Panorama deployment in Ansible

OysteinK — Thu, 12 Sep 2019 10:42:04 GMT

Hi.

Im working with a customer using PANW/NSX that wants to automate Panorama/firewall deployment with ansible.

So far I have found a few stumbling blocks:

The ESXi OVA file defines the VM with 4vCPUs and 8GB RAM. This wont work for Panorama mode, only legacy mode
The Panorama ESX ova does not have DHCP enabled by default on the MGMT interface, unlike the firewall ova, and the Azure/AWS. images.
The various Panos modules for Ansible do not support the "validate_certs: false" option common to most Ansible modules.

For nr 1, I'll fix it by creating a custom .ovf file.

If anyone has any suggestions to solve nr 2 and 3, please reply.

I'll keep posting as I figure out how to go forward.

Re: Panorama deployment in Ansible

OysteinK — Mon, 16 Sep 2019 14:10:12 GMT

You can disable certificate checking globally for Python by editing /etc/python/cert-verification.cfg and set verify=disable.

This is not very secure, so we should look at enabling this on runtime per playbook.This way we can disable checks, install certs from our favourite CA, and then turn cert-checks on again.

topic Re: Panorama deployment in Ansible in Automation/API Discussions

Panorama deployment in Ansible

Re: Panorama deployment in Ansible