topic Re: GlobalProtect Gateway Exclude Access Route and Domains in Automation/API Discussions

GlobalProtect Gateway Exclude Access Route and Domains

JimSilha — Wed, 11 Mar 2020 20:24:46 GMT

We need to dynamically update the GP gateway exclude access routes and exclude domains. Trying to find the XPATH for the list members. Below is what I have but I can't get to the actual items in the lists.

/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='TEMPLATE']/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/global-protect/global-protect-gateway/entry[@name='GATEWAY']/remote-user-tunnel-configs/entry[@name='AGENT']/split-tunneling/exclude-access-route

I need to add members to this XPATH.

Re: GlobalProtect Gateway Exclude Access Route and Domains

gfreeman — Thu, 26 Mar 2020 00:21:57 GMT

From what I can see, your xpath is good. This location is a member, so if you're just wanting to add stuff to this location, then do a set with this as the element:

<exclude-access-route> <member>thing1</member> <member>thing2</member> </exclude-access-route>

For set operations, you need to stop a xpath part above, so end the xpath location at "split-tunneling".

Re: GlobalProtect Gateway Exclude Access Route and Domains

JimSilha — Tue, 31 Mar 2020 19:13:02 GMT

What would the format be for the URL for use with urllib?

Re: GlobalProtect Gateway Exclude Access Route and Domains

JimSilha — Thu, 16 Apr 2020 15:59:49 GMT

Here is the actual URL for updating the exclude access list.

/api/?type=config&action=set&xpath=/config/devices/entry[@name=\'localhost.localdomain\']/template/entry[@name=\'TEMPLATENAME\']/config/devices/entry[@name=\'localhost.localdomain\']/vsys/entry[@name=\'vsys1\']/global-protect/global-protect-gateway/entry[@name=\'GATEWAYNAME\']/remote-user-tunnel-configs/entry[@name=\'AGENTCONFIGNAME\']/split-tunneling/exclude-access-route&element=<member>11.11.16.0/24</member>'

Re: GlobalProtect Gateway Exclude Access Route and Domains

NikKaretko — Wed, 02 Jun 2021 12:26:04 GMT

Hello, sir

if I want to add several members ? It's possible todo in one api request?

for example - ... /exclude-access-route&element=<member>11.11.16.0/24</member>&element=<member>12.12.17.0/24</member>&element=<member>13.13.17.0/24</member>

Re: GlobalProtect Gateway Exclude Access Route and Domains

JimmyHolland — Wed, 09 Jun 2021 12:09:16 GMT

Hi @NikKaretko,

You can specify multiple members in the element portion, so instead of

&element=<member>11.11.16.0/24</member>&element=<member>12.12.17.0/24</member>&element=<member>13.13.17.0/24</member>

Use:

&element=<member>11.11.16.0/24</member><member>12.12.17.0/24</member><member>13.13.17.0/24</member>