NAT rule creation. Could not find schema node for xpath

[kirillmuravyev]

Dear Devs!
Need some help with the problem I got.
Trying to create a NAT rule with NatRule class with simple code:

`nat_rule_params = {
    'name': 'nat_test_python',
    'fromzone': ['YAC-Inside'],
    'tozone': ['Outside'],
    'to_interface': 'any',
    'source_translation_type': 'dynamic-ip-and-port',
    'source_translation_address_type': 'interface-address',
    'source_translation_interface': 'ethernet1/2',
    'source_translation_ip_address': 'any',
    'source_translation_translated_addresses': ['192.168.0.29/28'],
    'disabled': 'True'

}
nat_rule = panos.policies.NatRule(**nat_rule_params)
fw.add(nat_rule)
nat_rule.create()`

Getting the below error:

Traceback (most recent call last):
  File "C:\Users\muravkir\Git projects\PANPython\venv\lib\site-packages\panos\base.py", line 3878, in method
    super_method(self, *args, **kwargs)
  File "C:\Users\muravkir\Git projects\PANPython\venv\lib\site-packages\pan\xapi.py", line 741, in set
    self.__type_config('set', query, extra_qs)
  File "C:\Users\muravkir\Git projects\PANPython\venv\lib\site-packages\pan\xapi.py", line 805, in __type_config
    raise PanXapiError(self.status_detail)
pan.xapi.PanXapiError: Could not find schema node for xpath /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/nat/rules


During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "c:\Users\muravkir\Git projects\PANPython\firewall_nat_rule", line 29, in <module>
    nat_rule.create()
  File "C:\Users\muravkir\Git projects\PANPython\venv\lib\site-packages\panos\base.py", line 652, in create
    device.active().xapi.set(
  File "C:\Users\muravkir\Git projects\PANPython\venv\lib\site-packages\panos\base.py", line 3899, in method
    raise the_exception
panos.errors.PanDeviceXapiError: Could not find schema node for xpath /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/nat/rules

Can you help with it please?

[shinmog]

Your object hierarchy is wrong. You can get information about an object's hierarchy using the related function:

https://pan-os-python.readthedocs.io/en/latest/useful-methods.html#informational-methods

[kirillmuravyev]

thanks @shinmog for the quick reply.
I used that link to get proper method. Can you tell exactly what is wrong? I didn't get it

I first use add method and then create, this is according to the AddressObject example in the docs:

webserver = AddressObject("Apache-webserver", "5.5.5.5", description="Company web server")
fw.add(webserver)
webserver.create()

[kirillmuravyev]

Do you mean I need to get a rulebase like:

base = panos.policies.RuleBase()
fw.add(base)
nat_rule = panos.policies.NatRule(**nat_rule_params)
base.add(nat_rule)
nat_rule.create()

[shinmog]

If you use hierarchy_info() it tells you what pan-os-python believes to be valid object hierarchies for that specific object. For panos.objects.AddressObject, doing firewall > address object is a valid configuration, and thus that options shows up in the output of hierarchy_info().

For any rule in panos.policies, you'll note that they all want a rulebase between it and either the firewall object or the Panorama object.

So correct, you'll just need to use a panos.policies.Rulebase between the rule and the firewall.