Authentication issue to Palo Alto Panorama from Ansible

merlintong — Fri, 07 Oct 2022 05:57:51 GMT

Just followed some examples from https://paloaltonetworks.github.io/pan-os-ansible/ and https://github.com/PaloAltoNetworks/ansible-playbooks/ to write my first playbook. The target system is a virtual Panorama instance on AWS (software version 10.1.6-h6)
The playbook is just to show system info:

I made sure the host inventory has been defined correctly, and both ansible galaxy role and python pan-os sdk are installed. Executing the playbook however throws me a 403 Invalid Credential error:

A simple curl test with the same target and API key however works fine:

curl -k 'https://hostname/api/?type=op&cmd=<show><system><info></info></system></show>&key=xxx'

Am I missing something obvious?

Re: Authentication issue to Palo Alto Panorama from Ansible

JimmyHolland — Fri, 07 Oct 2022 11:24:28 GMT

Hi @merlintong,

I replicated your playbook and could not replicate the error with a VM-Series on 10.1.6-h6.

Have you definitely got the inventory setup correctly? Even Wireshark/tcpdump on your Ansible machine to check it is talking to the correct target VM-Series? Can you see the failed login in the System Logs in PAN-OS? Is there anything going on with the format of the api_key variable variable string which we maybe can't see due to the redacted screenshot)? Does it work if you use username/password instead of the API key?

--- - name: Test Playbook hosts: '{{ target | default("host_vm-series-a") }}' gather_facts: false connection: local collections: - paloaltonetworks.panos vars: device: ip_address: "{{ ip_address }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: show system info panos_op: provider: "{{ device }}" cmd: 'show system info' LAY [host_vm-series-a] ************************************************************************************************************************************************************* TASK [show system info] ************************************************************************************************************************************************************* ok: [host_vm-series-a] PLAY RECAP ************************************************************************************************************************************************************************** host_vm-series-a : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

topic Authentication issue to Palo Alto Panorama from Ansible in Automation/API Discussions

Authentication issue to Palo Alto Panorama from Ansible

Re: Authentication issue to Palo Alto Panorama from Ansible