acl.yaml

---
- hosts: switches
  gather_facts: yes
  connection: local 


  tasks:
  - name: GET CREDENTIALS
    include_vars: secrets.yaml

  - name: DEFINE CONNECTION
    set_fact:
       connection:
          authorize: yes
          host: "{{ inventory_hostname }}"
          username: "{{ creds['username'] }}"
          password: "{{ creds['password'] }}"
          auth_pass: "{{ creds['auth_pass'] }}"

  - name: CHECK ACLs
    ios_command:
      provider: "{{ connection }}"
      commands:
         - show ip access-list
    register: beforeacl
  - #debug: var=beforeacl.stdout_lines

  - name: CREATE MGMT ACL
    ios_config:
      provider: "{{ connection }}"
      lines:
        - 10 permit ip host 192.168.1.254 any log
        - 20 permit ip host 192.168.1.250 any log
        - 30 permit ip 192.168.1.0 0.0.0.255 any log
        - 40 deny ip any any log
      parents: ['ip access-list extended ACL_MGMT']
      before: ['no ip access-list extended ACL_MGMT']
      match: exact

  - name: CHECK MGMT ACLS
    ios_command:
      provider: "{{ connection }}"
      commands:
         - show ip access-list ACL_MGMT
    register: afteracl   
  - #debug: var=afteracl.stdout_lines

  - name: APPLY MGMT ACL
    ios_config:
      provider: "{{ connection }}"
      lines:
        - access-class ACL_MGMT in
      parents: ['line vty 0 15']
     

  - name: SHOW VTY ACL
    ios_command:
      provider: "{{ connection }}"
      commands:
        - show run | b line vty 
    register: vtyacl
  - #debug: var=vtyacl.stdout_lines
  
  - name: WAIT FOR SSH CONNECTIVITY then SAVE
    wait_for:
      host: "{{ inventory_hostname }}"
      port: 22
      timeout: 10
      msg: SSH Connection failed and must reboot device to regain connectivity

  - name: WRITE ME 2
    ios_command:
      provider: "{{ connection }}"
      commands:
        - wr me