large API call fails: Invalid target object in edit handler

Announcements

Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

Reply
philipp_kreidl
L2 Linker

large API call fails: Invalid target object in edit handler

When trying to send an rather large API call (atomic) to Panorama I receive this error message <Fail: Invalid target object in edit handler>

error.png

 

 

 

 

What I found out so far:

  • API calls work correct if the "payload" (element content) is below a specific size, but there are also 2 different error situations
    • where the error message above is shown
    • where no error message is shown but a 500 internal server error is logged in the chrome console.
  • Happens for multiple types, tested and confirmed with: Security Rules & Address objects
  • Content of the API call is not the problem, I can split it manually and send it from Expedition in 2 runs by hand (same content but split into 2 api calls)
  • A single character makes the difference if it works or fails

Please see this picture for the size of the API call payload which causes problems:

sizes.png

Should the picture not work:

Lower equal 101162 bytes > works
Between 101163 and 101210 bytes > Does not work but no error message is shown. Chrome console throws 500 error
Above 101211 bytes > Expedition error message shown

 

 

I'm not sure if the problem is caused by expedition or by Panorama itself. I wasn't able to recreate the same API call expedition is doing with linux.
Expedition 1.1.73.1
Panorama 9.0.9

 

I've edited large security rulesets in the past and it worked, not sure since when this is broken.

Thanks for your help


Accepted Solutions
GustafB
L0 Member

Hello again,

 

I had a chat with Palo Alto and Expedition about this through our support case. Turns out it was not related to Panorama PanOS 9.x.

 

The expedition tool is using the POST to send the big amount of data, and in that case the limit should be 5MB, which is far from the limit you were seeing.

 

It seems to have been an issue in the PHP code handling a very large body.

 

Update to Expedition (1.1.83.2) fixed all our issues using the built in API Output Manager.

View solution in original post


All Replies
philipp_kreidl
L2 Linker

I got the values wrong,

101166 Works

101167 Fails, no error, chrome error

101215 Fails, with error, no chrome error

dgildelaig
L5 Sessionator

We are looking into it, as making the payload smaller works.

You may want to open a case with Panorama as well so they can check if this is a limitation on there while we look into Expedition end.

philipp_kreidl
L2 Linker

Quick update from my end: Upgraded Panorama from 9.0.9 to 9.1.4, issue is the same - no difference.

GustafB
L0 Member

Hey!

 

We also have this issue, so I raised a support ticket with Palo Alto and this is their response.


This behavior is a known issue with Panorama 9.x
Engineering is aware of the issue. From reading the notes, it looks like there is no setting or anything to implement as a workaround.
It appears to be strictly about the size of the call as you discovered. In testing, only making the API call shorter allowed it to work.
Currently, there is no ETA on a resolution.

 

I'll let you know if we get any more information about this from Palo Alto.

Expedition on 1.1.81.

GustafB
L0 Member

Hello again,

 

I had a chat with Palo Alto and Expedition about this through our support case. Turns out it was not related to Panorama PanOS 9.x.

 

The expedition tool is using the POST to send the big amount of data, and in that case the limit should be 5MB, which is far from the limit you were seeing.

 

It seems to have been an issue in the PHP code handling a very large body.

 

Update to Expedition (1.1.83.2) fixed all our issues using the built in API Output Manager.

View solution in original post

philipp_kreidl
L2 Linker

I can confirm that the API call for the security rules now works as expected.

 

But 1.1.83.2 introduced a different issue for me, I will create a new post for that issue.

 

Thanks @GustafB 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!