fortios_firewall_profile_protocol_options – Configure protocol options in Fortinet’s FortiOS and FortiGate.¶

New in version 2.8.

Synopsis
Requirements
Parameters
Notes
Examples
Return Values
Status
Authors

Synopsis ¶

This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify firewall feature and profile_protocol_options category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0

Requirements ¶

The below requirements are needed on the host that executes this module.

ansible>=2.9.0

Parameters ¶

access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: False
vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
state - Indicates whether to create or remove the object. This attribute was present already in previous version in a deeper level. It has been moved out to this outer level. type: str required: False choices: present, absent
firewall_profile_protocol_options - Configure protocol options. type: dict

state - B(Deprecated) type: str required: False choices: present, absent
comment - Optional comments. type: str
dns - Configure DNS protocol options. type: dict

ports - Ports to scan for content (1 - 65535). type: int
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable

ftp - Configure FTP protocol options. type: dict

comfort_amount - Amount of data to send in a transmission for client comforting (1 - 10240 bytes). type: int
comfort_interval - Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec). type: int
inspect_all - Enable/disable the inspection of all ports for the protocol. type: str choices: enable, disable
options - One or more options that can be applied to the session. type: str choices: clientcomfort, oversize, splice, bypass-rest-command, bypass-mode-command
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

http - Configure HTTP protocol options. type: dict

block_page_status_code - Code number returned for blocked HTTP pages (non-FortiGuard only) (100 - 599). type: int
comfort_amount - Amount of data to send in a transmission for client comforting (1 - 10240 bytes). type: int
comfort_interval - Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec). type: int
fortinet_bar - Enable/disable Fortinet bar on HTML content. type: str choices: enable, disable
fortinet_bar_port - Port for use by Fortinet Bar (1 - 65535). type: int
http_policy - Enable/disable HTTP policy check. type: str choices: disable, enable
inspect_all - Enable/disable the inspection of all ports for the protocol. type: str choices: enable, disable
options - One or more options that can be applied to the session. type: str choices: clientcomfort, servercomfort, oversize, chunkedbypass
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
post_lang - ID codes for character sets to be used to convert to UTF-8 for banned words and DLP on HTTP posts (maximum of 5 character sets). type: str choices: jisx0201, jisx0208, jisx0212, gb2312, ksc5601-ex, euc-jp, sjis, iso2022-jp, iso2022-jp-1, iso2022-jp-2, euc-cn, ces-gbk, hz, ces-big5, euc-kr, iso2022-jp-3, iso8859-1, tis620, cp874, cp1252, cp1251
range_block - Enable/disable blocking of partial downloads. type: str choices: disable, enable
retry_count - Number of attempts to retry HTTP connection (0 - 100). type: int
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
streaming_content_bypass - Enable/disable bypassing of streaming content from buffering. type: str choices: enable, disable
switching_protocols - Bypass from scanning, or block a connection that attempts to switch protocol. type: str choices: bypass, block
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

imap - Configure IMAP protocol options. type: dict

inspect_all - Enable/disable the inspection of all ports for the protocol. type: str choices: enable, disable
options - One or more options that can be applied to the session. type: str choices: fragmail, oversize
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

mail_signature - Configure Mail signature. type: dict

signature - Email signature to be added to outgoing email (if the signature contains spaces, enclose with quotation marks). type: str
status - Enable/disable adding an email signature to SMTP email messages as they pass through the FortiGate. type: str choices: disable, enable

mapi - Configure MAPI protocol options. type: dict

options - One or more options that can be applied to the session. type: str choices: fragmail, oversize
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

name - Name. type: str required: True
nntp - Configure NNTP protocol options. type: dict

inspect_all - Enable/disable the inspection of all ports for the protocol. type: str choices: enable, disable
options - One or more options that can be applied to the session. type: str choices: oversize, splice
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

oversize_log - Enable/disable logging for antivirus oversize file blocking. type: str choices: disable, enable
pop3 - Configure POP3 protocol options. type: dict

inspect_all - Enable/disable the inspection of all ports for the protocol. type: str choices: enable, disable
options - One or more options that can be applied to the session. type: str choices: fragmail, oversize
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

replacemsg_group - Name of the replacement message group to be used Source system.replacemsg-group.name. type: str
rpc_over_http - Enable/disable inspection of RPC over HTTP. type: str choices: enable, disable
smtp - Configure SMTP protocol options. type: dict

inspect_all - Enable/disable the inspection of all ports for the protocol. type: str choices: enable, disable
options - One or more options that can be applied to the session. type: str choices: fragmail, oversize, splice
oversize_limit - Maximum in-memory file size that can be scanned (1 - 383 MB). type: int
ports - Ports to scan for content (1 - 65535). type: int
scan_bzip2 - Enable/disable scanning of BZip2 compressed files. type: str choices: enable, disable
server_busy - Enable/disable SMTP server busy when server not available. type: str choices: enable, disable
status - Enable/disable the active status of scanning for this protocol. type: str choices: enable, disable
uncompressed_nest_limit - Maximum nested levels of compression that can be uncompressed and scanned (2 - 100). type: int
uncompressed_oversize_limit - Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited). type: int

switching_protocols_log - Enable/disable logging for HTTP/HTTPS switching protocols. type: str choices: disable, enable

Notes ¶

Note

Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks

Examples ¶

- hosts: fortigates
  collections:
    - fortinet.fortios
  connection: httpapi
  vars:
   vdom: "root"
   ansible_httpapi_use_ssl: yes
   ansible_httpapi_validate_certs: no
   ansible_httpapi_port: 443
  tasks:
  - name: Configure protocol options.
    fortios_firewall_profile_protocol_options:
      vdom:  "{{ vdom }}"
      state: "present"
      access_token: "<your_own_value>"
      firewall_profile_protocol_options:
        comment: "Optional comments."
        dns:
            ports: "5"
            status: "enable"
        ftp:
            comfort_amount: "8"
            comfort_interval: "9"
            inspect_all: "enable"
            options: "clientcomfort"
            oversize_limit: "12"
            ports: "13"
            scan_bzip2: "enable"
            status: "enable"
            uncompressed_nest_limit: "16"
            uncompressed_oversize_limit: "17"
        http:
            block_page_status_code: "19"
            comfort_amount: "20"
            comfort_interval: "21"
            fortinet_bar: "enable"
            fortinet_bar_port: "23"
            http_policy: "disable"
            inspect_all: "enable"
            options: "clientcomfort"
            oversize_limit: "27"
            ports: "28"
            post_lang: "jisx0201"
            range_block: "disable"
            retry_count: "31"
            scan_bzip2: "enable"
            status: "enable"
            streaming_content_bypass: "enable"
            switching_protocols: "bypass"
            uncompressed_nest_limit: "36"
            uncompressed_oversize_limit: "37"
        imap:
            inspect_all: "enable"
            options: "fragmail"
            oversize_limit: "41"
            ports: "42"
            scan_bzip2: "enable"
            status: "enable"
            uncompressed_nest_limit: "45"
            uncompressed_oversize_limit: "46"
        mail_signature:
            signature: "<your_own_value>"
            status: "disable"
        mapi:
            options: "fragmail"
            oversize_limit: "52"
            ports: "53"
            scan_bzip2: "enable"
            status: "enable"
            uncompressed_nest_limit: "56"
            uncompressed_oversize_limit: "57"
        name: "default_name_58"
        nntp:
            inspect_all: "enable"
            options: "oversize"
            oversize_limit: "62"
            ports: "63"
            scan_bzip2: "enable"
            status: "enable"
            uncompressed_nest_limit: "66"
            uncompressed_oversize_limit: "67"
        oversize_log: "disable"
        pop3:
            inspect_all: "enable"
            options: "fragmail"
            oversize_limit: "72"
            ports: "73"
            scan_bzip2: "enable"
            status: "enable"
            uncompressed_nest_limit: "76"
            uncompressed_oversize_limit: "77"
        replacemsg_group: "<your_own_value> (source system.replacemsg-group.name)"
        rpc_over_http: "enable"
        smtp:
            inspect_all: "enable"
            options: "fragmail"
            oversize_limit: "83"
            ports: "84"
            scan_bzip2: "enable"
            server_busy: "enable"
            status: "enable"
            uncompressed_nest_limit: "88"
            uncompressed_oversize_limit: "89"
        switching_protocols_log: "disable"

Return Values ¶

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

build - Build number of the fortigate image returned: always type: str sample: 1547
http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
revision - Internal revision number returned: always type: str sample: 17.0.2.10658
serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
status - Indication of the operation's result returned: always type: str sample: success
vdom - Virtual domain used returned: always type: str sample: root
version - Version of the FortiGate returned: always type: str sample: v5.6.3

Status ¶

This module is not guaranteed to have a backwards compatible interface.

Authors ¶

Link Zheng (@chillancezen)
Jie Xue (@JieX19)
Hongbin Lu (@fgtdev-hblu)
Frank Shen (@frankshen01)
Miguel Angel Munoz (@mamunozgonzalez)
Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation, you can create a pull request to improve it.