cisco.nxos.nxos_acl_interfaces 模块 – ACL 接口资源模块

注意

此模块是 cisco.nxos 集合 (版本 9.2.1) 的一部分。

如果您使用的是 ansible 包，则可能已安装此集合。它不包含在 ansible-core 中。要检查是否已安装它，请运行 ansible-galaxy collection list。

要安装它，请使用：ansible-galaxy collection install cisco.nxos。

要在剧本中使用它，请指定：cisco.nxos.nxos_acl_interfaces。

cisco.nxos 1.0.0 中的新增功能

概要 

在 NX-OS 平台上添加和删除接口上的访问控制列表

参数 

参数	注释
config 列表 / 元素=字典	要使用 ACL 配置的接口列表
access_groups 列表 / 元素=字典	要配置在接口上的 ACL 的地址族指示符列表
acls 列表 / 元素=字典	接口的访问控制列表列表
direction 字符串 / 必需	要为 ACL 应用的方向选项 `"in"` `"out"`
name 字符串 / 必需	要添加/删除的 ACL 的名称
port 布尔值	将 ACL 用作端口策略。选项 `false` `true`
afi 字符串 / 必需	要配置的 ACL 的地址族指示符选项 `"ipv4"` `"ipv6"`
name 字符串 / 必需	接口名称
running_config 字符串	此选项仅与状态 parsed 一起使用。此选项的值应为通过执行命令 show running-config \| section ‘^interface’ 从 NX-OS 设备接收的输出。状态 parsed 从 `running_config` 选项读取配置并将其转换为 Ansible 结构化数据，然后根据资源模块的 argspec 在结果中的 parsed 键中返回该值。
state 字符串	配置应保留到的状态选项 `"deleted"` `"gathered"` `"merged"` ← (默认) `"overridden"` `"rendered"` `"replaced"` `"parsed"`

备注 

注意

在 VIRL 上针对 NX-OS 7.3.(0)D1(1) 进行了测试
不支持 Cisco MDS

示例 

# Using merged

# Before state:
# ------------
#

- name: Merge ACL interfaces configuration
  cisco.nxos.nxos_acl_interfaces:
    config:
      - name: Ethernet1/2
        access_groups:
          - afi: ipv6
            acls:
              - name: ACL1v6
                direction: in

      - name: Eth1/5
        access_groups:
          - afi: ipv4
            acls:
              - name: PortACL
                direction: in
                port: true

              - name: ACL1v4
                direction: out

          - afi: ipv6
            acls:
              - name: ACL1v6
                direction: in
    state: merged

# After state:
# ------------
# interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
# interface Ethernet1/5
#   ip port access-group PortACL in
#   ip access-group ACL1v4 out
#   ipv6 traffic-filter ACL1v6 in

# Using replaced

# Before state:
# ------------
# interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
# interface Ethernet1/5
#   ip port access-group PortACL in
#   ip access-group ACL1v4 out
#   ipv6 traffic-filter ACL1v6 in

- name: Replace interface configuration with given configuration
  cisco.nxos.nxos_acl_interfaces:
    config:
      - name: Eth1/5
        access_groups:
          - afi: ipv4
            acls:
              - name: NewACLv4
                direction: out

      - name: Ethernet1/3
        access_groups:
          - afi: ipv6
            acls:
              - name: NewACLv6
                direction: in
                port: true
    state: replaced

# After state:
# ------------
# interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
# interface Ethernet1/3
#   ipv6 port traffic-filter NewACLv6 in
# interface Ethernet1/5
#   ip access-group NewACLv4 out

# Using overridden

# Before state:
# ------------
# interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
# interface Ethernet1/5
#   ip port access-group PortACL in
#   ip access-group ACL1v4 out
#   ipv6 traffic-filter ACL1v6 in

- name: Override interface configuration with given configuration
  cisco.nxos.nxos_acl_interfaces:
    config:
      - name: Ethernet1/3
        access_groups:
          - afi: ipv4
            acls:
              - name: ACL1v4
                direction: out

              - name: PortACL
                port: true
                direction: in
          - afi: ipv6
            acls:
              - name: NewACLv6
                direction: in
                port: true
    state: overridden

# After state:
# ------------
# interface Ethernet1/3
#   ip access-group ACL1v4 out
#   ip port access-group PortACL in
#   ipv6 port traffic-filter NewACLv6 in

# Using deleted to remove ACL config from specified interfaces

# Before state:
# -------------
# interface Ethernet1/1
#   ip access-group ACL2v4 in
# interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
# interface Ethernet1/5
#   ip port access-group PortACL in
#   ip access-group ACL1v4 out
#   ipv6 traffic-filter ACL1v6 in

- name: Delete ACL configuration on interfaces
  cisco.nxos.nxos_acl_interfaces:
    config:
      - name: Ethernet1/5
      - name: Ethernet1/2
    state: deleted

# After state:
# -------------
# interface Ethernet1/1
#   ip access-group ACL2v4 in
# interface Ethernet1/2
# interface Ethernet1/5

# Using deleted to remove ACL config from all interfaces

# Before state:
# -------------
# interface Ethernet1/1
#   ip access-group ACL2v4 in
# interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
# interface Ethernet1/5
#   ip port access-group PortACL in
#   ip access-group ACL1v4 out
#   ipv6 traffic-filter ACL1v6 in

- name: Delete ACL configuration from all interfaces
  cisco.nxos.nxos_acl_interfaces:
    state: deleted

# After state:
# -------------
# interface Ethernet1/1
# interface Ethernet1/2
# interface Ethernet1/5

# Using parsed

- name: Parse given configuration into structured format
  cisco.nxos.nxos_acl_interfaces:
    running_config: |
      interface Ethernet1/2
      ipv6 traffic-filter ACL1v6 in
      interface Ethernet1/5
      ipv6 traffic-filter ACL1v6 in
      ip access-group ACL1v4 out
      ip port access-group PortACL in
    state: parsed

# returns
# parsed:
#   - name: Ethernet1/2
#     access_groups:
#       - afi: ipv6
#         acls:
#           - name: ACL1v6
#             direction: in
#  - name: Ethernet1/5
#    access_groups:
#      - afi: ipv4
#        acls:
#          - name: PortACL
#            direction: in
#            port: True
#          - name: ACL1v4
#            direction: out
#      - afi: ipv6
#        acls:
#          - name: ACL1v6
#             direction: in


# Using gathered:

# Before state:
# ------------
# interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
# interface Ethernet1/5
#   ipv6 traffic-filter ACL1v6 in
#   ip access-group ACL1v4 out
#   ip port access-group PortACL in

- name: Gather existing configuration from device
  cisco.nxos.nxos_acl_interfaces:
    config:
    state: gathered

# returns
# gathered:
#   - name: Ethernet1/2
#     access_groups:
#       - afi: ipv6
#         acls:
#           - name: ACL1v6
#             direction: in
#  - name: Ethernet1/5
#    access_groups:
#      - afi: ipv4
#        acls:
#          - name: PortACL
#            direction: in
#            port: True
#          - name: ACL1v4
#            direction: out
#      - afi: ipv6
#        acls:
#          - name: ACL1v6
#             direction: in


# Using rendered

- name: Render required configuration to be pushed to the device
  cisco.nxos.nxos_acl_interfaces:
    config:
      - name: Ethernet1/2
        access_groups:
          - afi: ipv6
            acls:
              - name: ACL1v6
                direction: in
      - name: Ethernet1/5
        access_groups:
          - afi: ipv4
            acls:
              - name: PortACL
                direction: in
                port: true
              - name: ACL1v4
                direction: out
          - afi: ipv6
            acls:
              - name: ACL1v6
                direction: in
    state: rendered


# returns
# rendered:
#   interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
#   interface Ethernet1/5
#   ipv6 traffic-filter ACL1v6 in
#   ip access-group ACL1v4 out
#   ip port access-group PortACL in

返回值 

常见的返回值已在此处记录，以下是此模块特有的字段

键	描述
after 字典	生成的配置模型调用。返回：发生更改时示例： `"The configuration returned will always be in the same format\n of the parameters above.\n"`
before 字典	模型调用之前的配置。返回：始终返回示例： `"The configuration returned will always be in the same format\n of the parameters above.\n"`
commands 列表 / 元素=字符串	推送到远程设备的命令集。返回：始终返回示例： `["interface Ethernet1/2", "ipv6 traffic-filter ACL1v6 out", "ip port access-group PortACL in"]`

作者

Adharsh Srivats Rangarajan (@adharshsrivatsr)