:source: fortios_web_proxy_explicit.py
:orphan:
.. fortios_web_proxy_explicit:
fortios_web_proxy_explicit -- Configure explicit Web proxy settings in Fortinet's FortiOS and FortiGate.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
.. versionadded:: 2.0.0
.. contents::
:local:
:depth: 1
Synopsis
--------
- This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify web_proxy feature and explicit category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0
Requirements
------------
The below requirements are needed on the host that executes this module.
- ansible>=2.16
Tips
----
Using member operation to add an element to an existing object.
FortiOS Version Compatibility
-----------------------------
Supported Version Ranges: v6.0.0 -> v7.6.6
Parameters
----------
.. raw:: html
- access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: false
- enable_log - Enable/Disable logging for task. type: bool required: false default: False
- vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
- member_path - Member attribute path to operate on. type: str
- member_state - Add or delete a member under specified attribute path. type: str choices: present, absent
- web_proxy_explicit - Configure explicit Web proxy settings. type: dict
more...
| Supported Version Ranges |
| web_proxy_explicit |
v6.0.0 -> 7.6.6 |
- client_cert - Enable/disable to request client certificate. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| client_cert |
v7.4.4 -> 7.6.6 |
| [disable] |
v7.4.4 -> 7.6.6 |
| [enable] |
v7.4.4 -> 7.6.6 |
- empty_cert_action - Action of an empty client certificate. type: str choices: accept, block, accept-unmanageable
more...
|
Supported Version Ranges |
| empty_cert_action |
v7.4.4 -> 7.6.6 |
| [accept] |
v7.4.4 -> 7.6.6 |
| [block] |
v7.4.4 -> 7.6.6 |
| [accept-unmanageable] |
v7.4.4 -> 7.6.6 |
- ftp_incoming_port - Accept incoming FTP-over-HTTP requests on one or more ports (0 - 65535). type: str
more...
|
Supported Version Ranges |
| ftp_incoming_port |
v6.0.0 -> 7.6.6 |
- ftp_over_http - Enable to proxy FTP-over-HTTP sessions sent from a web browser. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| ftp_over_http |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- http_connection_mode - HTTP connection mode . type: str choices: static, multiplex, serverpool
more...
|
Supported Version Ranges |
| http_connection_mode |
v7.2.4 -> 7.6.6 |
| [static] |
v7.2.4 -> 7.6.6 |
| [multiplex] |
v7.2.4 -> 7.6.6 |
| [serverpool] |
v7.2.4 -> 7.6.6 |
- http_incoming_port - Accept incoming HTTP requests on one or more ports (0 - 65535). type: str
more...
|
Supported Version Ranges |
| http_incoming_port |
v6.0.0 -> 7.6.6 |
- https_incoming_port - Accept incoming HTTPS requests on one or more ports (0 - 65535). type: str
more...
|
Supported Version Ranges |
| https_incoming_port |
v6.0.0 -> 7.6.6 |
- https_replacement_message - Enable/disable sending the client a replacement message for HTTPS requests. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| https_replacement_message |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- incoming_ip - Restrict the explicit HTTP proxy to only accept sessions from this IP address. An interface must have this IP address. type: str
more...
|
Supported Version Ranges |
| incoming_ip |
v6.0.0 -> 7.6.6 |
- incoming_ip6 - Restrict the explicit web proxy to only accept sessions from this IPv6 address. An interface must have this IPv6 address. type: str
more...
|
Supported Version Ranges |
| incoming_ip6 |
v6.0.0 -> 7.6.6 |
- interface - Specify outgoing interface to reach server. Source system.interface.name. type: str
more...
|
Supported Version Ranges |
| interface |
v7.6.1 -> 7.6.6 |
- interface_select_method - Specify how to select outgoing interface to reach server. type: str choices: sdwan, specify
more...
|
Supported Version Ranges |
| interface_select_method |
v7.6.1 -> 7.6.6 |
| [sdwan] |
v7.6.1 -> 7.6.6 |
| [specify] |
v7.6.1 -> 7.6.6 |
- ipv6_status - Enable/disable allowing an IPv6 web proxy destination in policies and all IPv6 related entries in this command. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| ipv6_status |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- message_upon_server_error - Enable/disable displaying a replacement message when a server error is detected. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| message_upon_server_error |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- outgoing_ip - Outgoing HTTP requests will have this IP address as their source address. An interface must have this IP address. type: list
- outgoing_ip6 - Outgoing HTTP requests will leave this IPv6. Multiple interfaces can be specified. Interfaces must have these IPv6 addresses. type: list
- pac_file_data - PAC file contents enclosed in quotes (maximum of 256K bytes). type: str
more...
|
Supported Version Ranges |
| pac_file_data |
v6.0.0 -> 7.6.6 |
- pac_file_name - Pac file name. type: str
more...
|
Supported Version Ranges |
| pac_file_name |
v6.0.0 -> 7.6.6 |
- pac_file_server_port - Port number that PAC traffic from client web browsers uses to connect to the explicit web proxy (0 - 65535). type: str
more...
|
Supported Version Ranges |
| pac_file_server_port |
v6.0.0 -> 7.6.6 |
- pac_file_server_status - Enable/disable Proxy Auto-Configuration (PAC) for users of this explicit proxy profile. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| pac_file_server_status |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- pac_file_through_https - Enable/disable to get Proxy Auto-Configuration (PAC) through HTTPS. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| pac_file_through_https |
v7.2.1 -> 7.6.6 |
| [enable] |
v7.2.1 -> 7.6.6 |
| [disable] |
v7.2.1 -> 7.6.6 |
- pac_file_url - PAC file access URL. type: str
more...
|
Supported Version Ranges |
| pac_file_url |
v6.0.0 -> v7.0.5 |
v7.2.0 -> v7.2.0 |
- pac_policy - PAC policies. type: list member_path: pac_policy:policyid
more...
| Supported Version Ranges |
| pac_policy |
v6.0.0 -> 7.6.6 |
- comments - Optional comments. type: str
more...
|
Supported Version Ranges |
| comments |
v6.0.0 -> 7.6.6 |
- dstaddr - Destination address objects. type: list member_path: pac_policy:policyid/dstaddr:name
more...
| Supported Version Ranges |
| dstaddr |
v6.0.0 -> 7.6.6 |
- name - Address name. Source firewall.address.name firewall.addrgrp.name. type: str required: true
more...
|
Supported Version Ranges |
| name |
v6.0.0 -> 7.6.6 |
- pac_file_data - PAC file contents enclosed in quotes (maximum of 256K bytes). type: str
more...
|
Supported Version Ranges |
| pac_file_data |
v6.0.0 -> 7.6.6 |
- pac_file_name - Pac file name. type: str
more...
|
Supported Version Ranges |
| pac_file_name |
v6.0.0 -> 7.6.6 |
- policyid - Policy ID. see Notes. type: int required: true
more...
|
Supported Version Ranges |
| policyid |
v6.0.0 -> 7.6.6 |
- srcaddr - Source address objects. type: list member_path: pac_policy:policyid/srcaddr:name
more...
| Supported Version Ranges |
| srcaddr |
v6.0.0 -> 7.6.6 |
- name - Address name. Source firewall.address.name firewall.addrgrp.name firewall.proxy-address.name firewall.proxy-addrgrp.name. type: str required: true
more...
|
Supported Version Ranges |
| name |
v6.0.0 -> 7.6.6 |
- srcaddr6 - Source address6 objects. type: list member_path: pac_policy:policyid/srcaddr6:name
more...
| Supported Version Ranges |
| srcaddr6 |
v6.0.0 -> 7.6.6 |
- name - Address name. Source firewall.address6.name firewall.addrgrp6.name. type: str required: true
more...
|
Supported Version Ranges |
| name |
v6.0.0 -> 7.6.6 |
- status - Enable/disable policy. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| status |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- pref_dns_result - Prefer resolving addresses using the configured IPv4 or IPv6 DNS server . type: str choices: ipv4, ipv6, ipv4-strict, ipv6-strict
more...
|
Supported Version Ranges |
| pref_dns_result |
v6.0.0 -> 7.6.6 |
| [ipv4] |
v6.0.0 -> 7.6.6 |
| [ipv6] |
v6.0.0 -> 7.6.6 |
| [ipv4-strict] |
v7.4.4 -> 7.6.6 |
| [ipv6-strict] |
v7.4.4 -> 7.6.6 |
- realm - Authentication realm used to identify the explicit web proxy (maximum of 63 characters). type: str
more...
|
Supported Version Ranges |
| realm |
v6.0.0 -> 7.6.6 |
- sec_default_action - Accept or deny explicit web proxy sessions when no web proxy firewall policy exists. type: str choices: accept, deny
more...
|
Supported Version Ranges |
| sec_default_action |
v6.0.0 -> 7.6.6 |
| [accept] |
v6.0.0 -> 7.6.6 |
| [deny] |
v6.0.0 -> 7.6.6 |
- secure_web_proxy - Enable/disable/require the secure web proxy for HTTP and HTTPS session. type: str choices: disable, enable, secure
more...
|
Supported Version Ranges |
| secure_web_proxy |
v7.4.0 -> 7.6.6 |
| [disable] |
v7.4.0 -> 7.6.6 |
| [enable] |
v7.4.0 -> 7.6.6 |
| [secure] |
v7.4.0 -> 7.6.6 |
- secure_web_proxy_cert - Name of certificates for secure web proxy. type: list member_path: secure_web_proxy_cert:name
more...
| Supported Version Ranges |
| secure_web_proxy_cert |
v7.4.0 -> 7.6.6 |
- name - Certificate list. Source vpn.certificate.local.name. type: str required: true
more...
|
Supported Version Ranges |
| name |
v7.4.0 -> 7.6.6 |
- socks - Enable/disable the SOCKS proxy. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| socks |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- socks_incoming_port - Accept incoming SOCKS proxy requests on one or more ports (0 - 65535). type: str
more...
|
Supported Version Ranges |
| socks_incoming_port |
v6.0.0 -> 7.6.6 |
- ssl_algorithm - Relative strength of encryption algorithms accepted in HTTPS deep scan: high, medium, or low. type: str choices: high, medium, low
more...
|
Supported Version Ranges |
| ssl_algorithm |
v6.0.0 -> 7.6.6 |
| [high] |
v6.0.0 -> 7.6.6 |
| [medium] |
v6.0.0 -> 7.6.6 |
| [low] |
v6.0.0 -> 7.6.6 |
- ssl_dh_bits - Bit-size of Diffie-Hellman (DH) prime used in DHE-RSA negotiation . type: str choices: 768, 1024, 1536, 2048
more...
|
Supported Version Ranges |
| ssl_dh_bits |
v7.4.0 -> 7.6.6 |
| [768] |
v7.4.0 -> 7.6.6 |
| [1024] |
v7.4.0 -> 7.6.6 |
| [1536] |
v7.4.0 -> 7.6.6 |
| [2048] |
v7.4.0 -> 7.6.6 |
- status - Enable/disable the explicit Web proxy for HTTP and HTTPS session. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| status |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- strict_guest - Enable/disable strict guest user checking by the explicit web proxy. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| strict_guest |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- trace_auth_no_rsp - Enable/disable logging timed-out authentication requests. type: str choices: enable, disable
more...
|
Supported Version Ranges |
| trace_auth_no_rsp |
v6.0.0 -> 7.6.6 |
| [enable] |
v6.0.0 -> 7.6.6 |
| [disable] |
v6.0.0 -> 7.6.6 |
- unknown_http_version - How to handle HTTP sessions that do not comply with HTTP 0.9, 1.0, or 1.1. type: str choices: reject, best-effort, tunnel
more...
|
Supported Version Ranges |
| unknown_http_version |
v6.0.0 -> 7.6.6 |
| [reject] |
v6.0.0 -> 7.6.6 |
| [best-effort] |
v6.0.0 -> 7.6.6 |
| [tunnel] |
v6.4.0 -> v7.0.0 |
- user_agent_detect - Enable/disable to detect device type by HTTP user-agent if no client certificate provided. type: str choices: disable, enable
more...
|
Supported Version Ranges |
| user_agent_detect |
v7.4.4 -> 7.6.6 |
| [disable] |
v7.4.4 -> 7.6.6 |
| [enable] |
v7.4.4 -> 7.6.6 |
- vrf_select - VRF ID used for connection to server. type: int
more...
|
Supported Version Ranges |
| vrf_select |
v7.6.1 -> 7.6.6 |
Notes
-----
.. note::
- Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks
- The module supports check_mode.
Examples
--------
.. code-block:: yaml+jinja
- name: Configure explicit Web proxy settings.
fortinet.fortios.fortios_web_proxy_explicit:
vdom: "{{ vdom }}"
web_proxy_explicit:
client_cert: "disable"
empty_cert_action: "accept"
ftp_incoming_port: ""
ftp_over_http: "enable"
http_connection_mode: "static"
http_incoming_port: ""
https_incoming_port: ""
https_replacement_message: "enable"
incoming_ip: ""
incoming_ip6: ""
interface: " (source system.interface.name)"
interface_select_method: "sdwan"
ipv6_status: "enable"
message_upon_server_error: "enable"
outgoing_ip: ""
outgoing_ip6: ""
pac_file_data: ""
pac_file_name: ""
pac_file_server_port: ""
pac_file_server_status: "enable"
pac_file_through_https: "enable"
pac_file_url: ""
pac_policy:
-
comments: ""
dstaddr:
-
name: "default_name_28 (source firewall.address.name firewall.addrgrp.name)"
pac_file_data: ""
pac_file_name: ""
policyid: ""
srcaddr:
-
name: "default_name_33 (source firewall.address.name firewall.addrgrp.name firewall.proxy-address.name firewall.proxy-addrgrp.name)"
srcaddr6:
-
name: "default_name_35 (source firewall.address6.name firewall.addrgrp6.name)"
status: "enable"
pref_dns_result: "ipv4"
realm: ""
sec_default_action: "accept"
secure_web_proxy: "disable"
secure_web_proxy_cert:
-
name: "default_name_42 (source vpn.certificate.local.name)"
socks: "enable"
socks_incoming_port: ""
ssl_algorithm: "high"
ssl_dh_bits: "768"
status: "enable"
strict_guest: "enable"
trace_auth_no_rsp: "enable"
unknown_http_version: "reject"
user_agent_detect: "disable"
vrf_select: "-1"
Return Values
-------------
Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:
.. raw:: html
- build - Build number of the fortigate image returned: always type: str sample: 1547
- http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
- http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
- mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
- name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
- path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
- revision - Internal revision number returned: always type: str sample: 17.0.2.10658
- serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
- status - Indication of the operation's result returned: always type: str sample: success
- vdom - Virtual domain used returned: always type: str sample: root
- version - Version of the FortiGate returned: always type: str sample: v5.6.3
Status
------
- This module is not guaranteed to have a backwards compatible interface.
Authors
-------
- Link Zheng (@chillancezen)
- Jie Xue (@JieX19)
- Hongbin Lu (@fgtdev-hblu)
- Frank Shen (@frankshen01)
- Miguel Angel Munoz (@mamunozgonzalez)
- Nicolas Thomas (@thomnico)
.. hint::
If you notice any issues in this documentation, you can create a pull request to improve it.