Enable/Disable security rules via XML API

[LCMember4164]

Hi all,

is it possible to enable / disable an existing security rule via XML API ?

Looking at the documentation (both the XML config guide and the api on the firewall) I found no useful informations on this topic

thank's !

[bat]

Hi,

You can do so using the following command:

To disable:

https://<ip>/api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='<rule-name>']&element=<disabled>yes</disabled>

To enable:

https://<ip>/api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='<rule-name>']&element=<disabled>no</disabled>

[hshah]

Great Answer ...

[CoreySteele]

bat thank you for being awesome.  question: any idea why a get on the same xpath (without the element arg) won't simply return an XML object with the state of a security rule?

e.g. https://firewall/api/?type=config&action=get&xpath=%2Fconfig%2Fdevices%2Fentry%5B%40name%3D%27localh... returns something completely useless, like:

<response status="success" code="19">

     <result/>

</response>

What the deuce does that tell me?  Neither the status or the code change based on the state of the rule, so...

[bat]

Hi cjsteele

To know the status of rule query should be:

https://<ip>/api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='<rule-name>']/disabled

Let me know if this is what you are looking for.