dag-to-sag converter

[jesseagreen]

Describe the Problem

I'm an Resident Engineer at Palo and working on an config size issue. Large-scale Panorama deployments often rely on Dynamic Address Groups (DAGs) for automation. Address objects are heavily tagged so they can be dynamically included in DAGs. However, many security policies still reference the underlying tagged address objects directly, instead of using static address groups. This results in:

• Redundant <tag> XML blocks on each address object
• Configuration bloat
• Long commit, export, and validation times
• Difficulty auditing or interpreting security rules

In the client's environment, many address objects carry between 1–64 tags, which are reused heavily. Security policies often reference these objects directly, causing massive duplication in the XML configuration — despite DAGs already existing to capture them dynamically.

---

Describe the Solution You'd Like

We are requesting an offline-compatible CLI utility (or Panorama-native feature) that can be run against a PAN-OS XML configuration to do the following:

🔁 DAG-Based Static Group Conversion

For each Dynamic Address Group (DAG) in a specified Device Group:

1. Parse the DAG’s match filter (e.g., 'long_unique_name_TagName-src')
2. Identify all address objects that match the DAG filter based on their assigned tags
3. Create static address groups to represent these objects:
   • Group names should follow the format:
     • <DAGNAME>-SAG01
     • <DAGNAME>-SAG02
     • ...
     • Up to -SAG99 if needed
   • Each group must contain no more than 1000 address objects
   • If >1000 objects match a DAG, multiple groups must be created automatically
4. Update security policies in the same Device Group:
   • Add the newly created address group(s) to the source and/or destination fields if a matching address object is already present
   • Do not remove existing address objects (whether tagged or untagged)
   • Do not modify the rule’s <tag> metadata — these tags may be used for rule classification, visibility, or logging integrations
5. Preserve DAGs and tags:
   • Do not alter or delete DAG definitions or tag objects
   • These must remain in place to support dynamic onboarding and future automation
6. Optionally strip the tag from matched address objects — but only if strip=true is provided
   Note: We will be using this option.

---

CLI Interface (Suggested)

Argument	Description
in=	Input XML config file (offline mode)
out=	Output XML config with changes applied
location=	Device Group to process
replace=true	Add matching static address groups to rules (non-destructive)
strip=true	Remove the matched tag from address objects after group assignment
dryrun=true	Preview actions only, no modifications applied
csvout=	Output a CSV summary of DAG-to-group mappings and rule updates

---

Describe Alternatives You've Considered

• Custom pan-os-php scripting
  I've attempted this but the complexity required to scale this across 150K+ objects exceeds my scripting knowledge.

• Manual GUI export and filtering
  This approach is completely unscalable and error-prone. It would require hours of repetitive steps and provide no guarantees of accuracy.

• Accepting the current configuration bloat
  This leads to:

  • Commit and load times exceeding 30–40 minutes
  • A 100MB+ config file that takes 30–40 minutes to run basic scripts or validation
  • Excessive tag parsing time across the CLI and GUI

• pan-os-python
  This library appears to be API-only. Implementing this logic over the API would take weeks and could not be performed safely without halting automation — something we cannot do during this transition.

I can create a ticket on support.paloaltonetworks.com with the files. (to large/many to upload here)

[swaschkut]

Hi Jesse,
since I left Palo Alto Networks, nobody is maintaining this repository within the PANW GitHub path.
All changes are done there:
https://github.com/swaschkut/pan-os-php

Also the Docker container is only using this personal GitHub repository.
https://hub.docker.com/repositories/swaschkut

It is an interesting approach of configuration cleanup,
right now I can only put this on my todo list for later on.

[jesseagreen]

Thanks Sven,

Hope all is well. Should I remove this thread and add the enhancement request on your repository?

I've actually been working on a script for 3-4 days now. I think might have something working. I'm testing right now in lab but can provide you with what I have so far.

Thank you Sven, It's an amazing program.

[swaschkut]

Hey Jesse,
yeah that would be great if you can add it to the repository where the improvements and maintaining is taken place.