access_lists overwritten when defined in fabric, datacenter and as structured_config under a vrf

[PieterL75]

the definition of access_lists is overwritten by higer level of definitions
If I define an access_lists section in the 'fabric' and then one in the 'datacenter', the access_lists of the fabric is gone. I would expect them to be merged.
I tried "access_lists" in the fabric and "custom_structured_configuration_access_lists" in the 'datacenter', but that just doesn't stick. or even "custom_structured_configuration_access_lists" in both fabric and datacenter...

also, in Network_service, on a VRF, when I set a

        structured_config:
          access_lists:
            - name: SEC-SNMP_VRF_MIRROR-V4-IN
              sequence_numbers:
                - sequence: 10
                  action: permit host 100.74.2.130

it removes other already defined accesslist in the fabric or datacenter

[PieterL75]

This seems to work:

• no "access_lists" in the fabric
• "custom_structured_configuration_access_lists" in the datacenter
• "structured_config access_lists" in the network_services

now it all merges nicely..

Is seems that defining access_lists in the datacenter, simply replaces the access_lists of the fabric.
and if you don't use the custom_structured_configuration_access_lists in the datacenter, the "structured_config access_lists" in the network_services will overwrite the datacenter access_lists...

[ClausHolbechArista]

As I understand the issue, this is actually expected.
Please take a look at this article: https://avd.arista.com/stable/roles/eos_designs/docs/how-to/custom-structured-configuration.html
And also remember that Ansible can only have a variable once per device, so setting custom_structured_configuration_access_lists twice, will not be merged, but replaced by Ansible before AVD sees the variable. This is why we have custom_structured_configuration_prefix to allow you to have different lists that are then merged. All this is covered to some degree in the article.

Please let me know if you have further questions after going through this. Thanks!

[PieterL75]

It's a matter of wrapping my head around all these dependencies.

I managed to get the result I wanted, but it took me some time by trial and error.

Thx for replying!

Pieter