| source: | fortios_system_sdwan.py |
|---|---|
| orphan: |
fortios_system_sdwan -- Configure redundant Internet connections with multiple outbound links and health-check profiles in Fortinet's FortiOS and FortiGate.
.. versionadded:: 2.0.0
- This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify system feature and sdwan category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0
The below requirements are needed on the host that executes this module.
- ansible>=2.14
Using member operation to add an element to an existing object.
| Supported Version Ranges | |
| fortios_system_sdwan | v6.4.0 -> latest |
- access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: false
- enable_log - Enable/Disable logging for task. type: bool required: false default: False
- vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
- member_path - Member attribute path to operate on. type: str
- member_state - Add or delete a member under specified attribute path. type: str choices: present, absent
- system_sdwan - Configure redundant Internet connections with multiple outbound links and health-check profiles. type: dict
more...
Supported Version Ranges system_sdwan v6.4.0 -> latest - app_perf_log_period - Time interval in seconds that application performance logs are generated (0 - 3600). type: int
more...
Supported Version Ranges app_perf_log_period v7.4.0 -> latest - duplication - Create SD-WAN duplication rule. type: list member_path: duplication:id
more...
Supported Version Ranges duplication v6.4.0 -> v6.4.0v6.4.4 -> latest - dstaddr - Destination address or address group names. type: list member_path: duplication:id/dstaddr:name
more...
Supported Version Ranges dstaddr v6.4.0 -> v6.4.0v6.4.4 -> latest - name - Address or address group name. Source firewall.address.name firewall.addrgrp.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> v6.4.0v6.4.4 -> latest - dstaddr6 - Destination address6 or address6 group names. type: list member_path: duplication:id/dstaddr6:name
more...
Supported Version Ranges dstaddr6 v6.4.0 -> v6.4.0v6.4.4 -> latest - name - Address6 or address6 group name. Source firewall.address6.name firewall.addrgrp6.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> v6.4.0v6.4.4 -> latest - dstintf - Outgoing (egress) interfaces or zones. type: list member_path: duplication:id/dstintf:name
more...
Supported Version Ranges dstintf v6.4.0 -> v6.4.0v6.4.4 -> latest - name - Interface, zone or SDWAN zone name. Source system.interface.name system.zone.name system.sdwan.zone.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> v6.4.0v6.4.4 -> latest - id - Duplication rule ID (1 - 255). see Notes. type: int required: true
more...
Supported Version Ranges id v6.4.0 -> v6.4.0v6.4.4 -> latest - packet_de_duplication - Enable/disable discarding of packets that have been duplicated. type: str choices: enable, disable
more...
Supported Version Ranges packet_de_duplication v6.4.0 -> v6.4.0v6.4.4 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - packet_duplication - Configure packet duplication method. type: str choices: disable, force, on-demand
more...
Supported Version Ranges packet_duplication v6.4.0 -> v6.4.0v6.4.4 -> latest[disable] v6.0.0 -> latest[force] v6.0.0 -> latest[on-demand] v6.0.0 -> latest - service - Service and service group name. type: list member_path: duplication:id/service:name
more...
Supported Version Ranges service v6.4.0 -> v6.4.0v6.4.4 -> latest - name - Service and service group name. Source firewall.service.custom.name firewall.service.group.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> v6.4.0v6.4.4 -> latest - service_id - SD-WAN service rule ID list. type: list member_path: duplication:id/service_id:id
more...
Supported Version Ranges service_id v6.4.4 -> latest - id - SD-WAN service rule ID. see Notes. Source system.sdwan.service.id. type: int required: true
more...
Supported Version Ranges id v6.4.4 -> latest - sla_match_service - Enable/disable packet duplication matching health-check SLAs in service rule. type: str choices: enable, disable
more...
Supported Version Ranges sla_match_service v7.2.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - srcaddr - Source address or address group names. type: list member_path: duplication:id/srcaddr:name
more...
Supported Version Ranges srcaddr v6.4.0 -> v6.4.0v6.4.4 -> latest - name - Address or address group name. Source firewall.address.name firewall.addrgrp.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> v6.4.0v6.4.4 -> latest - srcaddr6 - Source address6 or address6 group names. type: list member_path: duplication:id/srcaddr6:name
more...
Supported Version Ranges srcaddr6 v6.4.0 -> v6.4.0v6.4.4 -> latest - name - Address6 or address6 group name. Source firewall.address6.name firewall.addrgrp6.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> v6.4.0v6.4.4 -> latest - srcintf - Incoming (ingress) interfaces or zones. type: list member_path: duplication:id/srcintf:name
more...
Supported Version Ranges srcintf v6.4.0 -> v6.4.0v6.4.4 -> latest - name - Interface, zone or SDWAN zone name. Source system.interface.name system.zone.name system.sdwan.zone.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> v6.4.0v6.4.4 -> latest - duplication_max_num - Maximum number of interface members a packet is duplicated in the SD-WAN zone (2 - 4). type: int
more...
Supported Version Ranges duplication_max_num v6.4.0 -> v6.4.0v6.4.4 -> latest - fail_alert_interfaces - Physical interfaces that will be alerted. type: list member_path: fail_alert_interfaces:name
more...
Supported Version Ranges fail_alert_interfaces v6.4.0 -> latest - name - Physical interface name. Source system.interface.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - fail_detect - Enable/disable SD-WAN Internet connection status checking (failure detection). type: str choices: enable, disable
more...
Supported Version Ranges fail_detect v6.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - health_check - SD-WAN status checking or health checking. Identify a server on the Internet and determine how SD-WAN verifies that the FortiGate can communicate with it. type: list member_path: health_check:name
more...
Supported Version Ranges health_check v6.4.0 -> latest - addr_mode - Address mode (IPv4 or IPv6). type: str choices: ipv4, ipv6
more...
Supported Version Ranges addr_mode v6.4.0 -> latest[ipv4] v6.0.0 -> latest[ipv6] v6.0.0 -> latest - class_id - Traffic class ID. Source firewall.traffic-class.class-id. type: int
more...
Supported Version Ranges class_id v7.4.0 -> latest - detect_mode - The mode determining how to detect the server. type: str choices: active, passive, prefer-passive, remote, agent-based
more...
Supported Version Ranges detect_mode v7.0.0 -> latest[active] v6.0.0 -> latest[passive] v6.0.0 -> latest[prefer-passive] v6.0.0 -> latest[remote] v7.2.1 -> latest[agent-based] v7.2.4 -> latest - diffservcode - Differentiated services code point (DSCP) in the IP header of the probe packet. type: str
more...
Supported Version Ranges diffservcode v6.4.0 -> latest - dns_match_ip - Response IP expected from DNS server if the protocol is DNS. type: str
more...
Supported Version Ranges dns_match_ip v6.4.0 -> v6.4.0v6.4.4 -> latest - dns_request_domain - Fully qualified domain name to resolve for the DNS probe. type: str
more...
Supported Version Ranges dns_request_domain v6.4.0 -> latest - embed_measured_health - Enable/disable embedding measured health information. type: str choices: enable, disable
more...
Supported Version Ranges embed_measured_health v7.2.1 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - failtime - Number of failures before server is considered lost (1 - 3600). type: int
more...
Supported Version Ranges failtime v6.4.0 -> latest - ftp_file - Full path and file name on the FTP server to download for FTP health-check to probe. type: str
more...
Supported Version Ranges ftp_file v6.4.0 -> v6.4.0v6.4.4 -> latest - ftp_mode - FTP mode. type: str choices: passive, port
more...
Supported Version Ranges ftp_mode v6.4.0 -> v6.4.0v6.4.4 -> latest[passive] v6.0.0 -> latest[port] v6.0.0 -> latest - ha_priority - HA election priority (1 - 50). type: int
more...
Supported Version Ranges ha_priority v6.4.0 -> latest - http_agent - String in the http-agent field in the HTTP header. type: str
more...
Supported Version Ranges http_agent v6.4.0 -> latest - http_get - URL used to communicate with the server if the protocol if the protocol is HTTP. type: str
more...
Supported Version Ranges http_get v6.4.0 -> latest - http_match - Response string expected from the server if the protocol is HTTP. type: str
more...
Supported Version Ranges http_match v6.4.0 -> latest - interval - Status check interval in milliseconds, or the time between attempting to connect to the server (20 - 3600*1000 msec). type: int
more...
Supported Version Ranges interval v6.4.0 -> latest - members - Member sequence number list. type: list member_path: health_check:name/members:seq_num
more...
Supported Version Ranges members v6.4.0 -> latest - seq_num - Member sequence number. see Notes. Source system.sdwan.members.seq-num. type: int required: true
more...
Supported Version Ranges seq_num v6.4.0 -> latest - mos_codec - Codec to use for MOS calculation . type: str choices: g711, g722, g729
more...
Supported Version Ranges mos_codec v7.2.0 -> latest[g711] v6.0.0 -> latest[g722] v6.0.0 -> latest[g729] v6.0.0 -> latest - name - Status check or health check name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - packet_size - Packet size of a TWAMP test session. (124/158 - 1024) type: int
more...
Supported Version Ranges packet_size v6.4.0 -> latest - password - TWAMP controller password in authentication mode. type: str
more...
Supported Version Ranges password v6.4.0 -> latest - port - Port number used to communicate with the server over the selected protocol (0 - 65535). type: int
more...
Supported Version Ranges port v6.4.0 -> latest - probe_count - Number of most recent probes that should be used to calculate latency and jitter (5 - 30). type: int
more...
Supported Version Ranges probe_count v6.4.0 -> latest - probe_packets - Enable/disable transmission of probe packets. type: str choices: disable, enable
more...
Supported Version Ranges probe_packets v6.4.0 -> latest[disable] v6.0.0 -> latest[enable] v6.0.0 -> latest - probe_timeout - Time to wait before a probe packet is considered lost (20 - 3600*1000 msec). type: int
more...
Supported Version Ranges probe_timeout v6.4.0 -> latest - protocol - Protocol used to determine if the FortiGate can communicate with the server. type: str choices: ping, tcp-echo, udp-echo, http, https, twamp, dns, tcp-connect, ftp, ping6
more...
Supported Version Ranges protocol v6.4.0 -> latest[ping] v6.0.0 -> latest[tcp-echo] v6.0.0 -> latest[udp-echo] v6.0.0 -> latest[http] v6.0.0 -> latest[https] v7.4.1 -> latest[twamp] v6.0.0 -> latest[dns] v6.0.0 -> latest[tcp-connect] v6.4.0 -> v6.4.0v6.4.4 -> latest[ftp] v6.4.0 -> v6.4.0v6.4.4 -> latest[ping6] v6.4.1 -> v6.4.1 - quality_measured_method - Method to measure the quality of tcp-connect. type: str choices: half-open, half-close
more...
Supported Version Ranges quality_measured_method v6.4.0 -> v6.4.0v6.4.4 -> latest[half-open] v6.0.0 -> latest[half-close] v6.0.0 -> latest - recoverytime - Number of successful responses received before server is considered recovered (1 - 3600). type: int
more...
Supported Version Ranges recoverytime v6.4.0 -> latest - security_mode - Twamp controller security mode. type: str choices: none, authentication
more...
Supported Version Ranges security_mode v6.4.0 -> latest[none] v6.0.0 -> latest[authentication] v6.0.0 -> latest - server - IP address or FQDN name of the server. type: list
- sla - Service level agreement (SLA). type: list member_path: health_check:name/sla:id
more...
Supported Version Ranges sla v6.4.0 -> latest - id - SLA ID. see Notes. type: int required: true
more...
Supported Version Ranges id v6.4.0 -> latest - jitter_threshold - Jitter for SLA to make decision in milliseconds. (0 - 10000000). type: int
more...
Supported Version Ranges jitter_threshold v6.4.0 -> latest - latency_threshold - Latency for SLA to make decision in milliseconds. (0 - 10000000). type: int
more...
Supported Version Ranges latency_threshold v6.4.0 -> latest - link_cost_factor - Criteria on which to base link selection. type: list choices: latency, jitter, packet-loss, mos
more...
Supported Version Ranges link_cost_factor v6.4.0 -> latest[latency] v6.0.0 -> latest[jitter] v6.0.0 -> latest[packet-loss] v6.0.0 -> latest[mos] v7.2.0 -> latest - mos_threshold - Minimum Mean Opinion Score for SLA to be marked as pass. (1.0 - 5.0). type: str
more...
Supported Version Ranges mos_threshold v7.2.0 -> latest - packetloss_threshold - Packet loss for SLA to make decision in percentage. (0 - 100). type: int
more...
Supported Version Ranges packetloss_threshold v6.4.0 -> latest - priority_in_sla - Value to be distributed into routing table when in-sla (0 - 65535). type: int
more...
Supported Version Ranges priority_in_sla v7.2.1 -> latest - priority_out_sla - Value to be distributed into routing table when out-sla (0 - 65535). type: int
more...
Supported Version Ranges priority_out_sla v7.2.1 -> latest - sla_fail_log_period - Time interval in seconds that SLA fail log messages will be generated (0 - 3600). type: int
more...
Supported Version Ranges sla_fail_log_period v6.4.0 -> latest - sla_id_redistribute - Select the ID from the SLA sub-table. The selected SLA"s priority value will be distributed into the routing table (0 - 32). type: int
more...
Supported Version Ranges sla_id_redistribute v7.2.1 -> latest - sla_pass_log_period - Time interval in seconds that SLA pass log messages will be generated (0 - 3600). type: int
more...
Supported Version Ranges sla_pass_log_period v6.4.0 -> latest - source - Source IP address used in the health-check packet to the server. type: str
more...
Supported Version Ranges source v7.2.0 -> latest - source6 - Source IPv6 address used in the health-check packet to server. type: str
more...
Supported Version Ranges source6 v7.4.0 -> latest - system_dns - Enable/disable system DNS as the probe server. type: str choices: disable, enable
more...
Supported Version Ranges system_dns v6.4.0 -> latest[disable] v6.0.0 -> latest[enable] v6.0.0 -> latest - threshold_alert_jitter - Alert threshold for jitter (ms). type: int
more...
Supported Version Ranges threshold_alert_jitter v6.4.0 -> latest - threshold_alert_latency - Alert threshold for latency (ms). type: int
more...
Supported Version Ranges threshold_alert_latency v6.4.0 -> latest - threshold_alert_packetloss - Alert threshold for packet loss (percentage). type: int
more...
Supported Version Ranges threshold_alert_packetloss v6.4.0 -> latest - threshold_warning_jitter - Warning threshold for jitter (ms). type: int
more...
Supported Version Ranges threshold_warning_jitter v6.4.0 -> latest - threshold_warning_latency - Warning threshold for latency (ms). type: int
more...
Supported Version Ranges threshold_warning_latency v6.4.0 -> latest - threshold_warning_packetloss - Warning threshold for packet loss (percentage). type: int
more...
Supported Version Ranges threshold_warning_packetloss v6.4.0 -> latest - update_cascade_interface - Enable/disable update cascade interface. type: str choices: enable, disable
more...
Supported Version Ranges update_cascade_interface v6.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - update_static_route - Enable/disable updating the static route. type: str choices: enable, disable
more...
Supported Version Ranges update_static_route v6.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - user - The user name to access probe server. type: str
more...
Supported Version Ranges user v6.4.0 -> v6.4.0v6.4.4 -> latest - vrf - Virtual Routing Forwarding ID. type: int
more...
Supported Version Ranges vrf v7.2.0 -> latest - load_balance_mode - Algorithm or mode to use for load balancing Internet traffic to SD-WAN members. type: str choices: source-ip-based, weight-based, usage-based, source-dest-ip-based, measured-volume-based
more...
Supported Version Ranges load_balance_mode v6.4.0 -> latest[source-ip-based] v6.0.0 -> latest[weight-based] v6.0.0 -> latest[usage-based] v6.0.0 -> latest[source-dest-ip-based] v6.0.0 -> latest[measured-volume-based] v6.0.0 -> latest - members - FortiGate interfaces added to the SD-WAN. type: list member_path: members:seq_num
more...
Supported Version Ranges members v6.4.0 -> latest - comment - Comments. type: str
more...
Supported Version Ranges comment v6.4.0 -> latest - cost - Cost of this interface for services in SLA mode (0 - 4294967295). type: int
more...
Supported Version Ranges cost v6.4.0 -> latest - gateway - The default gateway for this interface. Usually the default gateway of the Internet service provider that this interface is connected to. type: str
more...
Supported Version Ranges gateway v6.4.0 -> latest - gateway6 - IPv6 gateway. type: str
more...
Supported Version Ranges gateway6 v6.4.0 -> latest - ingress_spillover_threshold - Ingress spillover threshold for this interface (0 - 16776000 kbit/s). When this traffic volume threshold is reached, new sessions spill over to other interfaces in the SD-WAN. type: int
more...
Supported Version Ranges ingress_spillover_threshold v6.4.0 -> latest - interface - Interface name. Source system.interface.name. type: str
more...
Supported Version Ranges interface v6.4.0 -> latest - preferred_source - Preferred source of route for this member. type: str
more...
Supported Version Ranges preferred_source v7.4.0 -> latest - priority - Priority of the interface for IPv4 (1 - 65535). Used for SD-WAN rules or priority rules. type: int
more...
Supported Version Ranges priority v6.4.0 -> latest - priority6 - Priority of the interface for IPv6 (1 - 65535). Used for SD-WAN rules or priority rules. type: int
more...
Supported Version Ranges priority6 v7.0.0 -> latest - seq_num - Sequence number(1-512). see Notes. type: int required: true
more...
Supported Version Ranges seq_num v6.4.0 -> latest - source - Source IP address used in the health-check packet to the server. type: str
more...
Supported Version Ranges source v6.4.0 -> latest - source6 - Source IPv6 address used in the health-check packet to the server. type: str
more...
Supported Version Ranges source6 v6.4.0 -> latest - spillover_threshold - Egress spillover threshold for this interface (0 - 16776000 kbit/s). When this traffic volume threshold is reached, new sessions spill over to other interfaces in the SD-WAN. type: int
more...
Supported Version Ranges spillover_threshold v6.4.0 -> latest - status - Enable/disable this interface in the SD-WAN. type: str choices: disable, enable
more...
Supported Version Ranges status v6.4.0 -> latest[disable] v6.0.0 -> latest[enable] v6.0.0 -> latest - volume_ratio - Measured volume ratio (this value / sum of all values = percentage of link volume, 1 - 255). type: int
more...
Supported Version Ranges volume_ratio v6.4.0 -> latest - weight - Weight of this interface for weighted load balancing. (1 - 255) More traffic is directed to interfaces with higher weights. type: int
more...
Supported Version Ranges weight v6.4.0 -> latest - zone - Zone name. Source system.sdwan.zone.name. type: str
more...
Supported Version Ranges zone v6.4.0 -> latest - neighbor - Create SD-WAN neighbor from BGP neighbor table to control route advertisements according to SLA status. type: list member_path: neighbor:ip
more...
Supported Version Ranges neighbor v6.4.0 -> latest - health_check - SD-WAN health-check name. Source system.sdwan.health-check.name. type: str
more...
Supported Version Ranges health_check v6.4.0 -> latest - ip - IP/IPv6 address of neighbor or neighbor-group name. Source router.bgp.neighbor-group.name router.bgp.neighbor.ip. type: str required: true
more...
Supported Version Ranges ip v6.4.0 -> latest - member - Member sequence number list. Source system.sdwan.members.seq-num. type: list member_path: neighbor:ip/member:seq_num
more...
Supported Version Ranges member v6.4.0 -> latest - seq_num - Member sequence number. see Notes. Source system.sdwan.members.seq-num. type: int required: true
more...
Supported Version Ranges seq_num v7.2.0 -> latest - minimum_sla_meet_members - Minimum number of members which meet SLA when the neighbor is preferred. type: int
more...
Supported Version Ranges minimum_sla_meet_members v7.2.0 -> latest - mode - What metric to select the neighbor. type: str choices: sla, speedtest
more...
Supported Version Ranges mode v7.0.1 -> latest[sla] v6.0.0 -> latest[speedtest] v6.0.0 -> latest - role - Role of neighbor. type: str choices: standalone, primary, secondary
more...
Supported Version Ranges role v6.4.0 -> latest[standalone] v6.0.0 -> latest[primary] v6.0.0 -> latest[secondary] v6.0.0 -> latest - service_id - SD-WAN service ID to work with the neighbor. Source system.sdwan.service.id. type: int
more...
Supported Version Ranges service_id v7.4.1 -> latest - sla_id - SLA ID. type: int
more...
Supported Version Ranges sla_id v6.4.0 -> latest - neighbor_hold_boot_time - Waiting period in seconds when switching from the primary neighbor to the secondary neighbor from the neighbor start. (0 - 10000000). type: int
more...
Supported Version Ranges neighbor_hold_boot_time v6.4.0 -> latest - neighbor_hold_down - Enable/disable hold switching from the secondary neighbor to the primary neighbor. type: str choices: enable, disable
more...
Supported Version Ranges neighbor_hold_down v6.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - neighbor_hold_down_time - Waiting period in seconds when switching from the secondary neighbor to the primary neighbor when hold-down is disabled. (0 - 10000000). type: int
more...
Supported Version Ranges neighbor_hold_down_time v6.4.0 -> latest - service - Create SD-WAN rules (also called services) to control how sessions are distributed to interfaces in the SD-WAN. type: list member_path: service:id
more...
Supported Version Ranges service v6.4.0 -> latest - addr_mode - Address mode (IPv4 or IPv6). type: str choices: ipv4, ipv6
more...
Supported Version Ranges addr_mode v6.4.0 -> latest[ipv4] v6.0.0 -> latest[ipv6] v6.0.0 -> latest - agent_exclusive - Set/unset the service as agent use exclusively. type: str choices: enable, disable
more...
Supported Version Ranges agent_exclusive v7.2.4 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - bandwidth_weight - Coefficient of reciprocal of available bidirectional bandwidth in the formula of custom-profile-1. type: int
more...
Supported Version Ranges bandwidth_weight v6.4.0 -> latest - default - Enable/disable use of SD-WAN as default service. type: str choices: enable, disable
more...
Supported Version Ranges default v6.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - dscp_forward - Enable/disable forward traffic DSCP tag. type: str choices: enable, disable
more...
Supported Version Ranges dscp_forward v6.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - dscp_forward_tag - Forward traffic DSCP tag. type: str
more...
Supported Version Ranges dscp_forward_tag v6.4.0 -> latest - dscp_reverse - Enable/disable reverse traffic DSCP tag. type: str choices: enable, disable
more...
Supported Version Ranges dscp_reverse v6.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - dscp_reverse_tag - Reverse traffic DSCP tag. type: str
more...
Supported Version Ranges dscp_reverse_tag v6.4.0 -> latest - dst - Destination address name. type: list member_path: service:id/dst:name
more...
Supported Version Ranges dst v6.4.0 -> latest - name - Address or address group name. Source firewall.address.name firewall.addrgrp.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - dst_negate - Enable/disable negation of destination address match. type: str choices: enable, disable
more...
Supported Version Ranges dst_negate v6.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - dst6 - Destination address6 name. type: list member_path: service:id/dst6:name
more...
Supported Version Ranges dst6 v6.4.0 -> latest - name - Address6 or address6 group name. Source firewall.address6.name firewall.addrgrp6.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - end_port - End destination port number. type: int
more...
Supported Version Ranges end_port v6.4.0 -> latest - end_src_port - End source port number. type: int
more...
Supported Version Ranges end_src_port v7.4.1 -> latest - gateway - Enable/disable SD-WAN service gateway. type: str choices: enable, disable
more...
Supported Version Ranges gateway v6.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - groups - User groups. type: list member_path: service:id/groups:name
more...
Supported Version Ranges groups v6.4.0 -> latest - name - Group name. Source user.group.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - hash_mode - Hash algorithm for selected priority members for load balance mode. type: str choices: round-robin, source-ip-based, source-dest-ip-based, inbandwidth, outbandwidth, bibandwidth
more...
Supported Version Ranges hash_mode v6.4.0 -> v6.4.0v6.4.4 -> latest[round-robin] v6.0.0 -> latest[source-ip-based] v6.0.0 -> latest[source-dest-ip-based] v6.0.0 -> latest[inbandwidth] v6.0.0 -> latest[outbandwidth] v6.0.0 -> latest[bibandwidth] v6.0.0 -> latest - health_check - Health check list. type: list member_path: service:id/health_check:name
more...
Supported Version Ranges health_check v6.4.0 -> latest - name - Health check name. Source system.sdwan.health-check.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - hold_down_time - Waiting period in seconds when switching from the back-up member to the primary member (0 - 10000000). type: int
more...
Supported Version Ranges hold_down_time v6.4.0 -> latest - id - SD-WAN rule ID (1 - 4000). see Notes. type: int required: true
more...
Supported Version Ranges id v6.4.0 -> latest - input_device - Source interface name. type: list member_path: service:id/input_device:name
more...
Supported Version Ranges input_device v6.4.0 -> latest - name - Interface name. Source system.interface.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - input_device_negate - Enable/disable negation of input device match. type: str choices: enable, disable
more...
Supported Version Ranges input_device_negate v6.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - input_zone - Source input-zone name. type: list member_path: service:id/input_zone:name
more...
Supported Version Ranges input_zone v7.2.0 -> latest - name - Zone. Source system.sdwan.zone.name. type: str required: true
more...
Supported Version Ranges name v7.2.0 -> latest - internet_service - Enable/disable use of Internet service for application-based load balancing. type: str choices: enable, disable
more...
Supported Version Ranges internet_service v6.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - internet_service_app_ctrl - Application control based Internet Service ID list. type: list member_path: service:id/internet_service_app_ctrl:id
more...
Supported Version Ranges internet_service_app_ctrl v6.4.0 -> latest - id - Application control based Internet Service ID. see Notes. type: int required: true
more...
Supported Version Ranges id v6.4.0 -> latest - internet_service_app_ctrl_category - IDs of one or more application control categories. type: list member_path: service:id/internet_service_app_ctrl_category:id
more...
Supported Version Ranges internet_service_app_ctrl_category v7.2.0 -> latest - id - Application control category ID. see Notes. type: int required: true
more...
Supported Version Ranges id v7.2.0 -> latest - internet_service_app_ctrl_group - Application control based Internet Service group list. type: list member_path: service:id/internet_service_app_ctrl_group:name
more...
Supported Version Ranges internet_service_app_ctrl_group v6.4.0 -> latest - name - Application control based Internet Service group name. Source application.group.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - internet_service_custom - Custom Internet service name list. type: list member_path: service:id/internet_service_custom:name
more...
Supported Version Ranges internet_service_custom v6.4.0 -> latest - name - Custom Internet service name. Source firewall.internet-service-custom.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - internet_service_custom_group - Custom Internet Service group list. type: list member_path: service:id/internet_service_custom_group:name
more...
Supported Version Ranges internet_service_custom_group v6.4.0 -> latest - name - Custom Internet Service group name. Source firewall.internet-service-custom-group.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - internet_service_group - Internet Service group list. type: list member_path: service:id/internet_service_group:name
more...
Supported Version Ranges internet_service_group v6.4.0 -> latest - name - Internet Service group name. Source firewall.internet-service-group.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - internet_service_name - Internet service name list. type: list member_path: service:id/internet_service_name:name
more...
Supported Version Ranges internet_service_name v6.4.0 -> latest - name - Internet service name. Source firewall.internet-service-name.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - jitter_weight - Coefficient of jitter in the formula of custom-profile-1. type: int
more...
Supported Version Ranges jitter_weight v6.4.0 -> latest - latency_weight - Coefficient of latency in the formula of custom-profile-1. type: int
more...
Supported Version Ranges latency_weight v6.4.0 -> latest - link_cost_factor - Link cost factor. type: str choices: latency, jitter, packet-loss, inbandwidth, outbandwidth, bibandwidth, custom-profile-1
more...
Supported Version Ranges link_cost_factor v6.4.0 -> latest[latency] v6.0.0 -> latest[jitter] v6.0.0 -> latest[packet-loss] v6.0.0 -> latest[inbandwidth] v6.0.0 -> latest[outbandwidth] v6.0.0 -> latest[bibandwidth] v6.0.0 -> latest[custom-profile-1] v6.0.0 -> latest - link_cost_threshold - Percentage threshold change of link cost values that will result in policy route regeneration (0 - 10000000). type: int
more...
Supported Version Ranges link_cost_threshold v6.4.0 -> latest - load_balance - Enable/disable load-balance. type: str choices: enable, disable
more...
Supported Version Ranges load_balance v7.4.1 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - minimum_sla_meet_members - Minimum number of members which meet SLA. type: int
more...
Supported Version Ranges minimum_sla_meet_members v6.4.0 -> v6.4.0v6.4.4 -> latest - mode - Control how the SD-WAN rule sets the priority of interfaces in the SD-WAN. type: str choices: auto, manual, priority, sla, load-balance
more...
Supported Version Ranges mode v6.4.0 -> latest[auto] v6.0.0 -> latest[manual] v6.0.0 -> latest[priority] v6.0.0 -> latest[sla] v6.0.0 -> latest[load-balance] v6.4.0 -> v7.4.0 - name - SD-WAN rule name. type: str
more...
Supported Version Ranges name v6.4.0 -> latest - packet_loss_weight - Coefficient of packet-loss in the formula of custom-profile-1. type: int
more...
Supported Version Ranges packet_loss_weight v6.4.0 -> latest - passive_measurement - Enable/disable passive measurement based on the service criteria. type: str choices: enable, disable
more...
Supported Version Ranges passive_measurement v7.0.2 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - priority_members - Member sequence number list. type: list member_path: service:id/priority_members:seq_num
more...
Supported Version Ranges priority_members v6.4.0 -> latest - seq_num - Member sequence number. see Notes. Source system.sdwan.members.seq-num. type: int required: true
more...
Supported Version Ranges seq_num v6.4.0 -> latest - priority_zone - Priority zone name list. type: list member_path: service:id/priority_zone:name
more...
Supported Version Ranges priority_zone v7.0.1 -> latest - name - Priority zone name. Source system.sdwan.zone.name. type: str required: true
more...
Supported Version Ranges name v7.0.1 -> latest - protocol - Protocol number. type: int
more...
Supported Version Ranges protocol v6.4.0 -> latest - quality_link - Quality grade. type: int
more...
Supported Version Ranges quality_link v6.4.0 -> latest - role - Service role to work with neighbor. type: str choices: standalone, primary, secondary
more...
Supported Version Ranges role v6.4.0 -> latest[standalone] v6.0.0 -> latest[primary] v6.0.0 -> latest[secondary] v6.0.0 -> latest - route_tag - IPv4 route map route-tag. type: int
more...
Supported Version Ranges route_tag v6.4.0 -> v7.2.4 - shortcut - Enable/disable shortcut for this service. type: str choices: enable, disable
more...
Supported Version Ranges shortcut v7.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - shortcut_stickiness - Enable/disable shortcut-stickiness of ADVPN. type: str choices: enable, disable
more...
Supported Version Ranges shortcut_stickiness v7.4.0 -> v7.4.0[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - sla - Service level agreement (SLA). type: list member_path: service:id/sla:health_check
more...
Supported Version Ranges sla v6.4.0 -> latest - health_check - SD-WAN health-check. Source system.sdwan.health-check.name. type: str required: true
more...
Supported Version Ranges health_check v6.4.0 -> latest - id - SLA ID. type: int
more...
Supported Version Ranges id v6.4.0 -> latest - sla_compare_method - Method to compare SLA value for SLA mode. type: str choices: order, number
more...
Supported Version Ranges sla_compare_method v6.4.0 -> latest[order] v6.0.0 -> latest[number] v6.0.0 -> latest - sla_stickiness - Enable/disable SLA stickiness . type: str choices: enable, disable
more...
Supported Version Ranges sla_stickiness v7.4.1 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - src - Source address name. type: list member_path: service:id/src:name
more...
Supported Version Ranges src v6.4.0 -> latest - name - Address or address group name. Source firewall.address.name firewall.addrgrp.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - src_negate - Enable/disable negation of source address match. type: str choices: enable, disable
more...
Supported Version Ranges src_negate v6.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - src6 - Source address6 name. type: list member_path: service:id/src6:name
more...
Supported Version Ranges src6 v6.4.0 -> latest - name - Address6 or address6 group name. Source firewall.address6.name firewall.addrgrp6.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - standalone_action - Enable/disable service when selected neighbor role is standalone while service role is not standalone. type: str choices: enable, disable
more...
Supported Version Ranges standalone_action v6.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - start_port - Start destination port number. type: int
more...
Supported Version Ranges start_port v6.4.0 -> latest - start_src_port - Start source port number. type: int
more...
Supported Version Ranges start_src_port v7.4.1 -> latest - status - Enable/disable SD-WAN service. type: str choices: enable, disable
more...
Supported Version Ranges status v6.4.0 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - tie_break - Method of selecting member if more than one meets the SLA. type: str choices: zone, cfg-order, fib-best-match, input-device
more...
Supported Version Ranges tie_break v6.4.4 -> latest[zone] v6.0.0 -> latest[cfg-order] v6.0.0 -> latest[fib-best-match] v6.0.0 -> latest[input-device] v7.2.0 -> latest - tos - Type of service bit pattern. type: str
more...
Supported Version Ranges tos v6.4.0 -> latest - tos_mask - Type of service evaluated bits. type: str
more...
Supported Version Ranges tos_mask v6.4.0 -> latest - use_shortcut_sla - Enable/disable use of ADVPN shortcut for quality comparison. type: str choices: enable, disable
more...
Supported Version Ranges use_shortcut_sla v6.4.4 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - users - User name. type: list member_path: service:id/users:name
more...
Supported Version Ranges users v6.4.0 -> latest - name - User name. Source user.local.name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - zone_mode - Enable/disable zone mode. type: str choices: enable, disable
more...
Supported Version Ranges zone_mode v7.4.1 -> latest[enable] v6.0.0 -> latest[disable] v6.0.0 -> latest - speedtest_bypass_routing - Enable/disable bypass routing when speedtest on a SD-WAN member. type: str choices: disable, enable
more...
Supported Version Ranges speedtest_bypass_routing v7.0.1 -> latest[disable] v6.0.0 -> latest[enable] v6.0.0 -> latest - status - Enable/disable SD-WAN. type: str choices: disable, enable
more...
Supported Version Ranges status v6.4.0 -> latest[disable] v6.0.0 -> latest[enable] v6.0.0 -> latest - zone - Configure SD-WAN zones. type: list member_path: zone:name
more...
Supported Version Ranges zone v6.4.0 -> latest - minimum_sla_meet_members - Minimum number of members which meet SLA when the neighbor is preferred. type: int
more...
Supported Version Ranges minimum_sla_meet_members v7.4.1 -> latest - name - Zone name. type: str required: true
more...
Supported Version Ranges name v6.4.0 -> latest - service_sla_tie_break - Method of selecting member if more than one meets the SLA. type: str choices: cfg-order, fib-best-match, input-device
more...
Supported Version Ranges service_sla_tie_break v6.4.4 -> latest[cfg-order] v6.0.0 -> latest[fib-best-match] v6.0.0 -> latest[input-device] v7.2.0 -> latest
Note
- Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks
- name: Configure redundant Internet connections with multiple outbound links and health-check profiles.
fortinet.fortios.fortios_system_sdwan:
vdom: "{{ vdom }}"
system_sdwan:
app_perf_log_period: "0"
duplication:
-
dstaddr:
-
name: "default_name_6 (source firewall.address.name firewall.addrgrp.name)"
dstaddr6:
-
name: "default_name_8 (source firewall.address6.name firewall.addrgrp6.name)"
dstintf:
-
name: "default_name_10 (source system.interface.name system.zone.name system.sdwan.zone.name)"
id: "11"
packet_de_duplication: "enable"
packet_duplication: "disable"
service:
-
name: "default_name_15 (source firewall.service.custom.name firewall.service.group.name)"
service_id:
-
id: "17 (source system.sdwan.service.id)"
sla_match_service: "enable"
srcaddr:
-
name: "default_name_20 (source firewall.address.name firewall.addrgrp.name)"
srcaddr6:
-
name: "default_name_22 (source firewall.address6.name firewall.addrgrp6.name)"
srcintf:
-
name: "default_name_24 (source system.interface.name system.zone.name system.sdwan.zone.name)"
duplication_max_num: "2"
fail_alert_interfaces:
-
name: "default_name_27 (source system.interface.name)"
fail_detect: "enable"
health_check:
-
addr_mode: "ipv4"
class_id: "0"
detect_mode: "active"
diffservcode: "<your_own_value>"
dns_match_ip: "<your_own_value>"
dns_request_domain: "<your_own_value>"
embed_measured_health: "enable"
failtime: "5"
ftp_file: "<your_own_value>"
ftp_mode: "passive"
ha_priority: "1"
http_agent: "<your_own_value>"
http_get: "<your_own_value>"
http_match: "<your_own_value>"
interval: "500"
members:
-
seq_num: "<you_own_value>"
mos_codec: "g711"
name: "default_name_48"
packet_size: "124"
password: "<your_own_value>"
port: "0"
probe_count: "30"
probe_packets: "disable"
probe_timeout: "500"
protocol: "ping"
quality_measured_method: "half-open"
recoverytime: "5"
security_mode: "none"
server: "192.168.100.40"
sla:
-
id: "61"
jitter_threshold: "5"
latency_threshold: "5"
link_cost_factor: "latency"
mos_threshold: "<your_own_value>"
packetloss_threshold: "0"
priority_in_sla: "0"
priority_out_sla: "0"
sla_fail_log_period: "0"
sla_id_redistribute: "0"
sla_pass_log_period: "0"
source: "<your_own_value>"
source6: "<your_own_value>"
system_dns: "disable"
threshold_alert_jitter: "0"
threshold_alert_latency: "0"
threshold_alert_packetloss: "0"
threshold_warning_jitter: "0"
threshold_warning_latency: "0"
threshold_warning_packetloss: "0"
update_cascade_interface: "enable"
update_static_route: "enable"
user: "<your_own_value>"
vrf: "0"
load_balance_mode: "source-ip-based"
members:
-
comment: "Comments."
cost: "0"
gateway: "<your_own_value>"
gateway6: "<your_own_value>"
ingress_spillover_threshold: "0"
interface: "<your_own_value> (source system.interface.name)"
preferred_source: "<your_own_value>"
priority: "1"
priority6: "1024"
seq_num: "<you_own_value>"
source: "<your_own_value>"
source6: "<your_own_value>"
spillover_threshold: "0"
status: "disable"
volume_ratio: "1"
weight: "1"
zone: "<your_own_value> (source system.sdwan.zone.name)"
neighbor:
-
health_check: "<your_own_value> (source system.sdwan.health-check.name)"
ip: "<your_own_value> (source router.bgp.neighbor-group.name router.bgp.neighbor.ip)"
member:
-
seq_num: "<you_own_value>"
minimum_sla_meet_members: "1"
mode: "sla"
role: "standalone"
service_id: "0"
sla_id: "0"
neighbor_hold_boot_time: "0"
neighbor_hold_down: "enable"
neighbor_hold_down_time: "0"
service:
-
addr_mode: "ipv4"
agent_exclusive: "enable"
bandwidth_weight: "0"
default: "enable"
dscp_forward: "enable"
dscp_forward_tag: "<your_own_value>"
dscp_reverse: "enable"
dscp_reverse_tag: "<your_own_value>"
dst:
-
name: "default_name_127 (source firewall.address.name firewall.addrgrp.name)"
dst_negate: "enable"
dst6:
-
name: "default_name_130 (source firewall.address6.name firewall.addrgrp6.name)"
end_port: "65535"
end_src_port: "65535"
gateway: "enable"
groups:
-
name: "default_name_135 (source user.group.name)"
hash_mode: "round-robin"
health_check:
-
name: "default_name_138 (source system.sdwan.health-check.name)"
hold_down_time: "0"
id: "140"
input_device:
-
name: "default_name_142 (source system.interface.name)"
input_device_negate: "enable"
input_zone:
-
name: "default_name_145 (source system.sdwan.zone.name)"
internet_service: "enable"
internet_service_app_ctrl:
-
id: "148"
internet_service_app_ctrl_category:
-
id: "150"
internet_service_app_ctrl_group:
-
name: "default_name_152 (source application.group.name)"
internet_service_custom:
-
name: "default_name_154 (source firewall.internet-service-custom.name)"
internet_service_custom_group:
-
name: "default_name_156 (source firewall.internet-service-custom-group.name)"
internet_service_group:
-
name: "default_name_158 (source firewall.internet-service-group.name)"
internet_service_name:
-
name: "default_name_160 (source firewall.internet-service-name.name)"
jitter_weight: "0"
latency_weight: "0"
link_cost_factor: "latency"
link_cost_threshold: "10"
load_balance: "enable"
minimum_sla_meet_members: "0"
mode: "auto"
name: "default_name_168"
packet_loss_weight: "0"
passive_measurement: "enable"
priority_members:
-
seq_num: "<you_own_value>"
priority_zone:
-
name: "default_name_174 (source system.sdwan.zone.name)"
protocol: "0"
quality_link: "0"
role: "standalone"
route_tag: "0"
shortcut: "enable"
shortcut_stickiness: "enable"
sla:
-
health_check: "<your_own_value> (source system.sdwan.health-check.name)"
id: "183"
sla_compare_method: "order"
sla_stickiness: "enable"
src:
-
name: "default_name_187 (source firewall.address.name firewall.addrgrp.name)"
src_negate: "enable"
src6:
-
name: "default_name_190 (source firewall.address6.name firewall.addrgrp6.name)"
standalone_action: "enable"
start_port: "1"
start_src_port: "1"
status: "enable"
tie_break: "zone"
tos: "<your_own_value>"
tos_mask: "<your_own_value>"
use_shortcut_sla: "enable"
users:
-
name: "default_name_200 (source user.local.name)"
zone_mode: "enable"
speedtest_bypass_routing: "disable"
status: "disable"
zone:
-
minimum_sla_meet_members: "1"
name: "default_name_206"
service_sla_tie_break: "cfg-order"
Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:
- build - Build number of the fortigate image returned: always type: str sample: 1547
- http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
- http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
- mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
- name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
- path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
- revision - Internal revision number returned: always type: str sample: 17.0.2.10658
- serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
- status - Indication of the operation's result returned: always type: str sample: success
- vdom - Virtual domain used returned: always type: str sample: root
- version - Version of the FortiGate returned: always type: str sample: v5.6.3
- This module is not guaranteed to have a backwards compatible interface.
- Link Zheng (@chillancezen)
- Jie Xue (@JieX19)
- Hongbin Lu (@fgtdev-hblu)
- Frank Shen (@frankshen01)
- Miguel Angel Munoz (@mamunozgonzalez)
- Nicolas Thomas (@thomnico)
Hint
If you notice any issues in this documentation, you can create a pull request to improve it.