Module paloalto

Module to configure panorama and panos devices

  • License: ASL 2.0

  • Version: 0.2.4

Typedefs

typedef paloalto::panorama::bfd_mode_t

  • Base type string

  • Type constraint (self in ['active', 'passive'])

typedef paloalto::panorama::bgp_peer_group_type_t

  • Base type string

  • Type constraint (self in ['ebgp', 'ibgp'])

typedef paloalto::panorama::interface_type_t

  • Base type string

  • Type constraint (self in ['layer3', 'layer2', 'virtual-wire', 'tap', 'ha', 'aggregate-group'])

typedef paloalto::panorama::min_received_ttl_t

  • Base type int

  • Type constraint ((self >= 1) and (self <= 254))

typedef paloalto::panorama::peer_address_type_t

  • Base type string

  • Type constraint (self in ['ip', 'fqdn'])

typedef paloalto::panorama::push_scope_t

  • Base type string

  • Type constraint (self in ['device_group', 'template'])

Entities

entity paloalto::DeploymentProfile

Parents: std::ManagedResource, std::PurgeableResource

A Software NGFW flexible-sizing deployment profile, managed through the Palo Alto Networks Licensing API.

When the profile is created, the API generates an authorization code. That code is published as the auth_code fact of this resource, so it can be consumed elsewhere in the model with std::getfact(profile, “auth_code”) (for example to license a firewall during bootstrap).

attribute string name

deployment profile name, unique within the credit pool.

attribute int credit_pool_id

id of the credit pool the profile draws its credits from.

attribute string client_id

OAuth2 client id used to authenticate against the Licensing API.

attribute string client_secret

OAuth2 client secret used to authenticate against the Licensing API.

attribute int firewall_quantity

number of firewalls the profile provisions.

attribute int vcpu_quantity

number of vCPUs per firewall.

attribute int v_sys_quantity=1

number of virtual systems per firewall.

attribute string type='VM'

firewall type (for example “VM”).

attribute string[] panorama=List()

Panorama features to enable on the profile.

attribute string[] subscriptions=List()

subscription codes to enable on the profile (for example [“ATP”, “AURL”]).

The following implements statements select implementations for this entity:

entity paloalto::panorama::AbstractInterface

Parents: std::Entity

attribute string name
attribute string template
attribute std::ipv4_interface[]? ip_addresses=null
attribute std::ipv6_interface[]? ipv6_addresses=null
attribute string? management_profile=null
attribute int? mtu=null
attribute string? comment=null
attribute bool? enable_dhcp=null
relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::AbstractVrfBgp

Parents: std::Entity

Configuration nested under the BGP instance of a route-domain’s VRF.

attribute string name

object name, unique within its parent.

attribute string template

Panorama template holding the route-domain, must exist.

attribute string route_domain

name of the logical router the VRF belongs to (see RouteDomain).

attribute string vrf_name='default'

VRF configured under the logical router.

relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::BfdProfile

Parents: std::ManagedResource, std::PurgeableResource

Bfd profile entity, exist within a template scope.

attribute string name

subinterface name

attribute string template

Panorama template where the interface is configured, must exist.

attribute paloalto::panorama::bfd_mode_t? mode=null

BFD operation mode

attribute int? min_tx_interval=null

Desired Minimum Tx Interval (ms)

attribute int? min_rx_interval=null

Required Minimum Rx Interval (ms)

attribute int? detection_multiplier=null

Detection Time Multiplier

attribute int? hold_time=null

Hold Time (ms)

attribute paloalto::panorama::min_received_ttl_t? min_received_ttl=null

Minimum accepted TTL on received BFD packet

relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::BgpPeer

Parents: std::ManagedResource, std::PurgeableResource, paloalto::panorama::AbstractVrfBgp

A BGP peer within a BgpPeerGroup.

The peer inherits its address family and filtering profiles from its group; PAN-OS defaults that inheritance to on and it is not configurable here.

attribute string peer_group

name of the BgpPeerGroup holding this peer, must exist.

attribute bool enable=true

enable the peer.

attribute bool passive=false

never send open messages to the peer, only answer them.

attribute int peer_as

AS number of the peer, the one assigned to the routing domain on the other side of the connection.

attribute string local_address_interface

local interface carrying the BGP session, attached to the route-domain. Either an interface or one of its vlan subinterfaces.

attribute string? local_address_ip=null

local IP to source the session from, only needed when local_address_interface carries several addresses.

attribute paloalto::panorama::peer_address_type_t peer_address_type='ip'

whether peer_address is an “ip” or an “fqdn”.

attribute string peer_address

address of the peer.

attribute string? bfd_profile=null

BFD profile for this peer, defaults to the route-domain’s setting.

The following implements statements select implementations for this entity:

entity paloalto::panorama::BgpPeerGroup

Parents: std::ManagedResource, std::PurgeableResource, paloalto::panorama::AbstractVrfBgp

A BGP peer group under a route-domain’s VRF.

The peers of the group are separate BgpPeer resources, which have to require the group they belong to.

Every profile is referenced by name and has to exist on Panorama, either as a predefined profile - “default” for the address family - or as one created together with the route-domain. A null profile is left untouched on the device.

attribute bool enable=true

enable the peer group.

attribute paloalto::panorama::bgp_peer_group_type_t type='ebgp'

peer group type, “ebgp” or “ibgp”.

attribute string? address_family_ipv4='default'

IPv4 address family profile.

attribute string? address_family_ipv6=null

IPv6 address family profile.

attribute string? filtering_profile_ipv4=null

IPv4 route filtering profile.

attribute string? filtering_profile_ipv6=null

IPv6 route filtering profile.

attribute string? auth_profile=null

BGP authentication profile.

attribute string? timer_profile=null

BGP timer profile.

attribute int multi_hop=0

multi-hop count, 0 to use the protocol default.

attribute string? dampening_profile=null

BGP dampening profile.

The following implements statements select implementations for this entity:

entity paloalto::panorama::Commit

Parents: std::ManagedResource, std::PurgeableResource

attribute string name='Commit'

name, to allow multiple commit per device

attribute bool wait_for_complete=true

wait for this commit to be complete

attribute bool force=false

force a commit even if one is not needed, may lead to a commit on every deploy!

attribute string[]? admins=null
attribute string[]? device_groups=null

optional list of device groups to scope the Panorama commit

attribute string[]? templates=null

optional list of templates to scope the Panorama commit

relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::DataplaneCores

Parents: std::ManagedResource, std::PurgeableResource

Enforce the number of dataplane cores on a VM-Series firewall through Panorama.

On a VM-Series firewall licensed with Software NGFW credits, the total number of vCPUs is split between the management plane and the dataplane. This resource enforces an explicit dataplane core count via the operational command request plugins vm_series set-cores dp-cores <#>. The management-plane core count is implicit (total vCPUs - dp_cores) and is not set directly, because PAN-OS only accepts the dataplane count.

Setting the split at bootstrap time (e.g. via the init-cfg plugin-op-commands parameter) is the consumer’s responsibility, not this resource’s: the split is operational state, not configuration, so it lives outside /config and cannot be delivered through a Panorama template/template-stack push. This resource only reacts to day-2 drift on an already-running firewall - it is a no-op when the device already matches dp_cores, however that count got there.

The firewall is reached through Panorama, matched by its device name (and optionally management IP) the same way as FirewallConnection: the serial is resolved from Panorama’s operational state and the firewall must be a connected member of device_group. While the firewall is not yet present and connected, the resource is skipped (the handler raises SkipResource), holding back any resources that require it.

Changing the dataplane core count only takes effect after a reboot: when reboot is true the handler issues request restart system and, rather than blocking, raises SkipResource so the change is verified on a later deploy once the firewall reconnects.

attribute string device_group

name of the device group the firewall must be a member of.

attribute string device_name

device name (hostname) of the firewall to configure.

attribute string? management_ip=null

optional management IP address. When set, the firewall must report both this management IP and device_name. When null, only device_name is matched.

attribute int dp_cores

desired number of dataplane cores. Must be at least 1 and less than the total number of cores (vCPUs) reported by the firewall; this is a coarse guard, not the exact device constraint, since the real PAN-OS minimum for management-plane cores depends on the firewall’s memory profile.

attribute bool reboot=true

whether to reboot the firewall after changing the dataplane core count so that the change takes effect. Defaults to true.

attribute bool timeout=false

If set to true, the resource will fail with timeout error instead of skipping if firewall is not present in panorama.

relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::DeviceGroup

Parents: paloalto::panorama::ScopedCommitPush

attribute string name
attribute string? parent=null

the name of the parent device group. ignored if null, ‘Shared’ for top level

attribute string? reference_template=null

optional reference template linked to this device group.

attribute bool manage_firewalls=true

whether this resource owns the device group’s firewall membership. When true (the default), the firewalls relation is the desired membership and the handler enforces it (adding/removing devices). Set to false when membership is established out-of-band - e.g. firewalls that self-register via their bootstrap dgname - so the handler ignores membership entirely (no read, no drift, no sync).

relation paloalto::panorama::Panorama panorama [1]
relation paloalto::panorama::Firewall firewalls [0:*]

The following implements statements select implementations for this entity:

entity paloalto::panorama::Firewall

Parents: std::Entity

attribute string serial

The following implements statements select implementations for this entity:

entity paloalto::panorama::FirewallConnection

Parents: std::ManagedResource, std::PurgeableResource

Wait for a firewall to be discovered by Panorama within a device group and connected.

Deploying this resource is a no-op once the firewall identified by device_name is a member of device_group and reports as connected to Panorama. While the firewall is not yet attached to the device group, or is attached but not connected, the resource is skipped (the handler raises SkipResource), holding back any resources that require it until the firewall is ready.

The firewall is matched on its device name (hostname) rather than its serial number: VM-Series serials are only assigned at licensing time and are therefore not known when the firewall is deployed, whereas the device name is set upfront (e.g. via the bootstrap init-cfg.txt when deploying in OpenStack) and is known before the firewall ever connects to Panorama. Optionally, management_ip can be set to also require the matched firewall to report that management IP, narrowing the match when the device name alone is not unique.

attribute string device_group

name of the device group the firewall must be a member of.

attribute string device_name

device name (hostname) of the firewall that must be present and connected to Panorama.

attribute string? management_ip=null

optional management IP address. When set, the firewall must report both this management IP and device_name. When null, only device_name is matched.

attribute bool timeout=false

If set to true, the resource will fail with timeout error instead of skipping if firewall is not present in panorama.

relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::Interface

Parents: std::ManagedResource, std::PurgeableResource, paloalto::panorama::AbstractInterface

attribute paloalto::panorama::interface_type_t type='layer3'

Interface type.

The following implements statements select implementations for this entity:

entity paloalto::panorama::L3SubInterface

Parents: std::ManagedResource, std::PurgeableResource, paloalto::panorama::AbstractInterface

A layer 3 subinterface

attribute string parent_interface

parent interface name (for example, ‘ethernet1/1’), must exist.

attribute int vlan_id

Interface vlan_id.

The following implements statements select implementations for this entity:

entity paloalto::panorama::Panorama

Parents: std::Entity

attribute string hostname
attribute string username
attribute string password

The following implements statements select implementations for this entity:

entity paloalto::panorama::Push

Parents: std::ManagedResource, std::PurgeableResource

attribute string name='Push'

name, to allow multiple push resources per Panorama

attribute paloalto::panorama::push_scope_t scope='device_group'

push scope, either “device_group” or “template”

attribute string target

scope target name (device-group name or template name)

attribute string[]? devices=null

optional list of firewall serials to limit device-group push targets

attribute bool include_template=false

include template changes in device-group pushes

attribute bool wait_for_complete=true

wait for the push job to complete on Panorama and target firewalls

attribute bool force=false

force a push even when the current sync status looks clean

attribute bool force_template_values=false

on push, template-defined values win over local/override config already present on the managed device (PAN-OS “Force Template Values”)

attribute string[]? admins=null
relation paloalto::panorama::Panorama panorama [1]

The following implementations are defined for this entity:

The following implements statements select implementations for this entity:

entity paloalto::panorama::RouteDomain

Parents: std::ManagedResource, std::PurgeableResource

attribute string name

Logical router name.

attribute string vrf_name='default'

VRF name configured under the logical router.

attribute string template

Panorama template where route-domain config is pushed.

attribute string router_id

BGP router ID configured on the route-domain VRF.

attribute string local_as

BGP local AS configured on the route-domain VRF.

attribute bool bgp_install_route=true

Install BGP-learned routes.

attribute bool bgp_fast_external_failover=true

Fast external failover.

attribute bool bgp_graceful_shutdown=true

Graceful shutdown.

attribute bool bgp_ecmp_multi_as=false

ECMP multiple-AS support.

attribute bool bgp_enforce_first_as=false

Enforce first AS.

attribute int bgp_default_local_preference=100

Default local preference.

attribute bool bgp_graceful_restart_enable=true

Graceful restart enable.

attribute int bgp_graceful_restart_stale_route_time=120

Stale route time in seconds.

attribute int bgp_graceful_max_peer_restart_time=120

Max peer restart time in seconds.

attribute int bgp_graceful_local_restart_time=120

Local restart time in seconds.

attribute bool bgp_med_always_compare_med=false

Always compare MED.

attribute bool bgp_med_deterministic_med_comparison=true

Deterministic MED comparison.

attribute string bgp_bfd_profile='300x3'

BFD profile name used by BGP in this route-domain.

attribute string[] interfaces=List()

Interface to attach to this route_domain.

relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::ScopedCommitPush

Parents: std::ManagedResource, std::PurgeableResource

attribute bool committed=false
attribute bool pushed=false

The following implements statements select implementations for this entity:

entity paloalto::panorama::Template

Parents: paloalto::panorama::ScopedCommitPush

attribute string name
attribute string? description=null
attribute string? default_vsys=null
relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::TemplateStack

Parents: paloalto::panorama::ScopedCommitPush

attribute string name
attribute string? description=null
attribute string[] templates
relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

entity paloalto::panorama::Zone

Parents: std::ManagedResource, std::PurgeableResource

attribute string name

Security zone name.

attribute string template

Panorama template where the zone is configured.

attribute string mode='layer3'

Zone mode (for example, “layer3”).

attribute bool enable_user_id=true

Enable user-ID in the zone.

attribute string? log_setting=null

Optional log setting profile.

attribute string[]? interfaces=null

Optional list of interfaces bound to the zone.

attribute bool enable_packet_buffer_protection=true

Optional boolean to enable packet buffer protection in the zone (default to true).

relation paloalto::panorama::Panorama panorama [1]

The following implements statements select implementations for this entity:

Implementations

implementation paloalto::panorama::push_constraints

Plugins

paloalto.generate_auth_key(hostname: <class 'str'>, username: <class 'str'>, password: <class 'str'>, lifetime: <class 'int'> = 60) → <class 'str'>

Generate Panorama VM auth-key and return the generated key.

Resources

class paloalto.deployment_profile.DeploymentProfileResource
class paloalto.bfd_profile.BfdProfileResource
class paloalto.bgp.BgpPeerResource
class paloalto.bgp.BgpPeerGroupResource
class paloalto.commit.CommitResource
class paloalto.dataplane_cores.DataplaneCoresResource
class paloalto.device_group.DeviceGroupResource
class paloalto.firewall_connection.FirewallConnectionResource
class paloalto.interface.InterfaceResource
class paloalto.subinterface.L3SubInterfaceResource
class paloalto.push.PushResource
class paloalto.route_domain.RouteDomainResource
class paloalto.template.TemplateResource
class paloalto.template_stack.TemplateStackResource
class paloalto.security_zone.ZoneResource

Handlers

class paloalto.bgp.BgpPeerGroupHandler
class paloalto.bgp.BgpPeerHandler
class paloalto.commit.CommitHandler
class paloalto.dataplane_cores.DataplaneCoresHandler
class paloalto.deployment_profile.DeploymentProfileHandler

Manage a Software NGFW deployment profile through the Palo Alto Licensing API.

A deployment profile is identified by an authorization code that the API generates on creation. It is never part of the desired state, so the handler resolves the profile by its name within the credit pool and publishes the generated authorization code as the auth_code fact for the rest of the model to consume.

class paloalto.device_group.DeviceGroupHandler
class paloalto.firewall_connection.FirewallConnectionHandler
class paloalto.interface.InterfaceHandler
class paloalto.push.PushHandler
class paloalto.route_domain.RouteDomainHandler
class paloalto.security_zone.ZoneHandler
class paloalto.subinterface.L3SubInterfaceHandler
class paloalto.template.TemplateHandler
class paloalto.template_stack.TemplateStackHandler
class paloalto.bfd_profile.BfdProfileHandler