You are reading an unmaintained version of the Ansible documentation. Unmaintained Ansible versions can contain unfixed security vulnerabilities (CVE). Please upgrade to a maintained version. See the latest Ansible documentation.

fortinet.fortios.fortios_system_ha module – Configure HA in Fortinet’s FortiOS and FortiGate.

Note

This module is part of the fortinet.fortios collection (version 2.1.6).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install fortinet.fortios.

To use it in a playbook, specify: fortinet.fortios.fortios_system_ha.

New in version 2.0.0: of fortinet.fortios

Synopsis

• This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify system feature and ha category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0

Requirements

The below requirements are needed on the host that executes this module.

• ansible>=2.9.0

Parameters

Parameter	Comments
access_token string	Token-based authentication. Generated from GUI of Fortigate.
enable_log boolean	Enable/Disable logging for task. Choices: no ← (default) yes
member_path string	Member attribute path to operate on. Delimited by a slash character if there are more than one attribute. Parameter marked with member_path is legitimate for doing member operation.
member_state string	Add or delete a member under specified attribute path. When member_state is specified, the state option is ignored. Choices: present absent
system_ha dictionary	Configure HA.
arps integer	Number of gratuitous ARPs (1 - 60). Lower to reduce traffic. Higher to reduce failover time.
arps_interval integer	Time between gratuitous ARPs (1 - 20 sec). Lower to reduce failover time. Higher to reduce traffic.
authentication string	Enable/disable heartbeat message authentication. Choices: enable disable
cpu_threshold string	Dynamic weighted load balancing CPU usage weight and high and low thresholds.
encryption string	Enable/disable heartbeat message encryption. Choices: enable disable
failover_hold_time integer	Time to wait before failover (0 - 300 sec), to avoid flip.
ftp_proxy_threshold string	Dynamic weighted load balancing weight and high and low number of FTP proxy sessions.
gratuitous_arps string	Enable/disable gratuitous ARPs. Disable if link-failed-signal enabled. Choices: enable disable
group_id integer	HA group ID (0 - 1023). Must be the same for all members.
group_name string	Cluster group name. Must be the same for all members.
ha_direct string	Enable/disable using ha-mgmt interface for syslog, SNMP, remote authentication (RADIUS), FortiAnalyzer, FortiSandbox, sFlow, and Netflow. Choices: enable disable
ha_eth_type string	HA heartbeat packet Ethertype (4-digit hex).
ha_mgmt_interfaces list / elements=dictionary	Reserve interfaces to manage individual cluster units.
dst string	Default route destination for reserved HA management interface.
gateway string	Default route gateway for reserved HA management interface.
gateway6 string	Default IPv6 gateway for reserved HA management interface.
id integer / required	Table ID.
interface string	Interface to reserve for HA management. Source system.interface.name.
ha_mgmt_status string	Enable to reserve interfaces to manage individual cluster units. Choices: enable disable
ha_uptime_diff_margin integer	Normally you would only reduce this value for failover testing.
hb_interval integer	Time between sending heartbeat packets (1 - 20). Increase to reduce false positives.
hb_interval_in_milliseconds string	Number of milliseconds for each heartbeat interval: 100ms or 10ms. Choices: 100ms 10ms
hb_lost_threshold integer	Number of lost heartbeats to signal a failure (1 - 60). Increase to reduce false positives.
hbdev list / elements=string	Heartbeat interfaces. Must be the same for all members.
hc_eth_type string	Transparent mode HA heartbeat packet Ethertype (4-digit hex).
hello_holddown integer	Time to wait before changing from hello to work state (5 - 300 sec).
http_proxy_threshold string	Dynamic weighted load balancing weight and high and low number of HTTP proxy sessions.
imap_proxy_threshold string	Dynamic weighted load balancing weight and high and low number of IMAP proxy sessions.
inter_cluster_session_sync string	Enable/disable synchronization of sessions among HA clusters. Choices: enable disable
key string	Key.
l2ep_eth_type string	Telnet session HA heartbeat packet Ethertype (4-digit hex).
link_failed_signal string	Enable to shut down all interfaces for 1 sec after a failover. Use if gratuitous ARPs do not update network. Choices: enable disable
load_balance_all string	Enable to load balance TCP sessions. Disable to load balance proxy sessions only. Choices: enable disable
logical_sn string	Enable/disable usage of the logical serial number. Choices: enable disable
memory_based_failover string	Enable/disable memory based failover. Choices: enable disable
memory_compatible_mode string	Enable/disable memory compatible mode. Choices: enable disable
memory_failover_flip_timeout integer	Time to wait between subsequent memory based failovers in minutes (6 - 2147483647).
memory_failover_monitor_period integer	Duration of high memory usage before memory based failover is triggered in seconds (1 - 300).
memory_failover_sample_rate integer	Rate at which memory usage is sampled in order to measure memory usage in seconds (1 - 60).
memory_failover_threshold integer	Memory usage threshold to trigger memory based failover (0 means using conserve mode threshold in system.global).
memory_threshold string	Dynamic weighted load balancing memory usage weight and high and low thresholds.
mode string	HA mode. Must be the same for all members. FGSP requires standalone. Choices: standalone a-a a-p
monitor list / elements=string	Interfaces to check for port monitoring (or link failure). Source system.interface.name.
multicast_ttl integer	HA multicast TTL on primary (5 - 3600 sec).
nntp_proxy_threshold string	Dynamic weighted load balancing weight and high and low number of NNTP proxy sessions.
override string	Enable and increase the priority of the unit that should always be primary. Choices: enable disable
override_wait_time integer	Delay negotiating if override is enabled (0 - 3600 sec). Reduces how often the cluster negotiates.
password string	Cluster password. Must be the same for all members.
pingserver_failover_threshold integer	Remote IP monitoring failover threshold (0 - 50).
pingserver_flip_timeout integer	Time to wait in minutes before renegotiating after a remote IP monitoring failover.
pingserver_monitor_interface list / elements=string	Interfaces to check for remote IP monitoring. Source system.interface.name.
pingserver_secondary_force_reset string	Enable to force the cluster to negotiate after a remote IP monitoring failover. Choices: enable disable
pingserver_slave_force_reset string	Enable to force the cluster to negotiate after a remote IP monitoring failover. Choices: enable disable
pop3_proxy_threshold string	Dynamic weighted load balancing weight and high and low number of POP3 proxy sessions.
priority integer	Increase the priority to select the primary unit (0 - 255).
route_hold integer	Time to wait between routing table updates to the cluster (0 - 3600 sec).
route_ttl integer	TTL for primary unit routes (5 - 3600 sec). Increase to maintain active routes during failover.
route_wait integer	Time to wait before sending new routes to the cluster (0 - 3600 sec).
schedule string	Type of A-A load balancing. Use none if you have external load balancers. Choices: none hub leastconnection round-robin weight-round-robin random ip ipport
secondary_vcluster dictionary	Configure virtual cluster 2.
monitor string	Interfaces to check for port monitoring (or link failure). Source system.interface.name.
override string	Enable and increase the priority of the unit that should always be primary. Choices: enable disable
override_wait_time integer	Delay negotiating if override is enabled (0 - 3600 sec). Reduces how often the cluster negotiates.
pingserver_failover_threshold integer	Remote IP monitoring failover threshold (0 - 50).
pingserver_monitor_interface string	Interfaces to check for remote IP monitoring. Source system.interface.name.
pingserver_secondary_force_reset string	Enable to force the cluster to negotiate after a remote IP monitoring failover. Choices: enable disable
pingserver_slave_force_reset string	Enable to force the cluster to negotiate after a remote IP monitoring failover. Choices: enable disable
priority integer	Increase the priority to select the primary unit (0 - 255).
vcluster_id integer	Cluster ID.
vdom string	VDOMs in virtual cluster 2.
session_pickup string	Enable/disable session pickup. Enabling it can reduce session down time when fail over happens. Choices: enable disable
session_pickup_connectionless string	Enable/disable UDP and ICMP session sync. Choices: enable disable
session_pickup_delay string	Enable to sync sessions longer than 30 sec. Only longer lived sessions need to be synced. Choices: enable disable
session_pickup_expectation string	Enable/disable session helper expectation session sync for FGSP. Choices: enable disable
session_pickup_nat string	Enable/disable NAT session sync for FGSP. Choices: enable disable
session_sync_dev list / elements=string	Offload session-sync process to kernel and sync sessions using connected interface(s) directly. Source system.interface.name.
smtp_proxy_threshold string	Dynamic weighted load balancing weight and high and low number of SMTP proxy sessions.
ssd_failover string	Enable/disable automatic HA failover on SSD disk failure. Choices: enable disable
standalone_config_sync string	Enable/disable FGSP configuration synchronization. Choices: enable disable
standalone_mgmt_vdom string	Enable/disable standalone management VDOM. Choices: enable disable
sync_config string	Enable/disable configuration synchronization. Choices: enable disable
sync_packet_balance string	Enable/disable HA packet distribution to multiple CPUs. Choices: enable disable
unicast_gateway string	Default route gateway for unicast interface.
unicast_hb string	Enable/disable unicast heartbeat. Choices: enable disable
unicast_hb_netmask string	Unicast heartbeat netmask.
unicast_hb_peerip string	Unicast heartbeat peer IP.
unicast_peers list / elements=dictionary	Number of unicast peers.
id integer / required	Table ID.
peer_ip string	Unicast peer IP.
unicast_status string	Enable/disable unicast connection. Choices: enable disable
uninterruptible_primary_wait integer	Number of minutes the primary HA unit waits before the secondary HA unit is considered upgraded and the system is started before starting its own upgrade (1 - 300).
uninterruptible_upgrade string	Enable to upgrade a cluster without blocking network traffic. Choices: enable disable
vcluster2 string	Enable/disable virtual cluster 2 for virtual clustering. Choices: enable disable
vcluster_id integer	Cluster ID.
vdom string	VDOMs in virtual cluster 1.
weight string	Weighted round robin weight for each cluster unit. Syntax <priority> <weight>.
vdom string	Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. Default: “root”

Notes

Note

• Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks

Examples

- hosts: fortigates
  collections:
    - fortinet.fortios
  connection: httpapi
  vars:
   vdom: "root"
   ansible_httpapi_use_ssl: yes
   ansible_httpapi_validate_certs: no
   ansible_httpapi_port: 443
  tasks:
  - name: Configure HA.
    fortios_system_ha:
      vdom:  "{{ vdom }}"
      system_ha:
        arps: "3"
        arps_interval: "4"
        authentication: "enable"
        cpu_threshold: "<your_own_value>"
        encryption: "enable"
        failover_hold_time: "8"
        ftp_proxy_threshold: "<your_own_value>"
        gratuitous_arps: "enable"
        group_id: "11"
        group_name: "<your_own_value>"
        ha_direct: "enable"
        ha_eth_type: "<your_own_value>"
        ha_mgmt_interfaces:
         -
            dst: "<your_own_value>"
            gateway: "<your_own_value>"
            gateway6: "<your_own_value>"
            id:  "19"
            interface: "<your_own_value> (source system.interface.name)"
        ha_mgmt_status: "enable"
        ha_uptime_diff_margin: "22"
        hb_interval: "23"
        hb_interval_in_milliseconds: "100ms"
        hb_lost_threshold: "25"
        hbdev: "<your_own_value>"
        hc_eth_type: "<your_own_value>"
        hello_holddown: "28"
        http_proxy_threshold: "<your_own_value>"
        imap_proxy_threshold: "<your_own_value>"
        inter_cluster_session_sync: "enable"
        key: "<your_own_value>"
        l2ep_eth_type: "<your_own_value>"
        link_failed_signal: "enable"
        load_balance_all: "enable"
        logical_sn: "enable"
        memory_based_failover: "enable"
        memory_compatible_mode: "enable"
        memory_failover_flip_timeout: "39"
        memory_failover_monitor_period: "40"
        memory_failover_sample_rate: "41"
        memory_failover_threshold: "42"
        memory_threshold: "<your_own_value>"
        mode: "standalone"
        monitor: "<your_own_value> (source system.interface.name)"
        multicast_ttl: "46"
        nntp_proxy_threshold: "<your_own_value>"
        override: "enable"
        override_wait_time: "49"
        password: "<your_own_value>"
        pingserver_failover_threshold: "51"
        pingserver_flip_timeout: "52"
        pingserver_monitor_interface: "<your_own_value> (source system.interface.name)"
        pingserver_secondary_force_reset: "enable"
        pingserver_slave_force_reset: "enable"
        pop3_proxy_threshold: "<your_own_value>"
        priority: "57"
        route_hold: "58"
        route_ttl: "59"
        route_wait: "60"
        schedule: "none"
        secondary_vcluster:
            monitor: "<your_own_value> (source system.interface.name)"
            override: "enable"
            override_wait_time: "65"
            pingserver_failover_threshold: "66"
            pingserver_monitor_interface: "<your_own_value> (source system.interface.name)"
            pingserver_secondary_force_reset: "enable"
            pingserver_slave_force_reset: "enable"
            priority: "70"
            vcluster_id: "71"
            vdom: "<your_own_value>"
        session_pickup: "enable"
        session_pickup_connectionless: "enable"
        session_pickup_delay: "enable"
        session_pickup_expectation: "enable"
        session_pickup_nat: "enable"
        session_sync_dev: "<your_own_value> (source system.interface.name)"
        smtp_proxy_threshold: "<your_own_value>"
        ssd_failover: "enable"
        standalone_config_sync: "enable"
        standalone_mgmt_vdom: "enable"
        sync_config: "enable"
        sync_packet_balance: "enable"
        unicast_gateway: "<your_own_value>"
        unicast_hb: "enable"
        unicast_hb_netmask: "<your_own_value>"
        unicast_hb_peerip: "<your_own_value>"
        unicast_peers:
         -
            id:  "90"
            peer_ip: "<your_own_value>"
        unicast_status: "enable"
        uninterruptible_primary_wait: "93"
        uninterruptible_upgrade: "enable"
        vcluster_id: "95"
        vcluster2: "enable"
        vdom: "<your_own_value>"
        weight: "<your_own_value>"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
build string	Build number of the fortigate image Returned: always Sample: “1547”
http_method string	Last method used to provision the content into FortiGate Returned: always Sample: “PUT”
http_status string	Last result given by FortiGate on last operation applied Returned: always Sample: “200”
mkey string	Master key (id) used in the last call to FortiGate Returned: success Sample: “id”
name string	Name of the table used to fulfill the request Returned: always Sample: “urlfilter”
path string	Path of the table used to fulfill the request Returned: always Sample: “webfilter”
revision string	Internal revision number Returned: always Sample: “17.0.2.10658”
serial string	Serial number of the unit Returned: always Sample: “FGVMEVYYQT3AB5352”
status string	Indication of the operation’s result Returned: always Sample: “success”
vdom string	Virtual domain used Returned: always Sample: “root”
version string	Version of the FortiGate Returned: always Sample: “v5.6.3”

Authors

• Link Zheng (@chillancezen)

• Jie Xue (@JieX19)

• Hongbin Lu (@fgtdev-hblu)

• Frank Shen (@frankshen01)

• Miguel Angel Munoz (@mamunozgonzalez)

• Nicolas Thomas (@thomnico)

Collection links

Issue Tracker Homepage Repository (Sources)