cisco.nxos.nxos_acl_interfaces 模块 – ACL 接口资源模块

注意

此模块是 cisco.nxos 集合（版本 9.2.1）的一部分。

如果您使用的是 ansible 包，则可能已经安装了此集合。它不包含在 ansible-core 中。要检查是否已安装，请运行 ansible-galaxy collection list。

要安装它，请使用：ansible-galaxy collection install cisco.nxos。

要在 playbook 中使用它，请指定：cisco.nxos.nxos_acl_interfaces。

cisco.nxos 1.0.0 中的新功能

概要

• 在 NX-OS 平台上添加和删除接口上的访问控制列表

参数

参数	注释
config 列表 / elements=dictionary	要配置 ACL 的接口列表
access_groups 列表 / elements=dictionary	要在接口上配置的带有 ACL 的地址族指示符列表
acls 列表 / elements=dictionary	接口的访问控制列表
direction 字符串 / 必需	要应用于 ACL 的方向 选择 "in" "out"
name 字符串 / 必需	要添加/删除的 ACL 的名称
port 布尔值	将 ACL 用作端口策略。 选择 false true
afi 字符串 / 必需	要配置的 ACL 的地址族指示符 选择 "ipv4" "ipv6"
name 字符串 / 必需	接口的名称
running_config 字符串	此选项仅与状态 parsed 一起使用。 此选项的值应该是从 NX-OS 设备执行命令 show running-config | section '^interface' 收到的输出。 状态 parsed 从 running_config 选项读取配置，并根据资源模块的 argspec 将其转换为 Ansible 结构化数据，然后该值将返回到结果中的 parsed 键中。
state 字符串	配置应保留的状态 选择 "deleted" "gathered" "merged" ← (默认) "overridden" "rendered" "replaced" "parsed"

说明

注意

• 在 VIRL 上针对 NX-OS 7.3.(0)D1(1) 进行了测试

• 不支持 Cisco MDS

示例

# Using merged

# Before state:
# ------------
#

- name: Merge ACL interfaces configuration
  cisco.nxos.nxos_acl_interfaces:
    config:
      - name: Ethernet1/2
        access_groups:
          - afi: ipv6
            acls:
              - name: ACL1v6
                direction: in

      - name: Eth1/5
        access_groups:
          - afi: ipv4
            acls:
              - name: PortACL
                direction: in
                port: true

              - name: ACL1v4
                direction: out

          - afi: ipv6
            acls:
              - name: ACL1v6
                direction: in
    state: merged

# After state:
# ------------
# interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
# interface Ethernet1/5
#   ip port access-group PortACL in
#   ip access-group ACL1v4 out
#   ipv6 traffic-filter ACL1v6 in

# Using replaced

# Before state:
# ------------
# interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
# interface Ethernet1/5
#   ip port access-group PortACL in
#   ip access-group ACL1v4 out
#   ipv6 traffic-filter ACL1v6 in

- name: Replace interface configuration with given configuration
  cisco.nxos.nxos_acl_interfaces:
    config:
      - name: Eth1/5
        access_groups:
          - afi: ipv4
            acls:
              - name: NewACLv4
                direction: out

      - name: Ethernet1/3
        access_groups:
          - afi: ipv6
            acls:
              - name: NewACLv6
                direction: in
                port: true
    state: replaced

# After state:
# ------------
# interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
# interface Ethernet1/3
#   ipv6 port traffic-filter NewACLv6 in
# interface Ethernet1/5
#   ip access-group NewACLv4 out

# Using overridden

# Before state:
# ------------
# interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
# interface Ethernet1/5
#   ip port access-group PortACL in
#   ip access-group ACL1v4 out
#   ipv6 traffic-filter ACL1v6 in

- name: Override interface configuration with given configuration
  cisco.nxos.nxos_acl_interfaces:
    config:
      - name: Ethernet1/3
        access_groups:
          - afi: ipv4
            acls:
              - name: ACL1v4
                direction: out

              - name: PortACL
                port: true
                direction: in
          - afi: ipv6
            acls:
              - name: NewACLv6
                direction: in
                port: true
    state: overridden

# After state:
# ------------
# interface Ethernet1/3
#   ip access-group ACL1v4 out
#   ip port access-group PortACL in
#   ipv6 port traffic-filter NewACLv6 in

# Using deleted to remove ACL config from specified interfaces

# Before state:
# -------------
# interface Ethernet1/1
#   ip access-group ACL2v4 in
# interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
# interface Ethernet1/5
#   ip port access-group PortACL in
#   ip access-group ACL1v4 out
#   ipv6 traffic-filter ACL1v6 in

- name: Delete ACL configuration on interfaces
  cisco.nxos.nxos_acl_interfaces:
    config:
      - name: Ethernet1/5
      - name: Ethernet1/2
    state: deleted

# After state:
# -------------
# interface Ethernet1/1
#   ip access-group ACL2v4 in
# interface Ethernet1/2
# interface Ethernet1/5

# Using deleted to remove ACL config from all interfaces

# Before state:
# -------------
# interface Ethernet1/1
#   ip access-group ACL2v4 in
# interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
# interface Ethernet1/5
#   ip port access-group PortACL in
#   ip access-group ACL1v4 out
#   ipv6 traffic-filter ACL1v6 in

- name: Delete ACL configuration from all interfaces
  cisco.nxos.nxos_acl_interfaces:
    state: deleted

# After state:
# -------------
# interface Ethernet1/1
# interface Ethernet1/2
# interface Ethernet1/5

# Using parsed

- name: Parse given configuration into structured format
  cisco.nxos.nxos_acl_interfaces:
    running_config: |
      interface Ethernet1/2
      ipv6 traffic-filter ACL1v6 in
      interface Ethernet1/5
      ipv6 traffic-filter ACL1v6 in
      ip access-group ACL1v4 out
      ip port access-group PortACL in
    state: parsed

# returns
# parsed:
#   - name: Ethernet1/2
#     access_groups:
#       - afi: ipv6
#         acls:
#           - name: ACL1v6
#             direction: in
#  - name: Ethernet1/5
#    access_groups:
#      - afi: ipv4
#        acls:
#          - name: PortACL
#            direction: in
#            port: True
#          - name: ACL1v4
#            direction: out
#      - afi: ipv6
#        acls:
#          - name: ACL1v6
#             direction: in


# Using gathered:

# Before state:
# ------------
# interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
# interface Ethernet1/5
#   ipv6 traffic-filter ACL1v6 in
#   ip access-group ACL1v4 out
#   ip port access-group PortACL in

- name: Gather existing configuration from device
  cisco.nxos.nxos_acl_interfaces:
    config:
    state: gathered

# returns
# gathered:
#   - name: Ethernet1/2
#     access_groups:
#       - afi: ipv6
#         acls:
#           - name: ACL1v6
#             direction: in
#  - name: Ethernet1/5
#    access_groups:
#      - afi: ipv4
#        acls:
#          - name: PortACL
#            direction: in
#            port: True
#          - name: ACL1v4
#            direction: out
#      - afi: ipv6
#        acls:
#          - name: ACL1v6
#             direction: in


# Using rendered

- name: Render required configuration to be pushed to the device
  cisco.nxos.nxos_acl_interfaces:
    config:
      - name: Ethernet1/2
        access_groups:
          - afi: ipv6
            acls:
              - name: ACL1v6
                direction: in
      - name: Ethernet1/5
        access_groups:
          - afi: ipv4
            acls:
              - name: PortACL
                direction: in
                port: true
              - name: ACL1v4
                direction: out
          - afi: ipv6
            acls:
              - name: ACL1v6
                direction: in
    state: rendered


# returns
# rendered:
#   interface Ethernet1/2
#   ipv6 traffic-filter ACL1v6 in
#   interface Ethernet1/5
#   ipv6 traffic-filter ACL1v6 in
#   ip access-group ACL1v4 out
#   ip port access-group PortACL in

返回值

通用返回值记录在这里，以下是此模块独有的字段

键	描述
after 字典	生成的配置模型调用。 返回: 当更改时 示例: "返回的配置将始终采用与上述参数相同的格式\n"
before 字典	模型调用之前的配置。 返回: 始终 示例: "返回的配置将始终采用与上述参数相同的格式\n"
commands 列表 / elements=string	推送到远程设备的命令集。 返回: 始终 示例: ["interface Ethernet1/2", "ipv6 traffic-filter ACL1v6 out", "ip port access-group PortACL in"]

作者

• Adharsh Srivats Rangarajan (@adharshsrivatsr)

集合链接

• 问题跟踪器
• 存储库（源）