panos_nat_rule – create a policy NAT rule

New in version 2.4.

DEPRECATED

Removed in Ansible

version: 2.12

Why

Consolidating code base.

Alternative

Use https://galaxy.ansible.com/PaloAltoNetworks/paloaltonetworks instead.

Synopsis

    • Create a policy nat rule. Keep in mind that we can either end up configuring source NAT, destination NAT, or both. Instead of splitting it into two we will make a fair attempt to determine which one the user wants.

Requirements

The below requirements are needed on the host that executes this module.

Parameters

Parameter Choices/Defaults Comments
api_key
-
API key that can be used instead of username/password credentials.
commit
boolean
    Choices:
  • no
  • yes ←
Commit configuration if changed.
description
-
The description
destination_ip
-
Default:
["any"]
list of destination addresses
destination_zone
- / required
destination zone
devicegroup
-
If Panorama, the device group to put this rule in.
dnat_address
-
dnat translated address
dnat_port
-
dnat translated port
ip_address
- / required
IP address (or hostname) of PAN-OS device being configured.
operation
- / required
    Choices:
  • add
  • update
  • delete
  • find
The action to be taken. Supported values are add/update/find/delete.
password
- / required
Password credentials to use for auth unless api_key is set.
rule_name
- / required
name of the SNAT rule
service
-
Default:
"any"
service
snat_address_type
-
    Choices:
  • interface-address ←
  • translated-address
type of source translation. Supported values are translated-address/translated-address.
snat_bidirectional
boolean
    Choices:
  • no ←
  • yes
bidirectional flag
snat_dynamic_address
-
Source NAT translated address. Used with Dynamic-IP and Dynamic-IP-and-Port.
snat_interface
-
snat interface
snat_interface_address
-
snat interface address
snat_static_address
-
Source NAT translated address. Used with Static-IP translation.
snat_type
-
    Choices:
  • static-ip
  • dynamic-ip-and-port
  • dynamic-ip
type of source translation
source_ip
-
Default:
["any"]
list of source addresses
source_zone
- / required
list of source zones
tag_name
-
Tag for the NAT rule.
to_interface
-
Default:
"any"
Destination interface.
username
-
Default:
"admin"
Username credentials to use for auth unless api_key is set.

Notes

Note

  • Checkmode is not supported.

  • Panorama is supported.

Examples

# Create a source and destination nat rule
  - name: Create NAT SSH rule for 10.0.1.101
    panos_nat_rule:
      ip_address: '{{ ip_address }}'
      username: '{{ username }}'
      password: '{{ password }}'
      rule_name: "Web SSH"
      source_zone: ["external"]
      destination_zone: "external"
      source: ["any"]
      destination: ["10.0.0.100"]
      service: "service-tcp-221"
      snat_type: "dynamic-ip-and-port"
      snat_interface: "ethernet1/2"
      dnat_address: "10.0.1.101"
      dnat_port: "22"

Status

  • This module will be removed in version 2.12. [deprecated]

  • For more information see DEPRECATED.

Authors

  • Luigi Mori (@jtschichold), Ivan Bojer (@ivanbojer), Robert Hagen (@rnh556)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.