# Update security\_rule in PanOS

**URL:** <https://forum.ansible.com/t/update-security-rule-in-panos/7803>\
**Category:** Get Help\
**Tags:** paloaltonetworks, network\
**Created:** [August 12, 2024, 7:02pm UTC](https://forum.ansible.com/t/update-security-rule-in-panos/7803 "2024-08-12T19:02:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![acozine](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@acozine](https://forum.ansible.com/u/acozine)\
**Post date:** [August 12, 2024, 7:02pm UTC](https://forum.ansible.com/t/update-security-rule-in-panos/7803/1 "2024-08-12T19:02:17Z")

</div>

We have an existing PanOS firewall (with Panorama) that contains an obsolete IP range object. That object is used as a 'source\_ip` in several rules. I’d like to use Ansible to update those rules to remove the obsolete source IP, and eventually delete the object entirely.

We have been able to gather a dictionary of all the rules that use this obsolete source IP using `state: gathered` and `gathered_filter`. So far, so good.

But we are stuck on updating rules. We started with the simplest possible scenario - update a single rule. The docs for the [panos\_security\_rule module](https://paloaltonetworks.github.io/pan-os-ansible/modules/panos_security_rule_module.html) offer two values for `state` that seem like they are meant to update existing rules - `replaced` and `merged` - but there are no examples for either one, and no explanation of the difference between them. There’s also no indication of which fields are required, or what happens to the rule if Ansible passes some fields but not others. Can we just pass the new `source_ip` value and leave everything else unchanged? Or do we have to pass all existing settings for the rule?

Can anyone point me to examples of tasks that update existing rules in a PanOS firewall? Or if there’s a better way to achieve what we are trying to do, point me in that direction?

Thanks,  
Alicia

---

<div class="post-metadata">

**Author:** ![jiholland](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jiholland/32/11273_2.png) [@jiholland](https://forum.ansible.com/u/jiholland)\
**Post date:** [November 6, 2024, 7:50am UTC](https://forum.ansible.com/t/update-security-rule-in-panos/7803/2 "2024-11-06T07:50:08Z")

</div>

You can see some examples, along with required options, by using the `ansible-doc` command (or in [Github](https://github.com/PaloAltoNetworks/pan-os-ansible/blob/develop/plugins/modules/panos_security_rule.py)):

```yaml
$ ansible-doc paloaltonetworks.panos.panos_security_rule

```

States offered by network resource modules should be the same for every network module. From [doc](https://docs.ansible.com/ansible/latest/network/user_guide/network_resource_modules.html):

- `State merged:`  
Ansible merges the on-device configuration with the provided configuration in the task.

- `State replaced:`  
Ansible replaces the on-device configuration subsection with the provided configuration subsection in the task.

---

<div class="post-metadata">

**Author:** ![acozine](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@acozine](https://forum.ansible.com/u/acozine)\
**Post date:** [November 6, 2024, 4:23pm UTC](https://forum.ansible.com/t/update-security-rule-in-panos/7803/3 "2024-11-06T16:23:02Z")

</div>

Oh, awesome, thanks @jiholland!

In the interim we tried a different approach - we exported the entire contents of our test firewall as an XML document, changed the XML, then re-imported the entire document. This worked - the rules we wanted to change were updated and we were able to delete the obsolete object.

There was one surprise: one of the changed rules got `ruletype: universal` added to it in the test firewall, even though we did not add that to the XML.

We’ll try `state replaced` next to see how updating a subsection works, though we also want to have the contents of the firewall under source control, so I suspect we will use the all-rules approach in the long run.

Thanks again!