:source: fortios_vpn_ipsec_phase1_interface.py
:orphan:
.. fortios_vpn_ipsec_phase1_interface:
fortios_vpn_ipsec_phase1_interface -- Configure VPN remote gateway in Fortinet's FortiOS and FortiGate.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
.. versionadded:: 2.0.0
.. contents::
:local:
:depth: 1
Synopsis
--------
- This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify vpn_ipsec feature and phase1_interface category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0
Requirements
------------
The below requirements are needed on the host that executes this module.
- ansible>=2.16
Tips
----
Using member operation to add an element to an existing object.
FortiOS Version Compatibility
-----------------------------
Supported Version Ranges: v6.0.0 -> v7.6.6
Parameters
----------
.. raw:: html
- access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: false
- enable_log - Enable/Disable logging for task. type: bool required: false default: False
- vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
- member_path - Member attribute path to operate on. type: str
- member_state - Add or delete a member under specified attribute path. type: str choices: present, absent
- state - Indicates whether to create or remove the object. type: str required: true choices: present, absent
- vpn_ipsec_phase1_interface - Configure VPN remote gateway. type: dict
more...
| Supported Version Ranges |
| vpn_ipsec_phase1_interface |
v6.0.0 -> 7.6.6 |
- acct_verify - Enable/disable verification of RADIUS accounting record. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| acct_verify |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- add_gw_route - Enable/disable automatically add a route to the remote gateway. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| add_gw_route |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- add_route - Enable/disable control addition of a route to peer destination selector. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| add_route |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
- addke1 - ADDKE1 group. type: list choices: 0, 35, 36, 37, 1080, 1081, 1082, 1083, 1084, 1085, 1089, 1090, 1091, 1092, 1093, 1094
more...
|
Supported Version Ranges |
| addke1 |
v7.6.0 -> 7.6.6 |
| [0] |
v7.6.0 -> 7.6.6 |
| [35] |
v7.6.1 -> 7.6.6 |
| [36] |
v7.6.1 -> 7.6.6 |
| [37] |
v7.6.1 -> 7.6.6 |
| [1080] |
v7.6.0 -> 7.6.6 |
| [1081] |
v7.6.0 -> 7.6.6 |
| [1082] |
v7.6.0 -> 7.6.6 |
| [1083] |
v7.6.1 -> 7.6.6 |
| [1084] |
v7.6.1 -> 7.6.6 |
| [1085] |
v7.6.1 -> 7.6.6 |
| [1089] |
v7.6.1 -> 7.6.6 |
| [1090] |
v7.6.1 -> 7.6.6 |
| [1091] |
v7.6.1 -> 7.6.6 |
| [1092] |
v7.6.1 -> 7.6.6 |
| [1093] |
v7.6.1 -> 7.6.6 |
| [1094] |
v7.6.1 -> 7.6.6 |
- addke2 - ADDKE2 group. type: list choices: 0, 35, 36, 37, 1080, 1081, 1082, 1083, 1084, 1085, 1089, 1090, 1091, 1092, 1093, 1094
more...
|
Supported Version Ranges |
| addke2 |
v7.6.0 -> 7.6.6 |
| [0] |
v7.6.0 -> 7.6.6 |
| [35] |
v7.6.1 -> 7.6.6 |
| [36] |
v7.6.1 -> 7.6.6 |
| [37] |
v7.6.1 -> 7.6.6 |
| [1080] |
v7.6.0 -> 7.6.6 |
| [1081] |
v7.6.0 -> 7.6.6 |
| [1082] |
v7.6.0 -> 7.6.6 |
| [1083] |
v7.6.1 -> 7.6.6 |
| [1084] |
v7.6.1 -> 7.6.6 |
| [1085] |
v7.6.1 -> 7.6.6 |
| [1089] |
v7.6.1 -> 7.6.6 |
| [1090] |
v7.6.1 -> 7.6.6 |
| [1091] |
v7.6.1 -> 7.6.6 |
| [1092] |
v7.6.1 -> 7.6.6 |
| [1093] |
v7.6.1 -> 7.6.6 |
| [1094] |
v7.6.1 -> 7.6.6 |
- addke3 - ADDKE3 group. type: list choices: 0, 35, 36, 37, 1080, 1081, 1082, 1083, 1084, 1085, 1089, 1090, 1091, 1092, 1093, 1094
more...
|
Supported Version Ranges |
| addke3 |
v7.6.0 -> 7.6.6 |
| [0] |
v7.6.0 -> 7.6.6 |
| [35] |
v7.6.1 -> 7.6.6 |
| [36] |
v7.6.1 -> 7.6.6 |
| [37] |
v7.6.1 -> 7.6.6 |
| [1080] |
v7.6.0 -> 7.6.6 |
| [1081] |
v7.6.0 -> 7.6.6 |
| [1082] |
v7.6.0 -> 7.6.6 |
| [1083] |
v7.6.1 -> 7.6.6 |
| [1084] |
v7.6.1 -> 7.6.6 |
| [1085] |
v7.6.1 -> 7.6.6 |
| [1089] |
v7.6.1 -> 7.6.6 |
| [1090] |
v7.6.1 -> 7.6.6 |
| [1091] |
v7.6.1 -> 7.6.6 |
| [1092] |
v7.6.1 -> 7.6.6 |
| [1093] |
v7.6.1 -> 7.6.6 |
| [1094] |
v7.6.1 -> 7.6.6 |
- addke4 - ADDKE4 group. type: list choices: 0, 35, 36, 37, 1080, 1081, 1082, 1083, 1084, 1085, 1089, 1090, 1091, 1092, 1093, 1094
more...
|
Supported Version Ranges |
| addke4 |
v7.6.0 -> 7.6.6 |
| [0] |
v7.6.0 -> 7.6.6 |
| [35] |
v7.6.1 -> 7.6.6 |
| [36] |
v7.6.1 -> 7.6.6 |
| [37] |
v7.6.1 -> 7.6.6 |
| [1080] |
v7.6.0 -> 7.6.6 |
| [1081] |
v7.6.0 -> 7.6.6 |
| [1082] |
v7.6.0 -> 7.6.6 |
| [1083] |
v7.6.1 -> 7.6.6 |
| [1084] |
v7.6.1 -> 7.6.6 |
| [1085] |
v7.6.1 -> 7.6.6 |
| [1089] |
v7.6.1 -> 7.6.6 |
| [1090] |
v7.6.1 -> 7.6.6 |
| [1091] |
v7.6.1 -> 7.6.6 |
| [1092] |
v7.6.1 -> 7.6.6 |
| [1093] |
v7.6.1 -> 7.6.6 |
| [1094] |
v7.6.1 -> 7.6.6 |
- addke5 - ADDKE5 group. type: list choices: 0, 35, 36, 37, 1080, 1081, 1082, 1083, 1084, 1085, 1089, 1090, 1091, 1092, 1093, 1094
more...
|
Supported Version Ranges |
| addke5 |
v7.6.0 -> 7.6.6 |
| [0] |
v7.6.0 -> 7.6.6 |
| [35] |
v7.6.1 -> 7.6.6 |
| [36] |
v7.6.1 -> 7.6.6 |
| [37] |
v7.6.1 -> 7.6.6 |
| [1080] |
v7.6.0 -> 7.6.6 |
| [1081] |
v7.6.0 -> 7.6.6 |
| [1082] |
v7.6.0 -> 7.6.6 |
| [1083] |
v7.6.1 -> 7.6.6 |
| [1084] |
v7.6.1 -> 7.6.6 |
| [1085] |
v7.6.1 -> 7.6.6 |
| [1089] |
v7.6.1 -> 7.6.6 |
| [1090] |
v7.6.1 -> 7.6.6 |
| [1091] |
v7.6.1 -> 7.6.6 |
| [1092] |
v7.6.1 -> 7.6.6 |
| [1093] |
v7.6.1 -> 7.6.6 |
| [1094] |
v7.6.1 -> 7.6.6 |
- addke6 - ADDKE6 group. type: list choices: 0, 35, 36, 37, 1080, 1081, 1082, 1083, 1084, 1085, 1089, 1090, 1091, 1092, 1093, 1094
more...
|
Supported Version Ranges |
| addke6 |
v7.6.0 -> 7.6.6 |
| [0] |
v7.6.0 -> 7.6.6 |
| [35] |
v7.6.1 -> 7.6.6 |
| [36] |
v7.6.1 -> 7.6.6 |
| [37] |
v7.6.1 -> 7.6.6 |
| [1080] |
v7.6.0 -> 7.6.6 |
| [1081] |
v7.6.0 -> 7.6.6 |
| [1082] |
v7.6.0 -> 7.6.6 |
| [1083] |
v7.6.1 -> 7.6.6 |
| [1084] |
v7.6.1 -> 7.6.6 |
| [1085] |
v7.6.1 -> 7.6.6 |
| [1089] |
v7.6.1 -> 7.6.6 |
| [1090] |
v7.6.1 -> 7.6.6 |
| [1091] |
v7.6.1 -> 7.6.6 |
| [1092] |
v7.6.1 -> 7.6.6 |
| [1093] |
v7.6.1 -> 7.6.6 |
| [1094] |
v7.6.1 -> 7.6.6 |
- addke7 - ADDKE7 group. type: list choices: 0, 35, 36, 37, 1080, 1081, 1082, 1083, 1084, 1085, 1089, 1090, 1091, 1092, 1093, 1094
more...
|
Supported Version Ranges |
| addke7 |
v7.6.0 -> 7.6.6 |
| [0] |
v7.6.0 -> 7.6.6 |
| [35] |
v7.6.1 -> 7.6.6 |
| [36] |
v7.6.1 -> 7.6.6 |
| [37] |
v7.6.1 -> 7.6.6 |
| [1080] |
v7.6.0 -> 7.6.6 |
| [1081] |
v7.6.0 -> 7.6.6 |
| [1082] |
v7.6.0 -> 7.6.6 |
| [1083] |
v7.6.1 -> 7.6.6 |
| [1084] |
v7.6.1 -> 7.6.6 |
| [1085] |
v7.6.1 -> 7.6.6 |
| [1089] |
v7.6.1 -> 7.6.6 |
| [1090] |
v7.6.1 -> 7.6.6 |
| [1091] |
v7.6.1 -> 7.6.6 |
| [1092] |
v7.6.1 -> 7.6.6 |
| [1093] |
v7.6.1 -> 7.6.6 |
| [1094] |
v7.6.1 -> 7.6.6 |
- aggregate_member - Enable/disable use as an aggregate member. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| aggregate_member |
v6.2.0 -> 7.6.6 |
| [enable] |
v6.2.0 -> 7.6.6 |
| [disable] |
v6.2.0 -> 7.6.6 |
- aggregate_weight - Link weight for aggregate. type: int
more...
|
Supported Version Ranges |
| aggregate_weight |
v6.4.0 -> 7.6.6 |
- assign_ip - Enable/disable assignment of IP to IPsec interface via configuration method. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| assign_ip |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
- assign_ip_from - Method by which the IP address will be assigned. type: str choices: range, usrgrp, dhcp, name
more...
|
Supported Version Ranges |
| assign_ip_from |
v6.0.0 -> 7.6.6 |
| [range] |
v6.0.0 -> 7.6.6 |
| [usrgrp] |
v6.0.0 -> 7.6.6 |
| [dhcp] |
v6.0.0 -> 7.6.6 |
| [name] |
v6.0.0 -> 7.6.6 |
- authmethod - Authentication method. type: str choices: psk, signature
more...
|
Supported Version Ranges |
| authmethod |
v6.0.0 -> 7.6.6 |
| [psk] |
v6.0.0 -> 7.6.6 |
| [signature] |
v6.0.0 -> 7.6.6 |
- authmethod_remote - Authentication method (remote side). type: str choices: psk, signature
more...
|
Supported Version Ranges |
| authmethod_remote |
v6.0.0 -> 7.6.6 |
| [psk] |
v6.0.0 -> 7.6.6 |
| [signature] |
v6.0.0 -> 7.6.6 |
- authpasswd - XAuth password (max 35 characters). type: str
more...
|
Supported Version Ranges |
| authpasswd |
v6.0.0 -> 7.6.6 |
- authusr - XAuth user name. type: str
more...
|
Supported Version Ranges |
| authusr |
v6.0.0 -> 7.6.6 |
- authusrgrp - Authentication user group. Source user.group.name. type: str
more...
|
Supported Version Ranges |
| authusrgrp |
v6.0.0 -> 7.6.6 |
- auto_discovery_crossover - Allow/block set-up of short-cut tunnels between different network IDs. type: str choices: allow, block
more...
|
Supported Version Ranges |
| auto_discovery_crossover |
v7.4.0 -> 7.6.6 |
| [allow] |
v7.4.0 -> 7.6.6 |
| [block] |
v7.4.0 -> 7.6.6 |
- auto_discovery_dialup_placeholder - Control if this dynamic gateway is used for shortcut connections only. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| auto_discovery_dialup_placeholder |
v7.6.1 -> 7.6.6 |
| [disable] |
v7.6.1 -> 7.6.6 |
| [enable] |
v7.6.1 -> 7.6.6 |
- auto_discovery_forwarder - Enable/disable forwarding auto-discovery short-cut messages. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| auto_discovery_forwarder |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- auto_discovery_offer_interval - Interval between shortcut offer messages in seconds (1 - 300). type: int
more...
|
Supported Version Ranges |
| auto_discovery_offer_interval |
v7.2.0 -> 7.6.6 |
- auto_discovery_psk - Enable/disable use of pre-shared secrets for authentication of auto-discovery tunnels. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| auto_discovery_psk |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- auto_discovery_receiver - Enable/disable accepting auto-discovery short-cut messages. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| auto_discovery_receiver |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- auto_discovery_sender - Enable/disable sending auto-discovery short-cut messages. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| auto_discovery_sender |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- auto_discovery_shortcuts - Control deletion of child short-cut tunnels when the parent tunnel goes down. type: str choices: independent, dependent
more...
|
Supported Version Ranges |
| auto_discovery_shortcuts |
v6.4.4 -> 7.6.6 |
| [independent] |
v6.4.4 -> 7.6.6 |
| [dependent] |
v6.4.4 -> 7.6.6 |
- auto_negotiate - Enable/disable automatic initiation of IKE SA negotiation. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| auto_negotiate |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- auto_transport_threshold - Timeout in seconds before falling back to next transport protocol. type: int
more...
|
Supported Version Ranges |
| auto_transport_threshold |
v7.6.0 -> 7.6.6 |
- azure_ad_autoconnect - Enable/disable Azure AD Auto-Connect for FortiClient. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| azure_ad_autoconnect |
v7.4.2 -> 7.6.6 |
| [enable] |
v7.4.2 -> 7.6.6 |
| [disable] |
v7.4.2 -> 7.6.6 |
- backup_gateway - Instruct unity clients about the backup gateway address(es). type: list member_path: backup_gateway:address
more...
| Supported Version Ranges |
| backup_gateway |
v6.0.0 -> 7.6.6 |
- address - Address of backup gateway. type: str required: true
more...
|
Supported Version Ranges |
| address |
v6.0.0 -> 7.6.6 |
- banner - Message that unity client should display after connecting. type: str
more...
|
Supported Version Ranges |
| banner |
v6.0.0 -> 7.6.6 |
- cert_id_validation - Enable/disable cross validation of peer ID and the identity in the peer"s certificate as specified in RFC 4945. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| cert_id_validation |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- cert_peer_username_strip - Enable/disable domain stripping on certificate identity. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| cert_peer_username_strip |
v7.4.4 -> 7.6.6 |
| [disable] |
v7.4.4 -> 7.6.6 |
| [enable] |
v7.4.4 -> 7.6.6 |
- cert_peer_username_validation - Enable/disable cross validation of peer username and the identity in the peer"s certificate. type: str choices: none, othername, rfc822name, cn
more...
|
Supported Version Ranges |
| cert_peer_username_validation |
v7.4.4 -> 7.6.6 |
| [none] |
v7.4.4 -> 7.6.6 |
| [othername] |
v7.4.4 -> 7.6.6 |
| [rfc822name] |
v7.4.4 -> 7.6.6 |
| [cn] |
v7.4.4 -> 7.6.6 |
- cert_trust_store - CA certificate trust store. type: str choices: local, ems
more...
|
Supported Version Ranges |
| cert_trust_store |
v7.4.2 -> 7.6.6 |
| [local] |
v7.4.2 -> 7.6.6 |
| [ems] |
v7.4.2 -> 7.6.6 |
- certificate - The names of up to 4 signed personal certificates. type: list member_path: certificate:name
more...
| Supported Version Ranges |
| certificate |
v6.0.0 -> 7.6.6 |
- name - Certificate name. Source vpn.certificate.local.name. type: str required: true
more...
|
Supported Version Ranges |
| name |
v6.0.0 -> 7.6.6 |
- childless_ike - Enable/disable childless IKEv2 initiation (RFC 6023). type: str choices: enable, disable
more...
|
Supported Version Ranges |
| childless_ike |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- client_auto_negotiate - Enable/disable allowing the VPN client to bring up the tunnel when there is no traffic. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| client_auto_negotiate |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
- client_keep_alive - Enable/disable allowing the VPN client to keep the tunnel up when there is no traffic. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| client_keep_alive |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
- client_resume - Enable/disable resumption of offline FortiClient sessions. When a FortiClient enabled laptop is closed or enters sleep/hibernate mode, enabling this feature allows FortiClient to keep the tunnel during this period, and allows users to immediately resume using the IPsec tunnel when the device wakes up. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| client_resume |
v7.4.4 -> 7.6.6 |
| [enable] |
v7.4.4 -> 7.6.6 |
| [disable] |
v7.4.4 -> 7.6.6 |
- client_resume_interval - Maximum time in seconds during which a VPN client may resume using a tunnel after a client PC has entered sleep mode or temporarily lost its network connection (120 - 172800). type: int
more...
|
Supported Version Ranges |
| client_resume_interval |
v7.4.4 -> 7.6.6 |
- comments - Comment. type: str
more...
|
Supported Version Ranges |
| comments |
v6.0.0 -> 7.6.6 |
- default_gw - IPv4 address of default route gateway to use for traffic exiting the interface. type: str
more...
|
Supported Version Ranges |
| default_gw |
v6.0.0 -> 7.6.6 |
- default_gw_priority - Priority for default gateway route. A higher priority number signifies a less preferred route. type: int
more...
|
Supported Version Ranges |
| default_gw_priority |
v6.0.0 -> 7.6.6 |
- dev_id - Device ID carried by the device ID notification. type: str
more...
|
Supported Version Ranges |
| dev_id |
v7.4.0 -> 7.6.6 |
- dev_id_notification - Enable/disable device ID notification. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| dev_id_notification |
v7.4.0 -> 7.6.6 |
| [disable] |
v7.4.0 -> 7.6.6 |
| [enable] |
v7.4.0 -> 7.6.6 |
- dhcp_ra_giaddr - Relay agent gateway IP address to use in the giaddr field of DHCP requests. type: str
more...
|
Supported Version Ranges |
| dhcp_ra_giaddr |
v6.2.0 -> v6.2.0 |
v6.2.5 -> 7.6.6 |
- dhcp6_ra_linkaddr - Relay agent IPv6 link address to use in DHCP6 requests. type: str
more...
|
Supported Version Ranges |
| dhcp6_ra_linkaddr |
v6.2.0 -> v6.2.0 |
v6.2.5 -> 7.6.6 |
- dhgrp - DH group. type: list choices: 1, 2, 5, 14, 15, 16, 17, 18, 19, 20, 21, 27, 28, 29, 30, 31, 32
more...
|
Supported Version Ranges |
| dhgrp |
v6.0.0 -> 7.6.6 |
| [1] |
v6.0.0 -> 7.6.6 |
| [2] |
v6.0.0 -> 7.6.6 |
| [5] |
v6.0.0 -> 7.6.6 |
| [14] |
v6.0.0 -> 7.6.6 |
| [15] |
v6.0.0 -> 7.6.6 |
| [16] |
v6.0.0 -> 7.6.6 |
| [17] |
v6.0.0 -> 7.6.6 |
| [18] |
v6.0.0 -> 7.6.6 |
| [19] |
v6.0.0 -> 7.6.6 |
| [20] |
v6.0.0 -> 7.6.6 |
| [21] |
v6.0.0 -> 7.6.6 |
| [27] |
v6.0.0 -> 7.6.6 |
| [28] |
v6.0.0 -> 7.6.6 |
| [29] |
v6.0.0 -> 7.6.6 |
| [30] |
v6.0.0 -> 7.6.6 |
| [31] |
v6.0.0 -> 7.6.6 |
| [32] |
v6.2.0 -> 7.6.6 |
- digital_signature_auth - Enable/disable IKEv2 Digital Signature Authentication (RFC 7427). type: str choices: enable, disable
more...
|
Supported Version Ranges |
| digital_signature_auth |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- distance - Distance for routes added by IKE (1 - 255). type: int
more...
|
Supported Version Ranges |
| distance |
v6.0.0 -> 7.6.6 |
- dns_mode - DNS server mode. type: str choices: manual, auto
more...
|
Supported Version Ranges |
| dns_mode |
v6.0.0 -> 7.6.6 |
| [manual] |
v6.0.0 -> 7.6.6 |
| [auto] |
v6.0.0 -> 7.6.6 |
- dns_suffix_search - One or more DNS domain name suffixes in quotes separated by spaces. type: list member_path: dns_suffix_search:dns_suffix
more...
| Supported Version Ranges |
| dns_suffix_search |
v7.6.4 -> 7.6.6 |
- dns_suffix - DNS suffix. type: str required: true
more...
|
Supported Version Ranges |
| dns_suffix |
v7.6.4 -> 7.6.6 |
- domain - Instruct unity clients about the single default DNS domain. type: str
more...
|
Supported Version Ranges |
| domain |
v6.0.0 -> 7.6.6 |
- dpd - Dead Peer Detection mode. type: str choices: disable, on-idle, on-demand
more...
|
Supported Version Ranges |
| dpd |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [on-idle] |
v6.0.0 -> 7.6.6 |
| [on-demand] |
v6.0.0 -> 7.6.6 |
- dpd_retrycount - Number of DPD retry attempts. type: int
more...
|
Supported Version Ranges |
| dpd_retrycount |
v6.0.0 -> 7.6.6 |
- dpd_retryinterval - DPD retry interval. type: str
more...
|
Supported Version Ranges |
| dpd_retryinterval |
v6.0.0 -> 7.6.6 |
- eap - Enable/disable IKEv2 EAP authentication. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| eap |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- eap_cert_auth - Enable/disable peer certificate authentication in addition to EAP if peer is a FortiClient endpoint. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| eap_cert_auth |
v7.4.2 -> 7.6.6 |
| [enable] |
v7.4.2 -> 7.6.6 |
| [disable] |
v7.4.2 -> 7.6.6 |
- eap_exclude_peergrp - Peer group excluded from EAP authentication. Source user.peergrp.name. type: str
more...
|
Supported Version Ranges |
| eap_exclude_peergrp |
v6.2.0 -> 7.6.6 |
- eap_identity - IKEv2 EAP peer identity type. type: str choices: use-id-payload, send-request
more...
|
Supported Version Ranges |
| eap_identity |
v6.0.0 -> 7.6.6 |
| [use-id-payload] |
v6.0.0 -> 7.6.6 |
| [send-request] |
v6.0.0 -> 7.6.6 |
- ems_sn_check - Enable/disable verification of EMS serial number. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| ems_sn_check |
v7.4.1 -> 7.6.6 |
| [enable] |
v7.4.1 -> 7.6.6 |
| [disable] |
v7.4.1 -> 7.6.6 |
- encap_local_gw4 - Local IPv4 address of GRE/VXLAN tunnel. type: str
more...
|
Supported Version Ranges |
| encap_local_gw4 |
v6.0.0 -> 7.6.6 |
- encap_local_gw6 - Local IPv6 address of GRE/VXLAN tunnel. type: str
more...
|
Supported Version Ranges |
| encap_local_gw6 |
v6.0.0 -> 7.6.6 |
- encap_remote_gw4 - Remote IPv4 address of GRE/VXLAN tunnel. type: str
more...
|
Supported Version Ranges |
| encap_remote_gw4 |
v6.0.0 -> 7.6.6 |
- encap_remote_gw6 - Remote IPv6 address of GRE/VXLAN tunnel. type: str
more...
|
Supported Version Ranges |
| encap_remote_gw6 |
v6.0.0 -> 7.6.6 |
- encapsulation - Enable/disable GRE/VXLAN/VPNID encapsulation. type: str choices: none, gre, vxlan, vpn-id-ipip
more...
|
Supported Version Ranges |
| encapsulation |
v6.0.0 -> 7.6.6 |
| [none] |
v6.0.0 -> 7.6.6 |
| [gre] |
v6.0.0 -> 7.6.6 |
| [vxlan] |
v6.0.0 -> 7.6.6 |
| [vpn-id-ipip] |
v7.2.0 -> 7.6.6 |
- encapsulation_address - Source for GRE/VXLAN tunnel address. type: str choices: ike, ipv4, ipv6
more...
|
Supported Version Ranges |
| encapsulation_address |
v6.0.0 -> 7.6.6 |
| [ike] |
v6.0.0 -> 7.6.6 |
| [ipv4] |
v6.0.0 -> 7.6.6 |
| [ipv6] |
v6.0.0 -> 7.6.6 |
- enforce_unique_id - Enable/disable peer ID uniqueness check. type: str choices: disable, keep-new, keep-old
more...
|
Supported Version Ranges |
| enforce_unique_id |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [keep-new] |
v6.0.0 -> 7.6.6 |
| [keep-old] |
v6.0.0 -> 7.6.6 |
- esn - Extended sequence number (ESN) negotiation. type: str choices: require, allow, disable
more...
|
Supported Version Ranges |
| esn |
v6.0.0 -> 7.6.6 |
| [require] |
v6.0.0 -> 7.6.6 |
| [allow] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- exchange_fgt_device_id - Enable/disable device identifier exchange with peer FortiGate units for use of VPN monitor data by FortiManager. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| exchange_fgt_device_id |
v7.4.0 -> 7.6.6 |
| [enable] |
v7.4.0 -> 7.6.6 |
| [disable] |
v7.4.0 -> 7.6.6 |
- exchange_interface_ip - Enable/disable exchange of IPsec interface IP address. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| exchange_interface_ip |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- exchange_ip_addr4 - IPv4 address to exchange with peers. type: str
more...
|
Supported Version Ranges |
| exchange_ip_addr4 |
v6.0.0 -> 7.6.6 |
- exchange_ip_addr6 - IPv6 address to exchange with peers. type: str
more...
|
Supported Version Ranges |
| exchange_ip_addr6 |
v6.0.0 -> 7.6.6 |
- fallback_tcp_threshold - Timeout in seconds before falling back IKE/IPsec traffic to tcp. type: int
more...
|
Supported Version Ranges |
| fallback_tcp_threshold |
v7.4.2 -> v7.4.4 |
- fec_base - Number of base Forward Error Correction packets (1 - 20). type: int
more...
|
Supported Version Ranges |
| fec_base |
v6.2.0 -> 7.6.6 |
- fec_codec - Forward Error Correction encoding/decoding algorithm. type: str choices: rs, xor
more...
|
Supported Version Ranges |
| fec_codec |
v7.0.0 -> 7.6.6 |
| [rs] |
v7.0.2 -> 7.6.6 |
| [xor] |
v7.0.2 -> 7.6.6 |
- fec_egress - Enable/disable Forward Error Correction for egress IPsec traffic. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| fec_egress |
v6.2.0 -> 7.6.6 |
| [enable] |
v6.2.0 -> 7.6.6 |
| [disable] |
v6.2.0 -> 7.6.6 |
- fec_health_check - SD-WAN health check. Source system.sdwan.health-check.name. type: str
more...
|
Supported Version Ranges |
| fec_health_check |
v7.0.2 -> 7.6.6 |
- fec_ingress - Enable/disable Forward Error Correction for ingress IPsec traffic. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| fec_ingress |
v6.2.0 -> 7.6.6 |
| [enable] |
v6.2.0 -> 7.6.6 |
| [disable] |
v6.2.0 -> 7.6.6 |
- fec_mapping_profile - Forward Error Correction (FEC) mapping profile. Source vpn.ipsec.fec.name. type: str
more...
|
Supported Version Ranges |
| fec_mapping_profile |
v7.0.2 -> 7.6.6 |
- fec_receive_timeout - Timeout in milliseconds before dropping Forward Error Correction packets (1 - 1000). type: int
more...
|
Supported Version Ranges |
| fec_receive_timeout |
v6.2.0 -> 7.6.6 |
- fec_redundant - Number of redundant Forward Error Correction packets (1 - 5 for reed-solomon, 1 for xor). type: int
more...
|
Supported Version Ranges |
| fec_redundant |
v6.2.0 -> 7.6.6 |
- fec_send_timeout - Timeout in milliseconds before sending Forward Error Correction packets (1 - 1000). type: int
more...
|
Supported Version Ranges |
| fec_send_timeout |
v6.2.0 -> 7.6.6 |
- fgsp_sync - Enable/disable IPsec syncing of tunnels for FGSP IPsec. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| fgsp_sync |
v7.0.8 -> v7.0.12 |
v7.2.1 -> 7.6.6 |
| [enable] |
v7.0.8 -> v7.0.12 |
| [disable] |
v7.0.8 -> v7.0.12 |
- forticlient_enforcement - Enable/disable FortiClient enforcement. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| forticlient_enforcement |
v6.0.0 -> v7.4.0 |
| [enable] |
v6.0.0 -> v7.4.0 |
| [disable] |
v6.0.0 -> v7.4.0 |
- fortinet_esp - Enable/disable Fortinet ESP encapsulation. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| fortinet_esp |
v7.4.2 -> 7.6.6 |
| [enable] |
v7.4.2 -> 7.6.6 |
| [disable] |
v7.4.2 -> 7.6.6 |
- fragmentation - Enable/disable fragment IKE message on re-transmission. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| fragmentation |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- fragmentation_mtu - IKE fragmentation MTU (500 - 16000). type: int
more...
|
Supported Version Ranges |
| fragmentation_mtu |
v6.0.0 -> 7.6.6 |
- group_authentication - Enable/disable IKEv2 IDi group authentication. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| group_authentication |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- group_authentication_secret - Password for IKEv2 ID group authentication. ASCII string or hexadecimal indicated by a leading 0x. type: str
more...
|
Supported Version Ranges |
| group_authentication_secret |
v6.0.0 -> 7.6.6 |
- ha_sync_esp_seqno - Enable/disable sequence number jump ahead for IPsec HA. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| ha_sync_esp_seqno |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- idle_timeout - Enable/disable IPsec tunnel idle timeout. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| idle_timeout |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- idle_timeoutinterval - IPsec tunnel idle timeout in minutes (5 - 43200). type: int
more...
|
Supported Version Ranges |
| idle_timeoutinterval |
v6.0.0 -> 7.6.6 |
- ike_version - IKE protocol version. type: str choices: 1, 2
more...
|
Supported Version Ranges |
| ike_version |
v6.0.0 -> 7.6.6 |
| [1] |
v6.0.0 -> 7.6.6 |
| [2] |
v6.0.0 -> 7.6.6 |
- inbound_dscp_copy - Enable/disable copy the dscp in the ESP header to the inner IP Header. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| inbound_dscp_copy |
v7.0.6 -> v7.0.12 |
v7.2.1 -> 7.6.6 |
| [enable] |
v7.0.6 -> v7.0.12 |
| [disable] |
v7.0.6 -> v7.0.12 |
- include_local_lan - Enable/disable allow local LAN access on unity clients. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| include_local_lan |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
- interface - Local physical, aggregate, or VLAN outgoing interface. Source system.interface.name. type: str
more...
|
Supported Version Ranges |
| interface |
v6.0.0 -> 7.6.6 |
- internal_domain_list - One or more internal domain names in quotes separated by spaces. type: list member_path: internal_domain_list:domain_name
more...
| Supported Version Ranges |
| internal_domain_list |
v7.4.1 -> 7.6.6 |
- domain_name - Domain name. type: str required: true
more...
|
Supported Version Ranges |
| domain_name |
v7.4.1 -> 7.6.6 |
- ip_delay_interval - IP address reuse delay interval in seconds (0 - 28800). type: int
more...
|
Supported Version Ranges |
| ip_delay_interval |
v7.0.1 -> 7.6.6 |
- ip_fragmentation - Determine whether IP packets are fragmented before or after IPsec encapsulation. type: str choices: pre-encapsulation, post-encapsulation
more...
|
Supported Version Ranges |
| ip_fragmentation |
v6.2.0 -> 7.6.6 |
| [pre-encapsulation] |
v6.2.0 -> 7.6.6 |
| [post-encapsulation] |
v6.2.0 -> 7.6.6 |
- ip_version - IP version to use for VPN interface. type: str choices: 4, 6
more...
|
Supported Version Ranges |
| ip_version |
v6.0.0 -> 7.6.6 |
| [4] |
v6.0.0 -> 7.6.6 |
| [6] |
v6.0.0 -> 7.6.6 |
- ipv4_dns_server1 - IPv4 DNS server 1. type: str
more...
|
Supported Version Ranges |
| ipv4_dns_server1 |
v6.0.0 -> 7.6.6 |
- ipv4_dns_server2 - IPv4 DNS server 2. type: str
more...
|
Supported Version Ranges |
| ipv4_dns_server2 |
v6.0.0 -> 7.6.6 |
- ipv4_dns_server3 - IPv4 DNS server 3. type: str
more...
|
Supported Version Ranges |
| ipv4_dns_server3 |
v6.0.0 -> 7.6.6 |
- ipv4_end_ip - End of IPv4 range. type: str
more...
|
Supported Version Ranges |
| ipv4_end_ip |
v6.0.0 -> 7.6.6 |
- ipv4_exclude_range - Configuration Method IPv4 exclude ranges. type: list member_path: ipv4_exclude_range:id
more...
| Supported Version Ranges |
| ipv4_exclude_range |
v6.0.0 -> 7.6.6 |
- end_ip - End of IPv4 exclusive range. type: str
more...
|
Supported Version Ranges |
| end_ip |
v6.0.0 -> 7.6.6 |
- id - ID. see Notes. type: int required: true
more...
|
Supported Version Ranges |
| id |
v6.0.0 -> 7.6.6 |
- start_ip - Start of IPv4 exclusive range. type: str
more...
|
Supported Version Ranges |
| start_ip |
v6.0.0 -> 7.6.6 |
- ipv4_name - IPv4 address name. Source firewall.address.name firewall.addrgrp.name. type: str
more...
|
Supported Version Ranges |
| ipv4_name |
v6.0.0 -> 7.6.6 |
- ipv4_netmask - IPv4 Netmask. type: str
more...
|
Supported Version Ranges |
| ipv4_netmask |
v6.0.0 -> 7.6.6 |
- ipv4_split_exclude - IPv4 subnets that should not be sent over the IPsec tunnel. Source firewall.address.name firewall.addrgrp.name. type: str
more...
|
Supported Version Ranges |
| ipv4_split_exclude |
v6.0.0 -> 7.6.6 |
- ipv4_split_include - IPv4 split-include subnets. Source firewall.address.name firewall.addrgrp.name. type: str
more...
|
Supported Version Ranges |
| ipv4_split_include |
v6.0.0 -> 7.6.6 |
- ipv4_start_ip - Start of IPv4 range. type: str
more...
|
Supported Version Ranges |
| ipv4_start_ip |
v6.0.0 -> 7.6.6 |
- ipv4_wins_server1 - WINS server 1. type: str
more...
|
Supported Version Ranges |
| ipv4_wins_server1 |
v6.0.0 -> 7.6.6 |
- ipv4_wins_server2 - WINS server 2. type: str
more...
|
Supported Version Ranges |
| ipv4_wins_server2 |
v6.0.0 -> 7.6.6 |
- ipv6_auto_linklocal - Enable/disable auto generation of IPv6 link-local address using last 8 bytes of mode-cfg assigned IPv6 address. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| ipv6_auto_linklocal |
v7.6.0 -> 7.6.6 |
| [enable] |
v7.6.0 -> 7.6.6 |
| [disable] |
v7.6.0 -> 7.6.6 |
- ipv6_dns_server1 - IPv6 DNS server 1. type: str
more...
|
Supported Version Ranges |
| ipv6_dns_server1 |
v6.0.0 -> 7.6.6 |
- ipv6_dns_server2 - IPv6 DNS server 2. type: str
more...
|
Supported Version Ranges |
| ipv6_dns_server2 |
v6.0.0 -> 7.6.6 |
- ipv6_dns_server3 - IPv6 DNS server 3. type: str
more...
|
Supported Version Ranges |
| ipv6_dns_server3 |
v6.0.0 -> 7.6.6 |
- ipv6_end_ip - End of IPv6 range. type: str
more...
|
Supported Version Ranges |
| ipv6_end_ip |
v6.0.0 -> 7.6.6 |
- ipv6_exclude_range - Configuration method IPv6 exclude ranges. type: list member_path: ipv6_exclude_range:id
more...
| Supported Version Ranges |
| ipv6_exclude_range |
v6.0.0 -> 7.6.6 |
- end_ip - End of IPv6 exclusive range. type: str
more...
|
Supported Version Ranges |
| end_ip |
v6.0.0 -> 7.6.6 |
- id - ID. see Notes. type: int required: true
more...
|
Supported Version Ranges |
| id |
v6.0.0 -> 7.6.6 |
- start_ip - Start of IPv6 exclusive range. type: str
more...
|
Supported Version Ranges |
| start_ip |
v6.0.0 -> 7.6.6 |
- ipv6_name - IPv6 address name. Source firewall.address6.name firewall.addrgrp6.name. type: str
more...
|
Supported Version Ranges |
| ipv6_name |
v6.0.0 -> 7.6.6 |
- ipv6_prefix - IPv6 prefix. type: int
more...
|
Supported Version Ranges |
| ipv6_prefix |
v6.0.0 -> 7.6.6 |
- ipv6_split_exclude - IPv6 subnets that should not be sent over the IPsec tunnel. Source firewall.address6.name firewall.addrgrp6.name. type: str
more...
|
Supported Version Ranges |
| ipv6_split_exclude |
v6.0.0 -> 7.6.6 |
- ipv6_split_include - IPv6 split-include subnets. Source firewall.address6.name firewall.addrgrp6.name. type: str
more...
|
Supported Version Ranges |
| ipv6_split_include |
v6.0.0 -> 7.6.6 |
- ipv6_start_ip - Start of IPv6 range. type: str
more...
|
Supported Version Ranges |
| ipv6_start_ip |
v6.0.0 -> 7.6.6 |
- keepalive - NAT-T keep alive interval. type: int
more...
|
Supported Version Ranges |
| keepalive |
v6.0.0 -> 7.6.6 |
- keylife - Time to wait in seconds before phase 1 encryption key expires. type: int
more...
|
Supported Version Ranges |
| keylife |
v6.0.0 -> 7.6.6 |
- kms - Key Management Services server. Source vpn.kmip-server.name. type: str
more...
|
Supported Version Ranges |
| kms |
v7.4.0 -> 7.6.6 |
- link_cost - VPN tunnel underlay link cost. type: int
more...
|
Supported Version Ranges |
| link_cost |
v7.2.1 -> 7.6.6 |
- local_gw - IPv4 address of the local gateway"s external interface. type: str
more...
|
Supported Version Ranges |
| local_gw |
v6.0.0 -> 7.6.6 |
- local_gw6 - IPv6 address of the local gateway"s external interface. type: str
more...
|
Supported Version Ranges |
| local_gw6 |
v6.0.0 -> 7.6.6 |
- localid - Local ID. type: str
more...
|
Supported Version Ranges |
| localid |
v6.0.0 -> 7.6.6 |
- localid_type - Local ID type. type: str choices: auto, fqdn, user-fqdn, keyid, address, asn1dn
more...
|
Supported Version Ranges |
| localid_type |
v6.0.0 -> 7.6.6 |
| [auto] |
v6.0.0 -> 7.6.6 |
| [fqdn] |
v6.0.0 -> 7.6.6 |
| [user-fqdn] |
v6.0.0 -> 7.6.6 |
| [keyid] |
v6.0.0 -> 7.6.6 |
| [address] |
v6.0.0 -> 7.6.6 |
| [asn1dn] |
v6.0.0 -> 7.6.6 |
- loopback_asymroute - Enable/disable asymmetric routing for IKE traffic on loopback interface. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| loopback_asymroute |
v7.0.0 -> 7.6.6 |
| [enable] |
v7.0.0 -> 7.6.6 |
| [disable] |
v7.0.0 -> 7.6.6 |
- mesh_selector_type - Add selectors containing subsets of the configuration depending on traffic. type: str choices: disable, subnet, host
more...
|
Supported Version Ranges |
| mesh_selector_type |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [subnet] |
v6.0.0 -> 7.6.6 |
| [host] |
v6.0.0 -> 7.6.6 |
- mode - The ID protection mode used to establish a secure channel. type: str choices: aggressive, main
more...
|
Supported Version Ranges |
| mode |
v6.0.0 -> 7.6.6 |
| [aggressive] |
v6.0.0 -> 7.6.6 |
| [main] |
v6.0.0 -> 7.6.6 |
- mode_cfg - Enable/disable configuration method. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| mode_cfg |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
- mode_cfg_allow_client_selector - Enable/disable mode-cfg client to use custom phase2 selectors. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| mode_cfg_allow_client_selector |
v7.2.0 -> 7.6.6 |
| [disable] |
v7.2.0 -> 7.6.6 |
| [enable] |
v7.2.0 -> 7.6.6 |
- monitor - IPsec interface as backup for primary interface. Source vpn.ipsec.phase1-interface.name. type: str
more...
|
Supported Version Ranges |
| monitor |
v6.0.0 -> v7.4.0 |
- monitor_dict - IPsec interface as backup for primary interface. type: list member_path: monitor_dict:name
more...
| Supported Version Ranges |
| monitor_dict |
v7.4.1 -> 7.6.6 |
- name - IPsec interface as backup for primary interface. Source vpn.ipsec.phase1-interface.name. type: str required: true
more...
|
Supported Version Ranges |
| name |
v7.4.1 -> 7.6.6 |
- monitor_hold_down_delay - Time to wait in seconds before recovery once primary re-establishes. type: int
more...
|
Supported Version Ranges |
| monitor_hold_down_delay |
v6.0.0 -> 7.6.6 |
- monitor_hold_down_time - Time of day at which to fail back to primary after it re-establishes. type: str
more...
|
Supported Version Ranges |
| monitor_hold_down_time |
v6.0.0 -> 7.6.6 |
- monitor_hold_down_type - Recovery time method when primary interface re-establishes. type: str choices: immediate, delay, time
more...
|
Supported Version Ranges |
| monitor_hold_down_type |
v6.0.0 -> 7.6.6 |
| [immediate] |
v6.0.0 -> 7.6.6 |
| [delay] |
v6.0.0 -> 7.6.6 |
| [time] |
v6.0.0 -> 7.6.6 |
- monitor_hold_down_weekday - Day of the week to recover once primary re-establishes. type: str choices: everyday, sunday, monday, tuesday, wednesday, thursday, friday, saturday
more...
|
Supported Version Ranges |
| monitor_hold_down_weekday |
v6.0.0 -> 7.6.6 |
| [everyday] |
v6.0.0 -> 7.6.6 |
| [sunday] |
v6.0.0 -> 7.6.6 |
| [monday] |
v6.0.0 -> 7.6.6 |
| [tuesday] |
v6.0.0 -> 7.6.6 |
| [wednesday] |
v6.0.0 -> 7.6.6 |
| [thursday] |
v6.0.0 -> 7.6.6 |
| [friday] |
v6.0.0 -> 7.6.6 |
| [saturday] |
v6.0.0 -> 7.6.6 |
- monitor_min - Minimum number of links to become degraded before activating this interface. Zero (0) means all links must be down before activating this interface. type: int
more...
|
Supported Version Ranges |
| monitor_min |
v7.4.1 -> 7.6.6 |
- name - IPsec remote gateway name. type: str required: true
more...
|
Supported Version Ranges |
| name |
v6.0.0 -> 7.6.6 |
- nattraversal - Enable/disable NAT traversal. type: str choices: enable, disable, forced
more...
|
Supported Version Ranges |
| nattraversal |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [forced] |
v6.0.0 -> 7.6.6 |
- negotiate_timeout - IKE SA negotiation timeout in seconds (1 - 300). type: int
more...
|
Supported Version Ranges |
| negotiate_timeout |
v6.0.0 -> 7.6.6 |
- net_device - Enable/disable kernel device creation. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| net_device |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- network_id - VPN gateway network ID. type: int
more...
|
Supported Version Ranges |
| network_id |
v6.2.0 -> 7.6.6 |
- network_overlay - Enable/disable network overlays. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| network_overlay |
v6.2.0 -> 7.6.6 |
| [disable] |
v6.2.0 -> 7.6.6 |
| [enable] |
v6.2.0 -> 7.6.6 |
- npu_offload - Enable/disable offloading NPU. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| npu_offload |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- packet_redistribution - Enable/disable packet distribution (RPS) on the IPsec interface. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| packet_redistribution |
v7.4.2 -> v7.4.2 |
| [enable] |
v7.2.1 -> v7.2.2 |
v7.4.0 -> v7.6.1 |
| [disable] |
v7.2.1 -> v7.2.2 |
v7.4.0 -> v7.6.1 |
- passive_mode - Enable/disable IPsec passive mode for static tunnels. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| passive_mode |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- peer - Accept this peer certificate. Source user.peer.name. type: str
more...
|
Supported Version Ranges |
| peer |
v6.0.0 -> 7.6.6 |
- peer_egress_shaping - Enable/disable peer egress shaping. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| peer_egress_shaping |
v7.6.4 -> 7.6.6 |
| [enable] |
v7.6.4 -> 7.6.6 |
| [disable] |
v7.6.4 -> 7.6.6 |
- peer_egress_shaping_value - Configure outbound bandwidth to use for peer egress shaping in kbps (0 - 80000000). type: int
more...
|
Supported Version Ranges |
| peer_egress_shaping_value |
v7.6.4 -> 7.6.6 |
- peergrp - Accept this peer certificate group. Source user.peergrp.name. type: str
more...
|
Supported Version Ranges |
| peergrp |
v6.0.0 -> 7.6.6 |
- peerid - Accept this peer identity. type: str
more...
|
Supported Version Ranges |
| peerid |
v6.0.0 -> 7.6.6 |
- peertype - Accept this peer type. type: str choices: any, one, dialup, peer, peergrp
more...
|
Supported Version Ranges |
| peertype |
v6.0.0 -> 7.6.6 |
| [any] |
v6.0.0 -> 7.6.6 |
| [one] |
v6.0.0 -> 7.6.6 |
| [dialup] |
v6.0.0 -> 7.6.6 |
| [peer] |
v6.0.0 -> 7.6.6 |
| [peergrp] |
v6.0.0 -> 7.6.6 |
- ppk - Enable/disable IKEv2 Postquantum Preshared Key (PPK). type: str choices: disable, allow, require
more...
|
Supported Version Ranges |
| ppk |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [allow] |
v6.0.0 -> 7.6.6 |
| [require] |
v6.0.0 -> 7.6.6 |
- ppk_identity - IKEv2 Postquantum Preshared Key Identity. type: str
more...
|
Supported Version Ranges |
| ppk_identity |
v6.0.0 -> 7.6.6 |
- ppk_secret - IKEv2 Postquantum Preshared Key (ASCII string or hexadecimal encoded with a leading 0x). type: str
more...
|
Supported Version Ranges |
| ppk_secret |
v6.0.0 -> 7.6.6 |
- priority - Priority for routes added by IKE (1 - 65535). type: int
more...
|
Supported Version Ranges |
| priority |
v6.0.0 -> 7.6.6 |
- proposal - Phase1 proposal. type: list choices: des-md5, des-sha1, des-sha256, des-sha384, des-sha512, 3des-md5, 3des-sha1, 3des-sha256, 3des-sha384, 3des-sha512, aes128-md5, aes128-sha1, aes128-sha256, aes128-sha384, aes128-sha512, aes128gcm-prfsha1, aes128gcm-prfsha256, aes128gcm-prfsha384, aes128gcm-prfsha512, aes192-md5, aes192-sha1, aes192-sha256, aes192-sha384, aes192-sha512, aes256-md5, aes256-sha1, aes256-sha256, aes256-sha384, aes256-sha512, aes256gcm-prfsha1, aes256gcm-prfsha256, aes256gcm-prfsha384, aes256gcm-prfsha512, chacha20poly1305-prfsha1, chacha20poly1305-prfsha256, chacha20poly1305-prfsha384, chacha20poly1305-prfsha512, aria128-md5, aria128-sha1, aria128-sha256, aria128-sha384, aria128-sha512, aria192-md5, aria192-sha1, aria192-sha256, aria192-sha384, aria192-sha512, aria256-md5, aria256-sha1, aria256-sha256, aria256-sha384, aria256-sha512, seed-md5, seed-sha1, seed-sha256, seed-sha384, seed-sha512
more...
|
Supported Version Ranges |
| proposal |
v6.0.0 -> 7.6.6 |
| [des-md5] |
v6.0.0 -> 7.6.6 |
| [des-sha1] |
v6.0.0 -> 7.6.6 |
| [des-sha256] |
v6.0.0 -> 7.6.6 |
| [des-sha384] |
v6.0.0 -> 7.6.6 |
| [des-sha512] |
v6.0.0 -> 7.6.6 |
| [3des-md5] |
v6.0.0 -> 7.6.6 |
| [3des-sha1] |
v6.0.0 -> 7.6.6 |
| [3des-sha256] |
v6.0.0 -> 7.6.6 |
| [3des-sha384] |
v6.0.0 -> 7.6.6 |
| [3des-sha512] |
v6.0.0 -> 7.6.6 |
| [aes128-md5] |
v6.0.0 -> 7.6.6 |
| [aes128-sha1] |
v6.0.0 -> 7.6.6 |
| [aes128-sha256] |
v6.0.0 -> 7.6.6 |
| [aes128-sha384] |
v6.0.0 -> 7.6.6 |
| [aes128-sha512] |
v6.0.0 -> 7.6.6 |
| [aes128gcm-prfsha1] |
v6.0.0 -> 7.6.6 |
| [aes128gcm-prfsha256] |
v6.0.0 -> 7.6.6 |
| [aes128gcm-prfsha384] |
v6.0.0 -> 7.6.6 |
| [aes128gcm-prfsha512] |
v6.0.0 -> 7.6.6 |
| [aes192-md5] |
v6.0.0 -> 7.6.6 |
| [aes192-sha1] |
v6.0.0 -> 7.6.6 |
| [aes192-sha256] |
v6.0.0 -> 7.6.6 |
| [aes192-sha384] |
v6.0.0 -> 7.6.6 |
| [aes192-sha512] |
v6.0.0 -> 7.6.6 |
| [aes256-md5] |
v6.0.0 -> 7.6.6 |
| [aes256-sha1] |
v6.0.0 -> 7.6.6 |
| [aes256-sha256] |
v6.0.0 -> 7.6.6 |
| [aes256-sha384] |
v6.0.0 -> 7.6.6 |
| [aes256-sha512] |
v6.0.0 -> 7.6.6 |
| [aes256gcm-prfsha1] |
v6.0.0 -> 7.6.6 |
| [aes256gcm-prfsha256] |
v6.0.0 -> 7.6.6 |
| [aes256gcm-prfsha384] |
v6.0.0 -> 7.6.6 |
| [aes256gcm-prfsha512] |
v6.0.0 -> 7.6.6 |
| [chacha20poly1305-prfsha1] |
v6.0.0 -> 7.6.6 |
| [chacha20poly1305-prfsha256] |
v6.0.0 -> 7.6.6 |
| [chacha20poly1305-prfsha384] |
v6.0.0 -> 7.6.6 |
| [chacha20poly1305-prfsha512] |
v6.0.0 -> 7.6.6 |
| [aria128-md5] |
v6.0.0 -> 7.6.6 |
| [aria128-sha1] |
v6.0.0 -> 7.6.6 |
| [aria128-sha256] |
v6.0.0 -> 7.6.6 |
| [aria128-sha384] |
v6.0.0 -> 7.6.6 |
| [aria128-sha512] |
v6.0.0 -> 7.6.6 |
| [aria192-md5] |
v6.0.0 -> 7.6.6 |
| [aria192-sha1] |
v6.0.0 -> 7.6.6 |
| [aria192-sha256] |
v6.0.0 -> 7.6.6 |
| [aria192-sha384] |
v6.0.0 -> 7.6.6 |
| [aria192-sha512] |
v6.0.0 -> 7.6.6 |
| [aria256-md5] |
v6.0.0 -> 7.6.6 |
| [aria256-sha1] |
v6.0.0 -> 7.6.6 |
| [aria256-sha256] |
v6.0.0 -> 7.6.6 |
| [aria256-sha384] |
v6.0.0 -> 7.6.6 |
| [aria256-sha512] |
v6.0.0 -> 7.6.6 |
| [seed-md5] |
v6.0.0 -> 7.6.6 |
| [seed-sha1] |
v6.0.0 -> 7.6.6 |
| [seed-sha256] |
v6.0.0 -> 7.6.6 |
| [seed-sha384] |
v6.0.0 -> 7.6.6 |
| [seed-sha512] |
v6.0.0 -> 7.6.6 |
- psksecret - Pre-shared secret for PSK authentication (ASCII string or hexadecimal encoded with a leading 0x). type: str
more...
|
Supported Version Ranges |
| psksecret |
v6.0.0 -> 7.6.6 |
- psksecret_remote - Pre-shared secret for remote side PSK authentication (ASCII string or hexadecimal encoded with a leading 0x). type: str
more...
|
Supported Version Ranges |
| psksecret_remote |
v6.0.0 -> 7.6.6 |
- qkd - Enable/disable use of Quantum Key Distribution (QKD) server. type: str choices: disable, allow, require
more...
|
Supported Version Ranges |
| qkd |
v7.4.2 -> 7.6.6 |
| [disable] |
v7.4.2 -> 7.6.6 |
| [allow] |
v7.4.2 -> 7.6.6 |
| [require] |
v7.4.2 -> 7.6.6 |
- qkd_hybrid - Enable/disable use of Quantum Key Distribution (QKD) hybrid keys. type: str choices: disable, allow, require
more...
|
Supported Version Ranges |
| qkd_hybrid |
v7.6.3 -> 7.6.6 |
| [disable] |
v7.6.3 -> 7.6.6 |
| [allow] |
v7.6.3 -> 7.6.6 |
| [require] |
v7.6.3 -> 7.6.6 |
- qkd_profile - Quantum Key Distribution (QKD) server profile. Source vpn.qkd.name. type: str
more...
|
Supported Version Ranges |
| qkd_profile |
v7.4.2 -> 7.6.6 |
- reauth - Enable/disable re-authentication upon IKE SA lifetime expiration. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| reauth |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
- rekey - Enable/disable phase1 rekey. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| rekey |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- remote_gw - IPv4 address of the remote gateway"s external interface. type: str
more...
|
Supported Version Ranges |
| remote_gw |
v6.0.0 -> 7.6.6 |
- remote_gw_country - IPv4 addresses associated to a specific country. type: str
more...
|
Supported Version Ranges |
| remote_gw_country |
v7.4.4 -> 7.6.6 |
- remote_gw_end_ip - Last IPv4 address in the range. type: str
more...
|
Supported Version Ranges |
| remote_gw_end_ip |
v7.4.4 -> 7.6.6 |
- remote_gw_match - Set type of IPv4 remote gateway address matching. type: str choices: any, ipmask, iprange, geography, ztna
more...
|
Supported Version Ranges |
| remote_gw_match |
v7.4.4 -> 7.6.6 |
| [any] |
v7.4.4 -> 7.6.6 |
| [ipmask] |
v7.4.4 -> 7.6.6 |
| [iprange] |
v7.4.4 -> 7.6.6 |
| [geography] |
v7.4.4 -> 7.6.6 |
| [ztna] |
v7.6.0 -> 7.6.6 |
- remote_gw_start_ip - First IPv4 address in the range. type: str
more...
|
Supported Version Ranges |
| remote_gw_start_ip |
v7.4.4 -> 7.6.6 |
- remote_gw_subnet - IPv4 address and subnet mask. type: str
more...
|
Supported Version Ranges |
| remote_gw_subnet |
v7.4.4 -> 7.6.6 |
- remote_gw_ztna_tags - IPv4 ZTNA posture tags. type: list member_path: remote_gw_ztna_tags:name
more...
| Supported Version Ranges |
| remote_gw_ztna_tags |
v7.6.0 -> 7.6.6 |
- name - Address name. Source firewall.address.name firewall.addrgrp.name. type: str required: true
more...
|
Supported Version Ranges |
| name |
v7.6.0 -> 7.6.6 |
- remote_gw6 - IPv6 address of the remote gateway"s external interface. type: str
more...
|
Supported Version Ranges |
| remote_gw6 |
v6.0.0 -> 7.6.6 |
- remote_gw6_country - IPv6 addresses associated to a specific country. type: str
more...
|
Supported Version Ranges |
| remote_gw6_country |
v7.4.4 -> 7.6.6 |
- remote_gw6_end_ip - Last IPv6 address in the range. type: str
more...
|
Supported Version Ranges |
| remote_gw6_end_ip |
v7.4.4 -> 7.6.6 |
- remote_gw6_match - Set type of IPv6 remote gateway address matching. type: str choices: any, ipprefix, iprange, geography
more...
|
Supported Version Ranges |
| remote_gw6_match |
v7.4.4 -> 7.6.6 |
| [any] |
v7.4.4 -> 7.6.6 |
| [ipprefix] |
v7.4.4 -> 7.6.6 |
| [iprange] |
v7.4.4 -> 7.6.6 |
| [geography] |
v7.4.4 -> 7.6.6 |
- remote_gw6_start_ip - First IPv6 address in the range. type: str
more...
|
Supported Version Ranges |
| remote_gw6_start_ip |
v7.4.4 -> 7.6.6 |
- remote_gw6_subnet - IPv6 address and prefix. type: str
more...
|
Supported Version Ranges |
| remote_gw6_subnet |
v7.4.4 -> 7.6.6 |
- remotegw_ddns - Domain name of remote gateway. For example, name.ddns.com. type: str
more...
|
Supported Version Ranges |
| remotegw_ddns |
v6.0.0 -> 7.6.6 |
- rsa_signature_format - Digital Signature Authentication RSA signature format. type: str choices: pkcs1, pss
more...
|
Supported Version Ranges |
| rsa_signature_format |
v6.0.0 -> 7.6.6 |
| [pkcs1] |
v6.0.0 -> 7.6.6 |
| [pss] |
v6.0.0 -> 7.6.6 |
- rsa_signature_hash_override - Enable/disable IKEv2 RSA signature hash algorithm override. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| rsa_signature_hash_override |
v7.2.1 -> 7.6.6 |
| [enable] |
v7.2.1 -> 7.6.6 |
| [disable] |
v7.2.1 -> 7.6.6 |
- save_password - Enable/disable saving XAuth username and password on VPN clients. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| save_password |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
- send_cert_chain - Enable/disable sending certificate chain. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| send_cert_chain |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- shared_idle_timeout - Enable/disable IPsec tunnel shared idle timeout. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| shared_idle_timeout |
v7.6.0 -> 7.6.6 |
| [enable] |
v7.6.0 -> 7.6.6 |
| [disable] |
v7.6.0 -> 7.6.6 |
- signature_hash_alg - Digital Signature Authentication hash algorithms. type: list choices: sha1, sha2-256, sha2-384, sha2-512
more...
|
Supported Version Ranges |
| signature_hash_alg |
v6.0.0 -> 7.6.6 |
| [sha1] |
v6.0.0 -> 7.6.6 |
| [sha2-256] |
v6.0.0 -> 7.6.6 |
| [sha2-384] |
v6.0.0 -> 7.6.6 |
| [sha2-512] |
v6.0.0 -> 7.6.6 |
- split_include_service - Split-include services. Source firewall.service.group.name firewall.service.custom.name. type: str
more...
|
Supported Version Ranges |
| split_include_service |
v6.0.0 -> 7.6.6 |
- suite_b - Use Suite-B. type: str choices: disable, suite-b-gcm-128, suite-b-gcm-256
more...
|
Supported Version Ranges |
| suite_b |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [suite-b-gcm-128] |
v6.0.0 -> 7.6.6 |
| [suite-b-gcm-256] |
v6.0.0 -> 7.6.6 |
- transport - Set IKE transport protocol. type: str choices: udp, auto, tcp, udp-fallback-tcp
more...
|
Supported Version Ranges |
| transport |
v7.4.2 -> 7.6.6 |
| [udp] |
v7.4.2 -> 7.6.6 |
| [auto] |
v7.6.0 -> 7.6.6 |
| [tcp] |
v7.4.2 -> 7.6.6 |
| [udp-fallback-tcp] |
v7.4.2 -> v7.4.4 |
- tunnel_search - Tunnel search method for when the interface is shared. type: str choices: selectors, nexthop
more...
|
Supported Version Ranges |
| tunnel_search |
v6.0.0 -> v6.4.4 |
| [selectors] |
v6.0.0 -> v6.4.4 |
| [nexthop] |
v6.0.0 -> v6.4.4 |
- type - Remote gateway type. type: str choices: static, dynamic, ddns
more...
|
Supported Version Ranges |
| type |
v6.0.0 -> 7.6.6 |
| [static] |
v6.0.0 -> 7.6.6 |
| [dynamic] |
v6.0.0 -> 7.6.6 |
| [ddns] |
v6.0.0 -> 7.6.6 |
- unity_support - Enable/disable support for Cisco UNITY Configuration Method extensions. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| unity_support |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
- usrgrp - User group name for dialup peers. Source user.group.name. type: str
more...
|
Supported Version Ranges |
| usrgrp |
v6.0.0 -> 7.6.6 |
- vni - VNI of VXLAN tunnel. type: int
more...
|
Supported Version Ranges |
| vni |
v6.0.0 -> 7.6.6 |
- wizard_type - GUI VPN Wizard Type. type: str choices: custom, dialup-forticlient, dialup-ios, dialup-android, dialup-windows, dialup-cisco, static-fortigate, dialup-fortigate, static-cisco, dialup-cisco-fw, simplified-static-fortigate, hub-fortigate-auto-discovery, spoke-fortigate-auto-discovery, fabric-overlay-orchestrator
more...
|
Supported Version Ranges |
| wizard_type |
v6.0.0 -> 7.6.6 |
| [custom] |
v6.0.0 -> 7.6.6 |
| [dialup-forticlient] |
v6.0.0 -> 7.6.6 |
| [dialup-ios] |
v6.0.0 -> 7.6.6 |
| [dialup-android] |
v6.0.0 -> 7.6.6 |
| [dialup-windows] |
v6.0.0 -> 7.6.6 |
| [dialup-cisco] |
v6.0.0 -> 7.6.6 |
| [static-fortigate] |
v6.0.0 -> 7.6.6 |
| [dialup-fortigate] |
v6.0.0 -> 7.6.6 |
| [static-cisco] |
v6.0.0 -> 7.6.6 |
| [dialup-cisco-fw] |
v6.0.0 -> 7.6.6 |
| [simplified-static-fortigate] |
v6.2.0 -> 7.6.6 |
| [hub-fortigate-auto-discovery] |
v6.2.0 -> 7.6.6 |
| [spoke-fortigate-auto-discovery] |
v6.2.0 -> 7.6.6 |
| [fabric-overlay-orchestrator] |
v7.6.1 -> 7.6.6 |
- xauthtype - XAuth type. type: str choices: disable, client, pap, chap, auto
more...
|
Supported Version Ranges |
| xauthtype |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
| [client] |
v6.0.0 -> 7.6.6 |
| [pap] |
v6.0.0 -> 7.6.6 |
| [chap] |
v6.0.0 -> 7.6.6 |
| [auto] |
v6.0.0 -> 7.6.6 |
Notes
-----
.. note::
- Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks
- The module supports check_mode.
Examples
--------
.. code-block:: yaml+jinja
- name: Configure VPN remote gateway.
fortinet.fortios.fortios_vpn_ipsec_phase1_interface:
vdom: "{{ vdom }}"
state: "present"
access_token: ""
vpn_ipsec_phase1_interface:
acct_verify: "enable"
add_gw_route: "enable"
add_route: "disable"
addke1: "0"
addke2: "0"
addke3: "0"
addke4: "0"
addke5: "0"
addke6: "0"
addke7: "0"
aggregate_member: "enable"
aggregate_weight: "1"
assign_ip: "disable"
assign_ip_from: "range"
authmethod: "psk"
authmethod_remote: "psk"
authpasswd: ""
authusr: ""
authusrgrp: " (source user.group.name)"
auto_discovery_crossover: "allow"
auto_discovery_dialup_placeholder: "disable"
auto_discovery_forwarder: "enable"
auto_discovery_offer_interval: "5"
auto_discovery_psk: "enable"
auto_discovery_receiver: "enable"
auto_discovery_sender: "enable"
auto_discovery_shortcuts: "independent"
auto_negotiate: "enable"
auto_transport_threshold: "15"
azure_ad_autoconnect: "enable"
backup_gateway:
-
address: ""
banner: ""
cert_id_validation: "enable"
cert_peer_username_strip: "disable"
cert_peer_username_validation: "none"
cert_trust_store: "local"
certificate:
-
name: "default_name_41 (source vpn.certificate.local.name)"
childless_ike: "enable"
client_auto_negotiate: "disable"
client_keep_alive: "disable"
client_resume: "enable"
client_resume_interval: "7200"
comments: ""
default_gw: ""
default_gw_priority: "0"
dev_id: ""
dev_id_notification: "disable"
dhcp_ra_giaddr: ""
dhcp6_ra_linkaddr: ""
dhgrp: "1"
digital_signature_auth: "enable"
distance: "15"
dns_mode: "manual"
dns_suffix_search:
-
dns_suffix: ""
domain: ""
dpd: "disable"
dpd_retrycount: "3"
dpd_retryinterval: ""
eap: "enable"
eap_cert_auth: "enable"
eap_exclude_peergrp: " (source user.peergrp.name)"
eap_identity: "use-id-payload"
ems_sn_check: "enable"
encap_local_gw4: ""
encap_local_gw6: ""
encap_remote_gw4: ""
encap_remote_gw6: ""
encapsulation: "none"
encapsulation_address: "ike"
enforce_unique_id: "disable"
esn: "require"
exchange_fgt_device_id: "enable"
exchange_interface_ip: "enable"
exchange_ip_addr4: ""
exchange_ip_addr6: ""
fallback_tcp_threshold: "15"
fec_base: "10"
fec_codec: "rs"
fec_egress: "enable"
fec_health_check: " (source system.sdwan.health-check.name)"
fec_ingress: "enable"
fec_mapping_profile: " (source vpn.ipsec.fec.name)"
fec_receive_timeout: "50"
fec_redundant: "1"
fec_send_timeout: "5"
fgsp_sync: "enable"
forticlient_enforcement: "enable"
fortinet_esp: "enable"
fragmentation: "enable"
fragmentation_mtu: "1200"
group_authentication: "enable"
group_authentication_secret: ""
ha_sync_esp_seqno: "enable"
idle_timeout: "enable"
idle_timeoutinterval: "15"
ike_version: "1"
inbound_dscp_copy: "enable"
include_local_lan: "disable"
interface: " (source system.interface.name)"
internal_domain_list:
-
domain_name: ""
ip_delay_interval: "0"
ip_fragmentation: "pre-encapsulation"
ip_version: "4"
ipv4_dns_server1: ""
ipv4_dns_server2: ""
ipv4_dns_server3: ""
ipv4_end_ip: ""
ipv4_exclude_range:
-
end_ip: ""
id: "116"
start_ip: ""
ipv4_name: " (source firewall.address.name firewall.addrgrp.name)"
ipv4_netmask: ""
ipv4_split_exclude: " (source firewall.address.name firewall.addrgrp.name)"
ipv4_split_include: " (source firewall.address.name firewall.addrgrp.name)"
ipv4_start_ip: ""
ipv4_wins_server1: ""
ipv4_wins_server2: ""
ipv6_auto_linklocal: "enable"
ipv6_dns_server1: ""
ipv6_dns_server2: ""
ipv6_dns_server3: ""
ipv6_end_ip: ""
ipv6_exclude_range:
-
end_ip: ""
id: "132"
start_ip: ""
ipv6_name: " (source firewall.address6.name firewall.addrgrp6.name)"
ipv6_prefix: "128"
ipv6_split_exclude: " (source firewall.address6.name firewall.addrgrp6.name)"
ipv6_split_include: " (source firewall.address6.name firewall.addrgrp6.name)"
ipv6_start_ip: ""
keepalive: "10"
keylife: "86400"
kms: " (source vpn.kmip-server.name)"
link_cost: "0"
local_gw: ""
local_gw6: ""
localid: ""
localid_type: "auto"
loopback_asymroute: "enable"
mesh_selector_type: "disable"
mode: "aggressive"
mode_cfg: "disable"
mode_cfg_allow_client_selector: "disable"
monitor: " (source vpn.ipsec.phase1-interface.name)"
monitor_dict:
-
name: "default_name_154 (source vpn.ipsec.phase1-interface.name)"
monitor_hold_down_delay: "0"
monitor_hold_down_time: ""
monitor_hold_down_type: "immediate"
monitor_hold_down_weekday: "everyday"
monitor_min: "0"
name: "default_name_160"
nattraversal: "enable"
negotiate_timeout: "30"
net_device: "enable"
network_id: "0"
network_overlay: "disable"
npu_offload: "enable"
packet_redistribution: "enable"
passive_mode: "enable"
peer: " (source user.peer.name)"
peer_egress_shaping: "enable"
peer_egress_shaping_value: "0"
peergrp: " (source user.peergrp.name)"
peerid: ""
peertype: "any"
ppk: "disable"
ppk_identity: ""
ppk_secret: ""
priority: "1"
proposal: "des-md5"
psksecret: ""
psksecret_remote: ""
qkd: "disable"
qkd_hybrid: "disable"
qkd_profile: " (source vpn.qkd.name)"
reauth: "disable"
rekey: "enable"
remote_gw: ""
remote_gw_country: ""
remote_gw_end_ip: ""
remote_gw_match: "any"
remote_gw_start_ip: ""
remote_gw_subnet: ""
remote_gw_ztna_tags:
-
name: "default_name_194 (source firewall.address.name firewall.addrgrp.name)"
remote_gw6: ""
remote_gw6_country: ""
remote_gw6_end_ip: ""
remote_gw6_match: "any"
remote_gw6_start_ip: ""
remote_gw6_subnet: ""
remotegw_ddns: ""
rsa_signature_format: "pkcs1"
rsa_signature_hash_override: "enable"
save_password: "disable"
send_cert_chain: "enable"
shared_idle_timeout: "enable"
signature_hash_alg: "sha1"
split_include_service: " (source firewall.service.group.name firewall.service.custom.name)"
suite_b: "disable"
transport: "udp"
tunnel_search: "selectors"
type: "static"
unity_support: "disable"
usrgrp: " (source user.group.name)"
vni: "0"
wizard_type: "custom"
xauthtype: "disable"
Return Values
-------------
Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:
.. raw:: html
- build - Build number of the fortigate image returned: always type: str sample: 1547
- http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
- http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
- mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
- name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
- path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
- revision - Internal revision number returned: always type: str sample: 17.0.2.10658
- serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
- status - Indication of the operation's result returned: always type: str sample: success
- vdom - Virtual domain used returned: always type: str sample: root
- version - Version of the FortiGate returned: always type: str sample: v5.6.3
Status
------
- This module is not guaranteed to have a backwards compatible interface.
Authors
-------
- Link Zheng (@chillancezen)
- Jie Xue (@JieX19)
- Hongbin Lu (@fgtdev-hblu)
- Frank Shen (@frankshen01)
- Miguel Angel Munoz (@mamunozgonzalez)
- Nicolas Thomas (@thomnico)
.. hint::
If you notice any issues in this documentation, you can create a pull request to improve it.