Unable to deploy content to Firewall from Panorama using XML API

Unable to deploy content to Firewall from Panorama using XML API

7779
Created On 06/07/19 23:30 PM - Last Modified 03/28/25 23:54 PM


Symptom


  • Cannot deploy content to firewall from Panorama using XML API. Running the API's as follows: 
 
<request><batch><content><check></check></content></batch></request> 
<request><batch><content><download><file>panupv2-all-apps-8157-5479</file></download></content></batch></request> 
*wait 5 minutes* 
<request><batch><content><upload-install><file>panupv2-all-apps-8157-5479<devices>serial</devices></file></upload-install></content></batch></request>
 
  • Next alert is displayed:
<response status="error">
<msg>
<line>Failed to schedule deployment job</line>
</msg>
</response>


Environment


  •  Panorama
  •  PAN-OS v8.1 or later


Cause


  • In PAN-OS 8.1 and onwards there is a new content validation being triggered.
  • It is possible to disable it using "skip-content-validity-check" header.


Resolution


  1. Modify the order of the API query so content version is between the XML parameters "<file></file>"
  2. Serial Number should be between "<devices></devices>" following the XML standard as well
  3. Add the skip-content-validity-check in order to bypass the validation checking, for instance following next example:
<request><batch><content><upload-install><skip-content-validity-check>yes</skip-content-validity-check><file>panupv2-all-contents-(version)</file><devices>(S/N)</devices></upload-install></content></batch></request>


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PM7bCAG&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language