Palo Alto Networks® Firewall is a next-generation firewall by Palo Alto Networks®, which contains application awareness, full-stack visibility, extra-firewall intelligence, and upgrade paths in addition to the full capabilities of both traditional firewalls and intrusion prevention systems. Additionally, the company defines its firewall technology by the following abilities:
Identify applications regardless of port, protocol, evasive tactic, or Secure Sockets Layer.
Identify and control users regardless of IP address, location, or device.
Protect against known and unknown application-borne threats.
Fine-grained visibility and policy control over application access and functionality.
The Palo Alto Firewall connector allows the user to block and unblock both the IP and the application, thereby protecting against known and unknown threats and blocking the communication with malicious IPs. Palo Alto Networks® helps security analysts turn threat data into threat intelligence. It takes indicators from the network, like domain names and IPs, and connects them with nearly every active domain on the Internet. Those connections inform risk assessments, help profile attackers, guide online fraud investigations, and map cyber activity to attacker infrastructure.
This document provides information about the Palo Alto Firewall connector, which facilitates automated interactions, with a Palo Alto Networks® server using FortiSOAR™ playbooks. Add the Palo Alto Firewall connector as a step in FortiSOAR™ playbooks and perform automated operations, such as blocking and unblocking IPs, URLs, and applications.
Connector Version: 2.0.1
FortiSOAR™ Version Tested on: 6.4.3-2885
Palo Alto Firewall Versions Tested on: 9.1.1, 9.1.3, 10.0
Authored By: Fortinet
Certified: Yes
Following enhancements have been made to the Palo Alto Firewall connector in version 2.0.1:
Updated the "Configuration Parameters" to make the Security Policy Name For Blocking URL and Custom URL Group parameters as optional parameters.
Updated the connector to handle policy and group validation separately.
Renamed the connector from 'PaloAlto Firewall' to 'Palo Alto Firewall'.
From FortiSOAR™ 5.0.0 onwards, use the Connector Store to install the connector. For the detailed procedure to install a connector, click here.
You can also use the following yum command as a root
user to install connectors from an SSH session:
yum install cyops-connector-paloalto-firewall
To use the Palo Alto Firewall connector and call its REST APIs, you must be an "Administrator" or assigned an "Admin" role. The API supports the following types of administrators and "Admin" roles:
For the procedure to configure a connector, click here.
In FortiSOAR™, on the Connectors page, click the Palo Alto Firewall connector row (if you are in the Grid view on the Connectors page), and in the Configurations tab enter the required configuration details:
Parameter | Description |
---|---|
Server URL | IP address or Hostname of the Palo Alto Firewall. |
Username | Username to access the Palo Alto Firewall. |
Password | Password to access the Palo Alto Firewall. |
Security Policy Name for Blocking IP | Security Policy Name that has been pre-configured in Palo Alto for blocking an IP. |
IP Address Group | Name of the IP Address Group that is linked to the Security Policy Name for Blocking IP. |
Security Policy Name for Blocking Application | Security Policy Name that has been pre-configured in Palo Alto for blocking an Application. |
Application Group | Name of the Application Group that is linked to the Security Policy Name for Blocking Application. |
Security Policy Name for Blocking URL | (Optional)Security Policy Name that has been pre-configured in Palo Alto for blocking a URL. |
Custom URL Group | (Optional)Name of the URL Group that is linked to the Security Policy Name for Blocking URL. |
API Type | Type of API that you want to use to run connector actions. You can choose between XML APIs or REST APIs. If you choose 'REST APIs', then from the Product Version field, select the PAN-OS version that will be used to perform the connector actions. |
Verify SSL | Specifies whether the SSL certificate for the server is to be verified or not. |
The following automated operations can be included in playbooks, and you can also use the annotations to access operations from FortiSOAR™ release 4.10.0 onward:
Function | Description | Annotation and Category |
---|---|---|
Block IP | Blocks the specified IP address in the Palo Alto Firewall. | block_ip Containment |
Unblock IP | Unblocks the specified IP address in the Palo Alto Firewall. | unblock_ip Remediation |
Block URL | Blocks the specified URL in the Palo Alto Firewall. | block_url Containment |
Unblock URL | Unblocks the specified URL in the Palo Alto Firewall. | unblock_ip Remediation |
Block Application | Blocks the specified application in the Palo Alto Firewall. | block_app Containment |
Unblock Application | Unblocks the specified Application in the Palo Alto Firewall. | unblock_app Remediation |
Parameter | Description |
---|---|
IP Address | IP address that you want to block in the Palo Alto Firewall. |
The output contains the following populated JSON schema:
{
"response": {
"@code": "",
"@status": "",
"result": {
"msg": {
"line": ""
}
}
}
}
Parameter | Description |
---|---|
IP Address | IP address that you want to unblock in the Palo Alto Firewall. |
The output contains the following populated JSON schema:
{
"response": {
"@code": "",
"@status": "",
"result": {
"msg": {
"line": ""
}
}
}
}
Parameter | Description |
---|---|
URL | URL that you want to block in the Palo Alto Firewall. |
The output contains the following populated JSON schema:
{
"response": {
"@code": "",
"@status": "",
"result": {
"msg": {
"line": ""
}
}
}
}
Parameter | Description |
---|---|
URL | URL that you want to unblock in the Palo Alto Firewall. |
The output contains the following populated JSON schema:
{
"response": {
"@code": "",
"@status": "",
"result": {
"msg": {
"line": ""
}
}
}
}
Parameter | Description |
---|---|
Application Name | Name of the application that you want to block in the Palo Alto Firewall. |
The output contains the following populated JSON schema:
{
"response": {
"@code": "",
"@status": "",
"result": {
"msg": {
"line": ""
}
}
}
}
Parameter | Description |
---|---|
Application Name | Name of the application that you want to unblock in the Palo Alto Firewall. |
The output contains the following populated JSON schema:
{
"response": {
"@code": "",
"@status": "",
"result": {
"msg": {
"line": ""
}
}
}
}
The Sample - Palo Alto Firewall - 2.0.1
playbook collection comes bundled with the Palo Alto Firewall connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Palo Alto Firewall connector.
Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.
Palo Alto Networks® Firewall is a next-generation firewall by Palo Alto Networks®, which contains application awareness, full-stack visibility, extra-firewall intelligence, and upgrade paths in addition to the full capabilities of both traditional firewalls and intrusion prevention systems. Additionally, the company defines its firewall technology by the following abilities:
Identify applications regardless of port, protocol, evasive tactic, or Secure Sockets Layer.
Identify and control users regardless of IP address, location, or device.
Protect against known and unknown application-borne threats.
Fine-grained visibility and policy control over application access and functionality.
The Palo Alto Firewall connector allows the user to block and unblock both the IP and the application, thereby protecting against known and unknown threats and blocking the communication with malicious IPs. Palo Alto Networks® helps security analysts turn threat data into threat intelligence. It takes indicators from the network, like domain names and IPs, and connects them with nearly every active domain on the Internet. Those connections inform risk assessments, help profile attackers, guide online fraud investigations, and map cyber activity to attacker infrastructure.
This document provides information about the Palo Alto Firewall connector, which facilitates automated interactions, with a Palo Alto Networks® server using FortiSOAR™ playbooks. Add the Palo Alto Firewall connector as a step in FortiSOAR™ playbooks and perform automated operations, such as blocking and unblocking IPs, URLs, and applications.
Connector Version: 2.0.1
FortiSOAR™ Version Tested on: 6.4.3-2885
Palo Alto Firewall Versions Tested on: 9.1.1, 9.1.3, 10.0
Authored By: Fortinet
Certified: Yes
Following enhancements have been made to the Palo Alto Firewall connector in version 2.0.1:
Updated the "Configuration Parameters" to make the Security Policy Name For Blocking URL and Custom URL Group parameters as optional parameters.
Updated the connector to handle policy and group validation separately.
Renamed the connector from 'PaloAlto Firewall' to 'Palo Alto Firewall'.
From FortiSOAR™ 5.0.0 onwards, use the Connector Store to install the connector. For the detailed procedure to install a connector, click here.
You can also use the following yum command as a root
user to install connectors from an SSH session:
yum install cyops-connector-paloalto-firewall
To use the Palo Alto Firewall connector and call its REST APIs, you must be an "Administrator" or assigned an "Admin" role. The API supports the following types of administrators and "Admin" roles:
For the procedure to configure a connector, click here.
In FortiSOAR™, on the Connectors page, click the Palo Alto Firewall connector row (if you are in the Grid view on the Connectors page), and in the Configurations tab enter the required configuration details:
Parameter | Description |
---|---|
Server URL | IP address or Hostname of the Palo Alto Firewall. |
Username | Username to access the Palo Alto Firewall. |
Password | Password to access the Palo Alto Firewall. |
Security Policy Name for Blocking IP | Security Policy Name that has been pre-configured in Palo Alto for blocking an IP. |
IP Address Group | Name of the IP Address Group that is linked to the Security Policy Name for Blocking IP. |
Security Policy Name for Blocking Application | Security Policy Name that has been pre-configured in Palo Alto for blocking an Application. |
Application Group | Name of the Application Group that is linked to the Security Policy Name for Blocking Application. |
Security Policy Name for Blocking URL | (Optional)Security Policy Name that has been pre-configured in Palo Alto for blocking a URL. |
Custom URL Group | (Optional)Name of the URL Group that is linked to the Security Policy Name for Blocking URL. |
API Type | Type of API that you want to use to run connector actions. You can choose between XML APIs or REST APIs. If you choose 'REST APIs', then from the Product Version field, select the PAN-OS version that will be used to perform the connector actions. |
Verify SSL | Specifies whether the SSL certificate for the server is to be verified or not. |
The following automated operations can be included in playbooks, and you can also use the annotations to access operations from FortiSOAR™ release 4.10.0 onward:
Function | Description | Annotation and Category |
---|---|---|
Block IP | Blocks the specified IP address in the Palo Alto Firewall. | block_ip Containment |
Unblock IP | Unblocks the specified IP address in the Palo Alto Firewall. | unblock_ip Remediation |
Block URL | Blocks the specified URL in the Palo Alto Firewall. | block_url Containment |
Unblock URL | Unblocks the specified URL in the Palo Alto Firewall. | unblock_ip Remediation |
Block Application | Blocks the specified application in the Palo Alto Firewall. | block_app Containment |
Unblock Application | Unblocks the specified Application in the Palo Alto Firewall. | unblock_app Remediation |
Parameter | Description |
---|---|
IP Address | IP address that you want to block in the Palo Alto Firewall. |
The output contains the following populated JSON schema:
{
"response": {
"@code": "",
"@status": "",
"result": {
"msg": {
"line": ""
}
}
}
}
Parameter | Description |
---|---|
IP Address | IP address that you want to unblock in the Palo Alto Firewall. |
The output contains the following populated JSON schema:
{
"response": {
"@code": "",
"@status": "",
"result": {
"msg": {
"line": ""
}
}
}
}
Parameter | Description |
---|---|
URL | URL that you want to block in the Palo Alto Firewall. |
The output contains the following populated JSON schema:
{
"response": {
"@code": "",
"@status": "",
"result": {
"msg": {
"line": ""
}
}
}
}
Parameter | Description |
---|---|
URL | URL that you want to unblock in the Palo Alto Firewall. |
The output contains the following populated JSON schema:
{
"response": {
"@code": "",
"@status": "",
"result": {
"msg": {
"line": ""
}
}
}
}
Parameter | Description |
---|---|
Application Name | Name of the application that you want to block in the Palo Alto Firewall. |
The output contains the following populated JSON schema:
{
"response": {
"@code": "",
"@status": "",
"result": {
"msg": {
"line": ""
}
}
}
}
Parameter | Description |
---|---|
Application Name | Name of the application that you want to unblock in the Palo Alto Firewall. |
The output contains the following populated JSON schema:
{
"response": {
"@code": "",
"@status": "",
"result": {
"msg": {
"line": ""
}
}
}
}
The Sample - Palo Alto Firewall - 2.0.1
playbook collection comes bundled with the Palo Alto Firewall connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Palo Alto Firewall connector.
Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.