amnesh.soodar.soodar_acls module – Manages ACLs on Soodar devices.

Note

This module is part of the amnesh.soodar collection (version 1.0.0).

To install it, use: ansible-galaxy collection install https://soodar.ir/ansible/amnesh.soodar.tar.gz.

To use it in a playbook, specify: amnesh.soodar.soodar_acls.

New in amnesh.soodar 1.0

Synopsis

  • This module configures and manages ACLs on Soodar platforms.

Note

This module has a corresponding action plugin.

Parameters

Parameter

Comments

config

list / elements=dictionary

A dictionary of ACL options.

acls

list / elements=dictionary

A list of Access Control Lists (ACL).

aces

list / elements=dictionary

The entries within the ACL.

destination

dictionary

Specify the packet destination.

address

string

Host prefix to match.

any

boolean

Match any destination address.

Choices:

  • false

  • true

port_protocol

dictionary

Specify the destination port along with protocol.

Note, Valid with TCP/UDP protocol_options

eq

string

Match only packets on a given port number.

gt

string

Match only packets with a greater port number.

lt

string

Match only packets with a lower port number.

range

dictionary

Port group.

end

integer

Specify the end of the port range.

start

integer

Specify the start of the port range.

grant

string

Specify the action.

Choices:

  • "permit"

  • "deny"

protocol

string

Specify the protocol to match.

Refer to vendor documentation for valid values.

protocol_options

dictionary

protocol type.

ahp

boolean

Authentication Header Protocol.

Choices:

  • false

  • true

eigrp

boolean

Cisco’s EIGRP routing protocol.

Choices:

  • false

  • true

esp

boolean

Encapsulation Security Payload.

Choices:

  • false

  • true

gre

boolean

Cisco’s GRE tunneling.

Choices:

  • false

  • true

hbh

boolean

Hop by Hop options header. Valid for IPV6

Choices:

  • false

  • true

icmp

dictionary

Internet Control Message Protocol.

administratively_prohibited

boolean

Administratively prohibited

Choices:

  • false

  • true

alternate_address

boolean

Alternate address

Choices:

  • false

  • true

conversion_error

boolean

Datagram conversion

Choices:

  • false

  • true

dod_host_prohibited

boolean

Host prohibited

Choices:

  • false

  • true

dod_net_prohibited

boolean

Net prohibited

Choices:

  • false

  • true

echo

boolean

Echo (ping)

Choices:

  • false

  • true

echo_reply

boolean

Echo reply

Choices:

  • false

  • true

general_parameter_problem

boolean

Parameter problem

Choices:

  • false

  • true

host_isolated

boolean

Host isolated

Choices:

  • false

  • true

host_precedence_unreachable

boolean

Host unreachable for precedence

Choices:

  • false

  • true

host_redirect

boolean

Host redirect

Choices:

  • false

  • true

host_tos_redirect

boolean

Host redirect for TOS

Choices:

  • false

  • true

host_tos_unreachable

boolean

Host unreachable for TOS

Choices:

  • false

  • true

host_unknown

boolean

Host unknown

Choices:

  • false

  • true

host_unreachable

boolean

Host unreachable

Choices:

  • false

  • true

information_reply

boolean

Information replies

Choices:

  • false

  • true

information_request

boolean

Information requests

Choices:

  • false

  • true

mask_reply

boolean

Mask replies

Choices:

  • false

  • true

mask_request

boolean

mask_request

Choices:

  • false

  • true

mobile_redirect

boolean

Mobile host redirect

Choices:

  • false

  • true

net_redirect

boolean

Network redirect

Choices:

  • false

  • true

net_tos_redirect

boolean

Net redirect for TOS

Choices:

  • false

  • true

net_tos_unreachable

boolean

Network unreachable for TOS

Choices:

  • false

  • true

net_unreachable

boolean

Net unreachable

Choices:

  • false

  • true

network_unknown

boolean

Network unknown

Choices:

  • false

  • true

no_room_for_option

boolean

Parameter required but no room

Choices:

  • false

  • true

option_missing

boolean

Parameter required but not present

Choices:

  • false

  • true

packet_too_big

boolean

Fragmentation needed and DF set

Choices:

  • false

  • true

parameter_problem

boolean

All parameter problems

Choices:

  • false

  • true

port_unreachable

boolean

Port unreachable

Choices:

  • false

  • true

precedence_unreachable

boolean

Precedence cutoff

Choices:

  • false

  • true

protocol_unreachable

boolean

Protocol unreachable

Choices:

  • false

  • true

reassembly_timeout

boolean

Reassembly timeout

Choices:

  • false

  • true

redirect

boolean

All redirects

Choices:

  • false

  • true

router_advertisement

boolean

Router discovery advertisements

Choices:

  • false

  • true

router_solicitation

boolean

Router discovery solicitations

Choices:

  • false

  • true

source_quench

boolean

Source quenches

Choices:

  • false

  • true

source_route_failed

boolean

Source route failed

Choices:

  • false

  • true

time_exceeded

boolean

All time exceededs

Choices:

  • false

  • true

timestamp_reply

boolean

Timestamp replies

Choices:

  • false

  • true

timestamp_request

boolean

Timestamp requests

Choices:

  • false

  • true

traceroute

boolean

Traceroute

Choices:

  • false

  • true

ttl_exceeded

boolean

TTL exceeded

Choices:

  • false

  • true

unreachable

boolean

All unreachables

Choices:

  • false

  • true

igmp

boolean

Internet Gateway Message Protocol.

Choices:

  • false

  • true

ip

boolean

Any Internet Protocol.

Choices:

  • false

  • true

ipinip

boolean

IP in IP tunneling.

Choices:

  • false

  • true

ipv6

boolean

Any IPv6.

Choices:

  • false

  • true

nos

boolean

KA9Q NOS compatible IP over IP tunneling.

Choices:

  • false

  • true

ospf

boolean

OSPF routing protocol.

Choices:

  • false

  • true

pcp

boolean

Payload Compression Protocol.

Choices:

  • false

  • true

pim

boolean

Protocol Independent Multicast.

Choices:

  • false

  • true

protocol_number

integer

An IP protocol number

sctp

boolean

Stream Control Transmission Protocol.

Choices:

  • false

  • true

tcp

dictionary

Match TCP packet flags

ack

boolean

Match on the ACK bit

Choices:

  • false

  • true

established

boolean

Match established connections

Choices:

  • false

  • true

fin

boolean

Match on the FIN bit

Choices:

  • false

  • true

psh

boolean

Match on the PSH bit

Choices:

  • false

  • true

rst

boolean

Match on the RST bit

Choices:

  • false

  • true

syn

boolean

Match on the SYN bit

Choices:

  • false

  • true

urg

boolean

Match on the URG bit

Choices:

  • false

  • true

udp

boolean

User Datagram Protocol.

Choices:

  • false

  • true

sequence

integer

Sequence Number for the Access Control Entry(ACE).

Refer to vendor documentation for valid values.

source

dictionary

Specify the packet source.

address

string

Source network prefix.

any

boolean

Match any source address.

Choices:

  • false

  • true

port_protocol

dictionary

Specify the source port along with protocol.

Note, Valid with TCP/UDP protocol_options

eq

string

Match only packets on a given port number.

gt

string

Match only packets with a greater port number.

lt

string

Match only packets with a lower port number.

range

dictionary

Port group.

end

integer

Specify the end of the port range.

start

integer

Specify the start of the port range.

name

string / required

The name or the number of the ACL.

afi

string / required

The Address Family Indicator (AFI) for the Access Control Lists (ACL).

Choices:

  • "ipv4"

  • "ipv6"

running_config

string

This option is used only with state parsed.

The value of this option should be the output received from the Soodar device by executing the command sh access-list.

The state parsed reads the configuration from running_config option and transforms it into Ansible structured data as per the resource module’s argspec and the value is then returned in the parsed key within the result.

state

string

The state the configuration should be left in

The states merged is the default state which merges the want and have config, but for ACL module as the Soodar platform doesn’t allow update of ACE over an pre-existing ACE sequence in ACL, same way ACLs resource module will error out for respective scenario and only addition of new ACE over new sequence will be allowed with merge state.

The states rendered, gathered and parsed does not perform any change on the device.

The state rendered will transform the configuration in config option to platform specific CLI commands which will be returned in the rendered key within the result. For state rendered active connection to remote host is not required.

The state gathered will fetch the running configuration from device and transform it into structured data in the format as per the resource module argspec and the value is returned in the gathered key within the result.

The state parsed reads the configuration from running_config option and transforms it into JSON format as per the resource module parameters and the value is returned in the parsed key within the result. The value of running_config option should be the same format as the output of command show running-config | include ip route|ipv6 route executed on device. For state parsed active connection to remote host is not required.

Choices:

  • "merged" ← (default)

  • "replaced"

  • "overridden"

  • "deleted"

  • "gathered"

  • "rendered"

  • "parsed"

Notes

Note

  • Tested against Soodar Version 21.04

Examples

# Using Deleted

# Before state:
# -------------
#
# soodar# sh ip access-lists
# IP access list 110
#    10 deny icmp 192.0.2.0/24 192.0.3.0/24 traceroute
#    20 deny tcp host 198.51.100.0 host 198.51.110.0 eq telnet ack
# IP access list 123
#    10 deny tcp 198.51.100.0/24 198.51.101.0/24 eq telnet ack
#    20 deny tcp 192.0.3.0/24 192.0.4.0/24 eq www ack
# IP access list test
#    10 deny tcp 192.0.2.0/24 192.0.3.0/24 eq www fin
# IPv6 access list R1_TRAFFIC
#    10 deny tcp any eq www any eq telnet ack

- name: "Delete ACLs (Note: This won't delete the all configured ACLs)"
  amnesh.soodar.soodar_acls:
    config:
    - afi: ipv4
      acls:
      - name: test
        acl_type: extended
      - name: 110
    - afi: ipv6
      acls:
      - name: R1_TRAFFIC
    state: deleted

# Commands fired:
# ---------------
#
# - no ip access-list test
# - no ip access-list 110
# - no ipv6 access-list R1_TRAFFIC

# After state:
# -------------
#
# soodar# sh ip access-lists
# IP access list 123
#    10 deny tcp 198.51.100.0/24 198.51.101.0/24 eq telnet ack
#    20 deny tcp 192.0.3.0/24 192.0.4.0/24 eq www ack

# Before state:
# -------------
#
# soodar# sh ip access-lists
# IP access list 110
#    10 deny icmp 192.0.2.0/24 192.0.3.0/24 traceroute
#    20 deny tcp host 198.51.100.0 host 198.51.110.0 eq telnet ack
# IP access list 123
#    10 deny tcp 198.51.100.0/24 198.51.101.0/24 eq telnet ack
#    20 deny tcp 192.0.3.0/24 192.0.4.0/24 eq www ack
# IP access list test
#    10 deny tcp 192.0.2.0/24 192.0.3.0/24 eq www fin
# IPv6 access list R1_TRAFFIC
#    10 deny tcp any eq www any eq telnet ack

- name: "Delete ACLs based on AFI (Note: This won't delete the all configured ACLs)"
  amnesh.soodar.soodar_acls:
    config:
    - afi: ipv4
    state: deleted

# Commands fired:
# ---------------
#
# - no ip access-list test
# - no ip access-list 110
# - no ip access-list 123

# After state:
# -------------
#
# soodar# sh ip access-lists
# IPv6 access list R1_TRAFFIC
#    deny tcp any eq www any eq telnet ack

# Using Deleted without any config passed
#"(NOTE: This will delete all of configured ACLs)"

# Before state:
# -------------
#
# soodar# sh ip access-lists
# IP access list 110
#    10 deny icmp 192.0.2.0/24 192.0.3.0/24 traceroute
#    20 deny tcp host 198.51.100.0 host 198.51.110.0 eq telnet ack
# IP access list 123
#    10 deny tcp 198.51.100.0/24 198.51.101.0/24 eq telnet ack
#    20 deny tcp 192.0.3.0/24 192.0.4.0/24 eq www ack
# IP access list test
#    10 deny tcp 192.0.2.0/24 192.0.3.0/24 eq www fin
# IPv6 access list R1_TRAFFIC
#    10 deny tcp any eq www any eq telnet ack

- name: 'Delete ALL of configured ACLs (Note: This WILL delete the all configured
    ACLs)'
  amnesh.soodar.soodar_acls:
    state: deleted

# Commands fired:
# ---------------
#
# - no ip access-list test
# - no ip access-list 110
# - no ip access-list 123
# - no ip access-list test
# - no ipv6 access-list R1_TRAFFIC

# After state:
# -------------
#
# soodar# sh ip access-lists


# Using merged

# Before state:
# -------------
#
# soodar# sh ip access-lists
# IP access list 100
#    10 deny icmp 192.0.2.0/24 192.0.3.0/24 echo

- name: Merge provided configuration with device configuration
  amnesh.soodar.soodar_acls:
    config:
    - afi: ipv4
      acls:
      - name: 100
        aces:
        - sequence: 10
          protocol_options:
            icmp:
              traceroute: true
    state: merged

# After state:
# ------------
#
# Play Execution fails, with error:
# Cannot update existing sequence 10 of ACLs 100 with state merged.
# Please use state replaced or overridden.

# Before state:
# -------------
#
# soodar# sh ip access-lists
# IP access list 110
#    10 deny icmp 192.0.2.0/24 192.0.3.0/24 echo

- name: Merge provided configuration with device configuration
  amnesh.soodar.soodar_acls:
    config:
    - afi: ipv4
      acls:
      - name: 110
        aces:
        - sequence: 10
          protocol_options:
            icmp:
              traceroute: true
        - grant: deny
          protocol_options:
            tcp:
              ack: true
          source:
            address: 198.51.100.0/24
          destination:
            address: 198.51.110.0/24
            port_protocol:
              eq: telnet
      - name: test
        aces:
        - grant: deny
          protocol_options:
            tcp:
              fin: true
          source:
            address: 192.0.2.0/24
          destination:
            address: 192.0.3.0/24
            port_protocol:
              eq: www
      - name: 123
        aces:
        - grant: deny
          protocol_options:
            tcp:
              ack: true
          source:
            address: 198.51.100.0/24
          destination:
            address: 198.51.101.0/24
            port_protocol:
              eq: telnet
        - grant: deny
          protocol_options:
            tcp:
              ack: true
          source:
            address: 192.0.3.0/24
          destination:
            address: 192.0.4.0/24
            port_protocol:
              eq: www
    - afi: ipv6
      acls:
      - name: R1_TRAFFIC
        aces:
        - grant: deny
          protocol_options:
            tcp:
              ack: true
          source:
            any: true
            port_protocol:
              eq: www
          destination:
            any: true
            port_protocol:
              eq: telnet
    state: merged

# Commands fired:
# ---------------
#
# - ip access-list 110
# - 10 deny icmp 192.0.2.0/24 192.0.3.0/24 traceroute
# - deny tcp host 198.51.100.0 host 198.51.110.0 eq telnet ack
# - ip access-list test
# - deny tcp 192.0.2.0/24 192.0.3.0/24 eq www fin
# - ip access-list 123
# - deny tcp 198.51.100.0/24 198.51.101.0/24 eq telnet
# - deny tcp 192.0.3.0/24 192.0.4.0/24 eq www ack
# - ipv6 access-list R1_TRAFFIC
# - deny tcp any eq www any eq telnet ack

# After state:
# ------------
#
# soodar# sh ip access-lists
# IP access list 100
#    10 deny icmp 192.0.2.0/24 192.0.3.0/24 echo
# IP access list 110
#    10 deny icmp 192.0.2.0/24 192.0.3.0/24 traceroute
#    20 deny tcp host 198.51.100.0 host 198.51.110.0 eq telnet ack
# IP access list 123
#    10 deny tcp 198.51.100.0/24 198.51.101.0/24 eq telnet ack
#    20 deny tcp 192.0.3.0/24 192.0.4.0/24 eq www ack
# IP access list test
#    10 deny tcp 192.0.2.0/24 192.0.3.0/24 eq www fin
# IPv6 access list R1_TRAFFIC
#    10 deny tcp any eq www any eq telnet ack


# Using overridden

# Before state:
# -------------
#
# soodar# sh ip access-lists
# IP access list 110
#    10 deny icmp 192.0.2.0/24 192.0.3.0/24 traceroute
#    20 deny tcp host 198.51.100.0 host 198.51.110.0 eq telnet ack
# IP access list 123
#    10 deny tcp 198.51.100.0/24 198.51.101.0/24 eq telnet ack
#    20 deny tcp 192.0.3.0/24 192.0.4.0/24 eq www ack
# IP access list test
#    10 deny tcp 192.0.2.0/24 192.0.3.0/24 eq www fin
# IPv6 access list R1_TRAFFIC
#    10 deny tcp any eq www any eq telnet ack

- name: Override device configuration of all acls with provided configuration
  amnesh.soodar.soodar_acls:
    config:
    - afi: ipv4
      acls:
      - name: 110
        aces:
        - grant: deny
          sequence: 20
          protocol_options:
            tcp:
              ack: true
          source:
            address: 198.51.100.0/24
            port_protocol:
              eq: telnet
          destination:
            address: 198.51.110.0/24
            port_protocol:
              eq: www
      - name: 150
        aces:
        - grant: deny
          sequence: 10
          protocol_options:
            tcp:
              syn: true
          source:
            address: 198.51.100.0/24
            port_protocol:
              eq: telnet
          destination:
            address: 198.51.110.0/24
            port_protocol:
              eq: telnet
    state: overridden

# Commands fired:
# ---------------
#
# - no ip access-list 110
# - no ip access-list 123
# - no ip access-list 150
# - no ip access-list test
# - no ipv6 access-list R1_TRAFFIC
# - ip access-list 150
# - 10 deny tcp 198.51.100.0/24 eq telnet 198.51.110.0/24 eq telnet syn
# - ip access-list 110
# - 20 deny tcp 198.51.100.0/24 eq telnet 198.51.110.0/24 eq www ack

# After state:
# -------------
#
# soodar# sh ip access-lists
# IP access list 110
#    20 deny tcp 198.51.100.0/24 eq telnet 198.51.110.0/24 eq www ack
# IP access list 150
#    10 deny tcp 198.51.100.0/24 eq telnet 198.51.110.0/24 eq telnet syn


# Using replaced

# Before state:
# -------------
#
# soodar# sh ip access-lists
# IP access list 110
#    10 deny icmp 192.0.2.0/24 192.0.3.0/24 traceroute
#    20 deny tcp host 198.51.100.0 host 198.51.110.0 eq telnet ack
# IP access list 123
#    10 deny tcp 198.51.100.0/24 198.51.101.0/24 eq telnet ack
#    20 deny tcp 192.0.3.0/24 192.0.4.0/24 eq www ack
# IP access list test
#    10 deny tcp 192.0.2.0/24 192.0.3.0/24 eq www fin
# IPv6 access list R1_TRAFFIC
#    10 deny tcp any eq www any eq telnet ack


- name: Replaces device configuration of listed acls with provided configuration
  amnesh.soodar.soodar_acls:
    config:
    - afi: ipv4
      acls:
      - name: 110
        aces:
        - grant: deny
          protocol_options:
            tcp:
              syn: true
          source:
            address: 192.0.2.0/24
          destination:
            address: 192.0.3.0/24
            port_protocol:
              eq: www
      - name: 150
        aces:
        - grant: deny
          sequence: 20
          protocol_options:
            tcp:
              syn: true
          source:
            address: 198.51.100.0/24
            port_protocol:
              eq: telnet
          destination:
            address: 198.51.110.0/24
            port_protocol:
              eq: telnet
    state: replaced

# Commands fired:
# ---------------
#
# - no ip access-list 110
# - ip access-list 110
# - deny tcp 192.0.2.0/24 192.0.3.0/24 eq www syn
# - ip access-list 150
# - 20 deny tcp 198.51.100.0/24 eq telnet 198.51.110.0/24 eq telnet syn

# After state:
# -------------
#
# soodar# sh ip access-lists
# IP access list 110
#    10 deny tcp 192.0.2.0/24 192.0.3.0/24 eq www syn
# IP access list 123
#    10 deny tcp 198.51.100.0/24 198.51.101.0/24 eq telnet ack
#    20 deny tcp 192.0.3.0/24 192.0.4.0/24 eq www ack
# IP access list 150
#    20 deny tcp 198.51.100.0/24 eq telnet 198.51.110.0/24 eq telnet syn
# IP access list test
#    10 deny tcp 192.0.2.0/24 192.0.3.0/24 eq www fin
# IPv6 access list R1_TRAFFIC
#    10 deny tcp any eq www any eq telnet ack


# Using Gathered

# Before state:
# -------------
#
# soodar# sh ip access-lists
# IP access list 110
#    10 deny icmp 192.0.2.0/24 192.0.3.0/24 traceroute
#    20 deny tcp host 198.51.100.0 host 198.51.110.0 eq telnet ack
# IP access list 123
#    10 deny tcp 198.51.100.0/24 198.51.101.0/24 eq telnet ack
#    20 deny tcp 192.0.3.0/24 192.0.4.0/24 eq www ack
# IP access list test
#    10 deny tcp 192.0.2.0/24 192.0.3.0/24 eq www fin
# IPv6 access list R1_TRAFFIC
#    10 deny tcp any eq www any eq telnet ack

- name: Gather listed acls with provided configurations
  amnesh.soodar.soodar_acls:
    config:
    state: gathered

# Module Execution Result:
# ------------------------
#
# "gathered": [
#         {
#             "acls": [
#                 {
#                     "aces": [
#                         {
#                             "destination": {
#                                 "address": "192.0.3.0/24"
#                             },
#                             "dscp": "ef",
#                             "grant": "deny",
#                             "protocol_options": {
#                                 "icmp": {
#                                     "echo": true
#                                 }
#                             },
#                             "sequence": 10,
#                             "source": {
#                                 "address": "192.0.2.0/24"
#                             }
#                         }
#                     ],
#                     "acl_type": "extended",
#                     "name": "110"
#                 },
#                 {
#                     "aces": [
#                         {
#                             "destination": {
#                                 "address": "198.51.101.0/24",
#                                 "port_protocol": {
#                                     "eq": "telnet"
#                                 }
#                             },
#                             "grant": "deny",
#                             "protocol_options": {
#                                 "tcp": {
#                                     "ack": true
#                                 }
#                             },
#                             "sequence": 10,
#                             "source": {
#                                 "address": "198.51.100.0/24"
#                             }
#                         },
#                         {
#                             "destination": {
#                                 "address": "192.0.4.0/24",
#                                 "port_protocol": {
#                                     "eq": "www"
#                                 }
#                             },
#                             "grant": "deny",
#                             "protocol_options": {
#                                 "tcp": {
#                                     "ack": true
#                                 }
#                             },
#                             "sequence": 20,
#                             "source": {
#                                 "address": "192.0.3.0/24"
#                             }
#                         }
#                     ],
#                     "acl_type": "extended",
#                     "name": "123"
#                 },
#                 {
#                     "aces": [
#                         {
#                             "destination": {
#                                 "address": "192.0.3.0/24",
#                                 "port_protocol": {
#                                     "eq": "www"
#                                 }
#                             },
#                             "grant": "deny",
#                             "protocol_options": {
#                                 "tcp": {
#                                     "fin": true
#                                 }
#                             },
#                             "sequence": 10,
#                             "source": {
#                                 "address": "192.0.2.0/24"
#                             }
#                         }
#                     ],
#                     "acl_type": "extended",
#                     "name": "test_acl"
#                 }
#             ],
#             "afi": "ipv4"
#         },
#         {
#             "acls": [
#                 {
#                     "aces": [
#                         {
#                             "destination": {
#                                 "any": true,
#                                 "port_protocol": {
#                                     "eq": "telnet"
#                                 }
#                             },
#                             "grant": "deny",
#                             "protocol_options": {
#                                 "tcp": {
#                                     "ack": true
#                                 }
#                             },
#                             "sequence": 10,
#                             "source": {
#                                 "any": true,
#                                 "port_protocol": {
#                                     "eq": "www"
#                                 }
#                             }
#                         }
#                     ],
#                     "name": "R1_TRAFFIC"
#                 }
#             ],
#             "afi": "ipv6"
#         }
#     ]


# Using Rendered

- name: Rendered the provided configuration with the existing running configuration
  amnesh.soodar.soodar_acls:
    config:
    - afi: ipv4
      acls:
      - name: 110
        aces:
        - grant: deny
          sequence: 10
          protocol_options:
            tcp:
              syn: true
          source:
            address: 192.0.2.0/24
          destination:
            address: 192.0.3.0/24
            port_protocol:
              eq: www
      - name: 150
        aces:
        - grant: deny
          protocol_options:
            tcp:
              syn: true
          source:
            address: 198.51.100.0/24
            port_protocol:
              eq: telnet
          destination:
            address: 198.51.110.0/24
            port_protocol:
              eq: telnet
    state: rendered

# Module Execution Result:
# ------------------------
#
# "rendered": [
#         "ip access-list 110",
#         "10 deny tcp 192.0.2.0 0.0.0.255 192.0.3.0 0.0.0.255 eq www syn",
#         "ip access-list 150",
#         "deny tcp 198.51.100.0 0.0.0.255 eq telnet 198.51.110.0 0.0.0.255 eq telnet"
#     ]


# Using Parsed

# File: parsed.cfg
# ----------------
#
# IPv6 access-list R1_TRAFFIC
# deny tcp any eq www any eq telnet ack

- name: Parse the commands for provided configuration
  amnesh.soodar.soodar_acls:
    running_config: "{{ lookup('file', 'parsed.cfg') }}"
    state: parsed

# Module Execution Result:
# ------------------------
#
# "parsed": [
#         {
#             "acls": [
#                 {
#                     "aces": [
#                         {
#                             "destination": {
#                                 "any": true,
#                                 "port_protocol": {
#                                     "eq": "telnet"
#                                 }
#                             },
#                             "grant": "deny",
#                             "protocol_options": {
#                                 "tcp": {
#                                     "ack": true
#                                 }
#                             },
#                             "source": {
#                                 "any": true,
#                                 "port_protocol": {
#                                     "eq": "www"
#                                 }
#                             }
#                         }
#                     ],
#                     "name": "R1_TRAFFIC"
#                 }
#             ],
#             "afi": "ipv6"
#         }
#     ]

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

after

list / elements=string

The configuration as structured data after module completion.

Returned: when changed

Sample: ["The configuration returned will always be in the same format of the parameters above."]

before

list / elements=string

The configuration as structured data prior to module invocation.

Returned: always

Sample: ["The configuration returned will always be in the same format of the parameters above."]

commands

list / elements=string

The set of commands pushed to the remote device

Returned: always

Sample: ["ip access-list extended 110", "deny icmp 192.0.2.0/24 192.0.3.0/24 echo"]

Authors

  • Mahdi Varasteh (@m-varasteh)