diff --git a/lib/ansible/module_utils/nxos.py b/lib/ansible/module_utils/nxos.py
index d6254832565..136f9dcc3e3 100644
--- a/lib/ansible/module_utils/nxos.py
+++ b/lib/ansible/module_utils/nxos.py
@@ -41,12 +41,16 @@ _DEVICE_CONNECTION = None
 nxos_argument_spec = {
     'host': dict(),
     'port': dict(type='int'),
+
     'username': dict(fallback=(env_fallback, ['ANSIBLE_NET_USERNAME'])),
     'password': dict(fallback=(env_fallback, ['ANSIBLE_NET_PASSWORD']), no_log=True),
+    'ssh_keyfile': dict(fallback=(env_fallback, ['ANSIBLE_NET_SSH_KEYFILE'])),
+
     'use_ssl': dict(type='bool'),
     'validate_certs': dict(type='bool'),
     'timeout': dict(type='int'),
-    'provider': dict(type='dict'),
+
+    'provider': dict(type='dict', no_log=True),
     'transport': dict(choices=['cli', 'nxapi'])
 }
 
@@ -347,7 +351,7 @@ def get_config(module, flags=[]):
 
 def run_commands(module, commands, check_rc=True):
     conn = get_connection(module)
-    return conn.run_commands(to_command(module, commands))
+    return conn.run_commands(to_command(module, commands), check_rc)
 
 def load_config(module, config):
     conn = get_connection(module)
diff --git a/lib/ansible/modules/network/nxos/nxos_nxapi.py b/lib/ansible/modules/network/nxos/nxos_nxapi.py
index 5108b24d522..f40ecd78146 100644
--- a/lib/ansible/modules/network/nxos/nxos_nxapi.py
+++ b/lib/ansible/modules/network/nxos/nxos_nxapi.py
@@ -209,7 +209,7 @@ def parse_sandbox(data):
 
 def map_config_to_obj(module):
     out = run_commands(module, ['show nxapi'], check_rc=False)
-    if not out[0]:
+    if out[0] == '':
         return {'state': 'absent'}
 
     out = str(out[0]).strip()
diff --git a/lib/ansible/plugins/action/nxos.py b/lib/ansible/plugins/action/nxos.py
index dee35e0e831..6c13aaf7a35 100644
--- a/lib/ansible/plugins/action/nxos.py
+++ b/lib/ansible/plugins/action/nxos.py
@@ -57,6 +57,8 @@ class ActionModule(_ActionModule):
             pc.port = provider['port'] or self._play_context.port or 22
             pc.remote_user = provider['username'] or self._play_context.connection_user
             pc.password = provider['password'] or self._play_context.password
+            pc.private_key_file = provider['ssh_keyfile'] or self._play_context.private_key_file
+            pc.timeout = provider['timeout'] or self._play_context.timeout
 
             connection = self._shared_loader_obj.connection_loader.get('persistent', pc, sys.stdin)
 
@@ -71,18 +73,16 @@ class ActionModule(_ActionModule):
             task_vars['ansible_socket'] = socket_path
 
         else:
-            if provider['host'] is None:
-                self._task.args['host'] = self._play_context.remote_addr
-            if provider['username'] is None:
-                self._task.args['username'] = self._play_context.connection_user
-            if provider['password'] is None:
-                self._task.args['password'] = self._play_context.password
-            if provider['timeout'] is None:
-                self._task.args['timeout'] = self._play_context.timeout
-            if task_vars.get('nxapi_use_ssl'):
-                self._task.args['use_ssl'] = task_vars['nxapi_use_ssl']
-            if task_vars.get('nxapi_validate_certs'):
-                self._task.args['validate_certs'] = task_vars['nxapi_validate_certs']
+            provider_arg = {
+                'host': self._play_context.remote_addr,
+                'port': provider.get('port'),
+                'username': provider.get('username') or self._play_context.connection_user,
+                'password': provider.get('password') or self._play_context.password,
+                'timeout': provider.get('timeout') or self._play_context.timeout,
+                'use_ssl': task_vars.get('nxapi_use_ssl') or False,
+                'validate_certs': task_vars.get('nxapi_validate_certs') or True
+            }
+            self._task.args['provider'] = provider_arg
 
 
         result = super(ActionModule, self).run(tmp, task_vars)