Ansible playbook to shutdown interface

[sall13]

Hi all!

I need help creating an Ansible playbook that shutdown one of the firewall interface.

I'm trying to do something like this:

[...]

collections:
  - paloaltonetworks.panos

tasks:

- name: "Interface down"
  panos_op:
    provider: '{{ provider }}'
    cmd: 'set network interface ethernet ethernet1/1 link-state down'

[...]

But I get this result:

TASK [Interface down] **********************************************************************************
fatal: [localhost]: FAILED! => {"changed": false, "msg": "Failed to run command : set network interface ethernet ethernet1/1 link-state \"down\" : URLError: code: 400 reason: Illegal parameter [request]"}

I'm not sure about what is wrong. Maybe I'm not in configuration mode, but I don't know how to put it before the command.

How would be the best way to do it?

Thanks!

[JimmyHolland · Accepted solution]

Hi @sall13,

The panos_op module is only for operational mode (OP) commands, it will not execute configuration mode commands.

A general purpose module for configuration is panos_type_cmd, with which you could do something like this:

  tasks:
    - name: test
      panos_type_cmd:
        provider: '{{ provider }}'
        xpath: "/config/devices/entry[@name='localhost.localdomain']/network/interface/ethernet/entry[@name='ethernet1/1']"
        element: "<link-state>down</link-state>"

Also follow this with a commit task to make the change (link down) live.

Hope that helps!

[sall13]

Thank you @JimmyHolland, It looks great!

Just one more question about this part:

[@name='localhost.localdomain']

is it variable? I mean, it depends on something configured in the firewall?

Thanks again.

[JimmyHolland]

Hi @sall13, not really, this is the same on every PAN-OS device so it can stay the same each time on every device you target.

Hope that helps, click "Accept as Solution" on the post above if so...

[sall13]

Understood. Thanks!