fortinet.fortimanager.fmgr_widsprofile module – Configure wireless intrusion detection system

Note

This module is part of the fortinet.fortimanager collection (version 2.9.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install fortinet.fortimanager.

To use it in a playbook, specify: fortinet.fortimanager.fmgr_widsprofile.

New in fortinet.fortimanager 2.0.0

Synopsis

  • This module is able to configure a FortiManager device.

  • Examples include all parameters and values which need to be adjusted to data sources before usage.

Parameters

Parameter

Comments

access_token

string

The token to access FortiManager without using username and password.

adom

string / required

The parameter (adom) in requested url.

bypass_validation

boolean

Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters.

Choices:

  • false ← (default)

  • true

enable_log

boolean

Enable/Disable logging for task.

Choices:

  • false ← (default)

  • true

forticloud_access_token

string

Authenticate Ansible client with forticloud API access token.

proposed_method

string

The overridden method for the underlying Json RPC request.

Choices:

  • "update"

  • "set"

  • "add"

rc_failed

list / elements=integer

The rc codes list with which the conditions to fail will be overriden.

rc_succeeded

list / elements=integer

The rc codes list with which the conditions to succeed will be overriden.

state

string / required

The directive to create, update or delete an object.

Choices:

  • "present"

  • "absent"

widsprofile

dictionary

The top level parameters set.

adhoc_network

aliases: adhoc-network

string

Enable/disable adhoc network detection

Choices:

  • "disable"

  • "enable"

adhoc_valid_ssid

aliases: adhoc-valid-ssid

string

Enable/disable adhoc using valid SSID detection

Choices:

  • "disable"

  • "enable"

air_jack

aliases: air-jack

string

Enable/disable AirJack detection

Choices:

  • "disable"

  • "enable"

ap_auto_suppress

aliases: ap-auto-suppress

string

Enable/disable on-wire rogue AP auto-suppression

Choices:

  • "disable"

  • "enable"

ap_bgscan_disable_day

aliases: ap-bgscan-disable-day

list / elements=string

Optionally turn off scanning for one or more days of the week.

Choices:

  • "sunday"

  • "monday"

  • "tuesday"

  • "wednesday"

  • "thursday"

  • "friday"

  • "saturday"

ap_bgscan_disable_end

aliases: ap-bgscan-disable-end

string

End time, using a 24-hour clock in the format of hh

ap_bgscan_disable_schedules

aliases: ap-bgscan-disable-schedules

any

(list or str) Firewall schedules for turning off FortiAP radio background scan.

ap_bgscan_disable_start

aliases: ap-bgscan-disable-start

string

Start time, using a 24-hour clock in the format of hh

ap_bgscan_duration

aliases: ap-bgscan-duration

integer

Listening time on a scanning channel

ap_bgscan_idle

aliases: ap-bgscan-idle

integer

Waiting time for channel inactivity before scanning this channel

ap_bgscan_intv

aliases: ap-bgscan-intv

integer

Period of time between scanning two channels

ap_bgscan_period

aliases: ap-bgscan-period

integer

Period of time between background scans

ap_bgscan_report_intv

aliases: ap-bgscan-report-intv

integer

Period of time between background scan reports

ap_fgscan_report_intv

aliases: ap-fgscan-report-intv

integer

Period of time between foreground scan reports

ap_impersonation

aliases: ap-impersonation

string

Enable/disable AP impersonation detection

Choices:

  • "disable"

  • "enable"

ap_scan

aliases: ap-scan

string

Enable/disable rogue AP detection.

Choices:

  • "disable"

  • "enable"

ap_scan_channel_list_2G_5G

aliases: ap-scan-channel-list-2G-5G

any

(list) Selected ap scan channel list for 2.

ap_scan_channel_list_6G

aliases: ap-scan-channel-list-6G

any

(list) Selected ap scan channel list for 6G band.

ap_scan_passive

aliases: ap-scan-passive

string

Enable/disable passive scanning.

Choices:

  • "disable"

  • "enable"

ap_scan_threshold

aliases: ap-scan-threshold

string

Minimum signal level/threshold in dBm required for the AP to report detected rogue AP

ap_spoofing

aliases: ap-spoofing

string

Enable/disable AP spoofing detection

Choices:

  • "disable"

  • "enable"

asleap_attack

aliases: asleap-attack

string

Enable/disable asleap attack detection

Choices:

  • "disable"

  • "enable"

assoc_flood_thresh

aliases: assoc-flood-thresh

integer

The threshold value for association frame flooding.

assoc_flood_time

aliases: assoc-flood-time

integer

Number of seconds after which a station is considered not connected.

assoc_frame_flood

aliases: assoc-frame-flood

string

Enable/disable association frame flooding detection

Choices:

  • "disable"

  • "enable"

auth_flood_thresh

aliases: auth-flood-thresh

integer

The threshold value for authentication frame flooding.

auth_flood_time

aliases: auth-flood-time

integer

Number of seconds after which a station is considered not connected.

auth_frame_flood

aliases: auth-frame-flood

string

Enable/disable authentication frame flooding detection

Choices:

  • "disable"

  • "enable"

bcn_flood

aliases: bcn-flood

string

Enable/disable bcn flood detection

Choices:

  • "disable"

  • "enable"

bcn_flood_thresh

aliases: bcn-flood-thresh

integer

The threshold value for bcn flood.

bcn_flood_time

aliases: bcn-flood-time

integer

Detection Window Period.

beacon_wrong_channel

aliases: beacon-wrong-channel

string

Enable/disable beacon wrong channel detection

Choices:

  • "disable"

  • "enable"

block_ack_flood

aliases: block_ack-flood

string

Enable/disable block_ack flood detection

Choices:

  • "disable"

  • "enable"

block_ack_flood_thresh

aliases: block_ack-flood-thresh

integer

The threshold value for block_ack flood.

block_ack_flood_time

aliases: block_ack-flood-time

integer

Detection Window Period.

chan_based_mitm

aliases: chan-based-mitm

string

Enable/disable channel based mitm detection

Choices:

  • "disable"

  • "enable"

client_flood

aliases: client-flood

string

Enable/disable client flood detection

Choices:

  • "disable"

  • "enable"

client_flood_thresh

aliases: client-flood-thresh

integer

The threshold value for client flood.

client_flood_time

aliases: client-flood-time

integer

Detection Window Period.

comment

string

Comment.

cts_flood

aliases: cts-flood

string

Enable/disable cts flood detection

Choices:

  • "disable"

  • "enable"

cts_flood_thresh

aliases: cts-flood-thresh

integer

The threshold value for cts flood.

cts_flood_time

aliases: cts-flood-time

integer

Detection Window Period.

deauth_broadcast

aliases: deauth-broadcast

string

Enable/disable broadcasting de-authentication detection

Choices:

  • "disable"

  • "enable"

deauth_unknown_src_thresh

aliases: deauth-unknown-src-thresh

integer

Threshold value per second to deauth unknown src for DoS attack

disassoc_broadcast

aliases: disassoc-broadcast

string

Enable/disable broadcast dis-association detection

Choices:

  • "disable"

  • "enable"

disconnect_station

aliases: disconnect-station

string

Enable/disable disconnect station detection

Choices:

  • "disable"

  • "enable"

eapol_fail_flood

aliases: eapol-fail-flood

string

Enable/disable EAPOL-Failure flooding

Choices:

  • "disable"

  • "enable"

eapol_fail_intv

aliases: eapol-fail-intv

integer

The detection interval for EAPOL-Failure flooding

eapol_fail_thresh

aliases: eapol-fail-thresh

integer

The threshold value for EAPOL-Failure flooding in specified interval.

eapol_key_overflow

aliases: eapol-key-overflow

string

Enable/disable overflow EAPOL key detection

Choices:

  • "disable"

  • "enable"

eapol_logoff_flood

aliases: eapol-logoff-flood

string

Enable/disable EAPOL-Logoff flooding

Choices:

  • "disable"

  • "enable"

eapol_logoff_intv

aliases: eapol-logoff-intv

integer

The detection interval for EAPOL-Logoff flooding

eapol_logoff_thresh

aliases: eapol-logoff-thresh

integer

The threshold value for EAPOL-Logoff flooding in specified interval.

eapol_pre_fail_flood

aliases: eapol-pre-fail-flood

string

Enable/disable premature EAPOL-Failure flooding

Choices:

  • "disable"

  • "enable"

eapol_pre_fail_intv

aliases: eapol-pre-fail-intv

integer

The detection interval for premature EAPOL-Failure flooding

eapol_pre_fail_thresh

aliases: eapol-pre-fail-thresh

integer

The threshold value for premature EAPOL-Failure flooding in specified interval.

eapol_pre_succ_flood

aliases: eapol-pre-succ-flood

string

Enable/disable premature EAPOL-Success flooding

Choices:

  • "disable"

  • "enable"

eapol_pre_succ_intv

aliases: eapol-pre-succ-intv

integer

The detection interval for premature EAPOL-Success flooding

eapol_pre_succ_thresh

aliases: eapol-pre-succ-thresh

integer

The threshold value for premature EAPOL-Success flooding in specified interval.

eapol_start_flood

aliases: eapol-start-flood

string

Enable/disable EAPOL-Start flooding

Choices:

  • "disable"

  • "enable"

eapol_start_intv

aliases: eapol-start-intv

integer

The detection interval for EAPOL-Start flooding

eapol_start_thresh

aliases: eapol-start-thresh

integer

The threshold value for EAPOL-Start flooding in specified interval.

eapol_succ_flood

aliases: eapol-succ-flood

string

Enable/disable EAPOL-Success flooding

Choices:

  • "disable"

  • "enable"

eapol_succ_intv

aliases: eapol-succ-intv

integer

The detection interval for EAPOL-Success flooding

eapol_succ_thresh

aliases: eapol-succ-thresh

integer

The threshold value for EAPOL-Success flooding in specified interval.

fata_jack

aliases: fata-jack

string

Enable/disable FATA-Jack detection

Choices:

  • "disable"

  • "enable"

fuzzed_beacon

aliases: fuzzed-beacon

string

Enable/disable fuzzed beacon detection

Choices:

  • "disable"

  • "enable"

fuzzed_probe_request

aliases: fuzzed-probe-request

string

Enable/disable fuzzed probe request detection

Choices:

  • "disable"

  • "enable"

fuzzed_probe_response

aliases: fuzzed-probe-response

string

Enable/disable fuzzed probe response detection

Choices:

  • "disable"

  • "enable"

hotspotter_attack

aliases: hotspotter-attack

string

Enable/disable hotspotter attack detection

Choices:

  • "disable"

  • "enable"

ht_40mhz_intolerance

aliases: ht-40mhz-intolerance

string

Enable/disable HT 40 MHz intolerance detection

Choices:

  • "disable"

  • "enable"

ht_greenfield

aliases: ht-greenfield

string

Enable/disable HT greenfield detection

Choices:

  • "disable"

  • "enable"

invalid_addr_combination

aliases: invalid-addr-combination

string

Enable/disable invalid address combination detection

Choices:

  • "disable"

  • "enable"

invalid_mac_oui

aliases: invalid-mac-oui

string

Enable/disable invalid MAC OUI detection.

Choices:

  • "disable"

  • "enable"

long_duration_attack

aliases: long-duration-attack

string

Enable/disable long duration attack detection based on user configured threshold

Choices:

  • "disable"

  • "enable"

long_duration_thresh

aliases: long-duration-thresh

integer

Threshold value for long duration attack detection

malformed_association

aliases: malformed-association

string

Enable/disable malformed association request detection

Choices:

  • "disable"

  • "enable"

malformed_auth

aliases: malformed-auth

string

Enable/disable malformed auth frame detection

Choices:

  • "disable"

  • "enable"

malformed_ht_ie

aliases: malformed-ht-ie

string

Enable/disable malformed HT IE detection

Choices:

  • "disable"

  • "enable"

name

string / required

WIDS profile name.

netstumbler

string

Enable/disable netstumbler detection

Choices:

  • "disable"

  • "enable"

netstumbler_thresh

aliases: netstumbler-thresh

integer

The threshold value for netstumbler.

netstumbler_time

aliases: netstumbler-time

integer

Detection Window Period.

null_ssid_probe_resp

aliases: null-ssid-probe-resp

string

Enable/disable null SSID probe response detection

Choices:

  • "disable"

  • "enable"

omerta_attack

aliases: omerta-attack

string

Enable/disable omerta attack detection

Choices:

  • "disable"

  • "enable"

overflow_ie

aliases: overflow-ie

string

Enable/disable overflow IE detection

Choices:

  • "disable"

  • "enable"

probe_flood

aliases: probe-flood

string

Enable/disable probe flood detection

Choices:

  • "disable"

  • "enable"

probe_flood_thresh

aliases: probe-flood-thresh

integer

The threshold value for probe flood.

probe_flood_time

aliases: probe-flood-time

integer

Detection Window Period.

pspoll_flood

aliases: pspoll-flood

string

Enable/disable pspoll flood detection

Choices:

  • "disable"

  • "enable"

pspoll_flood_thresh

aliases: pspoll-flood-thresh

integer

The threshold value for pspoll flood.

pspoll_flood_time

aliases: pspoll-flood-time

integer

Detection Window Period.

pwsave_dos_attack

aliases: pwsave-dos-attack

string

Enable/disable power save DOS attack detection

Choices:

  • "disable"

  • "enable"

reassoc_flood

aliases: reassoc-flood

string

Enable/disable reassociation flood detection

Choices:

  • "disable"

  • "enable"

reassoc_flood_thresh

aliases: reassoc-flood-thresh

integer

The threshold value for reassociation flood.

reassoc_flood_time

aliases: reassoc-flood-time

integer

Detection Window Period.

risky_encryption

aliases: risky-encryption

string

Enable/disable Risky Encryption detection

Choices:

  • "disable"

  • "enable"

rogue_scan

aliases: rogue-scan

string

Enable/disable rogue AP on-wire scan.

Choices:

  • "disable"

  • "enable"

rts_flood

aliases: rts-flood

string

Enable/disable rts flood detection

Choices:

  • "disable"

  • "enable"

rts_flood_thresh

aliases: rts-flood-thresh

integer

The threshold value for rts flood.

rts_flood_time

aliases: rts-flood-time

integer

Detection Window Period.

sensor_mode

aliases: sensor-mode

string

Scan WiFi nearby stations

Choices:

  • "disable"

  • "foreign"

  • "both"

spoofed_deauth

aliases: spoofed-deauth

string

Enable/disable spoofed de-authentication attack detection

Choices:

  • "disable"

  • "enable"

unencrypted_valid

aliases: unencrypted-valid

string

Enable/disable unencrypted valid detection

Choices:

  • "disable"

  • "enable"

valid_client_misassociation

aliases: valid-client-misassociation

string

Enable/disable valid client misassociation detection

Choices:

  • "disable"

  • "enable"

valid_ssid_misuse

aliases: valid-ssid-misuse

string

Enable/disable valid SSID misuse detection

Choices:

  • "disable"

  • "enable"

weak_wep_iv

aliases: weak-wep-iv

string

Enable/disable weak WEP IV

Choices:

  • "disable"

  • "enable"

wellenreiter

string

Enable/disable wellenreiter detection

Choices:

  • "disable"

  • "enable"

wellenreiter_thresh

aliases: wellenreiter-thresh

integer

The threshold value for wellenreiter.

wellenreiter_time

aliases: wellenreiter-time

integer

Detection Window Period.

windows_bridge

aliases: windows-bridge

string

Enable/disable windows bridge detection

Choices:

  • "disable"

  • "enable"

wireless_bridge

aliases: wireless-bridge

string

Enable/disable wireless bridge detection

Choices:

  • "disable"

  • "enable"

wpa_ft_attack

aliases: wpa-ft-attack

string

Enable/disable WPA FT attack detection

Choices:

  • "disable"

  • "enable"

workspace_locking_adom

string

The adom to lock for FortiManager running in workspace mode, the value can be global and others including root.

workspace_locking_timeout

integer

The maximum time in seconds to wait for other user to release the workspace lock.

Default: 300

Notes

Note

  • Starting in version 2.4.0, all input arguments are named using the underscore naming convention (snake_case). Please change the arguments such as “var-name” to “var_name”. Old argument names are still available yet you will receive deprecation warnings. You can ignore this warning by setting deprecation_warnings=False in ansible.cfg.

  • Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.

  • To create or update an object, use state present directive.

  • To delete an object, use state absent directive.

  • Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded

Examples

- name: Example playbook (generated based on argument schema)
  hosts: fortimanagers
  connection: httpapi
  vars:
    ansible_httpapi_use_ssl: true
    ansible_httpapi_validate_certs: false
    ansible_httpapi_port: 443
  tasks:
    - name: Configure wireless intrusion detection system
      fortinet.fortimanager.fmgr_widsprofile:
        # bypass_validation: false
        workspace_locking_adom: <value in [global, custom adom including root]>
        workspace_locking_timeout: 300
        # rc_succeeded: [0, -2, -3, ...]
        # rc_failed: [-2, -3, ...]
        adom: <your own value>
        state: present # <value in [present, absent]>
        widsprofile:
          ap_auto_suppress: <value in [disable, enable]>
          ap_bgscan_disable_day:
            - "sunday"
            - "monday"
            - "tuesday"
            - "wednesday"
            - "thursday"
            - "friday"
            - "saturday"
          ap_bgscan_disable_end: <string>
          ap_bgscan_disable_start: <string>
          ap_bgscan_duration: <integer>
          ap_bgscan_idle: <integer>
          ap_bgscan_intv: <integer>
          ap_bgscan_period: <integer>
          ap_bgscan_report_intv: <integer>
          ap_fgscan_report_intv: <integer>
          ap_scan: <value in [disable, enable]>
          ap_scan_passive: <value in [disable, enable]>
          asleap_attack: <value in [disable, enable]>
          assoc_flood_thresh: <integer>
          assoc_flood_time: <integer>
          assoc_frame_flood: <value in [disable, enable]>
          auth_flood_thresh: <integer>
          auth_flood_time: <integer>
          auth_frame_flood: <value in [disable, enable]>
          comment: <string>
          deauth_broadcast: <value in [disable, enable]>
          deauth_unknown_src_thresh: <integer>
          eapol_fail_flood: <value in [disable, enable]>
          eapol_fail_intv: <integer>
          eapol_fail_thresh: <integer>
          eapol_logoff_flood: <value in [disable, enable]>
          eapol_logoff_intv: <integer>
          eapol_logoff_thresh: <integer>
          eapol_pre_fail_flood: <value in [disable, enable]>
          eapol_pre_fail_intv: <integer>
          eapol_pre_fail_thresh: <integer>
          eapol_pre_succ_flood: <value in [disable, enable]>
          eapol_pre_succ_intv: <integer>
          eapol_pre_succ_thresh: <integer>
          eapol_start_flood: <value in [disable, enable]>
          eapol_start_intv: <integer>
          eapol_start_thresh: <integer>
          eapol_succ_flood: <value in [disable, enable]>
          eapol_succ_intv: <integer>
          eapol_succ_thresh: <integer>
          invalid_mac_oui: <value in [disable, enable]>
          long_duration_attack: <value in [disable, enable]>
          long_duration_thresh: <integer>
          name: <string>
          null_ssid_probe_resp: <value in [disable, enable]>
          sensor_mode: <value in [disable, foreign, both]>
          spoofed_deauth: <value in [disable, enable]>
          weak_wep_iv: <value in [disable, enable]>
          wireless_bridge: <value in [disable, enable]>
          ap_bgscan_disable_schedules: <list or string>
          rogue_scan: <value in [disable, enable]>
          ap_scan_threshold: <string>
          ap_scan_channel_list_2G_5G: <list or string>
          ap_scan_channel_list_6G: <list or string>
          adhoc_network: <value in [disable, enable]>
          adhoc_valid_ssid: <value in [disable, enable]>
          air_jack: <value in [disable, enable]>
          ap_impersonation: <value in [disable, enable]>
          ap_spoofing: <value in [disable, enable]>
          bcn_flood: <value in [disable, enable]>
          bcn_flood_thresh: <integer>
          bcn_flood_time: <integer>
          beacon_wrong_channel: <value in [disable, enable]>
          block_ack_flood: <value in [disable, enable]>
          block_ack_flood_thresh: <integer>
          block_ack_flood_time: <integer>
          chan_based_mitm: <value in [disable, enable]>
          client_flood: <value in [disable, enable]>
          client_flood_thresh: <integer>
          client_flood_time: <integer>
          cts_flood: <value in [disable, enable]>
          cts_flood_thresh: <integer>
          cts_flood_time: <integer>
          disassoc_broadcast: <value in [disable, enable]>
          disconnect_station: <value in [disable, enable]>
          eapol_key_overflow: <value in [disable, enable]>
          fata_jack: <value in [disable, enable]>
          fuzzed_beacon: <value in [disable, enable]>
          fuzzed_probe_request: <value in [disable, enable]>
          fuzzed_probe_response: <value in [disable, enable]>
          hotspotter_attack: <value in [disable, enable]>
          ht_40mhz_intolerance: <value in [disable, enable]>
          ht_greenfield: <value in [disable, enable]>
          invalid_addr_combination: <value in [disable, enable]>
          malformed_association: <value in [disable, enable]>
          malformed_auth: <value in [disable, enable]>
          malformed_ht_ie: <value in [disable, enable]>
          netstumbler: <value in [disable, enable]>
          netstumbler_thresh: <integer>
          netstumbler_time: <integer>
          omerta_attack: <value in [disable, enable]>
          overflow_ie: <value in [disable, enable]>
          probe_flood: <value in [disable, enable]>
          probe_flood_thresh: <integer>
          probe_flood_time: <integer>
          pspoll_flood: <value in [disable, enable]>
          pspoll_flood_thresh: <integer>
          pspoll_flood_time: <integer>
          pwsave_dos_attack: <value in [disable, enable]>
          reassoc_flood: <value in [disable, enable]>
          reassoc_flood_thresh: <integer>
          reassoc_flood_time: <integer>
          risky_encryption: <value in [disable, enable]>
          rts_flood: <value in [disable, enable]>
          rts_flood_thresh: <integer>
          rts_flood_time: <integer>
          unencrypted_valid: <value in [disable, enable]>
          valid_client_misassociation: <value in [disable, enable]>
          valid_ssid_misuse: <value in [disable, enable]>
          wellenreiter: <value in [disable, enable]>
          wellenreiter_thresh: <integer>
          wellenreiter_time: <integer>
          windows_bridge: <value in [disable, enable]>
          wpa_ft_attack: <value in [disable, enable]>

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

meta

dictionary

The result of the request.

Returned: always

request_url

string

The full url requested.

Returned: always

Sample: "/sys/login/user"

response_code

integer

The status of api request.

Returned: always

Sample: 0

response_data

list / elements=string

The api response.

Returned: always

response_message

string

The descriptive message of the api response.

Returned: always

Sample: "OK."

system_information

dictionary

The information of the target system.

Returned: always

rc

integer

The status the request.

Returned: always

Sample: 0

version_check_warning

list / elements=string

Warning if the parameters used in the playbook are not supported by the current FortiManager version.

Returned: complex

Authors

  • Xinwei Du (@dux-fortinet)

  • Xing Li (@lix-fortinet)

  • Jie Xue (@JieX19)

  • Link Zheng (@chillancezen)

  • Frank Shen (@fshen01)

  • Hongbin Lu (@fgtdev-hblu)