Python3 scripts for reviewing and fixing Palo Alto Firewall configurations
This repository contains the script pan_analyzer
, which can detects and fix Palo Alto Network firewall configuration issues, as well as several other helper scripts.
The validators are designed to have as few false positives as possible. If there is a false positive, please report an issue!
pip install pan_analyzer
pan_analyzer --xml 12345.xml
The first time you launch pan_analyzer, it will create a PAN_CONFIG.cfg
file
in "~\.pan_policy_analyzer\
and instruct you to edit it.
The second time you launch the analyzer it will detect that "API_KEY.txt" is not present,
and will prompt you for credentials and save the retrieved API key to "API_KEY.txt"
Run all validators on all device groups:
pan_analyzer
Run a single validator on all device groups:
pan_analyzer --validator UnusedServices
Run a single validator on a single device group:
pan_analyzer --device-group my_device_group --validator UnusedServices
Run all validators on an XML configuration file downloaded with "Export Panorama configuration version":
pan_analyzer --xml 12345.xml
Run all validators on an XML configuration file downloaded with "Export Panorama configuration version" and choose type output file (formats support txt (text) and json (json)):
pan_analyzer --xml 12345.xml --output text
pan_analyzer --xml 12345.xml --output json
If you're not sure where to start, I recommend downloading an XML file from:
Panorama -> Setup -> Operations -> Export Panorama configuration version
and running: pan_analyzer.py --xml 12345.xml
There are a few common workflows to clean the firewall configuration:
Consolidate Service objects so there is only one object for each Service:
python pan_analyzer --fixer DeleteUnusedServices
python pan_analyzer --validator MisleadingServices
python pan_analyzer --fixer ConsolidateServices
python pan_analyzer --fixer DeleteUnusedServices
python pan_analyzer --fixer RenameUnconventionallyNamedServices
Consolidate Address objects so there is only one object for each target:
python pan_analyzer --fixer DeleteUnusedAddresses
python pan_analyzer --validator BadHostname
python pan_analyzer --validator FQDNContainsIP
python pan_analyzer --validator MisleadingAddresses
python pan_analyzer --fixer FixIPWithResolvingFQDN
python pan_analyzer --fixer ConsolidateAddresses
python pan_analyzer --fixer DeleteUnusedAddresses
python pan_analyzer --fixer FixUnqualifiedFQDN
python pan_analyzer --fixer RenameUnconventionallyNamedAddresses
The validators for checking zones (ExtaZones, MissingZones, and ExtraRules) all require looking up the zones for address objects on the firewall. This requires many API requests and can take a very long time. Given that PA recommends limiting the number of concurrent API calls to five, and that's shared among the web UI, these calls are not parallelized. Because of these concerns, the default configuration skips those validators.
In addition to pan_analyzer, several other scripts are included in this package:
This project is in the worldwide public domain.
This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.
All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.