fmgr_vpnsslweb_portal – Portal.¶
New in version 2.0.0.
Synopsis¶
- This module is able to configure a FortiManager device.
- Examples include all parameters and values need to be adjusted to data sources before usage.
- Tested with FortiManager v6.x and v7.x.
Requirements¶
The below requirements are needed on the host that executes this module.
- ansible>=2.9.0
FortiManager Version Compatibility¶
6.0.0 |
|||||||||||
| True | |||||||||||
6.2.0 |
6.2.1 |
6.2.2 |
6.2.3 |
6.2.5 |
6.2.6 |
6.2.7 |
6.2.8 |
6.2.9 |
6.2.10 |
||
| True | True | True | True | True | True | True | True | True | True | ||
6.4.0 |
6.4.1 |
6.4.2 |
6.4.3 |
6.4.4 |
6.4.5 |
6.4.6 |
6.4.7 |
6.4.8 |
6.4.9 |
6.4.10 |
6.4.11 |
| True | True | True | True | True | True | True | True | True | True | True | True |
7.0.0 |
7.0.1 |
7.0.2 |
7.0.3 |
7.0.4 |
7.0.5 |
7.0.6 |
7.0.7 |
||||
| True | True | True | True | True | True | True | True | ||||
7.2.0 |
7.2.1 |
7.2.2 |
|||||||||
| True | True | True | |||||||||
7.4.0 |
|||||||||||
| True |
Parameters¶
- access_token -The token to access FortiManager without using username and password. type: str required: false
- bypass_validation - Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters. type: bool required: false default: False
- enable_log - Enable/Disable logging for task. type: bool required: false default: False
- forticloud_access_token - Access token of forticloud managed API users, this option is available with FortiManager later than 6.4.0. type: str required: false
- proposed_method - The overridden method for the underlying Json RPC request. type: str required: false choices: set, update, add
- rc_succeeded - The rc codes list with which the conditions to succeed will be overriden. type: list required: false
- rc_failed - The rc codes list with which the conditions to fail will be overriden. type: list required: false
- state - The directive to create, update or delete an object type: str required: true choices: present, absent
- workspace_locking_adom - Acquire the workspace lock if FortiManager is running in workspace mode. type: str required: false choices: global, custom adom including root
- workspace_locking_timeout - The maximum time in seconds to wait for other users to release workspace lock. type: integer required: false default: 300
- adom - The parameter in requested url type: str required: true
- vpnsslweb_portal - Portal. type: dict
- allow-user-access - Allow user access to SSL-VPN applications. type: array choices: [web, ftp, telnet, smb, vnc, rdp, ssh, ping, citrix, portforward, sftp] more...
- auto-connect - Enable/disable automatic connect by client when system is up. type: str choices: [disable, enable] more...
- bookmark-group - Bookmark-Group. type: array
more...
- bookmarks - Bookmarks. type: array
more...
- additional-params - Additional parameters. type: str more...
- apptype - Application type. type: str choices: [web, telnet, ssh, ftp, smb, vnc, rdp, citrix, rdpnative, portforward, sftp] more...
- description - Description. type: str more...
- folder - Network shared file folder parameter. type: str more...
- form-data - Form-Data. type: array more...
- host - Host name/IP parameter. type: str more...
- listening-port - Listening port (0 - 65535). type: int more...
- load-balancing-info - The load balancing information or cookie which should be provided to the connection broker. type: str more...
- logon-password - Logon password. type: str more...
- logon-user - Logon user. type: str more...
- name - Bookmark name. type: str more...
- port - Remote port. type: int more...
- preconnection-blob - An arbitrary string which identifies the RDP source. type: str more...
- preconnection-id - The numeric ID of the RDP source (0-2147483648). type: int more...
- remote-port - Remote port (0 - 65535). type: int more...
- security - Security mode for RDP connection. type: str choices: [rdp, nla, tls, any] more...
- server-layout - Server side keyboard layout. type: str choices: [en-us-qwerty, de-de-qwertz, fr-fr-azerty, it-it-qwerty, sv-se-qwerty, failsafe, en-gb-qwerty, es-es-qwerty, fr-ch-qwertz, ja-jp-qwerty, pt-br-qwerty, tr-tr-qwerty, fr-ca-qwerty] more...
- show-status-window - Enable/disable showing of status window. type: str choices: [disable, enable] more...
- sso - Single Sign-On. type: str choices: [disable, static, auto] more...
- sso-credential - Single sign-on credentials. type: str choices: [sslvpn-login, alternative] more...
- sso-credential-sent-once - Single sign-on credentials are only sent once to remote server. type: str choices: [disable, enable] more...
- sso-password - SSO password. type: str more...
- sso-username - SSO user name. type: str more...
- url - URL parameter. type: str more...
- domain - Login domain. type: str more...
- color-depth - Color depth per pixel. type: str choices: [8, 16, 32] more...
- height - Screen height (range from 0 - 65535, default = 0). type: int more...
- keyboard-layout - Keyboard layout. type: str choices: [ar, da, de, de-ch, en-gb, en-uk, en-us, es, fi, fr, fr-be, fr-ca, fr-ch, hr, hu, it, ja, lt, lv, mk, no, pl, pt, pt-br, ru, sl, sv, tk, tr, fr-ca-m, wg, ar-101, ar-102, ar-102-azerty, can-mul, cz, cz-qwerty, cz-pr, nl, de-ibm, en-uk-ext, en-us-dvorak, es-var, fi-sami, hu-101, it-142, ko, lt-ibm, lt-std, lav-std, lav-leg, mk-std, no-sami, pol-214, pol-pr, pt-br-abnt2, ru-mne, ru-t, sv-sami, tuk, tur-f, tur-q, zh-sym-sg-us, zh-sym-us, zh-tr-hk, zh-tr-mo, zh-tr-us, fr-apple] more...
- restricted-admin - Enable/disable restricted admin mode for RDP. type: str choices: [disable, enable] more...
- send-preconnection-id - Enable/disable sending of preconnection ID. type: str choices: [disable, enable] more...
- width - Screen width (range from 0 - 65535, default = 0). type: int more...
- vnc-keyboard-layout - Keyboard layout. type: str choices: [da, de, de-ch, en-uk, es, fi, fr, fr-be, it, no, pt, sv, nl, en-uk-ext, it-142, pt-br-abnt2, default, fr-ca-mul, gd, us-intl] more...
- name - Bookmark group name. type: str more...
- bookmarks - Bookmarks. type: array
more...
- custom-lang - Change the web portal display language. type: str more...
- customize-forticlient-download-url - Enable support of customized download URL for FortiClient. type: str choices: [disable, enable] more...
- display-bookmark - Enable to display the web portal bookmark widget. type: str choices: [disable, enable] more...
- display-connection-tools - Enable to display the web portal connection tools widget. type: str choices: [disable, enable] more...
- display-history - Enable to display the web portal user login history widget. type: str choices: [disable, enable] more...
- display-status - Enable to display the web portal status widget. type: str choices: [disable, enable] more...
- dns-server1 - IPv4 DNS server 1. type: str more...
- dns-server2 - IPv4 DNS server 2. type: str more...
- dns-suffix - DNS suffix. type: str more...
- exclusive-routing - Enable/disable all traffic go through tunnel only. type: str choices: [disable, enable] more...
- forticlient-download - Enable/disable download option for FortiClient. type: str choices: [disable, enable] more...
- forticlient-download-method - FortiClient download method. type: str choices: [direct, ssl-vpn] more...
- heading - Web portal heading message. type: str more...
- hide-sso-credential - Enable to prevent SSO credential being sent to client. type: str choices: [disable, enable] more...
- host-check - Type of host checking performed on endpoints. type: str choices: [none, av, fw, av-fw, custom] more...
- host-check-interval - Periodic host check interval. type: int more...
- host-check-policy - One or more policies to require the endpoint to have specific security software. type: str more...
- ip-mode - Method by which users of this SSL-VPN tunnel obtain IP addresses. type: str choices: [range, user-group, dhcp, no-ip] more...
- ip-pools - IPv4 firewall source address objects reserved for SSL-VPN tunnel mode clients. type: str more...
- ipv6-dns-server1 - IPv6 DNS server 1. type: str more...
- ipv6-dns-server2 - IPv6 DNS server 2. type: str more...
- ipv6-exclusive-routing - Enable/disable all IPv6 traffic go through tunnel only. type: str choices: [disable, enable] more...
- ipv6-pools - IPv4 firewall source address objects reserved for SSL-VPN tunnel mode clients. type: str more...
- ipv6-service-restriction - Enable/disable IPv6 tunnel service restriction. type: str choices: [disable, enable] more...
- ipv6-split-tunneling - Enable/disable IPv6 split tunneling. type: str choices: [disable, enable] more...
- ipv6-split-tunneling-routing-address - IPv6 SSL-VPN tunnel mode firewall address objects that override firewall policy destination addresses to control split-tunneling access. type: str more...
- ipv6-tunnel-mode - Enable/disable IPv6 SSL-VPN tunnel mode. type: str choices: [disable, enable] more...
- ipv6-wins-server1 - IPv6 WINS server 1. type: str more...
- ipv6-wins-server2 - IPv6 WINS server 2. type: str more...
- keep-alive - Enable/disable automatic reconnect for FortiClient connections. type: str choices: [disable, enable] more...
- limit-user-logins - Enable to limit each user to one SSL-VPN session at a time. type: str choices: [disable, enable] more...
- mac-addr-action - Client MAC address action. type: str choices: [deny, allow] more...
- mac-addr-check - Enable/disable MAC address host checking. type: str choices: [disable, enable] more...
- mac-addr-check-rule - Mac-Addr-Check-Rule. type: array more...
- macos-forticlient-download-url - Download URL for Mac FortiClient. type: str more...
- name - Portal name. type: str more...
- os-check - Enable to let the FortiGate decide action based on client OS. type: str choices: [disable, enable] more...
- redir-url - Client login redirect URL. type: str more...
- save-password - Enable/disable FortiClient saving the users password. type: str choices: [disable, enable] more...
- service-restriction - Enable/disable tunnel service restriction. type: str choices: [disable, enable] more...
- skip-check-for-unsupported-browser - Enable to skip host check if browser does not support it. type: str choices: [disable, enable] more...
- skip-check-for-unsupported-os - Enable to skip host check if client OS does not support it. type: str choices: [disable, enable] more...
- smb-ntlmv1-auth - Enable support of NTLMv1 for Samba authentication. type: str choices: [disable, enable] more...
- smbv1 - Enable/disable support of SMBv1 for Samba. type: str choices: [disable, enable] more...
- split-dns - Split-Dns. type: array
more...
- dns-server1 - DNS server 1. type: str more...
- dns-server2 - DNS server 2. type: str more...
- domains - Split DNS domains used for SSL-VPN clients separated by comma(,). type: str more...
- id - ID. type: int more...
- ipv6-dns-server1 - IPv6 DNS server 1. type: str more...
- ipv6-dns-server2 - IPv6 DNS server 2. type: str more...
- split-tunneling - Enable/disable IPv4 split tunneling. type: str choices: [disable, enable] more...
- split-tunneling-routing-address - IPv4 SSL-VPN tunnel mode firewall address objects that override firewall policy destination addresses to control split-tunneling access. type: str more...
- theme - Web portal color scheme. type: str choices: [gray, blue, orange, crimson, steelblue, darkgrey, green, melongene, red, mariner, neutrino, jade, graphite, dark-matter, onyx, eclipse, jet-stream, security-fabric] more...
- tunnel-mode - Enable/disable IPv4 SSL-VPN tunnel mode. type: str choices: [disable, enable] more...
- user-bookmark - Enable to allow web portal users to create their own bookmarks. type: str choices: [disable, enable] more...
- user-group-bookmark - Enable to allow web portal users to create bookmarks for all users in the same user group. type: str choices: [disable, enable] more...
- web-mode - Enable/disable SSL VPN web mode. type: str choices: [disable, enable] more...
- windows-forticlient-download-url - Download URL for Windows FortiClient. type: str more...
- wins-server1 - IPv4 WINS server 1. type: str more...
- wins-server2 - IPv4 WINS server 1. type: str more...
- skip-check-for-browser - Enable to skip host check for browser support. type: str choices: [disable, enable] more...
- smb-max-version - SMB maximum client protocol version. type: str choices: [smbv1, smbv2, smbv3] more...
- smb-min-version - SMB minimum client protocol version. type: str choices: [smbv1, smbv2, smbv3] more...
- virtual-desktop-printing - Enable/disable printing in virtual desktop. type: str choices: [disable, enable] more...
- virtual-desktop-desktop-switch - Enable/disable switch to virtual desktop. type: str choices: [disable, enable] more...
- virtual-desktop-app-list - Virtual desktop application list. type: str more...
- virtual-desktop-clipboard-share - Enable/disable sharing of clipboard in virtual desktop. type: str choices: [disable, enable] more...
- virtual-desktop-removable-media-access - Enable/disable access to removable media in virtual desktop. type: str choices: [disable, enable] more...
- virtual-desktop-logout-when-browser-close - Enable/disable logout when browser is close in virtual desktop. type: str choices: [disable, enable] more...
- virtual-desktop-network-share-access - Enable/disable network share access in virtual desktop. type: str choices: [disable, enable] more...
- virtual-desktop - Enable/disable SSL VPN virtual desktop. type: str choices: [disable, enable] more...
- transform-backward-slashes - Transform backward slashes to forward slashes in URLs. type: str choices: [disable, enable] more...
- ipv6-split-tunneling-routing-negate - Enable to negate IPv6 split tunneling routing address. type: str choices: [disable, enable] more...
- split-tunneling-routing-negate - Enable to negate split tunneling routing address. type: str choices: [disable, enable] more...
- os-check-list type: dict
- action - OS check options. type: str choices: [allow, check-up-to-date, deny] more...
- latest-patch-level - Latest OS patch level. type: str more...
- name - Name. type: str more...
- tolerance - OS patch level tolerance. type: int more...
- use-sdwan - Use SD-WAN rules to get output interface. type: str choices: [disable, enable] more...
- prefer-ipv6-dns - prefer to query IPv6 dns first if enabled. type: str choices: [disable, enable] more...
- rewrite-ip-uri-ui - Rewrite contents for URI contains IP and /ui/. type: str choices: [disable, enable] more...
- clipboard - Enable to support RDP/VPC clipboard functionality. type: str choices: [disable, enable] more...
- default-window-height - Screen height (range from 0 - 65535, default = 768). type: int more...
- default-window-width - Screen width (range from 0 - 65535, default = 1024). type: int more...
- dhcp-ip-overlap - Configure overlapping DHCP IP allocation assignment. type: str choices: [use-old, use-new] more...
- client-src-range - Allow client to add source range for the tunnel traffic. type: str choices: [disable, enable] more...
- dhcp-ra-giaddr - Relay agent gateway IP address to use in the giaddr field of DHCP requests. type: str more...
- dhcp6-ra-linkaddr - Relay agent IPv6 link address to use in DHCP6 requests. type: str more...
- landing-page type: dict
- form-data - No description for the parameter type: array more...
- logout-url - Landing page log out URL. type: str more...
- sso - Single sign-on. type: str choices: [disable, static, auto] more...
- sso-credential - Single sign-on credentials. type: str choices: [sslvpn-login, alternative] more...
- sso-password - No description for the parameter type: str more...
- sso-username - SSO user name. type: str more...
- url - Landing page URL. type: str more...
- landing-page-mode - Enable/disable SSL-VPN landing page mode. type: str choices: [disable, enable] more...
Notes¶
Note
- Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.
- To create or update an object, use state: present directive.
- To delete an object, use state: absent directive
- Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded
Examples¶
- hosts: fortimanager-inventory
collections:
- fortinet.fortimanager
connection: httpapi
vars:
ansible_httpapi_use_ssl: True
ansible_httpapi_validate_certs: False
ansible_httpapi_port: 443
tasks:
- name: Portal.
fmgr_vpnsslweb_portal:
bypass_validation: False
workspace_locking_adom: <value in [global, custom adom including root]>
workspace_locking_timeout: 300
rc_succeeded: [0, -2, -3, ...]
rc_failed: [-2, -3, ...]
adom: <your own value>
state: <value in [present, absent]>
vpnsslweb_portal:
allow-user-access:
- web
- ftp
- telnet
- smb
- vnc
- rdp
- ssh
- ping
- citrix
- portforward
- sftp
auto-connect: <value in [disable, enable]>
bookmark-group:
-
bookmarks:
-
additional-params: <value of string>
apptype: <value in [web, telnet, ssh, ...]>
description: <value of string>
folder: <value of string>
form-data:
-
name: <value of string>
value: <value of string>
host: <value of string>
listening-port: <value of integer>
load-balancing-info: <value of string>
logon-password: <value of string>
logon-user: <value of string>
name: <value of string>
port: <value of integer>
preconnection-blob: <value of string>
preconnection-id: <value of integer>
remote-port: <value of integer>
security: <value in [rdp, nla, tls, ...]>
server-layout: <value in [en-us-qwerty, de-de-qwertz, fr-fr-azerty, ...]>
show-status-window: <value in [disable, enable]>
sso: <value in [disable, static, auto]>
sso-credential: <value in [sslvpn-login, alternative]>
sso-credential-sent-once: <value in [disable, enable]>
sso-password: <value of string>
sso-username: <value of string>
url: <value of string>
domain: <value of string>
color-depth: <value in [8, 16, 32]>
height: <value of integer>
keyboard-layout: <value in [ar, da, de, ...]>
restricted-admin: <value in [disable, enable]>
send-preconnection-id: <value in [disable, enable]>
width: <value of integer>
vnc-keyboard-layout: <value in [da, de, de-ch, ...]>
name: <value of string>
custom-lang: <value of string>
customize-forticlient-download-url: <value in [disable, enable]>
display-bookmark: <value in [disable, enable]>
display-connection-tools: <value in [disable, enable]>
display-history: <value in [disable, enable]>
display-status: <value in [disable, enable]>
dns-server1: <value of string>
dns-server2: <value of string>
dns-suffix: <value of string>
exclusive-routing: <value in [disable, enable]>
forticlient-download: <value in [disable, enable]>
forticlient-download-method: <value in [direct, ssl-vpn]>
heading: <value of string>
hide-sso-credential: <value in [disable, enable]>
host-check: <value in [none, av, fw, ...]>
host-check-interval: <value of integer>
host-check-policy: <value of string>
ip-mode: <value in [range, user-group, dhcp, ...]>
ip-pools: <value of string>
ipv6-dns-server1: <value of string>
ipv6-dns-server2: <value of string>
ipv6-exclusive-routing: <value in [disable, enable]>
ipv6-pools: <value of string>
ipv6-service-restriction: <value in [disable, enable]>
ipv6-split-tunneling: <value in [disable, enable]>
ipv6-split-tunneling-routing-address: <value of string>
ipv6-tunnel-mode: <value in [disable, enable]>
ipv6-wins-server1: <value of string>
ipv6-wins-server2: <value of string>
keep-alive: <value in [disable, enable]>
limit-user-logins: <value in [disable, enable]>
mac-addr-action: <value in [deny, allow]>
mac-addr-check: <value in [disable, enable]>
mac-addr-check-rule:
-
mac-addr-list: <value of string>
mac-addr-mask: <value of integer>
name: <value of string>
macos-forticlient-download-url: <value of string>
name: <value of string>
os-check: <value in [disable, enable]>
redir-url: <value of string>
save-password: <value in [disable, enable]>
service-restriction: <value in [disable, enable]>
skip-check-for-unsupported-browser: <value in [disable, enable]>
skip-check-for-unsupported-os: <value in [disable, enable]>
smb-ntlmv1-auth: <value in [disable, enable]>
smbv1: <value in [disable, enable]>
split-dns:
-
dns-server1: <value of string>
dns-server2: <value of string>
domains: <value of string>
id: <value of integer>
ipv6-dns-server1: <value of string>
ipv6-dns-server2: <value of string>
split-tunneling: <value in [disable, enable]>
split-tunneling-routing-address: <value of string>
theme: <value in [gray, blue, orange, ...]>
tunnel-mode: <value in [disable, enable]>
user-bookmark: <value in [disable, enable]>
user-group-bookmark: <value in [disable, enable]>
web-mode: <value in [disable, enable]>
windows-forticlient-download-url: <value of string>
wins-server1: <value of string>
wins-server2: <value of string>
skip-check-for-browser: <value in [disable, enable]>
smb-max-version: <value in [smbv1, smbv2, smbv3]>
smb-min-version: <value in [smbv1, smbv2, smbv3]>
virtual-desktop-printing: <value in [disable, enable]>
virtual-desktop-desktop-switch: <value in [disable, enable]>
virtual-desktop-app-list: <value of string>
virtual-desktop-clipboard-share: <value in [disable, enable]>
virtual-desktop-removable-media-access: <value in [disable, enable]>
virtual-desktop-logout-when-browser-close: <value in [disable, enable]>
virtual-desktop-network-share-access: <value in [disable, enable]>
virtual-desktop: <value in [disable, enable]>
transform-backward-slashes: <value in [disable, enable]>
ipv6-split-tunneling-routing-negate: <value in [disable, enable]>
split-tunneling-routing-negate: <value in [disable, enable]>
os-check-list:
action: <value in [allow, check-up-to-date, deny]>
latest-patch-level: <value of string>
name: <value of string>
tolerance: <value of integer>
use-sdwan: <value in [disable, enable]>
prefer-ipv6-dns: <value in [disable, enable]>
rewrite-ip-uri-ui: <value in [disable, enable]>
clipboard: <value in [disable, enable]>
default-window-height: <value of integer>
default-window-width: <value of integer>
dhcp-ip-overlap: <value in [use-old, use-new]>
client-src-range: <value in [disable, enable]>
dhcp-ra-giaddr: <value of string>
dhcp6-ra-linkaddr: <value of string>
landing-page:
form-data:
-
name: <value of string>
value: <value of string>
logout-url: <value of string>
sso: <value in [disable, static, auto]>
sso-credential: <value in [sslvpn-login, alternative]>
sso-password: <value of string>
sso-username: <value of string>
url: <value of string>
landing-page-mode: <value in [disable, enable]>
Return Values¶
Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:
- meta - The result of the request.returned: always type: dict
- request_url - The full url requested. returned: always type: str sample: /sys/login/user
- response_code - The status of api request. returned: always type: int sample: 0
- response_data - The data body of the api response. returned: optional type: list or dict
- response_message - The descriptive message of the api response. returned: always type: str sample: OK
- system_information - The information of the target system. returned: always type: dict
- rc - The status the request. returned: always type: int 0
- version_check_warning - Warning if the parameters used in the playbook are not supported by the current FortiManager version. returned: if at least on parameter mpt supported by the current FortiManager version type: list 0