fortios_antivirus_profile – Configure AntiVirus profiles in Fortinet’s FortiOS and FortiGate

New in version 2.8.

Synopsis

  • This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify antivirus feature and profile category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.5

Requirements

The below requirements are needed on the host that executes this module.

  • fortiosapi>=0.9.8

Parameters

Parameter Choices/Defaults Comments
antivirus_profile
dictionary
Configure AntiVirus profiles.
analytics_bl_filetype
integer
Only submit files matching this DLP file-pattern to FortiSandbox. Source dlp.filepattern.id.
analytics_db
string
    Choices:
  • disable
  • enable
Enable/disable using the FortiSandbox signature database to supplement the AV signature databases.
analytics_max_upload
integer
Maximum size of files that can be uploaded to FortiSandbox (1 - 395 MBytes).
analytics_wl_filetype
integer
Do not submit files matching this DLP file-pattern to FortiSandbox. Source dlp.filepattern.id.
av_block_log
string
    Choices:
  • enable
  • disable
Enable/disable logging for AntiVirus file blocking.
av_virus_log
string
    Choices:
  • enable
  • disable
Enable/disable AntiVirus logging.
comment
string
Comment.
content_disarm
dictionary
AV Content Disarm and Reconstruction settings.
cover_page
string
    Choices:
  • disable
  • enable
Enable/disable inserting a cover page into the disarmed document.
detect_only
string
    Choices:
  • disable
  • enable
Enable/disable only detect disarmable files, do not alter content.
office_embed
string
    Choices:
  • disable
  • enable
Enable/disable stripping of embedded objects in Microsoft Office documents.
office_hylink
string
    Choices:
  • disable
  • enable
Enable/disable stripping of hyperlinks in Microsoft Office documents.
office_linked
string
    Choices:
  • disable
  • enable
Enable/disable stripping of linked objects in Microsoft Office documents.
office_macro
string
    Choices:
  • disable
  • enable
Enable/disable stripping of macros in Microsoft Office documents.
original_file_destination
string
    Choices:
  • fortisandbox
  • quarantine
  • discard
Destination to send original file if active content is removed.
pdf_act_form
string
    Choices:
  • disable
  • enable
Enable/disable stripping of actions that submit data to other targets in PDF documents.
pdf_act_gotor
string
    Choices:
  • disable
  • enable
Enable/disable stripping of links to other PDFs in PDF documents.
pdf_act_java
string
    Choices:
  • disable
  • enable
Enable/disable stripping of actions that execute JavaScript code in PDF documents.
pdf_act_launch
string
    Choices:
  • disable
  • enable
Enable/disable stripping of links to external applications in PDF documents.
pdf_act_movie
string
    Choices:
  • disable
  • enable
Enable/disable stripping of embedded movies in PDF documents.
pdf_act_sound
string
    Choices:
  • disable
  • enable
Enable/disable stripping of embedded sound files in PDF documents.
pdf_embedfile
string
    Choices:
  • disable
  • enable
Enable/disable stripping of embedded files in PDF documents.
pdf_hyperlink
string
    Choices:
  • disable
  • enable
Enable/disable stripping of hyperlinks from PDF documents.
pdf_javacode
string
    Choices:
  • disable
  • enable
Enable/disable stripping of JavaScript code in PDF documents.
extended_log
string
    Choices:
  • enable
  • disable
Enable/disable extended logging for antivirus.
ftgd_analytics
string
    Choices:
  • disable
  • suspicious
  • everything
Settings to control which files are uploaded to FortiSandbox.
ftp
dictionary
Configure FTP AntiVirus options.
archive_block
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to block.
archive_log
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to log.
emulator
string
    Choices:
  • enable
  • disable
Enable/disable the virus emulator.
options
string
    Choices:
  • scan
  • avmonitor
  • quarantine
Enable/disable FTP AntiVirus scanning, monitoring, and quarantine.
outbreak_prevention
string
    Choices:
  • disabled
  • files
  • full-archive
Enable FortiGuard Virus Outbreak Prevention service.
http
dictionary
Configure HTTP AntiVirus options.
archive_block
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to block.
archive_log
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to log.
content_disarm
string
    Choices:
  • disable
  • enable
Enable Content Disarm and Reconstruction for this protocol.
emulator
string
    Choices:
  • enable
  • disable
Enable/disable the virus emulator.
options
string
    Choices:
  • scan
  • avmonitor
  • quarantine
Enable/disable HTTP AntiVirus scanning, monitoring, and quarantine.
outbreak_prevention
string
    Choices:
  • disabled
  • files
  • full-archive
Enable FortiGuard Virus Outbreak Prevention service.
imap
dictionary
Configure IMAP AntiVirus options.
archive_block
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to block.
archive_log
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to log.
content_disarm
string
    Choices:
  • disable
  • enable
Enable Content Disarm and Reconstruction for this protocol.
emulator
string
    Choices:
  • enable
  • disable
Enable/disable the virus emulator.
executables
string
    Choices:
  • default
  • virus
Treat Windows executable files as viruses for the purpose of blocking or monitoring.
options
string
    Choices:
  • scan
  • avmonitor
  • quarantine
Enable/disable IMAP AntiVirus scanning, monitoring, and quarantine.
outbreak_prevention
string
    Choices:
  • disabled
  • files
  • full-archive
Enable FortiGuard Virus Outbreak Prevention service.
inspection_mode
string
    Choices:
  • proxy
  • flow-based
Inspection mode.
mapi
dictionary
Configure MAPI AntiVirus options.
archive_block
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to block.
archive_log
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to log.
emulator
string
    Choices:
  • enable
  • disable
Enable/disable the virus emulator.
executables
string
    Choices:
  • default
  • virus
Treat Windows executable files as viruses for the purpose of blocking or monitoring.
options
string
    Choices:
  • scan
  • avmonitor
  • quarantine
Enable/disable MAPI AntiVirus scanning, monitoring, and quarantine.
outbreak_prevention
string
    Choices:
  • disabled
  • files
  • full-archive
Enable FortiGuard Virus Outbreak Prevention service.
mobile_malware_db
string
    Choices:
  • disable
  • enable
Enable/disable using the mobile malware signature database.
nac_quar
dictionary
Configure AntiVirus quarantine settings.
expiry
string
Duration of quarantine.
infected
string
    Choices:
  • none
  • quar-src-ip
Enable/Disable quarantining infected hosts to the banned user list.
log
string
    Choices:
  • enable
  • disable
Enable/disable AntiVirus quarantine logging.
name
string / required
Profile name.
nntp
dictionary
Configure NNTP AntiVirus options.
archive_block
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to block.
archive_log
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to log.
emulator
string
    Choices:
  • enable
  • disable
Enable/disable the virus emulator.
options
string
    Choices:
  • scan
  • avmonitor
  • quarantine
Enable/disable NNTP AntiVirus scanning, monitoring, and quarantine.
outbreak_prevention
string
    Choices:
  • disabled
  • files
  • full-archive
Enable FortiGuard Virus Outbreak Prevention service.
pop3
dictionary
Configure POP3 AntiVirus options.
archive_block
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to block.
archive_log
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to log.
content_disarm
string
    Choices:
  • disable
  • enable
Enable Content Disarm and Reconstruction for this protocol.
emulator
string
    Choices:
  • enable
  • disable
Enable/disable the virus emulator.
executables
string
    Choices:
  • default
  • virus
Treat Windows executable files as viruses for the purpose of blocking or monitoring.
options
string
    Choices:
  • scan
  • avmonitor
  • quarantine
Enable/disable POP3 AntiVirus scanning, monitoring, and quarantine.
outbreak_prevention
string
    Choices:
  • disabled
  • files
  • full-archive
Enable FortiGuard Virus Outbreak Prevention service.
replacemsg_group
string
Replacement message group customized for this profile. Source system.replacemsg-group.name.
scan_mode
string
    Choices:
  • quick
  • full
Choose between full scan mode and quick scan mode.
smb
dictionary
Configure SMB AntiVirus options.
archive_block
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to block.
archive_log
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to log.
emulator
string
    Choices:
  • enable
  • disable
Enable/disable the virus emulator.
options
string
    Choices:
  • scan
  • avmonitor
  • quarantine
Enable/disable SMB AntiVirus scanning, monitoring, and quarantine.
outbreak_prevention
string
    Choices:
  • disabled
  • files
  • full-archive
Enable FortiGuard Virus Outbreak Prevention service.
smtp
dictionary
Configure SMTP AntiVirus options.
archive_block
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to block.
archive_log
string
    Choices:
  • encrypted
  • corrupted
  • partiallycorrupted
  • multipart
  • nested
  • mailbomb
  • fileslimit
  • timeout
  • unhandled
Select the archive types to log.
content_disarm
string
    Choices:
  • disable
  • enable
Enable Content Disarm and Reconstruction for this protocol.
emulator
string
    Choices:
  • enable
  • disable
Enable/disable the virus emulator.
executables
string
    Choices:
  • default
  • virus
Treat Windows executable files as viruses for the purpose of blocking or monitoring.
options
string
    Choices:
  • scan
  • avmonitor
  • quarantine
Enable/disable SMTP AntiVirus scanning, monitoring, and quarantine.
outbreak_prevention
string
    Choices:
  • disabled
  • files
  • full-archive
Enable FortiGuard Virus Outbreak Prevention service.
state
string
    Choices:
  • present
  • absent
Deprecated
Starting with Ansible 2.9 we recommend using the top-level 'state' parameter.
Indicates whether to create or remove the object.
host
string
FortiOS or FortiGate IP address.
https
boolean
    Choices:
  • no
  • yes ←
Indicates if the requests towards FortiGate must use HTTPS protocol.
password
string
Default:
""
FortiOS or FortiGate password.
ssl_verify
boolean
added in 2.9
    Choices:
  • no
  • yes ←
Ensures FortiGate certificate must be verified by a proper CA.
state
string
added in 2.9
    Choices:
  • present
  • absent
Indicates whether to create or remove the object. This attribute was present already in previous version in a deeper level. It has been moved out to this outer level.
username
string
FortiOS or FortiGate username.
vdom
string
Default:
"root"
Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit.

Notes

Note

  • Requires fortiosapi library developed by Fortinet

  • Run as a local_action in your playbook

Examples

- hosts: localhost
  vars:
   host: "192.168.122.40"
   username: "admin"
   password: ""
   vdom: "root"
   ssl_verify: "False"
  tasks:
  - name: Configure AntiVirus profiles.
    fortios_antivirus_profile:
      host:  "{{ host }}"
      username: "{{ username }}"
      password: "{{ password }}"
      vdom:  "{{ vdom }}"
      https: "False"
      state: "present"
      antivirus_profile:
        analytics_bl_filetype: "3 (source dlp.filepattern.id)"
        analytics_db: "disable"
        analytics_max_upload: "5"
        analytics_wl_filetype: "6 (source dlp.filepattern.id)"
        av_block_log: "enable"
        av_virus_log: "enable"
        comment: "Comment."
        content_disarm:
            cover_page: "disable"
            detect_only: "disable"
            office_embed: "disable"
            office_hylink: "disable"
            office_linked: "disable"
            office_macro: "disable"
            original_file_destination: "fortisandbox"
            pdf_act_form: "disable"
            pdf_act_gotor: "disable"
            pdf_act_java: "disable"
            pdf_act_launch: "disable"
            pdf_act_movie: "disable"
            pdf_act_sound: "disable"
            pdf_embedfile: "disable"
            pdf_hyperlink: "disable"
            pdf_javacode: "disable"
        extended_log: "enable"
        ftgd_analytics: "disable"
        ftp:
            archive_block: "encrypted"
            archive_log: "encrypted"
            emulator: "enable"
            options: "scan"
            outbreak_prevention: "disabled"
        http:
            archive_block: "encrypted"
            archive_log: "encrypted"
            content_disarm: "disable"
            emulator: "enable"
            options: "scan"
            outbreak_prevention: "disabled"
        imap:
            archive_block: "encrypted"
            archive_log: "encrypted"
            content_disarm: "disable"
            emulator: "enable"
            executables: "default"
            options: "scan"
            outbreak_prevention: "disabled"
        inspection_mode: "proxy"
        mapi:
            archive_block: "encrypted"
            archive_log: "encrypted"
            emulator: "enable"
            executables: "default"
            options: "scan"
            outbreak_prevention: "disabled"
        mobile_malware_db: "disable"
        nac_quar:
            expiry: "<your_own_value>"
            infected: "none"
            log: "enable"
        name: "default_name_63"
        nntp:
            archive_block: "encrypted"
            archive_log: "encrypted"
            emulator: "enable"
            options: "scan"
            outbreak_prevention: "disabled"
        pop3:
            archive_block: "encrypted"
            archive_log: "encrypted"
            content_disarm: "disable"
            emulator: "enable"
            executables: "default"
            options: "scan"
            outbreak_prevention: "disabled"
        replacemsg_group: "<your_own_value> (source system.replacemsg-group.name)"
        scan_mode: "quick"
        smb:
            archive_block: "encrypted"
            archive_log: "encrypted"
            emulator: "enable"
            options: "scan"
            outbreak_prevention: "disabled"
        smtp:
            archive_block: "encrypted"
            archive_log: "encrypted"
            content_disarm: "disable"
            emulator: "enable"
            executables: "default"
            options: "scan"
            outbreak_prevention: "disabled"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key Returned Description
build
string
always
Build number of the fortigate image

Sample:
1547
http_method
string
always
Last method used to provision the content into FortiGate

Sample:
PUT
http_status
string
always
Last result given by FortiGate on last operation applied

Sample:
200
mkey
string
success
Master key (id) used in the last call to FortiGate

Sample:
id
name
string
always
Name of the table used to fulfill the request

Sample:
urlfilter
path
string
always
Path of the table used to fulfill the request

Sample:
webfilter
revision
string
always
Internal revision number

Sample:
17.0.2.10658
serial
string
always
Serial number of the unit

Sample:
FGVMEVYYQT3AB5352
status
string
always
Indication of the operation's result

Sample:
success
vdom
string
always
Virtual domain used

Sample:
root
version
string
always
Version of the FortiGate

Sample:
v5.6.3


Status

Authors

  • Miguel Angel Munoz (@mamunozgonzalez)

  • Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.