PAN-OS DAG Configuration

This playbook utilizes the Dynamic Address Group (DAG) capability of PAN-OS. DAG enables analysts to create a rule one time, where the group is the source/destination, and adds IP addresses dynamically without the need to commit the configuration every time. The playbook checks if the given tag already exists. If the tag exists, then the IP address is added to the tag. If the tag does not exist, a new address group is created with the given tag and a matching rule, and the configuration is committed.

PAN-OS by Palo Alto Networks · 11 tasks · 12 inputs · 0 outputs

Inputs

  • tag_name — The name of the tag to add to PAN-OS. This can be a single tag.
  • ip_list — The list of the IP addresses to block.
  • address_group_name — The name of the group that will be created if the tag does not exist.
  • rule_name — The name of the rule to update, or the name of the rule that will be created.
  • auto_commit — Whether the rule will be committed automatically.
  • log-forwarding-object-name — The server address to which to forward logs.
  • rule-position — The position of the rule in the ruleset. Valid values are: * Top * Bottom * Before * After The default position is 'Top'
  • relative-rule-name — If the rule-position that is chosen is before or after, specify the rule name to which it is related.
  • inbound-or-outbound-rule — Determines if the rule is inbound or outbound.
  • action-type — The action that will be defined in the rule. Valid values are: * allow * deny * drop
  • pre-post-rulebase — Determines whether the rule is a pre-rulebase or post-rulebase rule, according to the rule structure. Exists only in panorama!
  • device-group — the device group for which to return results. for panorama only!

Commands used

pan-os-create-address-group pan-os-list-address-groups pan-os-register-ip-tag

Flowchart

yes yes yes Start Start Is PAN-OS integration enabled? Is PAN-OS integration ena... List Address Groups - pan-os-list-address-groups List Address Groups pan-os-list-address-groups Check if tag exists in address groups Check if tag exists in ad... Register IP address to a tag - pan-os-register-ip-tag Register IP address to a tag pan-os-register-ip-tag Done Done Create Address Group - pan-os-create-address-group Create Address Group pan-os-create-address-group Manually commit Manually commit PAN-OS Commit Configuration - PAN-OS Commit Configuration PAN-OS Commit Configuration PAN-OS Commit Configuration Is auto-commit defined? - AreValuesEqual Is auto-commit defined? AreValuesEqual PAN-OS - Create Or Edit Rule - PAN-OS - Create Or Edit Rule PAN-OS - Create Or Edit Rule PAN-OS - Create Or Edit Rule