Exporting and importing ASM/AWAF security policies with Ansible and Terraform
MVPExample of using seperate plays to first play delete the old local asm policy file and then just for group "bigip" the second play exports and imports the ASM policy. If you are using different F5 devices for production and preproduction then just make different host groups and seperate plays (in one play for preprod that exports and one play for prod that imports the ASM policy).
---
- name: Deliting old files
hosts: all
connection: local
vars_prompt:
- name: asm_policy
prompt: What is the name of the ASM policy?
private: no
tasks:
- name: Ansible delete file example
file:
path: "/home/niki/asm_policy/{{ asm_policy }}"
state: absent
when: inventory_hostname in groups['internal']
- set_fact: "asm_fact={{ asm_policy }}"
- name: Import and export the ASM policy
hosts: bigip
connection: local
become: yes
vars:
provider:
password: "{{ bigip_password }}"
server: "{{ ansible_host }}"
user: "{{ bigip_username }}"
validate_certs: no
server_port: 443
tasks:
- name: Export policy in XML format
bigip_asm_policy_fetch:
name: "{{ asm_fact }}_preprod"
file: "{{ asm_fact }}"
dest: /home/niki/asm_policy/
binary: yes
provider: "{{ provider }}"
- name: Override existing ASM policy
bigip_asm_policy_import:
name: "{{ asm_fact }}_prod"
source: "/home/niki/asm_policy/{{ asm_fact }}"
force: yes
provider: "{{ provider }}"
notify:
- Save the running configuration to disk
- name: Task - deactivate policy
bigip_asm_policy_manage:
name: "{{ asm_fact }}_prod"
state: present
provider: "{{ provider }}"
active: no
- name: Task - activate policy
bigip_asm_policy_manage:
name: "{{ asm_fact }}_prod"
state: present
provider: "{{ provider }}"
active: yes
handlers:
- name: Save the running configuration to disk
bigip_config:
save: yes
provider: "{{ provider }}"
Another way to share the policy name variable between hosts again with facts is using a dummy host to attach it and this way you don't need to use "all" in the first play to attach the fact under all the hosts.
---
- name: Deliting old files
hosts: internal
connection: local
vars_prompt:
- name: asm_policy
prompt: What is the name of the ASM policy?
private: no
tasks:
- name: Ansible delete file example
file:
path: "/home/niki/asm_policy/{{ asm_policy }}"
state: absent
- name: set a variable
set_fact:
shared_variable: "{{ asm_policy }}"
- name: add variables to dummy host
add_host:
name: "variable_holder"
shared_variable: "{{ shared_variable }}"
- name: Import and export the ASM policy
hosts: bigip
connection: local
become: yes
vars:
asm_fact: "{{ hostvars['variable_holder']['shared_variable'] }}"
provider:
password: "{{ bigip_password }}"
server: "{{ ansible_host }}"
user: "{{ bigip_username }}"
validate_certs: no
server_port: 443