Panorama deployment in Ansible

[OysteinK]

Hi.

Im working with a customer using PANW/NSX that wants to automate Panorama/firewall deployment with ansible.

So far I have found a few stumbling blocks:

1. The ESXi OVA file defines the VM with 4vCPUs and 8GB RAM. This wont work for Panorama mode, only legacy mode
2. The Panorama ESX ova does not have DHCP enabled by default on the MGMT interface, unlike the firewall ova, and the Azure/AWS. images.
3. The various Panos modules for Ansible do not support the "validate_certs: false" option common to most Ansible modules.

For nr 1, I'll fix it by creating a custom .ovf file.

If anyone has any suggestions to solve nr 2 and 3, please reply.

I'll keep posting as I figure out how to go forward.

[OysteinK]

You can disable certificate checking globally for Python by editing /etc/python/cert-verification.cfg and set verify=disable.

This is not very secure, so we should look at enabling this on runtime per playbook.This way we can disable checks, install certs from our favourite CA, and then turn cert-checks on again.