:source: fmgd_vpn_ipsec_phase1interface.py
:orphan:
.. _fmgd_vpn_ipsec_phase1interface:
fmgd_vpn_ipsec_phase1interface -- Configure VPN remote gateway.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
.. versionadded:: 1.0.0
.. contents::
:local:
:depth: 1
Synopsis
--------
- This module is able to configure a FortiManager device.
- Examples include all parameters and values need to be adjusted to data sources before usage.
- Tested with FortiManager v7.x.
Requirements
------------
The below requirements are needed on the host that executes this module.
- ansible-core>=2.16.0
FortiManager Version Compatibility
----------------------------------
.. raw:: html
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
Parameters
----------
.. raw:: html
- access_token -The token to access FortiManager without using username and password. type: str required: false
- bypass_validation - Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters. type: bool required: false default: False
- enable_log - Enable/Disable logging for task. type: bool required: false default: False
- forticloud_access_token - Access token of forticloud managed API users, this option is available with FortiManager later than 6.4.0. type: str required: false
- proposed_method - The overridden method for the underlying Json RPC request. type: str required: false choices: set, update, add
- rc_succeeded - The rc codes list with which the conditions to succeed will be overriden. type: list required: false
- rc_failed - The rc codes list with which the conditions to fail will be overriden. type: list required: false
- state - The directive to create, update or delete an object type: str required: true choices: present, absent
- workspace_locking_adom - Acquire the workspace lock if FortiManager is running in workspace mode. type: str required: false choices: global, custom adom including root
- workspace_locking_timeout - The maximum time in seconds to wait for other users to release workspace lock. type: integer required: false default: 300
- device - The parameter in requested url type: str required: true
- vdom - The parameter in requested url type: str required: true
- vpn_ipsec_phase1interface - Configure VPN remote gateway. type: dict
- acct_verify (Alias name: acct-verify) Enable/disable verification of radius accounting record. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- add_gw_route (Alias name: add-gw-route) Enable/disable automatically add a route to the remote gateway. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- add_route (Alias name: add-route) Enable/disable control addition of a route to peer destination selector. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- aggregate_member (Alias name: aggregate-member) Enable/disable use as an aggregate member. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- aggregate_weight (Alias name: aggregate-weight) Link weight for aggregate. type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- assign_ip (Alias name: assign-ip) Enable/disable assignment of ip to ipsec interface via configuration method. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- assign_ip_from (Alias name: assign-ip-from) Method by which the ip address will be assigned. type: str choices: [range, usrgrp, dhcp, name]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- authmethod Authentication method. type: str choices: [psk, rsa-signature, signature]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- authmethod_remote (Alias name: authmethod-remote) Authentication method (remote side). type: str choices: [psk, signature]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- authpasswd Xauth password (max 35 characters). type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- authusr Xauth user name. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- authusrgrp Authentication user group. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- auto_discovery_crossover (Alias name: auto-discovery-crossover) Allow/block set-up of short-cut tunnels between different network ids. type: str choices: [block, allow]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- auto_discovery_forwarder (Alias name: auto-discovery-forwarder) Enable/disable forwarding auto-discovery short-cut messages. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- auto_discovery_offer_interval (Alias name: auto-discovery-offer-interval) Interval between shortcut offer messages in seconds (1 - 300, default = 5). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- auto_discovery_psk (Alias name: auto-discovery-psk) Enable/disable use of pre-shared secrets for authentication of auto-discovery tunnels. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- auto_discovery_receiver (Alias name: auto-discovery-receiver) Enable/disable accepting auto-discovery short-cut messages. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- auto_discovery_sender (Alias name: auto-discovery-sender) Enable/disable sending auto-discovery short-cut messages. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- auto_discovery_shortcuts (Alias name: auto-discovery-shortcuts) Control deletion of child short-cut tunnels when the parent tunnel goes down. type: str choices: [independent, dependent]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- auto_negotiate (Alias name: auto-negotiate) Enable/disable automatic initiation of ike sa negotiation. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- azure_ad_autoconnect (Alias name: azure-ad-autoconnect) Enable/disable azure ad auto-connect for forticlient. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- backup_gateway (Alias name: backup-gateway) Instruct unity clients about the backup gateway address(es). type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- banner Message that unity client should display after connecting. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- cert_id_validation (Alias name: cert-id-validation) Enable/disable cross validation of peer id and the identity in the peers certificate as specified in rfc 4945. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- cert_peer_username_strip (Alias name: cert-peer-username-strip) Enable/disable domain stripping on certificate identity. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.4.3 -> latest
- cert_peer_username_validation (Alias name: cert-peer-username-validation) Enable/disable cross validation of peer username and the identity in the peers certificate. type: str choices: [othername, rfc822name, cn, none]
more...
Supported Version Ranges: v7.4.3 -> latest
- cert_trust_store (Alias name: cert-trust-store) Ca certificate trust store. type: str choices: [local, ems]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- certificate The names of up to 4 signed personal certificates. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- childless_ike (Alias name: childless-ike) Enable/disable childless ikev2 initiation (rfc 6023). type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- client_auto_negotiate (Alias name: client-auto-negotiate) Enable/disable allowing the vpn client to bring up the tunnel when there is no traffic. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- client_keep_alive (Alias name: client-keep-alive) Enable/disable allowing the vpn client to keep the tunnel up when there is no traffic. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- client_resume (Alias name: client-resume) Enable/disable resumption of offline forticlient sessions. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.4.3 -> latest
- client_resume_interval (Alias name: client-resume-interval) Maximum time in seconds during which a vpn client may resume using a tunnel after a client pc has entered sleep mode or temporarily lost its network connection (120 - 172800, default = 1800). type: int
more...
Supported Version Ranges: v7.4.3 -> latest
- comments Comment. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- default_gw (Alias name: default-gw) Ipv4 address of default route gateway to use for traffic exiting the interface. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- default_gw_priority (Alias name: default-gw-priority) Priority for default gateway route. type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dev_id (Alias name: dev-id) Device id carried by the device id notification. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dev_id_notification (Alias name: dev-id-notification) Enable/disable device id notification. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dhcp_ra_giaddr (Alias name: dhcp-ra-giaddr) Relay agent gateway ip address to use in the giaddr field of dhcp requests. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dhcp6_ra_linkaddr (Alias name: dhcp6-ra-linkaddr) Relay agent ipv6 link address to use in dhcp6 requests. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dhgrp Dh group. type: list choices: [1, 2, 5, 14, 15, 16, 17, 18, 19, 20, 21, 27, 28, 29, 30, 31, 32]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- digital_signature_auth (Alias name: digital-signature-auth) Enable/disable ikev2 digital signature authentication (rfc 7427). type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- distance Distance for routes added by ike (1 - 255). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dns_mode (Alias name: dns-mode) Dns server mode. type: str choices: [auto, manual]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- domain Instruct unity clients about the single default dns domain. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dpd Dead peer detection mode. type: str choices: [disable, enable, on-idle, on-demand]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dpd_retrycount (Alias name: dpd-retrycount) Number of dpd retry attempts. type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- dpd_retryinterval (Alias name: dpd-retryinterval) Dpd retry interval. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- eap Enable/disable ikev2 eap authentication. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- eap_cert_auth (Alias name: eap-cert-auth) Enable/disable peer certificate authentication in addition to eap if peer is a forticlient endpoint. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.4.3 -> latest
- eap_exclude_peergrp (Alias name: eap-exclude-peergrp) Peer group excluded from eap authentication. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- eap_identity (Alias name: eap-identity) Ikev2 eap peer identity type. type: str choices: [use-id-payload, send-request]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ems_sn_check (Alias name: ems-sn-check) Enable/disable verification of ems serial number. type: str choices: [use-global, enable, disable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- encap_local_gw4 (Alias name: encap-local-gw4) Local ipv4 address of gre/vxlan tunnel. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- encap_local_gw6 (Alias name: encap-local-gw6) Local ipv6 address of gre/vxlan tunnel. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- encap_remote_gw4 (Alias name: encap-remote-gw4) Remote ipv4 address of gre/vxlan tunnel. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- encap_remote_gw6 (Alias name: encap-remote-gw6) Remote ipv6 address of gre/vxlan tunnel. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- encapsulation Enable/disable gre/vxlan/vpnid encapsulation. type: str choices: [none, gre, vxlan, vpn-id-ipip]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- encapsulation_address (Alias name: encapsulation-address) Source for gre/vxlan tunnel address. type: str choices: [ike, ipv4, ipv6]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- enforce_unique_id (Alias name: enforce-unique-id) Enable/disable peer id uniqueness check. type: str choices: [disable, keep-new, keep-old]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- esn Extended sequence number (esn) negotiation. type: str choices: [disable, require, allow]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- exchange_fgt_device_id (Alias name: exchange-fgt-device-id) Enable/disable device identifier exchange with peer fortigate units for use of vpn monitor data by fortimanager. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- exchange_interface_ip (Alias name: exchange-interface-ip) Enable/disable exchange of ipsec interface ip address. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- exchange_ip_addr4 (Alias name: exchange-ip-addr4) Ipv4 address to exchange with peers. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- exchange_ip_addr6 (Alias name: exchange-ip-addr6) Ipv6 address to exchange with peers. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- fallback_tcp_threshold (Alias name: fallback-tcp-threshold) Timeout in seconds before falling back ike/ipsec traffic to tcp. type: int
more...
Supported Version Ranges: v7.4.3 -> latest
- fec_base (Alias name: fec-base) Number of base forward error correction packets (1 - 20). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- fec_codec (Alias name: fec-codec) Forward error correction encoding/decoding algorithm. type: str choices: [rs, xor]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- fec_egress (Alias name: fec-egress) Enable/disable forward error correction for egress ipsec traffic. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- fec_health_check (Alias name: fec-health-check) Sd-wan health check. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- fec_ingress (Alias name: fec-ingress) Enable/disable forward error correction for ingress ipsec traffic. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- fec_mapping_profile (Alias name: fec-mapping-profile) Forward error correction (fec) mapping profile. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- fec_receive_timeout (Alias name: fec-receive-timeout) Timeout in milliseconds before dropping forward error correction packets (1 - 1000). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- fec_redundant (Alias name: fec-redundant) Number of redundant forward error correction packets (1 - 5 for reed-solomon, 1 for xor). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- fec_send_timeout (Alias name: fec-send-timeout) Timeout in milliseconds before sending forward error correction packets (1 - 1000). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- fgsp_sync (Alias name: fgsp-sync) Enable/disable ipsec syncing of tunnels for fgsp ipsec. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- fortinet_esp (Alias name: fortinet-esp) Enable/disable fortinet esp encapsulaton. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.4.3 -> latest
- fragmentation Enable/disable fragment ike message on re-transmission. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- fragmentation_mtu (Alias name: fragmentation-mtu) Ike fragmentation mtu (500 - 16000). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- group_authentication (Alias name: group-authentication) Enable/disable ikev2 idi group authentication. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- group_authentication_secret (Alias name: group-authentication-secret) Password for ikev2 id group authentication. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ha_sync_esp_seqno (Alias name: ha-sync-esp-seqno) Enable/disable sequence number jump ahead for ipsec ha. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- idle_timeout (Alias name: idle-timeout) Enable/disable ipsec tunnel idle timeout. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- idle_timeoutinterval (Alias name: idle-timeoutinterval) Ipsec tunnel idle timeout in minutes (5 - 43200). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ike_version (Alias name: ike-version) Ike protocol version. type: str choices: [1, 2]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- inbound_dscp_copy (Alias name: inbound-dscp-copy) Enable/disable copy the dscp in the esp header to the inner ip header. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- include_local_lan (Alias name: include-local-lan) Enable/disable allow local lan access on unity clients. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- interface Local physical, aggregate, or vlan outgoing interface. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- internal_domain_list (Alias name: internal-domain-list) One or more internal domain names in quotes separated by spaces. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ip_delay_interval (Alias name: ip-delay-interval) Ip address reuse delay interval in seconds (0 - 28800). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ip_fragmentation (Alias name: ip-fragmentation) Determine whether ip packets are fragmented before or after ipsec encapsulation. type: str choices: [pre-encapsulation, post-encapsulation]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ip_version (Alias name: ip-version) Ip version to use for vpn interface. type: str choices: [4, 6]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipsec_tunnel_slot (Alias name: ipsec-tunnel-slot) Slot at which ipsec tunnel will be establishd. type: str choices: [master, auto, FPC1, FPC2, FPC3, FPC4, FPC5, FPC6, FPC7, FPC8, FPC9, FPC10, FPM3, FPM4, FPM5, FPM6, FPM7, FPM8, FPM9, FPM10, FPM11, FPM12]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv4_dns_server1 (Alias name: ipv4-dns-server1) Ipv4 dns server 1. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv4_dns_server2 (Alias name: ipv4-dns-server2) Ipv4 dns server 2. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv4_dns_server3 (Alias name: ipv4-dns-server3) Ipv4 dns server 3. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv4_end_ip (Alias name: ipv4-end-ip) End of ipv4 range. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv4_exclude_range (Alias name: ipv4-exclude-range) Ipv4 exclude range. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- end_ip (Alias name: end-ip) End of ipv4 exclusive range. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- id Id. type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- start_ip (Alias name: start-ip) Start of ipv4 exclusive range. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv4_name (Alias name: ipv4-name) Ipv4 address name. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv4_netmask (Alias name: ipv4-netmask) Ipv4 netmask. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv4_split_exclude (Alias name: ipv4-split-exclude) Ipv4 subnets that should not be sent over the ipsec tunnel. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv4_split_include (Alias name: ipv4-split-include) Ipv4 split-include subnets. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv4_start_ip (Alias name: ipv4-start-ip) Start of ipv4 range. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv4_wins_server1 (Alias name: ipv4-wins-server1) Wins server 1. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv4_wins_server2 (Alias name: ipv4-wins-server2) Wins server 2. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv6_dns_server1 (Alias name: ipv6-dns-server1) Ipv6 dns server 1. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv6_dns_server2 (Alias name: ipv6-dns-server2) Ipv6 dns server 2. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv6_dns_server3 (Alias name: ipv6-dns-server3) Ipv6 dns server 3. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv6_end_ip (Alias name: ipv6-end-ip) End of ipv6 range. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv6_exclude_range (Alias name: ipv6-exclude-range) Ipv6 exclude range. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- end_ip (Alias name: end-ip) End of ipv6 exclusive range. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- id Id. type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- start_ip (Alias name: start-ip) Start of ipv6 exclusive range. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv6_name (Alias name: ipv6-name) Ipv6 address name. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv6_prefix (Alias name: ipv6-prefix) Ipv6 prefix. type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv6_split_exclude (Alias name: ipv6-split-exclude) Ipv6 subnets that should not be sent over the ipsec tunnel. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv6_split_include (Alias name: ipv6-split-include) Ipv6 split-include subnets. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ipv6_start_ip (Alias name: ipv6-start-ip) Start of ipv6 range. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- keepalive Nat-t keep alive interval. type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- keylife Time to wait in seconds before phase 1 encryption key expires. type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- kms Key management services server. type: list
more...
Supported Version Ranges: v7.4.3 -> latest
- link_cost (Alias name: link-cost) Vpn tunnel underlay link cost. type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- local_gw (Alias name: local-gw) Ipv4 address of the local gateways external interface. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- local_gw6 (Alias name: local-gw6) Ipv6 address of the local gateways external interface. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- localid Local id. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- localid_type (Alias name: localid-type) Local id type. type: str choices: [auto, fqdn, user-fqdn, keyid, address, asn1dn]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- loopback_asymroute (Alias name: loopback-asymroute) Enable/disable asymmetric routing for ike traffic on loopback interface. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- mesh_selector_type (Alias name: mesh-selector-type) Add selectors containing subsets of the configuration depending on traffic. type: str choices: [disable, subnet, host]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- mode The id protection mode used to establish a secure channel. type: str choices: [main, aggressive]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- mode_cfg (Alias name: mode-cfg) Enable/disable configuration method. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- mode_cfg_allow_client_selector (Alias name: mode-cfg-allow-client-selector) Enable/disable mode-cfg client to use custom phase2 selectors. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- monitor Ipsec interface as backup for primary interface. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- monitor_hold_down_delay (Alias name: monitor-hold-down-delay) Time to wait in seconds before recovery once primary re-establishes. type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- monitor_hold_down_time (Alias name: monitor-hold-down-time) Time of day at which to fail back to primary after it re-establishes. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- monitor_hold_down_type (Alias name: monitor-hold-down-type) Recovery time method when primary interface re-establishes. type: str choices: [immediate, delay, time]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- monitor_hold_down_weekday (Alias name: monitor-hold-down-weekday) Day of the week to recover once primary re-establishes. type: str choices: [sunday, monday, tuesday, wednesday, thursday, friday, saturday, everyday]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- monitor_min (Alias name: monitor-min) Minimum number of links to become degraded before activating this interface. type: int
more...
Supported Version Ranges: v7.4.3 -> latest
- name Ipsec remote gateway name. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- nattraversal Enable/disable nat traversal. type: str choices: [disable, enable, forced]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- negotiate_timeout (Alias name: negotiate-timeout) Ike sa negotiation timeout in seconds (1 - 300). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- net_device (Alias name: net-device) Enable/disable kernel device creation. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- network_id (Alias name: network-id) Vpn gateway network id. type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- network_overlay (Alias name: network-overlay) Enable/disable network overlays. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- npu_offload (Alias name: npu-offload) Enable/disable offloading npu. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- packet_redistribution (Alias name: packet-redistribution) Enable/disable packet distribution (rps) on the ipsec interface. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- passive_mode (Alias name: passive-mode) Enable/disable ipsec passive mode for static tunnels. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- peer Accept this peer certificate. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- peergrp Accept this peer certificate group. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- peerid Accept this peer identity. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- peertype Accept this peer type. type: str choices: [any, one, dialup, peer, peergrp]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ppk Enable/disable ikev2 postquantum preshared key (ppk). type: str choices: [disable, allow, require]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ppk_identity (Alias name: ppk-identity) Ikev2 postquantum preshared key identity. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- ppk_secret (Alias name: ppk-secret) Ikev2 postquantum preshared key (ascii string or hexadecimal encoded with a leading 0x). type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- priority Priority for routes added by ike (1 - 65535). type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- proposal Phase1 proposal. type: str choices: [des-md5, des-sha1, 3des-md5, 3des-sha1, aes128-md5, aes128-sha1, aes192-md5, aes192-sha1, aes256-md5, aes256-sha1, des-sha256, 3des-sha256, aes128-sha256, aes192-sha256, aes256-sha256, des-sha384, des-sha512, 3des-sha384, 3des-sha512, aes128-sha384, aes128-sha512, aes192-sha384, aes192-sha512, aes256-sha384, aes256-sha512, aria128-md5, aria128-sha1, aria128-sha256, aria128-sha384, aria128-sha512, aria192-md5, aria192-sha1, aria192-sha256, aria192-sha384, aria192-sha512, aria256-md5, aria256-sha1, aria256-sha256, aria256-sha384, aria256-sha512, seed-md5, seed-sha1, seed-sha256, seed-sha384, seed-sha512, aes128gcm-prfsha1, aes128gcm-prfsha256, aes128gcm-prfsha384, aes128gcm-prfsha512, aes256gcm-prfsha1, aes256gcm-prfsha256, aes256gcm-prfsha384, aes256gcm-prfsha512, chacha20poly1305-prfsha1, chacha20poly1305-prfsha256, chacha20poly1305-prfsha384, chacha20poly1305-prfsha512]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- psksecret Pre-shared secret for psk authentication (ascii string or hexadecimal encoded with a leading 0x). type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- psksecret_remote (Alias name: psksecret-remote) Pre-shared secret for remote side psk authentication (ascii string or hexadecimal encoded with a leading 0x). type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- qkd Enable/disable use of quantum key distribution (qkd) server. type: str choices: [disable, allow, require]
more...
Supported Version Ranges: v7.4.3 -> latest
- qkd_profile (Alias name: qkd-profile) Quantum key distribution (qkd) server profile. type: list
more...
Supported Version Ranges: v7.4.3 -> latest
- reauth Enable/disable re-authentication upon ike sa lifetime expiration. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- rekey Enable/disable phase1 rekey. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- remote_gw (Alias name: remote-gw) Ipv4 address of the remote gateways external interface. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- remote_gw_country (Alias name: remote-gw-country) Ipv4 addresses associated to a specific country. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- remote_gw_end_ip (Alias name: remote-gw-end-ip) Last ipv4 address in the range. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- remote_gw_match (Alias name: remote-gw-match) Set type of ipv4 remote gateway address matching. type: str choices: [any, ipmask, iprange, geography, ztna]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- remote_gw_start_ip (Alias name: remote-gw-start-ip) First ipv4 address in the range. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- remote_gw_subnet (Alias name: remote-gw-subnet) Ipv4 address and subnet mask. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- remote_gw6 (Alias name: remote-gw6) Ipv6 address of the remote gateways external interface. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- remote_gw6_country (Alias name: remote-gw6-country) Ipv6 addresses associated to a specific country. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- remote_gw6_end_ip (Alias name: remote-gw6-end-ip) Last ipv6 address in the range. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- remote_gw6_match (Alias name: remote-gw6-match) Set type of ipv6 remote gateway address matching. type: str choices: [any, iprange, geography, ipprefix]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- remote_gw6_start_ip (Alias name: remote-gw6-start-ip) First ipv6 address in the range. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- remote_gw6_subnet (Alias name: remote-gw6-subnet) Ipv6 address and prefix. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- remotegw_ddns (Alias name: remotegw-ddns) Domain name of remote gateway. type: str
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- rsa_signature_format (Alias name: rsa-signature-format) Digital signature authentication rsa signature format. type: str choices: [pkcs1, pss]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- rsa_signature_hash_override (Alias name: rsa-signature-hash-override) Enable/disable ikev2 rsa signature hash algorithm override. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- save_password (Alias name: save-password) Enable/disable saving xauth username and password on vpn clients. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- send_cert_chain (Alias name: send-cert-chain) Enable/disable sending certificate chain. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- signature_hash_alg (Alias name: signature-hash-alg) Digital signature authentication hash algorithms. type: list choices: [sha1, sha2-256, sha2-384, sha2-512]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- split_include_service (Alias name: split-include-service) Split-include services. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- suite_b (Alias name: suite-b) Use suite-b. type: str choices: [disable, suite-b-gcm-128, suite-b-gcm-256]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- transit_gateway (Alias name: transit-gateway) Ipsec tunnel created by autoscaling to be used as a transit gateway. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- transport Set ike transport protocol. type: str choices: [udp, tcp, udp-fallback-tcp, auto]
more...
Supported Version Ranges: v7.4.3 -> latest
- type Remote gateway type. type: str choices: [static, dynamic, ddns]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- unity_support (Alias name: unity-support) Enable/disable support for cisco unity configuration method extensions. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- usrgrp User group name for dialup peers. type: list
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- vni Vni of vxlan tunnel. type: int
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- wizard_type (Alias name: wizard-type) Gui vpn wizard type. type: str choices: [custom, dialup-forticlient, dialup-ios, dialup-android, dialup-cisco, static-fortigate, static-cisco, dialup-windows, dialup-fortigate, dialup-cisco-fw, simplified-static-fortigate, hub-fortigate-auto-discovery, spoke-fortigate-auto-discovery, static-fortiproxy, dialup-fortiproxy, simplified-static-fortiproxy, hub-fortiproxy-auto-discovery, spoke-fortiproxy-auto-discovery, fabric-overlay-orchestrator]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- xauthtype Xauth type. type: str choices: [disable, client, pap, chap, auto]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- forticlient_enforcement (Alias name: forticlient-enforcement) Enable/disable forticlient enforcement. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- tunnel_search (Alias name: tunnel-search) Tunnel search method for when the interface is shared. type: str choices: [selectors, nexthop]
more...
Supported Version Ranges: v7.2.6 -> v7.2.12, v7.4.3 -> latest
- addke1 Addke1 group. type: list choices: [0, 1080, 1081, 1082, 1083, 1084, 1085, 1089, 1090, 1091, 1092, 1093, 1094, 35, 36, 37]
more...
Supported Version Ranges: v7.6.0 -> latest
- addke2 Addke2 group. type: list choices: [0, 1080, 1081, 1082, 1083, 1084, 1085, 1089, 1090, 1091, 1092, 1093, 1094, 35, 36, 37]
more...
Supported Version Ranges: v7.6.0 -> latest
- addke3 Addke3 group. type: list choices: [0, 1080, 1081, 1082, 1083, 1084, 1085, 1089, 1090, 1091, 1092, 1093, 1094, 35, 36, 37]
more...
Supported Version Ranges: v7.6.0 -> latest
- addke4 Addke4 group. type: list choices: [0, 1080, 1081, 1082, 1083, 1084, 1085, 1089, 1090, 1091, 1092, 1093, 1094, 35, 36, 37]
more...
Supported Version Ranges: v7.6.0 -> latest
- addke5 Addke5 group. type: list choices: [0, 1080, 1081, 1082, 1083, 1084, 1085, 1089, 1090, 1091, 1092, 1093, 1094, 35, 36, 37]
more...
Supported Version Ranges: v7.6.0 -> latest
- addke6 Addke6 group. type: list choices: [0, 1080, 1081, 1082, 1083, 1084, 1085, 1089, 1090, 1091, 1092, 1093, 1094, 35, 36, 37]
more...
Supported Version Ranges: v7.6.0 -> latest
- addke7 Addke7 group. type: list choices: [0, 1080, 1081, 1082, 1083, 1084, 1085, 1089, 1090, 1091, 1092, 1093, 1094, 35, 36, 37]
more...
Supported Version Ranges: v7.6.0 -> latest
- auto_transport_threshold (Alias name: auto-transport-threshold) Timeout in seconds before falling back to next transport protocol. type: int
more...
Supported Version Ranges: v7.6.0 -> latest
- ipv6_auto_linklocal (Alias name: ipv6-auto-linklocal) Enable/disable auto generation of ipv6 link-local address using last 8 bytes of mode-cfg assigned ipv6 address. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.6.0 -> latest
- remote_gw_ztna_tags (Alias name: remote-gw-ztna-tags) Ipv4 ztna posture tags. type: list
more...
Supported Version Ranges: v7.6.0 -> latest
- shared_idle_timeout (Alias name: shared-idle-timeout) Enable/disable ipsec tunnel shared idle timeout. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.6.0 -> latest
- auto_discovery_dialup_placeholder (Alias name: auto-discovery-dialup-placeholder) Control if this dynamic gateway is used for shortcut connections only. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.6.2 -> latest
- qkd_hybrid (Alias name: qkd-hybrid) Enable/disable use of quantum key distribution (qkd) hybrid keys. type: str choices: [disable, require, allow]
more...
Supported Version Ranges: v7.6.3 -> latest
- mobike Mobike. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.4.8 -> v7.4.10, v7.6.4 -> latest
- peer_egress_shaping (Alias name: peer-egress-shaping) Enable/disable peer egress shaping. type: str choices: [disable, enable]
more...
Supported Version Ranges: v7.6.4 -> latest
- dns_suffix_search (Alias name: dns-suffix-search) One or more dns domain name suffixes in quotes separated by spaces. type: list
more...
Supported Version Ranges: v7.6.4 -> latest
- peer_egress_shaping_value (Alias name: peer-egress-shaping-value) Configure outbound bandwidth to use for peer egress shaping in kbps (0 - 100000000, default = 0). type: int
more...
Supported Version Ranges: v7.6.4 -> latest
Notes
-----
.. note::
- Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.
- To create or update an object, use state: present directive.
- To delete an object, use state: absent directive
- Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded
Examples
--------
.. code-block:: yaml+jinja
- name: Example playbook (generated based on argument schema)
hosts: fortimanagers
connection: httpapi
gather_facts: false
vars:
ansible_httpapi_use_ssl: true
ansible_httpapi_validate_certs: false
ansible_httpapi_port: 443
tasks:
- name: Configure VPN remote gateway.
fortinet.fmgdevice.fmgd_vpn_ipsec_phase1interface:
# bypass_validation: false
# workspace_locking_adom:
# workspace_locking_timeout: 300
# rc_succeeded: [0, -2, -3, ...]
# rc_failed: [-2, -3, ...]
device:
vdom:
state: present #
vpn_ipsec_phase1interface:
name: "your value" # Required variable, string
# acct_verify:
# add_gw_route:
# add_route:
# aggregate_member:
# aggregate_weight:
# assign_ip:
# assign_ip_from:
# authmethod:
# authmethod_remote:
# authpasswd:
# authusr:
# authusrgrp:
# auto_discovery_crossover:
# auto_discovery_forwarder:
# auto_discovery_offer_interval:
# auto_discovery_psk:
# auto_discovery_receiver:
# auto_discovery_sender:
# auto_discovery_shortcuts:
# auto_negotiate:
# azure_ad_autoconnect:
# backup_gateway:
# banner:
# cert_id_validation:
# cert_peer_username_strip:
# cert_peer_username_validation:
# cert_trust_store:
# certificate:
# childless_ike:
# client_auto_negotiate:
# client_keep_alive:
# client_resume:
# client_resume_interval:
# comments:
# default_gw:
# default_gw_priority:
# dev_id:
# dev_id_notification:
# dhcp_ra_giaddr:
# dhcp6_ra_linkaddr:
# dhgrp:
# - "1"
# - "2"
# - "5"
# - "14"
# - "15"
# - "16"
# - "17"
# - "18"
# - "19"
# - "20"
# - "21"
# - "27"
# - "28"
# - "29"
# - "30"
# - "31"
# - "32"
# digital_signature_auth:
# distance:
# dns_mode:
# domain:
# dpd:
# dpd_retrycount:
# dpd_retryinterval:
# eap:
# eap_cert_auth:
# eap_exclude_peergrp:
# eap_identity:
# ems_sn_check:
# encap_local_gw4:
# encap_local_gw6:
# encap_remote_gw4:
# encap_remote_gw6:
# encapsulation:
# encapsulation_address:
# enforce_unique_id:
# esn:
# exchange_fgt_device_id:
# exchange_interface_ip:
# exchange_ip_addr4:
# exchange_ip_addr6:
# fallback_tcp_threshold:
# fec_base:
# fec_codec:
# fec_egress:
# fec_health_check:
# fec_ingress:
# fec_mapping_profile:
# fec_receive_timeout:
# fec_redundant:
# fec_send_timeout:
# fgsp_sync:
# fortinet_esp:
# fragmentation:
# fragmentation_mtu:
# group_authentication:
# group_authentication_secret:
# ha_sync_esp_seqno:
# idle_timeout:
# idle_timeoutinterval:
# ike_version:
# inbound_dscp_copy:
# include_local_lan:
# interface:
# internal_domain_list:
# ip_delay_interval:
# ip_fragmentation:
# ip_version:
# ipsec_tunnel_slot:
# ipv4_dns_server1:
# ipv4_dns_server2:
# ipv4_dns_server3:
# ipv4_end_ip:
# ipv4_exclude_range:
# - end_ip:
# id:
# start_ip:
# ipv4_name:
# ipv4_netmask:
# ipv4_split_exclude:
# ipv4_split_include:
# ipv4_start_ip:
# ipv4_wins_server1:
# ipv4_wins_server2:
# ipv6_dns_server1:
# ipv6_dns_server2:
# ipv6_dns_server3:
# ipv6_end_ip:
# ipv6_exclude_range:
# - end_ip:
# id:
# start_ip:
# ipv6_name:
# ipv6_prefix:
# ipv6_split_exclude:
# ipv6_split_include:
# ipv6_start_ip:
# keepalive:
# keylife:
# kms:
# link_cost:
# local_gw:
# local_gw6:
# localid:
# localid_type:
# loopback_asymroute:
# mesh_selector_type:
# mode:
# mode_cfg:
# mode_cfg_allow_client_selector:
# monitor:
# monitor_hold_down_delay:
# monitor_hold_down_time:
# monitor_hold_down_type:
# monitor_hold_down_weekday:
# monitor_min:
# nattraversal:
# negotiate_timeout:
# net_device:
# network_id:
# network_overlay:
# npu_offload:
# packet_redistribution:
# passive_mode:
# peer:
# peergrp:
# peerid:
# peertype:
# ppk:
# ppk_identity:
# ppk_secret:
# priority:
# proposal:
# psksecret:
# psksecret_remote:
# qkd:
# qkd_profile:
# reauth:
# rekey:
# remote_gw:
# remote_gw_country:
# remote_gw_end_ip:
# remote_gw_match:
# remote_gw_start_ip:
# remote_gw_subnet:
# remote_gw6:
# remote_gw6_country:
# remote_gw6_end_ip:
# remote_gw6_match:
# remote_gw6_start_ip:
# remote_gw6_subnet:
# remotegw_ddns:
# rsa_signature_format:
# rsa_signature_hash_override:
# save_password:
# send_cert_chain:
# signature_hash_alg:
# - "sha1"
# - "sha2-256"
# - "sha2-384"
# - "sha2-512"
# split_include_service:
# suite_b:
# transit_gateway:
# transport:
# type:
# unity_support:
# usrgrp:
# vni:
# wizard_type:
# xauthtype:
# forticlient_enforcement:
# tunnel_search:
# addke1:
# - "0"
# - "1080"
# - "1081"
# - "1082"
# - "1083"
# - "1084"
# - "1085"
# - "1089"
# - "1090"
# - "1091"
# - "1092"
# - "1093"
# - "1094"
# - "35"
# - "36"
# - "37"
# addke2:
# - "0"
# - "1080"
# - "1081"
# - "1082"
# - "1083"
# - "1084"
# - "1085"
# - "1089"
# - "1090"
# - "1091"
# - "1092"
# - "1093"
# - "1094"
# - "35"
# - "36"
# - "37"
# addke3:
# - "0"
# - "1080"
# - "1081"
# - "1082"
# - "1083"
# - "1084"
# - "1085"
# - "1089"
# - "1090"
# - "1091"
# - "1092"
# - "1093"
# - "1094"
# - "35"
# - "36"
# - "37"
# addke4:
# - "0"
# - "1080"
# - "1081"
# - "1082"
# - "1083"
# - "1084"
# - "1085"
# - "1089"
# - "1090"
# - "1091"
# - "1092"
# - "1093"
# - "1094"
# - "35"
# - "36"
# - "37"
# addke5:
# - "0"
# - "1080"
# - "1081"
# - "1082"
# - "1083"
# - "1084"
# - "1085"
# - "1089"
# - "1090"
# - "1091"
# - "1092"
# - "1093"
# - "1094"
# - "35"
# - "36"
# - "37"
# addke6:
# - "0"
# - "1080"
# - "1081"
# - "1082"
# - "1083"
# - "1084"
# - "1085"
# - "1089"
# - "1090"
# - "1091"
# - "1092"
# - "1093"
# - "1094"
# - "35"
# - "36"
# - "37"
# addke7:
# - "0"
# - "1080"
# - "1081"
# - "1082"
# - "1083"
# - "1084"
# - "1085"
# - "1089"
# - "1090"
# - "1091"
# - "1092"
# - "1093"
# - "1094"
# - "35"
# - "36"
# - "37"
# auto_transport_threshold:
# ipv6_auto_linklocal:
# remote_gw_ztna_tags:
# shared_idle_timeout:
# auto_discovery_dialup_placeholder:
# qkd_hybrid:
# mobike:
# peer_egress_shaping:
# dns_suffix_search:
# peer_egress_shaping_value:
Return Values
-------------
Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:
.. raw:: html
- meta - The result of the request.returned: always type: dict
- request_url - The full url requested. returned: always type: str sample: /sys/login/user
- response_code - The status of api request. returned: always type: int sample: 0
- response_data - The data body of the api response. returned: optional type: list or dict
- response_message - The descriptive message of the api response. returned: always type: str sample: OK
- system_information - The information of the target system. returned: always type: dict
- rc - The status the request. returned: always type: int sample: 0
- version_check_warning - Warning if the parameters used in the playbook are not supported by the current FortiManager version. returned: if at least one parameter not supported by the current FortiManager version type: list
Status
------
- This module is not guaranteed to have a backwards compatible interface.
Authors
-------
- Xinwei Du (@dux-fortinet)
- Xing Li (@lix-fortinet)
- Jie Xue (@JieX19)
- Link Zheng (@chillancezen)
- Frank Shen (@fshen01)
- Hongbin Lu (@fgtdev-hblu)