topic Re: Ansible playbook to shutdown interface in Automation/API Discussions

Ansible playbook to shutdown interface

sall13 — Tue, 22 Feb 2022 14:57:31 GMT

Hi all!

I need help creating an Ansible playbook that shutdown one of the firewall interface.

I'm trying to do something like this:

[...]

collections:
- paloaltonetworks.panos

tasks:

- name: "Interface down"
panos_op:
provider: '{{ provider }}'
cmd: 'set network interface ethernet ethernet1/1 link-state down'

[...]

But I get this result:

TASK [Interface down] **********************************************************************************
fatal: [localhost]: FAILED! => {"changed": false, "msg": "Failed to run command : set network interface ethernet ethernet1/1 link-state \"down\" : URLError: code: 400 reason: Illegal parameter [request]"}

I'm not sure about what is wrong. Maybe I'm not in configuration mode, but I don't know how to put it before the command.

How would be the best way to do it?

Thanks!

Re: Ansible playbook to shutdown interface

JimmyHolland — Tue, 22 Feb 2022 16:34:33 GMT

Hi @sall13,

The panos_op module is only for operational mode (OP) commands, it will not execute configuration mode commands.

A general purpose module for configuration is panos_type_cmd, with which you could do something like this:

tasks: - name: test panos_type_cmd: provider: '{{ provider }}' xpath: "/config/devices/entry[@name='localhost.localdomain']/network/interface/ethernet/entry[@name='ethernet1/1']" element: "<link-state>down</link-state>"

Also follow this with a commit task to make the change (link down) live.

Hope that helps!

Re: Ansible playbook to shutdown interface

sall13 — Wed, 23 Feb 2022 16:03:55 GMT

Thank you @JimmyHolland, It looks great!

Just one more question about this part:

[@name='localhost.localdomain']

is it variable? I mean, it depends on something configured in the firewall?

Thanks again.

Re: Ansible playbook to shutdown interface

JimmyHolland — Wed, 23 Feb 2022 16:16:38 GMT

Hi @sall13, not really, this is the same on every PAN-OS device so it can stay the same each time on every device you target.

Hope that helps, click "Accept as Solution" on the post above if so...

Re: Ansible playbook to shutdown interface

sall13 — Thu, 24 Feb 2022 08:14:58 GMT

Understood. Thanks!