fmgr_icap_profile – Configure ICAP profiles.

New in version 2.0.0.

Synopsis

  • This module is able to configure a FortiManager device.
  • Examples include all parameters and values need to be adjusted to data sources before usage.
  • Tested with FortiManager v6.x and v7.x.

Requirements

The below requirements are needed on the host that executes this module.

  • ansible>=2.9.0

FortiManager Version Compatibility


6.0.0
True
6.2.0 6.2.1 6.2.2 6.2.3 6.2.5 6.2.6 6.2.7 6.2.8 6.2.9 6.2.10
True True True True True True True True True True
6.4.0 6.4.1 6.4.2 6.4.3 6.4.4 6.4.5 6.4.6 6.4.7 6.4.8 6.4.9 6.4.10 6.4.11
True True True True True True True True True True True True
7.0.0 7.0.1 7.0.2 7.0.3 7.0.4 7.0.5 7.0.6 7.0.7
True True True True True True True True
7.2.0 7.2.1 7.2.2
True True True
7.4.0
True

Parameters

  • access_token -The token to access FortiManager without using username and password. type: str required: false
  • bypass_validation - Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters. type: bool required: false default: False
  • enable_log - Enable/Disable logging for task. type: bool required: false default: False
  • forticloud_access_token - Access token of forticloud managed API users, this option is available with FortiManager later than 6.4.0. type: str required: false
  • proposed_method - The overridden method for the underlying Json RPC request. type: str required: false choices: set, update, add
  • rc_succeeded - The rc codes list with which the conditions to succeed will be overriden. type: list required: false
  • rc_failed - The rc codes list with which the conditions to fail will be overriden. type: list required: false
  • state - The directive to create, update or delete an object type: str required: true choices: present, absent
  • workspace_locking_adom - Acquire the workspace lock if FortiManager is running in workspace mode. type: str required: false choices: global, custom adom including root
  • workspace_locking_timeout - The maximum time in seconds to wait for other users to release workspace lock. type: integer required: false default: 300
  • adom - The parameter in requested url type: str required: true
  • icap_profile - Configure ICAP profiles. type: dict
    • methods - The allowed HTTP methods that will be sent to ICAP server for further processing. type: array choices: [delete, get, head, options, post, put, trace, other, connect] more...
    • name - ICAP profile name. type: str more...
    • replacemsg-group - Replacement message group. type: str more...
    • request - Enable/disable whether an HTTP request is passed to an ICAP server. type: str choices: [disable, enable] more...
    • request-failure - Action to take if the ICAP server cannot be contacted when processing an HTTP request. type: str choices: [error, bypass] more...
    • request-path - Path component of the ICAP URI that identifies the HTTP request processing service. type: str more...
    • request-server - ICAP server to use for an HTTP request. type: str more...
    • response - Enable/disable whether an HTTP response is passed to an ICAP server. type: str choices: [disable, enable] more...
    • response-failure - Action to take if the ICAP server cannot be contacted when processing an HTTP response. type: str choices: [error, bypass] more...
    • response-path - Path component of the ICAP URI that identifies the HTTP response processing service. type: str more...
    • response-server - ICAP server to use for an HTTP response. type: str more...
    • streaming-content-bypass - Enable/disable bypassing of ICAP server for streaming content. type: str choices: [disable, enable] more...
    • icap-headers - Icap-Headers. type: array more...
      • base64-encoding - Enable/disable use of base64 encoding of HTTP content. type: str choices: [disable, enable] more...
      • content - HTTP header content. type: str more...
      • id - HTTP forwarded header ID. type: int more...
      • name - HTTP forwarded header name. type: str more...
    • preview - Enable/disable preview of data to ICAP server. type: str choices: [disable, enable] more...
    • preview-data-length - Preview data length to be sent to ICAP server. type: int more...
    • response-req-hdr - Enable/disable addition of req-hdr for ICAP response modification (respmod) processing. type: str choices: [disable, enable] more...
    • respmod-default-action - Default action to ICAP response modification (respmod) processing. type: str choices: [bypass, forward] more...
    • respmod-forward-rules - Respmod-Forward-Rules. type: array more...
      • action - Action to be taken for ICAP server. type: str choices: [bypass, forward] more...
      • header-group - Header-Group. type: array more...
        • case-sensitivity - Enable/disable case sensitivity when matching header. type: str choices: [disable, enable] more...
        • header - HTTP header regular expression. type: str more...
        • header-name - HTTP header. type: str more...
        • id - ID. type: int more...
      • host - Address object for the host. type: str more...
      • http-resp-status-code - HTTP response status code. type: int more...
      • name - Address name. type: str more...
    • 204-response - Enable/disable allowance of 204 response from ICAP server. type: str choices: [disable, enable] more...
    • 204-size-limit - 204 response size limit to be saved by ICAP client in megabytes (1 - 10, default = 1 MB). type: int more...
    • chunk-encap - Enable/disable chunked encapsulation (default = disable). type: str choices: [disable, enable] more...
    • extension-feature - No description for the parameter type: array choices: [scan-progress] more...
    • file-transfer - No description for the parameter type: array choices: [ssh, ftp] more...
    • file-transfer-failure - Action to take if the ICAP server cannot be contacted when processing a file transfer. type: str choices: [error, bypass] more...
    • file-transfer-path - Path component of the ICAP URI that identifies the file transfer processing service. type: str more...
    • file-transfer-server - ICAP server to use for a file transfer. type: str more...
    • icap-block-log - Enable/disable UTM log when infection found (default = disable). type: str choices: [disable, enable] more...
    • scan-progress-interval - Scan progress interval value. type: int more...
    • timeout - Time (in seconds) that ICAP client waits for the response from ICAP server. type: int more...
    • comment - Comment. type: str more...

Notes

Note

  • Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.
  • To create or update an object, use state: present directive.
  • To delete an object, use state: absent directive
  • Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded

Examples

- hosts: fortimanager-inventory
  collections:
    - fortinet.fortimanager
  connection: httpapi
  vars:
     ansible_httpapi_use_ssl: True
     ansible_httpapi_validate_certs: False
     ansible_httpapi_port: 443
  tasks:
   - name: Configure ICAP profiles.
     fmgr_icap_profile:
        bypass_validation: False
        workspace_locking_adom: <value in [global, custom adom including root]>
        workspace_locking_timeout: 300
        rc_succeeded: [0, -2, -3, ...]
        rc_failed: [-2, -3, ...]
        adom: <your own value>
        state: <value in [present, absent]>
        icap_profile:
           methods:
             - delete
             - get
             - head
             - options
             - post
             - put
             - trace
             - other
             - connect
           name: <value of string>
           replacemsg-group: <value of string>
           request: <value in [disable, enable]>
           request-failure: <value in [error, bypass]>
           request-path: <value of string>
           request-server: <value of string>
           response: <value in [disable, enable]>
           response-failure: <value in [error, bypass]>
           response-path: <value of string>
           response-server: <value of string>
           streaming-content-bypass: <value in [disable, enable]>
           icap-headers:
             -
                 base64-encoding: <value in [disable, enable]>
                 content: <value of string>
                 id: <value of integer>
                 name: <value of string>
           preview: <value in [disable, enable]>
           preview-data-length: <value of integer>
           response-req-hdr: <value in [disable, enable]>
           respmod-default-action: <value in [bypass, forward]>
           respmod-forward-rules:
             -
                 action: <value in [bypass, forward]>
                 header-group:
                   -
                       case-sensitivity: <value in [disable, enable]>
                       header: <value of string>
                       header-name: <value of string>
                       id: <value of integer>
                 host: <value of string>
                 http-resp-status-code: <value of integer>
                 name: <value of string>
           204-response: <value in [disable, enable]>
           204-size-limit: <value of integer>
           chunk-encap: <value in [disable, enable]>
           extension-feature:
             - scan-progress
           file-transfer:
             - ssh
             - ftp
           file-transfer-failure: <value in [error, bypass]>
           file-transfer-path: <value of string>
           file-transfer-server: <value of string>
           icap-block-log: <value in [disable, enable]>
           scan-progress-interval: <value of integer>
           timeout: <value of integer>
           comment: <value of string>

Return Values

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

  • meta - The result of the request.returned: always type: dict
    • request_url - The full url requested. returned: always type: str sample: /sys/login/user
    • response_code - The status of api request. returned: always type: int sample: 0
    • response_data - The data body of the api response. returned: optional type: list or dict
    • response_message - The descriptive message of the api response. returned: always type: str sample: OK
    • system_information - The information of the target system. returned: always type: dict
  • rc - The status the request. returned: always type: int 0
  • version_check_warning - Warning if the parameters used in the playbook are not supported by the current FortiManager version. returned: if at least on parameter mpt supported by the current FortiManager version type: list 0

Status

  • This module is not guaranteed to have a backwards compatible interface.

Authors

  • Xinwei Du (@dux-fortinet)
  • Xing Li (@lix-fortinet)
  • Jie Xue (@JieX19)
  • Link Zheng (@chillancezen)
  • Frank Shen (@fshen01)
  • Hongbin Lu (@fgtdev-hblu)

Hint

If you notice any issues in this documentation, you can create a pull request to improve it.