05-21-2019 12:21 PM
I see that "Panos_address_group" can help you to create groups with a list of "static_values"; however, how do you "add/modify" a new IP addresses to an existing group or how do you delete values from the static list?
I did try using "panos_address_object" module; but this works in the same way that "panos_object" when adding a new address to a group.
What is your recommendation to solve this issue?
07-05-2019 03:09 PM
Decided to make answering this a blog article so it helps more people:
05-23-2019 09:17 AM
I've forgot to mention that "Panos_address_group" module deleted all existing host records when using an existing group name.
Is this the way that should work? This become a big issue when you have more than 1K hosts associated to a group and all of the sudden all get removed.
05-28-2019 06:26 AM
That is actually working as designed. As a task automation tool, Ansible is idempotent in nature. This means that any task will be performed exactly as prescribed. That same task can be performed repeatedly and nothing will change as long as none of the parameters have changed. However, if any parameter changes from what is currently defined, the new parameter will be applied in whole.
If a parameter such as an address group list contains 1,000 members and you simply need to add one more, you will need to specify all 1,001 members. Otherwise the 1,000 will be overwritten by the 1.
This concept is much broader than Ansible and is actually a fundamental concept of Infrastructure as Code (IaC) in automation. All of the Ansible modules for PAN-OS support this notion of idempotent operations.
Hopefully this clears up any confusion.
05-28-2019 09:37 AM
I understand the issue; however, reading all the members of a giving address group and adding IPs all again just to add an IP address or more or eliminate it will not be an easy task and could cause many other issues.
Especially when you have to delete an IP address across three or four address groups, and the need to recreate all groups again if/when the IP address is found in all groups.
Would you confirm if Panos_address_group (update or delete options) will not be available at all either via this module or any new Panos module?
05-28-2019 10:32 AM
I think that the way to do this is to use a "facts" module to get the current setting, then do a Jinja2 modification on the current config to do the update. So in this case you would use
panos_object_facts to get the current config, register the result to some variable, then use
panos_address_group with a modified setting.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!