# How to filter results from Palo Alto firewall

**URL:** <https://forum.ansible.com/t/how-to-filter-results-from-palo-alto-firewall/4877>\
**Category:** Get Help\
**Tags:** paloaltonetworks, network\
**Created:** [April 10, 2024, 9:51pm UTC](https://forum.ansible.com/t/how-to-filter-results-from-palo-alto-firewall/4877 "2024-04-10T21:51:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![acozine](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@acozine](https://forum.ansible.com/u/acozine)\
**Post date:** [April 10, 2024, 9:51pm UTC](https://forum.ansible.com/t/how-to-filter-results-from-palo-alto-firewall/4877/1 "2024-04-10T21:51:39Z")

</div>

I have what’s probably a newbie question about automating our Palo Alto firewall with Ansible.

I want to create a playbook that accepts an IP address or FQDN as a variable and returns all the objects with that IP/FQDN and all rules that apply to those objects. By adding this as a template in Tower, I’m trying to let developers answer the question, “My code isn’t working, could the firewall be my problem?” They enter the IP and get back a list of all the rules that apply to it.

My playbook authenticates and returns all objects or all rules with `gathered_filter: *`. So far, so good. I’d like to use `gathered_filter` to get only those rules that apply to the IP provided.

I want something like `gathered_filter: "<field> contains {{ ip_user_entered }}"` but I don’t know what I should put in the `<field>`. Where should I look for possible values for `<field>`?

The [examples in the documentation](https://paloaltonetworks.github.io/pan-os-ansible/gatheredfilter.html#examples) show three options: `description`, ‘name’ and ‘interfaces’. Are those the only fields available for filtering? Or should I be looking at the `gathered_xml`?

All suggestions, links, pointers welcome. Thanks!

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [April 10, 2024, 10:51pm UTC](https://forum.ansible.com/t/how-to-filter-results-from-palo-alto-firewall/4877/2 "2024-04-10T22:51:55Z")

</div>

I’m unable to assist specifically with filtering the initial gathered facts or with what PA returns, but you will probably need to do some jmespath magic to get the results you want.

---

<div class="post-metadata">

**Author:** ![acozine](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@acozine](https://forum.ansible.com/u/acozine)\
**Post date:** [April 11, 2024, 10:37pm UTC](https://forum.ansible.com/t/how-to-filter-results-from-palo-alto-firewall/4877/3 "2024-04-11T22:37:55Z")

</div>

Thanks for chiming in @Denney-tech!

It turns out that using `state: gathered` turns anything in the Ansible return values in the section marked `gathered` into a field you can filter. And strange as it seems, in this case the field to filter on turned out to be `value`.

I tracked this down by trial and error. I first created a task that retrieved all address objects using the `paloaltonetworks.panos.panos_address_object` module:

```auto
    - name: find address stuff with panos_address_object
      paloaltonetworks.panos.panos_address_object:
        provider: "{{ panos_provider }}"
        state: gathered
        gathered_filter: "*"
      register: address_stuff

```

Then I added a debug task with `var: address_stuff`, which gave me output like this (details scrubbed/anonymized):

```auto
{
  "address_stuff": {
    "changed": false,
    "gathered": [
      {
        "value": "123.456.78.90/32",
        "description": null,
        "tag": null,
        "name": "MyAddressObject",
        "address_type": "ip-netmask"
      },
      {
        "value": "123.456.0.0/16",
        "description": null,
        "tag": null,
        "name": "MySubnet",
        "address_type": "ip-netmask"
      },
      {
        "value": "10.10.10.0/18",
        "description": "other-subnetprivate",
        "tag": null,
        "name": "MyPrivateSubnet",
        "address_type": "ip-netmask"
      }
    ],
    "gathered_xml": [
      "details omitted here . . . "
    ],
    "failed": false
  },
  "_ansible_verbose_always": true,
  "_ansible_no_log": null,
  "changed": false
}

```

Then I tried a bunch of different things, most of which failed . . . and eventually I tried this and it worked:

```auto
    - name: find object with known IP
      paloaltonetworks.panos.panos_address_object:
        provider: "{{ panos_provider }}"
        state: gathered
        gathered_filter: "value contains 123.456.78.90"
      register: test_object

```

So it seems that in the pattern `gathered_filter: "<field> <operator> <value>"`, the available values for `<field>` include anything inside `gathered` in the Ansible return values, however odd it may look.

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [April 11, 2024, 10:52pm UTC](https://forum.ansible.com/t/how-to-filter-results-from-palo-alto-firewall/4877/4 "2024-04-11T22:52:48Z")

</div>

Glad you got it figured out! That’s actually pretty straightforward considering you didn’t need to do anything weird with jmespath.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [May 11, 2024, 10:53pm UTC](https://forum.ansible.com/t/how-to-filter-results-from-palo-alto-firewall/4877/5 "2024-05-11T22:53:34Z")

</div>

Closed on May 11, 2024, 10:53pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.