fmgr_ips_sensor – Configure IPS sensor.¶

New in version 2.10.

Synopsis
Requirements
Parameters
Notes
Examples
Return Values
Status
Authors

Synopsis ¶

This module is able to configure a FortiManager device by allowing the user to [add, get, set, update] the following FortiManager json-rpc urls.
/pm/config/adom/{adom}/obj/ips/sensor
/pm/config/global/obj/ips/sensor
Examples include all parameters and values need to be adjusted to data sources before usage.
Tested with FortiManager v6.0.0

Requirements ¶

The below requirements are needed on the host that executes this module.

ansible>=2.10.0

Parameters ¶

loose_validation - Do parameter validation in a loose way type: bool required: false default: false
workspace_locking_adom - Acquire the workspace lock if FortiManager is running in workspace mode type: str required: false choices: global, custom dom
workspace_locking_timeout - The maximum time in seconds to wait for other users to release workspace lock type: integer required: false default: 300
url_params - parameters in url path type: dict required: true

adom - the domain prefix type: str choices: none, global, custom dom

parameters for method: [add, set, update] - Configure IPS sensor.

data - No description for the parameter type: array
- block-malicious-url - Enable/disable malicious URL blocking. type: str choices: [disable, enable]
- comment - Comment. type: str
- entries - No description for the parameter type: array
  - action - Action taken with traffic in which signatures are detected. type: str choices: [pass, block, reset, default]
  - application - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - exempt-ip - No description for the parameter type: array
    - dst-ip - Destination IP address and netmask. type: str
    - id - Exempt IP ID. type: int
    - src-ip - Source IP address and netmask. type: str
  - id - Rule ID in IPS database (0 - 4294967295). type: int
  - location - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - log - Enable/disable logging of signatures included in filter. type: str choices: [disable, enable]
  - log-attack-context - Enable/disable logging of attack context: URL buffer, header buffer, body buffer, packet buffer. type: str choices: [disable, enable]
  - log-packet - Enable/disable packet logging. type: str choices: [disable, enable]
  - os - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - protocol - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - quarantine - Quarantine method. type: str choices: [none, attacker, both, interface]
  - quarantine-expiry - Duration of quarantine. type: str
  - quarantine-log - Enable/disable quarantine logging. type: str choices: [disable, enable]
  - rate-count - Count of the rate. type: int
  - rate-duration - Duration (sec) of the rate. type: int
  - rate-mode - Rate limit mode. type: str choices: [periodical, continuous]
  - rate-track - Track the packet protocol field. type: str choices: [none, src-ip, dest-ip, dhcp-client-mac, dns-domain]
  - rule - Identifies the predefined or custom IPS signatures to add to the sensor. type: str
  - severity - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - status - Status of the signatures included in filter. type: str choices: [disable, enable, default]
- extended-log - Enable/disable extended logging. type: str choices: [disable, enable]
- filter - No description for the parameter type: array
  - action - Action of selected rules. type: str choices: [pass, block, default, reset]
  - application - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - location - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - log - Enable/disable logging of selected rules. type: str choices: [disable, enable, default]
  - log-packet - Enable/disable packet logging of selected rules. type: str choices: [disable, enable, default]
  - name - Filter name. type: str
  - os - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - protocol - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - quarantine - Quarantine IP or interface. type: str choices: [none, attacker, both, interface]
  - quarantine-expiry - Duration of quarantine in minute. type: int
  - quarantine-log - Enable/disable logging of selected quarantine. type: str choices: [disable, enable]
  - severity - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - status - Selected rules status. type: str choices: [disable, enable, default]
- name - Sensor name. type: str
- override - No description for the parameter type: array
  - action - Action of override rule. type: str choices: [pass, block, reset]
  - exempt-ip - No description for the parameter type: array
    - dst-ip - Destination IP address and netmask. type: str
    - id - Exempt IP ID. type: int
    - src-ip - Source IP address and netmask. type: str
  - log - Enable/disable logging. type: str choices: [disable, enable]
  - log-packet - Enable/disable packet logging. type: str choices: [disable, enable]
  - quarantine - Quarantine IP or interface. type: str choices: [none, attacker, both, interface]
  - quarantine-expiry - Duration of quarantine in minute. type: int
  - quarantine-log - Enable/disable logging of selected quarantine. type: str choices: [disable, enable]
  - rule-id - Override rule ID. type: int
  - status - Enable/disable status of override rule. type: str choices: [disable, enable]
- replacemsg-group - Replacement message group. type: str

parameters for method: [get] - Configure IPS sensor.

attr - The name of the attribute to retrieve its datasource. type: str
fields - No description for the parameter type: array
- {no-name} - No description for the parameter type: array
  - {no-name} - No description for the parameter type: str choices: [block-malicious-url, comment, extended-log, name, replacemsg-group]
filter - No description for the parameter type: array
- {no-name} - No description for the parameter type: str
get used - No description for the parameter type: int
loadsub - Enable or disable the return of any sub-objects. type: int
option - Set fetch option for the request. type: str choices: [count, object member, datasrc, get reserved, syntax]
range - No description for the parameter type: array
- {no-name} - No description for the parameter type: int
sortings - No description for the parameter type: array
- {attr_name} - No description for the parameter type: int choices: [1, -1]

Notes ¶

Note

The module may supports multiple method, every method has different parameters definition
One method may also have more than one parameter definition collection, each collection is dedicated to one API endpoint
The module may include domain dependent urls, the domain can be specified in url_params as adom
To run in workspace mode, the paremeter workspace_locking_adom must be included in the task

Examples ¶

- hosts: fortimanager-inventory
  collections:
    - fortinet.fortimanager
  connection: httpapi
  vars:
     ansible_httpapi_use_ssl: True
     ansible_httpapi_validate_certs: False
     ansible_httpapi_port: 443
  tasks:

   - name: REQUESTING /PM/CONFIG/OBJ/IPS/SENSOR
     fmgr_ips_sensor:
        loose_validation: False
        workspace_locking_adom: <value in [global, custom adom]>
        workspace_locking_timeout: 300
        method: <value in [add, set, update]>
        url_params:
           adom: <value in [none, global, custom dom]>
        params:
           -
              data:
                -
                    block-malicious-url: <value in [disable, enable]>
                    comment: <value of string>
                    entries:
                      -
                          action: <value in [pass, block, reset, ...]>
                          application:
                            - <value of string>
                          exempt-ip:
                            -
                                dst-ip: <value of string>
                                id: <value of integer>
                                src-ip: <value of string>
                          id: <value of integer>
                          location:
                            - <value of string>
                          log: <value in [disable, enable]>
                          log-attack-context: <value in [disable, enable]>
                          log-packet: <value in [disable, enable]>
                          os:
                            - <value of string>
                          protocol:
                            - <value of string>
                          quarantine: <value in [none, attacker, both, ...]>
                          quarantine-expiry: <value of string>
                          quarantine-log: <value in [disable, enable]>
                          rate-count: <value of integer>
                          rate-duration: <value of integer>
                          rate-mode: <value in [periodical, continuous]>
                          rate-track: <value in [none, src-ip, dest-ip, ...]>
                          rule: <value of string>
                          severity:
                            - <value of string>
                          status: <value in [disable, enable, default]>
                    extended-log: <value in [disable, enable]>
                    filter:
                      -
                          action: <value in [pass, block, default, ...]>
                          application:
                            - <value of string>
                          location:
                            - <value of string>
                          log: <value in [disable, enable, default]>
                          log-packet: <value in [disable, enable, default]>
                          name: <value of string>
                          os:
                            - <value of string>
                          protocol:
                            - <value of string>
                          quarantine: <value in [none, attacker, both, ...]>
                          quarantine-expiry: <value of integer>
                          quarantine-log: <value in [disable, enable]>
                          severity:
                            - <value of string>
                          status: <value in [disable, enable, default]>
                    name: <value of string>
                    override:
                      -
                          action: <value in [pass, block, reset]>
                          exempt-ip:
                            -
                                dst-ip: <value of string>
                                id: <value of integer>
                                src-ip: <value of string>
                          log: <value in [disable, enable]>
                          log-packet: <value in [disable, enable]>
                          quarantine: <value in [none, attacker, both, ...]>
                          quarantine-expiry: <value of integer>
                          quarantine-log: <value in [disable, enable]>
                          rule-id: <value of integer>
                          status: <value in [disable, enable]>
                    replacemsg-group: <value of string>

   - name: REQUESTING /PM/CONFIG/OBJ/IPS/SENSOR
     fmgr_ips_sensor:
        loose_validation: False
        workspace_locking_adom: <value in [global, custom adom]>
        workspace_locking_timeout: 300
        method: <value in [get]>
        url_params:
           adom: <value in [none, global, custom dom]>
        params:
           -
              attr: <value of string>
              fields:
                -
                   - <value in [block-malicious-url, comment, extended-log, ...]>
              filter:
                - <value of string>
              get used: <value of integer>
              loadsub: <value of integer>
              option: <value in [count, object member, datasrc, ...]>
              range:
                - <value of integer>
              sortings:
                -
                    varidic.attr_name: <value in [1, -1]>

Return Values ¶

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

return values for method: [add, set, update]

status - No description for the parameter type: dict
- code - No description for the parameter type: int
- message - No description for the parameter type: str
url - No description for the parameter type: str example: /pm/config/adom/{adom}/obj/ips/sensor

return values for method: [get]

data - No description for the parameter type: array
- block-malicious-url - Enable/disable malicious URL blocking. type: str
- comment - Comment. type: str
- entries - No description for the parameter type: array
  - action - Action taken with traffic in which signatures are detected. type: str
  - application - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - exempt-ip - No description for the parameter type: array
    - dst-ip - Destination IP address and netmask. type: str
    - id - Exempt IP ID. type: int
    - src-ip - Source IP address and netmask. type: str
  - id - Rule ID in IPS database (0 - 4294967295). type: int
  - location - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - log - Enable/disable logging of signatures included in filter. type: str
  - log-attack-context - Enable/disable logging of attack context: URL buffer, header buffer, body buffer, packet buffer. type: str
  - log-packet - Enable/disable packet logging. type: str
  - os - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - protocol - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - quarantine - Quarantine method. type: str
  - quarantine-expiry - Duration of quarantine. type: str
  - quarantine-log - Enable/disable quarantine logging. type: str
  - rate-count - Count of the rate. type: int
  - rate-duration - Duration (sec) of the rate. type: int
  - rate-mode - Rate limit mode. type: str
  - rate-track - Track the packet protocol field. type: str
  - rule - Identifies the predefined or custom IPS signatures to add to the sensor. type: str
  - severity - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - status - Status of the signatures included in filter. type: str
- extended-log - Enable/disable extended logging. type: str
- filter - No description for the parameter type: array
  - action - Action of selected rules. type: str
  - application - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - location - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - log - Enable/disable logging of selected rules. type: str
  - log-packet - Enable/disable packet logging of selected rules. type: str
  - name - Filter name. type: str
  - os - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - protocol - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - quarantine - Quarantine IP or interface. type: str
  - quarantine-expiry - Duration of quarantine in minute. type: int
  - quarantine-log - Enable/disable logging of selected quarantine. type: str
  - severity - No description for the parameter type: array
    - {no-name} - No description for the parameter type: str
  - status - Selected rules status. type: str
- name - Sensor name. type: str
- override - No description for the parameter type: array
  - action - Action of override rule. type: str
  - exempt-ip - No description for the parameter type: array
    - dst-ip - Destination IP address and netmask. type: str
    - id - Exempt IP ID. type: int
    - src-ip - Source IP address and netmask. type: str
  - log - Enable/disable logging. type: str
  - log-packet - Enable/disable packet logging. type: str
  - quarantine - Quarantine IP or interface. type: str
  - quarantine-expiry - Duration of quarantine in minute. type: int
  - quarantine-log - Enable/disable logging of selected quarantine. type: str
  - rule-id - Override rule ID. type: int
  - status - Enable/disable status of override rule. type: str
- replacemsg-group - Replacement message group. type: str
status - No description for the parameter type: dict
- code - No description for the parameter type: int
- message - No description for the parameter type: str
url - No description for the parameter type: str example: /pm/config/adom/{adom}/obj/ips/sensor

Status ¶

This module is not guaranteed to have a backwards compatible interface.

Authors ¶

Frank Shen (@fshen01)
Link Zheng (@zhengl)

Hint

If you notice any issues in this documentation, you can create a pull request to improve it.