fortinet.fortimanager.fmgr_webfilter_profile module – Configure Web filter profiles.

Note

This module is part of the fortinet.fortimanager collection (version 2.4.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install fortinet.fortimanager.

To use it in a playbook, specify: fortinet.fortimanager.fmgr_webfilter_profile.

New in fortinet.fortimanager 1.0.0

Synopsis

• This module is able to configure a FortiManager device.

• Examples include all parameters and values which need to be adjusted to data sources before usage.

Parameters

Parameter	Comments
access_token string	The token to access FortiManager without using username and password.
adom string / required	The parameter (adom) in requested url.
bypass_validation boolean	Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters. Choices: false ← (default) true
enable_log boolean	Enable/Disable logging for task. Choices: false ← (default) true
forticloud_access_token string	Authenticate Ansible client with forticloud API access token.
proposed_method string	The overridden method for the underlying Json RPC request. Choices: "update" "set" "add"
rc_failed list / elements=integer	The rc codes list with which the conditions to fail will be overriden.
rc_succeeded list / elements=integer	The rc codes list with which the conditions to succeed will be overriden.
state string / required	The directive to create, update or delete an object. Choices: "present" "absent"
webfilter_profile dictionary	The top level parameters set.
antiphish dictionary	No description.
authentication string	Authentication methods. Choices: "domain-controller" "ldap"
check-basic-auth string	Deprecated, please rename it to check_basic_auth. Enable/disable checking of HTTP Basic Auth field for known crede… Choices: "disable" "enable"
check-uri string	Deprecated, please rename it to check_uri. Enable/disable checking of GET URI parameters for known credentials. Choices: "disable" "enable"
check-username-only string	Deprecated, please rename it to check_username_only. Enable/disable acting only on valid username credentials. Choices: "disable" "enable"
custom-patterns list / elements=dictionary	Deprecated, please rename it to custom_patterns. Custom-Patterns.
category string	Category that the pattern matches. Choices: "username" "password"
pattern string	Target pattern.
type string	Pattern will be treated either as a regex pattern or literal string. Choices: "regex" "literal"
default-action string	Deprecated, please rename it to default_action. Action to be taken when there is no matching rule. Choices: "log" "block" "exempt"
domain-controller string	Deprecated, please rename it to domain_controller. Domain for which to verify received credentials against.
inspection-entries list / elements=dictionary	Deprecated, please rename it to inspection_entries. Inspection-Entries.
action string	Action to be taken upon an AntiPhishing match. Choices: "log" "block" "exempt"
fortiguard-category any	(list) Deprecated, please rename it to fortiguard_category. FortiGuard category to match.
name string	Inspection target name.
ldap string	LDAP server for which to verify received credentials against.
max-body-len integer	Deprecated, please rename it to max_body_len. Maximum size of a POST body to check for credentials.
status string	Toggle AntiPhishing functionality. Choices: "disable" "enable"
comment string	Optional comments.
extended-log string	Deprecated, please rename it to extended_log. Enable/disable extended logging for web filtering. Choices: "disable" "enable"
feature-set string	Deprecated, please rename it to feature_set. Flow/proxy feature set. Choices: "proxy" "flow"
file-filter dictionary	Deprecated, please rename it to file_filter.
entries list / elements=dictionary	No description.
action string	Action taken for matched file. Choices: "log" "block"
comment string	Comment.
direction string	Match files transmitted in the sessions originating or reply direction. Choices: "any" "incoming" "outgoing"
encryption string	No description. Choices: "any" "yes"
file-type any	(list) Deprecated, please rename it to file_type.
filter string	Add a file filter.
password-protected string	Deprecated, please rename it to password_protected. Match password-protected files. Choices: "any" "yes"
protocol list / elements=string	No description. Choices: "http" "ftp"
log string	Enable/disable file filter logging. Choices: "disable" "enable"
scan-archive-contents string	Deprecated, please rename it to scan_archive_contents. Enable/disable file filter archive contents scan. Choices: "disable" "enable"
status string	Enable/disable file filter. Choices: "disable" "enable"
ftgd-wf dictionary	Deprecated, please rename it to ftgd_wf.
category-override string	Deprecated, please rename it to category_override. Local categories take precedence over FortiGuard categories.
exempt-quota any	(list or str) Deprecated, please rename it to exempt_quota. Do not stop quota for these categories.
filters list / elements=dictionary	Filters.
action string	Action to take for matches. Choices: "block" "monitor" "warning" "authenticate"
auth-usr-grp any	(list or str) Deprecated, please rename it to auth_usr_grp. Groups with permission to authenticate.
category string	Categories and groups the filter examines.
id integer	ID number.
log string	Enable/disable logging. Choices: "disable" "enable"
override-replacemsg string	Deprecated, please rename it to override_replacemsg. Override replacement message.
warn-duration string	Deprecated, please rename it to warn_duration. Duration of warnings.
warning-duration-type string	Deprecated, please rename it to warning_duration_type. Re-display warning after closing browser or after a… Choices: "session" "timeout"
warning-prompt string	Deprecated, please rename it to warning_prompt. Warning prompts in each category or each domain. Choices: "per-domain" "per-category"
max-quota-timeout integer	Deprecated, please rename it to max_quota_timeout. Maximum FortiGuard quota used by single page view in seconds
options list / elements=string	Options for FortiGuard Web Filter. Choices: "error-allow" "http-err-detail" "rate-image-urls" "strict-blocking" "rate-server-ip" "redir-block" "connect-request-bypass" "log-all-url" "ftgd-disable"
ovrd any	(list or str) Allow web filter profile overrides.
quota list / elements=dictionary	Quota.
category any	(list or str) FortiGuard categories to apply quota to
duration string	Duration of quota.
id integer	ID number.
override-replacemsg string	Deprecated, please rename it to override_replacemsg. Override replacement message.
type string	Quota type. Choices: "time" "traffic"
unit string	Traffic quota unit of measurement. Choices: "B" "KB" "MB" "GB"
value integer	Traffic quota value.
rate-crl-urls string	Deprecated, please rename it to rate_crl_urls. Enable/disable rating CRL by URL. Choices: "disable" "enable"
rate-css-urls string	Deprecated, please rename it to rate_css_urls. Enable/disable rating CSS by URL. Choices: "disable" "enable"
rate-image-urls string	Deprecated, please rename it to rate_image_urls. Enable/disable rating images by URL. Choices: "disable" "enable"
rate-javascript-urls string	Deprecated, please rename it to rate_javascript_urls. Enable/disable rating JavaScript by URL. Choices: "disable" "enable"
https-replacemsg string	Deprecated, please rename it to https_replacemsg. Enable replacement messages for HTTPS. Choices: "disable" "enable"
inspection-mode string	Deprecated, please rename it to inspection_mode. Web filtering inspection mode. Choices: "proxy" "flow-based" "dns"
log-all-url string	Deprecated, please rename it to log_all_url. Enable/disable logging all URLs visited. Choices: "disable" "enable"
name string / required	Profile name.
options list / elements=string	Options. Choices: "block-invalid-url" "jscript" "js" "vbs" "unknown" "wf-referer" "https-scan" "intrinsic" "wf-cookie" "per-user-bwl" "activexfilter" "cookiefilter" "https-url-scan" "javafilter" "rangeblock" "contenttype-check" "per-user-bal"
override dictionary	No description.
ovrd-cookie string	Deprecated, please rename it to ovrd_cookie. Allow/deny browser-based Choices: "deny" "allow"
ovrd-dur string	Deprecated, please rename it to ovrd_dur. Override duration.
ovrd-dur-mode string	Deprecated, please rename it to ovrd_dur_mode. Override duration mode. Choices: "constant" "ask"
ovrd-scope string	Deprecated, please rename it to ovrd_scope. Override scope. Choices: "user" "user-group" "ip" "ask" "browser"
ovrd-user-group any	(list or str) Deprecated, please rename it to ovrd_user_group. User groups with permission to use the override.
profile any	(list or str) Web filter profile with permission to create overrides.
profile-attribute string	Deprecated, please rename it to profile_attribute. Profile attribute to retrieve from the RADIUS server. Choices: "User-Name" "User-Password" "CHAP-Password" "NAS-IP-Address" "NAS-Port" "Service-Type" "Framed-Protocol" "Framed-IP-Address" "Framed-IP-Netmask" "Framed-Routing" "Filter-Id" "Framed-MTU" "Framed-Compression" "Login-IP-Host" "Login-Service" "Login-TCP-Port" "Reply-Message" "Callback-Number" "Callback-Id" "Framed-Route" "Framed-IPX-Network" "State" "Class" "Vendor-Specific" "Session-Timeout" "Idle-Timeout" "Termination-Action" "Called-Station-Id" "Calling-Station-Id" "NAS-Identifier" "Proxy-State" "Login-LAT-Service" "Login-LAT-Node" "Login-LAT-Group" "Framed-AppleTalk-Link" "Framed-AppleTalk-Network" "Framed-AppleTalk-Zone" "Acct-Status-Type" "Acct-Delay-Time" "Acct-Input-Octets" "Acct-Output-Octets" "Acct-Session-Id" "Acct-Authentic" "Acct-Session-Time" "Acct-Input-Packets" "Acct-Output-Packets" "Acct-Terminate-Cause" "Acct-Multi-Session-Id" "Acct-Link-Count" "CHAP-Challenge" "NAS-Port-Type" "Port-Limit" "Login-LAT-Port"
profile-type string	Deprecated, please rename it to profile_type. Override profile type. Choices: "list" "radius"
ovrd-perm list / elements=string	Deprecated, please rename it to ovrd_perm. Permitted override types. Choices: "bannedword-override" "urlfilter-override" "fortiguard-wf-override" "contenttype-check-override"
post-action string	Deprecated, please rename it to post_action. Action taken for HTTP POST traffic. Choices: "normal" "comfort" "block"
replacemsg-group string	Deprecated, please rename it to replacemsg_group. Replacement message group.
url-extraction dictionary	Deprecated, please rename it to url_extraction.
redirect-header string	Deprecated, please rename it to redirect_header. HTTP header name to use for client redirect on blocked requests
redirect-no-content string	Deprecated, please rename it to redirect_no_content. Enable / Disable empty message-body entity in HTTP response Choices: "disable" "enable"
redirect-url string	Deprecated, please rename it to redirect_url. HTTP header value to use for client redirect on blocked requests
server-fqdn string	Deprecated, please rename it to server_fqdn. URL extraction server FQDN
status string	Enable URL Extraction Choices: "disable" "enable"
web dictionary	No description.
allowlist list / elements=string	FortiGuard allowlist settings. Choices: "exempt-av" "exempt-webcontent" "exempt-activex-java-cookie" "exempt-dlp" "exempt-rangeblock" "extended-log-others"
blacklist string	Enable/disable automatic addition of URLs detected by FortiSandbox to blacklist. Choices: "disable" "enable"
blocklist string	Enable/disable automatic addition of URLs detected by FortiSandbox to blocklist. Choices: "disable" "enable"
bword-table string	Deprecated, please rename it to bword_table. Banned word table ID.
bword-threshold integer	Deprecated, please rename it to bword_threshold. Banned word score threshold.
content-header-list string	Deprecated, please rename it to content_header_list. Content header list.
keyword-match any	(list) Deprecated, please rename it to keyword_match. Search keywords to log when match is found.
log-search string	Deprecated, please rename it to log_search. Enable/disable logging all search phrases. Choices: "disable" "enable"
safe-search list / elements=string	Deprecated, please rename it to safe_search. Safe search type. Choices: "google" "yahoo" "bing" "url" "header"
urlfilter-table string	Deprecated, please rename it to urlfilter_table. URL filter table ID.
vimeo-restrict string	Deprecated, please rename it to vimeo_restrict. Set Vimeo-restrict
whitelist list / elements=string	FortiGuard whitelist settings. Choices: "exempt-av" "exempt-webcontent" "exempt-activex-java-cookie" "exempt-dlp" "exempt-rangeblock" "extended-log-others"
youtube-restrict string	Deprecated, please rename it to youtube_restrict. YouTube EDU filter level. Choices: "strict" "none" "moderate"
web-antiphishing-log string	Deprecated, please rename it to web_antiphishing_log. Enable/disable logging of AntiPhishing checks. Choices: "disable" "enable"
web-content-log string	Deprecated, please rename it to web_content_log. Enable/disable logging logging blocked web content. Choices: "disable" "enable"
web-extended-all-action-log string	Deprecated, please rename it to web_extended_all_action_log. Enable/disable extended any filter action logging for web fil… Choices: "disable" "enable"
web-filter-activex-log string	Deprecated, please rename it to web_filter_activex_log. Enable/disable logging ActiveX. Choices: "disable" "enable"
web-filter-applet-log string	Deprecated, please rename it to web_filter_applet_log. Enable/disable logging Java applets. Choices: "disable" "enable"
web-filter-command-block-log string	Deprecated, please rename it to web_filter_command_block_log. Enable/disable logging blocked commands. Choices: "disable" "enable"
web-filter-cookie-log string	Deprecated, please rename it to web_filter_cookie_log. Enable/disable logging cookie filtering. Choices: "disable" "enable"
web-filter-cookie-removal-log string	Deprecated, please rename it to web_filter_cookie_removal_log. Enable/disable logging blocked cookies. Choices: "disable" "enable"
web-filter-js-log string	Deprecated, please rename it to web_filter_js_log. Enable/disable logging Java scripts. Choices: "disable" "enable"
web-filter-jscript-log string	Deprecated, please rename it to web_filter_jscript_log. Enable/disable logging JScripts. Choices: "disable" "enable"
web-filter-referer-log string	Deprecated, please rename it to web_filter_referer_log. Enable/disable logging referrers. Choices: "disable" "enable"
web-filter-unknown-log string	Deprecated, please rename it to web_filter_unknown_log. Enable/disable logging unknown scripts. Choices: "disable" "enable"
web-filter-vbs-log string	Deprecated, please rename it to web_filter_vbs_log. Enable/disable logging VBS scripts. Choices: "disable" "enable"
web-flow-log-encoding string	Deprecated, please rename it to web_flow_log_encoding. Log encoding in flow mode. Choices: "utf-8" "punycode"
web-ftgd-err-log string	Deprecated, please rename it to web_ftgd_err_log. Enable/disable logging rating errors. Choices: "disable" "enable"
web-ftgd-quota-usage string	Deprecated, please rename it to web_ftgd_quota_usage. Enable/disable logging daily quota usage. Choices: "disable" "enable"
web-invalid-domain-log string	Deprecated, please rename it to web_invalid_domain_log. Enable/disable logging invalid domain names. Choices: "disable" "enable"
web-url-log string	Deprecated, please rename it to web_url_log. Enable/disable logging URL filtering. Choices: "disable" "enable"
wisp string	Enable/disable web proxy WISP. Choices: "disable" "enable"
wisp-algorithm string	Deprecated, please rename it to wisp_algorithm. WISP server selection algorithm. Choices: "auto-learning" "primary-secondary" "round-robin"
wisp-servers any	(list or str) Deprecated, please rename it to wisp_servers. WISP servers.
youtube-channel-filter list / elements=dictionary	Deprecated, please rename it to youtube_channel_filter. Youtube-Channel-Filter.
channel-id string	Deprecated, please rename it to channel_id. YouTube channel ID to be filtered.
comment string	Comment.
id integer	ID.
youtube-channel-status string	Deprecated, please rename it to youtube_channel_status. YouTube channel filter status. Choices: "disable" "blacklist" "whitelist"
workspace_locking_adom string	The adom to lock for FortiManager running in workspace mode, the value can be global and others including root.
workspace_locking_timeout integer	The maximum time in seconds to wait for other user to release the workspace lock. Default: 300

Notes

Note

• Starting in version 2.4.0, all input arguments are named using the underscore naming convention (snake_case). Please change the arguments such as “var-name” to “var_name”. Old argument names are still available yet you will receive deprecation warnings. You can ignore this warning by setting deprecation_warnings=False in ansible.cfg.

• Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.

• To create or update an object, use state present directive.

• To delete an object, use state absent directive.

• Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded

Examples

- name: Example playbook (generated based on argument schema)
  hosts: fortimanagers
  connection: httpapi
  vars:
    ansible_httpapi_use_ssl: true
    ansible_httpapi_validate_certs: false
    ansible_httpapi_port: 443
  tasks:
    - name: Configure Web filter profiles.
      fortinet.fortimanager.fmgr_webfilter_profile:
        # bypass_validation: false
        workspace_locking_adom: <value in [global, custom adom including root]>
        workspace_locking_timeout: 300
        # rc_succeeded: [0, -2, -3, ...]
        # rc_failed: [-2, -3, ...]
        adom: <your own value>
        state: present # <value in [present, absent]>
        webfilter_profile:
          comment: <string>
          extended_log: <value in [disable, enable]>
          https_replacemsg: <value in [disable, enable]>
          inspection_mode: <value in [proxy, flow-based, dns]>
          log_all_url: <value in [disable, enable]>
          name: <string>
          options:
            - block-invalid-url
            - jscript
            - js
            - vbs
            - unknown
            - wf-referer
            - https-scan
            - intrinsic
            - wf-cookie
            - per-user-bwl
            - activexfilter
            - cookiefilter
            - https-url-scan
            - javafilter
            - rangeblock
            - contenttype-check
            - per-user-bal
          ovrd_perm:
            - bannedword-override
            - urlfilter-override
            - fortiguard-wf-override
            - contenttype-check-override
          post_action: <value in [normal, comfort, block]>
          replacemsg_group: <string>
          web_content_log: <value in [disable, enable]>
          web_extended_all_action_log: <value in [disable, enable]>
          web_filter_activex_log: <value in [disable, enable]>
          web_filter_applet_log: <value in [disable, enable]>
          web_filter_command_block_log: <value in [disable, enable]>
          web_filter_cookie_log: <value in [disable, enable]>
          web_filter_cookie_removal_log: <value in [disable, enable]>
          web_filter_js_log: <value in [disable, enable]>
          web_filter_jscript_log: <value in [disable, enable]>
          web_filter_referer_log: <value in [disable, enable]>
          web_filter_unknown_log: <value in [disable, enable]>
          web_filter_vbs_log: <value in [disable, enable]>
          web_ftgd_err_log: <value in [disable, enable]>
          web_ftgd_quota_usage: <value in [disable, enable]>
          web_invalid_domain_log: <value in [disable, enable]>
          web_url_log: <value in [disable, enable]>
          wisp: <value in [disable, enable]>
          wisp_algorithm: <value in [auto-learning, primary-secondary, round-robin]>
          wisp_servers: <list or string>
          youtube_channel_filter:
            -
              channel_id: <string>
              comment: <string>
              id: <integer>
          youtube_channel_status: <value in [disable, blacklist, whitelist]>
          feature_set: <value in [proxy, flow]>
          web_antiphishing_log: <value in [disable, enable]>
          antiphish:
            check_basic_auth: <value in [disable, enable]>
            check_uri: <value in [disable, enable]>
            check_username_only: <value in [disable, enable]>
            custom_patterns:
              -
                category: <value in [username, password]>
                pattern: <string>
                type: <value in [regex, literal]>
            default_action: <value in [log, block, exempt]>
            domain_controller: <string>
            inspection_entries:
              -
                action: <value in [log, block, exempt]>
                fortiguard_category: <list or string>
                name: <string>
            max_body_len: <integer>
            status: <value in [disable, enable]>
            authentication: <value in [domain-controller, ldap]>
            ldap: <string>
          ftgd_wf:
            exempt_quota: <list or string>
            filters:
              -
                action: <value in [block, monitor, warning, ...]>
                auth_usr_grp: <list or string>
                category: <string>
                id: <integer>
                log: <value in [disable, enable]>
                override_replacemsg: <string>
                warn_duration: <string>
                warning_duration_type: <value in [session, timeout]>
                warning_prompt: <value in [per-domain, per-category]>
            max_quota_timeout: <integer>
            options:
              - error-allow
              - http-err-detail
              - rate-image-urls
              - strict-blocking
              - rate-server-ip
              - redir-block
              - connect-request-bypass
              - log-all-url
              - ftgd-disable
            ovrd: <list or string>
            quota:
              -
                category: <list or string>
                duration: <string>
                id: <integer>
                override_replacemsg: <string>
                type: <value in [time, traffic]>
                unit: <value in [B, KB, MB, ...]>
                value: <integer>
            rate_crl_urls: <value in [disable, enable]>
            rate_css_urls: <value in [disable, enable]>
            rate_image_urls: <value in [disable, enable]>
            rate_javascript_urls: <value in [disable, enable]>
            category_override: <string>
          override:
            ovrd_cookie: <value in [deny, allow]>
            ovrd_dur: <string>
            ovrd_dur_mode: <value in [constant, ask]>
            ovrd_scope: <value in [user, user-group, ip, ...]>
            ovrd_user_group: <list or string>
            profile: <list or string>
            profile_attribute: <value in [User-Name, User-Password, CHAP-Password, ...]>
            profile_type: <value in [list, radius]>
          url_extraction:
            redirect_header: <string>
            redirect_no_content: <value in [disable, enable]>
            redirect_url: <string>
            server_fqdn: <string>
            status: <value in [disable, enable]>
          web:
            blacklist: <value in [disable, enable]>
            bword_table: <string>
            bword_threshold: <integer>
            content_header_list: <string>
            keyword_match: <list or string>
            log_search: <value in [disable, enable]>
            safe_search:
              - google
              - yahoo
              - bing
              - url
              - header
            urlfilter_table: <string>
            whitelist:
              - exempt-av
              - exempt-webcontent
              - exempt-activex-java-cookie
              - exempt-dlp
              - exempt-rangeblock
              - extended-log-others
            youtube_restrict: <value in [strict, none, moderate]>
            allowlist:
              - exempt-av
              - exempt-webcontent
              - exempt-activex-java-cookie
              - exempt-dlp
              - exempt-rangeblock
              - extended-log-others
            blocklist: <value in [disable, enable]>
            vimeo_restrict: <string>
          file_filter:
            entries:
              -
                action: <value in [log, block]>
                comment: <string>
                direction: <value in [any, incoming, outgoing]>
                encryption: <value in [any, yes]>
                file_type: <list or string>
                filter: <string>
                password_protected: <value in [any, yes]>
                protocol:
                  - http
                  - ftp
            log: <value in [disable, enable]>
            scan_archive_contents: <value in [disable, enable]>
            status: <value in [disable, enable]>
          web_flow_log_encoding: <value in [utf-8, punycode]>

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
meta dictionary	The result of the request. Returned: always
request_url string	The full url requested. Returned: always Sample: "/sys/login/user"
response_code integer	The status of api request. Returned: always Sample: 0
response_data list / elements=string	The api response. Returned: always
response_message string	The descriptive message of the api response. Returned: always Sample: "OK."
system_information dictionary	The information of the target system. Returned: always
rc integer	The status the request. Returned: always Sample: 0
version_check_warning list / elements=string	Warning if the parameters used in the playbook are not supported by the current FortiManager version. Returned: complex

Authors

• Xinwei Du (@dux-fortinet)

• Xing Li (@lix-fortinet)

• Jie Xue (@JieX19)

• Link Zheng (@chillancezen)

• Frank Shen (@fshen01)

• Hongbin Lu (@fgtdev-hblu)

Collection links

• Issue Tracker
• Homepage
• Repository (Sources)