Sorry, I misstyped. It is R81.10 ofc. It is just an ansible executable, no tower awx whatsoever.
I am doing the following:
- name: set objects and layers
block:
- name: set policy/package
check_point.mgmt.cp_mgmt_package:
name: "{{ role_var_checkpoint_mgmt.default_policy }}"
access: true
auto_publish_session: yes
installation_targets: "{{ host_var_checkpoint_mgmt.default_gw }}"
- name: set access layer
check_point.mgmt.cp_mgmt_access_layer:
name: "{{ role_var_checkpoint_mgmt.default_access_layer }}"
applications_and_url_filtering: yes
content_awareness: yes
firewall: yes
implicit_cleanup_action: drop
auto_publish_session: yes
- name: set hosts
check_point.mgmt.cp_mgmt_host:
name: "{{ item.Name }}"
ip_address: "{{ item.IPv4_address }}"
comments: "{{ item.Comments }}"
color: "{{ item.Color|default(role_var_checkpoint_mgmt.default_color) }}"
with_items: "{{ cp_hosts }}"
notify: set session
- name: set networks
check_point.mgmt.cp_mgmt_network:
name: "{{ item.Name }}"
color: "{{ item.Color|default(role_var_checkpoint_mgmt.default_color) }}"
comments: "{{ item.Comments }}"
subnet_mask: "{{ item.Mask }}"
subnet4: "{{ item.IPv4_address }}"
with_items: "{{ cp_nets }}"
notify: set session
## more tasks about objects (groups, access-roles, services, etc.) and rules
rescue:
- name: discard any unpublished changes
check_point.mgmt.cp_mgmt_discard:
I am setting up my policy and layer, looping through all my objects and rules and if anything fails I discard anything. If there are no errors the handlers set a session, publish and install. Take everything or nothing, so no half finished/wrongly set policy is getting installed, therefore publishing every $ objects is not an option. The publishing and installing works fine, the part about looping over the objects does take a lot of time (up to 10 secs per object). My object and rule "database", the config file does not only represent changes to be made but includes the whole ruleset, so the playbook is intended to identify differences between my config file and the actual installed/published policy (which works fine, but slow). So therefore I always have the whole ruleset saved in a git which is great for disaster recovery. This procedure also means that often only a few changes are made (i.e.: 4-5) but the whole ruleset needs to be parsed. The "publish every $ objects" would not work here, as there are only 4-5 objects to publish.
ansible.cfg is quite simple:
[defaults]
roles_path = ./roles
ansible_managed = NOTICE: This file was deployed automatically, manual changes will be lost when re-deploying.
# show "[CHECK MODE]" for every task
check_mode_markers = yes
# do not display tasks that did not change anything
display_ok_hosts = no
display_skipped_hosts = no
[ssh_connection]
pipelining = True
