salt.proxy.panos module

Proxy Minion interface module for managing Palo Alto firewall devices

New in version 2018.3.0.

codeauthor:Spencer Ervin <spencer_ervin@hotmail.com>
maturity:new
depends:none
platform:unix

This proxy minion enables Palo Alto firewalls (hereafter referred to as simply 'panos') to be treated individually like a Salt Minion.

The panos proxy leverages the XML API functionality on the Palo Alto firewall. The Salt proxy must have access to the Palo Alto firewall on HTTPS (tcp/443).

More in-depth conceptual reading on Proxy Minions can be found in the Proxy Minion section of Salt's documentation.

Configuration

To use this integration proxy module, please configure the following:

Pillar

Proxy minions get their configuration from Salt's Pillar. Every proxy must have a stanza in Pillar and a reference in the Pillar top-file that matches the ID. There are four connection options available for the panos proxy module.

  • Direct Device (Password)
  • Direct Device (API Key)
  • Panorama Pass-Through (Password)
  • Panorama Pass-Through (API Key)

Direct Device (Password)

The direct device configuration configures the proxy to connect directly to the device with username and password.

proxy:
  proxytype: panos
  host: <ip or dns name of panos host>
  username: <panos username>
  password: <panos password>

proxytype

The proxytype key and value pair is critical, as it tells Salt which interface to load from the proxy directory in Salt's install hierarchy, or from /srv/salt/_proxy on the Salt Master (if you have created your own proxy module, for example). To use this panos Proxy Module, set this to panos.

host

The location, or ip/dns, of the panos host. Required.

username

The username used to login to the panos host. Required.

password

The password used to login to the panos host. Required.

Direct Device (API Key)

Palo Alto devices allow for access to the XML API with a generated 'API key'_ instead of username and password.

proxy:
  proxytype: panos
  host: <ip or dns name of panos host>
  apikey: <panos generated api key>

proxytype

The proxytype key and value pair is critical, as it tells Salt which interface to load from the proxy directory in Salt's install hierarchy, or from /srv/salt/_proxy on the Salt Master (if you have created your own proxy module, for example). To use this panos Proxy Module, set this to panos.

host

The location, or ip/dns, of the panos host. Required.

apikey

The generated XML API key for the panos host. Required.

Panorama Pass-Through (Password)

The Panorama pass-through method sends all connections through the Panorama management system. It passes the connections to the appropriate device using the serial number of the Palo Alto firewall.

This option will reduce the number of connections that must be present for the proxy server. It will only require a connection to the Panorama server.

The username and password will be for authentication to the Panorama server, not the panos device.

proxy:
  proxytype: panos
  serial: <serial number of panos host>
  host: <ip or dns name of the panorama server>
  username: <panorama server username>
  password: <panorama server password>

proxytype

The proxytype key and value pair is critical, as it tells Salt which interface to load from the proxy directory in Salt's install hierarchy, or from /srv/salt/_proxy on the Salt Master (if you have created your own proxy module, for example). To use this panos Proxy Module, set this to panos.

serial

The serial number of the panos host. Required.

host

The location, or ip/dns, of the Panorama server. Required.

username

The username used to login to the Panorama server. Required.

password

The password used to login to the Panorama server. Required.

Panorama Pass-Through (API Key)

The Panorama server can also utilize a generated 'API key'_ for authentication.

proxy:
  proxytype: panos
  serial: <serial number of panos host>
  host: <ip or dns name of the panorama server>
  apikey: <panos generated api key>

proxytype

The proxytype key and value pair is critical, as it tells Salt which interface to load from the proxy directory in Salt's install hierarchy, or from /srv/salt/_proxy on the Salt Master (if you have created your own proxy module, for example). To use this panos Proxy Module, set this to panos.

serial

The serial number of the panos host. Required.

host

The location, or ip/dns, of the Panorama server. Required.

apikey

The generated XML API key for the Panorama server. Required.

salt.proxy.panos.call(payload=None)

This function captures the query string and sends it to the Palo Alto device.

salt.proxy.panos.grains()

Get the grains from the proxied device

salt.proxy.panos.grains_refresh()

Refresh the grains from the proxied device

salt.proxy.panos.init(opts)

This function gets called when the proxy starts up. For panos devices, a determination is made on the connection type and the appropriate connection details that must be cached.

salt.proxy.panos.initialized()

Since grains are loaded in many different places and some of those places occur before the proxy can be initialized, return whether our init() function has been called

salt.proxy.panos.is_required_version(required_version=u'0.0.0')

Because different versions of Palo Alto support different command sets, this function will return true if the current version of Palo Alto supports the required command.

salt.proxy.panos.ping()

Returns true if the device is reachable, else false.

salt.proxy.panos.shutdown()

Shutdown the connection to the proxy device. For this proxy, shutdown is a no-op.