You are reading an unmaintained version of the Ansible documentation. Unmaintained Ansible versions can contain unfixed security vulnerabilities (CVE). Please upgrade to a maintained version. See the latest Ansible documentation.

fortinet.fortimanager.fmgr_pm_config_pblock_firewall_securitypolicy module – Configure NGFW IPv4/IPv6 application policies.

Note

This module is part of the fortinet.fortimanager collection (version 2.2.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install fortinet.fortimanager.

To use it in a playbook, specify: fortinet.fortimanager.fmgr_pm_config_pblock_firewall_securitypolicy.

New in fortinet.fortimanager 2.1.6

Synopsis

• This module is able to configure a FortiManager device.

• Examples include all parameters and values which need to be adjusted to data sources before usage.

Parameters

Parameter	Comments
access_token string	The token to access FortiManager without using username and password.
adom string / required	the parameter (adom) in requested url
bypass_validation boolean	Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters. Choices: false ← (default) true
enable_log boolean	Enable/Disable logging for task. Choices: false ← (default) true
forticloud_access_token string	Authenticate Ansible client with forticloud API access token.
pblock string / required	the parameter (pblock) in requested url
pm_config_pblock_firewall_securitypolicy dictionary	the top level parameters set
_policy_block integer	Assigned policy block.
action string	Policy action Choices: "deny" "accept"
app-category string	description
app-group string	description
application integer	description
application-list string	Name of an existing Application list.
av-profile string	Name of an existing Antivirus profile.
cifs-profile string	Name of an existing CIFS profile.
comments string	Comment.
dlp-profile string	Name of an existing DLP profile.
dlp-sensor string	Name of an existing DLP sensor.
dnsfilter-profile string	Name of an existing DNS filter profile.
dstaddr string	description
dstaddr-negate string	When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Choices: "disable" "enable"
dstaddr4 string	description
dstaddr6 string	description
dstintf string	description
emailfilter-profile string	Name of an existing email filter profile.
enforce-default-app-port string	Enable/disable default application port enforcement for allowed applications. Choices: "disable" "enable"
file-filter-profile string	Name of an existing file-filter profile.
fsso-groups string	description
global-label string	Label for the policy that appears when the GUI is in Global View mode.
groups string	description
icap-profile string	Name of an existing ICAP profile.
internet-service string	Enable/disable use of Internet Services for this policy. Choices: "disable" "enable"
internet-service-custom string	description
internet-service-custom-group string	description
internet-service-group string	description
internet-service-id string	description
internet-service-name string	description
internet-service-negate string	When enabled internet-service specifies what the service must NOT be. Choices: "disable" "enable"
internet-service-src string	Enable/disable use of Internet Services in source for this policy. Choices: "disable" "enable"
internet-service-src-custom string	description
internet-service-src-custom-group string	description
internet-service-src-group string	description
internet-service-src-id string	description
internet-service-src-name string	description
internet-service-src-negate string	When enabled internet-service-src specifies what the service must NOT be. Choices: "disable" "enable"
internet-service6 string	Enable/disable use of IPv6 Internet Services for this policy. Choices: "disable" "enable"
internet-service6-custom string	description
internet-service6-custom-group string	description
internet-service6-group string	description
internet-service6-name string	description
internet-service6-negate string	When enabled internet-service6 specifies what the service must NOT be. Choices: "disable" "enable"
internet-service6-src string	Enable/disable use of IPv6 Internet Services in source for this policy. Choices: "disable" "enable"
internet-service6-src-custom string	description
internet-service6-src-custom-group string	description
internet-service6-src-group string	description
internet-service6-src-name string	description
internet-service6-src-negate string	When enabled internet-service6-src specifies what the service must NOT be. Choices: "disable" "enable"
ips-sensor string	Name of an existing IPS sensor.
learning-mode string	Enable to allow everything, but log all of the meaningful data for security information gathering. Choices: "disable" "enable"
logtraffic string	Enable or disable logging. Choices: "disable" "all" "utm"
logtraffic-start string	Record logs when a session starts. Choices: "disable" "enable"
mms-profile string	Name of an existing MMS profile.
name string	Policy name.
nat46 string	Enable/disable NAT46. Choices: "disable" "enable"
nat64 string	Enable/disable NAT64. Choices: "disable" "enable"
policyid integer	Policy ID.
profile-group string	Name of profile group.
profile-protocol-options string	Name of an existing Protocol options profile.
profile-type string	Determine whether the firewall policy allows security profile groups or single profiles only. Choices: "single" "group"
schedule string	Schedule name.
sctp-filter-profile string	Name of an existing SCTP filter profile.
send-deny-packet string	Enable to send a reply when a session is denied or blocked by a firewall policy. Choices: "disable" "enable"
service string	description
service-negate string	When enabled service specifies what the service must NOT be. Choices: "disable" "enable"
srcaddr string	description
srcaddr-negate string	When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Choices: "disable" "enable"
srcaddr4 string	description
srcaddr6 string	description
srcintf string	description
ssh-filter-profile string	Name of an existing SSH filter profile.
ssl-ssh-profile string	Name of an existing SSL SSH profile.
status string	Enable or disable this policy. Choices: "disable" "enable"
url-category string	description
users string	description
utm-status string	Enable security profiles. Choices: "disable" "enable"
uuid string	Universally Unique Identifier
videofilter-profile string	Name of an existing VideoFilter profile.
voip-profile string	Name of an existing VoIP profile.
webfilter-profile string	Name of an existing Web filter profile.
proposed_method string	The overridden method for the underlying Json RPC request. Choices: "update" "set" "add"
rc_failed list / elements=integer	The rc codes list with which the conditions to fail will be overriden.
rc_succeeded list / elements=integer	The rc codes list with which the conditions to succeed will be overriden.
state string / required	The directive to create, update or delete an object. Choices: "present" "absent"
workspace_locking_adom string	The adom to lock for FortiManager running in workspace mode, the value can be global and others including root.
workspace_locking_timeout integer	The maximum time in seconds to wait for other user to release the workspace lock. Default: 300

Notes

Note

• Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.

• To create or update an object, use state present directive.

• To delete an object, use state absent directive.

• Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded

Examples

- hosts: fortimanager-inventory
  collections:
    - fortinet.fortimanager
  connection: httpapi
  vars:
     ansible_httpapi_use_ssl: True
     ansible_httpapi_validate_certs: False
     ansible_httpapi_port: 443
  tasks:
   - name: Configure NGFW IPv4/IPv6 application policies.
     fmgr_pm_config_pblock_firewall_securitypolicy:
        bypass_validation: False
        workspace_locking_adom: <value in [global, custom adom including root]>
        workspace_locking_timeout: 300
        rc_succeeded: [0, -2, -3, ...]
        rc_failed: [-2, -3, ...]
        adom: <your own value>
        pblock: <your own value>
        state: <value in [present, absent]>
        pm_config_pblock_firewall_securitypolicy:
           _policy_block: <value of integer>
           action: <value in [deny, accept]>
           app-category: <value of string>
           app-group: <value of string>
           application: <value of integer>
           application-list: <value of string>
           av-profile: <value of string>
           cifs-profile: <value of string>
           comments: <value of string>
           dlp-profile: <value of string>
           dnsfilter-profile: <value of string>
           dstaddr: <value of string>
           dstaddr-negate: <value in [disable, enable]>
           dstaddr6: <value of string>
           dstintf: <value of string>
           emailfilter-profile: <value of string>
           enforce-default-app-port: <value in [disable, enable]>
           file-filter-profile: <value of string>
           fsso-groups: <value of string>
           global-label: <value of string>
           groups: <value of string>
           icap-profile: <value of string>
           internet-service: <value in [disable, enable]>
           internet-service-custom: <value of string>
           internet-service-custom-group: <value of string>
           internet-service-group: <value of string>
           internet-service-name: <value of string>
           internet-service-negate: <value in [disable, enable]>
           internet-service-src: <value in [disable, enable]>
           internet-service-src-custom: <value of string>
           internet-service-src-custom-group: <value of string>
           internet-service-src-group: <value of string>
           internet-service-src-name: <value of string>
           internet-service-src-negate: <value in [disable, enable]>
           ips-sensor: <value of string>
           learning-mode: <value in [disable, enable]>
           logtraffic: <value in [disable, all, utm]>
           name: <value of string>
           nat46: <value in [disable, enable]>
           nat64: <value in [disable, enable]>
           policyid: <value of integer>
           profile-group: <value of string>
           profile-protocol-options: <value of string>
           profile-type: <value in [single, group]>
           schedule: <value of string>
           sctp-filter-profile: <value of string>
           send-deny-packet: <value in [disable, enable]>
           service: <value of string>
           service-negate: <value in [disable, enable]>
           srcaddr: <value of string>
           srcaddr-negate: <value in [disable, enable]>
           srcaddr6: <value of string>
           srcintf: <value of string>
           ssh-filter-profile: <value of string>
           ssl-ssh-profile: <value of string>
           status: <value in [disable, enable]>
           url-category: <value of string>
           users: <value of string>
           utm-status: <value in [disable, enable]>
           uuid: <value of string>
           videofilter-profile: <value of string>
           voip-profile: <value of string>
           webfilter-profile: <value of string>
           dlp-sensor: <value of string>
           internet-service-id: <value of string>
           dstaddr4: <value of string>
           srcaddr4: <value of string>
           mms-profile: <value of string>
           internet-service-src-id: <value of string>
           logtraffic-start: <value in [disable, enable]>
           internet-service6: <value in [disable, enable]>
           internet-service6-custom: <value of string>
           internet-service6-custom-group: <value of string>
           internet-service6-group: <value of string>
           internet-service6-name: <value of string>
           internet-service6-negate: <value in [disable, enable]>
           internet-service6-src: <value in [disable, enable]>
           internet-service6-src-custom: <value of string>
           internet-service6-src-custom-group: <value of string>
           internet-service6-src-group: <value of string>
           internet-service6-src-name: <value of string>
           internet-service6-src-negate: <value in [disable, enable]>

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
meta dictionary	The result of the request. Returned: always
request_url string	The full url requested. Returned: always Sample: "/sys/login/user"
response_code integer	The status of api request. Returned: always Sample: 0
response_data list / elements=string	The api response. Returned: always
response_message string	The descriptive message of the api response. Returned: always Sample: "OK."
system_information dictionary	The information of the target system. Returned: always
rc integer	The status the request. Returned: always Sample: 0
version_check_warning list / elements=string	Warning if the parameters used in the playbook are not supported by the current FortiManager version. Returned: complex

Authors

• Xinwei Du (@dux-fortinet)

• Xing Li (@lix-fortinet)

• Jie Xue (@JieX19)

• Link Zheng (@chillancezen)

• Frank Shen (@fshen01)

• Hongbin Lu (@fgtdev-hblu)

Collection links

Issue Tracker Homepage Repository (Sources)