topic Re: Use panxapi to delete member from address group in Automation/API Discussions

Use panxapi to delete member from address group

blwallace — Wed, 16 Jan 2013 20:38:25 GMT

Is there a way to use the panxapi module and delete or modify a member from an address group? I have an address object I no longer use and want to remove all references. I can use panxapi to delete the address object as long as I manually remove the objects from all groups to which it is a member. I want to be able to write a program to remove all references, but can't get it to remove from the address groups.

Thanks,

Bart

Re: Use panxapi to delete member from address group

ksteves1 — Thu, 17 Jan 2013 19:00:06 GMT

to delete member addr1 from address-group group1 the xpath would

be something like:

/config/devices/entry/vsys/entry[@name='vsys1']/address-group/entry[@name='group1']/member[text()='addr1']

you can use 'or' to delete multiple members with one call:

/config/devices/entry/vsys/entry[@name='vsys1']/address-group/entry[@name='group1']/member[text()='addr2' or text()='addr3']

there is also a command line program, panaddr, that can be used

to manage address objects.

to do the above you could do (--verbose shows the xpath used):

$ panaddr --verbose --delete --address-group group1 --member addr1

xpath: /config/devices/entry/vsys/entry[@name='vsys1']/address-group/entry[@name='group1']/member[text()='addr1']

delete: success: command succeeded

Re: Use panxapi to delete member from address group

blwallace — Fri, 18 Jan 2013 03:32:06 GMT

I don't have a panaddr. My PAN version is 20111226 (I think - not at my desk right now). Is there a newer pan version? If so, I don't see a download link.

Re: Use panxapi to delete member from address group

ksteves1 — Fri, 18 Jan 2013 17:42:03 GMT

this is PAN-perl-20120921 and has panaddr. there is a newer PAN-perl version and I'll look into getting that posted.

Re: Use panxapi to delete member from address group

blwallace — Fri, 18 Jan 2013 18:02:14 GMT

Yes, it would be great to have those posted when they are available. Not sure why they aren't posted within software updates page. That would be my suggestion.