bug: set network zone --interfaces always fails (extra_forbidden); zone interfaces unusable

[cdot65]

Summary

scm set network zone --interfaces ... always fails — it's impossible to create a security zone with interface members via the CLI. Only bare zones (no --interfaces) succeed.

Repro

scm set network zone --folder home --name lan --mode layer3 --interfaces ethernet1/1

Actual

ERROR ... SDK model validation error ... 1 validation error for SecurityZoneCreateModel
interfaces
  Extra inputs are not permitted [type=extra_forbidden, input_value=['ethernet1/1'], input_type=list]

Root cause (CLI, not SDK)

src/scm_cli/utils/sdk_client.py::create_zone builds the payload with a stray flat key:

if interfaces:
    zone_data["interfaces"] = interfaces        # ~line 6594  <-- invalid key
...
else:
    if mode:
        zone_data["network"] = {mode.lower().replace("-", "_"): interfaces or []}  # ~line 6631  <-- CORRECT
    result = self.client.security_zone.create(zone_data)

On create, zone_data ends up containing both interfaces (invalid) and network (valid). The SDK model has no interfaces field — the real field is network.<mode> — so extra="forbid" correctly rejects it. This is a malformed-payload bug in the CLI wrapper; the SDK is behaving as intended. (Bare zones work only because the if interfaces: block is skipped.)

Additional defects in the same method

• Update path is a no-op for interfaces (~lines 6612–6620 contain pass / a warning), so updating an existing zone's interfaces silently does nothing.
• --interfaces is not comma-split: --interfaces a,b,c arrives as ['a,b,c'] (one bogus interface), unlike address-group --members. INTERFACES_OPTION/set_zone should run parse_comma_separated_list.

Suggested fix

• Remove the if interfaces: zone_data["interfaces"] = interfaces block — the create path already nests interfaces under network.
• Apply the same network.<mode> structure on the update path so interface edits persist.
• Comma-split --interfaces.

Severity

High — the command is broken for its primary use case.

Found while reverse-engineering an on-prem PAN-OS 11.2 NGFW config.xml into an SCM folder; zones had to be created bare.