Disable tunnel ipsec via api

Reply
L2 Linker

Disable tunnel ipsec via api

Is there a way to disable ipsec tunnel via api?

From what I reah ansible-pan, there is only state present / absent.

 

Thanks

L4 Transporter

Re: Disable tunnel ipsec via api

Looking at the module code, it looks like the disabled flag is not currently exposed as a param for playbooks.  Adding it shouldn't be that big a deal tho.  If you are so inclined yourself, you could open a PR against the Ansible libraries yourself, otherwise just open a GitHub issue so we know we need to add this in:

 

https://github.com/PaloAltoNetworks/ansible-pan

L2 Linker

Re: Disable tunnel ipsec via api

Thanks, I'll open an issue at Git.

 

But in general, is there a  way to disable tunnel via API? If there is, I'd like to test that, since couldn't find anything yet browsing palo api.

 

 

L4 Transporter

Re: Disable tunnel ipsec via api

There is (replace foobar below with the real name of your IPSec tunnel):

 

    /config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='foobar']/disabled

 

If you look at the code of the Ansible playbook, it's actually statically setting this param to False when it performs the configuration.  This is why I said that making this addition shouldn't be too hard.

L2 Linker

Re: Disable tunnel ipsec via api

Thanks!

 

The reason I started this thread is that this one didn't work :)

 

tried from /api of the FW:

 

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/member[@name='disabled'

didn't work

 

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/disabled

Didn't work either

 

 

With all those I get

<response status="success" code="7">
<result/>
</response>
 
But the code isn't changing, no commit pending, nothing.
 
I assume that is because Operational Commands are show commands.
 
From CLI debub request looks like that when disabling tunnel
 
<request cmd="set" obj="/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']" cookie="6784285203591846"><disabled>yes</disabled></request>
 
And is done from config / set
L4 Transporter

Re: Disable tunnel ipsec via api

The xpath that I gave (and that the CLI is reporting) is the correct one.  You just need to give all the rest of the usual PAN-OS XML API params and it will work:

 

type: config

action: set

xpath: 

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/disabled

element: <disabled>yes</disabled>

key: <your api key here>

L4 Transporter

Re: Disable tunnel ipsec via api

Ok, sorry, looking at what I said, I said setting it to False, which in the PAN-OS XML schema world means the word "yes" or "no", I should have been more clear about that.

L2 Linker

Re: Disable tunnel ipsec via api

Thanks, will give it a try and update!

L4 Transporter

Re: Disable tunnel ipsec via api

One other thing I'll mention:  I don't know how you're doing these API calls, but I think it's time to plug pandevice at this point.

 

Doing this with pandevice is pretty straight forward:

 

from pandevice.firewall import Firewall
from pandevice.network import IpsecTunnel

fw = Firewall('192.168.1.1', 'admin', 'admin')
tun = IpsecTunnel('foobar')
fw.add(tun)
tun.refresh()
tun.disabled = True
tun.apply()
fw.commit(sync=True)

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!