Backing Up Palo Alto configurations

Barkermatthew1980

Hi,

Does anyone know if it is possible to backup the device state and startup configuration for Palo Alto firewalls using the PaloAlto device template?

The running configuration works fine but I get an error for device state and startup configuration.

Does the Palo Alto even have a startup configuration or is the equivalent the candidate configuration?

Thanks,

Matt.

Find more posts tagged with

Accepted answers

All comments

stuartd

My understanding is that PA's don't have a startup config per se. I also wouldn't call the candidate config a startup as it is [again AIUI] a direct copy of the running with any potential edits that haven't been committed yet. In strict terms of startup when in a Cisco world, then it is the config that gets loaded after a power reset. In PA terms I would expect the running to load at this point.

As to if NCM can do what you want, sorry I can't assist with that.

mesverrum

This is the answer, those other config types should not be applied to a PA

anmolkumar7

but we should be able to backup device state config right ?

I am myslef facing the same problem, running config is getting dowloaded but device state fails. When i checked traces i find no logs of network path i have specified which makes me feel may be my template is incorrect and it is not using correct commands for device state(since it is binary type).

Any suggestions ?

Thanks

mesverrum

Just pulled the device template from my lab to see what the commands it looks like it is trying to run will do.

At a glance it looks like device state is a binary, so have you set up a file share for binary storage and did you set your connection profile to use SCP and have all that set up on your server?
https://documentation.solarwinds.com/en/success_center/ncm/content/ncm-configuration-binary-config-setup.htm
https://documentation.solarwinds.com/en/success_center/ncm/content/ncm-using-the-sftp-and-scp-server.htm

Another relevant piece is that binary configs can't be viewed in the GUI, so you wouldn't be able to read through them or do config change reports or compliance reports the way you do the running/startup configs for other gear. It's just going to be a file sitting in a folder wherever you tell it to go.

The relevant pieces I'm seeing in the device template are below, you'll see there are a lot of placeholder macros and in order for the command to run correctly you have to set a lot of values for the SCP to work.

<Configuration-Management Device="Palo Alto Networks" SystemOID=" 1.3.6.1.4.1.25461.2">
<Commands>
<Command Name="DownloadConfig" ConfigType="Running" Value="set cli op-command-xml-output on${CRLF}show config running"/>
<Command Name="Device State" Value="Device State" IsBinary="true" />
<Command Name="DownloadConfigIndirectSCP" ConfigType="Device State" Regex="\[edit\]" Value="${EnterConfigMode}${CRLF}save device-state${CRLF}exit${CRLF}${TransferProtocol} export device-state to ${SCPServerUserName}@${SCPStorageAddress}${StorageFilename}${CRLF}yes${CRLF}${SCPServerPassword}"/>
<Command Name="UploadConfigIndirectSCP" ConfigType="Device State" Value="${TransferProtocol} import device-state from ${SCPServerUserName}@${SCPStorageAddress}${StorageFilename}${CRLF}yes${CRLF}${SCPServerPassword}${CRLF}${EnterConfigMode}${CRLF}load device-state${CRLF}commit${CRLF}exit"/>
</Commands>
</Configuration-Management>