fmgr_vpnsslweb_portal – Portal.

New in version 2.10.

Synopsis

  • This module is able to configure a FortiManager device.
  • Examples include all parameters and values need to be adjusted to data sources before usage.

Requirements

The below requirements are needed on the host that executes this module.

  • ansible>=2.9.0

FortiManager Version Compatibility


6.0.0 6.2.1 6.2.3 6.2.5 6.4.0 6.4.2 6.4.5 7.0.0 7.2.0
vpnsslweb_portal yes yes yes yes yes yes yes yes yes

Parameters

  • enable_log - Enable/Disable logging for task type: bool required: false default: False
  • forticloud_access_token - Access token of forticloud managed API users, this option is available with FortiManager later than 6.4.0 type: str required: false
  • proposed_method - The overridden method for the underlying Json RPC request type: str required: false choices: set, update, add
  • bypass_validation - Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters type: bool required: false default: False
  • workspace_locking_adom - Acquire the workspace lock if FortiManager is running in workspace mode type: str required: false choices: global, custom adom including root
  • workspace_locking_timeout - The maximum time in seconds to wait for other users to release workspace lock type: integer required: false default: 300
  • rc_succeeded - The rc codes list with which the conditions to succeed will be overriden type: list required: false
  • rc_failed - The rc codes list with which the conditions to fail will be overriden type: list required: false
  • state - The directive to create, update or delete an object type: str required: true choices: present, absent
  • adom - The parameter in requested url type: str required: true
  • vpnsslweb_portal - no description type: dict
    • allow-user-access - Allow user access to SSL-VPN applications. type: array choices: [web, ftp, telnet, smb, vnc, rdp, ssh, ping, citrix, portforward, sftp] more...
    • auto-connect - Enable/disable automatic connect by client when system is up. type: str choices: [disable, enable] more...
    • bookmark-group - Bookmark-Group. type: array more...
      • bookmarks - Bookmarks. type: array more...
        • additional-params - Additional parameters. type: str more...
        • apptype - Application type. type: str choices: [web, telnet, ssh, ftp, smb, vnc, rdp, citrix, rdpnative, portforward, sftp] more...
        • description - Description. type: str more...
        • folder - Network shared file folder parameter. type: str more...
        • form-data - Form-Data. type: array more...
          • name - Name. type: str more...
          • value - Value. type: str more...
        • host - Host name/IP parameter. type: str more...
        • listening-port - Listening port (0 - 65535). type: int more...
        • load-balancing-info - The load balancing information or cookie which should be provided to the connection broker. type: str more...
        • logon-password - Logon password. type: str more...
        • logon-user - Logon user. type: str more...
        • name - Bookmark name. type: str more...
        • port - Remote port. type: int more...
        • preconnection-blob - An arbitrary string which identifies the RDP source. type: str more...
        • preconnection-id - The numeric ID of the RDP source (0-2147483648). type: int more...
        • remote-port - Remote port (0 - 65535). type: int more...
        • security - Security mode for RDP connection. type: str choices: [rdp, nla, tls, any] more...
        • server-layout - Server side keyboard layout. type: str choices: [en-us-qwerty, de-de-qwertz, fr-fr-azerty, it-it-qwerty, sv-se-qwerty, failsafe, en-gb-qwerty, es-es-qwerty, fr-ch-qwertz, ja-jp-qwerty, pt-br-qwerty, tr-tr-qwerty, fr-ca-qwerty] more...
        • show-status-window - Enable/disable showing of status window. type: str choices: [disable, enable] more...
        • sso - Single Sign-On. type: str choices: [disable, static, auto] more...
        • sso-credential - Single sign-on credentials. type: str choices: [sslvpn-login, alternative] more...
        • sso-credential-sent-once - Single sign-on credentials are only sent once to remote server. type: str choices: [disable, enable] more...
        • sso-password - SSO password. type: str more...
        • sso-username - SSO user name. type: str more...
        • url - URL parameter. type: str more...
        • domain - Login domain. type: str more...
        • color-depth - Color depth per pixel. type: str choices: [8, 16, 32] more...
        • height - Screen height (range from 0 - 65535, default = 0). type: int more...
        • keyboard-layout - Keyboard layout. type: str choices: [ar, da, de, de-ch, en-gb, en-uk, en-us, es, fi, fr, fr-be, fr-ca, fr-ch, hr, hu, it, ja, lt, lv, mk, no, pl, pt, pt-br, ru, sl, sv, tk, tr, fr-ca-m, wg, ar-101, ar-102, ar-102-azerty, can-mul, cz, cz-qwerty, cz-pr, nl, de-ibm, en-uk-ext, en-us-dvorak, es-var, fi-sami, hu-101, it-142, ko, lt-ibm, lt-std, lav-std, lav-leg, mk-std, no-sami, pol-214, pol-pr, pt-br-abnt2, ru-mne, ru-t, sv-sami, tuk, tur-f, tur-q, zh-sym-sg-us, zh-sym-us, zh-tr-hk, zh-tr-mo, zh-tr-us, fr-apple] more...
        • restricted-admin - Enable/disable restricted admin mode for RDP. type: str choices: [disable, enable] more...
        • send-preconnection-id - Enable/disable sending of preconnection ID. type: str choices: [disable, enable] more...
        • width - Screen width (range from 0 - 65535, default = 0). type: int more...
      • name - Bookmark group name. type: str more...
    • custom-lang - Change the web portal display language. type: str more...
    • customize-forticlient-download-url - Enable support of customized download URL for FortiClient. type: str choices: [disable, enable] more...
    • display-bookmark - Enable to display the web portal bookmark widget. type: str choices: [disable, enable] more...
    • display-connection-tools - Enable to display the web portal connection tools widget. type: str choices: [disable, enable] more...
    • display-history - Enable to display the web portal user login history widget. type: str choices: [disable, enable] more...
    • display-status - Enable to display the web portal status widget. type: str choices: [disable, enable] more...
    • dns-server1 - IPv4 DNS server 1. type: str more...
    • dns-server2 - IPv4 DNS server 2. type: str more...
    • dns-suffix - DNS suffix. type: str more...
    • exclusive-routing - Enable/disable all traffic go through tunnel only. type: str choices: [disable, enable] more...
    • forticlient-download - Enable/disable download option for FortiClient. type: str choices: [disable, enable] more...
    • forticlient-download-method - FortiClient download method. type: str choices: [direct, ssl-vpn] more...
    • heading - Web portal heading message. type: str more...
    • hide-sso-credential - Enable to prevent SSO credential being sent to client. type: str choices: [disable, enable] more...
    • host-check - Type of host checking performed on endpoints. type: str choices: [none, av, fw, av-fw, custom] more...
    • host-check-interval - Periodic host check interval. type: int more...
    • host-check-policy - One or more policies to require the endpoint to have specific security software. type: str more...
    • ip-mode - Method by which users of this SSL-VPN tunnel obtain IP addresses. type: str choices: [range, user-group] more...
    • ip-pools - IPv4 firewall source address objects reserved for SSL-VPN tunnel mode clients. type: str more...
    • ipv6-dns-server1 - IPv6 DNS server 1. type: str more...
    • ipv6-dns-server2 - IPv6 DNS server 2. type: str more...
    • ipv6-exclusive-routing - Enable/disable all IPv6 traffic go through tunnel only. type: str choices: [disable, enable] more...
    • ipv6-pools - IPv4 firewall source address objects reserved for SSL-VPN tunnel mode clients. type: str more...
    • ipv6-service-restriction - Enable/disable IPv6 tunnel service restriction. type: str choices: [disable, enable] more...
    • ipv6-split-tunneling - Enable/disable IPv6 split tunneling. type: str choices: [disable, enable] more...
    • ipv6-split-tunneling-routing-address - IPv6 SSL-VPN tunnel mode firewall address objects that override firewall policy destination addresses to control split-tunneling access. type: str more...
    • ipv6-tunnel-mode - Enable/disable IPv6 SSL-VPN tunnel mode. type: str choices: [disable, enable] more...
    • ipv6-wins-server1 - IPv6 WINS server 1. type: str more...
    • ipv6-wins-server2 - IPv6 WINS server 2. type: str more...
    • keep-alive - Enable/disable automatic reconnect for FortiClient connections. type: str choices: [disable, enable] more...
    • limit-user-logins - Enable to limit each user to one SSL-VPN session at a time. type: str choices: [disable, enable] more...
    • mac-addr-action - Client MAC address action. type: str choices: [deny, allow] more...
    • mac-addr-check - Enable/disable MAC address host checking. type: str choices: [disable, enable] more...
    • mac-addr-check-rule - Mac-Addr-Check-Rule. type: array more...
      • mac-addr-list - Client MAC address list. type: str more...
      • mac-addr-mask - Client MAC address mask. type: int more...
      • name - Client MAC address check rule name. type: str more...
    • macos-forticlient-download-url - Download URL for Mac FortiClient. type: str more...
    • name - Portal name. type: str more...
    • os-check - Enable to let the FortiGate decide action based on client OS. type: str choices: [disable, enable] more...
    • redir-url - Client login redirect URL. type: str more...
    • save-password - Enable/disable FortiClient saving the users password. type: str choices: [disable, enable] more...
    • service-restriction - Enable/disable tunnel service restriction. type: str choices: [disable, enable] more...
    • skip-check-for-unsupported-browser - Enable to skip host check if browser does not support it. type: str choices: [disable, enable] more...
    • skip-check-for-unsupported-os - Enable to skip host check if client OS does not support it. type: str choices: [disable, enable] more...
    • smb-ntlmv1-auth - Enable support of NTLMv1 for Samba authentication. type: str choices: [disable, enable] more...
    • smbv1 - Enable/disable support of SMBv1 for Samba. type: str choices: [disable, enable] more...
    • split-dns - Split-Dns. type: array more...
      • dns-server1 - DNS server 1. type: str more...
      • dns-server2 - DNS server 2. type: str more...
      • domains - Split DNS domains used for SSL-VPN clients separated by comma(,). type: str more...
      • id - ID. type: int more...
      • ipv6-dns-server1 - IPv6 DNS server 1. type: str more...
      • ipv6-dns-server2 - IPv6 DNS server 2. type: str more...
    • split-tunneling - Enable/disable IPv4 split tunneling. type: str choices: [disable, enable] more...
    • split-tunneling-routing-address - IPv4 SSL-VPN tunnel mode firewall address objects that override firewall policy destination addresses to control split-tunneling access. type: str more...
    • theme - Web portal color scheme. type: str choices: [gray, blue, orange, crimson, steelblue, darkgrey, green, melongene, red, mariner, neutrino, jade, graphite, dark-matter, onyx, eclipse] more...
    • tunnel-mode - Enable/disable IPv4 SSL-VPN tunnel mode. type: str choices: [disable, enable] more...
    • user-bookmark - Enable to allow web portal users to create their own bookmarks. type: str choices: [disable, enable] more...
    • user-group-bookmark - Enable to allow web portal users to create bookmarks for all users in the same user group. type: str choices: [disable, enable] more...
    • web-mode - Enable/disable SSL VPN web mode. type: str choices: [disable, enable] more...
    • windows-forticlient-download-url - Download URL for Windows FortiClient. type: str more...
    • wins-server1 - IPv4 WINS server 1. type: str more...
    • wins-server2 - IPv4 WINS server 1. type: str more...
    • skip-check-for-browser - Enable to skip host check for browser support. type: str choices: [disable, enable] more...
    • smb-max-version - SMB maximum client protocol version. type: str choices: [smbv1, smbv2, smbv3] more...
    • smb-min-version - SMB minimum client protocol version. type: str choices: [smbv1, smbv2, smbv3] more...
    • transform-backward-slashes - Transform backward slashes to forward slashes in URLs. type: str choices: [disable, enable] more...
    • ipv6-split-tunneling-routing-negate - Enable to negate IPv6 split tunneling routing address. type: str choices: [disable, enable] more...
    • split-tunneling-routing-negate - Enable to negate split tunneling routing address. type: str choices: [disable, enable] more...
    • os-check-list type: dict
      • action - OS check options. type: str choices: [allow, check-up-to-date, deny] more...
      • latest-patch-level - Latest OS patch level. type: str more...
      • name - Name. type: str more...
      • tolerance - OS patch level tolerance. type: int more...
    • use-sdwan - Use SD-WAN rules to get output interface. type: str choices: [disable, enable] more...
    • prefer-ipv6-dns - prefer to query IPv6 dns first if enabled. type: str choices: [disable, enable] more...
    • rewrite-ip-uri-ui - Rewrite contents for URI contains IP and "/ui/". type: str choices: [disable, enable] more...
    • clipboard - Enable to support RDP/VPC clipboard functionality. type: str choices: [disable, enable] more...
    • default-window-height - Screen height (range from 0 - 65535, default = 768). type: int more...
    • default-window-width - Screen width (range from 0 - 65535, default = 1024). type: int more...

Notes

Note

  • Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.
  • To create or update an object, use state: present directive.
  • To delete an object, use state: absent directive
  • Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded

Examples

- hosts: fortimanager-inventory
  collections:
    - fortinet.fortimanager
  connection: httpapi
  vars:
     ansible_httpapi_use_ssl: True
     ansible_httpapi_validate_certs: False
     ansible_httpapi_port: 443
  tasks:
   - name: no description
     fmgr_vpnsslweb_portal:
        bypass_validation: False
        workspace_locking_adom: <value in [global, custom adom including root]>
        workspace_locking_timeout: 300
        rc_succeeded: [0, -2, -3, ...]
        rc_failed: [-2, -3, ...]
        adom: <your own value>
        state: <value in [present, absent]>
        vpnsslweb_portal:
           allow-user-access:
             - web
             - ftp
             - telnet
             - smb
             - vnc
             - rdp
             - ssh
             - ping
             - citrix
             - portforward
             - sftp
           auto-connect: <value in [disable, enable]>
           bookmark-group:
             -
                 bookmarks:
                   -
                       additional-params: <value of string>
                       apptype: <value in [web, telnet, ssh, ...]>
                       description: <value of string>
                       folder: <value of string>
                       form-data:
                         -
                             name: <value of string>
                             value: <value of string>
                       host: <value of string>
                       listening-port: <value of integer>
                       load-balancing-info: <value of string>
                       logon-password: <value of string>
                       logon-user: <value of string>
                       name: <value of string>
                       port: <value of integer>
                       preconnection-blob: <value of string>
                       preconnection-id: <value of integer>
                       remote-port: <value of integer>
                       security: <value in [rdp, nla, tls, ...]>
                       server-layout: <value in [en-us-qwerty, de-de-qwertz, fr-fr-azerty, ...]>
                       show-status-window: <value in [disable, enable]>
                       sso: <value in [disable, static, auto]>
                       sso-credential: <value in [sslvpn-login, alternative]>
                       sso-credential-sent-once: <value in [disable, enable]>
                       sso-password: <value of string>
                       sso-username: <value of string>
                       url: <value of string>
                       domain: <value of string>
                       color-depth: <value in [8, 16, 32]>
                       height: <value of integer>
                       keyboard-layout: <value in [ar, da, de, ...]>
                       restricted-admin: <value in [disable, enable]>
                       send-preconnection-id: <value in [disable, enable]>
                       width: <value of integer>
                 name: <value of string>
           custom-lang: <value of string>
           customize-forticlient-download-url: <value in [disable, enable]>
           display-bookmark: <value in [disable, enable]>
           display-connection-tools: <value in [disable, enable]>
           display-history: <value in [disable, enable]>
           display-status: <value in [disable, enable]>
           dns-server1: <value of string>
           dns-server2: <value of string>
           dns-suffix: <value of string>
           exclusive-routing: <value in [disable, enable]>
           forticlient-download: <value in [disable, enable]>
           forticlient-download-method: <value in [direct, ssl-vpn]>
           heading: <value of string>
           hide-sso-credential: <value in [disable, enable]>
           host-check: <value in [none, av, fw, ...]>
           host-check-interval: <value of integer>
           host-check-policy: <value of string>
           ip-mode: <value in [range, user-group]>
           ip-pools: <value of string>
           ipv6-dns-server1: <value of string>
           ipv6-dns-server2: <value of string>
           ipv6-exclusive-routing: <value in [disable, enable]>
           ipv6-pools: <value of string>
           ipv6-service-restriction: <value in [disable, enable]>
           ipv6-split-tunneling: <value in [disable, enable]>
           ipv6-split-tunneling-routing-address: <value of string>
           ipv6-tunnel-mode: <value in [disable, enable]>
           ipv6-wins-server1: <value of string>
           ipv6-wins-server2: <value of string>
           keep-alive: <value in [disable, enable]>
           limit-user-logins: <value in [disable, enable]>
           mac-addr-action: <value in [deny, allow]>
           mac-addr-check: <value in [disable, enable]>
           mac-addr-check-rule:
             -
                 mac-addr-list: <value of string>
                 mac-addr-mask: <value of integer>
                 name: <value of string>
           macos-forticlient-download-url: <value of string>
           name: <value of string>
           os-check: <value in [disable, enable]>
           redir-url: <value of string>
           save-password: <value in [disable, enable]>
           service-restriction: <value in [disable, enable]>
           skip-check-for-unsupported-browser: <value in [disable, enable]>
           skip-check-for-unsupported-os: <value in [disable, enable]>
           smb-ntlmv1-auth: <value in [disable, enable]>
           smbv1: <value in [disable, enable]>
           split-dns:
             -
                 dns-server1: <value of string>
                 dns-server2: <value of string>
                 domains: <value of string>
                 id: <value of integer>
                 ipv6-dns-server1: <value of string>
                 ipv6-dns-server2: <value of string>
           split-tunneling: <value in [disable, enable]>
           split-tunneling-routing-address: <value of string>
           theme: <value in [gray, blue, orange, ...]>
           tunnel-mode: <value in [disable, enable]>
           user-bookmark: <value in [disable, enable]>
           user-group-bookmark: <value in [disable, enable]>
           web-mode: <value in [disable, enable]>
           windows-forticlient-download-url: <value of string>
           wins-server1: <value of string>
           wins-server2: <value of string>
           skip-check-for-browser: <value in [disable, enable]>
           smb-max-version: <value in [smbv1, smbv2, smbv3]>
           smb-min-version: <value in [smbv1, smbv2, smbv3]>
           transform-backward-slashes: <value in [disable, enable]>
           ipv6-split-tunneling-routing-negate: <value in [disable, enable]>
           split-tunneling-routing-negate: <value in [disable, enable]>
           os-check-list:
              action: <value in [allow, check-up-to-date, deny]>
              latest-patch-level: <value of string>
              name: <value of string>
              tolerance: <value of integer>
           use-sdwan: <value in [disable, enable]>
           prefer-ipv6-dns: <value in [disable, enable]>
           rewrite-ip-uri-ui: <value in [disable, enable]>
           clipboard: <value in [disable, enable]>
           default-window-height: <value of integer>
           default-window-width: <value of integer>

Return Values

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

  • request_url - The full url requested returned: always type: str sample: /sys/login/user
  • response_code - The status of api request returned: always type: int sample: 0
  • response_message - The descriptive message of the api response returned: always type: str sample: OK
  • response_data - The data body of the api response returned: optional type: list or dict

Status

  • This module is not guaranteed to have a backwards compatible interface.

Authors

  • Link Zheng (@chillancezen)
  • Jie Xue (@JieX19)
  • Frank Shen (@fshen01)
  • Hongbin Lu (@fgtdev-hblu)

Hint

If you notice any issues in this documentation, you can create a pull request to improve it.