Skip to content

Latest commit

 

History

History
745 lines (556 loc) · 52.7 KB

fortimgr_module_docs.md

File metadata and controls

745 lines (556 loc) · 52.7 KB
Raw

Fortinet FortiManager Modules

Requirements

  • Python requests
  • Everything was tested with FortiManager 5.4

Modules

fortimgr_ip_pool

Manages IP Pool resources and attributes

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiManager IP Pool configurations using jsonrpc API

Options

Parameter required default choices comments
username no The username used to authenticate with the FortiManager.
comment no A comment to add to the IP Pool.
state no present
  • absent
  • param_absent
  • present
 The desired state of the specified object. absent will delete the object if it exists. param_absent will remove passed params from the object config if necessary and possible. present will create the configuration if needed.
type no
  • overload
  • one-to-one
  • fixed-port-range
  • port-block-allocation
 The type of NAT the IP Pool will perform
end_ip no The last address in the range of external addresses used to NAT internal addresses to.
pool_name yes The name of the IP Pool.
lock no True True locks the ADOM, makes necessary configuration updates, saves the config, and unlocks the ADOM
adom yes The ADOM the configuration should belong to.
source_end_ip no The last address in the range of internal addresses which will be NAT'ed to an address in the external range.
arp_intfc no Sets the interface which should reply for ARP if arp_reply is enabled.
session_id no The session_id of an established and active session
permit_any_host no
  • enable
  • disable
 Allows for the use fo full cone NAT.
host yes The FortiManager's Address.
arp_reply no
  • enable
  • disable
 Allows the fortigate to reply to ARP requests.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
start_ip no The first address in the range of external addresses used to NAT internal addresses to.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
password no The password associated with the username account.
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False)
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).
source_start_ip no The first address in the range of internal addresses which will be NAT'ed to an address in the external range.

fortimgr_policy

Manages FW Policy resources and attributes

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiManager FW Policy configurations using jsonrpc API

Options

Parameter required default choices comments
comment no A comment to add to the Policy.
status no
  • enable
  • disable
 The desired status of the policy.
lock no True True locks the ADOM, makes necessary configuration updates, saves the config, and unlocks the ADOM
nat_ip no The IP to use for NAT when enabled. First IP in the list is beginning NAT range Second IP in the list is the ending NAT range..
policy_name no The name of the Policy.
reference_policy_id no The policy id to use as a reference point for policy placement.
source_intfc no A list of source interfaces used for policy matching.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
destination_address no A list of destinations to use for policy matching.
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).
service no A list services used for policy matching.
schedule no The schedule to use for when the policy should be enabled.
label no A label for policy grouping.
state no present
  • absent
  • param_absent
  • present
 The desired state of the specified policy. absent will delete the policy if it exists. param_absent will remove passed params from the policy config if necessary and possible. present will update the configuration if needed.
nat no
  • enable
  • disable
 Setting the NAT to enable or disable.
reference_policy_name no The policy name to use as a reference point for policy placement.
source_address no A list of source addresses used for policy matching.
global_label no A section label for policy grouping.
username no The username used to authenticate with the FortiManager.
pool_name no The name of the IP Pool when enabled.
direction no
  • before
  • after
 The direction the policy should be placed in reference to the reference_policy
adom yes The ADOM the configuration should belong to.
log_traffic no
  • disable
  • all
  • utm
 Setting the Log Traffic to disable, all, or utm(log security events).
log_traffic_start no
  • enable
  • disable
 Setting the Log Traffic Start to enable or disable.
host yes The FortiManager's Address.
password no The password associated with the username account.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
ip_pool no
  • enable
  • disable
 Setting the IP Pool Nat feature to enable or disable.
permit_any_host no
  • enable
  • disable
 Setting the Permit Any Host to enable or disable.
match_filter False Determines whether to use match_filters to retrieve existing policies. True will use match_filters to retrieve a matching policy. False will not use match_filters to retrieve a matching policy.
package yes The policy package to add the policy to.
match_filters [u'source_address', u'source_intfc', u'destination_address', u'destination_intfc', u'service'] This is an alternative means of matching an existing policy when not using policy_id or policy_name. The config parameters to match existing policies against for comparing module parameters against existing configurations. All fields passed into the list will be used to retrieve an exact match from existing policies. If multiple policies match on the parameters, the module will fail with the list of matching policies. C(all) can be used to match all parameters that are passed to the module.
destination_intfc no A list of interface destinations to use for policy matching.
session_id no The session_id of an established and active session
action no
  • accept
  • deny
  • ipsec
  • ssl-vpn
 The action the end device should take when the policy is matched.
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False)
policy_id no The ID associated with the Policy.

fortimgr_vip

Manages VIP resources and attributes

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiManager VIP configurations using jsonrpc API

Options

Parameter required default choices comments
username no The username used to authenticate with the FortiManager.
comment no A comment to add to the VIP.
state no present
  • absent
  • param_absent
  • present
 The desired state of the specified object. absent will delete the object if it exists. param_absent will remove passed params from the object config if necessary and possible. present will create the configuration if needed.
type no
  • static-nat
  • fqdn
  • dns-translation
 The type of service the VIP will offer.
source_filter no The source IP addresses which will be used to filter when the NAT takes place.
adom yes The ADOM the configuration should belong to.
color no A tag that can be used to group objects.
lock no True True locks the ADOM, makes necessary configuration updates, saves the config, and unlocks the ADOM
external_intfc no The associated external interface
session_id no The session_id of an established and active session
vip_name yes The name of the VIP.
external_ip no The external IP or IP range that will be NAT'ed to the internal mapped IP.
host yes The FortiManager's Address.
arp_reply no
  • enable
  • disable
 Allows the fortigate to reply to ARP requests.
source_intfc no The source interface which will be used to filter when the NAT takes place.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
password no The password associated with the username account.
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False)
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).
mapped_ip no The address or address range used that the external IP will be mapped to.

fortimgr_ip_pool_map

Manages IP Pool mapped resources and attributes

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiManager IP Pool dynamic_mapping configurations using jsonrpc API

Options

Parameter required default choices comments
comment no A comment to add to the IP Pool.
source_start_ip no The first address in the range of internal addresses which will be NAT'ed to an address in the external range.
lock no True True locks the ADOM, makes necessary configuration updates, saves the config, and unlocks the ADOM
arp_intfc no Sets the interface which should reply for ARP if arp_reply is enabled.
arp_reply no
  • enable
  • disable
 Allows the fortigate to reply to ARP requests.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).
state no present
  • absent
  • param_absent
  • present
 The desired state of the specified object. absent will delete the mapping from the object if it exists. param_absent will remove passed params from the object config if necessary and possible. present will create configuration for the mapping correlating to the fortigate specified if needed.
end_ip no The last address in the range of external addresses used to NAT internal addresses to.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
type no
  • overload
  • one-to-one
  • fixed-port-range
  • port-block-allocation
 The type of NAT the IP Pool will perform
username no The username used to authenticate with the FortiManager.
pool_name yes The name of the IP Pool.
adom yes The ADOM the configuration should belong to.
source_end_ip no The last address in the range of internal addresses which will be NAT'ed to an address in the external range.
start_ip no The first address in the range of external addresses used to NAT internal addresses to.
password no The password associated with the username account.
fortigate no The name of the fortigate to map the configuration to.
vdom yes The vdom on the fortigate that the config should be associated to.
permit_any_host no
  • enable
  • disable
 Allows for the use fo full cone NAT.
host yes The FortiManager's Address.
session_id no The session_id of an established and active session
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False)

fortimgr_revision

Manages ADOM revisions

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiManager revisions using jsonrpc API

Options

Parameter required default choices comments
username no The username used to authenticate with the FortiManager.
lock_revision no
  • 0
  • 1
 The lock status of the revision. 0 permits the revision to be automatically deleted per FortiManager settings. 1 prevents the revision from being automatically deleted per FortiManager settings.
description no A description to add to the revision.
adom yes The ADOM the configuration should belong to.
lock no True True locks the ADOM, makes necessary configuration updates, saves the config, and unlocks the ADOM
state no present
  • absent
  • present
  • restore
 The desired state of the revision. Absent will ensure no revisions exist with the specified name. Present will create a new revision. Restore will restore the ADOM to the specified revision.
session_id no The session_id of an established and active session
host yes The FortiManager's Address.
created_by no The name of the user who created the revision.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
password no The password associated with the username account.
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False)
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).
revision_name yes The name of the revision.

fortimgr_address_map

Manages Address mapped resources and attributes

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiManager Address dynamic_mapping configurations using jsonrpc API

Options

Parameter required default choices comments
comment no A comment to add to the Address
allow_routing no Determines if the address can be used in static routing configuration.
color no A tag that can be used to group objects
lock no True True locks the ADOM, makes necessary configuration updates, saves the config, and unlocks the ADOM
network_address no The network address to use when address_type is ipmask. The network_mask param must be used in conjuction with network_address. Alternatively, the subnet param can be used for cidr notation.
wildcard_fqdn no The wildcard FQDN associated with an Address when the type is wildcard-fqdn.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).
subnet no The subnet associated with an Address when the type is ipmask. This supports sending a string as cidr notation or a two element list that would be returned from getting existing address objects. Alternatively, the network_address and network_mask params can be used.
state no present
  • absent
  • param_absent
  • present
 The desired state of the specified object. absent will delete the mapping from the object if it exists. param_absent will remove passed params from the object config if necessary and possible. present will create configuration for the mapping correlating to the fortigate specified if needed.
end_ip no The last IP associated with an Address when the type is iprange.
wildcard_mask no The wildcard mask to use when address_type is wildcard. The wildcard_address param must be used in conjuction with the wildcard_mask Alternatively, the wildcard param can be used for cidr notation.
address_name yes The name of the Address object.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
address_type no
  • ipmask
  • iprange
  • fqdn
  • wildcard
  • wildcard-fqdn
 The type of address the Address object is.
username no The username used to authenticate with the FortiManager.
adom yes The ADOM the configuration should belong to.
host yes The FortiManager's Address.
start_ip no The first IP associated with an Address when the type is iprange.
network_mask no The netmask to use when address_type is ipmask. The network_address param must be used in conjuction with network_mask. Alternatively, the subnet param can be used for cidr notation.
password no The password associated with the username account.
vdom yes The vdom on the fortigate that the config should be associated to.
fqdn no The fully qualified domain name associated with an Address when the type is fqdn.
session_id no The session_id of an established and active session
wildcard no The wildcard associated with an Address when the type is wildcard. This supports sending a string as cidr notation or a two element list that would be returned from getting existing address objects. Alternatively, the wildcard_address and wildcard_mask params can be used.
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False)
wildcard_address no The wildcard address to use when address_type is wildcard. The wildcard_mask param must be used in conjunction with the wildcard_address. Alternatively, the wildcard param can be used for cidr notation.

fortimgr_vip_group

Manages the VIP Group resources and attributes

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiManager VIP Group configurations using jsonrpc API

Options

Parameter required default choices comments
username no The username used to authenticate with the FortiManager.
comment no A comment to add to the VIP.
adom yes The ADOM the configuration should belong to.
color no A tag that can be used to group objects.
lock no True True locks the ADOM, makes necessary configuration updates, saves the config, and unlocks the ADOM
vip_group_name yes The name of the VIP Group.
state no present
  • absent
  • param_absent
  • present
 The desired state of the specified object. absent will delete the object if it exists. param_absent will remove passed params from the object config if necessary and possible. present will create the configuration if needed.
session_id no The session_id of an established and active session
host yes The FortiManager's Address.
members no The list of VIP objects that should be associated to the VIP Group.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
interface no The list of interfaces/zones associated with the VIP Group
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
password no The password associated with the username account.
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False)
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).

fortimgr_address

Manages Address resources and attributes

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiManager Address configurations using jsonrpc API

Options

Parameter required default choices comments
comment no A comment to add to the Address
allow_routing no Determines if the address can be used in static routing configuration.
color no A tag that can be used to group objects
lock no True True locks the ADOM, makes necessary configuration updates, saves the config, and unlocks the ADOM
network_address no The network address to use when address_type is ipmask. The network_mask param must be used in conjuction with network_address. Alternatively, the subnet param can be used for cidr notation.
wildcard_fqdn no The wildcard FQDN associated with an Address when the type is wildcard-fqdn.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).
subnet no The subnet associated with an Address when the type is ipmask. This supports sending a string as cidr notation or a two element list that would be returned from getting existing address objects. Alternatively, the network_address and network_mask params can be used.
associated_intfc no The interface associated with the Address.
state no present
  • absent
  • param_absent
  • present
 The desired state of the specified object. absent will delete resource if it exists. param_absent will remove passed params from the object config if necessary and possible. present will update the configuration if needed.
end_ip no The last IP associated with an Address when the type is iprange.
wildcard_mask no The wildcard mask to use when address_type is wildcard. The wildcard_address param must be used in conjuction with the wildcard_mask Alternatively, the wildcard param can be used for cidr notation.
address_name yes The name of the Address object.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
address_type no
  • ipmask
  • iprange
  • fqdn
  • wildcard
  • wildcard-fqdn
 The type of address the Address object is.
username no The username used to authenticate with the FortiManager.
adom yes The ADOM the configuration should belong to.
host yes The FortiManager's Address.
start_ip no The first IP associated with an Address when the type is iprange.
network_mask no The netmask to use when address_type is ipmask. The network_address param must be used in conjuction with network_mask. Alternatively, the subnet param can be used for cidr notation.
password no The password associated with the username account.
fqdn no The fully qualified domain name associated with an Address when the type is fqdn.
session_id no The session_id of an established and active session
wildcard no The wildcard associated with an Address when the type is wildcard. This supports sending a string as cidr notation or a two element list that would be returned from getting existing address objects. Alternatively, the wildcard_address and wildcard_mask params can be used.
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False)
wildcard_address no The wildcard address to use when address_type is wildcard. The wildcard_mask param must be used in conjunction with the wildcard_address. Alternatively, the wildcard param can be used for cidr notation.

fortimgr_lock

Manages ADOM locking and unlocking

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiManager ADOM locking and unlocking using jsonrpc API

Options

Parameter required default choices comments
username no The username used to authenticate with the FortiManager.
save no False Saves the config before unlocking a session. True saves the configuration. False does not save the configuration and all changes in the session will be lost if unlocked.
adom yes The ADOM the configuration should belong to.
lock no False Locks the ADOM in the FortiManager. True ensures the ADOM is locked.
unlock no False Unlocks the ADOM in the FortiManager. True ensures the ADOM is unlocked and closes the current session with the FortiManager.
session_id no The session_id of an established and active session
host yes The FortiManager's Address.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
password no The password associated with the username account.
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False)
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).

fortimgr_address_group

Manages Address Group resources and attributes

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiManager Address Group configurations using jsonrpc API

Options

Parameter required default choices comments
username no The username used to authenticate with the FortiManager.
allow_routing no Determines if the address can be used in static routing configuration.
adom yes The ADOM the configuration should belong to.
color no A tag that can be used to group objects
lock no True True locks the ADOM, makes necessary configuration updates, saves the config, and unlocks the ADOM
state no present
  • absent
  • param_absent
  • present
 The desired state of the specified object. absent will delete the object if it exists. param_absent will remove passed params from the object config if necessary and possible. present will create the configuration if needed.
session_id no The session_id of an established and active session
host yes The FortiManager's Address.
address_group_name yes The name of the Address Group object.
members no A list of members associated with the Address Group object.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
password no The password associated with the username account.
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False)
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).
comment no A comment to add to the Address

fortimgr_service_group

Manages Service Group resources and attributes

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiManager Service Group configurations using jsonrpc API

Options

Parameter required default choices comments
username no The username used to authenticate with the FortiManager.
comment no A comment to add to the Service Group
adom yes The ADOM the configuration should belong to.
color no A tag that can be used to group objects
lock no True True locks the ADOM, makes necessary configuration updates, saves the config, and unlocks the ADOM
service_group_name yes The name of the Service Group object.
explicit-proxy no Used to set the explicit-proxy service for the Service Group object.
session_id no The session_id of an established and active session
host yes The FortiManager's Address.
state no present
  • absent
  • param_absent
  • present
 The desired state of the specified object. absent will delete the object if it exists. param_absent will remove passed params from the object config if necessary and possible. present will create the configuration if needed.
members no A list of members associated with the Service Group object.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
password no The password associated with the username account.
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False)
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).

fortimgr_service

Manages Service resources and attributes

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiManager Service configurations using jsonrpc API

Options

Parameter required default choices comments
username no The username used to authenticate with the FortiManager.
icmp_code no The ICMP code for when protocol is set to ICMP.
password no The password associated with the username account.
protocol no Used to specify the service's protocol type.
icmp_type no The ICMP type for when the protocol is set to ICMP.
category no
  • Uncategorized
  • Authentication
  • Email
  • File Access
  • General
  • Network Services
  • Remote Access
  • Tunneling
  • VoIP, Messaging & Other Applications
  • Web Access
  • Web Proxy
 The category of the service object.
adom yes The ADOM the configuration should belong to.
color no A tag that can be used to group objects
lock no True True locks the ADOM, makes necessary configuration updates, saves the config, and unlocks the ADOM
protocol_number no Used to specify the IP protocol number when protocol is set to IP.
state no present
  • absent
  • param_absent
  • present
 The desired state of the specified object. absent will delete the object if it exists. param_absent will remove passed params from the object config if necessary and possible. present will create the configuration if needed.
session_id no The session_id of an established and active session
port_range no The range of TCP or UDP ports associated with the service object.
host yes The FortiManager's Address.
service_name yes The name of the service.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
explicit_proxy no Used to set the explicit-proxy service for the Service object.
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False)
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).
comment no A comment to add to the Service

fortimgr_install

Manages ADOM package installs

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiManager package installs using jsonrpc API

Options

Parameter required default choices comments
username no The username used to authenticate with the FortiManager.
adom_revision_name no The name to give the ADOM revision if creating a revision.
fortigate_revision_comments no Comments to add to the FortiGate revision.
adom yes The ADOM that should have package installed should belong to.
lock no True True locks the ADOM, makes necessary configuration updates, saves the config, and unlocks the ADOM
package yes The policy package that should be pushed to the end devices.
adom_revision_comments no Comments to add to the ADOM revision if creating a revision.
check_install no Determines if the install will only be committed if the FortiGate is in sync and connected with the FortManager. True performs the check. False attempts the install regardless of device status.
session_id no The session_id of an established and active session
fortigate_name yes The name of FortiGate in consideration for package install.
install_flags no
  • cp_all_objs
  • generate_rev
  • copy_assigned_pkg
  • unassign
  • ifpolicy_only
  • no_ifpolicy
  • objs_only
  • copy_only
 Flags to send to the FortiManager identifying how the install should be done.
host yes The FortiManager's Address.
state no present
  • present
  • preview
 The desired state of the package. Present will update the configuration if needed. Preview (or check mode) will return a preview of what will be pushed to the end device.
dst_file no The file path/name where to write the install preview to.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
password no The password associated with the username account.
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False).
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).
vdom no The VDOM associated with the FortiGate and package.

fortimgr_vip_mapping

Manages VIP mapped resources and attributes

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiManager VIP dynamic_mapping configurations using jsonrpc API

Options

Parameter required default choices comments
comment no A comment to add to the VIP.
color no A tag that can be used to group objects.
lock no True True locks the ADOM, makes necessary configuration updates, saves the config, and unlocks the ADOM
arp_reply no
  • enable
  • disable
 Allows the fortigate to reply to ARP requests.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).
mapped_ip no The address or address range used that the external IP will be mapped to.
state no present
  • absent
  • param_absent
  • present
 The desired state of the specified object. absent will delete the mapping from the object if it exists. param_absent will remove passed params from the object config if necessary and possible. present will create configuration for the mapping correlating to the fortigate specified if needed.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
type no The source interface which will be used to filter when the NAT takes place.
username no The username used to authenticate with the FortiManager.
source_filter no The source IP addresses which will be used to filter when the NAT takes place.
adom yes The ADOM the configuration should belong to.
host yes The FortiManager's Address.
password no The password associated with the username account.
fortigate no The name of the fortigate to map the configuration to.
vdom yes The vdom on the fortigate that the config should be associated to.
external_intfc no The associated external interface
external_ip no The external IP or IP range that will be NAT'ed to the internal mapped IP.
session_id no The session_id of an established and active session
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False)
vip_name yes The name of the VIP.

fortimgr_route

Manages Route configurations for FortiGate devices

  • Synopsis
  • Options
  • Examples

Synopsis

Manages FortiGate route configurations using FortiManager's jsonrpc API

Options

Parameter required default choices comments
comment no A comment to add to the route.
weight no The weight to assign to the route.
lock no True True locks the ADOM, makes necessary configuration updates, saves the config, and unlocks the ADOM
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
destination_netmask no The netmask to use for the destination address. The network param must be used in conjuction with netmask. Alternatively, the destination param can be used for cidr notation.
destination_network no The network address to use destination address. The netmask param must be used in conjuction with network. Alternatively, the destination param can be used for cidr notation.
gateway yes The gateway address for which the destination can be reached.
destination yes The destination subnet. This supports sending a string as cidr notation or a two element list that would be returned from getting existing address objects. Alternatively, the netmask and network params can be used.
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).
priority no The priority to assign the route.
state no present
  • present
  • absent
 The desired state of the route. absent will remove the route if it exists. present will update the configuration if needed.
intfc no The interface used to reach the route.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
username no The username used to authenticate with the FortiManager.
adom no The ADOM the configuration should belong to.
host yes The FortiManager's Address.
password no The password associated with the username account.
fortigate yes The fortigate to apply the route to.
vdom yes The vdom on the fortigate to add the route to.
distance no The distance metric to associate to the route.
destination_object no The address or address-group object to use as the destination address
session_id no The session_id of an established and active session
validate_certs no False Determines whether to validate certs against a trusted certificate file C(True), or accept all certs C(False).
sequence_number no The sequence number of the route in FortiManager This is required in order to modify an existing route's interface, destination, and gateway.

fortimgr_facts

Gathers facts from the FortiManager

  • Synopsis
  • Options
  • Examples

Synopsis

Gathers facts from the FortiManager using jsonrpc API

Options

Parameter required default choices comments
username no The username used to authenticate with the FortiManager.
config_filter no
  • all
  • route
  • address
  • address_group
  • service
  • service_group
  • ip_pool
  • vip
  • vip_group
  • policy
 The list of configuration items to retrieve from the list of ADOMs and FortiGates managed by the FortiManager. This list will only be used if the fortigates or adoms parameters are passed.
fortigates no A list of FortiGates to retrieve device information for; "all" can be used to retrieve all devices managed by the FortiManger. If config_filter is defined, this list will be used to determine what devices to retrieve configuration from. If config_filter is defined, this list should be a list of dictionaries with "name" and "vdom" keys defining the mapping for fortigate and vdom.
adom no The ADOM that should have package installed should belong to.
session_id no The session_id of an established and active session
fortigate_name no device_id
  • device_id
  • hostname
 The name to use as the config dictionary key when returning configuration data. This is only used when fortigates is all or a list of fortigate names. C(device_id) will use the device ID that FortiManager has associated to the device. C(hostname) will use the hostname of the device.
host yes The FortiManager's Address.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
password no The password associated with the username account.
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False).
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).
adoms no A list of ADOMs for which configurations from FortiManager will be retrieved; "all" can be used to retrieve all ADOMs. If "all" is used, or the value is a list of ADOM names (as strings), then all packages for each ADOM will be retrieved. Passing a list of dictionaries with "name" and "package" keys can be used to limit the scope of policies retrieved. A key/value pair is required for each package (the dictionary values cannot be lists). The objects and policy elements will be collected based on what is listed in the config_filter param.

fortimgr_jsonrpc_request

Sends generic json-rpc FortiManager API requests

  • Synopsis
  • Options
  • Examples

Synopsis

Sends generic json-rpc FortiManager API requests

Options

Parameter required default choices comments
username no The username used to authenticate with the FortiManager.
session_id no The session_id of an established and active session
host yes The FortiManager's Address.
provider no Dictionary which acts as a collection of arguments used to define the characteristics of how to connect to the device. Arguments hostname, username, and password must be specified in either provider or local param. Local params take precedence, e.g. hostname is preferred to provider["hostname"] when both are specified.
use_ssl no True Determines whether to use HTTPS(True) or HTTP(False).
password no The password associated with the username account.
validate_certs no False Determines whether to validate certs against a trusted certificate file (True), or accept all certs (False).
port no The TCP port used to connect to the FortiManager if other than the default used by the transport method(http=80, https=443).
method yes The json-rpc method to use (get, add, set, update, delete, move, clone, replace, exec).
params yes The json-rpc request parameters. Refere to Fortimanager API doc for details.

Created by Network to Code, LLC For: 2015