XML API: Do we need to specify "localhost.localdomain" in the Device entry name? Why can we leave Device entry name as blank?

[HermanEdwards]

Scenario: While reading the 10.1 Guide and XML API guide, I see:

• Case1: actions where "localhost.localdomain" is included as the Device entry name in the xpath (e.g. "/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='paul']")
• Case2: actions where the entry name is ignored completely (e.g. "/config/devices/entry/vsys/entry[@name='vsys1']")
  • See how there is no [@name=<entry_name>] for "devices/entry"
• You can find more examples in this page https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-panorama-api/pan-os-xml-api-request-types/config...

Questions:

• When do we need to specify the name of the device entry? (e.g. 'localhost.localdomain')
  • Is this value consistent across all Panorama versions?
• By leaving it blank, does the value default to something? I don't think this is the case, as xpath should represent a path to an object.
  • I tried leaving the Device entry name as blank when doing Operation mode (see example), the update is successful. However, the update is applied to the wrong path, resulting in no effect on Panoroma UI.

Your help is much appreciated.

[JimmyHolland · Accepted solution]

Hi @HermanEdwards, the best way to validate anything with 100% conclusive proof is to export/backup the XML config file and look at it in a text editor/viewer. Here you will be able to see the configuration elements.

Certainly in recent PAN-OS releases (per screenshot below for Panorama, where I have collapsed a lot of the lines of XML config), a large amount of config lives under the devices/entry[@name='localhost.localdomain'] element, including Device Groups, Templates and stacks, Log Collectors, etc etc.

In non-Panorama, therefore NGFW directly, it is slightly different, but still has the localhost.localdomain: 

So to your questions:

When do we need to specify the name of the device entry? (e.g. 'localhost.localdomain') - Always
Is this value consistent across all Panorama versions? - Yes
By leaving it blank, does the value default to something?  - No

Hope that helps?