topic Re: Use panxapi and place rule in Automation/API Discussions

Use panxapi and place rule

blwallace — Wed, 07 Mar 2012 00:52:31 GMT

I've successfully created a rule on my firewall using panxapi, but it puts the rule at the bottom. How can I use panxapi to put a rule in a location other than the bottom (last) rule?

Re: Use panxapi and place rule

ksomu — Wed, 07 Mar 2012 03:45:02 GMT

bart - XML API supports moving policy up and down. however panxapi doesn't support this. how important this is for you ?

thanks,
krishna

Re: Use panxapi and place rule

blwallace — Wed, 07 Mar 2012 04:10:56 GMT

Very. For several reasons:

I have been tasked with cleaning up our firewall policies and creating a naming convention for all objects, etc. So all my rules and objects on my existing configuration across six firewalls are going obsolete. I'd like to be able to create rules and import and place them into the configuration using panxapi.
The GUI interface only allows moving up and down one at a time or moving to top or bottom. The old 3.x GUI used to at least offer to move a rule either above or below a listed one. In my opinion, that was nice - it is not now.
I'm going to be importing rules over several weeks because we don't want to induce too much change at any one time, so I need a fast and flexible way to add rules - possibly even remove them or move existing ones around.
As slow as the GUI is, having a command line option that can be scripted would ease administration changes immensely.

I've noticed that rules are ordered on the firewall as they are sequentially ordered in the XML. I would propose adding an index number to each rule and order them in that manner. A rule with a number, or index would be awesome!!

Is there any way this is possible?

Re: Use panxapi and place rule

ksomu — Wed, 07 Mar 2012 22:15:05 GMT

bart - we are looking into expanding panxapi to support policy moving functionality. I will update you on monday. could you please send me an email at ksomu@paloaltonetworks.com. I would like to talk to you

thanks,
krishna