Hello. Looking at https://galaxy.ansible.com/PaloAltoNetworks/panos I see a version 3.0.0 listed as 3 months old. I find no information about this release in the github repository. https://github.com/PaloAltoNetworks/pan-os-ansible Only thing I can find is some reference to changes upcomming for version 3.0.0 in release notes. Any info on this 3.0.0 release at all anywhere ?
... View more
I have entered a dependency loop situation in Panorama that surprised me a little.
We have installed a new firewall, and configured it to talk with Panorama. It shows up here and we are ready to push configs.
Said firewall have a template stack associated, and it's placed in a device group to receive a base set of policies.
Now the template-stack contains all network definitions, like for instance interface names and zones. Part of the zone configuration we have configured a zone logging profile that sends Zone logs to panorama. We did this since we saw for instance scan sweep warnings in the firewall logs, but not in Panorama logs (forwarded) and figured out this was part of the zone logging, but not rule or threat logs.
Funny thing though is that Log forwarding settings is configured under objects in the device groups section, while it's then possible to use it in a template, like I have done as a log forwarding profile on a security zone.
Now trying to perform a push to the new firewall, it ends up being 2 different commits on the firewall. One commit for all the device group config (policies and objects), and one commit for the template configurations.
So the Policy push (commit) fails since the security zones are not present. A second push attempt would have fixed this if the template commit had been successful, but this fails also since the log forwarding profile used on the security zone isn't in place due to the policy commit failing, and behold we have a dependency loop.
There are workaround to this of course, but I find that a bit tedious, and I was a bit caught out by this dependency loop between template and objects in device groups.
Any tips or tricks to be shared about this conundrum ? I would really like to be able to just assign a firewall to the device group and template it should belong to right from the start, instead of applying a 2 step procedure with an in between template or device group.
... View more
Hello. In the Palo Alto GUI you have the option of global find on an object and get a list of all references where said object is used. I would like to automate removal of object and references when a server get decommissioned, and thought of this function. Using panorama and ansible you would have various device groups to pull and iterate through, and my understanding of this that whenever you create a new device group, you would have to update your ansible playbooks to reflect this. I have tried to find a way to use this global find function by any of the automation options you have, but I haven't really found any. I haven't seen it for CLI (yea there is config out put set with | match, but that is partial info, not the complete reference list), ansible or API. Does anyone have a any idea if this function is possible in any other way than GUI? Another way of making it fully automatic would be to list out device groups in Panorama, preferably by ansible. I haven't found any way of doing that either in the ansible modules from the Pan-OS collection.
... View more