Posts

Querying Palo Alto Strata Logging Service (SLS) Traffic and Threat Logs with Python

Image
I was recently told that querying Palo Alto Networks Strata Logging Service (SLS) directly through an API was not possible. I also found a few Reddit threads and older examples that pointed toward the legacy Cortex Data Lake APIs, but after spending some time with the Strata Cloud Manager Log Viewer and Chrome Developer Tools, it turns out that raw Traffic and Threat logs can be queried programmatically. The important caveat is that I have not found public Palo Alto documentation for the specific Log Viewer resources used below. The API is clearly being used by the Strata Cloud Manager UI, though, and it works with the normal service-account OAuth flow. API Endpoints For the US tenant I tested against, Traffic logs were available here: https://pa-us01.api.prismaaccess.com/api/sase/v3.0/resource/query/logviewer/firewall_traffic Threat logs use a similar resource: https://pa-us01.api.prismaaccess.com/api/sase/v3.0/resource/query/logviewe...
Post a Comment
Read more

Suppressing Fault Code "F2543" in Cisco ACI/APIC (3.1+) with the Cobra SDK

Sometimes in the ACI environment you would like to suppress a fault that either isn't typically suppressible or one that is hard to find to suppress. Legacy note: This 2018 article targets Cisco ACI/APIC 3.1 and the Python 2.7-era Cobra SDK. It remains available as a historical reference. APIs, packages, and vendor guidance may have changed, so validate the approach against current Cisco documentation before using it in production. I recently encountered CSCvi72804 which will cause unsuppressible faults that are auto-generated if you have used a fabric ID value other than "1". I couldn't let the persistent alerts go unaddressed, so I wrote a script to suppress these faults. According to TAC, my only other options were to upgrade my ACI fabric to 3.2 or wipe the whole production datacenter and build it with a fabric ID value of "1". No thanks for those other options. This script will put your fault suppression inside the Fabric tab's monitoring poli...
Post a Comment
Read more

Adding FEX Static Ports to Cisco ACI with Cobra SDK (Network-Centric Approach)

Let's look at how to start migrating FEXs to ACI. Legacy note: This 2017 article and its sample code target Cisco ACI 2.3(1f) and the Python 2.7-era Cobra SDK. Treat it as a historical migration reference and validate object models, dependencies, and deployment steps against current Cisco documentation. Firstly, we need to discuss the basics of the application-centric approach and the network-centric approach. In the network-centric model, you can connect ACI to a legacy network that is still running significant VLANs. This is a decent strategy if you don't want to re-IP as you move to ACI and have a significant Nexus 7000/5000/2000 deployment today. Background: Cisco ACI overview Although ACI is capable of handling this type of infrastructure, it was obviously not designed to maintain a deployment this way from the GUI so we will need to compensate with a significant amount of scripting. This example was actually created to support some B22 migrations. For each of th...
Post a Comment
Read more

Getting Started with the Cisco Cobra SDK and ACI

We should talk about Cisco ACI and the Python Cobra SDK. The Cisco ACI Python Cobra SDK can automate common tasks that are cumbersome to repeat manually in the APIC interface. Legacy note: This 2017 introduction targets Cisco ACI 2.3(1f) and the Python 2.7-era Cobra SDK. Package installation, authentication behavior, and supported APIs may differ in current releases. Use current Cisco documentation for production implementations. I will not provide examples of how to install the Cobra SDK or any of the Python modules you need. There are plenty of other places on the internet that you can get those instructions from. Let's start with the absolute basics. Authentication is obviously the first step as we begin our discussion of Cisco ACI. I have provided a basic auth module that can be imported into any Python SDK program. It's not really all that useful, but it will be easier for me to include code later as these posts will build on each other. We should talk about Cis...
Post a Comment
Read more

Enable Web Admin Interface on Cisco 8861 IP Phone on a 10.5 Call Manager with Python 2.7

If you happen to have the fortune of needing to deploy Cisco 8861 Wi-Fi phones on an EAP-TLS network with user-installed certificates on a 10.5 Call Manager, this script shows the approach I used. Legacy note: This 2016 article targets Cisco Unified Communications Manager 10.5, Cisco 8861 firmware of that era, and Python 2.7. Current CUCM releases and phone firmware may expose different supported settings. Test in a lab, consult current Cisco documentation, and never hard-code production credentials. Call Manager 10.5 has the capability to enable the Web Admin interface on the 8861, but the Call Manager GUI doesn't support enabling it. Without the Web Admin interface, there is no way to actually install your user-installed certificate. - Dietze #!/Python27/python #Environment #OSX/UCM10.5/Python2.7/ import os import requests import json import smtplib import urllib import sys #####GET INFO FROM CALL MANAGER######## cmserver = 'YOUR_CALL_MANAGER_IP_...
Post a Comment
Read more