engine - Operations on single or cluster layer 3 firewalls¶

New in version 2.5.

Synopsis
Requirements (on host that executes module)
Options
Examples
Return Values
Notes
- Author
- Status

Synopsis ¶

Create or delete a Stonesoft Layer 3 Firewall on the Stonesoft Management Center.

Requirements (on host that executes module)¶

smc-python

Options ¶

parameter required default choices comments

antivirus

no

yes
no

Enable Anti-Virus engine on the FW

backup_mgt

no

Specify an interface by ID that will be the backup management. If the interface is a VLAN, specify in '2.4' format (interface 2, vlan 4).

bgp

no

If enabling BGP on the engine, provide BGP related settings

**Dictionary object bgp**
parameter	required	choices	comments
router_id	no		Optional router ID to identify this BGP peer
bgp_peering	no		BGP Peerings to add to specified interfaces.
announced_network	no	network group host	Announced networks identify the network and optional route map for internal networks announced over BGP. The list should be a dict with the key identifying the announced network type from SMC. The key should have a dict with name and route_map (optional) if the element should have an associated route_map.
antispoofing_network	no	network group host	Antispoofing networks are automatically added to the route antispoofing configuration. The dict should have a key specifying the element type from SMC. The dict key value should be a list of the element types by name.
enabled	no	yes no	Set to true or false to specify whether to configure BGP
autonomous_system	no		The autonomous system for this engine. Provide additional arguments to allow for get or create logic

cluster_mode

no

standby

balancing
standby

How to perform clustering, either balancing or standby

comment

no

Optional comment tag for the engine

default_nat

no

yes
no

Whether to enable default NAT on the FW. Default NAT will identify internal networks and use the external interface IP for outgoing traffic

delete_undefined_interfaces

no

yes
no

Delete interfaces from engine cluster that are not defined in the YAML file. This can be used as a strategy to remove interfaces. One option is to retrieve the full engine json using engine_facts as yaml, then remove the interfaces from the yaml and set this to True.

domain_server_address

no

A list of IP addresses to use as DNS resolvers for the FW. Required to enable Antivirus, GTI and URL Filtering on the NGFW.

file_reputation

no

yes
no

Enable file reputation

interfaces

yes

Define the interface settings for this cluster interface, such as address, network and node id.

**Dictionary object interfaces**
parameter	required	comments
comment	no	Optional comment for this interface. If you want to unset the interface comment, set to an empty string or define with no value
macaddress	no	The mac address to assign to the cluster virtual IP interface. This is required if cluster_virtual
zone_ref	no	Optional zone name for this interface
network_value	no	The cluster netmask for the cluster_vip. Required if cluster_virtual
cluster_virtual	no	The cluster virtual (shared) IP address for all cluster members. Not required if only creating NDI's
nodes	yes	List of the nodes for this interface
interface_id	yes	The cluster nic ID for this interface. Required.

location

no

Location identifier for the engine. Used when engine is behind NAT. If a location is set on the engine and you want to reset to unspecified, then use the keyword None.

name

yes

The name of the firewall cluster to add or delete

primary_heartbeat

no

Specify an interface for the primary heartbeat interface. This will default to the same interface as primary_mgt if not specified.

primary_mgt

yes

Identify the interface to be specified as management. When creating a new cluster, the primary mgt must be a non-VLAN interface. You can move it to a VLAN interface after creation.

skip_interfaces

no

yes
no

Optionally skip the analysis of interface changes. This is only relevant when running the playbook against an already created engine. This must be false if attempting to add interfaces.

smc_address

no

FQDN with port of SMC. The default value is the environment variable SMC_ADDRESS

smc_alt_filepath

no

Provide an alternate path location to read the credentials from. File is expected to be stored in ~.smcrc. If provided, url and api_key settings are not required and will be ignored.

smc_api_key

no

API key for api client. The default value is the environment variable SMC_API_KEY Required if url

smc_api_version

no

Optional API version to connect to. If none is provided, the latest SMC version API will be used based on the Management Center version. Can be set though the environment variable SMC_API_VERSION

smc_domain

no

Optional domain to log in to. If no domain is provided, 'Shared Domain' is used. Can be set throuh the environment variable SMC_DOMAIN

smc_extra_args

no

Extra arguments to pass to login constructor. These are generally only used if specifically requested by support personnel.

**Dictionary object smc_extra_args**
parameter	required	default	choices	comments
verify	no	True	yes no	Is the connection to SMC is HTTPS, you can set this to True, or provide a path to a client certificate to verify the SMC SSL certificate. You can also explicitly set this to False.

smc_logging

no

Optionally enable SMC API logging to a file

**Dictionary object smc_logging**
parameter	required	default	choices	comments
path	yes			Full path to the log file
level	no			Log level as specified by the standard python logging library, in int format. Default setting is logging.DEBUG.

smc_timeout

no

Optional timeout for connections to the SMC. Can be set through environment SMC_TIMEOUT

snmp

no

SNMP settings for the engine

**Dictionary object snmp**
parameter	required	choices	comments
snmp_agent	yes		The name of the SNMP agent from within the SMC
enabled	no	yes no	Set this to False if enabled on the engine and wanting to remove the configuration.
snmp_interface	no		A list of interface IDs to enable SNMP. If enabling on a VLAN, use '2.3' syntax. If omitted, snmp is enabled on all interfaces
snmp_location	no		Optional SNMP location string to add the SNMP configuration

state

no

present

present
absent

Create or delete a firewall cluster

Examples ¶

- name: Create a single layer 3 firewall
  register: result
  l3fw:
    smc_logging:
      level: 10
      path: ansible-smc.log
    name: myfw
    mgmt_interface: 10
    interfaces:
      - interface_id: 0
        address: 1.1.1.2
        network_value: 1.1.1.0/16
        zone_ref: management
      - interface_id: 10
        address: 10.10.10.1
        network_value: 10.10.10.0/24
        zone_ref: external
        enable_vpn: yes
      - interface_id: 11
      - interface_id: 1000
        address: 11.11.11.1
        network_value: 11.11.11.0/24
        zone_ref: awsvpn
        type: tunnel_interface
    domain_server_address:
      - 10.0.0.1
      - 10.0.0.2
    default_nat: yes
    enable_antivirus: yes
    enable_gti: yes
    enable_sidewinder_proxy: yes
    tags:
      - footag

# Delete a layer 3 firewall, using environment variables for credentials
- name: delete firewall by name
  l3fw:
    name: myfirewall
    state: 'absent'

Return Values ¶

Common return values are documented Return Values, the following are the fields unique to this module:

name	description	returned	type	sample
state	The current state of the element		dict
changed	Whether or not the change succeeded	always	bool

Notes ¶

Note

Login credential information is either obtained by providing them directly to the task/play, specifying an alt_filepath to read the credentials from to the play, or from environment variables (in that order). See http://smc-python.readthedocs.io/en/latest/pages/session.html for more information.

Author ¶

David LePage (@gabstopper)

Status ¶

This module is flagged as preview which means that it is not guaranteed to have a backwards compatible interface.