Posts

Ten Years as a CCIE: The Foundation Matters More Than the Number

Image
When I was early in my career, I thought of CCIEs almost like monks who had dedicated themselves completely to their craft. They seemed to operate at a different level. There were people I deeply respected who could look at a difficult networking problem, strip away the noise, and somehow get to the heart of it faster than everyone else in the room. One of those people was Sean Orta, an OG CCIE who became something of a technical oracle in my mind. I used to joke that when I needed to think through something difficult, I was going to "consult the Ortacle." The joke was lighthearted, but the respect behind it was very real.
Post a Comment
Read more

Querying Palo Alto Strata Logging Service (SLS) Traffic and Threat Logs with Python

Image
I was recently told that querying Palo Alto Networks Strata Logging Service (SLS) directly through an API was not possible. I also found a few Reddit threads and older examples that pointed toward the legacy Cortex Data Lake APIs, but after spending some time with the Strata Cloud Manager Log Viewer and Chrome Developer Tools, it turns out that raw Traffic and Threat logs can be queried programmatically. The important caveat is that I have not found public Palo Alto documentation for the specific Log Viewer resources used below. The API is clearly being used by the Strata Cloud Manager UI, though, and it works with the normal service-account OAuth flow. API Endpoints For the US tenant I tested against, Traffic logs were available here: https://pa-us01.api.prismaaccess.com/api/sase/v3.0/resource/query/logviewer/firewall_traffic Threat logs use a similar resource: https://pa-us01.api.prismaaccess.com/api/sase/v3.0/resource/query/logviewe...
Post a Comment
Read more

Suppressing Fault Code "F2543" in Cisco ACI/APIC (3.1+) with the Cobra SDK

Sometimes in the ACI environment you would like to suppress a fault that either isn't typically suppressible or one that is hard to find to suppress. Legacy note: This 2018 article targets Cisco ACI/APIC 3.1 and the Python 2.7-era Cobra SDK. It remains available as a historical reference. APIs, packages, and vendor guidance may have changed, so validate the approach against current Cisco documentation before using it in production. I recently encountered CSCvi72804 which will cause unsuppressible faults that are auto-generated if you have used a fabric ID value other than "1". I couldn't let the persistent alerts go unaddressed, so I wrote a script to suppress these faults. According to TAC, my only other options were to upgrade my ACI fabric to 3.2 or wipe the whole production datacenter and build it with a fabric ID value of "1". No thanks for those other options. This script will put your fault suppression inside the Fabric tab's monitoring poli...
Post a Comment
Read more

Adding FEX Static Ports to Cisco ACI with Cobra SDK (Network-Centric Approach)

Let's look at how to start migrating FEXs to ACI. Legacy note: This 2017 article and its sample code target Cisco ACI 2.3(1f) and the Python 2.7-era Cobra SDK. Treat it as a historical migration reference and validate object models, dependencies, and deployment steps against current Cisco documentation. Firstly, we need to discuss the basics of the application-centric approach and the network-centric approach. In the network-centric model, you can connect ACI to a legacy network that is still running significant VLANs. This is a decent strategy if you don't want to re-IP as you move to ACI and have a significant Nexus 7000/5000/2000 deployment today. Background: Cisco ACI overview Although ACI is capable of handling this type of infrastructure, it was obviously not designed to maintain a deployment this way from the GUI so we will need to compensate with a significant amount of scripting. This example was actually created to support some B22 migrations. For each of th...
Post a Comment
Read more

Getting Started with the Cisco Cobra SDK and ACI

We should talk about Cisco ACI and the Python Cobra SDK. The Cisco ACI Python Cobra SDK can automate common tasks that are cumbersome to repeat manually in the APIC interface. Legacy note: This 2017 introduction targets Cisco ACI 2.3(1f) and the Python 2.7-era Cobra SDK. Package installation, authentication behavior, and supported APIs may differ in current releases. Use current Cisco documentation for production implementations. I will not provide examples of how to install the Cobra SDK or any of the Python modules you need. There are plenty of other places on the internet that you can get those instructions from. Let's start with the absolute basics. Authentication is obviously the first step as we begin our discussion of Cisco ACI. I have provided a basic auth module that can be imported into any Python SDK program. It's not really all that useful, but it will be easier for me to include code later as these posts will build on each other. We should talk about Cis...
Post a Comment
Read more