Focus

PAN-OS® and Panorama™API Usage Guide

Configure a Security Zone (REST API)

Table of Contents

Configure a Security Zone (REST API)

Security zones are a logical way to group physical and virtual interfaces on the firewall to control and log the traffic that traverses specific interfaces on your network. You must assign an interface on the firewall to a security zone before that interface can process traffic. A zone can have multiple interfaces of the same type, but an interface can belong to only one zone.

Create a Security Zone

You can create a security zone either directly on the firewall or as part of a network template on Panorama™.

Make a REST API request to add a security zone.

The following example shows you how to use a Panorama REST API request to create a security zone with Ethernet interfaces and a virtual SD-WAN interface. See Configure an SD-WAN Interface (REST API) for an example of a REST API request to create a virtual SD-WAN interface through Panorama and Configure an Ethernet Interface (REST API) for an example of a REST API request on the firewall to configure an Ethernet interface.


								curl -X POST
								'https://<Panorama>/restapi/v11.0/network/zones?location=template&template=SDWAN-Branch-Network&name=Untrust'
								-H 'X-PAN-KEY: <api key>'
								-d '{
    "entry": {
        "@name": "Untrust",
        "enable-user-identification": "no",
        "network": {
            "layer3": {
                "member": [
                    "ethernet1/1",
                    "ethernet1/2",
                    "ethernet1/3",
                    "sdwan.1"
                ]
            }
        }
    }
}'

Update a Security Zone

To update a security zone, you should first make a REST API request to get the existing security zone. You can then copy data from the response to your REST API request to update the zone to ensure no desired existing data is inadvertently lost or overwritten. The following example first retrieves an existing security zone from a PAN-OS firewall and then updates the zone by adding a new Ethernet interface.

Get the zone you to which you want to add the Ethernet interface.

The following example requests an existing security zone.


								curl -X GET 'https://<firewall>/restapi/v11.0/network/zones?name=test&location=vsys&vsys=vsys1' \
								-H 'X-PAN-KEY: <api key>'

The response is shown below. Note that this security zone already has on Ethernet interface, ethernet1/4. You need to include that member in your request to update this zone to avoid losing this data.


								{
    "@code": "19",
    "@status": "success",
    "result": {
        "@count": "1",
        "@total-count": "1",
        "entry": [
            {
                "@location": "vsys",
                "@name": "test",
                "@vsys": "vsys1",
                "network": {
                    "layer3": {
                        "member": [
                            "ethernet1/4"
                        ]
                    }
                }
            }
        ]
    }
}

Add a new Ethernet interface and include any existing data.

The following example updates the security zone with (1) a new Ethernet interface, ethernet1/3 and (2) the member that already existed in the zone, ethernet1/4.


								curl -X PUT 'https://<firewall>/restapi/v11.0/network/zones?location=vsys&vsys=vsys1&name=test' \
								--header 'X-PAN-KEY: <api key>' \
								-d '{
    "entry": {
        "@name": "test",
        "enable-device-identification": "no",
        "enable-user-identification": "no",
        "network": {
            "layer3": {
                "member": [
                    "ethernet1/4",
                    "ethernet1/3"
                ]
            }
        }
    }
}'

Create a Tag (REST API)

Configure an SD-WAN Interface (REST API)