fortinet.fortios.fortios_system_np6 – Configure NP6 attributes in Fortinet’s FortiOS and FortiGate.

Note

This plugin is part of the fortinet.fortios collection (version 2.1.2).

To install it use: ansible-galaxy collection install fortinet.fortios.

To use it in a playbook, specify: fortinet.fortios.fortios_system_np6.

New in version 2.10: of fortinet.fortios

Synopsis

  • This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify system feature and np6 category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0

Requirements

The below requirements are needed on the host that executes this module.

  • ansible>=2.9.0

Parameters

Parameter Choices/Defaults Comments
access_token
string
Token-based authentication. Generated from GUI of Fortigate.
enable_log
boolean
    Choices:
  • no ←
  • yes
Enable/Disable logging for task.
state
string / required
    Choices:
  • present
  • absent
Indicates whether to create or remove the object.
system_np6
dictionary
Configure NP6 attributes.
fastpath
string
    Choices:
  • disable
  • enable
Enable/disable NP4 or NP6 offloading (also called fast path).
fp_anomaly
dictionary
NP6 IPv4 anomaly protection. trap-to-host forwards anomaly sessions to the CPU.
icmp_csum_err
string
    Choices:
  • drop
  • trap-to-host
Invalid IPv4 ICMP checksum anomalies.
icmp_frag
string
    Choices:
  • allow
  • drop
  • trap-to-host
Layer 3 fragmented packets that could be part of layer 4 ICMP anomalies.
icmp_land
string
    Choices:
  • allow
  • drop
  • trap-to-host
ICMP land anomalies.
ipv4_csum_err
string
    Choices:
  • drop
  • trap-to-host
Invalid IPv4 IP checksum anomalies.
ipv4_land
string
    Choices:
  • allow
  • drop
  • trap-to-host
Land anomalies.
ipv4_optlsrr
string
    Choices:
  • allow
  • drop
  • trap-to-host
Loose source record route option anomalies.
ipv4_optrr
string
    Choices:
  • allow
  • drop
  • trap-to-host
Record route option anomalies.
ipv4_optsecurity
string
    Choices:
  • allow
  • drop
  • trap-to-host
Security option anomalies.
ipv4_optssrr
string
    Choices:
  • allow
  • drop
  • trap-to-host
Strict source record route option anomalies.
ipv4_optstream
string
    Choices:
  • allow
  • drop
  • trap-to-host
Stream option anomalies.
ipv4_opttimestamp
string
    Choices:
  • allow
  • drop
  • trap-to-host
Timestamp option anomalies.
ipv4_proto_err
string
    Choices:
  • allow
  • drop
  • trap-to-host
Invalid layer 4 protocol anomalies.
ipv4_unknopt
string
    Choices:
  • allow
  • drop
  • trap-to-host
Unknown option anomalies.
ipv6_daddr_err
string
    Choices:
  • allow
  • drop
  • trap-to-host
Destination address as unspecified or loopback address anomalies.
ipv6_land
string
    Choices:
  • allow
  • drop
  • trap-to-host
Land anomalies.
ipv6_optendpid
string
    Choices:
  • allow
  • drop
  • trap-to-host
End point identification anomalies.
ipv6_opthomeaddr
string
    Choices:
  • allow
  • drop
  • trap-to-host
Home address option anomalies.
ipv6_optinvld
string
    Choices:
  • allow
  • drop
  • trap-to-host
Invalid option anomalies.Invalid option anomalies.
ipv6_optjumbo
string
    Choices:
  • allow
  • drop
  • trap-to-host
Jumbo options anomalies.
ipv6_optnsap
string
    Choices:
  • allow
  • drop
  • trap-to-host
Network service access point address option anomalies.
ipv6_optralert
string
    Choices:
  • allow
  • drop
  • trap-to-host
Router alert option anomalies.
ipv6_opttunnel
string
    Choices:
  • allow
  • drop
  • trap-to-host
Tunnel encapsulation limit option anomalies.
ipv6_proto_err
string
    Choices:
  • allow
  • drop
  • trap-to-host
Layer 4 invalid protocol anomalies.
ipv6_saddr_err
string
    Choices:
  • allow
  • drop
  • trap-to-host
Source address as multicast anomalies.
ipv6_unknopt
string
    Choices:
  • allow
  • drop
  • trap-to-host
Unknown option anomalies.
tcp_csum_err
string
    Choices:
  • drop
  • trap-to-host
Invalid IPv4 TCP checksum anomalies.
tcp_fin_noack
string
    Choices:
  • allow
  • drop
  • trap-to-host
TCP SYN flood with FIN flag set without ACK setting anomalies.
tcp_fin_only
string
    Choices:
  • allow
  • drop
  • trap-to-host
TCP SYN flood with only FIN flag set anomalies.
tcp_land
string
    Choices:
  • allow
  • drop
  • trap-to-host
TCP land anomalies.
tcp_no_flag
string
    Choices:
  • allow
  • drop
  • trap-to-host
TCP SYN flood with no flag set anomalies.
tcp_syn_data
string
    Choices:
  • allow
  • drop
  • trap-to-host
TCP SYN flood packets with data anomalies.
tcp_syn_fin
string
    Choices:
  • allow
  • drop
  • trap-to-host
TCP SYN flood SYN/FIN flag set anomalies.
tcp_winnuke
string
    Choices:
  • allow
  • drop
  • trap-to-host
TCP WinNuke anomalies.
udp_csum_err
string
    Choices:
  • drop
  • trap-to-host
Invalid IPv4 UDP checksum anomalies.
udp_land
string
    Choices:
  • allow
  • drop
  • trap-to-host
UDP land anomalies.
garbage_session_collector
string
    Choices:
  • disable
  • enable
Enable/disable garbage session collector.
hpe
string
HPE configuration.
arp_max
integer
Maximum ARP packet rate (10K - 4G pps).
enable_shaper
string
    Choices:
  • disable
  • enable
Enable/Disable NPU host protection engine (HPE) shaper.
esp_max
integer
Maximum ESP packet rate (10K - 4G pps).
icmp_max
integer
Maximum ICMP packet rate (10K - 4G pps).
ip_frag_max
integer
Maximum fragmented IP packet rate (10K - 4G pps).
ip_others_max
integer
Maximum IP packet rate for other packets (packet types that cannot be set with other options) (10G - 4G pps).
l2_others_max
integer
Maximum L2 packet rate for L2 packets that are not ARP packets (10K - 4G pps).
pri_type_max
integer
Maximum overflow rate of priority type traffic(10K - 4G pps). Includes L2: HA, 802.3ad LACP, heartbeats. L3: OSPF. L4_TCP: BGP. L4_UDP: IKE, SLBC, BFD.
sctp_max
integer
Maximum SCTP packet rate (10K - 4G pps).
tcp_max
integer
Maximum TCP packet rate (10K - 4G pps).
tcpfin_rst_max
integer
Maximum TCP carries FIN or RST flags packet rate (1K - 1G pps).
tcpsyn_ack_max
integer
Maximum TCP carries SYN and ACK flags packet rate (1K - 1G pps).
tcpsyn_max
integer
Maximum TCP SYN packet rate (10K - 4G pps).
udp_max
integer
Maximum UDP packet rate (10K - 4G pps).
ipsec_ob_hash_function
string
    Choices:
  • global-hash
  • round-robin-global
Set hash function for IPSec outbound.
ipsec_outbound_hash
string
    Choices:
  • disable
  • enable
Enable/disable hash function for IPsec outbound traffic.
low_latency_mode
string
    Choices:
  • disable
  • enable
Enable/disable low latency mode.
name
string / required
Device Name.
per_session_accounting
string
    Choices:
  • disable
  • traffic-log-only
  • enable
Enable/disable per-session accounting.
session_collector_interval
integer
Set garbage session collection cleanup interval (1 - 100 sec).
session_timeout_fixed
string
    Choices:
  • disable
  • enable
{disable | enable} Toggle between using fixed or random timeouts for refreshing NP6 sessions.
session_timeout_interval
integer
Set the fixed timeout for refreshing NP6 sessions (0 - 1000 sec).
session_timeout_random_range
integer
Set the random timeout range for refreshing NP6 sessions (0 - 1000 sec).
vdom
string
Default:
"root"
Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit.

Notes

Note

  • Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks

Examples

- hosts: fortigates
  collections:
    - fortinet.fortios
  connection: httpapi
  vars:
   vdom: "root"
   ansible_httpapi_use_ssl: yes
   ansible_httpapi_validate_certs: no
   ansible_httpapi_port: 443
  tasks:
  - name: Configure NP6 attributes.
    fortios_system_np6:
      vdom:  "{{ vdom }}"
      state: "present"
      access_token: "<your_own_value>"
      system_np6:
        fastpath: "disable"
        fp_anomaly:
            icmp_csum_err: "drop"
            icmp_frag: "allow"
            icmp_land: "allow"
            ipv4_csum_err: "drop"
            ipv4_land: "allow"
            ipv4_optlsrr: "allow"
            ipv4_optrr: "allow"
            ipv4_optsecurity: "allow"
            ipv4_optssrr: "allow"
            ipv4_optstream: "allow"
            ipv4_opttimestamp: "allow"
            ipv4_proto_err: "allow"
            ipv4_unknopt: "allow"
            ipv6_daddr_err: "allow"
            ipv6_land: "allow"
            ipv6_optendpid: "allow"
            ipv6_opthomeaddr: "allow"
            ipv6_optinvld: "allow"
            ipv6_optjumbo: "allow"
            ipv6_optnsap: "allow"
            ipv6_optralert: "allow"
            ipv6_opttunnel: "allow"
            ipv6_proto_err: "allow"
            ipv6_saddr_err: "allow"
            ipv6_unknopt: "allow"
            tcp_csum_err: "drop"
            tcp_fin_noack: "allow"
            tcp_fin_only: "allow"
            tcp_land: "allow"
            tcp_no_flag: "allow"
            tcp_syn_data: "allow"
            tcp_syn_fin: "allow"
            tcp_winnuke: "allow"
            udp_csum_err: "drop"
            udp_land: "allow"
        garbage_session_collector: "disable"
        hpe:
            arp_max: "42"
            enable_shaper: "disable"
            esp_max: "44"
            icmp_max: "45"
            ip_frag_max: "46"
            ip_others_max: "47"
            l2_others_max: "48"
            pri_type_max: "49"
            sctp_max: "50"
            tcp_max: "51"
            tcpfin_rst_max: "52"
            tcpsyn_ack_max: "53"
            tcpsyn_max: "54"
            udp_max: "55"
        ipsec_ob_hash_function: "global-hash"
        ipsec_outbound_hash: "disable"
        low_latency_mode: "disable"
        name: "default_name_59"
        per_session_accounting: "disable"
        session_collector_interval: "61"
        session_timeout_fixed: "disable"
        session_timeout_interval: "63"
        session_timeout_random_range: "64"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key Returned Description
build
string
always
Build number of the fortigate image

Sample:
1547
http_method
string
always
Last method used to provision the content into FortiGate

Sample:
PUT
http_status
string
always
Last result given by FortiGate on last operation applied

Sample:
200
mkey
string
success
Master key (id) used in the last call to FortiGate

Sample:
id
name
string
always
Name of the table used to fulfill the request

Sample:
urlfilter
path
string
always
Path of the table used to fulfill the request

Sample:
webfilter
revision
string
always
Internal revision number

Sample:
17.0.2.10658
serial
string
always
Serial number of the unit

Sample:
FGVMEVYYQT3AB5352
status
string
always
Indication of the operation's result

Sample:
success
vdom
string
always
Virtual domain used

Sample:
root
version
string
always
Version of the FortiGate

Sample:
v5.6.3


Authors

  • Link Zheng (@chillancezen)

  • Jie Xue (@JieX19)

  • Hongbin Lu (@fgtdev-hblu)

  • Frank Shen (@frankshen01)

  • Miguel Angel Munoz (@mamunozgonzalez)

  • Nicolas Thomas (@thomnico)