fortios_firewall_vip – Configure virtual IP for IPv4 in Fortinet’s FortiOS and FortiGate.
New in version 2.0.0.
Synopsis
This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify firewall feature and vip category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0
Requirements
The below requirements are needed on the host that executes this module.
ansible>=2.15
Tips
Using member operation to add an element to an existing object.
FortiOS Version Compatibility
Supported Version Ranges: v6.0.0 -> 7.4.3
Parameters
- access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: false
- enable_log - Enable/Disable logging for task. type: bool required: false default: False
- vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
- member_path - Member attribute path to operate on. type: str
- member_state - Add or delete a member under specified attribute path. type: str choices: present, absent
- state - Indicates whether to create or remove the object. type: str required: true choices: present, absent
- firewall_vip - Configure virtual IP for IPv4. type: dict more...
- add_nat46_route - Enable/disable adding NAT46 route. type: str choices: disable, enable more...
- arp_reply - Enable to respond to ARP requests for this virtual IP address. Enabled by default. type: str choices: disable, enable more...
- color - Color of icon on the GUI. type: int more...
- comment - Comment. type: str more...
- dns_mapping_ttl - DNS mapping TTL (Set to zero to use TTL in DNS response). type: int more...
- extaddr - External FQDN address name. type: list member_path: extaddr:name more...
- name - Address name. Source firewall.address.name firewall.addrgrp.name. type: str required: true more...
- extintf - Interface connected to the source network that receives the packets that will be forwarded to the destination network. Source system .interface.name. type: str more...
- extip - IP address or address range on the external interface that you want to map to an address or address range on the destination network. type: str more...
- extport - Incoming port number range that you want to map to a port number range on the destination network. type: str more...
- gratuitous_arp_interval - Enable to have the VIP send gratuitous ARPs. 0=disabled. Set from 5 up to 8640000 seconds to enable. type: int more...
- gslb_domain_name - Domain to use when integrating with FortiGSLB. type: str more...
- gslb_hostname - Hostname to use within the configured FortiGSLB domain. type: str more...
- gslb_public_ips - Publicly accessible IP addresses for the FortiGSLB service. type: list member_path: gslb_public_ips:index more...
- index - Index of this public IP setting. see Notes. type: int required: true more...
- ip - The publicly accessible IP address. type: str more...
- h2_support - Enable/disable HTTP2 support . type: str choices: enable, disable more...
- h3_support - Enable/disable HTTP3/QUIC support . type: str choices: enable, disable more...
- http_cookie_age - Time in minutes that client web browsers should keep a cookie. Default is 60 minutes. 0 = no time limit. type: int more...
- http_cookie_domain - Domain that HTTP cookie persistence should apply to. type: str more...
- http_cookie_domain_from_host - Enable/disable use of HTTP cookie domain from host field in HTTP. type: str choices: disable, enable more...
- http_cookie_generation - Generation of HTTP cookie to be accepted. Changing invalidates all existing cookies. type: int more...
- http_cookie_path - Limit HTTP cookie persistence to the specified path. type: str more...
- http_cookie_share - Control sharing of cookies across virtual servers. Use of same-ip means a cookie from one virtual server can be used by another. Disable stops cookie sharing. type: str choices: disable, same-ip more...
- http_ip_header - For HTTP multiplexing, enable to add the original client IP address in the XForwarded-For HTTP header. type: str choices: enable, disable more...
- http_ip_header_name - For HTTP multiplexing, enter a custom HTTPS header name. The original client IP address is added to this header. If empty, X-Forwarded-For is used. type: str more...
- http_multiplex - Enable/disable HTTP multiplexing. type: str choices: enable, disable more...
- http_multiplex_max_concurrent_request - Maximum number of concurrent requests that a multiplex server can handle . type: int more...
- http_multiplex_max_request - Maximum number of requests that a multiplex server can handle before disconnecting sessions . type: int more...
- http_multiplex_ttl - Time-to-live for idle connections to servers. type: int more...
- http_redirect - Enable/disable redirection of HTTP to HTTPS. type: str choices: enable, disable more...
- http_supported_max_version - Maximum supported HTTP versions. default = HTTP2 type: str choices: http1, http2 more...
- https_cookie_secure - Enable/disable verification that inserted HTTPS cookies are secure. type: str choices: disable, enable more...
- id - Custom defined ID. type: int more...
- ipv6_mappedip - Range of mapped IPv6 addresses. Specify the start IPv6 address followed by a space and the end IPv6 address. type: str more...
- ipv6_mappedport - IPv6 port number range on the destination network to which the external port number range is mapped. type: str more...
- ldb_method - Method used to distribute sessions to real servers. type: str choices: static, round-robin, weighted, least-session, least-rtt, first-alive, http-host more...
- mapped_addr - Mapped FQDN address name. Source firewall.address.name. type: str more...
- mappedip - IP address or address range on the destination network to which the external IP address is mapped. type: list member_path: mappedip:range more...
- range - Mapped IP range. type: str required: true more...
- mappedport - Port number range on the destination network to which the external port number range is mapped. type: str more...
- max_embryonic_connections - Maximum number of incomplete connections. type: int more...
- monitor - Name of the health check monitor to use when polling to determine a virtual server"s connectivity status. type: list member_path: monitor:name more...
- name - Health monitor name. Source firewall.ldb-monitor.name. type: str required: true more...
- name - Virtual IP name. type: str required: true more...
- nat_source_vip - Enable/disable forcing the source NAT mapped IP to the external IP for all traffic. type: str choices: disable, enable more...
- nat44 - Enable/disable NAT44. type: str choices: disable, enable more...
- nat46 - Enable/disable NAT46. type: str choices: disable, enable more...
- one_click_gslb_server - Enable/disable one click GSLB server integration with FortiGSLB. type: str choices: disable, enable more...
- outlook_web_access - Enable to add the Front-End-Https header for Microsoft Outlook Web Access. type: str choices: disable, enable more...
- persistence - Configure how to make sure that clients connect to the same server every time they make a request that is part of the same session. type: str choices: none, http-cookie, ssl-session-id more...
- portforward - Enable/disable port forwarding. type: str choices: disable, enable more...
- portmapping_type - Port mapping type. type: str choices: 1-to-1, m-to-n more...
- protocol - Protocol to use when forwarding packets. type: str choices: tcp, udp, sctp, icmp more...
- quic - QUIC setting. type: dict more...
- ack_delay_exponent - ACK delay exponent (1 - 20). type: int more...
- active_connection_id_limit - Active connection ID limit (1 - 8). type: int more...
- active_migration - Enable/disable active migration . type: str choices: enable, disable more...
- grease_quic_bit - Enable/disable grease QUIC bit . type: str choices: enable, disable more...
- max_ack_delay - Maximum ACK delay in milliseconds (1 - 16383). type: int more...
- max_datagram_frame_size - Maximum datagram frame size in bytes (1 - 1500). type: int more...
- max_idle_timeout - Maximum idle timeout milliseconds (1 - 60000). type: int more...
- max_udp_payload_size - Maximum UDP payload size in bytes (1200 - 1500). type: int more...
- realservers - Select the real servers that this server load balancing VIP will distribute traffic to. type: list member_path: realservers:id more...
- address - Dynamic address of the real server. Source firewall.address.name. type: str more...
- client_ip - Only clients in this IP range can connect to this real server. type: str more...
- healthcheck - Enable to check the responsiveness of the real server before forwarding traffic. type: str choices: disable, enable, vip more...
- holddown_interval - Time in seconds that the health check monitor continues to monitor and unresponsive server that should be active. type: int more...
- http_host - HTTP server domain name in HTTP header. type: str more...
- id - Real server ID. see Notes. type: int required: true more...
- ip - IP address of the real server. type: str more...
- max_connections - Max number of active connections that can be directed to the real server. When reached, sessions are sent to other real servers. type: int more...
- monitor - Name of the health check monitor to use when polling to determine a virtual server"s connectivity status. Source firewall .ldb-monitor.name. type: list member_path: realservers:id/monitor:name more...
- name - Health monitor name. Source firewall.ldb-monitor.name. type: str required: true more...
- port - Port for communicating with the real server. Required if port forwarding is enabled. type: int more...
- status - Set the status of the real server to active so that it can accept traffic, or on standby or disabled so no traffic is sent. type: str choices: active, standby, disable more...
- translate_host - Enable/disable translation of hostname/IP from virtual server to real server. type: str choices: enable, disable more...
- type - Type of address. type: str choices: ip, address more...
- weight - Weight of the real server. If weighted load balancing is enabled, the server with the highest weight gets more connections. type: int more...
- server_type - Protocol to be load balanced by the virtual server (also called the server load balance virtual IP). type: str choices: http, https, imaps, pop3s, smtps, ssl, tcp, udp, ip, ssh more...
- service - Service name. type: list member_path: service:name more...
- name - Service name. Source firewall.service.custom.name firewall.service.group.name. type: str required: true more...
- src_filter - Source address filter. Each address must be either an IP/subnet (x.x.x.x/n) or a range (x.x.x.x-y.y.y.y). Separate addresses with spaces. type: list member_path: src_filter:range more...
- range - Source-filter range. type: str required: true more...
- srcintf_filter - Interfaces to which the VIP applies. Separate the names with spaces. type: list member_path: srcintf_filter:interface_name more...
- interface_name - Interface name. Source system.interface.name. type: str required: true more...
- ssl_accept_ffdhe_groups - Enable/disable FFDHE cipher suite for SSL key exchange. type: str choices: enable, disable more...
- ssl_algorithm - Permitted encryption algorithms for SSL sessions according to encryption strength. type: str choices: high, medium, low, custom more...
- ssl_certificate - The name of the certificate to use for SSL handshake. Source vpn.certificate.local.name. type: str more...
- ssl_certificate_dict - Name of the certificate to use for SSL handshake. Use the parameter ssl-certificate instead if the fortiOS firmwear <= 7.4.1 type: list member_path: ssl_certificate_dict:name more...
- name - Certificate list. Source vpn.certificate.local.name. type: str required: true more...
- ssl_cipher_suites - SSL/TLS cipher suites acceptable from a client, ordered by priority. type: list member_path: ssl_cipher_suites:priority more...
- cipher - Cipher suite name. type: str choices: TLS-AES-128-GCM-SHA256, TLS-AES-256-GCM-SHA384, TLS-CHACHA20-POLY1305-SHA256, TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256, TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256, TLS-DHE-RSA-WITH-CHACHA20-POLY1305-SHA256, TLS-DHE-RSA-WITH-AES-128-CBC-SHA, TLS-DHE-RSA-WITH-AES-256-CBC-SHA, TLS-DHE-RSA-WITH-AES-128-CBC-SHA256, TLS-DHE-RSA-WITH-AES-128-GCM-SHA256, TLS-DHE-RSA-WITH-AES-256-CBC-SHA256, TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, TLS-DHE-DSS-WITH-AES-128-CBC-SHA, TLS-DHE-DSS-WITH-AES-256-CBC-SHA, TLS-DHE-DSS-WITH-AES-128-CBC-SHA256, TLS-DHE-DSS-WITH-AES-128-GCM-SHA256, TLS-DHE-DSS-WITH-AES-256-CBC-SHA256, TLS-DHE-DSS-WITH-AES-256-GCM-SHA384, TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA, TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256, TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256, TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA, TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384, TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA, TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256, TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256, TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA, TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384, TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384, TLS-RSA-WITH-AES-128-CBC-SHA, TLS-RSA-WITH-AES-256-CBC-SHA, TLS-RSA-WITH-AES-128-CBC-SHA256, TLS-RSA-WITH-AES-128-GCM-SHA256, TLS-RSA-WITH-AES-256-CBC-SHA256, TLS-RSA-WITH-AES-256-GCM-SHA384, TLS-RSA-WITH-CAMELLIA-128-CBC-SHA, TLS-RSA-WITH-CAMELLIA-256-CBC-SHA, TLS-RSA-WITH-CAMELLIA-128-CBC-SHA256, TLS-RSA-WITH-CAMELLIA-256-CBC-SHA256, TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA, TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA, TLS-DHE-DSS-WITH-CAMELLIA-128-CBC-SHA, TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA, TLS-DHE-DSS-WITH-CAMELLIA-256-CBC-SHA, TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA256, TLS-DHE-DSS-WITH-CAMELLIA-128-CBC-SHA256, TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA256, TLS-DHE-DSS-WITH-CAMELLIA-256-CBC-SHA256, TLS-DHE-RSA-WITH-SEED-CBC-SHA, TLS-DHE-DSS-WITH-SEED-CBC-SHA, TLS-DHE-RSA-WITH-ARIA-128-CBC-SHA256, TLS-DHE-RSA-WITH-ARIA-256-CBC-SHA384, TLS-DHE-DSS-WITH-ARIA-128-CBC-SHA256, TLS-DHE-DSS-WITH-ARIA-256-CBC-SHA384, TLS-RSA-WITH-SEED-CBC-SHA, TLS-RSA-WITH-ARIA-128-CBC-SHA256, TLS-RSA-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-ARIA-128-CBC-SHA256, TLS-ECDHE-RSA-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-ECDSA-WITH-ARIA-128-CBC-SHA256, TLS-ECDHE-ECDSA-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-RC4-128-SHA, TLS-ECDHE-RSA-WITH-3DES-EDE-CBC-SHA, TLS-DHE-DSS-WITH-3DES-EDE-CBC-SHA, TLS-RSA-WITH-3DES-EDE-CBC-SHA, TLS-RSA-WITH-RC4-128-MD5, TLS-RSA-WITH-RC4-128-SHA, TLS-DHE-RSA-WITH-DES-CBC-SHA, TLS-DHE-DSS-WITH-DES-CBC-SHA, TLS-RSA-WITH-DES-CBC-SHA more...
- priority - SSL/TLS cipher suites priority. see Notes. type: int required: true more...
- versions - SSL/TLS versions that the cipher suite can be used with. type: list choices: ssl-3.0, tls-1.0, tls-1.1, tls-1.2, tls-1.3 more...
- ssl_client_fallback - Enable/disable support for preventing Downgrade Attacks on client connections (RFC 7507). type: str choices: disable, enable more...
- ssl_client_rekey_count - Maximum length of data in MB before triggering a client rekey (0 = disable). type: int more...
- ssl_client_renegotiation - Allow, deny, or require secure renegotiation of client sessions to comply with RFC 5746. type: str choices: allow, deny, secure more...
- ssl_client_session_state_max - Maximum number of client to FortiGate SSL session states to keep. type: int more...
- ssl_client_session_state_timeout - Number of minutes to keep client to FortiGate SSL session state. type: int more...
- ssl_client_session_state_type - How to expire SSL sessions for the segment of the SSL connection between the client and the FortiGate. type: str choices: disable, time, count, both more...
- ssl_dh_bits - Number of bits to use in the Diffie-Hellman exchange for RSA encryption of SSL sessions. type: str choices: 768, 1024, 1536, 2048, 3072, 4096 more...
- ssl_hpkp - Enable/disable including HPKP header in response. type: str choices: disable, enable, report-only more...
- ssl_hpkp_age - Number of seconds the client should honor the HPKP setting. type: int more...
- ssl_hpkp_backup - Certificate to generate backup HPKP pin from. Source vpn.certificate.local.name vpn.certificate.ca.name. type: str more...
- ssl_hpkp_include_subdomains - Indicate that HPKP header applies to all subdomains. type: str choices: disable, enable more...
- ssl_hpkp_primary - Certificate to generate primary HPKP pin from. Source vpn.certificate.local.name vpn.certificate.ca.name. type: str more...
- ssl_hpkp_report_uri - URL to report HPKP violations to. type: str more...
- ssl_hsts - Enable/disable including HSTS header in response. type: str choices: disable, enable more...
- ssl_hsts_age - Number of seconds the client should honor the HSTS setting. type: int more...
- ssl_hsts_include_subdomains - Indicate that HSTS header applies to all subdomains. type: str choices: disable, enable more...
- ssl_http_location_conversion - Enable to replace HTTP with HTTPS in the reply"s Location HTTP header field. type: str choices: enable, disable more...
- ssl_http_match_host - Enable/disable HTTP host matching for location conversion. type: str choices: enable, disable more...
- ssl_max_version - Highest SSL/TLS version acceptable from a client. type: str choices: ssl-3.0, tls-1.0, tls-1.1, tls-1.2, tls-1.3 more...
- ssl_min_version - Lowest SSL/TLS version acceptable from a client. type: str choices: ssl-3.0, tls-1.0, tls-1.1, tls-1.2, tls-1.3 more...
- ssl_mode - Apply SSL offloading between the client and the FortiGate (half) or from the client to the FortiGate and from the FortiGate to the server (full). type: str choices: half, full more...
- ssl_pfs - Select the cipher suites that can be used for SSL perfect forward secrecy (PFS). Applies to both client and server sessions. type: str choices: require, deny, allow more...
- ssl_send_empty_frags - Enable/disable sending empty fragments to avoid CBC IV attacks (SSL 3.0 & TLS 1.0 only). May need to be disabled for compatibility with older systems. type: str choices: enable, disable more...
- ssl_server_algorithm - Permitted encryption algorithms for the server side of SSL full mode sessions according to encryption strength. type: str choices: high, medium, low, custom, client more...
- ssl_server_cipher_suites - SSL/TLS cipher suites to offer to a server, ordered by priority. type: list member_path: ssl_server_cipher_suites:priority more...
- cipher - Cipher suite name. type: str choices: TLS-AES-128-GCM-SHA256, TLS-AES-256-GCM-SHA384, TLS-CHACHA20-POLY1305-SHA256, TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256, TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256, TLS-DHE-RSA-WITH-CHACHA20-POLY1305-SHA256, TLS-DHE-RSA-WITH-AES-128-CBC-SHA, TLS-DHE-RSA-WITH-AES-256-CBC-SHA, TLS-DHE-RSA-WITH-AES-128-CBC-SHA256, TLS-DHE-RSA-WITH-AES-128-GCM-SHA256, TLS-DHE-RSA-WITH-AES-256-CBC-SHA256, TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, TLS-DHE-DSS-WITH-AES-128-CBC-SHA, TLS-DHE-DSS-WITH-AES-256-CBC-SHA, TLS-DHE-DSS-WITH-AES-128-CBC-SHA256, TLS-DHE-DSS-WITH-AES-128-GCM-SHA256, TLS-DHE-DSS-WITH-AES-256-CBC-SHA256, TLS-DHE-DSS-WITH-AES-256-GCM-SHA384, TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA, TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256, TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256, TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA, TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384, TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA, TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256, TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256, TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA, TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384, TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384, TLS-RSA-WITH-AES-128-CBC-SHA, TLS-RSA-WITH-AES-256-CBC-SHA, TLS-RSA-WITH-AES-128-CBC-SHA256, TLS-RSA-WITH-AES-128-GCM-SHA256, TLS-RSA-WITH-AES-256-CBC-SHA256, TLS-RSA-WITH-AES-256-GCM-SHA384, TLS-RSA-WITH-CAMELLIA-128-CBC-SHA, TLS-RSA-WITH-CAMELLIA-256-CBC-SHA, TLS-RSA-WITH-CAMELLIA-128-CBC-SHA256, TLS-RSA-WITH-CAMELLIA-256-CBC-SHA256, TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA, TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA, TLS-DHE-DSS-WITH-CAMELLIA-128-CBC-SHA, TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA, TLS-DHE-DSS-WITH-CAMELLIA-256-CBC-SHA, TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA256, TLS-DHE-DSS-WITH-CAMELLIA-128-CBC-SHA256, TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA256, TLS-DHE-DSS-WITH-CAMELLIA-256-CBC-SHA256, TLS-DHE-RSA-WITH-SEED-CBC-SHA, TLS-DHE-DSS-WITH-SEED-CBC-SHA, TLS-DHE-RSA-WITH-ARIA-128-CBC-SHA256, TLS-DHE-RSA-WITH-ARIA-256-CBC-SHA384, TLS-DHE-DSS-WITH-ARIA-128-CBC-SHA256, TLS-DHE-DSS-WITH-ARIA-256-CBC-SHA384, TLS-RSA-WITH-SEED-CBC-SHA, TLS-RSA-WITH-ARIA-128-CBC-SHA256, TLS-RSA-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-ARIA-128-CBC-SHA256, TLS-ECDHE-RSA-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-ECDSA-WITH-ARIA-128-CBC-SHA256, TLS-ECDHE-ECDSA-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-RC4-128-SHA, TLS-ECDHE-RSA-WITH-3DES-EDE-CBC-SHA, TLS-DHE-DSS-WITH-3DES-EDE-CBC-SHA, TLS-RSA-WITH-3DES-EDE-CBC-SHA, TLS-RSA-WITH-RC4-128-MD5, TLS-RSA-WITH-RC4-128-SHA, TLS-DHE-RSA-WITH-DES-CBC-SHA, TLS-DHE-DSS-WITH-DES-CBC-SHA, TLS-RSA-WITH-DES-CBC-SHA more...
- priority - SSL/TLS cipher suites priority. see Notes. type: int required: true more...
- versions - SSL/TLS versions that the cipher suite can be used with. type: list choices: ssl-3.0, tls-1.0, tls-1.1, tls-1.2, tls-1.3 more...
- ssl_server_max_version - Highest SSL/TLS version acceptable from a server. Use the client setting by default. type: str choices: ssl-3.0, tls-1.0, tls-1.1, tls-1.2, tls-1.3, client more...
- ssl_server_min_version - Lowest SSL/TLS version acceptable from a server. Use the client setting by default. type: str choices: ssl-3.0, tls-1.0, tls-1.1, tls-1.2, tls-1.3, client more...
- ssl_server_renegotiation - Enable/disable secure renegotiation to comply with RFC 5746. type: str choices: enable, disable more...
- ssl_server_session_state_max - Maximum number of FortiGate to Server SSL session states to keep. type: int more...
- ssl_server_session_state_timeout - Number of minutes to keep FortiGate to Server SSL session state. type: int more...
- ssl_server_session_state_type - How to expire SSL sessions for the segment of the SSL connection between the server and the FortiGate. type: str choices: disable, time, count, both more...
- status - Enable/disable VIP. type: str choices: disable, enable more...
- type - Configure a static NAT, load balance, server load balance, access proxy, DNS translation, or FQDN VIP. type: str choices: static-nat, load-balance, server-load-balance, dns-translation, fqdn, access-proxy more...
- uuid - Universally Unique Identifier (UUID; automatically assigned but can be manually reset). type: str more...
- weblogic_server - Enable to add an HTTP header to indicate SSL offloading for a WebLogic server. type: str choices: disable, enable more...
- websphere_server - Enable to add an HTTP header to indicate SSL offloading for a WebSphere server. type: str choices: disable, enable more...
Notes
Note
Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks
Examples
- name: Configure virtual IP for IPv4.
fortinet.fortios.fortios_firewall_vip:
vdom: "{{ vdom }}"
state: "present"
access_token: "<your_own_value>"
firewall_vip:
add_nat46_route: "disable"
arp_reply: "disable"
color: "0"
comment: "Comment."
dns_mapping_ttl: "0"
extaddr:
-
name: "default_name_9 (source firewall.address.name firewall.addrgrp.name)"
extintf: "<your_own_value> (source system.interface.name)"
extip: "<your_own_value>"
extport: "<your_own_value>"
gratuitous_arp_interval: "0"
gslb_domain_name: "<your_own_value>"
gslb_hostname: "myhostname"
gslb_public_ips:
-
index: "<you_own_value>"
ip: "<your_own_value>"
h2_support: "enable"
h3_support: "enable"
http_cookie_age: "60"
http_cookie_domain: "<your_own_value>"
http_cookie_domain_from_host: "disable"
http_cookie_generation: "0"
http_cookie_path: "<your_own_value>"
http_cookie_share: "disable"
http_ip_header: "enable"
http_ip_header_name: "<your_own_value>"
http_multiplex: "enable"
http_multiplex_max_concurrent_request: "0"
http_multiplex_max_request: "0"
http_multiplex_ttl: "15"
http_redirect: "enable"
http_supported_max_version: "http1"
https_cookie_secure: "disable"
id: "36"
ipv6_mappedip: "<your_own_value>"
ipv6_mappedport: "<your_own_value>"
ldb_method: "static"
mapped_addr: "<your_own_value> (source firewall.address.name)"
mappedip:
-
range: "<your_own_value>"
mappedport: "<your_own_value>"
max_embryonic_connections: "1000"
monitor:
-
name: "default_name_46 (source firewall.ldb-monitor.name)"
name: "default_name_47"
nat_source_vip: "disable"
nat44: "disable"
nat46: "disable"
one_click_gslb_server: "disable"
outlook_web_access: "disable"
persistence: "none"
portforward: "disable"
portmapping_type: "1-to-1"
protocol: "tcp"
quic:
ack_delay_exponent: "3"
active_connection_id_limit: "2"
active_migration: "enable"
grease_quic_bit: "enable"
max_ack_delay: "25"
max_datagram_frame_size: "1500"
max_idle_timeout: "30000"
max_udp_payload_size: "1500"
realservers:
-
address: "<your_own_value> (source firewall.address.name)"
client_ip: "<your_own_value>"
healthcheck: "disable"
holddown_interval: "300"
http_host: "myhostname"
id: "72"
ip: "<your_own_value>"
max_connections: "0"
monitor:
-
name: "default_name_76 (source firewall.ldb-monitor.name)"
port: "0"
status: "active"
translate_host: "enable"
type: "ip"
weight: "1"
server_type: "http"
service:
-
name: "default_name_84 (source firewall.service.custom.name firewall.service.group.name)"
src_filter:
-
range: "<your_own_value>"
srcintf_filter:
-
interface_name: "<your_own_value> (source system.interface.name)"
ssl_accept_ffdhe_groups: "enable"
ssl_algorithm: "high"
ssl_certificate: "<your_own_value> (source vpn.certificate.local.name)"
ssl_certificate_dict:
-
name: "default_name_93 (source vpn.certificate.local.name)"
ssl_cipher_suites:
-
cipher: "TLS-AES-128-GCM-SHA256"
priority: "<you_own_value>"
versions: "ssl-3.0"
ssl_client_fallback: "disable"
ssl_client_rekey_count: "0"
ssl_client_renegotiation: "allow"
ssl_client_session_state_max: "1000"
ssl_client_session_state_timeout: "30"
ssl_client_session_state_type: "disable"
ssl_dh_bits: "768"
ssl_hpkp: "disable"
ssl_hpkp_age: "5184000"
ssl_hpkp_backup: "<your_own_value> (source vpn.certificate.local.name vpn.certificate.ca.name)"
ssl_hpkp_include_subdomains: "disable"
ssl_hpkp_primary: "<your_own_value> (source vpn.certificate.local.name vpn.certificate.ca.name)"
ssl_hpkp_report_uri: "<your_own_value>"
ssl_hsts: "disable"
ssl_hsts_age: "5184000"
ssl_hsts_include_subdomains: "disable"
ssl_http_location_conversion: "enable"
ssl_http_match_host: "enable"
ssl_max_version: "ssl-3.0"
ssl_min_version: "ssl-3.0"
ssl_mode: "half"
ssl_pfs: "require"
ssl_send_empty_frags: "enable"
ssl_server_algorithm: "high"
ssl_server_cipher_suites:
-
cipher: "TLS-AES-128-GCM-SHA256"
priority: "<you_own_value>"
versions: "ssl-3.0"
ssl_server_max_version: "ssl-3.0"
ssl_server_min_version: "ssl-3.0"
ssl_server_renegotiation: "enable"
ssl_server_session_state_max: "100"
ssl_server_session_state_timeout: "60"
ssl_server_session_state_type: "disable"
status: "disable"
type: "static-nat"
uuid: "<your_own_value>"
weblogic_server: "disable"
websphere_server: "disable"
Return Values
Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:
- build - Build number of the fortigate image returned: always type: str sample: 1547
- http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
- http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
- mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
- name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
- path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
- revision - Internal revision number returned: always type: str sample: 17.0.2.10658
- serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
- status - Indication of the operation's result returned: always type: str sample: success
- vdom - Virtual domain used returned: always type: str sample: root
- version - Version of the FortiGate returned: always type: str sample: v5.6.3
Status
This module is not guaranteed to have a backwards compatible interface.