Try SpotterManage a decryption rule on PAN-OS.
| "added in version" 2.10.0 of paloaltonetworks.panos"
Authors: Garfield Lee Freeman (@shinmog)
Install with ansible-galaxy collection install paloaltonetworks.panos:==2.19.1
collections:
- name: paloaltonetworks.panos
version: 2.19.1This module works for PAN-OS 7.0 and above.
Allows for the management of decryption rules on PAN-OS.
- name: add SSH inbound rule to Panorama device group
paloaltonetworks.panos.panos_decryption_rule:
provider: '{{ provider }}'
device_group: 'Cloud Edge'
name: 'sampleRule'
description: 'Made by Ansible'
source_zones: ['any']
source_addresses: ['192.168.10.15']
source_users: ['any']
source_hip: ['any']
destination_zones: ['any']
destination_addresses: ['10.20.30.40']
destination_hip: ['any']
negate_destination: true
services: ['application-default']
url_categories: ['adult', 'dating']
action: 'decrypt'
decryption_type: 'ssl-forward-proxy'
log_successful_tls_handshakes: true
log_failed_tls_handshakes: true
audit_comment: 'Initial config'
name:
description:
- Name of the rule.
type: str
port:
default: 443
description:
- B(Deprecated)
- Use I(provider) to specify PAN-OS connectivity instead.
- HORIZONTALLINE
- The port number to connect to the PAN-OS device on.
type: int
tags:
description:
- The administrative tags.
elements: str
type: list
uuid:
description:
- The rule UUID.
- Note that this is currently more of a read-only field.
- Usage of the UUID cannot currently take the place of using the rule name as the
primary identifier.
type: str
vsys:
default: vsys1
description:
- The vsys this object belongs to.
type: str
state:
choices:
- present
- absent
- replaced
- merged
- deleted
- gathered
default: present
description:
- The state.
type: str
action:
choices:
- no-decrypt
- decrypt
- decrypt-and-forward
default: no-decrypt
description:
- The action.
type: str
target:
description:
- Applicable for Panorama only.
- Apply this rule exclusively to the listed firewall serial numbers.
elements: str
type: list
api_key:
description:
- B(Deprecated)
- Use I(provider) to specify PAN-OS connectivity instead.
- HORIZONTALLINE
- The API key to use instead of generating it using I(username) / I(password).
type: str
disabled:
description:
- Rule is disabled or not.
type: bool
location:
choices:
- top
- bottom
- before
- after
description:
- Position to place the rule in.
type: str
password:
description:
- B(Deprecated)
- Use I(provider) to specify PAN-OS connectivity instead.
- HORIZONTALLINE
- The password to use for authentication. This is ignored if I(api_key) is specified.
type: str
provider:
description:
- A dict object containing connection details.
suboptions:
api_key:
description:
- The API key to use instead of generating it using I(username) / I(password).
type: str
ip_address:
description:
- The IP address or hostname of the PAN-OS device being configured.
type: str
password:
description:
- The password to use for authentication. This is ignored if I(api_key) is specified.
type: str
port:
default: 443
description:
- The port number to connect to the PAN-OS device on.
type: int
serial_number:
description:
- The serial number of a firewall to use for targeted commands. If I(ip_address)
is not a Panorama PAN-OS device, then this param is ignored.
type: str
username:
default: admin
description:
- The username to use for authentication. This is ignored if I(api_key) is specified.
type: str
type: dict
version_added: 1.0.0
version_added_collection: paloaltonetworks.panos
rulebase:
choices:
- pre-rulebase
- rulebase
- post-rulebase
description:
- The rulebase in which the rule is to exist. If left unspecified, this defaults
to I(rulebase=pre-rulebase) for Panorama. For NGFW, this is always set to be I(rulebase=rulebase).
type: str
services:
description:
- List of services.
elements: str
type: list
username:
default: admin
description:
- B(Deprecated)
- Use I(provider) to specify PAN-OS connectivity instead.
- HORIZONTALLINE
- The username to use for authentication. This is ignored if I(api_key) is specified.
type: str
group_tag:
description:
- PAN-OS 9.0 and above.
- The group tag.
type: str
ip_address:
description:
- B(Deprecated)
- Use I(provider) to specify PAN-OS connectivity instead.
- HORIZONTALLINE
- The IP address or hostname of the PAN-OS device being configured.
type: str
source_hip:
description:
- The source HIP info.
elements: str
type: list
description:
description:
- The rule description.
type: str
log_setting:
description:
- PAN-OS 10.0 and above.
- The log setting.
type: str
device_group:
default: shared
description:
- (Panorama only) The device group the operation should target.
type: str
source_users:
description:
- The source users.
elements: str
type: list
source_zones:
description:
- List of source zones.
elements: str
type: list
audit_comment:
description:
- Add an audit comment to the rule being defined.
- This is only applied if there was a change to the rule.
type: str
existing_rule:
description: "- If I(location=before) or I(location=after), this option specifies\n\
\ an existing rule name. The rule being managed by this module will\n be positioned\
\ relative to the value of this parameter.\n- Required if I(location=before) or\
\ I(location=after).\n"
type: str
negate_source:
description:
- Negate the source addresses.
type: bool
negate_target:
description:
- Applicable for Panorama only.
- Negate the value for I(target).
type: bool
url_categories:
description:
- List of URL categories.
- When referencing predefined EDLs, use config names of the EDLS not their full names.
The config names can be found with the CLI... request system external-list show
type predefined-url name <tab> panw-auth-portal-exclude-list panw-auth-portal-exclude-list
elements: str
type: list
decryption_type:
choices:
- ssl-forward-proxy
- ssh-proxy
- ssl-inbound-inspection
description:
- The decryption type.
type: str
destination_hip:
description:
- The source HIP info.
elements: str
type: list
gathered_filter:
description:
- When I(state=gathered).
- An advanced filtering option to filter results returned from PAN-OS.
- Refer to the guide discussing I(gathered_filter) for more information.
type: str
ssl_certificate:
description:
- The SSL certificate.
type: str
source_addresses:
description:
- List of source addresses.
- This can be an IP address, an address object/group, etc.
- When referencing predefined EDLs, use config names of the EDLS not their full names.
The config names can be found with the CLI... request system external-list show
type predefined-ip name <tab> panw-bulletproof-ip-list panw-bulletproof-ip-list
panw-highrisk-ip-list panw-highrisk-ip-list panw-known-ip-list panw-known-ip-list
panw-torexit-ip-list panw-torexit-ip-list
elements: str
type: list
destination_zones:
description:
- List of destination zones.
elements: str
type: list
decryption_profile:
description:
- The decryption profile.
type: str
forwarding_profile:
description:
- The forwarding profile.
type: str
negate_destination:
description:
- Negate the destination addresses.
type: bool
destination_addresses:
description:
- List of destination addresses.
- This can be an IP address, an address object/group, etc.
- When referencing predefined EDLs, use config names of the EDLS not their full names.
The config names can be found with the CLI... request system external-list show
type predefined-ip name <tab> panw-bulletproof-ip-list panw-bulletproof-ip-list
panw-highrisk-ip-list panw-highrisk-ip-list panw-known-ip-list panw-known-ip-list
panw-torexit-ip-list panw-torexit-ip-list
elements: str
type: list
log_failed_tls_handshakes:
description:
- PAN-OS 10.0 and above.
- Log failed TLS handshakes.
type: bool
log_successful_tls_handshakes:
description:
- PAN-OS 10.0 and above.
- Log successful TLS handshakes.
type: bool