PaloAltoNetworks / PaloAltoNetworks/pan.dev

But with "List IPSec crypto profiles" Inconsistent returns

Open
#274 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

documentation
Dominant language
MDX
Stars
78
Forks
88
Avg merge
5d 17h
Merged PRs (30d)
18

Description

Documentation link

https://pan.dev/access/api/prisma-access-config/get-sse-config-v-1-ipsec-crypto-profiles/

Describe the problem

When calling on ike-crypto-profiles you need to specify the folder that you are looking to get a response from. Unfortunately, I send a specific Folder in the query to get a list of al IKE Crypto Profiles in Service Connection Folder, yet I get a response with everything in the "Remote Network" folder instead; which I know is wrong because there is a specific IKE Crypto Profile I use called "ike-crypto-profile-standard" that is located in the "Service Connection" Folder and not in the "Remote Networks" folder. So, somehow you are returning the incorrect folder location which is breaking all my back end code as I reformat your data based on the location of where it is making everything look like it is in the "Remote Network" location which is a bit of a problem.

Here is my curl:

curl --request GET \
  --url 'https://api.sase.paloaltonetworks.com/sse/config/v1/ike-crypto-profiles?folder=Service%20Connections' \
  --header 'Authorization: Bearer {removed}

Here is my response:

{
	"data": [
		{
			"id": "2b1b21fd-6703-4190-9db9-289e677bac99",
			"name": "CloudGenix-IKE-Crypto-Default",
			"folder": "Remote Networks",
			"hash": [
				"sha512"
			],
			"dh_group": [
				"group5"
			],
			"encryption": [
				"aes-256-cbc"
			],
			"lifetime": {
				"hours": 8
			}
		},
		{
			"id": "3f7915a0-f3c3-4c6e-ad52-20585710ae25",
			"name": "Citrix-IKE-Crypto-Default",
			"folder": "Remote Networks",
			"hash": [
				"sha256"
			],
			"dh_group": [
				"group20"
			],
			"encryption": [
				"aes-256-cbc"
			],
			"lifetime": {
				"hours": 8
			}
		},
		{
			"id": "a02486d2-8bbf-489e-85bb-5280669aeeba",
			"name": "Riverbed-IKE-Crypto-Default",
			"folder": "Remote Networks",
			"hash": [
				"sha512"
			],
			"dh_group": [
				"group2"
			],
			"encryption": [
				"aes-256-cbc"
			],
			"lifetime": {
				"hours": 8
			}
		},
		{
			"id": "8f42e98b-f55f-4945-a0f3-691862b38168",
			"name": "SilverPeak-IKE-Crypto-Default",
			"folder": "Remote Networks",
			"hash": [
				"sha512"
			],
			"dh_group": [
				"group14"
			],
			"encryption": [
				"aes-256-cbc"
			],
			"lifetime": {
				"hours": 8
			}
		},
		{
			"id": "03e6ad27-ba15-425e-ad47-31229658ced8",
			"name": "CiscoISR-IKE-Crypto-Default",
			"folder": "Remote Networks",
			"hash": [
				"sha512",
				"sha384",
				"sha256",
				"sha1"
			],
			"dh_group": [
				"group5",
				"group2"
			],
			"encryption": [
				"aes-256-cbc",
				"aes-192-cbc",
				"aes-128-cbc"
			],
			"lifetime": {
				"hours": 8
			}
		},
		{
			"id": "cd418541-d678-4900-95a4-869267ab0406",
			"name": "CiscoASA-IKE-Crypto-Default",
			"folder": "Remote Networks",
			"hash": [
				"sha512",
				"sha384",
				"sha256",
				"sha1",
				"md5"
			],
			"dh_group": [
				"group5",
				"group2",
				"group1"
			],
			"encryption": [
				"aes-256-cbc",
				"3des"
			],
			"lifetime": {
				"hours": 8
			}
		},
		{
			"id": "a5f9778e-73d6-42ba-9ace-d018be74cf6c",
			"name": "Viptela-IKE-default",
			"folder": "Remote Networks",
			"hash": [
				"sha1"
			],
			"dh_group": [
				"group2"
			],
			"encryption": [
				"aes-128-cbc"
			],
			"lifetime": {
				"hours": 8
			}
		},
		{
			"id": "35920918-010c-4aa5-9982-7f239a1a2387",
			"name": "Suite-B-GCM-128",
			"folder": "Remote Networks",
			"hash": [
				"sha256"
			],
			"dh_group": [
				"group19"
			],
			"encryption": [
				"aes-128-cbc"
			],
			"lifetime": {
				"hours": 8
			}
		},
		{
			"id": "ac20decb-90ee-4ba9-b3d9-10467e5be04e",
			"name": "Suite-B-GCM-256",
			"folder": "Remote Networks",
			"hash": [
				"sha384"
			],
			"dh_group": [
				"group20"
			],
			"encryption": [
				"aes-256-cbc"
			],
			"lifetime": {
				"hours": 8
			}
		},
		{
			"id": "ce26111c-b01e-4595-830a-87d06e7b9765",
			"name": "Velocloud-IKE-default",
			"folder": "Remote Networks",
			"hash": [
				"sha1"
			],
			"dh_group": [
				"group5"
			],
			"encryption": [
				"aes-128-cbc"
			],
			"lifetime": {
				"hours": 8
			}
		},
		{
			"id": "d646d190-094d-4ed2-96c3-c68f9c551d22",
			"name": "PaloAlto-Networks-IKE-Crypto",
			"folder": "Remote Networks",
			"hash": [
				"sha1"
			],
			"dh_group": [
				"group2"
			],
			"encryption": [
				"aes-128-cbc",
				"3des"
			],
			"lifetime": {
				"hours": 8
			}
		},
		{
			"id": "83d4bdf0-87cb-4177-845c-478f336b40c8",
			"name": "Others-IKE-Crypto-Default",
			"folder": "Remote Networks",
			"hash": [
				"sha512",
				"sha384",
				"sha256",
				"sha1",
				"md5"
			],
			"dh_group": [
				"group20",
				"group19",
				"group14",
				"group5",
				"group2",
				"group1"
			],
			"encryption": [
				"aes-256-cbc",
				"aes-192-cbc",
				"aes-128-cbc",
				"3des"
			],
			"lifetime": {
				"hours": 8
			}
		},
		{
			"id": "19f22703-f04d-403b-a7f4-cffdcd8c1154",
			"name": "ike-crypto-profile-standard",
			"folder": "Remote Networks",
			"dh_group": [
				"group14"
			],
			"lifetime": {
				"hours": 8
			},
			"encryption": [
				"aes-256-cbc"
			],
			"hash": [
				"sha256",
				"sha384",
				"sha512"
			]
		}
	],
	"offset": 0,
	"total": 13,
	"limit": 200
}

You can see from the above response you are sending me back the folder location of "Remote Networks" which is incorrect as when I specify "Remote Networks" there are actually 29 IKE Profiles listed in that folder causing all types of confusion and issues with retrieving correct information.

Suggested fix

Return the correct responses based on the query being sent or remove the folder requirement and ensure each UUID has the correct associated folder to it?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked Prisma Access API documentation page and reproduce the curl request for the ike-crypto-profiles endpoint using the Service Connections and Remote Networks folder values. Compare the requested folder with the returned folder fields and determine whether the issue belongs in this repository or the API service. Done means the endpoint returns the requested profiles with correct folder metadata, or the documented behavior and limitation are clarified.

Written by the indexing model from the issue text.

Assessment

Domain
api, backend-api-design
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.