fmgr_vpn_ssl_settings – Configure SSL VPN.

Added in version 2.1.0.

Warning

Starting in version 3.0.0, all input arguments will be named using the underscore naming convention (snake_case).

  • Argument name before 3.0.0: var-name, var name, var.name

  • New argument name starting in 3.0.0: var_name

FortiManager Ansible v2.4+ supports both previous argument name and new underscore name. You will receive deprecation warnings if you keep using the previous argument name. You can ignore the warning by setting deprecation_warnings=False in ansible.cfg.

Synopsis

  • This module is able to configure a FortiManager device.

  • Examples include all parameters and values need to be adjusted to data sources before usage.

  • Tested with FortiManager v7.x.

Requirements

The below requirements are needed on the host that executes this module.

  • ansible>=2.15.0

FortiManager Version Compatibility

Supported Version Ranges: v6.2.6 -> v6.2.13, v6.4.2 -> latest

Parameters

  • access_token -The token to access FortiManager without using username and password. type: str required: false
  • bypass_validation - Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters. type: bool required: false default: False
  • enable_log - Enable/Disable logging for task. type: bool required: false default: False
  • forticloud_access_token - Access token of forticloud managed API users, this option is available with FortiManager later than 6.4.0. type: str required: false
  • proposed_method - The overridden method for the underlying Json RPC request. type: str required: false choices: set, update, add
  • rc_succeeded - The rc codes list with which the conditions to succeed will be overriden. type: list required: false
  • rc_failed - The rc codes list with which the conditions to fail will be overriden. type: list required: false
  • workspace_locking_adom - Acquire the workspace lock if FortiManager is running in workspace mode. type: str required: false choices: global, custom adom including root
  • workspace_locking_timeout - The maximum time in seconds to wait for other users to release workspace lock. type: integer required: false default: 300
  • device - The parameter in requested url type: str required: true
  • vdom - The parameter in requested url type: str required: true
  • vpn_ssl_settings - Configure SSL VPN. type: dict
    • algorithm Force the ssl vpn security level. type: str choices: [default, high, low, medium] more...
    • auth_session_check_source_ip (Alias name: auth-session-check-source-ip) Enable/disable checking of source ip for authentication session. type: str choices: [disable, enable] more...
    • auth_timeout (Alias name: auth-timeout) Ssl vpn authentication timeout (1 - 259200 sec (3 days), 0 for no timeout). type: int more...
    • authentication_rule (Alias name: authentication-rule) Authentication rule. type: list more...
      • auth Ssl vpn authentication method restriction. type: str choices: [any, local, radius, ldap, tacacs+, peer] more...
      • cipher Ssl vpn cipher strength. type: str choices: [any, high, medium] more...
      • client_cert (Alias name: client-cert) Enable/disable ssl vpn client certificate restrictive. type: str choices: [disable, enable] more...
      • groups User groups. type: list or str more...
      • id Id (0 - 4294967295). type: int more...
      • portal Ssl vpn portal. type: str more...
      • realm Ssl vpn realm. type: str more...
      • source_address (Alias name: source-address) Source address of incoming traffic. type: list or str more...
      • source_address_negate (Alias name: source-address-negate) Enable/disable negated source address match. type: str choices: [disable, enable] more...
      • source_address6 (Alias name: source-address6) Ipv6 source address of incoming traffic. type: list or str more...
      • source_address6_negate (Alias name: source-address6-negate) Enable/disable negated source ipv6 address match. type: str choices: [disable, enable] more...
      • source_interface (Alias name: source-interface) Ssl vpn source interface of incoming traffic. type: list or str more...
      • user_peer (Alias name: user-peer) Name of user peer. type: str more...
      • users User name. type: list or str more...
    • auto_tunnel_static_route (Alias name: auto-tunnel-static-route) Enable/disable to auto-create static routes for the ssl vpn tunnel ip addresses. type: str choices: [disable, enable] more...
    • banned_cipher (Alias name: banned-cipher) Select one or more cipher technologies that cannot be used in ssl vpn negotiations. type: list choices: [RSA, DH, DHE, ECDH, ECDHE, DSS, ECDSA, AES, AESGCM, CAMELLIA, 3DES, SHA1, SHA256, SHA384, STATIC, CHACHA20, ARIA, AESCCM] more...
    • check_referer (Alias name: check-referer) Enable/disable verification of referer field in http request header. type: str choices: [disable, enable] more...
    • default_portal (Alias name: default-portal) Default ssl vpn portal. type: str more...
    • deflate_compression_level (Alias name: deflate-compression-level) Compression level (0~9). type: int more...
    • deflate_min_data_size (Alias name: deflate-min-data-size) Minimum amount of data that triggers compression (200 - 65535 bytes). type: int more...
    • dns_server1 (Alias name: dns-server1) Dns server 1. type: str more...
    • dns_server2 (Alias name: dns-server2) Dns server 2. type: str more...
    • dns_suffix (Alias name: dns-suffix) Dns suffix used for ssl vpn clients. type: str more...
    • dtls_hello_timeout (Alias name: dtls-hello-timeout) Sslvpn maximum dtls hello timeout (10 - 60 sec, default = 10). type: int more...
    • dtls_max_proto_ver (Alias name: dtls-max-proto-ver) Dtls maximum protocol version. type: str choices: [dtls1-0, dtls1-2] more...
    • dtls_min_proto_ver (Alias name: dtls-min-proto-ver) Dtls minimum protocol version. type: str choices: [dtls1-0, dtls1-2] more...
    • dtls_tunnel (Alias name: dtls-tunnel) Enable/disable dtls to prevent eavesdropping, tampering, or message forgery. type: str choices: [disable, enable] more...
    • encode_2f_sequence (Alias name: encode-2f-sequence) Encode \2f sequence to forward slash in urls. type: str choices: [disable, enable] more...
    • encrypt_and_store_password (Alias name: encrypt-and-store-password) Encrypt and store user passwords for ssl vpn web sessions. type: str choices: [disable, enable] more...
    • force_two_factor_auth (Alias name: force-two-factor-auth) Enable/disable only pki users with two-factor authentication for ssl vpns. type: str choices: [disable, enable] more...
    • header_x_forwarded_for (Alias name: header-x-forwarded-for) Forward the same, add, or remove http header. type: str choices: [pass, add, remove] more...
    • hsts_include_subdomains (Alias name: hsts-include-subdomains) Add hsts includesubdomains response header. type: str choices: [disable, enable] more...
    • http_compression (Alias name: http-compression) Enable/disable to allow http compression over ssl vpn tunnels. type: str choices: [disable, enable] more...
    • http_only_cookie (Alias name: http-only-cookie) Enable/disable ssl vpn support for httponly cookies. type: str choices: [disable, enable] more...
    • http_request_body_timeout (Alias name: http-request-body-timeout) Ssl vpn session is disconnected if an http request body is not received within this time (1 - 60 sec, default = 20). type: int more...
    • http_request_header_timeout (Alias name: http-request-header-timeout) Ssl vpn session is disconnected if an http request header is not received within this time (1 - 60 sec, default = 20). type: int more...
    • https_redirect (Alias name: https-redirect) Enable/disable redirect of port 80 to ssl vpn port. type: str choices: [disable, enable] more...
    • idle_timeout (Alias name: idle-timeout) Ssl vpn disconnects if idle for specified time in seconds. type: int more...
    • ipv6_dns_server1 (Alias name: ipv6-dns-server1) Ipv6 dns server 1. type: str more...
    • ipv6_dns_server2 (Alias name: ipv6-dns-server2) Ipv6 dns server 2. type: str more...
    • ipv6_wins_server1 (Alias name: ipv6-wins-server1) Ipv6 wins server 1. type: str more...
    • ipv6_wins_server2 (Alias name: ipv6-wins-server2) Ipv6 wins server 2. type: str more...
    • login_attempt_limit (Alias name: login-attempt-limit) Ssl vpn maximum login attempt times before block (0 - 10, default = 2, 0 = no limit). type: int more...
    • login_block_time (Alias name: login-block-time) Time for which a user is blocked from logging in after too many failed login attempts (0 - 86400 sec, default = 60). type: int more...
    • login_timeout (Alias name: login-timeout) Sslvpn maximum login timeout (10 - 180 sec, default = 30). type: int more...
    • port Ssl vpn access port (1 - 65535). type: int more...
    • port_precedence (Alias name: port-precedence) Enable/disable, enable means that if ssl vpn connections are allowed on an interface admin gui connections are blocked on that interface. type: str choices: [disable, enable] more...
    • reqclientcert Enable/disable to require client certificates for all ssl vpn users. type: str choices: [disable, enable] more...
    • route_source_interface (Alias name: route-source-interface) Enable/disable to allow ssl vpn sessions to bypass routing and bind to the incoming interface. type: str choices: [disable, enable] more...
    • servercert Name of the server certificate to be used for ssl vpns. type: str more...
    • source_address (Alias name: source-address) Source address of incoming traffic. type: list or str more...
    • source_address_negate (Alias name: source-address-negate) Enable/disable negated source address match. type: str choices: [disable, enable] more...
    • source_address6 (Alias name: source-address6) Ipv6 source address of incoming traffic. type: list or str more...
    • source_address6_negate (Alias name: source-address6-negate) Enable/disable negated source ipv6 address match. type: str choices: [disable, enable] more...
    • source_interface (Alias name: source-interface) Ssl vpn source interface of incoming traffic. type: list or str more...
    • ssl_client_renegotiation (Alias name: ssl-client-renegotiation) Enable/disable to allow client renegotiation by the server if the tunnel goes down. type: str choices: [disable, enable] more...
    • ssl_insert_empty_fragment (Alias name: ssl-insert-empty-fragment) Enable/disable insertion of empty fragment. type: str choices: [disable, enable] more...
    • ssl_max_proto_ver (Alias name: ssl-max-proto-ver) Ssl maximum protocol version. type: str choices: [tls1-0, tls1-1, tls1-2, tls1-3] more...
    • ssl_min_proto_ver (Alias name: ssl-min-proto-ver) Ssl minimum protocol version. type: str choices: [tls1-0, tls1-1, tls1-2, tls1-3] more...
    • tlsv1_0 (Alias name: tlsv1-0) Enable/disable tlsv1. type: str choices: [disable, enable] more...
    • tlsv1_1 (Alias name: tlsv1-1) Enable/disable tlsv1. type: str choices: [disable, enable] more...
    • tlsv1_2 (Alias name: tlsv1-2) Enable/disable tlsv1. type: str choices: [disable, enable] more...
    • tlsv1_3 (Alias name: tlsv1-3) Tlsv1 3. type: str choices: [disable, enable] more...
    • transform_backward_slashes (Alias name: transform-backward-slashes) Transform backward slashes to forward slashes in urls. type: str choices: [disable, enable] more...
    • tunnel_connect_without_reauth (Alias name: tunnel-connect-without-reauth) Enable/disable tunnel connection without re-authorization if previous connection dropped. type: str choices: [disable, enable] more...
    • tunnel_ip_pools (Alias name: tunnel-ip-pools) Names of the ipv4 ip pool firewall objects that define the ip addresses reserved for remote clients. type: list or str more...
    • tunnel_ipv6_pools (Alias name: tunnel-ipv6-pools) Names of the ipv6 ip pool firewall objects that define the ip addresses reserved for remote clients. type: list or str more...
    • tunnel_user_session_timeout (Alias name: tunnel-user-session-timeout) Time out value to clean up user session after tunnel connection is dropped (1 - 255 sec, default=30). type: int more...
    • unsafe_legacy_renegotiation (Alias name: unsafe-legacy-renegotiation) Enable/disable unsafe legacy re-negotiation. type: str choices: [disable, enable] more...
    • url_obscuration (Alias name: url-obscuration) Enable/disable to obscure the host name of the url of the web browser display. type: str choices: [disable, enable] more...
    • user_peer (Alias name: user-peer) Name of user peer. type: str more...
    • wins_server1 (Alias name: wins-server1) Wins server 1. type: str more...
    • wins_server2 (Alias name: wins-server2) Wins server 2. type: str more...
    • x_content_type_options (Alias name: x-content-type-options) Add http x-content-type-options header. type: str choices: [disable, enable] more...
    • sslv3 Sslv3. type: str choices: [disable, enable] more...
    • ssl_big_buffer (Alias name: ssl-big-buffer) Disable using the big sslv3 buffer feature to save memory and force higher security. type: str choices: [disable, enable] more...
    • client_sigalgs (Alias name: client-sigalgs) Set signature algorithms related to client authentication. type: str choices: [no-rsa-pss, all] more...
    • ciphersuite Select one or more tls 1. type: list choices: [TLS-AES-128-GCM-SHA256, TLS-AES-256-GCM-SHA384, TLS-CHACHA20-POLY1305-SHA256, TLS-AES-128-CCM-SHA256, TLS-AES-128-CCM-8-SHA256] more...
    • dual_stack_mode (Alias name: dual-stack-mode) Tunnel mode: enable parallel ipv4 and ipv6 tunnel. type: str choices: [disable, enable] more...
    • tunnel_addr_assigned_method (Alias name: tunnel-addr-assigned-method) Method used for assigning address for tunnel. type: str choices: [first-available, round-robin] more...
    • browser_language_detection (Alias name: browser-language-detection) Enable/disable overriding the configured system language based on the preferred language of the browser. type: str choices: [disable, enable] more...
    • saml_redirect_port (Alias name: saml-redirect-port) Saml local redirect port in the machine running forticlient (0 - 65535). type: int more...
    • status Enable/disable ssl-vpn. type: str choices: [disable, enable] more...
    • web_mode_snat (Alias name: web-mode-snat) Enable/disable use of ip pools defined in firewall policy while using web-mode. type: str choices: [disable, enable] more...
    • ztna_trusted_client (Alias name: ztna-trusted-client) Enable/disable verification of device certificate for sslvpn ztna session. type: str choices: [disable, enable] more...
    • dtls_heartbeat_fail_count (Alias name: dtls-heartbeat-fail-count) Number of missing heartbeats before the connection is considered dropped. type: int more...
    • dtls_heartbeat_idle_timeout (Alias name: dtls-heartbeat-idle-timeout) Idle timeout before dtls heartbeat is sent. type: int more...
    • dtls_heartbeat_interval (Alias name: dtls-heartbeat-interval) Interval between dtls heartbeat. type: int more...
    • server_hostname (Alias name: server-hostname) Server hostname for https. type: str more...

Notes

Note

  • Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.

  • To create or update an object, use state: present directive.

  • To delete an object, use state: absent directive

  • Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded

Examples

- name: Example playbook (generated based on argument schema)
  hosts: fortimanagers
  connection: httpapi
  vars:
    ansible_httpapi_use_ssl: true
    ansible_httpapi_validate_certs: false
    ansible_httpapi_port: 443
  tasks:
    - name: Configure SSL VPN.
      fortinet.fortimanager.fmgr_vpn_ssl_settings:
        # bypass_validation: false
        workspace_locking_adom: <value in [global, custom adom including root]>
        workspace_locking_timeout: 300
        # rc_succeeded: [0, -2, -3, ...]
        # rc_failed: [-2, -3, ...]
        device: <your own value>
        vdom: <your own value>
        vpn_ssl_settings:
          algorithm: <value in [default, high, low, ...]>
          auth_session_check_source_ip: <value in [disable, enable]>
          auth_timeout: <integer>
          authentication_rule:
            -
              auth: <value in [any, local, radius, ...]>
              cipher: <value in [any, high, medium]>
              client_cert: <value in [disable, enable]>
              groups: <list or string>
              id: <integer>
              portal: <string>
              realm: <string>
              source_address: <list or string>
              source_address_negate: <value in [disable, enable]>
              source_address6: <list or string>
              source_address6_negate: <value in [disable, enable]>
              source_interface: <list or string>
              user_peer: <string>
              users: <list or string>
          auto_tunnel_static_route: <value in [disable, enable]>
          banned_cipher:
            - "RSA"
            - "DH"
            - "DHE"
            - "ECDH"
            - "ECDHE"
            - "DSS"
            - "ECDSA"
            - "AES"
            - "AESGCM"
            - "CAMELLIA"
            - "3DES"
            - "SHA1"
            - "SHA256"
            - "SHA384"
            - "STATIC"
            - "CHACHA20"
            - "ARIA"
            - "AESCCM"
          check_referer: <value in [disable, enable]>
          default_portal: <string>
          deflate_compression_level: <integer>
          deflate_min_data_size: <integer>
          dns_server1: <string>
          dns_server2: <string>
          dns_suffix: <string>
          dtls_hello_timeout: <integer>
          dtls_max_proto_ver: <value in [dtls1-0, dtls1-2]>
          dtls_min_proto_ver: <value in [dtls1-0, dtls1-2]>
          dtls_tunnel: <value in [disable, enable]>
          encode_2f_sequence: <value in [disable, enable]>
          encrypt_and_store_password: <value in [disable, enable]>
          force_two_factor_auth: <value in [disable, enable]>
          header_x_forwarded_for: <value in [pass, add, remove]>
          hsts_include_subdomains: <value in [disable, enable]>
          http_compression: <value in [disable, enable]>
          http_only_cookie: <value in [disable, enable]>
          http_request_body_timeout: <integer>
          http_request_header_timeout: <integer>
          https_redirect: <value in [disable, enable]>
          idle_timeout: <integer>
          ipv6_dns_server1: <string>
          ipv6_dns_server2: <string>
          ipv6_wins_server1: <string>
          ipv6_wins_server2: <string>
          login_attempt_limit: <integer>
          login_block_time: <integer>
          login_timeout: <integer>
          port: <integer>
          port_precedence: <value in [disable, enable]>
          reqclientcert: <value in [disable, enable]>
          route_source_interface: <value in [disable, enable]>
          servercert: <string>
          source_address: <list or string>
          source_address_negate: <value in [disable, enable]>
          source_address6: <list or string>
          source_address6_negate: <value in [disable, enable]>
          source_interface: <list or string>
          ssl_client_renegotiation: <value in [disable, enable]>
          ssl_insert_empty_fragment: <value in [disable, enable]>
          ssl_max_proto_ver: <value in [tls1-0, tls1-1, tls1-2, ...]>
          ssl_min_proto_ver: <value in [tls1-0, tls1-1, tls1-2, ...]>
          tlsv1_0: <value in [disable, enable]>
          tlsv1_1: <value in [disable, enable]>
          tlsv1_2: <value in [disable, enable]>
          tlsv1_3: <value in [disable, enable]>
          transform_backward_slashes: <value in [disable, enable]>
          tunnel_connect_without_reauth: <value in [disable, enable]>
          tunnel_ip_pools: <list or string>
          tunnel_ipv6_pools: <list or string>
          tunnel_user_session_timeout: <integer>
          unsafe_legacy_renegotiation: <value in [disable, enable]>
          url_obscuration: <value in [disable, enable]>
          user_peer: <string>
          wins_server1: <string>
          wins_server2: <string>
          x_content_type_options: <value in [disable, enable]>
          sslv3: <value in [disable, enable]>
          ssl_big_buffer: <value in [disable, enable]>
          client_sigalgs: <value in [no-rsa-pss, all]>
          ciphersuite:
            - "TLS-AES-128-GCM-SHA256"
            - "TLS-AES-256-GCM-SHA384"
            - "TLS-CHACHA20-POLY1305-SHA256"
            - "TLS-AES-128-CCM-SHA256"
            - "TLS-AES-128-CCM-8-SHA256"
          dual_stack_mode: <value in [disable, enable]>
          tunnel_addr_assigned_method: <value in [first-available, round-robin]>
          browser_language_detection: <value in [disable, enable]>
          saml_redirect_port: <integer>
          status: <value in [disable, enable]>
          web_mode_snat: <value in [disable, enable]>
          ztna_trusted_client: <value in [disable, enable]>
          dtls_heartbeat_fail_count: <integer>
          dtls_heartbeat_idle_timeout: <integer>
          dtls_heartbeat_interval: <integer>
          server_hostname: <string>

Return Values

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

  • meta - The result of the request.returned: always type: dict
    • request_url - The full url requested. returned: always type: str sample: /sys/login/user
    • response_code - The status of api request. returned: always type: int sample: 0
    • response_data - The data body of the api response. returned: optional type: list or dict
    • response_message - The descriptive message of the api response. returned: always type: str sample: OK
    • system_information - The information of the target system. returned: always type: dict
  • rc - The status the request. returned: always type: int sample: 0
  • version_check_warning - Warning if the parameters used in the playbook are not supported by the current FortiManager version. returned: if at least one parameter not supported by the current FortiManager version type: list

Status

  • This module is not guaranteed to have a backwards compatible interface.

Authors

  • Xinwei Du (@dux-fortinet)

  • Xing Li (@lix-fortinet)

  • Jie Xue (@JieX19)

  • Link Zheng (@chillancezen)

  • Frank Shen (@fshen01)

  • Hongbin Lu (@fgtdev-hblu)