fortios_firewall_policy – Настройка политики IPv4

• Обзор
• Требования
• Параметры
• Примечания
• Примеры
• Возвращаемые значения
• Статус

Обзор

• Этот модуль позволяет настраивать FortiGate или FortiOS, предоставляя пользователю возможность настраивать категорию функций и политик брандмауэра. Примеры включают все варианты и должны быть настроены под источники данных перед использованием. Тестировано с FOS v6.0.2

Требования

Ниже перечислены требования к хосту, на котором будет выполняться этот модуль.

• fortiosapi>=0.9.8

Параметры

Примечания

Примеры

- hosts: localhost
  vars:
   host: "192.168.122.40"
   username: "admin"
   password: ""
   vdom: "root"
  tasks:
  - name: Configure IPv4 policies.
    fortios_firewall_policy:
      host:  "{{ host }}"
      username: "{{ username }}"
      password: "{{ password }}"
      vdom:  "{{ vdom }}"
      firewall_policy:
        state: "present"
        action: "accept"
        app-category:
         -
            id:  "5"
        app-group:
         -
            name: "default_name_7 (source application.group.name)"
        application:
         -
            id:  "9"
        application-list: "<your_own_value> (source application.list.name)"
        auth-cert: "<your_own_value> (source vpn.certificate.local.name)"
        auth-path: "enable"
        auth-redirect-addr: "<your_own_value>"
        av-profile: "<your_own_value> (source antivirus.profile.name)"
        block-notification: "enable"
        captive-portal-exempt: "enable"
        capture-packet: "enable"
        comments: "<your_own_value>"
        custom-log-fields:
         -
            field-id: "<your_own_value> (source log.custom-field.id)"
        delay-tcp-npu-session: "enable"
        devices:
         -
            name: "default_name_23 (source user.device.alias user.device-group.name user.device-category.name)"
        diffserv-forward: "enable"
        diffserv-reverse: "enable"
        diffservcode-forward: "<your_own_value>"
        diffservcode-rev: "<your_own_value>"
        disclaimer: "enable"
        dlp-sensor: "<your_own_value> (source dlp.sensor.name)"
        dnsfilter-profile: "<your_own_value> (source dnsfilter.profile.name)"
        dscp-match: "enable"
        dscp-negate: "enable"
        dscp-value: "<your_own_value>"
        dsri: "enable"
        dstaddr:
         -
            name: "default_name_36 (source firewall.address.name firewall.addrgrp.name firewall.vip.name firewall.vipgrp.name)"
        dstaddr-negate: "enable"
        dstintf:
         -
            name: "default_name_39 (source system.interface.name system.zone.name)"
        firewall-session-dirty: "check-all"
        fixedport: "enable"
        fsso: "enable"
        fsso-agent-for-ntlm: "<your_own_value> (source user.fsso.name)"
        global-label: "<your_own_value>"
        groups:
         -
            name: "default_name_46 (source user.group.name)"
        icap-profile: "<your_own_value> (source icap.profile.name)"
        identity-based-route: "<your_own_value> (source firewall.identity-based-route.name)"
        inbound: "enable"
        internet-service: "enable"
        internet-service-custom:
         -
            name: "default_name_52 (source firewall.internet-service-custom.name)"
        internet-service-id:
         -
            id:  "54 (source firewall.internet-service.id)"
        internet-service-negate: "enable"
        internet-service-src: "enable"
        internet-service-src-custom:
         -
            name: "default_name_58 (source firewall.internet-service-custom.name)"
        internet-service-src-id:
         -
            id:  "60 (source firewall.internet-service.id)"
        internet-service-src-negate: "enable"
        ippool: "enable"
        ips-sensor: "<your_own_value> (source ips.sensor.name)"
        label: "<your_own_value>"
        learning-mode: "enable"
        logtraffic: "all"
        logtraffic-start: "enable"
        match-vip: "enable"
        name: "default_name_69"
        nat: "enable"
        natinbound: "enable"
        natip: "<your_own_value>"
        natoutbound: "enable"
        ntlm: "enable"
        ntlm-enabled-browsers:
         -
            user-agent-string: "<your_own_value>"
        ntlm-guest: "enable"
        outbound: "enable"
        per-ip-shaper: "<your_own_value> (source firewall.shaper.per-ip-shaper.name)"
        permit-any-host: "enable"
        permit-stun-host: "enable"
        policyid: "82"
        poolname:
         -
            name: "default_name_84 (source firewall.ippool.name)"
        profile-group: "<your_own_value> (source firewall.profile-group.name)"
        profile-protocol-options: "<your_own_value> (source firewall.profile-protocol-options.name)"
        profile-type: "single"
        radius-mac-auth-bypass: "enable"
        redirect-url: "<your_own_value>"
        replacemsg-override-group: "<your_own_value> (source system.replacemsg-group.name)"
        rsso: "enable"
        rtp-addr:
         -
            name: "default_name_93 (source firewall.address.name firewall.addrgrp.name)"
        rtp-nat: "disable"
        scan-botnet-connections: "disable"
        schedule: "<your_own_value> (source firewall.schedule.onetime.name firewall.schedule.recurring.name firewall.schedule.group.name)"
        schedule-timeout: "enable"
        send-deny-packet: "disable"
        service:
         -
            name: "default_name_100 (source firewall.service.custom.name firewall.service.group.name)"
        service-negate: "enable"
        session-ttl: "102"
        spamfilter-profile: "<your_own_value> (source spamfilter.profile.name)"
        srcaddr:
         -
            name: "default_name_105 (source firewall.address.name firewall.addrgrp.name)"
        srcaddr-negate: "enable"
        srcintf:
         -
            name: "default_name_108 (source system.interface.name system.zone.name)"
        ssh-filter-profile: "<your_own_value> (source ssh-filter.profile.name)"
        ssl-mirror: "enable"
        ssl-mirror-intf:
         -
            name: "default_name_112 (source system.interface.name system.zone.name)"
        ssl-ssh-profile: "<your_own_value> (source firewall.ssl-ssh-profile.name)"
        status: "enable"
        tcp-mss-receiver: "115"
        tcp-mss-sender: "116"
        tcp-session-without-syn: "all"
        timeout-send-rst: "enable"
        traffic-shaper: "<your_own_value> (source firewall.shaper.traffic-shaper.name)"
        traffic-shaper-reverse: "<your_own_value> (source firewall.shaper.traffic-shaper.name)"
        url-category:
         -
            id:  "122"
        users:
         -
            name: "default_name_124 (source user.local.name)"
        utm-status: "enable"
        uuid: "<your_own_value>"
        vlan-cos-fwd: "127"
        vlan-cos-rev: "128"
        vlan-filter: "<your_own_value>"
        voip-profile: "<your_own_value> (source voip.profile.name)"
        vpntunnel: "<your_own_value> (source vpn.ipsec.phase1.name vpn.ipsec.manualkey.name)"
        waf-profile: "<your_own_value> (source waf.profile.name)"
        wanopt: "enable"
        wanopt-detection: "active"
        wanopt-passive-opt: "default"
        wanopt-peer: "<your_own_value> (source wanopt.peer.peer-host-id)"
        wanopt-profile: "<your_own_value> (source wanopt.profile.name)"
        wccp: "enable"
        webcache: "enable"
        webcache-https: "disable"
        webfilter-profile: "<your_own_value> (source webfilter.profile.name)"
        wsso: "enable"

Значения возврата

Общие значения возврата описаны здесь, следующие поля уникальны для данного модуля:

Статус

• Данный модуль не гарантирует обратной совместимости. [превью]
• Этот модуль поддерживается сообществом Ansible. [community]

Авторы

• Miguel Angel Munoz (@mamunozgonzalez)
• Nicolas Thomas (@thomnico)