Palo Alto

This guide covers Palo Alto Networks firewalls running PAN-OS, using either the CLI over SSH or the XML API.

PAN-OS

PAN-OS runs on PA-Series hardware firewalls and VM-Series virtual firewalls.

Create a dedicated backup account

Create a read-only administrator. The built-in superreader role can display the full running configuration without any ability to change it.

From the CLI:

configure
set mgt-config users netwatch-backup permissions role-based superreader yes
set mgt-config users netwatch-backup password
commit

Or in the web UI, go to Device > Administrators, add netwatch-backup, and assign the Superuser (read-only) administrator type.

SSH is enabled by default on the management interface. To restrict who can connect, go to Device > Setup > Interfaces > Management and add the QUARK collector's IP address to Permitted IP Addresses. If the collector reaches the firewall through a dataplane interface instead, attach an Interface Management profile that permits SSH and lists the collector's IP.

Platform notes

PAN-OS has no separate enable password; the read-only superuser lands directly in a shell that can run show config running.
Candidate (uncommitted) changes are not part of the running configuration; QUARK backs up the committed config.

PAN-OS API

As an alternative to SSH, QUARK can retrieve the configuration through the PAN-OS XML API over HTTPS.

Create an API account with read-only access

Go to Device > Admin Roles and create a custom role, for example quark-backup-api.
On the XML API tab of the role, enable only the read operations QUARK needs — Configuration and Operational Requests — and disable Commit and the other write operations. Disable Web UI access on the role if the account will only ever be used by QUARK.
Go to Device > Administrators, add netwatch-backup, choose Role Based, and assign the custom role.

Generate an API key

Request an API key from the firewall's keygen endpoint using the account's credentials (the type=keygen request of the XML API). The returned key is the credential you enter in QUARK.

Keep in mind:

API keys are derived from the account's password; changing the password invalidates existing keys.
The API key lifetime is controlled under Device > Setup > Management > Authentication Settings. If you set an expiry, plan to rotate the key in QUARK before it lapses.

Access control

The API is served on the management HTTPS port. Restrict access with Permitted IP Addresses under Device > Setup > Interfaces > Management, or with an Interface Management profile on a dataplane interface, limited to the collector's IP.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.