Category Archives: Security

param
(
    [Parameter(Mandatory=$True,
    ValueFromPipeline=$True,
    ValueFromPipelineByPropertyName=$True,
    HelpMessage='CSV file with list of Palo Alto firewalls and their API key.  Format: fw,apiKey')]
    [string]$list,
    [Parameter(Mandatory=$False,
    ValueFromPipeline=$False,
    HelpMessage='If used, email will be sent.  If excluded, no email will be sent.')]
    [switch]$sendEmail = $false
)

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

if (-Not ("TrustAllCertsPolicy" -as [type]))
{
add-type @"
    using System.Net;
    using System.Security.Cryptography.X509Certificates;
    public class TrustAllCertsPolicy : ICertificatePolicy
    {
        public bool CheckValidationResult
        (
            ServicePoint srvPoint, X509Certificate certificate,
            WebRequest request, int certificateProblem
        )
        {
            return true;
        }
    }
"@


    [System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
}

$emailFrom = "<YourEmailAddress"
$emailTo = '<YourEmailAddress>'
$emailSubject = "Palo Alto FW Logging Issues"
$smtpServer = "<YourEmailServer>"

# How many hours the firewall's last log forward can be behind the current time.
$hourOffset = "2"

$fwLIst = Get-Content $list

$apiStem = "api/?type=op&cmd=%3Cshow%3E%3Clogging-status%3E%3C%2Flogging-status%3E%3C%2Fshow%3E"

$fwNotSendingLogs = $null

$htmlMessage = New-Object System.Text.StringBuilder
$textMessage = New-Object System.Text.StringBuilder

foreach ($listItem in $fwLIst)
{
    $fw,$apiKey = $listItem -split ","

    $url = "https://$($fw.trim())/$apiStem&key=$($apiKey.trim())"

    $WebRequestContent = $null
    $ErrResp = $null
    [xml]$WebResponse = $null

    try
    {
        $WebRequestContent = Invoke-WebRequest -Uri "$url" -Method Get
    }
    catch
    {
        $streamReader = [System.IO.StreamReader]::new($_.Exception.Response.GetResponseStream())
        $ErrResp = $streamReader.ReadToEnd() | ConvertFrom-Json
        $streamReader.Close()
    }

    if ($WebRequestContent -ne $null)
    {
        [xml]$WebResponse = $WebRequestContent.Content
    }

    if (($ErrResp) -or ($WebResponse -eq $null))
    {
        Write-Host "There was an error!" -ForegroundColor Red
        Write-Host $ErrResp -ForegroundColor Yellow
    }
    elseif($WebResponse.response.status -ne "success")
    {
        Write-Host "There was an error!" -ForegroundColor Red
        Write-Host $WebResponse.response.result -ForegroundColor Yellow
        Write-Host $WebResponse.response.status -ForegroundColor Yellow
    }
    else
    {

        $ConnStatus = $WebResponse.response.result | Select-String -Pattern 'Connection Status.*' -AllMatches | ForEach-Object{$_.Matches}

        $LogCollectors = $WebResponse.response.result | Select-String -Pattern 'Log Collector.*' -AllMatches | ForEach-Object{$_.Matches}
        
        $trafficString = $WebResponse.response.result | Select-String -Pattern 'traffic.*' -AllMatches | ForEach-Object{$_.Matches}

        $i=0
        
        if ($ConnStatus)
        {
            foreach ($ConnStringMatch in $ConnStatus)
            {                                                                                                       
                if ($ConnStringMatch -match "lr - Active")
                {

                    $logType,$logLastCreated,$logLastFwd,$seqNumFwd,$seqNumAck,$totalLogsFwd = $trafficString[$i] -split "\s{2,}"
                    $lcLabel,$lcValue = $LogCollectors[$i] -split ":"
                    $lcValue = $lcValue.Trim()

                    # Add offset hours to the Last Log Fwred datetime.  If this is less than the current datetime, logs are not being fowarded.  Add the firewall to the list.
                    if ($logLastFwd -as [DateTime])
                    {
                        if ((Get-Date $logLastFwd).AddHours($hourOffset) -lt (Get-Date))
                        {
                            $fwNotSendingLogs += $fw
                            $null = $htmlMessage.AppendLine("<tr><td>$fw</td><td>$lcValue</td><td>$logLastFwd</td></tr>")
                            $null = $textMessage.AppendLine("$fw using Log Collector $lcValue last forwarded logs on $logLastFwd")
                        }
                    }
                    else
                    {
                        $fwNotSendingLogs += $fw
                        $null = $htmlMessage.AppendLine("<tr><td>$fw</td><td>$lcValue</td><td>$logLastFwd</td></tr>")
                        $null = $textMessage.AppendLine("$fw using Log Collector $lcValue last forwarded logs on $logLastFwd")
                    }
                }
            
                $i++
            }
        }
        elseif ($trafficString)
        {

            $trafficString = $WebResponse.response.result | Where {$_ -match "traffic.*"} | Foreach {$Matches[0]}

            $logType,$logLastCreated,$logLastFwd,$seqNumFwd,$seqNumAck,$totalLogsFwd = $trafficString -split "\s{2,}"

            # Add offset hours to the Last Log Fwred datetime.  If this is less than the current datetime, logs are not being fowarded.  Add the firewall to the list.
            if ((Get-Date $logLastFwd).AddHours($hourOffset) -lt (Get-Date))
            {
                $fwNotSendingLogs += $fw
                $null = $htmlMessage.AppendLine("<tr><td>$fw</td><td>$logLastFwd</td></tr>")
                $null = $textMessage.AppendLine("$fw last forwarded logs on $logLastFwd")
            }
        }
    }
}

if ($fwNotSendingLogs)
{
    $htmlhead = "<html>
                <style>
                BODY{font-family: Consolas; font-size: 10pt;}
                H1{font-size: 22px; font-family: 'Segoe UI Light','Segoe UI','Lucida Grande',Verdana,Arial,Helvetica,sans-serif;}
                H2{font-size: 18px; font-family: 'Segoe UI Light','Segoe UI','Lucida Grande',Verdana,Arial,Helvetica,sans-serif;}
                H3{font-size: 16px; font-family: 'Segoe UI Light','Segoe UI','Lucida Grande',Verdana,Arial,Helvetica,sans-serif;}
                TABLE{border: 1px solid black; border-collapse: collapse; font-size: 9pt;}
                TH{border: 1px solid #969595; background: #dddddd; padding: 5px; color: #000000;}
                TD{border: 1px solid #969595; padding: 5px; }
                td.pass{background: #B7EB83;}
                td.warn{background: #FFF275;}
                td.fail{background: #FF2626; color: #ffffff;}
                td.info{background: #85D4FF;}
				tr:hover {background-color: #85D4FF}
                </style>
                <body>
                <p>The following Palo Alto firewalls have stopped forwarding logs:</p>
                <table>
                <tr><th>Firewall</th><th>Log Collector Name</th><th>Last Log Fowarded</th></tr>"
    
    $htmltail = "</table></body></html>"

    $body = $htmlhead + $htmlMessage + $htmltail

    If ($sendEmail)
    {
        Send-MailMessage -To $emailTo -body $body -BodyAsHtml -From $emailFrom -Subject $emailSubject -Priority High -smtpServer $smtpServer
    }

    Write-Host $textMessage -ForegroundColor Yellow
}
else
{
    Write-Host "All firewalls are forwarding logs."
}

Get-LoggingStatus.ps1 -list "C:\PathTo\firewall.txt" [-sendEmail]

firewall01 last forwarded logs on YYYY/MM/DD HH:MM:SS
firewall02 last forwarded logs on YYYY/MM/DD HH:MM:SS
...