[BUG] junos.device.junos_acls | unable to deploy term with icmp-code as port_unreachable for junos evo based QFX5x device

[chidanandpujar]

Category

• Bug
• Feature
• Task

---

Collection Namespace & Version

Field	Value
Collection namespace	juniper.device
Collection version	2.0.2 (beta build PR845)
Collection install path	/home/jcluser/.ansible/collections/ansible_collections

# How to find it:
ansible-galaxy collection list | grep -E 'juniper|junipernetworks'

---

Module / Plugin Details

Field	Value
Module / plugin name	juniper.device.junos_acls
Module version (if shown in output)
Plugin type	module

# How to inspect module documentation:
ansible-doc juniper.device.config

---

Description

icmp-code 'port_unreachable' is not getting configured using the junos_acls ansible module for junos EVO based QFX device.
Note: same attribute 'port_unreachable' works fine for junos based QFX

Inventory File (sanitized)

[junos]
device1 ansible_host= ansible_user=jcluser ansible_ssh_pass=<*******>
[junos:vars]
ansible_connection=ansible.netcommon.netconf
ansible_network_os=juniper.device.junos

# vars/inventory.yml (sanitized)
  vars:
    acl_config:
      - afi: ipv4
        acls:
          - name: ANSIBLE-TEST-IPv4
            aces: 
              - grant: deny
                sequence: 150
                source:
                      any: true
                destination:
                      any: true
                protocol: icmp
                protocol_options:
                  icmp:
                    port_unreachable: true

---

Playbook Details

---
- name: Configure ACL on QFX
  hosts: junos
  connection: netconf
  gather_facts: false

  tasks:
    - name: Configure ACL
      juniper.device.junos_acls:
        config: "{{ acl_config }}"
        state: merged
      register: result
    - name: Display result
      debug:
        var: result

ansible-playbook -i inventory.ini playbook.yml -vvv

---

Steps to Reproduce

1. Install the collection: ansible-galaxy collection install juniper.device==2.0.2 beta build
2. Set up the inventory file as shown above.
3. Run the playbook: ansible-playbook -i inventory.ini playbook.yml -vvv
5. Observe the error / unexpected behaviour.

---

Expected Behavior

This playbook should create firewall filters using icmp-code 'port_unreachable' on both junos and junos EVO based QFX devices

The same behaviour is working for
Model: qfx5120-48y-8c
Junos: 23.4R2-S6.6 flex

set firewall family inet filter ANSIBLE-TEST-IPv4 term 150 from protocol icmp
set firewall family inet filter ANSIBLE-TEST-IPv4 term 150 from icmp-code port-unreachable

---

Actual Behavior

The playbook did not configure icmp-code 'port_unreachable' on QFX device based on junos EVO but works successfully on Junos based QFX device

PLAYBOOK: playbook.yml ********************************************************************************************************************************************************************
1 plays in playbook.yml
PLAY
TASK [yeti.network_services.acls : Configure acls configurations] **********************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ansible.module_utils.connection.ConnectionError: b'error: mustd: Icmp-code match requires both Protocol(or next-header or ip-protocol or payload-protocol) and icmp-type match\nerror: configuration check-out failed: (statements constraint check failed)'
fatal: [L00BL400]: FAILED! => {"msg": "Unexpected failure during module execution: b'error: mustd: Icmp-code match requires both Protocol(or next-header or ip-protocol or payload-protocol) and icmp-type match\\nerror: configuration check-out failed: (statements constraint check failed)'", "stdout": ""}

Error summary:

Environment

JCL NITA Sandbox

Ansible & Python

Item	Version
ansible-core	2.17.14
Python	3.11.13
OS	Linux nita 5.14.0-503.14.1.el9_5.x86_64

Collection & Python Package Versions

ansible-galaxy collection list | grep -E 'juniper|junipernetworks'
pip show junos-eznc ncclient paramiko lxml

# ansible-galaxy collection list output:
# pip show output:
junos-eznc    : 2.8.2
ncclient      : 0.7.0
paramiko      : 5.0.0
lxml          : 6.1.1

Junos Device

Item	Value
Junos version	23.4R2-S6.9-EVO
Junos platform / model	qfx5130-32cd
Transport	NETCONF over SSH
NETCONF port	830

---

Junos RPC / XML (if applicable)

<!-- RPC request -->
<!-- RPC response / error -->

---

Additional Context

---

Support

As Red Hat Ansible Certified Content, this collection is entitled to support through the Ansible Automation Platform (AAP) using the Create issue button on the top right corner of the AAP support portal.](https://access.redhat.com/support/cases/#/case/new).)
If a support case cannot be opened with Red Hat and the collection has been obtained either from Galaxy or GitHub, there may be community help available on the Ansible Forum.](https://forum.ansible.com/).)