Add panos_config_element

[mrichardson03]

panos_config_element is an Ansible module I wrote to provide idempotent manipulation of any config element in the XML-API. This can also support bulk API calls, which should greatly speed up infrastructure as code workflows.

It also runs on the httpapi connection type, which allows for connection persistence, and using standard Ansible host variables for connection, so provider no longer has to be specified.

It is called like this:

    - name: Create any configuration you want!
      panos_config_element:
        xpath: "/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/profiles/vulnerability"
        element: |
          <entry name="Outbound-Vuln-Profile">
            <rules>
              <entry name="Block-Critical-High-Medium">
                <action>
                  <reset-both/>
                </action>
                <vendor-id>
                  <member>any</member>
                </vendor-id>
                <severity>
                  <member>critical</member>
                  <member>high</member>
                  <member>medium</member>
                </severity>
                <cve>
                  <member>any</member>
                </cve>
                <threat-name>any</threat-name>
                <host>any</host>
                <category>any</category>
                <packet-capture>single-packet</packet-capture>
              </entry>
            </rules>
          </entry>

    - name: Create multiple objects at once, and use Jinja!
      panos_config_element:
        xpath: "/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address"
        element: |
          {% for object in address_objects %}
            <entry name="{{ object.name }}">
              <{{ object.type | default("ip-netmask") }}>{{ object.value }}</{{ object.type | default("ip-netmask") }}>
          {% if 'description' in object %}
              <description>{{ object.description }}</description>
          {% endif %}
            </entry>
          {% endfor %}

This module can be combined with Jinja template files to cleanly configure all aspects of a PAN-OS device, rather than just the subset of functionality the modules currently support. See my firewall role for examples of how this can be done.

[github-actions]

🎉 This issue has been resolved in version 2.7.0 🎉

The release is available on Ansible Galaxy and GitHub release

Posted by semantic-release bot

[superloopnetwork]

Hello @mrichardson03 . I'm trying to use your module panos_config_element to input the source-hip profile under a security ruleset since the panos.panos_security_rule does not support source-hip and destination-hip parameters. Here is a sample of my task:

    - name: Adding source-hip for rule 'A fake ruleset'
      paloaltonetworks.panos.panos_config_element:
        provider: '{{ device }}'
        xpath: "/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules"
        element: |
                   <entry name="A fake ruleset">
                       <source-hip>
                           <member>new_profile</member>
                       </source-hip>
                   </entry>

By default, after running a ruleset creation, source-hip is always set to "any". What I noticed after running your module and trying to replace/overwrite the 'any' entry, it appends it to the list. So it would look something like this:

+set config devices localhost.localdomain vsys vsys1 rulebase security rules "A fake ruleset" source-hip [ any new_profile ]

How do I get it to overwrite so that it looks like this:
+set config devices localhost.localdomain vsys vsys1 rulebase security rules "A fake ruleset" source-hip [ new_profile ]

• without the 'any'...

Thank you

[superloopnetwork]

Apologies @mrichardson03 .. I noticed in the documentation there is a parameter called edit.. I have set that to true to overwrite the existing configs. However when I re-run the playbook, I get this message:

{"changed": false, "msg": "Edit breaks config validity"}

What does that mean?