fortios_antivirus_profile – Configure AntiVirus profiles in Fortinet’s FortiOS and FortiGate.¶
New in version 2.8.
Synopsis¶
- This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify antivirus feature and profile category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0
Requirements¶
The below requirements are needed on the host that executes this module.
- ansible>=2.9.0
Parameters¶
- access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: False
- vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
- state - Indicates whether to create or remove the object. This attribute was present already in previous version in a deeper level. It has been moved out to this outer level. type: str required: False choices: present, absent
- antivirus_profile - Configure AntiVirus profiles. type: dict
- state - B(Deprecated) type: str required: False choices: present, absent
- analytics_bl_filetype - Only submit files matching this DLP file-pattern to FortiSandbox. Source dlp.filepattern.id. type: int
- analytics_db - Enable/disable using the FortiSandbox signature database to supplement the AV signature databases. type: str choices: disable, enable
- analytics_max_upload - Maximum size of files that can be uploaded to FortiSandbox (1 - 395 MBytes). type: int
- analytics_wl_filetype - Do not submit files matching this DLP file-pattern to FortiSandbox. Source dlp.filepattern.id. type: int
- av_block_log - Enable/disable logging for AntiVirus file blocking. type: str choices: enable, disable
- av_virus_log - Enable/disable AntiVirus logging. type: str choices: enable, disable
- comment - Comment. type: str
- content_disarm - AV Content Disarm and Reconstruction settings. type: dict
- cover_page - Enable/disable inserting a cover page into the disarmed document. type: str choices: disable, enable
- detect_only - Enable/disable only detect disarmable files, do not alter content. type: str choices: disable, enable
- office_embed - Enable/disable stripping of embedded objects in Microsoft Office documents. type: str choices: disable, enable
- office_hylink - Enable/disable stripping of hyperlinks in Microsoft Office documents. type: str choices: disable, enable
- office_linked - Enable/disable stripping of linked objects in Microsoft Office documents. type: str choices: disable, enable
- office_macro - Enable/disable stripping of macros in Microsoft Office documents. type: str choices: disable, enable
- original_file_destination - Destination to send original file if active content is removed. type: str choices: fortisandbox, quarantine, discard
- pdf_act_form - Enable/disable stripping of actions that submit data to other targets in PDF documents. type: str choices: disable, enable
- pdf_act_gotor - Enable/disable stripping of links to other PDFs in PDF documents. type: str choices: disable, enable
- pdf_act_java - Enable/disable stripping of actions that execute JavaScript code in PDF documents. type: str choices: disable, enable
- pdf_act_launch - Enable/disable stripping of links to external applications in PDF documents. type: str choices: disable, enable
- pdf_act_movie - Enable/disable stripping of embedded movies in PDF documents. type: str choices: disable, enable
- pdf_act_sound - Enable/disable stripping of embedded sound files in PDF documents. type: str choices: disable, enable
- pdf_embedfile - Enable/disable stripping of embedded files in PDF documents. type: str choices: disable, enable
- pdf_hyperlink - Enable/disable stripping of hyperlinks from PDF documents. type: str choices: disable, enable
- pdf_javacode - Enable/disable stripping of JavaScript code in PDF documents. type: str choices: disable, enable
- extended_log - Enable/disable extended logging for antivirus. type: str choices: enable, disable
- ftgd_analytics - Settings to control which files are uploaded to FortiSandbox. type: str choices: disable, suspicious, everything
- ftp - Configure FTP AntiVirus options. type: dict
- archive_block - Select the archive types to block. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- archive_log - Select the archive types to log. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- emulator - Enable/disable the virus emulator. type: str choices: enable, disable
- options - Enable/disable FTP AntiVirus scanning, monitoring, and quarantine. type: str choices: scan, avmonitor, quarantine
- outbreak_prevention - Enable FortiGuard Virus Outbreak Prevention service. type: str choices: disabled, files, full-archive
- http - Configure HTTP AntiVirus options. type: dict
- archive_block - Select the archive types to block. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- archive_log - Select the archive types to log. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- content_disarm - Enable Content Disarm and Reconstruction for this protocol. type: str choices: disable, enable
- emulator - Enable/disable the virus emulator. type: str choices: enable, disable
- options - Enable/disable HTTP AntiVirus scanning, monitoring, and quarantine. type: str choices: scan, avmonitor, quarantine
- outbreak_prevention - Enable FortiGuard Virus Outbreak Prevention service. type: str choices: disabled, files, full-archive
- imap - Configure IMAP AntiVirus options. type: dict
- archive_block - Select the archive types to block. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- archive_log - Select the archive types to log. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- content_disarm - Enable Content Disarm and Reconstruction for this protocol. type: str choices: disable, enable
- emulator - Enable/disable the virus emulator. type: str choices: enable, disable
- executables - Treat Windows executable files as viruses for the purpose of blocking or monitoring. type: str choices: default, virus
- options - Enable/disable IMAP AntiVirus scanning, monitoring, and quarantine. type: str choices: scan, avmonitor, quarantine
- outbreak_prevention - Enable FortiGuard Virus Outbreak Prevention service. type: str choices: disabled, files, full-archive
- inspection_mode - Inspection mode. type: str choices: proxy, flow-based
- mapi - Configure MAPI AntiVirus options. type: dict
- archive_block - Select the archive types to block. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- archive_log - Select the archive types to log. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- emulator - Enable/disable the virus emulator. type: str choices: enable, disable
- executables - Treat Windows executable files as viruses for the purpose of blocking or monitoring. type: str choices: default, virus
- options - Enable/disable MAPI AntiVirus scanning, monitoring, and quarantine. type: str choices: scan, avmonitor, quarantine
- outbreak_prevention - Enable FortiGuard Virus Outbreak Prevention service. type: str choices: disabled, files, full-archive
- mobile_malware_db - Enable/disable using the mobile malware signature database. type: str choices: disable, enable
- nac_quar - Configure AntiVirus quarantine settings. type: dict
- expiry - Duration of quarantine. type: str
- infected - Enable/Disable quarantining infected hosts to the banned user list. type: str choices: none, quar-src-ip
- log - Enable/disable AntiVirus quarantine logging. type: str choices: enable, disable
- name - Profile name. type: str required: True
- nntp - Configure NNTP AntiVirus options. type: dict
- archive_block - Select the archive types to block. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- archive_log - Select the archive types to log. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- emulator - Enable/disable the virus emulator. type: str choices: enable, disable
- options - Enable/disable NNTP AntiVirus scanning, monitoring, and quarantine. type: str choices: scan, avmonitor, quarantine
- outbreak_prevention - Enable FortiGuard Virus Outbreak Prevention service. type: str choices: disabled, files, full-archive
- pop3 - Configure POP3 AntiVirus options. type: dict
- archive_block - Select the archive types to block. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- archive_log - Select the archive types to log. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- content_disarm - Enable Content Disarm and Reconstruction for this protocol. type: str choices: disable, enable
- emulator - Enable/disable the virus emulator. type: str choices: enable, disable
- executables - Treat Windows executable files as viruses for the purpose of blocking or monitoring. type: str choices: default, virus
- options - Enable/disable POP3 AntiVirus scanning, monitoring, and quarantine. type: str choices: scan, avmonitor, quarantine
- outbreak_prevention - Enable FortiGuard Virus Outbreak Prevention service. type: str choices: disabled, files, full-archive
- replacemsg_group - Replacement message group customized for this profile. Source system.replacemsg-group.name. type: str
- scan_mode - Choose between full scan mode and quick scan mode. type: str choices: quick, full
- smb - Configure SMB AntiVirus options. type: dict
- archive_block - Select the archive types to block. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- archive_log - Select the archive types to log. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- emulator - Enable/disable the virus emulator. type: str choices: enable, disable
- options - Enable/disable SMB AntiVirus scanning, monitoring, and quarantine. type: str choices: scan, avmonitor, quarantine
- outbreak_prevention - Enable FortiGuard Virus Outbreak Prevention service. type: str choices: disabled, files, full-archive
- smtp - Configure SMTP AntiVirus options. type: dict
- archive_block - Select the archive types to block. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- archive_log - Select the archive types to log. type: str choices: encrypted, corrupted, partiallycorrupted, multipart, nested, mailbomb, fileslimit, timeout, unhandled
- content_disarm - Enable Content Disarm and Reconstruction for this protocol. type: str choices: disable, enable
- emulator - Enable/disable the virus emulator. type: str choices: enable, disable
- executables - Treat Windows executable files as viruses for the purpose of blocking or monitoring. type: str choices: default, virus
- options - Enable/disable SMTP AntiVirus scanning, monitoring, and quarantine. type: str choices: scan, avmonitor, quarantine
- outbreak_prevention - Enable FortiGuard Virus Outbreak Prevention service. type: str choices: disabled, files, full-archive
Examples¶
- hosts: fortigates
collections:
- fortinet.fortios
connection: httpapi
vars:
vdom: "root"
ansible_httpapi_use_ssl: yes
ansible_httpapi_validate_certs: no
ansible_httpapi_port: 443
tasks:
- name: Configure AntiVirus profiles.
fortios_antivirus_profile:
vdom: "{{ vdom }}"
state: "present"
access_token: "<your_own_value>"
antivirus_profile:
analytics_bl_filetype: "3 (source dlp.filepattern.id)"
analytics_db: "disable"
analytics_max_upload: "5"
analytics_wl_filetype: "6 (source dlp.filepattern.id)"
av_block_log: "enable"
av_virus_log: "enable"
comment: "Comment."
content_disarm:
cover_page: "disable"
detect_only: "disable"
office_embed: "disable"
office_hylink: "disable"
office_linked: "disable"
office_macro: "disable"
original_file_destination: "fortisandbox"
pdf_act_form: "disable"
pdf_act_gotor: "disable"
pdf_act_java: "disable"
pdf_act_launch: "disable"
pdf_act_movie: "disable"
pdf_act_sound: "disable"
pdf_embedfile: "disable"
pdf_hyperlink: "disable"
pdf_javacode: "disable"
extended_log: "enable"
ftgd_analytics: "disable"
ftp:
archive_block: "encrypted"
archive_log: "encrypted"
emulator: "enable"
options: "scan"
outbreak_prevention: "disabled"
http:
archive_block: "encrypted"
archive_log: "encrypted"
content_disarm: "disable"
emulator: "enable"
options: "scan"
outbreak_prevention: "disabled"
imap:
archive_block: "encrypted"
archive_log: "encrypted"
content_disarm: "disable"
emulator: "enable"
executables: "default"
options: "scan"
outbreak_prevention: "disabled"
inspection_mode: "proxy"
mapi:
archive_block: "encrypted"
archive_log: "encrypted"
emulator: "enable"
executables: "default"
options: "scan"
outbreak_prevention: "disabled"
mobile_malware_db: "disable"
nac_quar:
expiry: "<your_own_value>"
infected: "none"
log: "enable"
name: "default_name_63"
nntp:
archive_block: "encrypted"
archive_log: "encrypted"
emulator: "enable"
options: "scan"
outbreak_prevention: "disabled"
pop3:
archive_block: "encrypted"
archive_log: "encrypted"
content_disarm: "disable"
emulator: "enable"
executables: "default"
options: "scan"
outbreak_prevention: "disabled"
replacemsg_group: "<your_own_value> (source system.replacemsg-group.name)"
scan_mode: "quick"
smb:
archive_block: "encrypted"
archive_log: "encrypted"
emulator: "enable"
options: "scan"
outbreak_prevention: "disabled"
smtp:
archive_block: "encrypted"
archive_log: "encrypted"
content_disarm: "disable"
emulator: "enable"
executables: "default"
options: "scan"
outbreak_prevention: "disabled"
Return Values¶
Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:
- build - Build number of the fortigate image returned: always type: str sample: 1547
- http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
- http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
- mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
- name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
- path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
- revision - Internal revision number returned: always type: str sample: 17.0.2.10658
- serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
- status - Indication of the operation's result returned: always type: str sample: success
- vdom - Virtual domain used returned: always type: str sample: root
- version - Version of the FortiGate returned: always type: str sample: v5.6.3