panos_match_rule – Test for match against a security rule on PAN-OS devices or Panorama management console.

From Get docs
Ansible/docs/2.7/modules/panos match rule module


panos_match_rule – Test for match against a security rule on PAN-OS devices or Panorama management console.

New in version 2.5.


Synopsis

  • Security policies allow you to enforce rules and take action, and can be as general or specific as needed.

Requirements

The below requirements are needed on the host that executes this module.

Parameters

Parameter Choices/Defaults Comments

api_key

-

API key that can be used instead of username/password credentials.

application

-

The application.

category

-

URL category

destination_ip

-

The destination IP address.

destination_port

-

The destination port.

destination_zone

-

The destination zone.

ip_address

- / required

IP address (or hostname) of PAN-OS device being configured.

password

- / required

Password credentials to use for auth unless api_key is set.

protocol

-

The IP protocol number from 1 to 255.

rule_type

-

Default:

"security"

Type of rule. Valid types are security or nat.

source_ip

- / required

The source IP address.

source_port

-

The source port.

source_user

-

The source user or group.

source_zone

-

The source zone.

to_interface

-

The inbound interface in a NAT rule.

username

-

Default:

"admin"

Username credentials to use for auth unless api_key is set.

vsys_id

- / required

Default:

"vsys1"

ID of the VSYS object.



Notes

Note

  • Checkmode is not supported.
  • Panorama NOT is supported.


Examples

- name: check security rules for Google DNS
  panos_match_rule:
    ip_address: '{{ ip_address }}'
    username: '{{ username }}'
    password: '{{ password }}'
    rule_type: 'security'
    source_ip: '10.0.0.0'
    destination_ip: '8.8.8.8'
    application: 'dns'
    destination_port: '53'
    protocol: '17'
  register: result
- debug: msg='{{result.stdout_lines}}'

- name: check security rules inbound SSH with user match
  panos_match_rule:
    ip_address: '{{ ip_address }}'
    username: '{{ username }}'
    password: '{{ password }}'
    rule_type: 'security'
    source_ip: '0.0.0.0'
    source_user: 'mydomain\jsmith'
    destination_ip: '192.168.100.115'
    destination_port: '22'
    protocol: '6'
  register: result
- debug: msg='{{result.stdout_lines}}'

- name: check NAT rules for source NAT
  panos_match_rule:
    ip_address: '{{ ip_address }}'
    username: '{{ username }}'
    password: '{{ password }}'
    rule_type: 'nat'
    source_zone: 'Prod-DMZ'
    source_ip: '10.10.118.50'
    to_interface: 'ethernet1/2'
    destination_zone: 'Internet'
    destination_ip: '0.0.0.0'
    protocol: '6'
  register: result
- debug: msg='{{result.stdout_lines}}'

- name: check NAT rules for inbound web
  panos_match_rule:
    ip_address: '{{ ip_address }}'
    username: '{{ username }}'
    password: '{{ password }}'
    rule_type: 'nat'
    source_zone: 'Internet'
    source_ip: '0.0.0.0'
    to_interface: 'ethernet1/1'
    destination_zone: 'Prod DMZ'
    destination_ip: '192.168.118.50'
    destination_port: '80'
    protocol: '6'
  register: result
- debug: msg='{{result.stdout_lines}}'

- name: check security rules for outbound POP3 in vsys4
  panos_match_rule:
    ip_address: '{{ ip_address }}'
    username: '{{ username }}'
    password: '{{ password }}'
    vsys_id: 'vsys4'
    rule_type: 'security'
    source_ip: '10.0.0.0'
    destination_ip: '4.3.2.1'
    application: 'pop3'
    destination_port: '110'
    protocol: '6'
  register: result
- debug: msg='{{result.stdout_lines}}'

Status

Authors

  • Robert Hagen (@rnh556)

Hint

If you notice any issues in this documentation you can edit this document to improve it.


© 2012–2018 Michael DeHaan
© 2018–2019 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/2.7/modules/panos_match_rule_module.html