fortios_switch_controller_managed_switch – Configure FortiSwitch devices that are managed by this FortiGate in Fortinet’s FortiOS and FortiGate.¶

New in version 2.8.

Synopsis
Requirements
Parameters
Notes
Examples
Return Values
Status
Authors

Synopsis ¶

This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify switch_controller feature and managed_switch category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0

Requirements ¶

The below requirements are needed on the host that executes this module.

ansible>=2.9.0

Parameters ¶

access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: False
vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
state - Indicates whether to create or remove the object. This attribute was present already in previous version in a deeper level. It has been moved out to this outer level. type: str required: False choices: present, absent
switch_controller_managed_switch - Configure FortiSwitch devices that are managed by this FortiGate. type: dict

state - B(Deprecated) type: str required: False choices: present, absent
settings_802_1X - Configuration method to edit FortiSwitch 802.1X global settings. type: dict

link_down_auth - Authentication state to set if a link is down. type: str choices: set-unauth, no-action
local_override - Enable to override global 802.1X settings on individual FortiSwitches. type: str choices: enable, disable
max_reauth_attempt - Maximum number of authentication attempts (0 - 15). type: int
reauth_period - Reauthentication time interval (1 - 1440 min). type: int

connected - CAPWAP connection. type: int
custom_command - Configuration method to edit FortiSwitch commands to be pushed to this FortiSwitch device upon rebooting the FortiGate switch controller or the FortiSwitch. type: list

command_entry - List of FortiSwitch commands. type: str
command_name - Names of commands to be pushed to this FortiSwitch device, as configured under config switch-controller custom-command. Source switch-controller.custom-command.command-name. type: str

delayed_restart_trigger - Delayed restart triggered for this FortiSwitch. type: int
description - Description. type: str
directly_connected - Directly connected FortiSwitch. type: int
dynamic_capability - List of features this FortiSwitch supports (not configurable) that is sent to the FortiGate device for subsequent configuration initiated by the FortiGate device. type: int
dynamically_discovered - Dynamically discovered FortiSwitch. type: int
fsw_wan1_admin - FortiSwitch WAN1 admin status; enable to authorize the FortiSwitch as a managed switch. type: str choices: discovered, disable, enable
fsw_wan1_peer - Fortiswitch WAN1 peer port. type: str
fsw_wan2_admin - FortiSwitch WAN2 admin status; enable to authorize the FortiSwitch as a managed switch. type: str choices: discovered, disable, enable
fsw_wan2_peer - FortiSwitch WAN2 peer port. type: str
igmp_snooping - Configure FortiSwitch IGMP snooping global settings. type: dict

aging_time - Maximum time to retain a multicast snooping entry for which no packets have been seen (15 - 3600 sec). type: int
flood_unknown_multicast - Enable/disable unknown multicast flooding. type: str choices: enable, disable
local_override - Enable/disable overriding the global IGMP snooping configuration. type: str choices: enable, disable

max_allowed_trunk_members - FortiSwitch maximum allowed trunk members. type: int
mirror - Configuration method to edit FortiSwitch packet mirror. type: list

dst - Destination port. type: str
name - Mirror name. type: str required: True
src_egress - Source egress interfaces. type: list

name - Interface name. type: str required: True

src_ingress - Source ingress interfaces. type: list

name - Interface name. type: str required: True

status - Active/inactive mirror configuration. type: str choices: active, inactive
switching_packet - Enable/disable switching functionality when mirroring. type: str choices: enable, disable

name - Managed-switch name. type: str
owner_vdom - VDOM which owner of port belongs to. type: str
poe_pre_standard_detection - Enable/disable PoE pre-standard detection. type: str choices: enable, disable
ports - Managed-switch port list. type: list

allowed_vlans - Configure switch port tagged vlans type: list

vlan_name - VLAN name. Source system.interface.name. type: str

allowed_vlans_all - Enable/disable all defined vlans on this port. type: str choices: enable, disable
arp_inspection_trust - Trusted or untrusted dynamic ARP inspection. type: str choices: untrusted, trusted
bundle - Enable/disable Link Aggregation Group (LAG) bundling for non-FortiLink interfaces. type: str choices: enable, disable
description - Description for port. type: str
dhcp_snoop_option82_trust - Enable/disable allowance of DHCP with option-82 on untrusted interface. type: str choices: enable, disable
dhcp_snooping - Trusted or untrusted DHCP-snooping interface. type: str choices: untrusted, trusted
discard_mode - Configure discard mode for port. type: str choices: none, all-untagged, all-tagged
edge_port - Enable/disable this interface as an edge port, bridging connections between workstations and/or computers. type: str choices: enable, disable
export_tags - Switch controller export tag name. type: list

tag_name - Switch tag name. Source switch-controller.switch-interface-tag.name. type: str

export_to - Export managed-switch port to a tenant VDOM. Source system.vdom.name. type: str
export_to_pool - Switch controller export port to pool-list. Source switch-controller.virtual-port-pool.name. type: str
export_to_pool_flag - Switch controller export port to pool-list. type: int
fgt_peer_device_name - FGT peer device name. type: str
fgt_peer_port_name - FGT peer port name. type: str
fiber_port - Fiber-port. type: int
flags - Port properties flags. type: int
fortilink_port - FortiLink uplink port. type: int
igmp_snooping - Set IGMP snooping mode for the physical port interface. type: str choices: enable, disable
igmps_flood_reports - Enable/disable flooding of IGMP reports to this interface when igmp-snooping enabled. type: str choices: enable, disable
igmps_flood_traffic - Enable/disable flooding of IGMP snooping traffic to this interface. type: str choices: enable, disable
isl_local_trunk_name - ISL local trunk name. type: str
isl_peer_device_name - ISL peer device name. type: str
isl_peer_port_name - ISL peer port name. type: str
lacp_speed - end Link Aggregation Control Protocol (LACP) messages every 30 seconds (slow) or every second (fast). type: str choices: slow, fast
learning_limit - Limit the number of dynamic MAC addresses on this Port (1 - 128, 0 = no limit, default). type: int
lldp_profile - LLDP port TLV profile. Source switch-controller.lldp-profile.name. type: str
lldp_status - LLDP transmit and receive status. type: str choices: disable, rx-only, tx-only, tx-rx
loop_guard - Enable/disable loop-guard on this interface, an STP optimization used to prevent network loops. type: str choices: enabled, disabled
loop_guard_timeout - Loop-guard timeout (0 - 120 min). type: int
max_bundle - Maximum size of LAG bundle (1 - 24) type: int
mclag - Enable/disable multi-chassis link aggregation (MCLAG). type: str choices: enable, disable
member_withdrawal_behavior - Port behavior after it withdraws because of loss of control packets. type: str choices: forward, block
members - Aggregated LAG bundle interfaces. type: list

member_name - Interface name from available options. type: str

min_bundle - Minimum size of LAG bundle (1 - 24) type: int
mode - LACP mode: ignore and do not send control messages, or negotiate 802.3ad aggregation passively or actively. type: str choices: static, lacp-passive, lacp-active
poe_capable - PoE capable. type: int
poe_pre_standard_detection - Enable/disable PoE pre-standard detection. type: str choices: enable, disable
poe_status - Enable/disable PoE status. type: str choices: enable, disable
port_name - Switch port name. type: str
port_number - Port number. type: int
port_owner - Switch port name. type: str
port_prefix_type - Port prefix type. type: int
port_security_policy - Switch controller authentication policy to apply to this managed switch from available options. Source switch-controller .security-policy.802-1X.name switch-controller.security-policy.captive-portal.name. type: str
port_selection_criteria - Algorithm for aggregate port selection. type: str choices: src-mac, dst-mac, src-dst-mac, src-ip, dst-ip, src-dst-ip
qos_policy - Switch controller QoS policy from available options. Source switch-controller.qos.qos-policy.name. type: str
sample_direction - sFlow sample direction. type: str choices: tx, rx, both
sflow_counter_interval - sFlow sampler counter polling interval (1 - 255 sec). type: int
sflow_sample_rate - sFlow sampler sample rate (0 - 99999 p/sec). type: int
sflow_sampler - Enable/disable sFlow protocol on this interface. type: str choices: enabled, disabled
speed - Switch port speed; default and available settings depend on hardware. type: str choices: 10half, 10full, 100half, 100full, 1000auto, 1000fiber, 1000full, 10000, 40000, auto, auto-module, 100FX-half, 100FX-full, 100000full, 2500full, 25000full, 50000full
speed_mask - Switch port speed mask. type: int
stacking_port - Stacking port. type: int
status - Switch port admin status: up or down. type: str choices: up, down
stp_bpdu_guard - Enable/disable STP BPDU guard on this interface. type: str choices: enabled, disabled
stp_bpdu_guard_timeout - BPDU Guard disabling protection (0 - 120 min). type: int
stp_root_guard - Enable/disable STP root guard on this interface. type: str choices: enabled, disabled
stp_state - Enable/disable Spanning Tree Protocol (STP) on this interface. type: str choices: enabled, disabled
switch_id - Switch id. type: str
type - Interface type: physical or trunk port. type: str choices: physical, trunk
untagged_vlans - Configure switch port untagged vlans type: list

vlan_name - VLAN name. Source system.interface.name. type: str

virtual_port - Virtualized switch port. type: int
vlan - Assign switch ports to a VLAN. Source system.interface.name. type: str

pre_provisioned - Pre-provisioned managed switch. type: int
staged_image_version - Staged image version for FortiSwitch. type: str
storm_control - Configuration method to edit FortiSwitch storm control for measuring traffic activity using data rates to prevent traffic disruption. type: dict

broadcast - Enable/disable storm control to drop broadcast traffic. type: str choices: enable, disable
local_override - Enable to override global FortiSwitch storm control settings for this FortiSwitch. type: str choices: enable, disable
rate - Rate in packets per second at which storm traffic is controlled (1 - 10000000). Storm control drops excess traffic data rates beyond this threshold. type: int
unknown_multicast - Enable/disable storm control to drop unknown multicast traffic. type: str choices: enable, disable
unknown_unicast - Enable/disable storm control to drop unknown unicast traffic. type: str choices: enable, disable

stp_settings - Configuration method to edit Spanning Tree Protocol (STP) settings used to prevent bridge loops. type: dict

forward_time - Period of time a port is in listening and learning state (4 - 30 sec). type: int
hello_time - Period of time between successive STP frame Bridge Protocol Data Units (BPDUs) sent on a port (1 - 10 sec). type: int
local_override - Enable to configure local STP settings that override global STP settings. type: str choices: enable, disable
max_age - Maximum time before a bridge port saves its configuration BPDU information (6 - 40 sec). type: int
max_hops - Maximum number of hops between the root bridge and the furthest bridge (1- 40). type: int
name - Name of local STP settings configuration. type: str
pending_timer - Pending time (1 - 15 sec). type: int
revision - STP revision number (0 - 65535). type: int
status - Enable/disable STP. type: str choices: enable, disable

switch_device_tag - User definable label/tag. type: str
switch_id - Managed-switch id. type: str
switch_log - Configuration method to edit FortiSwitch logging settings (logs are transferred to and inserted into the FortiGate event log). type: dict

local_override - Enable to configure local logging settings that override global logging settings. type: str choices: enable, disable
severity - Severity of FortiSwitch logs that are added to the FortiGate event log. type: str choices: emergency, alert, critical, error, warning, notification, information, debug
status - Enable/disable adding FortiSwitch logs to the FortiGate event log. type: str choices: enable, disable

switch_profile - FortiSwitch profile. Source switch-controller.switch-profile.name. type: str
switch_stp_settings - Configure spanning tree protocol (STP). type: dict

status - Enable/disable STP. type: str choices: enable, disable

type - Indication of switch type, physical or virtual. type: str choices: virtual, physical
version - FortiSwitch version. type: int

Notes ¶

Note

Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks

Examples ¶

- hosts: fortigates
  collections:
    - fortinet.fortios
  connection: httpapi
  vars:
   vdom: "root"
   ansible_httpapi_use_ssl: yes
   ansible_httpapi_validate_certs: no
   ansible_httpapi_port: 443
  tasks:
  - name: Configure FortiSwitch devices that are managed by this FortiGate.
    fortios_switch_controller_managed_switch:
      vdom:  "{{ vdom }}"
      state: "present"
      access_token: "<your_own_value>"
      switch_controller_managed_switch:
        settings_802_1X:
            link_down_auth: "set-unauth"
            local_override: "enable"
            max_reauth_attempt: "6"
            reauth_period: "7"
        connected: "8"
        custom_command:
         -
            command_entry: "<your_own_value>"
            command_name: "<your_own_value> (source switch-controller.custom-command.command-name)"
        delayed_restart_trigger: "12"
        description: "<your_own_value>"
        directly_connected: "14"
        dynamic_capability: "15"
        dynamically_discovered: "16"
        fsw_wan1_admin: "discovered"
        fsw_wan1_peer: "<your_own_value>"
        fsw_wan2_admin: "discovered"
        fsw_wan2_peer: "<your_own_value>"
        igmp_snooping:
            aging_time: "22"
            flood_unknown_multicast: "enable"
            local_override: "enable"
        max_allowed_trunk_members: "25"
        mirror:
         -
            dst: "<your_own_value>"
            name: "default_name_28"
            src_egress:
             -
                name: "default_name_30"
            src_ingress:
             -
                name: "default_name_32"
            status: "active"
            switching_packet: "enable"
        name: "default_name_35"
        owner_vdom: "<your_own_value>"
        poe_pre_standard_detection: "enable"
        ports:
         -
            allowed_vlans:
             -
                vlan_name: "<your_own_value> (source system.interface.name)"
            allowed_vlans_all: "enable"
            arp_inspection_trust: "untrusted"
            bundle: "enable"
            description: "<your_own_value>"
            dhcp_snoop_option82_trust: "enable"
            dhcp_snooping: "untrusted"
            discard_mode: "none"
            edge_port: "enable"
            export_tags:
             -
                tag_name: "<your_own_value> (source switch-controller.switch-interface-tag.name)"
            export_to: "<your_own_value> (source system.vdom.name)"
            export_to_pool: "<your_own_value> (source switch-controller.virtual-port-pool.name)"
            export_to_pool_flag: "53"
            fgt_peer_device_name: "<your_own_value>"
            fgt_peer_port_name: "<your_own_value>"
            fiber_port: "56"
            flags: "57"
            fortilink_port: "58"
            igmp_snooping: "enable"
            igmps_flood_reports: "enable"
            igmps_flood_traffic: "enable"
            isl_local_trunk_name: "<your_own_value>"
            isl_peer_device_name: "<your_own_value>"
            isl_peer_port_name: "<your_own_value>"
            lacp_speed: "slow"
            learning_limit: "66"
            lldp_profile: "<your_own_value> (source switch-controller.lldp-profile.name)"
            lldp_status: "disable"
            loop_guard: "enabled"
            loop_guard_timeout: "70"
            max_bundle: "71"
            mclag: "enable"
            member_withdrawal_behavior: "forward"
            members:
             -
                member_name: "<your_own_value>"
            min_bundle: "76"
            mode: "static"
            poe_capable: "78"
            poe_pre_standard_detection: "enable"
            poe_status: "enable"
            port_name: "<your_own_value>"
            port_number: "82"
            port_owner: "<your_own_value>"
            port_prefix_type: "84"
            port_security_policy: "<your_own_value> (source switch-controller.security-policy.802-1X.name switch-controller.security-policy.captive-portal
              .name)"
            port_selection_criteria: "src-mac"
            qos_policy: "<your_own_value> (source switch-controller.qos.qos-policy.name)"
            sample_direction: "tx"
            sflow_counter_interval: "89"
            sflow_sample_rate: "90"
            sflow_sampler: "enabled"
            speed: "10half"
            speed_mask: "93"
            stacking_port: "94"
            status: "up"
            stp_bpdu_guard: "enabled"
            stp_bpdu_guard_timeout: "97"
            stp_root_guard: "enabled"
            stp_state: "enabled"
            switch_id: "<your_own_value>"
            type: "physical"
            untagged_vlans:
             -
                vlan_name: "<your_own_value> (source system.interface.name)"
            virtual_port: "104"
            vlan: "<your_own_value> (source system.interface.name)"
        pre_provisioned: "106"
        staged_image_version: "<your_own_value>"
        storm_control:
            broadcast: "enable"
            local_override: "enable"
            rate: "111"
            unknown_multicast: "enable"
            unknown_unicast: "enable"
        stp_settings:
            forward_time: "115"
            hello_time: "116"
            local_override: "enable"
            max_age: "118"
            max_hops: "119"
            name: "default_name_120"
            pending_timer: "121"
            revision: "122"
            status: "enable"
        switch_device_tag: "<your_own_value>"
        switch_id: "<your_own_value>"
        switch_log:
            local_override: "enable"
            severity: "emergency"
            status: "enable"
        switch_profile: "<your_own_value> (source switch-controller.switch-profile.name)"
        switch_stp_settings:
            status: "enable"
        type: "virtual"
        version: "134"

Return Values ¶

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

build - Build number of the fortigate image returned: always type: str sample: 1547
http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
revision - Internal revision number returned: always type: str sample: 17.0.2.10658
serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
status - Indication of the operation's result returned: always type: str sample: success
vdom - Virtual domain used returned: always type: str sample: root
version - Version of the FortiGate returned: always type: str sample: v5.6.3

Status ¶

This module is not guaranteed to have a backwards compatible interface.

Authors ¶

Link Zheng (@chillancezen)
Jie Xue (@JieX19)
Hongbin Lu (@fgtdev-hblu)
Frank Shen (@frankshen01)
Miguel Angel Munoz (@mamunozgonzalez)
Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation, you can create a pull request to improve it.