fortios_firewall_consolidated_policy
Manage FortiOS configuration through native controller HTTPAPI; requires httpapi inventory and fortinet.fortios.fortios network OS
Collection: fortinet.fortios
Full Name: fortinet.fortios.fortios_firewall_consolidated_policy
Controller module — runs on the local controller, not on remote hosts.
Synopsis
Manage FortiOS configuration through native controller HTTPAPI; requires httpapi inventory and fortinet.fortios.fortios network OS
Parameters
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| access_token | str | |||
| enable_log | bool | false | ||
| firewall_consolidated_policy | dict | |||
| member_path | str | |||
| member_state | str | |||
| state | str | yes | ||
| vdom | str | root |
Example
yaml
# Define these inventory variables: fortios_access_token.
- fortinet.fortios.fortios_firewall_consolidated_policy:
access_token: '{{ fortios_access_token }}'
firewall_consolidated_policy:
action: accept
auto_asic_offload: enable
captive_portal_exempt: enable
diffserv_forward: enable
diffserv_reverse: enable
dstaddr_negate: enable
dstaddr4:
- name: default_name_18 (source firewall.address.name firewall.addrgrp.name firewall.vip.name firewall.vipgrp.name system.external-resource .name)
dstaddr6:
- name: default_name_20 (source firewall.address6.name firewall.addrgrp6.name firewall.vip6.name firewall.vipgrp6.name system .external-resource.name)
dstintf:
- name: default_name_22 (source system.interface.name system.zone.name)
fixedport: enable
fsso_groups:
- name: default_name_26 (source user.adgrp.name)
groups:
- name: default_name_29 (source user.group.name)
http_policy_redirect: enable
inbound: enable
inspection_mode: proxy
internet_service: enable
internet_service_custom:
- name: default_name_36 (source firewall.internet-service-custom.name)
internet_service_custom_group:
- name: default_name_38 (source firewall.internet-service-custom-group.name)
internet_service_group:
- name: default_name_40 (source firewall.internet-service-group.name)
internet_service_id:
- id: "42"
internet_service_negate: enable
internet_service_src: enable
internet_service_src_custom:
- name: default_name_46 (source firewall.internet-service-custom.name)
internet_service_src_custom_group:
- name: default_name_48 (source firewall.internet-service-custom-group.name)
internet_service_src_group:
- name: default_name_50 (source firewall.internet-service-group.name)
internet_service_src_id:
- id: "52"
internet_service_src_negate: enable
ippool: enable
logtraffic: all
logtraffic_start: enable
name: default_name_59
nat: enable
outbound: enable
policyid: 1
poolname4:
- name: default_name_65 (source firewall.ippool.name)
poolname6:
- name: default_name_67 (source firewall.ippool6.name)
profile_type: single
service:
- name: default_name_73 (source firewall.service.custom.name firewall.service.group.name)
service_negate: enable
session_ttl: "1382400"
srcaddr_negate: enable
srcaddr4:
- name: default_name_78 (source firewall.address.name firewall.addrgrp.name system.external-resource.name)
srcaddr6:
- name: default_name_80 (source firewall.address6.name firewall.addrgrp6.name system.external-resource.name)
srcintf:
- name: default_name_82 (source system.interface.name system.zone.name)
ssh_policy_redirect: enable
status: enable
tcp_mss_receiver: "32767"
tcp_mss_sender: "32767"
users:
- name: default_name_92 (source user.local.name)
utm_status: enable
wanopt: enable
wanopt_detection: active
wanopt_passive_opt: default
webcache: enable
webcache_https: disable
state: present
vdom: root
name: Configure consolidated IPv4/IPv6 policies.