Mike Rockwell (Progress Software) asked a question.
Palo Alto Config Backup
I moved this from the Old community.whatsupgold.com. Originally posted by Randy Greenspon
"The hardest part was finding out how to turn off the paging."
- @login
-
- [running-config] set cli pager off
- [running-config, remove-lines= /show config running/] show config running
- [running-config, remove-lines= /set cli pager on/] set cli pager on
@Mike Rockwell (Progress Software) Does this still work for you? The @login command doesn't seem to be working for us anymore. We're getting a timeout now whenever our script runs at the login portion of the script. I had a ticket open with Progress and the tech said it had to do with the OIDs no longer being available in What's up Gold for Palo Alto or something to that affect. I've played around with using the @connect command and have been somewhat successful, but I can't get the body of my script to run properly after I am able to get WUG to connect.
As far as I know it does. I was just on a call with another customer who we set up the same script for their 'palo's is still working. Did the credential change assigned to the device in WUG change or the credential on the actual device change?
No we haven't had any credential changes. We use a service account dedicated for WUG logins. I've confirmed running the remotelogin.exe from the WUG server's CMD prompt that I can login with the credentials as well. I can also SSH with the credentials via putty and have no issues logging in. The @login command works fine for are Juniper and Cisco devices also. It's just our Palo Alto devices that are timing out.
*EDIT (More info) - I've used the debugging tool as well and confirmed that WUG is sending the right user info.
so was this working then quit or you haven't got it working at all?
Apparently it was working at some point. We have backups in the file location from about a year ago which indicates it was functioning at some point. Unfortunately, this was not really something we closely monitored. It was something that was set up and then we just kind of forgot about it. We're not entirely certain what exactly has changed since. At the very least, we know we have upgraded the palo OS a few time, but I can't imagine that being the cause.
Look at the task log, it should say why it was failing.
Ok, I just ran the task. I have the script setup as you did in the original post. The task log shows the failure with the script message reading "PALO ALTO Backup failed. Command Failed: login Script execution failed (ssh)". A strange thing I noticed is that my firewall logs show the SSH connection coming in from WUG's IP. However, they appear to be disconnecting the session due to an unknown user. The message on the firewalls all read "ssh: euid 0 (unknown user): CONNECTION_ABANDON". My colleague and I have done some tests and put a network tap inline on it's management port so we could wireshark the packets. We've discovered that when I ssh to the firewall with my credentials using putty, we can see the firewall sending the radius access request to our DC and receiving the access grant from the DC. However, when WUG is attempting to login, our firewalls are not sending the access request to the domain controller for some reason. We've been able to confirm this also by setting the credentials in WUG for our firewalls to a local account configured on the firewall (admin). When we run the script on WUG and it is using just a local credential, it can login because the firewall is not checking with our radius server. This seems to be an issue with our firewall setup and not WUG at all. We will continue TSing until we figure out a solution.
For future ref the above code gets added to the 'Task Script Library and I had to add @logout to make it work - mine looks like this: