About Eric.Nelson

I have a need to automate issuing test and clear commands to IPSEC vpn tunnels and gateways. This seems very straight forward using panxapi or curl. The concern I have is that there does not seem to be any checking that the tunnel exists. When you issue the command to test/clear from the CLI and you specify a bad name it errors out. When you do the same with panxapi or curl you get a success no matter what.    My concerns: Is this a bug or expected behavior? If you issue test/clear without specifying a name on the CLI it will issue the command to ALL tunnels (this seems broken to me) , if I issue an api call with a bad tunnel name what is the behavior? Reset everything? error out on the back end?    Example calls : panxapi: C:\Users\me>panxapi -h <IP> -K "<key>" -xr -o "<test><vpn><ipsec-sa><tunnel>GOOD_NAME</tunnel></ipsec-sa></vpn></test>" op: success <member>Initiate 0 IPSec SA for tunnel GOOD_NAME. </member> C:\Users\me>panxapi -h <IP> -K "<key>" -xr -o "<test><vpn><ipsec-sa><tunnel>BAD_NAME</tunnel></ipsec-sa></vpn></test>" op: success <member>Initiate 0 IPSec SA for tunnel BAD_NAME. </member>   curl: curl 'https://<IP>/api/?type=op&cmd=<clear><vpn><ipsec-sa><tunnel>GOOD_NAME</tunnel></ipsec-sa></vpn></clear>&key=<KEY> <response status="success"><result> <member>Clear IPSec SA for tunnel GOOD_NAME: 0 IKEv1 SA, 0 IKEv2 SA. </member> curl 'https://<IP>/api/?type=op&cmd=<clear><vpn><ipsec-sa><tunnel>BAD_NAME</tunnel></ipsec-sa></vpn></clear>&key=<KEY> <response status="success"><result> <member>Clear IPSec SA for tunnel BAD_NAME: 0 IKEv1 SA, 0 IKEv2 SA. </member>   Lastly, where can I find the logs for all this stuff?    Thanks !    ... View more