{"id":67,"date":"2016-10-10T23:46:37","date_gmt":"2016-10-10T15:46:37","guid":{"rendered":"https:\/\/www.theinsecurewire.com\/?p=67"},"modified":"2016-10-10T23:46:37","modified_gmt":"2016-10-10T15:46:37","slug":"palo-alto-api-captive-portal-logout","status":"publish","type":"post","link":"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/","title":{"rendered":"Using the Palo Alto API for Captive Portal Logout"},"content":{"rendered":"

It’s API time! Haven’t had a post in a while but in wanted to share this:<\/p>\n

This year I had the opportunity to roll out a Palo Alto networks next-gen firewall appliance. We have many areas of our college that require specific access to deliver classes (think IT, engineering etc). These areas are separated by an L2 firewall. Since i was rolling out a full user-id implementation of Palo Alto, i needed a solution that allowed these isolated areas to be able to access the network.<\/p>\n

\"Palo<\/a><\/p>\n

This is where the captive portal is really handy. You can redirect HTTP requests to a login page where the user is authenticated against your directory source and at the same time User-ID on the PAN will map that user to the source IP. The user will then be able to hit layer 7 rules based on user or group. You will also get the full content-id tracking of which user did what during their session. The issue that I faced was how to remove stale sessions if a user left a PC before the timeout values kicked in.<\/p>\n

A really cool feature of PAN-OS is its extensive RESTful XML API. You can browse PAN firewalls API by simply going to http(s):\/\/hostname\/api\/ (where host name is the device name and domain or IP address). Using the XML API i was able to create a php logout script which when called would remove the user to IP mapping from both the data plane and the management plane. The API supports both http GET and POST methods. The guide is accessible here<\/a>.<\/p>\n

Below is the code for logout.php which we call with wget or similar (no proxy). I used PHP as it was easy with the global $_SERVER[‘REMOTE_ADDR’] variable – this is so we could get the true client address as some machines are behind nat or even worse dual nat! The php curl module is used to access the PAN API using the http GET method.<\/p>\n

The variables needed are DNS name of the device and your API key. A prerequisite is that your host has the php5-curl package installed (for debian based \/w apache it is ‘sudo apt-get install php5-curl’).<\/p>\n[php]\n<\/p>\n

$ch = curl_init();
\n$url = “https:\/\/” .”$hostname”. “\/api\/?type=op&key=” .”$key”. “&vsys=vsys1&cmd=<clear><user-cache><ip>” .”$ipaddress
\ncurl_setopt($ch, CURLOPT_URL, $url);
\ncurl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
\ncurl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);<\/p>\n

$output = curl_exec($ch);
\ncurl_close($ch);
\n$format_dp = “<br \/><br \/>Response from PAN User-ID Data Plane:<br \/> “;
\n$response = $format_dp.$output;
\necho $response .” = api response <br \/><br \/>”;<\/p>\n

$format_msg = “I think your IP address is “;
\n$msg = $format_msg.$ipaddress;
\necho $msg .”<br><br>”;<\/p>\n

$ch1 = curl_init();
\n$urlmp = “https:\/\/” .”$hostname”. “\/api\/?type=op&key=” .”$key”. “&vsys=vsys1&cmd=<clear><user-cache-mp><ip>” .”$ipaddress
\ncurl_setopt($ch1, CURLOPT_URL, $urlmp);
\ncurl_setopt($ch1, CURLOPT_SSL_VERIFYHOST, false);
\ncurl_setopt($ch1, CURLOPT_SSL_VERIFYPEER, false);<\/p>\n

$output1 = curl_exec($ch1);
\ncurl_close($ch1);<\/p>\n

$format_mp = “Response from PAN User-ID Mgmt Plane: <br \/>”;
\n$response1 = $format_mp.$output1;
\necho $response1 . ” = api response”;
\n?>
\n[\/php]\nQuite simply you can call the script with a shell script or browse to the php page. We used a shell script and wget to http GET the script. You could set the shell \/ batch \/ powershell to run at logoff \/ startup whatever suits.<\/p>\n

Originally published as ‘Using the Palo Alto API for Captive Portal Logout’.<\/p>\n","protected":false},"excerpt":{"rendered":"

It’s API time! Haven’t had a post in a while but in wanted to share this: This year I had the opportunity to roll out…<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[28,9],"tags":[],"class_list":["post-67","post","type-post","status-publish","format-standard","hentry","category-firewall","category-scripting"],"acf":[],"yoast_head":"\nUsing the Palo Alto API for Captive Portal Logout - Insecure Wire<\/title>\n<meta name=\"description\" content=\"Using the Palo Alto Networks XML API Captive Portal for programmatic logout with PHP and cURL\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Using the Palo Alto API for Captive Portal Logout - Insecure Wire\" \/>\n<meta property=\"og:description\" content=\"Using the Palo Alto Networks XML API Captive Portal for programmatic logout with PHP and cURL\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/\" \/>\n<meta property=\"og:site_name\" content=\"Insecure Wire\" \/>\n<meta property=\"article:published_time\" content=\"2016-10-10T15:46:37+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.paloaltonetworks.com\/etc\/clientlibs\/pan\/img\/logo-blue-medium.png\" \/>\n<meta name=\"author\" content=\"nikonau\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/insecurewire\" \/>\n<meta name=\"twitter:site\" content=\"@insecurewire\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"nikonau\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/\"},\"author\":{\"name\":\"nikonau\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d\"},\"headline\":\"Using the Palo Alto API for Captive Portal Logout\",\"datePublished\":\"2016-10-10T15:46:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/\"},\"wordCount\":441,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.insecurewi.re\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.paloaltonetworks.com\/etc\/clientlibs\/pan\/img\/logo-blue-medium.png\",\"articleSection\":[\"Firewall\",\"Scripting\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/\",\"url\":\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/\",\"name\":\"Using the Palo Alto API for Captive Portal Logout - Insecure Wire\",\"isPartOf\":{\"@id\":\"https:\/\/www.insecurewi.re\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.paloaltonetworks.com\/etc\/clientlibs\/pan\/img\/logo-blue-medium.png\",\"datePublished\":\"2016-10-10T15:46:37+00:00\",\"description\":\"Using the Palo Alto Networks XML API Captive Portal for programmatic logout with PHP and cURL\",\"breadcrumb\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#primaryimage\",\"url\":\"https:\/\/www.paloaltonetworks.com\/etc\/clientlibs\/pan\/img\/logo-blue-medium.png\",\"contentUrl\":\"https:\/\/www.paloaltonetworks.com\/etc\/clientlibs\/pan\/img\/logo-blue-medium.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.insecurewi.re\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Using the Palo Alto API for Captive Portal Logout\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.insecurewi.re\/#website\",\"url\":\"https:\/\/www.insecurewi.re\/\",\"name\":\"Insecure Wire\",\"description\":\"A Network Engineer\u2019s Perspective.\",\"publisher\":{\"@id\":\"https:\/\/www.insecurewi.re\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.insecurewi.re\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.insecurewi.re\/#organization\",\"name\":\"Insecure Wire\",\"url\":\"https:\/\/www.insecurewi.re\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png\",\"contentUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png\",\"width\":32,\"height\":32,\"caption\":\"Insecure Wire\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/insecurewire\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d\",\"name\":\"nikonau\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g\",\"caption\":\"nikonau\"},\"sameAs\":[\"https:\/\/x.com\/https:\/\/twitter.com\/insecurewire\"],\"url\":\"https:\/\/www.insecurewi.re\/index.php\/author\/nikon\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Using the Palo Alto API for Captive Portal Logout - Insecure Wire","description":"Using the Palo Alto Networks XML API Captive Portal for programmatic logout with PHP and cURL","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/","og_locale":"en_US","og_type":"article","og_title":"Using the Palo Alto API for Captive Portal Logout - Insecure Wire","og_description":"Using the Palo Alto Networks XML API Captive Portal for programmatic logout with PHP and cURL","og_url":"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/","og_site_name":"Insecure Wire","article_published_time":"2016-10-10T15:46:37+00:00","og_image":[{"url":"https:\/\/www.paloaltonetworks.com\/etc\/clientlibs\/pan\/img\/logo-blue-medium.png","type":"","width":"","height":""}],"author":"nikonau","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/insecurewire","twitter_site":"@insecurewire","twitter_misc":{"Written by":"nikonau","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#article","isPartOf":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/"},"author":{"name":"nikonau","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d"},"headline":"Using the Palo Alto API for Captive Portal Logout","datePublished":"2016-10-10T15:46:37+00:00","mainEntityOfPage":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/"},"wordCount":441,"commentCount":0,"publisher":{"@id":"https:\/\/www.insecurewi.re\/#organization"},"image":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#primaryimage"},"thumbnailUrl":"https:\/\/www.paloaltonetworks.com\/etc\/clientlibs\/pan\/img\/logo-blue-medium.png","articleSection":["Firewall","Scripting"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/","url":"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/","name":"Using the Palo Alto API for Captive Portal Logout - Insecure Wire","isPartOf":{"@id":"https:\/\/www.insecurewi.re\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#primaryimage"},"image":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#primaryimage"},"thumbnailUrl":"https:\/\/www.paloaltonetworks.com\/etc\/clientlibs\/pan\/img\/logo-blue-medium.png","datePublished":"2016-10-10T15:46:37+00:00","description":"Using the Palo Alto Networks XML API Captive Portal for programmatic logout with PHP and cURL","breadcrumb":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#primaryimage","url":"https:\/\/www.paloaltonetworks.com\/etc\/clientlibs\/pan\/img\/logo-blue-medium.png","contentUrl":"https:\/\/www.paloaltonetworks.com\/etc\/clientlibs\/pan\/img\/logo-blue-medium.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.insecurewi.re\/index.php\/2016\/10\/10\/palo-alto-api-captive-portal-logout\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.insecurewi.re\/"},{"@type":"ListItem","position":2,"name":"Using the Palo Alto API for Captive Portal Logout"}]},{"@type":"WebSite","@id":"https:\/\/www.insecurewi.re\/#website","url":"https:\/\/www.insecurewi.re\/","name":"Insecure Wire","description":"A Network Engineer\u2019s Perspective.","publisher":{"@id":"https:\/\/www.insecurewi.re\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.insecurewi.re\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.insecurewi.re\/#organization","name":"Insecure Wire","url":"https:\/\/www.insecurewi.re\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/","url":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png","contentUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png","width":32,"height":32,"caption":"Insecure Wire"},"image":{"@id":"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/insecurewire"]},{"@type":"Person","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d","name":"nikonau","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g","caption":"nikonau"},"sameAs":["https:\/\/x.com\/https:\/\/twitter.com\/insecurewire"],"url":"https:\/\/www.insecurewi.re\/index.php\/author\/nikon\/"}]}},"_links":{"self":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts\/67","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/comments?post=67"}],"version-history":[{"count":0,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts\/67\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/media?parent=67"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/categories?post=67"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/tags?post=67"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}