fortinet.fortimanager.fmgr_pkg_firewall_policy_obj – Настройка политик IPv4.
Примечание
Этот плагин входит в коллекцию fortinet.fortimanager (версия 1.0.5).
Для его установки используйте: ansible-galaxy collection install fortinet.fortimanager.
Для использования в плейбуке укажите: fortinet.fortimanager.fmgr_pkg_firewall_policy_obj.
Новое в версии 2.10: модуля fortinet.fortimanager
Обзор
- Этот модуль позволяет настраивать устройство FortiManager, позволяя пользователю [ клонировать, удалить, получить, переместить, установить, обновить ] следующие API.
- /pm/config/adom/{adom}/pkg/{pkg}/firewall/policy/{policy}
- Примеры включают все параметры и значения, которые необходимо скорректировать для использования из источников данных.
Параметры
| Параметр | Варианты/Значения по умолчанию | Комментарии |
|---|---|---|
| loose_validation boolean |
| Проверка параметров в свободном режиме |
| method строка / обязательный |
| Метод запроса |
| params список / элементы=строка | Параметры для каждого метода Полный список параметров см. в https://ansible-galaxy-fortimanager-docs.readthedocs.io/en/latest | |
| url_params словарь | Параметры для каждого URL-адреса API-запроса Полный список параметров URL также см. в https://ansible-galaxy-fortimanager-docs.readthedocs.io/en/latest | |
| workspace_locking_adom строка | Имя adom для блокировки в случае работы FortiManager в режиме рабочего пространства Может быть глобальным или любым другим именем настраиваемого adom | |
| workspace_locking_timeout целое число | По умолчанию: 300 | Максимальное время в секундах ожидания освобождения блокировки рабочего пространства другим пользователем |
Примечания
Примечание
- Существует только три параметра верхнего уровня, где «method» всегда требуется, а два других «params» и «url_params» могут быть необязательными
- Из-за сложности схемы API fortimanager, проверка выполняется вне стандартной процедуры проверки параметров Ansible.
- Синтаксис OPTIONS не соответствует стандартной спецификации аргументов Ansible, но в соответствии со структурой схемы API fortimanager нам нужна тривиальная трансформация при заполнении плейбука Ansible
Примеры
- hosts: fortimanager-inventory
collections:
- fortinet.fortimanager
connection: httpapi
vars:
ansible_httpapi_use_ssl: True
ansible_httpapi_validate_certs: False
ansible_httpapi_port: 443
tasks:
- name: REQUESTING /PM/CONFIG/PKG/{PKG}/FIREWALL/POLICY/{POLICY}
fmgr_pkg_firewall_policy_obj:
loose_validation: False
workspace_locking_adom: <value in [global, custom adom]>
workspace_locking_timeout: 300
method: <value in [clone, update]>
url_params:
adom: <value in [none, global, custom dom]>
pkg: <value of string>
policy: <value of string>
params:
-
data:
action: <value in [deny, accept, ipsec, ...]>
app-category: <value of string>
application:
- <value of integer>
application-list: <value of string>
auth-cert: <value of string>
auth-path: <value in [disable, enable]>
auth-redirect-addr: <value of string>
auto-asic-offload: <value in [disable, enable]>
av-profile: <value of string>
block-notification: <value in [disable, enable]>
captive-portal-exempt: <value in [disable, enable]>
capture-packet: <value in [disable, enable]>
comments: <value of string>
custom-log-fields: <value of string>
delay-tcp-npu-session: <value in [disable, enable]>
devices: <value of string>
diffserv-forward: <value in [disable, enable]>
diffserv-reverse: <value in [disable, enable]>
diffservcode-forward: <value of string>
diffservcode-rev: <value of string>
disclaimer: <value in [disable, enable]>
dlp-sensor: <value of string>
dnsfilter-profile: <value of string>
dscp-match: <value in [disable, enable]>
dscp-negate: <value in [disable, enable]>
dscp-value: <value of string>
dsri: <value in [disable, enable]>
dstaddr: <value of string>
dstaddr-negate: <value in [disable, enable]>
dstintf: <value of string>
firewall-session-dirty: <value in [check-all, check-new]>
fixedport: <value in [disable, enable]>
fsso: <value in [disable, enable]>
fsso-agent-for-ntlm: <value of string>
global-label: <value of string>
groups: <value of string>
gtp-profile: <value of string>
icap-profile: <value of string>
identity-based-route: <value of string>
inbound: <value in [disable, enable]>
internet-service: <value in [disable, enable]>
internet-service-custom: <value of string>
internet-service-id: <value of string>
internet-service-negate: <value in [disable, enable]>
ippool: <value in [disable, enable]>
ips-sensor: <value of string>
label: <value of string>
learning-mode: <value in [disable, enable]>
logtraffic: <value in [disable, enable, all, ...]>
logtraffic-start: <value in [disable, enable]>
match-vip: <value in [disable, enable]>
mms-profile: <value of string>
name: <value of string>
nat: <value in [disable, enable]>
natinbound: <value in [disable, enable]>
natip: <value of string>
natoutbound: <value in [disable, enable]>
ntlm: <value in [disable, enable]>
ntlm-enabled-browsers:
- <value of string>
ntlm-guest: <value in [disable, enable]>
outbound: <value in [disable, enable]>
per-ip-shaper: <value of string>
permit-any-host: <value in [disable, enable]>
permit-stun-host: <value in [disable, enable]>
policyid: <value of integer>
poolname: <value of string>
profile-group: <value of string>
profile-protocol-options: <value of string>
profile-type: <value in [single, group]>
radius-mac-auth-bypass: <value in [disable, enable]>
redirect-url: <value of string>
replacemsg-override-group: <value of string>
rsso: <value in [disable, enable]>
rtp-addr: <value of string>
rtp-nat: <value in [disable, enable]>
scan-botnet-connections: <value in [disable, block, monitor]>
schedule: <value of string>
schedule-timeout: <value in [disable, enable]>
send-deny-packet: <value in [disable, enable]>
service: <value of string>
service-negate: <value in [disable, enable]>
session-ttl: <value of integer>
spamfilter-profile: <value of string>
srcaddr: <value of string>
srcaddr-negate: <value in [disable, enable]>
srcintf: <value of string>
ssl-mirror: <value in [disable, enable]>
ssl-mirror-intf: <value of string>
ssl-ssh-profile: <value of string>
status: <value in [disable, enable]>
tags: <value of string>
tcp-mss-receiver: <value of integer>
tcp-mss-sender: <value of integer>
tcp-session-without-syn: <value in [all, data-only, disable]>
timeout-send-rst: <value in [disable, enable]>
traffic-shaper: <value of string>
traffic-shaper-reverse: <value of string>
url-category: <value of string>
users: <value of string>
utm-status: <value in [disable, enable]>
uuid: <value of string>
vlan-cos-fwd: <value of integer>
vlan-cos-rev: <value of integer>
voip-profile: <value of string>
vpn_dst_node:
-
host: <value of string>
seq: <value of integer>
subnet: <value of string>
vpn_src_node:
-
host: <value of string>
seq: <value of integer>
subnet: <value of string>
vpntunnel: <value of string>
waf-profile: <value of string>
wanopt: <value in [disable, enable]>
wanopt-detection: <value in [active, passive, off]>
wanopt-passive-opt: <value in [default, transparent, non-transparent]>
wanopt-peer: <value of string>
wanopt-profile: <value of string>
wccp: <value in [disable, enable]>
webcache: <value in [disable, enable]>
webcache-https: <value in [disable, ssl-server, any, ...]>
webfilter-profile: <value of string>
wsso: <value in [disable, enable]>
- name: REQUESTING /PM/CONFIG/PKG/{PKG}/FIREWALL/POLICY/{POLICY}
fmgr_pkg_firewall_policy_obj:
loose_validation: False
workspace_locking_adom: <value in [global, custom adom]>
workspace_locking_timeout: 300
method: <value in [delete]>
url_params:
adom: <value in [none, global, custom dom]>
pkg: <value of string>
policy: <value of string>
params:
-
data:
attr: <value in [label, global-label]>
name: <value of string>
- name: REQUESTING /PM/CONFIG/PKG/{PKG}/FIREWALL/POLICY/{POLICY}
fmgr_pkg_firewall_policy_obj:
loose_validation: False
workspace_locking_adom: <value in [global, custom adom]>
workspace_locking_timeout: 300
method: <value in [get]>
url_params:
adom: <value in [none, global, custom dom]>
pkg: <value of string>
policy: <value of string>
params:
-
option: <value in [object member, chksum, datasrc]>
- name: REQUESTING /PM/CONFIG/PKG/{PKG}/FIREWALL/POLICY/{POLICY}
fmgr_pkg_firewall_policy_obj:
loose_validation: False
workspace_locking_adom: <value in [global, custom adom]>
workspace_locking_timeout: 300
method: <value in [move]>
url_params:
adom: <value in [none, global, custom dom]>
pkg: <value of string>
policy: <value of string>
params:
-
option: <value in [before, after]>
target: <value of string>
- name: REQUESTING /PM/CONFIG/PKG/{PKG}/FIREWALL/POLICY/{POLICY}
fmgr_pkg_firewall_policy_obj:
loose_validation: False
workspace_locking_adom: <value in [global, custom adom]>
workspace_locking_timeout: 300
method: <value in [set]>
url_params:
adom: <value in [none, global, custom dom]>
pkg: <value of string>
policy: <value of string>
params:
-
data:
action: <value in [deny, accept, ipsec, ...]>
app-category: <value of string>
application:
- <value of integer>
application-list: <value of string>
auth-cert: <value of string>
auth-path: <value in [disable, enable]>
auth-redirect-addr: <value of string>
auto-asic-offload: <value in [disable, enable]>
av-profile: <value of string>
block-notification: <value in [disable, enable]>
captive-portal-exempt: <value in [disable, enable]>
capture-packet: <value in [disable, enable]>
comments: <value of string>
custom-log-fields: <value of string>
delay-tcp-npu-session: <value in [disable, enable]>
devices: <value of string>
diffserv-forward: <value in [disable, enable]>
diffserv-reverse: <value in [disable, enable]>
diffservcode-forward: <value of string>
diffservcode-rev: <value of string>
disclaimer: <value in [disable, enable]>
dlp-sensor: <value of string>
dnsfilter-profile: <value of string>
dscp-match: <value in [disable, enable]>
dscp-negate: <value in [disable, enable]>
dscp-value: <value of string>
dsri: <value in [disable, enable]>
dstaddr: <value of string>
dstaddr-negate: <value in [disable, enable]>
dstintf: <value of string>
firewall-session-dirty: <value in [check-all, check-new]>
fixedport: <value in [disable, enable]>
fsso: <value in [disable, enable]>
fsso-agent-for-ntlm: <value of string>
global-label: <value of string>
groups: <value of string>
gtp-profile: <value of string>
icap-profile: <value of string>
identity-based-route: <value of string>
inbound: <value in [disable, enable]>
internet-service: <value in [disable, enable]>
internet-service-custom: <value of string>
internet-service-id: <value of string>
internet-service-negate: <value in [disable, enable]>
ippool: <value in [disable, enable]>
ips-sensor: <value of string>
label: <value of string>
learning-mode: <value in [disable, enable]>
logtraffic: <value in [disable, enable, all, ...]>
logtraffic-start: <value in [disable, enable]>
match-vip: <value in [disable, enable]>
mms-profile: <value of string>
name: <value of string>
nat: <value in [disable, enable]>
natinbound: <value in [disable, enable]>
natip: <value of string>
natoutbound: <value in [disable, enable]>
ntlm: <value in [disable, enable]>
ntlm-enabled-browsers:
- <value of string>
ntlm-guest: <value in [disable, enable]>
outbound: <value in [disable, enable]>
per-ip-shaper: <value of string>
permit-any-host: <value in [disable, enable]>
permit-stun-host: <value in [disable, enable]>
policyid: <value of integer>
poolname: <value of string>
profile-group: <value of string>
profile-protocol-options: <value of string>
profile-type: <value in [single, group]>
radius-mac-auth-bypass: <value in [disable, enable]>
redirect-url: <value of string>
replacemsg-override-group: <value of string>
rsso: <value in [disable, enable]>
rtp-addr: <value of string>
rtp-nat: <value in [disable, enable]>
scan-botnet-connections: <value in [disable, block, monitor]>
schedule: <value of string>
schedule-timeout: <value in [disable, enable]>
send-deny-packet: <value in [disable, enable]>
service: <value of string>
service-negate: <value in [disable, enable]>
session-ttl: <value of integer>
spamfilter-profile: <value of string>
srcaddr: <value of string>
srcaddr-negate: <value in [disable, enable]>
srcintf: <value of string>
ssl-mirror: <value in [disable, enable]>
ssl-mirror-intf: <value of string>
ssl-ssh-profile: <value of string>
status: <value in [disable, enable]>
tags: <value of string>
tcp-mss-receiver: <value of integer>
tcp-mss-sender: <value of integer>
tcp-session-without-syn: <value in [all, data-only, disable]>
timeout-send-rst: <value in [disable, enable]>
traffic-shaper: <value of string>
traffic-shaper-reverse: <value of string>
url-category: <value of string>
users: <value of string>
utm-status: <value in [disable, enable]>
uuid: <value of string>
vlan-cos-fwd: <value of integer>
vlan-cos-rev: <value of integer>
voip-profile: <value of string>
vpn_dst_node:
-
host: <value of string>
seq: <value of integer>
subnet: <value of string>
vpn_src_node:
-
host: <value of string>
seq: <value of integer>
subnet: <value of string>
vpntunnel: <value of string>
waf-profile: <value of string>
wanopt: <value in [disable, enable]>
wanopt-detection: <value in [active, passive, off]>
wanopt-passive-opt: <value in [default, transparent, non-transparent]>
wanopt-peer: <value of string>
wanopt-profile: <value of string>
wccp: <value in [disable, enable]>
webcache: <value in [disable, enable]>
webcache-https: <value in [disable, ssl-server, any, ...]>
webfilter-profile: <value of string>
wsso: <value in [disable, enable]>
- name: REQUESTING /PM/CONFIG/PKG/{PKG}/FIREWALL/POLICY/{POLICY}
fmgr_pkg_firewall_policy_obj:
loose_validation: False
workspace_locking_adom: <value in [global, custom adom]>
workspace_locking_timeout: 300
method: <value in [set]>
url_params:
adom: <value in [none, global, custom dom]>
pkg: <value of string>
policy: <value of string>
params:
-
data:
attr: <value in [label, global-label]>
name: <value of string>
Возвращаемые значения
Общие возвращаемые значения документированы здесь, следующие поля уникальны для этого модуля:
| Ключ | Возвращаемое значение | Описание |
|---|---|---|
| data словарь | всегда | Полезная нагрузка, возвращаемая в запросе |
| status словарь | всегда | Статус запроса API |
| url строка | всегда | Полный запрошенный URL Пример: /sys/login/user |
Авторы
- Frank Shen (@fshen01)
- Link Zheng (@zhengl)
© 2012–2018 Michael DeHaan
© 2018–2019 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/2.10/collections/fortinet/fortimanager/fmgr_pkg_firewall_policy_obj_module.html
