|
| 1 | +# Ansible PAN-OS Policy Automation |
| 2 | + |
| 3 | +This repository provides a framework and a philosophy for creating PAN-OS security policies |
| 4 | +via Automation. |
| 5 | + |
| 6 | +This repository would be of interest to you if: |
| 7 | + |
| 8 | + * You deal with a large number of incoming user requests for security policy |
| 9 | + * You can make repeatable, actionable policy decisions |
| 10 | + * You are comfortable with Ansible or General automation platforms. |
| 11 | + |
| 12 | +## Quickstart |
| 13 | + |
| 14 | +### Requirements |
| 15 | + |
| 16 | + * 🐍 Python 3.11+ |
| 17 | + * Ansible 2.16+ |
| 18 | + |
| 19 | + |
| 20 | +### Install the Paloaltonetworks Collection |
| 21 | + |
| 22 | +```shell |
| 23 | +ansible-galaxy install paloaltonetworks.panos |
| 24 | +``` |
| 25 | + |
| 26 | +### Clone this repo |
| 27 | + |
| 28 | +```shell |
| 29 | +# ssh |
| 30 | +git clone git@github.com:adambaumeister/ansible_panos_policy_orchestration.git |
| 31 | +# https |
| 32 | +https://github.com/adambaumeister/ansible_panos_policy_orchestration.git |
| 33 | +``` |
| 34 | + |
| 35 | +### Define your Inventory |
| 36 | + |
| 37 | +```yaml title='inventory.yml' |
| 38 | +all: |
| 39 | + children: |
| 40 | + # the `lab` group is included here as an example, but you can layout your panorama devices however you like. |
| 41 | + # Note you will need to create your own primary playbook mirroring `lab_policy.yml` if you change the grouping. |
| 42 | + lab: |
| 43 | + hosts: |
| 44 | + lab-panorama01: |
| 45 | + ansible_host: < YOUR PANORAMA HOSTNAME OR IP HERE > |
| 46 | + # Password should be provided via PAN_PASSWORD environment variable |
| 47 | + # Example: export PAN_PASSWORD="admin_password" |
| 48 | + |
| 49 | + # Username should be provided via PAN_USERNAME environment variable |
| 50 | + # Example: export PAN_USERNAME="admin" |
| 51 | + vars: |
| 52 | + # Common variables for lab environment |
| 53 | + ansible_connection: local |
| 54 | + ansible_python_interpreter: "{{ ansible_playbook_python }}" |
| 55 | + # These variables are only used when creating COMPLETELY NEW policies |
| 56 | + default_new_policy_device_group: Lab |
| 57 | + default_new_policy_rulebase: post-rulebase |
| 58 | + default_new_policy_tag: AUTOMATED |
| 59 | + default_rule_location: bottom |
| 60 | +``` |
| 61 | +
|
| 62 | +### Run the connectivity playbook to validate connectivity |
| 63 | +
|
| 64 | +```shell |
| 65 | +ansible-playbook playbooks/testing/connectivity.yml |
| 66 | +``` |
0 commit comments