One read-only API admin on the firewall gives SmartTile the whole PAN-OS picture — HA, IPsec and GlobalProtect, licences, the security and NAT rule base with a change history, configuration backups, PAN-OS advisories and who signed in — next to the rest of the network, in the IT Service Management (ITSM) system your team already uses.
/api/) over HTTPS 443, with a read-only admin's API key.Ping says a Palo Alto firewall is up. It does not say the HA peer dropped, a Threat Prevention licence lapses next week, a tunnel to a branch is down or someone edited a rule at 2 a.m. The PAN-OS XML API answers all of that, and SmartTile only ever reads it: show commands, config reads and a config export — nothing that sets, commits or reboots. Up/down stays with SmartTile's agent (ping/SNMP); the API adds everything behind it.
Model, serial, PAN-OS version, hostname and MAC written to the device record, marked “Palo Alto PAN-OS API”. A value typed by a person is never overwritten.
HA state and sync, interfaces with zones, session table use, dataplane CPU, hardware sensors, licence expiry, available PAN-OS releases and the admins logged in now.
Every IPsec tunnel with its state, peer and monitor, plus the GlobalProtect users connected — user, computer, source and VPN address.
Security and NAT rules for every virtual system, in evaluation order, re-read hourly. Each rule added, removed, changed or moved is logged with what changed.
The running configuration exported over the API on the device's backup schedule — saved, hashed, and kept as a new version with a diff only when it changed.
Target = newest release on the running branch; else the next feature release, flagged as a planned branch upgrade — never a multi-branch jump. Verified after the window.
AccessAutomate reads the firewall's own logs: every admin sign-in, failed sign-in and configuration command, with user and source address. SmartTile's own polling is labelled as such.
HA peer lost, licence expiring, tunnel down, hardware alarm, CPU or sessions high, newer PAN-OS: each opens once and fires the Workflow trigger once — never per poll.
157.245.117.9 under Permitted IP Addresses (and any cloud security group). Port 443./api/?type=keygen, or type the admin's name and password once — SmartTile generates the key and never stores the password.| XML API permission | What it powers |
|---|---|
| Operational Requests | Identity, health, HA, interfaces, IPsec, GlobalProtect, licences, logged-in admins, PAN-OS advisories and verify. |
| Configuration | Security and NAT rule inventory and the change ledger. |
| Export | Configuration backups of the running config. |
| Log | AccessAutomate — sign-ins and configuration changes. |
| Installing PAN-OS | Never. SmartTile does not install releases; an engineer upgrades in the window and SmartTile verifies the running version. |
Only show/op reads, config reads, log queries and one config export. No set, edit, commit or reboot exists in SmartTile's PAN-OS client.
Encrypted at rest per device, sent only in the X-PAN-KEY header of a POST (never in a URL), never returned — the screen shows only “Key saved”.
The self-signed certificate is trusted by its SHA-256 fingerprint from Test. A different certificate stops the call before the key is sent.
Every route checks the firewall belongs to the caller's company; changes need edit rights on its location and viewers cannot change anything. Saves are in the activity log, without the key.
show system infoidentity, PAN-OS version, uptime; the Test callshow high-availability state · show interface allHA, interfaces, zonesshow session info · show running resource-monitorsession table, dataplane CPUshow vpn flow · ipsec-sa · global-protect-gateway current-usertunnels, GlobalProtect usersshow system environmentals · request license infohardware sensors, licencesrequest system software info · show adminsPAN-OS releases, logged-in adminsaction=show …/rulebase/security · /natrule inventory per vsyscategory=configurationrunning-config backupsystem (subtype auth) · configAccessAutomate eventsWhen the company's firmware ticketing is switched on (off by default), each advisory opens in Rev.io and every other system the company enabled for firmware tickets (Asana included), and closes once SmartTile reads the target version.
In VPNAutomate, switch on the tunnels that matter: each is read live, and one staying down past the alert delay opens a ticket and e-mails the NOC. Unreadable firewall = unknown, never down.
The trigger “A Palo Alto firewall reports a problem” lets a company route chosen problems to a person — an Asana task for the engineer who owns the firewall, for example. Workflows ship switched off.
| Objection | Answer |
|---|---|
| “You would have write access to our firewall.” | No. The role has XML API reads only, and SmartTile's client has no write command. PAN-OS upgrades stay with your engineer. |
| “We already have Panorama.” | Different job. SmartTile puts the firewall next to your circuits, switches and access points, and tickets in your ITSM system — it does not manage configuration. |
| “Our VM-Series is already in SmartTile as a cloud instance.” | Switch the integration on for that record: its cloud up/down, vendor and model stay; PAN-OS adds health, rules and config. |