How to Export Address and Address-group Objects Using PAN-OS API

Overview

This document describes how to export address and address-group objects from a Palo Alto Networks firewall into an Excel spreadsheet.

Steps

1. Login to the Palo Alto Networks firewall through a browser. Generate an API Key with the following:
   

   https://<Firewall-IPaddress>/api/?type=keygen&user=<login-username>&password=<login-password>

2. Open a New Excel worksheet and select Data > From Web to bring up the Web Query dialog:
   
3. Enter the address of the Palo Alto Networks firewall into the Address field click Go. Then, login to the firewall.
4. Enter one of the URL (with the key embedded) into the address bar and click Go.
   • The Rest API URL to export Address objects:
     

     https:// <firewall-IP>/api/?type=config&action=get&key=<key>&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address

   • The Rest API URL to export Address-group objects:
     

     https:// <firewall-IP>/api/?type=config&action=get&key=<key>&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group

5. The firewall configuration will appear for the address objects. Click on Import to bring the data into the Excel worksheet. The screenshots below show examples of the resulting data:
   
   

owner: ssunku