Creating security rules in a specific location within the rulebase

[utami1511]

Hello,

I am new to pan-os-python and I would like to do create security rules within a specific location within the rulebase.
I tried to include 'location' in my security rule parameter as below:

rulebase = policies.Rulebase()
firewall.add(rulebase)

rule_name = 'rule_1c'
source_zone = 'any'
source_ip = ['192.168.1.0/24', '10.10.172.0/24']
destination_zone = 'any'
destination_ip = ['192.168.100.0/24']
application = ['web-browsing', 'ssl']
service = ['application-default']
action = 'allow'
tag = ['merge']
location = 'top'

security_rule = policies.SecurityRule(name=rule_name, fromzone=source_zone, source=source_ip, tozone=destination_zone, destination=destination_ip, application=application, service=service, action=action, tag=tag, location=location)

rulebase.add(security_rule)
security_rule.apply()
firewall.commit()

But it's complaining that the parameter does not exist;
Traceback (most recent call last):
File "/home/ops/LABS/LAB9/lab9-fw-rules-ami-test.py", line 54, in
security_rule = policies.SecurityRule(name=rule_name, fromzone=source_zone, source=source_ip, tozone=destination_zone, destination=destination_ip, application=application, service=service, action=action, tag=tag, location=location)
File "/home/ops/.local/lib/python3.6/site-packages/pandevice/base.py", line 2206, in init
raise ValueError('No param "{0}" exists'.format(name))
ValueError: No param "location" exists

[shinmog]

When you create a security rule, PAN-OS is going to put it where it puts it (I think typically at the end). So you just move it into place after creating it:

from panos.firewall import Firewall
from panos.policies import Rulebase, SecurityRule

fw = Firewall(host, user, passwd)
rb = Rulebase()
rule = SecurityRule(....)

fw.add(rb)
rb.add(rule)

rule.create()
rule.move("before", "other rule name here")

[RyanMBess]

We are reworking our policies so that we can one day tell python to go get the last rule in our ruleset where the zone is inside to outside (as an example) and place the rule there. Can you share the code to that would fetch the name of that rule so we could then use that rule name to move after that rule?