Automate backup for Palo Alto devices without scripts

Palo Alto® configuration backup is the process of making a copy of the complete configuration and settings for Palo Alto devices. Configuration backups allow network administrators to recover quickly from a device failure, roll back from misconfiguration or simply revert a device to a previous state.

Because configurations change in time, configuration backups for Palo Alto should be created regularly and stored in a secure location.

Restorepoint includes support for the following Palo Alto device types:

Firewall Platforms
Panorama Management

Palo Alto configuration backup and restore

Configuration Backup Cisco checkpoint f5 palo alto

See other supported vendor devices

Learn about deployment options

Palo Alto solution brief

Use Case 1:

Challenge: Backup/Restore network devices

In the event of failure due to network connectivity issues or other outages, Restorepoint can be configured to retry the backup and generate alerts; the number of retries, interval and alerts can be set as required for the Palo Alto environment. For convenience, backups can be configured so that files created by Restorepoint are automatically prefixed with the Device ID and/or the Device Name, or any other custom prefix as required.

Use Case 2:

Challenge: Detect Changes and Automate Compliance Analysis for Audit and Security purposes

The compliance feature of Restorepoint allows configuration and status checks to be run for each registered Palo Alto Networks device to assess conformance to a target baseline. These checks can inspect backed up configuration files, and if required can also include commands and scripting (LUA), utilizing additional Device Controls during backup runtime (or scheduled), to interrogate each device and report findings by analyzing the output with Regex.

When adding a Palo Alto firewall, you need to use a super-user account. A read-only super-user account is sufficient for the default configuration backup, but not for the Device State backup.
Note that backups may fail if the admin account on the device is configured with the default password.
If you are adding a Panorama-managed Palo Alto firewall, you can also back up the state information, which includes device group and template settings pushed from Panorama. If the firewall is a GlobalProtect portal, the information also includes certificate information, a list of satellites, and satellite authentication information.
When Panorama is selected, you should not select Device State for backup, because this configuration type is not available on the device.
During a restore operation, Restorepoint will restore and commit the saved configuration.
Restorepoint can back up the device either using the XML API over HTTPS, or an SSH connection. When using SSH, the device uses either SCP or TFTP to transfer its configuration to Restorepoint. Please ensure that ports 443/tcp (when using the API) or 22/tcp and 69/udp (when using SSH) are not blocked by any firewalls between Restorepoint and the device.
Restorepoint can upgrade the PanOS software; this has been tested with PanOS 8.
Restorepoint support real-time change detection using syslog. Before enabling this in the Restorepoint UI, you first need to define a Syslog Profile in the Palo Alto UI with the Restorepoint IP address (Device tab, Server Profiles→Syslog), then add this profle to the Configuration section in the Log Settings screen, so that any configuration change/commit sends a syslog message to Restorepoint.
By default, the device uses the management interface to transfer its configuration via SCP/TFTP. If wanting to use a different interface, it must be specified by the source IP in the Source IP field in the Connection tab. This setting is ignored when using the XML API.

‍

How it works

Network Configuration Backup & Recovery

Change Detection & Compliance Checks

Track live Network Asset Inventory

Make Bulk Configuration Changes Faster

Access & Record Sessions using Web Terminal

Restorepoint enables organisations to remove network management complexity by putting routine tasks such as network configuration backup, compliance and change management tasks on autopilot across their multi-vendor network infrastructure.

Using Restorepoint's simple graphical user interface network administrators can quickly schedule network device backups without scripts, analyse devices to ensure security, compliance and automate bulk changes that would otherwise take hours or days to implement manually. Learn more about how Restorepoint how you can save time and ensure you meet your disaster recovery and compliance needs.