fortios_wireless_controller_wtp – Configure Wireless Termination Points (WTPs), that is, FortiAPs or APs to be managed by FortiGate in Fortinet’s FortiOS and FortiGate

New in version 2.8.

Synopsis

  • This module is able to configure a FortiGate or FortiOS by allowing the user to set and modify wireless_controller feature and wtp category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.2

Requirements

The below requirements are needed on the host that executes this module.

  • fortiosapi>=0.9.8

Parameters

Parameter Choices/Defaults Comments
host
- / required
FortiOS or FortiGate ip address.
https
boolean
    Choices:
  • no
  • yes ←
Indicates if the requests towards FortiGate must use HTTPS protocol
password
-
Default:
""
FortiOS or FortiGate password.
username
- / required
FortiOS or FortiGate username.
vdom
-
Default:
"root"
Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit.
wireless_controller_wtp
-
Default:
null
Configure Wireless Termination Points (WTPs), that is, FortiAPs or APs to be managed by FortiGate.
admin
-
    Choices:
  • discovered
  • disable
  • enable
Configure how the FortiGate operating as a wireless controller discovers and manages this WTP, AP or FortiAP.
allowaccess
-
    Choices:
  • telnet
  • http
  • https
  • ssh
Control management access to the managed WTP, FortiAP, or AP. Separate entries with a space.
bonjour-profile
-
Bonjour profile name. Source wireless-controller.bonjour-profile.name.
coordinate-enable
-
    Choices:
  • enable
  • disable
Enable/disable WTP coordinates (X,Y axis).
coordinate-latitude
-
WTP latitude coordinate.
coordinate-longitude
-
WTP longitude coordinate.
coordinate-x
-
X axis coordinate.
coordinate-y
-
Y axis coordinate.
image-download
-
    Choices:
  • enable
  • disable
Enable/disable WTP image download.
index
-
Index (0 - 4294967295).
ip-fragment-preventing
-
    Choices:
  • tcp-mss-adjust
  • icmp-unreachable
Method by which IP fragmentation is prevented for CAPWAP tunneled control and data packets (default = tcp-mss-adjust).
lan
-
WTP LAN port mapping.
port-mode
-
    Choices:
  • offline
  • nat-to-wan
  • bridge-to-wan
  • bridge-to-ssid
LAN port mode.
port-ssid
-
Bridge LAN port to SSID. Source wireless-controller.vap.name.
port1-mode
-
    Choices:
  • offline
  • nat-to-wan
  • bridge-to-wan
  • bridge-to-ssid
LAN port 1 mode.
port1-ssid
-
Bridge LAN port 1 to SSID. Source wireless-controller.vap.name.
port2-mode
-
    Choices:
  • offline
  • nat-to-wan
  • bridge-to-wan
  • bridge-to-ssid
LAN port 2 mode.
port2-ssid
-
Bridge LAN port 2 to SSID. Source wireless-controller.vap.name.
port3-mode
-
    Choices:
  • offline
  • nat-to-wan
  • bridge-to-wan
  • bridge-to-ssid
LAN port 3 mode.
port3-ssid
-
Bridge LAN port 3 to SSID. Source wireless-controller.vap.name.
port4-mode
-
    Choices:
  • offline
  • nat-to-wan
  • bridge-to-wan
  • bridge-to-ssid
LAN port 4 mode.
port4-ssid
-
Bridge LAN port 4 to SSID. Source wireless-controller.vap.name.
port5-mode
-
    Choices:
  • offline
  • nat-to-wan
  • bridge-to-wan
  • bridge-to-ssid
LAN port 5 mode.
port5-ssid
-
Bridge LAN port 5 to SSID. Source wireless-controller.vap.name.
port6-mode
-
    Choices:
  • offline
  • nat-to-wan
  • bridge-to-wan
  • bridge-to-ssid
LAN port 6 mode.
port6-ssid
-
Bridge LAN port 6 to SSID. Source wireless-controller.vap.name.
port7-mode
-
    Choices:
  • offline
  • nat-to-wan
  • bridge-to-wan
  • bridge-to-ssid
LAN port 7 mode.
port7-ssid
-
Bridge LAN port 7 to SSID. Source wireless-controller.vap.name.
port8-mode
-
    Choices:
  • offline
  • nat-to-wan
  • bridge-to-wan
  • bridge-to-ssid
LAN port 8 mode.
port8-ssid
-
Bridge LAN port 8 to SSID. Source wireless-controller.vap.name.
led-state
-
    Choices:
  • enable
  • disable
Enable to allow the FortiAPs LEDs to light. Disable to keep the LEDs off. You may want to keep the LEDs off so they are not distracting in low light areas etc.
location
-
Field for describing the physical location of the WTP, AP or FortiAP.
login-passwd
-
Set the managed WTP, FortiAP, or AP's administrator password.
login-passwd-change
-
    Choices:
  • yes
  • default
  • no
Change or reset the administrator password of a managed WTP, FortiAP or AP (yes, default, or no, default = no).
mesh-bridge-enable
-
    Choices:
  • default
  • enable
  • disable
Enable/disable mesh Ethernet bridge when WTP is configured as a mesh branch/leaf AP.
name
-
WTP, AP or FortiAP configuration name.
override-allowaccess
-
    Choices:
  • enable
  • disable
Enable to override the WTP profile management access configuration.
override-ip-fragment
-
    Choices:
  • enable
  • disable
Enable/disable overriding the WTP profile IP fragment prevention setting.
override-lan
-
    Choices:
  • enable
  • disable
Enable to override the WTP profile LAN port setting.
override-led-state
-
    Choices:
  • enable
  • disable
Enable to override the profile LED state setting for this FortiAP. You must enable this option to use the led-state command to turn off the FortiAP's LEDs.
override-login-passwd-change
-
    Choices:
  • enable
  • disable
Enable to override the WTP profile login-password (administrator password) setting.
override-split-tunnel
-
    Choices:
  • enable
  • disable
Enable/disable overriding the WTP profile split tunneling setting.
override-wan-port-mode
-
    Choices:
  • enable
  • disable
Enable/disable overriding the wan-port-mode in the WTP profile.
radio-1
-
Configuration options for radio 1.
auto-power-high
-
Automatic transmission power high limit in decibels (dB) of the measured power referenced to one milliwatt (mW), or dBm (10 - 17 dBm, default = 17).
auto-power-level
-
    Choices:
  • enable
  • disable
Enable/disable automatic power-level adjustment to prevent co-channel interference (default = enable).
auto-power-low
-
Automatic transmission power low limit in dBm (the actual range of transmit power depends on the AP platform type).
band
-
    Choices:
  • 802.11a
  • 802.11b
  • 802.11g
  • 802.11n
  • 802.11n-5G
  • 802.11n,g-only
  • 802.11g-only
  • 802.11n-only
  • 802.11n-5G-only
  • 802.11ac
  • 802.11ac,n-only
  • 802.11ac-only
WiFi band that Radio 1 operates on.
channel
-
Selected list of wireless radio channels.
chan
- / required
Channel number.
override-analysis
-
    Choices:
  • enable
  • disable
Enable to override the WTP profile spectrum analysis configuration.
override-band
-
    Choices:
  • enable
  • disable
Enable to override the WTP profile band setting.
override-channel
-
    Choices:
  • enable
  • disable
Enable to override WTP profile channel settings.
override-txpower
-
    Choices:
  • enable
  • disable
Enable to override the WTP profile power level configuration.
override-vaps
-
    Choices:
  • enable
  • disable
Enable to override WTP profile Virtual Access Point (VAP) settings.
power-level
-
Radio power level as a percentage of the maximum transmit power (0 - 100, default = 100).
radio-id
-
radio-id
spectrum-analysis
-
    Choices:
  • enable
  • disable
Enable/disable spectrum analysis to find interference that would negatively impact wireless performance.
vap-all
-
    Choices:
  • enable
  • disable
Enable/disable the automatic inheritance of all Virtual Access Points (VAPs) (default = enable).
vaps
-
Manually selected list of Virtual Access Points (VAPs).
name
- / required
Virtual Access Point (VAP) name. Source wireless-controller.vap-group.name wireless-controller.vap.name.
radio-2
-
Configuration options for radio 2.
auto-power-high
-
Automatic transmission power high limit in decibels (dB) of the measured power referenced to one milliwatt (mW), or dBm (10 - 17 dBm, default = 17).
auto-power-level
-
    Choices:
  • enable
  • disable
Enable/disable automatic power-level adjustment to prevent co-channel interference (default = enable).
auto-power-low
-
Automatic transmission power low limit in dBm (the actual range of transmit power depends on the AP platform type).
band
-
    Choices:
  • 802.11a
  • 802.11b
  • 802.11g
  • 802.11n
  • 802.11n-5G
  • 802.11n,g-only
  • 802.11g-only
  • 802.11n-only
  • 802.11n-5G-only
  • 802.11ac
  • 802.11ac,n-only
  • 802.11ac-only
WiFi band that Radio 1 operates on.
channel
-
Selected list of wireless radio channels.
chan
- / required
Channel number.
override-analysis
-
    Choices:
  • enable
  • disable
Enable to override the WTP profile spectrum analysis configuration.
override-band
-
    Choices:
  • enable
  • disable
Enable to override the WTP profile band setting.
override-channel
-
    Choices:
  • enable
  • disable
Enable to override WTP profile channel settings.
override-txpower
-
    Choices:
  • enable
  • disable
Enable to override the WTP profile power level configuration.
override-vaps
-
    Choices:
  • enable
  • disable
Enable to override WTP profile Virtual Access Point (VAP) settings.
power-level
-
Radio power level as a percentage of the maximum transmit power (0 - 100, default = 100).
radio-id
-
radio-id
spectrum-analysis
-
    Choices:
  • enable
  • disable
Enable/disable spectrum analysis to find interference that would negatively impact wireless performance.
vap-all
-
    Choices:
  • enable
  • disable
Enable/disable the automatic inheritance of all Virtual Access Points (VAPs) (default = enable).
vaps
-
Manually selected list of Virtual Access Points (VAPs).
name
- / required
Virtual Access Point (VAP) name. Source wireless-controller.vap-group.name wireless-controller.vap.name.
split-tunneling-acl
-
Split tunneling ACL filter list.
dest-ip
-
Destination IP and mask for the split-tunneling subnet.
id
- / required
ID.
split-tunneling-acl-local-ap-subnet
-
    Choices:
  • enable
  • disable
Enable/disable automatically adding local subnetwork of FortiAP to split-tunneling ACL (default = disable).
split-tunneling-acl-path
-
    Choices:
  • tunnel
  • local
Split tunneling ACL path is local/tunnel.
state
-
    Choices:
  • present
  • absent
Indicates whether to create or remove the object
tun-mtu-downlink
-
Downlink tunnel MTU in octets. Set the value to either 0 (by default), 576, or 1500.
tun-mtu-uplink
-
Uplink tunnel maximum transmission unit (MTU) in octets (eight-bit bytes). Set the value to either 0 (by default), 576, or 1500.
wan-port-mode
-
    Choices:
  • wan-lan
  • wan-only
Enable/disable using the FortiAP WAN port as a LAN port.
wtp-id
- / required
WTP ID.
wtp-mode
-
    Choices:
  • normal
  • remote
WTP, AP, or FortiAP operating mode; normal (by default) or remote. A tunnel mode SSID can be assigned to an AP in normal mode but not remote mode, while a local-bridge mode SSID can be assigned to an AP in either normal mode or remote mode.
wtp-profile
-
WTP profile name to apply to this WTP, AP or FortiAP. Source wireless-controller.wtp-profile.name.

Notes

Note

  • Requires fortiosapi library developed by Fortinet

  • Run as a local_action in your playbook

Examples

- hosts: localhost
  vars:
   host: "192.168.122.40"
   username: "admin"
   password: ""
   vdom: "root"
  tasks:
  - name: Configure Wireless Termination Points (WTPs), that is, FortiAPs or APs to be managed by FortiGate.
    fortios_wireless_controller_wtp:
      host:  "{{ host }}"
      username: "{{ username }}"
      password: "{{ password }}"
      vdom:  "{{ vdom }}"
      https: "False"
      wireless_controller_wtp:
        state: "present"
        admin: "discovered"
        allowaccess: "telnet"
        bonjour-profile: "<your_own_value> (source wireless-controller.bonjour-profile.name)"
        coordinate-enable: "enable"
        coordinate-latitude: "<your_own_value>"
        coordinate-longitude: "<your_own_value>"
        coordinate-x: "<your_own_value>"
        coordinate-y: "<your_own_value>"
        image-download: "enable"
        index: "12"
        ip-fragment-preventing: "tcp-mss-adjust"
        lan:
            port-mode: "offline"
            port-ssid: "<your_own_value> (source wireless-controller.vap.name)"
            port1-mode: "offline"
            port1-ssid: "<your_own_value> (source wireless-controller.vap.name)"
            port2-mode: "offline"
            port2-ssid: "<your_own_value> (source wireless-controller.vap.name)"
            port3-mode: "offline"
            port3-ssid: "<your_own_value> (source wireless-controller.vap.name)"
            port4-mode: "offline"
            port4-ssid: "<your_own_value> (source wireless-controller.vap.name)"
            port5-mode: "offline"
            port5-ssid: "<your_own_value> (source wireless-controller.vap.name)"
            port6-mode: "offline"
            port6-ssid: "<your_own_value> (source wireless-controller.vap.name)"
            port7-mode: "offline"
            port7-ssid: "<your_own_value> (source wireless-controller.vap.name)"
            port8-mode: "offline"
            port8-ssid: "<your_own_value> (source wireless-controller.vap.name)"
        led-state: "enable"
        location: "<your_own_value>"
        login-passwd: "<your_own_value>"
        login-passwd-change: "yes"
        mesh-bridge-enable: "default"
        name: "default_name_38"
        override-allowaccess: "enable"
        override-ip-fragment: "enable"
        override-lan: "enable"
        override-led-state: "enable"
        override-login-passwd-change: "enable"
        override-split-tunnel: "enable"
        override-wan-port-mode: "enable"
        radio-1:
            auto-power-high: "47"
            auto-power-level: "enable"
            auto-power-low: "49"
            band: "802.11a"
            channel:
             -
                chan: "<your_own_value>"
            override-analysis: "enable"
            override-band: "enable"
            override-channel: "enable"
            override-txpower: "enable"
            override-vaps: "enable"
            power-level: "58"
            radio-id: "59"
            spectrum-analysis: "enable"
            vap-all: "enable"
            vaps:
             -
                name: "default_name_63 (source wireless-controller.vap-group.name wireless-controller.vap.name)"
        radio-2:
            auto-power-high: "65"
            auto-power-level: "enable"
            auto-power-low: "67"
            band: "802.11a"
            channel:
             -
                chan: "<your_own_value>"
            override-analysis: "enable"
            override-band: "enable"
            override-channel: "enable"
            override-txpower: "enable"
            override-vaps: "enable"
            power-level: "76"
            radio-id: "77"
            spectrum-analysis: "enable"
            vap-all: "enable"
            vaps:
             -
                name: "default_name_81 (source wireless-controller.vap-group.name wireless-controller.vap.name)"
        split-tunneling-acl:
         -
            dest-ip: "<your_own_value>"
            id:  "84"
        split-tunneling-acl-local-ap-subnet: "enable"
        split-tunneling-acl-path: "tunnel"
        tun-mtu-downlink: "87"
        tun-mtu-uplink: "88"
        wan-port-mode: "wan-lan"
        wtp-id: "<your_own_value>"
        wtp-mode: "normal"
        wtp-profile: "<your_own_value> (source wireless-controller.wtp-profile.name)"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key Returned Description
build
string
 always
Build number of the fortigate image

Sample:
1547
http_method
string
 always
Last method used to provision the content into FortiGate

Sample:
PUT
http_status
string
 always
Last result given by FortiGate on last operation applied

Sample:
200
mkey
string
 success
Master key (id) used in the last call to FortiGate

Sample:
id
name
string
 always
Name of the table used to fulfill the request

Sample:
urlfilter
path
string
 always
Path of the table used to fulfill the request

Sample:
webfilter
revision
string
 always
Internal revision number

Sample:
17.0.2.10658
serial
string
 always
Serial number of the unit

Sample:
FGVMEVYYQT3AB5352
status
string
 always
Indication of the operation's result

Sample:
success
vdom
string
 always
Virtual domain used

Sample:
root
version
string
 always
Version of the FortiGate

Sample:
v5.6.3


Status

Authors

  • Miguel Angel Munoz (@mamunozgonzalez)

  • Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation you can edit this document to improve it.