fortios_vpn_ipsec_phase2 – Configure VPN autokey tunnel in Fortinet’s FortiOS and FortiGate  New in version 2.8.   Synopsis Requirements Parameters Notes Examples Return Values Status  Synopsis  This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify vpn_ipsec feature and phase2 category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.5  Requirements The below requirements are needed on the host that executes this module.  fortiosapi>=0.9.8  Parameters   Parameter Choices/Defaults Comments    host  string      FortiOS or FortiGate IP address.     https  boolean    
Choices: no 
yes ←    Indicates if the requests towards FortiGate must use HTTPS protocol.     password  string    Default:""   FortiOS or FortiGate password.     ssl_verify  boolean  added in 2.9   
Choices: no 
yes ←    Ensures FortiGate certificate must be verified by a proper CA.     state  string  added in 2.9   
Choices: present absent    Indicates whether to create or remove the object. This attribute was present already in previous version in a deeper level. It has been moved out to this outer level.     username  string      FortiOS or FortiGate username.     vdom  string    Default:"root"   Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit.     vpn_ipsec_phase2  dictionary    Default:null   Configure VPN autokey tunnel.      add_route  string    
Choices: phase1 enable disable    Enable/disable automatic route addition.      auto_negotiate  string    
Choices: enable disable    Enable/disable IPsec SA auto-negotiation.      comments  string      Comment.      dhcp_ipsec  string    
Choices: enable disable    Enable/disable DHCP-IPsec.      dhgrp  string    
Choices: 1 2 5 14 15 16 17 18 19 20 21 27 28 29 30 31    Phase2 DH group.      dst_addr_type  string    
Choices: subnet range ip name    Remote proxy ID type.      dst_end_ip  string      Remote proxy ID IPv4 end.      dst_end_ip6  string      Remote proxy ID IPv6 end.      dst_name  string      Remote proxy ID name. Source firewall.address.name firewall.addrgrp.name.      dst_name6  string      Remote proxy ID name. Source firewall.address6.name firewall.addrgrp6.name.      dst_port  integer      Quick mode destination port (1 - 65535 or 0 for all).      dst_start_ip  string      Remote proxy ID IPv4 start.      dst_start_ip6  string      Remote proxy ID IPv6 start.      dst_subnet  string      Remote proxy ID IPv4 subnet.      dst_subnet6  string      Remote proxy ID IPv6 subnet.      encapsulation  string    
Choices: tunnel-mode transport-mode    ESP encapsulation mode.      keepalive  string    
Choices: enable disable    Enable/disable keep alive.      keylife_type  string    
Choices: seconds kbs both    Keylife type.      keylifekbs  integer      Phase2 key life in number of bytes of traffic (5120 - 4294967295).      keylifeseconds  integer      Phase2 key life in time in seconds (120 - 172800).      l2tp  string    
Choices: enable disable    Enable/disable L2TP over IPsec.      name  string / required      IPsec tunnel name.      pfs  string    
Choices: enable disable    Enable/disable PFS feature.      phase1name  string      Phase 1 determines the options required for phase 2. Source vpn.ipsec.phase1.name.      proposal  string    
Choices: null-md5 null-sha1 null-sha256 null-sha384 null-sha512 des-null des-md5 des-sha1 des-sha256 des-sha384 des-sha512    Phase2 proposal.      protocol  integer      Quick mode protocol selector (1 - 255 or 0 for all).      replay  string    
Choices: enable disable    Enable/disable replay detection.      route_overlap  string    
Choices: use-old use-new allow    Action for overlapping routes.      selector_match  string    
Choices: exact subset auto    Match type to use when comparing selectors.      single_source  string    
Choices: enable disable    Enable/disable single source IP restriction.      src_addr_type  string    
Choices: subnet range ip name    Local proxy ID type.      src_end_ip  string      Local proxy ID end.      src_end_ip6  string      Local proxy ID IPv6 end.      src_name  string      Local proxy ID name. Source firewall.address.name firewall.addrgrp.name.      src_name6  string      Local proxy ID name. Source firewall.address6.name firewall.addrgrp6.name.      src_port  integer      Quick mode source port (1 - 65535 or 0 for all).      src_start_ip  string      Local proxy ID start.      src_start_ip6  string      Local proxy ID IPv6 start.      src_subnet  string      Local proxy ID subnet.      src_subnet6  string      Local proxy ID IPv6 subnet.      state  string    
Choices: present absent    Deprecated Starting with Ansible 2.9 we recommend using the top-level 'state' parameter. Indicates whether to create or remove the object.      use_natip  string    
Choices: enable disable    Enable to use the FortiGate public IP as the source selector when outbound NAT is used.     Notes  Note  Requires fortiosapi library developed by Fortinet Run as a local_action in your playbook   Examples - hosts: localhost
  vars:
   host: "544-534-0093"
   username: "admin"
   password: ""
   vdom: "root"
   ssl_verify: "False"
  tasks:
  - name: Configure VPN autokey tunnel.
    fortios_vpn_ipsec_phase2:
      host:  "{{ host }}"
      username: "{{ username }}"
      password: "{{ password }}"
      vdom:  "{{ vdom }}"
      https: "False"
      state: "present"
      vpn_ipsec_phase2:
        add_route: "phase1"
        auto_negotiate: "enable"
        comments: "<your_own_value>"
        dhcp_ipsec: "enable"
        dhgrp: "1"
        dst_addr_type: "subnet"
        dst_end_ip: "<your_own_value>"
        dst_end_ip6: "<your_own_value>"
        dst_name: "<your_own_value> (source firewall.address.name firewall.addrgrp.name)"
        dst_name6: "<your_own_value> (source firewall.address6.name firewall.addrgrp6.name)"
        dst_port: "13"
        dst_start_ip: "<your_own_value>"
        dst_start_ip6: "<your_own_value>"
        dst_subnet: "<your_own_value>"
        dst_subnet6: "<your_own_value>"
        encapsulation: "tunnel-mode"
        keepalive: "enable"
        keylife_type: "seconds"
        keylifekbs: "21"
        keylifeseconds: "22"
        l2tp: "enable"
        name: "default_name_24"
        pfs: "enable"
        phase1name: "<your_own_value> (source vpn.ipsec.phase1.name)"
        proposal: "null-md5"
        protocol: "28"
        replay: "enable"
        route_overlap: "use-old"
        selector_match: "exact"
        single_source: "enable"
        src_addr_type: "subnet"
        src_end_ip: "<your_own_value>"
        src_end_ip6: "<your_own_value>"
        src_name: "<your_own_value> (source firewall.address.name firewall.addrgrp.name)"
        src_name6: "<your_own_value> (source firewall.address6.name firewall.addrgrp6.name)"
        src_port: "38"
        src_start_ip: "<your_own_value>"
        src_start_ip6: "<your_own_value>"
        src_subnet: "<your_own_value>"
        src_subnet6: "<your_own_value>"
        use_natip: "enable"
 Return Values Common return values are documented here, the following are the fields unique to this module:   Key Returned Description    build  string   always  Build number of the fortigate image  Sample: 1547     http_method  string   always  Last method used to provision the content into FortiGate  Sample: PUT     http_status  string   always  Last result given by FortiGate on last operation applied  Sample: 200     mkey  string   success  Master key (id) used in the last call to FortiGate  Sample: id     name  string   always  Name of the table used to fulfill the request  Sample: urlfilter     path  string   always  Path of the table used to fulfill the request  Sample: webfilter     revision  string   always  Internal revision number  Sample: 30.117-46-72728     serial  string   always  Serial number of the unit  Sample: FGVMEVYYQT3AB5352     status  string   always  Indication of the operation's result  Sample: success     vdom  string   always  Virtual domain used  Sample: root     version  string   always  Version of the FortiGate  Sample: v5.6.3     Status  This module is not guaranteed to have a backwards compatible interface. [preview]
 This module is maintained by the Ansible Community. [community]
  Authors  Miguel Angel Munoz (@mamunozgonzalez) Nicolas Thomas (@thomnico)   Hint If you notice any issues in this documentation, you can edit this document to improve it. 

    © 2012–2018 Michael DeHaan
{'path': 'public/docs/ansible~2.9/modules/fortios_vpn_ipsec_phase2_module.html', 'source': 'DevDocs.IO'}