fortios_vpn_ipsec_phase2_interface.rst

source:	fortios_vpn_ipsec_phase2_interface.py
orphan:

fortios_vpn_ipsec_phase2_interface -- Configure VPN autokey tunnel in Fortinet's FortiOS and FortiGate.

.. versionadded:: 2.0.0

• Synopsis
• Requirements
• Tips
• FortiOS Version Compatibility
• Parameters
• Notes
• Examples
• Return Values
• Status
• Authors

Synopsis

• This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify vpn_ipsec feature and phase2_interface category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0

Requirements

The below requirements are needed on the host that executes this module.

• ansible>=2.14

Tips

Using member operation to add an element to an existing object.

FortiOS Version Compatibility

	Supported Version Ranges
fortios_vpn_ipsec_phase2_interface	v6.0.0 -> latest

Parameters

• access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: false
• enable_log - Enable/Disable logging for task. type: bool required: false default: False
• vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
• member_path - Member attribute path to operate on. type: str
• member_state - Add or delete a member under specified attribute path. type: str choices: present, absent
• state - Indicates whether to create or remove the object. type: str required: true choices: present, absent
• vpn_ipsec_phase2_interface - Configure VPN autokey tunnel. type: dict more...

  	Supported Version Ranges
  vpn_ipsec_phase2_interface	v6.0.0 -> latest

• add_route - Enable/disable automatic route addition. type: str choices: phase1, enable, disable more...

  	Supported Version Ranges
  add_route	v6.0.0 -> latest
  [phase1]	v6.0.0 -> latest
  [enable]	v6.0.0 -> latest
  [disable]	v6.0.0 -> latest

• auto_discovery_forwarder - Enable/disable forwarding short-cut messages. type: str choices: phase1, enable, disable more...

  	Supported Version Ranges
  auto_discovery_forwarder	v6.0.0 -> latest
  [phase1]	v6.0.0 -> latest
  [enable]	v6.0.0 -> latest
  [disable]	v6.0.0 -> latest

• auto_discovery_sender - Enable/disable sending short-cut messages. type: str choices: phase1, enable, disable more...

  	Supported Version Ranges
  auto_discovery_sender	v6.0.0 -> latest
  [phase1]	v6.0.0 -> latest
  [enable]	v6.0.0 -> latest
  [disable]	v6.0.0 -> latest

• auto_negotiate - Enable/disable IPsec SA auto-negotiation. type: str choices: enable, disable more...

  	Supported Version Ranges
  auto_negotiate	v6.0.0 -> latest
  [enable]	v6.0.0 -> latest
  [disable]	v6.0.0 -> latest

• comments - Comment. type: str more...

  	Supported Version Ranges
  comments	v6.0.0 -> latest

• dhcp_ipsec - Enable/disable DHCP-IPsec. type: str choices: enable, disable more...

  	Supported Version Ranges
  dhcp_ipsec	v6.0.0 -> latest
  [enable]	v6.0.0 -> latest
  [disable]	v6.0.0 -> latest

• dhgrp - Phase2 DH group. type: list choices: 1, 2, 5, 14, 15, 16, 17, 18, 19, 20, 21, 27, 28, 29, 30, 31, 32 more...

  	Supported Version Ranges
  dhgrp	v6.0.0 -> latest
  [1]	v6.0.0 -> latest
  [2]	v6.0.0 -> latest
  [5]	v6.0.0 -> latest
  [14]	v6.0.0 -> latest
  [15]	v6.0.0 -> latest
  [16]	v6.0.0 -> latest
  [17]	v6.0.0 -> latest
  [18]	v6.0.0 -> latest
  [19]	v6.0.0 -> latest
  [20]	v6.0.0 -> latest
  [21]	v6.0.0 -> latest
  [27]	v6.0.0 -> latest
  [28]	v6.0.0 -> latest
  [29]	v6.0.0 -> latest
  [30]	v6.0.0 -> latest
  [31]	v6.0.0 -> latest
  [32]	v6.2.0 -> latest

• diffserv - Enable/disable applying DSCP value to the IPsec tunnel outer IP header. type: str choices: enable, disable more...

  	Supported Version Ranges
  diffserv	v6.4.4 -> latest
  [enable]	v6.0.0 -> latest
  [disable]	v6.0.0 -> latest

• diffservcode - DSCP value to be applied to the IPsec tunnel outer IP header. type: str more...

  	Supported Version Ranges
  diffservcode	v6.4.4 -> latest

• dst_addr_type - Remote proxy ID type. type: str choices: subnet, range, ip, name, subnet6, range6, ip6, name6 more...

  	Supported Version Ranges
  dst_addr_type	v6.0.0 -> latest
  [subnet]	v6.0.0 -> latest
  [range]	v6.0.0 -> latest
  [ip]	v6.0.0 -> latest
  [name]	v6.0.0 -> latest
  [subnet6]	v6.0.0 -> latest
  [range6]	v6.0.0 -> latest
  [ip6]	v6.0.0 -> latest
  [name6]	v6.0.0 -> latest

• dst_end_ip - Remote proxy ID IPv4 end. type: str more...

  	Supported Version Ranges
  dst_end_ip	v6.0.0 -> latest

• dst_end_ip6 - Remote proxy ID IPv6 end. type: str more...

  	Supported Version Ranges
  dst_end_ip6	v6.0.0 -> latest

• dst_name - Remote proxy ID name. Source firewall.address.name firewall.addrgrp.name. type: str more...

  	Supported Version Ranges
  dst_name	v6.0.0 -> latest

• dst_name6 - Remote proxy ID name. Source firewall.address6.name firewall.addrgrp6.name. type: str more...

  	Supported Version Ranges
  dst_name6	v6.0.0 -> latest

• dst_port - Quick mode destination port (1 - 65535 or 0 for all). type: int more...

  	Supported Version Ranges
  dst_port	v6.0.0 -> latest

• dst_start_ip - Remote proxy ID IPv4 start. type: str more...

  	Supported Version Ranges
  dst_start_ip	v6.0.0 -> latest

• dst_start_ip6 - Remote proxy ID IPv6 start. type: str more...

  	Supported Version Ranges
  dst_start_ip6	v6.0.0 -> latest

• dst_subnet - Remote proxy ID IPv4 subnet. type: str more...

  	Supported Version Ranges
  dst_subnet	v6.0.0 -> latest

• dst_subnet6 - Remote proxy ID IPv6 subnet. type: str more...

  	Supported Version Ranges
  dst_subnet6	v6.0.0 -> latest

• encapsulation - ESP encapsulation mode. type: str choices: tunnel-mode, transport-mode more...

  	Supported Version Ranges
  encapsulation	v6.0.0 -> latest
  [tunnel-mode]	v6.0.0 -> latest
  [transport-mode]	v6.0.0 -> latest

• inbound_dscp_copy - Enable/disable copying of the DSCP in the ESP header to the inner IP header. type: str choices: phase1, enable, disable more...

  	Supported Version Ranges
  inbound_dscp_copy	v7.0.6 -> v7.0.12	v7.2.1 -> latest
  [phase1]	v6.0.0 -> latest
  [enable]	v6.0.0 -> latest
  [disable]	v6.0.0 -> latest

• initiator_ts_narrow - Enable/disable traffic selector narrowing for IKEv2 initiator. type: str choices: enable, disable more...

  	Supported Version Ranges
  initiator_ts_narrow	v6.4.4 -> latest
  [enable]	v6.0.0 -> latest
  [disable]	v6.0.0 -> latest

• ipv4_df - Enable/disable setting and resetting of IPv4 "Don"t Fragment" bit. type: str choices: enable, disable more...

  	Supported Version Ranges
  ipv4_df	v6.2.0 -> latest
  [enable]	v6.0.0 -> latest
  [disable]	v6.0.0 -> latest

• keepalive - Enable/disable keep alive. type: str choices: enable, disable more...

  	Supported Version Ranges
  keepalive	v6.0.0 -> latest
  [enable]	v6.0.0 -> latest
  [disable]	v6.0.0 -> latest

• keylife_type - Keylife type. type: str choices: seconds, kbs, both more...

  	Supported Version Ranges
  keylife_type	v6.0.0 -> latest
  [seconds]	v6.0.0 -> latest
  [kbs]	v6.0.0 -> latest
  [both]	v6.0.0 -> latest

• keylifekbs - Phase2 key life in number of kilobytes of traffic (5120 - 4294967295). type: int more...

  	Supported Version Ranges
  keylifekbs	v6.0.0 -> latest

• keylifeseconds - Phase2 key life in time in seconds (120 - 172800). type: int more...

  	Supported Version Ranges
  keylifeseconds	v6.0.0 -> latest

• l2tp - Enable/disable L2TP over IPsec. type: str choices: enable, disable more...

  	Supported Version Ranges
  l2tp	v6.0.0 -> latest
  [enable]	v6.0.0 -> latest
  [disable]	v6.0.0 -> latest

• name - IPsec tunnel name. type: str required: true more...

  	Supported Version Ranges
  name	v6.0.0 -> latest

• pfs - Enable/disable PFS feature. type: str choices: enable, disable more...

  	Supported Version Ranges
  pfs	v6.0.0 -> latest
  [enable]	v6.0.0 -> latest
  [disable]	v6.0.0 -> latest

• phase1name - Phase 1 determines the options required for phase 2. Source vpn.ipsec.phase1-interface.name. type: str more...

  	Supported Version Ranges
  phase1name	v6.0.0 -> latest

• proposal - Phase2 proposal. type: list choices: null-md5, null-sha1, null-sha256, null-sha384, null-sha512, des-null, des-md5, des-sha1, des-sha256, des-sha384, des-sha512, 3des-null, 3des-md5, 3des-sha1, 3des-sha256, 3des-sha384, 3des-sha512, aes128-null, aes128-md5, aes128-sha1, aes128-sha256, aes128-sha384, aes128-sha512, aes128gcm, aes192-null, aes192-md5, aes192-sha1, aes192-sha256, aes192-sha384, aes192-sha512, aes256-null, aes256-md5, aes256-sha1, aes256-sha256, aes256-sha384, aes256-sha512, aes256gcm, chacha20poly1305, aria128-null, aria128-md5, aria128-sha1, aria128-sha256, aria128-sha384, aria128-sha512, aria192-null, aria192-md5, aria192-sha1, aria192-sha256, aria192-sha384, aria192-sha512, aria256-null, aria256-md5, aria256-sha1, aria256-sha256, aria256-sha384, aria256-sha512, seed-null, seed-md5, seed-sha1, seed-sha256, seed-sha384, seed-sha512 more...

  	Supported Version Ranges
  proposal	v6.0.0 -> latest
  [null-md5]	v6.0.0 -> latest
  [null-sha1]	v6.0.0 -> latest
  [null-sha256]	v6.0.0 -> latest
  [null-sha384]	v6.0.0 -> latest
  [null-sha512]	v6.0.0 -> latest
  [des-null]	v6.0.0 -> latest
  [des-md5]	v6.0.0 -> latest
  [des-sha1]	v6.0.0 -> latest
  [des-sha256]	v6.0.0 -> latest
  [des-sha384]	v6.0.0 -> latest
  [des-sha512]	v6.0.0 -> latest
  [3des-null]	v6.0.0 -> latest
  [3des-md5]	v6.0.0 -> latest
  [3des-sha1]	v6.0.0 -> latest
  [3des-sha256]	v6.0.0 -> latest
  [3des-sha384]	v6.0.0 -> latest
  [3des-sha512]	v6.0.0 -> latest
  [aes128-null]	v6.0.0 -> latest
  [aes128-md5]	v6.0.0 -> latest
  [aes128-sha1]	v6.0.0 -> latest
  [aes128-sha256]	v6.0.0 -> latest
  [aes128-sha384]	v6.0.0 -> latest
  [aes128-sha512]	v6.0.0 -> latest
  [aes128gcm]	v6.0.0 -> latest
  [aes192-null]	v6.0.0 -> latest
  [aes192-md5]	v6.0.0 -> latest
  [aes192-sha1]	v6.0.0 -> latest
  [aes192-sha256]	v6.0.0 -> latest
  [aes192-sha384]	v6.0.0 -> latest
  [aes192-sha512]	v6.0.0 -> latest
  [aes256-null]	v6.0.0 -> latest
  [aes256-md5]	v6.0.0 -> latest
  [aes256-sha1]	v6.0.0 -> latest
  [aes256-sha256]	v6.0.0 -> latest
  [aes256-sha384]	v6.0.0 -> latest
  [aes256-sha512]	v6.0.0 -> latest
  [aes256gcm]	v6.0.0 -> latest
  [chacha20poly1305]	v6.0.0 -> latest
  [aria128-null]	v6.0.0 -> latest
  [aria128-md5]	v6.0.0 -> latest
  [aria128-sha1]	v6.0.0 -> latest
  [aria128-sha256]	v6.0.0 -> latest
  [aria128-sha384]	v6.0.0 -> latest
  [aria128-sha512]	v6.0.0 -> latest
  [aria192-null]	v6.0.0 -> latest
  [aria192-md5]	v6.0.0 -> latest
  [aria192-sha1]	v6.0.0 -> latest
  [aria192-sha256]	v6.0.0 -> latest
  [aria192-sha384]	v6.0.0 -> latest
  [aria192-sha512]	v6.0.0 -> latest
  [aria256-null]	v6.0.0 -> latest
  [aria256-md5]	v6.0.0 -> latest
  [aria256-sha1]	v6.0.0 -> latest
  [aria256-sha256]	v6.0.0 -> latest
  [aria256-sha384]	v6.0.0 -> latest
  [aria256-sha512]	v6.0.0 -> latest
  [seed-null]	v6.0.0 -> latest
  [seed-md5]	v6.0.0 -> latest
  [seed-sha1]	v6.0.0 -> latest
  [seed-sha256]	v6.0.0 -> latest
  [seed-sha384]	v6.0.0 -> latest
  [seed-sha512]	v6.0.0 -> latest

• protocol - Quick mode protocol selector (1 - 255 or 0 for all). type: int more...

  	Supported Version Ranges
  protocol	v6.0.0 -> latest

• replay - Enable/disable replay detection. type: str choices: enable, disable more...

  	Supported Version Ranges
  replay	v6.0.0 -> latest
  [enable]	v6.0.0 -> latest
  [disable]	v6.0.0 -> latest

• route_overlap - Action for overlapping routes. type: str choices: use-old, use-new, allow more...

  	Supported Version Ranges
  route_overlap	v6.0.0 -> latest
  [use-old]	v6.0.0 -> latest
  [use-new]	v6.0.0 -> latest
  [allow]	v6.0.0 -> latest

• single_source - Enable/disable single source IP restriction. type: str choices: enable, disable more...

  	Supported Version Ranges
  single_source	v6.0.0 -> latest
  [enable]	v6.0.0 -> latest
  [disable]	v6.0.0 -> latest

• src_addr_type - Local proxy ID type. type: str choices: subnet, range, ip, name, subnet6, range6, ip6, name6 more...

  	Supported Version Ranges
  src_addr_type	v6.0.0 -> latest
  [subnet]	v6.0.0 -> latest
  [range]	v6.0.0 -> latest
  [ip]	v6.0.0 -> latest
  [name]	v6.0.0 -> latest
  [subnet6]	v6.0.0 -> latest
  [range6]	v6.0.0 -> latest
  [ip6]	v6.0.0 -> latest
  [name6]	v6.0.0 -> latest

• src_end_ip - Local proxy ID end. type: str more...

  	Supported Version Ranges
  src_end_ip	v6.0.0 -> latest

• src_end_ip6 - Local proxy ID IPv6 end. type: str more...

  	Supported Version Ranges
  src_end_ip6	v6.0.0 -> latest

• src_name - Local proxy ID name. Source firewall.address.name firewall.addrgrp.name. type: str more...

  	Supported Version Ranges
  src_name	v6.0.0 -> latest

• src_name6 - Local proxy ID name. Source firewall.address6.name firewall.addrgrp6.name. type: str more...

  	Supported Version Ranges
  src_name6	v6.0.0 -> latest

• src_port - Quick mode source port (1 - 65535 or 0 for all). type: int more...

  	Supported Version Ranges
  src_port	v6.0.0 -> latest

• src_start_ip - Local proxy ID start. type: str more...

  	Supported Version Ranges
  src_start_ip	v6.0.0 -> latest

• src_start_ip6 - Local proxy ID IPv6 start. type: str more...

  	Supported Version Ranges
  src_start_ip6	v6.0.0 -> latest

• src_subnet - Local proxy ID subnet. type: str more...

  	Supported Version Ranges
  src_subnet	v6.0.0 -> latest

• src_subnet6 - Local proxy ID IPv6 subnet. type: str more...

  	Supported Version Ranges
  src_subnet6	v6.0.0 -> latest

Notes

Note

• Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks

Examples

- name: Configure VPN autokey tunnel.
  fortinet.fortios.fortios_vpn_ipsec_phase2_interface:
      vdom: "{{ vdom }}"
      state: "present"
      access_token: "<your_own_value>"
      vpn_ipsec_phase2_interface:
          add_route: "phase1"
          auto_discovery_forwarder: "phase1"
          auto_discovery_sender: "phase1"
          auto_negotiate: "enable"
          comments: "<your_own_value>"
          dhcp_ipsec: "enable"
          dhgrp: "1"
          diffserv: "enable"
          diffservcode: "<your_own_value>"
          dst_addr_type: "subnet"
          dst_end_ip: "<your_own_value>"
          dst_end_ip6: "<your_own_value>"
          dst_name: "<your_own_value> (source firewall.address.name firewall.addrgrp.name)"
          dst_name6: "<your_own_value> (source firewall.address6.name firewall.addrgrp6.name)"
          dst_port: "0"
          dst_start_ip: "<your_own_value>"
          dst_start_ip6: "<your_own_value>"
          dst_subnet: "<your_own_value>"
          dst_subnet6: "<your_own_value>"
          encapsulation: "tunnel-mode"
          inbound_dscp_copy: "phase1"
          initiator_ts_narrow: "enable"
          ipv4_df: "enable"
          keepalive: "enable"
          keylife_type: "seconds"
          keylifekbs: "5120"
          keylifeseconds: "43200"
          l2tp: "enable"
          name: "default_name_31"
          pfs: "enable"
          phase1name: "<your_own_value> (source vpn.ipsec.phase1-interface.name)"
          proposal: "null-md5"
          protocol: "0"
          replay: "enable"
          route_overlap: "use-old"
          single_source: "enable"
          src_addr_type: "subnet"
          src_end_ip: "<your_own_value>"
          src_end_ip6: "<your_own_value>"
          src_name: "<your_own_value> (source firewall.address.name firewall.addrgrp.name)"
          src_name6: "<your_own_value> (source firewall.address6.name firewall.addrgrp6.name)"
          src_port: "0"
          src_start_ip: "<your_own_value>"
          src_start_ip6: "<your_own_value>"
          src_subnet: "<your_own_value>"
          src_subnet6: "<your_own_value>"

Return Values

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

• build - Build number of the fortigate image returned: always type: str sample: 1547
• http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
• http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
• mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
• name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
• path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
• revision - Internal revision number returned: always type: str sample: 17.0.2.10658
• serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
• status - Indication of the operation's result returned: always type: str sample: success
• vdom - Virtual domain used returned: always type: str sample: root
• version - Version of the FortiGate returned: always type: str sample: v5.6.3

Status

• This module is not guaranteed to have a backwards compatible interface.

Authors

• Link Zheng (@chillancezen)
• Jie Xue (@JieX19)
• Hongbin Lu (@fgtdev-hblu)
• Frank Shen (@frankshen01)
• Miguel Angel Munoz (@mamunozgonzalez)
• Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation, you can create a pull request to improve it.