fortios_vpn_ipsec_phase1 – Configure VPN remote gateway in Fortinet’s FortiOS and FortiGate.¶

New in version 2.8.

Synopsis
Requirements
Parameters
Notes
Examples
Return Values
Status
Authors

Synopsis ¶

This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify vpn_ipsec feature and phase1 category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0

Requirements ¶

The below requirements are needed on the host that executes this module.

ansible>=2.9.0

Parameters ¶

access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: False
vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
state - Indicates whether to create or remove the object. This attribute was present already in previous version in a deeper level. It has been moved out to this outer level. type: str required: False choices: present, absent
vpn_ipsec_phase1 - Configure VPN remote gateway. type: dict

state - B(Deprecated) type: str required: False choices: present, absent
acct_verify - Enable/disable verification of RADIUS accounting record. type: str choices: enable, disable
add_gw_route - Enable/disable automatically add a route to the remote gateway. type: str choices: enable, disable
add_route - Enable/disable control addition of a route to peer destination selector. type: str choices: disable, enable
assign_ip - Enable/disable assignment of IP to IPsec interface via configuration method. type: str choices: disable, enable
assign_ip_from - Method by which the IP address will be assigned. type: str choices: range, usrgrp, dhcp, name
authmethod - Authentication method. type: str choices: psk, signature
authmethod_remote - Authentication method (remote side). type: str choices: psk, signature
authpasswd - XAuth password (max 35 characters). type: str
authusr - XAuth user name. type: str
authusrgrp - Authentication user group. Source user.group.name. type: str
auto_negotiate - Enable/disable automatic initiation of IKE SA negotiation. type: str choices: enable, disable
autoconfig - Auto-configuration type. type: str choices: disable, client, gateway
backup_gateway - Instruct unity clients about the backup gateway address(es). type: list

address - Address of backup gateway. type: str required: True

banner - Message that unity client should display after connecting. type: str
certificate - Names of up to 4 signed personal certificates. type: list

name - Certificate name. Source vpn.certificate.local.name. type: str required: True

childless_ike - Enable/disable childless IKEv2 initiation (RFC 6023). type: str choices: enable, disable
client_auto_negotiate - Enable/disable allowing the VPN client to bring up the tunnel when there is no traffic. type: str choices: disable, enable
client_keep_alive - Enable/disable allowing the VPN client to keep the tunnel up when there is no traffic. type: str choices: disable, enable
comments - Comment. type: str
dhgrp - DH group. type: str choices: 1, 2, 5, 14, 15, 16, 17, 18, 19, 20, 21, 27, 28, 29, 30, 31
digital_signature_auth - Enable/disable IKEv2 Digital Signature Authentication (RFC 7427). type: str choices: enable, disable
distance - Distance for routes added by IKE (1 - 255). type: int
dns_mode - DNS server mode. type: str choices: manual, auto
domain - Instruct unity clients about the default DNS domain. type: str
dpd - Dead Peer Detection mode. type: str choices: disable, on-idle, on-demand
dpd_retrycount - Number of DPD retry attempts. type: int
dpd_retryinterval - DPD retry interval. type: str
eap - Enable/disable IKEv2 EAP authentication. type: str choices: enable, disable
eap_identity - IKEv2 EAP peer identity type. type: str choices: use-id-payload, send-request
enforce_unique_id - Enable/disable peer ID uniqueness check. type: str choices: disable, keep-new, keep-old
forticlient_enforcement - Enable/disable FortiClient enforcement. type: str choices: enable, disable
fragmentation - Enable/disable fragment IKE message on re-transmission. type: str choices: enable, disable
fragmentation_mtu - IKE fragmentation MTU (500 - 16000). type: int
group_authentication - Enable/disable IKEv2 IDi group authentication. type: str choices: enable, disable
group_authentication_secret - Password for IKEv2 IDi group authentication. (ASCII string or hexadecimal indicated by a leading 0x.) type: str
ha_sync_esp_seqno - Enable/disable sequence number jump ahead for IPsec HA. type: str choices: enable, disable
idle_timeout - Enable/disable IPsec tunnel idle timeout. type: str choices: enable, disable
idle_timeoutinterval - IPsec tunnel idle timeout in minutes (5 - 43200). type: int
ike_version - IKE protocol version. type: str choices: 1, 2
include_local_lan - Enable/disable allow local LAN access on unity clients. type: str choices: disable, enable
interface - Local physical, aggregate, or VLAN outgoing interface. Source system.interface.name. type: str
ipv4_dns_server1 - IPv4 DNS server 1. type: str
ipv4_dns_server2 - IPv4 DNS server 2. type: str
ipv4_dns_server3 - IPv4 DNS server 3. type: str
ipv4_end_ip - End of IPv4 range. type: str
ipv4_exclude_range - Configuration Method IPv4 exclude ranges. type: list

end_ip - End of IPv4 exclusive range. type: str
id - ID. type: int required: True
start_ip - Start of IPv4 exclusive range. type: str

ipv4_name - IPv4 address name. Source firewall.address.name firewall.addrgrp.name. type: str
ipv4_netmask - IPv4 Netmask. type: str
ipv4_split_exclude - IPv4 subnets that should not be sent over the IPsec tunnel. Source firewall.address.name firewall.addrgrp.name. type: str
ipv4_split_include - IPv4 split-include subnets. Source firewall.address.name firewall.addrgrp.name. type: str
ipv4_start_ip - Start of IPv4 range. type: str
ipv4_wins_server1 - WINS server 1. type: str
ipv4_wins_server2 - WINS server 2. type: str
ipv6_dns_server1 - IPv6 DNS server 1. type: str
ipv6_dns_server2 - IPv6 DNS server 2. type: str
ipv6_dns_server3 - IPv6 DNS server 3. type: str
ipv6_end_ip - End of IPv6 range. type: str
ipv6_exclude_range - Configuration method IPv6 exclude ranges. type: list

end_ip - End of IPv6 exclusive range. type: str
id - ID. type: int required: True
start_ip - Start of IPv6 exclusive range. type: str

ipv6_name - IPv6 address name. Source firewall.address6.name firewall.addrgrp6.name. type: str
ipv6_prefix - IPv6 prefix. type: int
ipv6_split_exclude - IPv6 subnets that should not be sent over the IPsec tunnel. Source firewall.address6.name firewall.addrgrp6.name. type: str
ipv6_split_include - IPv6 split-include subnets. Source firewall.address6.name firewall.addrgrp6.name. type: str
ipv6_start_ip - Start of IPv6 range. type: str
keepalive - NAT-T keep alive interval. type: int
keylife - Time to wait in seconds before phase 1 encryption key expires. type: int
local_gw - Local VPN gateway. type: str
localid - Local ID. type: str
localid_type - Local ID type. type: str choices: auto, fqdn, user-fqdn, keyid, address, asn1dn
mesh_selector_type - Add selectors containing subsets of the configuration depending on traffic. type: str choices: disable, subnet, host
mode - ID protection mode used to establish a secure channel. type: str choices: aggressive, main
mode_cfg - Enable/disable configuration method. type: str choices: disable, enable
name - IPsec remote gateway name. type: str required: True
nattraversal - Enable/disable NAT traversal. type: str choices: enable, disable, forced
negotiate_timeout - IKE SA negotiation timeout in seconds (1 - 300). type: int
npu_offload - Enable/disable offloading NPU. type: str choices: enable, disable
peer - Accept this peer certificate. Source user.peer.name. type: str
peergrp - Accept this peer certificate group. Source user.peergrp.name. type: str
peerid - Accept this peer identity. type: str
peertype - Accept this peer type. type: str choices: any, one, dialup, peer, peergrp
ppk - Enable/disable IKEv2 Postquantum Preshared Key (PPK). type: str choices: disable, allow, require
ppk_identity - IKEv2 Postquantum Preshared Key Identity. type: str
ppk_secret - IKEv2 Postquantum Preshared Key (ASCII string or hexadecimal encoded with a leading 0x). type: str
priority - Priority for routes added by IKE (0 - 4294967295). type: int
proposal - Phase1 proposal. type: str choices: des-md5, des-sha1, des-sha256, des-sha384, des-sha512, 3des-md5, 3des-sha1, 3des-sha256, 3des-sha384, 3des-sha512, aes128-md5, aes128-sha1, aes128-sha256, aes128-sha384, aes128-sha512, aes192-md5, aes192-sha1, aes192-sha256, aes192-sha384, aes192-sha512, aes256-md5, aes256-sha1, aes256-sha256, aes256-sha384, aes256-sha512, aria128-md5, aria128-sha1, aria128-sha256, aria128-sha384, aria128-sha512, aria192-md5, aria192-sha1, aria192-sha256, aria192-sha384, aria192-sha512, aria256-md5, aria256-sha1, aria256-sha256, aria256-sha384, aria256-sha512, seed-md5, seed-sha1, seed-sha256, seed-sha384, seed-sha512
psksecret - Pre-shared secret for PSK authentication (ASCII string or hexadecimal encoded with a leading 0x). type: str
psksecret_remote - Pre-shared secret for remote side PSK authentication (ASCII string or hexadecimal encoded with a leading 0x). type: str
reauth - Enable/disable re-authentication upon IKE SA lifetime expiration. type: str choices: disable, enable
rekey - Enable/disable phase1 rekey. type: str choices: enable, disable
remote_gw - Remote VPN gateway. type: str
remotegw_ddns - Domain name of remote gateway (eg. name.DDNS.com). type: str
rsa_signature_format - Digital Signature Authentication RSA signature format. type: str choices: pkcs1, pss
save_password - Enable/disable saving XAuth username and password on VPN clients. type: str choices: disable, enable
send_cert_chain - Enable/disable sending certificate chain. type: str choices: enable, disable
signature_hash_alg - Digital Signature Authentication hash algorithms. type: str choices: sha1, sha2-256, sha2-384, sha2-512
split_include_service - Split-include services. Source firewall.service.group.name firewall.service.custom.name. type: str
suite_b - Use Suite-B. type: str choices: disable, suite-b-gcm-128, suite-b-gcm-256
type - Remote gateway type. type: str choices: static, dynamic, ddns
unity_support - Enable/disable support for Cisco UNITY Configuration Method extensions. type: str choices: disable, enable
usrgrp - User group name for dialup peers. Source user.group.name. type: str
wizard_type - GUI VPN Wizard Type. type: str choices: custom, dialup-forticlient, dialup-ios, dialup-android, dialup-windows, dialup-cisco, static-fortigate, dialup-fortigate, static-cisco, dialup-cisco-fw
xauthtype - XAuth type. type: str choices: disable, client, pap, chap, auto

Notes ¶

Note

Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks

Examples ¶

- hosts: fortigates
  collections:
    - fortinet.fortios
  connection: httpapi
  vars:
   vdom: "root"
   ansible_httpapi_use_ssl: yes
   ansible_httpapi_validate_certs: no
   ansible_httpapi_port: 443
  tasks:
  - name: Configure VPN remote gateway.
    fortios_vpn_ipsec_phase1:
      vdom:  "{{ vdom }}"
      state: "present"
      access_token: "<your_own_value>"
      vpn_ipsec_phase1:
        acct_verify: "enable"
        add_gw_route: "enable"
        add_route: "disable"
        assign_ip: "disable"
        assign_ip_from: "range"
        authmethod: "psk"
        authmethod_remote: "psk"
        authpasswd: "<your_own_value>"
        authusr: "<your_own_value>"
        authusrgrp: "<your_own_value> (source user.group.name)"
        auto_negotiate: "enable"
        autoconfig: "disable"
        backup_gateway:
         -
            address: "<your_own_value>"
        banner: "<your_own_value>"
        certificate:
         -
            name: "default_name_19 (source vpn.certificate.local.name)"
        childless_ike: "enable"
        client_auto_negotiate: "disable"
        client_keep_alive: "disable"
        comments: "<your_own_value>"
        dhgrp: "1"
        digital_signature_auth: "enable"
        distance: "26"
        dns_mode: "manual"
        domain: "<your_own_value>"
        dpd: "disable"
        dpd_retrycount: "30"
        dpd_retryinterval: "<your_own_value>"
        eap: "enable"
        eap_identity: "use-id-payload"
        enforce_unique_id: "disable"
        forticlient_enforcement: "enable"
        fragmentation: "enable"
        fragmentation_mtu: "37"
        group_authentication: "enable"
        group_authentication_secret: "<your_own_value>"
        ha_sync_esp_seqno: "enable"
        idle_timeout: "enable"
        idle_timeoutinterval: "42"
        ike_version: "1"
        include_local_lan: "disable"
        interface: "<your_own_value> (source system.interface.name)"
        ipv4_dns_server1: "<your_own_value>"
        ipv4_dns_server2: "<your_own_value>"
        ipv4_dns_server3: "<your_own_value>"
        ipv4_end_ip: "<your_own_value>"
        ipv4_exclude_range:
         -
            end_ip: "<your_own_value>"
            id:  "52"
            start_ip: "<your_own_value>"
        ipv4_name: "<your_own_value> (source firewall.address.name firewall.addrgrp.name)"
        ipv4_netmask: "<your_own_value>"
        ipv4_split_exclude: "<your_own_value> (source firewall.address.name firewall.addrgrp.name)"
        ipv4_split_include: "<your_own_value> (source firewall.address.name firewall.addrgrp.name)"
        ipv4_start_ip: "<your_own_value>"
        ipv4_wins_server1: "<your_own_value>"
        ipv4_wins_server2: "<your_own_value>"
        ipv6_dns_server1: "<your_own_value>"
        ipv6_dns_server2: "<your_own_value>"
        ipv6_dns_server3: "<your_own_value>"
        ipv6_end_ip: "<your_own_value>"
        ipv6_exclude_range:
         -
            end_ip: "<your_own_value>"
            id:  "67"
            start_ip: "<your_own_value>"
        ipv6_name: "<your_own_value> (source firewall.address6.name firewall.addrgrp6.name)"
        ipv6_prefix: "70"
        ipv6_split_exclude: "<your_own_value> (source firewall.address6.name firewall.addrgrp6.name)"
        ipv6_split_include: "<your_own_value> (source firewall.address6.name firewall.addrgrp6.name)"
        ipv6_start_ip: "<your_own_value>"
        keepalive: "74"
        keylife: "75"
        local_gw: "<your_own_value>"
        localid: "<your_own_value>"
        localid_type: "auto"
        mesh_selector_type: "disable"
        mode: "aggressive"
        mode_cfg: "disable"
        name: "default_name_82"
        nattraversal: "enable"
        negotiate_timeout: "84"
        npu_offload: "enable"
        peer: "<your_own_value> (source user.peer.name)"
        peergrp: "<your_own_value> (source user.peergrp.name)"
        peerid: "<your_own_value>"
        peertype: "any"
        ppk: "disable"
        ppk_identity: "<your_own_value>"
        ppk_secret: "<your_own_value>"
        priority: "93"
        proposal: "des-md5"
        psksecret: "<your_own_value>"
        psksecret_remote: "<your_own_value>"
        reauth: "disable"
        rekey: "enable"
        remote_gw: "<your_own_value>"
        remotegw_ddns: "<your_own_value>"
        rsa_signature_format: "pkcs1"
        save_password: "disable"
        send_cert_chain: "enable"
        signature_hash_alg: "sha1"
        split_include_service: "<your_own_value> (source firewall.service.group.name firewall.service.custom.name)"
        suite_b: "disable"
        type: "static"
        unity_support: "disable"
        usrgrp: "<your_own_value> (source user.group.name)"
        wizard_type: "custom"
        xauthtype: "disable"

Return Values ¶

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

build - Build number of the fortigate image returned: always type: str sample: 1547
http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
revision - Internal revision number returned: always type: str sample: 17.0.2.10658
serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
status - Indication of the operation's result returned: always type: str sample: success
vdom - Virtual domain used returned: always type: str sample: root
version - Version of the FortiGate returned: always type: str sample: v5.6.3

Status ¶

This module is not guaranteed to have a backwards compatible interface.

Authors ¶

Link Zheng (@chillancezen)
Jie Xue (@JieX19)
Hongbin Lu (@fgtdev-hblu)
Frank Shen (@frankshen01)
Miguel Angel Munoz (@mamunozgonzalez)
Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation, you can create a pull request to improve it.