topic Re: Ansible change interzone-default logging in Automation/API Discussions

Ansible change interzone-default logging

Jaromme — Fri, 17 Mar 2023 19:34:35 GMT

I am trying to figure out a way that I can use Ansible playbook to override the interzone-default rule to add 'logging at session end'.

Have tried using panos_type_cmd but so far not having any luck. Just gettin the following error:

"module_stdout": "",
"msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
"rc": 1

Here is what the task looks like in playbook:

tasks:

- name: Set logging on interzone-default

paloaltonetworks.panos.panos_type_cmd:

provider: '{{ device }}'

xpath: "/config/predefined/default-security-rules/rules/entry[@name='interzone-default']/"

cmd: edit

element:

<log-end>yes</log-end>

Have also tried using 'set' command with no luck.

Re: Ansible change interzone-default logging

JimmyHolland — Mon, 20 Mar 2023 10:40:36 GMT

Those predefined inter and intra zone rules are slightly different, here's a task definition that works on my lab VM-Series, which I found using the GUI debug:

- name: Set logging on interzone-default paloaltonetworks.panos.panos_type_cmd: provider: '{{ device }}' xpath: | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1'] /rulebase/default-security-rules/rules/entry[@name='interzone-default'] cmd: edit element: <entry name="interzone-default"><action>deny</action><log-end>yes</log-end></entry>

Hope that helps!

Re: Ansible change interzone-default logging

Jaromme — Mon, 20 Mar 2023 15:29:49 GMT

Thanks Jimmy!

I tried the task you provided but am getting an error:

"changed": true,
"msg": "non-zero return code",
"rc": 127,
"stderr": "/bin/sh: show: command not found\n",
"stderr_lines": [
"/bin/sh: show: command not found"
],
"stdout": "",
"stdout_lines": []

Re: Ansible change interzone-default logging

JimmyHolland — Mon, 20 Mar 2023 15:35:38 GMT

Researching that error message, I think something else is not quite right with your Ansible environment. Are the paths set correctly? Have you got the correct Python interpreter? And got the dependencies installed in the right place?

Re: Ansible change interzone-default logging

Jaromme — Mon, 20 Mar 2023 16:03:05 GMT

Nevermind, it was just me being dumb. I had two different playbooks I was testing and was running the wrong one. It works, Thanks!