topic Re: Unable to set serial number on Panorama via Ansible Playbook in Automation/API Discussions

Unable to set serial number on Panorama via Ansible Playbook

SZanpure — Thu, 28 Jul 2022 20:50:16 GMT

Hi,

I have provisioned a Panorama in CSP using flex credits. I then spun up a Panorama instance using Terraform. After the instance has initialised (I browse to the Panorama Web UI login screen via public IP), I kick off my ansible playbook, which has the initial configuration. First attached screenshot shows that the serial number is "Unknown". This is before the ansible playbook is run.

The second screenshot shows the ansible error which I call "panos_op" to set the serial number. Third screenshot shows that the serial number has been set, even though the ansible playbook errored.

Ansible playbook below

--- - hosts: localhost connection: local # This is needed to set admin password. https://github.com/PaloAltoNetworks/pan-os-ansible/discussions/272 gather_facts: false collections: - paloaltonetworks.panos - amazon.aws vars: provider: ip_address: '<panorama public IP>' # TODO: Fetch this using aws collection username: 'admin' tasks: - name: retrieve admin password from aws secrets manager no_log: true set_fact: provider: "{{ provider | combine(new_item, recursive=true) }}" vars: new_item: { 'password': "{{ lookup('aws_secret', 'panos-admin-password', on_missing='error', on_denied='error') }}" } with_dict: "{{ provider }}" - name: Change admin password using ssh protocol panos_admpwd: ip_address: "{{ provider['ip_address'] }}" username: "{{ provider['username'] }}" newpassword: "{{ provider['password'] }}" key_filename: "../key.pem" register: result until: result is not failed retries: 300 delay: 10 - name: commit candidate config on panorama panos_commit_panorama: provider: '{{ provider }}' description: 'changed admin password' - name: wait for commits to finish panos_check: provider: '{{ provider }}' initial_delay: 10 interval: 5 timeout: 100 - name: retrieve panorama admin api key panos_api_key: provider: '{{ provider }}' register: panorama_admin_api_key - name: set panorama admin api key in provider dict no_log: true set_fact: provider: "{{ provider | combine(new_item, recursive=true) }}" vars: new_item: { 'api_key': "{{ panorama_admin_api_key.api_key }}" } with_dict: "{{ provider }}" - name: Get system info panos_facts: provider: '{{ provider }}' gather_subset: ['system'] register: system_info - name: Show system info debug: msg="{{ system_info }}" - name: set panorama serial number panos_op: provider: '{{ provider }}' cmd: "<set><serial-number>{{ lookup('aws_secret', 'panos-serial-number', on_missing='error', on_denied='error') }}</serial-number></set>" cmd_is_xml: true - name: commit candidate config on panorama panos_commit_panorama: provider: '{{ provider }}' description: 'added serial number' - name: wait for commits to finish panos_check: provider: '{{ provider }}' initial_delay: 10 interval: 5 timeout: 100 - name: check if panorama serial number has updated panos_facts: provider: '{{ provider }}' gather_subset: ['system']

I tried hardcoding the serial number in the set command (instead of fetching it from secrets manager) and that made no difference whatsoever.

Ansible output below

Starting galaxy collection install process Process install dependency map Starting collection install process Skipping 'paloaltonetworks.panos' as it is already installed Skipping 'amazon.aws' as it is already installed [WARNING]: No inventory was parsed, only implicit localhost is available [WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all' PLAY [localhost] ***************************************************************************************************************************************************************************** TASK [retrieve admin password from secrets manager] ****************************************************************************************************************************************** ok: [localhost] => (item=None) ok: [localhost] => (item=None) ok: [localhost] TASK [Change admin password using ssh protocol] ********************************************************************************************************************************************** changed: [localhost] TASK [commit candidate config on panorama] *************************************************************************************************************************************************** ok: [localhost] TASK [wait for commits to finish] ************************************************************************************************************************************************************ changed: [localhost] TASK [retrieve panorama admin api key] ******************************************************************************************************************************************************* ok: [localhost] TASK [set panorama admin api key in provider dict] ******************************************************************************************************************************************* ok: [localhost] => (item=None) ok: [localhost] => (item=None) ok: [localhost] => (item=None) ok: [localhost] TASK [Get system info] *********************************************************************************************************************************************************************** ok: [localhost] TASK [Show system info] ********************************************************************************************************************************************************************** ok: [localhost] => { "msg": { "ansible_facts": { "ansible_net_full_commit_required": false, "ansible_net_gather_subset": [ "system" ], "ansible_net_hostname": "Panorama", "ansible_net_model": "Panorama", "ansible_net_multivsys": null, "ansible_net_serial": "unknown", "ansible_net_uncommitted_changes": false, "ansible_net_uptime": "0 days, 0:22:23", "ansible_net_version": "10.1.5-h1" }, "changed": false, "failed": false } } TASK [set panorama serial number] ************************************************************************************************************************************************************ An exception occurred during task execution. To see the full traceback, use -vvv. The error was: http.client.RemoteDisconnected: Remote end closed connection without response fatal: [localhost]: FAILED! => {"changed": false, "module_stderr": "Traceback (most recent call last):\n File \"/opt/app/.ansible/tmp/ansible-tmp-1659027736.4368856-101-91496277608478/AnsiballZ_panos_op.py\", line 102, in <module>\n _ansiballz_main()\n File \"/opt/app/.ansible/tmp/ansible-tmp-1659027736.4368856-101-91496277608478/AnsiballZ_panos_op.py\", line 94, in _ansiballz_main\n invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n File \"/opt/app/.ansible/tmp/ansible-tmp-1659027736.4368856-101-91496277608478/AnsiballZ_panos_op.py\", line 40, in invoke_module\n runpy.run_module(mod_name='ansible_collections.paloaltonetworks.panos.plugins.modules.panos_op', init_globals=None, run_name='__main__', alter_sys=True)\n File \"/usr/lib/python3.9/runpy.py\", line 210, in run_module\n return _run_module_code(code, init_globals, run_name, mod_spec)\n File \"/usr/lib/python3.9/runpy.py\", line 97, in _run_module_code\n _run_code(code, mod_globals, init_globals,\n File \"/usr/lib/python3.9/runpy.py\", line 87, in _run_code\n exec(code, run_globals)\n File \"/tmp/ansible_panos_op_payload_cy8f9t6z/ansible_panos_op_payload.zip/ansible_collections/paloaltonetworks/panos/plugins/modules/panos_op.py\", line 170, in <module>\n File \"/tmp/ansible_panos_op_payload_cy8f9t6z/ansible_panos_op_payload.zip/ansible_collections/paloaltonetworks/panos/plugins/modules/panos_op.py\", line 144, in main\n File \"/usr/lib/python3.9/site-packages/panos/panorama.py\", line 498, in op\n return super(Panorama, self).op(\n File \"/usr/lib/python3.9/site-packages/panos/base.py\", line 4047, in op\n element = self.xapi.op(cmd, vsys, False, extra_qs, retry_on_peer=retry_on_peer)\n File \"/usr/lib/python3.9/site-packages/panos/base.py\", line 3878, in method\n super_method(self, *args, **kwargs)\n File \"/usr/lib/python3.9/site-packages/pan/xapi.py\", line 951, in op\n self.__type_op(cmd, vsys, extra_qs)\n File \"/usr/lib/python3.9/site-packages/pan/xapi.py\", line 969, in __type_op\n response = self.__api_request(query)\n File \"/usr/lib/python3.9/site-packages/pan/xapi.py\", line 545, in __api_request\n response = urlopen(**kwargs)\n File \"/usr/lib/python3.9/urllib/request.py\", line 214, in urlopen\n return opener.open(url, data, timeout)\n File \"/usr/lib/python3.9/urllib/request.py\", line 517, in open\n response = self._open(req, data)\n File \"/usr/lib/python3.9/urllib/request.py\", line 534, in _open\n result = self._call_chain(self.handle_open, protocol, protocol +\n File \"/usr/lib/python3.9/urllib/request.py\", line 494, in _call_chain\n result = func(*args)\n File \"/usr/lib/python3.9/urllib/request.py\", line 1389, in https_open\n return self.do_open(http.client.HTTPSConnection, req,\n File \"/usr/lib/python3.9/urllib/request.py\", line 1350, in do_open\n r = h.getresponse()\n File \"/usr/lib/python3.9/http/client.py\", line 1377, in getresponse\n response.begin()\n File \"/usr/lib/python3.9/http/client.py\", line 320, in begin\n version, status, reason = self._read_status()\n File \"/usr/lib/python3.9/http/client.py\", line 289, in _read_status\n raise RemoteDisconnected(\"Remote end closed connection without\"\nhttp.client.RemoteDisconnected: Remote end closed connection without response\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1} PLAY RECAP *********************************************************************************************************************************************************************************** localhost : ok=8 changed=2 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0

My python version is 3.9.12. My Ansible version is 2.10.7. I am using the latest ansible collection for paloaltonetworks.panos (the one released on pypi, which I believe is from main branch, and not develop).

Is this is a known issue, or am I doing something wrong? Any help appreciated please.

Regards,

Shreyas

Re: Unable to set serial number on Panorama via Ansible Playbook

SZanpure — Thu, 28 Jul 2022 21:04:00 GMT

Here is the full error after adding -vvvv to ansible-playbook

TASK [set panorama serial number] ************************************************************************************************************************************************************ task path: /opt/app/modules/panorama/ansible/playbooks/playbook.yml:69 redirecting (type: lookup) ansible.builtin.aws_secret to amazon.aws.aws_secret <127.0.0.1> ESTABLISH LOCAL CONNECTION FOR USER: dockeruser <127.0.0.1> EXEC /bin/sh -c 'echo ~dockeruser && sleep 0' <127.0.0.1> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /opt/app/.ansible/tmp `"&& mkdir "` echo /opt/app/.ansible/tmp/ansible-tmp-1659041750.0424504-101-58760158934861 `" && echo ansible-tmp-1659041750.0424504-101-58760158934861="` echo /opt/app/.ansible/tmp/ansible-tmp-1659041750.0424504-101-58760158934861 `" ) && sleep 0' Using module file /opt/app/.ansible/collections/ansible_collections/paloaltonetworks/panos/plugins/modules/panos_op.py <127.0.0.1> PUT /opt/app/.ansible/tmp/ansible-local-105i1psm3k/tmpp6h0lnyr TO /opt/app/.ansible/tmp/ansible-tmp-1659041750.0424504-101-58760158934861/AnsiballZ_panos_op.py <127.0.0.1> EXEC /bin/sh -c 'chmod u+x /opt/app/.ansible/tmp/ansible-tmp-1659041750.0424504-101-58760158934861/ /opt/app/.ansible/tmp/ansible-tmp-1659041750.0424504-101-58760158934861/AnsiballZ_panos_op.py && sleep 0' <127.0.0.1> EXEC /bin/sh -c '/usr/bin/python3 /opt/app/.ansible/tmp/ansible-tmp-1659041750.0424504-101-58760158934861/AnsiballZ_panos_op.py && sleep 0' <127.0.0.1> EXEC /bin/sh -c 'rm -f -r /opt/app/.ansible/tmp/ansible-tmp-1659041750.0424504-101-58760158934861/ > /dev/null 2>&1 && sleep 0' The full traceback is: Traceback (most recent call last): File "/opt/app/.ansible/tmp/ansible-tmp-1659041750.0424504-101-58760158934861/AnsiballZ_panos_op.py", line 102, in <module> _ansiballz_main() File "/opt/app/.ansible/tmp/ansible-tmp-1659041750.0424504-101-58760158934861/AnsiballZ_panos_op.py", line 94, in _ansiballz_main invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS) File "/opt/app/.ansible/tmp/ansible-tmp-1659041750.0424504-101-58760158934861/AnsiballZ_panos_op.py", line 40, in invoke_module runpy.run_module(mod_name='ansible_collections.paloaltonetworks.panos.plugins.modules.panos_op', init_globals=None, run_name='__main__', alter_sys=True) File "/usr/lib/python3.9/runpy.py", line 210, in run_module return _run_module_code(code, init_globals, run_name, mod_spec) File "/usr/lib/python3.9/runpy.py", line 97, in _run_module_code _run_code(code, mod_globals, init_globals, File "/usr/lib/python3.9/runpy.py", line 87, in _run_code exec(code, run_globals) File "/tmp/ansible_panos_op_payload_qz9ye_6j/ansible_panos_op_payload.zip/ansible_collections/paloaltonetworks/panos/plugins/modules/panos_op.py", line 170, in <module> File "/tmp/ansible_panos_op_payload_qz9ye_6j/ansible_panos_op_payload.zip/ansible_collections/paloaltonetworks/panos/plugins/modules/panos_op.py", line 144, in main File "/usr/lib/python3.9/site-packages/panos/panorama.py", line 498, in op return super(Panorama, self).op( File "/usr/lib/python3.9/site-packages/panos/base.py", line 4047, in op element = self.xapi.op(cmd, vsys, False, extra_qs, retry_on_peer=retry_on_peer) File "/usr/lib/python3.9/site-packages/panos/base.py", line 3878, in method super_method(self, *args, **kwargs) File "/usr/lib/python3.9/site-packages/pan/xapi.py", line 951, in op self.__type_op(cmd, vsys, extra_qs) File "/usr/lib/python3.9/site-packages/pan/xapi.py", line 969, in __type_op response = self.__api_request(query) File "/usr/lib/python3.9/site-packages/pan/xapi.py", line 545, in __api_request response = urlopen(**kwargs) File "/usr/lib/python3.9/urllib/request.py", line 214, in urlopen return opener.open(url, data, timeout) File "/usr/lib/python3.9/urllib/request.py", line 517, in open response = self._open(req, data) File "/usr/lib/python3.9/urllib/request.py", line 534, in _open result = self._call_chain(self.handle_open, protocol, protocol + File "/usr/lib/python3.9/urllib/request.py", line 494, in _call_chain result = func(*args) File "/usr/lib/python3.9/urllib/request.py", line 1389, in https_open return self.do_open(http.client.HTTPSConnection, req, File "/usr/lib/python3.9/urllib/request.py", line 1350, in do_open r = h.getresponse() File "/usr/lib/python3.9/http/client.py", line 1377, in getresponse response.begin() File "/usr/lib/python3.9/http/client.py", line 320, in begin version, status, reason = self._read_status() File "/usr/lib/python3.9/http/client.py", line 289, in _read_status raise RemoteDisconnected("Remote end closed connection without" http.client.RemoteDisconnected: Remote end closed connection without response fatal: [localhost]: FAILED! => { "changed": false, "module_stderr": "Traceback (most recent call last):\n File \"/opt/app/.ansible/tmp/ansible-tmp-1659041750.0424504-101-58760158934861/AnsiballZ_panos_op.py\", line 102, in <module>\n _ansiballz_main()\n File \"/opt/app/.ansible/tmp/ansible-tmp-1659041750.0424504-101-58760158934861/AnsiballZ_panos_op.py\", line 94, in _ansiballz_main\n invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n File \"/opt/app/.ansible/tmp/ansible-tmp-1659041750.0424504-101-58760158934861/AnsiballZ_panos_op.py\", line 40, in invoke_module\n runpy.run_module(mod_name='ansible_collections.paloaltonetworks.panos.plugins.modules.panos_op', init_globals=None, run_name='__main__', alter_sys=True)\n File \"/usr/lib/python3.9/runpy.py\", line 210, in run_module\n return _run_module_code(code, init_globals, run_name, mod_spec)\n File \"/usr/lib/python3.9/runpy.py\", line 97, in _run_module_code\n _run_code(code, mod_globals, init_globals,\n File \"/usr/lib/python3.9/runpy.py\", line 87, in _run_code\n exec(code, run_globals)\n File \"/tmp/ansible_panos_op_payload_qz9ye_6j/ansible_panos_op_payload.zip/ansible_collections/paloaltonetworks/panos/plugins/modules/panos_op.py\", line 170, in <module>\n File \"/tmp/ansible_panos_op_payload_qz9ye_6j/ansible_panos_op_payload.zip/ansible_collections/paloaltonetworks/panos/plugins/modules/panos_op.py\", line 144, in main\n File \"/usr/lib/python3.9/site-packages/panos/panorama.py\", line 498, in op\n return super(Panorama, self).op(\n File \"/usr/lib/python3.9/site-packages/panos/base.py\", line 4047, in op\n element = self.xapi.op(cmd, vsys, False, extra_qs, retry_on_peer=retry_on_peer)\n File \"/usr/lib/python3.9/site-packages/panos/base.py\", line 3878, in method\n super_method(self, *args, **kwargs)\n File \"/usr/lib/python3.9/site-packages/pan/xapi.py\", line 951, in op\n self.__type_op(cmd, vsys, extra_qs)\n File \"/usr/lib/python3.9/site-packages/pan/xapi.py\", line 969, in __type_op\n response = self.__api_request(query)\n File \"/usr/lib/python3.9/site-packages/pan/xapi.py\", line 545, in __api_request\n response = urlopen(**kwargs)\n File \"/usr/lib/python3.9/urllib/request.py\", line 214, in urlopen\n return opener.open(url, data, timeout)\n File \"/usr/lib/python3.9/urllib/request.py\", line 517, in open\n response = self._open(req, data)\n File \"/usr/lib/python3.9/urllib/request.py\", line 534, in _open\n result = self._call_chain(self.handle_open, protocol, protocol +\n File \"/usr/lib/python3.9/urllib/request.py\", line 494, in _call_chain\n result = func(*args)\n File \"/usr/lib/python3.9/urllib/request.py\", line 1389, in https_open\n return self.do_open(http.client.HTTPSConnection, req,\n File \"/usr/lib/python3.9/urllib/request.py\", line 1350, in do_open\n r = h.getresponse()\n File \"/usr/lib/python3.9/http/client.py\", line 1377, in getresponse\n response.begin()\n File \"/usr/lib/python3.9/http/client.py\", line 320, in begin\n version, status, reason = self._read_status()\n File \"/usr/lib/python3.9/http/client.py\", line 289, in _read_status\n raise RemoteDisconnected(\"Remote end closed connection without\"\nhttp.client.RemoteDisconnected: Remote end closed connection without response\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1 } PLAY RECAP *********************************************************************************************************************************************************************************** localhost : ok=8 changed=2 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0 make: *** [deploy_ansible] Error 2

Re: Unable to set serial number on Panorama via Ansible Playbook

SZanpure — Sat, 30 Jul 2022 16:21:59 GMT

Fixed. Seems like posting on Github repo gets quicker response that posting here. Lots of views but no replies. Closing the issue.

https://github.com/PaloAltoNetworks/pan-os-ansible/issues/331