How To use API to list the IP addresses and interface details of PaloAlto Networks Firewalls
Objective
This How To guide explains how to obtain the IP Addresses (and other Interface details) using API commands ran directly from the web browser.
It is also possible to use a python (or other) script with these API commands to perform bulk firewall modification. However the scripting would need to be performed on the customer side and is not covered in this guide.
Environment
These commands are run in the web browser and works with both PA-VM and On-Prem Firewalls and Panorama. Support from PANOS 8.1 and later code.
Procedure
(1) First run the following in a web browser as to output the KEY information to be used in the remaining step(s):
https://<FIREWALL_IP>/api/?type=keygen&user=<USERNAME>&password=<PASSWORD>
- In the above command substitute the following:
<FIREWALL_IP> = use the IP Address or FQDN of the firewall or Panorama
<USERNAME> = substitute the username that is used to log into the firewall or Panorama
<PASSWORD> = substitute the password that is used to log into the firewall or Panorama
- The above command will log the user into the firewall and output the 'KEY' to be used as authentication in the remaining steps.
- For example the actual command in our LAB would look as follows:
https://10.194.41.193/api/?type=keygen&user=admin&password=p@assWord$
- The output from the above command is as seen below:
[EXAMPLE]
<response status="success">
<result>
<key>LUFRVIjBmYXF3NW5NjBmYXF3NW5weG5OT1hyd0R1JLUjYxQ2NKTUVNaDd01BESTZNMA==</key>
</result>
</response>
- Here the key is: LUFRVIjBmYXF3NW5NjBmYXF3NW5weG5OT1hyd0R1JLUjYxQ2NKTUVNaDd01BESTZNMA==
(2) Once the KEY is found from the previous step replace <API_KEY> below with the actual KEY:
(2A) To list 'ALL' Interfaces and associated output use:
https://<FIREWALL_IP>/api/?key=<API_KEY>&type=op&cmd=<show><interface>all</interface></show>
- In the above command substitute the following:
<API_KEY> = substitute the KEY obtained in step (1)
- The above command will list the Interface details including the IP Address.
- For example the actual command in our LAB would look as follows:
https://10.194.41.193/api/?key=LUFRVIjBmYXF3NW5NjBmYXF3NW5weG5OT1hyd0R1JLUjYxQ2NKTUVNaDd01BESTZNMA==&type=op&cmd=<show><interface>all</interface></show>
- The output from the above command is as seen below:
[EXAMPLE]
<response status="success">
<result>
<ifnet>
<entry>
<name>ethernet1/1</name>
<zone>untrust</zone>
<fwd>vr:default</fwd>
<vsys>1</vsys>
<dyn-addr/>
<addr6/>
<tag>0</tag>
<ip>10.46.170.106/22</ip>
<id>16</id>
<addr/>
</entry>
<entry>
<name>ethernet1/2</name>
<zone>trust</zone>
<fwd>vr:default</fwd>
<vsys>1</vsys>
<dyn-addr/>
<addr6/>
<tag>0</tag>
<ip>172.16.0.1/24</ip>
<id>17</id>
<addr/>
</entry>
<entry>
<name>ethernet1/3</name>
<zone>dmz</zone>
<fwd>vr:default</fwd>
<vsys>1</vsys>
<dyn-addr/>
<addr6/>
<tag>0</tag>
<ip>10.0.0.1/24</ip>
<id>18</id>
<addr/>
</entry>
(2B) To list a single interface such as 'ethernet1/1' only and associated output use:
https://<FIREWALL_IP>/api/?key=<API_KEY>&type=op&cmd=<show><interface>ethernet1/1</interface></show>
- In the above command substitute the following:
<FIREWALL_IP> = use the IP Address or FQDN of the firewall or Panorama
<API_KEY> = substitute the KEY obtained in step (1)
- The above command will list ONLY the Interface details of ethernet1/1 including the IP Address. This will include Interface counters and statistics as well for ethernet1/1.
- For example the actual command in our LAB would look as follows:
https://10.194.41.193/api/?key=LUFRVIjBmYXF3NW5NjBmYXF3NW5weG5OT1hyd0R1JLUjYxQ2NKTUVNaDd01BESTZNMA==&type=op&cmd=<show><interface>ethernet1/1</interface></show>
- The output from the above command is as seen below:
[EXAMPLE]
<response status="success">
<result>
<ifnet>
<ipv6_client>False</ipv6_client>
<vr>default</vr>
<tag>0</tag>
<circuitonly>False</circuitonly>
<ndpmon>False</ndpmon>
<id>16</id>
<mgt_subnet>False</mgt_subnet>
<addr/>
<service/>
<gre>False</gre>
<ra>False</ra>
<df_ignore>False</df_ignore>
<zone>untrust</zone>
<counters>
<ifnet>
<entry>
<icmp_frag>0</icmp_frag>
<ifwderrors>0</ifwderrors>
<ierrors>0</ierrors>
<macspoof>0</macspoof>
<pod>0</pod>
<flowstate>0</flowstate>
<ipspoof>0</ipspoof>
<teardrop>0</teardrop>
<ibytes>260452473</ibytes>
<noarp>1</noarp>
<sctp_conn>0</sctp_conn>
<noroute>115</noroute>
<noneigh>0</noneigh>
<nomac>0</nomac>
<l2_encap>0</l2_encap>
<zonechange>0</zonechange>
<other_conn>0</other_conn>
<obytes>2268939</obytes>
<land>0</land>
<name>ethernet1/1</name>
<tcp_conn>0</tcp_conn>
<neighpend>0</neighpend>
<ipackets>3937621</ipackets>
<opackets>28531</opackets>
<l2_decap>0</l2_decap>
<udp_conn>0</udp_conn>
<idrops>4713</idrops>
</entry>
</ifnet>
<hw>
<entry>
<obytes>2268939</obytes>
<name>ethernet1/1</name>
<idrops>0</idrops>
<ipackets>4038253</ipackets>
<opackets>28531</opackets>
<ierrors>100632</ierrors>
<ibytes>266490393</ibytes>
<port>
<tx-unicast>28531</tx-unicast>
<tx-multicast>0</tx-multicast>
<rx-broadcast>0</rx-broadcast>
<rx-unicast>4036693</rx-unicast>
<rx-multicast>0</rx-multicast>
<rx-bytes>265860762</rx-bytes>
<tx-broadcast>0</tx-broadcast>
<tx-bytes>2397225</tx-bytes>
</port>
</entry>
</hw>
</counters>
<dad>False</dad>
<policing>False</policing>
<mssadjv4>0</mssadjv4>
<mssadjv6>0</mssadjv6>
<sdwan>False</sdwan>
<fwd_type>vr</fwd_type>
<addr6/>
<name>ethernet1/1</name>
<tunnel/>
<vsys>vsys1</vsys>
<dyn-addr>
<member>10.46.170.106/22</member>
</dyn-addr>
<mtu>1500</mtu>
<tcpmss>False</tcpmss>
<mode>layer3</mode>
</ifnet>
<hw>
<name>ethernet1/1</name>
<duplex>full</duplex>
<type>0</type>
<state_c>auto</state_c>
<mac>00:50:56:81:ed:9a</mac>
<state>up</state>
<duplex_c>auto</duplex_c>
<mode>layer3</mode>
<speed_c>auto</speed_c>
<speed>10000</speed>
<id>16</id>
<untag>False</untag>
</hw>
<dp>dp0</dp>
</result>
</response>
<response status="success">
<result>
<ifnet>
<entry>
<name>ethernet1/1</name>
<zone>untrust</zone>
<fwd>vr:default</fwd>
<vsys>1</vsys>
<dyn-addr/>
<addr6/>
<tag>0</tag>
<ip>10.46.170.106/22</ip>
<id>16</id>
<addr/>
</entry>
<entry>
<name>ethernet1/2</name>
<zone>trust</zone>
<fwd>vr:default</fwd>
<vsys>1</vsys>
<dyn-addr/>
<addr6/>
<tag>0</tag>
<ip>172.16.0.1/24</ip>
<id>17</id>
<addr/>
</entry>
<entry>
<name>ethernet1/3</name>
<zone>dmz</zone>
<fwd>vr:default</fwd>
<vsys>1</vsys>
<dyn-addr/>
<addr6/>
<tag>0</tag>
<ip>10.0.0.1/24</ip>
<id>18</id>
<addr/>
</entry>
Additional Information
Main API documentation for 10.1: Get Started with the PAN-OS XML API