01-13-2019 02:03 AM
Is there a way to disable ipsec tunnel via api?
From what I reah ansible-pan, there is only state present / absent.
Thanks
01-15-2019 10:09 AM
Looking at the module code, it looks like the disabled
flag is not currently exposed as a param for playbooks. Adding it shouldn't be that big a deal tho. If you are so inclined yourself, you could open a PR against the Ansible libraries yourself, otherwise just open a GitHub issue so we know we need to add this in:
01-16-2019 04:56 AM
Thanks, I'll open an issue at Git.
But in general, is there a way to disable tunnel via API? If there is, I'd like to test that, since couldn't find anything yet browsing palo api.
01-16-2019 08:48 AM
There is (replace foobar
below with the real name of your IPSec tunnel):
/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='foobar']/disabled
If you look at the code of the Ansible playbook, it's actually statically setting this param to False
when it performs the configuration. This is why I said that making this addition shouldn't be too hard.
01-17-2019 01:25 AM - edited 01-17-2019 01:57 AM
Thanks!
The reason I started this thread is that this one didn't work 🙂
tried from /api of the FW:
/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/member[@name='disabled'
didn't work
/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/disabled
Didn't work either
With all those I get
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!