Dear All, on Panorama GUI (version 8.1.3), I am able to move security policies to Top, Bottom, Up and Down in the device group pre-rule section. However I could not find APIs to perform these tasks. The closest one is in here
https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/pan-os-xml-api-request-types/config... but it is not enough. Would anyone know?
Many thanks for your reponses in advance!
Solved! Go to Solution.
Yeah, this is the correct thing you want. You'll just need to add in the API key to that request string and the move command will work just fine:
Thanks for your reply, gfreeman. I was posting in hurry so I was not clear. My question was I know API to create the security policy. It is always added to the bottom of the pre-rule section. And I know API to move it above or below a certain rule using the name of that rule or to the top. They are already mentioned here https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/pan-os-xml-api-request-types/config....
However, I don't know any API that can move the security policy up or down 1 level from its current position. When I tried "move" API without the "dst" parameter: https://<firewall>/api/?type=config&action=move&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='rule1']&where=after, I got the following error:
<response status="error" code="7"><msg><line>no target specified in move</line></msg></response>
Is it possible to move the rule up/down 1 level without having to provide the "dst" or "target" rule?
I see. Unfortunately, no. If you want to move a security rule up or down one, your workflow is:
1) get list of all rules
2) see which rule is above/below your current rule
3) do the move command, having it reference that other rule
gfreeman, that was my thoughts too. However I was expecting something more easily. As the mentioned workflow sounds simple but actually it is not easy as the script needs to read the whole device group pre-rule section in order to be able to extract the above/below rule names. It is more difficult when the the section has large number of rules say 4000 to 5000 rules.
Yes, that's right.
There are small xpath tricks you can do in order to speed up the API call (specifically in this case, do a call to "just give me the names of the rules, not their configurations), but the way to accomplish it is the same.
Thanks for your hint. I've just worked out how to do a call to "just give me the names of the rules, not their configurations". This would definitely reduce the processing time.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!