Move a firewall from a device group to another using API

Ben101 — Mon, 23 Sep 2019 09:31:40 GMT

Hi,

I have developed a script that provisions firewalls to activate and update when it connects to Panorama.

I am now trying to get the script to move a firewall from a "Provisioning" to a "Provisioned" device group within Panorama.

In the GUI I have to remove the device from a group and add it to the new group.

Does anyone know what API commands I can use this to achieve this?

Many thanks

Ben

Re: Move a firewall from a device group to another using API

gfreeman — Mon, 14 Oct 2019 19:49:18 GMT

You'll need to do a GET to get the current device group info, then do an EDIT to remove it from the old device group (or a targeted DELETE would also work), then you can do an EDIT to add it to the new device group (or a targeted SET would also work).

You can play around with moving a firewall in the GUI and see what PAN-OS is doing, then mimic that:

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/explore-the-api.html

You can also use pandevice if you wanted. I think moving firewalls between vsys is handled by having a Firewall object under a DeviceGroup object, then you can do .delete() with it under the old DeviceGroup, add it to the object heirarchy for the new DeviceGroup, then .create() with it under the new device group.

topic Re: Move a firewall from a device group to another using API in Automation/API Discussions

Move a firewall from a device group to another using API

Re: Move a firewall from a device group to another using API