Ansible执行Cisco IOS AAA命令遇交互式确认失败求助

现象 #

运行Ansible Playbook执行多数AAA命令均正常，但执行aaa accounting identity default start-stop group ISE-RADIUS-SERVERS时失败。直接在交换机CLI执行该命令会触发不可逆转换的交互式确认：

Net-Lab-02(config)#aaa accounting identity default start-stop group ISE-RADIUS-SERVERS
This operation will permanently convert all relevant authentication commands to their CPL control-policy equivalents. As this conversion is irreversible and will disable the conversion CLI 'authentication display [legacy|new-style]', you are strongly advised to back up your current configuration before proceeding.
Do you wish to continue? [yes]:

尝试的Playbook任务 #

编写以下任务，多次调整写法仍未解决问题：

tasks:
  - name: Run commands that require answering a prompt
    cisco.ios.ios_command:
      commands:
        - command: "aaa accounting identity default start-stop group ISE-RADIUS-SERVERS"
          prompt: 'Do you wish to continue? \[yes\]:'
          answer: "yes"

报错信息 #

执行后返回如下错误：

fatal: [Net-Lab-02]: FAILED! => {"changed": false, "msg": "aaa accounting identity default start-stop group ISE-RADIUS-SERVERS\r\naaa accounting identity default start-stop group ISE-RADIUS-SERVERS\r\n ^\r\n% Invalid input detected at '^' marker.\r\n\r\nNet-Lab-02#"}

问题分析与解决方法 #

核心原因 #

1. 命令重复执行：错误信息显示命令被执行了两次，大概率是ios_command模块的交互匹配逻辑异常，未正确识别确认提示，导致重复发送命令。
2. 模式错误：该命令需在全局配置模式下执行，而ios_command默认处于特权模式，未切换模式直接执行会触发语法错误。
3. Prompt匹配精度不足：仅匹配末尾的确认提示可能不够，模块可能未捕获到完整的交互触发流程。

修正方案 #

方案1：用ios_command明确切换配置模式并优化交互

tasks:
  - name: Execute AAA accounting command with confirmation
    cisco.ios.ios_command:
      commands:
        - command: "configure terminal"
        - command: "aaa accounting identity default start-stop group ISE-RADIUS-SERVERS"
          prompt: 'Do you wish to continue? \[yes\]:'
          answer: "yes"
          newline: true
        - command: "end"

方案2：改用ios_config模块（推荐）

ios_config是专门用于设备配置的模块，自动处理模式切换，交互逻辑更可靠：

tasks:
  - name: Configure AAA accounting identity with confirmation
    cisco.ios.ios_config:
      lines:
        - aaa accounting identity default start-stop group ISE-RADIUS-SERVERS
      prompts:
        - 'Do you wish to continue? \[yes\]:'
      answers:
        - 'yes'
      match: none

额外提示 #

• 若仍存在匹配问题，可扩展prompt正则表达式，匹配完整的警告提示开头：prompt: 'This operation will permanently convert.*Do you wish to continue? \[yes\]:'
• 执行前务必备份设备配置，该命令会触发不可逆的配置转换。

内容的提问来源于stack exchange，提问作者user2011902