How to add new objects to a Panos_address_group

[RobertNunez]

Hi Folks,

I see that "Panos_address_group" can help you to create groups with a list of "static_values"; however, how do you "add/modify" a new IP addresses to an existing group or how do you delete values from the static list?

I did try using "panos_address_object" module; but this works in the same way that "panos_object" when adding a new address to a group.

What is your recommendation to solve this issue?

Thanks,

Roberto

[RobertNunez]

I've forgot to mention that "Panos_address_group" module deleted all existing host records when using an existing group name.

Is this the way that should work? This become a big issue when you have more than 1K hosts associated to a group and all of the sudden all get removed.

Thanks,

Robert

[rhagen]

Hi Robert,

That is actually working as designed.  As a task automation tool, Ansible is idempotent in nature.  This means that any task will be performed exactly as prescribed.  That same task can be performed repeatedly and nothing will change as long as none of the parameters have changed.  However, if any parameter changes from what is currently defined, the new parameter will be applied in whole.

If a parameter such as an address group list contains 1,000 members and you simply need to add one more, you will need to specify all 1,001 members.  Otherwise the 1,000 will be overwritten by the 1.

This concept is much broader than Ansible and is actually a fundamental concept of Infrastructure as Code (IaC) in automation.  All of the Ansible modules for PAN-OS support this notion of idempotent operations.

Hopefully this clears up any confusion.

Regards,

-Bob-

[RobertNunez]

Thanks Bob.

I understand the issue; however, reading all the members of a giving address group and adding IPs all again just to add an IP address or more or eliminate it will not be an easy task and could cause many other issues.

Especially when you have to delete an IP address across three or four address groups, and the need to recreate all groups again if/when the IP address is found in all groups.

Would you confirm if Panos_address_group (update or delete options) will not be available at all either via this module or any new Panos module?

Thanks,

Roberto

[gfreeman]

I think that the way to do this is to use a "facts" module to get the current setting, then do a Jinja2 modification on the current config to do the update.  So in this case you would use panos_object_facts to get the current config, register the result to some variable, then use panos_address_group with a modified setting.

[RobertNunez]

I will rather prefer a module that can help executing the following:

"cmd": "set device-group MYCLOUD address-group MYCLOUD-GRP-1 static SMTP-10.10.20.30",

or

"cmd": "delete device-group MYCLOUD address-group MYCLOUD-GRP-1 static SMTP-<IP Address>"

This will look easy to understand and cleaner than a playbook that get it all (our production config have twenty+ groups with an average of 2K IP addresses each), remove it and re-add it.

Do you have a way or module to execute this?

Thanks,

Roberto

[gfreeman · Accepted solution]

Decided to make answering this a blog article so it helps more people:

https://live.paloaltonetworks.com/t5/Automation-API-Blog/Ansible-Using-facts-modules-to-do-updates/b...

[KNeedham]

Something like this would do the trick, based on Gfreemans post above

  - name: Get target address group and its config
    panos_object_facts:
      provider: '{{ panos_provider }}'
      object_type: 'address-group'
      name: 'Test-Group'
    register: TestGroupObject

  - name: Get new Address Object and its config
    panos_object_facts:
      provider: '{{ panos_provider }}'
      object_type: 'address'
      name: 'Test-Address'
    register: TestAddressObject

  - name: Add new address object to Target group
    panos_address_group:
      provider: '{{ panos_provider }}'
      name: '{{ TestGroupObject.objects[0].name }}'
      description: '{{ TestGroupObject.objects[0].description | default(omit, true) }}'
      static_value: '{{ TestGroupObject.objects[0].static_value | union([TestAddressObject.objects[0].name]) }}'
      tag: '{{ TestGroupObject.objects[0].tag | default(omit, true) }}'
      commit: false

[floresty36]

The problem is with the addition to the firewall group. The task that accomplishes this seems to overwrite the existing objects within the group instead of appending to it.