Panorama deployment in Ansible

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Panorama deployment in Ansible

L3 Networker

Hi.

Im working with a customer using PANW/NSX that wants to automate Panorama/firewall deployment with ansible.

 

So far I have found a few stumbling blocks:

  1. The ESXi OVA file defines the VM with 4vCPUs and 8GB RAM. This wont work for Panorama mode, only legacy mode
  2. The Panorama ESX ova does not have DHCP enabled by default on the MGMT interface, unlike the firewall ova, and the Azure/AWS. images.
  3. The various Panos modules for Ansible do not support the "validate_certs: false" option common to most Ansible modules.

For nr 1, I'll fix it by creating a custom .ovf file.

If anyone has any suggestions to solve nr 2 and 3, please reply.

I'll keep posting as I figure out how to go forward.

 

1 REPLY 1

L3 Networker

You can disable certificate checking globally for Python by editing /etc/python/cert-verification.cfg and set verify=disable.

 

This is not very secure, so we should look at enabling this on runtime per playbook.This way we can disable checks, install certs from our favourite CA, and then turn cert-checks on again.

 

 

  • 3019 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!