Ansible change interzone-default logging

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Ansible change interzone-default logging

L1 Bithead

I am trying to figure out a way that I can use Ansible playbook to override the interzone-default rule to add 'logging at session end'.

 

Have tried using panos_type_cmd but so far not having any luck.  Just gettin the following error:

"module_stdout": "",
"msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
"rc": 1

 

Here is what the task looks like in playbook:

 

tasks:
   - name: Set logging on interzone-default
      paloaltonetworks.panos.panos_type_cmd:
          provider: '{{ device }}'
          xpath: "/config/predefined/default-security-rules/rules/entry[@name='interzone-default']/"
          cmd: edit
          element:
            <log-end>yes</log-end>
 
Have also tried using 'set' command with no luck.
4 REPLIES 4

L5 Sessionator

Those predefined inter and intra zone rules are slightly different, here's a task definition that works on my lab VM-Series, which I found using the GUI debug:

    - name: Set logging on interzone-default
      paloaltonetworks.panos.panos_type_cmd:
        provider: '{{ device }}'
        xpath: |
          /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']
          /rulebase/default-security-rules/rules/entry[@name='interzone-default']
        cmd: edit
        element:
          <entry name="interzone-default"><action>deny</action><log-end>yes</log-end></entry>

 

Hope that helps!

Help the community: "Like" helpful comments, and click "Accept as Solution" if you found your answer 🙂

L1 Bithead

Thanks Jimmy! 

 

I tried the task you provided but am getting an error:

 

"changed": true,
"msg": "non-zero return code",
"rc": 127,
"stderr": "/bin/sh: show: command not found\n",
"stderr_lines": [
"/bin/sh: show: command not found"
],
"stdout": "",
"stdout_lines": []

L5 Sessionator

Researching that error message, I think something else is not quite right with your Ansible environment. Are the paths set correctly? Have you got the correct Python interpreter? And got the dependencies installed in the right place?

Help the community: "Like" helpful comments, and click "Accept as Solution" if you found your answer 🙂

Nevermind, it was just me being dumb.  I had two different playbooks I was testing and was running the wrong one.  It works, Thanks!

  • 1601 Views
  • 4 replies
  • 0 Likes
  • 71 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!