Limitations of Proxy Requests to PA firewall through Panorama

[armartirosyan]

Hi,
Are there any limitations to what commands can be proxied through the Panorama to a managed PA device? Currently I can't get the fw.op("show interface all") command to work, but fw.op("show system info") works just fine.

Thanks!

[itdependsnetworks]

To highlight what is going on, see the below, which works with a straight Python requests call.

>>> from panos.firewall import Firewall
>>> from panos.panorama import Panorama
>>> from panos import network
>>>
>>> fw = Firewall(serial="007055000111111")
>>> pano = Panorama("1.1.1.1", "admin", "password")
>>> pano.add(fw)
<Firewall '007055000111111' None at 0x7f5e376f2210>
>>> fw.op("show system info", xml=True)
b'<response status="success"><result><system><hostname>PA-VM</hostname><ip-address>10.125.1.121</ip-address><public-ip-address>unknown</public-ip-address><netmask>255.255.255.0</netmask><default-gateway>10.125.1.1</default-gateway><is-dhcp>yes</is-dhcp><ipv6-address>unknown</ipv6-address><ipv6-link-local-address>fe80::1b:45ff:fe94:270e/64</ipv6-link-local-address><mac-address>02:1b:45:94:27:0e</mac-address><time>Wed Jul 14 12:41:10 2021\n</time>\n<uptime>15 days, 1:55:36</uptime>\n<devicename>PA-VM</devicename>\n<family>vm</family><model>PA-VM</model><serial>007055000111111</serial><vm-mac-base /><vm-mac-count>256</vm-mac-count><vm-uuid>EC2478A6-FE8E-6E3F-00C1-466A092FC95C</vm-uuid><vm-cpuid>AWS:57060500FFFBEBBF</vm-cpuid><vm-license>VM-100</vm-license><vm-cap-tier>6.5 GB</vm-cap-tier><vm-cores>4</vm-cores><vm-mem>16114264</vm-mem><relicense>0</relicense><vm-mode>Amazon AWS</vm-mode>\n<cloud-mode>cloud</cloud-mode>\n<sw-version>10.1.0</sw-version>\n<global-protect-client-package-version>0.0.0</global-protect-client-package-version>\n<device-dictionary-version>27-276</device-dictionary-version>\n<device-dictionary-release-date>2021/06/24 21:06:05 PDT</device-dictionary-release-date>\n<app-version>8422-6787</app-version>\n<app-release-date>2021/06/28 17:11:31 PDT</app-release-date>\n<av-version>0</av-version>\n<threat-version>8422-6787</threat-version>\n<threat-release-date>2021/06/28 17:11:31 PDT</threat-release-date>\n<wf-private-version>0</wf-private-version>\n<wf-private-release-date>unknown</wf-private-release-date>\n<url-db>paloaltonetworks</url-db>\n<wildfire-version>0</wildfire-version>\n<wildfire-rt>Disabled</wildfire-rt>\n<url-filtering-version>20210714.20295</url-filtering-version>\n<global-protect-datafile-version>unknown</global-protect-datafile-version>\n<global-protect-datafile-release-date>unknown</global-protect-datafile-release-date><global-protect-clientless-vpn-version>0</global-protect-clientless-vpn-version>\n<logdb-version>10.1.2</logdb-version>\n<plugin_versions><entry name="vm_series" version="2.1.0"><pkginfo>vm_series-2.1.0</pkginfo></entry><entry name="dlp" version="1.0.3"><pkginfo>dlp-1.0.3</pkginfo></entry></plugin_versions><platform-family>vm</platform-family>\n<vpn-disable-mode>off</vpn-disable-mode>\n<multi-vsys>off</multi-vsys>\n<operational-mode>normal</operational-mode>\n<device-certificate-status>None</device-certificate-status></system></result></response>'
>>> fw.op("show interface all", xml=True)
Traceback (most recent call last):
  File "/root/.cache/pypoetry/virtualenvs/cookiecutter-ntc-A0LBleAz-py3.7/lib/python3.7/site-packages/panos/base.py", line 3661, in method
    super_method(self, *args, **kwargs)
  File "/root/.cache/pypoetry/virtualenvs/cookiecutter-ntc-A0LBleAz-py3.7/lib/python3.7/site-packages/pan/xapi.py", line 951, in op
    self.__type_op(cmd, vsys, extra_qs)
  File "/root/.cache/pypoetry/virtualenvs/cookiecutter-ntc-A0LBleAz-py3.7/lib/python3.7/site-packages/pan/xapi.py", line 974, in __type_op
    raise PanXapiError(self.status_detail)
pan.xapi.PanXapiError:  show -> interface -> all needs to have non NULL value

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/root/.cache/pypoetry/virtualenvs/cookiecutter-ntc-A0LBleAz-py3.7/lib/python3.7/site-packages/panos/firewall.py", line 214, in op
    cmd, vsys, xml, cmd_xml, extra_qs, retry_on_peer
  File "/root/.cache/pypoetry/virtualenvs/cookiecutter-ntc-A0LBleAz-py3.7/lib/python3.7/site-packages/panos/base.py", line 3823, in op
    cmd, vsys, cmd_xml, extra_qs, retry_on_peer=retry_on_peer
  File "/root/.cache/pypoetry/virtualenvs/cookiecutter-ntc-A0LBleAz-py3.7/lib/python3.7/site-packages/panos/base.py", line 3682, in method
    raise the_exception
panos.errors.PanDeviceXapiError:  show -> interface -> all needs to have non NULL value
>>>

[btorresgil]

The all must be in double-quotes to do automatic XML translation of an operational command.

So, this should work:

fw.op('show interface "all"', xml=True)

Here's the documentation on this:

https://pan-os-python.readthedocs.io/en/latest/getting-started.html#operational-commands