Note
This plugin is part of the fortinet.fortimanager collection (version 2.1.3).
You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install fortinet.fortimanager.
To use it in a playbook, specify: fortinet.fortimanager.fmgr_pkg_firewall_securitypolicy.
New in version 2.10: of fortinet.fortimanager
| Parameter | Choices/Defaults | Comments | |
|---|---|---|---|
| adom string / required | the parameter (adom) in requested url | ||
| bypass_validation boolean |
| only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters | |
| enable_log boolean |
| Enable/Disable logging for task | |
| pkg string / required | the parameter (pkg) in requested url | ||
| pkg_firewall_securitypolicy dictionary | the top level parameters set | ||
| action string |
| Policy action (accept/deny). | |
| app-category string | Application category ID list. | ||
| app-group string | Application group names. | ||
| application integer | no description | ||
| application-list string | Name of an existing Application list. | ||
| av-profile string | Name of an existing Antivirus profile. | ||
| cifs-profile string | Name of an existing CIFS profile. | ||
| comments string | Comment. | ||
| dlp-sensor string | Name of an existing DLP sensor. | ||
| dnsfilter-profile string | Name of an existing DNS filter profile. | ||
| dstaddr string | Destination IPv4 address name and address group names. | ||
| dstaddr-negate string |
| When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. | |
| dstaddr4 string | Destination IPv4 address name and address group names. | ||
| dstaddr6 string | Destination IPv6 address name and address group names. | ||
| dstintf string | Outgoing (egress) interface. | ||
| emailfilter-profile string | Name of an existing email filter profile. | ||
| enforce-default-app-port string |
| Enable/disable default application port enforcement for allowed applications. | |
| file-filter-profile string | Name of an existing file-filter profile. | ||
| fsso-groups string | Names of FSSO groups. | ||
| global-label string | Label for the policy that appears when the GUI is in Global View mode. | ||
| groups string | Names of user groups that can authenticate with this policy. | ||
| icap-profile string | Name of an existing ICAP profile. | ||
| internet-service string |
| Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. | |
| internet-service-custom string | Custom Internet Service name. | ||
| internet-service-custom-group string | Custom Internet Service group name. | ||
| internet-service-group string | Internet Service group name. | ||
| internet-service-id string | Internet Service ID. | ||
| internet-service-name string | Internet Service name. | ||
| internet-service-negate string |
| When enabled internet-service specifies what the service must NOT be. | |
| internet-service-src string |
| Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. | |
| internet-service-src-custom string | Custom Internet Service source name. | ||
| internet-service-src-custom-group string | Custom Internet Service source group name. | ||
| internet-service-src-group string | Internet Service source group name. | ||
| internet-service-src-id string | Internet Service source ID. | ||
| internet-service-src-name string | Internet Service source name. | ||
| internet-service-src-negate string |
| When enabled internet-service-src specifies what the service must NOT be. | |
| ips-sensor string | Name of an existing IPS sensor. | ||
| learning-mode string |
| Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be g... | |
| logtraffic string |
| Enable or disable logging. Log all sessions or security profile sessions. | |
| logtraffic-start string |
| Record logs when a session starts. | |
| mms-profile string | Name of an existing MMS profile. | ||
| name string | Policy name. | ||
| policyid integer | Policy ID. | ||
| profile-group string | Name of profile group. | ||
| profile-protocol-options string | Name of an existing Protocol options profile. | ||
| profile-type string |
| Determine whether the firewall policy allows security profile groups or single profiles only. | |
| schedule string | Schedule name. | ||
| send-deny-packet string |
| Enable to send a reply when a session is denied or blocked by a firewall policy. | |
| service string | Service and service group names. | ||
| service-negate string |
| When enabled service specifies what the service must NOT be. | |
| srcaddr string | Source IPv4 address name and address group names. | ||
| srcaddr-negate string |
| When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. | |
| srcaddr4 string | Source IPv4 address name and address group names. | ||
| srcaddr6 string | Source IPv6 address name and address group names. | ||
| srcintf string | Incoming (ingress) interface. | ||
| ssh-filter-profile string | Name of an existing SSH filter profile. | ||
| ssl-ssh-profile string | Name of an existing SSL SSH profile. | ||
| status string |
| Enable or disable this policy. | |
| url-category string | URL category ID list. | ||
| users string | Names of individual users that can authenticate with this policy. | ||
| utm-status string |
| Enable security profiles. | |
| uuid string | Universally Unique Identifier (UUID; automatically assigned but can be manually reset). | ||
| videofilter-profile string | Name of an existing VideoFilter profile. | ||
| voip-profile string | Name of an existing VoIP profile. | ||
| webfilter-profile string | Name of an existing Web filter profile. | ||
| proposed_method string |
| The overridden method for the underlying Json RPC request | |
| rc_failed list / elements=string | the rc codes list with which the conditions to fail will be overriden | ||
| rc_succeeded list / elements=string | the rc codes list with which the conditions to succeed will be overriden | ||
| state string / required |
| the directive to create, update or delete an object | |
| workspace_locking_adom string | the adom to lock for FortiManager running in workspace mode, the value can be global and others including root | ||
| workspace_locking_timeout integer | Default: 300 | the maximum time in seconds to wait for other user to release the workspace lock | |
Note
- hosts: fortimanager-inventory
collections:
- fortinet.fortimanager
connection: httpapi
vars:
ansible_httpapi_use_ssl: True
ansible_httpapi_validate_certs: False
ansible_httpapi_port: 443
tasks:
- name: Configure NGFW IPv4/IPv6 application policies.
fmgr_pkg_firewall_securitypolicy:
bypass_validation: False
workspace_locking_adom: <value in [global, custom adom including root]>
workspace_locking_timeout: 300
rc_succeeded: [0, -2, -3, ...]
rc_failed: [-2, -3, ...]
adom: <your own value>
pkg: <your own value>
state: <value in [present, absent]>
pkg_firewall_securitypolicy:
action: <value in [deny, accept]>
app-category: <value of string>
app-group: <value of string>
application: <value of integer>
application-list: <value of string>
av-profile: <value of string>
cifs-profile: <value of string>
comments: <value of string>
dlp-sensor: <value of string>
dnsfilter-profile: <value of string>
dstaddr4: <value of string>
dstaddr6: <value of string>
dstintf: <value of string>
emailfilter-profile: <value of string>
enforce-default-app-port: <value in [disable, enable]>
groups: <value of string>
icap-profile: <value of string>
internet-service: <value in [disable, enable]>
internet-service-custom: <value of string>
internet-service-custom-group: <value of string>
internet-service-group: <value of string>
internet-service-id: <value of string>
internet-service-negate: <value in [disable, enable]>
internet-service-src: <value in [disable, enable]>
internet-service-src-custom: <value of string>
internet-service-src-custom-group: <value of string>
internet-service-src-group: <value of string>
internet-service-src-id: <value of string>
internet-service-src-negate: <value in [disable, enable]>
ips-sensor: <value of string>
logtraffic: <value in [disable, all, utm]>
logtraffic-start: <value in [disable, enable]>
mms-profile: <value of string>
name: <value of string>
policyid: <value of integer>
profile-group: <value of string>
profile-protocol-options: <value of string>
profile-type: <value in [single, group]>
schedule: <value of string>
service: <value of string>
service-negate: <value in [disable, enable]>
srcaddr4: <value of string>
srcaddr6: <value of string>
srcintf: <value of string>
ssh-filter-profile: <value of string>
ssl-ssh-profile: <value of string>
status: <value in [disable, enable]>
url-category: <value of string>
users: <value of string>
utm-status: <value in [disable, enable]>
uuid: <value of string>
voip-profile: <value of string>
webfilter-profile: <value of string>
fsso-groups: <value of string>
global-label: <value of string>
send-deny-packet: <value in [disable, enable]>
dstaddr: <value of string>
internet-service-name: <value of string>
internet-service-src-name: <value of string>
srcaddr: <value of string>
dstaddr-negate: <value in [disable, enable]>
file-filter-profile: <value of string>
srcaddr-negate: <value in [disable, enable]>
learning-mode: <value in [disable, enable]>
videofilter-profile: <value of string>
Common return values are documented here, the following are the fields unique to this module:
| Key | Returned | Description |
|---|---|---|
| request_url string | always | The full url requested Sample: /sys/login/user |
| response_code integer | always | The status of api request |
| response_message string | always | The descriptive message of the api response Sample: OK. |
© 2012–2018 Michael DeHaan
© 2018–2021 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/latest/collections/fortinet/fortimanager/fmgr_pkg_firewall_securitypolicy_module.html