# networking not idempotent

**URL:** <https://forum.ansible.com/t/networking-not-idempotent/26938>\
**Category:** Ansible Project\
**Created:** [March 8, 2018, 9:43pm UTC](https://forum.ansible.com/t/networking-not-idempotent/26938 "2018-03-08T21:43:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mark.tovey](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@mark.tovey](https://forum.ansible.com/u/mark.tovey)\
**Post date:** [March 8, 2018, 9:43pm UTC](https://forum.ansible.com/t/networking-not-idempotent/26938/1 "2018-03-08T21:43:44Z")

</div>

I am experimenting with the networking modules in Ansible to try to understand how we can use Ansible to manage our network devices. To that end, I have written a simple playbook to apply an ACL to a router. It works well, except I notice that each time the playbook is run, the change is applied. It does not appear to be idempotent.  
My playbook looks like the following:

tasks:

- name: ACL before create  
ios\_command:  
provider: “{{provider}}”  
commands:

- show access-list TEST  
register: acl\_before

- debug: var=acl\_before.stdout\_lines

- name: Create access list  
ios\_config:  
provider: “{{ provider }}”  
authorize: yes  
parents: [‘ip access-list extended TEST’]  
lines:

- 10 permit ip host 1.1.1.1 any

- 20 deny ip any any  
before: [‘no ip access-list extended TEST’]  
match: exact  
backup: yes

- name: ACL after create  
ios\_command:  
provider: “{{ provider }}”  
commands:

- show access-list TEST  
register: acl\_after

- debug: var=acl\_after.stdout\_lines

The first time the playbook is run, the ACL is applied properly as expected. But the next time the playbook is run, the ACL is again applied even though it is clearly already present:

PLAY [R1] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

TASK [ACL before create] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [10.48.94.50]

TASK [debug] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [10.48.94.50] =\> {  
“acl\_before.stdout\_lines”: [  
[  
“Extended IP access list TEST”,  
" 10 permit ip host 1.1.1.1 any",  
" 20 deny ip any any"  
]  
]  
}

TASK [Create access list] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
changed: [10.48.94.50]

TASK [ACL after create] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [10.48.94.50]

TASK [debug] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [10.48.94.50] =\> {  
“acl\_after.stdout\_lines”: [  
[  
“Extended IP access list TEST”,  
" 10 permit ip host 1.1.1.1 any",  
" 20 deny ip any any"  
]  
]  
}

PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
10.48.94.50 : ok=5 changed=1 unreachable=0 failed=0

So what do I need to add to the playbook to ensure that it is idempotent?

---

<div class="post-metadata">

**Author:** ![mark.tovey](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@mark.tovey](https://forum.ansible.com/u/mark.tovey)\
**Post date:** [March 8, 2018, 9:45pm UTC](https://forum.ansible.com/t/networking-not-idempotent/26938/2 "2018-03-08T21:45:33Z")

</div>