ansible-collections / cisco.ios

Ansible Network Collection for Cisco IOS
GNU General Public License v3.0
262 stars 161 forks source link

Why my acl playbook stopped working ?? #1075

Closed saifvs closed 2 weeks ago

saifvs commented 2 weeks ago
SUMMARY

I had this below acl task in my playbook for over an year now, and it was working fine, i have not touched it, and I have also applied the acls to about 100 switches about an year back, all worked fine back then, recently when I had to update an IP, I ran the task again, but instead of adding the acl line by line, it applied first line and started to give error that says,

"Cannot update existing sequence  of ACLs ssh_access_list with state merged. Please use state replaced or overridden.

acl and I lost access to the switch, because it was ssh access list, luckily I ran it only for single switch.

and regarding the error if I change the state to replaced or overridden, it will keep replacing or overriding the IPs one by one instead of adding sequence by sequence. The reason why I am confident that it used to work fine and not anymore is because, all my ansible codes are in bitbucket, I checked the first version of the code, and it is same , no chnages yet.

- name: Adding users to SSH access list
  cisco.ios.ios_acls:
    config:
      - afi: ipv4
        acls:
          - name: "{{std_config.acls[0]['name']}}"
            acl_type: extended
            aces:
              - grant: permit
                protocol_options:
                  ip: true
                source:
                  host: "{{item}}"
                destination:
                  any: true
    state: merged
ISSUE TYPE
COMPONENT NAME

cisco.ios.ios_acls:

ANSIBLE VERSION
2.16.3
COLLECTION VERSION
# /home/saif/.local/lib/python3.10/site-packages/ansible_collections
Collection Version
---------- -------
cisco.ios  5.3.0  

# /usr/lib/python3/dist-packages/ansible_collections
Collection Version
---------- -------
cisco.ios  4.4.0  
CONFIGURATION
CALLBACKS_ENABLED(/etc/ansible/ansible.cfg) = ['timer']
CONFIG_FILE() = /etc/ansible/ansible.cfg
DEFAULT_TIMEOUT(/etc/ansible/ansible.cfg) = 5
HOST_KEY_CHECKING(/etc/ansible/ansible.cfg) = False
PERSISTENT_COMMAND_TIMEOUT(/etc/ansible/ansible.cfg) = 120
PERSISTENT_CONNECT_TIMEOUT(/etc/ansible/ansible.cfg) = 120
OS / ENVIRONMENT

cisco switch version 15.2

STEPS TO REPRODUCE

use the below code, I also added the yaml dictionary.

- name: Adding users to SSH access list
  cisco.ios.ios_acls:
    config:
      - afi: ipv4
        acls:
          - name: "{{std_config.acls[0]['name']}}"
            acl_type: extended
            aces:
              - grant: permit
                protocol_options:
                  ip: true
                source:
                  host: "{{item}}"
                destination:
                  any: true
    state: merged

https://github.com/ansible-collections/cisco.ios

EXPECTED RESULTS
ACTUAL RESULTS

my requirement is that, I need to be able to update the my var ip files, and when I run the below code, it should add the acl sequence by sequence, for eg, first IP will have sequence 10, and second will have 20, and so on.

below is the var files.

#Update the source_host to the users machine IP to allow the ssh access
acls:
      - name: ssh_access_list
        src_host:
          - 10.x.x.71 
          - 10.x.x.99 
          - 10.x.x.172 
          - 10.x.x.95
          - 10.x.x.96
          - 10.x.x.51
          - 10.x.x.134 
          - 10.x.x.135
          - 10.x.x.13 
          - 10.x.x.151 

below is the sample acl I ran on another switch using the same code an year back.

sh access-lists ssh_access_list
Extended IP access list ssh_access_list
    10 permit ip host 10.x.x.71 any
    20 permit ip host 10.x.x.99 any (430 matches)
    30 permit ip host 10.x.x.172 any (6 matches)
    40 permit ip host 10.x.x.95 any (28 matches)
    50 permit ip host 10.x.x.96 any (2 matches)
    60 permit ip host 10.x.x.51 any
    70 permit ip host 10.x.x.134 any (8 matches)
    80 permit ip host 10.x.x.135 any
    90 permit ip host 10.x.x.13 any
    100 deny ip any any
saifvs commented 2 weeks ago

never mind, I created new task with sequence number