topic Re: Enable/Disable security rules via XML API in Automation/API Discussions

Enable/Disable security rules via XML API

LCMember4164 — Wed, 31 Dec 2014 10:43:51 GMT

Hi all,

is it possible to enable / disable an existing security rule via XML API ?

Looking at the documentation (both the XML config guide and the api on the firewall) I found no useful informations on this topic

thank's !

Re: Enable/Disable security rules via XML API

bat — Wed, 31 Dec 2014 21:47:06 GMT

Hi,

You can do so using the following command:

To disable:

https://<ip>/api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='<rule-name>']&element=<disabled>yes</disabled>

To enable:

Re: Enable/Disable security rules via XML API

hshah — Thu, 07 May 2015 19:40:39 GMT

Great Answer ...

Re: Enable/Disable security rules via XML API

CoreySteele — Fri, 26 Jun 2015 00:25:22 GMT

bat thank you for being awesome. question: any idea why a get on the same xpath (without the element arg) won't simply return an XML object with the state of a security rule?

e.g. https://firewall/api/?type=config&action=get&xpath=%2Fconfig%2Fdevices%2Fentry%5B%40name%3D%27localhost.localdomain%2… returns something completely useless, like:

</response>

What the deuce does that tell me? Neither the status or the code change based on the state of the rule, so...

Re: Enable/Disable security rules via XML API

bat — Fri, 26 Jun 2015 00:34:23 GMT

Hi cjsteele

To know the status of rule query should be:

https://<ip>/api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='<rule-name>']/disabled

Let me know if this is what you are looking for.