topic Re: APIs to createmove a security policy at the top of device group pre-rule section and move it up/ in Automation/API Discussions

APIs to createmove a security policy at the top of device group pre-rule section and move it up/down

hstsvn — Tue, 15 Jan 2019 02:19:11 GMT

Dear All, on Panorama GUI (version 8.1.3), I am able to move security policies to Top, Bottom, Up and Down in the device group pre-rule section. However I could not find APIs to perform these tasks. The closest one is in here

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/pan-os-xml-api-request-types/configuration-api/move-configuration.html but it is not enough. Would anyone know?

Many thanks for your reponses in advance!

Re: APIs to createmove a security policy at the top of device group pre-rule section and move it up/

gfreeman — Tue, 15 Jan 2019 18:31:33 GMT

Yeah, this is the correct thing you want. You'll just need to add in the API key to that request string and the move command will work just fine:

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/get-started-with-the-pan-os-xml-api.html

Re: APIs to createmove a security policy at the top of device group pre-rule section and move it up/

hstsvn — Wed, 16 Jan 2019 02:19:05 GMT

Thanks for your reply, gfreeman. I was posting in hurry so I was not clear. My question was I know API to create the security policy. It is always added to the bottom of the pre-rule section. And I know API to move it above or below a certain rule using the name of that rule or to the top. They are already mentioned here https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/pan-os-xml-api-request-types/configuration-api/move-configuration.html.

However, I don't know any API that can move the security policy up or down 1 level from its current position. When I tried "move" API without the "dst" parameter: https://<firewall>/api/?type=config&action=move&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='rule1']&where=after, I got the following error:

<response status="error" code="7"><msg><line>no target specified in move</line></msg></response>

Is it possible to move the rule up/down 1 level without having to provide the "dst" or "target" rule?

Re: APIs to createmove a security policy at the top of device group pre-rule section and move it up/

gfreeman — Wed, 16 Jan 2019 16:42:29 GMT

I see. Unfortunately, no. If you want to move a security rule up or down one, your workflow is:

1) get list of all rules

2) see which rule is above/below your current rule

3) do the move command, having it reference that other rule

Re: APIs to createmove a security policy at the top of device group pre-rule section and move it up/

hstsvn — Wed, 16 Jan 2019 22:30:43 GMT

gfreeman, that was my thoughts too. However I was expecting something more easily. As the mentioned workflow sounds simple but actually it is not easy as the script needs to read the whole device group pre-rule section in order to be able to extract the above/below rule names. It is more difficult when the the section has large number of rules say 4000 to 5000 rules.

Re: APIs to createmove a security policy at the top of device group pre-rule section and move it up/

gfreeman — Thu, 17 Jan 2019 18:28:28 GMT

Yes, that's right.

There are small xpath tricks you can do in order to speed up the API call (specifically in this case, do a call to "just give me the names of the rules, not their configurations), but the way to accomplish it is the same.

Re: APIs to createmove a security policy at the top of device group pre-rule section and move it up/

hstsvn — Thu, 17 Jan 2019 23:40:06 GMT

Thanks for your hint. I've just worked out how to do a call to "just give me the names of the rules, not their configurations". This would definitely reduce the processing time.