Module: firewall¶
Inheritance diagram¶
Configuration tree diagram¶
Class Reference¶
Palo Alto Networks Firewall object
-
class
panos.firewall.
Firewall
(hostname=None, api_username=None, api_password=None, api_key=None, serial=None, port=443, vsys=None, is_virtual=None, multi_vsys=None, *args, **kwargs)[source]¶ A Palo Alto Networks Firewall
This object can represent a firewall physical chassis, virtual firewall, or individual vsys.
Parameters: - hostname – Hostname or IP of device for API connections
- api_username – Username of administrator to access API
- api_password – Password of administrator to access API
- api_key – The API Key for connecting to the device’s API
- serial – The serial number of this firewall
- port – Port of device for API connections
- vsys – The vsys of this firewall (eg. “vsys1”, “vsys2”, etc.)
- is_virtual (bool) – Physical or Virtual firewall
- timeout – The timeout for asynchronous jobs
- interval – The interval to check asynchronous jobs
-
apply
()[source]¶ Apply this object to the device, replacing any existing object of the same name
Modifies the live device
-
create
()[source]¶ Create this object on the device
Modifies the live device
This method is nondestructive. If the object exists, the variables are added to the device without changing existing variables on the device. If a variables already exists on the device and this object has a different value, the value on the firewall is changed to the value in this object.
-
element
()[source]¶ Construct an ElementTree for this PanObject and all its children
Parameters: - with_children (bool) – Include children in element.
- comparable (bool) – Element will be used in a comparison with another.
Returns: - An ElementTree instance representing the
xml form of this object and its children
Return type: xml.etree.ElementTree
-
op
(cmd=None, vsys=None, xml=False, cmd_xml=True, extra_qs=None, retry_on_peer=False, quote='"')[source]¶ Perform operational command on this Firewall
Operational commands are most any command that is not a debug or config command. These include many ‘show’ commands such as
show system info
.When passing the cmd as a command string (not XML) you must include any non-keyword strings in the command inside double quotes (
"
). Here’s some examples:# The string "facebook-base" must be in quotes because it is not a keyword fw.op('clear session all filter application "facebook-base"') # The string "ethernet1/1" must be in quotes because it is not a keyword fw.op('show interface "ethernet1/1"') # Using an alternative quote character to get DHCP info on ethernet1/1 fw.op('show dhcp client state `ethernet1/1`', quote='`')
Parameters: - cmd (str) – The operational command to execute
- vsys (str) – Vsys id. Defaults to the vsys of the firewall or the Vsys object in the parent tree.
- xml (bool) – Return value should be a string (Default: False)
- cmd_xml (bool) – True: cmd is not XML, False: cmd is XML (Default: True)
- extra_qs – Extra parameters for API call
- retry_on_peer (bool) – Try on active Firewall first, then try on passive Firewall
- quote (str) – The quote character when the supplied cmd is a string and cmd_xml=True
Returns: The result of the operational command. May also return a string of XML if xml=True
Return type: xml.etree.ElementTree
-
organize_into_vsys
(create_vsys_objects=True, refresh_vsys=True)[source]¶ Organizes all imported objects under the appropriate Vsys object.
Parameters: - create_vsys_objects (bool) – Create the vsys objects (True) or use the ones already connected to this firewall (False).
- refresh_vsys (bool) – Refresh all vsys objects’ parameters before doing the reorganization or not. This is assumed True if create_vsys_objects is True.
-
refreshall_from_xml
(xml, refresh_children=False, variables=None)[source]¶ Factory method to instantiate class from firewall config.
This method is a factory for the class. It takes an xml config from a firewall and generates instances of this class for each item this class represents in the xml config. For example, if the class is AddressObject and there are 5 address objects on the firewall, then this method will generate 5 instances of the class AddressObject.
Parameters: - xml (xml.etree.ElementTree) – A section of XML configuration from a firewall or Panorama. It should not contain the response or result tags.
- refresh_children (bool) – Refresh children objects or not.
- variables (iterable) – A list or tuple of the variables to parse
from the XML. Note that this is only used when invoked
against classes not derived from
VersionedPanObject
.
Returns: created instances of class
Return type: list
Set to True to act on the shared part of this firewall
-
state
= None¶ Panorama state variables refreshed by Panorama
-
vsys
¶ Return the vsys for this object
Traverses the tree to determine the vsys from a
panos.firewall.Firewall
orpanos.device.Vsys
instance somewhere before this node in the tree.Returns: The vsys id (eg. vsys2) Return type: str
-
class
panos.firewall.
FirewallCommit
(description=None, admins=None, exclude_device_and_network=False, exclude_shared_objects=False, exclude_policy_and_objects=False, force=False)[source]¶ Normalization of a firewall commit.
Instances of this class can be passed in to
Firewall.commit()
(inherited frompanos.base.PanDevice.commit()
) as thecmd
parameter.Parameters: - description (str) – The commit message.
- admins (list) – (PAN-OS 8.0+) List of admins whose changes are to be committed.
- exclude_device_and_network (bool) – Set to True to exclude device and network changes.
- exclude_shared_objects (bool) – Set to True to exclude shared objects changes.
- exclude_policy_and_objects (bool) – Set to True to exclude policy and objects changes.
- force (bool) – Set to True to force a commit even if one is not needed.