Palo Alto Networks Remote Networks API
The Remote Networks API from Palo Alto Networks — 4 operation(s) for remote networks.
OpenAPI Specification
openapi: 3.2.0
info:
title: Palo Alto Networks Remote Networks API
version: '1.0'
description: 'Operations tagged Remote Networks across 2 of this provider''s published API definitions: palo-alto-sase-config-orch-paloaltonetworks-remote-networks-openapi.yaml, palo-alto-scm-config-sase-deployment-deployment-services-june-openapi.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com/config/deployment/v1
description: Current
- url: https://api.sase.paloaltonetworks.com/sse/config/v1
description: Legacy
tags:
- name: Remote Networks
paths:
/v1/remote-networks:
delete:
description: 'Allows you to delete the set of IPSec tunnels.
'
operationId: delete-v1-remote-networks
parameters:
- $ref: '#/components/parameters/SubTenantName'
- description: remote networks prefix for bulk deletion
in: query
name: remote_networks_prefix
required: true
schema:
type: string
- $ref: '#/components/parameters/RemoteNetworksNames'
responses:
'202':
content:
application/json:
schema:
$ref: '#/components/schemas/UuidResponse'
description: successful operation
'400':
$ref: '#/components/responses/bad_request_errors_basic_with_body'
default:
$ref: '#/components/responses/default_errors'
security:
- Bearer: []
summary: Bulk delete IPSec tunnels
tags:
- Remote Networks
get:
description: 'Get remote networks IPSec tunnel details for create, modify, or delete by ID.
'
operationId: get-v1-remote-networks
parameters:
- $ref: '#/components/parameters/uuid'
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/RemoteNetworksResponse'
description: Remote networks IPSEC tunnel details.
security:
- Bearer: []
summary: Get IPSec tunnel details
tags:
- Remote Networks
post:
description: 'Create remote network IPSec tunnels.
'
operationId: post-v1-remote-networks
parameters:
- $ref: '#/components/parameters/SubTenantName'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/RemoteNetworksIpsecTunnelSet'
description: Create the remote network IPSEC tunnels.
responses:
'202':
content:
application/json:
schema:
$ref: '#/components/schemas/UuidResponse'
description: Successful operation
'400':
$ref: '#/components/responses/bad_request_errors_basic_with_body'
default:
$ref: '#/components/responses/default_errors'
security:
- Bearer: []
summary: Create IPSec tunnels
tags:
- Remote Networks
put:
description: 'Modify remote network IPSec tunnels.
'
operationId: put-v1-remote-networks
parameters:
- $ref: '#/components/parameters/SubTenantName'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/RemoteNetworksIpsecTunnelSet'
description: Modify the remote network IPSEC tunnels.
responses:
'202':
content:
application/json:
schema:
$ref: '#/components/schemas/UuidResponse'
description: Successful operation
'400':
$ref: '#/components/responses/bad_request_errors_basic_with_body'
default:
$ref: '#/components/responses/default_errors'
security:
- Bearer: []
summary: Modify IPSec tunnels
tags:
- Remote Networks
servers:
- url: https://api.sase.paloaltonetworks.com
/v1/remote-networks-read:
get:
description: 'Read the remote networks IPSec tunnel status by UUID.
'
operationId: get-v1-remote-networks-read
parameters:
- $ref: '#/components/parameters/uuid'
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/RemoteNetworksReadResult'
description: Get the remote networks IPSEC tunnel status by UUID.
security:
- Bearer: []
summary: Read IPSec tunnel details
tags:
- Remote Networks
post:
description: 'Create a request to read remote network IPSec tunnels.
'
operationId: post-v1-remote-networks-read
parameters:
- $ref: '#/components/parameters/SubTenantName'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/RemoteNetworksNamesSet'
description: Request to read remote networks IPSEC tunnels.
responses:
'202':
content:
application/json:
schema:
$ref: '#/components/schemas/UuidResponse'
description: Successful operation
'400':
$ref: '#/components/responses/bad_request_errors_basic_with_body'
default:
$ref: '#/components/responses/default_errors'
security:
- Bearer: []
summary: Request to read IPSec tunnels
tags:
- Remote Networks
servers:
- url: https://api.sase.paloaltonetworks.com
/remote-networks:
get:
tags:
- Remote Networks
summary: List remote networks
description: 'Retrieve a list of remote networks.
'
operationId: ListRemoteNetworks
parameters:
- $ref: '#/components/parameters/folder-remotenetworks'
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/offset'
- $ref: '#/components/parameters/name'
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data:
allOf:
- type: array
items:
$ref: '#/components/schemas/remote-networks'
limit:
type: integer
default: 200
offset:
type: integer
default: 0
total:
type: integer
'400':
$ref: '#/components/responses/bad_request_errors_basic'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'404':
$ref: '#/components/responses/not_found'
default:
$ref: '#/components/responses/default_errors_2'
security:
- scmToken: []
post:
tags:
- Remote Networks
summary: Create a remote network
description: 'Create a new remote network.
'
operationId: CreateRemoteNetworks
requestBody:
description: Created
content:
application/json:
schema:
$ref: '#/components/schemas/remote-networks'
responses:
'201':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/remote-networks'
'400':
$ref: '#/components/responses/bad_request_errors_basic_with_body_2'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'409':
$ref: '#/components/responses/conflict_errors'
default:
$ref: '#/components/responses/default_errors_2'
security:
- scmToken: []
servers:
- url: https://api.strata.paloaltonetworks.com/config/deployment/v1
description: Current
- url: https://api.sase.paloaltonetworks.com/sse/config/v1
description: Legacy
/remote-networks/{id}:
get:
tags:
- Remote Networks
summary: Get a remote network
description: 'Get an existing remote network.
'
operationId: GetRemoteNetworksByID
parameters:
- $ref: '#/components/parameters/uuid_2'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/remote-networks'
'400':
$ref: '#/components/responses/bad_request_errors_basic'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'404':
$ref: '#/components/responses/not_found'
default:
$ref: '#/components/responses/default_errors_2'
security:
- scmToken: []
put:
tags:
- Remote Networks
summary: Update a remote network
description: 'Update an existing remote network.
'
operationId: UpdateRemoteNetworksByID
parameters:
- $ref: '#/components/parameters/uuid_2'
requestBody:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/remote-networks'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/remote-networks'
'400':
$ref: '#/components/responses/bad_request_errors_basic_with_body_2'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'404':
$ref: '#/components/responses/not_found'
'409':
$ref: '#/components/responses/conflict_errors'
default:
$ref: '#/components/responses/default_errors_2'
security:
- scmToken: []
delete:
tags:
- Remote Networks
summary: Delete a remote network
description: 'Delete a remote network.
'
operationId: DeleteRemoteNetworksByID
parameters:
- $ref: '#/components/parameters/uuid_2'
responses:
'200':
$ref: '#/components/responses/http_ok'
'400':
$ref: '#/components/responses/bad_request_errors_basic'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'404':
$ref: '#/components/responses/not_found'
'409':
$ref: '#/components/responses/conflict_errors'
default:
$ref: '#/components/responses/default_errors_2'
security:
- scmToken: []
servers:
- url: https://api.strata.paloaltonetworks.com/config/deployment/v1
description: Current
- url: https://api.sase.paloaltonetworks.com/sse/config/v1
description: Legacy
components:
schemas:
IkeCryptoProfiles:
properties:
authentication_multiple:
default: 0
description: IKEv2 SA reauthentication interval equals authetication-multiple * rekey-lifetime; 0 means reauthentication disabled
maximum: 50
type: integer
dh_group:
items:
default: group2
description: Phase-1 DH group
enum:
- group1
- group2
- group5
- group14
- group19
- group20
type: string
type: array
encryption:
description: Encryption algorithm
items:
default: aes-128-cbc
enum:
- des
- 3des
- aes-128-cbc
- aes-192-cbc
- aes-256-cbc
- aes-128-gcm
- aes-256-gcm
type: string
type: array
hash:
items:
default: sha1
description: Hashing algorithm
enum:
- md5
- sha1
- sha256
- sha384
- sha512
type: string
type: array
id:
description: uuid of the resource
example: abcd-1234
readOnly: true
type: string
lifetime:
oneOf:
- properties:
seconds:
description: specify lifetime in seconds
maximum: 65535
minimum: 180
type: integer
title: seconds
type: object
- properties:
minutes:
description: specify lifetime in minutes
maximum: 65535
minimum: 3
type: integer
title: minutes
type: object
- properties:
hours:
description: specify lifetime in hours
maximum: 65535
minimum: 1
type: integer
title: hours
type: object
- properties:
days:
description: specify lifetime in days
maximum: 365
minimum: 1
type: integer
title: days
type: object
type: object
name:
description: 'Alphanumeric string begin with letter: [0-9a-zA-Z._-]'
maxLength: 31
type: string
required:
- name
- encryption
- hash
- dh_group
type: object
EcmpLoadBalancing:
properties:
ecmp_load_balancing_enabled:
default: disable
enum:
- enable
- disable
type: string
ecmp_tunnels:
description: ecmp_tunnels is required when ecmp_load_balancing is enable
items:
properties:
bgp:
properties:
do_not_export_routes:
type: boolean
enable:
type: boolean
local_ip_address:
type: string
originate_default_route:
type: boolean
peer_as:
type: string
peer_ip_address:
type: string
peering_type:
description: 'Exchange Routes: exchange-v4-over-v4 stands for Exchange IPv4 routes over IPv4 peering. exchange-v4-v6-over-v4 stands for Exchange both IPv4 and IPv6 routes over IPv4 peering. exchange-v4-over-v4-v6-over-v6 stands for Exchange IPv4 routes over IPv4 peer and IPv6 route over IPv6 peer. exchange-v6-over-v6 stands for Exchange IPv6 routes over IPv6 peering.'
enum:
- exchange-v4-over-v4
- exchange-v4-v6-over-v4
- exchange-v4-over-v4-v6-over-v6
- exchange-v6-over-v6
type: string
secret:
type: string
summarize_mobile_user_routes:
type: boolean
type: object
ipsec_tunnel:
$ref: '#/components/schemas/IpsecTunnel'
name:
type: string
required:
- name
- ipsec_tunnel
type: object
maxLength: 4
type: array
type: object
RemoteNetworksProtocolBgp:
properties:
do_not_export_routes:
type: boolean
enable:
description: To setup bgp protocol, enable need to set as true
type: boolean
local_ip_address:
type: string
originate_default_route:
type: boolean
peer_as:
type: string
peer_ip_address:
type: string
peering_type:
description: 'Exchange Routes: exchange-v4-over-v4 stands for Exchange IPv4 routes over IPv4 peering. exchange-v4-v6-over-v4 stands for Exchange both IPv4 and IPv6 routes over IPv4 peering. exchange-v4-over-v4-v6-over-v6 stands for Exchange IPv4 routes over IPv4 peer and IPv6 route over IPv6 peer. exchange-v6-over-v6 stands for Exchange IPv6 routes over IPv6 peering.'
enum:
- exchange-v4-over-v4
- exchange-v4-v6-over-v4
- exchange-v4-over-v4-v6-over-v6
- exchange-v6-over-v6
type: string
secret:
type: string
summarize_mobile_user_routes:
type: boolean
type: object
generic_error:
properties:
_errors:
$ref: '#/components/schemas/error_detail_cause_infos'
_request_id:
type: string
type: object
RemoteNetworksIpsecTunnel:
properties:
bgp:
properties:
bgp_peer:
properties:
local_ip_address:
type: string
peer_ip_address:
type: string
secret:
type: string
type: object
do_not_export_routes:
type: boolean
enable:
type: boolean
local_ip_address:
type: string
originate_default_route:
type: boolean
peer_as:
type: string
peer_ip_address:
type: string
peering_type:
description: 'Exchange Routes: exchange-v4-over-v4 stands for Exchange IPv4 routes over IPv4 peering. exchange-v4-v6-over-v4 stands for Exchange both IPv4 and IPv6 routes over IPv4 peering. exchange-v4-over-v4-v6-over-v6 stands for Exchange IPv4 routes over IPv4 peer and IPv6 route over IPv6 peer. exchange-v6-over-v6 stands for Exchange IPv6 routes over IPv6 peering.'
enum:
- exchange-v4-over-v4
- exchange-v4-v6-over-v4
- exchange-v4-over-v4-v6-over-v6
- exchange-v6-over-v6
type: string
secret:
type: string
summarize_mobile_user_routes:
type: boolean
type: object
ecmp-load-balancing:
$ref: '#/components/schemas/EcmpLoadBalancing'
ipsec-termination-node:
description: ipsec termination node
type: string
name:
description: 'Alphanumeric string begin with letter: [0-9a-zA-Z._-]'
maxLength: 63
type: string
primary_tunnel:
$ref: '#/components/schemas/IpsecTunnel'
region:
minLength: 5
type: string
secondary_tunnel:
$ref: '#/components/schemas/IpsecTunnel'
subnets:
items:
type: string
type: array
required:
- name
- region
type: object
Ike:
properties:
advanced:
$ref: '#/components/schemas/IkeAdvanced'
authentication:
properties:
pre_shared_key_auth:
description: user provided key
type: string
type: object
crypto:
oneOf:
- $ref: '#/components/schemas/IkeCryptoProfiles'
- $ref: '#/components/schemas/IkeCrypto'
type: object
local_id:
properties:
id:
description: Local ID string
maxLength: 1024
minLength: 1
pattern: ^(.+\@[a-zA-Z0-9.-]+)$|^([$a-zA-Z0-9_:.-]+)$|^(([[:xdigit:]][[:xdigit:]])+)$|^([a-zA-Z0-9.]+=(\\,|[^,])+[, ]+)*([a-zA-Z0-9.]+=(\\,|[^,])+)$
type: string
type:
type: string
type: object
peer_address:
oneOf:
- properties:
ip:
description: peer gateway has static IP address
type: string
title: ip
type: object
- properties:
fqdn:
description: peer gateway FQDN name
maxLength: 255
type: string
title: fqdn
type: object
- properties:
dynamic:
default: {}
description: 'enable dynamic option please set the value of this field to {'''': ''''}'
type: object
title: dynamic
type: object
type: object
peer_id:
properties:
id:
description: Peer ID string
maxLength: 1024
minLength: 1
pattern: ^(.+\@[\*a-zA-Z0-9.-]+)$|^([\*$a-zA-Z0-9_:.-]+)$|^(([[:xdigit:]][[:xdigit:]])+)$|^([a-zA-Z0-9.]+=(\\,|[^,])+[, ]+)*([a-zA-Z0-9.]+=(\\,|[^,])+)$
type: string
type:
enum:
- ipaddr
- keyid
- fqdn
- ufqdn
type: string
type: object
version:
enum:
- ikev1
- ikev2
- ikev2-preferred
type: string
required:
- authentication
- crypto
- peer_address
type: object
error_detail_cause_info:
properties:
code:
type: string
details:
type: object
help:
type: string
message:
type: string
title: Cause Info
type: object
Lifetime:
oneOf:
- properties:
seconds:
description: specify lifetime in seconds
maximum: 65535
minimum: 180
type: integer
title: seconds
type: object
- properties:
minutes:
description: specify lifetime in minutes
maximum: 65535
minimum: 3
type: integer
title: minutes
type: object
- properties:
hours:
description: specify lifetime in hours
maximum: 65535
minimum: 1
type: integer
title: hours
type: object
- properties:
days:
description: specify lifetime in days
maximum: 365
minimum: 1
type: integer
title: days
type: object
type: object
Lifesize:
oneOf:
- properties:
kb:
description: specify lifesize in kilobytes(KB)
maximum: 65535
minimum: 1
type: integer
title: kb
type: object
- properties:
mb:
description: specify lifesize in megabytes(MB)
maximum: 65535
minimum: 1
type: integer
title: mb
type: object
- properties:
gb:
description: specify lifesize in gigabytes(GB)
maximum: 65535
minimum: 1
type: integer
title: gb
type: object
- properties:
tb:
description: specify lifesize in terabytes(TB)
maximum: 65535
minimum: 1
type: integer
title: tb
type: object
type: object
IpsecTunnel:
properties:
anti_replay:
description: Enable Anti-Replay check on this tunnel
type: boolean
copy_tos:
default: false
description: Copy IP TOS bits from inner packet to IPSec packet (not recommended)
type: boolean
crypto:
oneOf:
- $ref: '#/components/schemas/IpsecCryptoProfiles'
- $ref: '#/components/schemas/IpsecCrypto'
type: object
enable_gre_encapsulation:
default: false
description: allow GRE over IPSec
type: boolean
ike:
$ref: '#/components/schemas/Ike'
tunnel_monitor:
properties:
destination_ip:
default: ''
description: Destination IP to send ICMP probe
type: string
enable:
default: true
description: Enable tunnel monitoring on this tunnel
type: boolean
proxy_id:
description: Which proxy-id (or proxy-id-v6) the monitoring traffic will use
type: string
type: object
required:
- ike
type: object
RemoteNetworksIpsecTunnelResponse:
properties:
name:
description: rn name
type: string
pre_shared_key:
description: Pre Shared Key for the Ipsec Tunnel
type: string
service_ip:
description: Service Ip for the provisioned remote network tunnel
format: ipv4
type: string
tunnel_id:
description: tunnel id
type: string
type: object
IkeAdvanced:
properties:
fragmentation:
properties:
enable:
default: false
enum:
- false
type: boolean
type: object
nat_traversal:
properties:
enable:
type: boolean
type: object
passive_mode:
type: boolean
type: object
IpsecCryptoProfiles:
properties:
ah:
properties:
authentication:
items:
enum:
- md5
- sha1
- sha256
- sha384
- sha512
type: string
type: array
required:
- authentication
type: object
dh_group:
default: group2
description: phase-2 DH group (PFS DH group)
enum:
- no-pfs
- group1
- group2
- group5
- group14
- group19
- group20
type: string
esp:
properties:
authentication:
description: Authentication algorithm
items:
default: sha1
type: string
type: array
encryption:
description: Encryption algorithm
items:
default: aes-128-cbc
enum:
- des
- 3des
- aes-128-cbc
- aes-192-cbc
- aes-256-cbc
- aes-128-gcm
- aes-256-gcm
- 'null'
type: string
type: array
required:
- encryption
- authentication
type: object
lifesize:
$ref: '#/components/schemas/Lifesize'
lifetime:
$ref: '#/components/schemas/Lifetime'
name:
description: 'Alphanumeric string begin with letter: [0-9a-zA-Z._-]'
maxLength: 31
type: string
required:
- name
- lifetime
type: object
RemoteNetworksIpsecTunnelSet:
properties:
name:
description: provide a name to use as a suffix for bulk operations
type: string
remote_networks_ipsec_tunnels:
items:
$ref: '#/components/schemas/RemoteNetworksIpsecTunnel'
maxItems: 100
minItems: 1
type: array
uniqueItems: true
required:
- name
type: object
error_detail_cause_infos:
items:
$ref: '#/components/schemas/error_detail_cause_info'
type: array
RemoteNetworksNamesSet:
properties:
remote_networks_names:
items:
type: string
maxItems: 100
minItems: 0
type: array
uniqueItems: true
type: object
UuidResponse:
properties:
uuid:
format: uuid
type: string
readOnly: true
type: object
RemoteNetworksIpsecTunnelResponseSet:
properties:
remote_networks_ipsec_tunnel_response_set:
items:
$ref: '#/components/schemas/RemoteNetworksIpsecTunnelResponse'
type: array
type: object
RemoteNetworksConfiguration:
properties:
ecmp_load_balancing:
default: disable
enum:
- enable
- disable
type: string
ecmp_tunnels:
description: ecmp_tunnels is required when ecmp_load_balancing is enable
items:
properties:
ipsec_tunnel:
type: string
name:
type: string
protocol:
properties:
bgp:
$ref: '#/components/schemas/RemoteNetworksProtocolBgp'
type: object
required:
- name
- ipsec_tunnel
- protocol
type: object
maxLength: 4
type: array
id:
description: uuid of the resource
example: abcd-1234
readOnly: true
type: string
inbound_access:
properties:
applications:
items:
properties:
dedicated_ip:
default: false
description: Dedicated IP address for this application
type: boolean
port:
description: Destination port
maximum: 65535
minimum: 1
type: integer
private_ip:
description: Private IP address
type: string
protocol:
description: Protocol used by this application
enum:
- TCP
- UDP
type: string
type: object
type: array
enabled:
default: false
description: Enable Inbound Access
type: boolean
public_ip:
default: 5
enum:
- 5
- 10
type: string
snat_enabled:
default: true
description: Enable source NAT
type: boolean
type: object
ipsec_tunnel:
description: ipsec_tunnel is required when ecmp_load_balancing is disable
type: string
license_type:
default: FWAAS-AGGREGATE
description: New customer will only be on aggregate bandwidth licensing
minLength: 1
type: string
name:
description: 'Alphanumeric string begin with letter: [0-9a-zA-Z._-]'
maxLength: 63
type: string
override_spn_name:
default: false
description: Enable/disable the ability to override the remote-network's spn-name at site level
type: boolean
protocol:
description: setup the protocol when ecmp_load_balancing is disable
properties:
bgp:
$ref: '#/components/schemas/RemoteNetworksProtocolBgp'
bgp_peer:
description: secondary bgp routing as bgp_peer
properties:
local_ip_address:
type: string
peer_ip_address:
type: string
secret:
type: string
type: object
type: object
region:
minLength: 1
type: string
secondary_ipsec_tunnel:
description: specify secondary ipsec_tunnel if needed
type: string
spn_name:
description: spn-name is needed when license_type is FWAAS-AGGREGATE
type: string
subnets:
items:
type: string
type: array
required:
- name
- region
- license_type
type: object
RemoteNetworksReadResult:
properties:
configuration:
$ref: '#/components/schemas/RemoteNetworksConfiguration'
error:
additionalProperties: true
type: object
name:
type: string
networkDetails:
$ref: '#/components/schemas/RemoteNetworksIpsecTunnelResponse'
status:
type: string
required:
- name
type: object
RemoteNetworksResponse:
description: Remote Networks Response
properties:
errors:
$ref: '#/components/schemas/error_detail_
# --- truncated at 32 KB (50 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-remote-networks-api-openapi.yml