W3cubDocs

/Ansible

fortinet.fortios.fortios_system_np6 – Configure NP6 attributes in Fortinet’s FortiOS and FortiGate.

Note

This plugin is part of the fortinet.fortios collection (version 2.1.2).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install fortinet.fortios.

To use it in a playbook, specify: fortinet.fortios.fortios_system_np6.

New in version 2.10: of fortinet.fortios

Synopsis
Requirements
Parameters
Notes
Examples
Return Values

Synopsis

This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify system feature and np6 category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0

Requirements

The below requirements are needed on the host that executes this module.

ansible>=2.9.0

Parameters

Parameter			Choices/Defaults	Comments
access_token string				Token-based authentication. Generated from GUI of Fortigate.
enable_log boolean			Choices: no ← yes	Enable/Disable logging for task.
state string / required			Choices: present absent	Indicates whether to create or remove the object.
system_np6 dictionary				Configure NP6 attributes.
	fastpath string		Choices: disable enable	Enable/disable NP4 or NP6 offloading (also called fast path).
	fp_anomaly dictionary			NP6 IPv4 anomaly protection. trap-to-host forwards anomaly sessions to the CPU.
		icmp_csum_err string	Choices: drop trap-to-host	Invalid IPv4 ICMP checksum anomalies.
		icmp_frag string	Choices: allow drop trap-to-host	Layer 3 fragmented packets that could be part of layer 4 ICMP anomalies.
		icmp_land string	Choices: allow drop trap-to-host	ICMP land anomalies.
		ipv4_csum_err string	Choices: drop trap-to-host	Invalid IPv4 IP checksum anomalies.
		ipv4_land string	Choices: allow drop trap-to-host	Land anomalies.
		ipv4_optlsrr string	Choices: allow drop trap-to-host	Loose source record route option anomalies.
		ipv4_optrr string	Choices: allow drop trap-to-host	Record route option anomalies.
		ipv4_optsecurity string	Choices: allow drop trap-to-host	Security option anomalies.
		ipv4_optssrr string	Choices: allow drop trap-to-host	Strict source record route option anomalies.
		ipv4_optstream string	Choices: allow drop trap-to-host	Stream option anomalies.
		ipv4_opttimestamp string	Choices: allow drop trap-to-host	Timestamp option anomalies.
		ipv4_proto_err string	Choices: allow drop trap-to-host	Invalid layer 4 protocol anomalies.
		ipv4_unknopt string	Choices: allow drop trap-to-host	Unknown option anomalies.
		ipv6_daddr_err string	Choices: allow drop trap-to-host	Destination address as unspecified or loopback address anomalies.
		ipv6_land string	Choices: allow drop trap-to-host	Land anomalies.
		ipv6_optendpid string	Choices: allow drop trap-to-host	End point identification anomalies.
		ipv6_opthomeaddr string	Choices: allow drop trap-to-host	Home address option anomalies.
		ipv6_optinvld string	Choices: allow drop trap-to-host	Invalid option anomalies.Invalid option anomalies.
		ipv6_optjumbo string	Choices: allow drop trap-to-host	Jumbo options anomalies.
		ipv6_optnsap string	Choices: allow drop trap-to-host	Network service access point address option anomalies.
		ipv6_optralert string	Choices: allow drop trap-to-host	Router alert option anomalies.
		ipv6_opttunnel string	Choices: allow drop trap-to-host	Tunnel encapsulation limit option anomalies.
		ipv6_proto_err string	Choices: allow drop trap-to-host	Layer 4 invalid protocol anomalies.
		ipv6_saddr_err string	Choices: allow drop trap-to-host	Source address as multicast anomalies.
		ipv6_unknopt string	Choices: allow drop trap-to-host	Unknown option anomalies.
		tcp_csum_err string	Choices: drop trap-to-host	Invalid IPv4 TCP checksum anomalies.
		tcp_fin_noack string	Choices: allow drop trap-to-host	TCP SYN flood with FIN flag set without ACK setting anomalies.
		tcp_fin_only string	Choices: allow drop trap-to-host	TCP SYN flood with only FIN flag set anomalies.
		tcp_land string	Choices: allow drop trap-to-host	TCP land anomalies.
		tcp_no_flag string	Choices: allow drop trap-to-host	TCP SYN flood with no flag set anomalies.
		tcp_syn_data string	Choices: allow drop trap-to-host	TCP SYN flood packets with data anomalies.
		tcp_syn_fin string	Choices: allow drop trap-to-host	TCP SYN flood SYN/FIN flag set anomalies.
		tcp_winnuke string	Choices: allow drop trap-to-host	TCP WinNuke anomalies.
		udp_csum_err string	Choices: drop trap-to-host	Invalid IPv4 UDP checksum anomalies.
		udp_land string	Choices: allow drop trap-to-host	UDP land anomalies.
	garbage_session_collector string		Choices: disable enable	Enable/disable garbage session collector.
	hpe string			HPE configuration.
		arp_max integer		Maximum ARP packet rate (10K - 4G pps).
		enable_shaper string	Choices: disable enable	Enable/Disable NPU host protection engine (HPE) shaper.
		esp_max integer		Maximum ESP packet rate (10K - 4G pps).
		icmp_max integer		Maximum ICMP packet rate (10K - 4G pps).
		ip_frag_max integer		Maximum fragmented IP packet rate (10K - 4G pps).
		ip_others_max integer		Maximum IP packet rate for other packets (packet types that cannot be set with other options) (10G - 4G pps).
		l2_others_max integer		Maximum L2 packet rate for L2 packets that are not ARP packets (10K - 4G pps).
		pri_type_max integer		Maximum overflow rate of priority type traffic(10K - 4G pps). Includes L2: HA, 802.3ad LACP, heartbeats. L3: OSPF. L4_TCP: BGP. L4_UDP: IKE, SLBC, BFD.
		sctp_max integer		Maximum SCTP packet rate (10K - 4G pps).
		tcp_max integer		Maximum TCP packet rate (10K - 4G pps).
		tcpfin_rst_max integer		Maximum TCP carries FIN or RST flags packet rate (1K - 1G pps).
		tcpsyn_ack_max integer		Maximum TCP carries SYN and ACK flags packet rate (1K - 1G pps).
		tcpsyn_max integer		Maximum TCP SYN packet rate (10K - 4G pps).
		udp_max integer		Maximum UDP packet rate (10K - 4G pps).
	ipsec_ob_hash_function string		Choices: global-hash round-robin-global	Set hash function for IPSec outbound.
	ipsec_outbound_hash string		Choices: disable enable	Enable/disable hash function for IPsec outbound traffic.
	low_latency_mode string		Choices: disable enable	Enable/disable low latency mode.
	name string / required			Device Name.
	per_session_accounting string		Choices: disable traffic-log-only enable	Enable/disable per-session accounting.
	session_collector_interval integer			Set garbage session collection cleanup interval (1 - 100 sec).
	session_timeout_fixed string		Choices: disable enable	{disable \| enable} Toggle between using fixed or random timeouts for refreshing NP6 sessions.
	session_timeout_interval integer			Set the fixed timeout for refreshing NP6 sessions (0 - 1000 sec).
	session_timeout_random_range integer			Set the random timeout range for refreshing NP6 sessions (0 - 1000 sec).
vdom string			Default: "root"	Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit.

Notes

Note

Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks

Examples

- hosts: fortigates
  collections:
    - fortinet.fortios
  connection: httpapi
  vars:
   vdom: "root"
   ansible_httpapi_use_ssl: yes
   ansible_httpapi_validate_certs: no
   ansible_httpapi_port: 443
  tasks:
  - name: Configure NP6 attributes.
    fortios_system_np6:
      vdom:  "{{ vdom }}"
      state: "present"
      access_token: "<your_own_value>"
      system_np6:
        fastpath: "disable"
        fp_anomaly:
            icmp_csum_err: "drop"
            icmp_frag: "allow"
            icmp_land: "allow"
            ipv4_csum_err: "drop"
            ipv4_land: "allow"
            ipv4_optlsrr: "allow"
            ipv4_optrr: "allow"
            ipv4_optsecurity: "allow"
            ipv4_optssrr: "allow"
            ipv4_optstream: "allow"
            ipv4_opttimestamp: "allow"
            ipv4_proto_err: "allow"
            ipv4_unknopt: "allow"
            ipv6_daddr_err: "allow"
            ipv6_land: "allow"
            ipv6_optendpid: "allow"
            ipv6_opthomeaddr: "allow"
            ipv6_optinvld: "allow"
            ipv6_optjumbo: "allow"
            ipv6_optnsap: "allow"
            ipv6_optralert: "allow"
            ipv6_opttunnel: "allow"
            ipv6_proto_err: "allow"
            ipv6_saddr_err: "allow"
            ipv6_unknopt: "allow"
            tcp_csum_err: "drop"
            tcp_fin_noack: "allow"
            tcp_fin_only: "allow"
            tcp_land: "allow"
            tcp_no_flag: "allow"
            tcp_syn_data: "allow"
            tcp_syn_fin: "allow"
            tcp_winnuke: "allow"
            udp_csum_err: "drop"
            udp_land: "allow"
        garbage_session_collector: "disable"
        hpe:
            arp_max: "42"
            enable_shaper: "disable"
            esp_max: "44"
            icmp_max: "45"
            ip_frag_max: "46"
            ip_others_max: "47"
            l2_others_max: "48"
            pri_type_max: "49"
            sctp_max: "50"
            tcp_max: "51"
            tcpfin_rst_max: "52"
            tcpsyn_ack_max: "53"
            tcpsyn_max: "54"
            udp_max: "55"
        ipsec_ob_hash_function: "global-hash"
        ipsec_outbound_hash: "disable"
        low_latency_mode: "disable"
        name: "default_name_59"
        per_session_accounting: "disable"
        session_collector_interval: "61"
        session_timeout_fixed: "disable"
        session_timeout_interval: "63"
        session_timeout_random_range: "64"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Returned	Description
build string	always	Build number of the fortigate image Sample: 1547
http_method string	always	Last method used to provision the content into FortiGate Sample: PUT
http_status string	always	Last result given by FortiGate on last operation applied Sample: 200
mkey string	success	Master key (id) used in the last call to FortiGate Sample: id
name string	always	Name of the table used to fulfill the request Sample: urlfilter
path string	always	Path of the table used to fulfill the request Sample: webfilter
revision string	always	Internal revision number Sample: 17.0.2.10658
serial string	always	Serial number of the unit Sample: FGVMEVYYQT3AB5352
status string	always	Indication of the operation's result Sample: success
vdom string	always	Virtual domain used Sample: root
version string	always	Version of the FortiGate Sample: v5.6.3

Authors

Link Zheng (@chillancezen)
Jie Xue (@JieX19)
Hongbin Lu (@fgtdev-hblu)
Frank Shen (@frankshen01)
Miguel Angel Munoz (@mamunozgonzalez)
Nicolas Thomas (@thomnico)

© 2012–2018 Michael DeHaan
© 2018–2021 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/latest/collections/fortinet/fortios/fortios_system_np6_module.html