cisco.meraki_rm.meraki_appliance

Synopsis Parameters Sample Task Examples Return Values

Synopsis

Manage Meraki appliance L3 firewall rules for a network.
Singleton per network (update only, no create/delete).
Supports merged, replaced, and gathered states.

Author

Cisco Meraki

Parameters

▶ config (list/dict)

Firewall configuration (singleton).

access (str)

Rule for which IPs are allowed to access.

allowed_ips (list/str)

Array of allowed CIDRs.

application_categories (list/dict)

L7 application categories and applications.

rules (list/dict)

Ordered array of L3 firewall rules.

service (str)

Appliance service name.

spoofing_protection (dict)

Spoofing protection settings.

syslog_default_rule (bool)

Log the special default rule.

network_id (str) required

The network ID.

state (str)

mergedreplacedgathered

The state of the resource.

Sample Task

A template task showing all available parameters with their defaults or example values.

- name: Meraki Appliance Firewall task
  cisco.meraki_rm.meraki_appliance_firewall:
    network_id: "192.168.1.0/24"
    config:
      - access: "access_value"
        allowed_ips:
          - "allowed_ips_item"
        application_categories:
          - {}
        rules:
          - {}
        service: "service_value"
        spoofing_protection: {}
        syslog_default_rule: true
    state: merged

- name: Meraki Appliance Firewall task
  cisco.meraki_rm.meraki_appliance_firewall:
    network_id: "192.168.1.0/24"
    config:  # optional
      - access: "access_value"  # optional
        allowed_ips:  # optional
          - "allowed_ips_item"
        application_categories:  # optional
          - {}
        rules:  # optional
          - {}
        service: "service_value"  # optional
        spoofing_protection: {}  # optional
        syslog_default_rule: true  # optional
    state: merged  # optional

- name: Meraki Appliance Firewall task
  cisco.meraki_rm.meraki_appliance_firewall:
    network_id: "192.168.1.0/24"  # (str, required) The network ID.
    config:  # (list, optional) Firewall configuration (singleton).
      - access: "access_value"  # (str, optional) Rule for which IPs are allowed to access.
        allowed_ips:  # (list, optional) Array of allowed CIDRs.
          - "allowed_ips_item"
        application_categories:  # (list, optional) L7 application categories and applications.
          - {}
        rules:  # (list, optional) Ordered array of L3 firewall rules.
          - {}
        service: "service_value"  # (str, optional) Appliance service name.
        spoofing_protection: {}  # (dict, optional) Spoofing protection settings.
        syslog_default_rule: true  # (bool, optional) Log the special default rule.
    state: merged  # (str, optional) The state of the resource.

Examples

Define Expected Configuration

- name: Define expected configuration
  ansible.builtin.set_fact:
    expected_config:
      syslog_default_rule: true
      access: example
      service: example

Create Appliance_firewall With Merged State

- name: Create appliance_firewall with merged state
  cisco.meraki_rm.meraki_appliance_firewall:
    network_id: "N_123456789012345678"
    state: merged
    config:
      - "{{ expected_config }}"
  register: merge_result

Assert Resource Was Created

- name: Assert resource was created
  ansible.builtin.assert:
    that:
      - merge_result is changed
      - merge_result.config | length == 1

Compare Expected Paths To Result (subset Check)

- name: Compare expected paths to result (subset check)
  ansible.builtin.set_fact:
    path_check: "{{ expected_paths | cisco.meraki_rm.path_contained_in(result_paths) }}"
  vars:
    expected_paths: "{{ expected_config | ansible.utils.to_paths }}"
    result_paths: "{{ merge_result.config[0] | ansible.utils.to_paths }}"

Assert All Expected Fields Are Present And Match

- name: Assert all expected fields are present and match
  ansible.builtin.assert:
    that: path_check.contained | bool
    success_msg: "{{ success_msg }}"
    fail_msg: "{{ fail_msg }}"
  vars:
    success_msg: "All expected fields match. Extras: {{ path_check.extras }}"
    fail_msg: "Missing or mismatch: {{ path_check.missing }}. Extras: {{ path_check.extras }}"

Task Output:

# Manage Meraki appliance firewall rules — full resource replacement

Define Replacement Configuration

- name: Define replacement configuration
  ansible.builtin.set_fact:
    expected_config:
      syslog_default_rule: true
      access: example
      service: example

Replace Appliance_firewall Configuration

- name: Replace appliance_firewall configuration
  cisco.meraki_rm.meraki_appliance_firewall:
    network_id: "N_123456789012345678"
    state: replaced
    config:
      - "{{ expected_config }}"
  register: replace_result

Assert Resource Was Replaced

- name: Assert resource was replaced
  ansible.builtin.assert:
    that:
      - replace_result is changed
      - replace_result.config | length == 1

Compare Expected Paths To Result (subset Check)

- name: Compare expected paths to result (subset check)
  ansible.builtin.set_fact:
    path_check: "{{ expected_paths | cisco.meraki_rm.path_contained_in(result_paths) }}"
  vars:
    expected_paths: "{{ expected_config | ansible.utils.to_paths }}"
    result_paths: "{{ replace_result.config[0] | ansible.utils.to_paths }}"

Assert All Expected Fields Are Present And Match

- name: Assert all expected fields are present and match
  ansible.builtin.assert:
    that: path_check.contained | bool
    success_msg: "{{ success_msg }}"
    fail_msg: "{{ fail_msg }}"
  vars:
    success_msg: "All expected fields match. Extras: {{ path_check.extras }}"
    fail_msg: "Missing or mismatch: {{ path_check.missing }}. Extras: {{ path_check.extras }}"

Task Output:

# Manage Meraki appliance firewall rules — gather current configuration

Gather Current Appliance_firewall Configuration

- name: Gather current appliance_firewall configuration
  cisco.meraki_rm.meraki_appliance_firewall:
    network_id: "N_123456789012345678"
    state: gathered
  register: gathered

Assert Gathered Config Is Not Empty

- name: Assert gathered config is not empty
  ansible.builtin.assert:
    that:
      - gathered.config is defined
      - gathered.config | length > 0
    fail_msg: "Gathered config is empty — expected at least one resource"

Display Gathered Configuration

- name: Display gathered configuration
  ansible.builtin.debug:
    var: gathered.config

---
# Manage Meraki appliance firewall rules — create or update

- name: Define expected configuration
  ansible.builtin.set_fact:
    expected_config:
      syslog_default_rule: true
      access: example
      service: example

- name: Create appliance_firewall with merged state
  cisco.meraki_rm.meraki_appliance_firewall:
    network_id: "N_123456789012345678"
    state: merged
    config:
      - "{{ expected_config }}"
  register: merge_result

- name: Assert resource was created
  ansible.builtin.assert:
    that:
      - merge_result is changed
      - merge_result.config | length == 1

- name: Compare expected paths to result (subset check)
  ansible.builtin.set_fact:
    path_check: "{{ expected_paths | cisco.meraki_rm.path_contained_in(result_paths) }}"
  vars:
    expected_paths: "{{ expected_config | ansible.utils.to_paths }}"
    result_paths: "{{ merge_result.config[0] | ansible.utils.to_paths }}"

- name: Assert all expected fields are present and match
  ansible.builtin.assert:
    that: path_check.contained | bool
    success_msg: "{{ success_msg }}"
    fail_msg: "{{ fail_msg }}"
  vars:
    success_msg: "All expected fields match. Extras: {{ path_check.extras }}"
    fail_msg: "Missing or mismatch: {{ path_check.missing }}. Extras: {{ path_check.extras }}"

# Manage Meraki appliance firewall rules — full resource replacement

- name: Define replacement configuration
  ansible.builtin.set_fact:
    expected_config:
      syslog_default_rule: true
      access: example
      service: example

- name: Replace appliance_firewall configuration
  cisco.meraki_rm.meraki_appliance_firewall:
    network_id: "N_123456789012345678"
    state: replaced
    config:
      - "{{ expected_config }}"
  register: replace_result

- name: Assert resource was replaced
  ansible.builtin.assert:
    that:
      - replace_result is changed
      - replace_result.config | length == 1

- name: Compare expected paths to result (subset check)
  ansible.builtin.set_fact:
    path_check: "{{ expected_paths | cisco.meraki_rm.path_contained_in(result_paths) }}"
  vars:
    expected_paths: "{{ expected_config | ansible.utils.to_paths }}"
    result_paths: "{{ replace_result.config[0] | ansible.utils.to_paths }}"

- name: Assert all expected fields are present and match
  ansible.builtin.assert:
    that: path_check.contained | bool
    success_msg: "{{ success_msg }}"
    fail_msg: "{{ fail_msg }}"
  vars:
    success_msg: "All expected fields match. Extras: {{ path_check.extras }}"
    fail_msg: "Missing or mismatch: {{ path_check.missing }}. Extras: {{ path_check.extras }}"

# Manage Meraki appliance firewall rules — gather current configuration

- name: Gather current appliance_firewall configuration
  cisco.meraki_rm.meraki_appliance_firewall:
    network_id: "N_123456789012345678"
    state: gathered
  register: gathered

- name: Assert gathered config is not empty
  ansible.builtin.assert:
    that:
      - gathered.config is defined
      - gathered.config | length > 0
    fail_msg: "Gathered config is empty — expected at least one resource"

- name: Display gathered configuration
  ansible.builtin.debug:
    var: gathered.config

Return Values

config

list — returned: always

The resulting resource configuration.