fortinet.fortimanager.fmgr_firewall_gtp – Configure GTP.
fortinet.fortimanager.fmgr_firewall_gtp – Configure GTP.
Note
This plugin is part of the fortinet.fortimanager collection (version 2.0.1).
To install it use: ansible-galaxy collection install fortinet.fortimanager.
To use it in a playbook, specify: fortinet.fortimanager.fmgr_firewall_gtp.
New in version 2.10: of fortinet.fortimanager
Synopsis
- This module is able to configure a FortiManager device.
- Examples include all parameters and values which need to be adjusted to data sources before usage.
Parameters
| Parameter | Choices/Defaults | Comments | ||
|---|---|---|---|---|
|
adom string / required |
the parameter (adom) in requested url | |||
|
bypass_validation boolean |
|
only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters | ||
|
firewall_gtp dictionary |
the top level parameters set | |||
|
addr-notify string |
overbilling notify address | |||
|
apn list / elements=string |
no description | |||
|
action string |
|
Action. | ||
|
apnmember string |
APN member. | |||
|
id integer |
ID. | |||
|
selection-mode list / elements=string |
|
no description | ||
|
apn-filter string |
|
apn filter | ||
|
authorized-ggsns string |
Authorized GGSN group | |||
|
authorized-sgsns string |
Authorized SGSN group | |||
|
comment string |
Comment. | |||
|
context-id integer |
Overbilling context. | |||
|
control-plane-message-rate-limit integer |
control plane message rate limit | |||
|
default-apn-action string |
|
default apn action | ||
|
default-imsi-action string |
|
default imsi action | ||
|
default-ip-action string |
|
default action for encapsulated IP traffic | ||
|
default-noip-action string |
|
default action for encapsulated non-IP traffic | ||
|
default-policy-action string |
|
default advanced policy action | ||
|
denied-log string |
|
log denied | ||
|
echo-request-interval integer |
echo request interval (in seconds) | |||
|
extension-log string |
|
log in extension format | ||
|
forwarded-log string |
|
log forwarded | ||
|
global-tunnel-limit string |
Global tunnel limit. | |||
|
gtp-in-gtp string |
|
gtp in gtp | ||
|
gtpu-denied-log string |
|
Enable/disable logging of denied GTP-U packets. | ||
|
gtpu-forwarded-log string |
|
Enable/disable logging of forwarded GTP-U packets. | ||
|
gtpu-log-freq integer |
Logging of frequency of GTP-U packets. | |||
|
half-close-timeout integer |
Half-close tunnel timeout (in seconds). | |||
|
half-open-timeout integer |
Half-open tunnel timeout (in seconds). | |||
|
handover-group string |
Handover SGSN group | |||
|
ie-remove-policy list / elements=string |
no description | |||
|
id integer |
ID. | |||
|
remove-ies list / elements=string |
|
no description | ||
|
sgsn-addr string |
SGSN address name. | |||
|
ie-remover string |
|
IE removal policy. | ||
|
ie-white-list-v0v1 string |
IE white list. | |||
|
ie-white-list-v2 string |
IE white list. | |||
|
imsi list / elements=string |
no description | |||
|
action string |
|
Action. | ||
|
apnmember string |
APN member. | |||
|
id integer |
ID. | |||
|
mcc-mnc string |
MCC MNC. | |||
|
msisdn-prefix string |
MSISDN prefix. | |||
|
selection-mode list / elements=string |
|
no description | ||
|
imsi-filter string |
|
imsi filter | ||
|
interface-notify string |
overbilling interface | |||
|
invalid-reserved-field string |
|
Invalid reserved field in GTP header | ||
|
invalid-sgsns-to-log string |
Invalid SGSN group to be logged | |||
|
ip-filter string |
|
IP filter for encapsulted traffic | ||
|
ip-policy list / elements=string |
no description | |||
|
action string |
|
Action. | ||
|
dstaddr string |
Destination address name. | |||
|
id integer |
ID. | |||
|
srcaddr string |
Source address name. | |||
|
log-freq integer |
Logging of frequency of GTP-C packets. | |||
|
log-gtpu-limit integer |
the user data log limit (0-512 bytes) | |||
|
log-imsi-prefix string |
IMSI prefix for selective logging. | |||
|
log-msisdn-prefix string |
the msisdn prefix for selective logging | |||
|
max-message-length integer |
max message length | |||
|
message-filter-v0v1 string |
Message filter. | |||
|
message-filter-v2 string |
Message filter. | |||
|
min-message-length integer |
min message length | |||
|
miss-must-ie string |
|
Missing mandatory information element | ||
|
monitor-mode string |
|
GTP monitor mode | ||
|
name string |
Profile name. | |||
|
noip-filter string |
|
non-IP filter for encapsulted traffic | ||
|
noip-policy list / elements=string |
no description | |||
|
action string |
|
Action. | ||
|
end integer |
End of protocol range (0 - 255). | |||
|
id integer |
ID. | |||
|
start integer |
Start of protocol range (0 - 255). | |||
|
type string |
|
Protocol field type. | ||
|
out-of-state-ie string |
|
Out of state information element. | ||
|
out-of-state-message string |
|
Out of state GTP message | ||
|
per-apn-shaper list / elements=string |
no description | |||
|
apn string |
APN name. | |||
|
id integer |
ID. | |||
|
rate-limit integer |
Rate limit (packets/s) for create PDP context request. | |||
|
version integer |
GTP version number: 0 or 1. | |||
|
policy list / elements=string |
no description | |||
|
action string |
|
Action. | ||
|
apn-sel-mode list / elements=string |
|
no description | ||
|
apnmember string |
APN member. | |||
|
id integer |
ID. | |||
|
imei string |
IMEI(SV) pattern. | |||
|
imsi string |
IMSI prefix. | |||
|
max-apn-restriction string |
|
Maximum APN restriction value. | ||
|
messages list / elements=string |
|
no description | ||
|
msisdn string |
MSISDN prefix. | |||
|
rai string |
RAI pattern. | |||
|
rat-type list / elements=string |
|
no description | ||
|
uli string |
ULI pattern. | |||
|
policy-filter string |
|
Advanced policy filter | ||
|
port-notify integer |
overbilling notify port | |||
|
rate-limit-mode string |
|
GTP rate limit mode. | ||
|
rate-limited-log string |
|
log rate limited | ||
|
rate-sampling-interval integer |
rate sampling interval (1-3600 seconds) | |||
|
remove-if-echo-expires string |
|
remove if echo response expires | ||
|
remove-if-recovery-differ string |
|
remove upon different Recovery IE | ||
|
reserved-ie string |
|
reserved information element | ||
|
send-delete-when-timeout string |
|
send DELETE request to path endpoints when GTPv0/v1 tunnel timeout. | ||
|
send-delete-when-timeout-v2 string |
|
send DELETE request to path endpoints when GTPv2 tunnel timeout. | ||
|
spoof-src-addr string |
|
Spoofed source address for Mobile Station. | ||
|
state-invalid-log string |
|
log state invalid | ||
|
traffic-count-log string |
|
log tunnel traffic counter | ||
|
tunnel-limit integer |
tunnel limit | |||
|
tunnel-limit-log string |
|
tunnel limit | ||
|
tunnel-timeout integer |
Established tunnel timeout (in seconds). | |||
|
unknown-version-action string |
|
action for unknown gtp version | ||
|
user-plane-message-rate-limit integer |
user plane message rate limit | |||
|
warning-threshold integer |
Warning threshold for rate limiting (0 - 99 percent). | |||
|
rc_failed list / elements=string |
the rc codes list with which the conditions to fail will be overriden | |||
|
rc_succeeded list / elements=string |
the rc codes list with which the conditions to succeed will be overriden | |||
|
state string / required |
|
the directive to create, update or delete an object | ||
|
workspace_locking_adom string |
the adom to lock for FortiManager running in workspace mode, the value can be global and others including root | |||
|
workspace_locking_timeout integer |
Default: 300 |
the maximum time in seconds to wait for other user to release the workspace lock |
Notes
Note
- Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.
- To create or update an object, use state present directive.
- To delete an object, use state absent directive.
- Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded
Examples
- hosts: fortimanager-inventory
collections:
- fortinet.fortimanager
connection: httpapi
vars:
ansible_httpapi_use_ssl: True
ansible_httpapi_validate_certs: False
ansible_httpapi_port: 443
tasks:
- name: Configure GTP.
fmgr_firewall_gtp:
bypass_validation: False
workspace_locking_adom: <value in [global, custom adom including root]>
workspace_locking_timeout: 300
rc_succeeded: [0, -2, -3, ...]
rc_failed: [-2, -3, ...]
adom: <your own value>
state: <value in [present, absent]>
firewall_gtp:
addr-notify: <value of string>
apn:
-
action: <value in [allow, deny]>
apnmember: <value of string>
id: <value of integer>
selection-mode:
- ms
- net
- vrf
apn-filter: <value in [disable, enable]>
authorized-ggsns: <value of string>
authorized-sgsns: <value of string>
comment: <value of string>
context-id: <value of integer>
control-plane-message-rate-limit: <value of integer>
default-apn-action: <value in [allow, deny]>
default-imsi-action: <value in [allow, deny]>
default-ip-action: <value in [allow, deny]>
default-noip-action: <value in [allow, deny]>
default-policy-action: <value in [allow, deny]>
denied-log: <value in [disable, enable]>
echo-request-interval: <value of integer>
extension-log: <value in [disable, enable]>
forwarded-log: <value in [disable, enable]>
global-tunnel-limit: <value of string>
gtp-in-gtp: <value in [allow, deny]>
gtpu-denied-log: <value in [disable, enable]>
gtpu-forwarded-log: <value in [disable, enable]>
gtpu-log-freq: <value of integer>
half-close-timeout: <value of integer>
half-open-timeout: <value of integer>
handover-group: <value of string>
ie-remove-policy:
-
id: <value of integer>
remove-ies:
- apn-restriction
- rat-type
- rai
- uli
- imei
sgsn-addr: <value of string>
ie-remover: <value in [disable, enable]>
ie-white-list-v0v1: <value of string>
ie-white-list-v2: <value of string>
imsi:
-
action: <value in [allow, deny]>
apnmember: <value of string>
id: <value of integer>
mcc-mnc: <value of string>
msisdn-prefix: <value of string>
selection-mode:
- ms
- net
- vrf
imsi-filter: <value in [disable, enable]>
interface-notify: <value of string>
invalid-reserved-field: <value in [allow, deny]>
invalid-sgsns-to-log: <value of string>
ip-filter: <value in [disable, enable]>
ip-policy:
-
action: <value in [allow, deny]>
dstaddr: <value of string>
id: <value of integer>
srcaddr: <value of string>
log-freq: <value of integer>
log-gtpu-limit: <value of integer>
log-imsi-prefix: <value of string>
log-msisdn-prefix: <value of string>
max-message-length: <value of integer>
message-filter-v0v1: <value of string>
message-filter-v2: <value of string>
min-message-length: <value of integer>
miss-must-ie: <value in [allow, deny]>
monitor-mode: <value in [disable, enable, vdom]>
name: <value of string>
noip-filter: <value in [disable, enable]>
noip-policy:
-
action: <value in [allow, deny]>
end: <value of integer>
id: <value of integer>
start: <value of integer>
type: <value in [etsi, ietf]>
out-of-state-ie: <value in [allow, deny]>
out-of-state-message: <value in [allow, deny]>
per-apn-shaper:
-
apn: <value of string>
id: <value of integer>
rate-limit: <value of integer>
version: <value of integer>
policy:
-
action: <value in [allow, deny]>
apn-sel-mode:
- ms
- net
- vrf
apnmember: <value of string>
id: <value of integer>
imei: <value of string>
imsi: <value of string>
max-apn-restriction: <value in [all, public-1, public-2, ...]>
messages:
- create-req
- create-res
- update-req
- update-res
msisdn: <value of string>
rai: <value of string>
rat-type:
- any
- utran
- geran
- wlan
- gan
- hspa
- eutran
- virtual
- nbiot
uli: <value of string>
policy-filter: <value in [disable, enable]>
port-notify: <value of integer>
rate-limit-mode: <value in [per-profile, per-stream, per-apn]>
rate-limited-log: <value in [disable, enable]>
rate-sampling-interval: <value of integer>
remove-if-echo-expires: <value in [disable, enable]>
remove-if-recovery-differ: <value in [disable, enable]>
reserved-ie: <value in [allow, deny]>
send-delete-when-timeout: <value in [disable, enable]>
send-delete-when-timeout-v2: <value in [disable, enable]>
spoof-src-addr: <value in [allow, deny]>
state-invalid-log: <value in [disable, enable]>
traffic-count-log: <value in [disable, enable]>
tunnel-limit: <value of integer>
tunnel-limit-log: <value in [disable, enable]>
tunnel-timeout: <value of integer>
unknown-version-action: <value in [allow, deny]>
user-plane-message-rate-limit: <value of integer>
warning-threshold: <value of integer>Return Values
Common return values are documented here, the following are the fields unique to this module:
| Key | Returned | Description |
|---|---|---|
|
request_url string |
always |
The full url requested
Sample: /sys/login/user |
|
response_code integer |
always |
The status of api request
|
|
response_message string |
always |
The descriptive message of the api response
Sample: OK. |
Authors
- Link Zheng (@chillancezen)
- Jie Xue (@JieX19)
- Frank Shen (@fshen01)
- Hongbin Lu (@fgtdev-hblu)
© 2012–2018 Michael DeHaan
© 2018–2021 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/2.11/collections/fortinet/fortimanager/fmgr_firewall_gtp_module.html
