{"id":2231,"date":"2017-08-21T19:27:57","date_gmt":"2017-08-21T19:27:57","guid":{"rendered":"https:\/\/live-infoblox-blog.pantheonsite.io\/?p=2231"},"modified":"2020-05-06T10:27:57","modified_gmt":"2020-05-06T17:27:57","slug":"creating-palo-alto-objects-from-infoblox","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/community\/creating-palo-alto-objects-from-infoblox\/","title":{"rendered":"Creating Palo Alto objects from Infoblox"},"content":{"rendered":"

This is a guest blog written by Niels van Kampen, freelance consultant and trainer,\u00a0www.vknit.nl<\/a>. The opinions expressed here belong to the author. If you have any questions on how Infoblox products work, please contact Infoblox support.<\/span><\/em><\/p>\n

Goal<\/span><\/p>\n

As probably any administrator has experienced, administration over multiple systems can be problematic. You have to keep your naming convention consistent over all systems and it is not uncommon to get the feeling you have to execute the same change multiple times over different systems, already sounds boring right?<\/p>\n

The answer every vendor throws at you: “But we have an API!” Sure, we need the API’s, but who is going to call the API’s? Are you going to run a script from your local machine? Deploy a server for the sole purpose of running python and curl? And who is going to maintain those scripts? Of course, you could buy an orchestrator-like tool, but the step between manual labor and full-blown automation is huge, it’s more of a leap….over the grand canyon. It would be great to have the possibility to be able to tie together different tools in your infrastructure like your IPAM and firewall and have them exchange information together. Most of the time those two will be different vendors and it will be like me trying to speak french: frustrating and useless.<\/p>\n

Wouldn’t it be great if you could somehow tell vendor x what language to speak to vendor y? Infoblox did that in a wonderful job on it and that’s what this post is all about.<\/p>\n

Theoretics<\/span><\/p>\n

The concept is actually so simple I’m not even going to make a nice Visio drawing for it, and I really like making those.<\/p>\n

In Infoblox you create an API endpoint for the Palo Alto, this uses a session template to connect and authenticate yourself.<\/p>\n

\"API
Fig 1. API endpoint information.<\/figcaption><\/figure>\n

Fig 1. API endpoint information.<\/p>\n

\"Session
Fig 2. Session template selection<\/figcaption><\/figure>\n

Fig 2. Session template selection<\/p>\n

The templates are JSON files (available at the bottom) which you upload to Infoblox on the templates tab.<\/p>\n

\"Templates
Fig 3. Templates overview<\/figcaption><\/figure>\n

Fig 3. Templates overview<\/p>\n

The next step is to use notifications, this defines the trigger conditions and when Infoblox should contact the firewall to send him some object information.<\/p>\n

\"Fig
Fig 4. Notification conditions<\/figcaption><\/figure>\n

Fig 4. Notification conditions<\/p>\n

\"Fig
Fig 5. Notification template usage<\/figcaption><\/figure>\n

Fig 5. Notification template usage<\/p>\n

What is configured above is “Hey Infoblox, if a Host object changes in the default network view, send information to the Palo Alto using the Palo Alto actions template.”<\/p>\n

In theory, this is easy! But there is a catch, the templates are not yet available and who is going to provide them? Should it be Palo Alto or Infoblox? As I imagined to myself how the conversations with both vendors would look like I figured it would be easier to create the templates myself.<\/p>\n

Setup<\/span><\/p>\n

How hard could it be I thought, you just tell the Infoblox how to talk to the Palo Alto. Put in a variable here and there and done, right? How wrong could I have been?<\/p>\n

There is\u00a0documentation<\/a>\u00a0and there are some examples on the\u00a0Infoblox user forum<\/a>, but it’s more like a push in the right direction.<\/p>\n

After some tries I figured I needed some more insight into what was going on between Infoblox and the Palo Alto so I used the setup below:<\/p>\n