:source: fmgd_system_settings.py
:orphan:
.. _fmgd_system_settings:
fmgd_system_settings -- Configure VDOM settings.
++++++++++++++++++++++++++++++++++++++++++++++++
.. versionadded:: 1.0.0
.. contents::
:local:
:depth: 1
Synopsis
--------
- This module is able to configure a FortiManager device.
- Examples include all parameters and values need to be adjusted to data sources before usage.
- Tested with FortiManager v7.x.
Requirements
------------
The below requirements are needed on the host that executes this module.
- ansible-core>=2.16.0
FortiManager Version Compatibility
----------------------------------
.. raw:: html
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
Parameters
----------
.. raw:: html
- access_token -The token to access FortiManager without using username and password. type: str required: false
- bypass_validation - Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters. type: bool required: false default: False
- enable_log - Enable/Disable logging for task. type: bool required: false default: False
- forticloud_access_token - Access token of forticloud managed API users, this option is available with FortiManager later than 6.4.0. type: str required: false
- proposed_method - The overridden method for the underlying Json RPC request. type: str required: false choices: set, update, add
- rc_succeeded - The rc codes list with which the conditions to succeed will be overriden. type: list required: false
- rc_failed - The rc codes list with which the conditions to fail will be overriden. type: list required: false
- workspace_locking_adom - Acquire the workspace lock if FortiManager is running in workspace mode. type: str required: false choices: global, custom adom including root
- workspace_locking_timeout - The maximum time in seconds to wait for other users to release workspace lock. type: integer required: false default: 300
- device - The parameter in requested url type: str required: true
- vdom - The parameter in requested url type: str required: true
- system_settings - Configure VDOM settings. type: dict
- allow_linkdown_path (Alias name: allow-linkdown-path) Enable/disable link down path. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- allow_subnet_overlap (Alias name: allow-subnet-overlap) Enable/disable allowing interface subnets to use overlapping ip addresses. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- application_bandwidth_tracking (Alias name: application-bandwidth-tracking) Enable/disable application bandwidth tracking. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- asymroute Enable/disable ipv4 asymmetric routing. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- asymroute_icmp (Alias name: asymroute-icmp) Enable/disable icmp asymmetric routing. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- asymroute6 Enable/disable asymmetric ipv6 routing. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- asymroute6_icmp (Alias name: asymroute6-icmp) Enable/disable asymmetric icmpv6 routing. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- auxiliary_session (Alias name: auxiliary-session) Enable/disable auxiliary session. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- bfd Enable/disable bi-directional forwarding detection (bfd) on all interfaces. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- bfd_desired_min_tx (Alias name: bfd-desired-min-tx) Bfd desired minimal transmit interval (1 - 100000 ms, default = 250). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- bfd_detect_mult (Alias name: bfd-detect-mult) Bfd detection multiplier (1 - 50, default = 3). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- bfd_dont_enforce_src_port (Alias name: bfd-dont-enforce-src-port) Enable to not enforce verifying the source port of bfd packets. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- bfd_required_min_rx (Alias name: bfd-required-min-rx) Bfd required minimal receive interval (1 - 100000 ms, default = 250). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- block_land_attack (Alias name: block-land-attack) Enable/disable blocking of land attacks. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- central_nat (Alias name: central-nat) Enable/disable central nat. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- comments Vdom comments. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- default_app_port_as_service (Alias name: default-app-port-as-service) Enable/disable policy service enforcement based on application default ports. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- default_policy_expiry_days (Alias name: default-policy-expiry-days) Default policy expiry in days (0 - 365 days, default = 30). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- default_voip_alg_mode (Alias name: default-voip-alg-mode) Configure how the fortigate handles voip traffic when a policy that accepts the traffic doesnt include a voip profile. type: str choices: [proxy-based, kernel-helper-based]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- deny_tcp_with_icmp (Alias name: deny-tcp-with-icmp) Enable/disable denying tcp by sending an icmp communication prohibited packet. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- detect_unknown_esp (Alias name: detect-unknown-esp) Enable/disable detection of unknown esp packets (default = enable). type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- device Interface to use for management access for nat mode. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dhcp_proxy (Alias name: dhcp-proxy) Enable/disable the dhcp proxy. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dhcp_proxy_interface (Alias name: dhcp-proxy-interface) Specify outgoing interface to reach server. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dhcp_proxy_interface_select_method (Alias name: dhcp-proxy-interface-select-method) Specify how to select outgoing interface to reach server. type: str choices: [auto, sdwan, specify]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dhcp_server_ip (Alias name: dhcp-server-ip) Dhcp server ipv4 address. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dhcp6_server_ip (Alias name: dhcp6-server-ip) Dhcpv6 server ipv6 address. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- discovered_device_timeout (Alias name: discovered-device-timeout) Timeout for discovered devices (1 - 365 days, default = 28). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dp_load_distribution_method (Alias name: dp-load-distribution-method) Per vdom dp load distribution method. type: str choices: [src-ip, dst-ip, src-dst-ip, src-ip-sport, dst-ip-dport, src-dst-ip-sport-dport, to-master, derived, to-primary]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dyn_addr_session_check (Alias name: dyn-addr-session-check) Enable/disable dirty session check caused by dynamic address updates. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ecmp_max_paths (Alias name: ecmp-max-paths) Maximum number of equal cost multi-path (ecmp) next-hops. type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- email_portal_check_dns (Alias name: email-portal-check-dns) Enable/disable using dns to validate email addresses collected by a captive portal. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ext_resource_session_check (Alias name: ext-resource-session-check) Enable/disable dirty session check caused by external resource updates. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- firewall_session_dirty (Alias name: firewall-session-dirty) Select how to manage sessions affected by firewall policy configuration changes. type: str choices: [check-all, check-new, check-policy-option]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- fqdn_session_check (Alias name: fqdn-session-check) Enable/disable dirty session check caused by fqdn updates. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- fw_session_hairpin (Alias name: fw-session-hairpin) Enable/disable checking for a matching policy each time hairpin traffic goes through the fortigate. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gateway Transparent mode ipv4 default gateway ip address. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gateway6 Transparent mode ipv6 default gateway ip address. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gtp_asym_fgsp (Alias name: gtp-asym-fgsp) Enable/disable gtp asymmetric traffic handling on fgsp. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gtp_monitor_mode (Alias name: gtp-monitor-mode) Enable/disable gtp monitor mode (vdom level). type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_advanced_policy (Alias name: gui-advanced-policy) Enable/disable advanced policy configuration on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_advanced_wireless_features (Alias name: gui-advanced-wireless-features) Enable/disable advanced wireless features in gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_allow_unnamed_policy (Alias name: gui-allow-unnamed-policy) Enable/disable the requirement for policy naming on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_antivirus (Alias name: gui-antivirus) Enable/disable antivirus on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_ap_profile (Alias name: gui-ap-profile) Enable/disable fortiap profiles on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_application_control (Alias name: gui-application-control) Enable/disable application control on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_casb (Alias name: gui-casb) Enable/disable inline-casb on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.4.3 -> latest
- gui_default_policy_columns (Alias name: gui-default-policy-columns) Default columns to display for policy lists on gui. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_dhcp_advanced (Alias name: gui-dhcp-advanced) Enable/disable advanced dhcp options on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_dlp_profile (Alias name: gui-dlp-profile) Enable/disable data loss prevention on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_dns_database (Alias name: gui-dns-database) Enable/disable dns database settings on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_dnsfilter (Alias name: gui-dnsfilter) Enable/disable dns filtering on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_dos_policy (Alias name: gui-dos-policy) Enable/disable dos policies on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_dynamic_device_os_id (Alias name: gui-dynamic-device-os-id) Enable/disable create dynamic addresses to manage known devices. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.4.3 -> latest
- gui_dynamic_routing (Alias name: gui-dynamic-routing) Enable/disable dynamic routing on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_email_collection (Alias name: gui-email-collection) Enable/disable email collection on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_enforce_change_summary (Alias name: gui-enforce-change-summary) Enforce change summaries for select tables in the gui. type: str choices: [disable, require, optional]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_explicit_proxy (Alias name: gui-explicit-proxy) Enable/disable the explicit proxy on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_file_filter (Alias name: gui-file-filter) Enable/disable file-filter on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_fortiap_split_tunneling (Alias name: gui-fortiap-split-tunneling) Enable/disable fortiap split tunneling on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_fortiextender_controller (Alias name: gui-fortiextender-controller) Enable/disable fortiextender on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_icap (Alias name: gui-icap) Enable/disable icap on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_implicit_policy (Alias name: gui-implicit-policy) Enable/disable implicit firewall policies on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_ips (Alias name: gui-ips) Enable/disable ips on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_load_balance (Alias name: gui-load-balance) Enable/disable server load balancing on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_local_in_policy (Alias name: gui-local-in-policy) Enable/disable local-in policies on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_multicast_policy (Alias name: gui-multicast-policy) Enable/disable multicast firewall policies on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_multiple_interface_policy (Alias name: gui-multiple-interface-policy) Enable/disable adding multiple interfaces to a policy on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_object_colors (Alias name: gui-object-colors) Enable/disable object colors on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_ot (Alias name: gui-ot) Enable/disable operational technology features on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_policy_based_ipsec (Alias name: gui-policy-based-ipsec) Enable/disable policy-based ipsec vpn on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_policy_disclaimer (Alias name: gui-policy-disclaimer) Enable/disable policy disclaimer on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_proxy_inspection (Alias name: gui-proxy-inspection) Enable/disable the proxy features on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_route_tag_address_creation (Alias name: gui-route-tag-address-creation) Enable/disable route-tag addresses on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.4.3 -> latest
- gui_security_profile_group (Alias name: gui-security-profile-group) Enable/disable security profile groups on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_spamfilter (Alias name: gui-spamfilter) Enable/disable antispam on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_sslvpn (Alias name: gui-sslvpn) Enable/disable ssl-vpn settings pages on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.4.3 -> latest
- gui_sslvpn_personal_bookmarks (Alias name: gui-sslvpn-personal-bookmarks) Enable/disable ssl-vpn personal bookmark management on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_sslvpn_realms (Alias name: gui-sslvpn-realms) Enable/disable ssl-vpn realms on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_switch_controller (Alias name: gui-switch-controller) Enable/disable the switch controller on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_threat_weight (Alias name: gui-threat-weight) Enable/disable threat weight on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_traffic_shaping (Alias name: gui-traffic-shaping) Enable/disable traffic shaping on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_videofilter (Alias name: gui-videofilter) Enable/disable video filtering on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_virtual_patch_profile (Alias name: gui-virtual-patch-profile) Enable/disable virtual patching on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.4.3 -> latest
- gui_voip_profile (Alias name: gui-voip-profile) Enable/disable voip profiles on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_vpn (Alias name: gui-vpn) Enable/disable ipsec vpn settings pages on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_waf_profile (Alias name: gui-waf-profile) Enable/disable web application firewall on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_wan_load_balancing (Alias name: gui-wan-load-balancing) Enable/disable sd-wan on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_wanopt_cache (Alias name: gui-wanopt-cache) Enable/disable wan optimization and web caching on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_webfilter (Alias name: gui-webfilter) Enable/disable web filtering on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_webfilter_advanced (Alias name: gui-webfilter-advanced) Enable/disable advanced web filtering on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_wireless_controller (Alias name: gui-wireless-controller) Enable/disable the wireless controller on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_ztna (Alias name: gui-ztna) Enable/disable zero trust network access features on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- h323_direct_model (Alias name: h323-direct-model) Enable/disable h323 direct model. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- http_external_dest (Alias name: http-external-dest) Offload http traffic to fortiweb or forticache. type: str choices: [fortiweb, forticache]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- hyperscale_default_policy_action (Alias name: hyperscale-default-policy-action) Hyperscale default policy action. type: str choices: [drop-on-hardware, forward-to-host]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ike_dn_format (Alias name: ike-dn-format) Configure ike asn. type: str choices: [with-space, no-space]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ike_policy_route (Alias name: ike-policy-route) Enable/disable ike policy based routing (pbr). type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ike_port (Alias name: ike-port) Udp port for ike/ipsec traffic (default 500). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ike_quick_crash_detect (Alias name: ike-quick-crash-detect) Enable/disable ike quick crash detection (rfc 6290). type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ike_session_resume (Alias name: ike-session-resume) Enable/disable ikev2 session resumption (rfc 5723). type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ike_tcp_port (Alias name: ike-tcp-port) Tcp port for ike/ipsec traffic (default 4500). type: int
more...
Supported Version Ranges: v7.4.3 -> latest
- internet_service_app_ctrl_size (Alias name: internet-service-app-ctrl-size) Maximum number of tuple entries (protocol, port, ip address, application id) stored by the fortigate unit (0 - 4294967295, default = 32768). type: int
more...
Supported Version Ranges: v7.4.3 -> latest
- internet_service_database_cache (Alias name: internet-service-database-cache) Enable/disable internet service database caching. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ip Ip address and netmask. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ip6 Ipv6 address prefix for nat mode. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- lan_extension_controller_addr (Alias name: lan-extension-controller-addr) Controller ip address or fqdn to connect. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- link_down_access (Alias name: link-down-access) Enable/disable link down access traffic. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- lldp_reception (Alias name: lldp-reception) Enable/disable link layer discovery protocol (lldp) reception for this vdom or apply global settings to this vdom. type: str choices: [disable, enable, global]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- lldp_transmission (Alias name: lldp-transmission) Enable/disable link layer discovery protocol (lldp) transmission for this vdom or apply global settings to this vdom. type: str choices: [enable, disable, global]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- location_id (Alias name: location-id) Local location id in the form of an ipv4 address. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- mac_ttl (Alias name: mac-ttl) Duration of mac addresses in transparent mode (300 - 8640000 sec, default = 300). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- manageip Transparent mode ipv4 management ip address and netmask. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- manageip6 Transparent mode ipv6 management ip address and netmask. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- multicast_forward (Alias name: multicast-forward) Enable/disable multicast forwarding. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- multicast_skip_policy (Alias name: multicast-skip-policy) Enable/disable allowing multicast traffic through the fortigate without a policy check. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- multicast_ttl_notchange (Alias name: multicast-ttl-notchange) Enable/disable preventing the fortigate from changing the ttl for forwarded multicast packets. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- nat46_force_ipv4_packet_forwarding (Alias name: nat46-force-ipv4-packet-forwarding) Enable/disable mandatory ipv4 packet forwarding in nat46. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- nat46_generate_ipv6_fragment_header (Alias name: nat46-generate-ipv6-fragment-header) Enable/disable nat46 ipv6 fragment header generation. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- nat64_force_ipv6_packet_forwarding (Alias name: nat64-force-ipv6-packet-forwarding) Enable/disable mandatory ipv6 packet forwarding in nat64. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ngfw_mode (Alias name: ngfw-mode) Next generation firewall (ngfw) mode. type: str choices: [profile-based, policy-based]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- npu_group_id (Alias name: npu-group-id) Npu-group-index. type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- opmode Firewall operation mode (nat or transparent). type: str choices: [nat, transparent]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- pfcp_monitor_mode (Alias name: pfcp-monitor-mode) Enable/disable pfcp monitor mode (vdom level). type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- policy_offload_level (Alias name: policy-offload-level) Configure firewall policy offload level. type: str choices: [disable, default, dos-offload, full-offload]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- prp_trailer_action (Alias name: prp-trailer-action) Enable/disable action to take on prp trailer. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- sccp_port (Alias name: sccp-port) Tcp port the sccp proxy monitors for sccp traffic (0 - 65535, default = 2000). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- sctp_session_without_init (Alias name: sctp-session-without-init) Enable/disable sctp session creation without sctp init. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ses_denied_traffic (Alias name: ses-denied-traffic) Enable/disable including denied session in the session table. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- session_insert_trial (Alias name: session-insert-trial) Trial session insert. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- sip_expectation (Alias name: sip-expectation) Enable/disable the sip kernel session helper to create an expectation for port 5060. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- sip_nat_trace (Alias name: sip-nat-trace) Enable/disable recording the original sip source ip address when nat is used. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- sip_ssl_port (Alias name: sip-ssl-port) Tcp port the sip proxy monitors for sip ssl/tls traffic (0 - 65535, default = 5061). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- sip_tcp_port (Alias name: sip-tcp-port) Tcp port the sip proxy monitors for sip traffic (0 - 65535, default = 5060). type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- sip_udp_port (Alias name: sip-udp-port) Udp port the sip proxy monitors for sip traffic (0 - 65535, default = 5060). type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- snat_hairpin_traffic (Alias name: snat-hairpin-traffic) Enable/disable source nat (snat) for hairpin traffic. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- status Enable/disable this vdom. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- strict_src_check (Alias name: strict-src-check) Enable/disable strict source verification. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- tcp_session_without_syn (Alias name: tcp-session-without-syn) Enable/disable allowing tcp session without syn flags. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- trap_local_session (Alias name: trap-local-session) Enable/disable local-in traffic session traps. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- trap_session_flag (Alias name: trap-session-flag) Trap session operation flags. type: str choices: [udp-both, udp-reply, tcpudp-both, tcpudp-reply, trap-none]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- utf8_spam_tagging (Alias name: utf8-spam-tagging) Enable/disable converting antispam tags to utf-8 for better non-ascii character support. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- v4_ecmp_mode (Alias name: v4-ecmp-mode) Ipv4 equal-cost multi-path (ecmp) routing and load balancing mode. type: str choices: [source-ip-based, weight-based, usage-based, source-dest-ip-based]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- vdom_type (Alias name: vdom-type) Vdom type (traffic, lan-extension or admin). type: str choices: [traffic, admin, lan-extension]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- vpn_stats_log (Alias name: vpn-stats-log) Enable/disable periodic vpn log statistics for one or more types of vpn. type: list choices: [ipsec, pptp, l2tp, ssl]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- vpn_stats_period (Alias name: vpn-stats-period) Period to send vpn log statistics (0 or 60 - 86400 sec). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- wccp_cache_engine (Alias name: wccp-cache-engine) Enable/disable wccp cache engine. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_endpoint_control_advanced (Alias name: gui-endpoint-control-advanced) Enable/disable advanced endpoint control options on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_endpoint_control (Alias name: gui-endpoint-control) Enable/disable endpoint control on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_local_reports (Alias name: gui-local-reports) Enable/disable local reports on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_nat46_64 (Alias name: gui-nat46-64) Enable/disable nat46 and nat64 settings on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_dynamic_profile_display (Alias name: gui-dynamic-profile-display) Enable/disable radius single sign on (rsso) on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_replacement_message_groups (Alias name: gui-replacement-message-groups) Enable/disable replacement message groups on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_domain_ip_reputation (Alias name: gui-domain-ip-reputation) Enable/disable domain and ip reputation on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- gui_multiple_utm_profiles (Alias name: gui-multiple-utm-profiles) Enable/disable multiple utm profiles on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- implicit_allow_dns (Alias name: implicit-allow-dns) Enable/disable implicitly allowing dns traffic. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> v7.6.2
- gui_per_policy_disclaimer (Alias name: gui-per-policy-disclaimer) Enable/disable policy disclaimer on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> v7.6.2
- consolidated_firewall_mode (Alias name: consolidated-firewall-mode) Consolidated firewall mode. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> v7.6.2
- motherboard_traffic_forwarding (Alias name: motherboard-traffic-forwarding) Motherboard traffic forwarding. type: list choices: [icmp, admin, auth]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> v7.6.2
- gui_gtp (Alias name: gui-gtp) Enable/disable manage general radio packet service (gprs) protocols on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.6.0 -> latest
- nonat_eif_key_sel (Alias name: nonat-eif-key-sel) Nonat eif tuple key selection. type: str choices: [dip-only, dip-dport, dip-dport-proto]
more...
Supported Version Ranges: v7.6.0 -> latest
- ses_denied_multicast_traffic (Alias name: ses-denied-multicast-traffic) Enable/disable including denied multicast session in the session table. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.4.4 -> v7.4.10, v7.6.2 -> latest
- dhcp_proxy_vrf_select (Alias name: dhcp-proxy-vrf-select) Vrf id used for connection to server. type: int
more...
Supported Version Ranges: v7.6.2 -> latest
- dp_load_distribution_group (Alias name: dp-load-distribution-group) Per vdom dp load distribution group. type: list
more...
Supported Version Ranges: v7.6.2 -> latest
- gui_dlp_advanced (Alias name: gui-dlp-advanced) Enable/disable show advanced dlp expressions on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.6.2 -> latest
- gui_sslvpn_clients (Alias name: gui-sslvpn-clients) Enable/disable ssl-vpn clients on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.6.2 -> latest
- intree_ses_best_route (Alias name: intree-ses-best-route) Force the intree session to always use the best route. type: str choices: [force, disable]
more...
Supported Version Ranges: v7.4.8 -> v7.4.10, v7.6.2 -> latest
- gui_fortitelemetry (Alias name: gui-fortitelemetry) Enable/disable fortitelemetry on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.6.3 -> latest
- ike_detailed_event_logs (Alias name: ike-detailed-event-logs) Enable/disable detail log for ike events. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.6.3 -> latest
- forward_domain (Alias name: forward-domain) Forward domain. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.4.8 -> v7.4.10, v7.6.4 -> latest
- wccp_local_route (Alias name: wccp-local-route) Wccp local route. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.4.8 -> v7.4.10, v7.6.4 -> latest
- gui_dlp (Alias name: gui-dlp) Enable/disable dlp on the gui. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.4.8 -> v7.4.10
- lan_extension_controller_port (Alias name: lan-extension-controller-port) Controller port to connect. type: int
more...
Supported Version Ranges: v7.6.5 -> latest
Notes
-----
.. note::
- Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.
- To create or update an object, use state: present directive.
- To delete an object, use state: absent directive
- Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded
Examples
--------
.. code-block:: yaml+jinja
- name: Example playbook (generated based on argument schema)
hosts: fortimanagers
connection: httpapi
gather_facts: false
vars:
ansible_httpapi_use_ssl: true
ansible_httpapi_validate_certs: false
ansible_httpapi_port: 443
tasks:
- name: Configure VDOM settings.
fortinet.fmgdevice.fmgd_system_settings:
# bypass_validation: false
# workspace_locking_adom:
# workspace_locking_timeout: 300
# rc_succeeded: [0, -2, -3, ...]
# rc_failed: [-2, -3, ...]
device:
vdom:
system_settings:
# allow_linkdown_path:
# allow_subnet_overlap:
# application_bandwidth_tracking:
# asymroute:
# asymroute_icmp:
# asymroute6:
# asymroute6_icmp:
# auxiliary_session:
# bfd:
# bfd_desired_min_tx:
# bfd_detect_mult:
# bfd_dont_enforce_src_port:
# bfd_required_min_rx:
# block_land_attack:
# central_nat:
# comments:
# default_app_port_as_service:
# default_policy_expiry_days:
# default_voip_alg_mode:
# deny_tcp_with_icmp:
# detect_unknown_esp:
# device:
# dhcp_proxy:
# dhcp_proxy_interface:
# dhcp_proxy_interface_select_method:
# dhcp_server_ip:
# dhcp6_server_ip:
# discovered_device_timeout:
# dp_load_distribution_method:
# dyn_addr_session_check:
# ecmp_max_paths:
# email_portal_check_dns:
# ext_resource_session_check:
# firewall_session_dirty:
# fqdn_session_check:
# fw_session_hairpin:
# gateway:
# gateway6:
# gtp_asym_fgsp:
# gtp_monitor_mode:
# gui_advanced_policy:
# gui_advanced_wireless_features:
# gui_allow_unnamed_policy:
# gui_antivirus:
# gui_ap_profile:
# gui_application_control:
# gui_casb:
# gui_default_policy_columns:
# gui_dhcp_advanced:
# gui_dlp_profile:
# gui_dns_database:
# gui_dnsfilter:
# gui_dos_policy:
# gui_dynamic_device_os_id:
# gui_dynamic_routing:
# gui_email_collection:
# gui_enforce_change_summary:
# gui_explicit_proxy:
# gui_file_filter:
# gui_fortiap_split_tunneling:
# gui_fortiextender_controller:
# gui_icap:
# gui_implicit_policy:
# gui_ips:
# gui_load_balance:
# gui_local_in_policy:
# gui_multicast_policy:
# gui_multiple_interface_policy:
# gui_object_colors:
# gui_ot:
# gui_policy_based_ipsec:
# gui_policy_disclaimer:
# gui_proxy_inspection:
# gui_route_tag_address_creation:
# gui_security_profile_group:
# gui_spamfilter:
# gui_sslvpn:
# gui_sslvpn_personal_bookmarks:
# gui_sslvpn_realms:
# gui_switch_controller:
# gui_threat_weight:
# gui_traffic_shaping:
# gui_videofilter:
# gui_virtual_patch_profile:
# gui_voip_profile:
# gui_vpn:
# gui_waf_profile:
# gui_wan_load_balancing:
# gui_wanopt_cache:
# gui_webfilter:
# gui_webfilter_advanced:
# gui_wireless_controller:
# gui_ztna:
# h323_direct_model:
# http_external_dest:
# hyperscale_default_policy_action:
# ike_dn_format:
# ike_policy_route:
# ike_port:
# ike_quick_crash_detect:
# ike_session_resume:
# ike_tcp_port:
# internet_service_app_ctrl_size:
# internet_service_database_cache:
# ip:
# ip6:
# lan_extension_controller_addr:
# link_down_access:
# lldp_reception:
# lldp_transmission:
# location_id:
# mac_ttl:
# manageip:
# manageip6:
# multicast_forward:
# multicast_skip_policy:
# multicast_ttl_notchange:
# nat46_force_ipv4_packet_forwarding:
# nat46_generate_ipv6_fragment_header:
# nat64_force_ipv6_packet_forwarding:
# ngfw_mode:
# npu_group_id:
# opmode:
# pfcp_monitor_mode:
# policy_offload_level:
# prp_trailer_action:
# sccp_port:
# sctp_session_without_init:
# ses_denied_traffic:
# session_insert_trial:
# sip_expectation:
# sip_nat_trace:
# sip_ssl_port:
# sip_tcp_port:
# sip_udp_port:
# snat_hairpin_traffic:
# status:
# strict_src_check:
# tcp_session_without_syn:
# trap_local_session:
# trap_session_flag:
# utf8_spam_tagging:
# v4_ecmp_mode:
# vdom_type:
# vpn_stats_log:
# - "ipsec"
# - "pptp"
# - "l2tp"
# - "ssl"
# vpn_stats_period:
# wccp_cache_engine:
# gui_endpoint_control_advanced:
# gui_endpoint_control:
# gui_local_reports:
# gui_nat46_64:
# gui_dynamic_profile_display:
# gui_replacement_message_groups:
# gui_domain_ip_reputation:
# gui_multiple_utm_profiles:
# implicit_allow_dns:
# gui_per_policy_disclaimer:
# consolidated_firewall_mode:
# motherboard_traffic_forwarding:
# - "icmp"
# - "admin"
# - "auth"
# gui_gtp:
# nonat_eif_key_sel:
# ses_denied_multicast_traffic:
# dhcp_proxy_vrf_select:
# dp_load_distribution_group:
# gui_dlp_advanced:
# gui_sslvpn_clients:
# intree_ses_best_route:
# gui_fortitelemetry:
# ike_detailed_event_logs:
# forward_domain:
# wccp_local_route:
# gui_dlp:
# lan_extension_controller_port:
Return Values
-------------
Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:
.. raw:: html
- meta - The result of the request.returned: always type: dict
- request_url - The full url requested. returned: always type: str sample: /sys/login/user
- response_code - The status of api request. returned: always type: int sample: 0
- response_data - The data body of the api response. returned: optional type: list or dict
- response_message - The descriptive message of the api response. returned: always type: str sample: OK
- system_information - The information of the target system. returned: always type: dict
- rc - The status the request. returned: always type: int sample: 0
- version_check_warning - Warning if the parameters used in the playbook are not supported by the current FortiManager version. returned: if at least one parameter not supported by the current FortiManager version type: list
Status
------
- This module is not guaranteed to have a backwards compatible interface.
Authors
-------
- Xinwei Du (@dux-fortinet)
- Xing Li (@lix-fortinet)
- Jie Xue (@JieX19)
- Link Zheng (@chillancezen)
- Frank Shen (@fshen01)
- Hongbin Lu (@fgtdev-hblu)