Disable tunnel ipsec via api

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Disable tunnel ipsec via api

L2 Linker

Is there a way to disable ipsec tunnel via api?

From what I reah ansible-pan, there is only state present / absent.

 

Thanks

8 REPLIES 8

L5 Sessionator

Looking at the module code, it looks like the disabled flag is not currently exposed as a param for playbooks.  Adding it shouldn't be that big a deal tho.  If you are so inclined yourself, you could open a PR against the Ansible libraries yourself, otherwise just open a GitHub issue so we know we need to add this in:

 

https://github.com/PaloAltoNetworks/ansible-pan

Thanks, I'll open an issue at Git.

 

But in general, is there a  way to disable tunnel via API? If there is, I'd like to test that, since couldn't find anything yet browsing palo api.

 

 

There is (replace foobar below with the real name of your IPSec tunnel):

 

    /config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='foobar']/disabled

 

If you look at the code of the Ansible playbook, it's actually statically setting this param to False when it performs the configuration.  This is why I said that making this addition shouldn't be too hard.

Thanks!

 

The reason I started this thread is that this one didn't work 🙂

 

tried from /api of the FW:

 

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/member[@name='disabled'

didn't work

 

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/disabled

Didn't work either

 

 

With all those I get

<response status="success" code="7">
<result/>
</response>
 
But the code isn't changing, no commit pending, nothing.
 
I assume that is because Operational Commands are show commands.
 
From CLI debub request looks like that when disabling tunnel
 
<request cmd="set" obj="/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']" cookie="6784285203591846"><disabled>yes</disabled></request>
 
And is done from config / set

The xpath that I gave (and that the CLI is reporting) is the correct one.  You just need to give all the rest of the usual PAN-OS XML API params and it will work:

 

type: config

action: set

xpath: 

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/disabled

element: <disabled>yes</disabled>

key: <your api key here>

Ok, sorry, looking at what I said, I said setting it to False, which in the PAN-OS XML schema world means the word "yes" or "no", I should have been more clear about that.

Thanks, will give it a try and update!

One other thing I'll mention:  I don't know how you're doing these API calls, but I think it's time to plug pandevice at this point.

 

Doing this with pandevice is pretty straight forward:

 

from pandevice.firewall import Firewall
from pandevice.network import IpsecTunnel

fw = Firewall('192.168.1.1', 'admin', 'admin')
tun = IpsecTunnel('foobar')
fw.add(tun)
tun.refresh()
tun.disabled = True
tun.apply()
fw.commit(sync=True)

  • 5258 Views
  • 8 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!