Ansible-pan with Ansible Tower and Git

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Ansible-pan with Ansible Tower and Git

L0 Member

We are using Ansible Tower 3.5 and Ansible 2.8 to schedule and run network and security automation playbooks. We are looking at using the Ansible Galaxy modules for automating PANOS configurations. I was able to write the playbooks to do what we need, but whenever I run the playbook with the ansible-pan modules, the main task runs PIP to install pan-python, pandevice, xmltodict everytime we execute the PAN-OS automation playbook. We also use GIT as a repository and version control of the playbooks, so Tower pulls the playbooks directly from the GIT server. When I install the Ansible Galaxy modules, the modules install in the same path as the playbook, and then the install the latest pan-python, pandevice, xmltodict. Since we are using GIT to store the playbooks, these modules will update everytime after Tower pulls the GIT repo. Tower releases the local copy of the repo when the task has completed.


Is there a way I can install the Ansible Galaxy roles to a different path or a global path, and is there any way I can avoid running PIP install every time I run the ansible-pan module?



Brian Burns


L3 Networker

Hi Brian,


The pip installs of pan-python, pandevice, and xmltodict are actually called from the main tasks file in the role itself. I don’t believe there’s anything you can do in your Tower configuration to avoid it. 

We’re likely going to remove those tasks going forward since most of the modules check to ensure those libraries are installed and will error out if they’re not found. 




Is this still the behavior? It will install the mentioned modules evrytime i run a playbook?


(I dont have access to a ansible installation to test with atm)



The Ansible role (here) has entered maintenance mode as Ansible is pushing non-core modules into the new collections framework.  As such, the Palo Alto Networks Ansible collection does not have this same behavior.

  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!