PaloAltoNetworks / PaloAltoNetworks/pan-os-python

Delete_similar() not working in 10.1.X

Open
#510 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
400
Forks
199
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

A script using .delete_similar() worked against 9.1.X but was recently discovered to not be working against 10.1.7. The script has not changed. Only the PAN-OS upgrade.

Expected behavior

Cycling through a dict of DeviceGroups as keys and a list of SecurityRule objects as the value:

for dg in dictRules:
    dictRules[dg][0].delete_similar()

This would do an atomic delete per Device Group

Current behavior

Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/panos/base.py", line 3878, in method
    super_method(self, *args, **kwargs)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/pan/xapi.py", line 733, in delete
    self.__type_config('delete', query, extra_qs)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/pan/xapi.py", line 805, in __type_config
    raise PanXapiError(self.status_detail)
pan.xapi.PanXapiError: The request could not be handled

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<pyshell#54>", line 2, in <module>
    dictDisabled[dg][0].delete_similar()
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/panos/base.py", line 1993, in delete_similar
    dev.xapi.delete(
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/panos/base.py", line 3899, in method
    raise the_exception
panos.errors.PanDeviceXapiError: The request could not be handled

Possible solution

Steps to reproduce

Screenshots

Context

This is part of an automation script that is used to disable a csv list of rules and then on a designated day of the month, the script is used to delete those rules if still disabled

Your Environment

Tested with multiple versions of lxml, pan-os-python, and pan-python (0.16.0, 0.17.0).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the delete_similar() entry point in panos/base.py and follow the failing call into pan/xapi.py. Reproduce the script against PAN-OS 10.1.7, compare it with 9.1.X behavior, and determine what conditions produce the PanDeviceXapiError. Done means the documented per-device-group deletion works again or the incompatibility is clearly identified.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.