PaloAltoNetworks / PaloAltoNetworks/pan.dev

Bug with "Edit an address": unable to edit all attributes of object

Open
#220 2 comments 0 reactions 1 assignee View on GitHub

@sarette is already working on this.

Since Jan 3, 2023.

documentation
Dominant language
MDX
Stars
78
Forks
88
Avg merge
5d 17h
Merged PRs (30d)
18

Description

Documentation link

https://pan.dev/access/api/prisma-access-config/put-sse-config-v-1-addresses-id/

Describe the problem

Type: Bug/Improvement

Description

Overview:
In your call to change/edit a name you only specify a few fields.. the documentation could be updated to advise that you can also change the description and tags. Which is proven and works. My issue is when an address-object needs to be changed. The object is referenced by a UUID which is unique so the name has no real validity except for humans to understand.

Why then do you require the "name" to be one of the values you need in the payload in order to make a change from say ip-netmask to FQDN or change the Description field or add/remove tags (as because auto tagging doesn't work the way PanOS does I have to resort to doing all my Address Group DAGS leveraging Tags requiring me to make these changes repeatedly. I cannot just send the IP to an auto tag rule without overhead complications and having to adjust a regex and then do a saftey measure that I don't break the Auto Tagging that already exists. This is a feature that exists in PanOS and is heavily used for orchestration and automation.

Required Work Around:
What I do instead is change the name of the Address Object to get it to update if the item has to be changed. Instead I have to orchestrate an entire deletion of the Address Object and re-create it with the new name.

Why this is a problem:
This becomes a problem now. As of now I'm only really using this technique to be able to add and remove address objects from DAG's associated to security policies since I cannot use Auto Tagging efficiently. Yet, now if I have to delete an object and re-create it because that network moved to a new location or the FQDN changed and I want to reflect that in the name of the object I have to build a whole search and replace everywhere in the configurations. Meaning I have to create the new object then search through every place the old object was used add the new object to those locations and then remove the old object from each of these locations before I can safely remove the object. It's a code that I had to write out for PanOS and it just gets not so pretty quickly.

Suggested fix

Since I'm referencing the UUID that is unique any value for that object should be able to be adjusted. Name has or should have no relevance to your backend system as you are only using the UUID to reference any object. So, I shouldn't need to confirm the object with the "name" of the object on top of the UUID.

Also, What if I need to use the object in a new location and someone created it or it was created in a specific folder and now I need that in a new folder. In editing the object can I have the option of moving the object to a new location. We generally move it up to 'Shared' when this becomes the case, but could also be a copy if I only need that object in specific folder's.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.