spatula

This Ansible role applies security best practice templates to Palo Alto Networks devices.

Purpose

This role leverages the Iron Skillet best practice templates to ensure that PAN-OS firewalls are configured in accordance with Palo Alto Networks best practice recommendations. These templates are downloaded from the following GitHub repo when the playbook is executed and applied to each device or to a Panorama management console.

• https://github.com/PaloAltoNetworks/iron-skillet

A Best Practices Assessment may be run following the application of these templates in order to gauge the effectiveness of the resulting configuration.

Requirements

This role utilizes the Python libraries listed below. All are available via PyPI and may be installed using the pip installer. The use of virtualenv is recommended in order to avoid system library conflicts.

• pandevice - Framework for interacting with Palo Alto Networks devices via API
• pan-python - Multi-tool set for Palo Alto Networks PAN-OS, Panorama, WildFire and AutoFocus
• xmltodict - Convert between XML string and Python dict
• passlib - Comprehensive password hashing framework supporting over 30 schemes

Role Variables

The variables used in this role are listed in the table below, along with default values (see defaults/main.yml). Variables in lowercase are playbook variables while UPPERCASE variables are used for Jinja2 variable substitution in the configuration templates. Some variables are marked as Panorama only while others are applicable to both Panorama and firewalls.

Dependencies

This role is dependent on the official Palo Alto Networks Ansible modules, which are contained in the following Galaxy role:

• PaloAltoNetworks.paloaltonetworks

The Palo Alto Networks Ansible modules utilize a provider dict for passing inventory and authentication credentials. This dict may be defined once in the playbook with values for the variables ip_address, username, and password passed in via any supported method.

vars:
  credentials:
    ip_address: '{{ ip_address }}'
    username: '{{ username }}'
    password: '{{ password }}'

Example Playbooks

The following are examples of Ansible playbooks that leverage this role to apply security best practice templates to Panorama and a firewall:

Panorama:

---
- name: Stage Panorama with best practice templates for PAN-OS 9.0
  hosts: all
  connection: local
  gather_facts: False

  vars:
    credentials:
      ip_address: '{{ ip_address }}'
      username: '{{ username }}'
      password: '{{ password }}'
    device_type: 'panorama'
    template_version: 'panos_v9.0'
  vars_files:
    - panorama_vars.yml
      
  roles:
    - role: PaloAltoNetworks.spatula

Firewall:

---
- name: Stage firewall with best practice templates for PAN-OS 8.1
  hosts: all
  connection: local
  gather_facts: False

  vars:
    credentials:
      ip_address: '{{ ip_address }}'
      username: '{{ admin }}'
      password: '{{ password }}'
    device_type: 'panos'
    template_version: 'panos_v8.1'
  vars_files:
    - fw_vars.yml
      
  roles:
    - role: PaloAltoNetworks.spatula

License

Apache 2.0

Author Information

Role created by Robert Hagen (@stealthllama).