PaloAltoNetworks / PaloAltoNetworks/pan.dev
But with "List IPSec crypto profiles" Inconsistent returns
Nobody has claimed this yet.
- Dominant language
- MDX
- Stars
- 78
- Forks
- 88
- Avg merge
- 5d 17h
- Merged PRs (30d)
- 18
Description
Documentation link
https://pan.dev/access/api/prisma-access-config/get-sse-config-v-1-ipsec-crypto-profiles/
Describe the problem
When calling on ike-crypto-profiles you need to specify the folder that you are looking to get a response from. Unfortunately, I send a specific Folder in the query to get a list of al IKE Crypto Profiles in Service Connection Folder, yet I get a response with everything in the "Remote Network" folder instead; which I know is wrong because there is a specific IKE Crypto Profile I use called "ike-crypto-profile-standard" that is located in the "Service Connection" Folder and not in the "Remote Networks" folder. So, somehow you are returning the incorrect folder location which is breaking all my back end code as I reformat your data based on the location of where it is making everything look like it is in the "Remote Network" location which is a bit of a problem.
Here is my curl:
curl --request GET \
--url 'https://api.sase.paloaltonetworks.com/sse/config/v1/ike-crypto-profiles?folder=Service%20Connections' \
--header 'Authorization: Bearer {removed}
Here is my response:
{
"data": [
{
"id": "2b1b21fd-6703-4190-9db9-289e677bac99",
"name": "CloudGenix-IKE-Crypto-Default",
"folder": "Remote Networks",
"hash": [
"sha512"
],
"dh_group": [
"group5"
],
"encryption": [
"aes-256-cbc"
],
"lifetime": {
"hours": 8
}
},
{
"id": "3f7915a0-f3c3-4c6e-ad52-20585710ae25",
"name": "Citrix-IKE-Crypto-Default",
"folder": "Remote Networks",
"hash": [
"sha256"
],
"dh_group": [
"group20"
],
"encryption": [
"aes-256-cbc"
],
"lifetime": {
"hours": 8
}
},
{
"id": "a02486d2-8bbf-489e-85bb-5280669aeeba",
"name": "Riverbed-IKE-Crypto-Default",
"folder": "Remote Networks",
"hash": [
"sha512"
],
"dh_group": [
"group2"
],
"encryption": [
"aes-256-cbc"
],
"lifetime": {
"hours": 8
}
},
{
"id": "8f42e98b-f55f-4945-a0f3-691862b38168",
"name": "SilverPeak-IKE-Crypto-Default",
"folder": "Remote Networks",
"hash": [
"sha512"
],
"dh_group": [
"group14"
],
"encryption": [
"aes-256-cbc"
],
"lifetime": {
"hours": 8
}
},
{
"id": "03e6ad27-ba15-425e-ad47-31229658ced8",
"name": "CiscoISR-IKE-Crypto-Default",
"folder": "Remote Networks",
"hash": [
"sha512",
"sha384",
"sha256",
"sha1"
],
"dh_group": [
"group5",
"group2"
],
"encryption": [
"aes-256-cbc",
"aes-192-cbc",
"aes-128-cbc"
],
"lifetime": {
"hours": 8
}
},
{
"id": "cd418541-d678-4900-95a4-869267ab0406",
"name": "CiscoASA-IKE-Crypto-Default",
"folder": "Remote Networks",
"hash": [
"sha512",
"sha384",
"sha256",
"sha1",
"md5"
],
"dh_group": [
"group5",
"group2",
"group1"
],
"encryption": [
"aes-256-cbc",
"3des"
],
"lifetime": {
"hours": 8
}
},
{
"id": "a5f9778e-73d6-42ba-9ace-d018be74cf6c",
"name": "Viptela-IKE-default",
"folder": "Remote Networks",
"hash": [
"sha1"
],
"dh_group": [
"group2"
],
"encryption": [
"aes-128-cbc"
],
"lifetime": {
"hours": 8
}
},
{
"id": "35920918-010c-4aa5-9982-7f239a1a2387",
"name": "Suite-B-GCM-128",
"folder": "Remote Networks",
"hash": [
"sha256"
],
"dh_group": [
"group19"
],
"encryption": [
"aes-128-cbc"
],
"lifetime": {
"hours": 8
}
},
{
"id": "ac20decb-90ee-4ba9-b3d9-10467e5be04e",
"name": "Suite-B-GCM-256",
"folder": "Remote Networks",
"hash": [
"sha384"
],
"dh_group": [
"group20"
],
"encryption": [
"aes-256-cbc"
],
"lifetime": {
"hours": 8
}
},
{
"id": "ce26111c-b01e-4595-830a-87d06e7b9765",
"name": "Velocloud-IKE-default",
"folder": "Remote Networks",
"hash": [
"sha1"
],
"dh_group": [
"group5"
],
"encryption": [
"aes-128-cbc"
],
"lifetime": {
"hours": 8
}
},
{
"id": "d646d190-094d-4ed2-96c3-c68f9c551d22",
"name": "PaloAlto-Networks-IKE-Crypto",
"folder": "Remote Networks",
"hash": [
"sha1"
],
"dh_group": [
"group2"
],
"encryption": [
"aes-128-cbc",
"3des"
],
"lifetime": {
"hours": 8
}
},
{
"id": "83d4bdf0-87cb-4177-845c-478f336b40c8",
"name": "Others-IKE-Crypto-Default",
"folder": "Remote Networks",
"hash": [
"sha512",
"sha384",
"sha256",
"sha1",
"md5"
],
"dh_group": [
"group20",
"group19",
"group14",
"group5",
"group2",
"group1"
],
"encryption": [
"aes-256-cbc",
"aes-192-cbc",
"aes-128-cbc",
"3des"
],
"lifetime": {
"hours": 8
}
},
{
"id": "19f22703-f04d-403b-a7f4-cffdcd8c1154",
"name": "ike-crypto-profile-standard",
"folder": "Remote Networks",
"dh_group": [
"group14"
],
"lifetime": {
"hours": 8
},
"encryption": [
"aes-256-cbc"
],
"hash": [
"sha256",
"sha384",
"sha512"
]
}
],
"offset": 0,
"total": 13,
"limit": 200
}
You can see from the above response you are sending me back the folder location of "Remote Networks" which is incorrect as when I specify "Remote Networks" there are actually 29 IKE Profiles listed in that folder causing all types of confusion and issues with retrieving correct information.
Suggested fix
Return the correct responses based on the query being sent or remove the folder requirement and ensure each UUID has the correct associated folder to it?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked Prisma Access API documentation page and reproduce the curl request for the ike-crypto-profiles endpoint using the Service Connections and Remote Networks folder values. Compare the requested folder with the returned folder fields and determine whether the issue belongs in this repository or the API service. Done means the endpoint returns the requested profiles with correct folder metadata, or the documented behavior and limitation are clarified.
Written by the indexing model from the issue text.
Assessment
- Domain
- api, backend-api-design
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100