You are reading an unmaintained version of the Ansible documentation. Unmaintained Ansible versions can contain unfixed security vulnerabilities (CVE). Please upgrade to a maintained version. See the latest Ansible documentation.

fortinet.fortimanager.fmgr_webfilter_profile module – Configure Web filter profiles.

Note

This module is part of the fortinet.fortimanager collection (version 2.1.5).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install fortinet.fortimanager.

To use it in a playbook, specify: fortinet.fortimanager.fmgr_webfilter_profile.

New in version 2.10: of fortinet.fortimanager

Synopsis

• This module is able to configure a FortiManager device.

• Examples include all parameters and values which need to be adjusted to data sources before usage.

Parameters

Parameter	Comments
adom string / required	the parameter (adom) in requested url
bypass_validation boolean	only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters Choices: no ← (default) yes
enable_log boolean	Enable/Disable logging for task Choices: no ← (default) yes
proposed_method string	The overridden method for the underlying Json RPC request Choices: update set add
rc_failed list / elements=string	the rc codes list with which the conditions to fail will be overriden
rc_succeeded list / elements=string	the rc codes list with which the conditions to succeed will be overriden
state string / required	the directive to create, update or delete an object Choices: present absent
webfilter_profile dictionary	the top level parameters set
antiphish dictionary	no description
authentication string	Authentication methods. Choices: domain-controller ldap
check-basic-auth string	Enable/disable checking of HTTP Basic Auth field for known credentials. Choices: disable enable
check-uri string	Enable/disable checking of GET URI parameters for known credentials. Choices: disable enable
check-username-only string	Enable/disable acting only on valid username credentials. Action will be taken for valid usernames regardless of passw… Choices: disable enable
custom-patterns list / elements=string	Custom-Patterns.
category string	Category that the pattern matches. Choices: username password
pattern string	Target pattern.
type string	Pattern will be treated either as a regex pattern or literal string. Choices: regex literal
default-action string	Action to be taken when there is no matching rule. Choices: log block exempt
domain-controller string	Domain for which to verify received credentials against.
inspection-entries list / elements=string	Inspection-Entries.
action string	Action to be taken upon an AntiPhishing match. Choices: log block exempt
fortiguard-category string	FortiGuard category to match.
name string	Inspection target name.
ldap string	LDAP server for which to verify received credentials against.
max-body-len integer	Maximum size of a POST body to check for credentials.
status string	Toggle AntiPhishing functionality. Choices: disable enable
comment string	Optional comments.
extended-log string	Enable/disable extended logging for web filtering. Choices: disable enable
feature-set string	Flow/proxy feature set. Choices: proxy flow
ftgd-wf dictionary	no description
exempt-quota string	Do not stop quota for these categories.
filters list / elements=string	Filters.
action string	Action to take for matches. Choices: block monitor warning authenticate
auth-usr-grp string	Groups with permission to authenticate.
category string	Categories and groups the filter examines.
id integer	ID number.
log string	Enable/disable logging. Choices: disable enable
override-replacemsg string	Override replacement message.
warn-duration string	Duration of warnings.
warning-duration-type string	Re-display warning after closing browser or after a timeout. Choices: session timeout
warning-prompt string	Warning prompts in each category or each domain. Choices: per-domain per-category
max-quota-timeout integer	Maximum FortiGuard quota used by single page view in seconds (excludes streams).
options list / elements=string	Options for FortiGuard Web Filter. Choices: error-allow http-err-detail rate-image-urls strict-blocking rate-server-ip redir-block connect-request-bypass log-all-url ftgd-disable
ovrd string	Allow web filter profile overrides.
quota list / elements=string	Quota.
category string	FortiGuard categories to apply quota to (category action must be set to monitor).
duration string	Duration of quota.
id integer	ID number.
override-replacemsg string	Override replacement message.
type string	Quota type. Choices: time traffic
unit string	Traffic quota unit of measurement. Choices: B KB MB GB
value integer	Traffic quota value.
rate-crl-urls string	Enable/disable rating CRL by URL. Choices: disable enable
rate-css-urls string	Enable/disable rating CSS by URL. Choices: disable enable
rate-image-urls string	Rate-Image-Urls. Choices: disable enable
rate-javascript-urls string	Enable/disable rating JavaScript by URL. Choices: disable enable
https-replacemsg string	Enable replacement messages for HTTPS. Choices: disable enable
inspection-mode string	Web filtering inspection mode. Choices: proxy flow-based dns
log-all-url string	Enable/disable logging all URLs visited. Choices: disable enable
name string	Profile name.
options list / elements=string	Options. Choices: block-invalid-url jscript js vbs unknown wf-referer https-scan intrinsic wf-cookie per-user-bwl activexfilter cookiefilter https-url-scan javafilter rangeblock contenttype-check per-user-bal
override dictionary	no description
ovrd-cookie string	Allow/deny browser-based (cookie) overrides. Choices: deny allow
ovrd-dur string	Override duration.
ovrd-dur-mode string	Override duration mode. Choices: constant ask
ovrd-scope string	Override scope. Choices: user user-group ip ask browser
ovrd-user-group string	User groups with permission to use the override.
profile string	Web filter profile with permission to create overrides.
profile-attribute string	Profile attribute to retrieve from the RADIUS server. Choices: User-Name User-Password CHAP-Password NAS-IP-Address NAS-Port Service-Type Framed-Protocol Framed-IP-Address Framed-IP-Netmask Framed-Routing Filter-Id Framed-MTU Framed-Compression Login-IP-Host Login-Service Login-TCP-Port Reply-Message Callback-Number Callback-Id Framed-Route Framed-IPX-Network State Class Vendor-Specific Session-Timeout Idle-Timeout Termination-Action Called-Station-Id Calling-Station-Id NAS-Identifier Proxy-State Login-LAT-Service Login-LAT-Node Login-LAT-Group Framed-AppleTalk-Link Framed-AppleTalk-Network Framed-AppleTalk-Zone Acct-Status-Type Acct-Delay-Time Acct-Input-Octets Acct-Output-Octets Acct-Session-Id Acct-Authentic Acct-Session-Time Acct-Input-Packets Acct-Output-Packets Acct-Terminate-Cause Acct-Multi-Session-Id Acct-Link-Count CHAP-Challenge NAS-Port-Type Port-Limit Login-LAT-Port
profile-type string	Override profile type. Choices: list radius
ovrd-perm list / elements=string	Permitted override types. Choices: bannedword-override urlfilter-override fortiguard-wf-override contenttype-check-override
post-action string	Action taken for HTTP POST traffic. Choices: normal comfort block
replacemsg-group string	Replacement message group.
url-extraction dictionary	no description
redirect-header string	HTTP header name to use for client redirect on blocked requests
redirect-no-content string	Enable / Disable empty message-body entity in HTTP response Choices: disable enable
redirect-url string	HTTP header value to use for client redirect on blocked requests
server-fqdn string	URL extraction server FQDN (fully qualified domain name)
status string	Enable URL Extraction Choices: disable enable
web dictionary	no description
allowlist list / elements=string	FortiGuard allowlist settings. Choices: exempt-av exempt-webcontent exempt-activex-java-cookie exempt-dlp exempt-rangeblock extended-log-others
blacklist string	Enable/disable automatic addition of URLs detected by FortiSandbox to blacklist. Choices: disable enable
blocklist string	Enable/disable automatic addition of URLs detected by FortiSandbox to blocklist. Choices: disable enable
bword-table string	Banned word table ID.
bword-threshold integer	Banned word score threshold.
content-header-list string	Content header list.
keyword-match string	Search keywords to log when match is found.
log-search string	Enable/disable logging all search phrases. Choices: disable enable
safe-search list / elements=string	Safe search type. Choices: google yahoo bing url header
urlfilter-table string	URL filter table ID.
whitelist list / elements=string	FortiGuard whitelist settings. Choices: exempt-av exempt-webcontent exempt-activex-java-cookie exempt-dlp exempt-rangeblock extended-log-others
youtube-restrict string	YouTube EDU filter level. Choices: strict none moderate
web-antiphishing-log string	Enable/disable logging of AntiPhishing checks. Choices: disable enable
web-content-log string	Enable/disable logging logging blocked web content. Choices: disable enable
web-extended-all-action-log string	Enable/disable extended any filter action logging for web filtering. Choices: disable enable
web-filter-activex-log string	Enable/disable logging ActiveX. Choices: disable enable
web-filter-applet-log string	Enable/disable logging Java applets. Choices: disable enable
web-filter-command-block-log string	Enable/disable logging blocked commands. Choices: disable enable
web-filter-cookie-log string	Enable/disable logging cookie filtering. Choices: disable enable
web-filter-cookie-removal-log string	Enable/disable logging blocked cookies. Choices: disable enable
web-filter-js-log string	Enable/disable logging Java scripts. Choices: disable enable
web-filter-jscript-log string	Enable/disable logging JScripts. Choices: disable enable
web-filter-referer-log string	Enable/disable logging referrers. Choices: disable enable
web-filter-unknown-log string	Enable/disable logging unknown scripts. Choices: disable enable
web-filter-vbs-log string	Enable/disable logging VBS scripts. Choices: disable enable
web-ftgd-err-log string	Enable/disable logging rating errors. Choices: disable enable
web-ftgd-quota-usage string	Enable/disable logging daily quota usage. Choices: disable enable
web-invalid-domain-log string	Enable/disable logging invalid domain names. Choices: disable enable
web-url-log string	Enable/disable logging URL filtering. Choices: disable enable
wisp string	Enable/disable web proxy WISP. Choices: disable enable
wisp-algorithm string	WISP server selection algorithm. Choices: auto-learning primary-secondary round-robin
wisp-servers string	WISP servers.
youtube-channel-filter list / elements=string	Youtube-Channel-Filter.
channel-id string	YouTube channel ID to be filtered.
comment string	Comment.
id integer	ID.
youtube-channel-status string	YouTube channel filter status. Choices: disable blacklist whitelist
workspace_locking_adom string	the adom to lock for FortiManager running in workspace mode, the value can be global and others including root
workspace_locking_timeout integer	the maximum time in seconds to wait for other user to release the workspace lock Default: 300

Notes

Note

• Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.

• To create or update an object, use state present directive.

• To delete an object, use state absent directive.

• Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded

Examples

- hosts: fortimanager-inventory
  collections:
    - fortinet.fortimanager
  connection: httpapi
  vars:
     ansible_httpapi_use_ssl: True
     ansible_httpapi_validate_certs: False
     ansible_httpapi_port: 443
  tasks:
   - name: Configure Web filter profiles.
     fmgr_webfilter_profile:
        bypass_validation: False
        workspace_locking_adom: <value in [global, custom adom including root]>
        workspace_locking_timeout: 300
        rc_succeeded: [0, -2, -3, ...]
        rc_failed: [-2, -3, ...]
        adom: <your own value>
        state: <value in [present, absent]>
        webfilter_profile:
           comment: <value of string>
           extended-log: <value in [disable, enable]>
           https-replacemsg: <value in [disable, enable]>
           inspection-mode: <value in [proxy, flow-based, dns]>
           log-all-url: <value in [disable, enable]>
           name: <value of string>
           options:
             - block-invalid-url
             - jscript
             - js
             - vbs
             - unknown
             - wf-referer
             - https-scan
             - intrinsic
             - wf-cookie
             - per-user-bwl
             - activexfilter
             - cookiefilter
             - https-url-scan
             - javafilter
             - rangeblock
             - contenttype-check
             - per-user-bal
           ovrd-perm:
             - bannedword-override
             - urlfilter-override
             - fortiguard-wf-override
             - contenttype-check-override
           post-action: <value in [normal, comfort, block]>
           replacemsg-group: <value of string>
           web-content-log: <value in [disable, enable]>
           web-extended-all-action-log: <value in [disable, enable]>
           web-filter-activex-log: <value in [disable, enable]>
           web-filter-applet-log: <value in [disable, enable]>
           web-filter-command-block-log: <value in [disable, enable]>
           web-filter-cookie-log: <value in [disable, enable]>
           web-filter-cookie-removal-log: <value in [disable, enable]>
           web-filter-js-log: <value in [disable, enable]>
           web-filter-jscript-log: <value in [disable, enable]>
           web-filter-referer-log: <value in [disable, enable]>
           web-filter-unknown-log: <value in [disable, enable]>
           web-filter-vbs-log: <value in [disable, enable]>
           web-ftgd-err-log: <value in [disable, enable]>
           web-ftgd-quota-usage: <value in [disable, enable]>
           web-invalid-domain-log: <value in [disable, enable]>
           web-url-log: <value in [disable, enable]>
           wisp: <value in [disable, enable]>
           wisp-algorithm: <value in [auto-learning, primary-secondary, round-robin]>
           wisp-servers: <value of string>
           youtube-channel-filter:
             -
                 channel-id: <value of string>
                 comment: <value of string>
                 id: <value of integer>
           youtube-channel-status: <value in [disable, blacklist, whitelist]>
           feature-set: <value in [proxy, flow]>
           web-antiphishing-log: <value in [disable, enable]>
           antiphish:
              check-basic-auth: <value in [disable, enable]>
              check-uri: <value in [disable, enable]>
              check-username-only: <value in [disable, enable]>
              custom-patterns:
                -
                    category: <value in [username, password]>
                    pattern: <value of string>
                    type: <value in [regex, literal]>
              default-action: <value in [log, block, exempt]>
              domain-controller: <value of string>
              inspection-entries:
                -
                    action: <value in [log, block, exempt]>
                    fortiguard-category: <value of string>
                    name: <value of string>
              max-body-len: <value of integer>
              status: <value in [disable, enable]>
              authentication: <value in [domain-controller, ldap]>
              ldap: <value of string>
           ftgd-wf:
              exempt-quota: <value of string>
              filters:
                -
                    action: <value in [block, monitor, warning, ...]>
                    auth-usr-grp: <value of string>
                    category: <value of string>
                    id: <value of integer>
                    log: <value in [disable, enable]>
                    override-replacemsg: <value of string>
                    warn-duration: <value of string>
                    warning-duration-type: <value in [session, timeout]>
                    warning-prompt: <value in [per-domain, per-category]>
              max-quota-timeout: <value of integer>
              options:
                - error-allow
                - http-err-detail
                - rate-image-urls
                - strict-blocking
                - rate-server-ip
                - redir-block
                - connect-request-bypass
                - log-all-url
                - ftgd-disable
              ovrd: <value of string>
              quota:
                -
                    category: <value of string>
                    duration: <value of string>
                    id: <value of integer>
                    override-replacemsg: <value of string>
                    type: <value in [time, traffic]>
                    unit: <value in [B, KB, MB, ...]>
                    value: <value of integer>
              rate-crl-urls: <value in [disable, enable]>
              rate-css-urls: <value in [disable, enable]>
              rate-image-urls: <value in [disable, enable]>
              rate-javascript-urls: <value in [disable, enable]>
           override:
              ovrd-cookie: <value in [deny, allow]>
              ovrd-dur: <value of string>
              ovrd-dur-mode: <value in [constant, ask]>
              ovrd-scope: <value in [user, user-group, ip, ...]>
              ovrd-user-group: <value of string>
              profile: <value of string>
              profile-attribute: <value in [User-Name, User-Password, CHAP-Password, ...]>
              profile-type: <value in [list, radius]>
           url-extraction:
              redirect-header: <value of string>
              redirect-no-content: <value in [disable, enable]>
              redirect-url: <value of string>
              server-fqdn: <value of string>
              status: <value in [disable, enable]>
           web:
              blacklist: <value in [disable, enable]>
              bword-table: <value of string>
              bword-threshold: <value of integer>
              content-header-list: <value of string>
              keyword-match: <value of string>
              log-search: <value in [disable, enable]>
              safe-search:
                - google
                - yahoo
                - bing
                - url
                - header
              urlfilter-table: <value of string>
              whitelist:
                - exempt-av
                - exempt-webcontent
                - exempt-activex-java-cookie
                - exempt-dlp
                - exempt-rangeblock
                - extended-log-others
              youtube-restrict: <value in [strict, none, moderate]>
              allowlist:
                - exempt-av
                - exempt-webcontent
                - exempt-activex-java-cookie
                - exempt-dlp
                - exempt-rangeblock
                - extended-log-others
              blocklist: <value in [disable, enable]>

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
request_url string	The full url requested Returned: always Sample: “/sys/login/user”
response_code integer	The status of api request Returned: always Sample: 0
response_message string	The descriptive message of the api response Returned: always Sample: “OK.”

Authors

• Link Zheng (@chillancezen)

• Jie Xue (@JieX19)

• Frank Shen (@fshen01)

• Hongbin Lu (@fgtdev-hblu)

Collection links

Issue Tracker Homepage Repository (Sources)