S2S VPN creation with Ansible

[mike_yand]

Hi All,

Any playbooks or example for VPN automation with ansible?

Can't find here anything related - http://panwansible.readthedocs.io/en/latest/index.html

If no, any plans on building a module for that?

Thanks

[btorresgil]

Hi Mike,

Are you interested in site to site VPN or GlobalProtect? Can you describe your use case so we know exactly what you want to accomplish?

Thanks!
-Brian

[mike_yand]

Hi,

I'm speaking about s2s VPN with creating all if its componets.

[vvenkatara · Accepted solution]

Hi Mike,

We currently do not have any ansible playbooks that allow you to setup VPN's. We are working on a solution that might address this use case. Please stay tuned and we will notify once that is ready.
Thanks,

- Vinay 

[mike_yand]

any luck with that one?

Thanks

[gvodenitcharov]

We are looking for the same thing, basically a playbook that allows us to create the PAN side of the IPSEC tunnel.

The other end is AWS VGW, there are Ansible plugins for it but nothing for PAN. 

[rkoenig]

Has there been any further update for using Ansible to create S2S/B2B VPN Tunnel?
Can it be done through the API? 

[vvenkatara]

Yes this can be done through the API. Additionally, we have made progress in implementing an ansible module for the creation of S2S VPN with AWS. This is currently under test and will be pushed out as soon as we complete that. 

Are you interested in these S2S VPN to AWS VGW or to Azure or to Palo Alto Networks GPCS? 

Thanks,

- Vinay

[rkoenig]

Hi Vinay,
Thanks for responding, right now I am interested in the S2S VPN, we are in the process of moving existing connections from an ASA to a PA-5220.  I am hoping that we can use Ansible for VPN in the same manner that it can be used for Sec Policies and Change Management.

Using Ansible For Firewall SEC Policy Change Management Process

[gvodenitcharov]

We are interested in the PAN side of the IPSec tunnel. Ansible has modules for the AWS VGW or we can use the boto3. We want to be able to use Ansible modules instead of panxapi, please keep us posted

[rkoenig]

"Yes this can be done through the API"

Are there any examples of how this could be done available?