Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IOS ACLs/Prefix List merge state issues a NO for pre-existing config which can break network and is not expected #345

Closed
justjais opened this issue Jun 3, 2021 · 0 comments · Fixed by #346
Assignees

Comments

@justjais
Copy link
Member

justjais commented Jun 3, 2021

SUMMARY

OS ACLs/Prefix List merge state issues a NO for pre-existing config which can break the network and is not expected

ISSUE TYPE
  • Bug Report
COMPONENT NAME

ios_acls and prefix_lists

ANSIBLE VERSION
2.10+
CONFIGURATION

OS / ENVIRONMENT

mac os

STEPS TO REPRODUCE
# Before state:
# -------------
#
# vios#sh access-lists
# Extended IP access list 110
#    10 deny icmp 192.0.2.0 0.0.0.255 192.0.3.0 0.0.0.255 echo dscp ef ttl eq 10

- name: Merge provided configuration with device configuration
  cisco.ios.ios_acls:
    config:
    - afi: ipv4
      acls:
      - name: 110
        aces:
        - sequence: 10
          protocol_options:
            icmp:
              traceroute: true
        - grant: deny
          protocol_options:
            tcp:
              ack: true
          source:
            host: 198.51.100.0
          destination:
            host: 198.51.110.0
            port_protocol:
              eq: telnet
    state: merged


# Prefix List
# Before state:
# -------------
#
# router-ios#sh running-config | section ^ip prefix-list|^ipv6 prefix-list
# ipv6 prefix-list test_ipv6 description this is ipv6
# ipv6 prefix-list test_ipv6 seq 10 deny 2001:DB8:0:4::/64 ge 80
- name: Merge provided Prefix lists configuration
  cisco.ios.ios_prefix_lists:
    config:
      - afi: ipv6
        prefix_lists:
          - name: test_ipv6
            entries:
              - description: this is ipv6 merge test
              - action: deny
                prefix: 2001:DB8:0:4::/64
                ge: 80
                le: 100
                sequence: 10
    state: merged

EXPECTED RESULTS

The task fails with error that pre-existing ACLs/Prefix Lists cannot be merged

ACTUAL RESULTS
ACL:

# Commands fired:
# ---------------
#
# - ip access-list extended 110
# - no 10
# - 10 deny icmp 192.0.2.0 0.0.0.255 192.0.3.0 0.0.0.255 traceroute dscp ef ttl eq 10

Prefix_List:

#  Commands Fired:
#  ---------------
#
#   "commands": [
#         "no ipv6 prefix-list test_ipv6 seq 10 deny 2001:DB8:0:4::/64 ge 80",
#         "ipv6 prefix-list test_ipv6 seq 10 deny 2001:DB8:0:4::/64 ge 80 le 100",
#         "ipv6 prefix-list test_ipv6 description this is ipv6 merge test"
#     ]
@justjais justjais self-assigned this Jun 3, 2021
@justjais justjais changed the title IOS ACLs merge state issues a NO ace for pre-existing ACEs which can break network and is not expected IOS ACLs/Prefix List merge state issues a NO for pre-existing config which can break network and is not expected Jun 3, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant