Always connect to active firewall

[DeepakVerma]

HI @gfreeman @btorresgil 

Just checking how we can connect to active firewall using Ansible module .

In python , we are using refresh_ha_active()  and its working , however we need to test using Ansible.
Could you please provide some input here. 

Thanks

[nikoolayy1]

Why not just use https://ansible-pan.readthedocs.io/en/latest/modules/panos_facts_module.html the facts ansible module and "ansible_net_ha_localstate" and then make the tasks that you want with an Ansible "when" condition to trigger only on the active firewall based on the variable collected by the facts module https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_conditionals.html ?

[Gruber_Marco]

We just run the playbook against both Panorama ans stop it if the Panorama is not active. If used in multiple playbooks you could create an "stop passive Panorama" role and run it at the beginning of your playbook.

- name: "Panorama HA State - GET Facts"
  paloaltonetworks.panos.panos_facts:
  provider: '{{ device }}'
  gather_subset: ['ha']

- name: "Panorama HA State - Show HA State"
  debug:
  msg: "HA State: {{ ansible_net_ha_localstate }} - {{ ( not ansible_net_ha_localstate.endswith('-active') ) | ternary('Not OK -> Need to Stop running further tasks for this host', 'OK') }}"

- name: "Panorama HA State - Stop running Playbook for Hoost"
  meta: end_host
  when:
    - "not ansible_net_ha_localstate.endswith('-active')"

[stangri-la]

Just connect to the loopback IP of the HA firewall pair which will always be the active firewall.

[nikoolayy1]

Also if you configure just one floating IP it will be the same deal with connecting to just the active device. It is called active-active but with one floating ip it is actually active-standby:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/high-availability/ha-concepts/floating-ip...