PanXapiError: ElementTree.fromstring ParseError: not well-formed (invalid token)

[XioNoX]

If a LLDP neighbor has in its description (and probably other places) the symbol "<" (most likely others symbols as well), PanXapi will return the error:

pan.xapi.PanXapiError: ElementTree.fromstring ParseError: not well-formed (invalid token): line 72, column 26

Here is for example the line 72 of the returned XML:

<port-description>border2<=>fw2:eth1-14</port-description>

[kevinsteves]

This may be a PAN-OS bug, where XML special characters are not being quoted in the 'show lldp neighbors' XML API response. Can you provide more details including PAN-OS version and neighbor configuration to help me duplicate? Thanks.

I set up a cisco SG-300 with this:

interface gigabitethernet8
no eee enable
description border2<=>fw2:eth1-14
switchport mode access
switchport access vlan 12
lldp optional-tlv port-desc sys-name sys-desc sys-cap
no eee lldp enable
green-ethernet short-reach
!

and PAN-OS 7.1.7 shows this, where port-description is set to the interface name and not the interface description string:

<entry name="bcc493ef5bca676938"> <chassis-type>MAC address</chassis-type> <chassis-id>bc:c4:93:ef:5b:ca</chassis-id> <port-type>Interface name</port-type> <port-id>gi8</port-id> <port-description>gigabitethernet8</port-description> <ttl>111</ttl> <system-name>SG300-10</system-name> <system-description>SG300-10 10-Port Gigabit Managed Switch</system-description> <system-capabilities>B, R, </system-capabilities> <enabled-capabilities>B, R, </enabled-capabilities> <management-address> </management-address> </entry>

[XioNoX]

On the other side is a Juniper router:

ge-1/0/1 {
    description border1<=>fw1:eth1-13;
    encapsulation ethernet-bridge;
    unit 0 {
        family bridge;
    }
}                                       
ge-1/0/2 {
    description border1<=>fw2:eth1-13;
    encapsulation ethernet-bridge;
    unit 0 {
        family bridge;
    }
}

The palo alto is running 7.1.2

Our cisco neighbors report the port description as the full interface name eg. GigabitEthernet2/0/2
But for Juniper neighbor, it shows the description:

show lldp neighbors all
[...]
Port description: Office-core: to_fw1b:eth1-14

That's after renaming it to a description without the "<"

[kevinsteves]

This appears to be related to this feature:

https://www.juniper.net/documentation/en_US/junos15.1/topics/reference/configuration-statement/port-description-type-edit-protocols-lldp.html

I don't have a switch with a junos version with that feature to duplicate.

Can you open a support case and request to log a bug for PAN-OS for this?

[XioNoX]

Ticket 00613270 opened with Palo Alto

[XioNoX]

"Your case has been escalated to my care. We have reproduced the issue in the lab and reported it to our development team. I will keep you posted with more information regarding issue at my earliest."

[arkaraung1993]

Hi XioNox,

I am so facing this issue:

error msg: "ElementTree.fromstring ParseError: not well-formed (invalid token)

I am trying to automate Palo Alto firewall with Ansible.

Panos Os Version : 7.1.14

When you found solution on this, please kindly share.

Much appreciate when can you help on it.