Who rated this post

I have a requirement to configure GlobalProtect on-demand with code on PAs. I am stuck on Network > GlobalProtect > Gateways.
My code calls the XML API and creates certificates, imports public cert, imports SAML file, creates GP portal, add firewall rules etc
I am able to configure all that and GlobalProtect > Portals just fine, just not the Gateway.

The API path to create the GlobalProtect Gateway config is:

$apiURL = "https://" + $panAddress + "//api/?key=" + $pankey +
"&type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/global-protect/global-protect-gateway/entry[@name='MY-GP-GATEWAY']&element<etc etc ...>

In the web GUI, when you add a new gateway in asks for an Interface. The API browser does NOT have an element for Interface. I thought that I could look at the CLI commands and convert them to API, but there is no choice for Interface there either. Here are the options.

set global-protect global-protect-gateway MY-GP-GATEWAY ?

+ block-quarantined-devices    Block login for quarantined devices
+ certificate-profile          Profile for authenticating client certificates
+ log-fail                     Log unsuccessful TLS handshakes
+ log-setting                  log-setting
+ log-success                  Log successful TLS handshakes
+ remote-user-tunnel           GlobalProtect user tunnel
+ satellite-tunnel             GlobalProtect satellite tunnel
+ ssl-tls-service-profile      SSL TLS service profile
+ tunnel-mode                  Tunnel mode
> client-auth                  GlobalProtect portal client authentication
> hip-notification             host PC health evaluate
> local-address                Local IP configuration
> remote-user-tunnel-configs   GlobalProtect gateway remote user tunnel configurations
> roles                        role based user management for GlobalProtect gateway users
> security-restrictions        Security Hardening for GlobalProtect
  <Enter>                      Finish input

Also I have another PA that has the whole configuration done manually. When I GET that config with the API, the output shows no element for Interface.

So I can run a SET api call which includes as much info as possible, and it does create the gateway. When I look at it in the GUI, the Interface and the Tunnel Interface are blank. If I fill them in manually, I can then commit.
This then causes a new gateway with a "-N" at the end to be created, you can't see it in the GUI, but it can be seen in the API browser at

/config/devices/entry[@name='localhost.localdomain']/network/tunnel/global-protect-gateway/entry[@name='MY-GP-GATEWAY-N'] --- what is that?

Then look at NETWORK > Interfaces > Tunnel .. and I see the GP feature on the tunnel interface with "MY-GP-GATEWAY-N" when I hover over it.
I have tried creating MY-GP-GATEWAY first and MY-GP-GATEWAY-N second, and vice versa, no luck.
What is the proper way to configure the GP Gateway with CLI or API without having to do anything in the web gui?

And just for reference, here is the API call I use to create the (partial) gateway config. I call it from powershell. Certs and Profiles are included as variables.

$apiURL = "https://" + $panAddress + "//api/?key=" + $pankey +
"&type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/global-protect/global-protect-gateway/entry[@name='$gtwyProfile']
&element=<client-auth>
<entry name='$gtwyAuthProf'>
<os>Any</os>
<authentication-profile>$authProfile</authentication-profile>
<authentication-message>Enter login credentials</authentication-message>
<user-credential-or-client-cert-required>yes</user-credential-or-client-cert-required>
<username-label>Username</username-label>
<password-label>Password</password-label>
</entry>
</client-auth>
<remote-user-tunnel-configs>
<entry name='$gtwyAuthConf'>
<split-tunneling><include-domains><list/></include-domains>
<exclude-domains><list/></exclude-domains>
<access-route>
<member>10.6.0.0/16</member>
<member>10.7.0.0/16</member>
</access-route>
<exclude-access-route/>
<include-applications/>
<exclude-applications/>
</split-tunneling>
<authentication-override>
<cookie-encrypt-decrypt-cert>$samlCert</cookie-encrypt-decrypt-cert>
<generate-cookie>yes</generate-cookie>
</authentication-override>
<ip-pool>
<member>10.81.92.192/27</member>
</ip-pool>
</entry>
</remote-user-tunnel-configs>
<ssl-tls-service-profile>$sslprofile</ssl-tls-service-profile>
<tunnel-mode>yes</tunnel-mode>&target=$serial"

Invoke-WebRequest -uri $apiURL