Authentication issue to Palo Alto Panorama from Ansible

[merlintong]

Just followed some examples from https://paloaltonetworks.github.io/pan-os-ansible/ and https://github.com/PaloAltoNetworks/ansible-playbooks/ to write my first playbook. The target system is a virtual Panorama instance on AWS (software version 10.1.6-h6)
The playbook is just to show system info:

I made sure the host inventory has been defined correctly, and both ansible galaxy role and python pan-os sdk are installed. Executing the playbook however throws me a 403 Invalid Credential error:

A simple curl test with the same target and API key however works fine:

curl -k 'https://hostname/api/?type=op&cmd=<show><system><info></info></system></show>&key=xxx'

Am I missing something obvious?

[JimmyHolland]

Hi @merlintong,

I replicated your playbook and could not replicate the error with a VM-Series on 10.1.6-h6.

Have you definitely got the inventory setup correctly? Even Wireshark/tcpdump on your Ansible machine to check it is talking to the correct target VM-Series? Can you see the failed login in the System Logs in PAN-OS? Is there anything going on with the format of the api_key variable variable string which we maybe can't see due to the redacted screenshot)? Does it work if you use username/password instead of the API key?

---
- name: Test Playbook
  hosts: '{{ target | default("host_vm-series-a") }}'
  gather_facts: false
  connection: local

  collections:
    - paloaltonetworks.panos

  vars:
    device:
      ip_address: "{{ ip_address }}"
      api_key: "{{ api_key | default(omit) }}"

  tasks:
    - name: show system info
      panos_op:
        provider: "{{ device }}"
        cmd: 'show system info'



LAY [host_vm-series-a] *************************************************************************************************************************************************************

TASK [show system info] *************************************************************************************************************************************************************
ok: [host_vm-series-a]

PLAY RECAP **************************************************************************************************************************************************************************
host_vm-series-a           : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0