- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
02-25-2022 05:36 AM
Hello Community,
I am working right now with PHP scripting to merge the services (in lower device group) to shared services and replace it service groups and rules by shared service.
For example, I have a service (TCP-443) in lower device group which I want to merge with the service (tcp_443) from shared in Panorama.
I am using the below script which has worked fine most of the time but in one case it caused issue.
php pan-os-php.php type=service-merger in=api://lab_panorama.com location=PHPTEST allowMergingWithUpperLevel 'pickFilter=(name regex /^tcp_/) or (name regex /^udp_/)'
Example output:
value 'TCP-443'
* using object from upper level : '/PanoramaConf:/ServiceStore/Service:tcp_443'
- replacing '/DC08-DT-App01/ServiceStore/Service:www_TCP' ...
- deleting '/DC08-DT-App01/ServiceStore/Service:www_TCP'
While running the script for whole device group to match with the pick filter and merge with upper level, it instead of merging the service with the upper level service, it went to delete it first. Due to which the service being used in rules/service objects were never replaced and was deleted, which cause traffic block on that service.
I confirmed the config log and found the service was deleted during the same time by the same API admin account.
Now I dont feel safe to use this PHP script as it might do this again and could cause big issue.
Does anyone has experienced the similar issue while running the PHP script or if anyone has idea, what could be the issue.
Thanks
07-28-2022 02:10 AM - edited 07-28-2022 02:16 AM
Hi,
this was fixed in March 2022, with version
2.0.32
This issue was tracked with:
https://github.com/PaloAltoNetworks/pan-os-php/issues/524
also possible to place questions there:
PAN-OS-PHP Scripting Library and Utilities
regards
Sven
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!