fortios_firewall_ssl_ssh_profile
Manage FortiOS configuration through native controller HTTPAPI; requires httpapi inventory and fortinet.fortios.fortios network OS
Collection: fortinet.fortios
Full Name: fortinet.fortios.fortios_firewall_ssl_ssh_profile
Controller module — runs on the local controller, not on remote hosts.
Synopsis
Manage FortiOS configuration through native controller HTTPAPI; requires httpapi inventory and fortinet.fortios.fortios network OS
Parameters
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| access_token | str | |||
| enable_log | bool | false | ||
| firewall_ssl_ssh_profile | dict | |||
| member_path | str | |||
| member_state | str | |||
| state | str | yes | ||
| vdom | str | root |
Example
yaml
# Define these inventory variables: fortios_access_token.
- fortinet.fortios.fortios_firewall_ssl_ssh_profile:
access_token: '{{ fortios_access_token }}'
firewall_ssl_ssh_profile:
allowlist: enable
block_blacklisted_certificates: disable
block_blocklisted_certificates: disable
comment: Optional comments.
dot:
cert_validation_failure: allow
cert_validation_timeout: allow
client_certificate: bypass
expired_server_cert: allow
proxy_after_tcp_handshake: enable
quic: inspect
revoked_server_cert: allow
sni_server_cert_check: enable
status: disable
udp_not_quic: allow
unsupported_ssl_cipher: allow
unsupported_ssl_negotiation: allow
unsupported_ssl_version: allow
untrusted_server_cert: allow
ech_outer_sni:
- name: default_name_24
ftps:
allow_invalid_server_cert: enable
cert_validation_failure: allow
cert_validation_timeout: allow
client_cert_request: bypass
client_certificate: bypass
expired_server_cert: allow
invalid_server_cert: allow
min_allowed_ssl_version: ssl-3.0
ports:
- 1
revoked_server_cert: allow
sni_server_cert_check: enable
status: disable
unsupported_ssl: bypass
unsupported_ssl_cipher: allow
unsupported_ssl_negotiation: allow
unsupported_ssl_version: allow
untrusted_cert: allow
untrusted_server_cert: allow
https:
allow_invalid_server_cert: enable
cert_probe_failure: allow
cert_validation_failure: allow
cert_validation_timeout: allow
client_cert_request: bypass
client_certificate: bypass
encrypted_client_hello: allow
expired_server_cert: allow
invalid_server_cert: allow
min_allowed_ssl_version: ssl-3.0
ports:
- 1
proxy_after_tcp_handshake: enable
quic: inspect
revoked_server_cert: allow
sni_server_cert_check: enable
status: disable
udp_not_quic: allow
unsupported_ssl: bypass
unsupported_ssl_cipher: allow
unsupported_ssl_negotiation: allow
unsupported_ssl_version: allow
untrusted_cert: allow
untrusted_server_cert: allow
imaps:
allow_invalid_server_cert: enable
cert_validation_failure: allow
cert_validation_timeout: allow
client_cert_request: bypass
client_certificate: bypass
expired_server_cert: allow
invalid_server_cert: allow
ports:
- 1
proxy_after_tcp_handshake: enable
revoked_server_cert: allow
sni_server_cert_check: enable
status: disable
unsupported_ssl: bypass
unsupported_ssl_cipher: allow
unsupported_ssl_negotiation: allow
unsupported_ssl_version: allow
untrusted_cert: allow
untrusted_server_cert: allow
mapi_over_https: enable
name: default_name_89
pop3s:
allow_invalid_server_cert: enable
cert_validation_failure: allow
cert_validation_timeout: allow
client_cert_request: bypass
client_certificate: bypass
expired_server_cert: allow
invalid_server_cert: allow
ports:
- 1
proxy_after_tcp_handshake: enable
revoked_server_cert: allow
sni_server_cert_check: enable
status: disable
unsupported_ssl: bypass
unsupported_ssl_cipher: allow
unsupported_ssl_negotiation: allow
unsupported_ssl_version: allow
untrusted_cert: allow
untrusted_server_cert: allow
rpc_over_https: enable
server_cert:
- name: default_name_111 (source vpn.certificate.local.name)
server_cert_mode: re-sign
smtps:
allow_invalid_server_cert: enable
cert_validation_failure: allow
cert_validation_timeout: allow
client_cert_request: bypass
client_certificate: bypass
expired_server_cert: allow
invalid_server_cert: allow
ports:
- 1
proxy_after_tcp_handshake: enable
revoked_server_cert: allow
sni_server_cert_check: enable
status: disable
unsupported_ssl: bypass
unsupported_ssl_cipher: allow
unsupported_ssl_negotiation: allow
unsupported_ssl_version: allow
untrusted_cert: allow
untrusted_server_cert: allow
ssh:
inspect_all: disable
ports:
- 1
proxy_after_tcp_handshake: enable
ssh_algorithm: compatible
ssh_policy_check: disable
ssh_tun_policy_check: disable
status: disable
unsupported_version: bypass
ssl:
allow_invalid_server_cert: enable
cert_probe_failure: allow
cert_validation_failure: allow
cert_validation_timeout: allow
client_cert_request: bypass
client_certificate: bypass
encrypted_client_hello: allow
expired_server_cert: allow
inspect_all: disable
invalid_server_cert: allow
min_allowed_ssl_version: ssl-3.0
revoked_server_cert: allow
sni_server_cert_check: enable
unsupported_ssl: bypass
unsupported_ssl_cipher: allow
unsupported_ssl_negotiation: allow
unsupported_ssl_version: allow
untrusted_cert: allow
untrusted_server_cert: allow
ssl_anomalies_log: disable
ssl_anomaly_log: disable
ssl_exempt:
- fortiguard_category: "0"
id: "167"
type: fortiguard-category
ssl_exemption_ip_rating: enable
ssl_exemption_log: disable
ssl_exemptions_log: disable
ssl_handshake_log: disable
ssl_negotiation_log: disable
ssl_server:
- ftps_client_cert_request: bypass
ftps_client_certificate: bypass
https_client_cert_request: bypass
https_client_certificate: bypass
id: "181"
imaps_client_cert_request: bypass
imaps_client_certificate: bypass
pop3s_client_cert_request: bypass
pop3s_client_certificate: bypass
smtps_client_cert_request: bypass
smtps_client_certificate: bypass
ssl_other_client_cert_request: bypass
ssl_other_client_certificate: bypass
ssl_server_cert_log: disable
supported_alpn: http1-1
use_ssl_server: disable
whitelist: enable
state: present
vdom: root
name: Configure SSL/SSH protocol options.