Disable tunnel ipsec via api

[mike_yand]

Is there a way to disable ipsec tunnel via api?

From what I reah ansible-pan, there is only state present / absent.

Thanks

[gfreeman]

Looking at the module code, it looks like the disabled flag is not currently exposed as a param for playbooks.  Adding it shouldn't be that big a deal tho.  If you are so inclined yourself, you could open a PR against the Ansible libraries yourself, otherwise just open a GitHub issue so we know we need to add this in:

https://github.com/PaloAltoNetworks/ansible-pan

[mike_yand]

Thanks, I'll open an issue at Git.

But in general, is there a  way to disable tunnel via API? If there is, I'd like to test that, since couldn't find anything yet browsing palo api.

[gfreeman]

There is (replace foobar below with the real name of your IPSec tunnel):

    /config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='foobar']/disabled

If you look at the code of the Ansible playbook, it's actually statically setting this param to False when it performs the configuration.  This is why I said that making this addition shouldn't be too hard.

[mike_yand]

Thanks!

The reason I started this thread is that this one didn't work 🙂

tried from /api of the FW:

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/member[@name='disabled'

didn't work

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/disabled

Didn't work either

With all those I get

<response status="success" code="7">

<result/>

</response>

But the code isn't changing, no commit pending, nothing.

I assume that is because Operational Commands are show commands.

From CLI debub request looks like that when disabling tunnel

<request cmd="set" obj="/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']" cookie="6784285203591846"><disabled>yes</disabled></request>

And is done from config / set