fmgd_webfilter_profile – Configure Web filter profiles.

Added in version 1.1.0.

Synopsis

  • This module is able to configure a FortiManager device.

  • Examples include all parameters and values need to be adjusted to data sources before usage.

  • Tested with FortiManager v7.x.

Requirements

The below requirements are needed on the host that executes this module.

  • ansible-core>=2.16.0

FortiManager Version Compatibility

Supported Version Ranges: v7.4.8 -> v7.4.10, v7.6.4 -> latest

Parameters

  • access_token -The token to access FortiManager without using username and password. type: str required: false
  • bypass_validation - Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters. type: bool required: false default: False
  • enable_log - Enable/Disable logging for task. type: bool required: false default: False
  • forticloud_access_token - Access token of forticloud managed API users, this option is available with FortiManager later than 6.4.0. type: str required: false
  • proposed_method - The overridden method for the underlying Json RPC request. type: str required: false choices: set, update, add
  • rc_succeeded - The rc codes list with which the conditions to succeed will be overriden. type: list required: false
  • rc_failed - The rc codes list with which the conditions to fail will be overriden. type: list required: false
  • state - The directive to create, update or delete an object type: str required: true choices: present, absent
  • workspace_locking_adom - Acquire the workspace lock if FortiManager is running in workspace mode. type: str required: false choices: global, custom adom including root
  • workspace_locking_timeout - The maximum time in seconds to wait for other users to release workspace lock. type: integer required: false default: 300
  • device - The parameter in requested url type: str required: true
  • vdom - The parameter in requested url type: str required: true
  • webfilter_profile - Configure Web filter profiles. type: dict
    • antiphish Antiphish. type: dict more...
      • authentication Authentication methods. type: str choices: [domain-controller, ldap] more...
      • check_basic_auth (Alias name: check-basic-auth) Enable/disable checking of http basic auth field for known credentials. type: str choices: [disable, enable] more...
      • check_uri (Alias name: check-uri) Enable/disable checking of get uri parameters for known credentials. type: str choices: [disable, enable] more...
      • check_username_only (Alias name: check-username-only) Enable/disable username only matching of credentials. type: str choices: [disable, enable] more...
      • custom_patterns (Alias name: custom-patterns) Custom patterns. type: list more...
        • category Category that the pattern matches. type: str choices: [username, password] more...
        • pattern Target pattern. type: str more...
        • type Pattern will be treated either as a regex pattern or literal string. type: str choices: [regex, literal] more...
      • default_action (Alias name: default-action) Action to be taken when there is no matching rule. type: str choices: [log, block, exempt] more...
      • domain_controller (Alias name: domain-controller) Domain for which to verify received credentials against. type: list more...
      • inspection_entries (Alias name: inspection-entries) Inspection entries. type: list more...
        • action Action to be taken upon an antiphishing match. type: str choices: [log, block, exempt] more...
        • fortiguard_category (Alias name: fortiguard-category) Fortiguard category to match. type: list more...
        • name Inspection target name. type: str more...
      • ldap Ldap server for which to verify received credentials against. type: list more...
      • max_body_len (Alias name: max-body-len) Maximum size of a post body to check for credentials. type: int more...
      • status Toggle antiphishing functionality. type: str choices: [disable, enable] more...
    • comment Optional comments. type: str more...
    • ftgd_wf (Alias name: ftgd-wf) Ftgd wf. type: dict more...
      • exempt_quota (Alias name: exempt-quota) Do not stop quota for these categories. type: list more...
      • filters Filters. type: list more...
        • action Action to take for matches. type: str choices: [block, monitor, warning, authenticate] more...
        • auth_usr_grp (Alias name: auth-usr-grp) Groups with permission to authenticate. type: list more...
        • category Categories and groups the filter examines. type: list more...
        • id Id number. type: int more...
        • log Enable/disable logging. type: str choices: [disable, enable] more...
        • override_replacemsg (Alias name: override-replacemsg) Override replacement message. type: str more...
        • warn_duration (Alias name: warn-duration) Duration of warnings. type: str more...
        • warning_duration_type (Alias name: warning-duration-type) Re-display warning after closing browser or after a timeout. type: str choices: [session, timeout] more...
        • warning_prompt (Alias name: warning-prompt) Warning prompts in each category or each domain. type: str choices: [per-domain, per-category] more...
      • max_quota_timeout (Alias name: max-quota-timeout) Maximum fortiguard quota used by single page view in seconds (excludes streams). type: int more...
      • options Options for fortiguard web filter. type: list choices: [error-allow, rate-server-ip, connect-request-bypass, ftgd-disable, http-err-detail] more...
      • ovrd Allow web filter profile overrides. type: list more...
      • quota Quota. type: list more...
        • category Fortiguard categories to apply quota to (category action must be set to monitor). type: list more...
        • duration Duration of quota. type: str more...
        • id Id number. type: int more...
        • override_replacemsg (Alias name: override-replacemsg) Override replacement message. type: str more...
        • type Quota type. type: str choices: [time, traffic] more...
        • unit Traffic quota unit of measurement. type: str choices: [B, KB, MB, GB] more...
        • value Traffic quota value. type: int more...
        • reset_frequency (Alias name: reset-frequency) Quota reset frequency (default = dayly). type: str choices: [daily, weekly, monthly] more...
      • rate_crl_urls (Alias name: rate-crl-urls) Enable/disable rating crl by url. type: str choices: [disable, enable] more...
      • rate_css_urls (Alias name: rate-css-urls) Enable/disable rating css by url. type: str choices: [disable, enable] more...
      • rate_javascript_urls (Alias name: rate-javascript-urls) Enable/disable rating javascript by url. type: str choices: [disable, enable] more...
      • risk Risk. type: list more...
        • action Action. type: str choices: [block, monitor] more...
        • id Id. type: int more...
        • log Log. type: str choices: [disable, enable] more...
        • risk_level (Alias name: risk-level) Risk level. type: list more...
      • rate_image_urls (Alias name: rate-image-urls) Enable/disable rating images by url. type: str choices: [disable, enable] more...
    • https_replacemsg (Alias name: https-replacemsg) Enable replacement messages for https. type: str choices: [disable, enable] more...
    • ia_categorization (Alias name: ia-categorization) Ia categorization. type: str choices: [disable, enable] more...
    • log_all_url (Alias name: log-all-url) Enable/disable logging all urls visited. type: str choices: [disable, enable] more...
    • name Profile name. type: str more...
    • options Options. type: list choices: [block-invalid-url, jscript, js, vbs, unknown, wf-referer, intrinsic, wf-cookie, activexfilter, cookiefilter, javafilter, per-user-bal, per-user-bwl] more...
    • override Override. type: dict more...
      • ovrd_cookie (Alias name: ovrd-cookie) Allow/deny browser-based (cookie) overrides. type: str choices: [deny, allow] more...
      • ovrd_dur (Alias name: ovrd-dur) Override duration. type: str more...
      • ovrd_dur_mode (Alias name: ovrd-dur-mode) Override duration mode. type: str choices: [constant, ask] more...
      • ovrd_scope (Alias name: ovrd-scope) Override scope. type: str choices: [user, user-group, ip, ask, browser] more...
      • ovrd_user_group (Alias name: ovrd-user-group) User groups with permission to use the override. type: list more...
      • profile Web filter profile with permission to create overrides. type: list more...
      • profile_attribute (Alias name: profile-attribute) Profile attribute to retrieve from the radius server. type: str choices: [User-Name, NAS-IP-Address, Framed-IP-Address, Framed-IP-Netmask, Filter-Id, Login-IP-Host, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, Class, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Zone, Acct-Session-Id, Acct-Multi-Session-Id] more...
      • profile_type (Alias name: profile-type) Override profile type. type: str choices: [list, radius] more...
    • ovrd_perm (Alias name: ovrd-perm) Permitted override types. type: list choices: [bannedword-override, urlfilter-override, fortiguard-wf-override, contenttype-check-override] more...
    • post_action (Alias name: post-action) Action taken for http post traffic. type: str choices: [normal, block] more...
    • replacemsg_group (Alias name: replacemsg-group) Replacement message group. type: list more...
    • web Web. type: dict more...
      • allowlist Fortiguard allowlist settings. type: list choices: [exempt-av, exempt-webcontent, exempt-activex-java-cookie, exempt-dlp, exempt-rangeblock, extended-log-others] more...
      • blocklist Enable/disable automatic addition of urls detected by fortisandbox to blocklist. type: str choices: [disable, enable] more...
      • bword_table (Alias name: bword-table) Banned word table id. type: list more...
      • bword_threshold (Alias name: bword-threshold) Banned word score threshold. type: int more...
      • content_header_list (Alias name: content-header-list) Content header list. type: list more...
      • keyword_match (Alias name: keyword-match) Search keywords to log when match is found. type: list more...
      • log_search (Alias name: log-search) Enable/disable logging all search phrases. type: str choices: [disable, enable] more...
      • qwant_restrict (Alias name: qwant-restrict) Qwant restrict. type: str choices: [strict, none, moderate] more...
      • safe_search (Alias name: safe-search) Safe search type. type: list choices: [url, header] more...
      • urlfilter_table (Alias name: urlfilter-table) Url filter table id. type: list more...
      • vimeo_restrict (Alias name: vimeo-restrict) Set vimeo-restrict (7 = dont show mature content, 134 = dont show unrated and mature content). type: str more...
      • youtube_restrict (Alias name: youtube-restrict) Youtube edu filter level. type: str choices: [strict, none, moderate] more...
      • whitelist Fortiguard whitelist settings. type: list choices: [exempt-av, exempt-webcontent, exempt-activex-java-cookie, exempt-dlp, exempt-rangeblock, extended-log-others] more...
      • blacklist Enable/disable automatic addition of urls detected by fortisandbox to blacklist. type: str choices: [disable, enable] more...
    • web_antiphishing_log (Alias name: web-antiphishing-log) Enable/disable logging of antiphishing checks. type: str choices: [disable, enable] more...
    • web_content_log (Alias name: web-content-log) Enable/disable logging logging blocked web content. type: str choices: [disable, enable] more...
    • web_filter_activex_log (Alias name: web-filter-activex-log) Enable/disable logging activex. type: str choices: [disable, enable] more...
    • web_filter_applet_log (Alias name: web-filter-applet-log) Enable/disable logging java applets. type: str choices: [disable, enable] more...
    • web_filter_command_block_log (Alias name: web-filter-command-block-log) Enable/disable logging blocked commands. type: str choices: [disable, enable] more...
    • web_filter_cookie_log (Alias name: web-filter-cookie-log) Enable/disable logging cookie filtering. type: str choices: [disable, enable] more...
    • web_filter_cookie_removal_log (Alias name: web-filter-cookie-removal-log) Enable/disable logging blocked cookies. type: str choices: [disable, enable] more...
    • web_filter_js_log (Alias name: web-filter-js-log) Enable/disable logging java scripts. type: str choices: [disable, enable] more...
    • web_filter_jscript_log (Alias name: web-filter-jscript-log) Enable/disable logging jscripts. type: str choices: [disable, enable] more...
    • web_filter_referer_log (Alias name: web-filter-referer-log) Enable/disable logging referrers. type: str choices: [disable, enable] more...
    • web_filter_unknown_log (Alias name: web-filter-unknown-log) Enable/disable logging unknown scripts. type: str choices: [disable, enable] more...
    • web_filter_vbs_log (Alias name: web-filter-vbs-log) Enable/disable logging vbs scripts. type: str choices: [disable, enable] more...
    • web_ftgd_err_log (Alias name: web-ftgd-err-log) Enable/disable logging rating errors. type: str choices: [disable, enable] more...
    • web_ftgd_quota_usage (Alias name: web-ftgd-quota-usage) Enable/disable logging daily quota usage. type: str choices: [disable, enable] more...
    • web_invalid_domain_log (Alias name: web-invalid-domain-log) Enable/disable logging invalid domain names. type: str choices: [disable, enable] more...
    • web_url_log (Alias name: web-url-log) Enable/disable logging url filtering. type: str choices: [disable, enable] more...
    • wisp Enable/disable web proxy wisp. type: str choices: [disable, enable] more...
    • wisp_algorithm (Alias name: wisp-algorithm) Wisp server selection algorithm. type: str choices: [auto-learning, primary-secondary, round-robin] more...
    • wisp_servers (Alias name: wisp-servers) Wisp servers. type: list more...
    • feature_set (Alias name: feature-set) Flow/proxy feature set. type: str choices: [proxy, flow] more...
    • web_flow_log_encoding (Alias name: web-flow-log-encoding) Log encoding in flow mode. type: str choices: [utf-8, punycode] more...
    • url_extraction (Alias name: url-extraction) Url extraction. type: dict more...
      • redirect_header (Alias name: redirect-header) Http header name to use for client redirect on blocked requests type: str more...
      • redirect_no_content (Alias name: redirect-no-content) Enable / disable empty message-body entity in http response type: str choices: [disable, enable] more...
      • redirect_url (Alias name: redirect-url) Http header value to use for client redirect on blocked requests type: str more...
      • server_fqdn (Alias name: server-fqdn) Url extraction server fqdn (fully qualified domain name) type: str more...
      • status Enable url extraction type: str choices: [disable, enable] more...
    • extended_log (Alias name: extended-log) Enable/disable extended logging for web filtering. type: str choices: [disable, enable] more...
    • web_extended_all_action_log (Alias name: web-extended-all-action-log) Enable/disable extended any filter action logging for web filtering. type: str choices: [disable, enable] more...
    • youtube_channel_status (Alias name: youtube-channel-status) Youtube channel filter status. type: str choices: [disable, blacklist, whitelist] more...
    • youtube_channel_filter (Alias name: youtube-channel-filter) Youtube channel filter. type: list more...
      • channel_id (Alias name: channel-id) Youtube channel id to be filtered. type: str more...
      • comment Comment. type: str more...
      • id Id. type: int more...
    • file_filter (Alias name: file-filter) File filter. type: dict more...
      • entries Entries. type: list more...
        • action Action taken for matched file. type: str choices: [log, block] more...
        • comment Comment. type: str more...
        • direction Match files transmitted in the sessions originating or reply direction. type: str choices: [any, incoming, outgoing] more...
        • file_type (Alias name: file-type) Select file type. type: list more...
        • filter Add a file filter. type: str more...
        • password_protected (Alias name: password-protected) Match password-protected files. type: str choices: [any, yes] more...
        • protocol Protocols to apply with. type: list choices: [http, ftp] more...
      • log Enable/disable file filter logging. type: str choices: [disable, enable] more...
      • scan_archive_contents (Alias name: scan-archive-contents) Enable/disable file filter archive contents scan. type: str choices: [disable, enable] more...
      • status Enable/disable file filter. type: str choices: [disable, enable] more...

Notes

Note

  • Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.

  • To create or update an object, use state: present directive.

  • To delete an object, use state: absent directive

  • Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded

Examples

- name: Example playbook (generated based on argument schema)
  hosts: fortimanagers
  connection: httpapi
  gather_facts: false
  vars:
    ansible_httpapi_use_ssl: true
    ansible_httpapi_validate_certs: false
    ansible_httpapi_port: 443
  tasks:
    - name: Configure Web filter profiles.
      fortinet.fmgdevice.fmgd_webfilter_profile:
        # bypass_validation: false
        # workspace_locking_adom: <global or your adom name>
        # workspace_locking_timeout: 300
        # rc_succeeded: [0, -2, -3, ...]
        # rc_failed: [-2, -3, ...]
        device: <your own value>
        vdom: <your own value>
        state: present # <value in [present, absent]>
        webfilter_profile:
          name: "your value" # Required variable, string
          # antiphish:
          #   authentication: <value in [domain-controller, ldap]>
          #   check_basic_auth: <value in [disable, enable]>
          #   check_uri: <value in [disable, enable]>
          #   check_username_only: <value in [disable, enable]>
          #   custom_patterns:
          #     - category: <value in [username, password]>
          #       pattern: <string>
          #       type: <value in [regex, literal]>
          #   default_action: <value in [log, block, exempt]>
          #   domain_controller: <list or string>
          #   inspection_entries:
          #     - action: <value in [log, block, exempt]>
          #       fortiguard_category: <list or string>
          #       name: <string>
          #   ldap: <list or string>
          #   max_body_len: <integer>
          #   status: <value in [disable, enable]>
          # comment: <string>
          # ftgd_wf:
          #   exempt_quota: <list or string>
          #   filters:
          #     - action: <value in [block, monitor, warning, ...]>
          #       auth_usr_grp: <list or string>
          #       category: <list or string>
          #       id: <integer>
          #       log: <value in [disable, enable]>
          #       override_replacemsg: <string>
          #       warn_duration: <string>
          #       warning_duration_type: <value in [session, timeout]>
          #       warning_prompt: <value in [per-domain, per-category]>
          #   max_quota_timeout: <integer>
          #   options:
          #     - "error-allow"
          #     - "rate-server-ip"
          #     - "connect-request-bypass"
          #     - "ftgd-disable"
          #     - "http-err-detail"
          #   ovrd: <list or string>
          #   quota:
          #     - category: <list or string>
          #       duration: <string>
          #       id: <integer>
          #       override_replacemsg: <string>
          #       type: <value in [time, traffic]>
          #       unit: <value in [B, KB, MB, ...]>
          #       value: <integer>
          #       reset_frequency: <value in [daily, weekly, monthly]>
          #   rate_crl_urls: <value in [disable, enable]>
          #   rate_css_urls: <value in [disable, enable]>
          #   rate_javascript_urls: <value in [disable, enable]>
          #   risk:
          #     - action: <value in [block, monitor]>
          #       id: <integer>
          #       log: <value in [disable, enable]>
          #       risk_level: <list or string>
          #   rate_image_urls: <value in [disable, enable]>
          # https_replacemsg: <value in [disable, enable]>
          # ia_categorization: <value in [disable, enable]>
          # log_all_url: <value in [disable, enable]>
          # options:
          #   - "block-invalid-url"
          #   - "jscript"
          #   - "js"
          #   - "vbs"
          #   - "unknown"
          #   - "wf-referer"
          #   - "intrinsic"
          #   - "wf-cookie"
          #   - "activexfilter"
          #   - "cookiefilter"
          #   - "javafilter"
          #   - "per-user-bal"
          #   - "per-user-bwl"
          # override:
          #   ovrd_cookie: <value in [deny, allow]>
          #   ovrd_dur: <string>
          #   ovrd_dur_mode: <value in [constant, ask]>
          #   ovrd_scope: <value in [user, user-group, ip, ...]>
          #   ovrd_user_group: <list or string>
          #   profile: <list or string>
          #   profile_attribute: <value in [User-Name, NAS-IP-Address, Framed-IP-Address, ...]>
          #   profile_type: <value in [list, radius]>
          # ovrd_perm:
          #   - "bannedword-override"
          #   - "urlfilter-override"
          #   - "fortiguard-wf-override"
          #   - "contenttype-check-override"
          # post_action: <value in [normal, block]>
          # replacemsg_group: <list or string>
          # web:
          #   allowlist:
          #     - "exempt-av"
          #     - "exempt-webcontent"
          #     - "exempt-activex-java-cookie"
          #     - "exempt-dlp"
          #     - "exempt-rangeblock"
          #     - "extended-log-others"
          #   blocklist: <value in [disable, enable]>
          #   bword_table: <list or string>
          #   bword_threshold: <integer>
          #   content_header_list: <list or string>
          #   keyword_match: <list or string>
          #   log_search: <value in [disable, enable]>
          #   qwant_restrict: <value in [strict, none, moderate]>
          #   safe_search:
          #     - "url"
          #     - "header"
          #   urlfilter_table: <list or string>
          #   vimeo_restrict: <string>
          #   youtube_restrict: <value in [strict, none, moderate]>
          #   whitelist:
          #     - "exempt-av"
          #     - "exempt-webcontent"
          #     - "exempt-activex-java-cookie"
          #     - "exempt-dlp"
          #     - "exempt-rangeblock"
          #     - "extended-log-others"
          #   blacklist: <value in [disable, enable]>
          # web_antiphishing_log: <value in [disable, enable]>
          # web_content_log: <value in [disable, enable]>
          # web_filter_activex_log: <value in [disable, enable]>
          # web_filter_applet_log: <value in [disable, enable]>
          # web_filter_command_block_log: <value in [disable, enable]>
          # web_filter_cookie_log: <value in [disable, enable]>
          # web_filter_cookie_removal_log: <value in [disable, enable]>
          # web_filter_js_log: <value in [disable, enable]>
          # web_filter_jscript_log: <value in [disable, enable]>
          # web_filter_referer_log: <value in [disable, enable]>
          # web_filter_unknown_log: <value in [disable, enable]>
          # web_filter_vbs_log: <value in [disable, enable]>
          # web_ftgd_err_log: <value in [disable, enable]>
          # web_ftgd_quota_usage: <value in [disable, enable]>
          # web_invalid_domain_log: <value in [disable, enable]>
          # web_url_log: <value in [disable, enable]>
          # wisp: <value in [disable, enable]>
          # wisp_algorithm: <value in [auto-learning, primary-secondary, round-robin]>
          # wisp_servers: <list or string>
          # feature_set: <value in [proxy, flow]>
          # web_flow_log_encoding: <value in [utf-8, punycode]>
          # url_extraction:
          #   redirect_header: <string>
          #   redirect_no_content: <value in [disable, enable]>
          #   redirect_url: <string>
          #   server_fqdn: <string>
          #   status: <value in [disable, enable]>
          # extended_log: <value in [disable, enable]>
          # web_extended_all_action_log: <value in [disable, enable]>
          # youtube_channel_status: <value in [disable, blacklist, whitelist]>
          # youtube_channel_filter:
          #   - channel_id: <string>
          #     comment: <string>
          #     id: <integer>
          # file_filter:
          #   entries:
          #     - action: <value in [log, block]>
          #       comment: <string>
          #       direction: <value in [any, incoming, outgoing]>
          #       file_type: <list or string>
          #       filter: <string>
          #       password_protected: <value in [any, yes]>
          #       protocol:
          #         - "http"
          #         - "ftp"
          #   log: <value in [disable, enable]>
          #   scan_archive_contents: <value in [disable, enable]>
          #   status: <value in [disable, enable]>

Return Values

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

  • meta - The result of the request.returned: always type: dict
    • request_url - The full url requested. returned: always type: str sample: /sys/login/user
    • response_code - The status of api request. returned: always type: int sample: 0
    • response_data - The data body of the api response. returned: optional type: list or dict
    • response_message - The descriptive message of the api response. returned: always type: str sample: OK
    • system_information - The information of the target system. returned: always type: dict
  • rc - The status the request. returned: always type: int sample: 0
  • version_check_warning - Warning if the parameters used in the playbook are not supported by the current FortiManager version. returned: if at least one parameter not supported by the current FortiManager version type: list

Status

  • This module is not guaranteed to have a backwards compatible interface.

Authors

  • Xinwei Du (@dux-fortinet)

  • Xing Li (@lix-fortinet)

  • Jie Xue (@JieX19)

  • Link Zheng (@chillancezen)

  • Frank Shen (@fshen01)

  • Hongbin Lu (@fgtdev-hblu)