topic Re: Trying to turn of Preemption via Ansible Playbook failure in Automation/API Discussions

Trying to turn of Preemption via Ansible Playbook failure

ryan.slater — Mon, 11 Oct 2021 15:19:45 GMT

I am working on an ansible playbook for upgrading our Palo Alto Firewall, and one of the requirements that we have is that I have to disable Preemption. I have not been able to find any examples of this so I have been working on creating my own task to add to the excellent examples that have been provided (https://github.com/PaloAltoNetworks/ansible-playbooks). Here is my task so far:

tasks:

- name: Disable preemption on primary device

paloaltonetworks.panos.panos_type_cmd:

provider: '{{ primary }}'

cmd: 'set'

xpath: |

/config/devices/entry[@name='localhost.localdomain']

/deviceconfig/high-availability/group/election-option

element: |

<election-option>

<preemptive>no

</preemptive>

</election-option>

When I run this task I get the following error:

FAILED! => {"changed": false, "msg": "set failed, may need to override template object first"}

And when I change to cmd to override I get the following error:

FAILED! => {"changed": false, "msg": "Object cannot be overridden\n"}

Additionally the management plan becomes unresponsive for several minutes.

I'm sure I am doing something wrong and it is something simple that I am missing on this, but I'm so deep into the weeds on it that I can't see it anymore.

Thank you for the help.

Re: Trying to turn of Preemption via Ansible Playbook failure

JimmyHolland — Tue, 12 Oct 2021 12:21:13 GMT

Hi @ryan.slater, I think it's a config format change you need. Try removing the election-option part of the xpath, leaving just

/config/devices/entry[@name='localhost.localdomain']/deviceconfig/high-availability/group

Re: Trying to turn of Preemption via Ansible Playbook failure

ryan.slater — Tue, 12 Oct 2021 17:56:33 GMT

With this change doing a SET I get the following:

FAILED! => {"changed": false, "msg": " group -> election-option -> preemptive is invalid"}

And with OVERRIDE I get the following:

FAILED! => {"changed": false, "msg": "Object cannot be overridden\n"}

If I add a "/" to the end of the XPATH (/config/devices/entry[@name='localhost.localdomain']/deviceconfig/high-availability/group/) I still have the same errors as I previously had in my past post.

Re: Trying to turn of Preemption via Ansible Playbook failure

JimmyHolland — Tue, 12 Oct 2021 20:02:26 GMT

Hi @ryan.slater, here's the full playbook and output in case it helps...

Re: Trying to turn of Preemption via Ansible Playbook failure

ryan.slater — Tue, 12 Oct 2021 21:05:12 GMT

Not sure what I must have typo'ed in my first attempt, but after copying your entry, it is now working on my side as expected. Thank you very much for your help.

Re: Trying to turn of Preemption via Ansible Playbook failure

brandonmajor — Wed, 15 Jun 2022 16:37:28 GMT

Hey @ryan.slater ; could you explain more what you possibly fixed? Was it a line break issue or something?