[READ-ONLY] Lists configured firewall targets that can be selected by name. Returns only name, host, and verify_ssl; API keys are never included.

[READ-ONLY] Retrieves system information (hostname, model, serial, software version) from the PanOS firewall. Executes: show system info.

[READ-ONLY] Retrieves high-availability (HA) state and peer information from the firewall. Executes: show high-availability state.

[READ-ONLY] Retrieves active session count and summary from the firewall. Executes: show session info.

[READ-ONLY] Retrieves system resource utilization including CPU, memory, and disk usage. Executes: show system resources.

[READ-ONLY] Retrieves all network interfaces with their status, IP addresses, and configuration. Executes: show interface all.

[READ-ONLY] Retrieves all security zones configured on the firewall. Reads config at: /config/.../vsys/entry/zone.

[READ-ONLY] Retrieves the current routing table from the firewall. Executes: show routing route.

[READ-ONLY] Retrieves ARP table entries from the firewall. Executes: show arp entry all.

[READ-ONLY] Retrieves VLAN configuration from the firewall. Reads config at: /config/.../network/vlan.

[READ-ONLY] Retrieves DHCP server lease information. Executes: show dhcp server lease all.

[READ-ONLY] Retrieves DNS proxy configuration. Reads config at: /config/.../network/dns-proxy.

[READ-ONLY] Retrieves static routes from a virtual router. Reads config at: /config/.../virtual-router/entry/routing-table/ip/static-route.

[MODIFIES CONFIG] Creates a static route in a virtual router. Staged in candidate config — requires 'commit' to activate.

[MODIFIES CONFIG] Deletes a static route from a virtual router. Staged in candidate config — requires 'commit' to activate.

[READ-ONLY] Retrieves all address objects (IP addresses, ranges, FQDNs) defined on the firewall. Reads config at: /config/.../vsys/entry/address.

[READ-ONLY] Retrieves all address groups that contain multiple address objects. Reads config at: /config/.../vsys/entry/address-group.

[READ-ONLY] Retrieves all service objects (port/protocol definitions) from the firewall. Reads config at: /config/.../vsys/entry/service.

[READ-ONLY] Retrieves all service groups that contain multiple service objects. Reads config at: /config/.../vsys/entry/service-group.

[READ-ONLY] Retrieves application filters used for application-based policy rules. Reads config at: /config/.../vsys/entry/application-filter.

[MODIFIES CONFIG] Creates an address object (IP/netmask, IP range, or FQDN). Staged in candidate config — requires 'commit' to activate.

[MODIFIES CONFIG] Creates a static address group containing one or more address objects. Staged in candidate config — requires 'commit' to activate.

[MODIFIES CONFIG] Creates a TCP or UDP service object with a port or port range. Staged in candidate config — requires 'commit' to activate.

[MODIFIES CONFIG] Creates a service group containing one or more service objects. Staged in candidate config — requires 'commit' to activate.

[MODIFIES CONFIG] Deletes an address object. Staged in candidate config — requires 'commit' to activate.

[MODIFIES CONFIG] Deletes an address group. Staged in candidate config — requires 'commit' to activate.

[MODIFIES CONFIG] Deletes a service object. Staged in candidate config — requires 'commit' to activate.

[MODIFIES CONFIG] Deletes a service group. Staged in candidate config — requires 'commit' to activate.

[READ-ONLY] Retrieves all tags defined on the firewall. Reads config at: /config/.../vsys/entry/tag.

[MODIFIES CONFIG] Creates a tag object. Tags can be applied to rules, objects, and other configuration elements. Staged in candidate config — requires 'commit' to activate.

[MODIFIES CONFIG] Deletes a tag object. Staged in candidate config — requires 'commit' to activate.

[READ-ONLY] Reads configuration XML at a specific XPath location from the firewall/Panorama candidate buffer. Use this to verify staged candidate changes (look for dirtyId="2" admin="admin" attributes on tags — those mark uncommitted candidate state) or to read committed config. Does not modify anything.

[READ-ONLY] Verifies the candidate configuration XPaths recorded for an apply operation. Returns only resource identity, XPath, existence, and candidate admin/dirtyId/time metadata. Never returns configuration XML or key material.

[MODIFIES CONFIG] Sets or creates configuration at a specific XPath location on the firewall. Changes are staged in the candidate config and require a separate 'commit' to take effect on the running firewall.

[MODIFIES CONFIG] Deletes configuration at a specific XPath location on the firewall. Changes are staged in the candidate config and require a separate 'commit' to take effect.

[MODIFIES CONFIG] Commits all pending (staged) configuration changes to the running firewall. This activates changes made by set_config/delete_config. This action affects live traffic.

[MODIFIES CONFIG] Commits pending configuration changes on Panorama. Use this before 'panorama_push_to_devices' to commit changes to device groups, templates, and shared objects. This commits on Panorama itself — it does NOT push to managed firewalls.

[MODIFIES CONFIG] Pushes configuration from Panorama to managed firewall devices. This deploys policy and object changes to production firewalls in the specified device group. This action affects live traffic on managed devices.

[READ-ONLY] Retrieves recent traffic logs from the firewall using the PanOS log API (type=log). Supports filtering by query and limiting result count.

[READ-ONLY] Retrieves recent threat logs from the firewall using the PanOS log API (type=log). Supports filtering by query and limiting result count.

[READ-ONLY] Retrieves recent system logs from the firewall using the PanOS log API (type=log). Supports filtering by query and limiting result count.

[READ-ONLY] Retrieves recent configuration change logs from the firewall using the PanOS log API (type=log). Supports filtering by query and limiting result count.

[READ-ONLY] Retrieves recent URL filtering logs from the firewall using the PanOS log API (type=log&log-type=url). Shows URLs visited and actions taken (allow/block/continue/override) by URL filtering policy.

[READ-ONLY] Returns safe lifecycle metadata for one active Panorama provisioning plan. Returns only a safe target label/hash; never returns plan/candidate hashes, XPath values, mutation XML, or secret slot names.

[READ-ONLY] Lists safe lifecycle metadata for active Panorama provisioning plans. Returns only safe target labels/hashes; never returns plan/candidate hashes, XPath values, mutation XML, or secret slot names.

[READ-ONLY] Returns safe lifecycle metadata for one active Panorama candidate operation. Returns only a safe target label/hash; never returns snapshot XPath values, restore XML, or secret metadata.

[READ-ONLY] Lists safe lifecycle metadata for active Panorama candidate operations. Returns only safe target labels/hashes; never returns snapshot XPath values, restore XML, or secret metadata.

[READ-ONLY] Validates the deployment context before IPsec or BGP planning. Checks Panorama endpoint, managed serial/template/vsys/vr_root, Legacy Virtual Router mode, and PAN-OS 11.1.x compatibility. Candidate only; does not commit or push.

[DESTRUCTIVE] Restores only the XPath values captured for one operation_id. Reverses mutations in reverse order. Does not issue a global candidate revert or touch unrelated changes. Requires a valid operation_id.

[READ-ONLY] Resolves the template context, inspects target-template tunnel units and target-VR BGP link-local addresses, then suggests bare tunnel interfaces and /30 near/far pairs that do not overlap within that limited scope. These are scoped suggestions, not global collision guarantees; human and merged/effective-config verification is required. Also returns WAN loopback detection and flags BGP policy choices requiring human intent. Candidate configuration only; no commit or push is performed.

[READ-ONLY] Plans ordered IPsec candidate mutations (IKE/IPsec crypto, tunnel interfaces, zones, vr_root membership, IKE gateways, IPsec tunnels). Returns backward-compatible flat Plan fields plus common planId, planHash, requiredSecretSlots, and summary metadata. Run this BEFORE panorama_plan_bgp — BGP peers bind to tunnel interfaces so the tunnels must exist first. Candidate configuration only; no commit or push is performed. Runtime verification requires a prior manual commit and push to the managed firewall.

[READ-ONLY] Auto-detects the WAN loopback interface/address an IPsec IKE gateway should reference, by inspecting existing IKE gateways and loopback units. Use before panorama_plan_ipsec when localInterface/localAddress are omitted, to preview which loopback will be chosen. Candidate configuration only; no commit or push is performed.

[DESTRUCTIVE] Applies an approved IPsec plan to the candidate configuration. Requires plan_id, plan_hash, and one direct PSK per secret slot the plan reported. PSKs always arrive directly from the human/operator via the request; whatever value is supplied is accepted as-is, with no strength or complexity check. Candidate configuration only; no commit or push is performed. Direct PSK client-history risk on apply: supplied PSKs transit the API as redacted secrets.

[READ-ONLY] Reads every expected IPsec XPath, verifies references resolve, then runs a full Panorama candidate validation. Candidate configuration only; no commit or push is performed.

[READ-ONLY] Validates the exact IPsec resources captured by a prior plan, using only plan_id and plan_hash, then runs a full Panorama candidate validation. The legacy spec-keyed validation tool remains available. Candidate configuration only; no commit or push is performed.

[DESTRUCTIVE] Two-phase removal of owned IPsec resources. mode 'plan' returns a removal plan; mode 'apply' requires the returned plan_id and plan_hash and deletes only owned resources, snapshotting first and auto-restoring on failure. Candidate configuration only; no commit or push is performed.

[READ-ONLY] Verifies IPsec runtime state (IKE/IPsec SAs) on the managed firewall by serial through Panorama. Runtime verification requires a prior manual commit and push to the managed firewall. Candidate configuration only; no commit or push is performed.

[READ-ONLY] Plans ordered BGP candidate mutations (global enable, router-id, local-as, route-install, peer group, two peers, and import/export rules with inline matched prefixes). policyMode records whether empty policies are intentional or explicit rules are required; omission preserves legacy behavior with a warning. Returns the legacy plan wrapper plus common planId, planHash, and summary metadata. Requires prior IPsec apply: each peer's local-address = own (near) tunnel IP, peer-address = far tunnel IP (near + 1 within the /30). A peer without local-address is rejected by PAN-OS. Candidate configuration only; no commit or push is performed. Runtime verification requires a prior manual commit and push to the managed firewall.

[DESTRUCTIVE] Applies an approved BGP plan to the candidate configuration. Requires plan_id and plan_hash. Candidate configuration only; no commit or push is performed.

[READ-ONLY] Validates the BGP candidate configuration without committing. Requires plan_id and plan_hash. Candidate configuration only; no commit or push is performed.

[DESTRUCTIVE] Two-phase removal of owned BGP resources. mode 'plan' returns a removal plan; mode 'apply' requires the returned plan_id and plan_hash. Pass disable_global to also disable global BGP (fails if unowned peers remain). Candidate configuration only; no commit or push is performed.

[READ-ONLY] Verifies BGP runtime peer state and expected routes on the managed firewall by serial through Panorama. Runtime verification requires a prior manual commit and push to the managed firewall. Candidate configuration only; no commit or push is performed.

[READ-ONLY] Static playbook for provisioning IPsec + BGP-over-IPsec on any Panorama the server is connected to. Covers what to ask the human vs. what to auto-resolve, the hard rules (candidate-only, no-touch-prod, PSK-as-secret, IPsec-before-BGP), the required tool sequence (preflight → suggest resources → plan_ipsec → apply_ipsec → validate_ipsec_v2 → plan_bgp → apply_bgp → validate_bgp → optional runtime verify), the common plan contract, explicit BGP policy intent, the BGP local-address binding, the global BGP local-as/router-id reuse rule, the IKE gateway ikev2 version emission, and naming conventions. Call this first in a session to learn the workflow without trial-and-error. Performs no API calls and mutates nothing.