About SZanpure

Hi,   I have provisioned a Panorama in CSP using flex credits. I then spun up a Panorama instance using Terraform. After the instance has initialised (I browse to the Panorama Web UI login screen via public IP), I kick off my ansible playbook, which has the initial configuration. First  attached screenshot shows that the serial number is "Unknown". This is before the ansible playbook is run. The second screenshot shows the ansible error which I call "panos_op" to set the serial number. Third screenshot shows that the serial number has been set, even though the ansible playbook errored.    Ansible playbook below   --- - hosts: localhost connection: local # This is needed to set admin password. https://github.com/PaloAltoNetworks/pan-os-ansible/discussions/272 gather_facts: false collections: - paloaltonetworks.panos - amazon.aws vars: provider: ip_address: '<panorama public IP>' # TODO: Fetch this using aws collection username: 'admin' tasks: - name: retrieve admin password from aws secrets manager no_log: true set_fact: provider: "{{ provider | combine(new_item, recursive=true) }}" vars: new_item: { 'password': "{{ lookup('aws_secret', 'panos-admin-password', on_missing='error', on_denied='error') }}" } with_dict: "{{ provider }}" - name: Change admin password using ssh protocol panos_admpwd: ip_address: "{{ provider['ip_address'] }}" username: "{{ provider['username'] }}" newpassword: "{{ provider['password'] }}" key_filename: "../key.pem" register: result until: result is not failed retries: 300 delay: 10 - name: commit candidate config on panorama panos_commit_panorama: provider: '{{ provider }}' description: 'changed admin password' - name: wait for commits to finish panos_check: provider: '{{ provider }}' initial_delay: 10 interval: 5 timeout: 100 - name: retrieve panorama admin api key panos_api_key: provider: '{{ provider }}' register: panorama_admin_api_key - name: set panorama admin api key in provider dict no_log: true set_fact: provider: "{{ provider | combine(new_item, recursive=true) }}" vars: new_item: { 'api_key': "{{ panorama_admin_api_key.api_key }}" } with_dict: "{{ provider }}" - name: Get system info panos_facts: provider: '{{ provider }}' gather_subset: ['system'] register: system_info - name: Show system info debug: msg="{{ system_info }}" - name: set panorama serial number panos_op: provider: '{{ provider }}' cmd: "<set><serial-number>{{ lookup('aws_secret', 'panos-serial-number', on_missing='error', on_denied='error') }}</serial-number></set>" cmd_is_xml: true - name: commit candidate config on panorama panos_commit_panorama: provider: '{{ provider }}' description: 'added serial number' - name: wait for commits to finish panos_check: provider: '{{ provider }}' initial_delay: 10 interval: 5 timeout: 100 - name: check if panorama serial number has updated panos_facts: provider: '{{ provider }}' gather_subset: ['system']   I tried hardcoding the serial number in the set command (instead of fetching it from secrets manager) and that made no difference whatsoever.   Ansible output below   Starting galaxy collection install process Process install dependency map Starting collection install process Skipping 'paloaltonetworks.panos' as it is already installed Skipping 'amazon.aws' as it is already installed [WARNING]: No inventory was parsed, only implicit localhost is available [WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all' PLAY [localhost] ***************************************************************************************************************************************************************************** TASK [retrieve admin password from secrets manager] ****************************************************************************************************************************************** ok: [localhost] => (item=None) ok: [localhost] => (item=None) ok: [localhost] TASK [Change admin password using ssh protocol] ********************************************************************************************************************************************** changed: [localhost] TASK [commit candidate config on panorama] *************************************************************************************************************************************************** ok: [localhost] TASK [wait for commits to finish] ************************************************************************************************************************************************************ changed: [localhost] TASK [retrieve panorama admin api key] ******************************************************************************************************************************************************* ok: [localhost] TASK [set panorama admin api key in provider dict] ******************************************************************************************************************************************* ok: [localhost] => (item=None) ok: [localhost] => (item=None) ok: [localhost] => (item=None) ok: [localhost] TASK [Get system info] *********************************************************************************************************************************************************************** ok: [localhost] TASK [Show system info] ********************************************************************************************************************************************************************** ok: [localhost] => { "msg": { "ansible_facts": { "ansible_net_full_commit_required": false, "ansible_net_gather_subset": [ "system" ], "ansible_net_hostname": "Panorama", "ansible_net_model": "Panorama", "ansible_net_multivsys": null, "ansible_net_serial": "unknown", "ansible_net_uncommitted_changes": false, "ansible_net_uptime": "0 days, 0:22:23", "ansible_net_version": "10.1.5-h1" }, "changed": false, "failed": false } } TASK [set panorama serial number] ************************************************************************************************************************************************************ An exception occurred during task execution. To see the full traceback, use -vvv. The error was: http.client.RemoteDisconnected: Remote end closed connection without response fatal: [localhost]: FAILED! => {"changed": false, "module_stderr": "Traceback (most recent call last):\n File \"/opt/app/.ansible/tmp/ansible-tmp-1659027736.4368856-101-91496277608478/AnsiballZ_panos_op.py\", line 102, in <module>\n _ansiballz_main()\n File \"/opt/app/.ansible/tmp/ansible-tmp-1659027736.4368856-101-91496277608478/AnsiballZ_panos_op.py\", line 94, in _ansiballz_main\n invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n File \"/opt/app/.ansible/tmp/ansible-tmp-1659027736.4368856-101-91496277608478/AnsiballZ_panos_op.py\", line 40, in invoke_module\n runpy.run_module(mod_name='ansible_collections.paloaltonetworks.panos.plugins.modules.panos_op', init_globals=None, run_name='__main__', alter_sys=True)\n File \"/usr/lib/python3.9/runpy.py\", line 210, in run_module\n return _run_module_code(code, init_globals, run_name, mod_spec)\n File \"/usr/lib/python3.9/runpy.py\", line 97, in _run_module_code\n _run_code(code, mod_globals, init_globals,\n File \"/usr/lib/python3.9/runpy.py\", line 87, in _run_code\n exec(code, run_globals)\n File \"/tmp/ansible_panos_op_payload_cy8f9t6z/ansible_panos_op_payload.zip/ansible_collections/paloaltonetworks/panos/plugins/modules/panos_op.py\", line 170, in <module>\n File \"/tmp/ansible_panos_op_payload_cy8f9t6z/ansible_panos_op_payload.zip/ansible_collections/paloaltonetworks/panos/plugins/modules/panos_op.py\", line 144, in main\n File \"/usr/lib/python3.9/site-packages/panos/panorama.py\", line 498, in op\n return super(Panorama, self).op(\n File \"/usr/lib/python3.9/site-packages/panos/base.py\", line 4047, in op\n element = self.xapi.op(cmd, vsys, False, extra_qs, retry_on_peer=retry_on_peer)\n File \"/usr/lib/python3.9/site-packages/panos/base.py\", line 3878, in method\n super_method(self, *args, **kwargs)\n File \"/usr/lib/python3.9/site-packages/pan/xapi.py\", line 951, in op\n self.__type_op(cmd, vsys, extra_qs)\n File \"/usr/lib/python3.9/site-packages/pan/xapi.py\", line 969, in __type_op\n response = self.__api_request(query)\n File \"/usr/lib/python3.9/site-packages/pan/xapi.py\", line 545, in __api_request\n response = urlopen(**kwargs)\n File \"/usr/lib/python3.9/urllib/request.py\", line 214, in urlopen\n return opener.open(url, data, timeout)\n File \"/usr/lib/python3.9/urllib/request.py\", line 517, in open\n response = self._open(req, data)\n File \"/usr/lib/python3.9/urllib/request.py\", line 534, in _open\n result = self._call_chain(self.handle_open, protocol, protocol +\n File \"/usr/lib/python3.9/urllib/request.py\", line 494, in _call_chain\n result = func(*args)\n File \"/usr/lib/python3.9/urllib/request.py\", line 1389, in https_open\n return self.do_open(http.client.HTTPSConnection, req,\n File \"/usr/lib/python3.9/urllib/request.py\", line 1350, in do_open\n r = h.getresponse()\n File \"/usr/lib/python3.9/http/client.py\", line 1377, in getresponse\n response.begin()\n File \"/usr/lib/python3.9/http/client.py\", line 320, in begin\n version, status, reason = self._read_status()\n File \"/usr/lib/python3.9/http/client.py\", line 289, in _read_status\n raise RemoteDisconnected(\"Remote end closed connection without\"\nhttp.client.RemoteDisconnected: Remote end closed connection without response\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1} PLAY RECAP *********************************************************************************************************************************************************************************** localhost : ok=8 changed=2 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0   My python version is 3.9.12. My Ansible version is 2.10.7. I am using the latest ansible collection for paloaltonetworks.panos (the one released on pypi, which I believe is from main branch, and not develop).   Is this is a known issue, or am I doing something wrong? Any help appreciated please.   Regards, Shreyas ... View more