fmgr_webfilter_profile – Configure Web filter profiles.

New in version 2.10.

Synopsis

  • This module is able to configure a FortiManager device.
  • Examples include all parameters and values need to be adjusted to data sources before usage.

Requirements

The below requirements are needed on the host that executes this module.

  • ansible>=2.9.0

FortiManager Version Compatibility


6.0.0 6.2.1 6.2.3 6.2.5 6.4.0 6.4.2 6.4.5 7.0.0 7.2.0
webfilter_profile yes yes yes yes yes yes yes yes yes

Parameters

  • enable_log - Enable/Disable logging for task type: bool required: false default: False
  • forticloud_access_token - Access token of forticloud managed API users, this option is available with FortiManager later than 6.4.0 type: str required: false
  • proposed_method - The overridden method for the underlying Json RPC request type: str required: false choices: set, update, add
  • bypass_validation - Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters type: bool required: false default: False
  • workspace_locking_adom - Acquire the workspace lock if FortiManager is running in workspace mode type: str required: false choices: global, custom adom including root
  • workspace_locking_timeout - The maximum time in seconds to wait for other users to release workspace lock type: integer required: false default: 300
  • rc_succeeded - The rc codes list with which the conditions to succeed will be overriden type: list required: false
  • rc_failed - The rc codes list with which the conditions to fail will be overriden type: list required: false
  • state - The directive to create, update or delete an object type: str required: true choices: present, absent
  • adom - The parameter in requested url type: str required: true
  • webfilter_profile - no description type: dict
    • comment - Optional comments. type: str more...
    • extended-log - Enable/disable extended logging for web filtering. type: str choices: [disable, enable] more...
    • https-replacemsg - Enable replacement messages for HTTPS. type: str choices: [disable, enable] more...
    • inspection-mode - Web filtering inspection mode. type: str choices: [proxy, flow-based, dns] more...
    • log-all-url - Enable/disable logging all URLs visited. type: str choices: [disable, enable] more...
    • name - Profile name. type: str more...
    • options - Options. type: array choices: [block-invalid-url, jscript, js, vbs, unknown, wf-referer, https-scan, intrinsic, wf-cookie, per-user-bwl, activexfilter, cookiefilter, https-url-scan, javafilter, rangeblock, contenttype-check, per-user-bal] more...
    • ovrd-perm - Permitted override types. type: array choices: [bannedword-override, urlfilter-override, fortiguard-wf-override, contenttype-check-override] more...
    • post-action - Action taken for HTTP POST traffic. type: str choices: [normal, comfort, block] more...
    • replacemsg-group - Replacement message group. type: str more...
    • web-content-log - Enable/disable logging logging blocked web content. type: str choices: [disable, enable] more...
    • web-extended-all-action-log - Enable/disable extended any filter action logging for web filtering. type: str choices: [disable, enable] more...
    • web-filter-activex-log - Enable/disable logging ActiveX. type: str choices: [disable, enable] more...
    • web-filter-applet-log - Enable/disable logging Java applets. type: str choices: [disable, enable] more...
    • web-filter-command-block-log - Enable/disable logging blocked commands. type: str choices: [disable, enable] more...
    • web-filter-cookie-log - Enable/disable logging cookie filtering. type: str choices: [disable, enable] more...
    • web-filter-cookie-removal-log - Enable/disable logging blocked cookies. type: str choices: [disable, enable] more...
    • web-filter-js-log - Enable/disable logging Java scripts. type: str choices: [disable, enable] more...
    • web-filter-jscript-log - Enable/disable logging JScripts. type: str choices: [disable, enable] more...
    • web-filter-referer-log - Enable/disable logging referrers. type: str choices: [disable, enable] more...
    • web-filter-unknown-log - Enable/disable logging unknown scripts. type: str choices: [disable, enable] more...
    • web-filter-vbs-log - Enable/disable logging VBS scripts. type: str choices: [disable, enable] more...
    • web-ftgd-err-log - Enable/disable logging rating errors. type: str choices: [disable, enable] more...
    • web-ftgd-quota-usage - Enable/disable logging daily quota usage. type: str choices: [disable, enable] more...
    • web-invalid-domain-log - Enable/disable logging invalid domain names. type: str choices: [disable, enable] more...
    • web-url-log - Enable/disable logging URL filtering. type: str choices: [disable, enable] more...
    • wisp - Enable/disable web proxy WISP. type: str choices: [disable, enable] more...
    • wisp-algorithm - WISP server selection algorithm. type: str choices: [auto-learning, primary-secondary, round-robin] more...
    • wisp-servers - WISP servers. type: str more...
    • youtube-channel-filter - Youtube-Channel-Filter. type: array more...
      • channel-id - YouTube channel ID to be filtered. type: str more...
      • comment - Comment. type: str more...
      • id - ID. type: int more...
    • youtube-channel-status - YouTube channel filter status. type: str choices: [disable, blacklist, whitelist] more...
    • feature-set - Flow/proxy feature set. type: str choices: [proxy, flow] more...
    • web-antiphishing-log - Enable/disable logging of AntiPhishing checks. type: str choices: [disable, enable] more...
    • antiphish type: dict
      • check-basic-auth - Enable/disable checking of HTTP Basic Auth field for known credentials. type: str choices: [disable, enable] more...
      • check-uri - Enable/disable checking of GET URI parameters for known credentials. type: str choices: [disable, enable] more...
      • check-username-only - Enable/disable acting only on valid username credentials. type: str choices: [disable, enable] more...
      • custom-patterns - Custom-Patterns. type: array more...
        • category - Category that the pattern matches. type: str choices: [username, password] more...
        • pattern - Target pattern. type: str more...
        • type - Pattern will be treated either as a regex pattern or literal string. type: str choices: [regex, literal] more...
      • default-action - Action to be taken when there is no matching rule. type: str choices: [log, block, exempt] more...
      • domain-controller - Domain for which to verify received credentials against. type: str more...
      • inspection-entries - Inspection-Entries. type: array more...
        • action - Action to be taken upon an AntiPhishing match. type: str choices: [log, block, exempt] more...
        • fortiguard-category - FortiGuard category to match. type: str more...
        • name - Inspection target name. type: str more...
      • max-body-len - Maximum size of a POST body to check for credentials. type: int more...
      • status - Toggle AntiPhishing functionality. type: str choices: [disable, enable] more...
      • authentication - Authentication methods. type: str choices: [domain-controller, ldap] more...
      • ldap - LDAP server for which to verify received credentials against. type: str more...
    • ftgd-wf type: dict
      • exempt-quota - Do not stop quota for these categories. type: str more...
      • filters - Filters. type: array more...
        • action - Action to take for matches. type: str choices: [block, monitor, warning, authenticate] more...
        • auth-usr-grp - Groups with permission to authenticate. type: str more...
        • category - Categories and groups the filter examines. type: str more...
        • id - ID number. type: int more...
        • log - Enable/disable logging. type: str choices: [disable, enable] more...
        • override-replacemsg - Override replacement message. type: str more...
        • warn-duration - Duration of warnings. type: str more...
        • warning-duration-type - Re-display warning after closing browser or after a timeout. type: str choices: [session, timeout] more...
        • warning-prompt - Warning prompts in each category or each domain. type: str choices: [per-domain, per-category] more...
      • max-quota-timeout - Maximum FortiGuard quota used by single page view in seconds (excludes streams). type: int more...
      • options - Options for FortiGuard Web Filter. type: array choices: [error-allow, http-err-detail, rate-image-urls, strict-blocking, rate-server-ip, redir-block, connect-request-bypass, log-all-url, ftgd-disable] more...
      • ovrd - Allow web filter profile overrides. type: str more...
      • quota - Quota. type: array more...
        • category - FortiGuard categories to apply quota to (category action must be set to monitor). type: str more...
        • duration - Duration of quota. type: str more...
        • id - ID number. type: int more...
        • override-replacemsg - Override replacement message. type: str more...
        • type - Quota type. type: str choices: [time, traffic] more...
        • unit - Traffic quota unit of measurement. type: str choices: [B, KB, MB, GB] more...
        • value - Traffic quota value. type: int more...
      • rate-crl-urls - Enable/disable rating CRL by URL. type: str choices: [disable, enable] more...
      • rate-css-urls - Enable/disable rating CSS by URL. type: str choices: [disable, enable] more...
      • rate-image-urls - Rate-Image-Urls. type: str choices: [disable, enable] more...
      • rate-javascript-urls - Enable/disable rating JavaScript by URL. type: str choices: [disable, enable] more...
    • override type: dict
      • ovrd-cookie - Allow/deny browser-based (cookie) overrides. type: str choices: [deny, allow] more...
      • ovrd-dur - Override duration. type: str more...
      • ovrd-dur-mode - Override duration mode. type: str choices: [constant, ask] more...
      • ovrd-scope - Override scope. type: str choices: [user, user-group, ip, ask, browser] more...
      • ovrd-user-group - User groups with permission to use the override. type: str more...
      • profile - Web filter profile with permission to create overrides. type: str more...
      • profile-attribute - Profile attribute to retrieve from the RADIUS server. type: str choices: [User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port] more...
      • profile-type - Override profile type. type: str choices: [list, radius] more...
    • url-extraction type: dict
      • redirect-header - HTTP header name to use for client redirect on blocked requests type: str more...
      • redirect-no-content - Enable / Disable empty message-body entity in HTTP response type: str choices: [disable, enable] more...
      • redirect-url - HTTP header value to use for client redirect on blocked requests type: str more...
      • server-fqdn - URL extraction server FQDN (fully qualified domain name) type: str more...
      • status - Enable URL Extraction type: str choices: [disable, enable] more...
    • web type: dict
      • blacklist - Enable/disable automatic addition of URLs detected by FortiSandbox to blacklist. type: str choices: [disable, enable] more...
      • bword-table - Banned word table ID. type: str more...
      • bword-threshold - Banned word score threshold. type: int more...
      • content-header-list - Content header list. type: str more...
      • keyword-match - Search keywords to log when match is found. type: str more...
      • log-search - Enable/disable logging all search phrases. type: str choices: [disable, enable] more...
      • safe-search - Safe search type. type: array choices: [google, yahoo, bing, url, header] more...
      • urlfilter-table - URL filter table ID. type: str more...
      • whitelist - FortiGuard whitelist settings. type: array choices: [exempt-av, exempt-webcontent, exempt-activex-java-cookie, exempt-dlp, exempt-rangeblock, extended-log-others] more...
      • youtube-restrict - YouTube EDU filter level. type: str choices: [strict, none, moderate] more...
      • allowlist - FortiGuard allowlist settings. type: array choices: [exempt-av, exempt-webcontent, exempt-activex-java-cookie, exempt-dlp, exempt-rangeblock, extended-log-others] more...
      • blocklist - Enable/disable automatic addition of URLs detected by FortiSandbox to blocklist. type: str choices: [disable, enable] more...
      • vimeo-restrict - Set Vimeo-restrict ("7" = dont show mature content, "134" = dont show unrated and mature content). type: str more...

Notes

Note

  • Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.
  • To create or update an object, use state: present directive.
  • To delete an object, use state: absent directive
  • Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded

Examples

- hosts: fortimanager-inventory
  collections:
    - fortinet.fortimanager
  connection: httpapi
  vars:
     ansible_httpapi_use_ssl: True
     ansible_httpapi_validate_certs: False
     ansible_httpapi_port: 443
  tasks:
   - name: no description
     fmgr_webfilter_profile:
        bypass_validation: False
        workspace_locking_adom: <value in [global, custom adom including root]>
        workspace_locking_timeout: 300
        rc_succeeded: [0, -2, -3, ...]
        rc_failed: [-2, -3, ...]
        adom: <your own value>
        state: <value in [present, absent]>
        webfilter_profile:
           comment: <value of string>
           extended-log: <value in [disable, enable]>
           https-replacemsg: <value in [disable, enable]>
           inspection-mode: <value in [proxy, flow-based, dns]>
           log-all-url: <value in [disable, enable]>
           name: <value of string>
           options:
             - block-invalid-url
             - jscript
             - js
             - vbs
             - unknown
             - wf-referer
             - https-scan
             - intrinsic
             - wf-cookie
             - per-user-bwl
             - activexfilter
             - cookiefilter
             - https-url-scan
             - javafilter
             - rangeblock
             - contenttype-check
             - per-user-bal
           ovrd-perm:
             - bannedword-override
             - urlfilter-override
             - fortiguard-wf-override
             - contenttype-check-override
           post-action: <value in [normal, comfort, block]>
           replacemsg-group: <value of string>
           web-content-log: <value in [disable, enable]>
           web-extended-all-action-log: <value in [disable, enable]>
           web-filter-activex-log: <value in [disable, enable]>
           web-filter-applet-log: <value in [disable, enable]>
           web-filter-command-block-log: <value in [disable, enable]>
           web-filter-cookie-log: <value in [disable, enable]>
           web-filter-cookie-removal-log: <value in [disable, enable]>
           web-filter-js-log: <value in [disable, enable]>
           web-filter-jscript-log: <value in [disable, enable]>
           web-filter-referer-log: <value in [disable, enable]>
           web-filter-unknown-log: <value in [disable, enable]>
           web-filter-vbs-log: <value in [disable, enable]>
           web-ftgd-err-log: <value in [disable, enable]>
           web-ftgd-quota-usage: <value in [disable, enable]>
           web-invalid-domain-log: <value in [disable, enable]>
           web-url-log: <value in [disable, enable]>
           wisp: <value in [disable, enable]>
           wisp-algorithm: <value in [auto-learning, primary-secondary, round-robin]>
           wisp-servers: <value of string>
           youtube-channel-filter:
             -
                 channel-id: <value of string>
                 comment: <value of string>
                 id: <value of integer>
           youtube-channel-status: <value in [disable, blacklist, whitelist]>
           feature-set: <value in [proxy, flow]>
           web-antiphishing-log: <value in [disable, enable]>
           antiphish:
              check-basic-auth: <value in [disable, enable]>
              check-uri: <value in [disable, enable]>
              check-username-only: <value in [disable, enable]>
              custom-patterns:
                -
                    category: <value in [username, password]>
                    pattern: <value of string>
                    type: <value in [regex, literal]>
              default-action: <value in [log, block, exempt]>
              domain-controller: <value of string>
              inspection-entries:
                -
                    action: <value in [log, block, exempt]>
                    fortiguard-category: <value of string>
                    name: <value of string>
              max-body-len: <value of integer>
              status: <value in [disable, enable]>
              authentication: <value in [domain-controller, ldap]>
              ldap: <value of string>
           ftgd-wf:
              exempt-quota: <value of string>
              filters:
                -
                    action: <value in [block, monitor, warning, ...]>
                    auth-usr-grp: <value of string>
                    category: <value of string>
                    id: <value of integer>
                    log: <value in [disable, enable]>
                    override-replacemsg: <value of string>
                    warn-duration: <value of string>
                    warning-duration-type: <value in [session, timeout]>
                    warning-prompt: <value in [per-domain, per-category]>
              max-quota-timeout: <value of integer>
              options:
                - error-allow
                - http-err-detail
                - rate-image-urls
                - strict-blocking
                - rate-server-ip
                - redir-block
                - connect-request-bypass
                - log-all-url
                - ftgd-disable
              ovrd: <value of string>
              quota:
                -
                    category: <value of string>
                    duration: <value of string>
                    id: <value of integer>
                    override-replacemsg: <value of string>
                    type: <value in [time, traffic]>
                    unit: <value in [B, KB, MB, ...]>
                    value: <value of integer>
              rate-crl-urls: <value in [disable, enable]>
              rate-css-urls: <value in [disable, enable]>
              rate-image-urls: <value in [disable, enable]>
              rate-javascript-urls: <value in [disable, enable]>
           override:
              ovrd-cookie: <value in [deny, allow]>
              ovrd-dur: <value of string>
              ovrd-dur-mode: <value in [constant, ask]>
              ovrd-scope: <value in [user, user-group, ip, ...]>
              ovrd-user-group: <value of string>
              profile: <value of string>
              profile-attribute: <value in [User-Name, User-Password, CHAP-Password, ...]>
              profile-type: <value in [list, radius]>
           url-extraction:
              redirect-header: <value of string>
              redirect-no-content: <value in [disable, enable]>
              redirect-url: <value of string>
              server-fqdn: <value of string>
              status: <value in [disable, enable]>
           web:
              blacklist: <value in [disable, enable]>
              bword-table: <value of string>
              bword-threshold: <value of integer>
              content-header-list: <value of string>
              keyword-match: <value of string>
              log-search: <value in [disable, enable]>
              safe-search:
                - google
                - yahoo
                - bing
                - url
                - header
              urlfilter-table: <value of string>
              whitelist:
                - exempt-av
                - exempt-webcontent
                - exempt-activex-java-cookie
                - exempt-dlp
                - exempt-rangeblock
                - extended-log-others
              youtube-restrict: <value in [strict, none, moderate]>
              allowlist:
                - exempt-av
                - exempt-webcontent
                - exempt-activex-java-cookie
                - exempt-dlp
                - exempt-rangeblock
                - extended-log-others
              blocklist: <value in [disable, enable]>
              vimeo-restrict: <value of string>

Return Values

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

  • request_url - The full url requested returned: always type: str sample: /sys/login/user
  • response_code - The status of api request returned: always type: int sample: 0
  • response_message - The descriptive message of the api response returned: always type: str sample: OK
  • response_data - The data body of the api response returned: optional type: list or dict

Status

  • This module is not guaranteed to have a backwards compatible interface.

Authors

  • Link Zheng (@chillancezen)
  • Jie Xue (@JieX19)
  • Frank Shen (@fshen01)
  • Hongbin Lu (@fgtdev-hblu)

Hint

If you notice any issues in this documentation, you can create a pull request to improve it.