paloaltonetworks.panos.panos_ike_crypto_profile module – Manage IKE Crypto profile on the firewall with subset of settings

Note

This module is part of the paloaltonetworks.panos collection (version 2.21.2).

To install it, use: ansible-galaxy collection install paloaltonetworks.panos. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: paloaltonetworks.panos.panos_ike_crypto_profile.

New in paloaltonetworks.panos 1.0.0

Synopsis

    • Use the IKE Crypto Profiles page to specify protocols and algorithms for identification, authentication, and encryption (IKEv1 or IKEv2, Phase 1).

Requirements

The below requirements are needed on the host that executes this module.

Parameters

Parameter

Comments

api_key

string

Deprecated

Use provider to specify PAN-OS connectivity instead.

The API key to use instead of generating it using username / password.

authentication

list / elements=string

Authentication hashes used for IKE phase 1 proposal.

Choices:

Default: :ansible-option-default:`["sha1"]`

authentication_multiple

integer
  • PAN-OS 7.0 and above. - IKEv2 SA reauthentication interval equals authentication_multiple

    times lifetime; 0 means reauthentication is disabled.

commit

boolean

Deprecated

Please use paloaltonetworks.panos.panos_commit_firewall, paloaltonetworks.panos.panos_commit_panorama, paloaltonetworks.panos.panos_commit_push instead.

Commit changes after creating object. If ip_address is a Panorama device, and device_group or template are also set, perform a commit to Panorama and a commit-all to the device group/template.

Choices:

dh_group

aliases: dhgroup

list / elements=string

Specify the priority for Diffie-Hellman (DH) groups.

Choices:

Default: :ansible-option-default:`["group2"]`

encryption

list / elements=string

Encryption algorithms used for IKE phase 1 proposal.

Choices:

Default: :ansible-option-default:`["aes-256-cbc", "3des"]`

gathered_filter

string

When state=gathered.

An advanced filtering option to filter results returned from PAN-OS.

Refer to the guide discussing gathered_filter for more information.

ip_address

string

Deprecated

Use provider to specify PAN-OS connectivity instead.

The IP address or hostname of the PAN-OS device being configured.

lifetime_days

integer

IKE phase 1 key lifetime in days.

lifetime_hours

integer

IKE phase 1 key lifetime in hours.

If state=present or state=replaced and no other lifetime is specified, this will default to 8.

lifetime_minutes

integer

IKE phase 1 key lifetime in minutes.

lifetime_seconds

aliases: lifetime_sec

integer

IKE phase 1 key lifetime in seconds.

name

string

Name for the profile.

password

string

Deprecated

Use provider to specify PAN-OS connectivity instead.

The password to use for authentication. This is ignored if api_key is specified.

port

integer

Deprecated

Use provider to specify PAN-OS connectivity instead.

The port number to connect to the PAN-OS device on.

Default: :ansible-option-default:`443`

provider

dictionary

added in paloaltonetworks.panos 1.0.0

A dict object containing connection details.

api_key

string

The API key to use instead of generating it using username / password.

ip_address

string

The IP address or hostname of the PAN-OS device being configured.

password

string

The password to use for authentication. This is ignored if api_key is specified.

port

integer

The port number to connect to the PAN-OS device on.

Default: :ansible-option-default:`443`

serial_number

string

The serial number of a firewall to use for targeted commands. If ip_address is not a Panorama PAN-OS device, then this param is ignored.

username

string

The username to use for authentication. This is ignored if api_key is specified.

Default: :ansible-option-default:`"admin"`

state

string

The state.

Choices:

template

string

(Panorama only) The template this operation should target. Mutually exclusive with template_stack.

template_stack

string

(Panorama only) The template stack this operation should target. Mutually exclusive with template.

username

string

Deprecated

Use provider to specify PAN-OS connectivity instead.

The username to use for authentication. This is ignored if api_key is specified.

Default: :ansible-option-default:`"admin"`

Notes

Note

  • Panorama is supported.

  • Check mode is supported.

  • PAN-OS connectivity should be specified using provider or the classic PAN-OS connectivity params (ip_address, username, password, api_key, and port). If both are present, then the classic params are ignored.

  • If the PAN-OS to be configured is Panorama, either template or template_stack must be specified.

Examples

- name: Add IKE crypto config to the firewall
  paloaltonetworks.panos.panos_ike_crypto_profile:
    provider: '{{ provider }}'
    state: 'present'
    name: 'vpn-0cc61dd8c06f95cfd-0'
    dh_group: ['group2']
    authentication: ['sha1']
    encryption: ['aes-128-cbc']
    lifetime_seconds: '28800'

Authors

  • Ivan Bojer (@ivanbojer)