PAN-OS-PHP Script issue while replacing services from lower device group to shared

Gaurav.Singh — Fri, 25 Feb 2022 13:36:28 GMT

Hello Community,

I am working right now with PHP scripting to merge the services (in lower device group) to shared services and replace it service groups and rules by shared service.

For example, I have a service (TCP-443) in lower device group which I want to merge with the service (tcp_443) from shared in Panorama.

I am using the below script which has worked fine most of the time but in one case it caused issue.

php pan-os-php.php type=service-merger in=api://lab_panorama.com location=PHPTEST allowMergingWithUpperLevel 'pickFilter=(name regex /^tcp_/) or (name regex /^udp_/)'

Example output:

value 'TCP-443'
* using object from upper level : '/PanoramaConf:/ServiceStore/Service:tcp_443'
- replacing '/DC08-DT-App01/ServiceStore/Service:www_TCP' ...
- deleting '/DC08-DT-App01/ServiceStore/Service:www_TCP'

While running the script for whole device group to match with the pick filter and merge with upper level, it instead of merging the service with the upper level service, it went to delete it first. Due to which the service being used in rules/service objects were never replaced and was deleted, which cause traffic block on that service.

I confirmed the config log and found the service was deleted during the same time by the same API admin account.

Now I dont feel safe to use this PHP script as it might do this again and could cause big issue.

Does anyone has experienced the similar issue while running the PHP script or if anyone has idea, what could be the issue.

Thanks

Re: PAN-OS-PHP Script issue while replacing services from lower device group to shared

swaschkut — Thu, 28 Jul 2022 09:16:38 GMT

Hi,
this was fixed in March 2022, with version

2.0.32

This issue was tracked with:
https://github.com/PaloAltoNetworks/pan-os-php/issues/524

also possible to place questions there:
PAN-OS-PHP Scripting Library and Utilities

regards
Sven

topic Re: PAN-OS-PHP Script issue while replacing services from lower device group to shared in Automation/API Discussions

PAN-OS-PHP Script issue while replacing services from lower device group to shared

Re: PAN-OS-PHP Script issue while replacing services from lower device group to shared