APIs to createmove a security policy at the top of device group pre-rule section and move it up/down

[hstsvn]

Dear All, on Panorama GUI (version 8.1.3),  I am able to move security policies to Top, Bottom, Up and Down in the device group pre-rule section. However I could not find APIs to perform these tasks. The closest one is in here 

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/pan-os-xml-api-request-types/config... but it is not enough. Would anyone know?

Many thanks for your reponses in advance!

[gfreeman]

Yeah, this is the correct thing you want.  You'll just need to add in the API key to that request string and the move command will work just fine:

    https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/get-started-with-the-pan-os-xml-api...

[hstsvn]

Thanks for your reply, gfreeman. I was posting in hurry so I was not clear. My question was I know API to create the security policy. It is always added to the bottom of the pre-rule section. And I know API to move it above or below a certain rule using the name of that rule or to the top. They are already mentioned here https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/pan-os-xml-api-request-types/config....

However, I don't know any API that can move the security policy up or down 1 level from its current position. When I tried "move" API without the "dst" parameter: https://<firewall>/api/?type=config&action=move&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='rule1']&where=after, I got the following error:

<response status="error" code="7"><msg><line>no target specified in move</line></msg></response>

Is it possible to move the rule up/down 1 level without having to provide the "dst" or "target" rule?

[gfreeman]

I see.  Unfortunately, no.  If you want to move a security rule up or down one, your workflow is:

1) get list of all rules

2) see which rule is above/below your current rule

3) do the move command, having it reference that other rule

[hstsvn]

gfreeman, that was my thoughts too. However I was expecting something more easily. As the mentioned workflow sounds simple but actually it is not easy as the script needs to read the whole device group pre-rule section in order to be able to extract the above/below rule names. It is more difficult when the the section has large number of rules say 4000 to 5000 rules.

[gfreeman · Accepted solution]

Yes, that's right.

There are small xpath tricks you can do in order to speed up the API call (specifically in this case, do a call to "just give me the names of the rules, not their configurations), but the way to accomplish it is the same.

[hstsvn]

Thanks for your hint. I've just worked out how to do a call to "just give me the names of the rules, not their configurations". This would definitely reduce the processing time.