APIs to createmove a security policy at the top of device group pre-rule section and move it up/down

Reply
L1 Bithead

APIs to createmove a security policy at the top of device group pre-rule section and move it up/down

Dear All, on Panorama GUI (version 8.1.3),  I am able to move security policies to Top, Bottom, Up and Down in the device group pre-rule section. However I could not find APIs to perform these tasks. The closest one is in here 

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/pan-os-xml-api-request-types/config... but it is not enough. Would anyone know?

Many thanks for your reponses in advance!

Tags (2)
L4 Transporter

Re: APIs to createmove a security policy at the top of device group pre-rule section and move it up/

Yeah, this is the correct thing you want.  You'll just need to add in the API key to that request string and the move command will work just fine:

 

    https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/get-started-with-the-pan-os-xml-api...

 

L1 Bithead

Re: APIs to createmove a security policy at the top of device group pre-rule section and move it up/

Thanks for your reply, gfreeman. I was posting in hurry so I was not clear. My question was I know API to create the security policy. It is always added to the bottom of the pre-rule section. And I know API to move it above or below a certain rule using the name of that rule or to the top. They are already mentioned here https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/pan-os-xml-api-request-types/config....

 

However, I don't know any API that can move the security policy up or down 1 level from its current position. When I tried "move" API without the "dst" parameter: https://<firewall>/api/?type=config&action=move&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='rule1']&where=after, I got the following error:

<response status="error" code="7"><msg><line>no target specified in move</line></msg></response>

 

Is it possible to move the rule up/down 1 level without having to provide the "dst" or "target" rule?

L4 Transporter

Re: APIs to createmove a security policy at the top of device group pre-rule section and move it up/

I see.  Unfortunately, no.  If you want to move a security rule up or down one, your workflow is:

 

1) get list of all rules

2) see which rule is above/below your current rule

3) do the move command, having it reference that other rule

L1 Bithead

Re: APIs to createmove a security policy at the top of device group pre-rule section and move it up/

gfreeman, that was my thoughts too. However I was expecting something more easily. As the mentioned workflow sounds simple but actually it is not easy as the script needs to read the whole device group pre-rule section in order to be able to extract the above/below rule names. It is more difficult when the the section has large number of rules say 4000 to 5000 rules.

L4 Transporter

Re: APIs to createmove a security policy at the top of device group pre-rule section and move it up/

Yes, that's right.

 

There are small xpath tricks you can do in order to speed up the API call (specifically in this case, do a call to "just give me the names of the rules, not their configurations), but the way to accomplish it is the same.

Highlighted
L1 Bithead

Re: APIs to createmove a security policy at the top of device group pre-rule section and move it up/

Thanks for your hint. I've just worked out how to do a call to "just give me the names of the rules, not their configurations". This would definitely reduce the processing time.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!