diff --git a/lib/ansible/modules/network/ironware/ironware_config.py b/lib/ansible/modules/network/ironware/ironware_config.py
new file mode 100644
index 00000000000..6fd48216596
--- /dev/null
+++ b/lib/ansible/modules/network/ironware/ironware_config.py
@@ -0,0 +1,285 @@
+#!/usr/bin/python
+#
+# Copyright: Ansible Project
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+ANSIBLE_METADATA = {'metadata_version': '1.1',
+                    'status': ['preview'],
+                    'supported_by': 'community'}
+
+
+DOCUMENTATION = """
+---
+module: ironware_config
+version_added: "2.5"
+author: "Paul Baker (@paulquack)"
+short_description: Manage configuration sections on Brocade Ironware devices
+description:
+  - Brocade Ironware configurations use a simple block indent file syntax
+    for segmenting configuration into sections.  This module provides
+    an implementation for working with Ironware configuration sections in
+    a deterministic way.
+extends_documentation_fragment: ironware
+options:
+  lines:
+    description:
+      - The ordered set of commands that should be configured in the
+        section.  The commands must be the exact same commands as found
+        in the device running-config.  Be sure to note the configuration
+        command syntax as some commands are automatically modified by the
+        device config parser.
+    required: false
+    default: null
+    aliases: ['commands']
+  parents:
+    description:
+      - The ordered set of parents that uniquely identify the section
+        the commands should be checked against.  If the parents argument
+        is omitted, the commands are checked against the set of top
+        level or global commands.
+    required: false
+    default: null
+  src:
+    description:
+      - Specifies the source path to the file that contains the configuration
+        or configuration template to load.  The path to the source file can
+        either be the full path on the Ansible control host or a relative
+        path from the playbook or role root directory.  This argument is mutually
+        exclusive with I(lines).
+    required: false
+    default: null
+  before:
+    description:
+      - The ordered set of commands to push on to the command stack if
+        a change needs to be made.  This allows the playbook designer
+        the opportunity to perform configuration commands prior to pushing
+        any changes without affecting how the set of commands are matched
+        against the system
+    required: false
+    default: null
+  after:
+    description:
+      - The ordered set of commands to append to the end of the command
+        stack if a change needs to be made.  Just like with I(before) this
+        allows the playbook designer to append a set of commands to be
+        executed after the command set.
+    required: false
+    default: null
+  match:
+    description:
+      - Instructs the module on the way to perform the matching of
+        the set of commands against the current device config.  If
+        match is set to I(line), commands are matched line by line.  If
+        match is set to I(strict), command lines are matched with respect
+        to position.  If match is set to I(exact), command lines
+        must be an equal match.  Finally, if match is set to I(none), the
+        module will not attempt to compare the source configuration with
+        the running configuration on the remote device.
+    required: false
+    default: line
+    choices: ['line', 'strict', 'exact', 'none']
+  replace:
+    description:
+      - Instructs the module on the way to perform the configuration
+        on the device.  If the replace argument is set to I(line) then
+        the modified lines are pushed to the device in configuration
+        mode.  If the replace argument is set to I(block) then the entire
+        command block is pushed to the device in configuration mode if any
+        line is not correct
+    required: false
+    default: line
+    choices: ['line', 'block']
+  update:
+    description:
+      - The I(update) argument controls how the configuration statements
+        are processed on the remote device.  Valid choices for the I(update)
+        argument are I(merge) and I(check).  When the argument is set to
+        I(merge), the configuration changes are merged with the current
+        device running configuration.  When the argument is set to I(check)
+        the configuration updates are determined but not actually configured
+        on the remote device.
+    required: false
+    default: merge
+    choices: ['merge', 'check']
+  commit:
+    description:
+      - This argument specifies the update method to use when applying the
+        configuration changes to the remote node.  If the value is set to
+        I(merge) the configuration updates are merged with the running-
+        config.  If the value is set to I(check), no changes are made to
+        the remote host.
+    required: false
+    default: merge
+    choices: ['merge', 'check']
+  backup:
+    description:
+      - This argument will cause the module to create a full backup of
+        the current C(running-config) from the remote device before any
+        changes are made.  The backup file is written to the C(backup)
+        folder in the playbook root directory.  If the directory does not
+        exist, it is created.
+    required: false
+    default: no
+    choices: ['yes', 'no']
+  config:
+    description:
+      - The C(config) argument allows the playbook designer to supply
+        the base configuration to be used to validate configuration
+        changes necessary.  If this argument is provided, the module
+        will not download the running-config from the remote node.
+    required: false
+    default: null
+  save_when:
+    description:
+      - When changes are made to the device running-configuration, the
+        changes are not copied to non-volatile storage by default.  Using
+        this argument will change that before.  If the argument is set to
+        I(always), then the running-config will always be copied to the
+        startup-config and the I(modified) flag will always be set to
+        True.  If the argument is set to I(modified), then the running-config
+        will only be copied to the startup-config if it has changed since
+        the last save to startup-config.  If the argument is set to
+        I(never), the running-config will never be copied to the
+        startup-config
+    required: false
+    default: never
+    choices: ['always', 'never', 'modified']
+    version_added: "2.4"
+"""
+
+EXAMPLES = """
+- ironware_config:
+    lines:
+      - port-name test
+      - enable
+      - load-interval 30
+      - rate-limit input broadcast unknown-unicast multicast 521216 64000
+    parents: ['interface ethernet 1/2']
+"""
+
+RETURN = """
+updates:
+  description: The set of commands that will be pushed to the remote device
+  returned: always
+  type: list
+  sample: ['...', '...']
+backup_path:
+  description: The full path to the backup file
+  returned: when backup is yes
+  type: string
+  sample: /playbooks/ansible/backup/ironware_config.2016-07-16@22:28:34
+"""
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ironware import ironware_argument_spec, check_args
+from ansible.module_utils.ironware import get_config, load_config, run_commands
+from ansible.module_utils.netcfg import NetworkConfig, dumps, ConfigLine
+from ansible.module_utils._text import to_native
+
+
+def get_candidate(module):
+    candidate = NetworkConfig(indent=1)
+    if module.params['src']:
+        candidate.load(module.params['src'])
+    elif module.params['lines']:
+        parents = module.params['parents'] or list()
+        candidate.add(module.params['lines'], parents=parents)
+    return candidate
+
+
+def run(module, result):
+    match = module.params['match']
+    replace = module.params['replace']
+    path = module.params['parents']
+    configobjs = None
+
+    candidate = get_candidate(module)
+    if match != 'none':
+        contents = module.params['config']
+        if not contents:
+            contents = get_config(module)
+        config = NetworkConfig(indent=1, contents=contents)
+        configobjs = candidate.difference(config, path=path, match=match,
+                                          replace=replace)
+
+    else:
+        configobjs = candidate.items
+    if configobjs:
+        commands = dumps(configobjs, 'commands').split('\n')
+
+        if module.params['lines']:
+            if module.params['before']:
+                commands[:0] = module.params['before']
+
+            if module.params['after']:
+                commands.extend(module.params['after'])
+
+        result['updates'] = commands
+
+        # send the configuration commands to the device and merge
+        # them with the current running config
+        if not module.check_mode:
+            load_config(module, commands)
+        result['changed'] = True
+
+    if result['changed'] or module.params['save_when'] == 'always':
+        result['changed'] = True
+        if not module.check_mode:
+            cmd = {'command': 'write memory', 'output': 'text'}
+            run_commands(module, [cmd])
+
+
+def main():
+    """ main entry point for module execution
+    """
+    argument_spec = dict(
+        src=dict(type='path'),
+
+        lines=dict(aliases=['commands'], type='list'),
+        parents=dict(type='list'),
+
+        before=dict(type='list'),
+        after=dict(type='list'),
+
+        match=dict(default='line', choices=['line', 'strict', 'exact', 'none']),
+        replace=dict(default='line', choices=['line', 'block']),
+
+        config=dict(),
+
+        backup=dict(type='bool', default=False),
+        save_when=dict(choices=['always', 'never', 'modified'], default='never')
+
+    )
+
+    argument_spec.update(ironware_argument_spec)
+
+    mutually_exclusive = [('lines', 'src')]
+
+    required_if = [('match', 'strict', ['lines']),
+                   ('match', 'exact', ['lines']),
+                   ('replace', 'block', ['lines'])]
+
+    module = AnsibleModule(argument_spec=argument_spec,
+                           mutually_exclusive=mutually_exclusive,
+                           required_if=required_if,
+                           supports_check_mode=True)
+
+    result = {'changed': False}
+
+    check_args(module)
+
+    config = None
+
+    if module.params['backup']:
+        result['__backup__'] = get_config(module)
+
+    run(module, result)
+
+    module.exit_json(**result)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/lib/ansible/plugins/action/ironware_config.py b/lib/ansible/plugins/action/ironware_config.py
new file mode 100644
index 00000000000..6406d4c4655
--- /dev/null
+++ b/lib/ansible/plugins/action/ironware_config.py
@@ -0,0 +1,112 @@
+#
+# (c) 2017, Red Hat, Inc.
+#
+# This file is part of Ansible
+#
+# Ansible is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Ansible is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
+#
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+import os
+import re
+import time
+import glob
+
+from ansible.plugins.action.ironware import ActionModule as _ActionModule
+from ansible.module_utils._text import to_text
+from ansible.module_utils.six.moves.urllib.parse import urlsplit
+from ansible.utils.vars import merge_hash
+
+PRIVATE_KEYS_RE = re.compile('__.+__')
+
+
+class ActionModule(_ActionModule):
+
+    def run(self, tmp=None, task_vars=None):
+
+        if self._task.args.get('src'):
+            try:
+                self._handle_template()
+            except ValueError as exc:
+                return dict(failed=True, msg=exc.message)
+
+        result = super(ActionModule, self).run(tmp, task_vars)
+
+        if self._task.args.get('backup') and result.get('__backup__'):
+            # User requested backup and no error occurred in module.
+            # NOTE: If there is a parameter error, _backup key may not be in results.
+            filepath = self._write_backup(task_vars['inventory_hostname'],
+                                          result['__backup__'])
+
+            result['backup_path'] = filepath
+
+        # strip out any keys that have two leading and two trailing
+        # underscore characters
+        for key in result.keys():
+            if PRIVATE_KEYS_RE.match(key):
+                del result[key]
+
+        return result
+
+    def _get_working_path(self):
+        cwd = self._loader.get_basedir()
+        if self._task._role is not None:
+            cwd = self._task._role._role_path
+        return cwd
+
+    def _write_backup(self, host, contents):
+        backup_path = self._get_working_path() + '/backup'
+        if not os.path.exists(backup_path):
+            os.mkdir(backup_path)
+        for fn in glob.glob('%s/%s*' % (backup_path, host)):
+            os.remove(fn)
+        tstamp = time.strftime("%Y-%m-%d@%H:%M:%S", time.localtime(time.time()))
+        filename = '%s/%s_config.%s' % (backup_path, host, tstamp)
+        open(filename, 'w').write(contents)
+        return filename
+
+    def _handle_template(self):
+        src = self._task.args.get('src')
+        working_path = self._get_working_path()
+
+        if os.path.isabs(src) or urlsplit('src').scheme:
+            source = src
+        else:
+            source = self._loader.path_dwim_relative(working_path, 'templates', src)
+            if not source:
+                source = self._loader.path_dwim_relative(working_path, src)
+
+        if not os.path.exists(source):
+            raise ValueError('path specified in src not found')
+
+        try:
+            with open(source, 'r') as f:
+                template_data = to_text(f.read())
+        except IOError:
+            return dict(failed=True, msg='unable to load src file')
+
+        # Create a template search path in the following order:
+        # [working_path, self_role_path, dependent_role_paths, dirname(source)]
+        searchpath = [working_path]
+        if self._task._role is not None:
+            searchpath.append(self._task._role._role_path)
+            if hasattr(self._task, "_block:"):
+                dep_chain = self._task._block.get_dep_chain()
+                if dep_chain is not None:
+                    for role in dep_chain:
+                        searchpath.append(role._role_path)
+        searchpath.append(os.path.dirname(source))
+        self._templar.environment.loader.searchpath = searchpath
+        self._task.args['src'] = self._templar.template(template_data)
diff --git a/test/units/modules/network/ironware/fixtures/ironware_config_config.cfg b/test/units/modules/network/ironware/fixtures/ironware_config_config.cfg
new file mode 100644
index 00000000000..6a509a3e0b1
--- /dev/null
+++ b/test/units/modules/network/ironware/fixtures/ironware_config_config.cfg
@@ -0,0 +1,12 @@
+!
+hostname router
+!
+interface ethernet 1/1
+ ip address 1.2.3.4 255.255.255.0
+ port-name test string
+ enable
+!
+interface ethernet 1/2
+ ip address 6.7.8.9 255.255.255.0
+ port-name test string
+!
diff --git a/test/units/modules/network/ironware/fixtures/ironware_config_defaults.cfg b/test/units/modules/network/ironware/fixtures/ironware_config_defaults.cfg
new file mode 100644
index 00000000000..b60e1c94133
--- /dev/null
+++ b/test/units/modules/network/ironware/fixtures/ironware_config_defaults.cfg
@@ -0,0 +1,13 @@
+!
+hostname router
+!
+interface ethernet 1/1
+ ip address 1.2.3.4 255.255.255.0
+ port-name test string
+ enable
+!
+interface ethernet 1/2
+ ip address 6.7.8.9 255.255.255.0
+ port-name test string
+ disable
+!
diff --git a/test/units/modules/network/ironware/fixtures/ironware_config_src.cfg b/test/units/modules/network/ironware/fixtures/ironware_config_src.cfg
new file mode 100644
index 00000000000..1ca1d600ad8
--- /dev/null
+++ b/test/units/modules/network/ironware/fixtures/ironware_config_src.cfg
@@ -0,0 +1,10 @@
+!
+hostname foo
+!
+interface ethernet 1/1
+ no ip address
+!
+interface ethernet 1/2
+ ip address 6.7.8.9 255.255.255.0
+ port-name test string
+!
diff --git a/test/units/modules/network/ironware/test_ironware_config.py b/test/units/modules/network/ironware/test_ironware_config.py
new file mode 100644
index 00000000000..c23c1a8b817
--- /dev/null
+++ b/test/units/modules/network/ironware/test_ironware_config.py
@@ -0,0 +1,163 @@
+#
+# (c) 2016 Red Hat Inc.
+#
+# This file is part of Ansible
+#
+# Ansible is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Ansible is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
+
+# Make coding more python3-ish
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+import json
+
+from ansible.compat.tests.mock import patch
+from ansible.modules.network.ironware import ironware_config
+from .ironware_module import TestIronwareModule, load_fixture, set_module_args
+
+
+class TestIronwareConfigModule(TestIronwareModule):
+
+    module = ironware_config
+
+    def setUp(self):
+        self.mock_get_config = patch('ansible.modules.network.ironware.ironware_config.get_config')
+        self.get_config = self.mock_get_config.start()
+
+        self.mock_load_config = patch('ansible.modules.network.ironware.ironware_config.load_config')
+        self.load_config = self.mock_load_config.start()
+
+        self.mock_run_commands = patch('ansible.modules.network.ironware.ironware_config.run_commands')
+        self.run_commands = self.mock_run_commands.start()
+
+    def tearDown(self):
+        self.mock_get_config.stop()
+        self.mock_load_config.stop()
+        self.mock_run_commands.stop()
+
+    def load_fixtures(self, commands=None):
+        config_file = 'ironware_config_config.cfg'
+        self.get_config.return_value = load_fixture(config_file)
+        self.load_config.return_value = None
+
+    def execute_module(self, failed=False, changed=False, updates=None, sort=True, defaults=False):
+
+        self.load_fixtures(updates)
+
+        if failed:
+            result = self.failed()
+            self.assertTrue(result['failed'], result)
+        else:
+            result = self.changed(changed)
+            self.assertEqual(result['changed'], changed, result)
+
+        if updates is not None:
+            if sort:
+                self.assertEqual(sorted(updates), sorted(result['updates']), result['updates'])
+            else:
+                self.assertEqual(updates, result['updates'], result['updates'])
+
+        return result
+
+    def test_ironware_config_unchanged(self):
+        src = load_fixture('ironware_config_config.cfg')
+        set_module_args(dict(src=src))
+        self.execute_module()
+
+    def test_ironware_config_src(self):
+        src = load_fixture('ironware_config_src.cfg')
+        set_module_args(dict(src=src))
+        updates = ['hostname foo', 'interface ethernet 1/1',
+                   'no ip address']
+        self.execute_module(changed=True, updates=updates)
+
+    def test_ironware_config_backup(self):
+        set_module_args(dict(backup=True))
+        result = self.execute_module()
+        self.assertIn('__backup__', result)
+
+    def test_ironware_config_save_always(self):
+        self.run_commands.return_value = "hostname foobar"
+        set_module_args(dict(save_when='always'))
+        self.execute_module(changed=True)
+        self.assertEqual(self.run_commands.call_count, 1)
+        self.assertEqual(self.get_config.call_count, 1)
+        self.assertEqual(self.load_config.call_count, 0)
+
+    def test_ironware_config_lines_wo_parents(self):
+        set_module_args(dict(lines=['hostname foobar']))
+        updates = ['hostname foobar']
+        self.execute_module(changed=True, updates=updates)
+
+    def test_ironware_config_lines_w_parents(self):
+        set_module_args(dict(lines=['disable'], parents=['interface ethernet 1/1']))
+        updates = ['interface ethernet 1/1', 'disable']
+        self.execute_module(changed=True, updates=updates)
+
+    def test_ironware_config_before(self):
+        set_module_args(dict(lines=['hostname foo'], before=['test1', 'test2']))
+        updates = ['test1', 'test2', 'hostname foo']
+        self.execute_module(changed=True, updates=updates, sort=False)
+
+    def test_ironware_config_after(self):
+        set_module_args(dict(lines=['hostname foo'], after=['test1', 'test2']))
+        updates = ['hostname foo', 'test1', 'test2']
+        self.execute_module(changed=True, updates=updates, sort=False)
+
+    def test_ironware_config_before_after_no_change(self):
+        set_module_args(dict(lines=['hostname router'],
+                             before=['test1', 'test2'],
+                             after=['test3', 'test4']))
+        self.execute_module()
+
+    def test_ironware_config_config(self):
+        config = 'hostname localhost'
+        set_module_args(dict(lines=['hostname router'], config=config))
+        updates = ['hostname router']
+        self.execute_module(changed=True, updates=updates)
+
+    def test_ironware_config_replace_block(self):
+        lines = ['port-name test string', 'test string']
+        parents = ['interface ethernet 1/1']
+        set_module_args(dict(lines=lines, replace='block', parents=parents))
+        updates = parents + lines
+        self.execute_module(changed=True, updates=updates)
+
+    def test_ironware_config_match_none(self):
+        lines = ['hostname router']
+        set_module_args(dict(lines=lines, match='none'))
+        self.execute_module(changed=True, updates=lines)
+
+    def test_ironware_config_match_none(self):
+        lines = ['ip address 1.2.3.4 255.255.255.0', 'port-name test string']
+        parents = ['interface ethernet 1/1']
+        set_module_args(dict(lines=lines, parents=parents, match='none'))
+        updates = parents + lines
+        self.execute_module(changed=True, updates=updates, sort=False)
+
+    def test_ironware_config_match_strict(self):
+        lines = ['ip address 1.2.3.4 255.255.255.0', 'port-name test string',
+                 'disable']
+        parents = ['interface ethernet 1/1']
+        set_module_args(dict(lines=lines, parents=parents, match='strict'))
+        updates = parents + ['disable']
+        self.execute_module(changed=True, updates=updates, sort=False)
+
+    def test_ironware_config_match_exact(self):
+        lines = ['ip address 1.2.3.4 255.255.255.0', 'port-name test string',
+                 'disable']
+        parents = ['interface ethernet 1/1']
+        set_module_args(dict(lines=lines, parents=parents, match='exact'))
+        updates = parents + lines
+        self.execute_module(changed=True, updates=updates, sort=False)