Try SpotterConfigure NGFW IPv4/IPv6 application policies.
| "added in version" 2.1.0 of drmofu.fortimanager"
Authors: Xinwei Du (@dux-fortinet), Xing Li (@lix-fortinet), Jie Xue (@JieX19), Link Zheng (@chillancezen), Frank Shen (@fshen01), Hongbin Lu (@fgtdev-hblu)
preview | supported by community
Install with ansible-galaxy collection install drmofu.fortimanager:==2.2.2
collections:
- name: drmofu.fortimanager
version: 2.2.2This module is able to configure a FortiManager device.
Examples include all parameters and values which need to be adjusted to data sources before usage.
- hosts: fortimanager-inventory
collections:
- fortinet.fortimanager
connection: httpapi
vars:
ansible_httpapi_use_ssl: True
ansible_httpapi_validate_certs: False
ansible_httpapi_port: 443
tasks:
- name: Configure NGFW IPv4/IPv6 application policies.
fmgr_pkg_firewall_securitypolicy:
bypass_validation: False
workspace_locking_adom: <value in [global, custom adom including root]>
workspace_locking_timeout: 300
rc_succeeded: [0, -2, -3, ...]
rc_failed: [-2, -3, ...]
adom: <your own value>
pkg: <your own value>
state: <value in [present, absent]>
pkg_firewall_securitypolicy:
action: <value in [deny, accept]>
app-category: <value of string>
app-group: <value of string>
application: <value of integer>
application-list: <value of string>
av-profile: <value of string>
cifs-profile: <value of string>
comments: <value of string>
dlp-sensor: <value of string>
dnsfilter-profile: <value of string>
dstaddr4: <value of string>
dstaddr6: <value of string>
dstintf: <value of string>
emailfilter-profile: <value of string>
enforce-default-app-port: <value in [disable, enable]>
groups: <value of string>
icap-profile: <value of string>
internet-service: <value in [disable, enable]>
internet-service-custom: <value of string>
internet-service-custom-group: <value of string>
internet-service-group: <value of string>
internet-service-id: <value of string>
internet-service-negate: <value in [disable, enable]>
internet-service-src: <value in [disable, enable]>
internet-service-src-custom: <value of string>
internet-service-src-custom-group: <value of string>
internet-service-src-group: <value of string>
internet-service-src-id: <value of string>
internet-service-src-negate: <value in [disable, enable]>
ips-sensor: <value of string>
logtraffic: <value in [disable, all, utm]>
logtraffic-start: <value in [disable, enable]>
mms-profile: <value of string>
name: <value of string>
policyid: <value of integer>
profile-group: <value of string>
profile-protocol-options: <value of string>
profile-type: <value in [single, group]>
schedule: <value of string>
service: <value of string>
service-negate: <value in [disable, enable]>
srcaddr4: <value of string>
srcaddr6: <value of string>
srcintf: <value of string>
ssh-filter-profile: <value of string>
ssl-ssh-profile: <value of string>
status: <value in [disable, enable]>
url-category: <value of string>
users: <value of string>
utm-status: <value in [disable, enable]>
uuid: <value of string>
voip-profile: <value of string>
webfilter-profile: <value of string>
fsso-groups: <value of string>
global-label: <value of string>
send-deny-packet: <value in [disable, enable]>
dstaddr: <value of string>
internet-service-name: <value of string>
internet-service-src-name: <value of string>
srcaddr: <value of string>
dstaddr-negate: <value in [disable, enable]>
file-filter-profile: <value of string>
srcaddr-negate: <value in [disable, enable]>
learning-mode: <value in [disable, enable]>
videofilter-profile: <value of string>
_policy_block: <value of integer>
dlp-profile: <value of string>
nat46: <value in [disable, enable]>
nat64: <value in [disable, enable]>
sctp-filter-profile: <value of string>
internet-service6: <value in [disable, enable]>
internet-service6-custom: <value of string>
internet-service6-custom-group: <value of string>
internet-service6-group: <value of string>
internet-service6-name: <value of string>
internet-service6-negate: <value in [disable, enable]>
internet-service6-src: <value in [disable, enable]>
internet-service6-src-custom: <value of string>
internet-service6-src-custom-group: <value of string>
internet-service6-src-group: <value of string>
internet-service6-src-name: <value of string>
internet-service6-src-negate: <value in [disable, enable]>
pkg:
description: the parameter (pkg) in requested url
required: true
type: str
adom:
description: the parameter (adom) in requested url
required: true
type: str
state:
choices:
- present
- absent
description: The directive to create, update or delete an object.
required: true
type: str
rc_failed:
description: The rc codes list with which the conditions to fail will be overriden.
elements: int
required: false
type: list
enable_log:
default: false
description: Enable/Disable logging for task.
required: false
type: bool
access_token:
description: The token to access FortiManager without using username and password.
required: false
type: str
rc_succeeded:
description: The rc codes list with which the conditions to succeed will be overriden.
elements: int
required: false
type: list
proposed_method:
choices:
- update
- set
- add
description: The overridden method for the underlying Json RPC request.
required: false
type: str
bypass_validation:
default: false
description: Only set to True when module schema diffs with FortiManager API structure,
module continues to execute without validating parameters.
required: false
type: bool
workspace_locking_adom:
description: The adom to lock for FortiManager running in workspace mode, the value
can be global and others including root.
required: false
type: str
forticloud_access_token:
description: Authenticate Ansible client with forticloud API access token.
required: false
type: str
workspace_locking_timeout:
default: 300
description: The maximum time in seconds to wait for other user to release the workspace
lock.
required: false
type: int
pkg_firewall_securitypolicy:
description: the top level parameters set
required: false
suboptions:
_policy_block:
description: Assigned policy block.
type: int
action:
choices:
- deny
- accept
description: Policy action
type: str
app-category:
description: Application category ID list.
type: str
app-group:
description: Application group names.
type: str
application:
description: Application ID list.
type: int
application-list:
description: Name of an existing Application list.
type: str
av-profile:
description: Name of an existing Antivirus profile.
type: str
cifs-profile:
description: Name of an existing CIFS profile.
type: str
comments:
description: Comment.
type: str
dlp-profile:
description: Name of an existing DLP profile.
type: str
dlp-sensor:
description: Name of an existing DLP sensor.
type: str
dnsfilter-profile:
description: Name of an existing DNS filter profile.
type: str
dstaddr:
description: Destination IPv4 address name and address group names.
type: str
dstaddr-negate:
choices:
- disable
- enable
description: When enabled dstaddr/dstaddr6 specifies what the destination address
must NOT be.
type: str
dstaddr4:
description: Destination IPv4 address name and address group names.
type: str
dstaddr6:
description: Destination IPv6 address name and address group names.
type: str
dstintf:
description: Outgoing
type: str
emailfilter-profile:
description: Name of an existing email filter profile.
type: str
enforce-default-app-port:
choices:
- disable
- enable
description: Enable/disable default application port enforcement for allowed applications.
type: str
file-filter-profile:
description: Name of an existing file-filter profile.
type: str
fsso-groups:
description: Names of FSSO groups.
type: str
global-label:
description: Label for the policy that appears when the GUI is in Global View
mode.
type: str
groups:
description: Names of user groups that can authenticate with this policy.
type: str
icap-profile:
description: Name of an existing ICAP profile.
type: str
internet-service:
choices:
- disable
- enable
description: Enable/disable use of Internet Services for this policy.
type: str
internet-service-custom:
description: Custom Internet Service name.
type: str
internet-service-custom-group:
description: Custom Internet Service group name.
type: str
internet-service-group:
description: Internet Service group name.
type: str
internet-service-id:
description: Internet Service ID.
type: str
internet-service-name:
description: Internet Service name.
type: str
internet-service-negate:
choices:
- disable
- enable
description: When enabled internet-service specifies what the service must NOT
be.
type: str
internet-service-src:
choices:
- disable
- enable
description: Enable/disable use of Internet Services in source for this policy.
type: str
internet-service-src-custom:
description: Custom Internet Service source name.
type: str
internet-service-src-custom-group:
description: Custom Internet Service source group name.
type: str
internet-service-src-group:
description: Internet Service source group name.
type: str
internet-service-src-id:
description: Internet Service source ID.
type: str
internet-service-src-name:
description: Internet Service source name.
type: str
internet-service-src-negate:
choices:
- disable
- enable
description: When enabled internet-service-src specifies what the service must
NOT be.
type: str
internet-service6:
choices:
- disable
- enable
description: Enable/disable use of IPv6 Internet Services for this policy.
type: str
internet-service6-custom:
description: description
type: str
internet-service6-custom-group:
description: description
type: str
internet-service6-group:
description: description
type: str
internet-service6-name:
description: description
type: str
internet-service6-negate:
choices:
- disable
- enable
description: When enabled internet-service6 specifies what the service must NOT
be.
type: str
internet-service6-src:
choices:
- disable
- enable
description: Enable/disable use of IPv6 Internet Services in source for this policy.
type: str
internet-service6-src-custom:
description: description
type: str
internet-service6-src-custom-group:
description: description
type: str
internet-service6-src-group:
description: description
type: str
internet-service6-src-name:
description: description
type: str
internet-service6-src-negate:
choices:
- disable
- enable
description: When enabled internet-service6-src specifies what the service must
NOT be.
type: str
ips-sensor:
description: Name of an existing IPS sensor.
type: str
learning-mode:
choices:
- disable
- enable
description: Enable to allow everything, but log all of the meaningful data for
security information gathering.
type: str
logtraffic:
choices:
- disable
- all
- utm
description: Enable or disable logging.
type: str
logtraffic-start:
choices:
- disable
- enable
description: Record logs when a session starts.
type: str
mms-profile:
description: Name of an existing MMS profile.
type: str
name:
description: Policy name.
type: str
nat46:
choices:
- disable
- enable
description: Enable/disable NAT46.
type: str
nat64:
choices:
- disable
- enable
description: Enable/disable NAT64.
type: str
policyid:
description: Policy ID.
type: int
profile-group:
description: Name of profile group.
type: str
profile-protocol-options:
description: Name of an existing Protocol options profile.
type: str
profile-type:
choices:
- single
- group
description: Determine whether the firewall policy allows security profile groups
or single profiles only.
type: str
schedule:
description: Schedule name.
type: str
sctp-filter-profile:
description: Name of an existing SCTP filter profile.
type: str
send-deny-packet:
choices:
- disable
- enable
description: Enable to send a reply when a session is denied or blocked by a firewall
policy.
type: str
service:
description: Service and service group names.
type: str
service-negate:
choices:
- disable
- enable
description: When enabled service specifies what the service must NOT be.
type: str
srcaddr:
description: Source IPv4 address name and address group names.
type: str
srcaddr-negate:
choices:
- disable
- enable
description: When enabled srcaddr/srcaddr6 specifies what the source address must
NOT be.
type: str
srcaddr4:
description: Source IPv4 address name and address group names.
type: str
srcaddr6:
description: Source IPv6 address name and address group names.
type: str
srcintf:
description: Incoming
type: str
ssh-filter-profile:
description: Name of an existing SSH filter profile.
type: str
ssl-ssh-profile:
description: Name of an existing SSL SSH profile.
type: str
status:
choices:
- disable
- enable
description: Enable or disable this policy.
type: str
url-category:
description: URL category ID list.
type: str
users:
description: Names of individual users that can authenticate with this policy.
type: str
utm-status:
choices:
- disable
- enable
description: Enable security profiles.
type: str
uuid:
description: Universally Unique Identifier
type: str
videofilter-profile:
description: Name of an existing VideoFilter profile.
type: str
voip-profile:
description: Name of an existing VoIP profile.
type: str
webfilter-profile:
description: Name of an existing Web filter profile.
type: str
type: dict
meta:
contains:
request_url:
description: The full url requested.
returned: always
sample: /sys/login/user
type: str
response_code:
description: The status of api request.
returned: always
sample: 0
type: int
response_data:
description: The api response.
returned: always
type: list
response_message:
description: The descriptive message of the api response.
returned: always
sample: OK.
type: str
system_information:
description: The information of the target system.
returned: always
type: dict
description: The result of the request.
returned: always
type: dict
rc:
description: The status the request.
returned: always
sample: 0
type: int
version_check_warning:
description: Warning if the parameters used in the playbook are not supported by
the current FortiManager version.
returned: complex
type: list