Hello,
Two quick questions on Palo FW backups:
1. Is there are target date for XML file format support for the Palo config backups? I saw in a previous post that it was planned but at that time there wasn't an ETA.
2. Does Unimus have an option to backup the Palo FW device state files in addition to configurations?
https://knowledgebase.paloaltonetworks. ... 000ClJ9CAK
Thanks,
Palo FW backup for configuration and device state
Hi, a few questions regarding your questions:
So for GUI-based restore, the XMLs from the CLI are not useful. And for Unimus purposes (diffs, change management, and CLI restore), the "set" commands are much more useful. Both for visualizing changes (diffs) over time, for CLI-based restore, and for things like Config Search.
You could definitely get it to Unimus tho, we describe setups like that in this article: https://blog.unimus.net/backing-up-the-unbackupable/
In general, both of the things you ask for can be accomplished using a scheduled Config Push in Unimus, and the "push-to-unimus" script in the article above.
We have had requests to get PA backups in the XML format a few times. We however struggle to understand why this is wanted. The XML exports on the PA CLI are actually different than the exports from their GUI, and can't be used to restore through the GUI (no idea why PA does it like this).
So for GUI-based restore, the XMLs from the CLI are not useful. And for Unimus purposes (diffs, change management, and CLI restore), the "set" commands are much more useful. Both for visualizing changes (diffs) over time, for CLI-based restore, and for things like Config Search.
As far as I am aware, the device state file is binary, and therefore can't be output to the CLI. Can only be retrieved by file transfer protocols. So we can't retrieve it using SSH.
You could definitely get it to Unimus tho, we describe setups like that in this article: https://blog.unimus.net/backing-up-the-unbackupable/
In general, both of the things you ask for can be accomplished using a scheduled Config Push in Unimus, and the "push-to-unimus" script in the article above.