Deploy Via Ansible on FMC

[fmugambi]

Hello Team,

Been trying to use ansible on FMC 7.4.5, to update host objects and manual NATs.
1. Been able to update  the host objects, but having challenges on the deployment of the same.
This is because, from the GUI, when I want to deploy, there is a prompt to ignore some warnings , not errors. How do you cater for this warnings from the ansible playbook, not to stop the playbook from running.

2. On the updating the manual NATs, i need assistance, not able to have it running.

Regards,

[Torbjørn · Accepted solution]

I would just add a step that removes the old one, either before or after the creation of the new one.

[fmugambi]

Hi,
been trying this over the weekend, got very stuck > the deletion bit.
i have multiple static manual Nats, I would not wish to affect the rest , just specific one.
Been using the source and destination IP address to use to filter the nat rule to delete to no joy.
when i debug i notice the nats output in form of either, 'id' 'links' ' type' but id & links seem as the unique identifiers.
question if say the current nat rule i wish to delete is 2, and its successfully deleted, then the new added one id is 8, next time if i want to delete this new nat, i must change my playbook?
or am i missing something?

[Torbjørn]

You should find the correct rule by filtering for specified attributes(as you have been trying) to avoid hardcoding IDs. Can you post the relevant parts of your playbook along with the error message you are receiving?

[fmugambi]

- name: Get the already existing nat pool to delete
cisco.fmcansible.fmc_configuration:
operation: getAllNetworkGroup
query_params:
filter: 'nameOrValue:DR-PROD-K8S-LOCAL'
path_params:
domainUUID: '{{ domain[0].uuid }}'
register_as: delete_source_network

- name: Fail if source network object to be deleted 'DR-PROD-K8S-LOCAL' not found
fail:
msg: "Source network object 'DR-PROD-K8S-LOCAL' not found."
when: delete_source_network | length == 0

- name: Get the translated network object from the intended to delete nat pool
cisco.fmcansible.fmc_configuration:
operation: getAllHostObject
query_params:
filter: 'nameOrValue:DR-PROD-K8S-NAT'
path_params:
domainUUID: '{{ domain[0].uuid }}'
register_as: delete_translated_network

- name: Fail if translated network object on the to be deleted source pool 'DR-PROD-K8S-NAT' not found
fail:
msg: "Translated network object for the pool to be deleted 'DR-PROD-K8S-NAT' not found."
when: delete_translated_network | length == 0

- name: Get FTD Manual NAT Rules for 'DR-NATs' to delete
cisco.fmcansible.fmc_configuration:
operation: "getAllFTDManualNatRule"
path_params:
containerUUID: "{{ natpolicy.id }}"
domainUUID: "{{ domain[0].uuid }}"
register_as: natrule_to_delete

- name: Debug Nat Rule to Delete
debug:
var: natrule_to_delete

- name: Find NAT rule with matching source and translated addresses to delete
set_fact:
rule_to_delete: "{{ natrule_to_delete.results | selectattr('originalSource.id', 'equalto', delete_source_network[0].id) | selectattr('translatedSource.id', 'equalto', delete_translated_network[0].id) | list | first }}"

- name: Fail if no matching NAT rule is found to delete
fail:
msg: "NAT rule with source 'DR-PROD-K8S-LOCAL' and translated source 'DR-PROD-K8S-NAT' not found."
when: rule_to_delete is not defined

- name: Delete the NAT rule
cisco.fmcansible.fmc_configuration:
operation: deleteFTDManualNatRule
path_params:
containerUUID: "{{ natpolicy.id }}"
domainUUID: "{{ domain[0].uuid }}"
objectId: "{{ rule_to_delete.id }}"

[fmugambi]

ASK [Find NAT rule with matching source and translated addresses to delete] *****************************************************************************************
fatal: [DR-FMCv]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: 'list object' has no attribute 'results'. 'list object' has no attribute 'results'\n\nThe error appears to be in '/etc/ansible/NAT_FAILOVER/dr-ftd-starting_traffic.yaml': line 130, column 7, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n - name: Find NAT rule with matching source and translated addresses to delete\n ^ here\n"}

PLAY RECAP ***********************************************************************************************************************************************************
DR-FMCv : ok=12 changed=0 unreachable=0 failed=1 skipped=5 rescued=0 ignored=0

[Torbjørn]

What's the output of the debug "Debug Nat Rule to Delete"?

[fmugambi]

[fmugambi]

hi,
i included the expanded: rue under below code,
- name: Get FTD Manual NAT Rules for 'ICOLO-NATs' to delete
cisco.fmcansible.fmc_configuration:
operation: "getAllFTDManualNatRule"
path_params:
containerUUID: "{{ natpolicy.id }}"
domainUUID: "{{ domain[0].uuid }}"
query_params:
expanded: true
register_as: natrule_to_delete

it worked, it deleted the nat i wanted to delete, but didnt replace with one i wanted.
when i try to re-run the command it fails since it wont find the dr network objects.

not sure what am missing to have this seamless

[fmugambi]

TASK [Find NAT rule with matching source and translated addresses to delete] *****************************************************************************************
fatal: [DR-FMCv]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: No first item, sequence was empty.. No first item, sequence was empty.\n\nThe error appears to be in '/etc/ansible/DR_FAILOVER/adc-ftd-starting_traffic.yaml': line 132, column 7, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n - name: Find NAT rule with matching source and translated addresses to delete\n ^ here\n"}

PLAY RECAP ***********************************************************************************************************************************************************
DR-FMCv : ok=12 changed=0 unreachable=0 failed=1 skipped=5 rescued=0 ignored=0

[fmugambi]

wonder why its skipping this step to translate,

[Torbjørn]

Ansible only makes changes when it needs to. In this case the new NAT rule already exists, so it doesn't need to create them and skips the step.