all:
  hosts:
    R1:
      ansible_host: 10.0.0.103
    R2:
      ansible_host: 10.0.0.104
    R3:
      ansible_host: 10.0.0.105
  vars:
    ansible_connection: ansible.netcommon.network_cli
    ansible_network_os: cisco.ios.ios
    ansible_user: cisco
    ansible_password: cisco
    ansible_become: yes
    ansible_become_method: enable
    ansible_become_password: cisco






[defaults]
inventory = inventory.yaml
host_key_checking = False






- name: SSH-MGMT
  cisco.ios.ios_acls:
    config:
      - afi: ipv4
        acls:
          - name: SSH-MGMT
            acl_type: standard
            aces:
              - grant: permit
                source:
                  address: 10.0.0.102
              - grant: permit
                source:
                  address: 10.0.10.0
                  wildcard_bits: 0.0.0.255

- name:  Apply ACL to VTY
  cisco.ios.ios_config:
    parents: "line vty 0 15"
    lines:
      - "access-class SSH-MGMT in"
      - "transport input ssh"






---
- name: Secure Management Access
  hosts: all
  gather_facts: no
  roles:
    - mgmt_access_control