fw_config_lock.yml

---
# fw_config_lock.yml - Handle firewall config locking.
#
# Description
# ===========
#
# Quick example of how to handle PAN-OS automatic config locks.  This uses the Ansible 'retries' keyword to wait until
# there are no active config locks before continuing.
#
# This playbook requires connection details for the device to be specified in the variables 'ip_address', 'username',
# and 'password'.  These may be defined as host variables (see `host_vars/firewall.yml` for an example) or
# extra vars.
#
# Modules Used
# ============
#
# panos_op - https://paloaltonetworks.github.io/pan-os-ansible/modules/panos_op.html
#
# Usage
# =====
#
#   $ ansible-playbook -i inventory fw_config_lock.yml

- hosts: '{{ target | default("firewall") }}'
  connection: local

  vars:
    device:
      ip_address: '{{ ip_address }}'
      username: '{{ username | default(omit) }}'
      password: '{{ password | default(omit) }}'
      api_key: '{{ api_key | default(omit) }}'

    vsys: vsys1

  tasks:
    - name: Wait for config lock
      paloaltonetworks.panos.panos_op:
        provider: '{{ device }}'
        cmd: '<show><config-locks><vsys>{{ vsys }}</vsys></config-locks></show>'
        cmd_is_xml: true
      retries: 30
      delay: 10
      register: result
      until: result.stdout_xml == '<response status="success"><result><config-locks /></result></response>'

    - name: Acquire config lock
      paloaltonetworks.panos.panos_op:
        provider: '{{ device }}'
        cmd: '<request><config-lock><add><comment>Ansible config lock</comment></add></config-lock></request>'
        cmd_is_xml: true

    - name: Change configuration here.
      ansible.builtin.debug:
        msg: 'Configuration would be changed here'

    - name: Release config lock
      paloaltonetworks.panos.panos_op:
        provider: '{{ device }}'
        cmd: '<request><config-lock><remove></remove></config-lock></request>'
        cmd_is_xml: true