natm_playbook.yml

---
# This play encompasses all NAT routers and makes changes to the NAT config
# on each device (assumine ci_test is false).
- name: "Manage NAT configuration on IOS routers"
  hosts: "ios_router"
  tasks:
    # When 'log' is true, execute the log preparation
    - name: "INCLUDE >> Perform logging preparation if 'log' is true"
      include_tasks: "tasks/log_setup.yml"
      when: "log"

    # Ensure inputs are correct and ready for processing
    - name: "INCLUDE >> Perform preliminary error checking on inputs"
      include_tasks: "tasks/pre_check.yml"

    # When CI testing is false (the general case), then log into the routers,
    # collect their NAT information, and make appropriate updates.
    - name: "INCLUDE >> Manage NAT statements on router"
      include_tasks: "tasks/manage_nat.yml"
      when: "not ci_test"

    # When CI testing is true, mock up a NAT table for checking later in the
    # playbook based on what is specified in the group/host variables file.
    - name: "INCLUDE >> Generate mock data for CI testing"
      include_tasks: "tasks/mock_{{ inventory_hostname }}.yml"
      when: "ci_test"

    # Print the table to stdout in raw format for troubleshooting
    - name: "DEBUG >> Print NAT translation table"
      debug:
        msg: "{{ NAT_TABLE.stdout[0] }}"
        verbosity: 1

    # Entries that are supposed to be present, per the state selector,
    # must be present at this point. If they are not, the task fails.
    - name: "SYS >> Verify present entries are present"
      assert:
        that:
          - "item.inside_private in NAT_TABLE.stdout[0]"
          - "item.outside_public in NAT_TABLE.stdout[0]"
        msg: |-
          NAT entry {{ item.inside_private }},{{ item.outside_public }}
          with name {{ item.name }} not found when state was 'present'
      when: "item.state == 'present'"
      loop: "{{ static_nats }}"
      loop_control:
        label: >-
          Present? {{ item.name }}:
          {{ item.inside_private }}->{{ item.outside_public }}

    # Entries that are supposed to be absent, per the state selector,
    # must be absent at this point. If they are not, the task fails.
    - name: "SYS >> Verify absent entries are absent"
      assert:
        that:
          - "not item.inside_private in NAT_TABLE.stdout[0]"
          - "not item.outside_public in NAT_TABLE.stdout[0]"
        msg: |-
          NAT entry {{ item.inside_private }},{{ item.outside_public }}
          with name {{ item.name }} found when state was 'absent'
      when: "item.state == 'absent'"
      loop: "{{ static_nats }}"
      loop_control:
        label: >-
          Absent? {{ item.name }}:
          {{ item.inside_private }}->{{ item.outside_public }}

  # If these handlers are invoked, it means that changes to the state
  # table occurred, and these changes should be appropriately logged.
  handlers:
    # The updates will be assembled into one text blob using newlines
    # and written to the screen for interested users.
    - name: "LOG >> Print updates written to device to stdout"
      listen: "updates exist"
      debug:
        msg: "{{ NAT_CONFIG.updates | join('\n') }}"

    - name: "INCLUDE >> Write logs to disk if 'log' is true"
      include: "tasks/log_write.yml"
      when: "log"
...