Ansible Modules for Cisco ASA

In Cisco ASA release 9.3 Cisco released a REST API to the firewall. These modules allows you to use that API from Ansible. The modules use the RASA Python package.

The modules are located at GitHub.

Work in progress

The work on these modules has just started as I’m exploring what can be done with the REST API. It’s still early code which might contain a few bugs and I’ve also found a few bugs in the REST API, it would really help if you could test the modules and let me know if you have any problem with them. Or perhaps if you don’t know how to get started.

Limitations

The REST API limits the number of objects returned in a query to 100 and then uses offsets to get the next ‘page’. These modules and RASA doesn’t yet support offsets. Currently this will only impact the module for network object-groups, if you have more than 100 members of your group. This will be fixed in later releases.

Current modules

• cisco_asa_ikev1_policy - Creates, modifies or deletes network objects
• cisco_asa_network_object - Creates, modifies or deletes network objects
• cisco_asa_network_objectgroup - Creates, modifies or deletes network object-groups
• cisco_asa_write_mem - Saves the running configuration

For information about the different arguments to each module check out the documentation.

Other modules

You might also be interested in the Ansible modules using SNMP to manage Cisco IOS devices.