Option to connect directly to each firewall instead of using Panorama as proxy
Opened this issue · 5 comments
Is your feature request related to a problem? Please describe.
No but a potential one if too many calls to Panorama API endpoint.
Describe the solution you'd like
Provide a way to bypass default behaviour of proxying via Panorama
Describe alternatives you've considered
None
Additional context
We had issues when using upgrade assurance module in Ansible when proxying connection via Panorama
Hello @alexortize, the firewall subcommand targets the firewalls directly, does that solve your need?
Understood. A couple hurdles stand in the way and I'd be interested to getting your perspective:
Inventory
Panorama provides a source of inventory as well as the connection to the devices. If we decide to target the firewalls directly, then we need to find a way of gathering a list of the devices and their IP addresses.
Since this is already captured when we run the batch or inventory commands, I'll assume that we can continue to keep this logic intact, but it would require a Panorama to be within the environment to derive our list from, is that okay?
Workflow would be like this: target Panorama to get a list of the devices, then use the IP address returned to form direct connections to the firewalls.
Authentication
In order to pull this off, we would need to ensure that the authentication credentials work for both Panorama and every firewall. This may not be an issue for some environments, but it will pose challenges for others. Do you see any challenges with this requirement in your setup?
Multi-threading will prevent us from being able to prompt for unique username/password combinations across multiple firewalls.