paloaltonetworks.panos.panos_ike_gateway module – Manage IKE gateway on the firewall with subset of settings.
Note
This module is part of the paloaltonetworks.panos collection (version 2.21.2).
To install it, use: ansible-galaxy collection install paloaltonetworks.panos.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: paloaltonetworks.panos.panos_ike_gateway.
New in paloaltonetworks.panos 1.0.0
Synopsis
Use this to manage or define a gateway, including the configuration information necessary to perform Internet Key Exchange (IKE) protocol negotiation with a peer gateway. This is the Phase 1 portion of the IKE/IPSec VPN setup.
Requirements
The below requirements are needed on the host that executes this module.
pan-python can be obtained from PyPI https://pypi.python.org/pypi/pan-python
pandevice can be obtained from PyPI https://pypi.python.org/pypi/pandevice
Parameters
Parameter |
Comments |
|---|---|
Deprecated Use provider to specify PAN-OS connectivity instead. The API key to use instead of generating it using username / password. |
|
Deprecated Please use paloaltonetworks.panos.panos_commit_firewall, paloaltonetworks.panos.panos_commit_panorama, paloaltonetworks.panos.panos_commit_push instead. Commit changes after creating object. If ip_address is a Panorama device, and device_group or template are also set, perform a commit to Panorama and a commit-all to the device group/template. Choices: |
|
Time in seconds to check for a dead peer. Default: :ansible-option-default:`99` |
|
Retry attempts before peer is marked dead. Default: :ansible-option-default:`10` |
|
True to enable Dead Peer Detection on the gateway. Choices: |
|
True to enable IKE fragmentation Incompatible with pre-shared keys, or ‘aggressive’ exchange mode Choices: |
|
Enable sending empty information liveness check message. Choices: |
|
True to NAT Traversal mode Choices: |
|
True to have the firewall only respond to IKE connections and never initiate them. Choices: |
|
When state=gathered. An advanced filtering option to filter results returned from PAN-OS. Refer to the guide discussing gathered_filter for more information. |
|
Crypto profile for IKEv1. Default: :ansible-option-default:`"default"` |
|
The IKE exchange mode to use Choices: |
|
Crypto profile for IKEv2. Default: :ansible-option-default:`"default"` |
|
Specify the outgoing firewall interface to the VPN tunnel. |
|
Deprecated Use provider to specify PAN-OS connectivity instead. The IP address or hostname of the PAN-OS device being configured. |
|
Delay interval before sending probing packets (in seconds). Default: :ansible-option-default:`5` |
|
Define the format of the identification of the local gateway. ipaddr: IP address fqdn: FQDN (hostname) ufqdn: User FQDN (email address) keyid: Key ID (binary format ID string in hex) Choices: |
|
Define the value for the identification of the local gateway. Required when local_id_type is set. |
|
Bind IKE gateway to the specified interface IP address. Only needed if ‘interface’ has multiple IP addresses associated with it. It should include the mask, such as ‘192.168.1.1/24’ |
|
The type of the bound interface IP address. ip: Specify exact IP address if interface has multiple addresses. floating-ip: Floating IP address in HA Active-Active configuration. Required when ‘local_ip_address’ is set. Choices: |
|
Name for the profile. |
|
Deprecated Use provider to specify PAN-OS connectivity instead. The password to use for authentication. This is ignored if api_key is specified. |
|
Type of checking to do on peer_id. Choices: |
|
Define the format of the identification of the peer gateway. ipaddr: IP address fqdn: FQDN (hostname) ufqdn: User FQDN (email address) keyid: Key ID (binary format ID string in hex) Choices: |
|
Define the value for the identification of the peer gateway. Required when peer_id_type is set. |
|
IP or dynamic. Choices: |
|
IPv4 address of the peer gateway. |
|
Deprecated Use provider to specify PAN-OS connectivity instead. The port number to connect to the PAN-OS device on. Default: :ansible-option-default:`443` |
|
Specify pre-shared key. Default: :ansible-option-default:`"CHANGEME"` |
|
A dict object containing connection details. |
|
The API key to use instead of generating it using username / password. |
|
The IP address or hostname of the PAN-OS device being configured. |
|
The password to use for authentication. This is ignored if api_key is specified. |
|
The port number to connect to the PAN-OS device on. Default: :ansible-option-default:`443` |
|
The serial number of a firewall to use for targeted commands. If ip_address is not a Panorama PAN-OS device, then this param is ignored. |
|
The username to use for authentication. This is ignored if api_key is specified. Default: :ansible-option-default:`"admin"` |
|
(Panorama only) The template this operation should target. Mutually exclusive with template_stack. |
|
(Panorama only) The template stack this operation should target. Mutually exclusive with template. |
|
Deprecated Use provider to specify PAN-OS connectivity instead. The username to use for authentication. This is ignored if api_key is specified. Default: :ansible-option-default:`"admin"` |
|
Specify the priority for Diffie-Hellman (DH) groups. Choices: |
Notes
Note
Panorama is supported.
Check mode is supported.
PAN-OS connectivity should be specified using provider or the classic PAN-OS connectivity params (ip_address, username, password, api_key, and port). If both are present, then the classic params are ignored.
If the PAN-OS to be configured is Panorama, either template or template_stack must be specified.
Examples
- name: Add IKE gateway config to the firewall
paloaltonetworks.panos.panos_ike_gateway:
provider: '{{ provider }}'
state: 'present'
name: 'IKEGW-Ansible'
version: 'ikev2'
interface: 'ethernet1/1'
enable_passive_mode: true
enable_liveness_check: true
liveness_check_interval: '5'
peer_ip_value: '1.2.3.4'
pre_shared_key: 'CHANGEME'
ikev2_crypto_profile: 'IKE-Ansible'
commit: false
- name: Create IKE gateway (dynamic)
paloaltonetworks.panos.panos_ike_gateway:
provider: '{{ device }}'
name: 'test-dynamic'
interface: 'ethernet1/1'
peer_ip_type: dynamic
pre_shared_key: 'CHANGEME'
commit: false