topic Re: Loading partial configuration snapshot in Automation/API Discussions

Loading partial configuration snapshot

LucaVitali — Thu, 05 Mar 2020 15:12:31 GMT

Hello,

I am new to Palo Alto and its API, and I am a bit lost: I need to load a named configuration snapshot, which may be uploaded from a third party, without changing the

/config/shared/local-user-database-user-database entry.

I am currently downloading the snapshot, editing it and re-uploading it in a very messy fashion:

From the documentation I only found how to get the current configuration with /api/?type=config&action=show&key=<key>, but can't find any way to get a named saved configuration via normal API call.

I can download the named snapshot with /php/device/config.export.php?name=<config name> but it requires mimicking a web admin login, is there any way to do so normally via API?

I also tried to use <partial> (which, in the documentation, is used with <commit> and some other commands) but I can't get it to work with <load>, for instance with:

/api/?&type=op&cmd=<load><config><regenerate-rule-uuid-all>no</regenerate-rule-uuid-all><from>config_name</from><partial><local-user-database>excluded</local-user-database></partial></config></load>&key=key

But I get

<response status="error" code="17"><msg><line><![CDATA[ load -> config -> partial -> local-user-database unexpected here]]></line><line><![CDATA[ load -> config -> partial is invalid]]></line></msg></response>

Is my syntax wrong or <partial> can't be used with <load> at all?

Re: Loading partial configuration snapshot

batd2 — Tue, 10 Mar 2020 07:16:54 GMT

@LucaVitali I think the your approach is slightly wrong. You can load any part of the configuration (e.g. address objects), but you can't directly load the whole configuration file, but exclude some conifg items.

I am not sure why exactly you need to do that, but one way to automate it could be to take the current config of the "/config/shared/local-user-database-user-database" then load the old configuration snapshot file and have a second API call to load the most up to date content of "/config/shared/local-user-database-user-database".

Re: Loading partial configuration snapshot

LucaVitali — Tue, 10 Mar 2020 13:58:38 GMT

@batd2 Thanks for your reply!

I was hoping to keep the local-user-database unchanged during the whole operation because if some of the defined users are doing something, when I switch to a configuration without them, then add them back, I might cause some interruptions I guess? As the configuration change does not seem disruptive per se (no reboot and stuff) this seems avoidable, although I may be misunderstanding how it all works so it may be a pointless effort.

Nonetheless I realised I still need to download the unselected configuration snapshots (to show some of the data to the end-user), I know can get the list of available named configs with:

/api/?type=op&action=complete&xpath=/operations/show/config/saved&key=<key>

but can't figure out how to get them with an api call (can only get them via /php/device/config.export.php?name= with the PHPSESSION cookie, like palo alto web interface does, but that's not ideal)