PaloAltoNetworks/pan-os-ansible

Playbook hangs using panos_commit_firewall

nishthaGupta opened this issue · 2 comments

Describe the bug

Hello,

I have a use case wherein I need to load a standard day 1 configuration on the firewall device. The new config is supposed to delete the existing users & reset the admin password to default.
I am using panos_loadcfg & panos_commit_firewall modules for the same. I want to keep retrying the commit until the result is success since a failure is expected for the first or second time.

My usage is as follows:name: Commit the config changes

      - name: Load the configuration 
       paloaltonetworks.panos.panos_loadcfg:
        ip_address: '{{ ansible_host }}'
        username: "user"
        password: "password"
        file: '{{ inventory_hostname }}.xml'

       - name: Commit it
          paloaltonetworks.panos.panos_commit_firewall:
            provider: '{{ provider }}'
          register: rs
          until: rs is success
          retries: 10

What I am observing is that the playbook execution hangs after the commit gets successful within the device but the status isnt reflected over the control node. When I forcefully kill the process & login to the device, I can see that the new config file was loaded successfully. I want to understand why the playbook execution hangs & how can I overcome this problem?

Expected behavior

The above code snippet should work & playbook should gracefully stop execution upon a successful commit.

Current behavior

The playbook execution hangs.

Ansible version used: 2.15.4

🎉 Thanks for opening your first issue here! Welcome to the community!

Hi @nishthaGupta, currently we do not have enough detail to troubleshoot this problem. Please provide debug output from the execution of the playbook.

One thing to consider: Is the playbook changing the admin credentials which are used by Ansible? If so, when the commit is successfully completed, will the credentials used by Ansible no longer be valid, and hence Ansible is unable to continue polling the device to ascertain if the commit was successful?