Skip to content

Commit 1874c83

Browse files
chore: Fix linting
1 parent ca5545b commit 1874c83

3 files changed

Lines changed: 67 additions & 3 deletions

File tree

README.md

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Ansible PAN-OS Policy Automation
2+
3+
This repository provides a framework and a philosophy for creating PAN-OS security policies
4+
via Automation.
5+
6+
This repository would be of interest to you if:
7+
8+
* You deal with a large number of incoming user requests for security policy
9+
* You can make repeatable, actionable policy decisions
10+
* You are comfortable with Ansible or General automation platforms.
11+
12+
## Quickstart
13+
14+
### Requirements
15+
16+
* 🐍 Python 3.11+
17+
* Ansible 2.16+
18+
19+
20+
### Install the Paloaltonetworks Collection
21+
22+
```shell
23+
ansible-galaxy install paloaltonetworks.panos
24+
```
25+
26+
### Clone this repo
27+
28+
```shell
29+
# ssh
30+
git clone git@github.com:adambaumeister/ansible_panos_policy_orchestration.git
31+
# https
32+
https://github.com/adambaumeister/ansible_panos_policy_orchestration.git
33+
```
34+
35+
### Define your Inventory
36+
37+
```yaml title='inventory.yml'
38+
all:
39+
children:
40+
# the `lab` group is included here as an example, but you can layout your panorama devices however you like.
41+
# Note you will need to create your own primary playbook mirroring `lab_policy.yml` if you change the grouping.
42+
lab:
43+
hosts:
44+
lab-panorama01:
45+
ansible_host: < YOUR PANORAMA HOSTNAME OR IP HERE >
46+
# Password should be provided via PAN_PASSWORD environment variable
47+
# Example: export PAN_PASSWORD="admin_password"
48+
49+
# Username should be provided via PAN_USERNAME environment variable
50+
# Example: export PAN_USERNAME="admin"
51+
vars:
52+
# Common variables for lab environment
53+
ansible_connection: local
54+
ansible_python_interpreter: "{{ ansible_playbook_python }}"
55+
# These variables are only used when creating COMPLETELY NEW policies
56+
default_new_policy_device_group: Lab
57+
default_new_policy_rulebase: post-rulebase
58+
default_new_policy_tag: AUTOMATED
59+
default_rule_location: bottom
60+
```
61+
62+
### Run the connectivity playbook to validate connectivity
63+
64+
```shell
65+
ansible-playbook playbooks/testing/connectivity.yml
66+
```

playbooks/orchestrator/preset/add_address_to_preset_group.yml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,6 @@
2525
state: gathered
2626
register: existing_group
2727

28-
- debug:
29-
msg: "{{ existing_group }}"
3028

3129
- name: Add ADDRESS object to preset ADDRESS GROUP
3230
paloaltonetworks.panos.panos_address_group:

playbooks/orchestrator/preset/ssh_jumpserver_inbound_access.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,4 @@
1010
device_group: Lab # Finally, we set the device group!
1111
when:
1212
- "'10.10.11.0/24' | ansible.utils.network_in_network( destination_ip )"
13-
- "not '10.0.0.0/8' | ansible.utils.network_in_network( source_ip )"
13+
- "not '10.0.0.0/8' | ansible.utils.network_in_network( source_ip )"

0 commit comments

Comments
 (0)