diff --git a/lib/ansible/module_utils/aireos.py b/lib/ansible/module_utils/aireos.py
index a7d9b5d1f9..70160cc14d 100644
--- a/lib/ansible/module_utils/aireos.py
+++ b/lib/ansible/module_utils/aireos.py
@@ -43,10 +43,16 @@ aireos_provider_spec = {
 aireos_argument_spec = {
     'provider': dict(type='dict', options=aireos_provider_spec)
 }
-aireos_argument_spec.update(aireos_provider_spec)
 
-# Add argument's default value here
-ARGS_DEFAULT_VALUE = {}
+aireos_top_spec = {
+    'host': dict(removed_in_version=2.3),
+    'port': dict(removed_in_version=2.3, type='int'),
+    'username': dict(removed_in_version=2.3),
+    'password': dict(removed_in_version=2.3, no_log=True),
+    'ssh_keyfile': dict(removed_in_version=2.3, type='path'),
+    'timeout': dict(removed_in_version=2.3, type='int'),
+}
+aireos_argument_spec.update(aireos_top_spec)
 
 
 def sanitize(resp):
@@ -59,21 +65,12 @@ def sanitize(resp):
     return '\n'.join(cleaned).strip()
 
 
-def get_argspec():
-    return aireos_argument_spec
+def get_provider_argspec():
+    return aireos_provider_spec
 
 
 def check_args(module, warnings):
-    for key in aireos_argument_spec:
-        if key not in ['provider', 'authorize'] and module.params[key]:
-            warnings.append('argument %s has been deprecated and will be removed in a future version' % key)
-
-    # set argument's default value if not provided in input
-    # This is done to avoid unwanted argument deprecation warning
-    # in case argument is not given as input (outside provider).
-    for key in ARGS_DEFAULT_VALUE:
-        if not module.params.get(key, None):
-            module.params[key] = ARGS_DEFAULT_VALUE[key]
+    pass
 
 
 def get_config(module, flags=None):
diff --git a/lib/ansible/module_utils/aruba.py b/lib/ansible/module_utils/aruba.py
index 829feb374b..bff164d435 100644
--- a/lib/ansible/module_utils/aruba.py
+++ b/lib/ansible/module_utils/aruba.py
@@ -43,27 +43,25 @@ aruba_provider_spec = {
 aruba_argument_spec = {
     'provider': dict(type='dict', options=aruba_provider_spec)
 }
-aruba_argument_spec.update(aruba_provider_spec)
 
-# Add argument's default value here
-ARGS_DEFAULT_VALUE = {}
+aruba_top_spec = {
+    'host': dict(removed_in_version=2.3),
+    'port': dict(removed_in_version=2.3, type='int'),
+    'username': dict(removed_in_version=2.3),
+    'password': dict(removed_in_version=2.3, no_log=True),
+    'ssh_keyfile': dict(removed_in_version=2.3, type='path'),
+    'timeout': dict(removed_in_version=2.3, type='int'),
+}
+
+aruba_argument_spec.update(aruba_top_spec)
 
 
-def get_argspec():
-    return aruba_argument_spec
+def get_provider_argspec():
+    return aruba_provider_spec
 
 
 def check_args(module, warnings):
-    for key in aruba_argument_spec:
-        if key not in ['provider', 'authorize'] and module.params[key]:
-            warnings.append('argument %s has been deprecated and will be removed in a future version' % key)
-
-    # set argument's default value if not provided in input
-    # This is done to avoid unwanted argument deprecation warning
-    # in case argument is not given as input (outside provider).
-    for key in ARGS_DEFAULT_VALUE:
-        if not module.params.get(key, None):
-            module.params[key] = ARGS_DEFAULT_VALUE[key]
+    pass
 
 
 def get_config(module, flags=None):
diff --git a/lib/ansible/module_utils/asa.py b/lib/ansible/module_utils/asa.py
index 31d0ee192c..d62f5f016e 100644
--- a/lib/ansible/module_utils/asa.py
+++ b/lib/ansible/module_utils/asa.py
@@ -33,7 +33,7 @@ from ansible.module_utils.connection import Connection, exec_command
 _DEVICE_CONFIGS = {}
 _CONNECTION = None
 
-asa_argument_spec = {
+asa_provider_spec = {
     'host': dict(),
     'port': dict(type='int'),
     'username': dict(fallback=(env_fallback, ['ANSIBLE_NET_USERNAME'])),
@@ -42,11 +42,28 @@ asa_argument_spec = {
     'authorize': dict(fallback=(env_fallback, ['ANSIBLE_NET_AUTHORIZE']), type='bool'),
     'auth_pass': dict(fallback=(env_fallback, ['ANSIBLE_NET_AUTH_PASS']), no_log=True),
     'timeout': dict(type='int'),
-    'provider': dict(type='dict'),
     'context': dict(),
     'passwords': dict()
 }
 
+asa_argument_spec = {
+    'provider': dict(type='dict', options=asa_provider_spec),
+}
+
+asa_top_spec = {
+    'host': dict(removed_in_version=2.3),
+    'port': dict(removed_in_version=2.3, type='int'),
+    'username': dict(removed_in_version=2.3),
+    'password': dict(removed_in_version=2.3, no_log=True),
+    'ssh_keyfile': dict(removed_in_version=2.3, type='path'),
+    'authorize': dict(type='bool'),
+    'auth_pass': dict(removed_in_version=2.3, no_log=True),
+    'timeout': dict(removed_in_version=2.3, type='int'),
+    'context': dict(),
+    'passwords': dict()
+}
+asa_argument_spec.update(asa_top_spec)
+
 command_spec = {
     'command': dict(key=True),
     'prompt': dict(),
@@ -54,21 +71,12 @@ command_spec = {
 }
 
 
-def get_argspec():
-    return asa_argument_spec
+def get_provider_argspec():
+    return asa_provider_spec
 
 
 def check_args(module):
-    provider = module.params['provider'] or {}
-
-    for key in asa_argument_spec:
-        if key not in ['provider', 'authorize'] and module.params[key]:
-            module.warn('argument %s has been deprecated and will be removed in a future version' % key)
-
-    if provider:
-        for param in ('auth_pass', 'password'):
-            if provider.get(param):
-                module.no_log_values.update(return_values(provider[param]))
+    pass
 
 
 def get_connection(module):
diff --git a/lib/ansible/module_utils/ce.py b/lib/ansible/module_utils/ce.py
index f8ff732810..150a5dfbf7 100644
--- a/lib/ansible/module_utils/ce.py
+++ b/lib/ansible/module_utils/ce.py
@@ -66,14 +66,21 @@ ce_provider_spec = {
 ce_argument_spec = {
     'provider': dict(type='dict', options=ce_provider_spec),
 }
-ce_argument_spec.update(ce_provider_spec)
+ce_top_spec = {
+    'host': dict(removed_in_version=2.3),
+    'port': dict(removed_in_version=2.3, type='int'),
+    'username': dict(removed_in_version=2.3),
+    'password': dict(removed_in_version=2.3, no_log=True),
+    'use_ssl': dict(removed_in_version=2.3, type='bool'),
+    'validate_certs': dict(removed_in_version=2.3, type='bool'),
+    'timeout': dict(removed_in_version=2.3, type='int'),
+    'transport': dict(choices=['cli']),
+}
+ce_argument_spec.update(ce_top_spec)
 
 
 def check_args(module, warnings):
-    for key in ce_argument_spec:
-        if key not in ['provider', 'transport'] and module.params[key]:
-            warnings.append('argument %s has been deprecated and will be '
-                            'removed in a future version' % key)
+    pass
 
 
 def load_params(module):
diff --git a/lib/ansible/module_utils/dellos10.py b/lib/ansible/module_utils/dellos10.py
index 1d69016ecf..7570846190 100644
--- a/lib/ansible/module_utils/dellos10.py
+++ b/lib/ansible/module_utils/dellos10.py
@@ -58,14 +58,21 @@ dellos10_provider_spec = {
 dellos10_argument_spec = {
     'provider': dict(type='dict', options=dellos10_provider_spec),
 }
-dellos10_argument_spec.update(dellos10_provider_spec)
+dellos10_top_spec = {
+    'host': dict(removed_in_version=2.3),
+    'port': dict(removed_in_version=2.3, type='int'),
+    'username': dict(removed_in_version=2.3),
+    'password': dict(removed_in_version=2.3, no_log=True),
+    'ssh_keyfile': dict(removed_in_version=2.3, type='path'),
+    'authorize': dict(removed_in_version=2.3, type='bool'),
+    'auth_pass': dict(removed_in_version=2.3, no_log=True),
+    'timeout': dict(removed_in_version=2.3, type='int'),
+}
+dellos10_argument_spec.update(dellos10_top_spec)
 
 
 def check_args(module, warnings):
-    for key in dellos10_argument_spec:
-        if key != 'provider' and module.params[key]:
-            warnings.append('argument %s has been deprecated and will be '
-                            'removed in a future version' % key)
+    pass
 
 
 def get_config(module, flags=None):
diff --git a/lib/ansible/module_utils/dellos6.py b/lib/ansible/module_utils/dellos6.py
index 70f3b418b7..301231a641 100644
--- a/lib/ansible/module_utils/dellos6.py
+++ b/lib/ansible/module_utils/dellos6.py
@@ -57,14 +57,21 @@ dellos6_provider_spec = {
 dellos6_argument_spec = {
     'provider': dict(type='dict', options=dellos6_provider_spec),
 }
-dellos6_argument_spec.update(dellos6_provider_spec)
+dellos6_top_spec = {
+    'host': dict(removed_in_version=2.3),
+    'port': dict(removed_in_version=2.3, type='int'),
+    'username': dict(removed_in_version=2.3),
+    'password': dict(removed_in_version=2.3, no_log=True),
+    'ssh_keyfile': dict(removed_in_version=2.3, type='path'),
+    'authorize': dict(removed_in_version=2.3, type='bool'),
+    'auth_pass': dict(removed_in_version=2.3, no_log=True),
+    'timeout': dict(removed_in_version=2.3, type='int'),
+}
+dellos6_argument_spec.update(dellos6_top_spec)
 
 
 def check_args(module, warnings):
-    for key in dellos6_argument_spec:
-        if key != 'provider' and module.params[key]:
-            warnings.append('argument %s has been deprecated and will be '
-                            'removed in a future version' % key)
+    pass
 
 
 def get_config(module, flags=None):
diff --git a/lib/ansible/module_utils/dellos9.py b/lib/ansible/module_utils/dellos9.py
index 754d8ab66a..2009cdbb6b 100644
--- a/lib/ansible/module_utils/dellos9.py
+++ b/lib/ansible/module_utils/dellos9.py
@@ -58,14 +58,21 @@ dellos9_provider_spec = {
 dellos9_argument_spec = {
     'provider': dict(type='dict', options=dellos9_provider_spec),
 }
-dellos9_argument_spec.update(dellos9_provider_spec)
+dellos9_top_spec = {
+    'host': dict(removed_in_version=2.3),
+    'port': dict(removed_in_version=2.3, type='int'),
+    'username': dict(removed_in_version=2.3),
+    'password': dict(removed_in_version=2.3, no_log=True),
+    'ssh_keyfile': dict(removed_in_version=2.3, type='path'),
+    'authorize': dict(removed_in_version=2.3, type='bool'),
+    'auth_pass': dict(removed_in_version=2.3, no_log=True),
+    'timeout': dict(removed_in_version=2.3, type='int'),
+}
+dellos9_argument_spec.update(dellos9_top_spec)
 
 
 def check_args(module, warnings):
-    for key in dellos9_argument_spec:
-        if key != 'provider' and module.params[key]:
-            warnings.append('argument %s has been deprecated and will be '
-                            'removed in a future version' % key)
+    pass
 
 
 def get_config(module, flags=None):
diff --git a/lib/ansible/module_utils/eos.py b/lib/ansible/module_utils/eos.py
index 1730abad82..4b3199f5ab 100644
--- a/lib/ansible/module_utils/eos.py
+++ b/lib/ansible/module_utils/eos.py
@@ -49,23 +49,32 @@ eos_provider_spec = {
     'authorize': dict(fallback=(env_fallback, ['ANSIBLE_NET_AUTHORIZE']), type='bool'),
     'auth_pass': dict(no_log=True, fallback=(env_fallback, ['ANSIBLE_NET_AUTH_PASS'])),
 
-    'use_ssl': dict(type='bool'),
-    'validate_certs': dict(type='bool'),
+    'use_ssl': dict(default=True, type='bool'),
+    'validate_certs': dict(default=True, type='bool'),
     'timeout': dict(type='int'),
 
-    'transport': dict(choices=['cli', 'eapi'])
+    'transport': dict(default='cli', choices=['cli', 'eapi'])
 }
 eos_argument_spec = {
     'provider': dict(type='dict', options=eos_provider_spec),
 }
-eos_argument_spec.update(eos_provider_spec)
+eos_top_spec = {
+    'host': dict(removed_in_version=2.3),
+    'port': dict(removed_in_version=2.3, type='int'),
+    'username': dict(removed_in_version=2.3),
+    'password': dict(removed_in_version=2.3, no_log=True),
+    'ssh_keyfile': dict(removed_in_version=2.3, type='path'),
 
-# Add argument's default value here
-ARGS_DEFAULT_VALUE = {
-    'transport': 'cli',
-    'use_ssl': True,
-    'validate_certs': True
+    'authorize': dict(fallback=(env_fallback, ['ANSIBLE_NET_AUTHORIZE']), type='bool'),
+    'auth_pass': dict(no_log=True, removed_in_version=2.3),
+
+    'use_ssl': dict(removed_in_version=2.3, type='bool'),
+    'validate_certs': dict(removed_in_version=2.3, type='bool'),
+    'timeout': dict(removed_in_version=2.3, type='int'),
+
+    'transport': dict(removed_in_version=2.3, choices=['cli', 'eapi'])
 }
+eos_argument_spec.update(eos_top_spec)
 
 
 def get_argspec():
@@ -73,21 +82,7 @@ def get_argspec():
 
 
 def check_args(module, warnings):
-    for key in eos_argument_spec:
-        if module._name == 'eos_user':
-            if (key not in ['username', 'password', 'provider', 'transport', 'authorize'] and
-                    module.params[key]):
-                warnings.append('argument %s has been deprecated and will be removed in a future version' % key)
-        else:
-            if key not in ['provider', 'authorize'] and module.params[key]:
-                warnings.append('argument %s has been deprecated and will be removed in a future version' % key)
-
-    # set argument's default value if not provided in input
-    # This is done to avoid unwanted argument deprecation warning
-    # in case argument is not given as input (outside provider).
-    for key in ARGS_DEFAULT_VALUE:
-        if not module.params.get(key, None):
-            module.params[key] = ARGS_DEFAULT_VALUE[key]
+    pass
 
 
 def load_params(module):
diff --git a/lib/ansible/module_utils/ios.py b/lib/ansible/module_utils/ios.py
index 5f796a8487..ed4abfa9ee 100644
--- a/lib/ansible/module_utils/ios.py
+++ b/lib/ansible/module_utils/ios.py
@@ -40,26 +40,31 @@ ios_provider_spec = {
     'ssh_keyfile': dict(fallback=(env_fallback, ['ANSIBLE_NET_SSH_KEYFILE']), type='path'),
     'authorize': dict(fallback=(env_fallback, ['ANSIBLE_NET_AUTHORIZE']), type='bool'),
     'auth_pass': dict(fallback=(env_fallback, ['ANSIBLE_NET_AUTH_PASS']), no_log=True),
-    'timeout': dict(type='int'),
+    'timeout': dict(type='int')
 }
 ios_argument_spec = {
     'provider': dict(type='dict', options=ios_provider_spec),
 }
-ios_argument_spec.update(ios_provider_spec)
+
+ios_top_spec = {
+    'host': dict(removed_in_version=2.3),
+    'port': dict(removed_in_version=2.3, type='int'),
+    'username': dict(removed_in_version=2.3),
+    'password': dict(removed_in_version=2.3, no_log=True),
+    'ssh_keyfile': dict(removed_in_version=2.3, type='path'),
+    'authorize': dict(fallback=(env_fallback, ['ANSIBLE_NET_AUTHORIZE']), type='bool'),
+    'auth_pass': dict(removed_in_version=2.3, no_log=True),
+    'timeout': dict(removed_in_version=2.3, type='int')
+}
+ios_argument_spec.update(ios_top_spec)
 
 
-def get_argspec():
-    return ios_argument_spec
+def get_provider_argspec():
+    return ios_provider_spec
 
 
 def check_args(module, warnings):
-    for key in ios_argument_spec:
-        if module._name == 'ios_user':
-            if key not in ['password', 'provider', 'authorize'] and module.params[key]:
-                warnings.append('argument %s has been deprecated and will be in a future version' % key)
-        else:
-            if key not in ['provider', 'authorize'] and module.params[key]:
-                warnings.append('argument %s has been deprecated and will be removed in a future version' % key)
+    pass
 
 
 def get_defaults_flag(module):
diff --git a/lib/ansible/module_utils/iosxr.py b/lib/ansible/module_utils/iosxr.py
index 857eb2b439..8555403e08 100644
--- a/lib/ansible/module_utils/iosxr.py
+++ b/lib/ansible/module_utils/iosxr.py
@@ -44,21 +44,23 @@ iosxr_provider_spec = {
 iosxr_argument_spec = {
     'provider': dict(type='dict', options=iosxr_provider_spec)
 }
-iosxr_argument_spec.update(iosxr_provider_spec)
+iosxr_top_spec = {
+    'host': dict(removed_in_version=2.3),
+    'port': dict(removed_in_version=2.3, type='int'),
+    'username': dict(removed_in_version=2.3),
+    'password': dict(removed_in_version=2.3, no_log=True),
+    'ssh_keyfile': dict(removed_in_version=2.3, type='path'),
+    'timeout': dict(removed_in_version=2.3, type='int'),
+}
+iosxr_argument_spec.update(iosxr_top_spec)
 
 
-def get_argspec():
-    return iosxr_argument_spec
+def get_provider_argspec():
+    return iosxr_provider_spec
 
 
 def check_args(module, warnings):
-    for key in iosxr_argument_spec:
-        if module._name == 'iosxr_user':
-            if key not in ['password', 'provider'] and module.params[key]:
-                warnings.append('argument %s has been deprecated and will be in a future version' % key)
-        else:
-            if key != 'provider' and module.params[key]:
-                warnings.append('argument %s has been deprecated and will be removed in a future version' % key)
+    pass
 
 
 def get_config(module, flags=None):
diff --git a/lib/ansible/module_utils/junos.py b/lib/ansible/module_utils/junos.py
index ac571c2d99..749db03c9e 100644
--- a/lib/ansible/module_utils/junos.py
+++ b/lib/ansible/module_utils/junos.py
@@ -50,28 +50,24 @@ junos_provider_spec = {
 junos_argument_spec = {
     'provider': dict(type='dict', options=junos_provider_spec),
 }
-junos_argument_spec.update(junos_provider_spec)
-
-# Add argument's default value here
-ARGS_DEFAULT_VALUE = {}
+junos_top_spec = {
+    'host': dict(removed_in_version=2.3),
+    'port': dict(removed_in_version=2.3, type='int'),
+    'username': dict(removed_in_version=2.3),
+    'password': dict(removed_in_version=2.3, no_log=True),
+    'ssh_keyfile': dict(removed_in_version=2.3, type='path'),
+    'timeout': dict(removed_in_version=2.3, type='int'),
+    'transport': dict(removed_in_version=2.3)
+}
+junos_argument_spec.update(junos_top_spec)
 
 
-def get_argspec():
-    return junos_argument_spec
+def get_provider_argspec():
+    return junos_provider_spec
 
 
 def check_args(module, warnings):
-    for key in junos_argument_spec:
-        if key not in ('provider',) and module.params[key]:
-            warnings.append('argument %s has been deprecated and will be '
-                            'removed in a future version' % key)
-
-    # set argument's default value if not provided in input
-    # This is done to avoid unwanted argument deprecation warning
-    # in case argument is not given as input (outside provider).
-    for key in ARGS_DEFAULT_VALUE:
-        if not module.params.get(key, None):
-            module.params[key] = ARGS_DEFAULT_VALUE[key]
+    pass
 
 
 def _validate_rollback_id(module, value):
diff --git a/lib/ansible/module_utils/network_common.py b/lib/ansible/module_utils/network_common.py
index 7d45cd73fb..307d84b329 100644
--- a/lib/ansible/module_utils/network_common.py
+++ b/lib/ansible/module_utils/network_common.py
@@ -337,6 +337,38 @@ def remove_default_spec(spec):
             del spec[item]['default']
 
 
+def load_provider(spec, args):
+    provider = args.get('provider', {})
+    for key, value in iteritems(spec):
+        if key not in provider:
+            if key in args:
+                provider[key] = args[key]
+            elif 'fallback' in value:
+                provider[key] = _fallback(value['fallback'])
+            elif 'default' in value:
+                provider[key] = value['default']
+            else:
+                provider[key] = None
+    args['provider'] = provider
+    return provider
+
+
+def _fallback(fallback):
+    strategy = fallback[0]
+    args = []
+    kwargs = {}
+
+    for item in fallback[1:]:
+        if isinstance(item, dict):
+            kwargs = item
+        else:
+            args = item
+    try:
+        return strategy(*args, **kwargs)
+    except AnsibleFallbackNotFound:
+        pass
+
+
 class Template:
 
     def __init__(self):
diff --git a/lib/ansible/module_utils/nxos.py b/lib/ansible/module_utils/nxos.py
index 678875d80f..a2def4a47c 100644
--- a/lib/ansible/module_utils/nxos.py
+++ b/lib/ansible/module_utils/nxos.py
@@ -51,38 +51,34 @@ nxos_provider_spec = {
     'validate_certs': dict(type='bool'),
     'timeout': dict(type='int'),
 
-    'transport': dict(choices=['cli', 'nxapi'])
+    'transport': dict(default='cli', choices=['cli', 'nxapi'])
 }
 nxos_argument_spec = {
     'provider': dict(type='dict', options=nxos_provider_spec),
 }
-nxos_argument_spec.update(nxos_provider_spec)
+nxos_top_spec = {
+    'host': dict(removed_in_version=2.3),
+    'port': dict(removed_in_version=2.3, type='int'),
 
-# Add argument's default value here
-ARGS_DEFAULT_VALUE = {
-    'transport': 'cli'
+    'username': dict(removed_in_version=2.3),
+    'password': dict(removed_in_version=2.3, no_log=True),
+    'ssh_keyfile': dict(removed_in_version=2.3),
+
+    'use_ssl': dict(removed_in_version=2.3, type='bool'),
+    'validate_certs': dict(removed_in_version=2.3, type='bool'),
+    'timeout': dict(removed_in_version=2.3, type='int'),
+
+    'transport': dict(default='cli', choices=['cli', 'nxapi'])
 }
+nxos_argument_spec.update(nxos_top_spec)
 
 
-def get_argspec():
-    return nxos_argument_spec
+def get_provider_argspec():
+    return nxos_provider_spec
 
 
 def check_args(module, warnings):
-    for key in nxos_argument_spec:
-        if module._name == 'nxos_user':
-            if key not in ['password', 'provider', 'transport'] and module.params[key]:
-                warnings.append('argument %s has been deprecated and will be in a future version' % key)
-        else:
-            if key not in ['provider', 'transport'] and module.params[key]:
-                warnings.append('argument %s has been deprecated and will be removed in a future version' % key)
-
-    # set argument's default value if not provided in input
-    # This is done to avoid unwanted argument deprecation warning
-    # in case argument is not given as input (outside provider).
-    for key in ARGS_DEFAULT_VALUE:
-        if not module.params.get(key, None):
-            module.params[key] = ARGS_DEFAULT_VALUE[key]
+    pass
 
 
 def load_params(module):
diff --git a/lib/ansible/module_utils/sros.py b/lib/ansible/module_utils/sros.py
index 77f8c3fc8c..0be88d30a1 100644
--- a/lib/ansible/module_utils/sros.py
+++ b/lib/ansible/module_utils/sros.py
@@ -49,13 +49,19 @@ sros_provider_spec = {
 sros_argument_spec = {
     'provider': dict(type='dict', options=sros_provider_spec),
 }
-sros_argument_spec.update(sros_provider_spec)
+sros_top_spec = {
+    'host': dict(removed_in_version=2.3),
+    'port': dict(removed_in_version=2.3, type='int'),
+    'username': dict(removed_in_version=2.3),
+    'password': dict(removed_in_version=2.3, no_log=True),
+    'ssh_keyfile': dict(removed_in_version=2.3, type='path'),
+    'timeout': dict(removed_in_version=2.3, type='int'),
+}
+sros_argument_spec.update(sros_top_spec)
 
 
 def check_args(module, warnings):
-    for key in sros_argument_spec:
-        if key != 'provider' and module.params[key]:
-            warnings.append('argument %s has been deprecated and will be removed in a future version' % key)
+    pass
 
 
 def get_config(module, flags=None):
diff --git a/lib/ansible/module_utils/vyos.py b/lib/ansible/module_utils/vyos.py
index 5d821cc505..70c1b31659 100644
--- a/lib/ansible/module_utils/vyos.py
+++ b/lib/ansible/module_utils/vyos.py
@@ -45,11 +45,21 @@ vyos_provider_spec = {
 vyos_argument_spec = {
     'provider': dict(type='dict', options=vyos_provider_spec),
 }
-vyos_argument_spec.update(vyos_provider_spec)
+vyos_top_spec = {
+    'host': dict(removed_in_version=2.3),
+    'port': dict(removed_in_version=2.3, type='int'),
+
+    'username': dict(removed_in_version=2.3),
+    'password': dict(removed_in_version=2.3, no_log=True),
+    'ssh_keyfile': dict(removed_in_version=2.3, type='path'),
+
+    'timeout': dict(removed_in_version=2.3, type='int'),
+}
+vyos_argument_spec.update(vyos_top_spec)
 
 
-def get_argspec():
-    return vyos_argument_spec
+def get_provider_argspec():
+    return vyos_provider_spec
 
 
 def check_args(module, warnings):
diff --git a/lib/ansible/plugins/action/aireos.py b/lib/ansible/plugins/action/aireos.py
index 7c7950cc1a..1c148946dc 100644
--- a/lib/ansible/plugins/action/aireos.py
+++ b/lib/ansible/plugins/action/aireos.py
@@ -24,9 +24,9 @@ import copy
 
 from ansible import constants as C
 from ansible.plugins.action.normal import ActionModule as _ActionModule
-from ansible.module_utils.basic import AnsibleFallbackNotFound
-from ansible.module_utils.aireos import aireos_argument_spec
-from ansible.module_utils.six import iteritems
+from ansible.module_utils.aireos import aireos_provider_spec
+from ansible.module_utils.network_common import load_provider
+
 
 try:
     from __main__ import display
@@ -46,7 +46,7 @@ class ActionModule(_ActionModule):
                     'got %s' % self._play_context.connection
             )
 
-        provider = self.load_provider()
+        provider = load_provider(aireos_provider_spec, self._task.args)
 
         pc = copy.deepcopy(self._play_context)
         pc.connection = 'network_cli'
@@ -82,30 +82,3 @@ class ActionModule(_ActionModule):
 
         result = super(ActionModule, self).run(tmp, task_vars)
         return result
-
-    def load_provider(self):
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(aireos_argument_spec):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass
diff --git a/lib/ansible/plugins/action/aruba.py b/lib/ansible/plugins/action/aruba.py
index 7abd345db0..57bb68c575 100644
--- a/lib/ansible/plugins/action/aruba.py
+++ b/lib/ansible/plugins/action/aruba.py
@@ -24,9 +24,8 @@ import copy
 
 from ansible import constants as C
 from ansible.plugins.action.normal import ActionModule as _ActionModule
-from ansible.module_utils.basic import AnsibleFallbackNotFound
-from ansible.module_utils.aruba import aruba_argument_spec
-from ansible.module_utils.six import iteritems
+from ansible.module_utils.aruba import aruba_provider_spec
+from ansible.module_utils.network_common import load_provider
 
 try:
     from __main__ import display
@@ -46,7 +45,7 @@ class ActionModule(_ActionModule):
                     'got %s' % self._play_context.connection
             )
 
-        provider = self.load_provider()
+        provider = load_provider(aruba_provider_spec, self._task.args)
 
         pc = copy.deepcopy(self._play_context)
         pc.connection = 'network_cli'
@@ -83,30 +82,3 @@ class ActionModule(_ActionModule):
 
         result = super(ActionModule, self).run(tmp, task_vars)
         return result
-
-    def load_provider(self):
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(aruba_argument_spec):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass
diff --git a/lib/ansible/plugins/action/asa.py b/lib/ansible/plugins/action/asa.py
index 7496834b9c..3483e39df7 100644
--- a/lib/ansible/plugins/action/asa.py
+++ b/lib/ansible/plugins/action/asa.py
@@ -25,11 +25,11 @@ import json
 
 from ansible import constants as C
 from ansible.plugins.action.normal import ActionModule as _ActionModule
-from ansible.module_utils.basic import AnsibleFallbackNotFound
-from ansible.module_utils.asa import asa_argument_spec
-from ansible.module_utils.six import iteritems
+from ansible.module_utils.aruba import asa_provider_spec
+from ansible.module_utils.network_common import load_provider
 from ansible.module_utils.connection import request_builder
 
+
 try:
     from __main__ import display
 except ImportError:
@@ -48,7 +48,7 @@ class ActionModule(_ActionModule):
                     'got %s' % self._play_context.connection
             )
 
-        provider = self.load_provider()
+        provider = load_provider(asa_provider_spec, self._task.args)
 
         pc = copy.deepcopy(self._play_context)
         pc.connection = 'network_cli'
@@ -78,30 +78,3 @@ class ActionModule(_ActionModule):
         result = super(ActionModule, self).run(tmp, task_vars)
 
         return result
-
-    def load_provider(self):
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(asa_argument_spec):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass
diff --git a/lib/ansible/plugins/action/ce.py b/lib/ansible/plugins/action/ce.py
index f5a2e8bc32..e3b39e5a2c 100644
--- a/lib/ansible/plugins/action/ce.py
+++ b/lib/ansible/plugins/action/ce.py
@@ -24,9 +24,9 @@ import copy
 
 from ansible import constants as C
 from ansible.plugins.action.normal import ActionModule as _ActionModule
-from ansible.module_utils.six import iteritems
-from ansible.module_utils.ce import ce_argument_spec
-from ansible.module_utils.basic import AnsibleFallbackNotFound
+from ansible.module_utils.ce import ce_provider_spec
+from ansible.module_utils.network_common import load_provider
+
 
 try:
     from __main__ import display
@@ -45,7 +45,7 @@ class ActionModule(_ActionModule):
                     'got %s' % self._play_context.connection
             )
 
-        provider = self.load_provider()
+        provider = load_provider(ce_provider_spec, self._task.args)
         transport = provider['transport'] or 'cli'
 
         display.vvvv('connection transport is %s' % transport, self._play_context.remote_addr)
@@ -91,30 +91,3 @@ class ActionModule(_ActionModule):
 
         result = super(ActionModule, self).run(tmp, task_vars)
         return result
-
-    def load_provider(self):
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(ce_argument_spec):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass
diff --git a/lib/ansible/plugins/action/dellos10.py b/lib/ansible/plugins/action/dellos10.py
index a468e26c7f..e0a9b29d7d 100644
--- a/lib/ansible/plugins/action/dellos10.py
+++ b/lib/ansible/plugins/action/dellos10.py
@@ -26,9 +26,8 @@ import copy
 
 from ansible import constants as C
 from ansible.plugins.action.normal import ActionModule as _ActionModule
-from ansible.module_utils.six import iteritems
-from ansible.module_utils.dellos10 import dellos10_argument_spec
-from ansible.module_utils.basic import AnsibleFallbackNotFound
+from ansible.module_utils.dellos10 import dellos10_provider_spec
+from ansible.module_utils.network_common import load_provider
 
 try:
     from __main__ import display
@@ -48,7 +47,7 @@ class ActionModule(_ActionModule):
                     'got %s' % self._play_context.connection
             )
 
-        provider = self.load_provider()
+        provider = load_provider(dellos10_provider_spec, self._task.args)
 
         pc = copy.deepcopy(self._play_context)
         pc.connection = 'network_cli'
@@ -87,30 +86,3 @@ class ActionModule(_ActionModule):
 
         result = super(ActionModule, self).run(tmp, task_vars)
         return result
-
-    def load_provider(self):
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(dellos10_argument_spec):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass
diff --git a/lib/ansible/plugins/action/dellos6.py b/lib/ansible/plugins/action/dellos6.py
index 1fdf63d3a7..f5d59ae0d0 100644
--- a/lib/ansible/plugins/action/dellos6.py
+++ b/lib/ansible/plugins/action/dellos6.py
@@ -23,9 +23,8 @@ import copy
 
 from ansible import constants as C
 from ansible.plugins.action.normal import ActionModule as _ActionModule
-from ansible.module_utils.six import iteritems
-from ansible.module_utils.dellos6 import dellos6_argument_spec
-from ansible.module_utils.basic import AnsibleFallbackNotFound
+from ansible.module_utils.dellos6 import dellos6_provider_spec
+from ansible.module_utils.network_common import load_provider
 
 try:
     from __main__ import display
@@ -44,7 +43,7 @@ class ActionModule(_ActionModule):
                     'got %s' % self._play_context.connection
             )
 
-        provider = self.load_provider()
+        provider = load_provider(dellos6_provider_spec, self._task.args)
 
         pc = copy.deepcopy(self._play_context)
         pc.connection = 'network_cli'
@@ -83,30 +82,3 @@ class ActionModule(_ActionModule):
 
         result = super(ActionModule, self).run(tmp, task_vars)
         return result
-
-    def load_provider(self):
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(dellos6_argument_spec):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass
diff --git a/lib/ansible/plugins/action/dellos9.py b/lib/ansible/plugins/action/dellos9.py
index 6fc07e6d27..a07145b334 100644
--- a/lib/ansible/plugins/action/dellos9.py
+++ b/lib/ansible/plugins/action/dellos9.py
@@ -26,9 +26,8 @@ import copy
 
 from ansible import constants as C
 from ansible.plugins.action.normal import ActionModule as _ActionModule
-from ansible.module_utils.six import iteritems
-from ansible.module_utils.dellos9 import dellos9_argument_spec
-from ansible.module_utils.basic import AnsibleFallbackNotFound
+from ansible.module_utils.dellos9 import dellos9_provider_spec
+from ansible.module_utils.network_common import load_provider
 
 try:
     from __main__ import display
@@ -48,7 +47,7 @@ class ActionModule(_ActionModule):
                     'got %s' % self._play_context.connection
             )
 
-        provider = self.load_provider()
+        provider = load_provider(dellos9_provider_spec, self._task.args)
 
         pc = copy.deepcopy(self._play_context)
         pc.connection = 'network_cli'
@@ -87,30 +86,3 @@ class ActionModule(_ActionModule):
 
         result = super(ActionModule, self).run(tmp, task_vars)
         return result
-
-    def load_provider(self):
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(dellos9_argument_spec):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass
diff --git a/lib/ansible/plugins/action/eos.py b/lib/ansible/plugins/action/eos.py
index 873051f99a..b6cd22dc55 100644
--- a/lib/ansible/plugins/action/eos.py
+++ b/lib/ansible/plugins/action/eos.py
@@ -23,10 +23,9 @@ import sys
 import copy
 
 from ansible import constants as C
-from ansible.module_utils.basic import AnsibleFallbackNotFound
-from ansible.module_utils.eos import ARGS_DEFAULT_VALUE, eos_argument_spec
-from ansible.module_utils.six import iteritems
+from ansible.module_utils.eos import eos_provider_spec
 from ansible.plugins.action.normal import ActionModule as _ActionModule
+from ansible.module_utils.network_common import load_provider
 
 try:
     from __main__ import display
@@ -45,7 +44,7 @@ class ActionModule(_ActionModule):
                     'got %s' % self._play_context.connection
             )
 
-        provider = self.load_provider()
+        provider = load_provider(eos_provider_spec, self._task.args)
         transport = provider['transport'] or 'cli'
 
         display.vvvv('connection transport is %s' % transport, self._play_context.remote_addr)
@@ -89,9 +88,6 @@ class ActionModule(_ActionModule):
             if provider.get('host') is None:
                 provider['host'] = self._play_context.remote_addr
 
-            if provider.get('use_ssl') is None:
-                provider['use_ssl'] = ARGS_DEFAULT_VALUE['use_ssl']
-
             if provider.get('port') is None:
                 default_port = 443 if provider['use_ssl'] else 80
                 provider['port'] = int(self._play_context.port or default_port)
@@ -108,37 +104,7 @@ class ActionModule(_ActionModule):
             if provider.get('authorize') is None:
                 provider['authorize'] = False
 
-            if provider.get('validate_certs') is None:
-                provider['validate_certs'] = ARGS_DEFAULT_VALUE['validate_certs']
-
             self._task.args['provider'] = provider
 
         result = super(ActionModule, self).run(tmp, task_vars)
         return result
-
-    def load_provider(self):
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(eos_argument_spec):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass
diff --git a/lib/ansible/plugins/action/ios.py b/lib/ansible/plugins/action/ios.py
index 070e641c26..1da9fdbc0e 100644
--- a/lib/ansible/plugins/action/ios.py
+++ b/lib/ansible/plugins/action/ios.py
@@ -24,9 +24,8 @@ import copy
 
 from ansible import constants as C
 from ansible.plugins.action.normal import ActionModule as _ActionModule
-from ansible.module_utils.basic import AnsibleFallbackNotFound
-from ansible.module_utils.ios import ios_argument_spec
-from ansible.module_utils.six import iteritems
+from ansible.module_utils.network_common import load_provider
+from ansible.module_utils.ios import ios_provider_spec
 
 try:
     from __main__ import display
@@ -46,7 +45,7 @@ class ActionModule(_ActionModule):
                     'got %s' % self._play_context.connection
             )
 
-        provider = self.load_provider()
+        provider = load_provider(ios_provider_spec, self._task.args)
 
         pc = copy.deepcopy(self._play_context)
         pc.connection = 'network_cli'
@@ -85,30 +84,3 @@ class ActionModule(_ActionModule):
 
         result = super(ActionModule, self).run(tmp, task_vars)
         return result
-
-    def load_provider(self):
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(ios_argument_spec):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass
diff --git a/lib/ansible/plugins/action/iosxr.py b/lib/ansible/plugins/action/iosxr.py
index 02ab8d6709..9e068baa72 100644
--- a/lib/ansible/plugins/action/iosxr.py
+++ b/lib/ansible/plugins/action/iosxr.py
@@ -23,10 +23,9 @@ import sys
 import copy
 
 from ansible import constants as C
-from ansible.module_utils.basic import AnsibleFallbackNotFound
-from ansible.module_utils.iosxr import iosxr_argument_spec
-from ansible.module_utils.six import iteritems
+from ansible.module_utils.iosxr import iosxr_provider_spec
 from ansible.plugins.action.normal import ActionModule as _ActionModule
+from ansible.module_utils.network_common import load_provider
 
 try:
     from __main__ import display
@@ -46,7 +45,7 @@ class ActionModule(_ActionModule):
                     'got %s' % self._play_context.connection
             )
 
-        provider = self.load_provider()
+        provider = load_provider(iosxr_provider_spec, self._task.args)
 
         pc = copy.deepcopy(self._play_context)
         pc.connection = 'network_cli'
@@ -79,30 +78,3 @@ class ActionModule(_ActionModule):
 
         result = super(ActionModule, self).run(tmp, task_vars)
         return result
-
-    def load_provider(self):
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(iosxr_argument_spec):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass
diff --git a/lib/ansible/plugins/action/junos.py b/lib/ansible/plugins/action/junos.py
index 7ea20825c8..54c5c4c0c7 100644
--- a/lib/ansible/plugins/action/junos.py
+++ b/lib/ansible/plugins/action/junos.py
@@ -23,12 +23,10 @@ import sys
 import copy
 
 from ansible import constants as C
-from ansible.module_utils.basic import AnsibleFallbackNotFound
-from ansible.module_utils.junos import junos_argument_spec
-from ansible.module_utils.six import iteritems
+from ansible.module_utils.junos import junos_provider_spec
 from ansible.plugins.loader import connection_loader, module_loader
 from ansible.plugins.action.normal import ActionModule as _ActionModule
-from ansible.module_utils.connection import Connection
+from ansible.module_utils.network_common import load_provider
 
 try:
     from __main__ import display
@@ -53,7 +51,7 @@ class ActionModule(_ActionModule):
         if not getattr(module, 'USE_PERSISTENT_CONNECTION', False):
             return super(ActionModule, self).run(tmp, task_vars)
 
-        provider = self.load_provider()
+        provider = load_provider(junos_provider_spec, self._task.args)
 
         pc = copy.deepcopy(self._play_context)
         pc.network_os = 'junos'
@@ -96,30 +94,3 @@ class ActionModule(_ActionModule):
 
         result = super(ActionModule, self).run(tmp, task_vars)
         return result
-
-    def load_provider(self):
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(junos_argument_spec):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass
diff --git a/lib/ansible/plugins/action/net_base.py b/lib/ansible/plugins/action/net_base.py
index a375cd0054..5516918588 100644
--- a/lib/ansible/plugins/action/net_base.py
+++ b/lib/ansible/plugins/action/net_base.py
@@ -22,8 +22,7 @@ import copy
 
 from ansible import constants as C
 from ansible.plugins.action import ActionBase
-from ansible.module_utils.basic import AnsibleFallbackNotFound
-from ansible.module_utils.six import iteritems
+from ansible.module_utils.network_common import load_provider
 
 from imp import find_module, load_module
 
@@ -47,7 +46,16 @@ class ActionModule(ActionBase):
         play_context = copy.deepcopy(self._play_context)
         play_context.network_os = self._get_network_os(task_vars)
 
-        self.provider = self._load_provider(play_context.network_os)
+        # we should be able to stream line this a bit by creating a common
+        # provider argument spec in module_utils/network_common.py or another
+        # option is that there isn't a need to push provider into the module
+        # since the connection is started in the action handler.
+        f, p, d = find_module('ansible')
+        f2, p2, d2 = find_module('module_utils', [p])
+        f3, p3, d3 = find_module(play_context.network_os, [p2])
+        module = load_module('ansible.module_utils.' + play_context.network_os, f3, p3, d3)
+
+        self.provider = load_provider(module.get_provider_argspec(), self._task.args)
 
         if play_context.network_os == 'junos':
             play_context.connection = 'netconf'
@@ -154,39 +162,3 @@ class ActionModule(ActionBase):
             implementation_module = None
 
         return implementation_module
-
-    def _load_provider(self, network_os):
-        # we should be able to stream line this a bit by creating a common
-        # provider argument spec in module_utils/network_common.py or another
-        # option is that there isn't a need to push provider into the module
-        # since the connection is started in the action handler.
-        f, p, d = find_module('ansible')
-        f2, p2, d2 = find_module('module_utils', [p])
-        f3, p3, d3 = find_module(network_os, [p2])
-        module = load_module('ansible.module_utils.' + network_os, f3, p3, d3)
-
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(module.get_argspec()):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass
diff --git a/lib/ansible/plugins/action/nxos.py b/lib/ansible/plugins/action/nxos.py
index 34f3c218e5..4bd4a0e0b1 100644
--- a/lib/ansible/plugins/action/nxos.py
+++ b/lib/ansible/plugins/action/nxos.py
@@ -24,9 +24,8 @@ import copy
 
 from ansible import constants as C
 from ansible.plugins.action.normal import ActionModule as _ActionModule
-from ansible.module_utils.basic import AnsibleFallbackNotFound
-from ansible.module_utils.nxos import nxos_argument_spec
-from ansible.module_utils.six import iteritems
+from ansible.module_utils.network_common import load_provider
+from ansible.module_utils.nxos import nxos_provider_spec
 
 try:
     from __main__ import display
@@ -45,7 +44,7 @@ class ActionModule(_ActionModule):
                     'got %s' % self._play_context.connection
             )
 
-        provider = self.load_provider()
+        provider = load_provider(nxos_provider_spec, self._task.args)
         transport = provider['transport'] or 'cli'
 
         display.vvvv('connection transport is %s' % transport, self._play_context.remote_addr)
@@ -120,30 +119,3 @@ class ActionModule(_ActionModule):
 
         result = super(ActionModule, self).run(tmp, task_vars)
         return result
-
-    def load_provider(self):
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(nxos_argument_spec):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass
diff --git a/lib/ansible/plugins/action/sros.py b/lib/ansible/plugins/action/sros.py
index f70f767973..6619841d54 100644
--- a/lib/ansible/plugins/action/sros.py
+++ b/lib/ansible/plugins/action/sros.py
@@ -24,9 +24,8 @@ import copy
 
 from ansible import constants as C
 from ansible.plugins.action.normal import ActionModule as _ActionModule
-from ansible.module_utils.sros import sros_argument_spec
-from ansible.module_utils.basic import AnsibleFallbackNotFound
-from ansible.module_utils.six import iteritems
+from ansible.module_utils.sros import sros_provider_spec
+from ansible.module_utils.network_common import load_provider
 
 try:
     from __main__ import display
@@ -46,7 +45,7 @@ class ActionModule(_ActionModule):
                     'got %s' % self._play_context.connection
             )
 
-        provider = self.load_provider()
+        provider = load_provider(sros_provider_spec, self._task.args)
 
         pc = copy.deepcopy(self._play_context)
         pc.connection = 'network_cli'
@@ -72,30 +71,3 @@ class ActionModule(_ActionModule):
 
         result = super(ActionModule, self).run(tmp, task_vars)
         return result
-
-    def load_provider(self):
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(sros_argument_spec):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass
diff --git a/lib/ansible/plugins/action/vyos.py b/lib/ansible/plugins/action/vyos.py
index 73a651a546..f3aa72d0d3 100644
--- a/lib/ansible/plugins/action/vyos.py
+++ b/lib/ansible/plugins/action/vyos.py
@@ -24,9 +24,8 @@ import copy
 
 from ansible import constants as C
 from ansible.plugins.action.normal import ActionModule as _ActionModule
-from ansible.module_utils.basic import AnsibleFallbackNotFound
-from ansible.module_utils.six import iteritems
-from ansible.module_utils.vyos import vyos_argument_spec
+from ansible.module_utils.network_common import load_provider
+from ansible.module_utils.vyos import vyos_provider_spec
 
 try:
     from __main__ import display
@@ -45,7 +44,7 @@ class ActionModule(_ActionModule):
                     'got %s' % self._play_context.connection
             )
 
-        provider = self.load_provider()
+        provider = load_provider(vyos_provider_spec, self._task.args)
 
         pc = copy.deepcopy(self._play_context)
         pc.connection = 'network_cli'
@@ -79,30 +78,3 @@ class ActionModule(_ActionModule):
 
         result = super(ActionModule, self).run(tmp, task_vars)
         return result
-
-    def load_provider(self):
-        provider = self._task.args.get('provider', {})
-        for key, value in iteritems(vyos_argument_spec):
-            if key != 'provider' and key not in provider:
-                if key in self._task.args:
-                    provider[key] = self._task.args[key]
-                elif 'fallback' in value:
-                    provider[key] = self._fallback(value['fallback'])
-                elif key not in provider:
-                    provider[key] = None
-        return provider
-
-    def _fallback(self, fallback):
-        strategy = fallback[0]
-        args = []
-        kwargs = {}
-
-        for item in fallback[1:]:
-            if isinstance(item, dict):
-                kwargs = item
-            else:
-                args = item
-        try:
-            return strategy(*args, **kwargs)
-        except AnsibleFallbackNotFound:
-            pass