Configuring GlobalProtect via Ansible

[marcin.radko]

Hi,
I'm working on creating an automated Ansible process through which I can configure GlobalProtect in PAN Firewall.

The automaton process I try to create it based on the official Paloalto Repository containing ansible playbooks:
GitHub - PaloAltoNetworks/ansible-playbooks: Sample playbooks for the Palo Alto Networks Ansible mod...
Unfortunately, I cannot find any playbook in the repository that is directly used to configure GlobalProtect.

Do you have any information which playbooks I can use to configure GlobalProtect or do you have any other repository containing Ansible playbooks used to configure GlobalProtect?

Best regards!

[erin77brown]

While the official ansible-playbooks repository provides a great foundation for general firewall tasks, it currently lacks a dedicated, "out-of-the-box" playbook for a full GlobalProtect configuration. This is because GlobalProtect involves several disparate components (Certificates, Portals, Gateways, and Authentication Profiles) that often require specific environment details. To automate this, you should use the paloaltonetworks.panos collection, which contains the building blocks you need: use panos_cert_gen_ssh to handle the required SSL certificates, panos_import for GlobalProtect client software, and panos_type_cmd or panos_config_element to push the specific XML structures for the Portal and Gateway settings if a high-level module isn't available for your specific PAN-OS version. For a more comprehensive starting point, many users leverage the pan-os-ansible repository's module documentation to chain these tasks together into a custom "GlobalProtect" role.