# cli\_command executing on localhost

**URL:** <https://forum.ansible.com/t/cli-command-executing-on-localhost/31222>\
**Category:** Ansible Project\
**Created:** [September 7, 2019, 4:35pm UTC](https://forum.ansible.com/t/cli-command-executing-on-localhost/31222 "2019-09-07T16:35:08Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![JP-OKC](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@JP-OKC](https://forum.ansible.com/u/JP-OKC)\
**Post date:** [September 7, 2019, 4:35pm UTC](https://forum.ansible.com/t/cli-command-executing-on-localhost/31222/1 "2019-09-07T16:35:08Z")

</div>

I have a playbook to harden the NXOS API on Nexus switches. It requires connecting to the Nexus, running the bash shell and executing some commands to configure iptables. Some of the commands execute correctly and others seem to try to run on the local host even though I don’t have delegate\_to: set for those tasks. These tasks seem to run on the switch:

- set the vrf for NXAPI
- enter the shell
- become root
- apply the ip tables config

All the others seem to run on localhost (my ansible box). Has anyone run into this before?

part of the playbook:

- name: set the vrf for NXAPI  
nxos\_config:  
lines: nxapi use-vrf management

- name: enter the shell

cli\_command:  
command: run bash  
sendonly: yes

- name: become root  
command: sudo su -

- name: setup the iptables\_init.log  
command: sudo touch /etc/iptables\_init.log; sudo chmod 777 /etc/iptables\_init.log

- name: Create the init file  
command: sudo echo “{{ initfile }}” \> /etc/init.d/iptables\_init

- name: set the default action to drop  
cli\_command:  
command: sudo ip netns exec management iptables -F INPUT  
sendonly: yes

- name: apply the ip tables config  
cli\_command:

command: sudo ip netns exec management iptables -A INPUT -s {{ item.source }} -p tcp --dport 443 -j ACCEPT  
sendonly: yes  
when:

- “‘WEB’ in item.remark”

- “‘remark’ not in item.action”  
with\_items: “{{ current\_acl.list }}”

- name: save the ipchains  
cli\_command:  
command: “sudo ip netns exec management iptables-save \> /etc/sysconfig/iptables”  
sendonly: yes