topic Struggling to Unset Virtual Router from Interface via API – Manual Works, API Always Fails in General Topics

Struggling to Unset Virtual Router from Interface via API – Manual Works, API Always Fails

AK_20201 — Mon, 15 Sep 2025 07:07:17 GMT

Hi everyone,

I’m working on automating Palo Alto firewall configuration via the API and I’ve run into a puzzling issue.

What I’m Trying to Do:

Unset the Virtual Router assigned to a specific Layer3 Ethernet interface (e.g., ae2.4008) using the API.
Manually, I can easily go to the GUI and set the Virtual Router to none, and everything works as expected.
I’m using the API key method to authenticate and tried a simple API call like this:

https://<firewall>/api/?type=config&action=set&key=<api-key>&xpath=/config/devices/entry[@name='localhost.localdomain']/network/interface/ethernet/entry[@name='ae2.4008']/layer3&element=<virtual-router>none</virtual-router>

Problem Encountered:

Every time I call the API, I get this error:

<response status="error" code="13">
  <msg><line>set failed, may need to override template object first</line></msg>
</response>

I also tried:

Adding override=yes
Different variations of the XML structure
Setting the whole layer3 block explicitly

But nothing worked.

Important Details:

No templates are configured in the firewall (verified manually via GUI).
XPath appears correct and points to the right element.
No schema issues or typos.
Manual configuration works flawlessly without warnings.

My Questions:

Why does the direct API set call always return a “template object override” error, even when no template exists?
Is this a known limitation or bug in the PAN-OS API?
Am I missing some special hidden configuration layer preventing direct API edits?
Is the export-modify-import approach the only recommended way to handle this type of config change via automation?

I’d greatly appreciate insights, experiences, or best practices if you’ve faced something similar.

Thanks in advance!