How to add new objects to a Panos_address_group

[RobertNunez]

Hi Folks,

I see that "Panos_address_group" can help you to create groups with a list of "static_values"; however, how do you "add/modify" a new IP addresses to an existing group or how do you delete values from the static list?

I did try using "panos_address_object" module; but this works in the same way that "panos_object" when adding a new address to a group.

What is your recommendation to solve this issue?

Thanks,

Roberto

[RobertNunez]

I will rather prefer a module that can help executing the following:

"cmd": "set device-group MYCLOUD address-group MYCLOUD-GRP-1 static SMTP-10.10.20.30",

or

"cmd": "delete device-group MYCLOUD address-group MYCLOUD-GRP-1 static SMTP-<IP Address>"

This will look easy to understand and cleaner than a playbook that get it all (our production config have twenty+ groups with an average of 2K IP addresses each), remove it and re-add it.

Do you have a way or module to execute this?

Thanks,

Roberto

[gfreeman · Accepted solution]

Decided to make answering this a blog article so it helps more people:

https://live.paloaltonetworks.com/t5/Automation-API-Blog/Ansible-Using-facts-modules-to-do-updates/b...

[KNeedham]

Something like this would do the trick, based on Gfreemans post above

  - name: Get target address group and its config
    panos_object_facts:
      provider: '{{ panos_provider }}'
      object_type: 'address-group'
      name: 'Test-Group'
    register: TestGroupObject

  - name: Get new Address Object and its config
    panos_object_facts:
      provider: '{{ panos_provider }}'
      object_type: 'address'
      name: 'Test-Address'
    register: TestAddressObject

  - name: Add new address object to Target group
    panos_address_group:
      provider: '{{ panos_provider }}'
      name: '{{ TestGroupObject.objects[0].name }}'
      description: '{{ TestGroupObject.objects[0].description | default(omit, true) }}'
      static_value: '{{ TestGroupObject.objects[0].static_value | union([TestAddressObject.objects[0].name]) }}'
      tag: '{{ TestGroupObject.objects[0].tag | default(omit, true) }}'
      commit: false

[floresty36]

The problem is with the addition to the firewall group. The task that accomplishes this seems to overwrite the existing objects within the group instead of appending to it.