Table of Contents

• Getting Started
  • Helpful Background Information
  • Prerequisites
  • External Dependencies
  • Adapters
  • How to Install
  • Testing
• Using this Workflow Project
  • Activate Firewall - Palo Alto - Panorama - REST
  • Commit - Palo Alto - Panorama - REST
  • Create Security Post Rule - Palo Alto - Panorama - REST
  • Create Security Pre Rule - Palo Alto - Panorama - REST
  • Download Software on Firewall - Palo Alto - Panorama - REST
  • HA Pair Software Upgrade - Palo Alto - Panorama - REST
  • Install Software on Firewall - Palo Alto - Panorama - REST
  • Reboot Firewall - Palo Alto - Panorama - REST
  • Standalone Software Upgrade - Palo Alto - Panorama - REST
  • Suspend Firewall - Palo Alto - Panorama - REST
• Additional Information
  • Support

Getting Started

This section is helpful for deployments as it provides you with pertinent information on prerequisites and properties.

Helpful Background Information

Workflows often include logic that varies from business to business. As a result, we often find that our Workflow Projects are more useful as modular components that can be incorporated into a larger process. In addition, they often can add value as a learning tool on how we integrate with other systems and how we do things within the Itential Automation Platform.

While these can be utilized, you may find more value in using them as a starting point to build around.

Prerequisites

Itential Workflow Projects are built and tested on particular versions of IAP. In addition, Workflow Projects are often dependent on external systems and as such, these Workflow Projects will have dependencies on these other systems. This version of Palo Alto - Panorama - REST has been tested with:

• IAP 2023.1

External Dependencies

Adapters

How to Install

To install the Workflow Project:

• Verify you are running a supported version of the Itential Automation Platform (IAP) as listed above in the Supported IAP Versions section in order to install the Example Project.
• Import the Example Project in Admin Essentials.

Testing

Cypress is generally used to test all Itential Example Projects. While Cypress is an opensource tool, at Itential we have internal libraries that have been built around Cypress to allow us to test with a deployed IAP.

When certifying our Example Projects for a release of IAP we run these tests against the particular version of IAP and create a release branch in GitLab. If you do not see the Example Project available in your version of IAP please contact Itential.

While Itential tests this Example Project and its capabilities, it is often the case the customer environments offer their own unique circumstances. Therefore, it is our recommendation that you deploy this Example Project into a development/testing environment in which you can test the Example Project.

Using this Workflow Project

Workflow Projects contain 1 or more workflows. Each of these workflows have different inputs and outputs.

Activate Firewall - Palo Alto - Panorama - REST

Activate suspended firewall in Palo Alto Panorama

Capabilities include:

• The workflow is used to activate a suspended firewall in Palo Alto Panorama

Entry Point IAP Component

The primary IAP component to run Activate Firewall - Palo Alto - Panorama - REST is listed below:

Inputs

The following table lists the inputs for Activate Firewall - Palo Alto - Panorama - REST:

123456789876

panorama

Outputs

There are no outputs for Activate Firewall - Palo Alto - Panorama - REST.

Query Output

There are no query output examples for Activate Firewall - Palo Alto - Panorama - REST.

Example Inputs and Outputs

Example 1

Input:

{
  "serialNumber": "123456789876",
  "adapterId": "panorama"
} 

API Links

Commit - Palo Alto - Panorama - REST

Commit staged changes to Palo Alto Panorama

Capabilities include:

• Commits staged changes to Palo Alto Panorama.
• Displays commit error if failure occurs.

Entry Point IAP Component

The primary IAP component to run Commit - Palo Alto - Panorama - REST is listed below:

Inputs

The following table lists the inputs for Commit - Palo Alto - Panorama - REST:

panorama

Outputs

The following table lists the outputs for Commit - Palo Alto - Panorama - REST:

{
  "icode": "AD.200",
  "response": "Commit job enqueued with jobid 77"
}

Query Output

The following items show how to query successful results from the output of Commit - Palo Alto - Panorama - REST:

Commit Response

commitResult.response

Example Inputs and Outputs

Example 1

Input:

{
  "adapterId": "panorama"
} 

Output:

{
  "commitResult": {  
    "icode": "AD.200",
    "response": "Commit job enqueued with jobid 404404"
  }
} 

API Links

Create Security Post Rule - Palo Alto - Panorama - REST

Creates security post rule on Palo Alto Panorama

Capabilities include:

• Checks existence of security post rule and creates rule if none exists

Entry Point IAP Component

The primary IAP component to run Create Security Post Rule - Palo Alto - Panorama - REST is listed below:

Inputs

The following table lists the inputs for Create Security Post Rule - Palo Alto - Panorama - REST:

postRule1

Post Rule 1 description

shared

universal

Overnight

yes

yes

[
  {
    "member": "any"
  }
]

[
  {
    "member": "10.0.0.0"
  },
  {
    "member": "10.0.0.1"
  }
]

[
  {
    "member": "any"
  }
]

[
  {
    "member": "any"
  }
]

allow

panorama

Outputs

The following table lists the outputs for Create Security Post Rule - Palo Alto - Panorama - REST:

{
  "icode": "AD.200",
  "response": {
    "@status": "success",
    "@code": "20",
    "msg": "command succeeded"
  }
}

{
  "icode": "AD.200",
  "response": {
    "@status": "success",
    "@code": "19",
    "result": {
      "@total-count": "1",
      "@count": "1",
      "entry": [
        {
          "@name": "postRule3",
          "@uuid": "80b87da7-e289-4ee5-a6b5-42ebb69801f3",
          "@location": "shared",
          "from": {
            "member": [
              "any"
            ]
          },
          "to": {
            "member": [
              "10.10.0.99"
            ]
          },
          "source": {
            "member": [
              "10.10.1.99"
            ]
          },
          "source-user": {
            "member": [
              "any"
            ]
          },
          "destination": {
            "member": [
              "any"
            ]
          },
          "service": {
            "member": [
              "application-default"
            ]
          },
          "category": {
            "member": [
              "any"
            ]
          },
          "application": {
            "member": [
              "any"
            ]
          },
          "schedule": "Overnight",
          "negate-source": "no",
          "negate-destination": "no",
          "disabled": "no",
          "description": "Post Rule 3",
          "hip-profiles": {
            "member": [
              "any"
            ]
          },
          "action": "deny",
          "icmp-unreachable": "no",
          "rule-type": "universal",
          "option": {
            "disable-server-response-inspection": "no"
          },
          "log-start": "yes",
          "log-end": "no"
        }
      ]
    }
  }
}

{
  "icode": "AD.500",
  "response": {
    "code": 6,
    "message": "Name Not Unique",
    "details": [
      {
        "@type": "CauseInfo",
        "causes": [
          {
            "code": 9,
            "module": "panui_mgmt",
            "description": "Name Not Unique:  rule1 'rule1' is already in use."
          }
        ]
      }
    ]
  }
}

Query Output

The following items show how to query successful results from the output of Create Security Post Rule - Palo Alto - Panorama - REST:

Create Security Rules Result Status

createSecurityRulesResult.response.@status

Post-Check Result Status

postCheckResult.response.@status

The following items show how to query failure results from the output of Create Security Post Rule - Palo Alto - Panorama - REST:

Create Security Rules Error Message

createSecurityRulesError.response.message

Example Inputs and Outputs

Example 1

Input:

{
  "name": "postRule1",
  "description": "Post Rule 1 description",
  "ruleLocation": "shared",
  "ruleType": "universal",
  "schedule": "Overnight",
  "logStart": "yes",
  "logEnd": "yes",
  "fromMembers": [
    {
      "member": "any"
    }
  ],
  "toMembers": [
    {
      "member": "10.0.0.0"
    },
    {
      "member": "10.0.0.1"
    }
  ],
  "sourceMembers": [
    {
      "member": "any"
    }
  ],
  "destinationMembers": [
    {
      "member": "any"
    }
  ],
  "action": "allow",
  "adapterId": "panorama"
} 

Output:

{
  "createSecurityRulesResult": {
    "icode": "AD.200",
    "response": {
      "@status": "success",
      "@code": "20",
      "msg": "command succeeded"
    }
  },
  "postCheckResult": {
    "icode": "AD.200",
    "response": {
      "@status": "success",
      "@code": "19",
      "result": {
        "@total-count": "1",
        "@count": "1",
        "entry": [
          {
            "@name": "postRule1",
            "@uuid": "80b87da7-e289-4ee5-a6b5-42ebb69801f3",
            "@location": "shared",
            "from": {
              "member": [
                "any"
              ]
            },
            "to": {
              "member": [
                "10.10.0.99"
              ]
            },
            "source": {
              "member": [
                "10.10.1.99"
              ]
            },
            "source-user": {
              "member": [
                "any"
              ]
            },
            "destination": {
              "member": [
                "any"
              ]
            },
            "service": {
              "member": [
                "application-default"
              ]
            },
            "category": {
              "member": [
                "any"
              ]
            },
            "application": {
              "member": [
                "any"
              ]
            },
            "schedule": "Overnight",
            "negate-source": "no",
            "negate-destination": "no",
            "disabled": "no",
            "description": "Post Rule 1 description",
            "hip-profiles": {
              "member": [
                "any"
              ]
            },
            "action": "deny",
            "icmp-unreachable": "no",
            "rule-type": "universal",
            "option": {
              "disable-server-response-inspection": "no"
            },
            "log-start": "yes",
            "log-end": "no"
          }
        ]
      }
    }
  }
} 

API Links

Create Security Pre Rule - Palo Alto - Panorama - REST

Creates security pre rule on Palo Alto Panorama

Capabilities include:

• Checks existence of security pre rule and creates rule if none exists

Entry Point IAP Component

The primary IAP component to run Create Security Pre Rule - Palo Alto - Panorama - REST is listed below:

Inputs

The following table lists the inputs for Create Security Pre Rule - Palo Alto - Panorama - REST:

preRule1

Pre Rule 1 description

shared

universal

Overnight

yes

yes

[
  {
    "member": "any"
  }
]

[
  {
    "member": "10.0.0.0"
  },
  {
    "member": "10.0.0.1"
  }
]

[
  {
    "member": "any"
  }
]

[
  {
    "member": "any"
  }
]

allow

panorama

Outputs

The following table lists the outputs for Create Security Pre Rule - Palo Alto - Panorama - REST:

{
  "icode": "AD.200",
  "response": {
    "@status": "success",
    "@code": "20",
    "msg": "command succeeded"
  }
}

{
  "icode": "AD.200",
  "response": {
    "@status": "success",
    "@code": "19",
    "result": {
      "@total-count": "1",
      "@count": "1",
      "entry": [
        {
          "@name": "preRule1",
          "@uuid": "932b87ac-d6b1-4103-9a49-03cac901d815",
          "@location": "shared",
          "from": {
            "member": [
              "any"
            ]
          },
          "to": {
            "member": [
              "10.10.0.99"
            ]
          },
          "source": {
            "member": [
              "10.10.1.99"
            ]
          },
          "source-user": {
            "member": [
              "any"
            ]
          },
          "destination": {
            "member": [
              "any"
            ]
          },
          "service": {
            "member": [
              "application-default"
            ]
          },
          "category": {
            "member": [
              "any"
            ]
          },
          "application": {
            "member": [
              "any"
            ]
          },
          "schedule": "Overnight",
          "negate-source": "no",
          "negate-destination": "no",
          "disabled": "no",
          "description": "Pre Rule 1 description",
          "hip-profiles": {
            "member": [
              "any"
            ]
          },
          "action": "deny",
          "icmp-unreachable": "no",
          "rule-type": "universal",
          "option": {
            "disable-server-response-inspection": "no"
          },
          "log-start": "yes",
          "log-end": "yes"
        }
      ]
    }
  }
}

{
  "icode": "AD.500",
  "response": {
    "code": 6,
    "message": "Name Not Unique",
    "details": [
      {
        "@type": "CauseInfo",
        "causes": [
          {
            "code": 9,
            "module": "panui_mgmt",
            "description": "Name Not Unique:  rule1 'rule1' is already in use."
          }
        ]
      }
    ]
  }
}

Query Output

The following items show how to query successful results from the output of Create Security Pre Rule - Palo Alto - Panorama - REST:

Create Security Rules Result Status

createSecurityRulesResult.response.@status

Post-Check Result Status

postCheckResult.response.@status

The following items show how to query failure results from the output of Create Security Pre Rule - Palo Alto - Panorama - REST:

Create Security Rules Error Message

createSecurityRulesError.response.message

Example Inputs and Outputs

Example 1

Input:

{
  "name": "preRule1",
  "description": "Pre Rule 1 description",
  "ruleLocation": "shared",
  "ruleType": "universal",
  "schedule": "Overnight",
  "logStart": "yes",
  "logEnd": "yes",
  "fromMembers": [
    {
      "member": "any"
    }
  ],
  "toMembers": [
    {
      "member": "10.0.0.0"
    },
    {
      "member": "10.0.0.1"
    }
  ],
  "sourceMembers": [
    {
      "member": "any"
    }
  ],
  "destinationMembers": [
    {
      "member": "any"
    }
  ],
  "action": "allow",
  "adapterId": "panorama"
} 

Output:

{
  "createSecurityRulesError": {
    "icode": "AD.200",
    "response": {
      "@status": "success",
      "@code": "20",
      "msg": "command succeeded"
    }
  },
  "postCheckResult": {
    "icode": "AD.200",
    "response": {
      "@status": "success",
      "@code": "19",
      "result": {
        "@total-count": "1",
        "@count": "1",
        "entry": [
          {
            "@name": "preRule1",
            "@uuid": "932b87ac-d6b1-4103-9a49-03cac901d815",
            "@location": "shared",
            "from": {
              "member": [
                "any"
              ]
            },
            "to": {
              "member": [
                "10.10.0.99"
              ]
            },
            "source": {
              "member": [
                "10.10.1.99"
              ]
            },
            "source-user": {
              "member": [
                "any"
              ]
            },
            "destination": {
              "member": [
                "any"
              ]
            },
            "service": {
              "member": [
                "application-default"
              ]
            },
            "category": {
              "member": [
                "any"
              ]
            },
            "application": {
              "member": [
                "any"
              ]
            },
            "schedule": "Overnight",
            "negate-source": "no",
            "negate-destination": "no",
            "disabled": "no",
            "description": "Pre Rule 1 description",
            "hip-profiles": {
              "member": [
                "any"
              ]
            },
            "action": "deny",
            "icmp-unreachable": "no",
            "rule-type": "universal",
            "option": {
              "disable-server-response-inspection": "no"
            },
            "log-start": "yes",
            "log-end": "yes"
          }
        ]
      }
    }
  }
} 

API Links

Download Software on Firewall - Palo Alto - Panorama - REST

Download the software to the firewall in Palo Alto Panorama

Capabilities include:

• The workflow is used to download the software to the firewall in Palo Alto Panorama

Entry Point IAP Component

The primary IAP component to run Download Software on Firewall - Palo Alto - Panorama - REST is listed below:

Inputs

The following table lists the inputs for Download Software on Firewall - Palo Alto - Panorama - REST:

123456789876

10.0.0

panorama

Outputs

There are no outputs for Download Software on Firewall - Palo Alto - Panorama - REST.

Query Output

There are no query output examples for Download Software on Firewall - Palo Alto - Panorama - REST.

Example Inputs and Outputs

Example 1

Input:

{
  "serialNumber": "123456789876",
  "adapterId": "panorama",
  "softwareVersion": "10.0.0"
} 

API Links

HA Pair Software Upgrade - Palo Alto - Panorama - REST

Upgrade PAN-OS on a firewall set up as active-passive high-availability (HA) pair in Palo Alto Panorama

Capabilities include:

• The workflow is used to upgrade PAN-OS on a firewall set up as active-passive high-availability (HA) pair in Palo Alto Panorama

Entry Point IAP Component

The primary IAP component to run HA Pair Software Upgrade - Palo Alto - Panorama - REST is listed below:

Inputs

The following table lists the inputs for HA Pair Software Upgrade - Palo Alto - Panorama - REST:

10.0.0

FW-A

panorama

Outputs

There are no outputs for HA Pair Software Upgrade - Palo Alto - Panorama - REST.

Query Output

There are no query output examples for HA Pair Software Upgrade - Palo Alto - Panorama - REST.

Example Inputs and Outputs

Example 1

Input:

{
  "targetVersion": "10.0.0",
  "firewall": "FW-A",
  "adapterId": "panorama"
} 

API Links

Install Software on Firewall - Palo Alto - Panorama - REST

Install the software on the firewall in Palo Alto Panorama

Capabilities include:

• The workflow is used to install the software on the firewall in Palo Alto Panorama

Entry Point IAP Component

The primary IAP component to run Install Software on Firewall - Palo Alto - Panorama - REST is listed below:

Inputs

The following table lists the inputs for Install Software on Firewall - Palo Alto - Panorama - REST:

123456789876

10.0.0

panorama

Outputs

There are no outputs for Install Software on Firewall - Palo Alto - Panorama - REST.

Query Output

There are no query output examples for Install Software on Firewall - Palo Alto - Panorama - REST.

Example Inputs and Outputs

Example 1

Input:

{
  "serialNumber": "123456789876",
  "adapterId": "panorama",
  "softwareVersion": "10.0.0"
} 

API Links

Reboot Firewall - Palo Alto - Panorama - REST

Reboot the firewall in Palo Alto Panorama

Capabilities include:

• The workflow is used to reboot a firewall in Palo Alto Panorama

Entry Point IAP Component

The primary IAP component to run Reboot Firewall - Palo Alto - Panorama - REST is listed below:

Inputs

The following table lists the inputs for Reboot Firewall - Palo Alto - Panorama - REST:

123456789876

panorama

Outputs

There are no outputs for Reboot Firewall - Palo Alto - Panorama - REST.

Query Output

There are no query output examples for Reboot Firewall - Palo Alto - Panorama - REST.

Example Inputs and Outputs

Example 1

Input:

{
  "serialNumber": "123456789876",
  "adapterId": "panorama"
} 

API Links

Standalone Software Upgrade - Palo Alto - Panorama - REST

Upgrade a firewall to a software version in Palo Alto Panorama

Capabilities include:

• The workflow is used to upgrade a firewall to a software version in Palo Alto Panorama

Entry Point IAP Component

The primary IAP component to run Standalone Software Upgrade - Palo Alto - Panorama - REST is listed below:

Inputs

The following table lists the inputs for Standalone Software Upgrade - Palo Alto - Panorama - REST:

123456789876

10.0.0

LAB-FW3.xml

LAB-FW3

panorama

Outputs

There are no outputs for Standalone Software Upgrade - Palo Alto - Panorama - REST.

Query Output

There are no query output examples for Standalone Software Upgrade - Palo Alto - Panorama - REST.

Example Inputs and Outputs

Example 1

Input:

{
  "backupFilename": "LAB-FW3.xml",
  "deviceName": "LAB-FW3",
  "softwareVersion": "10.0.0",
  "serialNumber": "123456789876",
  "adapterId": "panorama"
} 

API Links

Suspend Firewall - Palo Alto - Panorama - REST

Suspend an active firewall in Palo Alto Panorama

Capabilities include:

• The workflow is used to suspend an active firewall in Palo Alto Panorama

Entry Point IAP Component

The primary IAP component to run Suspend Firewall - Palo Alto - Panorama - REST is listed below:

Inputs

The following table lists the inputs for Suspend Firewall - Palo Alto - Panorama - REST:

123456789876

panorama

Outputs

There are no outputs for Suspend Firewall - Palo Alto - Panorama - REST.

Query Output

There are no query output examples for Suspend Firewall - Palo Alto - Panorama - REST.

Example Inputs and Outputs

Example 1

Input:

{
  "serialNumber": "123456789876",
  "adapterId": "panorama"
} 

API Links

Additional Information

Support

Please use your Itential Customer Success account if you need support when using this Workflow Project.

Itential Documents:

Related Items:

Adapters