Ken Felix Security Blog

Thursday, May 4, 2023

Simple PANOS api examples

The REST-api or XML-api is very simple to use. I'm going to show you a few examples.

1st with RESTapi you have to call your API-KEY as a header "X-PAN-KEY: biglogapikey".

tip:

You have to specify the API version also. if you specify the wrong version you will received a error similar to;

:[{"code":1,"module":"panui_restapi","description":"Version Not Supported: v10.1"}]}]}%

tip:

If you have typos , the key will not work

tip:

Do not add the key as a HTTP query string

examples;

restapi

# retrieve all objects from fw

curl -H "X-PAN-KEY:LUFRPT1zQ05XOHhPbXpFWk9GWTVFcXVaMkhDVTY4dEE9bFg3VnFtc3RlSGN1L1U2eGd1bVA3NGJRN0wwaUxkcEZVVlYvN1o5VTZ6cklsRi9QZjA4NEhqc1NkblJqd3FROQ==" -k "https://192.168.11.99/restapi/v10.0/Objects/Addresses?location=vsys&vsys=vsys1"

# all services

# addressGroups

# security polices

# NAT rules

# zones

The XML-API can use the key within a http query string, just append it to the HTTP get query.

xml-api

#list devices XPath

curl -k 'https://csockets-panorama01.socpuppets.net/api/?type=op&cmd=<show><config><running><xpath>devices</xpath></running></config></show>&key=LUFRPT1wWno4WEprSHlqV1hkNGtuWllXckxXaVFtOWM9a0ZmdTlKMFQxZWRVMVhkd29pSVlqZU1JL2UvcVF6L1AvbmZKYUR3Yi8xeXdkS0XnedRscXk2Z043OWJMbEtpdw=='

# list shared xpath

curl -k 'https://csockets-panorama01.socpuppets.net/api/?type=op&cmd=<show><config><running><xpath>shared</xpath></running></config></show>&key=LUFRPT1wWno4WEprSHlqV1hkNGtuWllXckxXaVFtOWM9a0ZmdTlKMFQxZWRVMVhkd29pSVlqZU1JL2UvcVF6L1AvbmZKYUR3Yi8xeXdkS0XnedRscXk2Z043OWJMbEtpdw=='

# check operational mode

curl -k 'https://panorama01.socpuppets.net/api/?type=op&cmd=<show><operational-mode></operational-mode></show>&key=LUFRPT1lL0I0YkFhMFNIOUs1SDSiUFFBVDAvOXdxNjQ9WmNaa1JrblVuMEVubFBBNlVJT3loWk9VT0F5VThiK0s1UmFjTVhwa0oyVXVyV21YREFSeFFnZmFXVzUrb0luZw=='

# fetch license

curl -k 'https://panorama01.socpuppets.net/api/?type=op&cmd=<request><license><fetch/></license></request>&key=LUFRPT1lL0I0YkFhMFNIOUs1SDSiUFFBVDAvOXdxNjQ9WmNaa1JrblVuMEVubFBBNlVJT3loWk9VT0F5VThiK0s1UmFjTVhwa0oyVXVyV21YREFSeFFnZmFXVzUrb0luZw=='

curl -k 'https://panorama01.socpuppets.net/api/?type=op&cmd=<request><license><info/></license></request>&key=LUFRPT1lL0I0YkFhMFNIOUs1SDSiUFFBVDAvOXdxNjQ9WmNaa1JrblVuMEVubFBBNlVJT3loWk9VT0F5VThiK0s1UmFjTVhwa0oyVXVyV21YREFSeFFnZmFXVzUrb0luZw=='

# display the license details

curl -k 'https://panorama01.socpuppets.net/api/?type=op&cmd=<show><system><info></info></system></show>&key=LUFRPT1lL0I0YkFhMFNIOUs1SDSiUFFBVDAvOXdxNjQ9WmNaa1JrblVuMEVubFBBNlVJT3loWk9VT0F5VThiK0s1UmFjTVhwa0oyVXVyV21YREFSeFFnZmFXVzUrb0luZw=='

# save the config file

curl -k 'https://panorama01.socpuppets.net/api/?type=op&cmd=<save><config><to>config.save</to></config></save>&key=LUFRPT1lL0I0YkFhMFNIOUs1SDSiUFFBVDAvOXdxNjQ9WmNaa1JrblVuMEVubFBBNlVJT3loWk9VT0F5VThiK0s1UmFjTVhwa0oyVXVyV21YREFSeFFnZmFXVzUrb0luZw=='

here's an example of a license info

XML is sometimes slightly harder but you have multiple items that can be done from show operational and commit commands.

RESTapi is easier but if you ever upgrade your FW and have hardcoded scripts, the API version will come back and haunt you.

I've always found myself using a combination of REST and XML API calls.

NSE ( network security expert) and Route/Switching Engineer

kfelix -----a----t---- socpuppets ---dot---com

^ ^

=( @ @ )=

/ \

Tuesday, April 18, 2023

HOWTO Backup Panorama with a API call

One of my colleagues was discussing a way to backup panorama cfg vrs with the "schedule backup export" option that Palo has.

The problem with Scheduled Config Export the save file does not have the time stamps in the name

By using the API you can set the timestamp by using the date cmd

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-panorama-api/pan-os-xml-api-use-cases/query-a-firewall-from-panorama-api

e.g

create the API key

curl -k -X GET 'https:///panorama.socpuppets.com/api/?type=keygen&user=kfelix&password=ChangeME2023%21%40%23'

run the API call every hour and download the file

curl -o panorama.`date +%F-%H-%M-%S`.xml -k  'https://panorama.socpuppets.com/api/?type=op&cmd=<show><config><running><%2Frunning><%2Fconfig><%2Fshow>&key=LUFRPT1lL0I0YkFhMFNIOUs1RDRiUFFBVDAvOXdxNjQ9WmNaa1JrblVuMEVubFBBNlVJT3loWk9VT0F5VThiK0s1UmFjTVhwa0oyVJJyV21YREFSeFFnZmFXVzUrb0luZw=='

Monday, April 3, 2023

Sonic route-based vpn 0.0.0.0/0

I was working in my day job with a customer that has a sonicwall and they need to change from specific proxy-ids for src/dst to 0.0.0.0/0:0

In order to do this you need to change the VPN from site2site to tunnel. Check out the screenshots of the two modes and take notice of how the "network" option disappears when you do tunnel mode

You still need to apply a route-policy for the destination to ensure that traffic is routed over the VPN . This is an option in sonicwalls that is commonly missed

NSE ( network security expert) and Route/Switching Engineer

kfelix -----a----t---- socpuppets ---dot---com

^ ^

=( @ @ )=

/ \

Saturday, February 18, 2023

linux GRE interface TX error( the issue and resolution )

So I was doing some work for a friend of mine in the Market Delivery Network who's using a linux host and we ran into an issue where our ipsec tunnel was up but the GRE encapsulation over the tunnel was not working.

We had put this design into place over 2 years ago and it was moved to a new host and had issues. So I was scratching my head to figure out what was happening.

What we found was the gre interface had TX errors;

So after hours and hours recreating the gre interface, I finally figured out the SRC IP of our GRE1 interface was not configured. So the tunnel had no means to source the gre traffic

Once we set up the src.ip on a dummy interface, the tunnel came up and our pim neighborship was established

sample dummy1 interface sysconfig;

[root@host01 ~]# cat /etc/sysconfig/network-scripts/ifcfg-dummy1

DEVICE=dummy0

NM_CONTROLLED=no

ONBOOT=yes

TYPE=Ethernet

BRIDGE=virbr10

IPV6INIT=no

IPADDR=10.247.0.39

NETMASK=255.255.255.255

Sample ipsec.conf strongswan

# CERT FEEDS 69.50.112.0/25

# CERT/NR A-Feed/B-Feed MDP Source Range

#CERT FEEDS 69.50.112.128/25 CERT/NR Mediator IP Source Range

#CERT FEEDS 69.50.112.254/32 CERT/NR A-Feed/B-Feed RP

conn CERT01

type=tunnel

compress=no

authby=secret

left=<my public address>

right=164.74.129.26

ikelifetime=86400s

lifetime=3600s

keyexchange=ikev1

keyingtries=%forever

rekey=yes

auto=start

ike=aes256-sha1-modp1024

esp=aes256-sha1

#dpdtimeout= 120s

#dpdaction=restart

conn CERT01A

# phase2 for unicast traffic e.g order entry CME group

leftsubnet=10.247.39.64/26

rightsubnet=69.50.112.128/25

also=CERT01

# phase2 for GRE and multicast CME group

conn CERT01B

leftsubnet=10.247.0.39/32

rightsubnet=10.247.254.1/32

also=CERT01

leftupdown=/etc/strongswan/cme_mcast.sh

NSE ( network security expert) and Route/Switching Engineer

kfelix -----a----t---- socpuppets ---dot---com

^ ^

=( @ @ )=

/ \

Sunday, February 5, 2023

Cloudflare IPs list

For proper protection with cloudflare CDN you should provide rules to allow only the cloudflare address to reach your server. Do not use ANY or ALL as a source address.

1st cloud flare ORIGIN AS13335 and we have a list of address that belong to CloudFlare CDN

kfelix@kfelixs-MacBook-Air ~ % whois -h whois.radb.net AS13335

aut-num: AS13335

as-name: CLOUDFLARENET-AS

descr: Cloudflare, Inc.

descr: 101 Townsend Street, San Francisco, CA 94107, US

status: OTHER

( output snipped )

Next, we can grab all ipv4/v6 address from one of two ways

1: via curl

reisfelix@consultnt ~ % curl -o cdn-v4.file https://www.cloudflare.com/ips-v4

173.245.48.0/20

103.21.244.0/22

103.22.200.0/22

103.31.4.0/22

141.101.64.0/18

108.162.192.0/18

190.93.240.0/20

188.114.96.0/20

197.234.240.0/22

198.41.128.0/17

162.158.0.0/15

104.16.0.0/13

104.24.0.0/14

172.64.0.0/13

131.0.72.0/22

( for ipv6 if you have ipv6 hosted web servers use the below string )

reisfelix@consultnt ~ % curl -o cdn-v6.file https://www.cloudflare.com/ips-v6

or by query against the cloudflare CDN AS

ipv4

whois -h whois.radb.net '!gAS13335'

ipv6

whois -h whois.radb.net '!6AS13335'

Next you will use these addresses in your rule to filter and allow only cloudflare addresses to hit your public webserver.

e.g # fortigate

config firewall policy

edit 10

set name "CDN PROTECTION CLOUDFLARE"

set uuid 333cdb5a-c602-51ea-95d4-b967c36245b5

set srcintf "wan"

set dstintf "DMZ"

set srcaddr "CLOUDFLARE_ADDRESS_GROUP"

set dstaddr "NET-WEB"

set action accept

set schedule "always"

set service "HTTP" "HTTPS" "HTTP8080"

end

In this example above the "CLOUDFLARE_ADDRESS_GROUP" contains our ipv4/ipv6 addresess

For adding multiple addresses at one time we can bulk create addresses or even loop them thru a API call

e.g # using a bash script to make an address

#!/bin/bash

for p in `cat cdn-v4.file `;

# cdn.file contains your ipv4 address

echo " config firewall address"

echo " edit $p "

echo " set subnet $p "

echo " set comment CDN_CLOUDFLARE"

echo " end"

# let's create our group

echo " config firewall addrgrp "

echo " edit CLOUDFLARE_ADDRESS_GROUP"

echo " append member $p "

echo " end"

done

NSE ( network security expert) and Route/Switching Engineer

kfelix -----a----t---- socpuppets ---dot---com

^ ^

=( @ @ )=

/ \

Thursday, December 29, 2022

globalprotect client tips

We are going thru some global protect VPN deployment, and the same issues always come up about the server certificate.

1: Ideally, you want the certificate signed by a public CA or your internalCA that is already trusted

2: On Android to install the certificate, you need a file. extension that ends in <name>.crt. the extension.Cert or .cert will not work

3: On unbuntu , download the latest client and dpkg install it.

e.g

sudo dpkg -i ./GlobalProtect_deb-6.0.4.1-28.deb

4: On Android it's sometimes best to use an altName and ip.address value since it's harder to trust private certificates or the DNS name check will mess you up.

5: If you have a rooted phone you cand adb get /etc/systems/hosts and modify the file and push it back into the device

6: Always check logs and cli for successful connections

7: If you need multiple gateways best practice is to use a loop back interface and set up multiple addresses with different gateways

e.g

loop0 IP 1.1.1.1 = gateway1

loop0 IP 1.1.1.2 = gateway2

loop0 IP 1.1.1.3 = gateway3

Doing this will let you craft different auth-profile, different gateways, pools, different rules, etc...

8: Lastly, if remote authentication is required, do not forget any service routes if you are not using the mgmt-interface for the auth access

NSE ( network security expert) and Route/Switching Engineer

kfelix -----a----t---- socpuppets ---dot---com

^ ^

=( @ @ )=

/ \