fortios_router_prefix_list treats each rule as exclusive about ansible-galaxy-fortios-collection

[chillancezen]

hi @freddygfy, thank you for the issue,

note the state is for the object router.prefix-list, not for the rule. you should not set state to absent unless you really wang to delete the whole router.prefix-list object.

despite that you can delete a single rule in CLI, the rules in API design is not incrementally updated, this means each time you have to specify the whole rule set when you are creating/updating the router.prefix-list object.

here is your example , always remember to give the whole ruleset.

- hosts: fortigate01
  connection: httpapi
  collections:
  - fortinet.fortios
  vars:
   vdom: "root"
   ansible_httpapi_use_ssl: yes
   ansible_httpapi_validate_certs: no
   ansible_httpapi_port: 443
   prefix_list:
   - name: "LOCAL_NETS"
     vdom: "root"
     state: 'present' # 'absent' is to delete the whole LOCAL_NETS rulesets, not a single rule, always set to 'present'
     rule:
      - id: "1"
        action: "permit"
        prefix: "10.10.10.0/24"
        ge: ""
        le: ""
        removed: 'yes' # any value will be ok, because we only examine whether this field is defined
      - id: "2"
        action: "permit"
        prefix: "10.10.255.10/32"
        ge: ""
        le: ""
        #removed: 'no, must be commented out'
   - name: "EXTERNAL_NETS"
     vdom: "root"
     state: 'present' # ditto
     rule:
      - id: "1"
        action: "permit"
        prefix: "0.0.0.0/0"
        ge: ""
        le: ""

  tasks:
    - name: Configure Prefix Lists
      fortios_router_prefix_list:
        vdom: "{{ item.vdom }}"
        state: "{{ item.state }}"
        router_prefix_list:
            name: "{{ item.name }}"
            rule: "{{ item.rule | rejectattr('removed', 'defined') | list }}"
      with_items:
            - "{{ prefix_list }}"
      when: prefix_list is defined

for more filters, please see https://docs.ansible.com/ansible/latest/user_guide/complex_data_manipulation.html

thanks,
Link.

[FredPocai]

the rules in API design is not incrementally updated, this means each time you have to specify the whole rule set when you are creating/updating the router.prefix-list object.

Thank you for your clarification, this certainly explains why my method wasn't working.

The firewall I was working on is in prod now so I'm a bit hesitant to make changes but I have a couple more lined up for staging in the coming days. I will try your example play against them.

[chillancezen]

yes it is a limitation. api is limited as opposed to CLI Thanks for your understanding. As for another router-map issue , I’ve requested support inside from api team. Hope we can have an update soon.

…

Sent from my iPhone On Sep 25, 2020, at 6:10 PM, freddygfy <[email protected]<mailto:[email protected]>> wrote: the rules in API design is not incrementally updated, this means each time you have to specify the whole rule set when you are creating/updating the router.prefix-list object. That would explain the issue...is this an API limitation? Ideally I would be able to run this as a loop over a dict to allow the same playbook to be used on devices with prefix-lists of varying lengths, though I understand if this is outside of your control. Thank you for your clarification. The firewall I was working on is in prod now so I'm a bit hesitant to make changes but I have a couple more lined up for staging in the coming days. I will try your example play against them. — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#56 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ACOVYVMQOMYT4MP2CCXMRFTSHRUBHANCNFSM4RW4KO5A>.

[chillancezen]

hi @freddygfy ,

hope you are doing fine.

I mark this issue closed, feel free to reopen it if the problem persists or any other support you need.

thanks,
Link