Palo Alto PAN-OS

Connect a Palo Alto Networks firewall or Panorama and CloudThinker agents can check device health, flag risky or unused security rules, and read threat logs and live sessions. The connection is read-only and uses a PAN-OS API key that belongs to a dedicated administrator.

Palo Alto PAN-OS is available on self-hosted deployments of CloudThinker. To use it on CloudThinker Cloud, contact us.

Prerequisites

An HTTPS path from your CloudThinker deployment to the management interface of the firewall or Panorama. Palo Alto advises against opening the management interface to the internet, so keep this path inside your management network. If the management interface lists Permitted IP Addresses (on a firewall, Device → Setup → Interfaces → Management), add the address CloudThinker connects from.
A firewall or Panorama administrator who can create admin roles and administrator accounts, such as a superuser.
The Admin role in your CloudThinker workspace, which can add and edit connections. See Roles.

Connect Panorama to reach every firewall it manages through one connection, or connect each firewall on its own.

Setup

Create an admin role

On a firewall, go to Device → Admin Roles and click Add. Name it cloudthinker and set Role to Device. On Panorama, go to Panorama → Admin Roles, click Add, and set Role to Panorama.On the XML API tab, enable Operational Requests, Log, and Configuration, and disable every other feature. CloudThinker uses only the XML API, so set every feature on the Web UI and REST API tabs to Disable, and Command Line to None. Click OK.

Create the administrator

On a firewall, go to Device → Administrators and click Add. On Panorama, go to Panorama → Administrators. Fill in:

Name: cloudthinker
Authentication Profile: None, then enter a Password
Administrator Type: Role Based on a firewall, or Custom Panorama Admin on Panorama
Profile: the cloudthinker role

Click OK and Commit.

Generate the API key

PAN-OS creates API keys through its API, not in the web interface. From a machine that can reach the management interface, run:

curl -k -X POST 'https://<management-address>/api/?type=keygen' \
  --data-urlencode 'user=cloudthinker' \
  --data-urlencode 'password=<password>'

The key is the value inside <key> in the response. Copy only that value. The -k flag accepts PAN-OS’s default self-signed certificate.

Add the connection in CloudThinker

In the sidebar, click More → Workspace settings → Connections. On the Builtin Connections tab, search for Palo Alto PAN-OS and click Connect. Fill in the fields from Connection details and click Connect.CloudThinker tests the key by reading the device’s system information.Success state: the connection shows Connected with a message such as PAN-OS <version> firewall <hostname> (<model>) connected (read-only). or Panorama <version> connected (read-only).

Connection details

Field	Description	Example
Management URL	The firewall or Panorama management address, with `https://` and no path	`https://fw.example.internal`
API key	The key from step 3	`<your-api-key>`
TLS certificate	Skip SSL verification (the default, for PAN-OS’s self-signed certificate) or Verify SSL certificate (for a certificate from a publicly trusted certificate authority)	Verify SSL certificate

Skip SSL verification encrypts traffic but can’t tell your firewall from an impostor. Replace the management certificate with one from a trusted certificate authority, then switch to Verify SSL certificate.

Required permissions

Each XML API feature on the admin role unlocks part of what agents can read.

What agents read	XML API feature
Device health, HA, licenses, sessions, rule hit counts, and the connection test	Operational Requests
Threat, traffic, and other logs	Log
Security rules	Configuration

PAN-OS XML API features are either enabled or disabled, with no read-only setting. Operational Requests can run any operational command, including a restart, and Configuration can change the configuration. CloudThinker sends only read requests, but protect the key as one that can do both.

Leave Commit, Import, and Export disabled. If you don’t need rule reviews, disable Configuration too: health, logs, and sessions still work.

Agent capabilities

Capability	What agents can do
Device overview	Report hostname, model, serial number, PAN-OS and content versions, management CPU and memory, session table use, HA state, and expired or expiring licenses
Security rules	Count rules and flag any that allow any application and service, allow any source and destination, have no security profile, don’t log at session end, are disabled, or were never hit
Logs	Search threat, traffic, URL, WildFire, system, config, authentication, and GlobalProtect logs, with an optional PAN-OS filter
Live sessions	Show current sessions for a source, destination, application, destination port, rule, or session ID
Panorama	List managed firewalls and device groups, read device-group or shared rules, and read one managed firewall’s health and sessions through Panorama

This connection is read-only. Agents can’t change rules, objects, or settings. Make changes in the PAN-OS or Panorama web interface. Log searches cover the last 15 minutes up to the last 30 days and return at most 500 rows. Log times are in the firewall’s local time. Agents always filter sessions and never read the whole session table. On a firewall with several virtual systems, agents read vsys1 unless you name another one. Through Panorama, agents don’t read rule hit counts: connect the firewall itself for those.

Verify the connection

Summarize my Palo Alto firewall: model, PAN-OS version, HA state, session table use, and any expired or expiring licenses

A working connection returns your device’s hostname, model, and PAN-OS version. On Panorama, it also lists the managed firewalls and device groups.

Example prompts

Which Palo Alto security rules allow any application, or have never been hit?
Show high-severity threats the firewall logged in the last 24 hours, grouped by source
What sessions does 10.1.2.3 have open right now, and which rule allows them?

Troubleshooting

The first six accordion titles are the messages CloudThinker shows when the connection test fails.

PAN-OS rejected the API key. Generate a new key and reconnect.

PAN-OS didn’t accept the key. Check that you copied only the value inside <key>. PAN-OS also invalidates a key when the administrator’s password changes, the administrator is deleted, the API Key Lifetime passes, or someone selects Expire all API Keys. PAN-OS uses the same error when the role lacks rights, so also check that Operational Requests is enabled. Then generate a new key and replace it in the connection.

PAN-OS refused the system info read. Give the admin role XML API Operational Requests rights.

The key works, but its admin role can’t run operational commands. Enable Operational Requests on the role’s XML API tab, commit, and connect again.

The management certificate is not trusted. Choose Skip SSL verification for a self-signed certificate.

TLS certificate is set to Verify SSL certificate, but the management interface uses a self-signed certificate. Choose Skip SSL verification, or replace the certificate with one from a publicly trusted certificate authority.

Could not reach the management address over HTTPS.

CloudThinker connects to the management address directly. Check the address, the route from your CloudThinker deployment, and that the management interface allows HTTPS and lists CloudThinker’s address in Permitted IP Addresses.

That address answered, but not as the PAN-OS XML API. Use the management address root, with no path.

Management URL points to something other than the PAN-OS management interface, such as a GlobalProtect portal or a proxy. Enter the management address itself.

PAN-OS answered HTTP <code>. Try again in a minute.

A 3xx code means the address redirected. CloudThinker doesn’t follow redirects, so it never sends the key elsewhere. Enter the exact management address. A 429 or 5xx code means the management server is busy: wait and connect again.

Connected, but rule or log questions fail with "PAN-OS refused the request"

The admin role is missing the XML API feature for that read. Enable Configuration for rules or Log for logs, then commit.

Security

Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

Keep the management interface private. Palo Alto advises against opening it to the internet. Allow only the address CloudThinker connects from in Permitted IP Addresses.
Set an API key lifetime. By default, PAN-OS keys never expire. Set API Key Lifetime (min) in Device → Setup → Management → Authentication Settings. When the key expires, generate a new one and replace it in the connection.

FortiGate Connection

Device health, licenses, and traffic from your FortiGate firewall

Connections

Add, test, and rotate connections

Connections

Customize

Approvals

Workspace settings

Admin Settings

Artifacts and sharing

Prerequisites

Setup

Connection details

Required permissions

Agent capabilities

Verify the connection

Example prompts

Troubleshooting

Security

FortiGate Connection

Connections

​Prerequisites

​Setup

​Connection details

​Required permissions

​Agent capabilities

​Verify the connection

​Example prompts

​Troubleshooting

​Security

​Related

FortiGate Connection

Connections

Prerequisites

Setup

Connection details

Required permissions

Agent capabilities

Verify the connection

Example prompts

Troubleshooting

Security

Related