Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Always connect to active firewall

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Always connect to active firewall

L2 Linker

HI @gfreeman @btorresgil 

 

Just checking how we can connect to active firewall using Ansible module .

In python , we are using refresh_ha_active()  and its working , however we need to test using Ansible.
Could you please provide some input here. 

 

Thanks

4 REPLIES 4

L6 Presenter

Why not just use https://ansible-pan.readthedocs.io/en/latest/modules/panos_facts_module.html the facts ansible module and "ansible_net_ha_localstate" and then make the tasks that you want with an Ansible "when" condition to trigger only on the active firewall based on the variable collected by the facts module https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_conditionals.html ?

L0 Member

We just run the playbook against both Panorama ans stop it if the Panorama is not active. If used in multiple playbooks you could create an "stop passive Panorama" role and run it at the beginning of your playbook.

 

- name: "Panorama HA State - GET Facts"
paloaltonetworks.panos.panos_facts:
provider: '{{ device }}'
gather_subset: ['ha']

- name: "Panorama HA State - Show HA State"
debug:
msg: "HA State: {{ ansible_net_ha_localstate }} - {{ ( not ansible_net_ha_localstate.endswith('-active') ) | ternary('Not OK -> Need to Stop running further tasks for this host', 'OK') }}"

- name: "Panorama HA State - Stop running Playbook for Hoost"
meta: end_host
when:
- "not ansible_net_ha_localstate.endswith('-active')"

 

 

 

 

L1 Bithead

Just connect to the loopback IP of the HA firewall pair which will always be the active firewall.

Also if you configure just one floating IP it will be the same deal with connecting to just the active device. It is called active-active but with one floating ip it is actually active-standby:

 

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/high-availability/ha-concepts/floating-ip...

  • 2027 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!