topic Re: Python XML API Create policy issue in Automation/API Discussions

Python XML API Create policy issue

xxddpac — Tue, 12 Nov 2019 09:39:46 GMT

My PA3020 version is 7.0.3, when i use python xml api create a policy return(<response status="error" code="5"><msg>Could not copy parent object in set handler</msg></response>)

can someone help me?

I know version 9.0 can use json api,but now can not upgraud..lol..

Python code below:

import requests
import urllib3
try:
    import xml.etree.cElementTree as ET
except ImportError:
    import xml.etree.ElementTree as ET


class Paloalto(object):
   def __init__(self,host):
      self.host = host
      self.__username = 'api'
      self.__password = 'python'
      self.verify = False
      self.url = 'https://{}/api'.format(self.host)
      self.key = self.apikey()

def apikey(self):
    params = {'type':'keygen','user:':self.__username,'password':self.__password}
    r = requests.get(url=self.url,params=params,verify=self.verify)
    res = ET.fromstring(r.text)
    if res.attrib['status'] != 'success':
        print('Generate API key failed for host {}.\nPlease check user/passwd/etc.'.format(self.host))
        return
    key = [i.text for i in res.iter('key')][0]
    return key

@property
def config(self):
    xpathvalue = '/config/devices/entry[@name="localhost.localdomain"]/vsys/entry[@name="vsys1"]/rulebase/security/rules/entry[@name="python"]'
    elementvalue = '<from><member>trust</member></from>' \
                    '<to><member>untrust</member></to>' \
                   '<destination><member>any</member></destination>' \
                    '<application><member>any</member></application>' \
                    '<service><member>any</member></service>' \
                    '<source><member>any</member></source>' \
                   '<action>allow</action>'
    params = {'type':'config','action':'set','key':self.key,
              'xpath':xpathvalue,'element':elementvalue}
    r = requests.post(url=self.url, params=params, verify=self.verify)
    return r.text

if __name__ == '__main__':
    host = '172.19.1.23'
    pa = Paloalto(host)
    print(pa.config)

Re: Python XML API Create policy issue

gfreeman — Tue, 12 Nov 2019 17:31:10 GMT

I would recommend using pandevice if you're looking to do automation with PAN-OS in python.

But to answer the question, your XML is improper, there's no opening and closing tag surrounding the element you're passing in. If you surround what you currently have in <entry name="python"> / </entry>, it should get you around the error code you're getting now.

Also, if you're doing a set, I think your XPATH should not have the '/entry[@name="python"]' part, that should only be there if you're doing an edit. It's stuff like this that pandevice helps out with.

Re: Python XML API Create policy issue

xxddpac — Wed, 13 Nov 2019 02:12:10 GMT

@gfreeman Thanks for you reply.

Maybe some problems in my xml body, so can you show a example policy xml body.

I will test Pandevice module, I think XML rest api speed is better pandevice.

Many thanks

Re: Python XML API Create policy issue

gfreeman — Wed, 13 Nov 2019 15:03:13 GMT

<entry name="deny all and log"><from><member>any</member></from><to><member>any</member></to><source><member>any</member></source><source-user><member>any</member></source-user><hip-profiles><member>any</member></hip-profiles><destination><member>any</member></destination><application><member>any</member></application><service><member>application-default</member></service><category><member>any</member></category><action>deny</action></entry>

Just as an FYI, you can always see what XML the PAN-OS is creating using any of the following methods:

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/explore-the-api.html

Re: Python XML API Create policy issue

xxddpac — Thu, 14 Nov 2019 08:27:54 GMT

@gfreeman many thanks !!