The Ansible Cisco ASA collection includes a variety of Ansible content to help automate the management of Cisco ASA firewall appliances.
As a Red Hat Ansible Certified Content, this collection is entitled to support through Ansible Automation Platform (AAP).
If a support case cannot be opened with Red Hat and the collection has been obtained either from Galaxy or GitHub, there is community support available at no charge.
You can join us on #network:ansible.com room or the Ansible Forum Network Working Group.
For more information you can check the communication section below.
Join the Ansible forum:
The Ansible Bullhorn newsletter: used to announce releases and important changes.
For more information about communication, see the Ansible communication guide.
This collection has been tested against following Ansible versions: >=2.15.0.
For collections that support Ansible 2.9, please ensure you update your network_os
to use the
fully qualified collection name (for example, cisco.ios.ios
).
Plugins and modules within a collection may be tested with only specific Ansible versions.
A collection may contain metadata that identifies these versions.
PEP440 is the schema used to describe the versions of Ansible.
This collection has been tested against Cisco ASA 9.10(1)11 and Cisco ASA image configured over Zuul with version 9.12.3.
The Cisco ASA collection supports network_cli
connections.
Name | Description |
---|---|
cisco.asa.asa | Use asa cliconf to run command on Cisco ASA platform |
Name | Description |
---|---|
cisco.asa.asa_acls | Access-Lists resource module |
cisco.asa.asa_command | Run arbitrary commands on Cisco ASA devices |
cisco.asa.asa_config | Manage configuration sections on Cisco ASA devices |
cisco.asa.asa_facts | Collect facts from remote devices running Cisco ASA |
cisco.asa.asa_ogs | Object Group resource module |
You can install the Cisco ASA collection with the Ansible Galaxy CLI:
ansible-galaxy collection install cisco.asa
You can also include it in a requirements.yml
file and install it with ansible-galaxy collection install -r requirements.yml
, using the format:
---
collections:
- name: cisco.asa
This collection includes security resource modules. Similar to Network resource modules introduced in Ansible 2.9
An example for using this collection to manage a ACL resource Cisco ASA is as follows:
inventory.ini
(Note the password should be managed by a Vault for a production environment.
[asa01]
host_asa.example.com
[asa01:vars]
ansible_user=admin
ansible_ssh_pass=password
ansible_become=true
ansible_become_method=ansible.netcommon.enable
ansible_become_pass=become_password
ansible_connection=ansible.netcommon.network_cli
ansible_network_os=cisco.asa.asa
ansible_python_interpreter=python
You can either call modules by their Fully Qualified Collection Name (FQCN), like cisco.asa.asa_acls
, or you can call modules by their short name if you list the cisco.asa
collection in the playbook's collections
, as follows:
---
- hosts: asa01
gather_facts: false
connection: network_cli
collections:
- cisco.asa
tasks:
- name: Merge the provided configuration with the existing running configuration
register: result
cisco.asa.asa_acls: &id001
config:
- acls:
- name: test_global_access
acl_type: extended
aces:
- grant: deny
line: 1
protocol: tcp
protocol_options:
tcp: true
source:
address: 192.0.2.0
netmask: 255.255.255.0
destination:
address: 192.0.3.0
netmask: 255.255.255.0
port_protocol:
eq: www
log: default
- name: test_R1_traffic
acl_type: extended
aces:
- grant: deny
line: 1
protocol_options:
tcp: true
source:
address: 2001:db8:0:3::/64
port_protocol:
eq: www
destination:
address: 2001:fc8:0:4::/64
port_protocol:
eq: telnet
inactive: true
state: merged
The following example task replaces configuration changes in the existing configuration on a Cisco ASA firewall device, using the FQCN:
---
- name: Replace device configurations of listed ACLs with provided configurations
register: result
cisco.asa.asa_acls: &id001
config:
- acls:
- name: test_global_access
acl_type: extended
aces:
- grant: deny
line: 1
protocol_options:
tcp: true
source:
address: 192.0.4.0
netmask: 255.255.255.0
port_protocol:
eq: telnet
destination:
address: 192.0.5.0
netmask: 255.255.255.0
port_protocol:
eq: www
state: replaced
We welcome community contributions to this collection. If you find problems, please open an issue or create a PR against the Cisco ASA collection repository. See Contributing to Ansible-maintained collections for complete details.
You can also join us on:
#ansible-security
libera.chat channelSee the Ansible Community Guide for details on contributing to Ansible.
This collection follows the Ansible project's Code of Conduct. Please read and familiarize yourself with this document.
Release notes are available here.
GNU General Public License v3.0 or later.
See LICENSE to see the full text.