Remove Firewall from Log Collector Group and Push Changes to Collector
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

The Enhanced LIVEcommunity Experience is finally here! Learn all about it.

Remove Firewall from Log Collector Group and Push Changes to Collector

L1 Bithead

Hello All,

 

I am trying to use the XML API to automate the process of removing a firewall from a log collector group, pushing changes to collector, then removing managed device from Panorama. I am curious if anyone has done something similar? Every time I run the workflow, when trying to delete firewall I get the following error, "cannot be deleted because of references from:</line><line> log-collector-group". I know this is due to the log collector still having an entry for the firewall. But I am making the commit all XML API call to push these changes. 

 

Worflow

    - nameDELETE Device from Collector
      uri:
        url"{{ pan_url }}api/?type=config&action=delete&xpath=/config/devices/entry[@name='localhost.localdomain']/log-collector-group/entry[@name='SOMENAME']/logfwd-setting/devices/entry[@name='{{ firewall_sn }}']/collectors/entry[@name='SOMECOLLECTORSN']&key={{ pano_token }}"
        methodGET
        return_contentyes
        validate_certsno
        follow_redirectsall
      registerfirewall_collector_removal
 
    - name: Commit to panorama
 
    - nameCommit all log collector config
      uri:
        url"{{ pan_url }}api/?type=commit&action=all&cmd=<commit-all><log-collector-config><log-collector-group>COLLECTORGROUP</log-collector-group></log-collector-config></commit-all>&key={{ pano_token }}"
        methodGET
        return_contentyes
        validate_certsno
        follow_redirectsall
# Commit all should push to collector with task above
    - nameDELETE Managed Device
      uri:
        url"{{ pan_url }}api/?type=config&action=delete&xpath=/config/mgt-config/devices/entry[@name='{{ firewall_sn }}']&key={{ pano_token }}"
        methodGET
        return_contentyes
        validate_certsno
        follow_redirectsall
      registerfirewall_removal
 
    - name: Commit to panorama
# The final commit is where it get the error, "cannot be deleted because of references from:</line><line> log-collector-group". 
# Any advice or tips?
 
1 ACCEPTED SOLUTION

Accepted Solutions

L3 Networker

Hi @julioperez,

 

I was able to do this with:

https://{{host}}/api/?key={{key}}&type=config&action=delete&xpath=/config/devices/entry[@name='localhost.localdomain']/log-collector-group/entry[@name='{{log-collector-group}}']/logfwd-setting/devices/entry[@name='{{ngfw-serial-number}}']


From your original command to remove the NGFW from the LC Group, try removing this section just before the API key:

/collectors/entry[@name='SOMECOLLECTORSN']
Help the community: "Like" helpful comments, and click "Accept as Solution" if you found your answer :-)

View solution in original post

3 REPLIES 3

L3 Networker

Hi @julioperez,

 

I was able to do this with:

https://{{host}}/api/?key={{key}}&type=config&action=delete&xpath=/config/devices/entry[@name='localhost.localdomain']/log-collector-group/entry[@name='{{log-collector-group}}']/logfwd-setting/devices/entry[@name='{{ngfw-serial-number}}']


From your original command to remove the NGFW from the LC Group, try removing this section just before the API key:

/collectors/entry[@name='SOMECOLLECTORSN']
Help the community: "Like" helpful comments, and click "Accept as Solution" if you found your answer :-)

View solution in original post

Hi Jimmy,

 

I will give this a shot this week and report back what I find! 

Thank you Jimmy for this, just tested in the lab and it looks to have deleted the managed device correctly. You rock dude! I cant tell you how long I've been stuck on this? 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!