W3cubDocs

/Ansible

junipernetworks.junos.junos_acls – ACLs resource module

Note

This plugin is part of the junipernetworks.junos collection (version 2.6.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install junipernetworks.junos.

To use it in a playbook, specify: junipernetworks.junos.junos_acls.

New in version 1.0.0: of junipernetworks.junos

Synopsis
Requirements
Parameters
Notes
Examples
Return Values

Synopsis

This module provides declarative management of acls/filters on Juniper JUNOS devices

Note

This module has a corresponding action plugin.

Requirements

The below requirements are needed on the host that executes this module.

ncclient (>=v0.6.4)
xmltodict (>=0.12.0)

Parameters

Parameter							Choices/Defaults	Comments
config list / elements=dictionary								A dictionary of acls options
	acls list / elements=dictionary							List of Access Control Lists (ACLs).
		aces list / elements=dictionary						List of Access Control Entries (ACEs) for this Access Control List (ACL).
			destination dictionary					Specifies the destination for the filter
				address raw				Match IP destination address
				port_protocol dictionary				Specify the destination port or protocol.
					eq string			Match only packets on a given port number.
					range dictionary			Match only packets in the range of port numbers
						end integer		Specify the end of the port range
						start integer		Specify the start of the port range
				prefix_list list / elements=dictionary				Match IP destination prefixes in named list
					name string			Name of the list
			grant string				Choices: permit deny	Action to take after matching condition (allow, discard/reject)
			name string / required					Filter term name
			protocol string					Specify the protocol to match. Refer to vendor documentation for valid values.
			protocol_options dictionary					All possible suboptions for the protocol chosen.
				icmp dictionary				ICMP protocol options.
					dod_host_prohibited boolean		Choices: no yes	Host prohibited
					dod_net_prohibited boolean		Choices: no yes	Net prohibited
					echo boolean		Choices: no yes	Echo (ping)
					echo_reply boolean		Choices: no yes	Echo reply
					host_redirect boolean		Choices: no yes	Host redirect
					host_tos_redirect boolean		Choices: no yes	Host redirect for TOS
					host_tos_unreachable boolean		Choices: no yes	Host unreachable for TOS
					host_unknown boolean		Choices: no yes	Host unknown
					host_unreachable boolean		Choices: no yes	Host unreachable
					net_redirect boolean		Choices: no yes	Network redirect
					net_tos_redirect boolean		Choices: no yes	Net redirect for TOS
					network_unknown boolean		Choices: no yes	Network unknown
					port_unreachable boolean		Choices: no yes	Port unreachable
					protocol_unreachable boolean		Choices: no yes	Protocol unreachable
					reassembly_timeout boolean		Choices: no yes	Reassembly timeout
					redirect boolean		Choices: no yes	All redirects
					router_advertisement boolean		Choices: no yes	Router discovery advertisements
					router_solicitation boolean		Choices: no yes	Router discovery solicitations
					source_route_failed boolean		Choices: no yes	Source route failed
					time_exceeded boolean		Choices: no yes	All time exceeded.
					ttl_exceeded boolean		Choices: no yes	TTL exceeded
			source dictionary					Specifies the source for the filter
				address raw				IP source address to use for the filter
				port_protocol dictionary				Specify the source port or protocol.
					eq string			Match only packets on a given port number.
					range dictionary			Match only packets in the range of port numbers
						end integer		Specify the end of the port range
						start integer		Specify the start of the port range
				prefix_list list / elements=dictionary				IP source prefix list to use for the filter
					name string			Name of the list
		name string / required						Name to use for the acl filter
	afi string / required						Choices: ipv4 ipv6	Protocol family to use by the acl filter
state string							Choices: merged ← replaced overridden deleted gathered	The state the configuration should be left in

Notes

Note

This module requires the netconf system service be enabled on the device being managed.
This module works with connection netconf. See the Junos OS Platform Options.
Tested against JunOS v18.4R1

Examples

# Using merged

# Before state:
# -------------
#
# admin# show firewall

- name: Merge JUNOS acl
  junipernetworks.junos.junos_acls:
    config:
    - afi: ipv4
      acls:
      - name: allow_ssh_acl
        aces:
        - name: ssh_rule
          source:
            port_protocol:
              eq: ssh
          protocol: tcp
      state: merged

# After state:
# -------------
# admin# show firewall
# family inet {
#     filter allow_ssh_acl {
#         term ssh_rule {
#             from {
#                 protocol tcp;
#                 source-port ssh;
#             }
#         }
#     }
# }

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Returned	Description
after list / elements=string	when changed	The resulting configuration model invocation. Sample: The configuration returned will always be in the same format of the parameters above.
before list / elements=string	always	The configuration prior to the model invocation. Sample: The configuration returned will always be in the same format of the parameters above.
commands list / elements=string	always	The set of commands pushed to the remote device. Sample: ['command 1', 'command 2', 'command 3']

Authors

Daniel Mellado (@dmellado)

© 2012–2018 Michael DeHaan
© 2018–2021 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/latest/collections/junipernetworks/junos/junos_acls_module.html