About hstsvn

Thanks for your hint. I've just worked out how to  do a call to "just give me the names of the rules, not their configurations". This would definitely reduce the processing time. ... View more

gfreeman, that was my thoughts too. However I was expecting something more easily. As the mentioned workflow sounds simple but actually it is not easy as the script needs to read the whole device group pre-rule section in order to be able to extract the above/below rule names. It is more difficult when the the section has large number of rules say 4000 to 5000 rules. ... View more

Thanks for your reply, gfreeman. I was posting in hurry so I was not clear. My question was I know API to create the security policy. It is always added to the bottom of the pre-rule section. And I know API to move it above or below a certain rule using the name of that rule or to the top. They are already mentioned here https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/pan-os-xml-api-request-types/configuration-api/move-configuration.html.   However, I don't know any API that can move the security policy up or down 1 level from its current position. When I tried "move" API without the "dst" parameter:  https: / / <firewall> /api /?type=config&action=move&xpath=/config /devices/entry /vsys/entry [@name= 'vsys1' ]/rulebase/security/rules/entry[@name= 'rule1' ]&where=after, I got the following error: <response status="error" code="7"><msg><line>no target specified in move</line></msg></response>   Is it possible to move the rule up/down 1 level without having to provide the "dst" or "target" rule? ... View more

Thanks, will do. Just another question: Do you or your team provide custom ansible solutions? Say we want to do firewall cleanup task via automation development. Can it be possible? If yes, how to order this service? @ibojer wrote: Palo Alto Networks Modules for Ansible are distributed with every Ansible release and they can be used to configure and provision the Next Generation Firewall. The underlying protocol is Palo Alto Networks open XML API. This protocol is exposed and used for both virtual and physical appliance, and Palo Alto Networks Ansible modules can be used to configure either. These modules depend on already available Python SDK tools. The combination of Ansible and Palo Alto Networks modules address the most common applications of automation and orchestration of the Palo Alto Networks VM-Series NGFW for both public and private cloud deployments.   ... View more

Hi Ivan,   I have downloaded ansible-pan from github without any issue. However I have been trying to install the  PaloAltoNetworks.paloaltonetworks role without any success. It produces "IndexError: list index out of range" error.   [ansible-user@localhost roles]$ ansible-galaxy install PaloAltoNetworks.paloaltonetworks -vvv ansible-galaxy 2.4.1.0 config file = /etc/ansible/ansible.cfg configured module search path = [u'/home/ansible-user/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python2.7/site-packages/ansible executable location = /usr/bin/ansible-galaxy python version = 2.7.5 (default, Aug 4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]   Could you please shed some light on this issue?   Using /etc/ansible/ansible.cfg as config file Opened /home/ansible-user/.ansible_galaxy Processing role PaloAltoNetworks.paloaltonetworks Opened /home/ansible-user/.ansible_galaxy - downloading role 'paloaltonetworks', owned by PaloAltoNetworks https://galaxy.ansible.com/api/v1/roles/?owner__username=PaloAltoNetworks&name=paloaltonetworks https://galaxy.ansible.com/api/v1/roles/16926/versions/?page_size=50 - downloading role from   https://github.com/PaloAltoNetworks/ansible-role-paloaltonetworks/archive/V1.0.4.4.tar.gz - extracting PaloAltoNetworks.paloaltonetworks to /etc/ansible/roles/PaloAltoNetworks.paloaltonetworks - extracting PaloAltoNetworks.paloaltonetworks to /usr/share/ansible/roles/PaloAltoNetworks.paloaltonetworks ERROR! Unexpected Exception, this is probably a bug: list index out of range the full traceback was: Traceback (most recent call last): File "/usr/bin/ansible-galaxy", line 106, in <module> exit_code = cli.run() File "/usr/lib/python2.7/site-packages/ansible/cli/galaxy.py", line 150, in run self.execute() File "/usr/lib/python2.7/site-packages/ansible/cli/__init__.py", line 154, in execute fn() File "/usr/lib/python2.7/site-packages/ansible/cli/galaxy.py", line 392, in execute_install installed = role.install() File "/usr/lib/python2.7/site-packages/ansible/galaxy/role.py", line 332, in install self.path = self.paths[nextidx] IndexError: list index out of range   Could you please shed some light on this issue? Thank you very much. ... View more

Hi Ivan,   I have downloaded ansible-pan from github without any issue. However I have been trying to install the  PaloAltoNetworks.paloaltonetworks role without any success. It produces "IndexError: list index out of range" error.   [ansible-user@localhost roles]$ ansible-galaxy install PaloAltoNetworks.paloaltonetworks -vvv ansible-galaxy 2.4.1.0 config file = /etc/ansible/ansible.cfg configured module search path = [u'/home/ansible-user/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python2.7/site-packages/ansible executable location = /usr/bin/ansible-galaxy python version = 2.7.5 (default, Aug 4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]   Could you please shed some light on this issue?   Using /etc/ansible/ansible.cfg as config file Opened /home/ansible-user/.ansible_galaxy Processing role PaloAltoNetworks.paloaltonetworks Opened /home/ansible-user/.ansible_galaxy - downloading role 'paloaltonetworks', owned by PaloAltoNetworks https://galaxy.ansible.com/api/v1/roles/?owner__username=PaloAltoNetworks&name=paloaltonetworks https://galaxy.ansible.com/api/v1/roles/16926/versions/?page_size=50 - downloading role from https://github.com/PaloAltoNetworks/ansible-role-paloaltonetworks/archive/V1.0.4.4.tar.gz - extracting PaloAltoNetworks.paloaltonetworks to /etc/ansible/roles/PaloAltoNetworks.paloaltonetworks - extracting PaloAltoNetworks.paloaltonetworks to /usr/share/ansible/roles/PaloAltoNetworks.paloaltonetworks ERROR! Unexpected Exception, this is probably a bug: list index out of range the full traceback was: Traceback (most recent call last): File "/usr/bin/ansible-galaxy", line 106, in <module> exit_code = cli.run() File "/usr/lib/python2.7/site-packages/ansible/cli/galaxy.py", line 150, in run self.execute() File "/usr/lib/python2.7/site-packages/ansible/cli/__init__.py", line 154, in execute fn() File "/usr/lib/python2.7/site-packages/ansible/cli/galaxy.py", line 392, in execute_install installed = role.install() File "/usr/lib/python2.7/site-packages/ansible/galaxy/role.py", line 332, in install self.path = self.paths[nextidx] IndexError: list index out of range ... View more