About gfreeman

gfreeman

Oops: './response/entry' should be './result/entry' and it should work. I can't see what the code looks like above the print statement, but make sure you've removed xml=True from the fw.op() . You want xml=False (the default) because you want fw.op() to return an ElementTree, not a string or bytes or whatever.

gfreeman

Glad you got it working! fw.op() will return an xml.etree.ElementTree by default, so turning it into a string and then having to re-parse it is a (small) waste. You're using a PanDevice object instead of the Firewall object, so I'd recommend changing that for clarity's sake. Then lastly you know what the result looks like, so you can use xml.etree.ElementTree.findall() to get there directly: from pandevice.firewall import Firewall import xml.etree.ElementTree as ET fw = Firewall('10.10.10.10', api_key='abcdefgh') result = fw.op(cmd='show global-protect-gateway current-user') # If you wanted to see the xml response as a string: # print(ET.tostring(result, encoding='utf-8') for elm in result.findall('./response/entry'): print(elm.attrib['name'] + ':') for e in elm: print(e.tag + ': ' + e.text)

gfreeman

From what I can see, your xpath is good. This location is a member , so if you're just wanting to add stuff to this location, then do a set with this as the element: <exclude-access-route> <member>thing1</member> <member>thing2</member> </exclude-access-route> For set operations, you need to stop a xpath part above, so end the xpath location at "split-tunneling".

gfreeman

First things first: if that is a legit password, you need to change your password immediately. For even curl to be failing means this isn't specifically an Ansible issue... Something deeper is going on. Not sure how big a long shot this is: if you're running the script from OSX catalina, then Apple has decided to change what they consider a valid SSL certificate at the OS level: https://support.apple.com/en-us/HT210176 This means that the self-signed certs that PAN-OS uses (for example, when you launch a new instance in AWS / Azure / GCP) are invalid and you won't be able to connect. Since the above is applicable to certs created after July 1, 2019, any instances you launched before should still work with Catalina.

gfreeman

You need to make a list of provider dicts, then loop over that: https://docs.ansible.com/ansible/latest/user_guide/playbooks_loops.html#standard-loops

gfreeman

The reason it's failing is because the GUI API browser is already at the following XML location (per your first screenshot): show > rule-hit-count > vsys > vsys-name The API browser kinda fails when you need to give multiple params at a specific depth... I don't know if it'd work, but you could try going back to the vsys location, then pasting the entire vsys-name block from opening to close and see if that works..?

gfreeman

So you can assign a custom role to a user, and that will limit what they have access to.. But if you're always getting the same API key back, then there is either a problem with your script (maybe using a static variable or something instead of what you specify) or a huge problem with your firewall / PAN-OS. If you're sure this isn't a script issue, then I would recommend reaching out to Palo Alto Networks tech support.

gfreeman

If I understand your question properly, you're wanting to take a downloaded firewall or Panorama XML config and turn it into an Ansible task that you could invoke in a playbook? This would be awesome, but doesn't currently exist. It is something we've discussed having to help drive adoption of Ansible and Terraform.

gfreeman

Yes! You can use facts and jinja2 templating functions to accomplish this. I've authored a blog post that explains everything step by step: https://live.paloaltonetworks.com/t5/Automation-API-Blog/Ansible-Using-Facts-Modules-to-do-Updates/ba-p/275173

gfreeman

You can use standard Ansible looping to do this. You have both Ansible filters and Jinja2 templating functions available to use in playbooks. This blog post shows a little bit of looping and walks through using facts modules to do updates to existing config: https://live.paloaltonetworks.com/t5/Automation-API-Blog/Ansible-Using-Facts-Modules-to-do-Updates/ba-p/275173

gfreeman

If you created a file "provider.yml" that has the auth credentials in it, then you just tell Ansible to load that file at the beginning of your "tasks": tasks: - name: Grab auth creds include_vars: 'provider.yml' no_log: 'yes'

gfreeman

Test security policy is a firewall command.

gfreeman

Seems like you're using pandevice to do the op() call? If so, this is better since there is an object for address objects: from pandevice.objects import AddressObject listing = AddressObject.refreshall(fw) for obj in listing: if obj.type != 'ip-netmask': continue print('Name: {0}) | ip-netmask: {1}'.format(obj.name, obj.value)) If you really wanted to do "'show config running" to get the answer, your xpath search is wrong. It should be ./result/config/devices/entry[@name='vsys1']/address/entry . At that location, the name is an attribute, and ip-netmask may or may not be there, so using find() is ok.

gfreeman

provider is a param that you're passing in to panos_security_rule , while the '{{ provider }}' part says, "use the variable "provider" that is somehow being brought into this playbook. You can specify credentials a few different ways: Load it from a file; this is fine if you're just playing around. Just create another YAML file in the same directory as your playbook and do this, except with real values: provider: ip_address: '10.1.1.1' username: 'admin' password: 'secret' Get the credentials from Ansible Vault; this is the preferred way if you're using Ansible in production Just as a side note, the Palo Alto Networks Ansible role is now deprecated in favor of the collection, which is on Ansible Galaxy as paloaltonetworks.panos. The repo for the new collection is here, and also keep in mind that collections require that you are using Ansible 2.9+.

gfreeman

Maybe, depending on what all you need to configure? The panos provider has over 100 resources (Panorama and Firewall combined), so there's a lot you can do with it. I'd check out the documentation and see if what you need to configure has resources for it or not: https://www.terraform.io/docs/providers/panos/index.html If something is missing, thumbs up / comment on a pre-existing issue, or open a new one if one doesn't already exist: https://github.com/terraform-providers/terraform-provider-panos

gfreeman · ‎02-27-2020

So when you do fw.xapi.(whatever) you are bypassing all the stuff pandevice can do for you. Since you are wanting pandevice to intervene, you should stick with fw.op() instead of doing fw.xapi.op() . Also, fw.op() has a param retry_on_peer that defaults to False. I'm not sure, but try setting that to True and see if it works?

gfreeman · ‎02-27-2020

Please try updating your pandevice/base.py file as shown here and tell me if this fixes it: https://github.com/PaloAltoNetworks/pandevice/commit/284710ac8633330fed1ef2d96180a2e955785e90

gfreeman · ‎02-20-2020

I believe this command was added to pandevice in the 8.x timeframe, so it should work. What is the command you're running against both firewalls, and what is the error you're seeing when running against the 8.x firewall?

gfreeman · ‎02-19-2020

I would skip the file part of this. If your true goal is just to see the states of things, I would take advantage of the fact that fw.op() returns an xml.etree.ElementTree object and use the python functions available to iterate over the results: result = fw.op('show vpn flow') for entry in result.findall('./result/IPSec/entry'): name = entry.find('./name') state = entry.find('./state') if name is None or state is None: # This should never happen, but just to code defensively... continue print('{0} has state {1}'.format(name.text, state.text))

gfreeman · ‎02-11-2020

I don't think that ping works on PAN-OS appliances because you don't connect to them using ssh, but the API. I think a better test to verify connectivity is to run a playbook that uses panos_op , and you can use the example from the documentation: https://ansible-pan.readthedocs.io/en/latest/modules/panos_op_module.html

gfreeman · ‎02-10-2020

You have a few options for how to pass it in. 1. Have pandevice create the XML command: fw.op('test routing fib-lookup virtual-router "default" ip "10.1.1.1"') 2. Pass in the XML command yourself: fw.op('<test><routing><fib-lookup><virtual-router>default</virtual-router><ip>10.1.1.1</ip></fib-lookup></routing></test>', cmd_xml=False)

gfreeman · ‎02-04-2020

If I ask the GUI to show a config diff, I see that it sends an op command that is queued, then when the job finishes, the XML response has a filepath param. This is making me think that you could script the retrieval of the config diff as HTML, but otherwise the config diff might not accessible via API..

gfreeman · ‎02-04-2020

In all the examples for the Palo Alto Networks role, the vars.yml file is located in the same directory as the playbook, which is the same directory that you're executing ansible-playbook in. Seems like you're not using the Palo Alto Networks Ansible Galaxy role in this playbook, so I guess vars.yml just contains the variables that you're referencing in this playbook.

gfreeman · ‎02-04-2020

Oh, I see it. You have a typo: it's "member" not "memeber".

gfreeman · ‎02-04-2020

So if you get the info from the CLI, then just mimic what command the CLI uses with pandevice and then you can invoke the function. You can see what op command the CLI is executing by doing cli debug enable before executing the command, then styling your pandevice fw.op() similarly.

gfreeman · ‎01-30-2020

If you're using pandevice, there's a function for this specifically: https://pandevice.readthedocs.io/en/latest/module-base.html#pandevice.base.PanDevice.test_security_policy_match

gfreeman · ‎01-28-2020

The JSON payload seems right, but the error is saying that administrative tag abc doesn't exist. You're sure it's there in vsys1 (or the shared scope)? So if you login to the GUI and go to Objects > Tags you see it?

gfreeman · ‎01-28-2020

You're close, you just need to put double quotes around the word "all": details = fw.op('show interface "all"')

gfreeman · ‎01-22-2020

This forum has eaten your formatting so it's hard to tell what the real issue is here. It could be that the YAML is not properly formatted in your playbook; it could be that the variable retrieval is broken somehow (say, the "panorama-secrets.yml" file is improperly formatted or not there); I also notice that you are trying to refer to a param named ip_address in the provider param, but the provider param is expecting a YAML dictionary not a string.

gfreeman · ‎01-15-2020

This isn't supported yet. Feel free to open feature requests against the repo itself in the future, but if you could just thumbs up the issue or comment so the issue has better visibility: https://github.com/PaloAltoNetworks/ansible-pan/issues/456

Date Registered	‎08-29-2016 10:26 AM
Date Last Visited	yesterday
Total Messages Posted	120
Total Likes Received	35

Online Status	Offline
Date Last Visited	yesterday

Enterprise

Prisma

Cortex

About gfreeman