fortios_firewall_profile_protocol_options – Configure protocol options in Fortinet’s FortiOS and FortiGate — Ansible Documentation

- AnsibleFest
- Products
- Community
- Webinars & Training
- Blog

Documentation

# fortios_firewall_profile_protocol_options – Configure protocol options in Fortinet’s FortiOS and FortiGate

New in version 2.8.

- Synopsis
- Requirements
- Parameters
- Notes
- Examples
- Return Values
- Status

## Synopsis

- This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify firewall feature and profile_protocol_options category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.5

## Requirements

The below requirements are needed on the host that executes this module.

- fortiosapi>=0.9.8

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
firewall_profile_protocol_options dictionary | Default: null | Configure protocol options.
| comment string |  | Optional comments.
| dns dictionary |  | Configure DNS protocol options.
|  | ports integer |  | Ports to scan for content (1 - 65535).
|  | status string | Choices: enable disable | Enable/disable the active status of scanning for this protocol.
| ftp dictionary |  | Configure FTP protocol options.
|  | comfort_amount integer |  | Amount of data to send in a transmission for client comforting (1 - 10240 bytes).
|  | comfort_interval integer |  | Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec).
|  | inspect_all string | Choices: enable disable | Enable/disable the inspection of all ports for the protocol.
|  | options string | Choices: clientcomfort oversize splice bypass-rest-command bypass-mode-command | One or more options that can be applied to the session.
|  | oversize_limit integer |  | Maximum in-memory file size that can be scanned (1 - 383 MB).
|  | ports integer |  | Ports to scan for content (1 - 65535).
|  | scan_bzip2 string | Choices: enable disable | Enable/disable scanning of BZip2 compressed files.
|  | status string | Choices: enable disable | Enable/disable the active status of scanning for this protocol.
|  | uncompressed_nest_limit integer |  | Maximum nested levels of compression that can be uncompressed and scanned (2 - 100).
|  | uncompressed_oversize_limit integer |  | Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited).
| http dictionary |  | Configure HTTP protocol options.
|  | block_page_status_code integer |  | Code number returned for blocked HTTP pages (non-FortiGuard only) (100 - 599).
|  | comfort_amount integer |  | Amount of data to send in a transmission for client comforting (1 - 10240 bytes).
|  | comfort_interval integer |  | Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec).
|  | fortinet_bar string | Choices: enable disable | Enable/disable Fortinet bar on HTML content.
|  | fortinet_bar_port integer |  | Port for use by Fortinet Bar (1 - 65535).
|  | http_policy string | Choices: disable enable | Enable/disable HTTP policy check.
|  | inspect_all string | Choices: enable disable | Enable/disable the inspection of all ports for the protocol.
|  | options string | Choices: clientcomfort servercomfort oversize chunkedbypass | One or more options that can be applied to the session.
|  | oversize_limit integer |  | Maximum in-memory file size that can be scanned (1 - 383 MB).
|  | ports integer |  | Ports to scan for content (1 - 65535).
|  | post_lang string | Choices: jisx0201 jisx0208 jisx0212 gb2312 ksc5601-ex euc-jp sjis iso2022-jp iso2022-jp-1 iso2022-jp-2 euc-cn ces-gbk hz ces-big5 euc-kr iso2022-jp-3 iso8859-1 tis620 cp874 cp1252 cp1251 | ID codes for character sets to be used to convert to UTF-8 for banned words and DLP on HTTP posts (maximum of 5 character sets).
|  | range_block string | Choices: disable enable | Enable/disable blocking of partial downloads.
|  | retry_count integer |  | Number of attempts to retry HTTP connection (0 - 100).
|  | scan_bzip2 string | Choices: enable disable | Enable/disable scanning of BZip2 compressed files.
|  | status string | Choices: enable disable | Enable/disable the active status of scanning for this protocol.
|  | streaming_content_bypass string | Choices: enable disable | Enable/disable bypassing of streaming content from buffering.
|  | strip_x_forwarded_for string | Choices: disable enable | Enable/disable stripping of HTTP X-Forwarded-For header.
|  | switching_protocols string | Choices: bypass block | Bypass from scanning, or block a connection that attempts to switch protocol.
|  | uncompressed_nest_limit integer |  | Maximum nested levels of compression that can be uncompressed and scanned (2 - 100).
|  | uncompressed_oversize_limit integer |  | Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited).
| imap dictionary |  | Configure IMAP protocol options.
|  | inspect_all string | Choices: enable disable | Enable/disable the inspection of all ports for the protocol.
|  | options string | Choices: fragmail oversize | One or more options that can be applied to the session.
|  | oversize_limit integer |  | Maximum in-memory file size that can be scanned (1 - 383 MB).
|  | ports integer |  | Ports to scan for content (1 - 65535).
|  | scan_bzip2 string | Choices: enable disable | Enable/disable scanning of BZip2 compressed files.
|  | status string | Choices: enable disable | Enable/disable the active status of scanning for this protocol.
|  | uncompressed_nest_limit integer |  | Maximum nested levels of compression that can be uncompressed and scanned (2 - 100).
|  | uncompressed_oversize_limit integer |  | Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited).
| mail_signature dictionary |  | Configure Mail signature.
|  | signature string |  | Email signature to be added to outgoing email (if the signature contains spaces, enclose with quotation marks).
|  | status string | Choices: disable enable | Enable/disable adding an email signature to SMTP email messages as they pass through the FortiGate.
| mapi dictionary |  | Configure MAPI protocol options.
|  | options string | Choices: fragmail oversize | One or more options that can be applied to the session.
|  | oversize_limit integer |  | Maximum in-memory file size that can be scanned (1 - 383 MB).
|  | ports integer |  | Ports to scan for content (1 - 65535).
|  | scan_bzip2 string | Choices: enable disable | Enable/disable scanning of BZip2 compressed files.
|  | status string | Choices: enable disable | Enable/disable the active status of scanning for this protocol.
|  | uncompressed_nest_limit integer |  | Maximum nested levels of compression that can be uncompressed and scanned (2 - 100).
|  | uncompressed_oversize_limit integer |  | Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited).
| name string / required |  | Name.
| nntp dictionary |  | Configure NNTP protocol options.
|  | inspect_all string | Choices: enable disable | Enable/disable the inspection of all ports for the protocol.
|  | options string | Choices: oversize splice | One or more options that can be applied to the session.
|  | oversize_limit integer |  | Maximum in-memory file size that can be scanned (1 - 383 MB).
|  | ports integer |  | Ports to scan for content (1 - 65535).
|  | scan_bzip2 string | Choices: enable disable | Enable/disable scanning of BZip2 compressed files.
|  | status string | Choices: enable disable | Enable/disable the active status of scanning for this protocol.
|  | uncompressed_nest_limit integer |  | Maximum nested levels of compression that can be uncompressed and scanned (2 - 100).
|  | uncompressed_oversize_limit integer |  | Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited).
| oversize_log string | Choices: disable enable | Enable/disable logging for antivirus oversize file blocking.
| pop3 dictionary |  | Configure POP3 protocol options.
|  | inspect_all string | Choices: enable disable | Enable/disable the inspection of all ports for the protocol.
|  | options string | Choices: fragmail oversize | One or more options that can be applied to the session.
|  | oversize_limit integer |  | Maximum in-memory file size that can be scanned (1 - 383 MB).
|  | ports integer |  | Ports to scan for content (1 - 65535).
|  | scan_bzip2 string | Choices: enable disable | Enable/disable scanning of BZip2 compressed files.
|  | status string | Choices: enable disable | Enable/disable the active status of scanning for this protocol.
|  | uncompressed_nest_limit integer |  | Maximum nested levels of compression that can be uncompressed and scanned (2 - 100).
|  | uncompressed_oversize_limit integer |  | Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited).
| replacemsg_group string |  | Name of the replacement message group to be used Source system.replacemsg-group.name.
| rpc_over_http string | Choices: enable disable | Enable/disable inspection of RPC over HTTP.
| smtp dictionary |  | Configure SMTP protocol options.
|  | inspect_all string | Choices: enable disable | Enable/disable the inspection of all ports for the protocol.
|  | options string | Choices: fragmail oversize splice | One or more options that can be applied to the session.
|  | oversize_limit integer |  | Maximum in-memory file size that can be scanned (1 - 383 MB).
|  | ports integer |  | Ports to scan for content (1 - 65535).
|  | scan_bzip2 string | Choices: enable disable | Enable/disable scanning of BZip2 compressed files.
|  | server_busy string | Choices: enable disable | Enable/disable SMTP server busy when server not available.
|  | status string | Choices: enable disable | Enable/disable the active status of scanning for this protocol.
|  | uncompressed_nest_limit integer |  | Maximum nested levels of compression that can be uncompressed and scanned (2 - 100).
|  | uncompressed_oversize_limit integer |  | Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited).
| state string | Choices: present absent | Deprecated Starting with Ansible 2.9 we recommend using the top-level 'state' parameter. Indicates whether to create or remove the object.
| switching_protocols_log string | Choices: disable enable | Enable/disable logging for HTTP/HTTPS switching protocols.
host string |  | FortiOS or FortiGate IP address.
https boolean | Choices: no yes ← | Indicates if the requests towards FortiGate must use HTTPS protocol.
password string | Default: "" | FortiOS or FortiGate password.
ssl_verify boolean added in 2.9 | Choices: no yes ← | Ensures FortiGate certificate must be verified by a proper CA.
state string added in 2.9 | Choices: present absent | Indicates whether to create or remove the object. This attribute was present already in previous version in a deeper level. It has been moved out to this outer level.
username string |  | FortiOS or FortiGate username.
vdom string | Default: "root" | Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit.

## Notes

Note

- Requires fortiosapi library developed by Fortinet
- Run as a local_action in your playbook

## Examples

    - hosts: localhost
      vars:
       host: "192.168.122.40"
       username: "admin"
       password: ""
       vdom: "root"
       ssl_verify: "False"
      tasks:
      - name: Configure protocol options.
        fortios_firewall_profile_protocol_options:
          host:  "{{ host }}"
          username: "{{ username }}"
          password: "{{ password }}"
          vdom:  "{{ vdom }}"
          https: "False"
          state: "present"
          firewall_profile_protocol_options:
            comment: "Optional comments."
            dns:
                ports: "5"
                status: "enable"
            ftp:
                comfort_amount: "8"
                comfort_interval: "9"
                inspect_all: "enable"
                options: "clientcomfort"
                oversize_limit: "12"
                ports: "13"
                scan_bzip2: "enable"
                status: "enable"
                uncompressed_nest_limit: "16"
                uncompressed_oversize_limit: "17"
            http:
                block_page_status_code: "19"
                comfort_amount: "20"
                comfort_interval: "21"
                fortinet_bar: "enable"
                fortinet_bar_port: "23"
                http_policy: "disable"
                inspect_all: "enable"
                options: "clientcomfort"
                oversize_limit: "27"
                ports: "28"
                post_lang: "jisx0201"
                range_block: "disable"
                retry_count: "31"
                scan_bzip2: "enable"
                status: "enable"
                streaming_content_bypass: "enable"
                strip_x_forwarded_for: "disable"
                switching_protocols: "bypass"
                uncompressed_nest_limit: "37"
                uncompressed_oversize_limit: "38"
            imap:
                inspect_all: "enable"
                options: "fragmail"
                oversize_limit: "42"
                ports: "43"
                scan_bzip2: "enable"
                status: "enable"
                uncompressed_nest_limit: "46"
                uncompressed_oversize_limit: "47"
            mail_signature:
                signature: "<your_own_value>"
                status: "disable"
            mapi:
                options: "fragmail"
                oversize_limit: "53"
                ports: "54"
                scan_bzip2: "enable"
                status: "enable"
                uncompressed_nest_limit: "57"
                uncompressed_oversize_limit: "58"
            name: "default_name_59"
            nntp:
                inspect_all: "enable"
                options: "oversize"
                oversize_limit: "63"
                ports: "64"
                scan_bzip2: "enable"
                status: "enable"
                uncompressed_nest_limit: "67"
                uncompressed_oversize_limit: "68"
            oversize_log: "disable"
            pop3:
                inspect_all: "enable"
                options: "fragmail"
                oversize_limit: "73"
                ports: "74"
                scan_bzip2: "enable"
                status: "enable"
                uncompressed_nest_limit: "77"
                uncompressed_oversize_limit: "78"
            replacemsg_group: "<your_own_value> (source system.replacemsg-group.name)"
            rpc_over_http: "enable"
            smtp:
                inspect_all: "enable"
                options: "fragmail"
                oversize_limit: "84"
                ports: "85"
                scan_bzip2: "enable"
                server_busy: "enable"
                status: "enable"
                uncompressed_nest_limit: "89"
                uncompressed_oversize_limit: "90"
            switching_protocols_log: "disable"

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
build string | always | Build number of the fortigate image Sample: 1547
http_method string | always | Last method used to provision the content into FortiGate Sample: PUT
http_status string | always | Last result given by FortiGate on last operation applied Sample: 200
mkey string | success | Master key (id) used in the last call to FortiGate Sample: id
name string | always | Name of the table used to fulfill the request Sample: urlfilter
path string | always | Path of the table used to fulfill the request Sample: webfilter
revision string | always | Internal revision number Sample: 17.0.2.10658
serial string | always | Serial number of the unit Sample: FGVMEVYYQT3AB5352
status string | always | Indication of the operation's result Sample: success
vdom string | always | Virtual domain used Sample: root
version string | always | Version of the FortiGate Sample: v5.6.3

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by the Ansible Community. [community]

### Authors

- Miguel Angel Munoz (@mamunozgonzalez)
- Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.