fortios_wireless_controller_vap – Configure Virtual Access Points (VAPs) in Fortinet’s FortiOS and FortiGate

New in version 2.8.

Synopsis

  • This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify wireless_controller feature and vap category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.5

Requirements

The below requirements are needed on the host that executes this module.

  • fortiosapi>=0.9.8

Parameters

Parameter Choices/Defaults Comments
host
string
FortiOS or FortiGate IP address.
https
boolean
    Choices:
  • no
  • yes ←
Indicates if the requests towards FortiGate must use HTTPS protocol.
password
string
Default:
""
FortiOS or FortiGate password.
ssl_verify
boolean
added in 2.9
    Choices:
  • no
  • yes ←
Ensures FortiGate certificate must be verified by a proper CA.
state
string
added in 2.9
    Choices:
  • present
  • absent
Indicates whether to create or remove the object. This attribute was present already in previous version in a deeper level. It has been moved out to this outer level.
username
string
FortiOS or FortiGate username.
vdom
string
Default:
"root"
Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit.
wireless_controller_vap
dictionary
Configure Virtual Access Points (VAPs).
acct_interim_interval
integer
WiFi RADIUS accounting interim interval (60 - 86400 sec).
alias
string
Alias.
auth
string
    Choices:
  • psk
  • radius
  • usergroup
Authentication protocol.
broadcast_ssid
string
    Choices:
  • enable
  • disable
Enable/disable broadcasting the SSID .
broadcast_suppression
string
    Choices:
  • dhcp-up
  • dhcp-down
  • dhcp-starvation
  • arp-known
  • arp-unknown
  • arp-reply
  • arp-poison
  • arp-proxy
  • netbios-ns
  • netbios-ds
  • ipv6
  • all-other-mc
  • all-other-bc
Optional suppression of broadcast messages. For example, you can keep DHCP messages, ARP broadcasts, and so on off of the wireless network.
captive_portal_ac_name
string
Local-bridging captive portal ac-name.
captive_portal_macauth_radius_secret
string
Secret key to access the macauth RADIUS server.
captive_portal_macauth_radius_server
string
Captive portal external RADIUS server domain name or IP address.
captive_portal_radius_secret
string
Secret key to access the RADIUS server.
captive_portal_radius_server
string
Captive portal RADIUS server domain name or IP address.
captive_portal_session_timeout_interval
integer
Session timeout interval (0 - 864000 sec).
dhcp_lease_time
integer
DHCP lease time in seconds for NAT IP address.
dhcp_option82_circuit_id_insertion
string
    Choices:
  • style-1
  • style-2
  • disable
Enable/disable DHCP option 82 circuit-id insert .
dhcp_option82_insertion
string
    Choices:
  • enable
  • disable
Enable/disable DHCP option 82 insert .
dhcp_option82_remote_id_insertion
string
    Choices:
  • style-1
  • disable
Enable/disable DHCP option 82 remote-id insert .
dynamic_vlan
string
    Choices:
  • enable
  • disable
Enable/disable dynamic VLAN assignment.
eap_reauth
string
    Choices:
  • enable
  • disable
Enable/disable EAP re-authentication for WPA-Enterprise security.
eap_reauth_intv
integer
EAP re-authentication interval (1800 - 864000 sec).
eapol_key_retries
string
    Choices:
  • disable
  • enable
Enable/disable retransmission of EAPOL-Key frames (message 3/4 and group message 1/2) .
encrypt
string
    Choices:
  • TKIP
  • AES
  • TKIP-AES
Encryption protocol to use (only available when security is set to a WPA type).
external_fast_roaming
string
    Choices:
  • enable
  • disable
Enable/disable fast roaming or pre-authentication with external APs not managed by the FortiGate .
external_logout
string
URL of external authentication logout server.
external_web
string
URL of external authentication web server.
fast_bss_transition
string
    Choices:
  • disable
  • enable
Enable/disable 802.11r Fast BSS Transition (FT) .
fast_roaming
string
    Choices:
  • enable
  • disable
Enable/disable fast-roaming, or pre-authentication, where supported by clients .
ft_mobility_domain
integer
Mobility domain identifier in FT (1 - 65535).
ft_over_ds
string
    Choices:
  • disable
  • enable
Enable/disable FT over the Distribution System (DS).
ft_r0_key_lifetime
integer
Lifetime of the PMK-R0 key in FT, 1-65535 minutes.
gtk_rekey
string
    Choices:
  • enable
  • disable
Enable/disable GTK rekey for WPA security.
gtk_rekey_intv
integer
GTK rekey interval (1800 - 864000 sec).
hotspot20_profile
string
Hotspot 2.0 profile name.
intra_vap_privacy
string
    Choices:
  • enable
  • disable
Enable/disable blocking communication between clients on the same SSID (called intra-SSID privacy) .
ip
string
IP address and subnet mask for the local standalone NAT subnet.
key
string
WEP Key.
keyindex
integer
WEP key index (1 - 4).
ldpc
string
    Choices:
  • disable
  • rx
  • tx
  • rxtx
VAP low-density parity-check (LDPC) coding configuration.
local_authentication
string
    Choices:
  • enable
  • disable
Enable/disable AP local authentication.
local_bridging
string
    Choices:
  • enable
  • disable
Enable/disable bridging of wireless and Ethernet interfaces on the FortiAP .
local_lan
string
    Choices:
  • allow
  • deny
Allow/deny traffic destined for a Class A, B, or C private IP address .
local_standalone
string
    Choices:
  • enable
  • disable
Enable/disable AP local standalone .
local_standalone_nat
string
    Choices:
  • enable
  • disable
Enable/disable AP local standalone NAT mode.
mac_auth_bypass
string
    Choices:
  • enable
  • disable
Enable/disable MAC authentication bypass.
mac_filter
string
    Choices:
  • enable
  • disable
Enable/disable MAC filtering to block wireless clients by mac address.
mac_filter_list
list
Create a list of MAC addresses for MAC address filtering.
id
integer / required
ID.
mac
string
MAC address.
mac_filter_policy
string
    Choices:
  • allow
  • deny
Deny or allow the client with this MAC address.
mac_filter_policy_other
string
    Choices:
  • allow
  • deny
Allow or block clients with MAC addresses that are not in the filter list.
max_clients
integer
Maximum number of clients that can connect simultaneously to the VAP .
max_clients_ap
integer
Maximum number of clients that can connect simultaneously to each radio .
me_disable_thresh
integer
Disable multicast enhancement when this many clients are receiving multicast traffic.
mesh_backhaul
string
    Choices:
  • enable
  • disable
Enable/disable using this VAP as a WiFi mesh backhaul . This entry is only available when security is set to a WPA type or open.
mpsk
string
    Choices:
  • enable
  • disable
Enable/disable multiple pre-shared keys (PSKs.)
mpsk_concurrent_clients
integer
Number of pre-shared keys (PSKs) to allow if multiple pre-shared keys are enabled.
mpsk_key
list
Pre-shared keys that can be used to connect to this virtual access point.
comment
string
Comment.
concurrent_clients
string
Number of clients that can connect using this pre-shared key.
key_name
string
Pre-shared key name.
passphrase
string
WPA Pre-shared key.
multicast_enhance
string
    Choices:
  • enable
  • disable
Enable/disable converting multicast to unicast to improve performance .
multicast_rate
string
    Choices:
  • 0
  • 6000
  • 12000
  • 24000
Multicast rate (0, 6000, 12000, or 24000 kbps).
name
string / required
Virtual AP name.
okc
string
    Choices:
  • disable
  • enable
Enable/disable Opportunistic Key Caching (OKC) .
passphrase
string
WPA pre-shard key (PSK) to be used to authenticate WiFi users.
pmf
string
    Choices:
  • disable
  • enable
  • optional
Protected Management Frames (PMF) support .
pmf_assoc_comeback_timeout
integer
Protected Management Frames (PMF) comeback maximum timeout (1-20 sec).
pmf_sa_query_retry_timeout
integer
Protected Management Frames (PMF) SA query retry timeout interval (1 - 5 100s of msec).
portal_message_override_group
string
Replacement message group for this VAP (only available when security is set to a captive portal type).
portal_message_overrides
dictionary
Individual message overrides.
auth_disclaimer_page
string
Override auth-disclaimer-page message with message from portal-message-overrides group.
auth_login_failed_page
string
Override auth-login-failed-page message with message from portal-message-overrides group.
auth_login_page
string
Override auth-login-page message with message from portal-message-overrides group.
auth_reject_page
string
Override auth-reject-page message with message from portal-message-overrides group.
portal_type
string
    Choices:
  • auth
  • auth+disclaimer
  • disclaimer
  • email-collect
  • cmcc
  • cmcc-macauth
  • auth-mac
Captive portal functionality. Configure how the captive portal authenticates users and whether it includes a disclaimer.
probe_resp_suppression
string
    Choices:
  • enable
  • disable
Enable/disable probe response suppression (to ignore weak signals) .
probe_resp_threshold
string
Minimum signal level/threshold in dBm required for the AP response to probe requests (-95 to -20).
ptk_rekey
string
    Choices:
  • enable
  • disable
Enable/disable PTK rekey for WPA-Enterprise security.
ptk_rekey_intv
integer
PTK rekey interval (1800 - 864000 sec).
qos_profile
string
Quality of service profile name.
quarantine
string
    Choices:
  • enable
  • disable
Enable/disable station quarantine .
radio_2g_threshold
string
Minimum signal level/threshold in dBm required for the AP response to receive a packet in 2.4G band (-95 to -20).
radio_5g_threshold
string
Minimum signal level/threshold in dBm required for the AP response to receive a packet in 5G band(-95 to -20).
radio_sensitivity
string
    Choices:
  • enable
  • disable
Enable/disable software radio sensitivity (to ignore weak signals) .
radius_mac_auth
string
    Choices:
  • enable
  • disable
Enable/disable RADIUS-based MAC authentication of clients .
radius_mac_auth_server
string
RADIUS-based MAC authentication server.
radius_mac_auth_usergroups
list
Selective user groups that are permitted for RADIUS mac authentication.
name
string / required
User group name.
radius_server
string
RADIUS server to be used to authenticate WiFi users.
rates_11a
string
    Choices:
  • 1
  • 1-basic
  • 2
  • 2-basic
  • 5.5
  • 5.5-basic
  • 11
  • 11-basic
  • 6
  • 6-basic
  • 9
  • 9-basic
  • 12
  • 12-basic
  • 18
  • 18-basic
  • 24
  • 24-basic
  • 36
  • 36-basic
  • 48
  • 48-basic
  • 54
  • 54-basic
Allowed data rates for 802.11a.
rates_11ac_ss12
string
    Choices:
  • mcs0/1
  • mcs1/1
  • mcs2/1
  • mcs3/1
  • mcs4/1
  • mcs5/1
  • mcs6/1
  • mcs7/1
  • mcs8/1
  • mcs9/1
  • mcs10/1
  • mcs11/1
  • mcs0/2
  • mcs1/2
  • mcs2/2
  • mcs3/2
  • mcs4/2
  • mcs5/2
  • mcs6/2
  • mcs7/2
  • mcs8/2
  • mcs9/2
  • mcs10/2
  • mcs11/2
Allowed data rates for 802.11ac with 1 or 2 spatial streams.
rates_11ac_ss34
string
    Choices:
  • mcs0/3
  • mcs1/3
  • mcs2/3
  • mcs3/3
  • mcs4/3
  • mcs5/3
  • mcs6/3
  • mcs7/3
  • mcs8/3
  • mcs9/3
  • mcs10/3
  • mcs11/3
  • mcs0/4
  • mcs1/4
  • mcs2/4
  • mcs3/4
  • mcs4/4
  • mcs5/4
  • mcs6/4
  • mcs7/4
  • mcs8/4
  • mcs9/4
  • mcs10/4
  • mcs11/4
Allowed data rates for 802.11ac with 3 or 4 spatial streams.
rates_11bg
string
    Choices:
  • 1
  • 1-basic
  • 2
  • 2-basic
  • 5.5
  • 5.5-basic
  • 11
  • 11-basic
  • 6
  • 6-basic
  • 9
  • 9-basic
  • 12
  • 12-basic
  • 18
  • 18-basic
  • 24
  • 24-basic
  • 36
  • 36-basic
  • 48
  • 48-basic
  • 54
  • 54-basic
Allowed data rates for 802.11b/g.
rates_11n_ss12
string
    Choices:
  • mcs0/1
  • mcs1/1
  • mcs2/1
  • mcs3/1
  • mcs4/1
  • mcs5/1
  • mcs6/1
  • mcs7/1
  • mcs8/2
  • mcs9/2
  • mcs10/2
  • mcs11/2
  • mcs12/2
  • mcs13/2
  • mcs14/2
  • mcs15/2
Allowed data rates for 802.11n with 1 or 2 spatial streams.
rates_11n_ss34
string
    Choices:
  • mcs16/3
  • mcs17/3
  • mcs18/3
  • mcs19/3
  • mcs20/3
  • mcs21/3
  • mcs22/3
  • mcs23/3
  • mcs24/4
  • mcs25/4
  • mcs26/4
  • mcs27/4
  • mcs28/4
  • mcs29/4
  • mcs30/4
  • mcs31/4
Allowed data rates for 802.11n with 3 or 4 spatial streams.
schedule
string
VAP schedule name.
security
string
    Choices:
  • open
  • captive-portal
  • wep64
  • wep128
  • wpa-personal
  • wpa-personal+captive-portal
  • wpa-enterprise
  • wpa-only-personal
  • wpa-only-personal+captive-portal
  • wpa-only-enterprise
  • wpa2-only-personal
  • wpa2-only-personal+captive-portal
  • wpa2-only-enterprise
  • osen
Security mode for the wireless interface .
security_exempt_list
string
Optional security exempt list for captive portal authentication.
security_obsolete_option
string
    Choices:
  • enable
  • disable
Enable/disable obsolete security options.
security_redirect_url
string
Optional URL for redirecting users after they pass captive portal authentication.
selected_usergroups
list
Selective user groups that are permitted to authenticate.
name
string / required
User group name.
split_tunneling
string
    Choices:
  • enable
  • disable
Enable/disable split tunneling .
ssid
string
IEEE 802.11 service set identifier (SSID) for the wireless interface. Users who wish to use the wireless network must configure their computers to access this SSID name.
state
string
    Choices:
  • present
  • absent
Deprecated
Starting with Ansible 2.9 we recommend using the top-level 'state' parameter.
Indicates whether to create or remove the object.
tkip_counter_measure
string
    Choices:
  • enable
  • disable
Enable/disable TKIP counter measure.
usergroup
list
Firewall user group to be used to authenticate WiFi users.
name
string / required
User group name.
utm_profile
string
UTM profile name.
vdom
string
Name of the VDOM that the Virtual AP has been added to. Source system.vdom.name.
vlan_auto
string
    Choices:
  • enable
  • disable
Enable/disable automatic management of SSID VLAN interface.
vlan_pool
list
VLAN pool.
id
integer / required
ID.
wtp_group
string
WTP group name.
vlan_pooling
string
    Choices:
  • wtp-group
  • round-robin
  • hash
  • disable
Enable/disable VLAN pooling, to allow grouping of multiple wireless controller VLANs into VLAN pools . When set to wtp-group, VLAN pooling occurs with VLAN assignment by wtp-group.
vlanid
integer
Optional VLAN ID.
voice_enterprise
string
    Choices:
  • disable
  • enable
Enable/disable 802.11k and 802.11v assisted Voice-Enterprise roaming .

Notes

Note

  • Requires fortiosapi library developed by Fortinet

  • Run as a local_action in your playbook

Examples

- hosts: localhost
  vars:
   host: "192.168.122.40"
   username: "admin"
   password: ""
   vdom: "root"
   ssl_verify: "False"
  tasks:
  - name: Configure Virtual Access Points (VAPs).
    fortios_wireless_controller_vap:
      host:  "{{ host }}"
      username: "{{ username }}"
      password: "{{ password }}"
      vdom:  "{{ vdom }}"
      https: "False"
      state: "present"
      wireless_controller_vap:
        acct_interim_interval: "3"
        alias: "<your_own_value>"
        auth: "psk"
        broadcast_ssid: "enable"
        broadcast_suppression: "dhcp-up"
        captive_portal_ac_name: "<your_own_value>"
        captive_portal_macauth_radius_secret: "<your_own_value>"
        captive_portal_macauth_radius_server: "<your_own_value>"
        captive_portal_radius_secret: "<your_own_value>"
        captive_portal_radius_server: "<your_own_value>"
        captive_portal_session_timeout_interval: "13"
        dhcp_lease_time: "14"
        dhcp_option82_circuit_id_insertion: "style-1"
        dhcp_option82_insertion: "enable"
        dhcp_option82_remote_id_insertion: "style-1"
        dynamic_vlan: "enable"
        eap_reauth: "enable"
        eap_reauth_intv: "20"
        eapol_key_retries: "disable"
        encrypt: "TKIP"
        external_fast_roaming: "enable"
        external_logout: "<your_own_value>"
        external_web: "<your_own_value>"
        fast_bss_transition: "disable"
        fast_roaming: "enable"
        ft_mobility_domain: "28"
        ft_over_ds: "disable"
        ft_r0_key_lifetime: "30"
        gtk_rekey: "enable"
        gtk_rekey_intv: "32"
        hotspot20_profile: "<your_own_value>"
        intra_vap_privacy: "enable"
        ip: "<your_own_value>"
        key: "<your_own_value>"
        keyindex: "37"
        ldpc: "disable"
        local_authentication: "enable"
        local_bridging: "enable"
        local_lan: "allow"
        local_standalone: "enable"
        local_standalone_nat: "enable"
        mac_auth_bypass: "enable"
        mac_filter: "enable"
        mac_filter_list:
         -
            id:  "47"
            mac: "<your_own_value>"
            mac_filter_policy: "allow"
        mac_filter_policy_other: "allow"
        max_clients: "51"
        max_clients_ap: "52"
        me_disable_thresh: "53"
        mesh_backhaul: "enable"
        mpsk: "enable"
        mpsk_concurrent_clients: "56"
        mpsk_key:
         -
            comment: "Comment."
            concurrent_clients: "<your_own_value>"
            key_name: "<your_own_value>"
            passphrase: "<your_own_value>"
        multicast_enhance: "enable"
        multicast_rate: "0"
        name: "default_name_64"
        okc: "disable"
        passphrase: "<your_own_value>"
        pmf: "disable"
        pmf_assoc_comeback_timeout: "68"
        pmf_sa_query_retry_timeout: "69"
        portal_message_override_group: "<your_own_value>"
        portal_message_overrides:
            auth_disclaimer_page: "<your_own_value>"
            auth_login_failed_page: "<your_own_value>"
            auth_login_page: "<your_own_value>"
            auth_reject_page: "<your_own_value>"
        portal_type: "auth"
        probe_resp_suppression: "enable"
        probe_resp_threshold: "<your_own_value>"
        ptk_rekey: "enable"
        ptk_rekey_intv: "80"
        qos_profile: "<your_own_value>"
        quarantine: "enable"
        radio_2g_threshold: "<your_own_value>"
        radio_5g_threshold: "<your_own_value>"
        radio_sensitivity: "enable"
        radius_mac_auth: "enable"
        radius_mac_auth_server: "<your_own_value>"
        radius_mac_auth_usergroups:
         -
            name: "default_name_89"
        radius_server: "<your_own_value>"
        rates_11a: "1"
        rates_11ac_ss12: "mcs0/1"
        rates_11ac_ss34: "mcs0/3"
        rates_11bg: "1"
        rates_11n_ss12: "mcs0/1"
        rates_11n_ss34: "mcs16/3"
        schedule: "<your_own_value>"
        security: "open"
        security_exempt_list: "<your_own_value>"
        security_obsolete_option: "enable"
        security_redirect_url: "<your_own_value>"
        selected_usergroups:
         -
            name: "default_name_103"
        split_tunneling: "enable"
        ssid: "<your_own_value>"
        tkip_counter_measure: "enable"
        usergroup:
         -
            name: "default_name_108"
        utm_profile: "<your_own_value>"
        vdom: "<your_own_value> (source system.vdom.name)"
        vlan_auto: "enable"
        vlan_pool:
         -
            id:  "113"
            wtp_group: "<your_own_value>"
        vlan_pooling: "wtp-group"
        vlanid: "116"
        voice_enterprise: "disable"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key Returned Description
build
string
always
Build number of the fortigate image

Sample:
1547
http_method
string
always
Last method used to provision the content into FortiGate

Sample:
PUT
http_status
string
always
Last result given by FortiGate on last operation applied

Sample:
200
mkey
string
success
Master key (id) used in the last call to FortiGate

Sample:
id
name
string
always
Name of the table used to fulfill the request

Sample:
urlfilter
path
string
always
Path of the table used to fulfill the request

Sample:
webfilter
revision
string
always
Internal revision number

Sample:
17.0.2.10658
serial
string
always
Serial number of the unit

Sample:
FGVMEVYYQT3AB5352
status
string
always
Indication of the operation's result

Sample:
success
vdom
string
always
Virtual domain used

Sample:
root
version
string
always
Version of the FortiGate

Sample:
v5.6.3


Status

Authors

  • Miguel Angel Munoz (@mamunozgonzalez)

  • Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.