# one common acl name with unique ip per device

**URL:** <https://forum.ansible.com/t/one-common-acl-name-with-unique-ip-per-device/35664>\
**Category:** Ansible Project\
**Created:** [August 24, 2021, 3:28am UTC](https://forum.ansible.com/t/one-common-acl-name-with-unique-ip-per-device/35664 "2021-08-24T03:28:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Josh\_Karki](https://avatars.discourse-cdn.com/v4/letter/j/77aa72/32.png) [@Josh\_Karki](https://forum.ansible.com/u/Josh_Karki)\
**Post date:** [August 24, 2021, 3:28am UTC](https://forum.ansible.com/t/one-common-acl-name-with-unique-ip-per-device/35664/1 "2021-08-24T03:28:01Z")

</div>

I have about 5 ASAs and they all have one common ACL name say for example “allow\_test”

now I need to add one more entry in the list for all 5 ASAs but each with different IP. Eg.

access-list allow\_test standard permit host 1.1.1.1 (for asa1)  
access-list allow\_test standard permit host 2.2.2.2 (for asa2 and so on)

I tired it with\_item loop and the variable set for hostname and then the ip for acl, but it doesn’t seem to work.

Have you guys come across of similar situation and have addressed this challenge? I would appreciate if you could share your solution with me.

Thanks!

---

<div class="post-metadata">

**Author:** ![Clint\_Denham](https://avatars.discourse-cdn.com/v4/letter/c/919ad9/32.png) [@Clint\_Denham](https://forum.ansible.com/u/Clint_Denham)\
**Post date:** [August 25, 2021, 6:04pm UTC](https://forum.ansible.com/t/one-common-acl-name-with-unique-ip-per-device/35664/2 "2021-08-25T18:04:23Z")

</div>

Not sure if this would help, but maybe a different way of looking at it using with\_subelements?

I have one Task that creates some ACLs for OpenStack

- name: Add Rules to the Security Groups  
tags: security\_groups  
os\_security\_group\_rule:  
security\_group: “{{item.0.group}}”  
direction: “{{item.1.direction}}”  
protocol: “{{item.1.protocol}}”  
remote\_ip\_prefix: “{{item.1.remote\_ip}}”  
ethertype: “{{ (item.1.remote\_ip | search(‘:’)) | ternary(‘IPv6’,‘IPv4’) }}”  
with\_subelements:
- “{{ security\_groups }}”
- rules  
run\_once: true

The Dictionary security\_groups looks like this

security\_groups:

- group: prod\_traffic\_plane  
rules:
- { “direction”:“ingress”, “protocol”: “tcp”, “remote\_ip”: “[0.0.0.0/0](http://0.0.0.0/0)” }
- { “direction”:“ingress”, “protocol”: “udp”, “remote\_ip”: “[0.0.0.0/0](http://0.0.0.0/0)” }
- { “direction”:“ingress”, “protocol”: “icmp”, “remote\_ip”: “[0.0.0.0/0](http://0.0.0.0/0)” }
- { “direction”:“ingress”, “protocol”: “tcp”, “remote\_ip”: “::/0” }
- { “direction”:“ingress”, “protocol”: “udp”, “remote\_ip”: “::/0” }
- { “direction”:“ingress”, “protocol”: “icmp”, “remote\_ip”: “::/0” }
- { “direction”:“egress”, “protocol”: “tcp”, “remote\_ip”: “[0.0.0.0/0](http://0.0.0.0/0)” }
- { “direction”:“egress”, “protocol”: “udp”, “remote\_ip”: “[0.0.0.0/0](http://0.0.0.0/0)” }
- { “direction”:“egress”, “protocol”: “icmp”, “remote\_ip”: “[0.0.0.0/0](http://0.0.0.0/0)” }
- { “direction”:“egress”, “protocol”: “tcp”, “remote\_ip”: “::/0” }
- { “direction”:“egress”, “protocol”: “udp”, “remote\_ip”: “::/0” }
- { “direction”:“egress”, “protocol”: “icmp”, “remote\_ip”: “::/0” }
- group: dev\_traffic\_plane  
rules:
- { “direction”:“ingress”, “protocol”: “tcp”, “remote\_ip”: “[0.0.0.0/0](http://0.0.0.0/0)” }
- { “direction”:“ingress”, “protocol”: “udp”, “remote\_ip”: “[0.0.0.0/0](http://0.0.0.0/0)” }
- { “direction”:“ingress”, “protocol”: “icmp”, “remote\_ip”: “[0.0.0.0/0](http://0.0.0.0/0)” }
- { “direction”:“ingress”, “protocol”: “tcp”, “remote\_ip”: “::/0” }
- { “direction”:“ingress”, “protocol”: “udp”, “remote\_ip”: “::/0” }
- { “direction”:“ingress”, “protocol”: “icmp”, “remote\_ip”: “::/0” }
- { “direction”:“egress”, “protocol”: “tcp”, “remote\_ip”: “[0.0.0.0/0](http://0.0.0.0/0)” }
- { “direction”:“egress”, “protocol”: “udp”, “remote\_ip”: “[0.0.0.0/0](http://0.0.0.0/0)” }
- { “direction”:“egress”, “protocol”: “icmp”, “remote\_ip”: “[0.0.0.0/0](http://0.0.0.0/0)” }
- { “direction”:“egress”, “protocol”: “tcp”, “remote\_ip”: “::/0” }
- { “direction”:“egress”, “protocol”: “udp”, “remote\_ip”: “::/0” }
- { “direction”:“egress”, “protocol”: “icmp”, “remote\_ip”: “::/0” }

---

<div class="post-metadata">

**Author:** ![Josh\_Karki](https://avatars.discourse-cdn.com/v4/letter/j/77aa72/32.png) [@Josh\_Karki](https://forum.ansible.com/u/Josh_Karki)\
**Post date:** [August 25, 2021, 7:28pm UTC](https://forum.ansible.com/t/one-common-acl-name-with-unique-ip-per-device/35664/3 "2021-08-25T19:28:27Z")

</div>

Thanks Clint!

I fixed this with:  
vars:  
asas:  
asa1: 1.1.1.1  
asa2: 2.2.2.2

- name: get hostname  
asa\_command:  
commands:
- show hostname

register: hostname

- name: update acl  
asa\_config:  
lines:
- access-list test1 remark test-test
- access-list test1 standard permit host {{asas[hostname.stdout[0]]}}  
match: strict