fortios_vpn_ipsec_phase2 – Configure VPN autokey tunnel in Fortinet’s FortiOS and FortiGate

New in version 2.8.

Synopsis

• This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify vpn_ipsec feature and phase2 category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.5

Requirements

The below requirements are needed on the host that executes this module.

• fortiosapi>=0.9.8

Parameters

Parameter		Choices/Defaults	Comments
host string			FortiOS or FortiGate IP address.
https boolean		Choices: no yes ←	Indicates if the requests towards FortiGate must use HTTPS protocol.
password string		Default: ""	FortiOS or FortiGate password.
ssl_verify boolean added in 2.9		Choices: no yes ←	Ensures FortiGate certificate must be verified by a proper CA.
state string added in 2.9		Choices: present absent	Indicates whether to create or remove the object. This attribute was present already in previous version in a deeper level. It has been moved out to this outer level.
username string			FortiOS or FortiGate username.
vdom string		Default: "root"	Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit.
vpn_ipsec_phase2 dictionary			Configure VPN autokey tunnel.
	add_route string	Choices: phase1 enable disable	Enable/disable automatic route addition.
	auto_negotiate string	Choices: enable disable	Enable/disable IPsec SA auto-negotiation.
	comments string		Comment.
	dhcp_ipsec string	Choices: enable disable	Enable/disable DHCP-IPsec.
	dhgrp string	Choices: 1 2 5 14 15 16 17 18 19 20 21 27 28 29 30 31	Phase2 DH group.
	dst_addr_type string	Choices: subnet range ip name	Remote proxy ID type.
	dst_end_ip string		Remote proxy ID IPv4 end.
	dst_end_ip6 string		Remote proxy ID IPv6 end.
	dst_name string		Remote proxy ID name. Source firewall.address.name firewall.addrgrp.name.
	dst_name6 string		Remote proxy ID name. Source firewall.address6.name firewall.addrgrp6.name.
	dst_port integer		Quick mode destination port (1 - 65535 or 0 for all).
	dst_start_ip string		Remote proxy ID IPv4 start.
	dst_start_ip6 string		Remote proxy ID IPv6 start.
	dst_subnet string		Remote proxy ID IPv4 subnet.
	dst_subnet6 string		Remote proxy ID IPv6 subnet.
	encapsulation string	Choices: tunnel-mode transport-mode	ESP encapsulation mode.
	keepalive string	Choices: enable disable	Enable/disable keep alive.
	keylife_type string	Choices: seconds kbs both	Keylife type.
	keylifekbs integer		Phase2 key life in number of bytes of traffic (5120 - 4294967295).
	keylifeseconds integer		Phase2 key life in time in seconds (120 - 172800).
	l2tp string	Choices: enable disable	Enable/disable L2TP over IPsec.
	name string / required		IPsec tunnel name.
	pfs string	Choices: enable disable	Enable/disable PFS feature.
	phase1name string		Phase 1 determines the options required for phase 2. Source vpn.ipsec.phase1.name.
	proposal string	Choices: null-md5 null-sha1 null-sha256 null-sha384 null-sha512 des-null des-md5 des-sha1 des-sha256 des-sha384 des-sha512	Phase2 proposal.
	protocol integer		Quick mode protocol selector (1 - 255 or 0 for all).
	replay string	Choices: enable disable	Enable/disable replay detection.
	route_overlap string	Choices: use-old use-new allow	Action for overlapping routes.
	selector_match string	Choices: exact subset auto	Match type to use when comparing selectors.
	single_source string	Choices: enable disable	Enable/disable single source IP restriction.
	src_addr_type string	Choices: subnet range ip name	Local proxy ID type.
	src_end_ip string		Local proxy ID end.
	src_end_ip6 string		Local proxy ID IPv6 end.
	src_name string		Local proxy ID name. Source firewall.address.name firewall.addrgrp.name.
	src_name6 string		Local proxy ID name. Source firewall.address6.name firewall.addrgrp6.name.
	src_port integer		Quick mode source port (1 - 65535 or 0 for all).
	src_start_ip string		Local proxy ID start.
	src_start_ip6 string		Local proxy ID IPv6 start.
	src_subnet string		Local proxy ID subnet.
	src_subnet6 string		Local proxy ID IPv6 subnet.
	state string	Choices: present absent	Deprecated Starting with Ansible 2.9 we recommend using the top-level 'state' parameter. Indicates whether to create or remove the object.
	use_natip string	Choices: enable disable	Enable to use the FortiGate public IP as the source selector when outbound NAT is used.

Notes

Note

• Requires fortiosapi library developed by Fortinet

• Run as a local_action in your playbook

Examples

- hosts: localhost
  vars:
   host: "192.168.122.40"
   username: "admin"
   password: ""
   vdom: "root"
   ssl_verify: "False"
  tasks:
  - name: Configure VPN autokey tunnel.
    fortios_vpn_ipsec_phase2:
      host:  "{{ host }}"
      username: "{{ username }}"
      password: "{{ password }}"
      vdom:  "{{ vdom }}"
      https: "False"
      state: "present"
      vpn_ipsec_phase2:
        add_route: "phase1"
        auto_negotiate: "enable"
        comments: "<your_own_value>"
        dhcp_ipsec: "enable"
        dhgrp: "1"
        dst_addr_type: "subnet"
        dst_end_ip: "<your_own_value>"
        dst_end_ip6: "<your_own_value>"
        dst_name: "<your_own_value> (source firewall.address.name firewall.addrgrp.name)"
        dst_name6: "<your_own_value> (source firewall.address6.name firewall.addrgrp6.name)"
        dst_port: "13"
        dst_start_ip: "<your_own_value>"
        dst_start_ip6: "<your_own_value>"
        dst_subnet: "<your_own_value>"
        dst_subnet6: "<your_own_value>"
        encapsulation: "tunnel-mode"
        keepalive: "enable"
        keylife_type: "seconds"
        keylifekbs: "21"
        keylifeseconds: "22"
        l2tp: "enable"
        name: "default_name_24"
        pfs: "enable"
        phase1name: "<your_own_value> (source vpn.ipsec.phase1.name)"
        proposal: "null-md5"
        protocol: "28"
        replay: "enable"
        route_overlap: "use-old"
        selector_match: "exact"
        single_source: "enable"
        src_addr_type: "subnet"
        src_end_ip: "<your_own_value>"
        src_end_ip6: "<your_own_value>"
        src_name: "<your_own_value> (source firewall.address.name firewall.addrgrp.name)"
        src_name6: "<your_own_value> (source firewall.address6.name firewall.addrgrp6.name)"
        src_port: "38"
        src_start_ip: "<your_own_value>"
        src_start_ip6: "<your_own_value>"
        src_subnet: "<your_own_value>"
        src_subnet6: "<your_own_value>"
        use_natip: "enable"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Returned	Description
build string	always	Build number of the fortigate image Sample: 1547
http_method string	always	Last method used to provision the content into FortiGate Sample: PUT
http_status string	always	Last result given by FortiGate on last operation applied Sample: 200
mkey string	success	Master key (id) used in the last call to FortiGate Sample: id
name string	always	Name of the table used to fulfill the request Sample: urlfilter
path string	always	Path of the table used to fulfill the request Sample: webfilter
revision string	always	Internal revision number Sample: 17.0.2.10658
serial string	always	Serial number of the unit Sample: FGVMEVYYQT3AB5352
status string	always	Indication of the operation's result Sample: success
vdom string	always	Virtual domain used Sample: root
version string	always	Version of the FortiGate Sample: v5.6.3

Status

• This module is not guaranteed to have a backwards compatible interface. [preview]

• This module is maintained by the Ansible Community. [community]

Authors

• Miguel Angel Munoz (@mamunozgonzalez)

• Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.