private_access_service_connections - Secure Private Access Resource

Added in version 1.0.0.

Synopsis

Secure Private Access Resource.

Use API “/resource-api/v1/private-access/service-connections”.

Requirements

The below requirements are needed on the host that executes this module.

• ansible>=2.17.0

Parameters

• state The state of the module. "present" means create or update the resource, "absent" means delete the resource.type: strchoices: ['present', 'absent']default: present
• force_behavior Specify this option to force the method to use to interact with the resource.type: strchoices: ['none', 'read', 'create', 'update', 'delete']default: none
• bypass_validation Bypass validation of the module.type: booldefault: False
• params The parameters of the module.[Required]type: dict
  • service_connection_id [Required]type: str
  • alias alias for serivce connectiontype: str
  • bgp_peer_ip BGP Routing Peer IP.type: str
  • ipsec_remote_gw IPSEC Remote Gateway IPtype: str
  • overlay_network_id integer id for overlaytype: str
  • route_map_tag route map tagtype: str
  • auth IPSEC authentication methodtype: strchoices: ['pki', 'psk']
  • ipsec_pre_shared_key IPSEC auth by pre shared key.type: str
  • ipsec_cert_name the name of IPSEC authentication certificate that uploaded to SASEtype: str
  • ipsec_ike_version IKE version for IPSECtype: strchoices: ['2']
  • ipsec_peer_name Peer PKI user name that created on SASE for IPSEC authenticationtype: str
  • backup_links type: listelements: dict
    • alias alias for serivce connection additional overlaytype: str
    • auth IPSEC authentication methodtype: strchoices: ['pki', 'psk']
    • ipsec_cert_name the name of IPSEC authentication certificate that uploaded to SASEtype: str
    • ipsec_ike_version IKE version for IPSECtype: strchoices: ['2']
    • ipsec_peer_name Peer PKI user name that created on SASE for IPSEC authenticationtype: str
    • ipsec_remote_gw IPSEC Remote Gateway IPtype: str
    • overlay_network_id integer id for overlaytype: str
    • ipsec_pre_shared_key IPSEC auth by pre shared key.type: str
  • type BGP Routing Design. Must be same as network configuration.type: strchoices: ['loopback', 'overlay']
  • region_cost Cost value to determine the priority of SASE spokes. Default cost is 5 if not provided through initial api request.type: dict
    • sjc_f1 type: int
    • lon_f1 type: int
    • fra_f1 type: int
    • iad_f1 type: int

Examples

- name: Private Access Service Connections
  hosts: fortisase
  gather_facts: false
  tasks:
    # !!!! private_access_network_configuration has to be created first
    # - name: Create/Update Private Access Network Configuration
    #   fortinet.fortisase.private_access_network_configuration:
    #     state: present
    #     params:
    #       bgp_design: "loopback"
    #       bgp_router_ids_subnet: "172.1.0.0/24"
    #       as_number: "65400"
    #       sdwan_rule_enable: true
    #       sdwan_health_check_vm: "10.255.255.100"
    #       recursive_next_hop: true
    # - name: Wait until the resource config_state is success
    #   fortinet.fortisase.fortisase_facts:
    #     selector: "private_access_network_configuration"
    #   register: result
    #   until: result.response.config_state == "success"
    #   retries: 15
    #   delay: 10

    - name: Create Private Access Service Connections
      fortinet.fortisase.private_access_service_connections:
        state: present
        params:
          service_connection_id: "placeholder, not in use in create"
          type: "loopback"
          alias: "AWS-Ireland-Primary"
          ipsec_remote_gw: "1.1.1.1"
          ipsec_ike_version: "2"
          auth: "psk"
          ipsec_pre_shared_key: "example_shared_key"
          route_map_tag: "100"
          bgp_peer_ip: "10.255.255.100"
          overlay_network_id: "100"
      register: create_result
    - name: Wait until the resource config_state in create_result is success
      fortinet.fortisase.fortisase_facts:
        selector: "private_access_service_connections"
        params:
          service_connection_id: "{{ create_result.response.id }}"
      register: result
      until: result.response.config_state == "success" or result.response.config_state == "failed"
      retries: 15
      delay: 10
      failed_when: result.response.config_state != "success"

    - name: Update Private Access Service Connections
      fortinet.fortisase.private_access_service_connections:
        state: present
        params:
          service_connection_id: "{{ create_result.response.id }}"
          ipsec_remote_gw: "1.1.1.2"
      register: update_result
    - name: Wait until the resource config_state in update_result is success
      fortinet.fortisase.fortisase_facts:
        selector: "private_access_service_connections"
        params:
          service_connection_id: "{{ update_result.response.id }}"
      register: result
      until: result.response.config_state == "success" or result.response.config_state == "failed"
      retries: 15
      delay: 10
      failed_when: result.response.config_state != "success"

    - name: Delete Private Access Service Connections
      fortinet.fortisase.private_access_service_connections:
        state: absent
        params:
          service_connection_id: "{{ create_result.response.id }}"
    - name: Wait until return error 403 (deleted successfully)
      fortinet.fortisase.fortisase_facts:
        selector: "private_access_service_connections"
        params:
          service_connection_id: "{{ create_result.response.id }}"
      register: result
      until: result.http_code == 403
      retries: 15
      delay: 10
      failed_when: false  # Never fail, regardless of HTTP 403 error

Return Values

• http_code type: intreturned: always
• response type: rawreturned: always

Authors

• Xinwei Du (@dux-fortinet)