| source: | fortios_system_virtual_wan_link.py |
|---|---|
| orphan: |
fortios_system_virtual_wan_link -- Configure redundant internet connections using SD-WAN (formerly virtual WAN link) in Fortinet's FortiOS and FortiGate.
.. versionadded:: 2.0.0
- This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify system feature and virtual_wan_link category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0
The below requirements are needed on the host that executes this module.
- ansible>=2.9
Using member operation to add an element to an existing object.
v6.0.0 |
v6.0.5 |
v6.0.11 |
v6.2.0 |
v6.2.3 |
v6.2.5 |
v6.2.7 |
|
| fortios_system_virtual_wan_link | yes | yes | yes | yes | yes | yes | yes |
- access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: false
- enable_log - Enable/Disable logging for task. type: bool required: false default: False
- vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
- member_path - Member attribute path to operate on. type: str
- member_state - Add or delete a member under specified attribute path. type: str choices: present, absent
- system_virtual_wan_link - Configure redundant internet connections using SD-WAN (formerly virtual WAN link). type: dict
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7system_virtual_wan_link yes yes yes yes yes yes yes - fail_alert_interfaces - Physical interfaces that will be alerted. type: list member_path: fail_alert_interfaces:name
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7fail_alert_interfaces yes yes yes yes yes yes yes - name - Physical interface name. Source system.interface.name. type: str required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7name yes yes yes yes yes yes yes - fail_detect - Enable/disable SD-WAN Internet connection status checking (failure detection). type: str choices: enable, disable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7fail_detect yes yes yes yes yes yes yes [enable] yes yes yes yes yes yes yes [disable] yes yes yes yes yes yes yes - health_check - SD-WAN status checking or health checking. Identify a server on the Internet and determine how SD-WAN verifies that the FortiGate can communicate with it. type: list member_path: health_check:name
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7health_check yes yes yes yes yes yes yes - addr_mode - Address mode (IPv4 or IPv6). type: str choices: ipv4, ipv6
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7addr_mode yes yes yes yes yes yes yes [ipv4] yes yes yes yes yes yes yes [ipv6] yes yes yes yes yes yes yes - diffservcode - Differentiated services code point (DSCP) in the IP header of the probe packet. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7diffservcode no no no yes no yes yes - failtime - Number of failures before server is considered lost (1 - 3600). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7failtime yes yes yes yes yes yes yes - ha_priority - HA election priority (1 - 50). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7ha_priority no no no yes yes yes yes - http_agent - String in the http-agent field in the HTTP header. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7http_agent yes yes yes yes yes yes yes - http_get - URL used to communicate with the server if the protocol if the protocol is HTTP. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7http_get yes yes yes yes yes yes yes - http_match - Response string expected from the server if the protocol is HTTP. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7http_match yes yes yes yes yes yes yes - interval - Status check interval in milliseconds, or the time between attempting to connect to the server (500 - 3600*1000 msec). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7interval yes yes yes yes yes yes yes - members - Member sequence number list. type: list member_path: health_check:name/members:seq_num
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7members yes yes yes yes yes yes yes - seq_num - Member sequence number. Source system.virtual-wan-link.members.seq-num. type: int required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7seq_num yes yes yes yes yes yes yes - name - Status check or health check name. type: str required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7name yes yes yes yes yes yes yes - packet_size - Packet size of a twamp test session, type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7packet_size yes yes yes yes yes yes yes - password - Twamp controller password in authentication mode type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7password yes yes yes yes yes yes yes - port - Port number used to communicate with the server over the selected protocol. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7port yes yes yes yes yes yes yes - probe_packets - Enable/disable transmission of probe packets. type: str choices: disable, enable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7probe_packets no no no yes yes yes yes [disable] n/a n/a n/a yes yes yes yes [enable] n/a n/a n/a yes yes yes yes - probe_timeout - Time to wait before a probe packet is considered lost (500 - 5000 msec). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7probe_timeout no no no yes no yes yes - protocol - Protocol used to determine if the FortiGate can communicate with the server. type: str choices: ping, tcp-echo, udp-echo, http, twamp, ping6
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7protocol yes yes yes yes yes yes yes [ping] yes yes yes yes yes yes yes [tcp-echo] yes yes yes yes yes yes yes [udp-echo] yes yes yes yes yes yes yes [http] yes yes yes yes yes yes yes [twamp] yes yes yes yes yes yes yes [ping6] yes yes yes yes yes yes yes - recoverytime - Number of successful responses received before server is considered recovered (1 - 3600). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7recoverytime yes yes yes yes yes yes yes - security_mode - Twamp controller security mode. type: str choices: none, authentication
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7security_mode yes yes yes yes yes yes yes [none] yes yes yes yes yes yes yes [authentication] yes yes yes yes yes yes yes - server - IP address or FQDN name of the server. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7server yes yes yes yes yes yes yes - sla - Service level agreement (SLA). type: list member_path: health_check:name/sla:id
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7sla yes yes yes yes yes yes yes - id - SLA ID. type: int required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7id yes yes yes yes yes yes yes - jitter_threshold - Jitter for SLA to make decision in milliseconds. (0 - 10000000). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7jitter_threshold yes yes yes yes yes yes yes - latency_threshold - Latency for SLA to make decision in milliseconds. (0 - 10000000). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7latency_threshold yes yes yes yes yes yes yes - link_cost_factor - Criteria on which to base link selection. type: list choices: latency, jitter, packet-loss
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7link_cost_factor yes yes yes yes yes yes yes [latency] yes yes yes yes yes yes yes [jitter] yes yes yes yes yes yes yes [packet-loss] yes yes yes yes yes yes yes - packetloss_threshold - Packet loss for SLA to make decision in percentage. (0 - 100). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7packetloss_threshold yes yes yes yes yes yes yes - sla_fail_log_period - Time interval in seconds that SLA fail log messages will be generated (0 - 3600). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7sla_fail_log_period no no no yes yes yes yes - sla_pass_log_period - Time interval in seconds that SLA pass log messages will be generated (0 - 3600). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7sla_pass_log_period no no no yes yes yes yes - threshold_alert_jitter - Alert threshold for jitter (ms). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7threshold_alert_jitter yes yes yes yes yes yes yes - threshold_alert_latency - Alert threshold for latency (ms). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7threshold_alert_latency yes yes yes yes yes yes yes - threshold_alert_packetloss - Alert threshold for packet loss (percentage). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7threshold_alert_packetloss yes yes yes yes yes yes yes - threshold_warning_jitter - Warning threshold for jitter (ms). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7threshold_warning_jitter yes yes yes yes yes yes yes - threshold_warning_latency - Warning threshold for latency (ms). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7threshold_warning_latency yes yes yes yes yes yes yes - threshold_warning_packetloss - Warning threshold for packet loss (percentage). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7threshold_warning_packetloss yes yes yes yes yes yes yes - update_cascade_interface - Enable/disable update cascade interface. type: str choices: enable, disable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7update_cascade_interface yes yes yes yes yes yes yes [enable] yes yes yes yes yes yes yes [disable] yes yes yes yes yes yes yes - update_static_route - Enable/disable updating the static route. type: str choices: enable, disable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7update_static_route yes yes yes yes yes yes yes [enable] yes yes yes yes yes yes yes [disable] yes yes yes yes yes yes yes - load_balance_mode - Algorithm or mode to use for load balancing Internet traffic to SD-WAN members. type: str choices: source-ip-based, weight-based, usage-based, source-dest-ip-based, measured-volume-based
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7load_balance_mode yes yes yes yes yes yes yes [source-ip-based] yes yes yes yes yes yes yes [weight-based] yes yes yes yes yes yes yes [usage-based] yes yes yes yes yes yes yes [source-dest-ip-based] yes yes yes yes yes yes yes [measured-volume-based] yes yes yes yes yes yes yes - members - FortiGate interfaces added to the virtual-wan-link. type: list member_path: members:seq_num
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7members yes yes yes yes yes yes yes - comment - Comments. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7comment yes yes yes yes yes yes yes - cost - Cost of this interface for services in SLA mode (0 - 4294967295). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7cost no no no yes yes yes yes - gateway - The default gateway for this interface. Usually the default gateway of the Internet service provider that this interface is connected to. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7gateway yes yes yes yes yes yes yes - gateway6 - IPv6 gateway. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7gateway6 yes yes yes yes yes yes yes - ingress_spillover_threshold - Ingress spillover threshold for this interface (0 - 16776000 kbit/s). When this traffic volume threshold is reached, new sessions spill over to other interfaces in the SD-WAN. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7ingress_spillover_threshold yes yes yes yes yes yes yes - interface - Interface name. Source system.interface.name. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7interface yes yes yes yes yes yes yes - priority - Priority of the interface (0 - 4294967295). Used for SD-WAN rules or priority rules. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7priority yes yes yes yes yes yes yes - seq_num - Sequence number(1-255). type: int required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7seq_num yes yes yes yes yes yes yes - source - Source IP address used in the health-check packet to the server. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7source yes yes yes yes yes yes yes - source6 - Source IPv6 address used in the health-check packet to the server. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7source6 yes yes yes yes yes yes yes - spillover_threshold - Egress spillover threshold for this interface (0 - 16776000 kbit/s). When this traffic volume threshold is reached, new sessions spill over to other interfaces in the SD-WAN. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7spillover_threshold yes yes yes yes yes yes yes - status - Enable/disable this interface in the SD-WAN. type: str choices: disable, enable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7status yes yes yes yes yes yes yes [disable] yes yes yes yes yes yes yes [enable] yes yes yes yes yes yes yes - volume_ratio - Measured volume ratio (this value / sum of all values = percentage of link volume, 1 - 255). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7volume_ratio yes yes yes yes yes yes yes - weight - Weight of this interface for weighted load balancing. (1 - 255) More traffic is directed to interfaces with higher weights. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7weight yes yes yes yes yes yes yes - neighbor - Create SD-WAN neighbor from BGP neighbor table to control route advertisements according to SLA status. type: list member_path: neighbor:ip
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7neighbor no no no yes yes yes yes - health_check - SD-WAN health-check name. Source system.virtual-wan-link.health-check.name. type: str
more...
v6.2.0v6.2.3v6.2.5v6.2.7health_check yes yes yes yes - ip - IP address of neighbor. Source router.bgp.neighbor.ip. type: str required: true
more...
v6.2.0v6.2.3v6.2.5v6.2.7ip yes yes yes yes - member - Member sequence number. Source system.virtual-wan-link.members.seq-num. type: int
more...
v6.2.0v6.2.3v6.2.5v6.2.7member yes yes yes yes - role - Role of neighbor. type: str choices: standalone, primary, secondary
more...
v6.2.0v6.2.3v6.2.5v6.2.7role yes yes yes yes [standalone] yes yes yes yes [primary] yes yes yes yes [secondary] yes yes yes yes - sla_id - SLA ID. type: int
more...
v6.2.0v6.2.3v6.2.5v6.2.7sla_id yes yes yes yes - neighbor_hold_boot_time - Waiting period in seconds when switching from the primary neighbor to the secondary neighbor from the neighbor start. (0 - 10000000). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7neighbor_hold_boot_time no no no yes yes yes yes - neighbor_hold_down - Enable/disable hold switching from the secondary neighbor to the primary neighbor. type: str choices: enable, disable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7neighbor_hold_down no no no yes yes yes yes [enable] n/a n/a n/a yes yes yes yes [disable] n/a n/a n/a yes yes yes yes - neighbor_hold_down_time - Waiting period in seconds when switching from the secondary neighbor to the primary neighbor when hold-down is disabled. (0 - 10000000). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7neighbor_hold_down_time no no no yes yes yes yes - service - Create SD-WAN rules (also called services) to control how sessions are distributed to interfaces in the SD-WAN. type: list member_path: service:id
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7service yes yes yes yes yes yes yes - addr_mode - Address mode (IPv4 or IPv6). type: str choices: ipv4, ipv6
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7addr_mode yes yes yes yes yes yes yes [ipv4] yes yes yes yes yes yes yes [ipv6] yes yes yes yes yes yes yes - bandwidth_weight - Coefficient of reciprocal of available bidirectional bandwidth in the formula of custom-profile-1. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7bandwidth_weight yes yes yes yes yes yes yes - default - Enable/disable use of SD-WAN as default service. type: str choices: enable, disable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7default yes yes yes yes yes yes yes [enable] yes yes yes yes yes yes yes [disable] yes yes yes yes yes yes yes - dscp_forward - Enable/disable forward traffic DSCP tag. type: str choices: enable, disable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7dscp_forward yes yes yes yes yes yes yes [enable] yes yes yes yes yes yes yes [disable] yes yes yes yes yes yes yes - dscp_forward_tag - Forward traffic DSCP tag. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7dscp_forward_tag yes yes yes yes yes yes yes - dscp_reverse - Enable/disable reverse traffic DSCP tag. type: str choices: enable, disable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7dscp_reverse yes yes yes yes yes yes yes [enable] yes yes yes yes yes yes yes [disable] yes yes yes yes yes yes yes - dscp_reverse_tag - Reverse traffic DSCP tag. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7dscp_reverse_tag yes yes yes yes yes yes yes - dst - Destination address name. type: list member_path: service:id/dst:name
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7dst yes yes yes yes yes yes yes - name - Address or address group name. Source firewall.address.name firewall.addrgrp.name. type: str required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7name yes yes yes yes yes yes yes - dst_negate - Enable/disable negation of destination address match. type: str choices: enable, disable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7dst_negate yes yes yes yes yes yes yes [enable] yes yes yes yes yes yes yes [disable] yes yes yes yes yes yes yes - dst6 - Destination address6 name. type: list member_path: service:id/dst6:name
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7dst6 yes yes yes yes yes yes yes - name - Address6 or address6 group name. Source firewall.address6.name firewall.addrgrp6.name. type: str required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7name yes yes yes yes yes yes yes - end_port - End destination port number. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7end_port yes yes yes yes yes yes yes - gateway - Enable/disable SD-WAN service gateway. type: str choices: enable, disable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7gateway yes yes yes yes yes yes yes [enable] yes yes yes yes yes yes yes [disable] yes yes yes yes yes yes yes - groups - User groups. type: list member_path: service:id/groups:name
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7groups yes yes yes yes yes yes yes - name - Group name. Source user.group.name. type: str required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7name yes yes yes yes yes yes yes - health_check - Health check. Source system.virtual-wan-link.health-check.name. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7health_check yes yes yes yes yes yes yes - hold_down_time - Waiting period in seconds when switching from the back-up member to the primary member (0 - 10000000). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7hold_down_time yes yes yes yes yes yes yes - id - Priority rule ID (1 - 4000). type: int required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7id yes yes yes yes yes yes yes - input_device - Source interface name. type: list member_path: service:id/input_device:name
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7input_device yes yes yes yes yes yes yes - name - Interface name. Source system.interface.name. type: str required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7name yes yes yes yes yes yes yes - input_device_negate - Enable/disable negation of input device match. type: str choices: enable, disable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7input_device_negate no no no yes yes yes yes [enable] n/a n/a n/a yes yes yes yes [disable] n/a n/a n/a yes yes yes yes - internet_service - Enable/disable use of Internet service for application-based load balancing. type: str choices: enable, disable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7internet_service yes yes yes yes yes yes yes [enable] yes yes yes yes yes yes yes [disable] yes yes yes yes yes yes yes - internet_service_app_ctrl - Application control based Internet Service ID list. type: list member_path: service:id/internet_service_app_ctrl:id
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7internet_service_app_ctrl no no no yes yes yes yes - id - Application control based Internet Service ID. type: int required: true
more...
v6.2.0v6.2.3v6.2.5v6.2.7id yes yes yes yes - internet_service_app_ctrl_group - Application control based Internet Service group list. type: list member_path: service:id/internet_service_app_ctrl_group:name
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7internet_service_app_ctrl_group no no no yes yes yes yes - name - Application control based Internet Service group name. Source application.group.name. type: str required: true
more...
v6.2.0v6.2.3v6.2.5v6.2.7name yes yes yes yes - internet_service_ctrl - Control-based Internet Service ID list. type: list member_path: service:id/internet_service_ctrl:id
more...
v6.0.0v6.0.5v6.0.11internet_service_ctrl yes yes yes - id - Control-based Internet Service ID. type: int required: true
more...
v6.0.0v6.0.5v6.0.11id yes yes yes - internet_service_ctrl_group - Control-based Internet Service group list. type: list member_path: service:id/internet_service_ctrl_group:name
more...
v6.0.0v6.0.5v6.0.11internet_service_ctrl_group yes yes yes - name - Control-based Internet Service group name. Source application.group.name. type: str required: true
more...
v6.0.0v6.0.5v6.0.11name yes yes yes - internet_service_custom - Custom Internet service name list. type: list member_path: service:id/internet_service_custom:name
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7internet_service_custom yes yes yes yes yes yes yes - name - Custom Internet service name. Source firewall.internet-service-custom.name. type: str required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7name yes yes yes yes yes yes yes - internet_service_custom_group - Custom Internet Service group list. type: list member_path: service:id/internet_service_custom_group:name
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7internet_service_custom_group yes yes yes yes yes yes yes - name - Custom Internet Service group name. Source firewall.internet-service-custom-group.name. type: str required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7name yes yes yes yes yes yes yes - internet_service_group - Internet Service group list. type: list member_path: service:id/internet_service_group:name
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7internet_service_group yes yes yes yes yes yes yes - name - Internet Service group name. Source firewall.internet-service-group.name. type: str required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7name yes yes yes yes yes yes yes - internet_service_id - Internet service ID list. type: list member_path: service:id/internet_service_id:id
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7internet_service_id yes yes yes yes yes yes yes - id - Internet service ID. Source firewall.internet-service.id. type: int required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7id yes yes yes yes yes yes yes - jitter_weight - Coefficient of jitter in the formula of custom-profile-1. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7jitter_weight yes yes yes yes yes yes yes - latency_weight - Coefficient of latency in the formula of custom-profile-1. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7latency_weight yes yes yes yes yes yes yes - link_cost_factor - Link cost factor. type: str choices: latency, jitter, packet-loss, inbandwidth, outbandwidth, bibandwidth, custom-profile-1
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7link_cost_factor yes yes yes yes yes yes yes [latency] yes yes yes yes yes yes yes [jitter] yes yes yes yes yes yes yes [packet-loss] yes yes yes yes yes yes yes [inbandwidth] yes yes yes yes yes yes yes [outbandwidth] yes yes yes yes yes yes yes [bibandwidth] yes yes yes yes yes yes yes [custom-profile-1] yes yes yes yes yes yes yes - link_cost_threshold - Percentage threshold change of link cost values that will result in policy route regeneration (0 - 10000000). type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7link_cost_threshold yes yes yes yes yes yes yes - member - Member sequence number. Source system.virtual-wan-link.members.seq-num. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3member yes yes yes no yes - mode - Control how the priority rule sets the priority of interfaces in the SD-WAN. type: str choices: auto, manual, priority, sla, load-balance
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7mode yes yes yes yes yes yes yes [auto] yes yes yes yes yes yes yes [manual] yes yes yes yes yes yes yes [priority] yes yes yes yes yes yes yes [sla] yes yes yes yes yes yes yes [load-balance] no no no yes yes yes yes - name - Priority rule name. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7name yes yes yes yes yes yes yes - packet_loss_weight - Coefficient of packet-loss in the formula of custom-profile-1. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7packet_loss_weight yes yes yes yes yes yes yes - priority_members - Member sequence number list. type: list member_path: service:id/priority_members:seq_num
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7priority_members yes yes yes yes yes yes yes - seq_num - Member sequence number. Source system.virtual-wan-link.members.seq-num. type: int required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7seq_num yes yes yes yes yes yes yes - protocol - Protocol number. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7protocol yes yes yes yes yes yes yes - quality_link - Quality grade. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7quality_link yes yes yes yes yes yes yes - role - Service role to work with neighbor. type: str choices: standalone, primary, secondary
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7role no no no yes yes yes yes [standalone] n/a n/a n/a yes yes yes yes [primary] n/a n/a n/a yes yes yes yes [secondary] n/a n/a n/a yes yes yes yes - route_tag - IPv4 route map route-tag. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7route_tag yes yes yes yes yes yes yes - sla - Service level agreement (SLA). type: list member_path: service:id/sla:health_check
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7sla yes yes yes yes yes yes yes - health_check - Virtual WAN Link health-check. Source system.virtual-wan-link.health-check.name. type: str required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7health_check yes yes yes yes yes yes yes - id - SLA ID. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7id yes yes yes yes yes yes yes - sla_compare_method - Method to compare SLA value for sla and load balance mode. type: str choices: order, number
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7sla_compare_method no no no yes yes yes yes [order] n/a n/a n/a yes yes yes yes [number] n/a n/a n/a yes yes yes yes - src - Source address name. type: list member_path: service:id/src:name
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7src yes yes yes yes yes yes yes - name - Address or address group name. Source firewall.address.name firewall.addrgrp.name. type: str required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7name yes yes yes yes yes yes yes - src_negate - Enable/disable negation of source address match. type: str choices: enable, disable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7src_negate yes yes yes yes yes yes yes [enable] yes yes yes yes yes yes yes [disable] yes yes yes yes yes yes yes - src6 - Source address6 name. type: list member_path: service:id/src6:name
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7src6 yes yes yes yes yes yes yes - name - Address6 or address6 group name. Source firewall.address6.name firewall.addrgrp6.name. type: str required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7name yes yes yes yes yes yes yes - standalone_action - Enable/disable service when selected neighbor role is standalone while service role is not standalone. type: str choices: enable, disable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7standalone_action no no no yes yes yes yes [enable] n/a n/a n/a yes yes yes yes [disable] n/a n/a n/a yes yes yes yes - start_port - Start destination port number. type: int
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7start_port yes yes yes yes yes yes yes - status - Enable/disable SD-WAN service. type: str choices: enable, disable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7status yes yes yes yes yes yes yes [enable] yes yes yes yes yes yes yes [disable] yes yes yes yes yes yes yes - tos - Type of service bit pattern. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7tos yes yes yes yes yes yes yes - tos_mask - Type of service evaluated bits. type: str
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7tos_mask yes yes yes yes yes yes yes - users - User name. type: list member_path: service:id/users:name
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7users yes yes yes yes yes yes yes - name - User name. Source user.local.name. type: str required: true
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7name yes yes yes yes yes yes yes - status - Enable/disable SD-WAN. type: str choices: disable, enable
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7status yes yes yes yes yes yes yes [disable] yes yes yes yes yes yes yes [enable] yes yes yes yes yes yes yes - zone - Configure SD-WAN zones. type: list member_path: zone:name
more...
v6.0.0v6.0.5v6.0.11v6.2.0v6.2.3v6.2.5v6.2.7zone no no no yes no yes yes - name - Zone name. type: str required: true
more...
v6.2.0v6.2.5v6.2.7name yes yes yes
Note
- Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks
- hosts: fortigates
collections:
- fortinet.fortios
connection: httpapi
vars:
vdom: "root"
ansible_httpapi_use_ssl: yes
ansible_httpapi_validate_certs: no
ansible_httpapi_port: 443
tasks:
- name: Configure redundant internet connections using SD-WAN (formerly virtual WAN link).
fortios_system_virtual_wan_link:
vdom: "{{ vdom }}"
system_virtual_wan_link:
fail_alert_interfaces:
-
name: "default_name_4 (source system.interface.name)"
fail_detect: "enable"
health_check:
-
addr_mode: "ipv4"
diffservcode: "<your_own_value>"
failtime: "1800"
ha_priority: "25"
http_agent: "<your_own_value>"
http_get: "<your_own_value>"
http_match: "<your_own_value>"
interval: "1800000"
members:
-
seq_num: "2147483647"
name: "default_name_17"
packet_size: "512"
password: "<your_own_value>"
port: "32767"
probe_packets: "disable"
probe_timeout: "2500"
protocol: "ping"
recoverytime: "1800"
security_mode: "none"
server: "192.168.100.40"
sla:
-
id: "28"
jitter_threshold: "5000000"
latency_threshold: "5000000"
link_cost_factor: "latency"
packetloss_threshold: "50"
sla_fail_log_period: "1800"
sla_pass_log_period: "1800"
threshold_alert_jitter: "2147483647"
threshold_alert_latency: "2147483647"
threshold_alert_packetloss: "50"
threshold_warning_jitter: "2147483647"
threshold_warning_latency: "2147483647"
threshold_warning_packetloss: "50"
update_cascade_interface: "enable"
update_static_route: "enable"
load_balance_mode: "source-ip-based"
members:
-
comment: "Comments."
cost: "2147483647"
gateway: "<your_own_value>"
gateway6: "<your_own_value>"
ingress_spillover_threshold: "8388000"
interface: "<your_own_value> (source system.interface.name)"
priority: "2147483647"
seq_num: "127"
source: "<your_own_value>"
source6: "<your_own_value>"
spillover_threshold: "8388000"
status: "disable"
volume_ratio: "127"
weight: "127"
neighbor:
-
health_check: "<your_own_value> (source system.virtual-wan-link.health-check.name)"
ip: "<your_own_value> (source router.bgp.neighbor.ip)"
member: "2147483647"
role: "standalone"
sla_id: "2147483647"
neighbor_hold_boot_time: "5000000"
neighbor_hold_down: "enable"
neighbor_hold_down_time: "5000000"
service:
-
addr_mode: "ipv4"
bandwidth_weight: "5000000"
default: "enable"
dscp_forward: "enable"
dscp_forward_tag: "<your_own_value>"
dscp_reverse: "enable"
dscp_reverse_tag: "<your_own_value>"
dst:
-
name: "default_name_77 (source firewall.address.name firewall.addrgrp.name)"
dst_negate: "enable"
dst6:
-
name: "default_name_80 (source firewall.address6.name firewall.addrgrp6.name)"
end_port: "32767"
gateway: "enable"
groups:
-
name: "default_name_84 (source user.group.name)"
health_check: "<your_own_value> (source system.virtual-wan-link.health-check.name)"
hold_down_time: "5000000"
id: "87"
input_device:
-
name: "default_name_89 (source system.interface.name)"
input_device_negate: "enable"
internet_service: "enable"
internet_service_app_ctrl:
-
id: "93"
internet_service_app_ctrl_group:
-
name: "default_name_95 (source application.group.name)"
internet_service_ctrl:
-
id: "97"
internet_service_ctrl_group:
-
name: "default_name_99 (source application.group.name)"
internet_service_custom:
-
name: "default_name_101 (source firewall.internet-service-custom.name)"
internet_service_custom_group:
-
name: "default_name_103 (source firewall.internet-service-custom-group.name)"
internet_service_group:
-
name: "default_name_105 (source firewall.internet-service-group.name)"
internet_service_id:
-
id: "107 (source firewall.internet-service.id)"
jitter_weight: "5000000"
latency_weight: "5000000"
link_cost_factor: "latency"
link_cost_threshold: "5000000"
member: "2147483647"
mode: "auto"
name: "default_name_114"
packet_loss_weight: "5000000"
priority_members:
-
seq_num: "2147483647"
protocol: "127"
quality_link: "127"
role: "standalone"
route_tag: "2147483647"
sla:
-
health_check: "<your_own_value> (source system.virtual-wan-link.health-check.name)"
id: "124"
sla_compare_method: "order"
src:
-
name: "default_name_127 (source firewall.address.name firewall.addrgrp.name)"
src_negate: "enable"
src6:
-
name: "default_name_130 (source firewall.address6.name firewall.addrgrp6.name)"
standalone_action: "enable"
start_port: "32767"
status: "enable"
tos: "<your_own_value>"
tos_mask: "<your_own_value>"
users:
-
name: "default_name_137 (source user.local.name)"
status: "disable"
zone:
-
name: "default_name_140"
Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:
- build - Build number of the fortigate image returned: always type: str sample: 1547
- http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
- http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
- mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
- name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
- path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
- revision - Internal revision number returned: always type: str sample: 17.0.2.10658
- serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
- status - Indication of the operation's result returned: always type: str sample: success
- vdom - Virtual domain used returned: always type: str sample: root
- version - Version of the FortiGate returned: always type: str sample: v5.6.3
- This module is not guaranteed to have a backwards compatible interface.
- Link Zheng (@chillancezen)
- Jie Xue (@JieX19)
- Hongbin Lu (@fgtdev-hblu)
- Frank Shen (@frankshen01)
- Miguel Angel Munoz (@mamunozgonzalez)
- Nicolas Thomas (@thomnico)
Hint
If you notice any issues in this documentation, you can create a pull request to improve it.