---
title: "Build AI-assisted firewall workflows with Ansible Automation Platform"
description: "The workflow replaces a manual, fragmented process for turning a simple ServiceNow connectivity request into firewall changes. Event-Driven Ansible connects ServiceNow, GitHub, an LLM, and two Palo Alto Networks firewalls, checking drift, gathering topology data, and coordinating structured rule proposals, pull requests, and workflow records. Ansible Automation Platform keeps credentials away from the AI and deploys approved rules through a deterministic, idempotent path after engineer and CAB approvals. GitHub’s main branch records the last successful state, proposed changes are reviewed as Configuration as Code, and execution stops when live configuration differs from the intended state. The lab demonstrates partial coverage, no coverage, and an unresolvable request; failed deployments can roll back, while an undefined Palo Alto Networks App-ID stops the workflow for human intervention."
---

# Build AI-assisted firewall workflows with Ansible Automation Platform

[Red Hat](https://yomu.fyi/company/red-hat) · Michal Zdyb · Sep 4, 2026

**Type:** Problem & solution

## Summary

The workflow replaces a manual, fragmented process for turning a simple ServiceNow connectivity request into firewall changes. Event-Driven Ansible connects ServiceNow, GitHub, an LLM, and two Palo Alto Networks firewalls, checking drift, gathering topology data, and coordinating structured rule proposals, pull requests, and workflow records. Ansible Automation Platform keeps credentials away from the AI and deploys approved rules through a deterministic, idempotent path after engineer and CAB approvals. GitHub’s main branch records the last successful state, proposed changes are reviewed as Configuration as Code, and execution stops when live configuration differs from the intended state. The lab demonstrates partial coverage, no coverage, and an unresolvable request; failed deployments can roll back, while an undefined Palo Alto Networks App-ID stops the workflow for human intervention.

## Context

The source describes a manual, slow, and fragmented process for handling firewall connectivity requests, involving tickets, email and chat, information gathering, technical analysis, manual firewall changes, and duplicated documentation across disconnected systems.

## Approach / What changed

Event-Driven Ansible orchestrates ServiceNow, GitHub, an LLM, and two Palo Alto Networks firewalls. The LLM analyzes network paths and proposes structured rules, while humans approve a pull request and ServiceNow change request before Ansible Automation Platform validates, deploys, records, and potentially rolls back the change.

## Takeaways

- The LLM proposes firewall rules, traffic-path analysis, rationale, and change-record content, but it does not connect to devices, access credentials, or deploy changes.
- The workflow uses two human approval gates: engineer approval of the GitHub pull request and Change Advisory Board approval of the ServiceNow change request.
- Drift detection compares live firewall configuration with GitHub’s intended state; mismatches stop execution and are recorded in ServiceNow rather than allowing automation to proceed.

**Tags:** [AI](https://yomu.fyi/topic/ai), [Ansible](https://yomu.fyi/topic/ansible), [Architecture](https://yomu.fyi/topic/architecture), [Deployment](https://yomu.fyi/topic/deployment), [Security](https://yomu.fyi/topic/security)

- Source: [Red Hat](https://developers.redhat.com/articles/2026/09/04/build-ai-assisted-firewall-workflows-ansible-automation-platform)
- Source URL: https://developers.redhat.com/articles/2026/09/04/build-ai-assisted-firewall-workflows-ansible-automation-platform
- Ingested by Yomu: 2026-09-04T08:00:52.768Z

[Read original post](https://developers.redhat.com/articles/2026/09/04/build-ai-assisted-firewall-workflows-ansible-automation-platform)