fmgr_switchcontroller_managedswitch – Configure FortiSwitch devices that are managed by this FortiGate.¶
New in version 2.0.0.
Synopsis¶
- This module is able to configure a FortiManager device.
- Examples include all parameters and values need to be adjusted to data sources before usage.
- Tested with FortiManager v6.x and v7.x.
Requirements¶
The below requirements are needed on the host that executes this module.
- ansible>=2.9.0
FortiManager Version Compatibility¶
6.0.0 |
||||||||||||
| True | ||||||||||||
6.2.0 |
6.2.1 |
6.2.2 |
6.2.3 |
6.2.5 |
6.2.6 |
6.2.7 |
6.2.8 |
6.2.9 |
6.2.10 |
6.2.11 |
||
| True | True | True | True | True | True | True | True | True | True | True | ||
6.4.0 |
6.4.1 |
6.4.2 |
6.4.3 |
6.4.4 |
6.4.5 |
6.4.6 |
6.4.7 |
6.4.8 |
6.4.9 |
6.4.10 |
6.4.11 |
6.4.12 |
| True | True | True | True | True | True | True | True | True | True | True | True | True |
7.0.0 |
7.0.1 |
7.0.2 |
7.0.3 |
7.0.4 |
7.0.5 |
7.0.6 |
7.0.7 |
7.0.8 |
||||
| True | True | True | True | True | True | True | True | True | ||||
7.2.0 |
7.2.1 |
7.2.2 |
7.2.3 |
|||||||||
| True | True | True | True | |||||||||
7.4.0 |
||||||||||||
| True |
Parameters¶
- access_token -The token to access FortiManager without using username and password. type: str required: false
- bypass_validation - Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters. type: bool required: false default: False
- enable_log - Enable/Disable logging for task. type: bool required: false default: False
- forticloud_access_token - Access token of forticloud managed API users, this option is available with FortiManager later than 6.4.0. type: str required: false
- proposed_method - The overridden method for the underlying Json RPC request. type: str required: false choices: set, update, add
- rc_succeeded - The rc codes list with which the conditions to succeed will be overriden. type: list required: false
- rc_failed - The rc codes list with which the conditions to fail will be overriden. type: list required: false
- state - The directive to create, update or delete an object type: str required: true choices: present, absent
- workspace_locking_adom - Acquire the workspace lock if FortiManager is running in workspace mode. type: str required: false choices: global, custom adom including root
- workspace_locking_timeout - The maximum time in seconds to wait for other users to release workspace lock. type: integer required: false default: 300
- adom - The parameter in requested url type: str required: true
- switchcontroller_managedswitch - Configure FortiSwitch devices that are managed by this FortiGate. type: dict
- _platform - _Platform. type: str more...
- description - Description. type: str more...
- name - Managed-switch name. type: str more...
- ports - Ports. type: array
more...
- allowed-vlans - Configure switch port tagged vlans type: str more...
- allowed-vlans-all - Enable/disable all defined vlans on this port. type: str choices: [disable, enable] more...
- arp-inspection-trust - Trusted or untrusted dynamic ARP inspection. type: str choices: [untrusted, trusted] more...
- bundle - Enable/disable Link Aggregation Group (LAG) bundling for non-FortiLink interfaces. type: str choices: [disable, enable] more...
- description - Description for port. type: str more...
- dhcp-snoop-option82-trust - Enable/disable allowance of DHCP with option-82 on untrusted interface. type: str choices: [disable, enable] more...
- dhcp-snooping - Trusted or untrusted DHCP-snooping interface. type: str choices: [trusted, untrusted] more...
- discard-mode - Configure discard mode for port. type: str choices: [none, all-untagged, all-tagged] more...
- edge-port - Enable/disable this interface as an edge port, bridging connections between workstations and/or computers. type: str choices: [disable, enable] more...
- igmp-snooping - Set IGMP snooping mode for the physical port interface. type: str choices: [disable, enable] more...
- igmps-flood-reports - Enable/disable flooding of IGMP reports to this interface when igmp-snooping enabled. type: str choices: [disable, enable] more...
- igmps-flood-traffic - Enable/disable flooding of IGMP snooping traffic to this interface. type: str choices: [disable, enable] more...
- lacp-speed - end Link Aggregation Control Protocol (LACP) messages every 30 seconds (slow) or every second (fast). type: str choices: [slow, fast] more...
- learning-limit - Limit the number of dynamic MAC addresses on this Port (1 - 128, 0 = no limit, default). type: int more...
- lldp-profile - LLDP port TLV profile. type: str more...
- lldp-status - LLDP transmit and receive status. type: str choices: [disable, rx-only, tx-only, tx-rx] more...
- loop-guard - Enable/disable loop-guard on this interface, an STP optimization used to prevent network loops. type: str choices: [disabled, enabled] more...
- loop-guard-timeout - Loop-guard timeout (0 - 120 min, default = 45). type: int more...
- max-bundle - Maximum size of LAG bundle (1 - 24, default = 24) type: int more...
- mclag - Enable/disable multi-chassis link aggregation (MCLAG). type: str choices: [disable, enable] more...
- member-withdrawal-behavior - Port behavior after it withdraws because of loss of control packets. type: str choices: [forward, block] more...
- members - Aggregated LAG bundle interfaces. type: str more...
- min-bundle - Minimum size of LAG bundle (1 - 24, default = 1) type: int more...
- mode - LACP mode: ignore and do not send control messages, or negotiate 802. type: str choices: [static, lacp-passive, lacp-active] more...
- poe-pre-standard-detection - Enable/disable PoE pre-standard detection. type: str choices: [disable, enable] more...
- poe-status - Enable/disable PoE status. type: str choices: [disable, enable] more...
- port-name - Switch port name. type: str more...
- port-owner - Switch port name. type: str more...
- port-security-policy - Switch controller authentication policy to apply to this managed switch from available options. type: str more...
- port-selection-criteria - Algorithm for aggregate port selection. type: str choices: [src-mac, dst-mac, src-dst-mac, src-ip, dst-ip, src-dst-ip] more...
- qos-policy - Switch controller QoS policy from available options. type: str more...
- sample-direction - sFlow sample direction. type: str choices: [rx, tx, both] more...
- sflow-counter-interval - sFlow sampler counter polling interval (1 - 255 sec). type: int more...
- sflow-sample-rate - sFlow sampler sample rate (0 - 99999 p/sec). type: int more...
- sflow-sampler - Enable/disable sFlow protocol on this interface. type: str choices: [disabled, enabled] more...
- stp-bpdu-guard - Enable/disable STP BPDU guard on this interface. type: str choices: [disabled, enabled] more...
- stp-bpdu-guard-timeout - BPDU Guard disabling protection (0 - 120 min). type: int more...
- stp-root-guard - Enable/disable STP root guard on this interface. type: str choices: [disabled, enabled] more...
- stp-state - Enable/disable Spanning Tree Protocol (STP) on this interface. type: str choices: [disabled, enabled] more...
- type - Interface type: physical or trunk port. type: str choices: [physical, trunk] more...
- untagged-vlans - Configure switch port untagged vlans type: str more...
- vlan - Assign switch ports to a VLAN. type: str more...
- export-to-pool-flag - Switch controller export port to pool-list. type: int more...
- mac-addr - Port/Trunk MAC. type: str more...
- packet-sample-rate - Packet sampling rate (0 - 99999 p/sec). type: int more...
- packet-sampler - Enable/disable packet sampling on this interface. type: str choices: [disabled, enabled] more...
- sticky-mac - Enable or disable sticky-mac on the interface. type: str choices: [disable, enable] more...
- storm-control-policy - Switch controller storm control policy from available options. type: str more...
- dot1x-enable - No description for the parameter type: str choices: [disable, enable] more...
- max-miss-heartbeats - Maximum tolerant missed heartbeats. type: int more...
- access-mode - Access mode of the port. type: str choices: [normal, nac, dynamic, static] more...
- ip-source-guard - Enable/disable IP source guard. type: str choices: [disable, enable] more...
- mclag-icl-port - Mclag-Icl-Port. type: int more...
- p2p-port - P2P-Port. type: int more...
- aggregator-mode - LACP member select mode. type: str choices: [bandwidth, count] more...
- rpvst-port - Enable/disable inter-operability with rapid PVST on this interface. type: str choices: [disabled, enabled] more...
- flow-control - Flow control direction. type: str choices: [disable, tx, rx, both] more...
- media-type - Media-Type. type: str more...
- pause-meter - Configure ingress pause metering rate, in kbps (default = 0, disabled). type: int more...
- pause-meter-resume - Resume threshold for resuming traffic on ingress port. type: str choices: [25%, 50%, 75%] more...
- trunk-member - Trunk member. type: int more...
- fec-capable - FEC capable. type: int more...
- fec-state - State of forward error correction. type: str choices: [disabled, cl74, cl91] more...
- matched-dpp-intf-tags - Matched interface tags in the dynamic port policy. type: str more...
- matched-dpp-policy - Matched child policy in the dynamic port policy. type: str more...
- port-policy - Switch controller dynamic port policy from available options. type: str more...
- status - Switch port admin status: up or down. type: str choices: [down, up] more...
- dsl-profile - DSL policy configuration. type: str more...
- flap-duration - Period over which flap events are calculated (seconds). type: int more...
- flap-rate - Number of stage change events needed within flap-duration. type: int more...
- flap-timeout - Flap guard disabling protection (min). type: int more...
- flapguard - Enable/disable flap guard. type: str choices: [disable, enable] more...
- interface-tags - No description for the parameter type: str more...
- poe-max-power - No description for the parameter type: str more...
- poe-standard - No description for the parameter type: str more...
- igmp-snooping-flood-reports - Enable/disable flooding of IGMP reports to this interface when igmp-snooping enabled. type: str choices: [disable, enable] more...
- mcast-snooping-flood-traffic - Enable/disable flooding of IGMP snooping traffic to this interface. type: str choices: [disable, enable] more...
- link-status - No description for the parameter type: str choices: [down, up] more...
- poe-mode-bt-cabable - PoE mode IEEE 802. type: int more...
- poe-port-mode - Configure PoE port mode. type: str choices: [ieee802-3af, ieee802-3at, ieee802-3bt] more...
- poe-port-power - Configure PoE port power. type: str choices: [normal, perpetual, perpetual-fast] more...
- poe-port-priority - Configure PoE port priority. type: str choices: [critical-priority, high-priority, low-priority, medium-priority] more...
- acl-group - No description for the parameter type: str more...
- dhcp-snoop-option82-override - No description for the parameter type: array more...
- fortiswitch-acls - No description for the parameter type: int more...
- isl-peer-device-sn - No description for the parameter type: str more...
- switch-id - Managed-switch id. type: str more...
- override-snmp-community - Enable/disable overriding the global SNMP communities. type: str choices: [disable, enable] more...
- override-snmp-sysinfo - Enable/disable overriding the global SNMP system information. type: str choices: [disable, enable] more...
- override-snmp-trap-threshold - Enable/disable overriding the global SNMP trap threshold values. type: str choices: [disable, enable] more...
- override-snmp-user - Enable/disable overriding the global SNMP users. type: str choices: [disable, enable] more...
- poe-detection-type - Poe-Detection-Type. type: int more...
- remote-log - No description for the parameter type: array
more...
- csv - Enable/disable comma-separated value (CSV) strings. type: str choices: [disable, enable] more...
- facility - Facility to log to remote syslog server. type: str choices: [kernel, user, mail, daemon, auth, syslog, lpr, news, uucp, cron, authpriv, ftp, ntp, audit, alert, clock, local0, local1, local2, local3, local4, local5, local6, local7] more...
- name - Remote log name. type: str more...
- port - Remote syslog server listening port. type: int more...
- server - IPv4 address of the remote syslog server. type: str more...
- severity - Severity of logs to be transferred to remote log server. type: str choices: [emergency, alert, critical, error, warning, notification, information, debug] more...
- status - Enable/disable logging by FortiSwitch device to a remote syslog server. type: str choices: [disable, enable] more...
- snmp-community - No description for the parameter type: array
more...
- events - No description for the parameter type: array choices: [cpu-high, mem-low, log-full, intf-ip, ent-conf-change] more...
- hosts - No description for the parameter type: array more...
- id - SNMP community ID. type: int more...
- name - SNMP community name. type: str more...
- query-v1-port - SNMP v1 query port (default = 161). type: int more...
- query-v1-status - Enable/disable SNMP v1 queries. type: str choices: [disable, enable] more...
- query-v2c-port - SNMP v2c query port (default = 161). type: int more...
- query-v2c-status - Enable/disable SNMP v2c queries. type: str choices: [disable, enable] more...
- status - Enable/disable this SNMP community. type: str choices: [disable, enable] more...
- trap-v1-lport - SNMP v2c trap local port (default = 162). type: int more...
- trap-v1-rport - SNMP v2c trap remote port (default = 162). type: int more...
- trap-v1-status - Enable/disable SNMP v1 traps. type: str choices: [disable, enable] more...
- trap-v2c-lport - SNMP v2c trap local port (default = 162). type: int more...
- trap-v2c-rport - SNMP v2c trap remote port (default = 162). type: int more...
- trap-v2c-status - Enable/disable SNMP v2c traps. type: str choices: [disable, enable] more...
- snmp-user - No description for the parameter type: array
more...
- auth-proto - Authentication protocol. type: str choices: [md5, sha] more...
- auth-pwd - No description for the parameter type: str more...
- name - SNMP user name. type: str more...
- priv-proto - Privacy (encryption) protocol. type: str choices: [des, aes] more...
- priv-pwd - No description for the parameter type: str more...
- queries - Enable/disable SNMP queries for this user. type: str choices: [disable, enable] more...
- query-port - SNMPv3 query port (default = 161). type: int more...
- security-level - Security level for message authentication and encryption. type: str choices: [no-auth-no-priv, auth-no-priv, auth-priv] more...
- mclag-igmp-snooping-aware - Enable/disable MCLAG IGMP-snooping awareness. type: str choices: [disable, enable] more...
- ip-source-guard - No description for the parameter type: array more...
- l3-discovered - L3-Discovered. type: int more...
- qos-drop-policy - Set QoS drop-policy. type: str choices: [taildrop, random-early-detection] more...
- qos-red-probability - Set QoS RED/WRED drop probability. type: int more...
- switch-dhcp_opt43_key - DHCP option43 key. type: str more...
- tdr-supported - Tdr-Supported. type: str more...
- custom-command - Custom-Command. type: array more...
- firmware-provision - Enable/disable provisioning of firmware to FortiSwitches on join connection. type: str choices: [disable, enable] more...
- firmware-provision-version - Firmware version to provision to this FortiSwitch on bootup (major. type: str more...
- dhcp-server-access-list - DHCP snooping server access list. type: str choices: [disable, enable, global] more...
- firmware-provision-latest - Enable/disable one-time automatic provisioning of the latest firmware version. type: str choices: [disable, once] more...
- dhcp-snooping-static-client - No description for the parameter type: array more...
Notes¶
Note
- Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.
- To create or update an object, use state: present directive.
- To delete an object, use state: absent directive
- Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded
Examples¶
- hosts: fortimanager-inventory
collections:
- fortinet.fortimanager
connection: httpapi
vars:
ansible_httpapi_use_ssl: True
ansible_httpapi_validate_certs: False
ansible_httpapi_port: 443
tasks:
- name: Configure FortiSwitch devices that are managed by this FortiGate.
fmgr_switchcontroller_managedswitch:
bypass_validation: False
workspace_locking_adom: <value in [global, custom adom including root]>
workspace_locking_timeout: 300
rc_succeeded: [0, -2, -3, ...]
rc_failed: [-2, -3, ...]
adom: <your own value>
state: <value in [present, absent]>
switchcontroller_managedswitch:
_platform: <value of string>
description: <value of string>
name: <value of string>
ports:
-
allowed-vlans: <value of string>
allowed-vlans-all: <value in [disable, enable]>
arp-inspection-trust: <value in [untrusted, trusted]>
bundle: <value in [disable, enable]>
description: <value of string>
dhcp-snoop-option82-trust: <value in [disable, enable]>
dhcp-snooping: <value in [trusted, untrusted]>
discard-mode: <value in [none, all-untagged, all-tagged]>
edge-port: <value in [disable, enable]>
igmp-snooping: <value in [disable, enable]>
igmps-flood-reports: <value in [disable, enable]>
igmps-flood-traffic: <value in [disable, enable]>
lacp-speed: <value in [slow, fast]>
learning-limit: <value of integer>
lldp-profile: <value of string>
lldp-status: <value in [disable, rx-only, tx-only, ...]>
loop-guard: <value in [disabled, enabled]>
loop-guard-timeout: <value of integer>
max-bundle: <value of integer>
mclag: <value in [disable, enable]>
member-withdrawal-behavior: <value in [forward, block]>
members: <value of string>
min-bundle: <value of integer>
mode: <value in [static, lacp-passive, lacp-active]>
poe-pre-standard-detection: <value in [disable, enable]>
poe-status: <value in [disable, enable]>
port-name: <value of string>
port-owner: <value of string>
port-security-policy: <value of string>
port-selection-criteria: <value in [src-mac, dst-mac, src-dst-mac, ...]>
qos-policy: <value of string>
sample-direction: <value in [rx, tx, both]>
sflow-counter-interval: <value of integer>
sflow-sample-rate: <value of integer>
sflow-sampler: <value in [disabled, enabled]>
stp-bpdu-guard: <value in [disabled, enabled]>
stp-bpdu-guard-timeout: <value of integer>
stp-root-guard: <value in [disabled, enabled]>
stp-state: <value in [disabled, enabled]>
type: <value in [physical, trunk]>
untagged-vlans: <value of string>
vlan: <value of string>
export-to-pool-flag: <value of integer>
mac-addr: <value of string>
packet-sample-rate: <value of integer>
packet-sampler: <value in [disabled, enabled]>
sticky-mac: <value in [disable, enable]>
storm-control-policy: <value of string>
dot1x-enable: <value in [disable, enable]>
max-miss-heartbeats: <value of integer>
access-mode: <value in [normal, nac, dynamic, ...]>
ip-source-guard: <value in [disable, enable]>
mclag-icl-port: <value of integer>
p2p-port: <value of integer>
aggregator-mode: <value in [bandwidth, count]>
rpvst-port: <value in [disabled, enabled]>
flow-control: <value in [disable, tx, rx, ...]>
media-type: <value of string>
pause-meter: <value of integer>
pause-meter-resume: <value in [25%, 50%, 75%]>
trunk-member: <value of integer>
fec-capable: <value of integer>
fec-state: <value in [disabled, cl74, cl91]>
matched-dpp-intf-tags: <value of string>
matched-dpp-policy: <value of string>
port-policy: <value of string>
status: <value in [down, up]>
dsl-profile: <value of string>
flap-duration: <value of integer>
flap-rate: <value of integer>
flap-timeout: <value of integer>
flapguard: <value in [disable, enable]>
interface-tags: <value of string>
poe-max-power: <value of string>
poe-standard: <value of string>
igmp-snooping-flood-reports: <value in [disable, enable]>
mcast-snooping-flood-traffic: <value in [disable, enable]>
link-status: <value in [down, up]>
poe-mode-bt-cabable: <value of integer>
poe-port-mode: <value in [ieee802-3af, ieee802-3at, ieee802-3bt]>
poe-port-power: <value in [normal, perpetual, perpetual-fast]>
poe-port-priority: <value in [critical-priority, high-priority, low-priority, ...]>
acl-group: <value of string>
dhcp-snoop-option82-override:
-
circuit-id: <value of string>
remote-id: <value of string>
vlan-name: <value of string>
fortiswitch-acls: <value of integer>
isl-peer-device-sn: <value of string>
switch-id: <value of string>
override-snmp-community: <value in [disable, enable]>
override-snmp-sysinfo: <value in [disable, enable]>
override-snmp-trap-threshold: <value in [disable, enable]>
override-snmp-user: <value in [disable, enable]>
poe-detection-type: <value of integer>
remote-log:
-
csv: <value in [disable, enable]>
facility: <value in [kernel, user, mail, ...]>
name: <value of string>
port: <value of integer>
server: <value of string>
severity: <value in [emergency, alert, critical, ...]>
status: <value in [disable, enable]>
snmp-community:
-
events:
- cpu-high
- mem-low
- log-full
- intf-ip
- ent-conf-change
hosts:
-
id: <value of integer>
ip: <value of string>
id: <value of integer>
name: <value of string>
query-v1-port: <value of integer>
query-v1-status: <value in [disable, enable]>
query-v2c-port: <value of integer>
query-v2c-status: <value in [disable, enable]>
status: <value in [disable, enable]>
trap-v1-lport: <value of integer>
trap-v1-rport: <value of integer>
trap-v1-status: <value in [disable, enable]>
trap-v2c-lport: <value of integer>
trap-v2c-rport: <value of integer>
trap-v2c-status: <value in [disable, enable]>
snmp-user:
-
auth-proto: <value in [md5, sha]>
auth-pwd: <value of string>
name: <value of string>
priv-proto: <value in [des, aes]>
priv-pwd: <value of string>
queries: <value in [disable, enable]>
query-port: <value of integer>
security-level: <value in [no-auth-no-priv, auth-no-priv, auth-priv]>
mclag-igmp-snooping-aware: <value in [disable, enable]>
ip-source-guard:
-
binding-entry:
-
entry-name: <value of string>
ip: <value of string>
mac: <value of string>
description: <value of string>
port: <value of string>
l3-discovered: <value of integer>
qos-drop-policy: <value in [taildrop, random-early-detection]>
qos-red-probability: <value of integer>
switch-dhcp_opt43_key: <value of string>
tdr-supported: <value of string>
custom-command:
-
command-entry: <value of string>
command-name: <value of string>
firmware-provision: <value in [disable, enable]>
firmware-provision-version: <value of string>
dhcp-server-access-list: <value in [disable, enable, global]>
firmware-provision-latest: <value in [disable, once]>
dhcp-snooping-static-client:
-
ip: <value of string>
mac: <value of string>
name: <value of string>
port: <value of string>
vlan: <value of string>
Return Values¶
Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:
- meta - The result of the request.returned: always type: dict
- request_url - The full url requested. returned: always type: str sample: /sys/login/user
- response_code - The status of api request. returned: always type: int sample: 0
- response_data - The data body of the api response. returned: optional type: list or dict
- response_message - The descriptive message of the api response. returned: always type: str sample: OK
- system_information - The information of the target system. returned: always type: dict
- rc - The status the request. returned: always type: int 0
- version_check_warning - Warning if the parameters used in the playbook are not supported by the current FortiManager version. returned: if at least on parameter mpt supported by the current FortiManager version type: list 0