In previous posts, we explored how to automate certain operations on Palo Alto Networks firewalls using XML API and REST API directly. According to the official documentation , there are ready-to-use libraries available for several programming languages (PHP, Go, Python).

Personally, I believe Python is the most suitable language for writing automations and integrations. For this reason, we will focus on the Python SDKs. There are two libraries available:

• pan-python : developed and maintained personally by Kevin Steves. This library allows low-level operations on PAN-OS systems.
• pan-os-python : officially developed and maintained by Palo Alto Networks, it enables high-level interaction with firewalls, similar to the CLI or Web interface. This library depends on specific versions of pan-python.

The pan-os-python library is officially maintained by Palo Alto Networks. It depends on the pan-python library but is not compatible with its latest version. pan-os-python allows interaction with firewalls and Panorama similarly to the Web interface.

The documentation is available online, and the relationships between APIs are described through diagrams.

On some systems, you may encounter the following error:

from distutils.version import LooseVersion # Used by PanOSVersion class ModuleNotFoundError: No module named 'distutils'

In this case, you need to install a specific version of setuptools:

pip install setuptools>=75.1.0

The library organizes various methods into the following classes:

• base
• device
• errors
• firewall
• ha
• network
• objects
• panorama
• plugins
• policies
• predefined
• updater
• userid

Continue reading the post on Patreon .