Ansible change interzone-default logging

[Jaromme]

I am trying to figure out a way that I can use Ansible playbook to override the interzone-default rule to add 'logging at session end'.

Have tried using panos_type_cmd but so far not having any luck.  Just gettin the following error:

"module_stdout": "",
"msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
"rc": 1

Here is what the task looks like in playbook:

tasks:

   - name: Set logging on interzone-default

      paloaltonetworks.panos.panos_type_cmd:

          provider: '{{ device }}'

          xpath: "/config/predefined/default-security-rules/rules/entry[@name='interzone-default']/"

          cmd: edit

          element:

            <log-end>yes</log-end>

Have also tried using 'set' command with no luck.

[JimmyHolland]

Those predefined inter and intra zone rules are slightly different, here's a task definition that works on my lab VM-Series, which I found using the GUI debug:

    - name: Set logging on interzone-default
      paloaltonetworks.panos.panos_type_cmd:
        provider: '{{ device }}'
        xpath: |
          /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']
          /rulebase/default-security-rules/rules/entry[@name='interzone-default']
        cmd: edit
        element:
          <entry name="interzone-default"><action>deny</action><log-end>yes</log-end></entry>

Hope that helps!

[Jaromme]

Thanks Jimmy! 

I tried the task you provided but am getting an error:

"changed": true,
"msg": "non-zero return code",
"rc": 127,
"stderr": "/bin/sh: show: command not found\n",
"stderr_lines": [
"/bin/sh: show: command not found"
],
"stdout": "",
"stdout_lines": []

[JimmyHolland]

Researching that error message, I think something else is not quite right with your Ansible environment. Are the paths set correctly? Have you got the correct Python interpreter? And got the dependencies installed in the right place?

[Jaromme]

Nevermind, it was just me being dumb.  I had two different playbooks I was testing and was running the wrong one.  It works, Thanks!