Try SpotterConfigure IPv4/IPv6 policies.
| "added in version" 2.1.0 of fortinet.fortimanager"
Authors: Xinwei Du (@dux-fortinet), Xing Li (@lix-fortinet), Jie Xue (@JieX19), Link Zheng (@chillancezen), Frank Shen (@fshen01), Hongbin Lu (@fgtdev-hblu)
preview | supported by community
Install with ansible-galaxy collection install fortinet.fortimanager:==2.4.0
collections:
- name: fortinet.fortimanager
version: 2.4.0This module is able to configure a FortiManager device.
Examples include all parameters and values which need to be adjusted to data sources before usage.
- name: Example playbook (generated based on argument schema)
hosts: fortimanagers
connection: httpapi
vars:
ansible_httpapi_use_ssl: true
ansible_httpapi_validate_certs: false
ansible_httpapi_port: 443
tasks:
- name: Configure IPv4/IPv6 policies.
fortinet.fortimanager.fmgr_pm_config_pblock_firewall_policy:
# bypass_validation: false
workspace_locking_adom: <value in [global, custom adom including root]>
workspace_locking_timeout: 300
# rc_succeeded: [0, -2, -3, ...]
# rc_failed: [-2, -3, ...]
adom: <your own value>
pblock: <your own value>
state: present # <value in [present, absent]>
pm_config_pblock_firewall_policy:
_policy_block: <integer>
action: <value in [deny, accept, ipsec, ...]>
anti_replay: <value in [disable, enable]>
application_list: <string>
auth_cert: <string>
auth_path: <value in [disable, enable]>
auth_redirect_addr: <string>
auto_asic_offload: <value in [disable, enable]>
av_profile: <string>
block_notification: <value in [disable, enable]>
captive_portal_exempt: <value in [disable, enable]>
capture_packet: <value in [disable, enable]>
cifs_profile: <string>
comments: <string>
custom_log_fields: <list or string>
decrypted_traffic_mirror: <string>
delay_tcp_npu_session: <value in [disable, enable]>
diffserv_forward: <value in [disable, enable]>
diffserv_reverse: <value in [disable, enable]>
diffservcode_forward: <string>
diffservcode_rev: <string>
disclaimer: <value in [disable, enable, user, ...]>
dlp_profile: <string>
dnsfilter_profile: <string>
dsri: <value in [disable, enable]>
dstaddr: <list or string>
dstaddr_negate: <value in [disable, enable]>
dstaddr6: <list or string>
dstintf: <list or string>
dynamic_shaping: <value in [disable, enable]>
email_collect: <value in [disable, enable]>
emailfilter_profile: <string>
fec: <value in [disable, enable]>
file_filter_profile: <string>
firewall_session_dirty: <value in [check-all, check-new]>
fixedport: <value in [disable, enable]>
fsso_agent_for_ntlm: <string>
fsso_groups: <list or string>
geoip_anycast: <value in [disable, enable]>
geoip_match: <value in [physical-location, registered-location]>
global_label: <string>
groups: <list or string>
gtp_profile: <string>
http_policy_redirect: <value in [disable, enable]>
icap_profile: <string>
identity_based_route: <string>
inbound: <value in [disable, enable]>
inspection_mode: <value in [proxy, flow]>
internet_service: <value in [disable, enable]>
internet_service_custom: <list or string>
internet_service_custom_group: <list or string>
internet_service_group: <list or string>
internet_service_name: <list or string>
internet_service_negate: <value in [disable, enable]>
internet_service_src: <value in [disable, enable]>
internet_service_src_custom: <list or string>
internet_service_src_custom_group: <list or string>
internet_service_src_group: <list or string>
internet_service_src_name: <list or string>
internet_service_src_negate: <value in [disable, enable]>
ippool: <value in [disable, enable]>
ips_sensor: <string>
label: <string>
logtraffic: <value in [disable, enable, all, ...]>
logtraffic_start: <value in [disable, enable]>
match_vip: <value in [disable, enable]>
match_vip_only: <value in [disable, enable]>
name: <string>
nat: <value in [disable, enable]>
nat46: <value in [disable, enable]>
nat64: <value in [disable, enable]>
natinbound: <value in [disable, enable]>
natip: <string>
natoutbound: <value in [disable, enable]>
np_acceleration: <value in [disable, enable]>
ntlm: <value in [disable, enable]>
ntlm_enabled_browsers: <list or string>
ntlm_guest: <value in [disable, enable]>
outbound: <value in [disable, enable]>
passive_wan_health_measurement: <value in [disable, enable]>
per_ip_shaper: <string>
permit_any_host: <value in [disable, enable]>
permit_stun_host: <value in [disable, enable]>
pfcp_profile: <string>
policy_expiry: <value in [disable, enable]>
policy_expiry_date: <string>
policyid: <integer>
poolname: <list or string>
poolname6: <list or string>
profile_group: <string>
profile_protocol_options: <string>
profile_type: <value in [single, group]>
radius_mac_auth_bypass: <value in [disable, enable]>
redirect_url: <string>
replacemsg_override_group: <string>
reputation_direction: <value in [source, destination]>
reputation_minimum: <integer>
rtp_addr: <list or string>
rtp_nat: <value in [disable, enable]>
schedule: <string>
schedule_timeout: <value in [disable, enable]>
sctp_filter_profile: <string>
send_deny_packet: <value in [disable, enable]>
service: <list or string>
service_negate: <value in [disable, enable]>
session_ttl: <integer or string>
sgt: <list or integer>
sgt_check: <value in [disable, enable]>
src_vendor_mac: <list or string>
srcaddr: <list or string>
srcaddr_negate: <value in [disable, enable]>
srcaddr6: <list or string>
srcintf: <list or string>
ssh_filter_profile: <string>
ssh_policy_redirect: <value in [disable, enable]>
ssl_ssh_profile: <string>
status: <value in [disable, enable]>
tcp_mss_receiver: <integer>
tcp_mss_sender: <integer>
tcp_session_without_syn: <value in [all, data-only, disable]>
timeout_send_rst: <value in [disable, enable]>
tos: <string>
tos_mask: <string>
tos_negate: <value in [disable, enable]>
traffic_shaper: <string>
traffic_shaper_reverse: <string>
users: <list or string>
utm_status: <value in [disable, enable]>
uuid: <string>
videofilter_profile: <string>
vlan_cos_fwd: <integer>
vlan_cos_rev: <integer>
vlan_filter: <string>
voip_profile: <string>
vpntunnel: <string>
waf_profile: <string>
wanopt: <value in [disable, enable]>
wanopt_detection: <value in [active, passive, off]>
wanopt_passive_opt: <value in [default, transparent, non-transparent]>
wanopt_peer: <string>
wanopt_profile: <string>
wccp: <value in [disable, enable]>
webcache: <value in [disable, enable]>
webcache_https: <value in [disable, ssl-server, any, ...]>
webfilter_profile: <string>
webproxy_forward_server: <string>
webproxy_profile: <string>
ztna_ems_tag: <list or string>
ztna_geo_tag: <list or string>
ztna_status: <value in [disable, enable]>
policy_offload: <value in [disable, enable]>
cgn_session_quota: <integer>
tcp_timeout_pid: <string>
udp_timeout_pid: <string>
dlp_sensor: <string>
cgn_eif: <value in [disable, enable]>
cgn_log_server_grp: <string>
cgn_resource_quota: <integer>
cgn_eim: <value in [disable, enable]>
mms_profile: <string>
app_category: <list or string>
internet_service_src_id: <list or string>
rsso: <value in [disable, enable]>
internet_service_id: <list or string>
best_route: <value in [disable, enable]>
fsso: <value in [disable, enable]>
url_category: <list or string>
app_group: <list or string>
ssl_mirror_intf: <list or string>
wsso: <value in [disable, enable]>
ssl_mirror: <value in [disable, enable]>
application: <list or integer>
dscp_negate: <value in [disable, enable]>
learning_mode: <value in [disable, enable]>
devices: <list or string>
dscp_value: <string>
spamfilter_profile: <string>
scan_botnet_connections: <value in [disable, block, monitor]>
dscp_match: <value in [disable, enable]>
diffserv_copy: <value in [disable, enable]>
dstaddr6_negate: <value in [disable, enable]>
internet_service6: <value in [disable, enable]>
internet_service6_custom: <list or string>
internet_service6_custom_group: <list or string>
internet_service6_group: <list or string>
internet_service6_name: <list or string>
internet_service6_negate: <value in [disable, enable]>
internet_service6_src: <value in [disable, enable]>
internet_service6_src_custom: <list or string>
internet_service6_src_custom_group: <list or string>
internet_service6_src_group: <list or string>
internet_service6_src_name: <list or string>
internet_service6_src_negate: <value in [disable, enable]>
network_service_dynamic: <list or string>
network_service_src_dynamic: <list or string>
reputation_direction6: <value in [source, destination]>
reputation_minimum6: <integer>
srcaddr6_negate: <value in [disable, enable]>
ip_version_type: <string>
ips_voip_filter: <string>
pcp_inbound: <value in [disable, enable]>
pcp_outbound: <value in [disable, enable]>
pcp_poolname: <list or string>
policy_behaviour_type: <string>
policy_expiry_date_utc: <string>
ztna_device_ownership: <value in [disable, enable]>
ztna_ems_tag_secondary: <list or string>
ztna_policy_redirect: <value in [disable, enable]>
ztna_tags_match_logic: <value in [or, and]>
casb_profile: <string>
virtual_patch_profile: <string>
diameter_filter_profile: <string>
adom:
description: The parameter (adom) in requested url.
required: true
type: str
state:
choices:
- present
- absent
description: The directive to create, update or delete an object.
required: true
type: str
pblock:
description: The parameter (pblock) in requested url.
required: true
type: str
rc_failed:
description: The rc codes list with which the conditions to fail will be overriden.
elements: int
type: list
enable_log:
default: false
description: Enable/Disable logging for task.
type: bool
access_token:
description: The token to access FortiManager without using username and password.
type: str
rc_succeeded:
description: The rc codes list with which the conditions to succeed will be overriden.
elements: int
type: list
proposed_method:
choices:
- update
- set
- add
description: The overridden method for the underlying Json RPC request.
type: str
bypass_validation:
default: false
description: Only set to True when module schema diffs with FortiManager API structure,
module continues to execute without validating parameters.
type: bool
workspace_locking_adom:
description: The adom to lock for FortiManager running in workspace mode, the value
can be global and others including root.
type: str
forticloud_access_token:
description: Authenticate Ansible client with forticloud API access token.
type: str
workspace_locking_timeout:
default: 300
description: The maximum time in seconds to wait for other user to release the workspace
lock.
type: int
pm_config_pblock_firewall_policy:
description: The top level parameters set.
required: false
suboptions:
_policy_block:
description: Assigned policy block.
type: int
action:
choices:
- deny
- accept
- ipsec
- ssl-vpn
- redirect
- isolate
description: Policy action
type: str
anti-replay:
choices:
- disable
- enable
description: Deprecated, please rename it to anti_replay. Enable/disable anti-replay
check.
type: str
app-category:
description: (list) Deprecated, please rename it to app_category.
type: raw
app-group:
description: (list) Deprecated, please rename it to app_group.
type: raw
application:
description: (list) No description.
type: raw
application-list:
description: Deprecated, please rename it to application_list. Name of an existing
Application list.
type: str
auth-cert:
description: Deprecated, please rename it to auth_cert. HTTPS server certificate
for policy authentication.
type: str
auth-path:
choices:
- disable
- enable
description: Deprecated, please rename it to auth_path. Enable/disable authentication-based
routing.
type: str
auth-redirect-addr:
description: Deprecated, please rename it to auth_redirect_addr. HTTP-to-HTTPS
redirect address for firewall authentication.
type: str
auto-asic-offload:
choices:
- disable
- enable
description: Deprecated, please rename it to auto_asic_offload. Enable/disable
policy traffic ASIC offloading.
type: str
av-profile:
description: Deprecated, please rename it to av_profile. Name of an existing Antivirus
profile.
type: str
best-route:
choices:
- disable
- enable
description: Deprecated, please rename it to best_route.
type: str
block-notification:
choices:
- disable
- enable
description: Deprecated, please rename it to block_notification. Enable/disable
block notification.
type: str
captive-portal-exempt:
choices:
- disable
- enable
description: Deprecated, please rename it to captive_portal_exempt. Enable to
exempt some users from the captive portal.
type: str
capture-packet:
choices:
- disable
- enable
description: Deprecated, please rename it to capture_packet. Enable/disable capture
packets.
type: str
casb-profile:
description: Deprecated, please rename it to casb_profile. Name of an existing
CASB profile.
type: str
cgn-eif:
choices:
- disable
- enable
description: Deprecated, please rename it to cgn_eif. Enable/Disable CGN endpoint
independent filtering.
type: str
cgn-eim:
choices:
- disable
- enable
description: Deprecated, please rename it to cgn_eim. Enable/Disable CGN endpoint
independent mapping
type: str
cgn-log-server-grp:
description: Deprecated, please rename it to cgn_log_server_grp. NP log server
group name
type: str
cgn-resource-quota:
description: Deprecated, please rename it to cgn_resource_quota. Resource quota
type: int
cgn-session-quota:
description: Deprecated, please rename it to cgn_session_quota. Session quota
type: int
cifs-profile:
description: Deprecated, please rename it to cifs_profile. Name of an existing
CIFS profile.
type: str
comments:
description: Comment.
type: str
custom-log-fields:
description: (list) Deprecated, please rename it to custom_log_fields.
type: raw
decrypted-traffic-mirror:
description: Deprecated, please rename it to decrypted_traffic_mirror. Decrypted
traffic mirror.
type: str
delay-tcp-npu-session:
choices:
- disable
- enable
description: Deprecated, please rename it to delay_tcp_npu_session. Enable TCP
NPU session delay to guarantee packet order of 3-way han...
type: str
devices:
description: (list) No description.
type: raw
diameter-filter-profile:
description: Deprecated, please rename it to diameter_filter_profile. Name of
an existing Diameter filter profile.
type: str
diffserv-copy:
choices:
- disable
- enable
description: Deprecated, please rename it to diffserv_copy. Enable to copy packets
DiffServ values from sessions original direction to ...
type: str
diffserv-forward:
choices:
- disable
- enable
description: Deprecated, please rename it to diffserv_forward. Enable to change
packets DiffServ values to the specified diffservcode-f...
type: str
diffserv-reverse:
choices:
- disable
- enable
description: Deprecated, please rename it to diffserv_reverse. Enable to change
packets reverse
type: str
diffservcode-forward:
description: Deprecated, please rename it to diffservcode_forward. Change packets
DiffServ to this value.
type: str
diffservcode-rev:
description: Deprecated, please rename it to diffservcode_rev. Change packets
reverse
type: str
disclaimer:
choices:
- disable
- enable
- user
- domain
- policy
description: Enable/disable user authentication disclaimer.
type: str
dlp-profile:
description: Deprecated, please rename it to dlp_profile. Name of an existing
DLP profile.
type: str
dlp-sensor:
description: Deprecated, please rename it to dlp_sensor. Name of an existing DLP
sensor.
type: str
dnsfilter-profile:
description: Deprecated, please rename it to dnsfilter_profile. Name of an existing
DNS filter profile.
type: str
dscp-match:
choices:
- disable
- enable
description: Deprecated, please rename it to dscp_match. Enable DSCP check.
type: str
dscp-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to dscp_negate. Enable negated DSCP
match.
type: str
dscp-value:
description: Deprecated, please rename it to dscp_value. DSCP value.
type: str
dsri:
choices:
- disable
- enable
description: Enable DSRI to ignore HTTP server responses.
type: str
dstaddr:
description: (list) No description.
type: raw
dstaddr-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to dstaddr_negate. When enabled dstaddr/dstaddr6
specifies what the destination address must ...
type: str
dstaddr6:
description: (list) No description.
type: raw
dstaddr6-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to dstaddr6_negate. When enabled dstaddr6
specifies what the destination address must NOT be.
type: str
dstintf:
description: (list) No description.
type: raw
dynamic-shaping:
choices:
- disable
- enable
description: Deprecated, please rename it to dynamic_shaping. Enable/disable dynamic
RADIUS defined traffic shaping.
type: str
email-collect:
choices:
- disable
- enable
description: Deprecated, please rename it to email_collect. Enable/disable email
collection.
type: str
emailfilter-profile:
description: Deprecated, please rename it to emailfilter_profile. Name of an existing
email filter profile.
type: str
fec:
choices:
- disable
- enable
description: Enable/disable Forward Error Correction on traffic matching this
policy on a FEC device.
type: str
file-filter-profile:
description: Deprecated, please rename it to file_filter_profile. Name of an existing
file-filter profile.
type: str
firewall-session-dirty:
choices:
- check-all
- check-new
description: Deprecated, please rename it to firewall_session_dirty. How to handle
sessions if the configuration of this firewall polic...
type: str
fixedport:
choices:
- disable
- enable
description: Enable to prevent source NAT from changing a sessions source port.
type: str
fsso:
choices:
- disable
- enable
description: Enable/disable Fortinet Single Sign-On.
type: str
fsso-agent-for-ntlm:
description: Deprecated, please rename it to fsso_agent_for_ntlm. FSSO agent to
use for NTLM authentication.
type: str
fsso-groups:
description: (list) Deprecated, please rename it to fsso_groups.
type: raw
geoip-anycast:
choices:
- disable
- enable
description: Deprecated, please rename it to geoip_anycast. Enable/disable recognition
of anycast IP addresses using the geography IP d...
type: str
geoip-match:
choices:
- physical-location
- registered-location
description: Deprecated, please rename it to geoip_match. Match geography address
based either on its physical location or registered l...
type: str
global-label:
description: Deprecated, please rename it to global_label. Label for the policy
that appears when the GUI is in Global View mode.
type: str
groups:
description: (list) No description.
type: raw
gtp-profile:
description: Deprecated, please rename it to gtp_profile. GTP profile.
type: str
http-policy-redirect:
choices:
- disable
- enable
description: Deprecated, please rename it to http_policy_redirect. Redirect HTTP
type: str
icap-profile:
description: Deprecated, please rename it to icap_profile. Name of an existing
ICAP profile.
type: str
identity-based-route:
description: Deprecated, please rename it to identity_based_route. Name of identity-based
routing rule.
type: str
inbound:
choices:
- disable
- enable
description: Policy-based IPsec VPN
type: str
inspection-mode:
choices:
- proxy
- flow
description: Deprecated, please rename it to inspection_mode. Policy inspection
mode
type: str
internet-service:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service. Enable/disable
use of Internet Services for this policy.
type: str
internet-service-custom:
description: (list) Deprecated, please rename it to internet_service_custom.
type: raw
internet-service-custom-group:
description: (list) Deprecated, please rename it to internet_service_custom_group.
type: raw
internet-service-group:
description: (list) Deprecated, please rename it to internet_service_group.
type: raw
internet-service-id:
description: (list) Deprecated, please rename it to internet_service_id.
type: raw
internet-service-name:
description: (list) Deprecated, please rename it to internet_service_name.
type: raw
internet-service-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service_negate. When enabled
internet-service specifies what the service must NOT be.
type: str
internet-service-src:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service_src. Enable/disable
use of Internet Services in source for this policy.
type: str
internet-service-src-custom:
description: (list) Deprecated, please rename it to internet_service_src_custom.
type: raw
internet-service-src-custom-group:
description: (list) Deprecated, please rename it to internet_service_src_custom_group.
type: raw
internet-service-src-group:
description: (list) Deprecated, please rename it to internet_service_src_group.
type: raw
internet-service-src-id:
description: (list) Deprecated, please rename it to internet_service_src_id.
type: raw
internet-service-src-name:
description: (list) Deprecated, please rename it to internet_service_src_name.
type: raw
internet-service-src-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service_src_negate. When
enabled internet-service-src specifies what the service ...
type: str
internet-service6:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service6. Enable/disable
use of IPv6 Internet Services for this policy.
type: str
internet-service6-custom:
description: (list) Deprecated, please rename it to internet_service6_custom.
type: raw
internet-service6-custom-group:
description: (list) Deprecated, please rename it to internet_service6_custom_group.
type: raw
internet-service6-group:
description: (list) Deprecated, please rename it to internet_service6_group.
type: raw
internet-service6-name:
description: (list) Deprecated, please rename it to internet_service6_name.
type: raw
internet-service6-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service6_negate. When enabled
internet-service6 specifies what the service must N...
type: str
internet-service6-src:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service6_src. Enable/disable
use of IPv6 Internet Services in source for this policy.
type: str
internet-service6-src-custom:
description: (list) Deprecated, please rename it to internet_service6_src_custom.
type: raw
internet-service6-src-custom-group:
description: (list) Deprecated, please rename it to internet_service6_src_custom_group.
type: raw
internet-service6-src-group:
description: (list) Deprecated, please rename it to internet_service6_src_group.
type: raw
internet-service6-src-name:
description: (list) Deprecated, please rename it to internet_service6_src_name.
type: raw
internet-service6-src-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service6_src_negate. When
enabled internet-service6-src specifies what the servic...
type: str
ip-version-type:
description: Deprecated, please rename it to ip_version_type. IP version of the
policy.
type: str
ippool:
choices:
- disable
- enable
description: Enable to use IP Pools for source NAT.
type: str
ips-sensor:
description: Deprecated, please rename it to ips_sensor. Name of an existing IPS
sensor.
type: str
ips-voip-filter:
description: Deprecated, please rename it to ips_voip_filter. Name of an existing
VoIP
type: str
label:
description: Label for the policy that appears when the GUI is in Section View
mode.
type: str
learning-mode:
choices:
- disable
- enable
description: Deprecated, please rename it to learning_mode. Enable to allow everything,
but log all of the meaningful data for security...
type: str
logtraffic:
choices:
- disable
- enable
- all
- utm
description: Enable or disable logging.
type: str
logtraffic-start:
choices:
- disable
- enable
description: Deprecated, please rename it to logtraffic_start. Record logs when
a session starts.
type: str
match-vip:
choices:
- disable
- enable
description: Deprecated, please rename it to match_vip. Enable to match packets
that have had their destination addresses changed by a VIP.
type: str
match-vip-only:
choices:
- disable
- enable
description: Deprecated, please rename it to match_vip_only. Enable/disable matching
of only those packets that have had their destinat...
type: str
mms-profile:
description: Deprecated, please rename it to mms_profile. Name of an existing
MMS profile.
type: str
name:
description: Policy name.
type: str
nat:
choices:
- disable
- enable
description: Enable/disable source NAT.
type: str
nat46:
choices:
- disable
- enable
description: Enable/disable NAT46.
type: str
nat64:
choices:
- disable
- enable
description: Enable/disable NAT64.
type: str
natinbound:
choices:
- disable
- enable
description: Policy-based IPsec VPN
type: str
natip:
description: Policy-based IPsec VPN
type: str
natoutbound:
choices:
- disable
- enable
description: Policy-based IPsec VPN
type: str
network-service-dynamic:
description: (list) Deprecated, please rename it to network_service_dynamic.
type: raw
network-service-src-dynamic:
description: (list) Deprecated, please rename it to network_service_src_dynamic.
type: raw
np-acceleration:
choices:
- disable
- enable
description: Deprecated, please rename it to np_acceleration. Enable/disable UTM
Network Processor acceleration.
type: str
ntlm:
choices:
- disable
- enable
description: Enable/disable NTLM authentication.
type: str
ntlm-enabled-browsers:
description: (list) Deprecated, please rename it to ntlm_enabled_browsers.
type: raw
ntlm-guest:
choices:
- disable
- enable
description: Deprecated, please rename it to ntlm_guest. Enable/disable NTLM guest
user access.
type: str
outbound:
choices:
- disable
- enable
description: Policy-based IPsec VPN
type: str
passive-wan-health-measurement:
choices:
- disable
- enable
description: Deprecated, please rename it to passive_wan_health_measurement. Enable/disable
passive WAN health measurement.
type: str
pcp-inbound:
choices:
- disable
- enable
description: Deprecated, please rename it to pcp_inbound. Enable/disable PCP inbound
DNAT.
type: str
pcp-outbound:
choices:
- disable
- enable
description: Deprecated, please rename it to pcp_outbound. Enable/disable PCP
outbound SNAT.
type: str
pcp-poolname:
description: (list) Deprecated, please rename it to pcp_poolname.
type: raw
per-ip-shaper:
description: Deprecated, please rename it to per_ip_shaper. Per-IP traffic shaper.
type: str
permit-any-host:
choices:
- disable
- enable
description: Deprecated, please rename it to permit_any_host. Accept UDP packets
from any host.
type: str
permit-stun-host:
choices:
- disable
- enable
description: Deprecated, please rename it to permit_stun_host. Accept UDP packets
from any Session Traversal Utilities for NAT
type: str
pfcp-profile:
description: Deprecated, please rename it to pfcp_profile. PFCP profile.
type: str
policy-behaviour-type:
description: Deprecated, please rename it to policy_behaviour_type. Behaviour
of the policy.
type: str
policy-expiry:
choices:
- disable
- enable
description: Deprecated, please rename it to policy_expiry. Enable/disable policy
expiry.
type: str
policy-expiry-date:
description: Deprecated, please rename it to policy_expiry_date. Policy expiry
date
type: str
policy-expiry-date-utc:
description: Deprecated, please rename it to policy_expiry_date_utc. Policy expiry
date and time, in epoch format.
type: str
policy-offload:
choices:
- disable
- enable
description: Deprecated, please rename it to policy_offload. Enable/Disable hardware
session setup for CGNAT.
type: str
policyid:
description: Policy ID
required: true
type: int
poolname:
description: (list) No description.
type: raw
poolname6:
description: (list) No description.
type: raw
profile-group:
description: Deprecated, please rename it to profile_group. Name of profile group.
type: str
profile-protocol-options:
description: Deprecated, please rename it to profile_protocol_options. Name of
an existing Protocol options profile.
type: str
profile-type:
choices:
- single
- group
description: Deprecated, please rename it to profile_type. Determine whether the
firewall policy allows security profile groups or sing...
type: str
radius-mac-auth-bypass:
choices:
- disable
- enable
description: Deprecated, please rename it to radius_mac_auth_bypass. Enable MAC
authentication bypass.
type: str
redirect-url:
description: Deprecated, please rename it to redirect_url. URL users are directed
to after seeing and accepting the disclaimer or authe...
type: str
replacemsg-override-group:
description: Deprecated, please rename it to replacemsg_override_group. Override
the default replacement message group for this policy.
type: str
reputation-direction:
choices:
- source
- destination
description: Deprecated, please rename it to reputation_direction. Direction of
the initial traffic for reputation to take effect.
type: str
reputation-direction6:
choices:
- source
- destination
description: Deprecated, please rename it to reputation_direction6. Direction
of the initial traffic for IPv6 reputation to take effect.
type: str
reputation-minimum:
description: Deprecated, please rename it to reputation_minimum. Minimum Reputation
to take action.
type: int
reputation-minimum6:
description: Deprecated, please rename it to reputation_minimum6. IPv6 Minimum
Reputation to take action.
type: int
rsso:
choices:
- disable
- enable
description: Enable/disable RADIUS single sign-on
type: str
rtp-addr:
description: (list) Deprecated, please rename it to rtp_addr.
type: raw
rtp-nat:
choices:
- disable
- enable
description: Deprecated, please rename it to rtp_nat. Enable Real Time Protocol
type: str
scan-botnet-connections:
choices:
- disable
- block
- monitor
description: Deprecated, please rename it to scan_botnet_connections. Block or
monitor connections to Botnet servers or disable Botnet ...
type: str
schedule:
description: Schedule name.
type: str
schedule-timeout:
choices:
- disable
- enable
description: Deprecated, please rename it to schedule_timeout. Enable to force
current sessions to end when the schedule object times out.
type: str
sctp-filter-profile:
description: Deprecated, please rename it to sctp_filter_profile. Name of an existing
SCTP filter profile.
type: str
send-deny-packet:
choices:
- disable
- enable
description: Deprecated, please rename it to send_deny_packet. Enable to send
a reply when a session is denied or blocked by a firewall...
type: str
service:
description: (list) No description.
type: raw
service-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to service_negate. When enabled service
specifies what the service must NOT be.
type: str
session-ttl:
description: (int or str) Deprecated, please rename it to session_ttl. TTL in
seconds for sessions accepted by this policy
type: raw
sgt:
description: (list) No description.
type: raw
sgt-check:
choices:
- disable
- enable
description: Deprecated, please rename it to sgt_check. Enable/disable security
group tags
type: str
spamfilter-profile:
description: Deprecated, please rename it to spamfilter_profile. Name of an existing
Spam filter profile.
type: str
src-vendor-mac:
description: (list) Deprecated, please rename it to src_vendor_mac.
type: raw
srcaddr:
description: (list) No description.
type: raw
srcaddr-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to srcaddr_negate. When enabled srcaddr/srcaddr6
specifies what the source address must NOT be.
type: str
srcaddr6:
description: (list) No description.
type: raw
srcaddr6-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to srcaddr6_negate. When enabled srcaddr6
specifies what the source address must NOT be.
type: str
srcintf:
description: (list) No description.
type: raw
ssh-filter-profile:
description: Deprecated, please rename it to ssh_filter_profile. Name of an existing
SSH filter profile.
type: str
ssh-policy-redirect:
choices:
- disable
- enable
description: Deprecated, please rename it to ssh_policy_redirect. Redirect SSH
traffic to matching transparent proxy policy.
type: str
ssl-mirror:
choices:
- disable
- enable
description: Deprecated, please rename it to ssl_mirror. Enable to copy decrypted
SSL traffic to a FortiGate interface
type: str
ssl-mirror-intf:
description: (list) Deprecated, please rename it to ssl_mirror_intf.
type: raw
ssl-ssh-profile:
description: Deprecated, please rename it to ssl_ssh_profile. Name of an existing
SSL SSH profile.
type: str
status:
choices:
- disable
- enable
description: Enable or disable this policy.
type: str
tcp-mss-receiver:
description: Deprecated, please rename it to tcp_mss_receiver. Receiver TCP maximum
segment size
type: int
tcp-mss-sender:
description: Deprecated, please rename it to tcp_mss_sender. Sender TCP maximum
segment size
type: int
tcp-session-without-syn:
choices:
- all
- data-only
- disable
description: Deprecated, please rename it to tcp_session_without_syn. Enable/disable
creation of TCP session without SYN flag.
type: str
tcp-timeout-pid:
description: Deprecated, please rename it to tcp_timeout_pid. TCP timeout profile
ID
type: str
timeout-send-rst:
choices:
- disable
- enable
description: Deprecated, please rename it to timeout_send_rst. Enable/disable
sending RST packets when TCP sessions expire.
type: str
tos:
description: ToS
type: str
tos-mask:
description: Deprecated, please rename it to tos_mask. Non-zero bit positions
are used for comparison while zero bit positions are ignored.
type: str
tos-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to tos_negate. Enable negated TOS match.
type: str
traffic-shaper:
description: Deprecated, please rename it to traffic_shaper. Traffic shaper.
type: str
traffic-shaper-reverse:
description: Deprecated, please rename it to traffic_shaper_reverse. Reverse traffic
shaper.
type: str
udp-timeout-pid:
description: Deprecated, please rename it to udp_timeout_pid. UDP timeout profile
ID
type: str
url-category:
description: (list) Deprecated, please rename it to url_category.
type: raw
users:
description: (list) No description.
type: raw
utm-status:
choices:
- disable
- enable
description: Deprecated, please rename it to utm_status. Enable to add one or
more security profiles
type: str
uuid:
description: Universally Unique Identifier
type: str
videofilter-profile:
description: Deprecated, please rename it to videofilter_profile. Name of an existing
VideoFilter profile.
type: str
virtual-patch-profile:
description: Deprecated, please rename it to virtual_patch_profile. Name of an
existing virtual-patch profile.
type: str
vlan-cos-fwd:
description: Deprecated, please rename it to vlan_cos_fwd. VLAN forward direction
user priority
type: int
vlan-cos-rev:
description: Deprecated, please rename it to vlan_cos_rev. VLAN reverse direction
user priority
type: int
vlan-filter:
description: Deprecated, please rename it to vlan_filter. Set VLAN filters.
type: str
voip-profile:
description: Deprecated, please rename it to voip_profile. Name of an existing
VoIP profile.
type: str
vpntunnel:
description: Policy-based IPsec VPN
type: str
waf-profile:
description: Deprecated, please rename it to waf_profile. Name of an existing
Web application firewall profile.
type: str
wanopt:
choices:
- disable
- enable
description: Enable/disable WAN optimization.
type: str
wanopt-detection:
choices:
- active
- passive
- 'off'
description: Deprecated, please rename it to wanopt_detection. WAN optimization
auto-detection mode.
type: str
wanopt-passive-opt:
choices:
- default
- transparent
- non-transparent
description: Deprecated, please rename it to wanopt_passive_opt. WAN optimization
passive mode options.
type: str
wanopt-peer:
description: Deprecated, please rename it to wanopt_peer. WAN optimization peer.
type: str
wanopt-profile:
description: Deprecated, please rename it to wanopt_profile. WAN optimization
profile.
type: str
wccp:
choices:
- disable
- enable
description: Enable/disable forwarding traffic matching this policy to a configured
WCCP server.
type: str
webcache:
choices:
- disable
- enable
description: Enable/disable web cache.
type: str
webcache-https:
choices:
- disable
- ssl-server
- any
- enable
description: Deprecated, please rename it to webcache_https. Enable/disable web
cache for HTTPS.
type: str
webfilter-profile:
description: Deprecated, please rename it to webfilter_profile. Name of an existing
Web filter profile.
type: str
webproxy-forward-server:
description: Deprecated, please rename it to webproxy_forward_server. Webproxy
forward server name.
type: str
webproxy-profile:
description: Deprecated, please rename it to webproxy_profile. Webproxy profile
name.
type: str
wsso:
choices:
- disable
- enable
description: Enable/disable WiFi Single Sign On
type: str
ztna-device-ownership:
choices:
- disable
- enable
description: Deprecated, please rename it to ztna_device_ownership. Enable/disable
zero trust device ownership.
type: str
ztna-ems-tag:
description: (list) Deprecated, please rename it to ztna_ems_tag.
type: raw
ztna-ems-tag-secondary:
description: (list) Deprecated, please rename it to ztna_ems_tag_secondary.
type: raw
ztna-geo-tag:
description: (list) Deprecated, please rename it to ztna_geo_tag.
type: raw
ztna-policy-redirect:
choices:
- disable
- enable
description: Deprecated, please rename it to ztna_policy_redirect. Redirect ZTNA
traffic to matching Access-Proxy proxy-policy.
type: str
ztna-status:
choices:
- disable
- enable
description: Deprecated, please rename it to ztna_status. Enable/disable zero
trust access.
type: str
ztna-tags-match-logic:
choices:
- or
- and
description: Deprecated, please rename it to ztna_tags_match_logic. ZTNA tag matching
logic.
type: str
type: dict
meta:
contains:
request_url:
description: The full url requested.
returned: always
sample: /sys/login/user
type: str
response_code:
description: The status of api request.
returned: always
sample: 0
type: int
response_data:
description: The api response.
returned: always
type: list
response_message:
description: The descriptive message of the api response.
returned: always
sample: OK.
type: str
system_information:
description: The information of the target system.
returned: always
type: dict
description: The result of the request.
returned: always
type: dict
rc:
description: The status the request.
returned: always
sample: 0
type: int
version_check_warning:
description: Warning if the parameters used in the playbook are not supported by
the current FortiManager version.
returned: complex
type: list