[BUG] juniper.device.junos_acls | ansible playbook failing while trying to attach named Prefix_lists to firewall filters on device

[chidanandpujar]

Category

• Bug
• Feature
• Task

---

Collection Namespace & Version

Field	Value
Collection namespace	juniper.device
Collection version	2.0.1
Collection install path	/home/jcluser/.ansible/collections/ansible_collections

# How to find it:
ansible-galaxy collection list | grep -E 'juniper|junipernetworks'

---

Module / Plugin Details

Field	Value
Module / plugin name	juniper.device.junos_acls
Module version (if shown in output)
Plugin type	module

# How to inspect module documentation:
ansible-doc juniper.device.config

---

Description

---

Inventory File (sanitized)

[junos]
device1 ansible_host= ansible_user=jcluser ansible_ssh_pass=<*******>

[junos:vars]
ansible_connection=ansible.netcommon.netconf
ansible_network_os=juniper.device.junos

# vars/inventory.yml (sanitized)
  vars:
    junos_network_services:
      state: merged
      config:
        - afi: ipv4
          acls:
            - name: ALL-ATTRS-ACL
              aces:
                - name: t40-src-prefix-list
                  grant: permit
                  protocol: tcp
                  source:
                    prefix_list:
                      - name: TRUSTED-SOURCES
                  destination:
                    address: xx.xx.xx.xx/32

---

Playbook Details

---
- name: Configure ACL on QFX
  hosts: junos
  connection: netconf
  gather_facts: false

  vars:
    junos_network_services:
      state: merged
      config:
        - afi: ipv4
          acls:
            - name: ALL-ATTRS-ACL
              aces:
                - name: t40-src-prefix-list
                  grant: permit
                  protocol: tcp
                  source:
                    prefix_list:
                      - name: TRUSTED-SOURCES
                  destination:
                    address: xx.xx.xx.xx/32

  tasks:
    - name: Configure ACL
      juniper.device.junos_acls:
        config: "{{ junos_network_services.config }}"
        state: "{{ junos_network_services.state }}"
      register: result

    - name: Display result
      debug:
        var: result

ansible-playbook -i inventory.ini playbook.yml -vvv

---

Steps to Reproduce

1. Install the collection: ansible-galaxy collection install juniper.device==2.0.1
2. Set up the inventory file as shown above.
3. Run the playbook: ansible-playbook -i inventory.ini playbook.yml -vvv
5. Observe the error / unexpected behaviour.

---

Expected Behavior

This playbook should create firewall filters with existing prefix_list (TRUSTED-SOURCES) on device

---

Actual Behavior

The playbook failed with exception

msg": "argument 'prefix_list' is of type <class 'dict'> found in 'config -> acls -> aces -> source'. and we were unable to convert to list: <class 'dict'> cannot be converted to a list"

PLAYBOOK: playbook.yml ********************************************************************************************************************************************************************
1 plays in playbook.yml

PLAY [Configure ACL on QFX] ***************************************************************************************************************************************************************

TASK [Configure ACL] **********************************************************************************************************************************************************************
task path: /home/jcluser/playbook.yml:25
fatal: [device1]: FAILED! => {
    "changed": false,
    "invocation": {
        "module_args": {
            "config": [
                {
                    "acls": [
                        {
                            "aces": [
                                {
                                    "destination": {
                                        "address": "xx.xx.xx.xx/32",
                                        "port_protocol": null,
                                        "prefix_list": null
                                    },
                                    "grant": "permit",
                                    "name": "t30-udp-src-range",
                                    "protocol": "udp",
                                    "protocol_options": null,
                                    "source": {
                                        "address": "xx.xx.xx.xx/24",
                                        "port_protocol": null,
                                        "prefix_list": null
                                    }
                                },
                                {
                                    "destination": {
                                        "address": "xx.xx.xx.xx/32",
                                        "port_protocol": null,
                                        "prefix_list": null
                                    },
                                    "grant": "permit",
                                    "name": "t40-src-prefix-list",
                                    "protocol": "tcp",
                                    "protocol_options": null,
                                    "source": {
                                        "address": null,
                                        "port_protocol": null,
                                        "port_protocol": null,
                                        "prefix_list": null
                                    },
                                    "grant": "permit",
                                    "name": "t40-src-prefix-list",
                                    "protocol": "tcp",
                                    "protocol_options": null,
                                    "source": {
                                        "address": null,
                                        "port_protocol": null,
                                        "prefix_list": {
                                            "name": "TRUSTED-SOURCES"
                                        }
                                    }
                                }
                            ],
                            "name": "ALL-ATTRS-ACL"
                        }
                    ],
                    "afi": "ipv4"
                }
            ],
            "running_config": null,
            "state": "merged"
        }
    },
    "msg": "argument 'prefix_list' is of type <class 'dict'> found in 'config -> acls -> aces -> source'. and we were unable to convert to list: <class 'dict'> cannot be converted to a list"
}

PLAY RECAP ********************************************************************************************************************************************************************************
device1                    : ok=0    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0 



Prefix_list existing on device 

{master:0}
jcluser@dc1-spine2> show configuration | display set | match TRUSTED-SOURCES 
set policy-options prefix-list TRUSTED-SOURCES xx.xx.xx.xx/24
set policy-options prefix-list TRUSTED-SOURCES xx.xx.xx.xx/24

Error summary:

---

Environment

JCL NITA Sandbox

Ansible & Python

Item	Version
ansible-core	2.17.14
Python	3.11.13
OS	Linux nita 5.14.0-503.14.1.el9_5.x86_64

Collection & Python Package Versions

ansible-galaxy collection list | grep -E 'juniper|junipernetworks'
pip show junos-eznc ncclient paramiko lxml

# ansible-galaxy collection list output:

# pip show output:
junos-eznc    : 2.8.2
ncclient      : 0.7.0
paramiko      : 5.0.0
lxml          : 6.1.1

Junos Device

Item	Value
Junos version	18.1R3-S5.3
Junos platform / model	vqfx-10000
Transport	NETCONF over SSH
NETCONF port	830

---

Junos RPC / XML (if applicable)

<!-- RPC request -->

<!-- RPC response / error -->

---

Additional Context

---

Support

As Red Hat Ansible Certified Content, this collection is entitled to support through the Ansible Automation Platform (AAP) using the Create issue button on the top right corner of the AAP support portal.

If a support case cannot be opened with Red Hat and the collection has been obtained either from Galaxy or GitHub, there may be community help available on the Ansible Forum.