Hi,
Thanks for your suggestion but i just now checked asa_facts doesn't gather
mac address. The modules for ASA are not as feature rich nor extensive as
that for network routers and switches (ios).
So iam wondering if i should consider this workaround: as mentioned above,
end the 1st play playbook after reload. Then write 2nd playbook referencing
standby firewall in 'hosts' column and keep below TASK as first task. So
the script aill automatically take access to standby firewall (the active
firewall that reloaded and became standby now) and check if IOS is
upgraded, etc. But only issue is that i don't know when the standby
firewall may come up, so 2nd play may fail to connect and playbook may end.
So can i use ignore_errors keyword for 2nd playbook as a whole instead of
specific tasks (as i have used below)?
- name: 2ND PLAY FOR ASA UPGRADE
hosts: STANDBYFIREWALL
gather_facts: false
connection: network_cli
vars:
ansible_network_os: asa
tasks:
- name: WAIT FOR
wait_for:
host: "{{ ansible_host }}"
port: 22
delay: 300
timeout: 4800
delegate_to: localhost
ignore_errors: yes
- name: sleep for 10 more minutes and continue with play
wait_for:
timeout: 600
delegate_to: localhost
- name: WAIT FOR
wait_for:
host: "{{ ansible_host }}"
port: 22
delay: 300
timeout: 4800
delegate_to: localhost
Thanks,
Vikram
On Sunday, 8 August, 2021 at 11:17:12 pm UTC+5:30 melvins...@gmail.com
wrote:
> Just a thought.
> Try to gather the MAC address from the fact, register it and save it as a
> local file?
>
> Write a play with two tasks,
> One for ping test.
> Second for ios validation.
> Schedule this job for every 5 min and it should gather the fact and match
> the mac saved in the local file.
> Another task is, the job should run the ios version fetch command and save
> it in the local file.
>
> Remember. Your inventory should be updated with the hoatname of fw, or
> static ip.
> You can use jinja template for preparing the report.
>
> On Sun, 8 Aug, 2021, 10:17 pm Vikram S, <vikrams...@gmail.com> wrote:
>
>> I am trying to write a script for IOS upgrade of active-standby ASA
>> firewall (failover pair).
>>
>> 2 firewalls are configured as Active-standby firewall for failover
>> purpose. Which means if the active firewall goes down, standby firewall
>> automatically becomes the active and standby also takes over the IP of
>> active firewall and this is what creates hurdle in writing script for ASA.
>>
>> Below is the script i have written for Routers and is successfully
>> working but facing a challenge in writing similar script for ASA firewall.
>> I have given the portion where script waits for router to come back UP
>> after reboot and then checks if image is successfully upgraded. But when i
>> upgrade and reboot active firewall, standby firewall would immediately
>> become active and script would detect the wrong device to be UP and would
>> be checking the ios image of wrong device.
>>
>> I thought of writing multiple plays within same playbook wherein the 1st
>> play would end after reboot and 2nd play would check the standby device
>> (the active would have become standby after reboot since the earlier
>> standby took over as active) but issue is firewall may take anywhere
>> between 10-50 mins to reboot and come back UP. So my 2nd play would fail
>> immediately unless i use wait_for module for certain minutes before
>> continuing with 2nd play. Downside to this approach is many a times,
>> firewall would come back earlier than the time set in wait_for module and
>> precious time wasted.
>>
>>
>> - name: WRITE TO MEMORY
>>
>> ios_config:
>>
>> save_when: always
>>
>> vars:
>>
>> ansible_command_timeout: 180
>>
>>
>> - name: RELOAD DEVICE
>>
>> ios_command:
>>
>> commands:
>>
>> - command: 'reload'
>>
>> prompt: '[confirm]'
>>
>> answer: 'y'
>>
>> vars:
>>
>> ansible_command_timeout: 180
>>
>>
>> - name: WAIT FOR ROUTER TO REBOOT
>>
>> wait_for:
>>
>> host: "{{ ansible_host }}"
>>
>> port: 22
>>
>> delay: 300
>>
>> timeout: 4800
>>
>> delegate_to: localhost
>>
>>
>> - name: GATHER NEW DEVICE FACTS
>>
>> ios_facts:
>>
>>
>> - assert:
>>
>> that:
>>
>> - ansible_net_version is version('16.12.04', '==')
>>
>> fail_msg: "IMAGE WAS NOT UPGRADED. PLAYBOOK IS ENDING"
>>
>> success_msg: "IMAGE HAS BEEN SUCCESSFULLY UPGRADED"
>>
>>
>>
>> Thanks,
>>
>> Vikram
>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "Ansible Project" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to ansible-proje...@googlegroups.com.
>> To view this discussion on the web visit
>> https://groups.google.com/d/msgid/ansible-project/d1068dc0-0d8a-4b6d-85c4-963f722677c8n%40googlegroups.com
>>
>> <https://groups.google.com/d/msgid/ansible-project/d1068dc0-0d8a-4b6d-85c4-963f722677c8n%40googlegroups.com?utm_medium=email&utm_source=footer>
>> .
>>
>
--
You received this message because you are subscribed to the Google Groups
"Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to ansible-project+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/ansible-project/dcf47a0a-54ef-4328-b6ba-d7c4270b2b3cn%40googlegroups.com.
