Manage Firewall Zones

How to automate firewall zones configuration with PAN-OS using openconfig models.

Create a Zone

The following request creates a new zone and sets the firewall zone type to layer3.
gnmic -a localhost --port 9339 -u username -p password --timeout 300s --skip-verify -e JSON_IETF set --update-path "/zones" --update-file new-zone.json
The contents of new-zone.json are as follows:
{ "zone": [ { "fw-zone-type": "pan-fw-zones-deviations:layer3", "openconfig-fw-zones:interfaces": { "interface": [] }, "openconfig-fw-zones:name": "openconfig-test" } ] }
A successful request returns the output below:
Set Response: { "results": [ { "operation": "UPDATE", "path": "zones/zone[name=opencofig-test]/interfaces/interface/id" } ] }
The following command adds interface1/5 the zone named testzone:
gnmic -a localhost --port 9339 -u username -p password --timeout 300s --skip-verify -e JSON_IETF set --update "/zones/zone[name=openconfig-tet]/interfaces/interface/id:::string:::ethernet1/5"
A successful request returns the output below:
{ "results": [ { "operation": "UPDATE", "path": "zones/zone[name=openconfig-test]/interfaces/interface/id" } ] }
The following is displayed in PAN-OS after making the previous updates:

Retrieving Zones

The following command provides the output retrieved after setting the example above.
gnmic -a localhost --port 9339 -u username -p password --e JSON_IETF get --path "/zones"
[ { "time": "1969-12-31T16:00:00-08:00", "updates": [ { "Path": "zones/zone[name=openconfig-test]", "values": { "zones/zone": { "config": { "fw-zone-type": "pan-fw-zones-deviations:layer3", "name": "openconfig-test" }, "interfaces": { "interface": [ { "config": { "id": "ethernet1/4" }, "id": "ethernet1/4", "state": { "id": "ethernet1/4" } }, { "config": { "id": "ethernet1/4.1" }, "id": "ethernet1/4.1", "state": { "id": "ethernet1/4.1" } }, { "config": { "id": "ethernet1/5" }, "id": "ethernet1/5", "state": { "id": "ethernet1/5" } }, { "config": { "id": "ethernet1/5.1" }, "id": "ethernet1/5.1", "state": { "id": "ethernet1/5.1" } } ] }, "name": "openconfig-test", "state": { "fw-zone-type": "pan-fw-zones-deviations:layer3", "name": "openconfig-test" } } } } ] } ]

Recommended For You