topic Re: API Feature request or how to do this? in Automation/API Discussions

API Feature request or how to do this?

jorgen.boberg — Sat, 03 Oct 2015 18:49:03 GMT

Hello,

I am working on an automation solution where-by I need to add interfaces or sub-interfaces for tenants. Now the problem I have run into is in cases where an interface has been used previously and either not reset back to default config properly or at all. In these cases when I try to commit configuration I run into issues with interface being members in VLAN's, VR's or zones etc. To get around this I need to perform a barrage of calls to the API to check all zone, VR, VLAN etc and grep on members and then if the interface in question is a member I need to remove it by delete calls.

So the ideal scenario would be an API call to reset an interface to a default state. Sort of like a factory reset. Or if that is not doable a way to get all dependencies (memberships) of interfaces in one call at least reducing the amount of API calls I need to make by 50% (i.e. leaving only the delete calls).

Am I approaching this wrong or has anyone else run into this?

EDIT: Actually best way to do this that I can think of now is simply reading in the whole config into array and then do all queries on the array before sending the delete API calls.

BR,

Jorgen

Re: API Feature request or how to do this?

Remo — Mon, 16 Nov 2015 12:53:08 GMT

Hi Jorgen,

You could use this command to delete the interface (actually it sets everything on that interface to default):

https://FIREWALLNAME/api/?type=config&action=delete&xpath=/config/devices/entry[@name='localhost.localdomain']/network/interface/ethernet/entry[@name='ethernet1/XX']

On a vsys-enabled firewall you first have to unlink the interface from the vsys, (sorry, but I don't know the command for doing that at the moment)

Hope it helps,

Remo

Re: API Feature request or how to do this?

jorgen.boberg — Mon, 16 Nov 2015 14:33:16 GMT

Hello,

Thanks. However that doesn't work. But at least it gives the error message and notes the references which I can use to plugin to the script and try again instead of searching the whole config for interface references.

See example below:

<response status="error" code="10">
<msg>
<line>ethernet1/3 cannot be deleted because of references from:</line>
<line>layer3 zone -> muuu -> network -> layer3</line>
<line>interface network -> virtual-router -> test-vr -> interface</line>
</msg>
</response>

So I could do something like:

Delete interfaceXX

If success

then end

else

if /reference/

then

if /zone/

delete int from zone

if /virtual-router/

delete int from vr

else

fail

// jpb

Re: API Feature request or how to do this?

Remo — Mon, 16 Nov 2015 18:01:43 GMT

if you already need the configuration for something else in your script or if this wouldn't be a problem you could get the config with one api call and then get from this file the dependencies where this interface is used and from there create the dependency delete calls for vsys,zone and virtual-router. After deleting them you can issue the command I already posted to reset the interface.