salt '*' panos.install_license 8.0.0

salt.modules.panos.reboot()¶

Reboot a running system.

CLI Example:

salt '*' panos.reboot

salt.modules.panos.refresh_fqdn_cache(force=False)¶

Force refreshes all FQDNs used in rules.

force: Forces all fqdn refresh

CLI Example:

salt '*' panos.refresh_fqdn_cache
salt '*' panos.refresh_fqdn_cache force=True

salt.modules.panos.remove_config_lock()¶

Release config lock previously held.

CLI Example:

salt '*' panos.remove_config_lock

salt.modules.panos.resolve_address(address=None, vsys=None)¶

Resolve address to ip address. Required version 7.0.0 or greater.

address: Address name you want to resolve.
vsys: The vsys name.

CLI Example:

salt '*' panos.resolve_address foo.bar.com
salt '*' panos.resolve_address foo.bar.com vsys=2

salt.modules.panos.save_device_config(filename=None)¶

Save device configuration to a named file.

filename: The filename to save the configuration to.

CLI Example:

salt '*' panos.save_device_config foo.xml

salt.modules.panos.save_device_state()¶

Save files needed to restore device to local disk.

CLI Example:

salt '*' panos.save_device_state

salt.modules.panos.set_authentication_profile(profile=None, deploy=False)¶

Set the authentication profile of the Palo Alto proxy minion. A commit will be required before this is processed.

CLI Example:

Parameters

profile (str) -- The name of the authentication profile to set.
deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

salt '*' panos.set_authentication_profile foo
salt '*' panos.set_authentication_profile foo deploy=True

salt.modules.panos.set_hostname(hostname=None, deploy=False)¶

Set the hostname of the Palo Alto proxy minion. A commit will be required before this is processed.

CLI Example:

Parameters

hostname (str) -- The hostname to set
deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

salt '*' panos.set_hostname newhostname
salt '*' panos.set_hostname newhostname deploy=True

salt.modules.panos.set_management_http(enabled=True, deploy=False)¶

Enables or disables the HTTP management service on the device.

CLI Example:

Parameters

enabled (bool) -- If true the service will be enabled. If false the service will be disabled.
deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

salt '*' panos.set_management_http
salt '*' panos.set_management_http enabled=False deploy=True

salt.modules.panos.set_management_https(enabled=True, deploy=False)¶

Enables or disables the HTTPS management service on the device.

CLI Example:

Parameters

enabled (bool) -- If true the service will be enabled. If false the service will be disabled.
deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

salt '*' panos.set_management_https
salt '*' panos.set_management_https enabled=False deploy=True

salt.modules.panos.set_management_icmp(enabled=True, deploy=False)¶

Enables or disables the ICMP management service on the device.

CLI Example:

Parameters

enabled (bool) -- If true the service will be enabled. If false the service will be disabled.
deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

salt '*' panos.set_management_icmp
salt '*' panos.set_management_icmp enabled=False deploy=True

salt.modules.panos.set_management_ocsp(enabled=True, deploy=False)¶

Enables or disables the HTTP OCSP management service on the device.

CLI Example:

Parameters

enabled (bool) -- If true the service will be enabled. If false the service will be disabled.
deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

salt '*' panos.set_management_ocsp
salt '*' panos.set_management_ocsp enabled=False deploy=True

salt.modules.panos.set_management_snmp(enabled=True, deploy=False)¶

Enables or disables the SNMP management service on the device.

CLI Example:

Parameters

enabled (bool) -- If true the service will be enabled. If false the service will be disabled.
deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

salt '*' panos.set_management_snmp
salt '*' panos.set_management_snmp enabled=False deploy=True

salt.modules.panos.set_management_ssh(enabled=True, deploy=False)¶

Enables or disables the SSH management service on the device.

CLI Example:

Parameters

enabled (bool) -- If true the service will be enabled. If false the service will be disabled.
deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

salt '*' panos.set_management_ssh
salt '*' panos.set_management_ssh enabled=False deploy=True

salt.modules.panos.set_management_telnet(enabled=True, deploy=False)¶

Enables or disables the Telnet management service on the device.

CLI Example:

Parameters

enabled (bool) -- If true the service will be enabled. If false the service will be disabled.
deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

salt '*' panos.set_management_telnet
salt '*' panos.set_management_telnet enabled=False deploy=True

salt.modules.panos.set_ntp_authentication(target=None, authentication_type=None, key_id=None, authentication_key=None, algorithm=None, deploy=False)¶

Set the NTP authentication of the Palo Alto proxy minion. A commit will be required before this is processed.

CLI Example:

Parameters

target (str) -- Determines the target of the authentication. Valid options are primary, secondary, or both.
authentication_type (str) -- The authentication type to be used. Valid options are symmetric, autokey, and none.
key_id (int) -- The NTP authentication key ID.
authentication_key (str) -- The authentication key.
algorithm (str) -- The algorithm type to be used for a symmetric key. Valid options are md5 and sha1.
deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

salt '*' ntp.set_authentication target=both authentication_type=autokey
salt '*' ntp.set_authentication target=primary authentication_type=none
salt '*' ntp.set_authentication target=both authentication_type=symmetric key_id=15 authentication_key=mykey algorithm=md5
salt '*' ntp.set_authentication target=both authentication_type=symmetric key_id=15 authentication_key=mykey algorithm=md5 deploy=True

salt.modules.panos.set_ntp_servers(primary_server=None, secondary_server=None, deploy=False)¶

Set the NTP servers of the Palo Alto proxy minion. A commit will be required before this is processed.

CLI Example:

Parameters

primary_server (str) -- The primary NTP server IP address or FQDN.
secondary_server (str) -- The secondary NTP server IP address or FQDN.
deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

salt '*' ntp.set_servers 0.pool.ntp.org 1.pool.ntp.org
salt '*' ntp.set_servers primary_server=0.pool.ntp.org secondary_server=1.pool.ntp.org
salt '*' ntp.ser_servers 0.pool.ntp.org 1.pool.ntp.org deploy=True

salt.modules.panos.set_permitted_ip(address=None, deploy=False)¶

Add an IPv4 address or network to the permitted IP list.

CLI Example:

Parameters

address (str) -- The IPv4 address or network to allow access to add to the Palo Alto device.
deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

salt '*' panos.set_permitted_ip 10.0.0.1
salt '*' panos.set_permitted_ip 10.0.0.0/24
salt '*' panos.set_permitted_ip 10.0.0.1 deploy=True

salt.modules.panos.set_timezone(tz=None, deploy=False)¶

Set the timezone of the Palo Alto proxy minion. A commit will be required before this is processed.

CLI Example:

Parameters

tz (str) -- The name of the timezone to set.
deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

salt '*' panos.set_timezone UTC
salt '*' panos.set_timezone UTC deploy=True

salt.modules.panos.shutdown()¶

Shutdown a running system.

CLI Example:

salt '*' panos.shutdown

salt.modules.panos.test_fib_route(ip=None, vr='vr1')¶

Perform a route lookup within active route table (fib).

ip (str): The destination IP address to test.

vr (str): The name of the virtual router to test.

CLI Example:

salt '*' panos.test_fib_route 4.2.2.2
salt '*' panos.test_fib_route 4.2.2.2 my-vr

salt.modules.panos.test_security_policy(sourcezone=None, destinationzone=None, source=None, destination=None, protocol=None, port=None, application=None, category=None, vsys='1', allrules=False)¶

Checks which security policy as connection will match on the device.

sourcezone (str): The source zone matched against the connection.

destinationzone (str): The destination zone matched against the connection.

source (str): The source address. This must be a single IP address.

destination (str): The destination address. This must be a single IP address.

protocol (int): The protocol number for the connection. This is the numerical representation of the protocol.

port (int): The port number for the connection.

application (str): The application that should be matched.

category (str): The category that should be matched.

vsys (int): The numerical representation of the VSYS ID.

allrules (bool): Show all potential match rules until first allow rule.

CLI Example:

salt '*' panos.test_security_policy sourcezone=trust destinationzone=untrust protocol=6 port=22
salt '*' panos.test_security_policy sourcezone=trust destinationzone=untrust protocol=6 port=22 vsys=2

salt.modules.panos.unlock_admin(username=None)¶

Unlocks a locked administrator account.

username: Username of the administrator.

CLI Example:

salt '*' panos.unlock_admin username=bob

Generated on August 05, 2021 at 04:04:00 UTC.

You are viewing docs for the previous stable release, 3000.9. Switch to docs for the latest stable release, 3003.1, or to a recent doc build from the master branch.

saltstack.com