# Different results in dnf upgrade command and dnf module

**URL:** <https://forum.ansible.com/t/different-results-in-dnf-upgrade-command-and-dnf-module/46168>\
**Category:** Get Help\
**Created:** [August 12, 2026, 1:08pm UTC](https://forum.ansible.com/t/different-results-in-dnf-upgrade-command-and-dnf-module/46168 "2026-08-12T13:08:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ab203972](https://avatars.discourse-cdn.com/v4/letter/a/ea5d25/32.png) [@ab203972](https://forum.ansible.com/u/ab203972)\
**Post date:** [August 12, 2026, 1:08pm UTC](https://forum.ansible.com/t/different-results-in-dnf-upgrade-command-and-dnf-module/46168/1 "2026-08-12T13:08:16Z")

</div>

Ansible version: 2.16.19, due to some RHEL8 servers in our inventory

Hello everyone,

I am experiencing difficulties with applying automatic updates with Ansible. We have several servers where we would like to automate the installation of updates. These servers are behind a restrictive firewall that is causing some issues, blocking access to necessary sources. However, the results are consistently inconsistent; when we run `dnf upgrade`, an upgrade is performed successfully. It takes a while, but it works very consistently. Meanwhile, with Ansible, I try to apply updates as follows:

```yaml
- name: Update all packages except excluded (dnf based)
  ansible.builtin.dnf:
    name: "*"
    state: latest
    update_only: true
    update_cache: "{{ update_linux_packages_update_cache }}"
    cacheonly: "{{ update_linux_packages_cache_only }}"
    exclude: "{{ update_linux_packages_exclude | join(',') }}"
    disablerepo: "{{ update_linux_packages_disable_repo | join(',') }}"
  when: ansible_facts.pkg_mgr == 'dnf'

```

This is part of a role, hence the configurable cache and exclusions. If we run with the module default parameters (`cacheonly == false` & `update_cache == false`) or force updating the cache, it fails because it cannot access repository metadata:

```auto
fatal: [server0102]: FAILED! => {
	"attempts": 3,
	"changed": false,
	"msg": "Failed to download metadata for repo 'packages-microsoft-com-prod': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried",
	"rc": 1,
	"results": []
}

```

Meanwhile, when we ensure that the cache isn’t updated, it fails because the cache is invalid:

```auto
fatal: [server0102]: FAILED! => {
	"attempts": 3,
	"changed": false,
	"failures": [],
	"msg": "Unknown Error occurred: Some packages have invalid cache, but cannot be downloaded due to \"--cacheonly\" option",
	"rc": 1,
	"results": []
}

```

As stated earlier, our firewall is very restrictive. I can see it blocking the required sources, which explains the errors. What it doesn’t explain is why it goes right when we do the command manually. I see no difference in traffic; a lot of it is blocked when running the command as well. So, I would like some insight what the module does that makes it so that it fails. Is it checking other sources that need to be allowlisted? Or is it checking less mirrors than the system dnf? Any tips would be appreciated.

Final note: This can be solved by expanding our allowlist, but I would just like some insight as to why this occurs in the first place.

---

<div class="post-metadata">

**Author:** ![bvitnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bvitnik/32/4132_2.png) [@bvitnik](https://forum.ansible.com/u/bvitnik)\
**Post date:** [August 12, 2026, 8:45pm UTC](https://forum.ansible.com/t/different-results-in-dnf-upgrade-command-and-dnf-module/46168/2 "2026-08-12T20:45:41Z")

</div>

Since you mentioned that you have a restrictive firewall (I presume an external, dedicated device?), then your answer lies there. Check for the reason for blocking as reported by the firewall in the logs.

This could be as simple as different user-agent being used by Ansible `dnf` module compared to the regular `dnf` command.