topic Re: Can't import policy from firewall to Panorama using panxapi in Automation/API Discussions

Can't import policy from firewall to Panorama using panxapi

kmurphy — Wed, 09 Oct 2013 18:29:21 GMT

I've already imported all objects successfully with panxapi (part of PAN-Perl), and have manually created all zones referenced in security policy. But for some reason I keep getting error code 12 when I try to import policy. I've tried the xpath syntax from the Panorama-Device-Migration guide and also variations on the xpath based off what I see when using the API browser. Any idea what's wrong?

This is the syntax from the conversion guide…

mint-alternate ~ # panxapi -h $pan -S ./temp_security.xml "/config/devices/entry/device-group/entry[@name='Primary_Burlington_PA5020']/pre-rulebase"

set: HASH(0x1dfa9b8) status="error" code="12"

Also tried variations on the xpath based off what I saw in the API browser….

panxapi -h $pan -S ./temp_security.xml "/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Primary_Burlington_PA5020']/pre-rulebase/security"

set: HASH(0x33a5918) status="error" code="12"

mint-alternate ~ # panxapi -h $pan -S ./temp_security.xml "/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Primary_Burlington_PA5020']/pre-rulebase"

set: HASH(0x2ac8a88) status="error" code="12"

temp_security.xml was produced with this command:

panxapi -h $fw -sxr "/config/devices/entry/vsys/entry/rulebase/security" > temp_security.xml

Thanks!

Re: Can't import policy from firewall to Panorama using panxapi

ksteves1 — Wed, 09 Oct 2013 20:49:46 GMT

the HASH() is because the response XML format is not recognized.

run panxapi with -x which will print the full XML response and see if

it shows clues.

panxapi -x -h $pan -S ./temp_security.xml "/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Primary_Burlington_PA5020']/pre-rulebase"

Re: Can't import policy from firewall to Panorama using panxapi

kmurphy — Thu, 10 Oct 2013 00:32:03 GMT

Ok I'll try that, thanks. So is the problem more likely with the input file I'm using, or with the xpath I'm using in the command? I ask because of the description of error code 12 in the XML API guide....

12 Invalid object Xpath or element values provided are not complete.

Re: Can't import policy from firewall to Panorama using panxapi

ksteves1 — Thu, 10 Oct 2013 23:19:44 GMT

your show and set command (the one I quoted) look correct, so I think it may be something else. need to see the error message in the XML response.

Re: Can't import policy from firewall to Panorama using panxapi

djm1001 — Thu, 17 Oct 2013 15:21:45 GMT

First thing to consider is that you need to be careful if trying to import the entire config as there's has to be a concept of pre and post policies in your migration XML. Second, is more of a troubleshooting helper - enable debug (-D) in your commands to help drill down into where you're going wrong. My initial guess would be that it's complaining about your import breaking existing validity or something along those lines...

Good luck!

Dave