Use Ansible to backup config

[IarnoPagliani]

Ciao,

is there a simple way to backup config using Ansible ?

Thanks

[gfreeman]

Not yet, this is still a pending feature request for the Ansible role:

https://github.com/PaloAltoNetworks/ansible-pan/issues/90

I'd recommend commenting or thumbs-up'ing the original issue opener, so that Palo Alto Networks has a way to see how many users want a particular issue / feature request.

[sylvaing]

Hi @IarnoPagliani 

A bit late on the topic but I created a playbook sometime ago to perform backups of PAN FWs

https://github.com/wpacket/pan-ansible/blob/master/pan_config_pull.yml

Had to reuse it today and I can confirm it still works ( Python3 + Ansible 2.9.7 )

I also put a playbook to push local configs to devices from the same inventory but I guess you already have that 

https://github.com/wpacket/pan-ansible/blob/master/pan_config_push.yml

Regards

[hbalzac]

Is there any reason to use this insted of the built in backup function with scp?

[jmolefe]

Hi @sylvaing 

I'm also using Ansible 2.9.7

However the play fails at the "Extract API Key from XML Output" task with error "fatal: [x.x.x.x]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: 'dict object' has no attribute 'content'\n\n"

No changes done on the playbook besides referencing my host group

Thank you

John.

[jmolefe]

Upgrading to python 3 doesn't help as well

[sylvaing]

Hi @hbalzac 

If you only manage PAN firewalls , no.

However if you are dealing with a multivendor setup , using ansible as a central point of automation ( backup , config , ops ) can simplify your life.

[sylvaing]

Hi @jmolefe 

Interresting , this might be related to the format of the API KEY response from the firewall. I ve been dealing with 8.1 and 9.0 atm when creating this playbook mostly. What version are you running on your firewall ?

Sylvain

[jmolefe]

Hi @sylvaing 

Firewalls run 8.1 and Panorama is on 9.0 and both fail. Please see format of API response below

<response status="success">

<result>

<key>

KEY_HERE

</key>

</result>

</response>

Br

John.

[sylvaing]

Hi @jmolefe 

Can you -vvv you ansible-playbook command and show me the output of the Generate API Key task ?

I bet it is not formated as mine and that must be the reason why the API key cannot be extracted.  Or maybe one ansible module is missing.

Let s figure that out,