Remove Firewall from Log Collector Group and Push Changes to Collector

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Remove Firewall from Log Collector Group and Push Changes to Collector

L1 Bithead

Hello All,

 

I am trying to use the XML API to automate the process of removing a firewall from a log collector group, pushing changes to collector, then removing managed device from Panorama. I am curious if anyone has done something similar? Every time I run the workflow, when trying to delete firewall I get the following error, "cannot be deleted because of references from:</line><line> log-collector-group". I know this is due to the log collector still having an entry for the firewall. But I am making the commit all XML API call to push these changes. 

 

Worflow

    - nameDELETE Device from Collector
      uri:
        url"{{ pan_url }}api/?type=config&action=delete&xpath=/config/devices/entry[@name='localhost.localdomain']/log-collector-group/entry[@name='SOMENAME']/logfwd-setting/devices/entry[@name='{{ firewall_sn }}']/collectors/entry[@name='SOMECOLLECTORSN']&key={{ pano_token }}"
        methodGET
        return_contentyes
        validate_certsno
        follow_redirectsall
      registerfirewall_collector_removal
 
    - name: Commit to panorama
 
    - nameCommit all log collector config
      uri:
        url"{{ pan_url }}api/?type=commit&action=all&cmd=<commit-all><log-collector-config><log-collector-group>COLLECTORGROUP</log-collector-group></log-collector-config></commit-all>&key={{ pano_token }}"
        methodGET
        return_contentyes
        validate_certsno
        follow_redirectsall
# Commit all should push to collector with task above
    - nameDELETE Managed Device
      uri:
        url"{{ pan_url }}api/?type=config&action=delete&xpath=/config/mgt-config/devices/entry[@name='{{ firewall_sn }}']&key={{ pano_token }}"
        methodGET
        return_contentyes
        validate_certsno
        follow_redirectsall
      registerfirewall_removal
 
    - name: Commit to panorama
# The final commit is where it get the error, "cannot be deleted because of references from:</line><line> log-collector-group". 
# Any advice or tips?
 
1 accepted solution

Accepted Solutions

L5 Sessionator

Hi @julioperez,

 

I was able to do this with:

https://{{host}}/api/?key={{key}}&type=config&action=delete&xpath=/config/devices/entry[@name='localhost.localdomain']/log-collector-group/entry[@name='{{log-collector-group}}']/logfwd-setting/devices/entry[@name='{{ngfw-serial-number}}']


From your original command to remove the NGFW from the LC Group, try removing this section just before the API key:

/collectors/entry[@name='SOMECOLLECTORSN']
Help the community: "Like" helpful comments, and click "Accept as Solution" if you found your answer 🙂

View solution in original post

3 REPLIES 3

L5 Sessionator

Hi @julioperez,

 

I was able to do this with:

https://{{host}}/api/?key={{key}}&type=config&action=delete&xpath=/config/devices/entry[@name='localhost.localdomain']/log-collector-group/entry[@name='{{log-collector-group}}']/logfwd-setting/devices/entry[@name='{{ngfw-serial-number}}']


From your original command to remove the NGFW from the LC Group, try removing this section just before the API key:

/collectors/entry[@name='SOMECOLLECTORSN']
Help the community: "Like" helpful comments, and click "Accept as Solution" if you found your answer 🙂

Hi Jimmy,

 

I will give this a shot this week and report back what I find! 

Thank you Jimmy for this, just tested in the lab and it looks to have deleted the managed device correctly. You rock dude! I cant tell you how long I've been stuck on this? 

  • 1 accepted solution
  • 3665 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!