Using lists with firewall policy about ansible-galaxy-fortios-collection

[mbdraks]

Yeap, you need to reconstruct the list and post the complete object.

Here's one example with another module:

#
---
- name: initialize empty list
  set_fact:
    pp_install_target_list: []

- name: get current pp scope members
  fortinet.fortimanager.fmgr_pm_pkg_obj:
    method: get
    url_params:
        adom: '{{ adom }}'
        pkg_path: '{{ item.policy_package }}'
  register: results

- name: register list with existing pp members
  set_fact:
    pp_install_target_list: "{{ results.meta.data['scope member'] }}"
  when: results.meta.data['scope member'] is defined

- name: append member to list
  set_fact:
    pp_install_target_list: "{{ pp_install_target_list + [ { 'name': item.device_name, 'vdom': vdom } ]}}"

- name: update policy package scope members
  fortinet.fortimanager.fmgr_pm_pkg_adom_obj:
    method: set
    url_params:
        adom: '{{ adom }}'
    params:
        - data:
            - name: '{{ item.policy_package }}'
              scope member: '{{ pp_install_target_list }}'

[JieX19]

Hi,

Yes, with_items works correctly while creating the firewall address, you loop a list of address objects using with_items function.

For the third task, the type of local_networks and remote_networks is list, you are actually iterating a list of list, that's the reason. I think you may add a third variable in vars to join the local_network and remote_network, let's name it network_pair.

[shariaty59]

@JieX19 But it's not a one to one map. As an example I may have a list of 3 firewall addresses for "srcaddr" and 20 addresses for "dstaddr". I'm not sure how to do that in a single "network_pair" var.

[shariaty59]

@JieX19 Hi,
My concern of 1x1 map from previous comment still applies but I wanted to test your suggestion. assuming the number of local and remote networks are the same, I added a new var as below:

   network_pair:
      - {local_policy: "MY-IP1",    remote_policy: "LA-IP1"}
      - {local_policy: "MY-IP2",    remote_policy: "LA-IP2"}
      - {local_policy: "MY-IP3",    remote_policy: "LA-IP3"}
      - {local_policy: "MY-IP4",    remote_policy: "LA-IP4"}
      - {local_policy: "MY-IP5",    remote_policy: "LA-IP5"}
      - {local_policy: "MY-IP6",    remote_policy: "LA-IP6"}
      - {local_policy: "MY-IP7",    remote_policy: "LA-IP7"}
      - {local_policy: "MY-IP8",    remote_policy: "LA-IP8"}

Then I changed my task to below:

  - name: Configure IPv4 policy
    fortios_firewall_policy:
      vdom:  "{{ vdom }}"
      state: "present"
      firewall_policy:
        state: "present" 
        policyid: "2002"
        name: "Policy_2002"
        action: "deny"
        srcintf:
          - name: any
        dstintf:
          - name: any
        srcaddr: 
          - name: "{{ item.local_policy }}"
        dstaddr:
          - name: "{{ item.remote_policy }}"
        service: 
          - name: 'HTTP'
          - name: 'HTTPS'
        schedule: "always" 
        nat: "disable"
        logtraffic: "all"
    with_items:
      - "{{ policy_networks }}"

So when I checked the policy on the firewall, it only had the last line in it.

- {local_policy: "MY-IP8", remote_policy: "LA-IP8"}

So apparently it loops through the list but each time the new value replaces the old one. Any thought?
Thank you,

[mbdraks]

@shariaty59

If the desired outcome is a single rule with all objects of local_networks list as source and all objects of remote_networks as dst I would change the code to create a object group for each network list and only use those groups on the rule.

This also makes maintenance easier, if you have more networks all you have to do is add to list and it would cascade to include the new network object on the proper group (which is already configured on the correct rule).

[shariaty59]

@mbdraks Thank you. That actually makes sense. Let me try that quick.

[shariaty59]

using the same "remote_networks" and "local_networks" vars.

   remote_networks:
      - {remote_network_subnet: "210.20.30.0/24",    remote_subnet_name: "LA-IP1"}
      - {remote_network_subnet: "210.20.40.100/30",  remote_subnet_name: "LA-IP2"}
      - {remote_network_subnet: "210.20.50.0/28",    remote_subnet_name: "LA-IP3"}
      - {remote_network_subnet: "210.20.60.145/32",  remote_subnet_name: "LA-IP4"}
      - {remote_network_subnet: "210.20.70.0/24",    remote_subnet_name: "LA-IP5"}
      - {remote_network_subnet: "210.20.80.16/32",   remote_subnet_name: "LA-IP6"}
      - {remote_network_subnet: "210.20.90.0/30",    remote_subnet_name: "LA-IP7"}
      - {remote_network_subnet: "210.20.140.104/32", remote_subnet_name: "LA-IP8"}

   local_networks:
      - {local_network_subnet: "10.20.30.0/24",    local_subnet_name: "MY-IP1"}
      - {local_network_subnet: "10.20.40.100/30",  local_subnet_name: "MY-IP2"}
      - {local_network_subnet: "10.20.50.0/28",    local_subnet_name: "MY-IP3"}
      - {local_network_subnet: "10.20.60.145/32",  local_subnet_name: "MY-IP4"}
      - {local_network_subnet: "10.20.70.0/24",    local_subnet_name: "MY-IP5"}
      - {local_network_subnet: "10.20.80.16/32",   local_subnet_name: "MY-IP6"}
      - {local_network_subnet: "10.20.90.0/30",    local_subnet_name: "MY-IP7"}
      - {local_network_subnet: "10.20.140.104/32", local_subnet_name: "MY-IP8"}

I added these tasks below to create the address groups:

  - name: Configure Remote IPv4 address group
    fortios_firewall_addrgrp:
      vdom:  "{{ vdom }}"
      state: "present"
      firewall_addrgrp:
        name: "MY-LA-VPN-Remote-IPs"
        visibility: "enable"
        member:
         - name: "{{ item.remote_subnet_name}}"
    with_items:
      - "{{ remote_networks }}"

  - name: Configure Local IPv4 address group
    fortios_firewall_addrgrp:
      vdom:  "{{ vdom }}"
      state: "present"
      firewall_addrgrp:
        name: "MY-LA-VPN-Local-IPs"
        visibility: "enable"
        member:
         - name: "{{ item.local_subnet_name}}"
    with_items:
      - "{{ local_networks }}"

apparently the loop is working fine but each time it goes over the list, the item gets "replaced" not added. Therefore at the end, I only see the last items below in the address groups. Please advise.

      - {remote_network_subnet: "210.20.140.104/32", remote_subnet_name: "LA-IP8"}
      - {local_network_subnet: "10.20.140.104/32", local_subnet_name: "MY-IP8"}

[shariaty59]

@mbdraks Thank you so much, I will try it later and let you know.

[chillancezen]

thank you Michel @mbdraks for supporting Ansible issues.

set_fact is really a good tool to process data internally. the syntax allows users to call many Python's native libraries.

@shariaty59 please let us know if your problem persists.
I mark this issue closed, feel free to reopen it if you need further help.

thanks,
Link