panos_object - Error: Parent device group 'Shared' is not recognised as valid device group

[mattspera]

failed: [10.x.x.x -> localhost] (item={u'name': u'test4', u'device_group': u'Shared'}) => {
"changed": false,
"failed": true,
"invocation": {
"module_args": {
"address": null,
"address_type": "ip-netmask",
"addressgroup": null,
"addressobject": null,
"api_key": null,
"color": null,
"description": null,
"destination_port": null,
"devicegroup": "Shared",
"dynamic_value": null,
"ip_address": "10.x.x.x",
"operation": "add",
"password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
"protocol": null,
"servicegroup": null,
"serviceobject": null,
"services": null,
"source_port": null,
"static_value": null,
"tag_name": "test4",
"username": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER"
}
},
"item": {
"device_group": "Shared",
"name": "test4"
},
"msg": "'Shared' device group not found in Panorama. Is the name correct?"
}

[niemesrw]

Ah yes, I'm seeing this as well. Upvoting for a fix please.

[btorresgil]

Have you tried naming the devicegroup 'shared' (all lower case)?

[niemesrw]

Just attempted, here's the text of the error: "msg": "'shared' device group not found in Panorama. Is the name correct?"

…

On Tue, Mar 13, 2018 at 10:06 AM, Brian Torres-Gil ***@***.*** > wrote: Have you tried naming the devicegroup 'shared' (all lower case)? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#44 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AIba1hs-t4QuC2j3zb28lKzAsYcxYcngks5td_x4gaJpZM4QjqW7> .

[niemesrw]

FWIW, when I put a valid device group in the playbook it works just fine:

changed: [ussd-prd-pano01] => {
"changed": true,
"invocation": {
"module_args": {
"address": "35.154.2.119",
"address_type": "ip-netmask",
"addressgroup": null,
"addressobject": "netskope-proxy-35.154.2.119",
"api_key": null,
"color": null,
"description": "NetSkope Proxy Address 35.154.2.119",
"destination_port": null,
"devicegroup": "San Diego HQ",
"dynamic_value": null,
"ip_address": "ussd-prd-pano01",
"operation": "update",
"password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
"protocol": null,
"servicegroup": null,
"serviceobject": null,
"services": null,
"source_port": null,
"static_value": null,
"tag_name": null,
"username": "svc_ansible"
}
},
"msg": "Object 'netskope-proxy-35.154.2.119' successfully updated."
}

[btorresgil]

Thanks for trying. Taking a look at this.

[shinmog]

This should work properly after updating pandevice to 0.6.0 or later.

[dannypetrov]

Same error applies for panos_security_rule. I have a devicegroup called "Shared" which is shared among all firewalls. When I try to apply a shared rule I get exactly the same error :/

[mcanetto]

I haven't tried with the panos_security_rule, but with panos_object I got this to work by leaving the devicegroup off of the playbook entirely. If it isn't specified it seems Panorama assumes Shared.

[shinmog]

That's correct: this is because with config items that go into a vsys, on a firewall the default is to put it in vsys1, but on Panorama the default is the shared scope.

[btorresgil]

Closed by a different repo, re-opening.

[skathiresan-hw]

when you config for a firewall, by default it goes to vsys1, is it possible to create a shared object in a mulitvsys environment?