Trying to turn of Preemption via Ansible Playbook failure

[ryan.slater]

I am working on an ansible playbook for upgrading our Palo Alto Firewall, and one of the requirements that we have is that I have to disable Preemption.  I have not been able to find any examples of this so I have been working on creating my own task to add to the excellent examples that have been provided (https://github.com/PaloAltoNetworks/ansible-playbooks).  Here is my task so far:

  tasks:

    - name: Disable preemption on primary device

      paloaltonetworks.panos.panos_type_cmd:

        provider: '{{ primary }}'

        cmd: 'set'

        xpath: |

          /config/devices/entry[@name='localhost.localdomain']

          /deviceconfig/high-availability/group/election-option

        element: |

          <election-option>

            <preemptive>no

            </preemptive>

          </election-option>

When I run this task I get the following error:

FAILED! => {"changed": false, "msg": "set failed, may need to override template object first"}

And when I change to cmd to override I get the following error: 

FAILED! => {"changed": false, "msg": "Object cannot be overridden\n"}

Additionally the management plan becomes unresponsive for several minutes.

I'm sure I am doing something wrong and it is something simple that I am missing on this, but I'm so deep into the weeds on it that I can't see it anymore.

Thank you for the help.

[JimmyHolland]

Hi @ryan.slater, I think it's a config format change you need. Try removing the election-option part of the xpath, leaving just 

/config/devices/entry[@name='localhost.localdomain']/deviceconfig/high-availability/group

[ryan.slater]

With this change doing a SET I get the following:

FAILED! => {"changed": false, "msg": " group -> election-option -> preemptive is invalid"}

And with OVERRIDE I get the following:

FAILED! => {"changed": false, "msg": "Object cannot be overridden\n"}

If I add a "/" to the end of the XPATH (/config/devices/entry[@name='localhost.localdomain']/deviceconfig/high-availability/group/) I still have the same errors as I previously had in my past post.

[JimmyHolland · Accepted solution]

Hi @ryan.slater, here's the full playbook and output in case it helps...

[ryan.slater]

Not sure what I must have typo'ed in my first attempt, but after copying your entry, it is now working on my side as expected.  Thank you very much for your help.

RS

[brandonmajor]

Hey @ryan.slater ; could you explain more what you possibly fixed? Was it a line break issue or something?