Delete Specific Zone in Security Policy via XML API

[dhebal]

So i am trying to delete a specific zone in a policy via XML API.  However, it deletes all of the zones within the policy. Is there a better way to accomplish this?  Or is it even possible to remove a specific zone without removing all of them? 

[jfandel]

I struggled with this as well and came up with this as my solution for running on Panorama.

I'm using Postman for my API calls in this case

update all zones in either the Source Zone OR the Destination Zone - not both at the same time  (you are basically overwriting/replacing all of the zones in either the source or destination zone to have the zones you want instead of "deleting" only the zone you want rid of).

if you had a rule or multiple rules with multiple source (or destination) zones - i.e. trust, untrust and dmz - and you wanted to just eliminate the dmz zone - I used the below API and CSV to accomplish this.

I have a CSV file with variables for device group/policy name {{$policy}}, rule name {{$ruleName}} and FROM zone {{$FROM_Zone}}.
CSV:

$policy,$ruleName,$FROM_Zone
pan-policy-1,testrule1,<member>trust</member><member>untrust</member>

pan-policy-1,testrule2,<member>trust</member><member>untrust</member>

pan-policy-1,testrule3,<member>trust</member><member>untrust</member>

then the API Call:
https://<panorama-IP>/api/?Key=<API-KEY>&type=config&action=edit&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='{{$policy}}']/pre-rulebase/security/rules/entry[@name='{{$ruleName}}']/from&element=<from>{{$FROM_Zone}}</from>

This will replace all 3 zones (trust, untrust and dmz) in the Source ("from") Zone with only the 2 desired zones - trust and untrust - essentially eliminating the unwanted zone (dmz).