# wait\_for using bastion host

**URL:** <https://forum.ansible.com/t/wait-for-using-bastion-host/21831>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [June 22, 2016, 11:39am UTC](https://forum.ansible.com/t/wait-for-using-bastion-host/21831 "2016-06-22T11:39:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vincent\_Van\_der\_Kuss](https://avatars.discourse-cdn.com/v4/letter/v/7c8e57/32.png) [@Vincent\_Van\_der\_Kuss](https://forum.ansible.com/u/Vincent_Van_der_Kuss)\
**Post date:** [June 22, 2016, 11:39am UTC](https://forum.ansible.com/t/wait-for-using-bastion-host/21831/1 "2016-06-22T11:39:38Z")

</div>

Hi,

I’m currently testing Ansible for deploying instances on AWS. To reach hosts in private subnets, I’m using a bastion host. When deploying new instances I have a task that waits for the ssh port of the new instance to come up before proceding.

During the creation of the instance I also update my local inventory file with the ip of the instance and the ansible\_ssh\_private\_key\_file (aws generated key-pair) like this:

x.x.x.x ansible\_private\_key\_file=~/.ssh/instance.pem

However, the task that waits for the ssh port to come up gives a timeout. This is the wait\_for task:

- name: Wait for SSH  
wait\_for:  
host: “{{ item.private\_ip }}”  
port: 22  
delay: 60  
timeout: 320  
state: started  
with\_items: “{{ ec2.instances }}”

The host variable resolves to the correct ip of the new instance.

In my ssh config file I have configured the bastion host for each subnet. And ssh’ing into the new instance works without issues. I can also perfectly run ad-hoc commands against the new instance.

This is the ansible\_cfg I’m using:

[defaults]  
inventory=./hosts  
ProxyCommand=“ssh -W %h:%p -q centos@”  
host\_key\_checking=False

[ssh\_connection]  
ssh\_args=-o ForwardAgent=yes

I also tried delegating the wait task to the bastion host, but that results in the same error. Is there something I’m missing?

Vincent

---

<div class="post-metadata">

**Author:** ![Ansible\_Madness](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Ansible\_Madness](https://forum.ansible.com/u/Ansible_Madness)\
**Post date:** [May 24, 2017, 12:06pm UTC](https://forum.ansible.com/t/wait-for-using-bastion-host/21831/2 "2017-05-24T12:06:25Z")

</div>

Sadly I do not have an answer to your question, but as I am facing the same situation i was curious to know if you found a solution?

Rod

---

<div class="post-metadata">

**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\
**Post date:** [May 24, 2017, 12:26pm UTC](https://forum.ansible.com/t/wait-for-using-bastion-host/21831/3 "2017-05-24T12:26:07Z")

</div>

You need to delegate the wait\_for task to the bastion server:

delegate\_to: [bastion.host.com](http://bastion.host.com)

---

<div class="post-metadata">

**Author:** ![igorc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/igorc/32/5491_2.png) [@igorc](https://forum.ansible.com/u/igorc)\
**Post date:** [May 24, 2017, 11:12pm UTC](https://forum.ansible.com/t/wait-for-using-bastion-host/21831/4 "2017-05-24T23:12:43Z")

</div>

Try to connect manually with the same ssh command with -vvv switch to find out what went wrong. Also use register in the ansible command and debug the returned value. My guess is missing/mismatch key or security group issue ie the instance has tcp port 22 blocked.

---

<div class="post-metadata">

**Author:** ![Ansible\_Madness](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Ansible\_Madness](https://forum.ansible.com/u/Ansible_Madness)\
**Post date:** [May 25, 2017, 7:12am UTC](https://forum.ansible.com/t/wait-for-using-bastion-host/21831/5 "2017-05-25T07:12:21Z")

</div>

Many thanks, this sorted out my issue!