fortios_wireless_controller_vap – Configure Virtual Access Points (VAPs) in Fortinet’s FortiOS and FortiGate.

New in version 2.8.

Synopsis

  • This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify wireless_controller feature and vap category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0

Requirements

The below requirements are needed on the host that executes this module.

  • ansible>=2.9.0

Parameters

  • access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: False
  • vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
  • state - Indicates whether to create or remove the object. This attribute was present already in previous version in a deeper level. It has been moved out to this outer level. type: str required: False choices: present, absent
  • wireless_controller_vap - Configure Virtual Access Points (VAPs). type: dict
    • state - B(Deprecated) type: str required: False choices: present, absent
    • acct_interim_interval - WiFi RADIUS accounting interim interval (60 - 86400 sec). type: int
    • alias - Alias. type: str
    • auth - Authentication protocol. type: str choices: psk, radius, usergroup
    • broadcast_ssid - Enable/disable broadcasting the SSID . type: str choices: enable, disable
    • broadcast_suppression - Optional suppression of broadcast messages. For example, you can keep DHCP messages, ARP broadcasts, and so on off of the wireless network. type: str choices: dhcp-up, dhcp-down, dhcp-starvation, arp-known, arp-unknown, arp-reply, arp-poison, arp-proxy, netbios-ns, netbios-ds, ipv6, all-other-mc, all-other-bc
    • captive_portal_ac_name - Local-bridging captive portal ac-name. type: str
    • captive_portal_macauth_radius_secret - Secret key to access the macauth RADIUS server. type: str
    • captive_portal_macauth_radius_server - Captive portal external RADIUS server domain name or IP address. type: str
    • captive_portal_radius_secret - Secret key to access the RADIUS server. type: str
    • captive_portal_radius_server - Captive portal RADIUS server domain name or IP address. type: str
    • captive_portal_session_timeout_interval - Session timeout interval (0 - 864000 sec). type: int
    • dhcp_lease_time - DHCP lease time in seconds for NAT IP address. type: int
    • dhcp_option82_circuit_id_insertion - Enable/disable DHCP option 82 circuit-id insert . type: str choices: style-1, style-2, disable
    • dhcp_option82_insertion - Enable/disable DHCP option 82 insert . type: str choices: enable, disable
    • dhcp_option82_remote_id_insertion - Enable/disable DHCP option 82 remote-id insert . type: str choices: style-1, disable
    • dynamic_vlan - Enable/disable dynamic VLAN assignment. type: str choices: enable, disable
    • eap_reauth - Enable/disable EAP re-authentication for WPA-Enterprise security. type: str choices: enable, disable
    • eap_reauth_intv - EAP re-authentication interval (1800 - 864000 sec). type: int
    • eapol_key_retries - Enable/disable retransmission of EAPOL-Key frames (message 3/4 and group message 1/2) . type: str choices: disable, enable
    • encrypt - Encryption protocol to use (only available when security is set to a WPA type). type: str choices: TKIP, AES, TKIP-AES
    • external_fast_roaming - Enable/disable fast roaming or pre-authentication with external APs not managed by the FortiGate . type: str choices: enable, disable
    • external_logout - URL of external authentication logout server. type: str
    • external_web - URL of external authentication web server. type: str
    • fast_bss_transition - Enable/disable 802.11r Fast BSS Transition (FT) . type: str choices: disable, enable
    • fast_roaming - Enable/disable fast-roaming, or pre-authentication, where supported by clients . type: str choices: enable, disable
    • ft_mobility_domain - Mobility domain identifier in FT (1 - 65535). type: int
    • ft_over_ds - Enable/disable FT over the Distribution System (DS). type: str choices: disable, enable
    • ft_r0_key_lifetime - Lifetime of the PMK-R0 key in FT, 1-65535 minutes. type: int
    • gtk_rekey - Enable/disable GTK rekey for WPA security. type: str choices: enable, disable
    • gtk_rekey_intv - GTK rekey interval interval (1800 - 864000 sec). type: int
    • hotspot20_profile - Hotspot 2.0 profile name. type: str
    • intra_vap_privacy - Enable/disable blocking communication between clients on the same SSID (called intra-SSID privacy) . type: str choices: enable, disable
    • ip - IP address and subnet mask for the local standalone NAT subnet. type: str
    • key - WEP Key. type: str
    • keyindex - WEP key index (1 - 4). type: int
    • ldpc - VAP low-density parity-check (LDPC) coding configuration. type: str choices: disable, rx, tx, rxtx
    • local_authentication - Enable/disable AP local authentication. type: str choices: enable, disable
    • local_bridging - Enable/disable bridging of wireless and Ethernet interfaces on the FortiAP . type: str choices: enable, disable
    • local_lan - Allow/deny traffic destined for a Class A, B, or C private IP address . type: str choices: allow, deny
    • local_standalone - Enable/disable AP local standalone . type: str choices: enable, disable
    • local_standalone_nat - Enable/disable AP local standalone NAT mode. type: str choices: enable, disable
    • mac_auth_bypass - Enable/disable MAC authentication bypass. type: str choices: enable, disable
    • mac_filter - Enable/disable MAC filtering to block wireless clients by mac address. type: str choices: enable, disable
    • mac_filter_list - Create a list of MAC addresses for MAC address filtering. type: list
      • id - ID. type: int required: True
      • mac - MAC address. type: str
      • mac_filter_policy - Deny or allow the client with this MAC address. type: str choices: allow, deny
    • mac_filter_policy_other - Allow or block clients with MAC addresses that are not in the filter list. type: str choices: allow, deny
    • max_clients - Maximum number of clients that can connect simultaneously to the VAP . type: int
    • max_clients_ap - Maximum number of clients that can connect simultaneously to each radio . type: int
    • me_disable_thresh - Disable multicast enhancement when this many clients are receiving multicast traffic. type: int
    • mesh_backhaul - Enable/disable using this VAP as a WiFi mesh backhaul . This entry is only available when security is set to a WPA type or open. type: str choices: enable, disable
    • mpsk - Enable/disable multiple pre-shared keys (PSKs.) type: str choices: enable, disable
    • mpsk_concurrent_clients - Number of pre-shared keys (PSKs) to allow if multiple pre-shared keys are enabled. type: int
    • mpsk_key - Pre-shared keys that can be used to connect to this virtual access point. type: list
      • comment - Comment. type: str
      • concurrent_clients - Number of clients that can connect using this pre-shared key. type: str
      • key_name - Pre-shared key name. type: str
      • passphrase - WPA Pre-shared key. type: str
    • multicast_enhance - Enable/disable converting multicast to unicast to improve performance . type: str choices: enable, disable
    • multicast_rate - Multicast rate (0, 6000, 12000, or 24000 kbps). type: str choices: 0, 6000, 12000, 24000
    • name - Virtual AP name. type: str required: True
    • okc - Enable/disable Opportunistic Key Caching (OKC) . type: str choices: disable, enable
    • passphrase - WPA pre-shard key (PSK) to be used to authenticate WiFi users. type: str
    • pmf - Protected Management Frames (PMF) support . type: str choices: disable, enable, optional
    • pmf_assoc_comeback_timeout - Protected Management Frames (PMF) comeback maximum timeout (1-20 sec). type: int
    • pmf_sa_query_retry_timeout - Protected Management Frames (PMF) SA query retry timeout interval (1 - 5 100s of msec). type: int
    • portal_message_override_group - Replacement message group for this VAP (only available when security is set to a captive portal type). type: str
    • portal_message_overrides - Individual message overrides. type: dict
      • auth_disclaimer_page - Override auth-disclaimer-page message with message from portal-message-overrides group. type: str
      • auth_login_failed_page - Override auth-login-failed-page message with message from portal-message-overrides group. type: str
      • auth_login_page - Override auth-login-page message with message from portal-message-overrides group. type: str
      • auth_reject_page - Override auth-reject-page message with message from portal-message-overrides group. type: str
    • portal_type - Captive portal functionality. Configure how the captive portal authenticates users and whether it includes a disclaimer. type: str choices: auth, auth+disclaimer, disclaimer, email-collect, cmcc, cmcc-macauth
    • probe_resp_suppression - Enable/disable probe response suppression (to ignore weak signals) . type: str choices: enable, disable
    • probe_resp_threshold - Minimum signal level/threshold in dBm required for the AP response to probe requests (-95 to -20). type: str
    • ptk_rekey - Enable/disable PTK rekey for WPA-Enterprise security. type: str choices: enable, disable
    • ptk_rekey_intv - PTK rekey interval interval (1800 - 864000 sec). type: int
    • qos_profile - Quality of service profile name. type: str
    • quarantine - Enable/disable station quarantine . type: str choices: enable, disable
    • radius_mac_auth - Enable/disable RADIUS-based MAC authentication of clients . type: str choices: enable, disable
    • radius_mac_auth_server - RADIUS-based MAC authentication server. type: str
    • radius_server - RADIUS server to be used to authenticate WiFi users. type: str
    • rates_11a - Allowed data rates for 802.11a. type: str choices: 1, 1-basic, 2, 2-basic, 5.5, 5.5-basic, 11, 11-basic, 6, 6-basic, 9, 9-basic, 12, 12-basic, 18, 18-basic, 24, 24-basic, 36, 36-basic, 48, 48-basic, 54, 54-basic
    • rates_11ac_ss12 - Allowed data rates for 802.11ac with 1 or 2 spatial streams. type: str choices: mcs0/1, mcs1/1, mcs2/1, mcs3/1, mcs4/1, mcs5/1, mcs6/1, mcs7/1, mcs8/1, mcs9/1, mcs10/1, mcs11/1, mcs0/2, mcs1/2, mcs2/2, mcs3/2, mcs4/2, mcs5/2, mcs6/2, mcs7/2, mcs8/2, mcs9/2, mcs10/2, mcs11/2
    • rates_11ac_ss34 - Allowed data rates for 802.11ac with 3 or 4 spatial streams. type: str choices: mcs0/3, mcs1/3, mcs2/3, mcs3/3, mcs4/3, mcs5/3, mcs6/3, mcs7/3, mcs8/3, mcs9/3, mcs10/3, mcs11/3, mcs0/4, mcs1/4, mcs2/4, mcs3/4, mcs4/4, mcs5/4, mcs6/4, mcs7/4, mcs8/4, mcs9/4, mcs10/4, mcs11/4
    • rates_11bg - Allowed data rates for 802.11b/g. type: str choices: 1, 1-basic, 2, 2-basic, 5.5, 5.5-basic, 11, 11-basic, 6, 6-basic, 9, 9-basic, 12, 12-basic, 18, 18-basic, 24, 24-basic, 36, 36-basic, 48, 48-basic, 54, 54-basic
    • rates_11n_ss12 - Allowed data rates for 802.11n with 1 or 2 spatial streams. type: str choices: mcs0/1, mcs1/1, mcs2/1, mcs3/1, mcs4/1, mcs5/1, mcs6/1, mcs7/1, mcs8/2, mcs9/2, mcs10/2, mcs11/2, mcs12/2, mcs13/2, mcs14/2, mcs15/2
    • rates_11n_ss34 - Allowed data rates for 802.11n with 3 or 4 spatial streams. type: str choices: mcs16/3, mcs17/3, mcs18/3, mcs19/3, mcs20/3, mcs21/3, mcs22/3, mcs23/3, mcs24/4, mcs25/4, mcs26/4, mcs27/4, mcs28/4, mcs29/4, mcs30/4, mcs31/4
    • schedule - VAP schedule name. type: str
    • security - Security mode for the wireless interface . type: str choices: open, captive-portal, wep64, wep128, wpa-personal, wpa-personal+captive-portal, wpa-enterprise, wpa-only-personal, wpa-only-personal+captive-portal, wpa-only-enterprise, wpa2-only-personal, wpa2-only-personal+captive-portal, wpa2-only-enterprise, osen
    • security_exempt_list - Optional security exempt list for captive portal authentication. type: str
    • security_obsolete_option - Enable/disable obsolete security options. type: str choices: enable, disable
    • security_redirect_url - Optional URL for redirecting users after they pass captive portal authentication. type: str
    • selected_usergroups - Selective user groups that are permitted to authenticate. type: list
      • name - User group name. type: str required: True
    • split_tunneling - Enable/disable split tunneling . type: str choices: enable, disable
    • ssid - IEEE 802.11 service set identifier (SSID) for the wireless interface. Users who wish to use the wireless network must configure their computers to access this SSID name. type: str
    • tkip_counter_measure - Enable/disable TKIP counter measure. type: str choices: enable, disable
    • usergroup - Firewall user group to be used to authenticate WiFi users. type: list
      • name - User group name. type: str required: True
    • utm_profile - UTM profile name. type: str
    • vdom - Name of the VDOM that the Virtual AP has been added to. Source system.vdom.name. type: str
    • vlan_auto - Enable/disable automatic management of SSID VLAN interface. type: str choices: enable, disable
    • vlan_pool - VLAN pool. type: list
      • id - ID. type: int required: True
      • wtp_group - WTP group name. type: str
    • vlan_pooling - Enable/disable VLAN pooling, to allow grouping of multiple wireless controller VLANs into VLAN pools . When set to wtp-group, VLAN pooling occurs with VLAN assignment by wtp-group. type: str choices: wtp-group, round-robin, hash, disable
    • vlanid - Optional VLAN ID. type: int
    • voice_enterprise - Enable/disable 802.11k and 802.11v assisted Voice-Enterprise roaming . type: str choices: disable, enable

Notes

Note

  • Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks

Examples

- hosts: fortigates
  collections:
    - fortinet.fortios
  connection: httpapi
  vars:
   vdom: "root"
   ansible_httpapi_use_ssl: yes
   ansible_httpapi_validate_certs: no
   ansible_httpapi_port: 443
  tasks:
  - name: Configure Virtual Access Points (VAPs).
    fortios_wireless_controller_vap:
      vdom:  "{{ vdom }}"
      state: "present"
      access_token: "<your_own_value>"
      wireless_controller_vap:
        acct_interim_interval: "3"
        alias: "<your_own_value>"
        auth: "psk"
        broadcast_ssid: "enable"
        broadcast_suppression: "dhcp-up"
        captive_portal_ac_name: "<your_own_value>"
        captive_portal_macauth_radius_secret: "<your_own_value>"
        captive_portal_macauth_radius_server: "<your_own_value>"
        captive_portal_radius_secret: "<your_own_value>"
        captive_portal_radius_server: "<your_own_value>"
        captive_portal_session_timeout_interval: "13"
        dhcp_lease_time: "14"
        dhcp_option82_circuit_id_insertion: "style-1"
        dhcp_option82_insertion: "enable"
        dhcp_option82_remote_id_insertion: "style-1"
        dynamic_vlan: "enable"
        eap_reauth: "enable"
        eap_reauth_intv: "20"
        eapol_key_retries: "disable"
        encrypt: "TKIP"
        external_fast_roaming: "enable"
        external_logout: "<your_own_value>"
        external_web: "<your_own_value>"
        fast_bss_transition: "disable"
        fast_roaming: "enable"
        ft_mobility_domain: "28"
        ft_over_ds: "disable"
        ft_r0_key_lifetime: "30"
        gtk_rekey: "enable"
        gtk_rekey_intv: "32"
        hotspot20_profile: "<your_own_value>"
        intra_vap_privacy: "enable"
        ip: "<your_own_value>"
        key: "<your_own_value>"
        keyindex: "37"
        ldpc: "disable"
        local_authentication: "enable"
        local_bridging: "enable"
        local_lan: "allow"
        local_standalone: "enable"
        local_standalone_nat: "enable"
        mac_auth_bypass: "enable"
        mac_filter: "enable"
        mac_filter_list:
         -
            id:  "47"
            mac: "<your_own_value>"
            mac_filter_policy: "allow"
        mac_filter_policy_other: "allow"
        max_clients: "51"
        max_clients_ap: "52"
        me_disable_thresh: "53"
        mesh_backhaul: "enable"
        mpsk: "enable"
        mpsk_concurrent_clients: "56"
        mpsk_key:
         -
            comment: "Comment."
            concurrent_clients: "<your_own_value>"
            key_name: "<your_own_value>"
            passphrase: "<your_own_value>"
        multicast_enhance: "enable"
        multicast_rate: "0"
        name: "default_name_64"
        okc: "disable"
        passphrase: "<your_own_value>"
        pmf: "disable"
        pmf_assoc_comeback_timeout: "68"
        pmf_sa_query_retry_timeout: "69"
        portal_message_override_group: "<your_own_value>"
        portal_message_overrides:
            auth_disclaimer_page: "<your_own_value>"
            auth_login_failed_page: "<your_own_value>"
            auth_login_page: "<your_own_value>"
            auth_reject_page: "<your_own_value>"
        portal_type: "auth"
        probe_resp_suppression: "enable"
        probe_resp_threshold: "<your_own_value>"
        ptk_rekey: "enable"
        ptk_rekey_intv: "80"
        qos_profile: "<your_own_value>"
        quarantine: "enable"
        radius_mac_auth: "enable"
        radius_mac_auth_server: "<your_own_value>"
        radius_server: "<your_own_value>"
        rates_11a: "1"
        rates_11ac_ss12: "mcs0/1"
        rates_11ac_ss34: "mcs0/3"
        rates_11bg: "1"
        rates_11n_ss12: "mcs0/1"
        rates_11n_ss34: "mcs16/3"
        schedule: "<your_own_value>"
        security: "open"
        security_exempt_list: "<your_own_value>"
        security_obsolete_option: "enable"
        security_redirect_url: "<your_own_value>"
        selected_usergroups:
         -
            name: "default_name_98"
        split_tunneling: "enable"
        ssid: "<your_own_value>"
        tkip_counter_measure: "enable"
        usergroup:
         -
            name: "default_name_103"
        utm_profile: "<your_own_value>"
        vdom: "<your_own_value> (source system.vdom.name)"
        vlan_auto: "enable"
        vlan_pool:
         -
            id:  "108"
            wtp_group: "<your_own_value>"
        vlan_pooling: "wtp-group"
        vlanid: "111"
        voice_enterprise: "disable"

Return Values

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

  • build - Build number of the fortigate image returned: always type: str sample: 1547
  • http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
  • http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
  • mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
  • name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
  • path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
  • revision - Internal revision number returned: always type: str sample: 17.0.2.10658
  • serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
  • status - Indication of the operation's result returned: always type: str sample: success
  • vdom - Virtual domain used returned: always type: str sample: root
  • version - Version of the FortiGate returned: always type: str sample: v5.6.3

Status

  • This module is not guaranteed to have a backwards compatible interface.

Authors

  • Link Zheng (@chillancezen)
  • Jie Xue (@JieX19)
  • Hongbin Lu (@fgtdev-hblu)
  • Frank Shen (@frankshen01)
  • Miguel Angel Munoz (@mamunozgonzalez)
  • Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation, you can create a pull request to improve it.