Disable tunnel ipsec via api

[mike_yand]

Is there a way to disable ipsec tunnel via api?

From what I reah ansible-pan, there is only state present / absent.

Thanks

[gfreeman]

Looking at the module code, it looks like the disabled flag is not currently exposed as a param for playbooks.  Adding it shouldn't be that big a deal tho.  If you are so inclined yourself, you could open a PR against the Ansible libraries yourself, otherwise just open a GitHub issue so we know we need to add this in:

https://github.com/PaloAltoNetworks/ansible-pan

[mike_yand]

Thanks, I'll open an issue at Git.

But in general, is there a  way to disable tunnel via API? If there is, I'd like to test that, since couldn't find anything yet browsing palo api.

[gfreeman]

There is (replace foobar below with the real name of your IPSec tunnel):

    /config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='foobar']/disabled

If you look at the code of the Ansible playbook, it's actually statically setting this param to False when it performs the configuration.  This is why I said that making this addition shouldn't be too hard.

[mike_yand]

Thanks!

The reason I started this thread is that this one didn't work :)

tried from /api of the FW:

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/member[@name='disabled'

didn't work

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/disabled

Didn't work either

With all those I get

<response status="success" code="7">

<result/>

</response>

But the code isn't changing, no commit pending, nothing.

I assume that is because Operational Commands are show commands.

From CLI debub request looks like that when disabling tunnel

<request cmd="set" obj="/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']" cookie="6784285203591846"><disabled>yes</disabled></request>

And is done from config / set

[gfreeman]

The xpath that I gave (and that the CLI is reporting) is the correct one.  You just need to give all the rest of the usual PAN-OS XML API params and it will work:

type: config

action: set

xpath: 

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/ipsec/entry[@name='xxx']/disabled

element: <disabled>yes</disabled>

key: <your api key here>

[gfreeman]

Ok, sorry, looking at what I said, I said setting it to False, which in the PAN-OS XML schema world means the word "yes" or "no", I should have been more clear about that.

[mike_yand]

Thanks, will give it a try and update!

[gfreeman]

One other thing I'll mention:  I don't know how you're doing these API calls, but I think it's time to plug pandevice at this point.

Doing this with pandevice is pretty straight forward:

from pandevice.firewall import Firewall
from pandevice.network import IpsecTunnel

fw = Firewall('192.168.1.1', 'admin', 'admin')
tun = IpsecTunnel('foobar')
fw.add(tun)
tun.refresh()
tun.disabled = True
tun.apply()
fw.commit(sync=True)