topic Re: fw.refresh_ha_active() functionality in Automation/API Discussions

fw.refresh_ha_active() functionality

deepak12 — Mon, 24 Feb 2020 17:40:53 GMT

I am trying to use refresh_ha_active() functionality so that script always run on active device. As per my understanding once i set the peer it will check internally and run it on active box or my understanding is wrong here ? I am trying to run test route cmd to pull interface details and then later run test security cmd and in order that we need to always connect to active box to pull details . I am trying below . Could you please suggest on below :

NOTE: If i am giving device1 IP active device member and device2 IP standby IP , this works fine . However if i am giving device1 IP as standby and device2 IP as active , then its failing as from standby its not pulling interface details.

deviceip1 = input('Enter device FQDN/IP: ')
deviceip2 = input('Enter device2 FQDN/IP: ')
user = input('Enter username: ')

fw = Firewall(deviceip1, user, getpass())
fw.set_ha_peers(Firewall(deviceip2,user,getpass()))

fw.refresh_ha_active()

srcip = input ('Enter SOURCE IP: ')
dstip = input ('Enter DEST IP: ')
dstport = input ('Enter dstport: ')
proto = input('Enter protocol number: ')

z1 = fw.xapi.op(cmd='<test><routing><fib-lookup><virtual-router>default</virtual-router><ip>{}</ip></fib-lookup></routing></test>'.format(srcip) , cmd_xml=False)

<< truncated output >>

Re: fw.refresh_ha_active() functionality

gfreeman — Thu, 27 Feb 2020 18:30:09 GMT

So when you do fw.xapi.(whatever) you are bypassing all the stuff pandevice can do for you. Since you are wanting pandevice to intervene, you should stick with fw.op() instead of doing fw.xapi.op().

Also, fw.op() has a param retry_on_peer that defaults to False. I'm not sure, but try setting that to True and see if it works?

Re: fw.refresh_ha_active() functionality

btorresgil — Thu, 27 Feb 2020 20:32:51 GMT

Agree with @gfreeman . Also, I responded with details on your GitHub issue over here: https://github.com/PaloAltoNetworks/pandevice/issues/210

Re: fw.refresh_ha_active() functionality

deepak12 — Fri, 28 Feb 2020 14:18:06 GMT

Thanks @btorresgil , @gfreeman

I will test it and update you .

Thanks

Re: fw.refresh_ha_active() functionality

deepak12 — Mon, 02 Mar 2020 18:01:38 GMT

@btorresgil , @gfreeman

Thanks for your help . It's working now.

Thanks,