Repository navigation
feat(panos): add LLDP port discovery to PAN-OS inspect interface - #2564
Open
khackworth wants to merge 7 commits into
Open
khackworth wants to merge 7 commits into
khackworth wants to merge 7 commits into
Conversation
Python test results466 tests 461 ✅ 30s ⏱️ Results for commit 924db13. ♻️ This comment has been updated with latest results. |
khackworth
force-pushed
the
panos-inspect-lldp-ports
branch
from
October 23, 2026 15:13
c1fc47f to
9e6c459
Compare
khackworth
changed the title
khackworth
force-pushed
the
panos-inspect-lldp-ports
branch
4 times, most recently
from
October 23, 2026 18:57
5632021 to
d76ad65
Compare
khackworth
marked this pull request as ready for review
October 23, 2026 19:04
khackworth
enabled auto-merge
October 23, 2026 19:04
Adds automatic network port discovery to PAN-OS firewalls during inspection using LLDP neighbor discovery. Implementation: 1. Removes factory default zone and virtual-wire configurations that would block interface configuration 2. Enables LLDP globally and configures it on all physical interfaces 3. Waits 30 seconds for LLDP neighbor discovery 4. Creates Ironic ports with local_link_connection metadata including: - switch_id (chassis ID) - port_id (remote port identifier) - switch_info (normalized FQDN switch name) 5. Derives VLAN groups from switch names using existing conventions 6. Removes temporary LLDP configuration to clean up Port creation: - Handles re-inspection gracefully by checking for existing ports by both MAC address and port name - Normalizes switch names to FQDN format (adds .rackspace.net suffix) to match baremetal server port format - Uses correct config group path for switch_name_vlan_group_mapping IMPORTANT: This modifies device configuration and deletes factory default settings. It should ONLY run during initial enrollment when the device is in 'manageable' state, before any production configuration exists. The inspect interface is only called during enrollment, never on already-configured devices.
- Remove virtual-wire config from each interface before configuring as layer3 - Only commit factory cleanup if we actually deleted something - Check commit return values and fail loudly with proper errors - Include job details in commit failure error messages This fixes inspection failures on devices with virtual-wire interfaces configured, where commits were silently failing and code continued anyway.
Security rules reference zones, so they must be deleted first to avoid validation errors when cleaning up factory/staging config for LLDP discovery. This allows inspect to work on devices that have been through a staging station that adds generic security rules.
Simplified LLDP discovery to configure all interfaces instead of trying to detect which ones are already configured. Since the device must be in manageable (not production) state, we can be destructive and just blast through all interfaces. This fixes the issue where ethernet1/1 and ethernet1/2 had virtual-wire config that was detected as 'configured', causing them to be skipped, which meant they never got LLDP enabled.
- Remove verbose DEBUG logs showing full XML responses and config operations from panos_api.py - Remove per-interface deletion logs (22 lines per run) - Add single summary log showing which factory configs were deleted - Use contextlib.suppress for cleaner exception handling - Keep essential INFO logs for key events (neighbor discovery, port creation)
Ruff S110 requires specific exception types instead of bare except Exception. This also improves error handling by only catching the expected exception type.
khackworth
force-pushed
the
panos-inspect-lldp-ports
branch
from
October 23, 2026 20:08
d76ad65 to
924db13
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements automatic LLDP neighbor discovery during PAN-OS device inspection to populate port MAC addresses and local_link_connection data.
Changes
_discover_and_update_ports()to enable LLDP, wait for neighbor discovery, and update portsTesting
Draft PR to build container image for testing in dev environment with device PaloAlto-026701009584.