dev2rama error

[tonyh]

After issuing a the set .sh command we recieve an error when pushing the policy to panorama.

/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='DG1']/pre-rulebase/security ../templates/dev2rama//set/12_security-rules.xml
Executing:  /usr/local/bin/panxapi -S -h 192.168.0.230 -K 0RgWc42Oi0vDx2WRUIUM6A== ../templates/dev2rama//set/12_security-rules.xml "/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='DG1']/pre-rulebase/security"
set: Malformed Request status="error" code="18"

Any ideas what would cause this? It seemed to import the rulebase fine.

../templates/dev2rama//show/12_security-rules.xpath
Executing:  panxapi -rsx "devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules"
show: success

Thanks.

[mbenoit]

Hi Tony,

What version of PAN-Perl do you currently have installed?  the initial mechanism that panxapi was using to interact with the XML API was HTTPS 'GET' which has a limitation to the number of characters that you can push to the FW at a given time.  The latest version posted (PAN-perl-20110828) the default mechanism is now 'POST' which eliminates that as an issue.  It would also be helpful to know what model and software version your are running on Panorama and the FW's that you are attempting to migrate from.  You can also add a debug flag to the script for the panxapi call by modifying this line in the set script:

    /usr/local/bin/panxapi -h $hostname -K $api_key -S $elem "$xpath"

    /usr/local/bin/panxapi -h $hostname -K $api_key -DS $elem "$xpath"

Best Regards,

Marc

[migration]

We are running the 0828 version with 4.0.4 on a PA-2050 and 4.0.5 for Panorama.  It's failing only on the policy side.  We are getting objects fine.  I think you are onto something with the character side of things though.  The policy is comprised of over 2,700 rules.  We'll add the debug flag & see what it gets us.

-Mike

[tonyh]

Marc,

After setting the debug we see it is terminating at rule "1511", is there a limitation as to how many rules it will convert?

ber>any</member></application><action>allow</action><log-end>yes</log-end><disabled>no</disabled><negate-source>no</negate-source><negate-destination>no</negate-destination><description/></entry><entry name="rule 1511',
  key => '0RgWc42Oi0vDx2WRUIUM6A=='
};
API response:
<response status="error" code="18"><msg><line>Malformed Request</line></msg></response>
$VAR1 = {
  msg => {
    line => 'Malformed Request'
  },
  status => 'error',
  code => '18'
};
set: Malformed Request status="error" code="18"

Thanks, Tony

[mbenoit]

weird! A malformed request indicates a general failure of the call and that no data is passed so you shouldnt be displaying any of the policies in Panorama at the conclusion of that call.  The rules are all set in an atomic transaction that is step 12 of the template execution.