# salt.modules.panos

Module to provide Palo Alto compatibility to Salt

codeauthor:

  `Spencer Ervin <spencer_ervin@hotmail.com>`

maturity:

  new

depends:

  none

platform:

  unix

Added in version 2018.3.0.

## Configuration

This module accepts connection configuration details either as parameters, or as configuration settings in pillar as a Salt proxy. Options passed into opts will be ignored if options are passed into pillar.

See also

`Palo Alto Proxy Module`

## About

This execution module was designed to handle connections to a Palo Alto based firewall. This module adds support to send connections directly to the device through the XML API or through a brokered connection to Panorama.

salt.modules.panos.add_config_lock()

  Prevent other users from changing configuration until the lock is released.

  CLI Example:

      salt '*' panos.add_config_lock

salt.modules.panos.check_antivirus()

  Get anti-virus information from PaloAlto Networks server

  CLI Example:

      salt '*' panos.check_antivirus

salt.modules.panos.check_software()

  Get software information from PaloAlto Networks server.

  CLI Example:

      salt '*' panos.check_software

salt.modules.panos.clear_commit_tasks()

  Clear all commit tasks.

  CLI Example:

      salt '*' panos.clear_commit_tasks

salt.modules.panos.commit()

  Commits the candidate configuration to the running configuration.

  CLI Example:

      salt '*' panos.commit

salt.modules.panos.deactivate_license(key_name=None)

  Deactivates an installed license. Required version 7.0.0 or greater.

  key_name(str): The file name of the license key installed.

  CLI Example:

      salt '*' panos.deactivate_license key_name=License_File_Name.key

salt.modules.panos.delete_license(key_name=None)

  Remove license keys on disk.

  key_name(str): The file name of the license key to be deleted.

  CLI Example:

      salt '*' panos.delete_license key_name=License_File_Name.key

salt.modules.panos.download_antivirus()

  Download the most recent anti-virus package.

  CLI Example:

      salt '*' panos.download_antivirus

salt.modules.panos.download_software_file(filename=None, synch=False)

  Download software packages by filename.

  Parameters:

    - filename (str) -- The filename of the PANOS file to download.

    - synch (bool) -- If true then the file will synch to the peer unit.

  CLI Example:

      salt '*' panos.download_software_file PanOS_5000-8.0.0
      salt '*' panos.download_software_file PanOS_5000-8.0.0 True

salt.modules.panos.download_software_version(version=None, synch=False)

  Download software packages by version number.

  Parameters:

    - version (str) -- The version of the PANOS file to download.

    - synch (bool) -- If true then the file will synch to the peer unit.

  CLI Example:

      salt '*' panos.download_software_version 8.0.0
      salt '*' panos.download_software_version 8.0.0 True

salt.modules.panos.fetch_license(auth_code=None)

  Get new license(s) using from the Palo Alto Network Server.

  auth_code

    The license authorization code.

  CLI Example:

      salt '*' panos.fetch_license
      salt '*' panos.fetch_license auth_code=foobar

salt.modules.panos.get_address(address=None, vsys='1')

  Get the candidate configuration for the specified get_address object. This will not return address objects that are marked as pre-defined objects.

  address(str): The name of the address object.

  vsys(str): The string representation of the VSYS ID.

  CLI Example:

      salt '*' panos.get_address myhost
      salt '*' panos.get_address myhost 3

salt.modules.panos.get_address_group(addressgroup=None, vsys='1')

  Get the candidate configuration for the specified address group. This will not return address groups that are marked as pre-defined objects.

  addressgroup(str): The name of the address group.

  vsys(str): The string representation of the VSYS ID.

  CLI Example:

      salt '*' panos.get_address_group foobar
      salt '*' panos.get_address_group foobar 3

salt.modules.panos.get_admins_active()

  Show active administrators.

  CLI Example:

      salt '*' panos.get_admins_active

salt.modules.panos.get_admins_all()

  Show all administrators.

  CLI Example:

      salt '*' panos.get_admins_all

salt.modules.panos.get_antivirus_info()

  Show information about available anti-virus packages.

  CLI Example:

      salt '*' panos.get_antivirus_info

salt.modules.panos.get_arp()

  Show ARP information.

  CLI Example:

      salt '*' panos.get_arp

salt.modules.panos.get_cli_idle_timeout()

  Show timeout information for this administrative session.

  CLI Example:

      salt '*' panos.get_cli_idle_timeout

salt.modules.panos.get_cli_permissions()

  Show cli administrative permissions.

  CLI Example:

      salt '*' panos.get_cli_permissions

salt.modules.panos.get_disk_usage()

  Report filesystem disk space usage.

  CLI Example:

      salt '*' panos.get_disk_usage

salt.modules.panos.get_dns_server_config()

  Get the DNS server configuration from the candidate configuration.

  CLI Example:

      salt '*' panos.get_dns_server_config

salt.modules.panos.get_domain_config()

  Get the domain name configuration from the candidate configuration.

  CLI Example:

      salt '*' panos.get_domain_config

salt.modules.panos.get_dos_blocks()

  Show the DoS block-ip table.

  CLI Example:

      salt '*' panos.get_dos_blocks

salt.modules.panos.get_fqdn_cache()

  Print FQDNs used in rules and their IPs.

  CLI Example:

      salt '*' panos.get_fqdn_cache

salt.modules.panos.get_ha_config()

  Get the high availability configuration.

  CLI Example:

      salt '*' panos.get_ha_config

salt.modules.panos.get_ha_link()

  > Show high-availability link-monitoring state.

  > CLI Example:

      salt '*' panos.get_ha_link

salt.modules.panos.get_ha_path()

  Show high-availability path-monitoring state.

  CLI Example:

      salt '*' panos.get_ha_path

salt.modules.panos.get_ha_state()

  Show high-availability state information.

  CLI Example:

      salt '*' panos.get_ha_state

salt.modules.panos.get_ha_transitions()

  Show high-availability transition statistic information.

  CLI Example:

      salt '*' panos.get_ha_transitions

salt.modules.panos.get_hostname()

  Get the hostname of the device.

  CLI Example:

      salt '*' panos.get_hostname

salt.modules.panos.get_interface_counters(name='all')

  Get the counter statistics for interfaces.

  Parameters:

    name (str) -- The name of the interface to view. By default, all interface statistics are viewed.

  CLI Example:

      salt '*' panos.get_interface_counters
      salt '*' panos.get_interface_counters ethernet1/1

salt.modules.panos.get_interfaces(name='all')

  Show interface information.

  Parameters:

    name (str) -- The name of the interface to view. By default, all interface statistics are viewed.

  CLI Example:

      salt '*' panos.get_interfaces
      salt '*' panos.get_interfaces ethernet1/1

salt.modules.panos.get_job(jid=None)

  List all a single job by ID.

  jid

    The ID of the job to retrieve.

  CLI Example:

      salt '*' panos.get_job jid=15

salt.modules.panos.get_jobs(state='all')

  List all jobs on the device.

  state

    The state of the jobs to display. Valid options are all, pending, or processed. Pending jobs are jobs that are currently in a running or waiting state. Processed jobs are jobs that have completed execution.

  CLI Example:

      salt '*' panos.get_jobs
      salt '*' panos.get_jobs state=pending

salt.modules.panos.get_lacp()

  Show LACP state.

  CLI Example:

      salt '*' panos.get_lacp

salt.modules.panos.get_license_info()

  Show information about owned license(s).

  CLI Example:

      salt '*' panos.get_license_info

salt.modules.panos.get_license_tokens()

  Show license token files for manual license deactivation.

  CLI Example:

      salt '*' panos.get_license_tokens

salt.modules.panos.get_lldp_config()

  Show lldp config for interfaces.

  CLI Example:

      salt '*' panos.get_lldp_config

salt.modules.panos.get_lldp_counters()

  Show lldp counters for interfaces.

  CLI Example:

      salt '*' panos.get_lldp_counters

salt.modules.panos.get_lldp_local()

  Show lldp local info for interfaces.

  CLI Example:

      salt '*' panos.get_lldp_local

salt.modules.panos.get_lldp_neighbors()

  Show lldp neighbors info for interfaces.

  CLI Example:

      salt '*' panos.get_lldp_neighbors

salt.modules.panos.get_local_admins()

  Show all local administrator accounts.

  CLI Example:

      salt '*' panos.get_local_admins

salt.modules.panos.get_logdb_quota()

  Report the logdb quotas.

  CLI Example:

      salt '*' panos.get_logdb_quota

salt.modules.panos.get_master_key()

  Get the master key properties.

  CLI Example:

      salt '*' panos.get_master_key

salt.modules.panos.get_ntp_config()

  Get the NTP configuration from the candidate configuration.

  CLI Example:

      salt '*' panos.get_ntp_config

salt.modules.panos.get_ntp_servers()

  Get list of configured NTP servers.

  CLI Example:

      salt '*' panos.get_ntp_servers

salt.modules.panos.get_operational_mode()

  Show device operational mode setting.

  CLI Example:

      salt '*' panos.get_operational_mode

salt.modules.panos.get_panorama_status()

  Show panorama connection status.

  CLI Example:

      salt '*' panos.get_panorama_status

salt.modules.panos.get_permitted_ips()

  Get the IP addresses that are permitted to establish management connections to the device.

  CLI Example:

      salt '*' panos.get_permitted_ips

salt.modules.panos.get_platform()

  Get the platform model information and limitations.

  CLI Example:

      salt '*' panos.get_platform

salt.modules.panos.get_predefined_application(application=None)

  Get the configuration for the specified pre-defined application object. This will only return pre-defined application objects.

  application(str): The name of the pre-defined application object.

  CLI Example:

      salt '*' panos.get_predefined_application saltstack

salt.modules.panos.get_security_rule(rulename=None, vsys='1')

  Get the candidate configuration for the specified security rule.

  rulename(str): The name of the security rule.

  vsys(str): The string representation of the VSYS ID.

  CLI Example:

      salt '*' panos.get_security_rule rule01
      salt '*' panos.get_security_rule rule01 3

salt.modules.panos.get_service(service=None, vsys='1')

  Get the candidate configuration for the specified service object. This will not return services that are marked as pre-defined objects.

  service(str): The name of the service object.

  vsys(str): The string representation of the VSYS ID.

  CLI Example:

      salt '*' panos.get_service tcp-443
      salt '*' panos.get_service tcp-443 3

salt.modules.panos.get_service_group(servicegroup=None, vsys='1')

  Get the candidate configuration for the specified service group. This will not return service groups that are marked as pre-defined objects.

  servicegroup(str): The name of the service group.

  vsys(str): The string representation of the VSYS ID.

  CLI Example:

      salt '*' panos.get_service_group foobar
      salt '*' panos.get_service_group foobar 3

salt.modules.panos.get_session_info()

  Show device session statistics.

  CLI Example:

      salt '*' panos.get_session_info

salt.modules.panos.get_snmp_config()

  Get the SNMP configuration from the device.

  CLI Example:

      salt '*' panos.get_snmp_config

salt.modules.panos.get_software_info()

  Show information about available software packages.

  CLI Example:

      salt '*' panos.get_software_info

salt.modules.panos.get_system_date_time()

  Get the system date/time.

  CLI Example:

      salt '*' panos.get_system_date_time

salt.modules.panos.get_system_files()

  List important files in the system.

  CLI Example:

      salt '*' panos.get_system_files

salt.modules.panos.get_system_info()

  Get the system information.

  CLI Example:

      salt '*' panos.get_system_info

salt.modules.panos.get_system_services()

  Show system services.

  CLI Example:

      salt '*' panos.get_system_services

salt.modules.panos.get_system_state(mask=None)

  Show the system state variables.

  mask

    Filters by a subtree or a wildcard.

  CLI Example:

      salt '*' panos.get_system_state
      salt '*' panos.get_system_state mask=cfg.ha.config.enabled
      salt '*' panos.get_system_state mask=cfg.ha.*

salt.modules.panos.get_uncommitted_changes()

  Retrieve a list of all uncommitted changes on the device. Requires PANOS version 8.0.0 or greater.

  CLI Example:

      salt '*' panos.get_uncommitted_changes

salt.modules.panos.get_users_config()

  Get the local administrative user account configuration.

  CLI Example:

      salt '*' panos.get_users_config

salt.modules.panos.get_vlans()

  Show all VLAN information.

  CLI Example:

      salt '*' panos.get_vlans

salt.modules.panos.get_xpath(xpath='')

  Retrieve a specified xpath from the candidate configuration.

  xpath(str): The specified xpath in the candidate configuration.

  CLI Example:

      salt '*' panos.get_xpath /config/shared/service

salt.modules.panos.get_zone(zone='', vsys='1')

  Get the candidate configuration for the specified zone.

  zone(str): The name of the zone.

  vsys(str): The string representation of the VSYS ID.

  CLI Example:

      salt '*' panos.get_zone trust
      salt '*' panos.get_zone trust 2

salt.modules.panos.get_zones(vsys='1')

  Get all the zones in the candidate configuration.

  vsys(str): The string representation of the VSYS ID.

  CLI Example:

      salt '*' panos.get_zones
      salt '*' panos.get_zones 2

salt.modules.panos.install_antivirus(version=None, latest=False, synch=False, skip_commit=False)

  Install anti-virus packages.

  Parameters:

    - version (str) -- The version of the PANOS file to install.

    - latest (bool) -- If true, the latest anti-virus file will be installed. The specified version option will be ignored.

    - synch (bool) -- If true, the anti-virus will synch to the peer unit.

    - skip_commit (bool) -- If true, the install will skip committing to the device.

  CLI Example:

      salt '*' panos.install_antivirus 8.0.0

salt.modules.panos.install_license()

  Install the license key(s).

  CLI Example:

      salt '*' panos.install_license

salt.modules.panos.install_software(version=None)

  Upgrade to a software package by version.

  Parameters:

    version (str) -- The version of the PANOS file to install.

  CLI Example:

      salt '*' panos.install_license 8.0.0

salt.modules.panos.reboot()

  Reboot a running system.

  CLI Example:

      salt '*' panos.reboot

salt.modules.panos.refresh_fqdn_cache(force=False)

  Force refreshes all FQDNs used in rules.

  force

    Forces all fqdn refresh

  CLI Example:

      salt '*' panos.refresh_fqdn_cache
      salt '*' panos.refresh_fqdn_cache force=True

salt.modules.panos.remove_config_lock()

  Release config lock previously held.

  CLI Example:

      salt '*' panos.remove_config_lock

salt.modules.panos.resolve_address(address=None, vsys=None)

  Resolve address to ip address. Required version 7.0.0 or greater.

  address

    Address name you want to resolve.

  vsys

    The vsys name.

  CLI Example:

      salt '*' panos.resolve_address foo.bar.com
      salt '*' panos.resolve_address foo.bar.com vsys=2

salt.modules.panos.save_device_config(filename=None)

  Save device configuration to a named file.

  filename

    The filename to save the configuration to.

  CLI Example:

      salt '*' panos.save_device_config foo.xml

salt.modules.panos.save_device_state()

  Save files needed to restore device to local disk.

  CLI Example:

      salt '*' panos.save_device_state

salt.modules.panos.set_authentication_profile(profile=None, deploy=False)

  Set the authentication profile of the Palo Alto proxy minion. A commit will be required before this is processed.

  CLI Example:

  Parameters:

    - profile (str) -- The name of the authentication profile to set.

    - deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

      salt '*' panos.set_authentication_profile foo
      salt '*' panos.set_authentication_profile foo deploy=True

salt.modules.panos.set_hostname(hostname=None, deploy=False)

  Set the hostname of the Palo Alto proxy minion. A commit will be required before this is processed.

  CLI Example:

  Parameters:

    - hostname (str) -- The hostname to set

    - deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

      salt '*' panos.set_hostname newhostname
      salt '*' panos.set_hostname newhostname deploy=True

salt.modules.panos.set_management_http(enabled=True, deploy=False)

  Enables or disables the HTTP management service on the device.

  CLI Example:

  Parameters:

    - enabled (bool) -- If true the service will be enabled. If false the service will be disabled.

    - deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

      salt '*' panos.set_management_http
      salt '*' panos.set_management_http enabled=False deploy=True

salt.modules.panos.set_management_https(enabled=True, deploy=False)

  Enables or disables the HTTPS management service on the device.

  CLI Example:

  Parameters:

    - enabled (bool) -- If true the service will be enabled. If false the service will be disabled.

    - deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

      salt '*' panos.set_management_https
      salt '*' panos.set_management_https enabled=False deploy=True

salt.modules.panos.set_management_icmp(enabled=True, deploy=False)

  Enables or disables the ICMP management service on the device.

  CLI Example:

  Parameters:

    - enabled (bool) -- If true the service will be enabled. If false the service will be disabled.

    - deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

      salt '*' panos.set_management_icmp
      salt '*' panos.set_management_icmp enabled=False deploy=True

salt.modules.panos.set_management_ocsp(enabled=True, deploy=False)

  Enables or disables the HTTP OCSP management service on the device.

  CLI Example:

  Parameters:

    - enabled (bool) -- If true the service will be enabled. If false the service will be disabled.

    - deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

      salt '*' panos.set_management_ocsp
      salt '*' panos.set_management_ocsp enabled=False deploy=True

salt.modules.panos.set_management_snmp(enabled=True, deploy=False)

  Enables or disables the SNMP management service on the device.

  CLI Example:

  Parameters:

    - enabled (bool) -- If true the service will be enabled. If false the service will be disabled.

    - deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

      salt '*' panos.set_management_snmp
      salt '*' panos.set_management_snmp enabled=False deploy=True

salt.modules.panos.set_management_ssh(enabled=True, deploy=False)

  Enables or disables the SSH management service on the device.

  CLI Example:

  Parameters:

    - enabled (bool) -- If true the service will be enabled. If false the service will be disabled.

    - deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

      salt '*' panos.set_management_ssh
      salt '*' panos.set_management_ssh enabled=False deploy=True

salt.modules.panos.set_management_telnet(enabled=True, deploy=False)

  Enables or disables the Telnet management service on the device.

  CLI Example:

  Parameters:

    - enabled (bool) -- If true the service will be enabled. If false the service will be disabled.

    - deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

      salt '*' panos.set_management_telnet
      salt '*' panos.set_management_telnet enabled=False deploy=True

salt.modules.panos.set_ntp_authentication(target=None, authentication_type=None, key_id=None, authentication_key=None, algorithm=None, deploy=False)

  Set the NTP authentication of the Palo Alto proxy minion. A commit will be required before this is processed.

  CLI Example:

  Parameters:

    - target (str) -- Determines the target of the authentication. Valid options are primary, secondary, or both.

    - authentication_type (str) -- The authentication type to be used. Valid options are symmetric, autokey, and none.

    - key_id (int) -- The NTP authentication key ID.

    - authentication_key (str) -- The authentication key.

    - algorithm (str) -- The algorithm type to be used for a symmetric key. Valid options are md5 and sha1.

    - deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

      salt '*' ntp.set_authentication target=both authentication_type=autokey
      salt '*' ntp.set_authentication target=primary authentication_type=none
      salt '*' ntp.set_authentication target=both authentication_type=symmetric key_id=15 authentication_key=mykey algorithm=md5
      salt '*' ntp.set_authentication target=both authentication_type=symmetric key_id=15 authentication_key=mykey algorithm=md5 deploy=True

salt.modules.panos.set_ntp_servers(primary_server=None, secondary_server=None, deploy=False)

  Set the NTP servers of the Palo Alto proxy minion. A commit will be required before this is processed.

  CLI Example:

  Parameters:

    - primary_server (str) -- The primary NTP server IP address or FQDN.

    - secondary_server (str) -- The secondary NTP server IP address or FQDN.

    - deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

      salt '*' ntp.set_servers 0.pool.ntp.org 1.pool.ntp.org
      salt '*' ntp.set_servers primary_server=0.pool.ntp.org secondary_server=1.pool.ntp.org
      salt '*' ntp.ser_servers 0.pool.ntp.org 1.pool.ntp.org deploy=True

salt.modules.panos.set_permitted_ip(address=None, deploy=False)

  Add an IPv4 address or network to the permitted IP list.

  CLI Example:

  Parameters:

    - address (str) -- The IPv4 address or network to allow access to add to the Palo Alto device.

    - deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

      salt '*' panos.set_permitted_ip 10.0.0.1
      salt '*' panos.set_permitted_ip 10.0.0.0/24
      salt '*' panos.set_permitted_ip 10.0.0.1 deploy=True

salt.modules.panos.set_timezone(tz=None, deploy=False)

  Set the timezone of the Palo Alto proxy minion. A commit will be required before this is processed.

  CLI Example:

  Parameters:

    - tz (str) -- The name of the timezone to set.

    - deploy (bool) -- If true then commit the full candidate configuration, if false only set pending change.

      salt '*' panos.set_timezone UTC
      salt '*' panos.set_timezone UTC deploy=True

salt.modules.panos.shutdown()

  Shutdown a running system.

  CLI Example:

      salt '*' panos.shutdown

salt.modules.panos.test_fib_route(ip=None, vr='vr1')

  Perform a route lookup within active route table (fib).

  ip (str): The destination IP address to test.

  vr (str): The name of the virtual router to test.

  CLI Example:

      salt '*' panos.test_fib_route 4.2.2.2
      salt '*' panos.test_fib_route 4.2.2.2 my-vr

salt.modules.panos.test_security_policy(sourcezone=None, destinationzone=None, source=None, destination=None, protocol=None, port=None, application=None, category=None, vsys='1', allrules=False)

  Checks which security policy as connection will match on the device.

  sourcezone (str): The source zone matched against the connection.

  destinationzone (str): The destination zone matched against the connection.

  source (str): The source address. This must be a single IP address.

  destination (str): The destination address. This must be a single IP address.

  protocol (int): The protocol number for the connection. This is the numerical representation of the protocol.

  port (int): The port number for the connection.

  application (str): The application that should be matched.

  category (str): The category that should be matched.

  vsys (int): The numerical representation of the VSYS ID.

  allrules (bool): Show all potential match rules until first allow rule.

  CLI Example:

      salt '*' panos.test_security_policy sourcezone=trust destinationzone=untrust protocol=6 port=22
      salt '*' panos.test_security_policy sourcezone=trust destinationzone=untrust protocol=6 port=22 vsys=2

salt.modules.panos.unlock_admin(username=None)

  Unlocks a locked administrator account.

  username

    Username of the administrator.

  CLI Example:

      salt '*' panos.unlock_admin username=bob