topic Re: Use Ansible to backup config in Automation/API Discussions

Use Ansible to backup config

IarnoPagliani — Sun, 13 Oct 2019 16:11:57 GMT

Ciao,

is there a simple way to backup config using Ansible ?

Thanks

Re: Use Ansible to backup config

gfreeman — Mon, 14 Oct 2019 17:14:51 GMT

Not yet, this is still a pending feature request for the Ansible role:

https://github.com/PaloAltoNetworks/ansible-pan/issues/90

I'd recommend commenting or thumbs-up'ing the original issue opener, so that Palo Alto Networks has a way to see how many users want a particular issue / feature request.

Re: Use Ansible to backup config

sylvaing — Fri, 24 Apr 2020 09:50:53 GMT

Hi @IarnoPagliani

A bit late on the topic but I created a playbook sometime ago to perform backups of PAN FWs

https://github.com/wpacket/pan-ansible/blob/master/pan_config_pull.yml

Had to reuse it today and I can confirm it still works ( Python3 + Ansible 2.9.7 )

I also put a playbook to push local configs to devices from the same inventory but I guess you already have that

https://github.com/wpacket/pan-ansible/blob/master/pan_config_push.yml

Regards

Re: Use Ansible to backup config

hbalzac — Sat, 02 May 2020 12:26:12 GMT

Is there any reason to use this insted of the built in backup function with scp?

Re: Use Ansible to backup config

jmolefe — Tue, 12 May 2020 18:16:07 GMT

Hi @sylvaing

I'm also using Ansible 2.9.7

However the play fails at the "Extract API Key from XML Output" task with error "fatal: [x.x.x.x]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: 'dict object' has no attribute 'content'\n\n"

No changes done on the playbook besides referencing my host group

Thank you

John.

Re: Use Ansible to backup config

jmolefe — Tue, 12 May 2020 19:01:59 GMT

Upgrading to python 3 doesn't help as well

Re: Use Ansible to backup config

sylvaing — Thu, 14 May 2020 12:53:14 GMT

Hi @hbalzac

If you only manage PAN firewalls , no.

However if you are dealing with a multivendor setup , using ansible as a central point of automation ( backup , config , ops ) can simplify your life.

Re: Use Ansible to backup config

sylvaing — Thu, 14 May 2020 12:55:13 GMT

Hi @jmolefe

Interresting , this might be related to the format of the API KEY response from the firewall. I ve been dealing with 8.1 and 9.0 atm when creating this playbook mostly. What version are you running on your firewall ?

Sylvain

Re: Use Ansible to backup config

jmolefe — Thu, 14 May 2020 13:09:39 GMT

Hi @sylvaing

Firewalls run 8.1 and Panorama is on 9.0 and both fail. Please see format of API response below

<key>

KEY_HERE

</key>

</result>

</response>

John.

Re: Use Ansible to backup config

sylvaing — Thu, 14 May 2020 15:54:55 GMT

Hi @jmolefe

Can you -vvv you ansible-playbook command and show me the output of the Generate API Key task ?

I bet it is not formated as mine and that must be the reason why the API key cannot be extracted. Or maybe one ansible module is missing.

Let s figure that out,

Re: Use Ansible to backup config

jmolefe — Thu, 14 May 2020 18:45:04 GMT

Hi @sylvaing

Please see output below:

}
skipping: [x.x.x.x] => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"invocation": {
"module_args": {
"method": "GET",
"return_content": true,
"url": "https://x.x.x.x/api/?type=keygen&user=<username>&password=<password>",
"validate_certs": false
}
},
"msg": "remote module (uri) does not support check mode"
}

PS. Items in Bold have been substituted

At the moment I can pull the configs with a script that performs API calls though.

Regards

John.

Re: Use Ansible to backup config

sylvaing — Fri, 15 May 2020 09:50:03 GMT

Hi @jmolefe

I think you run the playbook with the --check knob which is not compatible with the uri module.

I don t like it but I have change the playbook to force each task to run in un-check mode.

Give it a try with the new version and you should be good,

Re: Use Ansible to backup config

jmolefe — Fri, 15 May 2020 11:07:10 GMT

Hi @sylvaing

Yes removing the --check mode and installing the lxml python module did the trick.

Thank you

John.

Re: Use Ansible to backup config

sylvaing — Fri, 15 May 2020 16:44:36 GMT

Hi @jmolefe

Correct lxml is mandatory , I should create a README with the requirement ,

Will do that in the next update,

Re: Use Ansible to backup config

jmolefe — Sat, 16 May 2020 06:11:38 GMT

Hi @sylvaing

Yes that should help.

I see however that whenever I connect to the devices using the playbook there is no logout task and the connection remains active until a connection-timeout kicks the sessions out. Weird..

* Check logged in users after the play completes.

John.