Update for PAN-OS 10.0 Device-ID/HIP features

[jamesholland-uk]

Describe the bug

With PAN-OS 10.0, commits fail after rules are created with Ansible using pan-os-python, due to a HIP profile issue

Expected behavior

Rules created with Ansible using pan-os-python should not cause commit errors to be generated later for PAN-OS 9.x firewalls

Current behavior

Rules created with Ansible using pan-os-python in 10.0 use an old style of XML configuration for HIP, which causes issues committing to 9.x firewalls

Possible solution

• Update pan-os-python to accommodate for 10.0 XML schema of source-hip and destination-hip, and still uses {{hip-profiles}}

Steps to reproduce

• Create a security rule on Panorama 10.0.x using Ansible.
• Whether HIP is explicitly defined in the user's Ansible playbook, or if the Ansible default 'any' is used, XML config {{hip-profiles}}{{member}}value-here{{/member}}{{/hip-profiles}} for HIP is created for this rule.
• This is pre-10.0 XML schema, where HIP profiles only applied to the source match criteria. Since 10.0 and the new Device-ID feature set, HIP applies to both source AND destination. In 10.0, the PAN-OS XML schema now expects two elements of {{source-hip}} and {{destination-hip}}, instead of the single {{hip-profiles}}.
• An admin attempts to modify this Ansible-created rule using the Panorama GUI/CLI.
• On saving the config, 10.0 Panorama presumably sees that {{source-hip}} and {{destination-hip}} are missing in the XML config for this rule, and creates those XML elements: {{source-hip}}{{member}}value-here{{/member}}{{/source-hip}}{{destination-hip}}{{member}}value-here{{/member}}{{/destination-hip}}. However, the {{hip-profiles}} element is not removed from the XML config by 10.0 Panorama GUI/CLI.
• The rule now has {{hip-profiles}} and {{source-hip}} and {{destination-hip}} XML elements.
• When Panorama attempts to push and commit this rule to a 9.1.x firewall, it presumably converts the {{source-hip}} element to a {{hip-profiles}} element to be backwards compatible.
• At this point, two {{hip-profiles}} elements exist for the rule exist, and validation fails, terminating the commit without changes being made to the firewall.

Your Environment

• Version used: Panorama 10.0.5, NGFW 9.1.6

[github-actions[bot]]

:tada: This issue has been resolved in version 1.4.0 :tada:

The release is available on PyPI and GitHub release

Posted by semantic-release bot

[2ps]

Please reopen -- this has reared its head in an ugly way with 10.2.x and 10.1.5 where hip-profiles has now been removed from support and causes commits to fail.