Deploy Via Ansible on FMC

[fmugambi]

Hello Team,

Been trying to use ansible on FMC 7.4.5, to update host objects and manual NATs.
1. Been able to update  the host objects, but having challenges on the deployment of the same.
This is because, from the GUI, when I want to deploy, there is a prompt to ignore some warnings , not errors. How do you cater for this warnings from the ansible playbook, not to stop the playbook from running.

2. On the updating the manual NATs, i need assistance, not able to have it running.

Regards,

[Torbjørn]

Hello @fmugambi,

1. You need to add "ignoreWarning: True" to your createDeploymentRequest step. See the following example from the Github repository:

- name: Execute 'createDeploymentRequest' operation
  cisco.fmcansible.fmc_configuration:
    operation: "createDeploymentRequest"
    data:
        type: DeploymentRequest
        version: 1457566762351
        forceDeploy: False
        ignoreWarning: True
        deviceList: ['d94f7ada-d141-11e5-acf3-c41f7e67fb1b']
        deploymentNote: yournotescomehere
    path_params:
        domainUUID: "{{ domain_uuid }}"

2. Can you elaborate here, I am not sure that I am interpreting your issue correctly.

[fmugambi]

First of all, thankyou very much, problem 1 worked end-to-end.

On problem 2, i have nat config as below,with the respective objects;

nat (Inside,Outside) source static PROD-K8S-LOCAL -PROD-K8S-NAT description PROD-IPS

object-group network PROD-K8S-LOCAL
description PRODUCTION K8S NODES
network-object 192.168.45.150 255.255.255.255
network-object 192.168.45.203 255.255.255.255
network-object 192.168.45.205 255.255.255.255
network-object 192.168.45.45.207 255.255.255.255

object network PROD-K8S-NAT
host 100.169.239.177

I would like to use ansible to change the source nat pool to a different group , as below ,

nat (Inside,Outside) source static DR-PROD-K8S-LOCAL PROD-K8S-NAT description DR-PROD-IPS

object-group network DR-PROD-K8S-LOCAL
description DR-PRODUCTION K8S NODES
network-object 192.168.40.150 255.255.255.255
network-object 192.168.40.203 255.255.255.255
network-object 192.168.40.205 255.255.255.255
network-object 192.168.40.45.207 255.255.255.255

Question, 
1. Is it possible to use same example as above to just change the group objects to the new source pool?
2. if we don't want to amend the objects, how can ansible change the NAT command as a whole, to change the source pool.

Thank you.

[Torbjørn]

1. It should be fine to just alter the NAT rule for the new object. 
2. You can only have one NAT rule for a given destination object, you must hence either alter or replace the existing NAT rule fully.

[fmugambi]

Please help with the ansible playbook for this.

[Torbjørn]

There's a sample for configuring NAT in the Ansible module Github repo. It's a good place to start.
If you need further assistance with this, can you post the relevant sections of your current playbook? 

[fmugambi]

Hi, went ahead and configured the playbook,
getting attached error,

what operation do i need to invoke, note am doing a source pool to an external ip translation, then false on the outside interface.
below is the code where the output is complaining,

- name: Get the Source Network Pool Object (Pointing-To-ADC)
cisco.fmcansible.fmc_configuration:
operation: getAllNetworkGroupObject
query_params:
filter: 'nameOrValue:PROD-K8S-LOCAL'
path_params:
domainUUID: '{{ domain[0].uuid }}'
register_as: source_network

- name: Get the translated network object
cisco.fmcansible.fmc_configuration:
operation: getAllNetworkGroupObject
query_params:
filter: 'nameOrValue:PROD-K8S-NAT'
path_params:
domainUUID: '{{ domain[0].uuid }}'
register_as: translated_network

what could I be missing?

[Torbjørn]

You look to be well on your way to get this working!

You should be using getAllNetworkObject here. This also encompasses group objects.

[fmugambi]

Thanks, passed that level, but got to a different roadblock,

Below is my code,

- name: Get the Source Network Pool Object (Pointing-To-ADC)
cisco.fmcansible.fmc_configuration:
operation: getAllNetworkObject
query_params:
filter: 'nameOrValue:EADC-PROD-K8S-LOCAL'
path_params:
domainUUID: '{{ domain[0].uuid }}'
register_as: source_network

- name: Fail if source network not found
fail:
msg: "Source network object 'EADC-PROD-K8S-LOCAL' not found."
when: source_network | length == 0

Wonder why yet from the device itself the object exists;

Thanks

[Torbjørn]

I'm sorry @fmugambi, I misremembered the usage of getAllNetworkObject in regards to group objects. You should use getAllNetworkGroup there instead. The parameters should be the same so you'll only have to change the operation.

[fmugambi]

Got it ,
wha  if the object is just host, what operation do I use?

[fmugambi]

i think i Got it;
getAllHostObject

[fmugambi]

so far so good, nat seems to have worked,
allow me to include the deployment code on the playbook, to have it run end-to-end i.e work on the nat and deploy the changes,
will update here.
thankyou so much for your help to this point.

[Torbjørn]

That would be getAllHostObject, same parameters used there.
The list of all available operations can be found under the docs in the Github repository

EDIT: Wrote this before I saw the reply above. You're correct!

[fmugambi]

hello @Torbjørn ,
was able to successfully deploy the nat but sorry, run into another issue.
instead of replacing the nat 1 to nat 2, i have ended up creating nat 1 and nat 2?
what can i do just to replace not add?
thanks.