Creating access-list wildcard masks for Cisco in Ansible

Working with access lists for Cisco IOS in Ansible is almost a nightmare by itself. This is due to the fact that you need to handle the exact position of each entry and you may have to remove the complete access list before you do anything.

One more thing to take into account is handling of wildcard bits. If you have defined your variables in CIDR notation you need to calculate the wildcard (or don't-care) bits before actually using them.

Just recently I found out there is a filter in Jinja2 that does exactly this calculation. It's an option in the ipaddr filter called 'hostmask'. It seems this filter is not so popular and I found very few references online, nevertheless it works quite well!

{{ mycidrvariable | ipaddr('hostmask') }}

For example if you apply this filter on '10.10.8.16/28' you will get '0.0.0.15'

7600 l2protocol forward vs ME3400 l2protocol-tunnel

ME3400

ME3400 is able to tunnel l2 protocols with the command "l2protocol-tunnel xxx"

Tunneled STP BPDUs have 01-00-0C-CD-CD-D0 as a destination mac-address

7600

On 7600 when using service instances on ES cards there is only one option, l2protocol forward.
As the name implies, the router does not alter the BPDUs. It just forwards them on the bridge domain bypassing the SP.

Tunneled STP BPDUs have 01-00-0C-CC-CC-CD as a destination mac-address

Following these different approaches, they can't interoperate in any easy way..