Struggling to Unset Virtual Router from Interface via API – Manual Works, API Always Fails

[AK_20201]

Hi everyone,

I’m working on automating Palo Alto firewall configuration via the API and I’ve run into a puzzling issue.

What I’m Trying to Do:

• Unset the Virtual Router assigned to a specific Layer3 Ethernet interface (e.g., ae2.4008) using the API.

• Manually, I can easily go to the GUI and set the Virtual Router to none, and everything works as expected.

• I’m using the API key method to authenticate and tried a simple API call like this:

https://<firewall>/api/?type=config&action=set&key=<api-key>&xpath=/config/devices/entry[@name='localhost.localdomain']/network/interface/ethernet/entry[@name='ae2.4008']/layer3&element=<virtual-router>none</virtual-router>

Problem Encountered:

Every time I call the API, I get this error:

<response status="error" code="13">
  <msg><line>set failed, may need to override template object first</line></msg>
</response>

I also tried:

• Adding override=yes

• Different variations of the XML structure

• Setting the whole layer3 block explicitly

But nothing worked.

Important Details:

• No templates are configured in the firewall (verified manually via GUI).

• XPath appears correct and points to the right element.

• No schema issues or typos.

• Manual configuration works flawlessly without warnings.

My Questions:

1. Why does the direct API set call always return a “template object override” error, even when no template exists?

2. Is this a known limitation or bug in the PAN-OS API?

3. Am I missing some special hidden configuration layer preventing direct API edits?

4. Is the export-modify-import approach the only recommended way to handle this type of config change via automation?

I’d greatly appreciate insights, experiences, or best practices if you’ve faced something similar.

Thanks in advance!