paloaltonetworks.panos.panos_object module – create/read/update/delete object in PAN-OS or Panorama
Note
This module is part of the paloaltonetworks.panos collection (version 2.13.2).
To install it, use: ansible-galaxy collection install paloaltonetworks.panos
.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: paloaltonetworks.panos.panos_object
.
New in paloaltonetworks.panos 1.0.0
DEPRECATED
- Removed in:
version 3.0.0
- Why:
Updated to idempotent modules
- Alternative:
Use paloaltonetworks.panos.panos_address_object, paloaltonetworks.panos.panos_address_group, paloaltonetworks.panos.panos_service_object, paloaltonetworks.panos.panos_service_group, or paloaltonetworks.panos.panos_tag_object as appropriate.
Synopsis
Policy objects form the match criteria for policy rules and many other functions in PAN-OS. These may include
address object, address groups, service objects, service groups, and tag.
Requirements
The below requirements are needed on the host that executes this module.
pan-python can be obtained from PyPI https://pypi.python.org/pypi/pan-python
pandevice can be obtained from PyPI https://pypi.python.org/pypi/pandevice
Parameters
Parameter |
Comments |
---|---|
The IP address of the host or network in CIDR notation. |
|
The type of address object definition. Valid types are ip-netmask and ip-range. Choices: |
|
A static group of address objects or dynamic address group. |
|
The name of the address object. |
|
API key that can be used instead of username/password credentials. |
|
Choices: |
|
Deprecated Please use paloaltonetworks.panos.panos_commit_firewall, paloaltonetworks.panos.panos_commit_panorama, paloaltonetworks.panos.panos_commit_push instead. Commit changes after creating object. If ip_address is a Panorama device, and device_group or template are also set, perform a commit to Panorama and a commit-all to the device group/template. Choices: |
|
The description of the object. |
|
The destination port to be used in a service object definition. |
|
The name of the (preexisting) Panorama device group. If undefined and ip_address is Panorama, this defaults to shared. |
|
The filter match criteria to be used in a dynamic addressgroup definition. |
|
IP address (or hostname) of PAN-OS device or Panorama management console being configured. |
|
The operation to be performed. Choices: |
|
Password credentials to use for authentication. |
|
The IP protocol to be used in a service object definition. Choices: |
|
A group of service objects. |
|
The name of the service object. |
|
The group of service objects used in a servicegroup definition. |
|
The source port to be used in a service object definition. |
|
A group of address objects to be used in an addressgroup definition. |
|
The name of an object or rule tag. |
|
Username credentials to use for authentication. Default: :ansible-option-default:`"admin"` |
|
Notes
Note
Checkmode is not supported.
Panorama is supported.
Examples
- name: search for shared address object
panos_object:
ip_address: '{{ ip_address }}'
username: '{{ username }}'
password: '{{ password }}'
operation: 'find'
address: 'DevNet'
- name: create an address group in devicegroup using API key
panos_object:
ip_address: '{{ ip_address }}'
api_key: '{{ api_key }}'
operation: 'add'
addressgroup: 'Prod_DB_Svrs'
static_value: ['prod-db1', 'prod-db2', 'prod-db3']
description: 'Production DMZ database servers'
tag_name: 'DMZ'
devicegroup: 'DMZ Firewalls'
- name: create a global service for TCP 3306
panos_object:
ip_address: '{{ ip_address }}'
api_key: '{{ api_key }}'
operation: 'add'
serviceobject: 'mysql-3306'
destination_port: '3306'
protocol: 'tcp'
description: 'MySQL on tcp/3306'
- name: create a global tag
panos_object:
ip_address: '{{ ip_address }}'
username: '{{ username }}'
password: '{{ password }}'
operation: 'add'
tag_name: 'ProjectX'
color: 'yellow'
description: 'Associated with Project X'
- name: delete an address object from a devicegroup using API key
panos_object:
ip_address: '{{ ip_address }}'
api_key: '{{ api_key }}'
operation: 'delete'
addressobject: 'Win2K test'
Status
This module will be removed in version 3.0.0. [deprecated]
For more information see DEPRECATED.