Remove Firewall from Log Collector Group and Push Changes to Collector

[julioperez]

Hello All,

I am trying to use the XML API to automate the process of removing a firewall from a log collector group, pushing changes to collector, then removing managed device from Panorama. I am curious if anyone has done something similar? Every time I run the workflow, when trying to delete firewall I get the following error, "cannot be deleted because of references from:</line><line> log-collector-group". I know this is due to the log collector still having an entry for the firewall. But I am making the commit all XML API call to push these changes. 

Worflow

    - name: DELETE Device from Collector

      uri:

        url: "{{ pan_url }}api/?type=config&action=delete&xpath=/config/devices/entry[@name='localhost.localdomain']/log-collector-group/entry[@name='SOMENAME']/logfwd-setting/devices/entry[@name='{{ firewall_sn }}']/collectors/entry[@name='SOMECOLLECTORSN']&key={{ pano_token }}"

        method: GET

        return_content: yes

        validate_certs: no

        follow_redirects: all

      register: firewall_collector_removal

    - name: Commit to panorama

    - name: Commit all log collector config

      uri:

        url: "{{ pan_url }}api/?type=commit&action=all&cmd=<commit-all><log-collector-config><log-collector-group>COLLECTORGROUP</log-collector-group></log-collector-config></commit-all>&key={{ pano_token }}"

        method: GET

        return_content: yes

        validate_certs: no

        follow_redirects: all

# Commit all should push to collector with task above

    - name: DELETE Managed Device

      uri:

        url: "{{ pan_url }}api/?type=config&action=delete&xpath=/config/mgt-config/devices/entry[@name='{{ firewall_sn }}']&key={{ pano_token }}"

        method: GET

        return_content: yes

        validate_certs: no

        follow_redirects: all

      register: firewall_removal

    - name: Commit to panorama

# The final commit is where it get the error, "cannot be deleted because of references from:</line><line> log-collector-group". 

# Any advice or tips?

[JimmyHolland · Accepted solution]

Hi @julioperez,

I was able to do this with:

https://{{host}}/api/?key={{key}}&type=config&action=delete&xpath=/config/devices/entry[@name='localhost.localdomain']/log-collector-group/entry[@name='{{log-collector-group}}']/logfwd-setting/devices/entry[@name='{{ngfw-serial-number}}']

From your original command to remove the NGFW from the LC Group, try removing this section just before the API key:

/collectors/entry[@name='SOMECOLLECTORSN']

[julioperez]

Hi Jimmy,

I will give this a shot this week and report back what I find! 

[julioperez]

Thank you Jimmy for this, just tested in the lab and it looks to have deleted the managed device correctly. You rock dude! I cant tell you how long I've been stuck on this?