Configuration of PA Firewall from Asnible - need assitance

L0 Member

Configuration of PA Firewall from Asnible - need assitance

 

Hello Friends,

 

I am new in terms of automation things I belong to Network and Secuirty specialist, however I am learning and implementing Ansible from documentation - but to be very honest I still unable to Push Playbook config to directly my Palato Firewall -

 

I have installed asnible - below is version,

$ ansible --version
ansible 2.4.2.0

 

I created an playbook configuration and when I execute using ansible-playbook palo_2.yml below is output, I am pretty sure I am missing some critical part which prevents conecting my playbook with my Firewall - I also red http://panwansible.readthedocs.io/en/latest/readme.html but did not underatand the concept.

 

I would appreciate if anyone can share configuration of from scratch Step to Step - how to connect Anible to Palo Alto Firewall - what and how to install patches - 

 

$ ansible-playbook palo_2.yml


PLAY [palo] ************************************************************************************************************

TASK [PaloAltoNetworks.paloaltonetworks : pip] *************************************************************************
changed: [10.1.1.1]

TASK [PaloAltoNetworks.paloaltonetworks : pip] *************************************************************************
changed: [10.1.1.1]

TASK [PaloAltoNetworks.paloaltonetworks : pip] *************************************************************************
changed: [10.1.1.1]

TASK [include variables (free-form)] ***********************************************************************************
ok: [10.1.1.1]


TASK [create an address group in devicegroup using API key] ************************************************************
fatal: [10.1.1.1]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: 'LUFRPT1QVWxBZ2tZWkVCMlpmSW1IVnFhY1I4eVdsdjQ9WXpwZC9GY3NlYUIwN2ZaNm9Ca2J0QT09' is undefined\n\nThe error appears to have been in '/home/kaijaz/Development/ansible-personal-servers/palo_2.yml': line 15, column 7, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n    - name: create an address group in devicegroup using API key\n      ^ here\n\nexception type: <class 'ansible.errors.AnsibleUndefinedVariable'>\nexception: 'LUFRPT1QVWxBZ2tZWkVCMlpmSW1IVnFhY1I4eVdsdjQ9WXpwZC9GY3NlYUIwN2ZaNm9Ca2J0QT09' is undefined"}
        to retry, use: --limit @/home/kaijaz/Development/ansible-personal-servers/palo_2.retry

PLAY RECAP *************************************************************************************************************
10.1.1.1                : ok=4    changed=3    unreachable=0    failed=1

 

 

 

--------------------

Playbook Configuration

 

---

- hosts: palo
  gather_facts: no
  connection: local

  roles:
    - role: PaloAltoNetworks.paloaltonetworks

  tasks:
    - name: include variables (free-form)
      include_vars: vars1.yml
      no_log: 'yes'

    - name: create an address group in devicegroup using API key
      panos_object:
        ip_address: '{{ 10.20.20.20 }}'
        api_key: '{{ LUFRPT1QVWxBZ2tZWkVCMlpmSW1IVnFhY1I4eVdsdjQ9WXpwZC9GY3NlYUIwN2ZaNm9Ca2J0QT09 }}'
        operation: 'add'
        addressgroup: 'ANSIBLE'
        static_value: ['prod-db1', 'prod-db2', 'prod-db3']
        description: 'ASIBLE TESTING'
        tag_name: 'ANS'
        devicegroup: 'ANSIBLE Firewalls'

~                                                                                                                       ~                                                                                                                       ~                                                                                                                       ~                                                                                                                       "palo_2.yml" 25L, 665C

 

 

 

Thank You

KM

L1 Bithead

Re: Configuration of PA Firewall from Asnible - need assitance

Can I ask why you are using the key? 

IMHO managing keys can become clumsy and time consuming.  The module supports a username and password which can be easily managed and secured using the password vault.

 

This looks like a syntax issue.

ip_address: '{{ 10.20.20.20 }}'
api_key: '{{ LUFRPT1QVWxBZ2tZWkVCMlpmSW1IVnFhY1I4eVdsdjQ9WXpwZC9GY3NlYUIwN2ZaNm9Ca2J0QT09 }}'

 

Should be written like this:

ip_adress: 10.20.20.20

api_key: LUFRPT1QVWxBZ2tZWkVCMlpmSW1IVnFhY1I4eVdsdjQ9WXpwZC9GY3NlYUIwN2ZaNm9Ca2J0QT09

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!