Delete Specific Zone in Security Policy via XML API

Announcements

Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

Reply
dhebal
L0 Member

Delete Specific Zone in Security Policy via XML API

So i am trying to delete a specific zone in a policy via XML API.  However, it deletes all of the zones within the policy. Is there a better way to accomplish this?  Or is it even possible to remove a specific zone without removing all of them? 

jfandel
L0 Member

I struggled with this as well and came up with this as my solution for running on Panorama.

I'm using Postman for my API calls in this case

update all zones in either the Source Zone OR the Destination Zone - not both at the same time  (you are basically overwriting/replacing all of the zones in either the source or destination zone to have the zones you want instead of "deleting" only the zone you want rid of).

if you had a rule or multiple rules with multiple source (or destination) zones - i.e. trust, untrust and dmz - and you wanted to just eliminate the dmz zone - I used the below API and CSV to accomplish this.

I have a CSV file with variables for device group/policy name {{$policy}}, rule name {{$ruleName}} and FROM zone {{$FROM_Zone}}.
CSV:

$policy,$ruleName,$FROM_Zone
pan-policy-1,testrule1,<member>trust</member><member>untrust</member>

pan-policy-1,testrule2,<member>trust</member><member>untrust</member>

pan-policy-1,testrule3,<member>trust</member><member>untrust</member>

 

then the API Call:
https://<panorama-IP>/api/?Key=<API-KEY>&type=config&action=edit&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='{{$policy}}']/pre-rulebase/security/rules/entry[@name='{{$ruleName}}']/from&element=<from>{{$FROM_Zone}}</from>

 

This will replace all 3 zones (trust, untrust and dmz) in the Source ("from") Zone with only the 2 desired zones - trust and untrust - essentially eliminating the unwanted zone (dmz).

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!