- AnsibleFest
- Products
- Community
- Webinars & Training
- Blog

Documentation

# fortios_switch_controller_managed_switch – Configure FortiSwitch devices that are managed by this FortiGate in Fortinet’s FortiOS and FortiGate

New in version 2.8.

- Synopsis
- Requirements
- Parameters
- Notes
- Examples
- Return Values
- Status

## Synopsis

- This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify switch_controller feature and managed_switch category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.5

## Requirements

The below requirements are needed on the host that executes this module.

- fortiosapi>=0.9.8

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
host string |  | FortiOS or FortiGate IP address.
https boolean | Choices: no yes ← | Indicates if the requests towards FortiGate must use HTTPS protocol.
password string | Default: "" | FortiOS or FortiGate password.
ssl_verify boolean added in 2.9 | Choices: no yes ← | Ensures FortiGate certificate must be verified by a proper CA.
state string added in 2.9 | Choices: present absent | Indicates whether to create or remove the object. This attribute was present already in previous version in a deeper level. It has been moved out to this outer level.
switch_controller_managed_switch dictionary | Default: null | Configure FortiSwitch devices that are managed by this FortiGate.
| 802_1X_settings dictionary |  | Configuration method to edit FortiSwitch 802.1X global settings.
|  | link_down_auth string | Choices: set-unauth no-action | Authentication state to set if a link is down.
|  | local_override string | Choices: enable disable | Enable to override global 802.1X settings on individual FortiSwitches.
|  | max_reauth_attempt integer |  | Maximum number of authentication attempts (0 - 15).
|  | reauth_period integer |  | Reauthentication time interval (1 - 1440 min).
| custom_command list |  | Configuration method to edit FortiSwitch commands to be pushed to this FortiSwitch device upon rebooting the FortiGate switch controller or the FortiSwitch.
|  | command_entry string |  | List of FortiSwitch commands.
|  | command_name string |  | Names of commands to be pushed to this FortiSwitch device, as configured under config switch-controller custom-command. Source switch-controller.custom-command.command-name.
| delayed_restart_trigger integer |  | Delayed restart triggered for this FortiSwitch.
| description string |  | Description.
| directly_connected integer |  | Directly connected FortiSwitch.
| dynamic_capability integer |  | List of features this FortiSwitch supports (not configurable) that is sent to the FortiGate device for subsequent configuration initiated by the FortiGate device.
| dynamically_discovered integer |  | Dynamically discovered FortiSwitch.
| fsw_wan1_admin string | Choices: discovered disable enable | FortiSwitch WAN1 admin status; enable to authorize the FortiSwitch as a managed switch.
| fsw_wan1_peer string |  | Fortiswitch WAN1 peer port.
| fsw_wan2_admin string | Choices: discovered disable enable | FortiSwitch WAN2 admin status; enable to authorize the FortiSwitch as a managed switch.
| fsw_wan2_peer string |  | FortiSwitch WAN2 peer port.
| igmp_snooping dictionary |  | Configure FortiSwitch IGMP snooping global settings.
|  | aging_time integer |  | Maximum time to retain a multicast snooping entry for which no packets have been seen (15 - 3600 sec).
|  | flood_unknown_multicast string | Choices: enable disable | Enable/disable unknown multicast flooding.
|  | local_override string | Choices: enable disable | Enable/disable overriding the global IGMP snooping configuration.
| max_allowed_trunk_members integer |  | FortiSwitch maximum allowed trunk members.
| mirror list |  | Configuration method to edit FortiSwitch packet mirror.
|  | dst string |  | Destination port.
|  | name string / required |  | Mirror name.
|  | src_egress list |  | Source egress interfaces.
|  |  | name string / required |  | Interface name.
|  | src_ingress list |  | Source ingress interfaces.
|  |  | name string / required |  | Interface name.
|  | status string | Choices: active inactive | Active/inactive mirror configuration.
|  | switching_packet string | Choices: enable disable | Enable/disable switching functionality when mirroring.
| name string |  | Managed-switch name.
| owner_vdom string |  | VDOM which owner of port belongs to.
| poe_detection_type integer |  | PoE detection type for FortiSwitch.
| poe_pre_standard_detection string | Choices: enable disable | Enable/disable PoE pre-standard detection.
| ports list |  | Managed-switch port list.
|  | allowed_vlans list |  | Configure switch port tagged vlans
|  |  | vlan_name string |  | VLAN name. Source system.interface.name.
|  | allowed_vlans_all string | Choices: enable disable | Enable/disable all defined vlans on this port.
|  | arp_inspection_trust string | Choices: untrusted trusted | Trusted or untrusted dynamic ARP inspection.
|  | bundle string | Choices: enable disable | Enable/disable Link Aggregation Group (LAG) bundling for non-FortiLink interfaces.
|  | description string |  | Description for port.
|  | dhcp_snoop_option82_trust string | Choices: enable disable | Enable/disable allowance of DHCP with option-82 on untrusted interface.
|  | dhcp_snooping string | Choices: untrusted trusted | Trusted or untrusted DHCP-snooping interface.
|  | discard_mode string | Choices: none all-untagged all-tagged | Configure discard mode for port.
|  | edge_port string | Choices: enable disable | Enable/disable this interface as an edge port, bridging connections between workstations and/or computers.
|  | export_tags list |  | Switch controller export tag name.
|  |  | tag_name string |  | Switch tag name. Source switch-controller.switch-interface-tag.name.
|  | export_to string |  | Export managed-switch port to a tenant VDOM. Source system.vdom.name.
|  | export_to_pool string |  | Switch controller export port to pool-list. Source switch-controller.virtual-port-pool.name.
|  | export_to_pool_flag integer |  | Switch controller export port to pool-list.
|  | fgt_peer_device_name string |  | FGT peer device name.
|  | fgt_peer_port_name string |  | FGT peer port name.
|  | fiber_port integer |  | Fiber-port.
|  | flags integer |  | Port properties flags.
|  | fortilink_port integer |  | FortiLink uplink port.
|  | igmp_snooping string | Choices: enable disable | Set IGMP snooping mode for the physical port interface.
|  | igmps_flood_reports string | Choices: enable disable | Enable/disable flooding of IGMP reports to this interface when igmp-snooping enabled.
|  | igmps_flood_traffic string | Choices: enable disable | Enable/disable flooding of IGMP snooping traffic to this interface.
|  | isl_local_trunk_name string |  | ISL local trunk name.
|  | isl_peer_device_name string |  | ISL peer device name.
|  | isl_peer_port_name string |  | ISL peer port name.
|  | lacp_speed string | Choices: slow fast | end Link Aggregation Control Protocol (LACP) messages every 30 seconds (slow) or every second (fast).
|  | learning_limit integer |  | Limit the number of dynamic MAC addresses on this Port (1 - 128, 0 = no limit, default).
|  | lldp_profile string |  | LLDP port TLV profile. Source switch-controller.lldp-profile.name.
|  | lldp_status string | Choices: disable rx-only tx-only tx-rx | LLDP transmit and receive status.
|  | loop_guard string | Choices: enabled disabled | Enable/disable loop-guard on this interface, an STP optimization used to prevent network loops.
|  | loop_guard_timeout integer |  | Loop-guard timeout (0 - 120 min).
|  | max_bundle integer |  | Maximum size of LAG bundle (1 - 24)
|  | mclag string | Choices: enable disable | Enable/disable multi-chassis link aggregation (MCLAG).
|  | member_withdrawal_behavior string | Choices: forward block | Port behavior after it withdraws because of loss of control packets.
|  | members list |  | Aggregated LAG bundle interfaces.
|  |  | member_name string |  | Interface name from available options.
|  | min_bundle integer |  | Minimum size of LAG bundle (1 - 24)
|  | mode string | Choices: static lacp-passive lacp-active | LACP mode: ignore and do not send control messages, or negotiate 802.3ad aggregation passively or actively.
|  | poe_capable integer |  | PoE capable.
|  | poe_pre_standard_detection string | Choices: enable disable | Enable/disable PoE pre-standard detection.
|  | poe_status string | Choices: enable disable | Enable/disable PoE status.
|  | port_name string |  | Switch port name.
|  | port_number integer |  | Port number.
|  | port_owner string |  | Switch port name.
|  | port_prefix_type integer |  | Port prefix type.
|  | port_security_policy string |  | Switch controller authentication policy to apply to this managed switch from available options. Source switch-controller .security-policy.802-1X.name switch-controller.security-policy.captive-portal.name.
|  | port_selection_criteria string | Choices: src-mac dst-mac src-dst-mac src-ip dst-ip src-dst-ip | Algorithm for aggregate port selection.
|  | qos_policy string |  | Switch controller QoS policy from available options. Source switch-controller.qos.qos-policy.name.
|  | sample_direction string | Choices: tx rx both | sFlow sample direction.
|  | sflow_counter_interval integer |  | sFlow sampler counter polling interval (1 - 255 sec).
|  | sflow_sample_rate integer |  | sFlow sampler sample rate (0 - 99999 p/sec).
|  | sflow_sampler string | Choices: enabled disabled | Enable/disable sFlow protocol on this interface.
|  | speed string | Choices: 10half 10full 100half 100full 1000auto 1000fiber 1000full 10000 40000 auto auto-module 100FX-half 100FX-full 100000full 2500full 25000full 50000full | Switch port speed; default and available settings depend on hardware.
|  | speed_mask integer |  | Switch port speed mask.
|  | stacking_port integer |  | Stacking port.
|  | status string | Choices: up down | Switch port admin status: up or down.
|  | stp_bpdu_guard string | Choices: enabled disabled | Enable/disable STP BPDU guard on this interface.
|  | stp_bpdu_guard_timeout integer |  | BPDU Guard disabling protection (0 - 120 min).
|  | stp_root_guard string | Choices: enabled disabled | Enable/disable STP root guard on this interface.
|  | stp_state string | Choices: enabled disabled | Enable/disable Spanning Tree Protocol (STP) on this interface.
|  | switch_id string |  | Switch id.
|  | type string | Choices: physical trunk | Interface type: physical or trunk port.
|  | untagged_vlans list |  | Configure switch port untagged vlans
|  |  | vlan_name string |  | VLAN name. Source system.interface.name.
|  | virtual_port integer |  | Virtualized switch port.
|  | vlan string |  | Assign switch ports to a VLAN. Source system.interface.name.
| pre_provisioned integer |  | Pre-provisioned managed switch.
| staged_image_version string |  | Staged image version for FortiSwitch.
| state string | Choices: present absent | Deprecated Starting with Ansible 2.9 we recommend using the top-level 'state' parameter. Indicates whether to create or remove the object.
| storm_control dictionary |  | Configuration method to edit FortiSwitch storm control for measuring traffic activity using data rates to prevent traffic disruption.
|  | broadcast string | Choices: enable disable | Enable/disable storm control to drop broadcast traffic.
|  | local_override string | Choices: enable disable | Enable to override global FortiSwitch storm control settings for this FortiSwitch.
|  | rate integer |  | Rate in packets per second at which storm traffic is controlled (1 - 10000000). Storm control drops excess traffic data rates beyond this threshold.
|  | unknown_multicast string | Choices: enable disable | Enable/disable storm control to drop unknown multicast traffic.
|  | unknown_unicast string | Choices: enable disable | Enable/disable storm control to drop unknown unicast traffic.
| stp_settings dictionary |  | Configuration method to edit Spanning Tree Protocol (STP) settings used to prevent bridge loops.
|  | forward_time integer |  | Period of time a port is in listening and learning state (4 - 30 sec).
|  | hello_time integer |  | Period of time between successive STP frame Bridge Protocol Data Units (BPDUs) sent on a port (1 - 10 sec).
|  | local_override string | Choices: enable disable | Enable to configure local STP settings that override global STP settings.
|  | max_age integer |  | Maximum time before a bridge port saves its configuration BPDU information (6 - 40 sec).
|  | max_hops integer |  | Maximum number of hops between the root bridge and the furthest bridge (1- 40).
|  | name string |  | Name of local STP settings configuration.
|  | pending_timer integer |  | Pending time (1 - 15 sec).
|  | revision integer |  | STP revision number (0 - 65535).
|  | status string | Choices: enable disable | Enable/disable STP.
| switch_device_tag string |  | User definable label/tag.
| switch_id string |  | Managed-switch id.
| switch_log dictionary |  | Configuration method to edit FortiSwitch logging settings (logs are transferred to and inserted into the FortiGate event log).
|  | local_override string | Choices: enable disable | Enable to configure local logging settings that override global logging settings.
|  | severity string | Choices: emergency alert critical error warning notification information debug | Severity of FortiSwitch logs that are added to the FortiGate event log.
|  | status string | Choices: enable disable | Enable/disable adding FortiSwitch logs to the FortiGate event log.
| switch_profile string |  | FortiSwitch profile. Source switch-controller.switch-profile.name.
| switch_stp_settings dictionary |  | Configure spanning tree protocol (STP).
|  | status string | Choices: enable disable | Enable/disable STP.
| type string | Choices: virtual physical | Indication of switch type, physical or virtual.
| version integer |  | FortiSwitch version.
username string |  | FortiOS or FortiGate username.
vdom string | Default: "root" | Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit.

## Notes

Note

- Requires fortiosapi library developed by Fortinet
- Run as a local_action in your playbook

## Examples

    - hosts: localhost
      vars:
       host: "192.168.122.40"
       username: "admin"
       password: ""
       vdom: "root"
       ssl_verify: "False"
      tasks:
      - name: Configure FortiSwitch devices that are managed by this FortiGate.
        fortios_switch_controller_managed_switch:
          host:  "{{ host }}"
          username: "{{ username }}"
          password: "{{ password }}"
          vdom:  "{{ vdom }}"
          https: "False"
          state: "present"
          switch_controller_managed_switch:
            802_1X_settings:
                link_down_auth: "set-unauth"
                local_override: "enable"
                max_reauth_attempt: "6"
                reauth_period: "7"
            custom_command:
             -
                command_entry: "<your_own_value>"
                command_name: "<your_own_value> (source switch-controller.custom-command.command-name)"
            delayed_restart_trigger: "11"
            description: "<your_own_value>"
            directly_connected: "13"
            dynamic_capability: "14"
            dynamically_discovered: "15"
            fsw_wan1_admin: "discovered"
            fsw_wan1_peer: "<your_own_value>"
            fsw_wan2_admin: "discovered"
            fsw_wan2_peer: "<your_own_value>"
            igmp_snooping:
                aging_time: "21"
                flood_unknown_multicast: "enable"
                local_override: "enable"
            max_allowed_trunk_members: "24"
            mirror:
             -
                dst: "<your_own_value>"
                name: "default_name_27"
                src_egress:
                 -
                    name: "default_name_29"
                src_ingress:
                 -
                    name: "default_name_31"
                status: "active"
                switching_packet: "enable"
            name: "default_name_34"
            owner_vdom: "<your_own_value>"
            poe_detection_type: "36"
            poe_pre_standard_detection: "enable"
            ports:
             -
                allowed_vlans:
                 -
                    vlan_name: "<your_own_value> (source system.interface.name)"
                allowed_vlans_all: "enable"
                arp_inspection_trust: "untrusted"
                bundle: "enable"
                description: "<your_own_value>"
                dhcp_snoop_option82_trust: "enable"
                dhcp_snooping: "untrusted"
                discard_mode: "none"
                edge_port: "enable"
                export_tags:
                 -
                    tag_name: "<your_own_value> (source switch-controller.switch-interface-tag.name)"
                export_to: "<your_own_value> (source system.vdom.name)"
                export_to_pool: "<your_own_value> (source switch-controller.virtual-port-pool.name)"
                export_to_pool_flag: "53"
                fgt_peer_device_name: "<your_own_value>"
                fgt_peer_port_name: "<your_own_value>"
                fiber_port: "56"
                flags: "57"
                fortilink_port: "58"
                igmp_snooping: "enable"
                igmps_flood_reports: "enable"
                igmps_flood_traffic: "enable"
                isl_local_trunk_name: "<your_own_value>"
                isl_peer_device_name: "<your_own_value>"
                isl_peer_port_name: "<your_own_value>"
                lacp_speed: "slow"
                learning_limit: "66"
                lldp_profile: "<your_own_value> (source switch-controller.lldp-profile.name)"
                lldp_status: "disable"
                loop_guard: "enabled"
                loop_guard_timeout: "70"
                max_bundle: "71"
                mclag: "enable"
                member_withdrawal_behavior: "forward"
                members:
                 -
                    member_name: "<your_own_value>"
                min_bundle: "76"
                mode: "static"
                poe_capable: "78"
                poe_pre_standard_detection: "enable"
                poe_status: "enable"
                port_name: "<your_own_value>"
                port_number: "82"
                port_owner: "<your_own_value>"
                port_prefix_type: "84"
                port_security_policy: "<your_own_value> (source switch-controller.security-policy.802-1X.name switch-controller.security-policy.captive-portal
                  .name)"
                port_selection_criteria: "src-mac"
                qos_policy: "<your_own_value> (source switch-controller.qos.qos-policy.name)"
                sample_direction: "tx"
                sflow_counter_interval: "89"
                sflow_sample_rate: "90"
                sflow_sampler: "enabled"
                speed: "10half"
                speed_mask: "93"
                stacking_port: "94"
                status: "up"
                stp_bpdu_guard: "enabled"
                stp_bpdu_guard_timeout: "97"
                stp_root_guard: "enabled"
                stp_state: "enabled"
                switch_id: "<your_own_value>"
                type: "physical"
                untagged_vlans:
                 -
                    vlan_name: "<your_own_value> (source system.interface.name)"
                virtual_port: "104"
                vlan: "<your_own_value> (source system.interface.name)"
            pre_provisioned: "106"
            staged_image_version: "<your_own_value>"
            storm_control:
                broadcast: "enable"
                local_override: "enable"
                rate: "111"
                unknown_multicast: "enable"
                unknown_unicast: "enable"
            stp_settings:
                forward_time: "115"
                hello_time: "116"
                local_override: "enable"
                max_age: "118"
                max_hops: "119"
                name: "default_name_120"
                pending_timer: "121"
                revision: "122"
                status: "enable"
            switch_device_tag: "<your_own_value>"
            switch_id: "<your_own_value>"
            switch_log:
                local_override: "enable"
                severity: "emergency"
                status: "enable"
            switch_profile: "<your_own_value> (source switch-controller.switch-profile.name)"
            switch_stp_settings:
                status: "enable"
            type: "virtual"
            version: "134"

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
build string | always | Build number of the fortigate image Sample: 1547
http_method string | always | Last method used to provision the content into FortiGate Sample: PUT
http_status string | always | Last result given by FortiGate on last operation applied Sample: 200
mkey string | success | Master key (id) used in the last call to FortiGate Sample: id
name string | always | Name of the table used to fulfill the request Sample: urlfilter
path string | always | Path of the table used to fulfill the request Sample: webfilter
revision string | always | Internal revision number Sample: 17.0.2.10658
serial string | always | Serial number of the unit Sample: FGVMEVYYQT3AB5352
status string | always | Indication of the operation's result Sample: success
vdom string | always | Virtual domain used Sample: root
version string | always | Version of the FortiGate Sample: v5.6.3

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by the Ansible Community. [community]

### Authors

- Miguel Angel Munoz (@mamunozgonzalez)
- Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.