diff --git a/lib/ansible/plugins/action/ios.py b/lib/ansible/plugins/action/ios.py
index a06e29f52a..57d84a97ff 100644
--- a/lib/ansible/plugins/action/ios.py
+++ b/lib/ansible/plugins/action/ios.py
@@ -68,6 +68,13 @@ class ActionModule(_ActionModule):
             rc, out, err = connection.exec_command('open_shell()')
             if not rc == 0:
                 return {'failed': True, 'msg': 'unable to open shell', 'rc': rc}
+        else:
+            # make sure we are in the right cli context which should be
+            # enable mode and not config module
+            rc, out, err = connection.exec_command('prompt()')
+            if str(out).strip().endswith(')#'):
+                display.vvv('wrong context, sending exit to device', self._play_context.remote_addr)
+                connection.exec_command('exit')
 
         task_vars['ansible_socket'] = socket_path
 
@@ -75,15 +82,7 @@ class ActionModule(_ActionModule):
             self._play_context.become = False
             self._play_context.become_method = None
 
-
-        results = super(ActionModule, self).run(tmp, task_vars)
-
-        # need to make sure to leave config mode if the module didn't clean up
-        rc, out, err = connection.exec_command('prompt()')
-        if str(out).strip().endswith(')#'):
-            connection.exec_command('exit')
-
-        return results
+        return super(ActionModule, self).run(tmp, task_vars)
 
     def _get_socket_path(self, play_context):
         ssh = connection_loader.get('ssh', class_only=True)
@@ -117,5 +116,3 @@ class ActionModule(_ActionModule):
             return strategy(*args, **kwargs)
         except AnsibleFallbackNotFound:
             pass
-
-
diff --git a/lib/ansible/plugins/connection/network_cli.py b/lib/ansible/plugins/connection/network_cli.py
index ef3d2017b9..3b068e901b 100644
--- a/lib/ansible/plugins/connection/network_cli.py
+++ b/lib/ansible/plugins/connection/network_cli.py
@@ -193,16 +193,22 @@ class Connection(_Connection):
 
     def _find_prompt(self, response):
         """Searches the buffered response for a matching command prompt"""
+        errored_response = None
         for regex in self._terminal.terminal_errors_re:
             if regex.search(response):
-                raise AnsibleConnectionFailure(response)
+                errored_response = response
+                break
 
         for regex in self._terminal.terminal_prompts_re:
             match = regex.search(response)
             if match:
                 self._matched_pattern = regex.pattern
                 self._matched_prompt = match.group()
-                return True
+                if not errored_response:
+                    return True
+
+        if errored_response:
+            raise AnsibleConnectionFailure(errored_response)
 
     def alarm_handler(self, signum, frame):
         """Alarm handler raised in case of command timeout """