fortios_firewall_profile_protocol_options – Configure protocol options in Fortinet’s FortiOS and FortiGate.¶

New in version 2.8.

Synopsis
Requirements
Parameters
Notes
Examples
Return Values
Status
Authors

Synopsis ¶

This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify firewall feature and profile_protocol_options category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.4.0

Requirements ¶

The below requirements are needed on the host that executes this module.

ansible>=2.9.0

Parameters ¶

access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: False
vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
state - Indicates whether to create or remove the object. This attribute was present already in previous version in a deeper level. It has been moved out to this outer level. type: str required: False choices: present, absent
firewall_profile_protocol_options - Configure protocol options. type: dict

state - B(Deprecated) type: str required: False choices: present, absent
cifs - Configure CIFS protocol options. type: dict

options - One or more options that can be applied to the session. type: str choices: oversize
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
tcp_window_maximum - Maximum dynamic TCP window size . type: int
tcp_window_minimum - Minimum dynamic TCP window size . type: int
tcp_window_size - Set TCP static window size . type: int
tcp_window_type - Specify type of TCP window to use for this protocol. type: str choices: system, static, dynamic
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

comment - Optional comments. type: str
dns - Configure DNS protocol options. type: dict

ports - Ports to scan for content (1 - 65535). type: int
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable

feature_set - Flow/proxy feature set. type: str choices: flow, proxy
ftp - Configure FTP protocol options. type: dict

comfort_amount - Amount of data to send in a transmission for client comforting (1 - 65535 bytes). type: int
comfort_interval - Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec). type: int
inspect_all - Enable/disable the inspection of all ports for the protocol. type: str choices: enable, disable
options - One or more options that can be applied to the session. type: str choices: clientcomfort, oversize, splice, bypass-rest-command, bypass-mode-command
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
ssl_offloaded - SSL decryption and encryption performed by an external device. type: str choices: False, True
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

http - Configure HTTP protocol options. type: dict

block_page_status_code - Code number returned for blocked HTTP pages (non-FortiGuard only) (100 - 599). type: int
comfort_amount - Amount of data to send in a transmission for client comforting (1 - 65535 bytes). type: int
comfort_interval - Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec). type: int
fortinet_bar - Enable/disable Fortinet bar on HTML content. type: str choices: enable, disable
fortinet_bar_port - Port for use by Fortinet Bar (1 - 65535). type: int
inspect_all - Enable/disable the inspection of all ports for the protocol. type: str choices: enable, disable
options - One or more options that can be applied to the session. type: str choices: clientcomfort, servercomfort, oversize, chunkedbypass
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
post_lang - ID codes for character sets to be used to convert to UTF-8 for banned words and DLP on HTTP posts (maximum of 5 character sets). type: str choices: jisx0201, jisx0208, jisx0212, gb2312, ksc5601-ex, euc-jp, sjis, iso2022-jp, iso2022-jp-1, iso2022-jp-2, euc-cn, ces-gbk, hz, ces-big5, euc-kr, iso2022-jp-3, iso8859-1, tis620, cp874, cp1252, cp1251
proxy_after_tcp_handshake - Proxy traffic after the TCP 3-way handshake has been established (not before). type: str choices: enable, disable
range_block - Enable/disable blocking of partial downloads. type: str choices: disable, enable
retry_count - Number of attempts to retry HTTP connection (0 - 100). type: int
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
ssl_offloaded - SSL decryption and encryption performed by an external device. type: str choices: False, True
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
stream_based_uncompressed_limit - Maximum stream-based uncompressed data size that will be scanned (MB, 0 = unlimited (default). Stream-based uncompression used only under certain conditions.). type: int
streaming_content_bypass - Enable/disable bypassing of streaming content from buffering. type: str choices: enable, disable
strip_x_forwarded_for - Enable/disable stripping of HTTP X-Forwarded-For header. type: str choices: disable, enable
switching_protocols - Bypass from scanning, or block a connection that attempts to switch protocol. type: str choices: bypass, block
tcp_window_maximum - Maximum dynamic TCP window size . type: int
tcp_window_minimum - Minimum dynamic TCP window size . type: int
tcp_window_size - Set TCP static window size . type: int
tcp_window_type - Specify type of TCP window to use for this protocol. type: str choices: system, static, dynamic
tunnel_non_http - Configure how to process non-HTTP traffic when a profile configured for HTTP traffic accepts a non-HTTP session. Can occur if an application sends non-HTTP traffic using an HTTP destination port. type: str choices: enable, disable
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int
unknown_http_version - How to handle HTTP sessions that do not comply with HTTP 0.9, 1.0, or 1.1. type: str choices: reject, tunnel, best-effort

imap - Configure IMAP protocol options. type: dict

inspect_all - Enable/disable the inspection of all ports for the protocol. type: str choices: enable, disable
options - One or more options that can be applied to the session. type: str choices: fragmail, oversize
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
proxy_after_tcp_handshake - Proxy traffic after the TCP 3-way handshake has been established (not before). type: str choices: enable, disable
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
ssl_offloaded - SSL decryption and encryption performed by an external device. type: str choices: False, True
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

mail_signature - Configure Mail signature. type: dict

signature - Email signature to be added to outgoing email (if the signature contains spaces, enclose with quotation marks). type: str
status - Enable/disable adding an email signature to SMTP email messages as they pass through the FortiGate. type: str choices: disable, enable

mapi - Configure MAPI protocol options. type: dict

options - One or more options that can be applied to the session. type: str choices: fragmail, oversize
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

name - Name. type: str required: True
nntp - Configure NNTP protocol options. type: dict

inspect_all - Enable/disable the inspection of all ports for the protocol. type: str choices: enable, disable
options - One or more options that can be applied to the session. type: str choices: oversize, splice
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
proxy_after_tcp_handshake - Proxy traffic after the TCP 3-way handshake has been established (not before). type: str choices: enable, disable
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

oversize_log - Enable/disable logging for antivirus oversize file blocking. type: str choices: disable, enable
pop3 - Configure POP3 protocol options. type: dict

inspect_all - Enable/disable the inspection of all ports for the protocol. type: str choices: enable, disable
options - One or more options that can be applied to the session. type: str choices: fragmail, oversize
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
proxy_after_tcp_handshake - Proxy traffic after the TCP 3-way handshake has been established (not before). type: str choices: enable, disable
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
ssl_offloaded - SSL decryption and encryption performed by an external device. type: str choices: False, True
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

replacemsg_group - Name of the replacement message group to be used Source system.replacemsg-group.name. type: str
rpc_over_http - Enable/disable inspection of RPC over HTTP. type: str choices: enable, disable
smtp - Configure SMTP protocol options. type: dict

inspect_all - Enable/disable the inspection of all ports for the protocol. type: str choices: enable, disable
options - One or more options that can be applied to the session. type: str choices: fragmail, oversize, splice
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
proxy_after_tcp_handshake - Proxy traffic after the TCP 3-way handshake has been established (not before). type: str choices: enable, disable
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
server_busy - Enable/disable SMTP server busy when server not available. type: str choices: enable, disable
ssl_offloaded - SSL decryption and encryption performed by an external device. type: str choices: False, True
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

ssh - Configure SFTP and SCP protocol options. type: dict

comfort_amount - Amount of data to send in a transmission for client comforting (1 - 65535 bytes). type: int
comfort_interval - Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec). type: int
options - One or more options that can be applied to the session. type: str choices: oversize, clientcomfort, servercomfort
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

switching_protocols_log - Enable/disable logging for HTTP/HTTPS switching protocols. type: str choices: disable, enable

Notes ¶

Note

Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks

Examples ¶

- hosts: fortigates
  collections:
    - fortinet.fortios
  connection: httpapi
  vars:
   vdom: "root"
   ansible_httpapi_use_ssl: yes
   ansible_httpapi_validate_certs: no
   ansible_httpapi_port: 443
  tasks:
  - name: Configure protocol options.
    fortios_firewall_profile_protocol_options:
      vdom:  "{{ vdom }}"
      state: "present"
      access_token: "<your_own_value>"
      firewall_profile_protocol_options:
        cifs:
            options: "oversize"
            oversize_limit: "5"
            ports: "6"
            scan_bzip2: "enable"
            status: "enable"
            tcp_window_maximum: "9"
            tcp_window_minimum: "10"
            tcp_window_size: "11"
            tcp_window_type: "system"
            uncompressed_nest_limit: "13"
            uncompressed_oversize_limit: "14"
        comment: "Optional comments."
        dns:
            ports: "17"
            status: "enable"
        feature_set: "flow"
        ftp:
            comfort_amount: "21"
            comfort_interval: "22"
            inspect_all: "enable"
            options: "clientcomfort"
            oversize_limit: "25"
            ports: "26"
            scan_bzip2: "enable"
            ssl_offloaded: "no"
            status: "enable"
            uncompressed_nest_limit: "30"
            uncompressed_oversize_limit: "31"
        http:
            block_page_status_code: "33"
            comfort_amount: "34"
            comfort_interval: "35"
            fortinet_bar: "enable"
            fortinet_bar_port: "37"
            inspect_all: "enable"
            options: "clientcomfort"
            oversize_limit: "40"
            ports: "41"
            post_lang: "jisx0201"
            proxy_after_tcp_handshake: "enable"
            range_block: "disable"
            retry_count: "45"
            scan_bzip2: "enable"
            ssl_offloaded: "no"
            status: "enable"
            stream_based_uncompressed_limit: "49"
            streaming_content_bypass: "enable"
            strip_x_forwarded_for: "disable"
            switching_protocols: "bypass"
            tcp_window_maximum: "53"
            tcp_window_minimum: "54"
            tcp_window_size: "55"
            tcp_window_type: "system"
            tunnel_non_http: "enable"
            uncompressed_nest_limit: "58"
            uncompressed_oversize_limit: "59"
            unknown_http_version: "reject"
        imap:
            inspect_all: "enable"
            options: "fragmail"
            oversize_limit: "64"
            ports: "65"
            proxy_after_tcp_handshake: "enable"
            scan_bzip2: "enable"
            ssl_offloaded: "no"
            status: "enable"
            uncompressed_nest_limit: "70"
            uncompressed_oversize_limit: "71"
        mail_signature:
            signature: "<your_own_value>"
            status: "disable"
        mapi:
            options: "fragmail"
            oversize_limit: "77"
            ports: "78"
            scan_bzip2: "enable"
            status: "enable"
            uncompressed_nest_limit: "81"
            uncompressed_oversize_limit: "82"
        name: "default_name_83"
        nntp:
            inspect_all: "enable"
            options: "oversize"
            oversize_limit: "87"
            ports: "88"
            proxy_after_tcp_handshake: "enable"
            scan_bzip2: "enable"
            status: "enable"
            uncompressed_nest_limit: "92"
            uncompressed_oversize_limit: "93"
        oversize_log: "disable"
        pop3:
            inspect_all: "enable"
            options: "fragmail"
            oversize_limit: "98"
            ports: "99"
            proxy_after_tcp_handshake: "enable"
            scan_bzip2: "enable"
            ssl_offloaded: "no"
            status: "enable"
            uncompressed_nest_limit: "104"
            uncompressed_oversize_limit: "105"
        replacemsg_group: "<your_own_value> (source system.replacemsg-group.name)"
        rpc_over_http: "enable"
        smtp:
            inspect_all: "enable"
            options: "fragmail"
            oversize_limit: "111"
            ports: "112"
            proxy_after_tcp_handshake: "enable"
            scan_bzip2: "enable"
            server_busy: "enable"
            ssl_offloaded: "no"
            status: "enable"
            uncompressed_nest_limit: "118"
            uncompressed_oversize_limit: "119"
        ssh:
            comfort_amount: "121"
            comfort_interval: "122"
            options: "oversize"
            oversize_limit: "124"
            scan_bzip2: "enable"
            uncompressed_nest_limit: "126"
            uncompressed_oversize_limit: "127"
        switching_protocols_log: "disable"

Return Values ¶

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

build - Build number of the fortigate image returned: always type: str sample: 1547
http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
revision - Internal revision number returned: always type: str sample: 17.0.2.10658
serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
status - Indication of the operation's result returned: always type: str sample: success
vdom - Virtual domain used returned: always type: str sample: root
version - Version of the FortiGate returned: always type: str sample: v5.6.3

Status ¶

This module is not guaranteed to have a backwards compatible interface.

Authors ¶

Link Zheng (@chillancezen)
Jie Xue (@JieX19)
Hongbin Lu (@fgtdev-hblu)
Frank Shen (@frankshen01)
Miguel Angel Munoz (@mamunozgonzalez)
Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation, you can create a pull request to improve it.