fmgr_firewall_vip – Configure virtual IP for IPv4.¶

New in version 2.10.

Synopsis
Requirements
Parameters
Notes
Examples
Return Values
Status
Authors

Synopsis ¶

This module is able to configure a FortiManager device by allowing the user to [add, get, set, update] the following FortiManager json-rpc urls.
/pm/config/adom/{adom}/obj/firewall/vip
/pm/config/global/obj/firewall/vip
Examples include all parameters and values need to be adjusted to data sources before usage.
Tested with FortiManager v6.0.0

Requirements ¶

The below requirements are needed on the host that executes this module.

ansible>=2.10.0

Parameters ¶

loose_validation - Do parameter validation in a loose way type: bool required: false default: false
workspace_locking_adom - Acquire the workspace lock if FortiManager is running in workspace mode type: str required: false choices: global, custom dom
workspace_locking_timeout - The maximum time in seconds to wait for other users to release workspace lock type: integer required: false default: 300
url_params - parameters in url path type: dict required: true

adom - the domain prefix type: str choices: none, global, custom dom

parameters for method: [add, set, update] - Configure virtual IP for IPv4.

data - No description for the parameter type: array
- arp-reply - Enable to respond to ARP requests for this virtual IP address. type: str choices: [disable, enable]
- color - Color of icon on the GUI. type: int
- comment - Comment. type: str
- dns-mapping-ttl - DNS mapping TTL (Set to zero to use TTL in DNS response, default = 0). type: int
- dynamic_mapping - No description for the parameter type: array
  - _scope - No description for the parameter type: array
    - name - No description for the parameter type: str
    - vdom - No description for the parameter type: str
  - arp-reply - No description for the parameter type: str choices: [disable, enable]
  - color - No description for the parameter type: int
  - comment - No description for the parameter type: str
  - dns-mapping-ttl - No description for the parameter type: int
  - extaddr - No description for the parameter type: str
  - extintf - No description for the parameter type: str
  - extip - No description for the parameter type: str
  - extport - No description for the parameter type: str
  - gratuitous-arp-interval - No description for the parameter type: int
  - http-cookie-age - No description for the parameter type: int
  - http-cookie-domain - No description for the parameter type: str
  - http-cookie-domain-from-host - No description for the parameter type: str choices: [disable, enable]
  - http-cookie-generation - No description for the parameter type: int
  - http-cookie-path - No description for the parameter type: str
  - http-cookie-share - No description for the parameter type: str choices: [disable, same-ip]
  - http-ip-header - No description for the parameter type: str choices: [disable, enable]
  - http-ip-header-name - No description for the parameter type: str
  - http-multiplex - No description for the parameter type: str choices: [disable, enable]
  - https-cookie-secure - No description for the parameter type: str choices: [disable, enable]
  - id - No description for the parameter type: int
  - ldb-method - No description for the parameter type: str choices: [static, round-robin, weighted, least-session, least-rtt, first-alive, http-host]
  - mapped-addr - No description for the parameter type: str
  - mappedip - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - mappedport - No description for the parameter type: str
  - max-embryonic-connections - No description for the parameter type: int
  - monitor - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - nat-source-vip - No description for the parameter type: str choices: [disable, enable]
  - outlook-web-access - No description for the parameter type: str choices: [disable, enable]
  - persistence - No description for the parameter type: str choices: [none, http-cookie, ssl-session-id]
  - portforward - No description for the parameter type: str choices: [disable, enable]
  - portmapping-type - No description for the parameter type: str choices: [1-to-1, m-to-n]
  - protocol - No description for the parameter type: str choices: [tcp, udp, sctp, icmp]
  - realservers - No description for the parameter type: array
    - client-ip - No description for the parameter type: array
      - {no-name} - No description for the parameter type: str
    - healthcheck - No description for the parameter type: str choices: [disable, enable, vip]
    - holddown-interval - No description for the parameter type: int
    - http-host - No description for the parameter type: str
    - ip - No description for the parameter type: str
    - max-connections - No description for the parameter type: int
    - monitor - No description for the parameter type: str
    - port - No description for the parameter type: int
    - seq - No description for the parameter type: int
    - status - No description for the parameter type: str choices: [active, standby, disable]
    - weight - No description for the parameter type: int
  - server-type - No description for the parameter type: str choices: [http, https, ssl, tcp, udp, ip, imaps, pop3s, smtps]
  - service - No description for the parameter type: str
  - src-filter - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - srcintf-filter - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - ssl-algorithm - No description for the parameter type: str choices: [high, medium, low, custom]
  - ssl-certificate - No description for the parameter type: str
  - ssl-cipher-suites - No description for the parameter type: array
    - cipher - No description for the parameter type: str choices: [TLS-RSA-WITH-RC4-128-MD5, TLS-RSA-WITH-RC4-128-SHA, TLS-RSA-WITH-DES-CBC-SHA, TLS-RSA-WITH-3DES-EDE-CBC-SHA, TLS-RSA-WITH-AES-128-CBC-SHA, TLS-RSA-WITH-AES-256-CBC-SHA, TLS-RSA-WITH-AES-128-CBC-SHA256, TLS-RSA-WITH-AES-256-CBC-SHA256, TLS-RSA-WITH-CAMELLIA-128-CBC-SHA, TLS-RSA-WITH-CAMELLIA-256-CBC-SHA, TLS-RSA-WITH-CAMELLIA-128-CBC-SHA256, TLS-RSA-WITH-CAMELLIA-256-CBC-SHA256, TLS-RSA-WITH-SEED-CBC-SHA, TLS-RSA-WITH-ARIA-128-CBC-SHA256, TLS-RSA-WITH-ARIA-256-CBC-SHA384, TLS-DHE-RSA-WITH-DES-CBC-SHA, TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA, TLS-DHE-RSA-WITH-AES-128-CBC-SHA, TLS-DHE-RSA-WITH-AES-256-CBC-SHA, TLS-DHE-RSA-WITH-AES-128-CBC-SHA256, TLS-DHE-RSA-WITH-AES-256-CBC-SHA256, TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA, TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA, TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA256, TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA256, TLS-DHE-RSA-WITH-SEED-CBC-SHA, TLS-DHE-RSA-WITH-ARIA-128-CBC-SHA256, TLS-DHE-RSA-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-RC4-128-SHA, TLS-ECDHE-RSA-WITH-3DES-EDE-CBC-SHA, TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA, TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA, TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256, TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256, TLS-DHE-RSA-WITH-CHACHA20-POLY1305-SHA256, TLS-DHE-RSA-WITH-AES-128-GCM-SHA256, TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, TLS-DHE-DSS-WITH-AES-128-CBC-SHA, TLS-DHE-DSS-WITH-AES-256-CBC-SHA, TLS-DHE-DSS-WITH-AES-128-CBC-SHA256, TLS-DHE-DSS-WITH-AES-128-GCM-SHA256, TLS-DHE-DSS-WITH-AES-256-CBC-SHA256, TLS-DHE-DSS-WITH-AES-256-GCM-SHA384, TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256, TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256, TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384, TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA, TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256, TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256, TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384, TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384, TLS-RSA-WITH-AES-128-GCM-SHA256, TLS-RSA-WITH-AES-256-GCM-SHA384, TLS-DHE-DSS-WITH-CAMELLIA-128-CBC-SHA, TLS-DHE-DSS-WITH-CAMELLIA-256-CBC-SHA, TLS-DHE-DSS-WITH-CAMELLIA-128-CBC-SHA256, TLS-DHE-DSS-WITH-CAMELLIA-256-CBC-SHA256, TLS-DHE-DSS-WITH-SEED-CBC-SHA, TLS-DHE-DSS-WITH-ARIA-128-CBC-SHA256, TLS-DHE-DSS-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-ARIA-128-CBC-SHA256, TLS-ECDHE-RSA-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-ECDSA-WITH-ARIA-128-CBC-SHA256, TLS-ECDHE-ECDSA-WITH-ARIA-256-CBC-SHA384, TLS-DHE-DSS-WITH-3DES-EDE-CBC-SHA, TLS-DHE-DSS-WITH-DES-CBC-SHA]
    - id - No description for the parameter type: int
    - versions - No description for the parameter type: array
      - {no-name} - No description for the parameter type: str choices: [ssl-3.0, tls-1.0, tls-1.1, tls-1.2]
  - ssl-client-fallback - No description for the parameter type: str choices: [disable, enable]
  - ssl-client-renegotiation - No description for the parameter type: str choices: [deny, allow, secure]
  - ssl-client-session-state-max - No description for the parameter type: int
  - ssl-client-session-state-timeout - No description for the parameter type: int
  - ssl-client-session-state-type - No description for the parameter type: str choices: [disable, time, count, both]
  - ssl-dh-bits - No description for the parameter type: str choices: [768, 1024, 1536, 2048, 3072, 4096]
  - ssl-hpkp - No description for the parameter type: str choices: [disable, enable, report-only]
  - ssl-hpkp-age - No description for the parameter type: int
  - ssl-hpkp-backup - No description for the parameter type: str
  - ssl-hpkp-include-subdomains - No description for the parameter type: str choices: [disable, enable]
  - ssl-hpkp-primary - No description for the parameter type: str
  - ssl-hpkp-report-uri - No description for the parameter type: str
  - ssl-hsts - No description for the parameter type: str choices: [disable, enable]
  - ssl-hsts-age - No description for the parameter type: int
  - ssl-hsts-include-subdomains - No description for the parameter type: str choices: [disable, enable]
  - ssl-http-location-conversion - No description for the parameter type: str choices: [disable, enable]
  - ssl-http-match-host - No description for the parameter type: str choices: [disable, enable]
  - ssl-max-version - No description for the parameter type: str choices: [ssl-3.0, tls-1.0, tls-1.1, tls-1.2]
  - ssl-min-version - No description for the parameter type: str choices: [ssl-3.0, tls-1.0, tls-1.1, tls-1.2]
  - ssl-mode - No description for the parameter type: str choices: [half, full]
  - ssl-pfs - No description for the parameter type: str choices: [require, deny, allow]
  - ssl-send-empty-frags - No description for the parameter type: str choices: [disable, enable]
  - ssl-server-algorithm - No description for the parameter type: str choices: [high, low, medium, custom, client]
  - ssl-server-max-version - No description for the parameter type: str choices: [ssl-3.0, tls-1.0, tls-1.1, tls-1.2, client]
  - ssl-server-min-version - No description for the parameter type: str choices: [ssl-3.0, tls-1.0, tls-1.1, tls-1.2, client]
  - ssl-server-session-state-max - No description for the parameter type: int
  - ssl-server-session-state-timeout - No description for the parameter type: int
  - ssl-server-session-state-type - No description for the parameter type: str choices: [disable, time, count, both]
  - type - No description for the parameter type: str choices: [static-nat, load-balance, server-load-balance, dns-translation, fqdn]
  - uuid - No description for the parameter type: str
  - weblogic-server - No description for the parameter type: str choices: [disable, enable]
  - websphere-server - No description for the parameter type: str choices: [disable, enable]
- extaddr - External FQDN address name. type: str
- extintf - Interface connected to the source network that receives the packets that will be forwarded to the destination network. type: str
- extip - IP address or address range on the external interface that you want to map to an address or address range on the destination network. type: str
- extport - Incoming port number range that you want to map to a port number range on the destination network. type: str
- gratuitous-arp-interval - Enable to have the VIP send gratuitous ARPs. type: int
- http-cookie-age - Time in minutes that client web browsers should keep a cookie. type: int
- http-cookie-domain - Domain that HTTP cookie persistence should apply to. type: str
- http-cookie-domain-from-host - Enable/disable use of HTTP cookie domain from host field in HTTP. type: str choices: [disable, enable]
- http-cookie-generation - Generation of HTTP cookie to be accepted. type: int
- http-cookie-path - Limit HTTP cookie persistence to the specified path. type: str
- http-cookie-share - Control sharing of cookies across virtual servers. type: str choices: [disable, same-ip]
- http-ip-header - For HTTP multiplexing, enable to add the original client IP address in the XForwarded-For HTTP header. type: str choices: [disable, enable]
- http-ip-header-name - For HTTP multiplexing, enter a custom HTTPS header name. type: str
- http-multiplex - Enable/disable HTTP multiplexing. type: str choices: [disable, enable]
- https-cookie-secure - Enable/disable verification that inserted HTTPS cookies are secure. type: str choices: [disable, enable]
- id - Custom defined ID. type: int
- ldb-method - Method used to distribute sessions to real servers. type: str choices: [static, round-robin, weighted, least-session, least-rtt, first-alive, http-host]
- mapped-addr - Mapped FQDN address name. type: str
- mappedip - No description for the parameter type: array
  - {no-name} - No description for the parameter type: str
- mappedport - Port number range on the destination network to which the external port number range is mapped. type: str
- max-embryonic-connections - Maximum number of incomplete connections. type: int
- monitor - Name of the health check monitor to use when polling to determine a virtual servers connectivity status. type: str
- name - Virtual IP name. type: str
- nat-source-vip - Enable/disable forcing the source NAT mapped IP to the external IP for all traffic. type: str choices: [disable, enable]
- outlook-web-access - Enable to add the Front-End-Https header for Microsoft Outlook Web Access. type: str choices: [disable, enable]
- persistence - Configure how to make sure that clients connect to the same server every time they make a request that is part of the same session. type: str choices: [none, http-cookie, ssl-session-id]
- portforward - Enable/disable port forwarding. type: str choices: [disable, enable]
- portmapping-type - Port mapping type. type: str choices: [1-to-1, m-to-n]
- protocol - Protocol to use when forwarding packets. type: str choices: [tcp, udp, sctp, icmp]
- realservers - No description for the parameter type: array
  - client-ip - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - healthcheck - Enable to check the responsiveness of the real server before forwarding traffic. type: str choices: [disable, enable, vip]
  - holddown-interval - Time in seconds that the health check monitor continues to monitor and unresponsive server that should be active. type: int
  - http-host - HTTP server domain name in HTTP header. type: str
  - ip - IP address of the real server. type: str
  - max-connections - Max number of active connections that can be directed to the real server. type: int
  - monitor - Name of the health check monitor to use when polling to determine a virtual servers connectivity status. type: str
  - port - Port for communicating with the real server. type: int
  - seq - No description for the parameter type: int
  - status - Set the status of the real server to active so that it can accept traffic, or on standby or disabled so no traffic is sent. type: str choices: [active, standby, disable]
  - weight - Weight of the real server. type: int
- server-type - Protocol to be load balanced by the virtual server (also called the server load balance virtual IP). type: str choices: [http, https, ssl, tcp, udp, ip, imaps, pop3s, smtps]
- service - Service name. type: str
- src-filter - No description for the parameter type: array
  - {no-name} - No description for the parameter type: str
- srcintf-filter - Interfaces to which the VIP applies. type: str
- ssl-algorithm - Permitted encryption algorithms for SSL sessions according to encryption strength. type: str choices: [high, medium, low, custom]
- ssl-certificate - The name of the SSL certificate to use for SSL acceleration. type: str
- ssl-cipher-suites - No description for the parameter type: array
  - cipher - Cipher suite name. type: str choices: [TLS-RSA-WITH-RC4-128-MD5, TLS-RSA-WITH-RC4-128-SHA, TLS-RSA-WITH-DES-CBC-SHA, TLS-RSA-WITH-3DES-EDE-CBC-SHA, TLS-RSA-WITH-AES-128-CBC-SHA, TLS-RSA-WITH-AES-256-CBC-SHA, TLS-RSA-WITH-AES-128-CBC-SHA256, TLS-RSA-WITH-AES-256-CBC-SHA256, TLS-RSA-WITH-CAMELLIA-128-CBC-SHA, TLS-RSA-WITH-CAMELLIA-256-CBC-SHA, TLS-RSA-WITH-CAMELLIA-128-CBC-SHA256, TLS-RSA-WITH-CAMELLIA-256-CBC-SHA256, TLS-RSA-WITH-SEED-CBC-SHA, TLS-RSA-WITH-ARIA-128-CBC-SHA256, TLS-RSA-WITH-ARIA-256-CBC-SHA384, TLS-DHE-RSA-WITH-DES-CBC-SHA, TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA, TLS-DHE-RSA-WITH-AES-128-CBC-SHA, TLS-DHE-RSA-WITH-AES-256-CBC-SHA, TLS-DHE-RSA-WITH-AES-128-CBC-SHA256, TLS-DHE-RSA-WITH-AES-256-CBC-SHA256, TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA, TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA, TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA256, TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA256, TLS-DHE-RSA-WITH-SEED-CBC-SHA, TLS-DHE-RSA-WITH-ARIA-128-CBC-SHA256, TLS-DHE-RSA-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-RC4-128-SHA, TLS-ECDHE-RSA-WITH-3DES-EDE-CBC-SHA, TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA, TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA, TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256, TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256, TLS-DHE-RSA-WITH-CHACHA20-POLY1305-SHA256, TLS-DHE-RSA-WITH-AES-128-GCM-SHA256, TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, TLS-DHE-DSS-WITH-AES-128-CBC-SHA, TLS-DHE-DSS-WITH-AES-256-CBC-SHA, TLS-DHE-DSS-WITH-AES-128-CBC-SHA256, TLS-DHE-DSS-WITH-AES-128-GCM-SHA256, TLS-DHE-DSS-WITH-AES-256-CBC-SHA256, TLS-DHE-DSS-WITH-AES-256-GCM-SHA384, TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256, TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256, TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384, TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA, TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256, TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256, TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384, TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384, TLS-RSA-WITH-AES-128-GCM-SHA256, TLS-RSA-WITH-AES-256-GCM-SHA384, TLS-DHE-DSS-WITH-CAMELLIA-128-CBC-SHA, TLS-DHE-DSS-WITH-CAMELLIA-256-CBC-SHA, TLS-DHE-DSS-WITH-CAMELLIA-128-CBC-SHA256, TLS-DHE-DSS-WITH-CAMELLIA-256-CBC-SHA256, TLS-DHE-DSS-WITH-SEED-CBC-SHA, TLS-DHE-DSS-WITH-ARIA-128-CBC-SHA256, TLS-DHE-DSS-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-ARIA-128-CBC-SHA256, TLS-ECDHE-RSA-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-ECDSA-WITH-ARIA-128-CBC-SHA256, TLS-ECDHE-ECDSA-WITH-ARIA-256-CBC-SHA384, TLS-DHE-DSS-WITH-3DES-EDE-CBC-SHA, TLS-DHE-DSS-WITH-DES-CBC-SHA]
  - id - No description for the parameter type: int
  - versions - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str choices: [ssl-3.0, tls-1.0, tls-1.1, tls-1.2]
- ssl-client-fallback - Enable/disable support for preventing Downgrade Attacks on client connections (RFC 7507). type: str choices: [disable, enable]
- ssl-client-renegotiation - Allow, deny, or require secure renegotiation of client sessions to comply with RFC 5746. type: str choices: [deny, allow, secure]
- ssl-client-session-state-max - Maximum number of client to FortiGate SSL session states to keep. type: int
- ssl-client-session-state-timeout - Number of minutes to keep client to FortiGate SSL session state. type: int
- ssl-client-session-state-type - How to expire SSL sessions for the segment of the SSL connection between the client and the FortiGate. type: str choices: [disable, time, count, both]
- ssl-dh-bits - Number of bits to use in the Diffie-Hellman exchange for RSA encryption of SSL sessions. type: str choices: [768, 1024, 1536, 2048, 3072, 4096]
- ssl-hpkp - Enable/disable including HPKP header in response. type: str choices: [disable, enable, report-only]
- ssl-hpkp-age - Number of seconds the client should honour the HPKP setting. type: int
- ssl-hpkp-backup - Certificate to generate backup HPKP pin from. type: str
- ssl-hpkp-include-subdomains - Indicate that HPKP header applies to all subdomains. type: str choices: [disable, enable]
- ssl-hpkp-primary - Certificate to generate primary HPKP pin from. type: str
- ssl-hpkp-report-uri - URL to report HPKP violations to. type: str
- ssl-hsts - Enable/disable including HSTS header in response. type: str choices: [disable, enable]
- ssl-hsts-age - Number of seconds the client should honour the HSTS setting. type: int
- ssl-hsts-include-subdomains - Indicate that HSTS header applies to all subdomains. type: str choices: [disable, enable]
- ssl-http-location-conversion - Enable to replace HTTP with HTTPS in the replys Location HTTP header field. type: str choices: [disable, enable]
- ssl-http-match-host - Enable/disable HTTP host matching for location conversion. type: str choices: [disable, enable]
- ssl-max-version - Highest SSL/TLS version acceptable from a client. type: str choices: [ssl-3.0, tls-1.0, tls-1.1, tls-1.2]
- ssl-min-version - Lowest SSL/TLS version acceptable from a client. type: str choices: [ssl-3.0, tls-1.0, tls-1.1, tls-1.2]
- ssl-mode - Apply SSL offloading between the client and the FortiGate (half) or from the client to the FortiGate and from the FortiGate to the server (full). type: str choices: [half, full]
- ssl-pfs - Select the cipher suites that can be used for SSL perfect forward secrecy (PFS). type: str choices: [require, deny, allow]
- ssl-send-empty-frags - Enable/disable sending empty fragments to avoid CBC IV attacks (SSL 3. type: str choices: [disable, enable]
- ssl-server-algorithm - Permitted encryption algorithms for the server side of SSL full mode sessions according to encryption strength. type: str choices: [high, low, medium, custom, client]
- ssl-server-cipher-suites - No description for the parameter type: array
  - cipher - Cipher suite name. type: str choices: [TLS-RSA-WITH-RC4-128-MD5, TLS-RSA-WITH-RC4-128-SHA, TLS-RSA-WITH-DES-CBC-SHA, TLS-RSA-WITH-3DES-EDE-CBC-SHA, TLS-RSA-WITH-AES-128-CBC-SHA, TLS-RSA-WITH-AES-256-CBC-SHA, TLS-RSA-WITH-AES-128-CBC-SHA256, TLS-RSA-WITH-AES-256-CBC-SHA256, TLS-RSA-WITH-CAMELLIA-128-CBC-SHA, TLS-RSA-WITH-CAMELLIA-256-CBC-SHA, TLS-RSA-WITH-CAMELLIA-128-CBC-SHA256, TLS-RSA-WITH-CAMELLIA-256-CBC-SHA256, TLS-RSA-WITH-SEED-CBC-SHA, TLS-RSA-WITH-ARIA-128-CBC-SHA256, TLS-RSA-WITH-ARIA-256-CBC-SHA384, TLS-DHE-RSA-WITH-DES-CBC-SHA, TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA, TLS-DHE-RSA-WITH-AES-128-CBC-SHA, TLS-DHE-RSA-WITH-AES-256-CBC-SHA, TLS-DHE-RSA-WITH-AES-128-CBC-SHA256, TLS-DHE-RSA-WITH-AES-256-CBC-SHA256, TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA, TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA, TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA256, TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA256, TLS-DHE-RSA-WITH-SEED-CBC-SHA, TLS-DHE-RSA-WITH-ARIA-128-CBC-SHA256, TLS-DHE-RSA-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-RC4-128-SHA, TLS-ECDHE-RSA-WITH-3DES-EDE-CBC-SHA, TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA, TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA, TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256, TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256, TLS-DHE-RSA-WITH-CHACHA20-POLY1305-SHA256, TLS-DHE-RSA-WITH-AES-128-GCM-SHA256, TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, TLS-DHE-DSS-WITH-AES-128-CBC-SHA, TLS-DHE-DSS-WITH-AES-256-CBC-SHA, TLS-DHE-DSS-WITH-AES-128-CBC-SHA256, TLS-DHE-DSS-WITH-AES-128-GCM-SHA256, TLS-DHE-DSS-WITH-AES-256-CBC-SHA256, TLS-DHE-DSS-WITH-AES-256-GCM-SHA384, TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256, TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256, TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384, TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA, TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256, TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256, TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384, TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384, TLS-RSA-WITH-AES-128-GCM-SHA256, TLS-RSA-WITH-AES-256-GCM-SHA384, TLS-DHE-DSS-WITH-CAMELLIA-128-CBC-SHA, TLS-DHE-DSS-WITH-CAMELLIA-256-CBC-SHA, TLS-DHE-DSS-WITH-CAMELLIA-128-CBC-SHA256, TLS-DHE-DSS-WITH-CAMELLIA-256-CBC-SHA256, TLS-DHE-DSS-WITH-SEED-CBC-SHA, TLS-DHE-DSS-WITH-ARIA-128-CBC-SHA256, TLS-DHE-DSS-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-RSA-WITH-ARIA-128-CBC-SHA256, TLS-ECDHE-RSA-WITH-ARIA-256-CBC-SHA384, TLS-ECDHE-ECDSA-WITH-ARIA-128-CBC-SHA256, TLS-ECDHE-ECDSA-WITH-ARIA-256-CBC-SHA384, TLS-DHE-DSS-WITH-3DES-EDE-CBC-SHA, TLS-DHE-DSS-WITH-DES-CBC-SHA]
  - priority - SSL/TLS cipher suites priority. type: int
  - versions - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str choices: [ssl-3.0, tls-1.0, tls-1.1, tls-1.2]
- ssl-server-max-version - Highest SSL/TLS version acceptable from a server. type: str choices: [ssl-3.0, tls-1.0, tls-1.1, tls-1.2, client]
- ssl-server-min-version - Lowest SSL/TLS version acceptable from a server. type: str choices: [ssl-3.0, tls-1.0, tls-1.1, tls-1.2, client]
- ssl-server-session-state-max - Maximum number of FortiGate to Server SSL session states to keep. type: int
- ssl-server-session-state-timeout - Number of minutes to keep FortiGate to Server SSL session state. type: int
- ssl-server-session-state-type - How to expire SSL sessions for the segment of the SSL connection between the server and the FortiGate. type: str choices: [disable, time, count, both]
- type - Configure a static NAT, load balance, DNS translation, or FQDN VIP. type: str choices: [static-nat, load-balance, server-load-balance, dns-translation, fqdn]
- uuid - Universally Unique Identifier (UUID; automatically assigned but can be manually reset). type: str
- weblogic-server - Enable to add an HTTP header to indicate SSL offloading for a WebLogic server. type: str choices: [disable, enable]
- websphere-server - Enable to add an HTTP header to indicate SSL offloading for a WebSphere server. type: str choices: [disable, enable]

parameters for method: [get] - Configure virtual IP for IPv4.

attr - The name of the attribute to retrieve its datasource. type: str
fields - No description for the parameter type: array
- {no-name} - No description for the parameter type: array
  - {no-name} - No description for the parameter type: str choices: [arp-reply, color, comment, dns-mapping-ttl, extaddr, extintf, extip, extport, gratuitous-arp-interval, http-cookie-age, http-cookie-domain, http-cookie-domain-from-host, http-cookie-generation, http-cookie-path, http-cookie-share, http-ip-header, http-ip-header-name, http-multiplex, https-cookie-secure, id, ldb-method, mapped-addr, mappedip, mappedport, max-embryonic-connections, monitor, name, nat-source-vip, outlook-web-access, persistence, portforward, portmapping-type, protocol, server-type, service, src-filter, srcintf-filter, ssl-algorithm, ssl-certificate, ssl-client-fallback, ssl-client-renegotiation, ssl-client-session-state-max, ssl-client-session-state-timeout, ssl-client-session-state-type, ssl-dh-bits, ssl-hpkp, ssl-hpkp-age, ssl-hpkp-backup, ssl-hpkp-include-subdomains, ssl-hpkp-primary, ssl-hpkp-report-uri, ssl-hsts, ssl-hsts-age, ssl-hsts-include-subdomains, ssl-http-location-conversion, ssl-http-match-host, ssl-max-version, ssl-min-version, ssl-mode, ssl-pfs, ssl-send-empty-frags, ssl-server-algorithm, ssl-server-max-version, ssl-server-min-version, ssl-server-session-state-max, ssl-server-session-state-timeout, ssl-server-session-state-type, type, uuid, weblogic-server, websphere-server]
filter - No description for the parameter type: array
- {no-name} - No description for the parameter type: str
get used - No description for the parameter type: int
loadsub - Enable or disable the return of any sub-objects. type: int
option - Set fetch option for the request. type: str choices: [count, object member, datasrc, get reserved, syntax]
range - No description for the parameter type: array
- {no-name} - No description for the parameter type: int
sortings - No description for the parameter type: array
- {attr_name} - No description for the parameter type: int choices: [1, -1]

Notes ¶

Note

The module may supports multiple method, every method has different parameters definition
One method may also have more than one parameter definition collection, each collection is dedicated to one API endpoint
The module may include domain dependent urls, the domain can be specified in url_params as adom
To run in workspace mode, the paremeter workspace_locking_adom must be included in the task

Examples ¶

- hosts: fortimanager-inventory
  collections:
    - fortinet.fortimanager
  connection: httpapi
  vars:
     ansible_httpapi_use_ssl: True
     ansible_httpapi_validate_certs: False
     ansible_httpapi_port: 443
  tasks:

   - name: REQUESTING /PM/CONFIG/OBJ/FIREWALL/VIP
     fmgr_firewall_vip:
        loose_validation: False
        workspace_locking_adom: <value in [global, custom adom]>
        workspace_locking_timeout: 300
        method: <value in [add, set, update]>
        url_params:
           adom: <value in [none, global, custom dom]>
        params:
           -
              data:
                -
                    arp-reply: <value in [disable, enable]>
                    color: <value of integer>
                    comment: <value of string>
                    dns-mapping-ttl: <value of integer>
                    dynamic_mapping:
                      -
                          _scope:
                            -
                                name: <value of string>
                                vdom: <value of string>
                          arp-reply: <value in [disable, enable]>
                          color: <value of integer>
                          comment: <value of string>
                          dns-mapping-ttl: <value of integer>
                          extaddr: <value of string>
                          extintf: <value of string>
                          extip: <value of string>
                          extport: <value of string>
                          gratuitous-arp-interval: <value of integer>
                          http-cookie-age: <value of integer>
                          http-cookie-domain: <value of string>
                          http-cookie-domain-from-host: <value in [disable, enable]>
                          http-cookie-generation: <value of integer>
                          http-cookie-path: <value of string>
                          http-cookie-share: <value in [disable, same-ip]>
                          http-ip-header: <value in [disable, enable]>
                          http-ip-header-name: <value of string>
                          http-multiplex: <value in [disable, enable]>
                          https-cookie-secure: <value in [disable, enable]>
                          id: <value of integer>
                          ldb-method: <value in [static, round-robin, weighted, ...]>
                          mapped-addr: <value of string>
                          mappedip:
                            - <value of string>
                          mappedport: <value of string>
                          max-embryonic-connections: <value of integer>
                          monitor:
                            - <value of string>
                          nat-source-vip: <value in [disable, enable]>
                          outlook-web-access: <value in [disable, enable]>
                          persistence: <value in [none, http-cookie, ssl-session-id]>
                          portforward: <value in [disable, enable]>
                          portmapping-type: <value in [1-to-1, m-to-n]>
                          protocol: <value in [tcp, udp, sctp, ...]>
                          realservers:
                            -
                                client-ip:
                                  - <value of string>
                                healthcheck: <value in [disable, enable, vip]>
                                holddown-interval: <value of integer>
                                http-host: <value of string>
                                ip: <value of string>
                                max-connections: <value of integer>
                                monitor: <value of string>
                                port: <value of integer>
                                seq: <value of integer>
                                status: <value in [active, standby, disable]>
                                weight: <value of integer>
                          server-type: <value in [http, https, ssl, ...]>
                          service: <value of string>
                          src-filter:
                            - <value of string>
                          srcintf-filter:
                            - <value of string>
                          ssl-algorithm: <value in [high, medium, low, ...]>
                          ssl-certificate: <value of string>
                          ssl-cipher-suites:
                            -
                                cipher: <value in [TLS-RSA-WITH-RC4-128-MD5, TLS-RSA-WITH-RC4-128-SHA, TLS-RSA-WITH-DES-CBC-SHA, ...]>
                                id: <value of integer>
                                versions:
                                  - <value in [ssl-3.0, tls-1.0, tls-1.1, ...]>
                          ssl-client-fallback: <value in [disable, enable]>
                          ssl-client-renegotiation: <value in [deny, allow, secure]>
                          ssl-client-session-state-max: <value of integer>
                          ssl-client-session-state-timeout: <value of integer>
                          ssl-client-session-state-type: <value in [disable, time, count, ...]>
                          ssl-dh-bits: <value in [768, 1024, 1536, ...]>
                          ssl-hpkp: <value in [disable, enable, report-only]>
                          ssl-hpkp-age: <value of integer>
                          ssl-hpkp-backup: <value of string>
                          ssl-hpkp-include-subdomains: <value in [disable, enable]>
                          ssl-hpkp-primary: <value of string>
                          ssl-hpkp-report-uri: <value of string>
                          ssl-hsts: <value in [disable, enable]>
                          ssl-hsts-age: <value of integer>
                          ssl-hsts-include-subdomains: <value in [disable, enable]>
                          ssl-http-location-conversion: <value in [disable, enable]>
                          ssl-http-match-host: <value in [disable, enable]>
                          ssl-max-version: <value in [ssl-3.0, tls-1.0, tls-1.1, ...]>
                          ssl-min-version: <value in [ssl-3.0, tls-1.0, tls-1.1, ...]>
                          ssl-mode: <value in [half, full]>
                          ssl-pfs: <value in [require, deny, allow]>
                          ssl-send-empty-frags: <value in [disable, enable]>
                          ssl-server-algorithm: <value in [high, low, medium, ...]>
                          ssl-server-max-version: <value in [ssl-3.0, tls-1.0, tls-1.1, ...]>
                          ssl-server-min-version: <value in [ssl-3.0, tls-1.0, tls-1.1, ...]>
                          ssl-server-session-state-max: <value of integer>
                          ssl-server-session-state-timeout: <value of integer>
                          ssl-server-session-state-type: <value in [disable, time, count, ...]>
                          type: <value in [static-nat, load-balance, server-load-balance, ...]>
                          uuid: <value of string>
                          weblogic-server: <value in [disable, enable]>
                          websphere-server: <value in [disable, enable]>
                    extaddr: <value of string>
                    extintf: <value of string>
                    extip: <value of string>
                    extport: <value of string>
                    gratuitous-arp-interval: <value of integer>
                    http-cookie-age: <value of integer>
                    http-cookie-domain: <value of string>
                    http-cookie-domain-from-host: <value in [disable, enable]>
                    http-cookie-generation: <value of integer>
                    http-cookie-path: <value of string>
                    http-cookie-share: <value in [disable, same-ip]>
                    http-ip-header: <value in [disable, enable]>
                    http-ip-header-name: <value of string>
                    http-multiplex: <value in [disable, enable]>
                    https-cookie-secure: <value in [disable, enable]>
                    id: <value of integer>
                    ldb-method: <value in [static, round-robin, weighted, ...]>
                    mapped-addr: <value of string>
                    mappedip:
                      - <value of string>
                    mappedport: <value of string>
                    max-embryonic-connections: <value of integer>
                    monitor: <value of string>
                    name: <value of string>
                    nat-source-vip: <value in [disable, enable]>
                    outlook-web-access: <value in [disable, enable]>
                    persistence: <value in [none, http-cookie, ssl-session-id]>
                    portforward: <value in [disable, enable]>
                    portmapping-type: <value in [1-to-1, m-to-n]>
                    protocol: <value in [tcp, udp, sctp, ...]>
                    realservers:
                      -
                          client-ip:
                            - <value of string>
                          healthcheck: <value in [disable, enable, vip]>
                          holddown-interval: <value of integer>
                          http-host: <value of string>
                          ip: <value of string>
                          max-connections: <value of integer>
                          monitor: <value of string>
                          port: <value of integer>
                          seq: <value of integer>
                          status: <value in [active, standby, disable]>
                          weight: <value of integer>
                    server-type: <value in [http, https, ssl, ...]>
                    service: <value of string>
                    src-filter:
                      - <value of string>
                    srcintf-filter: <value of string>
                    ssl-algorithm: <value in [high, medium, low, ...]>
                    ssl-certificate: <value of string>
                    ssl-cipher-suites:
                      -
                          cipher: <value in [TLS-RSA-WITH-RC4-128-MD5, TLS-RSA-WITH-RC4-128-SHA, TLS-RSA-WITH-DES-CBC-SHA, ...]>
                          id: <value of integer>
                          versions:
                            - <value in [ssl-3.0, tls-1.0, tls-1.1, ...]>
                    ssl-client-fallback: <value in [disable, enable]>
                    ssl-client-renegotiation: <value in [deny, allow, secure]>
                    ssl-client-session-state-max: <value of integer>
                    ssl-client-session-state-timeout: <value of integer>
                    ssl-client-session-state-type: <value in [disable, time, count, ...]>
                    ssl-dh-bits: <value in [768, 1024, 1536, ...]>
                    ssl-hpkp: <value in [disable, enable, report-only]>
                    ssl-hpkp-age: <value of integer>
                    ssl-hpkp-backup: <value of string>
                    ssl-hpkp-include-subdomains: <value in [disable, enable]>
                    ssl-hpkp-primary: <value of string>
                    ssl-hpkp-report-uri: <value of string>
                    ssl-hsts: <value in [disable, enable]>
                    ssl-hsts-age: <value of integer>
                    ssl-hsts-include-subdomains: <value in [disable, enable]>
                    ssl-http-location-conversion: <value in [disable, enable]>
                    ssl-http-match-host: <value in [disable, enable]>
                    ssl-max-version: <value in [ssl-3.0, tls-1.0, tls-1.1, ...]>
                    ssl-min-version: <value in [ssl-3.0, tls-1.0, tls-1.1, ...]>
                    ssl-mode: <value in [half, full]>
                    ssl-pfs: <value in [require, deny, allow]>
                    ssl-send-empty-frags: <value in [disable, enable]>
                    ssl-server-algorithm: <value in [high, low, medium, ...]>
                    ssl-server-cipher-suites:
                      -
                          cipher: <value in [TLS-RSA-WITH-RC4-128-MD5, TLS-RSA-WITH-RC4-128-SHA, TLS-RSA-WITH-DES-CBC-SHA, ...]>
                          priority: <value of integer>
                          versions:
                            - <value in [ssl-3.0, tls-1.0, tls-1.1, ...]>
                    ssl-server-max-version: <value in [ssl-3.0, tls-1.0, tls-1.1, ...]>
                    ssl-server-min-version: <value in [ssl-3.0, tls-1.0, tls-1.1, ...]>
                    ssl-server-session-state-max: <value of integer>
                    ssl-server-session-state-timeout: <value of integer>
                    ssl-server-session-state-type: <value in [disable, time, count, ...]>
                    type: <value in [static-nat, load-balance, server-load-balance, ...]>
                    uuid: <value of string>
                    weblogic-server: <value in [disable, enable]>
                    websphere-server: <value in [disable, enable]>

   - name: REQUESTING /PM/CONFIG/OBJ/FIREWALL/VIP
     fmgr_firewall_vip:
        loose_validation: False
        workspace_locking_adom: <value in [global, custom adom]>
        workspace_locking_timeout: 300
        method: <value in [get]>
        url_params:
           adom: <value in [none, global, custom dom]>
        params:
           -
              attr: <value of string>
              fields:
                -
                   - <value in [arp-reply, color, comment, ...]>
              filter:
                - <value of string>
              get used: <value of integer>
              loadsub: <value of integer>
              option: <value in [count, object member, datasrc, ...]>
              range:
                - <value of integer>
              sortings:
                -
                    varidic.attr_name: <value in [1, -1]>

Return Values ¶

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

return values for method: [add, set, update]

status - No description for the parameter type: dict
- code - No description for the parameter type: int
- message - No description for the parameter type: str
url - No description for the parameter type: str example: /pm/config/adom/{adom}/obj/firewall/vip

return values for method: [get]

data - No description for the parameter type: array
- arp-reply - Enable to respond to ARP requests for this virtual IP address. type: str
- color - Color of icon on the GUI. type: int
- comment - Comment. type: str
- dns-mapping-ttl - DNS mapping TTL (Set to zero to use TTL in DNS response, default = 0). type: int
- dynamic_mapping - No description for the parameter type: array
  - _scope - No description for the parameter type: array
    - name - No description for the parameter type: str
    - vdom - No description for the parameter type: str
  - arp-reply - No description for the parameter type: str
  - color - No description for the parameter type: int
  - comment - No description for the parameter type: str
  - dns-mapping-ttl - No description for the parameter type: int
  - extaddr - No description for the parameter type: str
  - extintf - No description for the parameter type: str
  - extip - No description for the parameter type: str
  - extport - No description for the parameter type: str
  - gratuitous-arp-interval - No description for the parameter type: int
  - http-cookie-age - No description for the parameter type: int
  - http-cookie-domain - No description for the parameter type: str
  - http-cookie-domain-from-host - No description for the parameter type: str
  - http-cookie-generation - No description for the parameter type: int
  - http-cookie-path - No description for the parameter type: str
  - http-cookie-share - No description for the parameter type: str
  - http-ip-header - No description for the parameter type: str
  - http-ip-header-name - No description for the parameter type: str
  - http-multiplex - No description for the parameter type: str
  - https-cookie-secure - No description for the parameter type: str
  - id - No description for the parameter type: int
  - ldb-method - No description for the parameter type: str
  - mapped-addr - No description for the parameter type: str
  - mappedip - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - mappedport - No description for the parameter type: str
  - max-embryonic-connections - No description for the parameter type: int
  - monitor - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - nat-source-vip - No description for the parameter type: str
  - outlook-web-access - No description for the parameter type: str
  - persistence - No description for the parameter type: str
  - portforward - No description for the parameter type: str
  - portmapping-type - No description for the parameter type: str
  - protocol - No description for the parameter type: str
  - realservers - No description for the parameter type: array
    - client-ip - No description for the parameter type: array
      - {no-name} - No description for the parameter type: str
    - healthcheck - No description for the parameter type: str
    - holddown-interval - No description for the parameter type: int
    - http-host - No description for the parameter type: str
    - ip - No description for the parameter type: str
    - max-connections - No description for the parameter type: int
    - monitor - No description for the parameter type: str
    - port - No description for the parameter type: int
    - seq - No description for the parameter type: int
    - status - No description for the parameter type: str
    - weight - No description for the parameter type: int
  - server-type - No description for the parameter type: str
  - service - No description for the parameter type: str
  - src-filter - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - srcintf-filter - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - ssl-algorithm - No description for the parameter type: str
  - ssl-certificate - No description for the parameter type: str
  - ssl-cipher-suites - No description for the parameter type: array
    - cipher - No description for the parameter type: str
    - id - No description for the parameter type: int
    - versions - No description for the parameter type: array
      - {no-name} - No description for the parameter type: str
  - ssl-client-fallback - No description for the parameter type: str
  - ssl-client-renegotiation - No description for the parameter type: str
  - ssl-client-session-state-max - No description for the parameter type: int
  - ssl-client-session-state-timeout - No description for the parameter type: int
  - ssl-client-session-state-type - No description for the parameter type: str
  - ssl-dh-bits - No description for the parameter type: str
  - ssl-hpkp - No description for the parameter type: str
  - ssl-hpkp-age - No description for the parameter type: int
  - ssl-hpkp-backup - No description for the parameter type: str
  - ssl-hpkp-include-subdomains - No description for the parameter type: str
  - ssl-hpkp-primary - No description for the parameter type: str
  - ssl-hpkp-report-uri - No description for the parameter type: str
  - ssl-hsts - No description for the parameter type: str
  - ssl-hsts-age - No description for the parameter type: int
  - ssl-hsts-include-subdomains - No description for the parameter type: str
  - ssl-http-location-conversion - No description for the parameter type: str
  - ssl-http-match-host - No description for the parameter type: str
  - ssl-max-version - No description for the parameter type: str
  - ssl-min-version - No description for the parameter type: str
  - ssl-mode - No description for the parameter type: str
  - ssl-pfs - No description for the parameter type: str
  - ssl-send-empty-frags - No description for the parameter type: str
  - ssl-server-algorithm - No description for the parameter type: str
  - ssl-server-max-version - No description for the parameter type: str
  - ssl-server-min-version - No description for the parameter type: str
  - ssl-server-session-state-max - No description for the parameter type: int
  - ssl-server-session-state-timeout - No description for the parameter type: int
  - ssl-server-session-state-type - No description for the parameter type: str
  - type - No description for the parameter type: str
  - uuid - No description for the parameter type: str
  - weblogic-server - No description for the parameter type: str
  - websphere-server - No description for the parameter type: str
- extaddr - External FQDN address name. type: str
- extintf - Interface connected to the source network that receives the packets that will be forwarded to the destination network. type: str
- extip - IP address or address range on the external interface that you want to map to an address or address range on the destination network. type: str
- extport - Incoming port number range that you want to map to a port number range on the destination network. type: str
- gratuitous-arp-interval - Enable to have the VIP send gratuitous ARPs. type: int
- http-cookie-age - Time in minutes that client web browsers should keep a cookie. type: int
- http-cookie-domain - Domain that HTTP cookie persistence should apply to. type: str
- http-cookie-domain-from-host - Enable/disable use of HTTP cookie domain from host field in HTTP. type: str
- http-cookie-generation - Generation of HTTP cookie to be accepted. type: int
- http-cookie-path - Limit HTTP cookie persistence to the specified path. type: str
- http-cookie-share - Control sharing of cookies across virtual servers. type: str
- http-ip-header - For HTTP multiplexing, enable to add the original client IP address in the XForwarded-For HTTP header. type: str
- http-ip-header-name - For HTTP multiplexing, enter a custom HTTPS header name. type: str
- http-multiplex - Enable/disable HTTP multiplexing. type: str
- https-cookie-secure - Enable/disable verification that inserted HTTPS cookies are secure. type: str
- id - Custom defined ID. type: int
- ldb-method - Method used to distribute sessions to real servers. type: str
- mapped-addr - Mapped FQDN address name. type: str
- mappedip - No description for the parameter type: array
  - {no-name} - No description for the parameter type: str
- mappedport - Port number range on the destination network to which the external port number range is mapped. type: str
- max-embryonic-connections - Maximum number of incomplete connections. type: int
- monitor - Name of the health check monitor to use when polling to determine a virtual servers connectivity status. type: str
- name - Virtual IP name. type: str
- nat-source-vip - Enable/disable forcing the source NAT mapped IP to the external IP for all traffic. type: str
- outlook-web-access - Enable to add the Front-End-Https header for Microsoft Outlook Web Access. type: str
- persistence - Configure how to make sure that clients connect to the same server every time they make a request that is part of the same session. type: str
- portforward - Enable/disable port forwarding. type: str
- portmapping-type - Port mapping type. type: str
- protocol - Protocol to use when forwarding packets. type: str
- realservers - No description for the parameter type: array
  - client-ip - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - healthcheck - Enable to check the responsiveness of the real server before forwarding traffic. type: str
  - holddown-interval - Time in seconds that the health check monitor continues to monitor and unresponsive server that should be active. type: int
  - http-host - HTTP server domain name in HTTP header. type: str
  - ip - IP address of the real server. type: str
  - max-connections - Max number of active connections that can be directed to the real server. type: int
  - monitor - Name of the health check monitor to use when polling to determine a virtual servers connectivity status. type: str
  - port - Port for communicating with the real server. type: int
  - seq - No description for the parameter type: int
  - status - Set the status of the real server to active so that it can accept traffic, or on standby or disabled so no traffic is sent. type: str
  - weight - Weight of the real server. type: int
- server-type - Protocol to be load balanced by the virtual server (also called the server load balance virtual IP). type: str
- service - Service name. type: str
- src-filter - No description for the parameter type: array
  - {no-name} - No description for the parameter type: str
- srcintf-filter - Interfaces to which the VIP applies. type: str
- ssl-algorithm - Permitted encryption algorithms for SSL sessions according to encryption strength. type: str
- ssl-certificate - The name of the SSL certificate to use for SSL acceleration. type: str
- ssl-cipher-suites - No description for the parameter type: array
  - cipher - Cipher suite name. type: str
  - id - No description for the parameter type: int
  - versions - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
- ssl-client-fallback - Enable/disable support for preventing Downgrade Attacks on client connections (RFC 7507). type: str
- ssl-client-renegotiation - Allow, deny, or require secure renegotiation of client sessions to comply with RFC 5746. type: str
- ssl-client-session-state-max - Maximum number of client to FortiGate SSL session states to keep. type: int
- ssl-client-session-state-timeout - Number of minutes to keep client to FortiGate SSL session state. type: int
- ssl-client-session-state-type - How to expire SSL sessions for the segment of the SSL connection between the client and the FortiGate. type: str
- ssl-dh-bits - Number of bits to use in the Diffie-Hellman exchange for RSA encryption of SSL sessions. type: str
- ssl-hpkp - Enable/disable including HPKP header in response. type: str
- ssl-hpkp-age - Number of seconds the client should honour the HPKP setting. type: int
- ssl-hpkp-backup - Certificate to generate backup HPKP pin from. type: str
- ssl-hpkp-include-subdomains - Indicate that HPKP header applies to all subdomains. type: str
- ssl-hpkp-primary - Certificate to generate primary HPKP pin from. type: str
- ssl-hpkp-report-uri - URL to report HPKP violations to. type: str
- ssl-hsts - Enable/disable including HSTS header in response. type: str
- ssl-hsts-age - Number of seconds the client should honour the HSTS setting. type: int
- ssl-hsts-include-subdomains - Indicate that HSTS header applies to all subdomains. type: str
- ssl-http-location-conversion - Enable to replace HTTP with HTTPS in the replys Location HTTP header field. type: str
- ssl-http-match-host - Enable/disable HTTP host matching for location conversion. type: str
- ssl-max-version - Highest SSL/TLS version acceptable from a client. type: str
- ssl-min-version - Lowest SSL/TLS version acceptable from a client. type: str
- ssl-mode - Apply SSL offloading between the client and the FortiGate (half) or from the client to the FortiGate and from the FortiGate to the server (full). type: str
- ssl-pfs - Select the cipher suites that can be used for SSL perfect forward secrecy (PFS). type: str
- ssl-send-empty-frags - Enable/disable sending empty fragments to avoid CBC IV attacks (SSL 3. type: str
- ssl-server-algorithm - Permitted encryption algorithms for the server side of SSL full mode sessions according to encryption strength. type: str
- ssl-server-cipher-suites - No description for the parameter type: array
  - cipher - Cipher suite name. type: str
  - priority - SSL/TLS cipher suites priority. type: int
  - versions - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
- ssl-server-max-version - Highest SSL/TLS version acceptable from a server. type: str
- ssl-server-min-version - Lowest SSL/TLS version acceptable from a server. type: str
- ssl-server-session-state-max - Maximum number of FortiGate to Server SSL session states to keep. type: int
- ssl-server-session-state-timeout - Number of minutes to keep FortiGate to Server SSL session state. type: int
- ssl-server-session-state-type - How to expire SSL sessions for the segment of the SSL connection between the server and the FortiGate. type: str
- type - Configure a static NAT, load balance, DNS translation, or FQDN VIP. type: str
- uuid - Universally Unique Identifier (UUID; automatically assigned but can be manually reset). type: str
- weblogic-server - Enable to add an HTTP header to indicate SSL offloading for a WebLogic server. type: str
- websphere-server - Enable to add an HTTP header to indicate SSL offloading for a WebSphere server. type: str
status - No description for the parameter type: dict
- code - No description for the parameter type: int
- message - No description for the parameter type: str
url - No description for the parameter type: str example: /pm/config/adom/{adom}/obj/firewall/vip

Status ¶

This module is not guaranteed to have a backwards compatible interface.

Authors ¶

Frank Shen (@fshen01)
Link Zheng (@zhengl)

Hint

If you notice any issues in this documentation, you can create a pull request to improve it.