PAN-OS-PHP Script issue while replacing services from lower device group to shared

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

PAN-OS-PHP Script issue while replacing services from lower device group to shared

L1 Bithead

Hello Community,

 

I am working right now with PHP scripting to merge the services (in lower device group)  to shared services and replace it service groups and rules by shared service.

For example, I have a service (TCP-443) in lower device group which I want to merge with the service (tcp_443) from shared in Panorama. 

I am using the below script which has worked fine most of the time but in one case it caused issue.

 

php pan-os-php.php type=service-merger in=api://lab_panorama.com location=PHPTEST allowMergingWithUpperLevel 'pickFilter=(name regex /^tcp_/) or (name regex /^udp_/)'

 

Example output: 

value 'TCP-443'
* using object from upper level : '/PanoramaConf:/ServiceStore/Service:tcp_443'
- replacing '/DC08-DT-App01/ServiceStore/Service:www_TCP' ...
- deleting '/DC08-DT-App01/ServiceStore/Service:www_TCP'

 

While running the script for whole device group to match with the pick filter and merge with upper level, it instead of merging the service with the upper level service, it went to delete it first. Due to which the service being used in rules/service objects were never replaced and was deleted, which cause traffic block on that service. 

 

I confirmed the config log and found the service was deleted during the same time by the same API admin account. 

Now I dont feel safe to use this PHP script as it might do this again and could cause big issue. 

 

Does anyone has experienced the similar issue while running the PHP script or if anyone has idea, what could be the issue.

 

Thanks

 

1 REPLY 1

L3 Networker

Hi,
this was fixed in March 2022, with version 

2.0.32


This issue was tracked with:
https://github.com/PaloAltoNetworks/pan-os-php/issues/524

also possible to place questions there:
PAN-OS-PHP Scripting Library and Utilities

regards
Sven

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!