- AnsibleFest
- Products
- Community
- Webinars & Training
- Blog

Documentation

# fortios_vpn_ssl_settings – Configure SSL VPN in Fortinet’s FortiOS and FortiGate

New in version 2.8.

- Synopsis
- Requirements
- Parameters
- Notes
- Examples
- Return Values
- Status

## Synopsis

- This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify vpn_ssl feature and settings category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.5

## Requirements

The below requirements are needed on the host that executes this module.

- fortiosapi>=0.9.8

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
host string |  | FortiOS or FortiGate IP address.
https boolean | Choices: no yes ← | Indicates if the requests towards FortiGate must use HTTPS protocol.
password string | Default: "" | FortiOS or FortiGate password.
ssl_verify boolean added in 2.9 | Choices: no yes ← | Ensures FortiGate certificate must be verified by a proper CA.
username string |  | FortiOS or FortiGate username.
vdom string | Default: "root" | Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit.
vpn_ssl_settings dictionary | Default: null | Configure SSL VPN.
| auth_timeout integer |  | SSL-VPN authentication timeout (1 - 259200 sec (3 days), 0 for no timeout).
| authentication_rule list |  | Authentication rule for SSL VPN.
|  | auth string | Choices: any local radius tacacs+ ldap | SSL VPN authentication method restriction.
|  | cipher string | Choices: any high medium | SSL VPN cipher strength.
|  | client_cert string | Choices: enable disable | Enable/disable SSL VPN client certificate restrictive.
|  | groups list |  | User groups.
|  |  | name string / required |  | Group name. Source user.group.name.
|  | id integer / required |  | ID (0 - 4294967295).
|  | portal string |  | SSL VPN portal. Source vpn.ssl.web.portal.name.
|  | realm string |  | SSL VPN realm. Source vpn.ssl.web.realm.url-path.
|  | source_address list |  | Source address of incoming traffic.
|  |  | name string / required |  | Address name. Source firewall.address.name firewall.addrgrp.name.
|  | source_address6 list |  | IPv6 source address of incoming traffic.
|  |  | name string / required |  | IPv6 address name. Source firewall.address6.name firewall.addrgrp6.name.
|  | source_address6_negate string | Choices: enable disable | Enable/disable negated source IPv6 address match.
|  | source_address_negate string | Choices: enable disable | Enable/disable negated source address match.
|  | source_interface list |  | SSL VPN source interface of incoming traffic.
|  |  | name string / required |  | Interface name. Source system.interface.name system.zone.name.
|  | users list |  | User name.
|  |  | name string / required |  | User name. Source user.local.name.
| auto_tunnel_static_route string | Choices: enable disable | Enable to auto-create static routes for the SSL-VPN tunnel IP addresses.
| banned_cipher string | Choices: RSA DH DHE ECDH ECDHE DSS ECDSA AES AESGCM CAMELLIA 3DES SHA1 SHA256 SHA384 STATIC | Select one or more cipher technologies that cannot be used in SSL-VPN negotiations.
| check_referer string | Choices: enable disable | Enable/disable verification of referer field in HTTP request header.
| default_portal string |  | Default SSL VPN portal. Source vpn.ssl.web.portal.name.
| deflate_compression_level integer |  | Compression level (0~9).
| deflate_min_data_size integer |  | Minimum amount of data that triggers compression (200 - 65535 bytes).
| dns_server1 string |  | DNS server 1.
| dns_server2 string |  | DNS server 2.
| dns_suffix string |  | DNS suffix used for SSL-VPN clients.
| dtls_hello_timeout integer |  | SSLVPN maximum DTLS hello timeout (10 - 60 sec).
| dtls_tunnel string | Choices: enable disable | Enable DTLS to prevent eavesdropping, tampering, or message forgery.
| force_two_factor_auth string | Choices: enable disable | Enable to force two-factor authentication for all SSL-VPNs.
| header_x_forwarded_for string | Choices: pass add remove | Forward the same, add, or remove HTTP header.
| http_compression string | Choices: enable disable | Enable to allow HTTP compression over SSL-VPN tunnels.
| http_only_cookie string | Choices: enable disable | Enable/disable SSL-VPN support for HttpOnly cookies.
| http_request_body_timeout integer |  | SSL-VPN session is disconnected if an HTTP request body is not received within this time (1 - 60 sec).
| http_request_header_timeout integer |  | SSL-VPN session is disconnected if an HTTP request header is not received within this time (1 - 60 sec).
| https_redirect string | Choices: enable disable | Enable/disable redirect of port 80 to SSL-VPN port.
| idle_timeout integer |  | SSL VPN disconnects if idle for specified time in seconds.
| ipv6_dns_server1 string |  | IPv6 DNS server 1.
| ipv6_dns_server2 string |  | IPv6 DNS server 2.
| ipv6_wins_server1 string |  | IPv6 WINS server 1.
| ipv6_wins_server2 string |  | IPv6 WINS server 2.
| login_attempt_limit integer |  | SSL VPN maximum login attempt times before block (0 - 10).
| login_block_time integer |  | Time for which a user is blocked from logging in after too many failed login attempts (0 - 86400 sec).
| login_timeout integer |  | SSLVPN maximum login timeout (10 - 180 sec).
| port integer |  | SSL-VPN access port (1 - 65535).
| port_precedence string | Choices: enable disable | Enable means that if SSL-VPN connections are allowed on an interface admin GUI connections are blocked on that interface.
| reqclientcert string | Choices: enable disable | Enable to require client certificates for all SSL-VPN users.
| route_source_interface string | Choices: enable disable | Enable to allow SSL-VPN sessions to bypass routing and bind to the incoming interface.
| servercert string |  | Name of the server certificate to be used for SSL-VPNs. Source vpn.certificate.local.name.
| source_address list |  | Source address of incoming traffic.
|  | name string / required |  | Address name. Source firewall.address.name firewall.addrgrp.name.
| source_address6 list |  | IPv6 source address of incoming traffic.
|  | name string / required |  | IPv6 address name. Source firewall.address6.name firewall.addrgrp6.name.
| source_address6_negate string | Choices: enable disable | Enable/disable negated source IPv6 address match.
| source_address_negate string | Choices: enable disable | Enable/disable negated source address match.
| source_interface list |  | SSL VPN source interface of incoming traffic.
|  | name string / required |  | Interface name. Source system.interface.name system.zone.name.
| ssl_client_renegotiation string | Choices: disable enable | Enable to allow client renegotiation by the server if the tunnel goes down.
| ssl_insert_empty_fragment string | Choices: enable disable | Enable/disable insertion of empty fragment.
| tlsv1_0 string | Choices: enable disable | Enable/disable TLSv1.0.
| tlsv1_1 string | Choices: enable disable | Enable/disable TLSv1.1.
| tlsv1_2 string | Choices: enable disable | Enable/disable TLSv1.2.
| tunnel_ip_pools list |  | Names of the IPv4 IP Pool firewall objects that define the IP addresses reserved for remote clients.
|  | name string / required |  | Address name. Source firewall.address.name firewall.addrgrp.name.
| tunnel_ipv6_pools list |  | Names of the IPv6 IP Pool firewall objects that define the IP addresses reserved for remote clients.
|  | name string / required |  | Address name. Source firewall.address6.name firewall.addrgrp6.name.
| unsafe_legacy_renegotiation string | Choices: enable disable | Enable/disable unsafe legacy re-negotiation.
| url_obscuration string | Choices: enable disable | Enable to obscure the host name of the URL of the web browser display.
| wins_server1 string |  | WINS server 1.
| wins_server2 string |  | WINS server 2.
| x_content_type_options string | Choices: enable disable | Add HTTP X-Content-Type-Options header.

## Notes

Note

- Requires fortiosapi library developed by Fortinet
- Run as a local_action in your playbook

## Examples

    - hosts: localhost
      vars:
       host: "192.168.122.40"
       username: "admin"
       password: ""
       vdom: "root"
       ssl_verify: "False"
      tasks:
      - name: Configure SSL VPN.
        fortios_vpn_ssl_settings:
          host:  "{{ host }}"
          username: "{{ username }}"
          password: "{{ password }}"
          vdom:  "{{ vdom }}"
          https: "False"
          vpn_ssl_settings:
            auth_timeout: "3"
            authentication_rule:
             -
                auth: "any"
                cipher: "any"
                client_cert: "enable"
                groups:
                 -
                    name: "default_name_9 (source user.group.name)"
                id:  "10"
                portal: "<your_own_value> (source vpn.ssl.web.portal.name)"
                realm: "<your_own_value> (source vpn.ssl.web.realm.url-path)"
                source_address:
                 -
                    name: "default_name_14 (source firewall.address.name firewall.addrgrp.name)"
                source_address_negate: "enable"
                source_address6:
                 -
                    name: "default_name_17 (source firewall.address6.name firewall.addrgrp6.name)"
                source_address6_negate: "enable"
                source_interface:
                 -
                    name: "default_name_20 (source system.interface.name system.zone.name)"
                users:
                 -
                    name: "default_name_22 (source user.local.name)"
            auto_tunnel_static_route: "enable"
            banned_cipher: "RSA"
            check_referer: "enable"
            default_portal: "<your_own_value> (source vpn.ssl.web.portal.name)"
            deflate_compression_level: "27"
            deflate_min_data_size: "28"
            dns_server1: "<your_own_value>"
            dns_server2: "<your_own_value>"
            dns_suffix: "<your_own_value>"
            dtls_hello_timeout: "32"
            dtls_tunnel: "enable"
            force_two_factor_auth: "enable"
            header_x_forwarded_for: "pass"
            http_compression: "enable"
            http_only_cookie: "enable"
            http_request_body_timeout: "38"
            http_request_header_timeout: "39"
            https_redirect: "enable"
            idle_timeout: "41"
            ipv6_dns_server1: "<your_own_value>"
            ipv6_dns_server2: "<your_own_value>"
            ipv6_wins_server1: "<your_own_value>"
            ipv6_wins_server2: "<your_own_value>"
            login_attempt_limit: "46"
            login_block_time: "47"
            login_timeout: "48"
            port: "49"
            port_precedence: "enable"
            reqclientcert: "enable"
            route_source_interface: "enable"
            servercert: "<your_own_value> (source vpn.certificate.local.name)"
            source_address:
             -
                name: "default_name_55 (source firewall.address.name firewall.addrgrp.name)"
            source_address_negate: "enable"
            source_address6:
             -
                name: "default_name_58 (source firewall.address6.name firewall.addrgrp6.name)"
            source_address6_negate: "enable"
            source_interface:
             -
                name: "default_name_61 (source system.interface.name system.zone.name)"
            ssl_client_renegotiation: "disable"
            ssl_insert_empty_fragment: "enable"
            tlsv1_0: "enable"
            tlsv1_1: "enable"
            tlsv1_2: "enable"
            tunnel_ip_pools:
             -
                name: "default_name_68 (source firewall.address.name firewall.addrgrp.name)"
            tunnel_ipv6_pools:
             -
                name: "default_name_70 (source firewall.address6.name firewall.addrgrp6.name)"
            unsafe_legacy_renegotiation: "enable"
            url_obscuration: "enable"
            wins_server1: "<your_own_value>"
            wins_server2: "<your_own_value>"
            x_content_type_options: "enable"

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
build string | always | Build number of the fortigate image Sample: 1547
http_method string | always | Last method used to provision the content into FortiGate Sample: PUT
http_status string | always | Last result given by FortiGate on last operation applied Sample: 200
mkey string | success | Master key (id) used in the last call to FortiGate Sample: id
name string | always | Name of the table used to fulfill the request Sample: urlfilter
path string | always | Path of the table used to fulfill the request Sample: webfilter
revision string | always | Internal revision number Sample: 17.0.2.10658
serial string | always | Serial number of the unit Sample: FGVMEVYYQT3AB5352
status string | always | Indication of the operation's result Sample: success
vdom string | always | Virtual domain used Sample: root
version string | always | Version of the FortiGate Sample: v5.6.3

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by the Ansible Community. [community]

### Authors

- Miguel Angel Munoz (@mamunozgonzalez)
- Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.