topic Re: can't disable IPSec tunnel over API in Automation/API Discussions

can't disable IPSec tunnel over API

rone — Fri, 21 Jun 2019 19:15:42 GMT

I've taken the instructions to extract the XML command from the debug console.

<request cmd="edit" obj="/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='my-ipsec-tunnel']/disabled" cookie="7684494492332192">
 <disabled>yes</disabled>
</request>

When i tried using pan-python-0.14.0, it failed thus:

$ python3 panxapi.py -h my.firewall -K LUFRPT0yY2VpTWIzSjZQYUZEdzN4MHdoMXl0eFBKOUE9N29ZQ29HMndocmdLbjVJZWVkWWwrVFJPV0N6RmZVU1pJc1pjLzBnS2Fwdz0= -x -o '<request cmd="edit" obj="/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='my-ipsec-tunnel']/disabled" cookie="7684494492332192"><disabled>yes</disabled></request>'
op: error [code="17"]: " request -> disabled is unexpected"
<response code="17" status="error"><msg><line> request -&gt; disabled is unexpected</line></msg></response>

Also tried using curl:

$ curl --globoff 'https://my.firewall/api/key=LUFRPT0yY2VpTWIzSjZQYUZEdzN4MHdoMXl0eFBKOUE9N29ZQ29HMndocmdLbjVJZWVkWWwrVFJPV0N6RmZVU1pJc1pjLzBnS2Fwdz0=&type=config&action=edit&xpath=/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='my-ipsec-tunnel']&element=<disabled>yes</disabled>'
<!DOCTYPE html>
<html><head><title>Document Error: Not Found</title></head>
<body><h2>Access Error: 404 -- Not Found</h2>
<p>Can't locate document: /api/key=LUFRPT0yY2VpTWIzSjZQYUZEdzN4MHdoMXl0eFBKOUE9N29ZQ29HMndocmdLbjVJZWVkWWwrVFJPV0N6RmZVU1pJc1pjLzBnS2Fwdz0=&amp;type=config&amp;action=edit&amp;xpath=/config/devices/entry[@name=localhost.localdomain]/network/tunnel/ipsec/entry[@name=my-ipsec-tunnel]&amp;element=&lt;disabled&gt;yes&lt;/disabled&gt;</p>
</body>
</html>

What am i missing?

Re: can't disable IPSec tunnel over API

JoergSchuetter — Fri, 21 Jun 2019 19:50:21 GMT

I don't know the pan-python module, but I assume the "/disabled" is too much (you already have it in the XML snippet). When running it via curl, you need either to quote the single-quote ' in the URL or use double-quotes " to embrace the URL.

Re: can't disable IPSec tunnel over API

rone — Fri, 21 Jun 2019 23:28:46 GMT

No, the /disabled is necessary. Turns out that -o is for operational commands; for 'edit' commands, you have to use -e.

$ python3 panxapi.py -h my.firewall -K LUFRPT0yY2VpTWIzSjZQYUZEdzN4MHdoMXl0eFBKOUE9N29ZQ29HMndocmdLbjVJZWVkWWwrVFJPV0N6RmZVU1pJc1pjLzBnS2Fwdz0= -x -e '<disabled>yes</disabled>' "/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='my-ipsec-tunnel']/disabled"
edit: success [code="20"]: "command succeeded"
<response code="20" status="success"><msg>command succeeded</msg></response>