PAN-OS-PHP Script issue while replacing services from lower device group to shared

[Gaurav.Singh]

Hello Community,

I am working right now with PHP scripting to merge the services (in lower device group)  to shared services and replace it service groups and rules by shared service.

For example, I have a service (TCP-443) in lower device group which I want to merge with the service (tcp_443) from shared in Panorama. 

I am using the below script which has worked fine most of the time but in one case it caused issue.

php pan-os-php.php type=service-merger in=api://lab_panorama.com location=PHPTEST allowMergingWithUpperLevel 'pickFilter=(name regex /^tcp_/) or (name regex /^udp_/)'

Example output: 

value 'TCP-443'
* using object from upper level : '/PanoramaConf:/ServiceStore/Service:tcp_443'
- replacing '/DC08-DT-App01/ServiceStore/Service:www_TCP' ...
- deleting '/DC08-DT-App01/ServiceStore/Service:www_TCP'

While running the script for whole device group to match with the pick filter and merge with upper level, it instead of merging the service with the upper level service, it went to delete it first. Due to which the service being used in rules/service objects were never replaced and was deleted, which cause traffic block on that service. 

I confirmed the config log and found the service was deleted during the same time by the same API admin account. 

Now I dont feel safe to use this PHP script as it might do this again and could cause big issue. 

Does anyone has experienced the similar issue while running the PHP script or if anyone has idea, what could be the issue.

Thanks

[swaschkut]

Hi,
this was fixed in March 2022, with version 

2.0.32

This issue was tracked with:
https://github.com/PaloAltoNetworks/pan-os-php/issues/524

also possible to place questions there:
PAN-OS-PHP Scripting Library and Utilities

regards
Sven