fortios_vpn_ssl_settings
Manage FortiOS configuration through native controller HTTPAPI; requires httpapi inventory and fortinet.fortios.fortios network OS
Collection: fortinet.fortios
Full Name: fortinet.fortios.fortios_vpn_ssl_settings
Controller module — runs on the local controller, not on remote hosts.
Synopsis
Manage FortiOS configuration through native controller HTTPAPI; requires httpapi inventory and fortinet.fortios.fortios network OS
Parameters
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| access_token | str | |||
| enable_log | bool | false | ||
| member_path | str | |||
| member_state | str | |||
| vdom | str | root | ||
| vpn_ssl_settings | dict |
Example
yaml
- fortinet.fortios.fortios_vpn_ssl_settings:
vdom: root
vpn_ssl_settings:
algorithm: high
auth_session_check_source_ip: enable
auth_timeout: "28800"
authentication_rule:
- auth: any
cipher: any
client_cert: enable
groups:
- name: default_name_11 (source user.group.name)
id: "12"
source_address:
- name: default_name_16 (source firewall.address.name firewall.addrgrp.name system.external-resource.name)
source_address_negate: enable
source_address6:
- name: default_name_19 (source firewall.address6.name firewall.addrgrp6.name system.external-resource.name)
source_address6_negate: enable
source_interface:
- name: default_name_22 (source system.interface.name system.zone.name)
users:
- name: default_name_25 (source user.local.name)
auto_tunnel_static_route: enable
banned_cipher: RSA
browser_language_detection: enable
check_referer: enable
ciphersuite: TLS-AES-128-GCM-SHA256
client_sigalgs: no-rsa-pss
deflate_compression_level: "6"
deflate_min_data_size: "300"
dtls_heartbeat_fail_count: "3"
dtls_heartbeat_idle_timeout: "3"
dtls_heartbeat_interval: "3"
dtls_hello_timeout: "10"
dtls_max_proto_ver: dtls1-0
dtls_min_proto_ver: dtls1-0
dtls_tunnel: enable
dual_stack_mode: enable
encode_2f_sequence: enable
encrypt_and_store_password: enable
force_two_factor_auth: enable
header_x_forwarded_for: pass
hsts_include_subdomains: enable
http_compression: enable
http_only_cookie: enable
http_request_body_timeout: "30"
http_request_header_timeout: "20"
https_redirect: enable
idle_timeout: "300"
login_attempt_limit: "2"
login_block_time: "60"
login_timeout: "30"
port: "10443"
port_precedence: enable
remote_https_cert_check: no-check
reqclientcert: enable
route_source_interface: enable
saml_redirect_port: "8020"
server_hostname: myhostname
source_address:
- name: default_name_73 (source firewall.address.name firewall.addrgrp.name system.external-resource.name)
source_address_negate: enable
source_address6:
- name: default_name_76 (source firewall.address6.name firewall.addrgrp6.name system.external-resource.name)
source_address6_negate: enable
source_interface:
- name: default_name_79 (source system.interface.name system.zone.name)
ssl_client_renegotiation: disable
ssl_insert_empty_fragment: enable
ssl_max_proto_ver: tls1-0
ssl_min_proto_ver: tls1-0
status: enable
tls_groups: P-521
tlsv1_0: enable
tlsv1_1: enable
tlsv1_2: enable
tlsv1_3: enable
transform_backward_slashes: enable
tunnel_addr_assigned_method: first-available
tunnel_connect_without_reauth: enable
tunnel_ip_pools:
- name: default_name_94 (source firewall.address.name firewall.addrgrp.name)
tunnel_ipv6_pools:
- name: default_name_96 (source firewall.address6.name firewall.addrgrp6.name)
tunnel_user_session_timeout: "30"
unsafe_legacy_renegotiation: enable
url_obscuration: enable
web_mode_snat: enable
x_content_type_options: enable
ztna_trusted_client: enable
name: Configure Agentless VPN.