Creating Loadable Configurations¶
The base templates are designed for variable substitution. The variables provide flexibility for templates configurations to be modified specific to each deployment.
A jinja model for variables is used with the form {{ variable }}
Warning
The configuration templates for device and Panorama system include jinja ‘if’ conditionals. These are used by the create_loadable_configs.py tool to determine what IP information should be added regarding the management interface.
If the tool or jinja formats will not be used, remove the {% text %} statements. The user will also have to manually replace the variables in order for the config to load and commit
Variables list and descriptions¶
The table below lists the template variables along with placeholder or recommended settings.
| Variable name | Default value | Description |
|---|---|---|
| ADMINISTRATOR_USERNAME | admin | superuser id; prompted when using build_my_config tool |
| ADMINISTRATOR_PASSWORD | admin [change first] | superuser password; prompted and hashed in build_my_config |
| FW_NAME | sample | used for hostname and device-group/template in Panorama |
| STACK | sample_stack | Panorama sample template name |
| DEVICE_GROUP | sample_devicegroup | Panorama sample device-group name |
| DNS_1 | 8.8.8.8 (Google) | primary DNS server |
| DNS_2 | 8.8.4.4 (Google) | secondary DNS server |
| NTP_1 | 0.pool.ntp.org | primary NTP server |
| NTP_2 | 1.pool.ntp.org | secondary NTP server |
| SINKHOLE_IPV4 | 72.5.65.111 | IPv4 sinkhole address (Palo Alto Networks) |
| SINKHOLE_IPV6 | 2600:5200::1 | IPv6 sinkhole address (IPv6 bogon) |
| EMAIL_PROFILE_GATEWAY | 192.0.2.1 | email profile gateway address; NET-1 default |
| EMAIL_PROFILE_FROM | sentfrom@yourdomain.com | from address for email alerts |
| EMAIL_PROFILE_TO | sendto@yourdomain.com | to address for email alerts |
| SYSLOG_SERVER | 192.0.2.2 | syslog IP address; NET-1 unroutable default |
| CONFIG_EXPORT_IP | 192.0.2.3 | config bundle export target from Panorama; NET-1 default |
| MGMT_TYPE | dhcp-client | Firewall mgmt IP type (dhcp-client or static) |
| MGMT_IP | 192.168.55.10 | Firewall mgmt IP if type=static |
| MGMT_MASK | 255.255.255.0 | Firewall netmask if type=static |
| MGMT_DG | 192.168.55.2 | Firewall default gateway if type=static |
| CONFIG_PANORAMA_IP | yes | For build_my_config, determine if Panorama IP to be added |
| PANORAMA_TYPE | standard | Used in order to set mgmt interface for standard or cloud |
| PANORAMA_IP | 192.168.55.7 | Panorama IP if to be added to my_config |
| PANORAMA_MASK | 255.255.255.0 | Panorama netmask if to be added to my_config |
| PANORAMA_DG | 192.168.55.2 | Panorama default gateway if to be added to my_config |
| API_KEY_LIFETIME | 525600 | Panorama and device API key lifetime in minutes |
| INCLUDE_PAN_EDL | yes | Include the panw edl object security rules |
Create Loadable Configuration python utility¶
The tools folder in the iron-skillet repo contains a simple python utility for variable substitution.
This tools folder can be found at:
Release branch [ 8.0 | 8.1 | 9.0 ]
The directions below detail how to use the utility in a python virtual environment on Mac or Linux. Similar instructions can work for Windows with python and pip installed.
Note
This tool is designed for Python 3.6 or layer.
Note
The examples below show PAN-OS 9.0 and other releases can be used by changing the release|branch version.
Install the repo and tools¶
The initial step is to clone the repo to a local machine with release|branch panos_v9.0.
Clone using ssh:
$ git clone -b panos_v9.0 git@github.com:PaloAltoNetworks/iron-skillet.git
Clone using https:
$ git clone -b panos_v9.0 https://github.com/PaloAltoNetworks/iron-skillet.git
After the repo is cloned locally, the following steps are used to setup and activate the python virtual environment.
Note
The example below shows python version 3.6 in the second step. If using python 3.5 or 3.7, replace with the respective version
$ cd iron-skillet/tools
$ python3.6 -m venv env
$ source env/bin/activate
(env)$ pip install -r requirements.txt
The virtual environment name is env and if active will likely be shown to the left of the command prompt.
If successful, the iron-skillet templates and tools are now ready to use.
Update the variable values¶
Inside the tools directory, update the config_variables.yaml file then run create_loadable_configs.py. The example shows the vi text editor but any text editor may be used.
(env)$ cd iron-skillet/tools [if not in the tools directory]
(env)$ vi config_variables.yaml
Edit the config_variables.yaml file for your local deployment and save.
Key variables to edit include:
- management interface type: static or dhcp-client based on firewall deployment
- Panorama deployment type: standard or cloud based on Panorama deployment
Run the application¶
Ensure the variable values are correct and run the application.
(env)$ python3 create_loadable_configs.py
>>> Enter the name of the output directory:
>>> Enter the superuser administrator account username:
>>> Enter the superuser administrator account password:
This will run the python utility and output set commands and full xml config files. Loadable configs are stored in the loadable_configs directory. The config folder prefix is based on the output directory name used when running the script.
Warning
You will be prompted for a username/password that will be used in the configuruation file. A hash is created for the password so it is unreadable and the default admin/admin is removed. Remember the user/password information before committing to a running firewall or Panorama.