<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div style="" dir="auto">Just a reminder that the "set" output cannot always be uploaded directly to a PA in a disaster scenario, only the XML can be used for that. You can try to paste in the "set" output through either the serial port or an SSH session once
you have a network, but that is known to not always work 100% on all versions of PAN-OS. (The commands are not always generated in the correct order, and outright circular dependencies often exist.)</div>
<div style="" dir="auto"><br>
</div>
<div style="" dir="auto">OTOH, good luck having a human read and understand XML or JSON diffs, so you're kind of stuck between a rock and a hard place...</div>
<div style="" dir="auto"><br>
</div>
<div style="" dir="auto">We used to solve this by backing up the same config twice, once in each format. PITA but it worked.</div>
<div style="" dir="auto"><br>
</div>
<div style="" dir="auto">If you also have and use Palo Alto's Panorama product to manage your firewalls, you may as well disregard everything I've just said, it changes the rules of the game completely anyway. Its config can be captured via SSH in "set" format
like a firewall, which is still useful for human analysis. (Make sure your timeouts are high, though - my Panorama instance takes about 20min to dump ~0.7M lines in "set" format!)</div>
<div style="" dir="auto"><br>
</div>
<div style="" dir="auto">Source: currently in year 4 of a love-hate, no wait, more like a need-hate, relationship with Panorama.</div>
<div style="" dir="auto"><br>
</div>
<div style="" dir="auto">-Adam</div>
<div id="ms-outlook-mobile-signature" dir="auto">
<div><br>
</div>
Get <a href="https://aka.ms/AAb9ysg">Outlook for Android</a></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Rancid-discuss <rancid-discuss-bounces@www.shrubbery.net> on behalf of Chris <chris.weakland@gmail.com><br>
<b>Sent:</b> Wednesday, April 5, 2023 5:19:43 PM<br>
<b>To:</b> heasley <heas@shrubbery.net><br>
<b>Cc:</b> rancid-discuss@www.shrubbery.net <rancid-discuss@www.shrubbery.net><br>
<b>Subject:</b> Re: [rancid] login script for PaloAlto PA850</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.x_MsoHyperlink
{color:blue;
text-decoration:underline}
.x_MsoChpDefault
{}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.x_WordSection1
{}
-->
</style>
<div lang="EN-US" link="blue" vlink="#954F72" style="word-wrap:break-word">
<div class="x_WordSection1">
<p class="x_MsoNormal">Just wanted to add for the benefit of all, I like to edit my etc/rancid.types.conf and add a new “type”. Here is what the additional lines look like:</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">paloaltofw;script;rancid -t paloaltofw</p>
<p class="x_MsoNormal">paloaltofw;login;panlogin</p>
<p class="x_MsoNormal">paloaltofw;module;panos</p>
<p class="x_MsoNormal">paloaltofw;inloop;panos::inloop</p>
<p class="x_MsoNormal">paloaltofw;command;panos::ShowInfo;show system info</p>
<p class="x_MsoNormal">paloaltofw;command;panos::ShowInventory;show chassis inventory</p>
<p class="x_MsoNormal">paloaltofw;command;rancid::RunCommand;set cli config-output-format set</p>
<p class="x_MsoNormal">paloaltofw;command;rancid::RunCommand;configure</p>
<p class="x_MsoNormal">paloaltofw;command;panos::ShowConfig;show</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">This gives you a more human readable configuration.</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">In your router.db you would need to add:</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">Firewall1.yourdomain.com;paloaltofw;up</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">Chris</p>
<p class="x_MsoNormal"> </p>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal" style="border:none; padding:0in"><b>From: </b><a href="mailto:heas@shrubbery.net">heasley</a><br>
<b>Sent: </b>Wednesday, April 5, 2023 4:03 PM<br>
<b>To: </b><a href="mailto:chris.weakland@gmail.com">Chris Weakland</a><br>
<b>Cc: </b><a href="mailto:durrani.anwar@gmail.com">Anwar Durrani</a>; <a href="mailto:rancid-discuss@www.shrubbery.net">
rancid-discuss@www.shrubbery.net</a><br>
<b>Subject: </b>Re: [rancid] login script for PaloAlto PA850</p>
</div>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">Wed, Apr 05, 2023 at 07:21:17AM -0400, Chris Weakland:</p>
<p class="x_MsoNormal">> Palo Alto support has bee. built into Rancid for some time, no need for any</p>
<p class="x_MsoNormal">additional scripts. The device type is: paloalto</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">indeed; there is also device type paloaltoxml for the xml config.</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">> Your router.db looks incorrect, it should be:</p>
<p class="x_MsoNormal">> </p>
<p class="x_MsoNormal">> Firewall1.yourdomain.com;paloalto;up</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">to be pedantic, additional fields are simply ignored.</p>
<p class="x_MsoNormal"> </p>
</div>
</div>
</body>
</html>