fortios_system_virtual_wan_link – Configure redundant internet connections using SD-WAN (formerly virtual WAN link) in Fortinet’s FortiOS and FortiGate.¶
New in version 2.8.
Synopsis¶
- This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify system feature and virtual_wan_link category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.4.0
Requirements¶
The below requirements are needed on the host that executes this module.
- ansible>=2.9.0
Parameters¶
- host - FortiOS or FortiGate IP address. type: str required: False
- username - FortiOS or FortiGate username. type: str required: False
- password - FortiOS or FortiGate password. type: str default:
- vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
- https - Indicates if the requests towards FortiGate must use HTTPS protocol. type: bool default: True
- ssl_verify - Ensures FortiGate certificate must be verified by a proper CA. type: bool default: True
- system_virtual_wan_link - Configure redundant internet connections using SD-WAN (formerly virtual WAN link). type: dict
- fail_alert_interfaces - Physical interfaces that will be alerted. type: list
- name - Physical interface name. Source system.interface.name. type: str required: True
- fail_detect - Enable/disable SD-WAN Internet connection status checking (failure detection). type: str choices: enable, disable
- health_check - SD-WAN status checking or health checking. Identify a server on the Internet and determine how SD-WAN verifies that the FortiGate can communicate with it. type: list
- addr_mode - Address mode (IPv4 or IPv6). type: str choices: ipv4, ipv6
- diffservcode - Differentiated services code point (DSCP) in the IP header of the probe packet. type: str
- dns_request_domain - Fully qualified domain name to resolve for the DNS probe. type: str
- failtime - Number of failures before server is considered lost (1 - 3600). type: int
- ha_priority - HA election priority (1 - 50). type: int
- http_agent - String in the http-agent field in the HTTP header. type: str
- http_get - URL used to communicate with the server if the protocol if the protocol is HTTP. type: str
- http_match - Response string expected from the server if the protocol is HTTP. type: str
- interval - Status check interval in milliseconds, or the time between attempting to connect to the server (500 - 3600*1000 msec). type: int
- members - Member sequence number list. type: list
- seq_num - Member sequence number. Source system.virtual-wan-link.members.seq-num. type: int
- name - Status check or health check name. type: str required: True
- packet_size - Packet size of a twamp test session, type: int
- password - Twamp controller password in authentication mode type: str
- port - Port number used to communicate with the server over the selected protocol. type: int
- probe_count - Number of most recent probes that should be used to calculate latency and jitter (5 - 30). type: int
- probe_packets - Enable/disable transmission of probe packets. type: str choices: disable, enable
- probe_timeout - Time to wait before a probe packet is considered lost (500 - 5000 msec). type: int
- protocol - Protocol used to determine if the FortiGate can communicate with the server. type: str choices: ping, tcp-echo, udp-echo, http, twamp, ping6, dns
- recoverytime - Number of successful responses received before server is considered recovered (1 - 3600). type: int
- security_mode - Twamp controller security mode. type: str choices: none, authentication
- server - IP address or FQDN name of the server. type: str
- sla - Service level agreement (SLA). type: list
- id - SLA ID. type: int required: True
- jitter_threshold - Jitter for SLA to make decision in milliseconds. (0 - 10000000). type: int
- latency_threshold - Latency for SLA to make decision in milliseconds. (0 - 10000000). type: int
- link_cost_factor - Criteria on which to base link selection. type: str choices: latency, jitter, packet-loss
- packetloss_threshold - Packet loss for SLA to make decision in percentage. (0 - 100). type: int
- sla_fail_log_period - Time interval in seconds that SLA fail log messages will be generated (0 - 3600). type: int
- sla_pass_log_period - Time interval in seconds that SLA pass log messages will be generated (0 - 3600). type: int
- system_dns - Enable/disable system DNS as the probe server. type: str choices: disable, enable
- threshold_alert_jitter - Alert threshold for jitter (ms). type: int
- threshold_alert_latency - Alert threshold for latency (ms). type: int
- threshold_alert_packetloss - Alert threshold for packet loss (percentage). type: int
- threshold_warning_jitter - Warning threshold for jitter (ms). type: int
- threshold_warning_latency - Warning threshold for latency (ms). type: int
- threshold_warning_packetloss - Warning threshold for packet loss (percentage). type: int
- update_cascade_interface - Enable/disable update cascade interface. type: str choices: enable, disable
- update_static_route - Enable/disable updating the static route. type: str choices: enable, disable
- load_balance_mode - Algorithm or mode to use for load balancing Internet traffic to SD-WAN members. type: str choices: source-ip-based, weight-based, usage-based, source-dest-ip-based, measured-volume-based
- members - FortiGate interfaces added to the virtual-wan-link. type: list
- comment - Comments. type: str
- cost - Cost of this interface for services in SLA mode (0 - 4294967295). type: int
- gateway - The default gateway for this interface. Usually the default gateway of the Internet service provider that this interface is connected to. type: str
- gateway6 - IPv6 gateway. type: str
- ingress_spillover_threshold - Ingress spillover threshold for this interface (0 - 16776000 kbit/s). When this traffic volume threshold is reached, new sessions spill over to other interfaces in the SD-WAN. type: int
- interface - Interface name. Source system.interface.name. type: str
- priority - Priority of the interface (0 - 4294967295). Used for SD-WAN rules or priority rules. type: int
- seq_num - Sequence number(1-255). type: int
- source - Source IP address used in the health-check packet to the server. type: str
- source6 - Source IPv6 address used in the health-check packet to the server. type: str
- spillover_threshold - Egress spillover threshold for this interface (0 - 16776000 kbit/s). When this traffic volume threshold is reached, new sessions spill over to other interfaces in the SD-WAN. type: int
- status - Enable/disable this interface in the SD-WAN. type: str choices: disable, enable
- volume_ratio - Measured volume ratio (this value / sum of all values = percentage of link volume, 1 - 255). type: int
- weight - Weight of this interface for weighted load balancing. (1 - 255) More traffic is directed to interfaces with higher weights. type: int
- neighbor - Create SD-WAN neighbor from BGP neighbor table to control route advertisements according to SLA status. type: list
- health_check - SD-WAN health-check name. Source system.virtual-wan-link.health-check.name. type: str
- ip - IP/IPv6 address of neighbor. Source router.bgp.neighbor.ip. type: str required: True
- member - Member sequence number. Source system.virtual-wan-link.members.seq-num. type: int
- role - Role of neighbor. type: str choices: standalone, primary, secondary
- sla_id - SLA ID. type: int
- neighbor_hold_boot_time - Waiting period in seconds when switching from the primary neighbor to the secondary neighbor from the neighbor start. (0 - 10000000). type: int
- neighbor_hold_down - Enable/disable hold switching from the secondary neighbor to the primary neighbor. type: str choices: enable, disable
- neighbor_hold_down_time - Waiting period in seconds when switching from the secondary neighbor to the primary neighbor when hold-down is disabled. (0 - 10000000). type: int
- service - Create SD-WAN rules (also called services) to control how sessions are distributed to interfaces in the SD-WAN. type: list
- addr_mode - Address mode (IPv4 or IPv6). type: str choices: ipv4, ipv6
- bandwidth_weight - Coefficient of reciprocal of available bidirectional bandwidth in the formula of custom-profile-1. type: int
- default - Enable/disable use of SD-WAN as default service. type: str choices: enable, disable
- dscp_forward - Enable/disable forward traffic DSCP tag. type: str choices: enable, disable
- dscp_forward_tag - Forward traffic DSCP tag. type: str
- dscp_reverse - Enable/disable reverse traffic DSCP tag. type: str choices: enable, disable
- dscp_reverse_tag - Reverse traffic DSCP tag. type: str
- dst - Destination address name. type: list
- name - Address or address group name. Source firewall.address.name firewall.addrgrp.name. type: str required: True
- dst_negate - Enable/disable negation of destination address match. type: str choices: enable, disable
- dst6 - Destination address6 name. type: list
- name - Address6 or address6 group name. Source firewall.address6.name firewall.addrgrp6.name. type: str required: True
- end_port - End destination port number. type: int
- gateway - Enable/disable SD-WAN service gateway. type: str choices: enable, disable
- groups - User groups. type: list
- name - Group name. Source user.group.name. type: str required: True
- health_check - Health check list. type: list
- name - Health check name. Source system.virtual-wan-link.health-check.name. type: str required: True
- hold_down_time - Waiting period in seconds when switching from the back-up member to the primary member (0 - 10000000). type: int
- id - Priority rule ID (1 - 4000). type: int required: True
- input_device - Source interface name. type: list
- name - Interface name. Source system.interface.name. type: str required: True
- input_device_negate - Enable/disable negation of input device match. type: str choices: enable, disable
- internet_service - Enable/disable use of Internet service for application-based load balancing. type: str choices: enable, disable
- internet_service_app_ctrl - Application control based Internet Service ID list. type: list
- id - Application control based Internet Service ID. type: int required: True
- internet_service_app_ctrl_group - Application control based Internet Service group list. type: list
- name - Application control based Internet Service group name. Source application.group.name. type: str required: True
- internet_service_custom - Custom Internet service name list. type: list
- name - Custom Internet service name. Source firewall.internet-service-custom.name. type: str required: True
- internet_service_custom_group - Custom Internet Service group list. type: list
- name - Custom Internet Service group name. Source firewall.internet-service-custom-group.name. type: str required: True
- internet_service_group - Internet Service group list. type: list
- name - Internet Service group name. Source firewall.internet-service-group.name. type: str required: True
- internet_service_name - Internet service name list. type: list
- name - Internet service name. Source firewall.internet-service-name.name. type: str required: True
- jitter_weight - Coefficient of jitter in the formula of custom-profile-1. type: int
- latency_weight - Coefficient of latency in the formula of custom-profile-1. type: int
- link_cost_factor - Link cost factor. type: str choices: latency, jitter, packet-loss, inbandwidth, outbandwidth, bibandwidth, custom-profile-1
- link_cost_threshold - Percentage threshold change of link cost values that will result in policy route regeneration (0 - 10000000). type: int
- mode - Control how the priority rule sets the priority of interfaces in the SD-WAN. type: str choices: auto, manual, priority, sla, load-balance
- name - Priority rule name. type: str
- packet_loss_weight - Coefficient of packet-loss in the formula of custom-profile-1. type: int
- priority_members - Member sequence number list. type: list
- seq_num - Member sequence number. Source system.virtual-wan-link.members.seq-num. type: int
- protocol - Protocol number. type: int
- quality_link - Quality grade. type: int
- role - Service role to work with neighbor. type: str choices: standalone, primary, secondary
- route_tag - IPv4 route map route-tag. type: int
- sla - Service level agreement (SLA). type: list
- health_check - Virtual WAN Link health-check. Source system.virtual-wan-link.health-check.name. type: str
- id - SLA ID. type: int
- sla_compare_method - Method to compare SLA value for SLA mode. type: str choices: order, number
- src - Source address name. type: list
- name - Address or address group name. Source firewall.address.name firewall.addrgrp.name. type: str required: True
- src_negate - Enable/disable negation of source address match. type: str choices: enable, disable
- src6 - Source address6 name. type: list
- name - Address6 or address6 group name. Source firewall.address6.name firewall.addrgrp6.name. type: str required: True
- standalone_action - Enable/disable service when selected neighbor role is standalone while service role is not standalone. type: str choices: enable, disable
- start_port - Start destination port number. type: int
- status - Enable/disable SD-WAN service. type: str choices: enable, disable
- tos - Type of service bit pattern. type: str
- tos_mask - Type of service evaluated bits. type: str
- users - User name. type: list
- name - User name. Source user.local.name. type: str required: True
- status - Enable/disable SD-WAN. type: str choices: disable, enable
Examples¶
- hosts: fortigates
collections:
- fortinet.fortios
connection: httpapi
vars:
vdom: "root"
ansible_httpapi_use_ssl: yes
ansible_httpapi_validate_certs: no
ansible_httpapi_port: 443
tasks:
- name: Configure redundant internet connections using SD-WAN (formerly virtual WAN link).
fortios_system_virtual_wan_link:
vdom: "{{ vdom }}"
system_virtual_wan_link:
fail_alert_interfaces:
-
name: "default_name_4 (source system.interface.name)"
fail_detect: "enable"
health_check:
-
addr_mode: "ipv4"
diffservcode: "<your_own_value>"
dns_request_domain: "<your_own_value>"
failtime: "10"
ha_priority: "11"
http_agent: "<your_own_value>"
http_get: "<your_own_value>"
http_match: "<your_own_value>"
interval: "15"
members:
-
seq_num: "17 (source system.virtual-wan-link.members.seq-num)"
name: "default_name_18"
packet_size: "19"
password: "<your_own_value>"
port: "21"
probe_count: "22"
probe_packets: "disable"
probe_timeout: "24"
protocol: "ping"
recoverytime: "26"
security_mode: "none"
server: "192.168.100.40"
sla:
-
id: "30"
jitter_threshold: "31"
latency_threshold: "32"
link_cost_factor: "latency"
packetloss_threshold: "34"
sla_fail_log_period: "35"
sla_pass_log_period: "36"
system_dns: "disable"
threshold_alert_jitter: "38"
threshold_alert_latency: "39"
threshold_alert_packetloss: "40"
threshold_warning_jitter: "41"
threshold_warning_latency: "42"
threshold_warning_packetloss: "43"
update_cascade_interface: "enable"
update_static_route: "enable"
load_balance_mode: "source-ip-based"
members:
-
comment: "Comments."
cost: "49"
gateway: "<your_own_value>"
gateway6: "<your_own_value>"
ingress_spillover_threshold: "52"
interface: "<your_own_value> (source system.interface.name)"
priority: "54"
seq_num: "55"
source: "<your_own_value>"
source6: "<your_own_value>"
spillover_threshold: "58"
status: "disable"
volume_ratio: "60"
weight: "61"
neighbor:
-
health_check: "<your_own_value> (source system.virtual-wan-link.health-check.name)"
ip: "<your_own_value> (source router.bgp.neighbor.ip)"
member: "65 (source system.virtual-wan-link.members.seq-num)"
role: "standalone"
sla_id: "67"
neighbor_hold_boot_time: "68"
neighbor_hold_down: "enable"
neighbor_hold_down_time: "70"
service:
-
addr_mode: "ipv4"
bandwidth_weight: "73"
default: "enable"
dscp_forward: "enable"
dscp_forward_tag: "<your_own_value>"
dscp_reverse: "enable"
dscp_reverse_tag: "<your_own_value>"
dst:
-
name: "default_name_80 (source firewall.address.name firewall.addrgrp.name)"
dst_negate: "enable"
dst6:
-
name: "default_name_83 (source firewall.address6.name firewall.addrgrp6.name)"
end_port: "84"
gateway: "enable"
groups:
-
name: "default_name_87 (source user.group.name)"
health_check:
-
name: "default_name_89 (source system.virtual-wan-link.health-check.name)"
hold_down_time: "90"
id: "91"
input_device:
-
name: "default_name_93 (source system.interface.name)"
input_device_negate: "enable"
internet_service: "enable"
internet_service_app_ctrl:
-
id: "97"
internet_service_app_ctrl_group:
-
name: "default_name_99 (source application.group.name)"
internet_service_custom:
-
name: "default_name_101 (source firewall.internet-service-custom.name)"
internet_service_custom_group:
-
name: "default_name_103 (source firewall.internet-service-custom-group.name)"
internet_service_group:
-
name: "default_name_105 (source firewall.internet-service-group.name)"
internet_service_name:
-
name: "default_name_107 (source firewall.internet-service-name.name)"
jitter_weight: "108"
latency_weight: "109"
link_cost_factor: "latency"
link_cost_threshold: "111"
mode: "auto"
name: "default_name_113"
packet_loss_weight: "114"
priority_members:
-
seq_num: "116 (source system.virtual-wan-link.members.seq-num)"
protocol: "117"
quality_link: "118"
role: "standalone"
route_tag: "120"
sla:
-
health_check: "<your_own_value> (source system.virtual-wan-link.health-check.name)"
id: "123"
sla_compare_method: "order"
src:
-
name: "default_name_126 (source firewall.address.name firewall.addrgrp.name)"
src_negate: "enable"
src6:
-
name: "default_name_129 (source firewall.address6.name firewall.addrgrp6.name)"
standalone_action: "enable"
start_port: "131"
status: "enable"
tos: "<your_own_value>"
tos_mask: "<your_own_value>"
users:
-
name: "default_name_136 (source user.local.name)"
status: "disable"
Return Values¶
Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:
- build - Build number of the fortigate image returned: always type: str sample: 1547
- http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
- http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
- mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
- name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
- path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
- revision - Internal revision number returned: always type: str sample: 17.0.2.10658
- serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
- status - Indication of the operation's result returned: always type: str sample: success
- vdom - Virtual domain used returned: always type: str sample: root
- version - Version of the FortiGate returned: always type: str sample: v5.6.3