:source: fmgr_vpn_ssl_settings.py
:orphan:
.. _fmgr_vpn_ssl_settings:
fmgr_vpn_ssl_settings -- Configure SSL VPN.
+++++++++++++++++++++++++++++++++++++++++++
.. versionadded:: 2.1.0
.. warning::
Starting in version 3.0.0, all input arguments will be named using the underscore naming convention (snake_case).
- Argument name before 3.0.0: ``var-name``, ``var name``, ``var.name``
- New argument name starting in 3.0.0: ``var_name``
FortiManager Ansible v2.4+ supports both previous argument name and new underscore name.
You will receive deprecation warnings if you keep using the previous argument name.
You can ignore the warning by setting deprecation_warnings=False in ansible.cfg.
.. contents::
:local:
:depth: 1
Synopsis
--------
- This module is able to configure a FortiManager device.
- Examples include all parameters and values need to be adjusted to data sources before usage.
- Tested with FortiManager v7.x.
Requirements
------------
The below requirements are needed on the host that executes this module.
- ansible-core>=2.16.0
FortiManager Version Compatibility
----------------------------------
.. raw:: html
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
Parameters
----------
.. raw:: html
- access_token -The token to access FortiManager without using username and password. type: str required: false
- bypass_validation - Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters. type: bool required: false default: False
- enable_log - Enable/Disable logging for task. type: bool required: false default: False
- forticloud_access_token - Access token of forticloud managed API users, this option is available with FortiManager later than 6.4.0. type: str required: false
- proposed_method - The overridden method for the underlying Json RPC request. type: str required: false choices: set, update, add
- rc_succeeded - The rc codes list with which the conditions to succeed will be overriden. type: list required: false
- rc_failed - The rc codes list with which the conditions to fail will be overriden. type: list required: false
- workspace_locking_adom - Acquire the workspace lock if FortiManager is running in workspace mode. type: str required: false choices: global, custom adom including root
- workspace_locking_timeout - The maximum time in seconds to wait for other users to release workspace lock. type: integer required: false default: 300
- device - The parameter in requested url type: str required: true
- vdom - The parameter in requested url type: str required: true
- vpn_ssl_settings - Configure SSL VPN. type: dict
- algorithm Force the ssl vpn security level. type: str choices: [default, high, low, medium]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> v7.2.1, v7.2.6 -> v7.2.12, v7.4.3 -> latest
- auth_session_check_source_ip (Alias name: auth-session-check-source-ip) Enable/disable checking of source ip for authentication session. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- auth_timeout (Alias name: auth-timeout) Ssl vpn authentication timeout (1 - 259200 sec (3 days), 0 for no timeout). type: int
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- authentication_rule (Alias name: authentication-rule) Authentication rule. type: list
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- auth Ssl vpn authentication method restriction. type: str choices: [any, local, radius, ldap, tacacs+, peer]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- cipher Ssl vpn cipher strength. type: str choices: [any, high, medium]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- client_cert (Alias name: client-cert) Enable/disable ssl vpn client certificate restrictive. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- groups User groups. type: list or str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- id Id (0 - 4294967295). type: int
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- portal Ssl vpn portal. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- realm Ssl vpn realm. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- source_address (Alias name: source-address) Source address of incoming traffic. type: list or str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- source_address_negate (Alias name: source-address-negate) Enable/disable negated source address match. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- source_address6 (Alias name: source-address6) Ipv6 source address of incoming traffic. type: list or str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- source_address6_negate (Alias name: source-address6-negate) Enable/disable negated source ipv6 address match. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- source_interface (Alias name: source-interface) Ssl vpn source interface of incoming traffic. type: list or str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- user_peer (Alias name: user-peer) Name of user peer. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- users User name. type: list or str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- auto_tunnel_static_route (Alias name: auto-tunnel-static-route) Enable/disable to auto-create static routes for the ssl vpn tunnel ip addresses. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- banned_cipher (Alias name: banned-cipher) Select one or more cipher technologies that cannot be used in ssl vpn negotiations. type: list choices: [RSA, DH, DHE, ECDH, ECDHE, DSS, ECDSA, AES, AESGCM, CAMELLIA, 3DES, SHA1, SHA256, SHA384, STATIC, CHACHA20, ARIA, AESCCM]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- check_referer (Alias name: check-referer) Enable/disable verification of referer field in http request header. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- default_portal (Alias name: default-portal) Default ssl vpn portal. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- deflate_compression_level (Alias name: deflate-compression-level) Compression level (0~9). type: int
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- deflate_min_data_size (Alias name: deflate-min-data-size) Minimum amount of data that triggers compression (200 - 65535 bytes). type: int
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- dns_server1 (Alias name: dns-server1) Dns server 1. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- dns_server2 (Alias name: dns-server2) Dns server 2. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- dns_suffix (Alias name: dns-suffix) Dns suffix used for ssl vpn clients. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- dtls_hello_timeout (Alias name: dtls-hello-timeout) Sslvpn maximum dtls hello timeout (10 - 60 sec, default = 10). type: int
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- dtls_max_proto_ver (Alias name: dtls-max-proto-ver) Dtls maximum protocol version. type: str choices: [dtls1-0, dtls1-2]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- dtls_min_proto_ver (Alias name: dtls-min-proto-ver) Dtls minimum protocol version. type: str choices: [dtls1-0, dtls1-2]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- dtls_tunnel (Alias name: dtls-tunnel) Enable/disable dtls to prevent eavesdropping, tampering, or message forgery. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- encode_2f_sequence (Alias name: encode-2f-sequence) Encode \2f sequence to forward slash in urls. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- encrypt_and_store_password (Alias name: encrypt-and-store-password) Encrypt and store user passwords for ssl vpn web sessions. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.4.2 -> latest
- force_two_factor_auth (Alias name: force-two-factor-auth) Enable/disable only pki users with two-factor authentication for ssl vpns. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- header_x_forwarded_for (Alias name: header-x-forwarded-for) Forward the same, add, or remove http header. type: str choices: [pass, add, remove]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- hsts_include_subdomains (Alias name: hsts-include-subdomains) Add hsts includesubdomains response header. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- http_compression (Alias name: http-compression) Enable/disable to allow http compression over ssl vpn tunnels. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- http_only_cookie (Alias name: http-only-cookie) Enable/disable ssl vpn support for httponly cookies. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- http_request_body_timeout (Alias name: http-request-body-timeout) Ssl vpn session is disconnected if an http request body is not received within this time (1 - 60 sec, default = 20). type: int
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- http_request_header_timeout (Alias name: http-request-header-timeout) Ssl vpn session is disconnected if an http request header is not received within this time (1 - 60 sec, default = 20). type: int
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- https_redirect (Alias name: https-redirect) Enable/disable redirect of port 80 to ssl vpn port. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- idle_timeout (Alias name: idle-timeout) Ssl vpn disconnects if idle for specified time in seconds. type: int
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- ipv6_dns_server1 (Alias name: ipv6-dns-server1) Ipv6 dns server 1. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- ipv6_dns_server2 (Alias name: ipv6-dns-server2) Ipv6 dns server 2. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- ipv6_wins_server1 (Alias name: ipv6-wins-server1) Ipv6 wins server 1. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- ipv6_wins_server2 (Alias name: ipv6-wins-server2) Ipv6 wins server 2. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- login_attempt_limit (Alias name: login-attempt-limit) Ssl vpn maximum login attempt times before block (0 - 10, default = 2, 0 = no limit). type: int
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- login_block_time (Alias name: login-block-time) Time for which a user is blocked from logging in after too many failed login attempts (0 - 86400 sec, default = 60). type: int
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- login_timeout (Alias name: login-timeout) Sslvpn maximum login timeout (10 - 180 sec, default = 30). type: int
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- port Ssl vpn access port (1 - 65535). type: int
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- port_precedence (Alias name: port-precedence) Enable/disable, enable means that if ssl vpn connections are allowed on an interface admin gui connections are blocked on that interface. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- reqclientcert Enable/disable to require client certificates for all ssl vpn users. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- route_source_interface (Alias name: route-source-interface) Enable/disable to allow ssl vpn sessions to bypass routing and bind to the incoming interface. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> v7.2.0, v7.4.8 -> v7.4.10
- servercert Name of the server certificate to be used for ssl vpns. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- source_address (Alias name: source-address) Source address of incoming traffic. type: list or str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- source_address_negate (Alias name: source-address-negate) Enable/disable negated source address match. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- source_address6 (Alias name: source-address6) Ipv6 source address of incoming traffic. type: list or str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- source_address6_negate (Alias name: source-address6-negate) Enable/disable negated source ipv6 address match. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- source_interface (Alias name: source-interface) Ssl vpn source interface of incoming traffic. type: list or str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- ssl_client_renegotiation (Alias name: ssl-client-renegotiation) Enable/disable to allow client renegotiation by the server if the tunnel goes down. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- ssl_insert_empty_fragment (Alias name: ssl-insert-empty-fragment) Enable/disable insertion of empty fragment. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- ssl_max_proto_ver (Alias name: ssl-max-proto-ver) Ssl maximum protocol version. type: str choices: [tls1-0, tls1-1, tls1-2, tls1-3]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- ssl_min_proto_ver (Alias name: ssl-min-proto-ver) Ssl minimum protocol version. type: str choices: [tls1-0, tls1-1, tls1-2, tls1-3]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- tlsv1_0 (Alias name: tlsv1-0) Enable/disable tlsv1. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> v7.2.1, v7.4.8 -> v7.4.10
- tlsv1_1 (Alias name: tlsv1-1) Enable/disable tlsv1. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> v7.2.1, v7.4.8 -> v7.4.10
- tlsv1_2 (Alias name: tlsv1-2) Enable/disable tlsv1. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> v7.2.1, v7.4.8 -> v7.4.10
- tlsv1_3 (Alias name: tlsv1-3) Tlsv1 3. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> v7.2.0
- transform_backward_slashes (Alias name: transform-backward-slashes) Transform backward slashes to forward slashes in urls. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.4.2 -> latest
- tunnel_connect_without_reauth (Alias name: tunnel-connect-without-reauth) Enable/disable tunnel connection without re-authorization if previous connection dropped. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- tunnel_ip_pools (Alias name: tunnel-ip-pools) Names of the ipv4 ip pool firewall objects that define the ip addresses reserved for remote clients. type: list or str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- tunnel_ipv6_pools (Alias name: tunnel-ipv6-pools) Names of the ipv6 ip pool firewall objects that define the ip addresses reserved for remote clients. type: list or str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- tunnel_user_session_timeout (Alias name: tunnel-user-session-timeout) Time out value to clean up user session after tunnel connection is dropped (1 - 255 sec, default=30). type: int
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- unsafe_legacy_renegotiation (Alias name: unsafe-legacy-renegotiation) Enable/disable unsafe legacy re-negotiation. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- url_obscuration (Alias name: url-obscuration) Enable/disable to obscure the host name of the url of the web browser display. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- user_peer (Alias name: user-peer) Name of user peer. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- wins_server1 (Alias name: wins-server1) Wins server 1. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- wins_server2 (Alias name: wins-server2) Wins server 2. type: str
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- x_content_type_options (Alias name: x-content-type-options) Add http x-content-type-options header. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest
- sslv3 Sslv3. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> v6.4.15
- ssl_big_buffer (Alias name: ssl-big-buffer) Disable using the big sslv3 buffer feature to save memory and force higher security. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> v6.4.15, v7.4.8 -> v7.4.10
- client_sigalgs (Alias name: client-sigalgs) Set signature algorithms related to client authentication. type: str choices: [no-rsa-pss, all]
more...
Supported Version Ranges: v6.4.4 -> latest
- ciphersuite Select one or more tls 1. type: list choices: [TLS-AES-128-GCM-SHA256, TLS-AES-256-GCM-SHA384, TLS-CHACHA20-POLY1305-SHA256, TLS-AES-128-CCM-SHA256, TLS-AES-128-CCM-8-SHA256]
more...
Supported Version Ranges: v6.4.8 -> latest
- dual_stack_mode (Alias name: dual-stack-mode) Tunnel mode: enable parallel ipv4 and ipv6 tunnel. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.0.0 -> latest
- tunnel_addr_assigned_method (Alias name: tunnel-addr-assigned-method) Method used for assigning address for tunnel. type: str choices: [first-available, round-robin]
more...
Supported Version Ranges: v7.0.0 -> latest
- browser_language_detection (Alias name: browser-language-detection) Enable/disable overriding the configured system language based on the preferred language of the browser. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.0 -> latest
- saml_redirect_port (Alias name: saml-redirect-port) Saml local redirect port in the machine running forticlient (0 - 65535). type: int
more...
Supported Version Ranges: v7.0.1 -> latest
- status Enable/disable ssl-vpn. type: str choices: [disable, enable]
more...
Supported Version Ranges: v6.4.8 -> v6.4.15, v7.0.1 -> latest
- web_mode_snat (Alias name: web-mode-snat) Enable/disable use of ip pools defined in firewall policy while using web-mode. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.0.4 -> v7.2.3, v7.2.6 -> v7.4.1, v7.4.3 -> latest
- ztna_trusted_client (Alias name: ztna-trusted-client) Enable/disable verification of device certificate for sslvpn ztna session. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.1 -> latest
- dtls_heartbeat_fail_count (Alias name: dtls-heartbeat-fail-count) Number of missing heartbeats before the connection is considered dropped. type: int
more...
Supported Version Ranges: v7.4.0 -> latest
- dtls_heartbeat_idle_timeout (Alias name: dtls-heartbeat-idle-timeout) Idle timeout before dtls heartbeat is sent. type: int
more...
Supported Version Ranges: v7.4.0 -> latest
- dtls_heartbeat_interval (Alias name: dtls-heartbeat-interval) Interval between dtls heartbeat. type: int
more...
Supported Version Ranges: v7.4.0 -> latest
- server_hostname (Alias name: server-hostname) Server hostname for https. type: str
more...
Supported Version Ranges: v7.2.6 -> latest
- remote_https_cert_check (Alias name: remote-https-cert-check) Configure how the fortigate unit checks and responds to the remote https servers certificate (default = warn-on-error). type: str choices: [no-check, warn-on-error, reject-on-error]
more...
Supported Version Ranges: v7.6.5 -> latest
- tls_groups (Alias name: tls-groups) Configure the supported groups for tls negotiation. type: list choices: [P-521, P-384, P-256, ML-KEM512, ML-KEM768, ML-KEM1024, P-384-MLKEM1024, P-256-MLKEM768, X25519-MLKEM768, X448, X25519, FFDHE2048, FFDHE3072, FFDHE4096, FFDHE6144, FFDHE8192]
more...
Supported Version Ranges: v7.6.5 -> latest
Notes
-----
.. note::
- Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.
- To create or update an object, use state: present directive.
- To delete an object, use state: absent directive
- Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded
Examples
--------
.. code-block:: yaml+jinja
- name: Example playbook (generated based on argument schema)
hosts: fortimanagers
connection: httpapi
gather_facts: false
tasks:
- name: Configure SSL VPN.
fortinet.fortimanager.fmgr_vpn_ssl_settings:
# workspace_locking_adom:
device:
vdom:
vpn_ssl_settings:
# algorithm:
# auth_session_check_source_ip:
# auth_timeout:
# authentication_rule:
# - auth:
# cipher:
# client_cert:
# groups:
# id:
# portal:
# realm:
# source_address:
# source_address_negate:
# source_address6:
# source_address6_negate:
# source_interface:
# user_peer:
# users:
# auto_tunnel_static_route:
# banned_cipher: ["RSA", "DH", "DHE", "ECDH", "ECDHE", "DSS", "ECDSA", "AES", "AESGCM",
# "CAMELLIA", "3DES", "SHA1", "SHA256", "SHA384", "STATIC", "CHACHA20",
# "ARIA", "AESCCM"]
# check_referer:
# default_portal:
# deflate_compression_level:
# deflate_min_data_size:
# dns_server1:
# dns_server2:
# dns_suffix:
# dtls_hello_timeout:
# dtls_max_proto_ver:
# dtls_min_proto_ver:
# dtls_tunnel:
# encode_2f_sequence:
# encrypt_and_store_password:
# force_two_factor_auth:
# header_x_forwarded_for:
# hsts_include_subdomains:
# http_compression:
# http_only_cookie:
# http_request_body_timeout:
# http_request_header_timeout:
# https_redirect:
# idle_timeout:
# ipv6_dns_server1:
# ipv6_dns_server2:
# ipv6_wins_server1:
# ipv6_wins_server2:
# login_attempt_limit:
# login_block_time:
# login_timeout:
# port:
# port_precedence:
# reqclientcert:
# route_source_interface:
# servercert:
# source_address:
# source_address_negate:
# source_address6:
# source_address6_negate:
# source_interface:
# ssl_client_renegotiation:
# ssl_insert_empty_fragment:
# ssl_max_proto_ver:
# ssl_min_proto_ver:
# tlsv1_0:
# tlsv1_1:
# tlsv1_2:
# tlsv1_3:
# transform_backward_slashes:
# tunnel_connect_without_reauth:
# tunnel_ip_pools:
# tunnel_ipv6_pools:
# tunnel_user_session_timeout:
# unsafe_legacy_renegotiation:
# url_obscuration:
# user_peer:
# wins_server1:
# wins_server2:
# x_content_type_options:
# sslv3:
# ssl_big_buffer:
# client_sigalgs:
# ciphersuite: ["TLS-AES-128-GCM-SHA256", "TLS-AES-256-GCM-SHA384",
# "TLS-CHACHA20-POLY1305-SHA256", "TLS-AES-128-CCM-SHA256",
# "TLS-AES-128-CCM-8-SHA256"]
# dual_stack_mode:
# tunnel_addr_assigned_method:
# browser_language_detection:
# saml_redirect_port:
# status:
# web_mode_snat:
# ztna_trusted_client:
# dtls_heartbeat_fail_count:
# dtls_heartbeat_idle_timeout:
# dtls_heartbeat_interval:
# server_hostname:
# remote_https_cert_check:
# tls_groups: ["P-521", "P-384", "P-256", "ML-KEM512", "ML-KEM768", "ML-KEM1024",
# "P-384-MLKEM1024", "P-256-MLKEM768", "X25519-MLKEM768", "X448", "X25519",
# "FFDHE2048", "FFDHE3072", "FFDHE4096", "FFDHE6144", "FFDHE8192"]
Return Values
-------------
Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:
.. raw:: html
- meta - The result of the request.returned: always type: dict
- request_url - The full url requested. returned: always type: str sample: /sys/login/user
- response_code - The status of api request. returned: always type: int sample: 0
- response_data - The data body of the api response. returned: optional type: list or dict
- response_message - The descriptive message of the api response. returned: always type: str sample: OK
- system_information - The information of the target system. returned: always type: dict
- rc - The status the request. returned: always type: int sample: 0
- version_check_warning - Warning if the parameters used in the playbook are not supported by the current FortiManager version. returned: if at least one parameter not supported by the current FortiManager version type: list
Status
------
- This module is not guaranteed to have a backwards compatible interface.
Authors
-------
- Xinwei Du (@dux-fortinet)
- Xing Li (@lix-fortinet)
- Jie Xue (@JieX19)
- Link Zheng (@chillancezen)
- Frank Shen (@fshen01)
- Hongbin Lu (@fgtdev-hblu)