Try SpotterManage Policy Based Forwarding rules on PAN-OS.
| "added in version" 1.0.0 of paloaltonetworks.panos"
Authors: Garfield Lee Freeman (@shinmog)
Install with ansible-galaxy collection install paloaltonetworks.panos:==2.19.1
collections:
- name: paloaltonetworks.panos
version: 2.19.1Manage Policy Based Forwarding rules on PAN-OS.
- name: add a pbf rule
paloaltonetworks.panos.panos_pbf_rule:
provider: '{{ provider }}'
name: 'my-pbf'
description: 'Made by Ansible'
from_value: ['myZone']
action: 'discard'
name:
description:
- Name of the rule.
type: str
port:
default: 443
description:
- B(Deprecated)
- Use I(provider) to specify PAN-OS connectivity instead.
- HORIZONTALLINE
- The port number to connect to the PAN-OS device on.
type: int
tags:
description:
- List of tags.
elements: str
type: list
uuid:
description:
- The rule UUID.
- Note that this is currently more of a read-only field.
- Usage of the UUID cannot currently take the place of using the rule name as the
primary identifier.
type: str
vsys:
default: vsys1
description:
- The vsys this object belongs to.
type: str
state:
choices:
- present
- absent
- replaced
- merged
- deleted
- gathered
default: present
description:
- The state.
type: str
action:
choices:
- forward
- forward-to-vsys
- discard
- no-pbf
default: forward
description:
- The action to take.
type: str
target:
description:
- Applicable for Panorama only.
- Apply this rule exclusively to the listed firewall serial numbers.
elements: str
type: list
api_key:
description:
- B(Deprecated)
- Use I(provider) to specify PAN-OS connectivity instead.
- HORIZONTALLINE
- The API key to use instead of generating it using I(username) / I(password).
type: str
disabled:
description:
- Disable this rule.
type: bool
location:
choices:
- top
- bottom
- before
- after
description:
- Position to place the rule in.
type: str
password:
description:
- B(Deprecated)
- Use I(provider) to specify PAN-OS connectivity instead.
- HORIZONTALLINE
- The password to use for authentication. This is ignored if I(api_key) is specified.
type: str
provider:
description:
- A dict object containing connection details.
suboptions:
api_key:
description:
- The API key to use instead of generating it using I(username) / I(password).
type: str
ip_address:
description:
- The IP address or hostname of the PAN-OS device being configured.
type: str
password:
description:
- The password to use for authentication. This is ignored if I(api_key) is specified.
type: str
port:
default: 443
description:
- The port number to connect to the PAN-OS device on.
type: int
serial_number:
description:
- The serial number of a firewall to use for targeted commands. If I(ip_address)
is not a Panorama PAN-OS device, then this param is ignored.
type: str
username:
default: admin
description:
- The username to use for authentication. This is ignored if I(api_key) is specified.
type: str
type: dict
version_added: 1.0.0
version_added_collection: paloaltonetworks.panos
rulebase:
choices:
- pre-rulebase
- rulebase
- post-rulebase
description:
- The rulebase in which the rule is to exist. If left unspecified, this defaults
to I(rulebase=pre-rulebase) for Panorama. For NGFW, this is always set to be I(rulebase=rulebase).
type: str
schedule:
description:
- The schedule.
type: str
services:
default:
- any
description:
- List of services.
elements: str
type: list
username:
default: admin
description:
- B(Deprecated)
- Use I(provider) to specify PAN-OS connectivity instead.
- HORIZONTALLINE
- The username to use for authentication. This is ignored if I(api_key) is specified.
type: str
from_type:
choices:
- zone
- interface
default: zone
description:
- Source from type.
type: str
group_tag:
description:
- The group tag.
type: str
from_value:
description:
- The source values for the given type.
elements: str
type: list
ip_address:
description:
- B(Deprecated)
- Use I(provider) to specify PAN-OS connectivity instead.
- HORIZONTALLINE
- The IP address or hostname of the PAN-OS device being configured.
type: str
description:
description:
- The description.
type: str
applications:
default:
- any
description:
- List of applications.
elements: str
type: list
device_group:
default: shared
description:
- (Panorama only) The device group the operation should target.
type: str
forward_vsys:
description:
- The vsys to forward to if action is set to forward to a vsys.
type: str
source_users:
default:
- any
description:
- List of source users.
elements: str
type: list
audit_comment:
description:
- Add an audit comment to the rule being defined.
- This is only applied if there was a change to the rule.
type: str
existing_rule:
description: "- If I(location=before) or I(location=after), this option specifies\n\
\ an existing rule name. The rule being managed by this module will\n be positioned\
\ relative to the value of this parameter.\n- Required if I(location=before) or\
\ I(location=after).\n"
type: str
negate_source:
description:
- Set to negate the source.
type: bool
negate_target:
description:
- Applicable for Panorama only.
- Negate the value for I(target).
type: bool
gathered_filter:
description:
- When I(state=gathered).
- An advanced filtering option to filter results returned from PAN-OS.
- Refer to the guide discussing I(gathered_filter) for more information.
type: str
source_addresses:
default:
- any
description:
- List of source IP addresses.
- When referencing predefined EDLs, use config names of the EDLS not their full names.
The config names can be found with the CLI... request system external-list show
type predefined-ip name <tab> panw-bulletproof-ip-list panw-bulletproof-ip-list
panw-highrisk-ip-list panw-highrisk-ip-list panw-known-ip-list panw-known-ip-list
panw-torexit-ip-list panw-torexit-ip-list
elements: str
type: list
negate_destination:
description:
- Set to negate the destination.
type: bool
destination_addresses:
default:
- any
description:
- List of destination addresses.
- When referencing predefined EDLs, use config names of the EDLS not their full names.
The config names can be found with the CLI... request system external-list show
type predefined-ip name <tab> panw-bulletproof-ip-list panw-bulletproof-ip-list
panw-highrisk-ip-list panw-highrisk-ip-list panw-known-ip-list panw-known-ip-list
panw-torexit-ip-list panw-torexit-ip-list
elements: str
type: list
forward_next_hop_type:
choices:
- ip-address
- fqdn
description:
- The next hop type.
- Leave this as None for a next hop type of 'None'.
- To specify a next-hop of none, leave this parameter unset.
type: str
forward_next_hop_value:
description:
- The next hop value if forward next hop type is not None.
type: str
forward_monitor_profile:
description:
- The monitor profile to use.
type: str
forward_egress_interface:
description:
- The egress interface.
type: str
forward_monitor_ip_address:
description:
- The monitor IP address.
type: str
symmetric_return_addresses:
description:
- List of symmetric return addresses.
elements: str
type: list
enable_enforce_symmetric_return:
description:
- Set to enforce symmetric return.
type: bool
forward_monitor_disable_if_unreachable:
description:
- Set to disable this rule if nexthop / monitor IP is unreachable.
type: bool