fortinet.fortimanager.fmgr_vpn_ipsec_phase1 module – Configure VPN remote gateway.

access_token

string

The token to access FortiManager without using username and password.

adom

string / required

The parameter (adom) in requested url.

bypass_validation

boolean

Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters.

Choices:

• false ← (default)
• true

enable_log

boolean

Enable/Disable logging for task.

Choices:

• false ← (default)
• true

forticloud_access_token

string

Authenticate Ansible client with forticloud API access token.

proposed_method

string

The overridden method for the underlying Json RPC request.

Choices:

• "update"
• "set"
• "add"

rc_failed

list / elements=integer

The rc codes list with which the conditions to fail will be overriden.

rc_succeeded

list / elements=integer

The rc codes list with which the conditions to succeed will be overriden.

revision_note

string

The change note that can be specified when an object is created or updated.

state

string / required

The directive to create, update or delete an object.

Choices:

• "present"
• "absent"

vpn_ipsec_phase1

dictionary

The top level parameters set.

acct_verify

aliases: acct-verify

string

Enable/disable verification of RADIUS accounting record.

Choices:

• "disable"
• "enable"

add_gw_route

aliases: add-gw-route

string

Enable/disable automatically add a route to the remote gateway.

Choices:

• "disable"
• "enable"

add_route

aliases: add-route

string

Enable/disable control addition of a route to peer destination selector.

Choices:

• "disable"
• "enable"

addke1

list / elements=string

ADDKE1 group.

Choices:

• "0"
• "1080"
• "1081"
• "1082"
• "1083"
• "1084"
• "1085"
• "1089"
• "1090"
• "1091"
• "1092"
• "1093"
• "1094"
• "35"
• "36"
• "37"

addke2

list / elements=string

ADDKE2 group.

Choices:

• "0"
• "1080"
• "1081"
• "1082"
• "1083"
• "1084"
• "1085"
• "1089"
• "1090"
• "1091"
• "1092"
• "1093"
• "1094"
• "35"
• "36"
• "37"

addke3

list / elements=string

ADDKE3 group.

Choices:

• "0"
• "1080"
• "1081"
• "1082"
• "1083"
• "1084"
• "1085"
• "1089"
• "1090"
• "1091"
• "1092"
• "1093"
• "1094"
• "35"
• "36"
• "37"

addke4

list / elements=string

ADDKE4 group.

Choices:

• "0"
• "1080"
• "1081"
• "1082"
• "1083"
• "1084"
• "1085"
• "1089"
• "1090"
• "1091"
• "1092"
• "1093"
• "1094"
• "35"
• "36"
• "37"

addke5

list / elements=string

ADDKE5 group.

Choices:

• "0"
• "1080"
• "1081"
• "1082"
• "1083"
• "1084"
• "1085"
• "1089"
• "1090"
• "1091"
• "1092"
• "1093"
• "1094"
• "35"
• "36"
• "37"

addke6

list / elements=string

ADDKE6 group.

Choices:

• "0"
• "1080"
• "1081"
• "1082"
• "1083"
• "1084"
• "1085"
• "1089"
• "1090"
• "1091"
• "1092"
• "1093"
• "1094"
• "35"
• "36"
• "37"

addke7

list / elements=string

ADDKE7 group.

Choices:

• "0"
• "1080"
• "1081"
• "1082"
• "1083"
• "1084"
• "1085"
• "1089"
• "1090"
• "1091"
• "1092"
• "1093"
• "1094"
• "35"
• "36"
• "37"

assign_ip

aliases: assign-ip

string

Enable/disable assignment of IP to IPsec interface via configuration method.

Choices:

• "disable"
• "enable"

assign_ip_from

aliases: assign-ip-from

string

Method by which the IP address will be assigned.

Choices:

• "range"
• "usrgrp"
• "dhcp"
• "name"

authmethod

string

Authentication method.

Choices:

• "psk"
• "signature"

authmethod_remote

aliases: authmethod-remote

string

Authentication method

Choices:

• "psk"
• "signature"

authpasswd

list / elements=string

XAuth password

authusr

string

XAuth user name.

authusrgrp

list / elements=string

Authentication user group.

auto_negotiate

aliases: auto-negotiate

string

Enable/disable automatic initiation of IKE SA negotiation.

Choices:

• "disable"
• "enable"

auto_transport_threshold

aliases: auto-transport-threshold

integer

Timeout in seconds before falling back to next transport protocol.

azure_ad_autoconnect

aliases: azure-ad-autoconnect

string

Enable/disable Azure AD Auto-Connect for FortiClient.

Choices:

• "disable"
• "enable"

backup_gateway

aliases: backup-gateway

list / elements=string

Instruct unity clients about the backup gateway address

banner

string

Message that unity client should display after connecting.

cert_id_validation

aliases: cert-id-validation

string

Enable/disable cross validation of peer ID and the identity in the peers certificate as specified in RFC 4945.

Choices:

• "disable"
• "enable"

cert_peer_username_strip

aliases: cert-peer-username-strip

string

Enable/disable domain stripping on certificate identity.

Choices:

• "disable"
• "enable"

cert_peer_username_validation

aliases: cert-peer-username-validation

string

Enable/disable cross validation of peer username and the identity in the peers certificate.

Choices:

• "othername"
• "rfc822name"
• "cn"
• "none"

cert_trust_store

aliases: cert-trust-store

string

CA certificate trust store.

Choices:

• "local"
• "ems"

certificate

list / elements=string

Names of up to 4 signed personal certificates.

childless_ike

aliases: childless-ike

string

Enable/disable childless IKEv2 initiation

Choices:

• "disable"
• "enable"

client_auto_negotiate

aliases: client-auto-negotiate

string

Enable/disable allowing the VPN client to bring up the tunnel when there is no traffic.

Choices:

• "disable"
• "enable"

client_keep_alive

aliases: client-keep-alive

string

Enable/disable allowing the VPN client to keep the tunnel up when there is no traffic.

Choices:

• "disable"
• "enable"

client_resume

aliases: client-resume

string

Enable/disable resumption of offline FortiClient sessions.

Choices:

• "disable"
• "enable"

client_resume_interval

aliases: client-resume-interval

integer

Maximum time in seconds during which a VPN client may resume using a tunnel after a client PC has entered sleep mode or te…

comments

string

Comment.

dev_id

aliases: dev-id

string

Device ID carried by the device ID notification.

dev_id_notification

aliases: dev-id-notification

string

Enable/disable device ID notification.

Choices:

• "disable"
• "enable"

dhcp6_ra_linkaddr

aliases: dhcp6-ra-linkaddr

string

Relay agent IPv6 link address to use in DHCP6 requests.

dhcp_ra_giaddr

aliases: dhcp-ra-giaddr

string

Relay agent gateway IP address to use in the giaddr field of DHCP requests.

dhgrp

list / elements=string

DH group.

Choices:

• "1"
• "2"
• "5"
• "14"
• "15"
• "16"
• "17"
• "18"
• "19"
• "20"
• "21"
• "27"
• "28"
• "29"
• "30"
• "31"
• "32"

digital_signature_auth

aliases: digital-signature-auth

string

Enable/disable IKEv2 Digital Signature Authentication

Choices:

• "disable"
• "enable"

distance

integer

Distance for routes added by IKE

dns_mode

aliases: dns-mode

string

DNS server mode.

Choices:

• "auto"
• "manual"

dns_suffix_search

aliases: dns-suffix-search

list / elements=string

One or more DNS domain name suffixes in quotes separated by spaces.

domain

string

Instruct unity clients about the single default DNS domain.

dpd

string

Dead Peer Detection mode.

Choices:

• "disable"
• "on-idle"
• "on-demand"

dpd_retrycount

aliases: dpd-retrycount

integer

Number of DPD retry attempts.

dpd_retryinterval

aliases: dpd-retryinterval

list / elements=integer

DPD retry interval.

eap

string

Enable/disable IKEv2 EAP authentication.

Choices:

• "disable"
• "enable"

eap_cert_auth

aliases: eap-cert-auth

string

Enable/disable peer certificate authentication in addition to EAP if peer is a FortiClient endpoint.

Choices:

• "disable"
• "enable"

eap_exclude_peergrp

aliases: eap-exclude-peergrp

list / elements=string

Peer group excluded from EAP authentication.

eap_identity

aliases: eap-identity

string

IKEv2 EAP peer identity type.

Choices:

• "use-id-payload"
• "send-request"

ems_sn_check

aliases: ems-sn-check

string

Enable/disable verification of EMS serial number.

Choices:

• "enable"
• "disable"

enforce_unique_id

aliases: enforce-unique-id

string

Enable/disable peer ID uniqueness check.

Choices:

• "disable"
• "keep-new"
• "keep-old"

esn

string

Extended sequence number

Choices:

• "disable"
• "require"
• "allow"

exchange_fgt_device_id

aliases: exchange-fgt-device-id

string

Enable/disable device identifier exchange with peer FortiGate units for use of VPN monitor data by FortiManager.

Choices:

• "disable"
• "enable"

fallback_tcp_threshold

aliases: fallback-tcp-threshold

integer

Timeout in seconds before falling back IKE/IPsec traffic to tcp.

fec_base

aliases: fec-base

integer

Number of base Forward Error Correction packets

fec_codec

aliases: fec-codec

string

Forward Error Correction encoding/decoding algorithm.

Choices:

• "rs"
• "xor"

fec_egress

aliases: fec-egress

string

Enable/disable Forward Error Correction for egress IPsec traffic.

Choices:

• "disable"
• "enable"

fec_health_check

aliases: fec-health-check

list / elements=string

SD-WAN health check.

fec_ingress

aliases: fec-ingress

string

Enable/disable Forward Error Correction for ingress IPsec traffic.

Choices:

• "disable"
• "enable"

fec_mapping_profile

aliases: fec-mapping-profile

list / elements=string

Forward Error Correction

fec_receive_timeout

aliases: fec-receive-timeout

integer

Timeout in milliseconds before dropping Forward Error Correction packets

fec_redundant

aliases: fec-redundant

integer

Number of redundant Forward Error Correction packets

fec_send_timeout

aliases: fec-send-timeout

integer

Timeout in milliseconds before sending Forward Error Correction packets

fgsp_sync

aliases: fgsp-sync

string

Enable/disable IPsec syncing of tunnels for FGSP IPsec.

Choices:

• "disable"
• "enable"

forticlient_enforcement

aliases: forticlient-enforcement

string

Enable/disable FortiClient enforcement.

Choices:

• "disable"
• "enable"

fortinet_esp

aliases: fortinet-esp

string

Enable/disable Fortinet ESP encapsulaton.

Choices:

• "disable"
• "enable"

fragmentation

string

Enable/disable fragment IKE message on re-transmission.

Choices:

• "disable"
• "enable"

fragmentation_mtu

aliases: fragmentation-mtu

integer

IKE fragmentation MTU

group_authentication

aliases: group-authentication

string

Enable/disable IKEv2 IDi group authentication.

Choices:

• "disable"
• "enable"

group_authentication_secret

aliases: group-authentication-secret

list / elements=string

Password for IKEv2 ID group authentication.

ha_sync_esp_seqno

aliases: ha-sync-esp-seqno

string

Enable/disable sequence number jump ahead for IPsec HA.

Choices:

• "disable"
• "enable"

idle_timeout

aliases: idle-timeout

string

Enable/disable IPsec tunnel idle timeout.

Choices:

• "disable"
• "enable"

idle_timeoutinterval

aliases: idle-timeoutinterval

integer

IPsec tunnel idle timeout in minutes

ike_version

aliases: ike-version

string

IKE protocol version.

Choices:

• "1"
• "2"

inbound_dscp_copy

aliases: inbound-dscp-copy

string

Enable/disable copy the dscp in the ESP header to the inner IP Header.

Choices:

• "disable"
• "enable"

include_local_lan

aliases: include-local-lan

string

Enable/disable allow local LAN access on unity clients.

Choices:

• "disable"
• "enable"

interface

list / elements=string

Local physical, aggregate, or VLAN outgoing interface.

internal_domain_list

aliases: internal-domain-list

list / elements=string

One or more internal domain names in quotes separated by spaces.

ip_delay_interval

aliases: ip-delay-interval

integer

IP address reuse delay interval in seconds

ipv4_dns_server1

aliases: ipv4-dns-server1

string

IPv4 DNS server 1.

ipv4_dns_server2

aliases: ipv4-dns-server2

string

IPv4 DNS server 2.

ipv4_dns_server3

aliases: ipv4-dns-server3

string

IPv4 DNS server 3.

ipv4_end_ip

aliases: ipv4-end-ip

string

End of IPv4 range.

ipv4_exclude_range

aliases: ipv4-exclude-range

list / elements=dictionary

Ipv4 exclude range.

end_ip

aliases: end-ip

string

End of IPv4 exclusive range.

id

integer

ID.

start_ip

aliases: start-ip

string

Start of IPv4 exclusive range.

ipv4_name

aliases: ipv4-name

list / elements=string

IPv4 address name.

ipv4_netmask

aliases: ipv4-netmask

string

IPv4 Netmask.

ipv4_split_exclude

aliases: ipv4-split-exclude

list / elements=string

IPv4 subnets that should not be sent over the IPsec tunnel.

ipv4_split_include

aliases: ipv4-split-include

list / elements=string

IPv4 split-include subnets.

ipv4_start_ip

aliases: ipv4-start-ip

string

Start of IPv4 range.

ipv4_wins_server1

aliases: ipv4-wins-server1

string

WINS server 1.

ipv4_wins_server2

aliases: ipv4-wins-server2

string

WINS server 2.

ipv6_auto_linklocal

aliases: ipv6-auto-linklocal

string

Enable/disable auto generation of IPv6 link-local address using last 8 bytes of mode-cfg assigned IPv6 address.

Choices:

• "disable"
• "enable"

ipv6_dns_server1

aliases: ipv6-dns-server1

string

IPv6 DNS server 1.

ipv6_dns_server2

aliases: ipv6-dns-server2

string

IPv6 DNS server 2.

ipv6_dns_server3

aliases: ipv6-dns-server3

string

IPv6 DNS server 3.

ipv6_end_ip

aliases: ipv6-end-ip

string

End of IPv6 range.

ipv6_exclude_range

aliases: ipv6-exclude-range

list / elements=dictionary

Ipv6 exclude range.

end_ip

aliases: end-ip

string

End of IPv6 exclusive range.

id

integer

ID.

start_ip

aliases: start-ip

string

Start of IPv6 exclusive range.

ipv6_name

aliases: ipv6-name

list / elements=string

IPv6 address name.

ipv6_prefix

aliases: ipv6-prefix

integer

IPv6 prefix.

ipv6_split_exclude

aliases: ipv6-split-exclude

list / elements=string

IPv6 subnets that should not be sent over the IPsec tunnel.

ipv6_split_include

aliases: ipv6-split-include

list / elements=string

IPv6 split-include subnets.

ipv6_start_ip

aliases: ipv6-start-ip

string

Start of IPv6 range.

keepalive

integer

NAT-T keep alive interval.

keylife

integer

Time to wait in seconds before phase 1 encryption key expires.

kms

list / elements=string

Key Management Services server.

link_cost

aliases: link-cost

integer

VPN tunnel underlay link cost.

local_gw

aliases: local-gw

string

Local VPN gateway.

localid

string

Local ID.

localid_type

aliases: localid-type

string

Local ID type.

Choices:

• "auto"
• "fqdn"
• "user-fqdn"
• "keyid"
• "address"
• "asn1dn"

loopback_asymroute

aliases: loopback-asymroute

string

Enable/disable asymmetric routing for IKE traffic on loopback interface.

Choices:

• "disable"
• "enable"

mesh_selector_type

aliases: mesh-selector-type

string

Add selectors containing subsets of the configuration depending on traffic.

Choices:

• "disable"
• "subnet"
• "host"

mode

string

ID protection mode used to establish a secure channel.

Choices:

• "main"
• "aggressive"

mode_cfg

aliases: mode-cfg

string

Enable/disable configuration method.

Choices:

• "disable"
• "enable"

mode_cfg_allow_client_selector

aliases: mode-cfg-allow-client-selector

string

Enable/disable mode-cfg client to use custom phase2 selectors.

Choices:

• "disable"
• "enable"

name

string / required

IPsec remote gateway name.

nattraversal

string

Enable/disable NAT traversal.

Choices:

• "disable"
• "enable"
• "forced"

negotiate_timeout

aliases: negotiate-timeout

integer

IKE SA negotiation timeout in seconds

network_id

aliases: network-id

integer

VPN gateway network ID.

network_overlay

aliases: network-overlay

string

Enable/disable network overlays.

Choices:

• "disable"
• "enable"

npu_offload

aliases: npu-offload

string

Enable/disable offloading NPU.

Choices:

• "disable"
• "enable"

peer

list / elements=string

Accept this peer certificate.

peergrp

list / elements=string

Accept this peer certificate group.

peerid

string

Accept this peer identity.

peertype

string

Accept this peer type.

Choices:

• "any"
• "one"
• "dialup"
• "peer"
• "peergrp"

ppk

string

Enable/disable IKEv2 Postquantum Preshared Key

Choices:

• "disable"
• "allow"
• "require"

ppk_identity

aliases: ppk-identity

string

IKEv2 Postquantum Preshared Key Identity.

ppk_secret

aliases: ppk-secret

list / elements=string

IKEv2 Postquantum Preshared Key

priority

integer

Priority for routes added by IKE

proposal

string

Phase1 proposal.

Choices:

• "des-md5"
• "des-sha1"
• "3des-md5"
• "3des-sha1"
• "aes128-md5"
• "aes128-sha1"
• "aes192-md5"
• "aes192-sha1"
• "aes256-md5"
• "aes256-sha1"
• "des-sha256"
• "3des-sha256"
• "aes128-sha256"
• "aes192-sha256"
• "aes256-sha256"
• "des-sha384"
• "des-sha512"
• "3des-sha384"
• "3des-sha512"
• "aes128-sha384"
• "aes128-sha512"
• "aes192-sha384"
• "aes192-sha512"
• "aes256-sha384"
• "aes256-sha512"
• "aria128-md5"
• "aria128-sha1"
• "aria128-sha256"
• "aria128-sha384"
• "aria128-sha512"
• "aria192-md5"
• "aria192-sha1"
• "aria192-sha256"
• "aria192-sha384"
• "aria192-sha512"
• "aria256-md5"
• "aria256-sha1"
• "aria256-sha256"
• "aria256-sha384"
• "aria256-sha512"
• "seed-md5"
• "seed-sha1"
• "seed-sha256"
• "seed-sha384"
• "seed-sha512"
• "aes128gcm-prfsha1"
• "aes128gcm-prfsha256"
• "aes128gcm-prfsha384"
• "aes128gcm-prfsha512"
• "aes256gcm-prfsha1"
• "aes256gcm-prfsha256"
• "aes256gcm-prfsha384"
• "aes256gcm-prfsha512"
• "chacha20poly1305-prfsha1"
• "chacha20poly1305-prfsha256"
• "chacha20poly1305-prfsha384"
• "chacha20poly1305-prfsha512"

psksecret

list / elements=string

Pre-shared secret for PSK authentication

psksecret_remote

aliases: psksecret-remote

list / elements=string

Pre-shared secret for remote side PSK authentication

qkd

string

Enable/disable use of Quantum Key Distribution

Choices:

• "disable"
• "allow"
• "require"

qkd_hybrid

aliases: qkd-hybrid

string

Enable/disable use of Quantum Key Distribution

Choices:

• "disable"
• "require"
• "allow"

qkd_profile

aliases: qkd-profile

list / elements=string

Quantum Key Distribution

reauth

string

Enable/disable re-authentication upon IKE SA lifetime expiration.

Choices:

• "disable"
• "enable"

rekey

string

Enable/disable phase1 rekey.

Choices:

• "disable"
• "enable"

remote_gw

aliases: remote-gw

string

Remote VPN gateway.

remote_gw6_country

aliases: remote-gw6-country

string

IPv6 addresses associated to a specific country.

remote_gw6_end_ip

aliases: remote-gw6-end-ip

string

Last IPv6 address in the range.

remote_gw6_match

aliases: remote-gw6-match

string

Set type of IPv6 remote gateway address matching.

Choices:

• "any"
• "iprange"
• "geography"
• "ipprefix"

remote_gw6_start_ip

aliases: remote-gw6-start-ip

string

First IPv6 address in the range.

remote_gw6_subnet

aliases: remote-gw6-subnet

string

IPv6 address and prefix.

remote_gw_country

aliases: remote-gw-country

string

IPv4 addresses associated to a specific country.

remote_gw_end_ip

aliases: remote-gw-end-ip

string

Last IPv4 address in the range.

remote_gw_match

aliases: remote-gw-match

string

Set type of IPv4 remote gateway address matching.

Choices:

• "any"
• "ipmask"
• "iprange"
• "geography"
• "ztna"

remote_gw_start_ip

aliases: remote-gw-start-ip

string

First IPv4 address in the range.

remote_gw_subnet

aliases: remote-gw-subnet

list / elements=string

IPv4 address and subnet mask.

remote_gw_ztna_tags

aliases: remote-gw-ztna-tags

list / elements=string

IPv4 ZTNA posture tags.

remotegw_ddns

aliases: remotegw-ddns

string

Domain name of remote gateway.

rsa_signature_format

aliases: rsa-signature-format

string

Digital Signature Authentication RSA signature format.

Choices:

• "pkcs1"
• "pss"

rsa_signature_hash_override

aliases: rsa-signature-hash-override

string

Enable/disable IKEv2 RSA signature hash algorithm override.

Choices:

• "disable"
• "enable"

save_password

aliases: save-password

string

Enable/disable saving XAuth username and password on VPN clients.

Choices:

• "disable"
• "enable"

send_cert_chain

aliases: send-cert-chain

string

Enable/disable sending certificate chain.

Choices:

• "disable"
• "enable"

shared_idle_timeout

aliases: shared-idle-timeout

string

Enable/disable IPsec tunnel shared idle timeout.

Choices:

• "disable"
• "enable"

signature_hash_alg

aliases: signature-hash-alg

list / elements=string

Digital Signature Authentication hash algorithms.

Choices:

• "sha1"
• "sha2-256"
• "sha2-384"
• "sha2-512"

split_include_service

aliases: split-include-service

list / elements=string

Split-include services.

suite_b

aliases: suite-b

string

Use Suite-B.

Choices:

• "disable"
• "suite-b-gcm-128"
• "suite-b-gcm-256"

transit_gateway

aliases: transit-gateway

string

IPsec tunnel created by autoscaling to be used as a transit gateway.

Choices:

• "disable"
• "enable"

transport

string

Set IKE transport protocol.

Choices:

• "udp"
• "tcp"
• "auto"
• "udp-fallback-tcp"

type

string

Remote gateway type.

Choices:

• "static"
• "dynamic"
• "ddns"

unity_support

aliases: unity-support

string

Enable/disable support for Cisco UNITY Configuration Method extensions.

Choices:

• "disable"
• "enable"

usrgrp

list / elements=string

User group name for dialup peers.

wizard_type

aliases: wizard-type

string

GUI VPN Wizard Type.

Choices:

• "custom"
• "dialup-forticlient"
• "dialup-ios"
• "dialup-android"
• "dialup-cisco"
• "static-fortigate"
• "static-cisco"
• "dialup-windows"
• "dialup-fortigate"
• "dialup-cisco-fw"
• "simplified-static-fortigate"
• "hub-fortigate-auto-discovery"
• "spoke-fortigate-auto-discovery"
• "fabric-overlay-orchestrator"

xauthtype

string

XAuth type.

Choices:

• "disable"
• "client"
• "pap"
• "chap"
• "auto"

workspace_locking_adom

string

The adom to lock for FortiManager running in workspace mode, the value can be global and others including root.

workspace_locking_timeout

integer

The maximum time in seconds to wait for other user to release the workspace lock.

Default: 300

meta

dictionary

The result of the request.

Returned: always

request_url

string

The full url requested.

Returned: always

Sample: "/sys/login/user"

response_code

integer

The status of api request.

Returned: always

Sample: 0

response_data

list / elements=string

The api response.

Returned: always

response_message

string

The descriptive message of the api response.

Returned: always

Sample: "OK."

system_information

dictionary

The information of the target system.

Returned: always

rc

integer

The status the request.

Returned: always

Sample: 0

version_check_warning

list / elements=string

Warning if the parameters used in the playbook are not supported by the current FortiManager version.

Returned: complex