Objective
The license API key provides access to the various license functions through REST APIs. It authenticates users who access the licensing APIs. One key can be used for all license API calls. You must be a Super User to generate the key.

Step 5: Generate an API key for a firewall. When connecting to the PAN-OS API, the connection must include an API key that the firewall uses to authenticate the connection as coming from a specific administrator. In this example, we will generate the API key for the default admin user. Run this command in a terminal to generate an API Key for the admin user. There are two types of address groups in the Palo Alto Networks firewalls; dynamic and static. By default, the firewall creates a static address group if you do not explicitly select dynamic. Therefore, you need to add the static element at the time of address group creation. Use action=set to add or create a new object at a specified location in the PAN-OS configuration. Use the xpath parameter to specify the location of the object in the configuration. Unable to copy due to lack of browser support. Use the element parameter to specify a value for the object you are adding or creating using XML. Jul 14, 2016  Writing a Palo Alto Firewall REST API Client in Python While working on code to configure my PaloAlto instances automatically in Amazon AWS, I needed to write functions that would interact with the Palo Alto gateway (add/remove rules, create. The Controller monitors the health of Palo Alto Network software by using the VM-series API and performs switch over based on the API return status. The Controller dynamically programs Palo Alto Network route tables for any new propagated new routes discovered both from new Spoke VPCs and new on-premise routes. Jul 12, 2016  Python for Network Engineers - Part 7 - Using Palo Alto Networks XML API. For this example I’m using a VM-Series Palo Alto firewall with PAN-OS 6.1.0 and Ubuntu 16.04 linux. However before we start trying to query or configure the firewall we will need to generate an authentication key. We can do this from Python using the requests module.

Environment
Licensing API Key

The.panrc file is a convenient way to store API keys for all your firewalls in a file, then reference those keys by tag when executing API calls. You’ll create a.panrc file in ‘Lab 2’ at the bottom of this page and use it for all following API calls. When -t is combined with -h, -l and -k, panxapi.py writes.panrc format lines with the hostname and apikey variables to stdout.

Procedure

Palo Alto Generate Api Key

Access the Licensing API key:
(You must be a Super User)

Palo Alto Firewall Generate Api Key Code

1. Log into the Support Portal
2. Select Assets.
3. Select Licensing API.
4. Click ' Enable' to generate a key.
5. Click 'Regenerate' to create a new key.
6. Click 'Extend' to extend the same key in increments up to one year.

• Key will expire one year from the date of generation.
• Key may be extended forever but not for more than one year at a time.
• Account Super Users will receive email notification of pending expiration date 2 weeks, 1 week and 48 hours prior to expiration.

Resolution

Overview

Palo Alto Api Documentation

Palo Alto Networks XML API uses standard HTTP requests to send and receive data, allowing access to several types of data on the device. The data can then easily be integrated with and used in other systems. Using XML API you can also export the device state, which is used to backup a Palo Alto Networks firewall. Generating a new ssh key.

Details

Proceed with the following steps:

1. Get the API key, which is required for authenticating API calls. You can generate it per user by using:
   For more information, please refer to the admin guide: Get Your API Key .
2. Export the device state from the firewall using:
   You will then be prompted to save the file.

What are the privileges needed to export the device state?

• In 7.0 and earlier, a superuser as well as a custom-role based admin are able to export the device state.
• Starting with 7.1, only a superuser has the privilege of performing an export of the device state. A custom-role based admin is treated as a device-admin. If you try to export the device state without superuser privileges, you will get the following error message: 'You need superuser privileges to do that'.

See Also

Attachments