# fortios_system_settings – Configure VDOM settings in Fortinet’s FortiOS and FortiGate

New in version 2.8.

- Synopsis

- Requirements

- Parameters

- Notes

- Examples

- Return Values

- Status

## Synopsis

- This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify system feature and settings category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.5

## Requirements

The below requirements are needed on the host that executes this module.

- fortiosapi>=0.9.8

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
host string |  | FortiOS or FortiGate IP address.

https
boolean

Choices:
- no
- yes ←

Indicates if the requests towards FortiGate must use HTTPS protocol.

password string | Default: "" | FortiOS or FortiGate password.

ssl_verify
boolean
added in 2.9

Choices:
- no
- yes ←

Ensures FortiGate certificate must be verified by a proper CA.

system_settings dictionary | Default: null | Configure VDOM settings.

allow_linkdown_path
string

Choices:
- enable
- disable

Enable/disable link down path.

allow_subnet_overlap
string

Choices:
- enable
- disable

Enable/disable allowing interface subnets to use overlapping IP addresses.

asymroute
string

Choices:
- enable
- disable

Enable/disable IPv4 asymmetric routing.

asymroute6
string

Choices:
- enable
- disable

Enable/disable asymmetric IPv6 routing.

asymroute6_icmp
string

Choices:
- enable
- disable

Enable/disable asymmetric ICMPv6 routing.

asymroute_icmp
string

Choices:
- enable
- disable

Enable/disable ICMP asymmetric routing.

bfd
string

Choices:
- enable
- disable

Enable/disable Bi-directional Forwarding Detection (BFD) on all interfaces.

| bfd_desired_min_tx integer |  | BFD desired minimal transmit interval (1 - 100000 ms).
| bfd_detect_mult integer |  | BFD detection multiplier (1 - 50).

bfd_dont_enforce_src_port
string

Choices:
- enable
- disable

Enable to not enforce verifying the source port of BFD Packets.

| bfd_required_min_rx integer |  | BFD required minimal receive interval (1 - 100000 ms).

block_land_attack
string

Choices:
- disable
- enable

Enable/disable blocking of land attacks.

central_nat
string

Choices:
- enable
- disable

Enable/disable central NAT.

| comments string |  | VDOM comments.

compliance_check
string

Choices:
- enable
- disable

Enable/disable PCI DSS compliance checking.

default_voip_alg_mode
string

Choices:
- proxy-based
- kernel-helper-based

Configure how the FortiGate handles VoIP traffic when a policy that accepts the traffic doesn't include a VoIP profile.

deny_tcp_with_icmp
string

Choices:
- enable
- disable

Enable/disable denying TCP by sending an ICMP communication prohibited packet.

| device string |  | Interface to use for management access for NAT mode. Source system.interface.name.
| dhcp6_server_ip string |  | DHCPv6 server IPv6 address.

dhcp_proxy
string

Choices:
- enable
- disable

Enable/disable the DHCP Proxy.

| dhcp_server_ip string |  | DHCP Server IPv4 address.
| discovered_device_timeout integer |  | Timeout for discovered devices (1 - 365 days).
| ecmp_max_paths integer |  | Maximum number of Equal Cost Multi-Path (ECMP) next-hops. Set to 1 to disable ECMP routing (1 - 100).

email_portal_check_dns
string

Choices:
- disable
- enable

Enable/disable using DNS to validate email addresses collected by a captive portal.

firewall_session_dirty
string

Choices:
- check-all
- check-new
- check-policy-option

Select how to manage sessions affected by firewall policy configuration changes.

fw_session_hairpin
string

Choices:
- enable
- disable

Enable/disable checking for a matching policy each time hairpin traffic goes through the FortiGate.

| gateway string |  | Transparent mode IPv4 default gateway IP address.
| gateway6 string |  | Transparent mode IPv4 default gateway IP address.

gui_advanced_policy
string

Choices:
- enable
- disable

Enable/disable advanced policy configuration on the GUI.

gui_allow_unnamed_policy
string

Choices:
- enable
- disable

Enable/disable the requirement for policy naming on the GUI.

gui_antivirus
string

Choices:
- enable
- disable

Enable/disable AntiVirus on the GUI.

gui_ap_profile
string

Choices:
- enable
- disable

Enable/disable FortiAP profiles on the GUI.

gui_application_control
string

Choices:
- enable
- disable

Enable/disable application control on the GUI.

| gui_default_policy_columns list |  | Default columns to display for policy lists on GUI.
|  | name string / required |  | Select column name.

gui_dhcp_advanced
string

Choices:
- enable
- disable

Enable/disable advanced DHCP options on the GUI.

gui_dlp
string

Choices:
- enable
- disable

Enable/disable DLP on the GUI.

gui_dns_database
string

Choices:
- enable
- disable

Enable/disable DNS database settings on the GUI.

gui_dnsfilter
string

Choices:
- enable
- disable

Enable/disable DNS Filtering on the GUI.

gui_domain_ip_reputation
string

Choices:
- enable
- disable

Enable/disable Domain and IP Reputation on the GUI.

gui_dos_policy
string

Choices:
- enable
- disable

Enable/disable DoS policies on the GUI.

gui_dynamic_profile_display
string

Choices:
- enable
- disable

Enable/disable RADIUS Single Sign On (RSSO) on the GUI.

gui_dynamic_routing
string

Choices:
- enable
- disable

Enable/disable dynamic routing on the GUI.

gui_email_collection
string

Choices:
- enable
- disable

Enable/disable email collection on the GUI.

gui_endpoint_control
string

Choices:
- enable
- disable

Enable/disable endpoint control on the GUI.

gui_endpoint_control_advanced
string

Choices:
- enable
- disable

Enable/disable advanced endpoint control options on the GUI.

gui_explicit_proxy
string

Choices:
- enable
- disable

Enable/disable the explicit proxy on the GUI.

gui_fortiap_split_tunneling
string

Choices:
- enable
- disable

Enable/disable FortiAP split tunneling on the GUI.

gui_fortiextender_controller
string

Choices:
- enable
- disable

Enable/disable FortiExtender on the GUI.

gui_icap
string

Choices:
- enable
- disable

Enable/disable ICAP on the GUI.

gui_implicit_policy
string

Choices:
- enable
- disable

Enable/disable implicit firewall policies on the GUI.

gui_ips
string

Choices:
- enable
- disable

Enable/disable IPS on the GUI.

gui_load_balance
string

Choices:
- enable
- disable

Enable/disable server load balancing on the GUI.

gui_local_in_policy
string

Choices:
- enable
- disable

Enable/disable Local-In policies on the GUI.

gui_local_reports
string

Choices:
- enable
- disable

Enable/disable local reports on the GUI.

gui_multicast_policy
string

Choices:
- enable
- disable

Enable/disable multicast firewall policies on the GUI.

gui_multiple_interface_policy
string

Choices:
- enable
- disable

Enable/disable adding multiple interfaces to a policy on the GUI.

gui_multiple_utm_profiles
string

Choices:
- enable
- disable

Enable/disable multiple UTM profiles on the GUI.

gui_nat46_64
string

Choices:
- enable
- disable

Enable/disable NAT46 and NAT64 settings on the GUI.

gui_object_colors
string

Choices:
- enable
- disable

Enable/disable object colors on the GUI.

gui_policy_based_ipsec
string

Choices:
- enable
- disable

Enable/disable policy-based IPsec VPN on the GUI.

gui_policy_learning
string

Choices:
- enable
- disable

Enable/disable firewall policy learning mode on the GUI.

gui_replacement_message_groups
string

Choices:
- enable
- disable

Enable/disable replacement message groups on the GUI.

gui_spamfilter
string

Choices:
- enable
- disable

Enable/disable Antispam on the GUI.

gui_sslvpn_personal_bookmarks
string

Choices:
- enable
- disable

Enable/disable SSL-VPN personal bookmark management on the GUI.

gui_sslvpn_realms
string

Choices:
- enable
- disable

Enable/disable SSL-VPN realms on the GUI.

gui_switch_controller
string

Choices:
- enable
- disable

Enable/disable the switch controller on the GUI.

gui_threat_weight
string

Choices:
- enable
- disable

Enable/disable threat weight on the GUI.

gui_traffic_shaping
string

Choices:
- enable
- disable

Enable/disable traffic shaping on the GUI.

gui_voip_profile
string

Choices:
- enable
- disable

Enable/disable VoIP profiles on the GUI.

gui_vpn
string

Choices:
- enable
- disable

Enable/disable VPN tunnels on the GUI.

gui_waf_profile
string

Choices:
- enable
- disable

Enable/disable Web Application Firewall on the GUI.

gui_wan_load_balancing
string

Choices:
- enable
- disable

Enable/disable SD-WAN on the GUI.

gui_wanopt_cache
string

Choices:
- enable
- disable

Enable/disable WAN Optimization and Web Caching on the GUI.

gui_webfilter
string

Choices:
- enable
- disable

Enable/disable Web filtering on the GUI.

gui_webfilter_advanced
string

Choices:
- enable
- disable

Enable/disable advanced web filtering on the GUI.

gui_wireless_controller
string

Choices:
- enable
- disable

Enable/disable the wireless controller on the GUI.

http_external_dest
string

Choices:
- fortiweb
- forticache

Offload HTTP traffic to FortiWeb or FortiCache.

ike_dn_format
string

Choices:
- with-space
- no-space

Configure IKE ASN.1 Distinguished Name format conventions.

ike_quick_crash_detect
string

Choices:
- enable
- disable

Enable/disable IKE quick crash detection (RFC 6290).

ike_session_resume
string

Choices:
- enable
- disable

Enable/disable IKEv2 session resumption (RFC 5723).

implicit_allow_dns
string

Choices:
- enable
- disable

Enable/disable implicitly allowing DNS traffic.

inspection_mode
string

Choices:
- proxy
- flow

Inspection mode (proxy-based or flow-based).

| ip string |  | IP address and netmask.
| ip6 string |  | IPv6 address prefix for NAT mode.

link_down_access
string

Choices:
- enable
- disable

Enable/disable link down access traffic.

lldp_transmission
string

Choices:
- enable
- disable
- global

Enable/disable Link Layer Discovery Protocol (LLDP) for this VDOM or apply global settings to this VDOM.

| mac_ttl integer |  | Duration of MAC addresses in Transparent mode (300 - 8640000 sec).
| manageip string |  | Transparent mode IPv4 management IP address and netmask.
| manageip6 string |  | Transparent mode IPv6 management IP address and netmask.

multicast_forward
string

Choices:
- enable
- disable

Enable/disable multicast forwarding.

multicast_skip_policy
string

Choices:
- enable
- disable

Enable/disable allowing multicast traffic through the FortiGate without a policy check.

multicast_ttl_notchange
string

Choices:
- enable
- disable

Enable/disable preventing the FortiGate from changing the TTL for forwarded multicast packets.

ngfw_mode
string

Choices:
- profile-based
- policy-based

Next Generation Firewall (NGFW) mode.

opmode
string

Choices:
- nat
- transparent

Firewall operation mode (NAT or Transparent).

prp_trailer_action
string

Choices:
- enable
- disable

Enable/disable action to take on PRP trailer.

| sccp_port integer |  | TCP port the SCCP proxy monitors for SCCP traffic (0 - 65535).

ses_denied_traffic
string

Choices:
- enable
- disable

Enable/disable including denied session in the session table.

sip_helper
string

Choices:
- enable
- disable

Enable/disable the SIP session helper to process SIP sessions unless SIP sessions are accepted by the SIP application layer gateway (ALG).

sip_nat_trace
string

Choices:
- enable
- disable

Enable/disable recording the original SIP source IP address when NAT is used.

| sip_ssl_port integer |  | TCP port the SIP proxy monitors for SIP SSL/TLS traffic (0 - 65535).
| sip_tcp_port integer |  | TCP port the SIP proxy monitors for SIP traffic (0 - 65535).
| sip_udp_port integer |  | UDP port the SIP proxy monitors for SIP traffic (0 - 65535).

snat_hairpin_traffic
string

Choices:
- enable
- disable

Enable/disable source NAT (SNAT) for hairpin traffic.

| ssl_ssh_profile string |  | Profile for SSL/SSH inspection. Source firewall.ssl-ssh-profile.name.

status
string

Choices:
- enable
- disable

Enable/disable this VDOM.

strict_src_check
string

Choices:
- enable
- disable

Enable/disable strict source verification.

tcp_session_without_syn
string

Choices:
- enable
- disable

Enable/disable allowing TCP session without SYN flags.

utf8_spam_tagging
string

Choices:
- enable
- disable

Enable/disable converting antispam tags to UTF-8 for better non-ASCII character support.

v4_ecmp_mode
string

Choices:
- source-ip-based
- weight-based
- usage-based
- source-dest-ip-based

IPv4 Equal-cost multi-path (ECMP) routing and load balancing mode.

vpn_stats_log
string

Choices:
- ipsec
- pptp
- l2tp
- ssl

Enable/disable periodic VPN log statistics for one or more types of VPN. Separate names with a space.

| vpn_stats_period integer |  | Period to send VPN log statistics (60 - 86400 sec).

wccp_cache_engine
string

Choices:
- enable
- disable

Enable/disable WCCP cache engine.

username string |  | FortiOS or FortiGate username.
vdom string | Default: "root" | Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit.

## Notes

Note

- Requires fortiosapi library developed by Fortinet

- Run as a local_action in your playbook

## Examples

    - hosts: localhost
      vars:
       host: "192.168.122.40"
       username: "admin"
       password: ""
       vdom: "root"
       ssl_verify: "False"
      tasks:
      - name: Configure VDOM settings.
        fortios_system_settings:
          host:  "{{ host }}"
          username: "{{ username }}"
          password: "{{ password }}"
          vdom:  "{{ vdom }}"
          https: "False"
          system_settings:
            allow_linkdown_path: "enable"
            allow_subnet_overlap: "enable"
            asymroute: "enable"
            asymroute_icmp: "enable"
            asymroute6: "enable"
            asymroute6_icmp: "enable"
            bfd: "enable"
            bfd_desired_min_tx: "10"
            bfd_detect_mult: "11"
            bfd_dont_enforce_src_port: "enable"
            bfd_required_min_rx: "13"
            block_land_attack: "disable"
            central_nat: "enable"
            comments: "<your_own_value>"
            compliance_check: "enable"
            default_voip_alg_mode: "proxy-based"
            deny_tcp_with_icmp: "enable"
            device: "<your_own_value> (source system.interface.name)"
            dhcp_proxy: "enable"
            dhcp_server_ip: "<your_own_value>"
            dhcp6_server_ip: "<your_own_value>"
            discovered_device_timeout: "24"
            ecmp_max_paths: "25"
            email_portal_check_dns: "disable"
            firewall_session_dirty: "check-all"
            fw_session_hairpin: "enable"
            gateway: "<your_own_value>"
            gateway6: "<your_own_value>"
            gui_advanced_policy: "enable"
            gui_allow_unnamed_policy: "enable"
            gui_antivirus: "enable"
            gui_ap_profile: "enable"
            gui_application_control: "enable"
            gui_default_policy_columns:
             -
                name: "default_name_37"
            gui_dhcp_advanced: "enable"
            gui_dlp: "enable"
            gui_dns_database: "enable"
            gui_dnsfilter: "enable"
            gui_domain_ip_reputation: "enable"
            gui_dos_policy: "enable"
            gui_dynamic_profile_display: "enable"
            gui_dynamic_routing: "enable"
            gui_email_collection: "enable"
            gui_endpoint_control: "enable"
            gui_endpoint_control_advanced: "enable"
            gui_explicit_proxy: "enable"
            gui_fortiap_split_tunneling: "enable"
            gui_fortiextender_controller: "enable"
            gui_icap: "enable"
            gui_implicit_policy: "enable"
            gui_ips: "enable"
            gui_load_balance: "enable"
            gui_local_in_policy: "enable"
            gui_local_reports: "enable"
            gui_multicast_policy: "enable"
            gui_multiple_interface_policy: "enable"
            gui_multiple_utm_profiles: "enable"
            gui_nat46_64: "enable"
            gui_object_colors: "enable"
            gui_policy_based_ipsec: "enable"
            gui_policy_learning: "enable"
            gui_replacement_message_groups: "enable"
            gui_spamfilter: "enable"
            gui_sslvpn_personal_bookmarks: "enable"
            gui_sslvpn_realms: "enable"
            gui_switch_controller: "enable"
            gui_threat_weight: "enable"
            gui_traffic_shaping: "enable"
            gui_voip_profile: "enable"
            gui_vpn: "enable"
            gui_waf_profile: "enable"
            gui_wan_load_balancing: "enable"
            gui_wanopt_cache: "enable"
            gui_webfilter: "enable"
            gui_webfilter_advanced: "enable"
            gui_wireless_controller: "enable"
            http_external_dest: "fortiweb"
            ike_dn_format: "with-space"
            ike_quick_crash_detect: "enable"
            ike_session_resume: "enable"
            implicit_allow_dns: "enable"
            inspection_mode: "proxy"
            ip: "<your_own_value>"
            ip6: "<your_own_value>"
            link_down_access: "enable"
            lldp_transmission: "enable"
            mac_ttl: "90"
            manageip: "<your_own_value>"
            manageip6: "<your_own_value>"
            multicast_forward: "enable"
            multicast_skip_policy: "enable"
            multicast_ttl_notchange: "enable"
            ngfw_mode: "profile-based"
            opmode: "nat"
            prp_trailer_action: "enable"
            sccp_port: "99"
            ses_denied_traffic: "enable"
            sip_helper: "enable"
            sip_nat_trace: "enable"
            sip_ssl_port: "103"
            sip_tcp_port: "104"
            sip_udp_port: "105"
            snat_hairpin_traffic: "enable"
            ssl_ssh_profile: "<your_own_value> (source firewall.ssl-ssh-profile.name)"
            status: "enable"
            strict_src_check: "enable"
            tcp_session_without_syn: "enable"
            utf8_spam_tagging: "enable"
            v4_ecmp_mode: "source-ip-based"
            vpn_stats_log: "ipsec"
            vpn_stats_period: "114"
            wccp_cache_engine: "enable"

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
build string | always | Build number of the fortigate image Sample: 1547
http_method string | always | Last method used to provision the content into FortiGate Sample: PUT
http_status string | always | Last result given by FortiGate on last operation applied Sample: 200
mkey string | success | Master key (id) used in the last call to FortiGate Sample: id
name string | always | Name of the table used to fulfill the request Sample: urlfilter
path string | always | Path of the table used to fulfill the request Sample: webfilter
revision string | always | Internal revision number Sample: 17.0.2.10658
serial string | always | Serial number of the unit Sample: FGVMEVYYQT3AB5352
status string | always | Indication of the operation's result Sample: success
vdom string | always | Virtual domain used Sample: root
version string | always | Version of the FortiGate Sample: v5.6.3

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]

- This module is maintained by the Ansible Community. [community]

### Authors

- Miguel Angel Munoz (@mamunozgonzalez)

- Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.