topic Re: Panos_Security_Rule - "msg": "dictionary requested, could not parse JSON or key=value" in Automation/API Discussions

Panos_Security_Rule - "msg": "dictionary requested, could not parse JSON or key=value"

scoobyboy — Fri, 25 Feb 2022 17:47:50 GMT

Hi, if some one can advise or help, why I am getting this error within Ansible

I am creating a load of hosts from a csv, creating a object group and then creating a security rule that references that newly created object group as a source

Error is "msg": "dictionary requested, could not parse JSON or key=value"

Below is my code

Host creation :

- name: read-r1-host-csv-file

read_csv:

path: Intenet Access - Azure Data Pub-R1-Hosts.csv

key: hostname

- name: Create R1 address objects

panos_address_object:

provider: "{{ palo_provider }}"

state: present

name: '{{ item.value.hostname }}'

value: '{{ item.value.ip}}'

with_items: "{{ srcr1hosts.dict | dict2items }}"

- set_fact:

r1hosts_in_group: "{{ srcr1hosts.dict | dict2items | map(attribute='key') | list }}"

- name: add-r1-source-hosts-network-group

panos_address_group:

provider: "{{ palo_provider }}"

name: srcr1group

state: present

static_value: "{{ r1hosts_in_group }}"

delegate_to: Global

Rule Creation :

- name: add a rule Internet Access - Azure Databricks pub - ANY-01

panos_security_rule:

provider: "palo_provider"

device_group: "Azure_Perimeter_Prod"

state: 'present'

rule_name: 'Internet Access - Azure Databricks pub - ANY-01'

source_zone: ['internet']

destination_zone: ['azure']

source_ip: ['srcr1group']

source_user: ['any']

destination_ip: ['H-***********']

application: ['ssl']

group_profile: ['Global-Block-Url']

log_setting: ['NA_Log_Forward']

location: before

existing_rule: before Internet Access - Azure Databricks pub - ANY

action: 'allow'

Cheers, any help appreciated

Re: Panos_Security_Rule - "msg": "dictionary requested, could not parse JSON or key=value"

JimmyHolland — Sat, 16 Apr 2022 20:45:48 GMT

Hi @scoobyboy, I started with your tasks and tried to replicate the error, and I could not. There are a few things that I had to tweak along the way to get the playbook working, and hopefully the notes below could help you though?

the delegate_to: Global line isn't needed in the address group creation task
the group_profile: ['Global-Block-Url'] and log_setting: ['NA_Log_Forward'] lines need just strings instead of arrays of strings, like this: group_profile: 'Global-Block-Url' and log_setting: 'NA_Log_Forward'
the device_group: "Azure_Perimeter_Prod" line is placing the rule inside the context of a Device Group, implying targeting a Panorama, I didn't use this line as the previous tasks had no Device Group context so I targeted a NGFW. If you still need help, maybe you could clarify the target and whether the objects are intended to be shared or not, in Device Groups or not, etc

Here's my working playbook targeting a PA-Series NGFW

- name : Read CSV file read_csv : path : test.csv key : hostname register : srcr1hosts - name : Create address objects panos_address_object : provider : "{{ palo_provider }}" state : present name : '{{ item.value.hostname }}' value : '{{ item.value.ip}}' with_items : "{{ srcr1hosts.dict | dict2items }}" - set_fact : hosts_in_group : "{{ srcr1hosts.dict | dict2items | map(attribute='key') | list }}" - name : Add address objects to address group panos_address_group : provider : "{{ palo_provider }}" name : test_group state : present static_value : "{{ hosts_in_group }}" #delegate_to : Global - name : Add a rule panos_security_rule : provider : "{{ palo_provider }}" #device_group : "Azure_Perimeter_Prod" state : 'present' rule_name : 'Test rule' source_zone : [ 'lab_trust' ] destination_zone : [ 'lab_untrust' ] source_ip : [ 'test_group' ] source_user : [ 'any' ] destination_ip : [ 'any' ] application : [ 'ssl' ] group_profile : 'default' log_setting : 'test' location : before existing_rule : 'test' action : 'allow'

Hope this helps!

Re: Panos_Security_Rule - "msg": "dictionary requested, could not parse JSON or key=value"

scoobyboy — Mon, 25 Apr 2022 08:26:24 GMT

Hi @JimmyHolland, many thanks for taking a look at this for me, it is appreciated

In answer to your questions, its targeting a Panorama, and yes it is been created in certain device groups, and yes they are supposed to be shared

I got this working on a NGFW, but when i tried targeting the Pan i started to get this error, the only change I did was add the device_group value to the "add rule" task

But no matter, thanks for assisting 🙂

Paul