cisco.ios 11.5.1 Released - Whats New and How to Test

Introduction

cisco.ios is the Ansible collection that provides modules, plugins, and connection/cliconf logic for automating Cisco IOS and IOS-XE network devices - things like ios_acls, ios_bgp_address_family, ios_user, ios_facts, and the ios connection/terminal plugins used to manage config state, VLANs, interfaces, routing, and users over CLI (network_cli).

Version 11.5.1 has just been published on Ansible Galaxy. Since this is the first version tracked for this collection on the blog, there is no prior baseline to diff against - the notes below come straight from the collection's own changelog for this release.

Whats New

This is a bugfix and documentation release. No new modules or feature additions are included; the changes focus on ACL protocol mapping, BGP address-family SAFI choices, terminal error detection, and a set of idempotency fixes in ios_user around hashed passwords.

Bugfixes

• ios_acls - Corrected port-to-protocol mapping for ports 5001 and 5002.
• ios_bgp_address_family - Added vpls as a valid safi choice for the l2vpn address family configuration.
• ios_user - Fixed hashed_password idempotency so that re-applying the same type/value pair against an already-configured user produces no commands, preventing unnecessary password updates on repeat runs.
• ios_user - The parse_hashed_password helper now extracts the stored hash type and hash value from the running config, enabling proper diff-based idempotency checks for hashed_password.
• ios_user - update_password and password_type are now resolved per aggregate item via get_param_value, allowing each entry in the aggregate list to independently override the module-level defaults.
• terminal - Added % IPv6 routing not enabled to terminal_stderr_re so that configuring BGP IPv6/VPNv6 address-family without ipv6 unicast-routing correctly raises an error instead of silently succeeding (issue #1301).

Documentation Changes

• ios_user - Clarified that update_password (on_create/always) applies only to configured_password; hashed_password always uses hash type and value comparison to determine whether a change is required.
• ios_user - Documented type 9 (scrypt) as a valid hash type alongside the existing type 5 (MD5) and type 8 (PBKDF2) examples for hashed_password.

Why the ios_user fixes matter

Before this release, re-running a playbook that set hashed_password on an ios_user entry could report a change every run, even when the device already had the exact same hash configured. The new parse_hashed_password helper reads the type and value straight from the running config, so Ansible can do a real diff instead of assuming a change is always needed. Combined with the per-aggregate resolution of update_password/password_type, this makes bulk user management via the aggregate parameter behave consistently across mixed configurations.

Components Involved

Installation and Verification

# Install (or upgrade to) this exact version from Galaxy
ansible-galaxy collection install cisco.ios:==11.5.1

# Verify the installed version
ansible-galaxy collection list cisco.ios

# Inspect the changelog shipped inside the collection
find ~/.ansible/collections -path '*cisco/ios*/CHANGELOG.rst' -exec cat {} \;

# Quick sanity check: run ios_facts against a lab device
ansible -m cisco.ios.ios_facts -i inventory.ini ios_lab_host

For labs testing the ios_user hashed_password fix specifically, apply the same hashed_password value twice in a row with -C (check mode) or --diff on the second run and confirm no changes are reported.