I am trying to write a script for IOS upgrade of active-standby ASA firewall (failover pair).
2 firewalls are configured as Active-standby firewall for failover purpose. Which means if the active firewall goes down, standby firewall automatically becomes the active and standby also takes over the IP of active firewall and this is what creates hurdle in writing script for ASA.
Below is the script i have written for Routers and is successfully working but facing a challenge in writing similar script for ASA firewall. I have given the portion where script waits for router to come back UP after reboot and then checks if image is successfully upgraded. But when i upgrade and reboot active firewall, standby firewall would immediately become active and script would detect the wrong device to be UP and would be checking the ios image of wrong device.
I thought of writing multiple plays within same playbook wherein the 1st play would end after reboot and 2nd play would check the standby device (the active would have become standby after reboot since the earlier standby took over as active) but issue is firewall may take anywhere between 10-50 mins to reboot and come back UP. So my 2nd play would fail immediately unless i use wait_for module for certain minutes before continuing with 2nd play. Downside to this approach is many a times, firewall would come back earlier than the time set in wait_for module and precious time wasted.
name: WRITE TO MEMORY
ios_config:
save_when: always
vars:
ansible_command_timeout: 180
name: RELOAD DEVICE
ios_command:
commands:
command: ‘reload’
prompt: ‘[confirm]’
answer: ‘y’
vars:
ansible_command_timeout: 180
name: WAIT FOR ROUTER TO REBOOT
wait_for:
host: “{{ ansible_host }}”
port: 22
delay: 300
timeout: 4800
delegate_to: localhost
name: GATHER NEW DEVICE FACTS
ios_facts:
assert:
that:
ansible_net_version is version(‘16.12.04’, ‘==’)
fail_msg: “IMAGE WAS NOT UPGRADED. PLAYBOOK IS ENDING”
success_msg: “IMAGE HAS BEEN SUCCESSFULLY UPGRADED”
Just a thought.
Try to gather the MAC address from the fact, register it and save it as a local file?
Write a play with two tasks,
One for ping test.
Second for ios validation.
Schedule this job for every 5 min and it should gather the fact and match the mac saved in the local file.
Another task is, the job should run the ios version fetch command and save it in the local file.
Remember. Your inventory should be updated with the hoatname of fw, or static ip.
You can use jinja template for preparing the report.
Thanks for your suggestion but i just now checked asa_facts doesn’t gather mac address. The modules for ASA are not as feature rich nor extensive as that for network routers and switches (ios).
So iam wondering if i should consider this workaround: as mentioned above, end the 1st play playbook after reload. Then write 2nd playbook referencing standby firewall in ‘hosts’ column and keep below TASK as first task. So the script aill automatically take access to standby firewall (the active firewall that reloaded and became standby now) and check if IOS is upgraded, etc. But only issue is that i don’t know when the standby firewall may come up, so 2nd play may fail to connect and playbook may end. So can i use ignore_errors keyword for 2nd playbook as a whole instead of specific tasks (as i have used below)?
name: 2ND PLAY FOR ASA UPGRADE
hosts: STANDBYFIREWALL
gather_facts: false
connection: network_cli
Create a task in your play with a shell module to do arp to all your hosts. Just filter the destination Mac and save it via jinja.
It would be great if you can establish any connection before you do the arp, else you won’t get the output.
I kind of accidently managed to find solution. Writing below script solved the issue. My earlier assumption was that ansible would connect to the device even before it would execute the 1st TASK but based on my teasting below script, iam thinking it probably connects when executing the first task in below script.