network_device.update_by_id is overwriting exiting values that is not part of the post values

[tali1974]

Prerequisites

• [Yes ] Have you tested the operation in the API directly?
• [ Yes] Do you have the latest SDK version?
• Review the compatibility matrix before opening an issue.

Describe the bug
I am using the SDK ciscoisesdk. I want to only update network_device_group_list and description all other values should be untouched.
api_.network_device.update_by_id( id="16b867c0-ad7b-11ed-b060-7e0613ef335b", description="API TEST", name=DevName, network_device_group_list=["Device Type#All Device Types#Switches","IPSEC#Is IPSEC Device#No","Location#All Locations"], network_device_iplist=[{"ipaddress":"10.0.0.1", "mask": 32}] )
I am updating a network device from default to "Device Type#All Device Types#Switches" and it's updating it. But it removed all other settings as TACACS Authentication Setting, SNMP Settings and Advanced TrustSec Settings.

Expected behavior
It should only update the values that I have added in the call as shown above description, network_device_group_list should be changed/updated.
Screenshots

Environment (please complete the following information):

• ISE version and patch: 3.1.0.518
• Python version: Python 3.6.12
• SDK version: ciscoisesdk 2.0.8
• OS version:

[fmunozmiranda]

Hi @tali1974 I checked it and it seems to be an API behavior, if a field that previously existed does not go in the UPDATE request, it removes it. @1homas I don't know if this could be determined as an API issue?

[aghasi]

update means replace current settings with new settings in Cisco ISE context. This means that "TACACS Authentication Setting" is removed if you have not provided it network_device.update_by_id. Use network_device.get_by_id to get all settings of device, change the groups on it and then call network_device.update_by_id to set it.

[bgoulet00]

i concur with OP, when i perform an 'update' i expect that to be an update, in that i can update one or more attributes as required. this is standard behavior for other systems i've worked with. the device 'update' as implemented is an overwrite, not an update. barely different from a device delete followed by a device add.

[bgoulet00]

as a consolation, it appears you can round trip the data, which i assume is what aghasi was alluding to.

response = ise.network_device.get_network_device_by_name(device_name)
existing_config = response.response
existing_config['NetworkDevice']['name'] = new_device_name
response = ise.network_device.update_network_device_by_id(id=existing_config['NetworkDevice']['id'], payload=existing_config)

from what i can tell, this ability doesn't seem to be explained anywhere and there is no real info on the payload argument of the method.

i still believe the update method should be re-tooled into an update method, but at the very least, there should be some documentation on use of the payload argument.

[bgoulet00]

there seems to be some issues with other fields being updated even when using the existing data as the baseline for the payload. using the method above, i updated just the ip address and then fed that data back as the payload.

device_config['NetworkDevice']['NetworkDeviceIPList'][0]['ipaddress'] = ip
device_config['NetworkDevice']['NetworkDeviceIPList'][0]['mask'] = ip_mask

the response from the update shows more than just the ip address being updated.

{

[device config before.txt](https://github.com/user-attachments/files/20509211/device.config.before.txt)

[device config after.txt](https://github.com/user-attachments/files/20509213/device.config.after.txt)

  "UpdatedFieldsList": {
    "updatedField": [
      {'field': 'DtlsRequired', 'oldValue': '', 'newValue': 'false'},
      {'field': 'AuthenticationSettings.EnableKeyWrap', 'oldValue': '', 'newValue': 'false'},
      {'field': 'AuthenticationSettings.RadiusSharedSecret', 'oldValue': '**', 'newValue': '****'},
      {'field': 'AuthenticationSettings.KeyInputFormat', 'oldValue': '', 'newValue': 'ascii'},
      {'field': 'NetworkDeviceIpList', 'oldValue': 'item removed: IP:1.1.1.1 , Mask:32 , Min:16843009, Max: 16843009'},
      {'field': 'NetworkDeviceIpList', 'newValue': 'item added: IP:2.2.2.2 , Mask:32 , Min:33686018, Max: 33686018'}
    ]
  }
}

i've attached the before and after results of get_network_device_by_name() for reference
some of these items appear to be falsely reported. DtlsRequired and AuthenticationSettings.EnableKeyWrap were both false before and AuthenticationSettings.RadiusSharedSecret was a non-existing config before and after. AuthenticationSettings.KeyInputFormat certainly did change.

[bgoulet00]

not seeing my attachments went through so adding the info here

before:

{
  "NetworkDevice": {
    "id": "6c0ebf80-3cad-11f0-b1f8-463498aa2378",
    "name": "0000",
    "description": "",
    "authenticationSettings": {
      "enableKeyWrap": false,
      "dtlsRequired": false,
      "enableMultiSecret": "false"
    },
    "profileName": "Cisco",
    "coaPort": 1700,
    "link": {
      "rel": "self",
      "href": "https://ise-admin-1.peraton.com/ers/config/networkdevice/name/0000",
      "type": "application/json"
    },
    "NetworkDeviceIPList": [
      {
        "ipaddress": "1.1.1.1",
        "mask": 32
      }
    ],
    "NetworkDeviceGroupList": [
      "Location#All Locations",
      "Device Type#All Device Types",
      "IPSEC#Is IPSEC Device"
    ]
  }
}

after:

{
  "NetworkDevice": {
    "id": "6c0ebf80-3cad-11f0-b1f8-463498aa2378",
    "name": "0000",
    "description": "",
    "authenticationSettings": {
      "enableKeyWrap": false,
      "dtlsRequired": false,
      "keyInputFormat": "ASCII",
      "enableMultiSecret": "false"
    },
    "profileName": "Cisco",
    "coaPort": 1700,
    "link": {
      "rel": "self",
      "href": "https://ise-admin-1.peraton.com/ers/config/networkdevice/name/0000",
      "type": "application/json"
    },
    "NetworkDeviceIPList": [
      {
        "ipaddress": "2.2.2.2",
        "mask": 32
      }
    ],
    "NetworkDeviceGroupList": [
      "Location#All Locations",
      "Device Type#All Device Types",
      "IPSEC#Is IPSEC Device"
    ]
  }
}