get_wan
Inspect read-only WAN, VPN, VRF, LAN, and IPsec state across Prisma SD-WAN. Retrieve interfaces, paths, VPN links, LAN networks, and live VPN leg status by site or element.
Instructions
Inspect WAN, VPN, VRF, LAN, and IPsec read-only state through one semantic tool.
Operations needing a site or element accept names or IDs. For VPN leg
status/state, object_id is the vpnlink leg ID from topology, not the
parent AnyNet path ID.
Args:
operation: Which WAN-related collection to inspect:
networks (tenant-wide WAN network definitions, no site needed),
vrfs (tenant-wide VRF contexts, no site needed),
ipsec_profiles (tenant-wide, no site needed),
interfaces (WAN interfaces — requires site),
paths (WAN paths — requires site),
vpn_links (all VPN links, tenant-wide — this endpoint cannot be
narrowed by site or element, see site),
lan_networks (requires site),
vpn_leg_status / vpn_leg_state (live status/state for one VPN
leg — requires object_id, not site).
site: Site name or controller ID. Required (directly or via
element) for interfaces, paths, and lan_networks;
ignored by vpn_links (a VPN link record has no site field, so the
controller rejects a site filter there — the full tenant list is
returned and you can match legs to sites via get_topology);
unused otherwise.
element: Element name or controller ID, as an alternative to site
for the same operations — the element's own site is used if it
resolves uniquely. Unused for networks, vrfs,
ipsec_profiles, and the vpn_leg_* operations.
object_id: Required for vpn_leg_status/vpn_leg_state — the VPN
leg ID from a topology tool's basenet view, not the parent
AnyNet path_id.
cursor: Opaque pagination token copied from a previous response's
next_cursor. Omit on the first call.
limit: Max items to return in this page. Omit to use the server
default page size (50; max 200).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| site | No | Site name or controller ID. Required (directly or via `element`) for `interfaces`, `paths`, and `lan_networks`; ignored by `vpn_links` (a VPN link record has no site field, so the controller rejects a site filter there — the full tenant list is returned and you can match legs to sites via `get_topology`); unused otherwise. | |
| limit | No | Max items to return in this page. Omit to use the server default page size (50; max 200). | |
| cursor | No | Opaque pagination token copied from a previous response's `next_cursor`. Omit on the first call. | |
| element | No | Element name or controller ID, as an alternative to `site` for the same operations — the element's own site is used if it resolves uniquely. Unused for `networks`, `vrfs`, `ipsec_profiles`, and the `vpn_leg_*` operations. | |
| object_id | No | Required for `vpn_leg_status`/`vpn_leg_state` — the VPN leg ID from a topology tool's `basenet` view, not the parent AnyNet `path_id`. | |
| operation | Yes | Which WAN-related collection to inspect: `networks` (tenant-wide WAN network definitions, no site needed), `vrfs` (tenant-wide VRF contexts, no site needed), `ipsec_profiles` (tenant-wide, no site needed), `interfaces` (WAN interfaces — requires `site`), `paths` (WAN paths — requires `site`), `vpn_links` (all VPN links, tenant-wide — this endpoint cannot be narrowed by site or element, see `site`), `lan_networks` (requires `site`), `vpn_leg_status` / `vpn_leg_state` (live status/state for one VPN leg — requires `object_id`, not `site`). |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |