topic XML API commit-all not working in General Topics

XML API commit-all not working

Retired Member — Mon, 14 Sep 2015 08:07:25 GMT

Hi all,

Does anybody have an idea why the following happens, and what the solution might be?

I'm trying to perform a commit-all via the REST API using the the following URL:

https://panorama.domain/api/?REST_API_TOKEN=hash&type=commit&action=all&cmd=<commit-all><shared-policy><device-group>"Group-Name"</device-group></shared-policy></commit-all>

I get the following response even though the name of the device-group is correct:

<response status="error" code="17">
  <msg>
    <line> 
      commit-all -> shared-policy -> device-group has unexpected text.
    </line>
    <line> 
      commit-all -> shared-policy -> device-group is invalid
    </line>
  </msg>
</response>

Re: XML API commit-all not working

santonic — Mon, 14 Sep 2015 07:36:27 GMT

It seems like wrong device group name. I'd check again for some extra spaces or if it's maybe case sensitive.

Re: XML API commit-all not working

Retired Member — Mon, 14 Sep 2015 08:03:24 GMT

That's what I thought at first as well, so I've already renamed the device group, made sure there are no additional characters or special characters (even took the dash out) and still I keep running into this error. I've also made a new device group, and it still won't work.

Re: XML API commit-all not working

mdjeric — Mon, 14 Sep 2015 13:31:27 GMT

Hi Johan,

This is what works for me on 6.1

<commit-all><shared-policy><device-group><name>PA_VM_6.1</name></device-group></shared-policy></commit-all>

Result:

<response status="success" code="19"><result><msg><line>Job enqueued with jobid 82</line></msg><job>82</job></result></response>

Were you missing name tag? Also, it failed when I had space after PA_VM_6.1.

Can you try it?

Re: XML API commit-all not working

Retired Member — Mon, 14 Sep 2015 14:24:12 GMT

That indeed works on 6.1, but still fails on 7.0:

<response status="error" code="17">
  <msg>
    <line> 
      commit-all -> shared-policy -> device-group -> name has unexpected text.
    </line>
    <line> 
      commit-all -> shared-policy -> device-group is invalid
    </line>
  </msg>
</response>

Re: XML API commit-all not working

Rodney_Adkins — Thu, 07 Jan 2016 15:59:28 GMT

I have a PAN config that is in json format that I want to implement on a PAN fw. It seems that the fw will only take config in "set" command format or .xml. Is there a way to drop this json config onto the fw, or convert it to a .xml format?

Re: XML API commit-all not working

Harshit — Fri, 08 Jan 2016 04:25:29 GMT

i think you are putting this in the wrong thread 😛

Re: XML API commit-all not working

kiwi — Fri, 08 Jan 2016 08:32:37 GMT

The XML document format to commit shared policies to device groups on Panorama using the PAN-OS XML API has changed in PAN-OS 7.0. This change is due to an enhancement to permit a commit to devices within the device group: the device group name is now an attribute node instead of a text node.

The change in the XML API request is as follows:

– PAN-OS 6.1 and earlier releases: /api/?type=commit&action=all&cmd= DeviceGroupName

– PAN-OS 7.0 and later releases: /api/?type=commit&action=all&cmd= <entryname='devicegroupname'>

I did find some bugs related to this which all seem to be fixed in PAN-OS 7.0.3.

If you still see the issue on 7.0.3 then I'd recommend opening a case with TAC.

Hope it helps.

-Kim.

Re: XML API commit-all not working

Retired Member — Fri, 08 Jan 2016 08:34:50 GMT

Thanks, forgot to post the solution myself. It indeed works as designed with <entryname='devicegroupname'> instead of devicegroupname

Re: XML API commit-all not working

Rodney_Adkins — Fri, 08 Jan 2016 15:05:57 GMT

Agreed, my apologies.