panos_nat_rule – create a policy NAT rule — Ansible Documentation

- AnsibleFest
- Products
- Community
- Webinars & Training
- Blog

Documentation

# panos_nat_rule – create a policy NAT rule

New in version 2.4.

- DEPRECATED
- Synopsis
- Requirements
- Parameters
- Notes
- Examples
- Status

## DEPRECATED

Removed in Ansible:
| version: 2.12
Why: | Consolidating code base.
Alternative: | Use https://galaxy.ansible.com/PaloAltoNetworks/paloaltonetworks instead.

## Synopsis

- - Create a policy nat rule. Keep in mind that we can either end up configuring source NAT, destination NAT, or both. Instead of splitting it into two we will make a fair attempt to determine which one the user wants.

## Requirements

The below requirements are needed on the host that executes this module.

- pan-python can be obtained from PyPI https://pypi.org/project/pan-python/
- pandevice can be obtained from PyPI https://pypi.org/project/pandevice/

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
api_key - |  | API key that can be used instead of username/password credentials.
commit boolean | Choices: no yes ← | Commit configuration if changed.
description - |  | The description
destination_ip - | Default: ["any"] | list of destination addresses
destination_zone - / required |  | destination zone
devicegroup - |  | If Panorama, the device group to put this rule in.
dnat_address - |  | dnat translated address
dnat_port - |  | dnat translated port
ip_address - / required |  | IP address (or hostname) of PAN-OS device being configured.
operation - / required | Choices: add update delete find | The action to be taken. Supported values are add/update/find/delete.
password - / required |  | Password credentials to use for auth unless api_key is set.
rule_name - / required |  | name of the SNAT rule
service - | Default: "any" | service
snat_address_type - | Choices: interface-address ← translated-address | type of source translation. Supported values are translated-address/translated-address.
snat_bidirectional boolean | Choices: no ← yes | bidirectional flag
snat_dynamic_address - |  | Source NAT translated address. Used with Dynamic-IP and Dynamic-IP-and-Port.
snat_interface - |  | snat interface
snat_interface_address - |  | snat interface address
snat_static_address - |  | Source NAT translated address. Used with Static-IP translation.
snat_type - | Choices: static-ip dynamic-ip-and-port dynamic-ip | type of source translation
source_ip - | Default: ["any"] | list of source addresses
source_zone - / required |  | list of source zones
tag_name - |  | Tag for the NAT rule.
to_interface - | Default: "any" | Destination interface.
username - | Default: "admin" | Username credentials to use for auth unless api_key is set.

## Notes

Note

- Checkmode is not supported.
- Panorama is supported.

## Examples

    # Create a source and destination nat rule
      - name: Create NAT SSH rule for 10.0.1.101
        panos_nat_rule:
          ip_address: '{{ ip_address }}'
          username: '{{ username }}'
          password: '{{ password }}'
          rule_name: "Web SSH"
          source_zone: ["external"]
          destination_zone: "external"
          source: ["any"]
          destination: ["10.0.0.100"]
          service: "service-tcp-221"
          snat_type: "dynamic-ip-and-port"
          snat_interface: "ethernet1/2"
          dnat_address: "10.0.1.101"
          dnat_port: "22"

## Status

- This module will be removed in version 2.12. [deprecated]
- For more information see DEPRECATED.

### Authors

- Luigi Mori (@jtschichold), Ivan Bojer (@ivanbojer), Robert Hagen (@rnh556)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.