About dberber1

same issue here ... View more

Ahh - cool - overlooked it - thanks! ... View more

Thanks for this.  The one from the link that you provided is for vsphere 6.5 and we need 6.0 to work in our environment - are there any tricks for conversion? ... View more

Have a look at mindmeld and external dynamic lists.   https://github.com/PaloAltoNetworks/minemeld/wiki ... View more

Thanks Brian for this response.  This is all looking good and thanks to you and your team/contributors for the work.  I'm glad that PA has this on the radar and is working on improving the functionality of the Ansible modules.   My concern over 3rd party libraries was that with the Ansible modules being dependant on them, a change to either pandevice or pan-python could break the Ansible module and that would leave customers 'stuck' waiting on a fix.  If we decide to go the Ansible route for automation, there is a significant time and cost investment involved in it - we would not want to develop and deploy automation solutions that could work one day and then not another.  Remember, most of us are net-sec engineers and not developers - this is new ground for a lot of us and it has to work all the time to sell it to management and other engineers.   As for the support question - I understand that Github works and is best effort - but to reiterate my statement above - if significant time and cost is sunk into an automation solution, enterprise customers should be able to reach qualified support options other than best effort.  I guess the ask is to have a resource that TAC can reach if we have a problem with this.  What we're seeing on the customer side is a push from vendors to automate (we were at Ignite and Ansiblefest - automation was definitely a topic for PA) - but we're not seeing enterprise level support options (even if it was added paid for).   I'll work on developing my wish list for new modules as well.   Thanks. ... View more

To follow up on some of the questions and comments.   I posted back in March: "So, looking at the docs, it looks like I would not be able to create a tagged vlan sub interface (ae1.500 - vlan.500 - ip 10.2.2.2/24 -- for example) and also add a BGP peers to the VRouter with Ansible.  Looks like something I wold have to do directly through the API - but am I missing something?"   So, I don't see those functions.   About third party modules being needed, we see in the Ansible Module Index documentation.  From https://docs.ansible.com/ansible/latest/modules/panos_security_rule_module.html#panos-security-rule-module : Requirements The below requirements are needed on the host that executes this module. pan-python can be obtained from PyPi https://pypi.org/project/pan-python/ pandevice can be obtained from PyPi https://pypi.org/project/pandevice/ xmltodict can be obtained from PyPi https://pypi.org/project/xmltodict "   Sure there is a catchall for running arbitrary commands on a PAN-OS device using XPath and element (new is 2.7) -   ... View more

@LukeBullimoreHey - are you a PA customer?  Did your SE get you access to PANTS ot AutoAssistant?  If so, on-prem or hosted? ... View more

I don't think so as each context is a seperate file.  You can do it one-by-one, but not all-at-once.   ... View more

Yeah - I was just wondering if there was one.  I don't think so, but thought I would ask.  Bad actor could conciveably use up all sessions with valid long running sessions....   ... View more