Remove Config Lines on ASA with Ansible

Question

I have an ansible playbook that creates a network object and sets ACL policies. It's working well, but I would like to create the complementary playbook to remove the object and its associated config but I don't know the correct way to approach the task.

I could just use asa_command to issue the 'no' prefix for the appropriate lines, however, that doesn't feel like the "Ansible Way" since it would try to execute the commands even if they were already absent in the config.

I have seen that some modules have a state: absent operator. However, the asa_ modules don't indicate that as an option.

Any suggestions would be much appreciated.

So my assumption that I could use `asa_command` was incorrect. You cannot run config commands as `asa_command` operates in exec mode. You also cannot run `config t` from there as it tells you to that you should use `asa_config` instead. — Jarred Masterson, Oct 11 '17 at 18:11

score 1 · Accepted Answer · answered Oct 11 '17 at 17:45

1

I think having a state: absent option makes a lot of sense, as I don't think there is a simple way of doing this more efficiently with the current asa_ modules. The Ansible team is extremely responsive to issues and PRs, so I would submit one for this feature.

answered Oct 11 '17 at 17:45

Derek Brown

4,232
4
27
44

1

Thanks Derek, I have submitted that as a request! – Jarred Masterson Oct 12 '17 at 14:54

score 0 · Answer 2 · answered Oct 12 '17 at 15:07

It looks like there isn't a clean way to do this as of Ansible 2.4. I have a working playbook, however, I had to settle for issuing the no commands using asa_config and putting ignore_errors: yes in for each play. It's inelegant to say the least and in some cases can break down. I think there may be a way to use an error handling along with check_mode: yes. My initial attempt at this failed because when registering the result of a play to a variable, I cannot use that variable to interpret which of the affected hosts actually required a change it's just a generic yes/no for the entire play.

What I'm doing currently:

- name: Remove Network Object
  asa_config:
   commands:
    - no object network {{ object_name }}
   provider: "{{ cli }}"
  ignore_errors: yes
  register: dno

Remove Config Lines on ASA with Ansible

2 Answers2