topic Always connect to active firewall in Automation/API Discussions

Always connect to active firewall

DeepakVerma — Wed, 21 Dec 2022 19:11:49 GMT

Just checking how we can connect to active firewall using Ansible module .

In python , we are using refresh_ha_active() and its working , however we need to test using Ansible.
Could you please provide some input here.

Thanks

Re: Always connect to active firewall

nikoolayy1 — Tue, 21 Feb 2023 05:55:18 GMT

Why not just use https://ansible-pan.readthedocs.io/en/latest/modules/panos_facts_module.html the facts ansible module and "ansible_net_ha_localstate" and then make the tasks that you want with an Ansible "when" condition to trigger only on the active firewall based on the variable collected by the facts module https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_conditionals.html ?

Re: Always connect to active firewall

Gruber_Marco — Tue, 21 Feb 2023 06:46:27 GMT

We just run the playbook against both Panorama ans stop it if the Panorama is not active. If used in multiple playbooks you could create an "stop passive Panorama" role and run it at the beginning of your playbook.

- name: "Panorama HA State - GET Facts"
  paloaltonetworks.panos.panos_facts:
  provider: '{{ device }}'
  gather_subset: ['ha']

- name: "Panorama HA State - Show HA State"
  debug:
  msg: "HA State: {{ ansible_net_ha_localstate }} - {{ ( not ansible_net_ha_localstate.endswith('-active') ) | ternary('Not OK -> Need to Stop running further tasks for this host', 'OK') }}"

- name: "Panorama HA State - Stop running Playbook for Hoost"
  meta: end_host
  when:
    - "not ansible_net_ha_localstate.endswith('-active')"

Re: Always connect to active firewall

stangri-la — Fri, 24 Feb 2023 17:53:35 GMT

Just connect to the loopback IP of the HA firewall pair which will always be the active firewall.

Re: Always connect to active firewall

nikoolayy1 — Tue, 14 Mar 2023 06:57:52 GMT

Also if you configure just one floating IP it will be the same deal with connecting to just the active device. It is called active-active but with one floating ip it is actually active-standby:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/high-availability/ha-concepts/floating-ip-address-and-virtual-mac-address