- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
12-21-2022 11:11 AM
Just checking how we can connect to active firewall using Ansible module .
In python , we are using refresh_ha_active() and its working , however we need to test using Ansible.
Could you please provide some input here.
Thanks
02-20-2023 09:55 PM
Why not just use https://ansible-pan.readthedocs.io/en/latest/modules/panos_facts_module.html the facts ansible module and "ansible_net_ha_localstate" and then make the tasks that you want with an Ansible "when" condition to trigger only on the active firewall based on the variable collected by the facts module https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_conditionals.html ?
02-20-2023 10:46 PM
We just run the playbook against both Panorama ans stop it if the Panorama is not active. If used in multiple playbooks you could create an "stop passive Panorama" role and run it at the beginning of your playbook.
- name: "Panorama HA State - GET Facts"
paloaltonetworks.panos.panos_facts:
provider: '{{ device }}'
gather_subset: ['ha']
- name: "Panorama HA State - Show HA State"
debug:
msg: "HA State: {{ ansible_net_ha_localstate }} - {{ ( not ansible_net_ha_localstate.endswith('-active') ) | ternary('Not OK -> Need to Stop running further tasks for this host', 'OK') }}"
- name: "Panorama HA State - Stop running Playbook for Hoost"
meta: end_host
when:
- "not ansible_net_ha_localstate.endswith('-active')"
02-24-2023 09:53 AM
Just connect to the loopback IP of the HA firewall pair which will always be the active firewall.
03-13-2023 11:57 PM
Also if you configure just one floating IP it will be the same deal with connecting to just the active device. It is called active-active but with one floating ip it is actually active-standby:
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!