PAN-OS - Block Destination Service

This playbook blocks a destination IP and service (TCP or UDP port) by creating a rule for a specific device group on PAN-OS.

PAN-OS by Palo Alto Networks · 22 tasks · 13 inputs · 0 outputs

Inputs

  • LogForwarding — Panorama log forwarding object name.
  • IP — IP address to block.
  • AutoCommit — This input establishes whether to commit the configuration automatically. True - Commit automatically. False - Commit manually.
  • DeviceGroup — Target Device Group.
  • Port — Destination port to block.
  • Protocol — Protocol
  • ServiceNamePrefix — Prefix of the Service name to be created.
  • RuleNamePrefix — Prefix of the Rule name to be created.
  • ObjectNamePrefix — Prefix of the object name to be created.
  • WhereRule — Where to move the rule. If you specify "before" or "after", you need to supply the "dst" argument. (Default is: 'top')
  • SourceZone — A comma-separated list of source zones.
  • DestinationZone — A comma-separated list of destination zones.
  • SecondaryDeviceGroup — If the rule, address and service are created in the "Shared" location, we need to know what device-groups we can push to because it isn't possible to push to the "Shared" location.

Commands used

pan-os-create-address pan-os-create-rule pan-os-create-service pan-os-list-addresses pan-os-list-services

Flowchart

yes yes yes yes yes yes Start Start Palo Alto Networks PAN-OS enabled? Palo Alto Networks PAN-OS... Panorama - Create custom block rule - pan-os-create-rule Panorama - Create custom ... pan-os-create-rule Done Done PAN-OS - Create address object - pan-os-create-address PAN-OS - Create address o... pan-os-create-address PAN-OS Commit Configuration - PAN-OS Commit Configuration PAN-OS Commit Configuration PAN-OS Commit Configuration AutoCommit defined? AutoCommit defined? Commit PAN-OS Instance manually Commit PAN-OS Instance ma... Is there an IP/Service/Port to block? Is there an IP/Service/Po... List Panorama Services - pan-os-list-services List Panorama Services pan-os-list-services Find Panorama Service - SetAndHandleEmpty Find Panorama Service SetAndHandleEmpty Is there an existing Service? Is there an existing Serv... Create Panorama Service - pan-os-create-service Create Panorama Service pan-os-create-service Set Service Name - Set Set Service Name Set Panorama - Create custom block rule - pan-os-create-rule Panorama - Create custom ... pan-os-create-rule Is there an existing Address? Is there an existing Addr... List Panorama Addresses - pan-os-list-addresses List Panorama Addresses pan-os-list-addresses Find Panorama Address - SetAndHandleEmpty Find Panorama Address SetAndHandleEmpty Set Address Name - Set Set Address Name Set Set Address Name - Set Set Address Name Set Is device-group "shared"? Is device-group "shared"? PAN-OS Commit Configuration - PAN-OS Commit Configuration PAN-OS Commit Configuration PAN-OS Commit Configuration