How to commit candidate config with pan-os-php

[vinne81]

Hi,

I just started working with pan-os-php, everything is working great. I do have one question though. How do I commit the candidate config on my firewall?

I connect to the firewall and load my config like this:

$paconn = PanAPIConnector::findOrCreateConnectorFromHost( $firewall );
$panconf = new PANConf();
$panconf->API_load_from_candidate($paconn);

Then I do changes like this:

$addressgroup = $addressStore_shared->API_newAddressGroup( $objectgroupname );

So this all works, I can see on my firewall in the GUI that these changes are there in the candidate/uncommited config.

I'm looking for the command(s) to commit the candidate config, including any changes other users might have made of course.

Thank you
Vincent

[swaschkut]

HI Vincent,
thanks for reaching out.

Create to hear that you are writing your own Script to manipulate a PAN-OS Firewall configuration.

As in the past most of the people tried to avoid writing own scripts, the main focus is still on the predefined UTIL scripts:

1. based on your example:
   pan-os-php type=address in=api://FIREWALL-MGMT-IP actions=create-addressgroup:GROUPNAME

2. full commit
   pa_config-commit in=api://FIREWALL-MGMT-IP

The pa_config-commit is still under development, and there is already the plan available to bring this directly into the framework library, so that this can be used in the future with:

$panconf->API_commit_full($paconn)

I suggest to bring this into a FeatureRequest by opening an issue.
I am happy to implement this earlier as planned.

[vinne81]

Thanks for pointing me in the right direction. I ended up copying parts of utils/develop/commit-config.php so that I could integrate it in my code. I will make a FeatureRequest one of these.

I'd like to take the opportunity to thank you for providing us with this library! It has enabled me in a day to program what I thought would take weeks. Keep up the good work!

[swaschkut]

:-)
perfect.

I just implemented the new functionality:

//full commit:
$ret= $pan->connector->commitAll();

//partial commit, based on user name
//commitPartial( $type, $user )
$ret= $pan->connector->commitPartial( "user", "admin" );