fortios_system_settings – Configure VDOM settings in Fortinet’s FortiOS and FortiGate — Ansible Documentation

- AnsibleFest
- Products
- Community
- Webinars & Training
- Blog

Documentation

# fortios_system_settings – Configure VDOM settings in Fortinet’s FortiOS and FortiGate

New in version 2.8.

- Synopsis
- Requirements
- Parameters
- Notes
- Examples
- Return Values
- Status

## Synopsis

- This module is able to configure a FortiGate or FortiOS by allowing the user to configure system feature and settings category. Examples includes all options and need to be adjusted to datasources before usage. Tested with FOS v6.0.2

## Requirements

The below requirements are needed on the host that executes this module.

- fortiosapi>=0.9.8

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
host - / required |  | FortiOS or FortiGate ip adress.
https boolean | Choices: no yes ← | Indicates if the requests towards FortiGate must use HTTPS protocol
password - | Default: "" | FortiOS or FortiGate password.
system_settings - | Default: null | Configure VDOM settings.
| allow-subnet-overlap - | Choices: enable disable | Enable/disable allowing interface subnets to use overlapping IP addresses.
| asymroute - | Choices: enable disable | Enable/disable IPv4 asymmetric routing.
| asymroute-icmp - | Choices: enable disable | Enable/disable ICMP asymmetric routing.
| asymroute6 - | Choices: enable disable | Enable/disable asymmetric IPv6 routing.
| asymroute6-icmp - | Choices: enable disable | Enable/disable asymmetric ICMPv6 routing.
| bfd - | Choices: enable disable | Enable/disable Bi-directional Forwarding Detection (BFD) on all interfaces.
| bfd-desired-min-tx - |  | BFD desired minimal transmit interval (1 - 100000 ms, default = 50).
| bfd-detect-mult - |  | BFD detection multiplier (1 - 50, default = 3).
| bfd-dont-enforce-src-port - | Choices: enable disable | Enable to not enforce verifying the source port of BFD Packets.
| bfd-required-min-rx - |  | BFD required minimal receive interval (1 - 100000 ms, default = 50).
| block-land-attack - | Choices: disable enable | Enable/disable blocking of land attacks.
| central-nat - | Choices: enable disable | Enable/disable central NAT.
| comments - |  | VDOM comments.
| compliance-check - | Choices: enable disable | Enable/disable PCI DSS compliance checking.
| default-voip-alg-mode - | Choices: proxy-based kernel-helper-based | Configure how the FortiGate handles VoIP traffic when a policy that accepts the traffic doesn't include a VoIP profile.
| deny-tcp-with-icmp - | Choices: enable disable | Enable/disable denying TCP by sending an ICMP communication prohibited packet.
| device - |  | Interface to use for management access for NAT mode. Source system.interface.name.
| dhcp-proxy - | Choices: enable disable | Enable/disable the DHCP Proxy.
| dhcp-server-ip - |  | DHCP Server IPv4 address.
| dhcp6-server-ip - |  | DHCPv6 server IPv6 address.
| discovered-device-timeout - |  | Timeout for discovered devices (1 - 365 days, default = 28).
| ecmp-max-paths - |  | Maximum number of Equal Cost Multi-Path (ECMP) next-hops. Set to 1 to disable ECMP routing (1 - 100, default = 10).
| email-portal-check-dns - | Choices: disable enable | Enable/disable using DNS to validate email addresses collected by a captive portal.
| firewall-session-dirty - | Choices: check-all check-new check-policy-option | Select how to manage sessions affected by firewall policy configuration changes.
| fw-session-hairpin - | Choices: enable disable | Enable/disable checking for a matching policy each time hairpin traffic goes through the FortiGate.
| gateway - |  | Transparent mode IPv4 default gateway IP address.
| gateway6 - |  | Transparent mode IPv4 default gateway IP address.
| gui-advanced-policy - | Choices: enable disable | Enable/disable advanced policy configuration on the GUI.
| gui-allow-unnamed-policy - | Choices: enable disable | Enable/disable the requirement for policy naming on the GUI.
| gui-antivirus - | Choices: enable disable | Enable/disable AntiVirus on the GUI.
| gui-ap-profile - | Choices: enable disable | Enable/disable FortiAP profiles on the GUI.
| gui-application-control - | Choices: enable disable | Enable/disable application control on the GUI.
| gui-default-policy-columns - |  | Default columns to display for policy lists on GUI.
|  | name - / required |  | Select column name.
| gui-dhcp-advanced - | Choices: enable disable | Enable/disable advanced DHCP options on the GUI.
| gui-dlp - | Choices: enable disable | Enable/disable DLP on the GUI.
| gui-dns-database - | Choices: enable disable | Enable/disable DNS database settings on the GUI.
| gui-dnsfilter - | Choices: enable disable | Enable/disable DNS Filtering on the GUI.
| gui-domain-ip-reputation - | Choices: enable disable | Enable/disable Domain and IP Reputation on the GUI.
| gui-dos-policy - | Choices: enable disable | Enable/disable DoS policies on the GUI.
| gui-dynamic-profile-display - | Choices: enable disable | Enable/disable RADIUS Single Sign On (RSSO) on the GUI.
| gui-dynamic-routing - | Choices: enable disable | Enable/disable dynamic routing on the GUI.
| gui-email-collection - | Choices: enable disable | Enable/disable email collection on the GUI.
| gui-endpoint-control - | Choices: enable disable | Enable/disable endpoint control on the GUI.
| gui-endpoint-control-advanced - | Choices: enable disable | Enable/disable advanced endpoint control options on the GUI.
| gui-explicit-proxy - | Choices: enable disable | Enable/disable the explicit proxy on the GUI.
| gui-fortiap-split-tunneling - | Choices: enable disable | Enable/disable FortiAP split tunneling on the GUI.
| gui-fortiextender-controller - | Choices: enable disable | Enable/disable FortiExtender on the GUI.
| gui-icap - | Choices: enable disable | Enable/disable ICAP on the GUI.
| gui-implicit-policy - | Choices: enable disable | Enable/disable implicit firewall policies on the GUI.
| gui-ips - | Choices: enable disable | Enable/disable IPS on the GUI.
| gui-load-balance - | Choices: enable disable | Enable/disable server load balancing on the GUI.
| gui-local-in-policy - | Choices: enable disable | Enable/disable Local-In policies on the GUI.
| gui-local-reports - | Choices: enable disable | Enable/disable local reports on the GUI.
| gui-multicast-policy - | Choices: enable disable | Enable/disable multicast firewall policies on the GUI.
| gui-multiple-interface-policy - | Choices: enable disable | Enable/disable adding multiple interfaces to a policy on the GUI.
| gui-multiple-utm-profiles - | Choices: enable disable | Enable/disable multiple UTM profiles on the GUI.
| gui-nat46-64 - | Choices: enable disable | Enable/disable NAT46 and NAT64 settings on the GUI.
| gui-object-colors - | Choices: enable disable | Enable/disable object colors on the GUI.
| gui-policy-based-ipsec - | Choices: enable disable | Enable/disable policy-based IPsec VPN on the GUI.
| gui-policy-learning - | Choices: enable disable | Enable/disable firewall policy learning mode on the GUI.
| gui-replacement-message-groups - | Choices: enable disable | Enable/disable replacement message groups on the GUI.
| gui-spamfilter - | Choices: enable disable | Enable/disable Antispam on the GUI.
| gui-sslvpn-personal-bookmarks - | Choices: enable disable | Enable/disable SSL-VPN personal bookmark management on the GUI.
| gui-sslvpn-realms - | Choices: enable disable | Enable/disable SSL-VPN realms on the GUI.
| gui-switch-controller - | Choices: enable disable | Enable/disable the switch controller on the GUI.
| gui-threat-weight - | Choices: enable disable | Enable/disable threat weight on the GUI.
| gui-traffic-shaping - | Choices: enable disable | Enable/disable traffic shaping on the GUI.
| gui-voip-profile - | Choices: enable disable | Enable/disable VoIP profiles on the GUI.
| gui-vpn - | Choices: enable disable | Enable/disable VPN tunnels on the GUI.
| gui-waf-profile - | Choices: enable disable | Enable/disable Web Application Firewall on the GUI.
| gui-wan-load-balancing - | Choices: enable disable | Enable/disable SD-WAN on the GUI.
| gui-wanopt-cache - | Choices: enable disable | Enable/disable WAN Optimization and Web Caching on the GUI.
| gui-webfilter - | Choices: enable disable | Enable/disable Web filtering on the GUI.
| gui-webfilter-advanced - | Choices: enable disable | Enable/disable advanced web filtering on the GUI.
| gui-wireless-controller - | Choices: enable disable | Enable/disable the wireless controller on the GUI.
| http-external-dest - | Choices: fortiweb forticache | Offload HTTP traffic to FortiWeb or FortiCache.
| ike-dn-format - | Choices: with-space no-space | Configure IKE ASN.1 Distinguished Name format conventions.
| ike-quick-crash-detect - | Choices: enable disable | Enable/disable IKE quick crash detection (RFC 6290).
| ike-session-resume - | Choices: enable disable | Enable/disable IKEv2 session resumption (RFC 5723).
| implicit-allow-dns - | Choices: enable disable | Enable/disable implicitly allowing DNS traffic.
| inspection-mode - | Choices: proxy flow | Inspection mode (proxy-based or flow-based).
| ip - |  | IP address and netmask.
| ip6 - |  | IPv6 address prefix for NAT mode.
| link-down-access - | Choices: enable disable | Enable/disable link down access traffic.
| lldp-transmission - | Choices: enable disable global | Enable/disable Link Layer Discovery Protocol (LLDP) for this VDOM or apply global settings to this VDOM.
| mac-ttl - |  | Duration of MAC addresses in Transparent mode (300 - 8640000 sec, default = 300).
| manageip - |  | Transparent mode IPv4 management IP address and netmask.
| manageip6 - |  | Transparent mode IPv6 management IP address and netmask.
| multicast-forward - | Choices: enable disable | Enable/disable multicast forwarding.
| multicast-skip-policy - | Choices: enable disable | Enable/disable allowing multicast traffic through the FortiGate without a policy check.
| multicast-ttl-notchange - | Choices: enable disable | Enable/disable preventing the FortiGate from changing the TTL for forwarded multicast packets.
| ngfw-mode - | Choices: profile-based policy-based | Next Generation Firewall (NGFW) mode.
| opmode - | Choices: nat transparent | Firewall operation mode (NAT or Transparent).
| prp-trailer-action - | Choices: enable disable | Enable/disable action to take on PRP trailer.
| sccp-port - |  | TCP port the SCCP proxy monitors for SCCP traffic (0 - 65535, default = 2000).
| ses-denied-traffic - | Choices: enable disable | Enable/disable including denied session in the session table.
| sip-helper - | Choices: enable disable | Enable/disable the SIP session helper to process SIP sessions unless SIP sessions are accepted by the SIP application layer gateway (ALG).
| sip-nat-trace - | Choices: enable disable | Enable/disable recording the original SIP source IP address when NAT is used.
| sip-ssl-port - |  | TCP port the SIP proxy monitors for SIP SSL/TLS traffic (0 - 65535, default = 5061).
| sip-tcp-port - |  | TCP port the SIP proxy monitors for SIP traffic (0 - 65535, default = 5060).
| sip-udp-port - |  | UDP port the SIP proxy monitors for SIP traffic (0 - 65535, default = 5060).
| snat-hairpin-traffic - | Choices: enable disable | Enable/disable source NAT (SNAT) for hairpin traffic.
| ssl-ssh-profile - |  | Profile for SSL/SSH inspection. Source firewall.ssl-ssh-profile.name.
| status - | Choices: enable disable | Enable/disable this VDOM.
| strict-src-check - | Choices: enable disable | Enable/disable strict source verification.
| tcp-session-without-syn - | Choices: enable disable | Enable/disable allowing TCP session without SYN flags.
| utf8-spam-tagging - | Choices: enable disable | Enable/disable converting antispam tags to UTF-8 for better non-ASCII character support.
| v4-ecmp-mode - | Choices: source-ip-based weight-based usage-based source-dest-ip-based | IPv4 Equal-cost multi-path (ECMP) routing and load balancing mode.
| vpn-stats-log - | Choices: ipsec pptp l2tp ssl | Enable/disable periodic VPN log statistics for one or more types of VPN. Separate names with a space.
| vpn-stats-period - |  | Period to send VPN log statistics (60 - 86400 sec).
| wccp-cache-engine - | Choices: enable disable | Enable/disable WCCP cache engine.
username - / required |  | FortiOS or FortiGate username.
vdom - | Default: "root" | Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit.

## Notes

Note

- Requires fortiosapi library developed by Fortinet
- Run as a local_action in your playbook

## Examples

    - hosts: localhost
      vars:
       host: "192.168.122.40"
       username: "admin"
       password: ""
       vdom: "root"
      tasks:
      - name: Configure VDOM settings.
        fortios_system_settings:
          host:  "{{ host }}"
          username: "{{ username }}"
          password: "{{ password }}"
          vdom:  "{{ vdom }}"
          https: "False"
          system_settings:
            allow-subnet-overlap: "enable"
            asymroute: "enable"
            asymroute-icmp: "enable"
            asymroute6: "enable"
            asymroute6-icmp: "enable"
            bfd: "enable"
            bfd-desired-min-tx: "9"
            bfd-detect-mult: "10"
            bfd-dont-enforce-src-port: "enable"
            bfd-required-min-rx: "12"
            block-land-attack: "disable"
            central-nat: "enable"
            comments: "<your_own_value>"
            compliance-check: "enable"
            default-voip-alg-mode: "proxy-based"
            deny-tcp-with-icmp: "enable"
            device: "<your_own_value> (source system.interface.name)"
            dhcp-proxy: "enable"
            dhcp-server-ip: "<your_own_value>"
            dhcp6-server-ip: "<your_own_value>"
            discovered-device-timeout: "23"
            ecmp-max-paths: "24"
            email-portal-check-dns: "disable"
            firewall-session-dirty: "check-all"
            fw-session-hairpin: "enable"
            gateway: "<your_own_value>"
            gateway6: "<your_own_value>"
            gui-advanced-policy: "enable"
            gui-allow-unnamed-policy: "enable"
            gui-antivirus: "enable"
            gui-ap-profile: "enable"
            gui-application-control: "enable"
            gui-default-policy-columns:
             -
                name: "default_name_36"
            gui-dhcp-advanced: "enable"
            gui-dlp: "enable"
            gui-dns-database: "enable"
            gui-dnsfilter: "enable"
            gui-domain-ip-reputation: "enable"
            gui-dos-policy: "enable"
            gui-dynamic-profile-display: "enable"
            gui-dynamic-routing: "enable"
            gui-email-collection: "enable"
            gui-endpoint-control: "enable"
            gui-endpoint-control-advanced: "enable"
            gui-explicit-proxy: "enable"
            gui-fortiap-split-tunneling: "enable"
            gui-fortiextender-controller: "enable"
            gui-icap: "enable"
            gui-implicit-policy: "enable"
            gui-ips: "enable"
            gui-load-balance: "enable"
            gui-local-in-policy: "enable"
            gui-local-reports: "enable"
            gui-multicast-policy: "enable"
            gui-multiple-interface-policy: "enable"
            gui-multiple-utm-profiles: "enable"
            gui-nat46-64: "enable"
            gui-object-colors: "enable"
            gui-policy-based-ipsec: "enable"
            gui-policy-learning: "enable"
            gui-replacement-message-groups: "enable"
            gui-spamfilter: "enable"
            gui-sslvpn-personal-bookmarks: "enable"
            gui-sslvpn-realms: "enable"
            gui-switch-controller: "enable"
            gui-threat-weight: "enable"
            gui-traffic-shaping: "enable"
            gui-voip-profile: "enable"
            gui-vpn: "enable"
            gui-waf-profile: "enable"
            gui-wan-load-balancing: "enable"
            gui-wanopt-cache: "enable"
            gui-webfilter: "enable"
            gui-webfilter-advanced: "enable"
            gui-wireless-controller: "enable"
            http-external-dest: "fortiweb"
            ike-dn-format: "with-space"
            ike-quick-crash-detect: "enable"
            ike-session-resume: "enable"
            implicit-allow-dns: "enable"
            inspection-mode: "proxy"
            ip: "<your_own_value>"
            ip6: "<your_own_value>"
            link-down-access: "enable"
            lldp-transmission: "enable"
            mac-ttl: "89"
            manageip: "<your_own_value>"
            manageip6: "<your_own_value>"
            multicast-forward: "enable"
            multicast-skip-policy: "enable"
            multicast-ttl-notchange: "enable"
            ngfw-mode: "profile-based"
            opmode: "nat"
            prp-trailer-action: "enable"
            sccp-port: "98"
            ses-denied-traffic: "enable"
            sip-helper: "enable"
            sip-nat-trace: "enable"
            sip-ssl-port: "102"
            sip-tcp-port: "103"
            sip-udp-port: "104"
            snat-hairpin-traffic: "enable"
            ssl-ssh-profile: "<your_own_value> (source firewall.ssl-ssh-profile.name)"
            status: "enable"
            strict-src-check: "enable"
            tcp-session-without-syn: "enable"
            utf8-spam-tagging: "enable"
            v4-ecmp-mode: "source-ip-based"
            vpn-stats-log: "ipsec"
            vpn-stats-period: "113"
            wccp-cache-engine: "enable"

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
build string | always | Build number of the fortigate image Sample: 1547
http_method string | always | Last method used to provision the content into FortiGate Sample: PUT
http_status string | always | Last result given by FortiGate on last operation applied Sample: 200
mkey string | success | Master key (id) used in the last call to FortiGate Sample: id
name string | always | Name of the table used to fulfill the request Sample: urlfilter
path string | always | Path of the table used to fulfill the request Sample: webfilter
revision string | always | Internal revision number Sample: 17.0.2.10658
serial string | always | Serial number of the unit Sample: FGVMEVYYQT3AB5352
status string | always | Indication of the operation's result Sample: success
vdom string | always | Virtual domain used Sample: root
version string | always | Version of the FortiGate Sample: v5.6.3

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by the Ansible Community. [community]

### Authors

- Miguel Angel Munoz (@mamunozgonzalez)
- Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation you can edit this document to improve it.