Remove Firewall from Log Collector Group and Push Changes to Collector

julioperez — Wed, 17 Mar 2021 20:46:32 GMT

Hello All,

I am trying to use the XML API to automate the process of removing a firewall from a log collector group, pushing changes to collector, then removing managed device from Panorama. I am curious if anyone has done something similar? Every time I run the workflow, when trying to delete firewall I get the following error, "cannot be deleted because of references from:</line><line> log-collector-group". I know this is due to the log collector still having an entry for the firewall. But I am making the commit all XML API call to push these changes.

Worflow

- name: DELETE Device from Collector

uri:

url: "{{ pan_url }}api/?type=config&action=delete&xpath=/config/devices/entry[@name='localhost.localdomain']/log-collector-group/entry[@name='SOMENAME']/logfwd-setting/devices/entry[@name='{{ firewall_sn }}']/collectors/entry[@name='SOMECOLLECTORSN']&key={{ pano_token }}"

method: GET

return_content: yes

validate_certs: no

follow_redirects: all

- name: Commit to panorama

- name: Commit all log collector config

uri:

url: "{{ pan_url }}api/?type=commit&action=all&cmd=<commit-all><log-collector-config><log-collector-group>COLLECTORGROUP</log-collector-group></log-collector-config></commit-all>&key={{ pano_token }}"

method: GET

return_content: yes

validate_certs: no

follow_redirects: all

# Commit all should push to collector with task above

- name: DELETE Managed Device

uri:

url: "{{ pan_url }}api/?type=config&action=delete&xpath=/config/mgt-config/devices/entry[@name='{{ firewall_sn }}']&key={{ pano_token }}"

method: GET

return_content: yes

validate_certs: no

follow_redirects: all

- name: Commit to panorama

# The final commit is where it get the error, "cannot be deleted because of references from:</line><line> log-collector-group".

# Any advice or tips?

Re: Remove Firewall from Log Collector Group and Push Changes to Collector

JimmyHolland — Fri, 19 Mar 2021 20:28:51 GMT

Hi @julioperez,

I was able to do this with:

https://{{host}}/api/?key={{key}}&type=config&action=delete&xpath=/config/devices/entry[@name='localhost.localdomain']/log-collector-group/entry[@name='{{log-collector-group}}']/logfwd-setting/devices/entry[@name='{{ngfw-serial-number}}']

From your original command to remove the NGFW from the LC Group, try removing this section just before the API key:

/collectors/entry[@name='SOMECOLLECTORSN']

Re: Remove Firewall from Log Collector Group and Push Changes to Collector

julioperez — Mon, 22 Mar 2021 17:19:29 GMT

Hi Jimmy,

I will give this a shot this week and report back what I find!

Re: Remove Firewall from Log Collector Group and Push Changes to Collector

julioperez — Mon, 22 Mar 2021 17:45:13 GMT

Thank you Jimmy for this, just tested in the lab and it looks to have deleted the managed device correctly. You rock dude! I cant tell you how long I've been stuck on this?

topic Re: Remove Firewall from Log Collector Group and Push Changes to Collector in Automation/API Discussions

Remove Firewall from Log Collector Group and Push Changes to Collector

Re: Remove Firewall from Log Collector Group and Push Changes to Collector

Re: Remove Firewall from Log Collector Group and Push Changes to Collector

Re: Remove Firewall from Log Collector Group and Push Changes to Collector