AI导哈

防火墙管理套件

Palo Alto Networks MCP Server Suite 是一套用于通过统一API接口管理Palo Alto Networks防火墙和服务的模块化工具集，提供核心操作、策略管理、配置设置、网络对象管理和设备监控等功能。

  • by packetracer
  • JavaScript
  • 本地部署
  • 更新于
在 GitHub 查看 packetracer/mcpserver

使用说明

Palo Alto Networks MCP服务器套件

一套全面的模型上下文协议（MCP）服务器，用于通过统一的API接口管理Palo Alto Networks防火墙和服务。

目录

概述

Palo Alto Networks MCP服务器套件通过专用服务器提供了一种模块化的防火墙管理方法：

  • 核心服务器：基础防火墙操作和共享功能
  • 策略服务器：安全政策和规则管理
  • 配置服务器：系统配置和设置
  • 对象服务器：网络对象和地址管理
  • 设备服务器：设备操作和监控

建筑

┌─────────────────┐     ┌──────────────────┐
│    Core Server  │◄────┤  Policy Server   │
│                 │     └──────────────────┘
│  (Base Services)│     ┌──────────────────┐
│                 │◄────┤  Config Server   │
│                 │     └──────────────────┘
│                 │     ┌──────────────────┐
│                 │◄────┤  Objects Server  │
│                 │     └──────────────────┘
│                 │     ┌──────────────────┐
│                 │◄────┤  Device Server   │
└────────┬────────┘     └──────────────────┘
         │
         ▼
┌─────────────────┐
│  Palo Alto API  │
└─────────────────┘

安装

通过Smithery安装

通过以下方式自动安装适用于Claude Desktop的Palo Alto Networks MCP服务器套件 史密瑟里:

npx -y @smithery/cli install @DynamicEndpoints/paloalto-mcp-server --client claude

手动安装

  1. 克隆存储库：
git clone https://github.com/your-org/paloalto-mcp-servers.git
cd paloalto-mcp-servers
  1. 为每台服务器安装依赖关系：
# Install core server
cd paloalto-server
npm install

# Install policy server
cd ../paloalto-policy-server
npm install

# Install config server
cd ../paloalto-config-server
npm install

# Install objects server
cd ../paloalto-objects-server
npm install

# Install device server
cd ../paloalto-device-server
npm install
  1. 配置环境变量：
# Create .env files in each server directory
PANOS_API_KEY=your-api-key
PANOS_API_BASE_URL=https://your-firewall.example.com/api

# Optional configurations
PANOS_VERIFY_SSL=true
PANOS_TIMEOUT=30000
PANOS_DEBUG=false

服务器详细信息

核心服务器（paloalto服务器）

提供共享功能和核心操作的基础服务器。

主要特点

  • 身份验证和会话管理
  • API速率限制和重试逻辑
  • 共享实用功能
  • 错误处理框架

示例：基本身份验证

const result = await useMcpTool("paloalto-server", "verify_credentials", {
  api_key: process.env.PANOS_API_KEY
});

console.log(result.content[0].text); // Authentication status

策略服务器（paloalto策略服务器）

全面的政策和规则管理。

可用工具

  1. get_security_rules
// Get all security rules
const rules = await useMcpTool("paloalto-policy", "get_security_rules", {});

// Get rules with filtering
const webRules = await useMcpTool("paloalto-policy", "get_security_rules", {
  filter: {
    service: ["http", "https"],
    action: "allow"
  }
});
  1. 创建安全规则
// Create a basic security rule
await useMcpTool("paloalto-policy", "create_rule", {
  rule_type: "security",
  rule_data: {
    name: "allow-internal-web",
    source: ["internal-network"],
    destination: ["web-servers"],
    service: ["http", "https"],
    action: "allow",
    log_setting: "default",
    profile_setting: {
      group: ["default-protection"]
    }
  }
});

// Create a more complex rule with zones and applications
await useMcpTool("paloalto-policy", "create_rule", {
  rule_type: "security",
  rule_data: {
    name: "restrict-social-media",
    source_zone: ["trust"],
    destination_zone: ["untrust"],
    source: ["internal-users"],
    destination: ["any"],
    application: ["facebook-base", "twitter-base"],
    service: ["application-default"],
    action: "deny",
    log_setting: "detailed-logging",
    description: "Block social media access"
  }
});
  1. update_security_rule
// Update an existing rule
await useMcpTool("paloalto-policy", "update_rule", {
  rule_type: "security",
  rule_name: "allow-internal-web",
  rule_data: {
    service: ["http", "https", "ssh"],
    description: "Updated to allow SSH access"
  }
});

配置服务器（paloalto配置服务器）

系统配置和设置管理。

示例：网络配置

// Update DNS settings
await useMcpTool("paloalto-config", "update_network_settings", {
  dns_primary: "8.8.8.8",
  dns_secondary: "8.8.4.4",
  dns_search_domain: "example.com"
});

// Configure interfaces
await useMcpTool("paloalto-config", "configure_interface", {
  name: "ethernet1/1",
  config: {
    mode: "layer3",
    ip: ["10.0.1.1/24"],
    zone: "trust",
    enable: true
  }
});

对象服务器（paloalto对象服务器）

网络对象和地址管理。

示例：地址对象管理

// Create address objects
await useMcpTool("paloalto-objects", "create_address_object", {
  name: "web-server-1",
  type: "ip-netmask",
  value: "10.0.1.100/32",
  description: "Primary web server",
  tags: ["production", "web"]
});

// Create address group
await useMcpTool("paloalto-objects", "create_address_group", {
  name: "web-servers",
  description: "All web servers",
  members: ["web-server-1", "web-server-2"],
  tags: ["production", "web"]
});

// Create dynamic address group
await useMcpTool("paloalto-objects", "create_dynamic_address_group", {
  name: "active-web-servers",
  description: "Web servers currently in use",
  filter: "tag.production and tag.web and state.up"
});

设备服务器（paloalto设备服务器）

设备操作和监控。

示例：设备管理

// Get device status
const status = await useMcpTool("paloalto-device", "get_device_status", {});

// Commit changes
await useMcpTool("paloalto-device", "commit_changes", {
  description: "Updated security policies",
  admins: ["admin1"], // Optional: Specify which admin's changes to commit
});

// Backup configuration
await useMcpTool("paloalto-device", "backup_config", {
  filename: "backup-2024-01-20.xml",
  include_shared: true
});

集成模式

1.安全策略部署

async function deploySecurityPolicy() {
  // 1. Create address objects
  await useMcpTool("paloalto-objects", "create_address_object", {
    name: "internal-subnet",
    type: "ip-netmask",
    value: "192.168.1.0/24"
  });

  // 2. Create security rules
  await useMcpTool("paloalto-policy", "create_rule", {
    rule_type: "security",
    rule_data: {
      name: "allow-outbound",
      source: ["internal-subnet"],
      destination: ["any"],
      service: ["web-browsing"],
      action: "allow"
    }
  });

  // 3. Verify configuration
  const rules = await useMcpTool("paloalto-policy", "get_security_rules", {});
  
  // 4. Commit changes
  await useMcpTool("paloalto-device", "commit_changes", {
    description: "Deployed new security policy"
  });
}

2.高可用性配置

async function configureHA() {
  // 1. Configure HA interfaces
  await useMcpTool("paloalto-config", "configure_ha", {
    mode: "active-passive",
    group: {
      id: 1,
      description: "Primary HA Group"
    },
    interfaces: {
      ha1: {
        port: "ethernet1/3",
        ip: "10.0.0.1/24"
      },
      ha2: {
        port: "ethernet1/4",
        ip: "10.0.1.1/24"
      }
    }
  });

  // 2. Configure HA policy
  await useMcpTool("paloalto-config", "configure_ha_policy", {
    preemptive: true,
    heartbeat_interval: 2000,
    heartbeat_threshold: 3
  });

  // 3. Commit changes
  await useMcpTool("paloalto-device", "commit_changes", {
    description: "Configured HA settings"
  });
}

高级用法

1.自定义规则模板

const ruleTemplate = {
  base: {
    log_setting: "default",
    profile_setting: {
      group: ["default-protection"]
    }
  },
  web: {
    service: ["web-browsing"],
    application: ["web-browsing"],
    profile_setting: {
      group: ["strict-web-protection"]
    }
  }
};

async function createRuleFromTemplate(type, customData) {
  const template = {...ruleTemplate.base, ...ruleTemplate[type]};
  await useMcpTool("paloalto-policy", "create_rule", {
    rule_type: "security",
    rule_data: {...template, ...customData}
  });
}

2.批量操作

async function batchCreateObjects(objects) {
  const results = [];
  for (const obj of objects) {
    try {
      const result = await useMcpTool("paloalto-objects", "create_address_object", obj);
      results.push({status: "success", name: obj.name});
    } catch (error) {
      results.push({status: "error", name: obj.name, error: error.message});
    }
  }
  return results;
}

故障排除

常见问题

  1. API连接问题
// Test API connectivity
const status = await useMcpTool("paloalto-server", "test_connection", {
  timeout: 5000,
  verify_ssl: true
});

if (!status.success) {
  console.error(`Connection failed: ${status.error}`);
  // Check firewall accessibility
  // Verify API key permissions
  // Validate SSL certificates
}
  1. 规则冲突
// Analyze rule conflicts
const analysis = await useMcpTool("paloalto-policy", "analyze_rules", {
  rule_type: "security",
  checks: ["shadowing", "redundancy", "conflicts"]
});

if (analysis.issues.length > 0) {
  console.log("Found rule issues:", analysis.issues);
}
  1. 提交失败
try {
  await useMcpTool("paloalto-device", "commit_changes", {
    description: "Policy update"
  });
} catch (error) {
  if (error.code === "ConfigurationLocked") {
    // Handle locked configuration
    await useMcpTool("paloalto-device", "release_config_lock", {});
  } else if (error.code === "ValidationError") {
    // Handle validation errors
    console.error("Configuration validation failed:", error.details);
  }
}

贡献

  1. 分叉存储库
  2. 创建要素分支
git checkout -b feature/new-feature
  1. 提交您的更改
git commit -m "Add new feature"
  1. 推到分支
git push origin feature/new-feature
  1. 创建拉取请求

许可证

MIT许可证-有关详细信息，请参阅许可证文件

相关 MCP