Palo Alto Networks PAN-OS

Security API key PAN-OS and Panorama API

Manage address objects and security rules on Palo Alto Networks firewalls and Panorama, then commit and push them, from any Windmill script, flow or app.

Set up in 3 steps

Create an API admin

On the firewall or Panorama, create an administrator for automation, ideally a dedicated service account, with a role that allows the XML API and REST API. Generate its API key with a keygen request to /api/?type=keygen.

Add the resource in Windmill

Open Resources, add a resource of type palo_alto_panos, and fill base_url (the HTTPS management address) and api_key. Leave rest_api_version empty to read it from the device.

Run your first script

Start with List address objects. The upsert actions default to dry_run, which returns the diff without changing anything.

Scripts

Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.

Submit a script →

Resource type

The shape of the credential every script on this page expects.

palo_alto_panos

View raw schema →

Field	Type	Required	What it is
base_url	string	Yes	HTTPS address of the firewall or Panorama management interface, e.g. https://panorama.example.com. The certificate must match this address and be trusted by the Windmill worker (DENO_CERT or SSL_CERT_FILE; NODE_EXTRA_CA_CERTS for the non-native scripts): a default self-signed certificate is rejected.
api_key	string	Yes	PAN-OS API key, sent in the X-PAN-KEY header.
rest_api_version	string	No	Optional REST API version used in /restapi/<version>/ URLs, e.g. v11.1. It must not be higher than the PAN-OS version. Leave empty to read it from the device (show system info) on each run.

Questions

Firewall or Panorama?

Both. Choose location vsys (with the vsys name) to work on a firewall, or device-group or shared to work on Panorama. Security rules on Panorama also take the pre or post rulebase.

When do changes take effect?

The upsert actions only change the candidate configuration. On a firewall, run Commit. On Panorama, run Commit, then Push to device group, then poll Get job status until status is FIN.

What does dry_run do?

With dry_run on (the default), the upsert actions read the current object or rule and return the difference without writing. Turn it off to apply only that difference.

Is TLS verification disabled for self-signed appliances?

No. If the management interface uses a private CA, trust that CA on your Windmill workers.

Set up in 3 steps

Create an API admin

Add the resource in Windmill

Run your first script

Scripts

Upsert security rule

Upsert address object

Push to device group

List security rules

List address objects

Get job status

Commit

Resource type

palo_alto_panos

Questions