fortios_system_accprofile – Configure access profiles for system administrators in Fortinet’s FortiOS and FortiGate.
New in version 2.0.0.
Synopsis
This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify system feature and accprofile category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0
Requirements
The below requirements are needed on the host that executes this module.
ansible>=2.15
Tips
Using member operation to add an element to an existing object.
FortiOS Version Compatibility
Supported Version Ranges: v6.0.0 -> 7.4.3
Parameters
- access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: false
- enable_log - Enable/Disable logging for task. type: bool required: false default: False
- vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
- member_path - Member attribute path to operate on. type: str
- member_state - Add or delete a member under specified attribute path. type: str choices: present, absent
- state - Indicates whether to create or remove the object. type: str required: true choices: present, absent
- system_accprofile - Configure access profiles for system administrators. type: dict more...
- admintimeout - Administrator timeout for this access profile (0 - 480 min). type: int more...
- admintimeout_override - Enable/disable overriding the global administrator idle timeout. type: str choices: enable, disable more...
- authgrp - Administrator access to Users and Devices. type: str choices: none, read, read-write more...
- cli_config - Enable/disable permission to run config commands. type: str choices: enable, disable more...
- cli_diagnose - Enable/disable permission to run diagnostic commands. type: str choices: enable, disable more...
- cli_exec - Enable/disable permission to run execute commands. type: str choices: enable, disable more...
- cli_get - Enable/disable permission to run get commands. type: str choices: enable, disable more...
- cli_show - Enable/disable permission to run show commands. type: str choices: enable, disable more...
- comments - Comment. type: str more...
- ftviewgrp - FortiView. type: str choices: none, read, read-write more...
- fwgrp - Administrator access to the Firewall configuration. type: str choices: none, read, read-write, custom more...
- fwgrp_permission - Custom firewall permission. type: dict more...
- address - Address Configuration. type: str choices: none, read, read-write more...
- others - Other Firewall Configuration. type: str choices: none, read, read-write more...
- policy - Policy Configuration. type: str choices: none, read, read-write more...
- schedule - Schedule Configuration. type: str choices: none, read, read-write more...
- service - Service Configuration. type: str choices: none, read, read-write more...
- loggrp - Administrator access to Logging and Reporting including viewing log messages. type: str choices: none, read, read-write, custom more...
- loggrp_permission - Custom Log & Report permission. type: dict more...
- config - Log & Report configuration. type: str choices: none, read, read-write more...
- data_access - Log & Report Data Access. type: str choices: none, read, read-write more...
- report_access - Log & Report Report Access. type: str choices: none, read, read-write more...
- threat_weight - Log & Report Threat Weight. type: str choices: none, read, read-write more...
- name - Profile name. type: str required: true more...
- netgrp - Network Configuration. type: str choices: none, read, read-write, custom more...
- netgrp_permission - Custom network permission. type: dict more...
- cfg - Network Configuration. type: str choices: none, read, read-write more...
- packet_capture - Packet Capture Configuration. type: str choices: none, read, read-write more...
- route_cfg - Router Configuration. type: str choices: none, read, read-write more...
- scope - Scope of admin access: global or specific VDOM(s). type: str choices: vdom, global more...
- secfabgrp - Security Fabric. type: str choices: none, read, read-write more...
- sysgrp - System Configuration. type: str choices: none, read, read-write, custom more...
- sysgrp_permission - Custom system permission. type: dict more...
- admin - Administrator Users. type: str choices: none, read, read-write more...
- cfg - System Configuration. type: str choices: none, read, read-write more...
- mnt - Maintenance. type: str choices: none, read, read-write more...
- upd - FortiGuard Updates. type: str choices: none, read, read-write more...
- system_diagnostics - Enable/disable permission to run system diagnostic commands. type: str choices: enable, disable more...
- system_execute_ssh - Enable/disable permission to execute SSH commands. type: str choices: enable, disable more...
- system_execute_telnet - Enable/disable permission to execute TELNET commands. type: str choices: enable, disable more...
- utmgrp - Administrator access to Security Profiles. type: str choices: none, read, read-write, custom more...
- utmgrp_permission - Custom Security Profile permissions. type: dict more...
- antivirus - Antivirus profiles and settings. type: str choices: none, read, read-write more...
- application_control - Application Control profiles and settings. type: str choices: none, read, read-write more...
- casb - Inline CASB filter profile and settings type: str choices: none, read, read-write more...
- data_leak_prevention - DLP profiles and settings. type: str choices: none, read, read-write more...
- data_loss_prevention - DLP profiles and settings. type: str choices: none, read, read-write more...
- dnsfilter - DNS Filter profiles and settings. type: str choices: none, read, read-write more...
- emailfilter - Email Filter and settings. type: str choices: none, read, read-write more...
- endpoint_control - FortiClient Profiles. type: str choices: none, read, read-write more...
- file_filter - File-filter profiles and settings. type: str choices: none, read, read-write more...
- icap - ICAP profiles and settings. type: str choices: none, read, read-write more...
- ips - IPS profiles and settings. type: str choices: none, read, read-write more...
- mmsgtp - UTM permission. type: str choices: none, read, read-write more...
- spamfilter - AntiSpam filter and settings. type: str choices: none, read, read-write more...
- videofilter - Video filter profiles and settings. type: str choices: none, read, read-write more...
- virtual_patch - Virtual patch profiles and settings. type: str choices: none, read, read-write more...
- voip - VoIP profiles and settings. type: str choices: none, read, read-write more...
- waf - Web Application Firewall profiles and settings. type: str choices: none, read, read-write more...
- webfilter - Web Filter profiles and settings. type: str choices: none, read, read-write more...
- vpngrp - Administrator access to IPsec, SSL, PPTP, and L2TP VPN. type: str choices: none, read, read-write more...
- wanoptgrp - Administrator access to WAN Opt & Cache. type: str choices: none, read, read-write more...
- wifi - Administrator access to the WiFi controller and Switch controller. type: str choices: none, read, read-write more...
Notes
Note
Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks
Examples
- name: Configure access profiles for system administrators.
fortinet.fortios.fortios_system_accprofile:
vdom: "{{ vdom }}"
state: "present"
access_token: "<your_own_value>"
system_accprofile:
admintimeout: "10"
admintimeout_override: "enable"
authgrp: "none"
cli_config: "enable"
cli_diagnose: "enable"
cli_exec: "enable"
cli_get: "enable"
cli_show: "enable"
comments: "<your_own_value>"
ftviewgrp: "none"
fwgrp: "none"
fwgrp_permission:
address: "none"
others: "none"
policy: "none"
schedule: "none"
service: "none"
loggrp: "none"
loggrp_permission:
config: "none"
data_access: "none"
report_access: "none"
threat_weight: "none"
name: "default_name_26"
netgrp: "none"
netgrp_permission:
cfg: "none"
packet_capture: "none"
route_cfg: "none"
scope: "vdom"
secfabgrp: "none"
sysgrp: "none"
sysgrp_permission:
admin: "none"
cfg: "none"
mnt: "none"
upd: "none"
system_diagnostics: "enable"
system_execute_ssh: "enable"
system_execute_telnet: "enable"
utmgrp: "none"
utmgrp_permission:
antivirus: "none"
application_control: "none"
casb: "none"
data_leak_prevention: "none"
data_loss_prevention: "none"
dnsfilter: "none"
emailfilter: "none"
endpoint_control: "none"
file_filter: "none"
icap: "none"
ips: "none"
mmsgtp: "none"
spamfilter: "none"
videofilter: "none"
virtual_patch: "none"
voip: "none"
waf: "none"
webfilter: "none"
vpngrp: "none"
wanoptgrp: "none"
wifi: "none"
Return Values
Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:
- build - Build number of the fortigate image returned: always type: str sample: 1547
- http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
- http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
- mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
- name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
- path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
- revision - Internal revision number returned: always type: str sample: 17.0.2.10658
- serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
- status - Indication of the operation's result returned: always type: str sample: success
- vdom - Virtual domain used returned: always type: str sample: root
- version - Version of the FortiGate returned: always type: str sample: v5.6.3
Status
This module is not guaranteed to have a backwards compatible interface.