# fmgr_device_provision_template – Manages Device Provisioning Templates in FortiManager

New in version 2.8.

- Synopsis

- Parameters

- Notes

- Examples

- Return Values

- Status

## Synopsis

- Allows the editing and assignment of device provisioning templates in FortiManager.

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---

admin_enable_fortiguard
-

Choices:
- none
- direct
- this-fmg

Enables FortiGuard security updates to their default settings.

admin_fortianalyzer_target - |  | Configures faz target.
admin_fortiguard_target - |  | Configures fortiguard target. admin_enable_fortiguard must be set to "direct".

admin_gui_theme
-

Choices:
- green
- red
- blue
- melongene
- mariner

Changes the admin gui theme.

admin_http_port - |  | Non-SSL admin gui port number.
admin_https_port - |  | SSL admin gui port number.

admin_https_redirect
-

Choices:
- enable
- disable

Enables or disables https redirect from http.

admin_language
-

Choices:
- english
- simch
- japanese
- korean
- spanish
- trach
- french
- portuguese

Sets the admin gui language.

admin_switch_controller
-

Choices:
- enable
- disable

Enables or disables the switch controller.

admin_timeout - |  | Admin timeout in minutes.
adom - / required |  | The ADOM the configuration should belong to.
delete_provisioning_template - |  | If specified, all other options are ignored. The specified provisioning template will be deleted.
device_unique_name - / required |  | The unique device's name that you are editing.
dns_primary_ipv4 - |  | primary ipv4 dns forwarder.
dns_secondary_ipv4 - |  | secondary ipv4 dns forwarder.
dns_suffix - |  | Sets the local dns domain suffix.

mode
-

Choices:
- add ←
- set
- delete
- update

Sets one of three modes for managing the object.
Allows use of soft-adds instead of overwriting existing values.

ntp_auth
-

Choices:
- enable
- disable

Enables or disables ntp authentication.

ntp_auth_pwd - |  | Sets the ntp auth password.
ntp_server - |  | Only used with custom ntp_type -- specifies IP of server to sync to -- comma separated ip addresses for multiples.

ntp_status
-

Choices:
- enable
- disable

Enables or disables ntp.

ntp_sync_interval - |  | Sets the interval in minutes for ntp sync.

ntp_type
-

Choices:
- fortiguard
- custom

Enables fortiguard servers or custom servers are the ntp source.

ntp_v3
-

Choices:
- enable
- disable

Enables or disables ntpv3 (default is ntpv4).

provision_targets - / required |  | The friendly names of devices in FortiManager to assign the provisioning template to. CSV separated list.
provisioning_template - / required |  | The provisioning template you want to apply (default = default).

smtp_conn_sec
-

Choices:
- none
- starttls
- smtps

defines the ssl level for smtp.

smtp_password - |  | SMTP password.
smtp_port - |  | SMTP port number.
smtp_replyto - |  | SMTP reply to address.
smtp_server - |  | SMTP server ipv4 address.
smtp_source_ipv4 - |  | SMTP source ip address.
smtp_username - |  | SMTP auth username.

smtp_validate_cert
-

Choices:
- enable
- disable

Enables or disables valid certificate checking for smtp.

snmp_status
-

Choices:
- enable
- disable

Enables or disables SNMP globally.

snmp_v2c_id - |  | Primary key for the snmp community. this must be unique!
snmp_v2c_name - |  | Specifies the v2c community name.
snmp_v2c_query_hosts_ipv4 - |  | - IPv4 addresses or subnets that are allowed to query SNMP v2c, comma separated ("10.7.220.59 255.255.255.0, 10.7.220.0 255.255.255.0").
snmp_v2c_query_port - |  | Sets the snmp v2c community query port.

snmp_v2c_query_status
-

Choices:
- enable
- disable

Enables or disables the v2c community specified for queries.

snmp_v2c_status
-

Choices:
- enable
- disable

Enables or disables the v2c community specified.

snmp_v2c_trap_hosts_ipv4 - |  | - IPv4 addresses of the hosts that should get SNMP v2c traps, comma separated, must include mask ("10.7.220.59 255.255.255.255, 10.7.220.60 255.255.255.255").
snmp_v2c_trap_port - |  | Sets the snmp v2c community trap port.
snmp_v2c_trap_src_ipv4 - |  | Source ip the traps should come from IPv4.

snmp_v2c_trap_status
-

Choices:
- enable
- disable

Enables or disables the v2c community specified for traps.

snmpv3_auth_proto
-

Choices:
- md5
- sha

SNMPv3 auth protocol.

snmpv3_auth_pwd - |  | SNMPv3 auth pwd __ currently not encrypted! ensure this file is locked down permissions wise!
snmpv3_name - |  | SNMPv3 user name.
snmpv3_notify_hosts - |  | List of ipv4 hosts to send snmpv3 traps to. Comma separated IPv4 list.

snmpv3_priv_proto
-

Choices:
- aes
- des
- aes256
- aes256cisco

SNMPv3 priv protocol.

snmpv3_priv_pwd - |  | SNMPv3 priv pwd currently not encrypted! ensure this file is locked down permissions wise!

snmpv3_queries
-

Choices:
- enable
- disable

Allow snmpv3_queries.

snmpv3_query_port - |  | SNMPv3 query port.

snmpv3_security_level
-

Choices:
- no-auth-no-priv
- auth-no-priv
- auth-priv

SNMPv3 security level.

snmpv3_source_ip - |  | SNMPv3 source ipv4 address for traps.

snmpv3_status
-

Choices:
- enable
- disable

SNMPv3 user is enabled or disabled.

snmpv3_trap_rport - |  | SNMPv3 trap remote port.

snmpv3_trap_status
-

Choices:
- enable
- disable

SNMPv3 traps is enabled or disabled.

syslog_certificate - |  | Certificate used to communicate with Syslog server if encryption on.

syslog_enc_algorithm
-

Choices:
- high
- low
- disable ←
- high-medium

Enable/disable reliable syslogging with TLS encryption.
choice | high | SSL communication with high encryption algorithms.
choice | low | SSL communication with low encryption algorithms.
choice | disable | Disable SSL communication.
choice | high-medium | SSL communication with high and medium encryption algorithms.

syslog_facility
-

Choices:
- kernel
- user
- mail
- daemon
- auth
- syslog ←
- lpr
- news
- uucp
- cron
- authpriv
- ftp
- ntp
- audit
- alert
- clock
- local0
- local1
- local2
- local3
- local4
- local5
- local6
- local7

Remote syslog facility.
choice | kernel | Kernel messages.
choice | user | Random user-level messages.
choice | mail | Mail system.
choice | daemon | System daemons.
choice | auth | Security/authorization messages.
choice | syslog | Messages generated internally by syslog.
choice | lpr | Line printer subsystem.
choice | news | Network news subsystem.
choice | uucp | Network news subsystem.
choice | cron | Clock daemon.
choice | authpriv | Security/authorization messages (private).
choice | ftp | FTP daemon.
choice | ntp | NTP daemon.
choice | audit | Log audit.
choice | alert | Log alert.
choice | clock | Clock daemon.
choice | local0 | Reserved for local use.
choice | local1 | Reserved for local use.
choice | local2 | Reserved for local use.
choice | local3 | Reserved for local use.
choice | local4 | Reserved for local use.
choice | local5 | Reserved for local use.
choice | local6 | Reserved for local use.
choice | local7 | Reserved for local use.

syslog_filter
-

Choices:
- emergency
- alert
- critical
- error
- warning
- notification
- information
- debug

Sets the logging level for syslog.

syslog_mode
-

Choices:
- udp ←
- legacy-reliable
- reliable

Remote syslog logging over UDP/Reliable TCP.
choice | udp | Enable syslogging over UDP.
choice | legacy-reliable | Enable legacy reliable syslogging by RFC3195 (Reliable Delivery for Syslog).
choice | reliable | Enable reliable syslogging by RFC6587 (Transmission of Syslog Messages over TCP).

syslog_port - |  | Syslog port that will be set.
syslog_server - |  | Server the syslogs will be sent to.

syslog_status
-

Choices:
- enable
- disable

Enables or disables syslogs.

## Notes

Note

- Full Documentation at https://ftnt-ansible-docs.readthedocs.io/en/latest/.

## Examples

    - name: SET SNMP SYSTEM INFO
      fmgr_device_provision_template:
        provisioning_template: "default"
        snmp_status: "enable"
        mode: "set"

    - name: SET SNMP SYSTEM INFO ANSIBLE ADOM
      fmgr_device_provision_template:
        provisioning_template: "default"
        snmp_status: "enable"
        mode: "set"
        adom: "ansible"

    - name: SET SNMP SYSTEM INFO different template (SNMPv2)
      fmgr_device_provision_template:
        provisioning_template: "ansibleTest"
        snmp_status: "enable"
        mode: "set"
        adom: "ansible"
        snmp_v2c_query_port: "162"
        snmp_v2c_trap_port: "161"
        snmp_v2c_status: "enable"
        snmp_v2c_trap_status: "enable"
        snmp_v2c_query_status: "enable"
        snmp_v2c_name: "ansibleV2c"
        snmp_v2c_id: "1"
        snmp_v2c_trap_src_ipv4: "10.7.220.41"
        snmp_v2c_trap_hosts_ipv4: "10.7.220.59 255.255.255.255, 10.7.220.60 255.255.255.255"
        snmp_v2c_query_hosts_ipv4: "10.7.220.59 255.255.255.255, 10.7.220.0 255.255.255.0"

    - name: SET SNMP SYSTEM INFO different template (SNMPv3)
      fmgr_device_provision_template:
        provisioning_template: "ansibleTest"
        snmp_status: "enable"
        mode: "set"
        adom: "ansible"
        snmpv3_auth_proto: "sha"
        snmpv3_auth_pwd: "fortinet"
        snmpv3_name: "ansibleSNMPv3"
        snmpv3_notify_hosts: "10.7.220.59,10.7.220.60"
        snmpv3_priv_proto: "aes256"
        snmpv3_priv_pwd: "fortinet"
        snmpv3_queries: "enable"
        snmpv3_query_port: "161"
        snmpv3_security_level: "auth_priv"
        snmpv3_source_ip: "0.0.0.0"
        snmpv3_status: "enable"
        snmpv3_trap_rport: "162"
        snmpv3_trap_status: "enable"

    - name: SET SYSLOG INFO
      fmgr_device_provision_template:
        provisioning_template: "ansibleTest"
        mode: "set"
        adom: "ansible"
        syslog_server: "10.7.220.59"
        syslog_port: "514"
        syslog_mode: "disable"
        syslog_status: "enable"
        syslog_filter: "information"

    - name: SET NTP TO FORTIGUARD
      fmgr_device_provision_template:
        provisioning_template: "ansibleTest"
        mode: "set"
        adom: "ansible"
        ntp_status: "enable"
        ntp_sync_interval: "60"
        type: "fortiguard"

    - name: SET NTP TO CUSTOM SERVER
      fmgr_device_provision_template:
        provisioning_template: "ansibleTest"
        mode: "set"
        adom: "ansible"
        ntp_status: "enable"
        ntp_sync_interval: "60"
        ntp_type: "custom"
        ntp_server: "10.7.220.32,10.7.220.1"
        ntp_auth: "enable"
        ntp_auth_pwd: "fortinet"
        ntp_v3: "disable"

    - name: SET ADMIN GLOBAL SETTINGS
      fmgr_device_provision_template:
        provisioning_template: "ansibleTest"
        mode: "set"
        adom: "ansible"
        admin_https_redirect: "enable"
        admin_https_port: "4433"
        admin_http_port: "8080"
        admin_timeout: "30"
        admin_language: "english"
        admin_switch_controller: "enable"
        admin_gui_theme: "blue"
        admin_enable_fortiguard: "direct"
        admin_fortiguard_target: "10.7.220.128"
        admin_fortianalyzer_target: "10.7.220.61"

    - name: SET CUSTOM SMTP SERVER
      fmgr_device_provision_template:
        provisioning_template: "ansibleTest"
        mode: "set"
        adom: "ansible"
        smtp_username: "ansible"
        smtp_password: "fortinet"
        smtp_port: "25"
        smtp_replyto: "ansible@do-not-reply.com"
        smtp_conn_sec: "starttls"
        smtp_server: "10.7.220.32"
        smtp_source_ipv4: "0.0.0.0"
        smtp_validate_cert: "disable"

    - name: SET DNS SERVERS
      fmgr_device_provision_template:
        provisioning_template: "ansibleTest"
        mode: "set"
        adom: "ansible"
        dns_suffix: "ansible.local"
        dns_primary_ipv4: "8.8.8.8"
        dns_secondary_ipv4: "4.4.4.4"

    - name: SET PROVISIONING TEMPLATE DEVICE TARGETS IN FORTIMANAGER
      fmgr_device_provision_template:
        provisioning_template: "ansibleTest"
        mode: "set"
        adom: "ansible"
        provision_targets: "FGT1, FGT2"

    - name: DELETE ENTIRE PROVISIONING TEMPLATE
      fmgr_device_provision_template:
        delete_provisioning_template: "ansibleTest"
        mode: "delete"
        adom: "ansible"

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
api_result string | always | full API response, includes status code and message

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]

- This module is maintained by the Ansible Community. [community]

### Authors

- Luke Weighall (@lweighall)

- Andrew Welsh (@Ghilli3)

- Jim Huber (@p4r4n0y1ng)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.