Terraform for Panorama Configuration management

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Terraform for Panorama Configuration management

L4 Transporter

Hi all

Do you use Terraform for managing Panorama configuration and particularly routine security policies creation and changes? Is there any issues and do you have any feedback? 

I know this can be done well with Ansible, but for number of reasons Ansible cannot be used in our case. 

1 accepted solution

Accepted Solutions

@batd2 Yes, there is a common pattern in the industry, particularly around cloud infrastructure, that revolves around Terraform for build/deploy, and Ansible for configuration. The truth is that you could use either for both tasks, you have to decide as a team/organisation which tools make sense for you. You could go all-in on one tool for everything, or separate tools for separate jobs. Your organisation may invest in the paid version of one of those tools which means you have a vendor-supported product rather then OSS, which may affect the decision. There's lots of factors. As they both have OSS versions, you can try out both and pick the one(s) you like for the specific task(s) you wish to undertake 🙂

Help the community: "Like" helpful comments, and click "Accept as Solution" if you found your answer 🙂

View solution in original post

4 REPLIES 4

L5 Sessionator

Hi @batd2, there are a number of organisations using Terraform to configure their PAN-OS appliances. If you are familiar with Terraform already, the reference documentation is very useful and can be found here in Terraform Registry, otherwise "get started" with Terraform concepts in general first, then move onto PAN-OS configuration. Configuration work for objects and security policies is a common use case. I will let others contribute with their experiences here as they wish...

Help the community: "Like" helpful comments, and click "Accept as Solution" if you found your answer 🙂

L4 Transporter

@JimmyHolland Thank you for the information. The reason I am asking is because it is kind of suggested that Terraform is used for the initial build and initial configuration, rather than configuration management. 

@batd2 Yes, there is a common pattern in the industry, particularly around cloud infrastructure, that revolves around Terraform for build/deploy, and Ansible for configuration. The truth is that you could use either for both tasks, you have to decide as a team/organisation which tools make sense for you. You could go all-in on one tool for everything, or separate tools for separate jobs. Your organisation may invest in the paid version of one of those tools which means you have a vendor-supported product rather then OSS, which may affect the decision. There's lots of factors. As they both have OSS versions, you can try out both and pick the one(s) you like for the specific task(s) you wish to undertake 🙂

Help the community: "Like" helpful comments, and click "Accept as Solution" if you found your answer 🙂

L2 Linker

Hi i recently created a small tool to import security policies from panorama xml to terraform code you might want to look it up https://live.paloaltonetworks.com/t5/automation-api-discussions/import-existing-security-policies-fr...

Gabriel Montiel
  • 1 accepted solution
  • 2733 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!