topic Re: Disable tunnel ipsec via api in Automation/API Discussions

Disable tunnel ipsec via api

mike_yand — Sun, 13 Jan 2019 10:03:47 GMT

Is there a way to disable ipsec tunnel via api?

From what I reah ansible-pan, there is only state present / absent.

Thanks

Re: Disable tunnel ipsec via api

gfreeman — Tue, 15 Jan 2019 18:09:25 GMT

Looking at the module code, it looks like the disabled flag is not currently exposed as a param for playbooks. Adding it shouldn't be that big a deal tho. If you are so inclined yourself, you could open a PR against the Ansible libraries yourself, otherwise just open a GitHub issue so we know we need to add this in:

https://github.com/PaloAltoNetworks/ansible-pan

Re: Disable tunnel ipsec via api

mike_yand — Wed, 16 Jan 2019 12:56:05 GMT

Thanks, I'll open an issue at Git.

But in general, is there a way to disable tunnel via API? If there is, I'd like to test that, since couldn't find anything yet browsing palo api.

Re: Disable tunnel ipsec via api

gfreeman — Wed, 16 Jan 2019 16:48:21 GMT

There is (replace foobar below with the real name of your IPSec tunnel):

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='foobar']/disabled

If you look at the code of the Ansible playbook, it's actually statically setting this param to False when it performs the configuration. This is why I said that making this addition shouldn't be too hard.

Re: Disable tunnel ipsec via api

mike_yand — Thu, 17 Jan 2019 09:57:02 GMT

Thanks!

The reason I started this thread is that this one didn't work 🙂

tried from /api of the FW:

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/member[@name='disabled'

didn't work

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/disabled

Didn't work either

With all those I get

</response>

But the code isn't changing, no commit pending, nothing.

I assume that is because Operational Commands are show commands.

From CLI debub request looks like that when disabling tunnel

And is done from config / set

Re: Disable tunnel ipsec via api

gfreeman — Thu, 17 Jan 2019 12:28:50 GMT

The xpath that I gave (and that the CLI is reporting) is the correct one. You just need to give all the rest of the usual PAN-OS XML API params and it will work:

type: config

action: set

xpath:

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/disabled

element: <disabled>yes</disabled>

key: <your api key here>

Re: Disable tunnel ipsec via api

gfreeman — Thu, 17 Jan 2019 12:32:22 GMT

Ok, sorry, looking at what I said, I said setting it to False, which in the PAN-OS XML schema world means the word "yes" or "no", I should have been more clear about that.

Re: Disable tunnel ipsec via api

mike_yand — Thu, 17 Jan 2019 12:34:12 GMT

Thanks, will give it a try and update!

Re: Disable tunnel ipsec via api

gfreeman — Thu, 17 Jan 2019 18:39:34 GMT

One other thing I'll mention: I don't know how you're doing these API calls, but I think it's time to plug pandevice at this point.

Doing this with pandevice is pretty straight forward:

from pandevice.firewall import Firewall from pandevice.network import IpsecTunnel fw = Firewall('192.168.1.1', 'admin', 'admin') tun = IpsecTunnel('foobar') fw.add(tun) tun.refresh() tun.disabled = True tun.apply() fw.commit(sync=True)