APIs to createmove a security policy at the top of device group pre-rule section and move it up/down

Showing results for 
Show  only  | Search instead for 
Did you mean: 

APIs to createmove a security policy at the top of device group pre-rule section and move it up/down

L1 Bithead

Dear All, on Panorama GUI (version 8.1.3),  I am able to move security policies to Top, Bottom, Up and Down in the device group pre-rule section. However I could not find APIs to perform these tasks. The closest one is in here 

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/pan-os-xml-api-request-types/config... but it is not enough. Would anyone know?

Many thanks for your reponses in advance!


Accepted Solutions

Yes, that's right.


There are small xpath tricks you can do in order to speed up the API call (specifically in this case, do a call to "just give me the names of the rules, not their configurations), but the way to accomplish it is the same.

View solution in original post


L5 Sessionator

Yeah, this is the correct thing you want.  You'll just need to add in the API key to that request string and the move command will work just fine:




Thanks for your reply, gfreeman. I was posting in hurry so I was not clear. My question was I know API to create the security policy. It is always added to the bottom of the pre-rule section. And I know API to move it above or below a certain rule using the name of that rule or to the top. They are already mentioned here https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/pan-os-xml-api-request-types/config....


However, I don't know any API that can move the security policy up or down 1 level from its current position. When I tried "move" API without the "dst" parameter: https://<firewall>/api/?type=config&action=move&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='rule1']&where=after, I got the following error:

<response status="error" code="7"><msg><line>no target specified in move</line></msg></response>


Is it possible to move the rule up/down 1 level without having to provide the "dst" or "target" rule?

I see.  Unfortunately, no.  If you want to move a security rule up or down one, your workflow is:


1) get list of all rules

2) see which rule is above/below your current rule

3) do the move command, having it reference that other rule

gfreeman, that was my thoughts too. However I was expecting something more easily. As the mentioned workflow sounds simple but actually it is not easy as the script needs to read the whole device group pre-rule section in order to be able to extract the above/below rule names. It is more difficult when the the section has large number of rules say 4000 to 5000 rules.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!