Spatula

This Ansible role helps apply security best practice templates to Palo Alto Networks devices.

Purpose

This role uses the Iron Skillet templates to ensure that PAN-OS firewalls are set up according to Palo Alto Networks' best practice guidelines. When you run the playbook, it downloads these templates from the GitHub repository mentioned below and applies them to each device or a Panorama management console.

• https://github.com/PaloAltoNetworks/iron-skillet

After applying these templates, you can run a Best Practices Assessment to check how effective the configuration is.

Requirements

This role uses the Python libraries listed below. You can get them from PyPI and install using pip. It's advisable to use virtualenv to prevent any conflicts with system libraries.

• pandevice - Interact with Palo Alto Networks devices through API
• pan-python - Toolkit for PAN-OS, Panorama, WildFire, and AutoFocus
• xmltodict - Convert XML strings to Python dictionaries
• passlib - A framework for secure password hashing with many supported schemes

Role Variables

Below are the variables used in this role with their default values (see defaults/main.yml). Variables in lowercase are for the playbook while UPPERCASE variables are for Jinja2 templates in the configuration. Some variables are for Panorama only, while others work for both Panorama and firewalls.

Dependencies

This role relies on the official Palo Alto Networks Ansible modules found in this Galaxy role:

• PaloAltoNetworks.paloaltonetworks

The Palo Alto Networks Ansible modules use a dict for passing inventory and authentication details. This dict can be set up once in the playbook like this:

vars:
  credentials:
    ip_address: '{{ ip_address }}'
    username: '{{ username }}'
    password: '{{ password }}'

Example Playbooks

Here are examples of Ansible playbooks that use this role to apply security best practice templates on Panorama and a firewall:

Panorama:

---
- name: Setup Panorama with best practice templates for PAN-OS 9.0
  hosts: all
  connection: local
  gather_facts: False

  vars:
    credentials:
      ip_address: '{{ ip_address }}'
      username: '{{ username }}'
      password: '{{ password }}'
    device_type: 'panorama'
    template_version: 'panos_v9.0'
  vars_files:
    - panorama_vars.yml
      
  roles:
    - role: PaloAltoNetworks.spatula

Firewall:

---
- name: Setup firewall with best practice templates for PAN-OS 8.1
  hosts: all
  connection: local
  gather_facts: False

  vars:
    credentials:
      ip_address: '{{ ip_address }}'
      username: '{{ admin }}'
      password: '{{ password }}'
    device_type: 'panos'
    template_version: 'panos_v8.1'
  vars_files:
    - fw_vars.yml
      
  roles:
    - role: PaloAltoNetworks.spatula

License

Apache 2.0

Author Information

This role was created by Robert Hagen (@stealthllama).