community.fortios.fmgr_secprof_ips – Managing IPS security profiles in FortiManager

Note

This plugin is part of the community.fortios collection (version 1.0.0).

To install it use: ansible-galaxy collection install community.fortios.

To use it in a playbook, specify: community.fortios.fmgr_secprof_ips.

Synopsis

• Managing IPS security profiles in FortiManager

Parameters

Parameter	Choices/Defaults	Comments
adom string	Default: "root"	The ADOM the configuration should belong to.
block_malicious_url string	Choices: disable enable	Enable/disable malicious URL blocking.
comment string		Comment.
entries string		EXPERTS ONLY! KNOWLEDGE OF FMGR JSON API IS REQUIRED! List of multiple child objects to be added. Expects a list of dictionaries. Dictionaries must use FortiManager API parameters, not the ansible ones listed below. If submitted, all other prefixed sub-parameters ARE IGNORED. This object is MUTUALLY EXCLUSIVE with its options. We expect that you know what you are doing with these list parameters, and are leveraging the JSON API Guide. WHEN IN DOUBT, USE THE SUB OPTIONS BELOW INSTEAD TO CREATE OBJECTS WITH MULTIPLE TASKS
entries_action string	Choices: pass block reset default	Action taken with traffic in which signatures are detected.
entries_application string		Applications to be protected. set application ? lists available applications. all includes all applications. other includes all unlisted applications.
entries_exempt_ip_dst_ip string		Destination IP address and netmask.
entries_exempt_ip_src_ip string		Source IP address and netmask.
entries_location string		Protect client or server traffic.
entries_log string	Choices: disable enable	Enable/disable logging of signatures included in filter.
entries_log_attack_context string	Choices: disable enable	Enable/disable logging of attack context| URL buffer, header buffer, body buffer, packet buffer.
entries_log_packet string	Choices: disable enable	Enable/disable packet logging. Enable to save the packet that triggers the filter. You can download the packets in pcap format for diagnostic use.
entries_os string		Operating systems to be protected. all includes all operating systems. other includes all unlisted operating systems.
entries_protocol string		Protocols to be examined. set protocol ? lists available protocols. all includes all protocols. other includes all unlisted protocols.
entries_quarantine string	Choices: none attacker	Quarantine method.
entries_quarantine_expiry string		Duration of quarantine.
entries_quarantine_log string	Choices: disable enable	Enable/disable quarantine logging.
entries_rate_count string		Count of the rate.
entries_rate_duration string		Duration (sec) of the rate.
entries_rate_mode string	Choices: periodical continuous	Rate limit mode.
entries_rate_track string	Choices: none src-ip dest-ip dhcp-client-mac dns-domain	Track the packet protocol field.
entries_rule string		Identifies the predefined or custom IPS signatures to add to the sensor.
entries_severity string		Relative severity of the signature, from info to critical. Log messages generated by the signature include the severity.
entries_status string	Choices: disable enable default	Status of the signatures included in filter. default enables the filter and only use filters with default status of enable. Filters with default status of disable will not be used.
extended_log string	Choices: disable enable	Enable/disable extended logging.
filter string		EXPERTS ONLY! KNOWLEDGE OF FMGR JSON API IS REQUIRED! List of multiple child objects to be added. Expects a list of dictionaries. Dictionaries must use FortiManager API parameters, not the ansible ones listed below. If submitted, all other prefixed sub-parameters ARE IGNORED. This object is MUTUALLY EXCLUSIVE with its options. We expect that you know what you are doing with these list parameters, and are leveraging the JSON API Guide. WHEN IN DOUBT, USE THE SUB OPTIONS BELOW INSTEAD TO CREATE OBJECTS WITH MULTIPLE TASKS
filter_action string	Choices: pass block default reset	Action of selected rules.
filter_application string		Vulnerable application filter.
filter_location string		Vulnerability location filter.
filter_log string	Choices: disable enable	Enable/disable logging of selected rules.
filter_log_packet string	Choices: disable enable	Enable/disable packet logging of selected rules.
filter_name string		Filter name.
filter_os string		Vulnerable OS filter.
filter_protocol string		Vulnerable protocol filter.
filter_quarantine string	Choices: none attacker	Quarantine IP or interface.
filter_quarantine_expiry string		Duration of quarantine in minute.
filter_quarantine_log string	Choices: disable enable	Enable/disable logging of selected quarantine.
filter_severity string		Vulnerability severity filter.
filter_status string	Choices: disable enable default	Selected rules status.
mode string	Choices: add ← set delete update	Sets one of three modes for managing the object. Allows use of soft-adds instead of overwriting existing values
name string		Sensor name.
override string		EXPERTS ONLY! KNOWLEDGE OF FMGR JSON API IS REQUIRED! List of multiple child objects to be added. Expects a list of dictionaries. Dictionaries must use FortiManager API parameters, not the ansible ones listed below. If submitted, all other prefixed sub-parameters ARE IGNORED. This object is MUTUALLY EXCLUSIVE with its options. We expect that you know what you are doing with these list parameters, and are leveraging the JSON API Guide. WHEN IN DOUBT, USE THE SUB OPTIONS BELOW INSTEAD TO CREATE OBJECTS WITH MULTIPLE TASKS
override_action string	Choices: pass block reset	Action of override rule.
override_exempt_ip_dst_ip string		Destination IP address and netmask.
override_exempt_ip_src_ip string		Source IP address and netmask.
override_log string	Choices: disable enable	Enable/disable logging.
override_log_packet string	Choices: disable enable	Enable/disable packet logging.
override_quarantine string	Choices: none attacker	Quarantine IP or interface.
override_quarantine_expiry string		Duration of quarantine in minute.
override_quarantine_log string	Choices: disable enable	Enable/disable logging of selected quarantine.
override_rule_id string		Override rule ID.
override_status string	Choices: disable enable	Enable/disable status of override rule.
replacemsg_group string		Replacement message group.

Notes

Note

• Full Documentation at https://ftnt-ansible-docs.readthedocs.io/en/latest/.

Examples

- name: DELETE Profile
  community.fortios.fmgr_secprof_ips:
    name: "Ansible_IPS_Profile"
    comment: "Created by Ansible Module TEST"
    mode: "delete"

- name: CREATE Profile
  community.fortios.fmgr_secprof_ips:
    name: "Ansible_IPS_Profile"
    comment: "Created by Ansible Module TEST"
    mode: "set"
    block_malicious_url: "enable"
    entries: [{severity: "high", action: "block", log-packet: "enable"}, {severity: "medium", action: "pass"}]

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Returned	Description
api_result string	always	full API response, includes status code and message

Authors

• Luke Weighall (@lweighall)

• Andrew Welsh (@Ghilli3)

• Jim Huber (@p4r4n0y1ng)