fmgr_secprof_voip – VOIP security profiles in FMG — Ansible Documentation

- AnsibleFest
- Products
- Community
- Webinars & Training
- Blog

Documentation

# fmgr_secprof_voip – VOIP security profiles in FMG

New in version 2.8.

- Synopsis

- Parameters

- Notes

- Examples

- Return Values

- Status

## Synopsis

- Manage VOIP security profiles in FortiManager via API

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
adom - | Default: "root" | The ADOM the configuration should belong to.
comment - |  | Comment.
mode - | Choices: add ← set delete update | Sets one of three modes for managing the object. Allows use of soft-adds instead of overwriting existing values
name - |  | Profile name.
sccp - |  | EXPERTS ONLY! KNOWLEDGE OF FMGR JSON API IS REQUIRED! List of multiple child objects to be added. Expects a list of dictionaries. Dictionaries must use FortiManager API parameters, not the ansible ones listed below. If submitted, all other prefixed sub-parameters ARE IGNORED. This object is MUTUALLY EXCLUSIVE with its options. We expect that you know what you are doing with these list parameters, and are leveraging the JSON API Guide. WHEN IN DOUBT, USE THE SUB OPTIONS BELOW INSTEAD TO CREATE OBJECTS WITH MULTIPLE TASKS
sccp_block_mcast - | Choices: disable enable | Enable/disable block multicast RTP connections. choice | disable | Disable status. choice | enable | Enable status.
sccp_log_call_summary - | Choices: disable enable | Enable/disable log summary of SCCP calls. choice | disable | Disable status. choice | enable | Enable status.
sccp_log_violations - | Choices: disable enable | Enable/disable logging of SCCP violations. choice | disable | Disable status. choice | enable | Enable status.
sccp_max_calls - |  | Maximum calls per minute per SCCP client (max 65535).
sccp_status - | Choices: disable enable | Enable/disable SCCP. choice | disable | Disable status. choice | enable | Enable status.
sccp_verify_header - | Choices: disable enable | Enable/disable verify SCCP header content. choice | disable | Disable status. choice | enable | Enable status.
sip - |  | EXPERTS ONLY! KNOWLEDGE OF FMGR JSON API IS REQUIRED! List of multiple child objects to be added. Expects a list of dictionaries. Dictionaries must use FortiManager API parameters, not the ansible ones listed below. If submitted, all other prefixed sub-parameters ARE IGNORED. This object is MUTUALLY EXCLUSIVE with its options. We expect that you know what you are doing with these list parameters, and are leveraging the JSON API Guide. WHEN IN DOUBT, USE THE SUB OPTIONS BELOW INSTEAD TO CREATE OBJECTS WITH MULTIPLE TASKS
sip_ack_rate - |  | ACK request rate limit (per second, per policy).
sip_block_ack - | Choices: disable enable | Enable/disable block ACK requests. choice | disable | Disable status. choice | enable | Enable status.
sip_block_bye - | Choices: disable enable | Enable/disable block BYE requests. choice | disable | Disable status. choice | enable | Enable status.
sip_block_cancel - | Choices: disable enable | Enable/disable block CANCEL requests. choice | disable | Disable status. choice | enable | Enable status.
sip_block_geo_red_options - | Choices: disable enable | Enable/disable block OPTIONS requests, but OPTIONS requests still notify for redundancy. choice | disable | Disable status. choice | enable | Enable status.
sip_block_info - | Choices: disable enable | Enable/disable block INFO requests. choice | disable | Disable status. choice | enable | Enable status.
sip_block_invite - | Choices: disable enable | Enable/disable block INVITE requests. choice | disable | Disable status. choice | enable | Enable status.
sip_block_long_lines - | Choices: disable enable | Enable/disable block requests with headers exceeding max-line-length. choice | disable | Disable status. choice | enable | Enable status.
sip_block_message - | Choices: disable enable | Enable/disable block MESSAGE requests. choice | disable | Disable status. choice | enable | Enable status.
sip_block_notify - | Choices: disable enable | Enable/disable block NOTIFY requests. choice | disable | Disable status. choice | enable | Enable status.
sip_block_options - | Choices: disable enable | Enable/disable block OPTIONS requests and no OPTIONS as notifying message for redundancy either. choice | disable | Disable status. choice | enable | Enable status.
sip_block_prack - | Choices: disable enable | Enable/disable block prack requests. choice | disable | Disable status. choice | enable | Enable status.
sip_block_publish - | Choices: disable enable | Enable/disable block PUBLISH requests. choice | disable | Disable status. choice | enable | Enable status.
sip_block_refer - | Choices: disable enable | Enable/disable block REFER requests. choice | disable | Disable status. choice | enable | Enable status.
sip_block_register - | Choices: disable enable | Enable/disable block REGISTER requests. choice | disable | Disable status. choice | enable | Enable status.
sip_block_subscribe - | Choices: disable enable | Enable/disable block SUBSCRIBE requests. choice | disable | Disable status. choice | enable | Enable status.
sip_block_unknown - | Choices: disable enable | Block unrecognized SIP requests (enabled by default). choice | disable | Disable status. choice | enable | Enable status.
sip_block_update - | Choices: disable enable | Enable/disable block UPDATE requests. choice | disable | Disable status. choice | enable | Enable status.
sip_bye_rate - |  | BYE request rate limit (per second, per policy).
sip_call_keepalive - |  | Continue tracking calls with no RTP for this many minutes.
sip_cancel_rate - |  | CANCEL request rate limit (per second, per policy).
sip_contact_fixup - | Choices: disable enable | Fixup contact anyway even if contact's IP|port doesn't match session's IP|port. choice | disable | Disable status. choice | enable | Enable status.
sip_hnt_restrict_source_ip - | Choices: disable enable | Enable/disable restrict RTP source IP to be the same as SIP source IP when HNT is enabled. choice | disable | Disable status. choice | enable | Enable status.
sip_hosted_nat_traversal - | Choices: disable enable | Hosted NAT Traversal (HNT). choice | disable | Disable status. choice | enable | Enable status.
sip_info_rate - |  | INFO request rate limit (per second, per policy).
sip_invite_rate - |  | INVITE request rate limit (per second, per policy).
sip_ips_rtp - | Choices: disable enable | Enable/disable allow IPS on RTP. choice | disable | Disable status. choice | enable | Enable status.
sip_log_call_summary - | Choices: disable enable | Enable/disable logging of SIP call summary. choice | disable | Disable status. choice | enable | Enable status.
sip_log_violations - | Choices: disable enable | Enable/disable logging of SIP violations. choice | disable | Disable status. choice | enable | Enable status.
sip_malformed_header_allow - | Choices: pass discard respond | Action for malformed Allow header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_call_id - | Choices: pass discard respond | Action for malformed Call-ID header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_contact - | Choices: pass discard respond | Action for malformed Contact header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_content_length - | Choices: pass discard respond | Action for malformed Content-Length header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_content_type - | Choices: pass discard respond | Action for malformed Content-Type header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_cseq - | Choices: pass discard respond | Action for malformed CSeq header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_expires - | Choices: pass discard respond | Action for malformed Expires header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_from - | Choices: pass discard respond | Action for malformed From header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_max_forwards - | Choices: pass discard respond | Action for malformed Max-Forwards header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_p_asserted_identity - | Choices: pass discard respond | Action for malformed P-Asserted-Identity header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_rack - | Choices: pass discard respond | Action for malformed RAck header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_record_route - | Choices: pass discard respond | Action for malformed Record-Route header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_route - | Choices: pass discard respond | Action for malformed Route header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_rseq - | Choices: pass discard respond | Action for malformed RSeq header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_sdp_a - | Choices: pass discard respond | Action for malformed SDP a line. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_sdp_b - | Choices: pass discard respond | Action for malformed SDP b line. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_sdp_c - | Choices: pass discard respond | Action for malformed SDP c line. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_sdp_i - | Choices: pass discard respond | Action for malformed SDP i line. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_sdp_k - | Choices: pass discard respond | Action for malformed SDP k line. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_sdp_m - | Choices: pass discard respond | Action for malformed SDP m line. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_sdp_o - | Choices: pass discard respond | Action for malformed SDP o line. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_sdp_r - | Choices: pass discard respond | Action for malformed SDP r line. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_sdp_s - | Choices: pass discard respond | Action for malformed SDP s line. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_sdp_t - | Choices: pass discard respond | Action for malformed SDP t line. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_sdp_v - | Choices: pass discard respond | Action for malformed SDP v line. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_sdp_z - | Choices: pass discard respond | Action for malformed SDP z line. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_to - | Choices: pass discard respond | Action for malformed To header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_header_via - | Choices: pass discard respond | Action for malformed VIA header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_malformed_request_line - | Choices: pass discard respond | Action for malformed request line. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_max_body_length - |  | Maximum SIP message body length (0 meaning no limit).
sip_max_dialogs - |  | Maximum number of concurrent calls/dialogs (per policy).
sip_max_idle_dialogs - |  | Maximum number established but idle dialogs to retain (per policy).
sip_max_line_length - |  | Maximum SIP header line length (78-4096).
sip_message_rate - |  | MESSAGE request rate limit (per second, per policy).
sip_nat_trace - | Choices: disable enable | Enable/disable preservation of original IP in SDP i line. choice | disable | Disable status. choice | enable | Enable status.
sip_no_sdp_fixup - | Choices: disable enable | Enable/disable no SDP fix-up. choice | disable | Disable status. choice | enable | Enable status.
sip_notify_rate - |  | NOTIFY request rate limit (per second, per policy).
sip_open_contact_pinhole - | Choices: disable enable | Enable/disable open pinhole for non-REGISTER Contact port. choice | disable | Disable status. choice | enable | Enable status.
sip_open_record_route_pinhole - | Choices: disable enable | Enable/disable open pinhole for Record-Route port. choice | disable | Disable status. choice | enable | Enable status.
sip_open_register_pinhole - | Choices: disable enable | Enable/disable open pinhole for REGISTER Contact port. choice | disable | Disable status. choice | enable | Enable status.
sip_open_via_pinhole - | Choices: disable enable | Enable/disable open pinhole for Via port. choice | disable | Disable status. choice | enable | Enable status.
sip_options_rate - |  | OPTIONS request rate limit (per second, per policy).
sip_prack_rate - |  | PRACK request rate limit (per second, per policy).
sip_preserve_override - | Choices: disable enable | Override i line to preserve original IPS (default| append). choice | disable | Disable status. choice | enable | Enable status.
sip_provisional_invite_expiry_time - |  | Expiry time for provisional INVITE (10 - 3600 sec).
sip_publish_rate - |  | PUBLISH request rate limit (per second, per policy).
sip_refer_rate - |  | REFER request rate limit (per second, per policy).
sip_register_contact_trace - | Choices: disable enable | Enable/disable trace original IP/port within the contact header of REGISTER requests. choice | disable | Disable status. choice | enable | Enable status.
sip_register_rate - |  | REGISTER request rate limit (per second, per policy).
sip_rfc2543_branch - | Choices: disable enable | Enable/disable support via branch compliant with RFC 2543. choice | disable | Disable status. choice | enable | Enable status.
sip_rtp - | Choices: disable enable | Enable/disable create pinholes for RTP traffic to traverse firewall. choice | disable | Disable status. choice | enable | Enable status.
sip_ssl_algorithm - | Choices: high medium low | Relative strength of encryption algorithms accepted in negotiation. choice | high | High encryption. Allow only AES and ChaCha. choice | medium | Medium encryption. Allow AES, ChaCha, 3DES, and RC4. choice | low | Low encryption. Allow AES, ChaCha, 3DES, RC4, and DES.
sip_ssl_auth_client - |  | Require a client certificate and authenticate it with the peer/peergrp.
sip_ssl_auth_server - |  | Authenticate the server's certificate with the peer/peergrp.
sip_ssl_client_certificate - |  | Name of Certificate to offer to server if requested.
sip_ssl_client_renegotiation - | Choices: allow deny secure | Allow/block client renegotiation by server. choice | allow | Allow a SSL client to renegotiate. choice | deny | Abort any SSL connection that attempts to renegotiate. choice | secure | Reject any SSL connection that does not offer a RFC 5746 Secure Renegotiation Indication.
sip_ssl_max_version - | Choices: ssl-3.0 tls-1.0 tls-1.1 tls-1.2 | Highest SSL/TLS version to negotiate. choice | ssl-3.0 | SSL 3.0. choice | tls-1.0 | TLS 1.0. choice | tls-1.1 | TLS 1.1. choice | tls-1.2 | TLS 1.2.
sip_ssl_min_version - | Choices: ssl-3.0 tls-1.0 tls-1.1 tls-1.2 | Lowest SSL/TLS version to negotiate. choice | ssl-3.0 | SSL 3.0. choice | tls-1.0 | TLS 1.0. choice | tls-1.1 | TLS 1.1. choice | tls-1.2 | TLS 1.2.
sip_ssl_mode - | Choices: off full | SSL/TLS mode for encryption &amp; decryption of traffic. choice | off | No SSL. choice | full | Client to FortiGate and FortiGate to Server SSL.
sip_ssl_pfs - | Choices: require deny allow | SSL Perfect Forward Secrecy. choice | require | PFS mandatory. choice | deny | PFS rejected. choice | allow | PFS allowed.
sip_ssl_send_empty_frags - | Choices: disable enable | Send empty fragments to avoid attack on CBC IV (SSL 3.0 &amp; TLS 1.0 only). choice | disable | Do not send empty fragments. choice | enable | Send empty fragments.
sip_ssl_server_certificate - |  | Name of Certificate return to the client in every SSL connection.
sip_status - | Choices: disable enable | Enable/disable SIP. choice | disable | Disable status. choice | enable | Enable status.
sip_strict_register - | Choices: disable enable | Enable/disable only allow the registrar to connect. choice | disable | Disable status. choice | enable | Enable status.
sip_subscribe_rate - |  | SUBSCRIBE request rate limit (per second, per policy).
sip_unknown_header - | Choices: pass discard respond | Action for unknown SIP header. choice | pass | Bypass malformed messages. choice | discard | Discard malformed messages. choice | respond | Respond with error code.
sip_update_rate - |  | UPDATE request rate limit (per second, per policy).

## Notes

Note

- Full Documentation at https://ftnt-ansible-docs.readthedocs.io/en/latest/.

## Examples

    - name: DELETE Profile
      fmgr_secprof_voip:
        name: "Ansible_VOIP_Profile"
        mode: "delete"

    - name: Create FMGR_VOIP_PROFILE
      fmgr_secprof_voip:
        mode: "set"
        adom: "root"
        name: "Ansible_VOIP_Profile"
        comment: "Created by Ansible"
        sccp: {block-mcast: "enable", log-call-summary: "enable", log-violations: "enable", status: "enable"}

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
api_result string | always | full API response, includes status code and message

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]

- This module is maintained by the Ansible Community. [community]

### Authors

- Luke Weighall (@lweighall)

- Andrew Welsh (@Ghilli3)

- Jim Huber (@p4r4n0y1ng)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.