I have an ansible playbook that creates address,service objects -> security policy -> Commit and push to different device groups.
Randomly one of the task fails during executing with the error - Failed Connection: URL Error: code: 403 reason: Forbidden.
This is not specific to any particular module and have seen it happening in panos_address_object, panos_commit_push etc. Any guidance on this ?
You are using the REST-API right ? If so maybe you have generated an API key from a username that is not an admin with full permisions ? Because you mention device groups I think that you are using the Ansible with an API key to control Panorama and the error 403 also confirms that REST-API is used not ssh. It is possible that your user that you use the API_key in the Ansible may have access domain just to some device groups or templates.
Thanks for your response ! 🙂 I am using the panos ansible modules to run these tasks against the panorama.
In our case, the service account user has admin access (it is a superuser) to all the templates, device groups and we are using api_username and api_password to authenticate to the device.
Another interesting fact is it works while running most of tasks in the playbook , but randomly fails on one of them (And sometimes it doesn't fail). The panorama logs indicate that "Authorization Failed. Could not find the role/ado for the user <service_account>. However after checking the Remote auth server logs and policies looks like the policies and roles have been configured correctly on the Auth server.
Do you have any other suggestions ? Thanks a lot in advance for your help !
We have the same issue when calling some API endpoints.. It happens randomly and once we retry the same exact call with the same exact parameters, it works fine.. We were unable to find the root cause so we worked around it by adding a retry mechanism in our code (python) and whenever we hit a 403 we just retry...
It would be nice to know what might be causing this behaviour though
We're running Panorama 9.1 for reference
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!