Python XML API Create policy issue

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Python XML API Create policy issue

L1 Bithead

My PA3020 version is 7.0.3, when i use python xml api create a policy return(<response status="error" code="5"><msg>Could not copy parent object in set handler</msg></response>)

clipboard_image_0.png

can someone help me?

I know version 9.0 can use json api,but now can not upgraud..lol.. 

 

Python code below:

import requests
import urllib3
try:
import xml.etree.cElementTree as ET
except ImportError:
import xml.etree.ElementTree as ET

class
Paloalto(object):
def __init__(self,host):
self.host = host
self.__username = 'api'
self.__password = 'python'
self.verify = False
self.url = 'https://{}/api'.format(self.host)
self.key = self.apikey()
def apikey(self):
params = {'type':'keygen','user:':self.__username,'password':self.__password}
r = requests.get(url=self.url,params=params,verify=self.verify)
res = ET.fromstring(r.text)
if res.attrib['status'] != 'success':
print('Generate API key failed for host {}.\nPlease check user/passwd/etc.'.format(self.host))
return
key = [i.text for i in res.iter('key')][0]
return key
@property
def config(self):
xpathvalue = '/config/devices/entry[@name="localhost.localdomain"]/vsys/entry[@name="vsys1"]/rulebase/security/rules/entry[@name="python"]'
elementvalue = '<from><member>trust</member></from>' \
'<to><member>untrust</member></to>' \
'<destination><member>any</member></destination>' \
'<application><member>any</member></application>' \
'<service><member>any</member></service>' \
'<source><member>any</member></source>' \
'<action>allow</action>'
params = {'type':'config','action':'set','key':self.key,
'xpath':xpathvalue,'element':elementvalue}
r = requests.post(url=self.url, params=params, verify=self.verify)
return r.text
if __name__ == '__main__':
host = '172.19.1.23'
pa = Paloalto(host)
print(pa.config)

 

1 accepted solution

Accepted Solutions

<entry name="deny all and log"><from><member>any</member></from><to><member>any</member></to><source><member>any</member></source><source-user><member>any</member></source-user><hip-profiles><member>any</member></hip-profiles><destination><member>any</member></destination><application><member>any</member></application><service><member>application-default</member></service><category><member>any</member></category><action>deny</action></entry>

 

Just as an FYI, you can always see what XML the PAN-OS is creating using any of the following methods:

 

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-panorama-api/get-started-with-the-pan-os-xml-api...

View solution in original post

4 REPLIES 4

L5 Sessionator

I would recommend using pandevice if you're looking to do automation with PAN-OS in python.

 

But to answer the question, your XML is improper, there's no opening and closing tag surrounding the element you're passing in.  If you surround what you currently have in <entry name="python"> / </entry>, it should get you around the error code you're getting now.

 

Also, if you're doing a set, I think your XPATH should not have the '/entry[@name="python"]' part, that should only be there if you're doing an edit.  It's stuff like this that pandevice helps out with.

@gfreeman Thanks for you reply.

Maybe some problems in my xml body, so can you show a example policy xml body.

I will test Pandevice module, I think XML rest api speed is better pandevice.

Many thanks

<entry name="deny all and log"><from><member>any</member></from><to><member>any</member></to><source><member>any</member></source><source-user><member>any</member></source-user><hip-profiles><member>any</member></hip-profiles><destination><member>any</member></destination><application><member>any</member></application><service><member>application-default</member></service><category><member>any</member></category><action>deny</action></entry>

 

Just as an FYI, you can always see what XML the PAN-OS is creating using any of the following methods:

 

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-panorama-api/get-started-with-the-pan-os-xml-api...

@gfreeman many thanks !!

  • 1 accepted solution
  • 6957 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!