fortinet.fortios.fortios_vpn_ipsec_phase2 – Configure VPN autokey tunnel in Fortinet’s FortiOS and FortiGate.

Note

This plugin is part of the fortinet.fortios collection (version 2.1.2).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install fortinet.fortios.

To use it in a playbook, specify: fortinet.fortios.fortios_vpn_ipsec_phase2.

New in version 2.10: of fortinet.fortios

Synopsis
Requirements
Parameters
Notes
Examples
Return Values

Synopsis

This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify vpn_ipsec feature and phase2 category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0

Requirements

The below requirements are needed on the host that executes this module.

ansible>=2.9.0

Parameters

Parameter		Choices/Defaults	Comments
access_token string			Token-based authentication. Generated from GUI of Fortigate.
enable_log boolean		Choices: no ← yes	Enable/Disable logging for task.
state string / required		Choices: present absent	Indicates whether to create or remove the object.
vdom string		Default: "root"	Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit.
vpn_ipsec_phase2 dictionary			Configure VPN autokey tunnel.
	add_route string	Choices: phase1 enable disable	Enable/disable automatic route addition.
	auto_negotiate string	Choices: enable disable	Enable/disable IPsec SA auto-negotiation.
	comments string		Comment.
	dhcp_ipsec string	Choices: enable disable	Enable/disable DHCP-IPsec.
	dhgrp list / elements=string	Choices: 1 2 5 14 15 16 17 18 19 20 21 27 28 29 30 31 32	Phase2 DH group.
	diffserv string	Choices: enable disable	Enable/disable applying DSCP value to the IPsec tunnel outer IP header.
	diffservcode string		DSCP value to be applied to the IPsec tunnel outer IP header.
	dst_addr_type string	Choices: subnet range ip name	Remote proxy ID type.
	dst_end_ip string		Remote proxy ID IPv4 end.
	dst_end_ip6 string		Remote proxy ID IPv6 end.
	dst_name string		Remote proxy ID name. Source firewall.address.name firewall.addrgrp.name.
	dst_name6 string		Remote proxy ID name. Source firewall.address6.name firewall.addrgrp6.name.
	dst_port integer		Quick mode destination port (1 - 65535 or 0 for all).
	dst_start_ip string		Remote proxy ID IPv4 start.
	dst_start_ip6 string		Remote proxy ID IPv6 start.
	dst_subnet string		Remote proxy ID IPv4 subnet.
	dst_subnet6 string		Remote proxy ID IPv6 subnet.
	encapsulation string	Choices: tunnel-mode transport-mode	ESP encapsulation mode.
	initiator_ts_narrow string	Choices: enable disable	Enable/disable traffic selector narrowing for IKEv2 initiator.
	ipv4_df string	Choices: enable disable	Enable/disable setting and resetting of IPv4 "Don"t Fragment" bit.
	keepalive string	Choices: enable disable	Enable/disable keep alive.
	keylife_type string	Choices: seconds kbs both	Keylife type.
	keylifekbs integer		Phase2 key life in number of bytes of traffic (5120 - 4294967295).
	keylifeseconds integer		Phase2 key life in time in seconds (120 - 172800).
	l2tp string	Choices: enable disable	Enable/disable L2TP over IPsec.
	name string / required		IPsec tunnel name.
	pfs string	Choices: enable disable	Enable/disable PFS feature.
	phase1name string		Phase 1 determines the options required for phase 2. Source vpn.ipsec.phase1.name.
	proposal list / elements=string	Choices: null-md5 null-sha1 null-sha256 null-sha384 null-sha512 des-null des-md5 des-sha1 des-sha256 des-sha384 des-sha512 3des-null 3des-md5 3des-sha1 3des-sha256 3des-sha384 3des-sha512 aes128-null aes128-md5 aes128-sha1 aes128-sha256 aes128-sha384 aes128-sha512 aes128gcm aes192-null aes192-md5 aes192-sha1 aes192-sha256 aes192-sha384 aes192-sha512 aes256-null aes256-md5 aes256-sha1 aes256-sha256 aes256-sha384 aes256-sha512 aes256gcm chacha20poly1305 aria128-null aria128-md5 aria128-sha1 aria128-sha256 aria128-sha384 aria128-sha512 aria192-null aria192-md5 aria192-sha1 aria192-sha256 aria192-sha384 aria192-sha512 aria256-null aria256-md5 aria256-sha1 aria256-sha256 aria256-sha384 aria256-sha512 seed-null seed-md5 seed-sha1 seed-sha256 seed-sha384 seed-sha512	Phase2 proposal.
	protocol integer		Quick mode protocol selector (1 - 255 or 0 for all).
	replay string	Choices: enable disable	Enable/disable replay detection.
	route_overlap string	Choices: use-old use-new allow	Action for overlapping routes.
	selector_match string	Choices: exact subset auto	Match type to use when comparing selectors.
	single_source string	Choices: enable disable	Enable/disable single source IP restriction.
	src_addr_type string	Choices: subnet range ip name	Local proxy ID type.
	src_end_ip string		Local proxy ID end.
	src_end_ip6 string		Local proxy ID IPv6 end.
	src_name string		Local proxy ID name. Source firewall.address.name firewall.addrgrp.name.
	src_name6 string		Local proxy ID name. Source firewall.address6.name firewall.addrgrp6.name.
	src_port integer		Quick mode source port (1 - 65535 or 0 for all).
	src_start_ip string		Local proxy ID start.
	src_start_ip6 string		Local proxy ID IPv6 start.
	src_subnet string		Local proxy ID subnet.
	src_subnet6 string		Local proxy ID IPv6 subnet.
	use_natip string	Choices: enable disable	Enable to use the FortiGate public IP as the source selector when outbound NAT is used.

Notes

Note

Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks

Examples

- hosts: fortigates
  collections:
    - fortinet.fortios
  connection: httpapi
  vars:
   vdom: "root"
   ansible_httpapi_use_ssl: yes
   ansible_httpapi_validate_certs: no
   ansible_httpapi_port: 443
  tasks:
  - name: Configure VPN autokey tunnel.
    fortios_vpn_ipsec_phase2:
      vdom:  "{{ vdom }}"
      state: "present"
      access_token: "<your_own_value>"
      vpn_ipsec_phase2:
        add_route: "phase1"
        auto_negotiate: "enable"
        comments: "<your_own_value>"
        dhcp_ipsec: "enable"
        dhgrp: "1"
        diffserv: "enable"
        diffservcode: "<your_own_value>"
        dst_addr_type: "subnet"
        dst_end_ip: "<your_own_value>"
        dst_end_ip6: "<your_own_value>"
        dst_name: "<your_own_value> (source firewall.address.name firewall.addrgrp.name)"
        dst_name6: "<your_own_value> (source firewall.address6.name firewall.addrgrp6.name)"
        dst_port: "15"
        dst_start_ip: "<your_own_value>"
        dst_start_ip6: "<your_own_value>"
        dst_subnet: "<your_own_value>"
        dst_subnet6: "<your_own_value>"
        encapsulation: "tunnel-mode"
        initiator_ts_narrow: "enable"
        ipv4_df: "enable"
        keepalive: "enable"
        keylife_type: "seconds"
        keylifekbs: "25"
        keylifeseconds: "26"
        l2tp: "enable"
        name: "default_name_28"
        pfs: "enable"
        phase1name: "<your_own_value> (source vpn.ipsec.phase1.name)"
        proposal: "null-md5"
        protocol: "32"
        replay: "enable"
        route_overlap: "use-old"
        selector_match: "exact"
        single_source: "enable"
        src_addr_type: "subnet"
        src_end_ip: "<your_own_value>"
        src_end_ip6: "<your_own_value>"
        src_name: "<your_own_value> (source firewall.address.name firewall.addrgrp.name)"
        src_name6: "<your_own_value> (source firewall.address6.name firewall.addrgrp6.name)"
        src_port: "42"
        src_start_ip: "<your_own_value>"
        src_start_ip6: "<your_own_value>"
        src_subnet: "<your_own_value>"
        src_subnet6: "<your_own_value>"
        use_natip: "enable"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Returned	Description
build string	always	Build number of the fortigate image Sample: 1547
http_method string	always	Last method used to provision the content into FortiGate Sample: PUT
http_status string	always	Last result given by FortiGate on last operation applied Sample: 200
mkey string	success	Master key (id) used in the last call to FortiGate Sample: id
name string	always	Name of the table used to fulfill the request Sample: urlfilter
path string	always	Path of the table used to fulfill the request Sample: webfilter
revision string	always	Internal revision number Sample: 17.0.2.10658
serial string	always	Serial number of the unit Sample: FGVMEVYYQT3AB5352
status string	always	Indication of the operation's result Sample: success
vdom string	always	Virtual domain used Sample: root
version string	always	Version of the FortiGate Sample: v5.6.3

Authors

Link Zheng (@chillancezen)
Jie Xue (@JieX19)
Hongbin Lu (@fgtdev-hblu)
Frank Shen (@frankshen01)
Miguel Angel Munoz (@mamunozgonzalez)
Nicolas Thomas (@thomnico)

© 2012–2018 Michael DeHaan
© 2018–2021 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/latest/collections/fortinet/fortios/fortios_vpn_ipsec_phase2_module.html