Try SpotterConfigure application control lists in Fortinet's FortiOS and FortiGate.
| "added in version" 2.0.0 of lix_fortinet.fortios"
Authors: Link Zheng (@chillancezen), Jie Xue (@JieX19), Hongbin Lu (@fgtdev-hblu), Frank Shen (@frankshen01), Miguel Angel Munoz (@mamunozgonzalez), Nicolas Thomas (@thomnico)
preview | supported by community
Install with ansible-galaxy collection install lix_fortinet.fortios:==102.2.120
collections:
- name: lix_fortinet.fortios
version: 102.2.120This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify application feature and list category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0
- hosts: fortigates
collections:
- fortinet.fortios
connection: httpapi
vars:
vdom: "root"
ansible_httpapi_use_ssl: yes
ansible_httpapi_validate_certs: no
ansible_httpapi_port: 443
tasks:
- name: Configure application control lists.
fortios_application_list:
vdom: "{{ vdom }}"
state: "present"
access_token: "<your_own_value>"
application_list:
app_replacemsg: "disable"
comment: "Comments."
control_default_network_services: "disable"
deep_app_inspection: "disable"
default_network_services:
-
id: "8"
port: "0"
services: "http"
violation_action: "pass"
enforce_default_app_port: "disable"
entries:
-
action: "pass"
application:
-
id: "16"
behavior: "<your_own_value>"
category:
-
id: "19"
exclusion:
-
id: "21"
id: "22"
log: "disable"
log_packet: "disable"
parameters:
-
id: "26"
members:
-
id: "28"
name: "default_name_29"
value: "<your_own_value>"
value: "<your_own_value>"
per_ip_shaper: "<your_own_value> (source firewall.shaper.per-ip-shaper.name)"
popularity: "1"
protocols: "<your_own_value>"
quarantine: "none"
quarantine_expiry: "<your_own_value>"
quarantine_log: "disable"
rate_count: "0"
rate_duration: "60"
rate_mode: "periodical"
rate_track: "none"
risk:
-
level: "0"
session_ttl: "0"
shaper: "<your_own_value> (source firewall.shaper.traffic-shaper.name)"
shaper_reverse: "<your_own_value> (source firewall.shaper.traffic-shaper.name)"
sub_category:
-
id: "48"
technology: "<your_own_value>"
vendor: "<your_own_value>"
extended_log: "enable"
force_inclusion_ssl_di_sigs: "disable"
name: "default_name_53"
options: "allow-dns"
other_application_action: "pass"
other_application_log: "disable"
p2p_black_list: "skype"
p2p_block_list: "skype"
replacemsg_group: "<your_own_value> (source system.replacemsg-group.name)"
unknown_application_action: "pass"
unknown_application_log: "disable"
vdom:
default: root
description:
- Virtual domain, among those defined previously. A vdom is a virtual instance of
the FortiGate that can be configured and used as a different unit.
type: str
state:
choices:
- present
- absent
description:
- Indicates whether to create or remove the object.
required: true
type: str
enable_log:
default: false
description:
- Enable/Disable logging for task.
required: false
type: bool
member_path:
description:
- Member attribute path to operate on.
- Delimited by a slash character if there are more than one attribute.
- Parameter marked with member_path is legitimate for doing member operation.
type: str
access_token:
description:
- Token-based authentication. Generated from GUI of Fortigate.
required: false
type: str
member_state:
choices:
- present
- absent
description:
- Add or delete a member under specified attribute path.
- When member_state is specified, the state option is ignored.
type: str
application_list:
default: null
description:
- Configure application control lists.
suboptions:
app_replacemsg:
choices:
- disable
- enable
description:
- Enable/disable replacement messages for blocked applications.
type: str
comment:
description:
- Comments.
type: str
control_default_network_services:
choices:
- disable
- enable
description:
- Enable/disable enforcement of protocols over selected ports.
type: str
deep_app_inspection:
choices:
- disable
- enable
description:
- Enable/disable deep application inspection.
type: str
default_network_services:
description:
- Default network service entries.
elements: dict
suboptions:
id:
description:
- Entry ID.
type: int
port:
description:
- Port number.
type: int
services:
choices:
- http
- ssh
- telnet
- ftp
- dns
- smtp
- pop3
- imap
- snmp
- nntp
- https
description:
- Network protocols.
elements: str
type: list
violation_action:
choices:
- pass
- monitor
- block
description:
- Action for protocols not in the allowlist for selected port.
type: str
type: list
enforce_default_app_port:
choices:
- disable
- enable
description:
- Enable/disable default application port enforcement for allowed applications.
type: str
entries:
description:
- Application list entries.
elements: dict
suboptions:
action:
choices:
- pass
- block
- reset
description:
- Pass or block traffic, or reset connection for traffic from this application.
type: str
application:
description:
- ID of allowed applications.
elements: dict
suboptions:
id:
description:
- Application IDs.
type: int
type: list
behavior:
description:
- Application behavior filter.
elements: str
type: list
category:
description:
- Category ID list.
elements: dict
suboptions:
id:
description:
- Application category ID.
type: int
type: list
exclusion:
description:
- ID of excluded applications.
elements: dict
suboptions:
id:
description:
- Excluded application IDs.
type: int
type: list
id:
description:
- Entry ID.
type: int
log:
choices:
- disable
- enable
description:
- Enable/disable logging for this application list.
type: str
log_packet:
choices:
- disable
- enable
description:
- Enable/disable packet logging.
type: str
parameters:
description:
- Application parameters.
elements: dict
suboptions:
id:
description:
- Parameter tuple ID.
type: int
members:
description:
- Parameter tuple members.
elements: dict
suboptions:
id:
description:
- Parameter.
type: int
name:
description:
- Parameter name.
type: str
value:
description:
- Parameter value.
type: str
type: list
value:
description:
- Parameter value.
type: str
type: list
per_ip_shaper:
description:
- Per-IP traffic shaper. Source firewall.shaper.per-ip-shaper.name.
type: str
popularity:
choices:
- '1'
- '2'
- '3'
- '4'
- '5'
description:
- Application popularity filter (1 - 5, from least to most popular).
elements: str
type: list
protocols:
description:
- Application protocol filter.
elements: str
type: list
quarantine:
choices:
- none
- attacker
description:
- Quarantine method.
type: str
quarantine_expiry:
description:
- Duration of quarantine. (Format
type: str
quarantine_log:
choices:
- disable
- enable
description:
- Enable/disable quarantine logging.
type: str
rate_count:
description:
- Count of the rate.
type: int
rate_duration:
description:
- Duration (sec) of the rate.
type: int
rate_mode:
choices:
- periodical
- continuous
description:
- Rate limit mode.
type: str
rate_track:
choices:
- none
- src-ip
- dest-ip
- dhcp-client-mac
- dns-domain
description:
- Track the packet protocol field.
type: str
risk:
description:
- Risk, or impact, of allowing traffic from this application to occur (1 -
5; Low, Elevated, Medium, High, and Critical).
elements: dict
suboptions:
level:
description:
- Risk, or impact, of allowing traffic from this application to occur
(1 - 5; Low, Elevated, Medium, High, and Critical).
type: int
type: list
session_ttl:
description:
- Session TTL (0 = default).
type: int
shaper:
description:
- Traffic shaper. Source firewall.shaper.traffic-shaper.name.
type: str
shaper_reverse:
description:
- Reverse traffic shaper. Source firewall.shaper.traffic-shaper.name.
type: str
sub_category:
description:
- Application Sub-category ID list.
elements: dict
suboptions:
id:
description:
- Application sub-category ID.
type: int
type: list
technology:
description:
- Application technology filter.
elements: str
type: list
vendor:
description:
- Application vendor filter.
elements: str
type: list
type: list
extended_log:
choices:
- enable
- disable
description:
- Enable/disable extended logging.
type: str
force_inclusion_ssl_di_sigs:
choices:
- disable
- enable
description:
- Enable/disable forced inclusion of SSL deep inspection signatures.
type: str
name:
description:
- List name.
required: true
type: str
options:
choices:
- allow-dns
- allow-icmp
- allow-http
- allow-ssl
- allow-quic
description:
- Basic application protocol signatures allowed by default.
elements: str
type: list
other_application_action:
choices:
- pass
- block
description:
- Action for other applications.
type: str
other_application_log:
choices:
- disable
- enable
description:
- Enable/disable logging for other applications.
type: str
p2p_black_list:
choices:
- skype
- edonkey
- bittorrent
description:
- P2P applications to be black listed.
elements: str
type: list
p2p_block_list:
choices:
- skype
- edonkey
- bittorrent
description:
- P2P applications to be block listed.
elements: str
type: list
replacemsg_group:
description:
- Replacement message group. Source system.replacemsg-group.name.
type: str
unknown_application_action:
choices:
- pass
- block
description:
- Pass or block traffic from unknown applications.
type: str
unknown_application_log:
choices:
- disable
- enable
description:
- Enable/disable logging for unknown applications.
type: str
type: dict
build: description: Build number of the fortigate image returned: always sample: '1547' type: str http_method: description: Last method used to provision the content into FortiGate returned: always sample: PUT type: str http_status: description: Last result given by FortiGate on last operation applied returned: always sample: '200' type: str mkey: description: Master key (id) used in the last call to FortiGate returned: success sample: id type: str name: description: Name of the table used to fulfill the request returned: always sample: urlfilter type: str path: description: Path of the table used to fulfill the request returned: always sample: webfilter type: str revision: description: Internal revision number returned: always sample: 17.0.2.10658 type: str serial: description: Serial number of the unit returned: always sample: FGVMEVYYQT3AB5352 type: str status: description: Indication of the operation's result returned: always sample: success type: str vdom: description: Virtual domain used returned: always sample: root type: str version: description: Version of the FortiGate returned: always sample: v5.6.3 type: str