Closed mattspera closed 6 months ago
When gathering ACL facts using the nxos_acls module, if an ACL contains an ACE of the below format, it is parsed incorrectly.
nxos_acls
nexus-01(config-acl)# sh ip access-lists RH-SUPPORT-ACL IP access list RH-SUPPORT-ACL 10 permit tcp any range 1024 65535 192.168.0.0 0.0.0.255 eq 1720
ansible 2.10.14 config file = /Users/admin/Development/netbox/ansible.cfg configured module search path = ['/Users/admin/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] ansible python module location = /Users/admin/.venv/two-ten/lib/python3.9/site-packages/ansible executable location = /Users/admin/.venv/two-ten/bin/ansible python version = 3.9.6 (default, Aug 11 2023, 19:44:49) [Clang 15.0.0 (clang-1500.0.40.1)]
# /Users/admin/.ansible/collections/ansible_collections Collection Version ---------- ------- cisco.nxos 5.3.0
HOST_KEY_CHECKING(/Users/admin/Development/netbox/ansible.cfg) = False PERSISTENT_COMMAND_TIMEOUT(/Users/admin/Development/netbox/ansible.cfg) = 300
cisco Nexus9000 C93108TC-EX chassis NXOS: version 7.0(3)I7(3)
Using the nxos_acls module, gather ACL facts from an NX-OS device which contains the following ACL:
ip access-list RH-SUPPORT-ACL 10 permit tcp any range 1024 65535 192.168.0.0 0.0.0.255 eq 1720
--- - name: DISCOVER CISCO NX-OS ACL CONFIG hosts: all gather_facts: false tasks: - name: GATHER NXOS ACL FACTS cisco.nxos.nxos_acls: state: gathered register: acls
It is expected the ACE is parsed correctly, like so:
{ "aces": [ { "destination": { "address": "192.168.0.0", "wildcard_bits": "0.0.0.255" "port_protocol": { "eq": "1720" }, }, "grant": "permit", "protocol": "tcp", "sequence": 10, "source": { "any": true, "port_protocol": { "range": { "end": "65535", "start": "1024" } }, } } ], "name": "RH-SUPPORT-ACL" }
As can be observed, the source and destination components are parsed incorrectly.
source
destination
{ "aces": [ { "destination": { "address": "range", "wildcard_bits": "1024" }, "grant": "permit", "protocol": "tcp", "sequence": 10, "source": { "any": true, "port_protocol": { "eq": "1720" } } } ], "name": "RH-SUPPORT-ACL" }
SUMMARY
When gathering ACL facts using the
nxos_acls
module, if an ACL contains an ACE of the below format, it is parsed incorrectly.ISSUE TYPE
COMPONENT NAME
nxos_acls
ANSIBLE VERSION
COLLECTION VERSION
CONFIGURATION
OS / ENVIRONMENT
cisco Nexus9000 C93108TC-EX chassis NXOS: version 7.0(3)I7(3)
STEPS TO REPRODUCE
Using the
nxos_acls
module, gather ACL facts from an NX-OS device which contains the following ACL:EXPECTED RESULTS
It is expected the ACE is parsed correctly, like so:
ACTUAL RESULTS
As can be observed, the
source
anddestination
components are parsed incorrectly.