topic Re: API to create Address Group in Automation/API Discussions

API to create Address Group

pamalhotra — Thu, 25 Apr 2019 21:08:25 GMT

I am trying to create a new address group using API but I always end up getting

<msg>

<line>

Invalid target object in set handler

</line>

</msg>

</response>

Can someone help me with the correct xpath to create a new shared address group empty or with a list of address objects.

Re: API to create Address Group

btorresgil — Thu, 25 Apr 2019 21:24:17 GMT

If you're using PAN-OS 9.0, I recommend the new REST API. You don't need XPaths to create Address Groups with the new REST API:

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-panorama-api.html#

If you're using python, you might consider leveraging the Device Framework library. Here's an example of how to create an Address Object.

https://pandevice.readthedocs.io/en/latest/usage.html#configuration

Address Groups are very similar:

https://pandevice.readthedocs.io/en/latest/module-objects.html#pandevice.objects.AddressGroup

If you're using GoLang, we also have the PanGo library:

https://github.com/PaloAltoNetworks/pango

If you're not using Python or Go, you can check out this XML API tutorial lab:

http://api-lab.paloaltonetworks.com/set-edit-object.html

It uses pan-python library, but you don't need python code to use it. There are several examples of creating Address Objects and Address Groups with XPaths and XML.

Hope that helps!

-Brian

Re: API to create Address Group

pamalhotra — Thu, 25 Apr 2019 21:38:56 GMT

Hey Brian,

Thanks for the reply. I have been trying to use https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-panorama-api.html#.

I am using JAVA to create address Groups and rules. And this doesnt work -

https://<firewall>/api/?key=apikey&type=config&action=set&key=keyvalue&xpath=xpath-value&element=element-value

where the xpath-value is:

/config/devices/entry/vsys/entry/rulebase/security/rules/entry[@name='rule1']

I am able create address objects using xpath = /config/shared/address/entry[@name='hostname'] and body/ element as element=<ip-netmask>"+ip+"</ip-netmask>.

But a similar one above doesnt work for address groups.

Also in

/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group

what is supposed to be the devices entry name and vsys entry name?

Re: API to create Address Group

pamalhotra — Thu, 25 Apr 2019 21:40:33 GMT

I keep getting

<response status="error" code="13">
<msg>
<line>Could not find schema node for xpath /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='device-group-name']/address-group</line>
</msg>
</response>

Re: API to create Address Group

simon_taylor — Thu, 02 May 2019 03:02:59 GMT

Hi,

see tool I've shared which can do this for you.

Cheers,

Simon

Re: API to create Address Group

rodvand_de — Tue, 07 May 2019 07:44:54 GMT

Do the operation in CLI first with the "debug cli on" command activated. This will give you the precise path you need for the API call.

See https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/explore-the-api/use-the-cli-to-find-xml-api-syntax

Re: API to create Address Group

Retired Member — Sat, 26 Oct 2019 20:34:19 GMT

There are two types of address groups in the Palo Alto Networks firewalls; dynamic and static. By default, the firewall creates a static address group if you do not explicitly select dynamic. Therefore, you need to add the static element at the time of address group creation. The example below shows an example of creating an address-group named "test-address-group"

[https://<firewall-ip>/api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group/entry[@name='test-address-group']&element=<static />&key=<yourfirewall-ip-key>]

Hope this explains the mystery.