Module paloalto

Module to configure panorama and panos devices

  • License: ASL 2.0

  • Version: 0.2.1

Typedefs

typedef paloalto::panorama::bfd_mode_t

  • Base type string

  • Type constraint (self in ['active', 'passive'])

typedef paloalto::panorama::interface_type_t

  • Base type string

  • Type constraint (self in ['layer3', 'layer2', 'virtual-wire', 'tap', 'ha', 'aggregate-group'])

typedef paloalto::panorama::min_received_ttl_t

  • Base type int

  • Type constraint ((self >= 1) and (self <= 254))

typedef paloalto::panorama::push_scope_t

  • Base type string

  • Type constraint (self in ['device_group', 'template'])

Entities

entity paloalto::DeploymentProfile

Parents: std::ManagedResource, std::PurgeableResource

A Software NGFW flexible-sizing deployment profile, managed through the Palo Alto Networks Licensing API.

When the profile is created, the API generates an authorization code. That code is published as the auth_code fact of this resource, so it can be consumed elsewhere in the model with std::getfact(profile, “auth_code”) (for example to license a firewall during bootstrap).

attribute string name

deployment profile name, unique within the credit pool.

attribute int credit_pool_id

id of the credit pool the profile draws its credits from.

attribute string client_id

OAuth2 client id used to authenticate against the Licensing API.

attribute string client_secret

OAuth2 client secret used to authenticate against the Licensing API.

attribute int firewall_quantity

number of firewalls the profile provisions.

attribute int vcpu_quantity

number of vCPUs per firewall.

attribute int v_sys_quantity=1

number of virtual systems per firewall.

attribute string type='VM'

firewall type (for example “VM”).

attribute string[] panorama=List()

Panorama features to enable on the profile.

attribute string[] subscriptions=List()

subscription codes to enable on the profile (for example [“ATP”, “AURL”]).

The following implements statements select implementations for this entity:

entity paloalto::panorama::AbstractInterface

Parents: std::Entity

attribute string name
attribute string template
attribute std::ipv4_interface[]? ip_addresses=null
attribute std::ipv6_interface[]? ipv6_addresses=null
attribute string? management_profile=null
attribute int? mtu=null
attribute string? comment=null
attribute bool? enable_dhcp=null
relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::BfdProfile

Parents: std::ManagedResource, std::PurgeableResource

Bfd profile entity, exist within a template scope.

attribute string name

subinterface name

attribute string template

Panorama template where the interface is configured, must exist.

attribute paloalto::panorama::bfd_mode_t? mode=null

BFD operation mode

attribute int? min_tx_interval=null

Desired Minimum Tx Interval (ms)

attribute int? min_rx_interval=null

Required Minimum Rx Interval (ms)

attribute int? detection_multiplier=null

Detection Time Multiplier

attribute int? hold_time=null

Hold Time (ms)

attribute paloalto::panorama::min_received_ttl_t? min_received_ttl=null

Minimum accepted TTL on received BFD packet

relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::Commit

Parents: std::ManagedResource, std::PurgeableResource

attribute string name='Commit'

name, to allow multiple commit per device

attribute bool wait_for_complete=true

wait for this commit to be complete

attribute bool force=false

force a commit even if one is not needed, may lead to a commit on every deploy!

attribute string[]? admins=null
attribute string[]? device_groups=null

optional list of device groups to scope the Panorama commit

attribute string[]? templates=null

optional list of templates to scope the Panorama commit

relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::DeviceGroup

Parents: paloalto::panorama::ScopedCommitPush

attribute string name
attribute string? parent=null

the name of the parent device group. ignored if null, ‘Shared’ for top level

attribute string? reference_template=null

optional reference template linked to this device group.

attribute bool manage_firewalls=true

whether this resource owns the device group’s firewall membership. When true (the default), the firewalls relation is the desired membership and the handler enforces it (adding/removing devices). Set to false when membership is established out-of-band - e.g. firewalls that self-register via their bootstrap dgname - so the handler ignores membership entirely (no read, no drift, no sync).

relation paloalto::panorama::Panorama panorama [1]
relation paloalto::panorama::Firewall firewalls [0:*]

The following implements statements select implementations for this entity:

entity paloalto::panorama::Firewall

Parents: std::Entity

attribute string serial

The following implements statements select implementations for this entity:

entity paloalto::panorama::FirewallConnection

Parents: std::ManagedResource, std::PurgeableResource

Wait for a firewall to be discovered by Panorama within a device group and connected.

Deploying this resource is a no-op once the firewall identified by device_name is a member of device_group and reports as connected to Panorama. While the firewall is not yet attached to the device group, or is attached but not connected, the resource is skipped (the handler raises SkipResource), holding back any resources that require it until the firewall is ready.

The firewall is matched on its device name (hostname) rather than its serial number: VM-Series serials are only assigned at licensing time and are therefore not known when the firewall is deployed, whereas the device name is set upfront (e.g. via the bootstrap init-cfg.txt when deploying in OpenStack) and is known before the firewall ever connects to Panorama. Optionally, management_ip can be set to also require the matched firewall to report that management IP, narrowing the match when the device name alone is not unique.

attribute string device_group

name of the device group the firewall must be a member of.

attribute string device_name

device name (hostname) of the firewall that must be present and connected to Panorama.

attribute string? management_ip=null

optional management IP address. When set, the firewall must report both this management IP and device_name. When null, only device_name is matched.

attribute bool timeout=false

If set to true, the resource will fail with timeout error instead of skipping if firewall is not present in panorama.

relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::Interface

Parents: std::ManagedResource, std::PurgeableResource, paloalto::panorama::AbstractInterface

attribute paloalto::panorama::interface_type_t type='layer3'

Interface type.

The following implements statements select implementations for this entity:

entity paloalto::panorama::L3SubInterface

Parents: std::ManagedResource, std::PurgeableResource, paloalto::panorama::AbstractInterface

A layer 3 subinterface

attribute string parent_interface

parent interface name (for example, ‘ethernet1/1’), must exist.

attribute int vlan_id

Interface vlan_id.

The following implements statements select implementations for this entity:

entity paloalto::panorama::Panorama

Parents: std::Entity

attribute string hostname
attribute string username
attribute string password

The following implements statements select implementations for this entity:

entity paloalto::panorama::Push

Parents: std::ManagedResource, std::PurgeableResource

attribute string name='Push'

name, to allow multiple push resources per Panorama

attribute paloalto::panorama::push_scope_t scope='device_group'

push scope, either “device_group” or “template”

attribute string target

scope target name (device-group name or template name)

attribute string[]? devices=null

optional list of firewall serials to limit device-group push targets

attribute bool include_template=false

include template changes in device-group pushes

attribute bool wait_for_complete=true

wait for the push job to complete on Panorama and target firewalls

attribute bool force=false

force a push even when the current sync status looks clean

attribute string[]? admins=null
relation paloalto::panorama::Panorama panorama [1]

The following implementations are defined for this entity:

The following implements statements select implementations for this entity:

entity paloalto::panorama::RouteDomain

Parents: std::ManagedResource, std::PurgeableResource

attribute string name

Logical router name.

attribute string vrf_name='default'

VRF name configured under the logical router.

attribute string template

Panorama template where route-domain config is pushed.

attribute string router_id

BGP router ID configured on the route-domain VRF.

attribute string local_as

BGP local AS configured on the route-domain VRF.

attribute bool bgp_install_route=true

Install BGP-learned routes.

attribute bool bgp_fast_external_failover=true

Fast external failover.

attribute bool bgp_graceful_shutdown=true

Graceful shutdown.

attribute bool bgp_ecmp_multi_as=false

ECMP multiple-AS support.

attribute bool bgp_enforce_first_as=false

Enforce first AS.

attribute int bgp_default_local_preference=100

Default local preference.

attribute bool bgp_graceful_restart_enable=true

Graceful restart enable.

attribute int bgp_graceful_restart_stale_route_time=120

Stale route time in seconds.

attribute int bgp_graceful_max_peer_restart_time=120

Max peer restart time in seconds.

attribute int bgp_graceful_local_restart_time=120

Local restart time in seconds.

attribute bool bgp_med_always_compare_med=false

Always compare MED.

attribute bool bgp_med_deterministic_med_comparison=true

Deterministic MED comparison.

attribute string bgp_bfd_profile='300x3'

BFD profile name used by BGP in this route-domain.

attribute string[] interfaces=List()

Interface to attach to this route_domain.

relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::ScopedCommitPush

Parents: std::ManagedResource, std::PurgeableResource

attribute bool committed=false
attribute bool pushed=false

The following implements statements select implementations for this entity:

entity paloalto::panorama::Template

Parents: paloalto::panorama::ScopedCommitPush

attribute string name
attribute string? description=null
attribute string? default_vsys=null
relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::TemplateStack

Parents: paloalto::panorama::ScopedCommitPush

attribute string name
attribute string? description=null
attribute string[] templates
relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::Zone

Parents: std::ManagedResource, std::PurgeableResource

attribute string name

Security zone name.

attribute string template

Panorama template where the zone is configured.

attribute string mode='layer3'

Zone mode (for example, “layer3”).

attribute bool enable_user_id=true

Enable user-ID in the zone.

attribute string? log_setting=null

Optional log setting profile.

attribute string[]? interfaces=null

Optional list of interfaces bound to the zone.

attribute bool enable_packet_buffer_protection=true

Optional boolean to enable packet buffer protection in the zone (default to true).

relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

Implementations

implementation paloalto::panorama::push_constraints

Plugins

paloalto.generate_auth_key(hostname: <class 'str'>, username: <class 'str'>, password: <class 'str'>, lifetime: <class 'int'> = 60) → <class 'str'>

Generate Panorama VM auth-key and return the generated key.

Resources

class paloalto.deployment_profile.DeploymentProfileResource
class paloalto.bfd_profile.BfdProfileResource
class paloalto.commit.CommitResource
class paloalto.device_group.DeviceGroupResource
class paloalto.firewall_connection.FirewallConnectionResource
class paloalto.interface.InterfaceResource
class paloalto.subinterface.L3SubInterfaceResource
class paloalto.push.PushResource
class paloalto.route_domain.RouteDomainResource
class paloalto.template.TemplateResource
class paloalto.template_stack.TemplateStackResource
class paloalto.security_zone.ZoneResource

Handlers

class paloalto.commit.CommitHandler
class paloalto.deployment_profile.DeploymentProfileHandler

Manage a Software NGFW deployment profile through the Palo Alto Licensing API.

A deployment profile is identified by an authorization code that the API generates on creation. It is never part of the desired state, so the handler resolves the profile by its name within the credit pool and publishes the generated authorization code as the auth_code fact for the rest of the model to consume.

class paloalto.device_group.DeviceGroupHandler
class paloalto.firewall_connection.FirewallConnectionHandler
class paloalto.interface.InterfaceHandler
class paloalto.push.PushHandler
class paloalto.route_domain.RouteDomainHandler
class paloalto.security_zone.ZoneHandler
class paloalto.subinterface.L3SubInterfaceHandler
class paloalto.template.TemplateHandler
class paloalto.template_stack.TemplateStackHandler
class paloalto.bfd_profile.BfdProfileHandler