Module fortigate¶

Typedefs¶

typedef fortigate::common::enable_disable_t¶

Base type string
Type constraint (self in ['enable', 'disable'])

typedef fortigate::common::name_t¶

Base type string
Type constraint (std::length(self) <= 79)

typedef fortigate::vpn_ipsec_phase2_interface::comments¶

Base type string
Type constraint (std::length(self) <= 255)

typedef fortigate::vpn_ipsec_phase1_interface::interface¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::vpn_ipsec_phase2_interface::name¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::policyid¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967294))

typedef fortigate::router_prefix_list::rule::action¶

Base type string
Type constraint (self in ['permit', 'deny'])

typedef fortigate::firewall__dos_policy::anomaly::quarantine¶

Base type string
Type constraint (self in ['none', 'attacker'])

typedef fortigate::firewall__dos_policy::anomaly::threshold¶

Base type int
Type constraint ((self >= 1) and (self <= 2147483647))

typedef fortigate::firewall__dos_policy::anomaly::threshold_default_¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::firewall_address::associated_interface¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_address6::cache_ttl¶

Base type int
Type constraint ((self >= 0) and (self <= 86400))

typedef fortigate::firewall_address::clearpass_spt¶

Base type string
Type constraint (self in ['unknown', 'healthy', 'quarantine', 'checkup', 'transient', 'infected'])

typedef fortigate::system_interface::color¶

Base type int
Type constraint ((self >= 0) and (self <= 32))

typedef fortigate::system_sdwan::members::comment¶

Base type string
Type constraint (std::length(self) <= 255)

typedef fortigate::firewall_address6::country¶

Base type string
Type constraint (std::length(self) <= 2)

typedef fortigate::firewall_address6::epg_name¶

Base type string
Type constraint (std::length(self) <= 255)

typedef fortigate::firewall_address::filter¶

Base type string
Type constraint (std::length(self) <= 2047)

typedef fortigate::firewall_address6::fqdn¶

Base type string
Type constraint (std::length(self) <= 255)

typedef fortigate::firewall_address6::obj_id¶

Base type string
Type constraint (std::length(self) <= 255)

typedef fortigate::firewall_address::obj_tag¶

Base type string
Type constraint (std::length(self) <= 255)

typedef fortigate::firewall_address::obj_type¶

Base type string
Type constraint (self in ['ip', 'mac'])

typedef fortigate::firewall_address::organization¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_address::policy_group¶

Base type string
Type constraint (std::length(self) <= 15)

typedef fortigate::firewall_address6::sdn¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_address::sdn_addr_type¶

Base type string
Type constraint (self in ['private', 'public', 'all'])

typedef fortigate::firewall_address6::sdn_tag¶

Base type string
Type constraint (std::length(self) <= 15)

typedef fortigate::firewall_address::sub_type¶

Base type string
Type constraint (self in ['sdn', 'clearpass-spt', 'fsso', 'ems-tag', 'fortivoice-tag', 'fortinac-tag', 'fortipolicy-tag', 'swc-tag'])

typedef fortigate::firewall_address::subnet_name¶

Base type string
Type constraint (std::length(self) <= 255)

typedef fortigate::firewall_address::tag_detection_level¶

Base type string
Type constraint (std::length(self) <= 15)

typedef fortigate::firewall_address::tag_type¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::firewall_address6::tenant¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::vpn_ipsec_phase1_interface::type¶

Base type string
Type constraint (self in ['static', 'dynamic', 'ddns'])

typedef fortigate::firewall_address::wildcard_fqdn¶

Base type string
Type constraint (std::length(self) <= 255)

typedef fortigate::firewall_address6::host_type¶

Base type string
Type constraint (self in ['any', 'specific'])

typedef fortigate::firewall_address6::template¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::system_sdwan::neighbor::ip¶

Base type string
Type constraint (std::length(self) <= 45)

typedef fortigate::firewall_address::macaddr::macaddr¶

Base type string
Type constraint (std::length(self) <= 127)

typedef fortigate::system_interface::client_options::value¶

Base type string
Type constraint (std::length(self) <= 312)

typedef fortigate::system_interface::tagging::category¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::firewall_local_in_policy6::intf¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_admin::schedule¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_multicast_policy6::dstintf¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_sdwan::service::end_port¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::vpn_ipsec_phase1_interface::ipv6_exclude_range::id¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::vpn_ipsec_phase2_interface::protocol¶

Base type int
Type constraint ((self >= 0) and (self <= 255))

typedef fortigate::firewall_multicast_policy6::srcintf¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_sdwan::service::start_port¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::firewall_shaping_policy::traffic_shaper¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::application_list¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_interface::auth_cert¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::auth_redirect_addr¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::firewall_policy::av_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::cifs_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::decrypted_traffic_mirror¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::dlp_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::dnsfilter_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::emailfilter_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::file_filter_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_settings::firewall_session_dirty¶

Base type string
Type constraint (self in ['check-all', 'check-new', 'check-policy-option'])

typedef fortigate::firewall_policy::fsso_agent_for_ntlm¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::geoip_match¶

Base type string
Type constraint (self in ['physical-location', 'registered-location'])

typedef fortigate::firewall_policy::icap_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::identity_based_route¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::inspection_mode¶

Base type string
Type constraint (self in ['proxy', 'flow'])

typedef fortigate::firewall_policy::ips_sensor¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::ips_voip_filter¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::logtraffic¶

Base type string
Type constraint (self in ['all', 'utm', 'disable'])

typedef fortigate::firewall_shaping_policy::per_ip_shaper¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::profile_group¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::profile_protocol_options¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::profile_type¶

Base type string
Type constraint (self in ['single', 'group'])

typedef fortigate::firewall_policy::redirect_url¶

Base type string
Type constraint (std::length(self) <= 1023)

typedef fortigate::system_interface::replacemsg_override_group¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::reputation_direction¶

Base type string
Type constraint (self in ['source', 'destination'])

typedef fortigate::firewall_policy::reputation_direction6¶

Base type string
Type constraint (self in ['source', 'destination'])

typedef fortigate::firewall_policy::reputation_minimum¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::firewall_policy::reputation_minimum6¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::firewall_policy::sctp_filter_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::ssh_filter_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::ssl_ssh_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::tcp_mss_receiver¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::firewall_policy::tcp_mss_sender¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::firewall_policy::tcp_session_without_syn¶

Base type string
Type constraint (self in ['all', 'data-only', 'disable'])

typedef fortigate::firewall_shaping_policy::traffic_shaper_reverse¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::videofilter_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::vlan_cos_fwd¶

Base type int
Type constraint ((self >= 0) and (self <= 7))

typedef fortigate::firewall_policy::vlan_cos_rev¶

Base type int
Type constraint ((self >= 0) and (self <= 7))

typedef fortigate::firewall_policy::voip_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::vpntunnel¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::waf_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::wanopt_detection¶

Base type string
Type constraint (self in ['active', 'passive', 'off'])

typedef fortigate::firewall_policy::wanopt_passive_opt¶

Base type string
Type constraint (self in ['default', 'transparent', 'non-transparent'])

typedef fortigate::firewall_policy::wanopt_peer¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::wanopt_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::webfilter_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_policy::webproxy_forward_server¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::firewall_policy::webproxy_profile¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::firewall_policy::ztna_tags_match_logic¶

Base type string
Type constraint (self in ['or', 'and'])

typedef fortigate::firewall_policy::custom_log_fields::field_id¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::firewall_shaping_policy::class_id¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::vpn_ipsec_phase1_interface::ip_version¶

Base type string
Type constraint (self in ['4', '6'])

typedef fortigate::fortiflex::cloud_services¶

Base type string
Type constraint (self in ['FAMS', 'SWNM', 'AFAC', 'FAZC'])

typedef fortigate::fortiflex::fg_services¶

Base type string
Type constraint (self in ['IPS', 'AVDB', 'FURLDNS', 'FGSA', 'DLDB', 'FAIS'])

typedef fortigate::router_bgp::additional_path_select¶

Base type int
Type constraint ((self >= 2) and (self <= 255))

typedef fortigate::router_bgp::additional_path_select6¶

Base type int
Type constraint ((self >= 2) and (self <= 255))

typedef fortigate::router_bgp::additional_path_select_vpnv4¶

Base type int
Type constraint ((self >= 2) and (self <= 255))

typedef fortigate::router_bgp::confederation_identifier¶

Base type int
Type constraint ((self >= 1) and (self <= 4294967295))

typedef fortigate::router_bgp::dampening_max_suppress_time¶

Base type int
Type constraint ((self >= 1) and (self <= 255))

typedef fortigate::router_bgp::dampening_reachability_half_life¶

Base type int
Type constraint ((self >= 1) and (self <= 45))

typedef fortigate::router_bgp::dampening_reuse¶

Base type int
Type constraint ((self >= 1) and (self <= 20000))

typedef fortigate::router_bgp::dampening_route_map¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::dampening_suppress¶

Base type int
Type constraint ((self >= 1) and (self <= 20000))

typedef fortigate::router_bgp::dampening_unreachability_half_life¶

Base type int
Type constraint ((self >= 1) and (self <= 45))

typedef fortigate::router_bgp::default_local_preference¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::router_bgp::distance_external¶

Base type int
Type constraint ((self >= 1) and (self <= 255))

typedef fortigate::router_bgp::distance_internal¶

Base type int
Type constraint ((self >= 1) and (self <= 255))

typedef fortigate::router_bgp::distance_local¶

Base type int
Type constraint ((self >= 1) and (self <= 255))

typedef fortigate::router_bgp::graceful_restart_time¶

Base type int
Type constraint ((self >= 1) and (self <= 3600))

typedef fortigate::router_bgp::graceful_stalepath_time¶

Base type int
Type constraint ((self >= 1) and (self <= 3600))

typedef fortigate::router_bgp::graceful_update_delay¶

Base type int
Type constraint ((self >= 1) and (self <= 3600))

typedef fortigate::router_bgp::neighbor_group::holdtime_timer¶

Base type int
Type constraint ((self >= 3) and (self <= 65535))

typedef fortigate::router_bgp::keepalive_timer¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::router_bgp::scan_time¶

Base type int
Type constraint ((self >= 5) and (self <= 60))

typedef fortigate::router_bgp::tag_resolve_mode¶

Base type string
Type constraint (self in ['disable', 'preferred', 'merge'])

typedef fortigate::vpn_ipsec_phase1_interface::distance¶

Base type int
Type constraint ((self >= 1) and (self <= 255))

typedef fortigate::router_bgp::admin_distance::route_list¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::additional_path¶

Base type string
Type constraint (self in ['send', 'receive', 'both', 'disable'])

typedef fortigate::router_bgp::neighbor_group::additional_path6¶

Base type string
Type constraint (self in ['send', 'receive', 'both', 'disable'])

typedef fortigate::router_bgp::neighbor_group::additional_path_vpnv4¶

Base type string
Type constraint (self in ['send', 'receive', 'both', 'disable'])

typedef fortigate::router_bgp::neighbor_group::adv_additional_path¶

Base type int
Type constraint ((self >= 2) and (self <= 255))

typedef fortigate::router_bgp::neighbor_group::adv_additional_path6¶

Base type int
Type constraint ((self >= 2) and (self <= 255))

typedef fortigate::router_bgp::neighbor_group::adv_additional_path_vpnv4¶

Base type int
Type constraint ((self >= 2) and (self <= 255))

typedef fortigate::router_bgp::neighbor_group::advertisement_interval¶

Base type int
Type constraint ((self >= 0) and (self <= 600))

typedef fortigate::router_bgp::neighbor_group::allowas_in¶

Base type int
Type constraint ((self >= 1) and (self <= 10))

typedef fortigate::router_bgp::neighbor_group::allowas_in6¶

Base type int
Type constraint ((self >= 1) and (self <= 10))

typedef fortigate::router_bgp::neighbor_group::allowas_in_vpnv4¶

Base type int
Type constraint ((self >= 1) and (self <= 10))

typedef fortigate::router_bgp::neighbor_group::attribute_unchanged¶

Base type string
Type constraint (self in ['as-path', 'med', 'next-hop'])

typedef fortigate::router_bgp::neighbor_group::attribute_unchanged6¶

Base type string
Type constraint (self in ['as-path', 'med', 'next-hop'])

typedef fortigate::router_bgp::neighbor_group::attribute_unchanged_vpnv4¶

Base type string
Type constraint (self in ['as-path', 'med', 'next-hop'])

typedef fortigate::router_bgp::neighbor_group::capability_orf¶

Base type string
Type constraint (self in ['none', 'receive', 'send', 'both'])

typedef fortigate::router_bgp::neighbor_group::capability_orf6¶

Base type string
Type constraint (self in ['none', 'receive', 'send', 'both'])

typedef fortigate::router_bgp::neighbor_group::connect_timer¶

Base type int
Type constraint ((self >= 1) and (self <= 65535))

typedef fortigate::router_bgp::neighbor_group::default_originate_routemap¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::default_originate_routemap6¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_interface::description¶

Base type string
Type constraint (std::length(self) <= 255)

typedef fortigate::router_bgp::neighbor_group::distribute_list_in¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::distribute_list_in6¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::distribute_list_in_vpnv4¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::distribute_list_out¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::distribute_list_out6¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::distribute_list_out_vpnv4¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::ebgp_multihop_ttl¶

Base type int
Type constraint ((self >= 1) and (self <= 255))

typedef fortigate::router_bgp::neighbor_group::filter_list_in¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::filter_list_in6¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::filter_list_out¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::filter_list_out6¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::keep_alive_timer¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::router_bgp::neighbor_group::maximum_prefix¶

Base type int
Type constraint ((self >= 1) and (self <= 4294967295))

typedef fortigate::router_bgp::neighbor_group::maximum_prefix6¶

Base type int
Type constraint ((self >= 1) and (self <= 4294967295))

typedef fortigate::router_bgp::neighbor_group::maximum_prefix_threshold¶

Base type int
Type constraint ((self >= 1) and (self <= 100))

typedef fortigate::router_bgp::neighbor_group::maximum_prefix_threshold6¶

Base type int
Type constraint ((self >= 1) and (self <= 100))

typedef fortigate::router_bgp::neighbor_group::maximum_prefix_threshold_vpnv4¶

Base type int
Type constraint ((self >= 1) and (self <= 100))

typedef fortigate::router_bgp::neighbor_group::maximum_prefix_vpnv4¶

Base type int
Type constraint ((self >= 1) and (self <= 4294967295))

typedef fortigate::router_bgp::neighbor_group::prefix_list_in¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::prefix_list_in6¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::prefix_list_in_vpnv4¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::prefix_list_out¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::prefix_list_out6¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::prefix_list_out_vpnv4¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::restart_time¶

Base type int
Type constraint ((self >= 0) and (self <= 3600))

typedef fortigate::router_bgp::neighbor_group::retain_stale_time¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::router_bgp::neighbor_group::route_map_in¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::route_map_in6¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::route_map_in_vpnv4¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::route_map_out¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::route_map_out6¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::route_map_out6_preferable¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::route_map_out_preferable¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::route_map_out_vpnv4¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::route_map_out_vpnv4_preferable¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::send_community¶

Base type string
Type constraint (self in ['standard', 'extended', 'both', 'disable'])

typedef fortigate::router_bgp::neighbor_group::send_community6¶

Base type string
Type constraint (self in ['standard', 'extended', 'both', 'disable'])

typedef fortigate::router_bgp::neighbor_group::send_community_vpnv4¶

Base type string
Type constraint (self in ['standard', 'extended', 'both', 'disable'])

typedef fortigate::router_bgp::neighbor_group::unsuppress_map¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::unsuppress_map6¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor_group::update_source¶

Base type string
Type constraint (std::length(self) <= 15)

typedef fortigate::system_sdwan::members::weight¶

Base type int
Type constraint ((self >= 1) and (self <= 255))

typedef fortigate::router_bgp::neighbor::conditional_advertise6::advertise_routemap¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::neighbor::conditional_advertise6::condition_type¶

Base type string
Type constraint (self in ['exist', 'non-exist'])

typedef fortigate::router_bgp::neighbor_range6::max_neighbor_num¶

Base type int
Type constraint ((self >= 1) and (self <= 1000))

typedef fortigate::router_bgp::neighbor_range6::neighbor_group¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::router_bgp::network6::network_import_check¶

Base type string
Type constraint (self in ['global', 'enable', 'disable'])

typedef fortigate::router_bgp::vrf::leak_target::route_map¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_bgp::vrf::import_route_map¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_sdwan::service::role¶

Base type string
Type constraint (self in ['standalone', 'primary', 'secondary'])

typedef fortigate::system_sdwan::health_check::vrf¶

Base type int
Type constraint ((self >= 0) and (self <= 251))

typedef fortigate::router_prefix_list::rule::ge¶

Base type int
Type constraint ((self >= 0) and (self <= 32))

typedef fortigate::router_prefix_list::rule::le¶

Base type int
Type constraint ((self >= 0) and (self <= 32))

typedef fortigate::system_settings::device¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::router_static::internet_service¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::router_static::internet_service_custom¶

Base type string
Type constraint (std::length(self) <= 64)

typedef fortigate::vpn_ipsec_phase1_interface::priority¶

Base type int
Type constraint ((self >= 1) and (self <= 65535))

typedef fortigate::system_sdwan::service::priority_members::seq_num¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::router_static::tag¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::devindex¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_admin::accprofile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_admin::email_to¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::system_admin::fortitoken¶

Base type string
Type constraint (std::length(self) <= 16)

typedef fortigate::system_admin::guest_lang¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_admin::peer_group¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_admin::remote_group¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_admin::sms_custom_server¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_admin::sms_phone¶

Base type string
Type constraint (std::length(self) <= 15)

typedef fortigate::system_admin::sms_server¶

Base type string
Type constraint (self in ['fortiguard', 'custom'])

typedef fortigate::system_admin::ssh_certificate¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_admin::two_factor¶

Base type string
Type constraint (self in ['disable', 'fortitoken', 'fortitoken-cloud', 'email', 'sms'])

typedef fortigate::system_admin::two_factor_authentication¶

Base type string
Type constraint (self in ['fortitoken', 'email', 'sms'])

typedef fortigate::system_admin::two_factor_notification¶

Base type string
Type constraint (self in ['email', 'sms'])

typedef fortigate::system_interface::ac_name¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::system_interface::aggregate¶

Base type string
Type constraint (std::length(self) <= 15)

typedef fortigate::system_interface::aggregate_type¶

Base type string
Type constraint (self in ['physical', 'vxlan'])

typedef fortigate::system_interface::algorithm¶

Base type string
Type constraint (self in ['L2', 'L3', 'L4', 'Source-MAC'])

typedef fortigate::system_interface::alias¶

Base type string
Type constraint (std::length(self) <= 25)

typedef fortigate::system_interface::secondaryip::allowaccess¶

Base type string
Type constraint (self in ['ping', 'https', 'ssh', 'snmp', 'http', 'telnet', 'fgfm', 'radius-acct', 'probe-response', 'fabric', 'ftm', 'speed-test'])

typedef fortigate::system_interface::auth_portal_addr¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::system_interface::l2tp_client_settings::auth_type¶

Base type string
Type constraint (self in ['auto', 'pap', 'chap', 'mschapv1', 'mschapv2'])

typedef fortigate::system_interface::bandwidth_measure_time¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::bfd¶

Base type string
Type constraint (self in ['global', 'enable', 'disable'])

typedef fortigate::system_settings::bfd_desired_min_tx¶

Base type int
Type constraint ((self >= 1) and (self <= 100000))

typedef fortigate::system_settings::bfd_detect_mult¶

Base type int
Type constraint ((self >= 1) and (self <= 50))

typedef fortigate::system_settings::bfd_required_min_rx¶

Base type int
Type constraint ((self >= 1) and (self <= 100000))

typedef fortigate::system_interface::cli_conn_status¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::dedicated_to¶

Base type string
Type constraint (self in ['none', 'management'])

typedef fortigate::system_interface::detected_peer_mtu¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::secondaryip::detectprotocol¶

Base type string
Type constraint (self in ['ping', 'tcp-echo', 'udp-echo'])

typedef fortigate::system_interface::dhcp_client_identifier¶

Base type string
Type constraint (std::length(self) <= 48)

typedef fortigate::system_interface::dhcp_relay_interface¶

Base type string
Type constraint (std::length(self) <= 15)

typedef fortigate::system_interface::dhcp_relay_interface_select_method¶

Base type string
Type constraint (self in ['auto', 'sdwan', 'specify'])

typedef fortigate::system_interface::dhcp_relay_type¶

Base type string
Type constraint (self in ['regular', 'ipsec'])

typedef fortigate::system_interface::dhcp_renew_time¶

Base type int
Type constraint ((self >= 300) and (self <= 604800))

typedef fortigate::system_interface::disc_retry_timeout¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::disconnect_threshold¶

Base type int
Type constraint ((self >= 0) and (self <= 10000))

typedef fortigate::system_interface::dns_server_protocol¶

Base type string
Type constraint (self in ['cleartext', 'dot', 'doh'])

typedef fortigate::vpn_ipsec_phase1_interface::eap_identity¶

Base type string
Type constraint (self in ['use-id-payload', 'send-request'])

typedef fortigate::system_interface::eap_method¶

Base type string
Type constraint (self in ['tls', 'peap'])

typedef fortigate::system_interface::eap_user_cert¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_interface::egress_shaping_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_interface::estimated_downstream_bandwidth¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::estimated_upstream_bandwidth¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::fail_action_on_extender¶

Base type string
Type constraint (self in ['soft-restart', 'hard-restart', 'reboot'])

typedef fortigate::system_interface::fail_alert_method¶

Base type string
Type constraint (self in ['link-failed-signal', 'link-down'])

typedef fortigate::system_interface::fail_detect_option¶

Base type string
Type constraint (self in ['detectserver', 'link-down'])

typedef fortigate::system_interface::fortilink_backup_link¶

Base type int
Type constraint ((self >= 0) and (self <= 255))

typedef fortigate::system_interface::fortilink_neighbor_detect¶

Base type string
Type constraint (self in ['lldp', 'fortilink'])

typedef fortigate::system_interface::forward_domain¶

Base type int
Type constraint ((self >= 0) and (self <= 2147483647))

typedef fortigate::system_sdwan::health_check::ha_priority¶

Base type int
Type constraint ((self >= 1) and (self <= 50))

typedef fortigate::system_interface::idle_timeout¶

Base type int
Type constraint ((self >= 0) and (self <= 32767))

typedef fortigate::system_interface::ike_saml_server¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_interface::inbandwidth¶

Base type int
Type constraint ((self >= 0) and (self <= 80000000))

typedef fortigate::system_interface::ingress_shaping_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_sdwan::members::ingress_spillover_threshold¶

Base type int
Type constraint ((self >= 0) and (self <= 16776000))

typedef fortigate::system_interface::internal¶

Base type int
Type constraint ((self >= 0) and (self <= 255))

typedef fortigate::system_interface::lacp_mode¶

Base type string
Type constraint (self in ['static', 'passive', 'active'])

typedef fortigate::system_interface::lacp_speed¶

Base type string
Type constraint (self in ['slow', 'fast'])

typedef fortigate::system_interface::lcp_echo_interval¶

Base type int
Type constraint ((self >= 0) and (self <= 32767))

typedef fortigate::system_interface::lcp_max_echo_fails¶

Base type int
Type constraint ((self >= 0) and (self <= 32767))

typedef fortigate::system_interface::link_up_delay¶

Base type int
Type constraint ((self >= 50) and (self <= 3600000))

typedef fortigate::system_interface::lldp_network_policy¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_settings::lldp_reception¶

Base type string
Type constraint (self in ['enable', 'disable', 'global'])

typedef fortigate::system_settings::lldp_transmission¶

Base type string
Type constraint (self in ['enable', 'disable', 'global'])

typedef fortigate::system_interface::managed_subnetwork_size¶

Base type string
Type constraint (self in ['32', '64', '128', '256', '512', '1024', '2048', '4096', '8192', '16384', '32768', '65536'])

typedef fortigate::system_interface::measured_downstream_bandwidth¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::measured_upstream_bandwidth¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::min_links¶

Base type int
Type constraint ((self >= 1) and (self <= 32))

typedef fortigate::system_interface::min_links_down¶

Base type string
Type constraint (self in ['operational', 'administrative'])

typedef fortigate::vpn_ipsec_phase1_interface::mode¶

Base type string
Type constraint (self in ['aggressive', 'main'])

typedef fortigate::system_interface::l2tp_client_settings::mtu¶

Base type int
Type constraint ((self >= 40) and (self <= 65535))

typedef fortigate::system_interface::netflow_sampler¶

Base type string
Type constraint (self in ['disable', 'tx', 'rx', 'both'])

typedef fortigate::system_interface::outbandwidth¶

Base type int
Type constraint ((self >= 0) and (self <= 80000000))

typedef fortigate::system_interface::padt_retry_timeout¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::secondaryip::ping_serv_status¶

Base type int
Type constraint ((self >= 0) and (self <= 255))

typedef fortigate::system_interface::polling_interval¶

Base type int
Type constraint ((self >= 1) and (self <= 255))

typedef fortigate::system_interface::pptp_auth_type¶

Base type string
Type constraint (self in ['auto', 'pap', 'chap', 'mschapv1', 'mschapv2'])

typedef fortigate::system_interface::pptp_timeout¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::system_interface::pptp_user¶

Base type string
Type constraint (std::length(self) <= 64)

typedef fortigate::system_interface::reachable_time¶

Base type int
Type constraint ((self >= 30000) and (self <= 3600000))

typedef fortigate::system_interface::redundant_interface¶

Base type string
Type constraint (std::length(self) <= 15)

typedef fortigate::system_interface::sample_direction¶

Base type string
Type constraint (self in ['tx', 'rx', 'both'])

typedef fortigate::system_interface::sample_rate¶

Base type int
Type constraint ((self >= 10) and (self <= 99999))

typedef fortigate::system_interface::security_8021x_dynamic_vlan_id¶

Base type int
Type constraint ((self >= 0) and (self <= 4094))

typedef fortigate::system_interface::security_8021x_master¶

Base type string
Type constraint (std::length(self) <= 15)

typedef fortigate::system_interface::security_8021x_mode¶

Base type string
Type constraint (self in ['default', 'dynamic-vlan', 'fallback', 'slave'])

typedef fortigate::system_interface::security_exempt_list¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_interface::security_external_logout¶

Base type string
Type constraint (std::length(self) <= 127)

typedef fortigate::system_interface::security_external_web¶

Base type string
Type constraint (std::length(self) <= 1023)

typedef fortigate::system_interface::security_mac_auth_bypass¶

Base type string
Type constraint (self in ['mac-auth-only', 'enable', 'disable'])

typedef fortigate::system_sdwan::health_check::security_mode¶

Base type string
Type constraint (self in ['none', 'authentication'])

typedef fortigate::system_interface::security_redirect_url¶

Base type string
Type constraint (std::length(self) <= 1023)

typedef fortigate::system_interface::service_name¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::system_interface::snmp_index¶

Base type int
Type constraint ((self >= 1) and (self <= 2147483647))

typedef fortigate::system_interface::speed¶

Base type string
Type constraint (self in ['auto', '10full', '10half', '100full', '100half', '1000full', '1000auto'])

typedef fortigate::system_sdwan::members::spillover_threshold¶

Base type int
Type constraint ((self >= 0) and (self <= 16776000))

typedef fortigate::system_interface::status¶

Base type string
Type constraint (self in ['up', 'down'])

typedef fortigate::system_interface::stp_ha_secondary¶

Base type string
Type constraint (self in ['disable', 'enable', 'priority-adjust'])

typedef fortigate::system_interface::stpforward_mode¶

Base type string
Type constraint (self in ['rpl-all-ext-id', 'rpl-bridge-ext-id', 'rpl-nothing'])

typedef fortigate::system_interface::swc_first_create¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::swc_vlan¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::switch¶

Base type string
Type constraint (std::length(self) <= 15)

typedef fortigate::system_interface::switch_controller_dynamic¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_interface::switch_controller_feature¶

Base type string
Type constraint (self in ['none', 'default-vlan', 'quarantine', 'rspan', 'voice', 'video', 'nac', 'nac-segment'])

typedef fortigate::system_interface::switch_controller_learning_limit¶

Base type int
Type constraint ((self >= 0) and (self <= 128))

typedef fortigate::system_interface::switch_controller_mgmt_vlan¶

Base type int
Type constraint ((self >= 1) and (self <= 4094))

typedef fortigate::system_interface::switch_controller_nac¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_interface::switch_controller_source_ip¶

Base type string
Type constraint (self in ['outbound', 'fixed'])

typedef fortigate::system_interface::switch_controller_traffic_policy¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::system_interface::system_id_type¶

Base type string
Type constraint (self in ['auto', 'user'])

typedef fortigate::system_interface::tcp_mss¶

Base type int
Type constraint ((self >= 48) and (self <= 65535))

typedef fortigate::system_interface::username¶

Base type string
Type constraint (std::length(self) <= 64)

typedef fortigate::system_interface::vindex¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::system_interface::vlan_protocol¶

Base type string
Type constraint (self in ['8021q', '8021ad'])

typedef fortigate::system_interface::vlanid¶

Base type int
Type constraint ((self >= 1) and (self <= 4094))

typedef fortigate::system_interface::client_options::code¶

Base type int
Type constraint ((self >= 0) and (self <= 255))

typedef fortigate::system_interface::ipv6::cli_conn6_status¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::ipv6::dhcp6_client_options¶

Base type string
Type constraint (self in ['rapid', 'iapd', 'iana'])

typedef fortigate::system_interface::ipv6::dhcp6_relay_type¶

Base type string
Type constraint (self in ['regular'])

typedef fortigate::system_interface::ipv6::ip6_allowaccess¶

Base type string
Type constraint (self in ['ping', 'https', 'ssh', 'snmp', 'http', 'telnet', 'fgfm', 'fabric'])

typedef fortigate::system_interface::ipv6::ip6_default_life¶

Base type int
Type constraint ((self >= 0) and (self <= 9000))

typedef fortigate::system_interface::ipv6::ip6_delegated_prefix_iaid¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::ipv6::ip6_hop_limit¶

Base type int
Type constraint ((self >= 0) and (self <= 255))

typedef fortigate::system_interface::ipv6::ip6_link_mtu¶

Base type int
Type constraint ((self >= 1280) and (self <= 16000))

typedef fortigate::system_interface::ipv6::ip6_max_interval¶

Base type int
Type constraint ((self >= 4) and (self <= 1800))

typedef fortigate::system_interface::ipv6::ip6_min_interval¶

Base type int
Type constraint ((self >= 3) and (self <= 1350))

typedef fortigate::system_interface::ipv6::ip6_mode¶

Base type string
Type constraint (self in ['static', 'dhcp', 'pppoe', 'delegated'])

typedef fortigate::system_interface::ipv6::ip6_prefix_mode¶

Base type string
Type constraint (self in ['dhcp6', 'ra'])

typedef fortigate::system_interface::ipv6::ip6_reachable_time¶

Base type int
Type constraint ((self >= 0) and (self <= 3600000))

typedef fortigate::system_interface::ipv6::ip6_retrans_time¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::ipv6::ip6_upstream_interface¶

Base type string
Type constraint (std::length(self) <= 15)

typedef fortigate::system_interface::ipv6::nd_cert¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_interface::ipv6::nd_mode¶

Base type string
Type constraint (self in ['basic', 'SEND-compatible'])

typedef fortigate::system_interface::ipv6::nd_security_level¶

Base type int
Type constraint ((self >= 0) and (self <= 7))

typedef fortigate::system_interface::ipv6::nd_timestamp_delta¶

Base type int
Type constraint ((self >= 1) and (self <= 3600))

typedef fortigate::system_interface::ipv6::nd_timestamp_fuzz¶

Base type int
Type constraint ((self >= 1) and (self <= 60))

typedef fortigate::system_interface::ipv6::dhcp6_iapd_list::iaid¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::ipv6::dhcp6_iapd_list::prefix_hint_plt¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::ipv6::dhcp6_iapd_list::prefix_hint_vlt¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::ipv6::ip6_delegated_prefix_list::delegated_prefix_iaid¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::ipv6::ip6_delegated_prefix_list::prefix_id¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::ipv6::ip6_delegated_prefix_list::rdnss_service¶

Base type string
Type constraint (self in ['delegated', 'default', 'specify'])

typedef fortigate::system_interface::ipv6::ip6_delegated_prefix_list::upstream_interface¶

Base type string
Type constraint (std::length(self) <= 15)

typedef fortigate::system_interface::ipv6::ip6_prefix_list::preferred_life_time¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::ipv6::ip6_prefix_list::valid_life_time¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_interface::vrrp::adv_interval¶

Base type int
Type constraint ((self >= 1) and (self <= 255))

typedef fortigate::system_interface::vrrp::start_time¶

Base type int
Type constraint ((self >= 1) and (self <= 255))

typedef fortigate::system_interface::vrrp::vrgrp¶

Base type int
Type constraint ((self >= 1) and (self <= 65535))

typedef fortigate::system_interface::vrrp::vrid¶

Base type int
Type constraint ((self >= 1) and (self <= 255))

typedef fortigate::system_interface::l2tp_client_settings::hello_interval¶

Base type int
Type constraint ((self >= 0) and (self <= 3600))

typedef fortigate::system_interface::l2tp_client_settings::peer_host¶

Base type string
Type constraint (std::length(self) <= 255)

typedef fortigate::system_interface::l2tp_client_settings::peer_port¶

Base type int
Type constraint ((self >= 1) and (self <= 65535))

typedef fortigate::system_sdwan::health_check::user¶

Base type string
Type constraint (std::length(self) <= 64)

typedef fortigate::system_interface::vrrp::version¶

Base type string
Type constraint (self in ['2', '3'])

typedef fortigate::system_interface::vrrp::vrdst_priority¶

Base type int
Type constraint ((self >= 0) and (self <= 254))

typedef fortigate::system_sdwan::duplication_max_num¶

Base type int
Type constraint ((self >= 2) and (self <= 4))

typedef fortigate::system_sdwan::load_balance_mode¶

Base type string
Type constraint (self in ['source-ip-based', 'weight-based', 'usage-based', 'source-dest-ip-based', 'measured-volume-based'])

typedef fortigate::system_sdwan::neighbor_hold_boot_time¶

Base type int
Type constraint ((self >= 0) and (self <= 10000000))

typedef fortigate::system_sdwan::neighbor_hold_down_time¶

Base type int
Type constraint ((self >= 0) and (self <= 10000000))

typedef fortigate::system_sdwan::duplication::packet_duplication¶

Base type string
Type constraint (self in ['disable', 'force', 'on-demand'])

typedef fortigate::system_sdwan::service::addr_mode¶

Base type string
Type constraint (self in ['ipv4', 'ipv6'])

typedef fortigate::system_sdwan::health_check::detect_mode¶

Base type string
Type constraint (self in ['active', 'passive', 'prefer-passive', 'remote', 'agent-based'])

typedef fortigate::system_sdwan::health_check::dns_request_domain¶

Base type string
Type constraint (std::length(self) <= 255)

typedef fortigate::system_sdwan::health_check::failtime¶

Base type int
Type constraint ((self >= 1) and (self <= 3600))

typedef fortigate::system_sdwan::health_check::ftp_file¶

Base type string
Type constraint (std::length(self) <= 254)

typedef fortigate::system_sdwan::health_check::ftp_mode¶

Base type string
Type constraint (self in ['passive', 'port'])

typedef fortigate::system_sdwan::health_check::http_agent¶

Base type string
Type constraint (std::length(self) <= 1024)

typedef fortigate::system_sdwan::health_check::http_get¶

Base type string
Type constraint (std::length(self) <= 1024)

typedef fortigate::system_sdwan::health_check::http_match¶

Base type string
Type constraint (std::length(self) <= 1024)

typedef fortigate::system_sdwan::health_check::interval¶

Base type int
Type constraint ((self >= 20) and (self <= 3600000))

typedef fortigate::system_sdwan::health_check::mos_codec¶

Base type string
Type constraint (self in ['g711', 'g722', 'g729'])

typedef fortigate::system_sdwan::health_check::packet_size¶

Base type int
Type constraint ((self >= 64) and (self <= 1024))

typedef fortigate::system_sdwan::health_check::port¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::system_sdwan::health_check::probe_count¶

Base type int
Type constraint ((self >= 5) and (self <= 30))

typedef fortigate::system_sdwan::health_check::probe_timeout¶

Base type int
Type constraint ((self >= 20) and (self <= 3600000))

typedef fortigate::system_sdwan::health_check::quality_measured_method¶

Base type string
Type constraint (self in ['half-open', 'half-close'])

typedef fortigate::system_sdwan::health_check::recoverytime¶

Base type int
Type constraint ((self >= 1) and (self <= 3600))

typedef fortigate::system_sdwan::health_check::sla_fail_log_period¶

Base type int
Type constraint ((self >= 0) and (self <= 3600))

typedef fortigate::system_sdwan::health_check::sla_id_redistribute¶

Base type int
Type constraint ((self >= 0) and (self <= 32))

typedef fortigate::system_sdwan::health_check::sla_pass_log_period¶

Base type int
Type constraint ((self >= 0) and (self <= 3600))

typedef fortigate::system_sdwan::health_check::threshold_alert_jitter¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_sdwan::health_check::threshold_alert_latency¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_sdwan::health_check::threshold_alert_packetloss¶

Base type int
Type constraint ((self >= 0) and (self <= 100))

typedef fortigate::system_sdwan::health_check::threshold_warning_jitter¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_sdwan::health_check::threshold_warning_latency¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_sdwan::health_check::threshold_warning_packetloss¶

Base type int
Type constraint ((self >= 0) and (self <= 100))

typedef fortigate::system_sdwan::health_check::sla::jitter_threshold¶

Base type int
Type constraint ((self >= 0) and (self <= 10000000))

typedef fortigate::system_sdwan::health_check::sla::latency_threshold¶

Base type int
Type constraint ((self >= 0) and (self <= 10000000))

typedef fortigate::system_sdwan::service::link_cost_factor¶

Base type string
Type constraint (self in ['latency', 'jitter', 'packet-loss', 'inbandwidth', 'outbandwidth', 'bibandwidth', 'custom-profile-1'])

typedef fortigate::system_sdwan::health_check::sla::mos_threshold¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_sdwan::health_check::sla::packetloss_threshold¶

Base type int
Type constraint ((self >= 0) and (self <= 100))

typedef fortigate::system_sdwan::health_check::sla::priority_in_sla¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::system_sdwan::health_check::sla::priority_out_sla¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::system_sdwan::members::cost¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_sdwan::members::priority6¶

Base type int
Type constraint ((self >= 1) and (self <= 65535))

typedef fortigate::system_sdwan::members::volume_ratio¶

Base type int
Type constraint ((self >= 1) and (self <= 255))

typedef fortigate::system_sdwan::members::zone¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_sdwan::service::sla::health_check¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::system_sdwan::service::minimum_sla_meet_members¶

Base type int
Type constraint ((self >= 0) and (self <= 255))

typedef fortigate::system_sdwan::neighbor::sla_id¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_sdwan::service::bandwidth_weight¶

Base type int
Type constraint ((self >= 0) and (self <= 10000000))

typedef fortigate::system_sdwan::service::hash_mode¶

Base type string
Type constraint (self in ['round-robin', 'source-ip-based', 'source-dest-ip-based', 'inbandwidth', 'outbandwidth', 'bibandwidth'])

typedef fortigate::system_sdwan::service::hold_down_time¶

Base type int
Type constraint ((self >= 0) and (self <= 10000000))

typedef fortigate::system_sdwan::service::jitter_weight¶

Base type int
Type constraint ((self >= 0) and (self <= 10000000))

typedef fortigate::system_sdwan::service::latency_weight¶

Base type int
Type constraint ((self >= 0) and (self <= 10000000))

typedef fortigate::system_sdwan::service::link_cost_threshold¶

Base type int
Type constraint ((self >= 0) and (self <= 10000000))

typedef fortigate::system_sdwan::service::packet_loss_weight¶

Base type int
Type constraint ((self >= 0) and (self <= 10000000))

typedef fortigate::system_sdwan::service::quality_link¶

Base type int
Type constraint ((self >= 0) and (self <= 255))

typedef fortigate::system_sdwan::service::route_tag¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_sdwan::service::sla_compare_method¶

Base type string
Type constraint (self in ['order', 'number'])

typedef fortigate::system_sdwan::service::tie_break¶

Base type string
Type constraint (self in ['zone', 'cfg-order', 'fib-best-match', 'input-device'])

typedef fortigate::system_sdwan::zone::service_sla_tie_break¶

Base type string
Type constraint (self in ['cfg-order', 'fib-best-match', 'input-device'])

typedef fortigate::system_settings::default_policy_expiry_days¶

Base type int
Type constraint ((self >= 0) and (self <= 365))

typedef fortigate::system_settings::default_voip_alg_mode¶

Base type string
Type constraint (self in ['proxy-based', 'kernel-helper-based'])

typedef fortigate::system_settings::dhcp_proxy_interface¶

Base type string
Type constraint (std::length(self) <= 15)

typedef fortigate::system_settings::dhcp_proxy_interface_select_method¶

Base type string
Type constraint (self in ['auto', 'sdwan', 'specify'])

typedef fortigate::system_settings::discovered_device_timeout¶

Base type int
Type constraint ((self >= 1) and (self <= 365))

typedef fortigate::system_settings::ecmp_max_paths¶

Base type int
Type constraint ((self >= 1) and (self <= 255))

typedef fortigate::system_settings::gui_enforce_change_summary¶

Base type string
Type constraint (self in ['disable', 'require', 'optional'])

typedef fortigate::system_settings::http_external_dest¶

Base type string
Type constraint (self in ['fortiweb', 'forticache'])

typedef fortigate::system_settings::ike_dn_format¶

Base type string
Type constraint (self in ['with-space', 'no-space'])

typedef fortigate::system_settings::ike_port¶

Base type int
Type constraint ((self >= 1024) and (self <= 65535))

typedef fortigate::system_settings::lan_extension_controller_addr¶

Base type string
Type constraint (std::length(self) <= 255)

typedef fortigate::system_settings::mac_ttl¶

Base type int
Type constraint ((self >= 300) and (self <= 8640000))

typedef fortigate::system_settings::ngfw_mode¶

Base type string
Type constraint (self in ['profile-based', 'policy-based'])

typedef fortigate::system_settings::opmode¶

Base type string
Type constraint (self in ['nat', 'transparent'])

typedef fortigate::system_settings::sccp_port¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::system_settings::sip_ssl_port¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::system_settings::sip_tcp_port¶

Base type int
Type constraint ((self >= 1) and (self <= 65535))

typedef fortigate::system_settings::sip_udp_port¶

Base type int
Type constraint ((self >= 1) and (self <= 65535))

typedef fortigate::system_settings::v4_ecmp_mode¶

Base type string
Type constraint (self in ['source-ip-based', 'weight-based', 'usage-based', 'source-dest-ip-based'])

typedef fortigate::system_settings::vdom_type¶

Base type string
Type constraint (self in ['traffic', 'lan-extension', 'admin'])

typedef fortigate::system_settings::vpn_stats_log¶

Base type string
Type constraint (self in ['ipsec', 'pptp', 'l2tp', 'ssl'])

typedef fortigate::system_settings::vpn_stats_period¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_vdom::flag¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_vdom::short_name¶

Base type string
Type constraint (std::length(self) <= 11)

typedef fortigate::system_vdom::vcluster_id¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::system_vdom_link::vcluster¶

Base type string
Type constraint (self in ['vcluster1', 'vcluster2'])

typedef fortigate::vpn_ipsec_phase1_interface::aggregate_weight¶

Base type int
Type constraint ((self >= 1) and (self <= 100))

typedef fortigate::vpn_ipsec_phase1_interface::assign_ip_from¶

Base type string
Type constraint (self in ['range', 'usrgrp', 'dhcp', 'name'])

typedef fortigate::vpn_ipsec_phase1_interface::authmethod¶

Base type string
Type constraint (self in ['psk', 'signature'])

typedef fortigate::vpn_ipsec_phase1_interface::authmethod_remote¶

Base type string
Type constraint (self in ['psk', 'signature'])

typedef fortigate::vpn_ipsec_phase1_interface::authusr¶

Base type string
Type constraint (std::length(self) <= 64)

typedef fortigate::vpn_ipsec_phase1_interface::authusrgrp¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::vpn_ipsec_phase1_interface::auto_discovery_crossover¶

Base type string
Type constraint (self in ['allow', 'block'])

typedef fortigate::vpn_ipsec_phase1_interface::auto_discovery_offer_interval¶

Base type int
Type constraint ((self >= 1) and (self <= 300))

typedef fortigate::vpn_ipsec_phase1_interface::auto_discovery_shortcuts¶

Base type string
Type constraint (self in ['independent', 'dependent'])

typedef fortigate::vpn_ipsec_phase1_interface::banner¶

Base type string
Type constraint (std::length(self) <= 1024)

typedef fortigate::vpn_ipsec_phase1_interface::default_gw_priority¶

Base type int
Type constraint ((self >= 0) and (self <= 4294967295))

typedef fortigate::vpn_ipsec_phase1_interface::dev_id¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::vpn_ipsec_phase2_interface::dhgrp¶

Base type string
Type constraint (self in ['1', '2', '5', '14', '15', '16', '17', '18', '19', '20', '21', '27', '28', '29', '30', '31', '32'])

typedef fortigate::vpn_ipsec_phase1_interface::dns_mode¶

Base type string
Type constraint (self in ['manual', 'auto'])

typedef fortigate::vpn_ipsec_phase1_interface::domain¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::vpn_ipsec_phase1_interface::dpd¶

Base type string
Type constraint (self in ['disable', 'on-idle', 'on-demand'])

typedef fortigate::vpn_ipsec_phase1_interface::dpd_retrycount¶

Base type int
Type constraint ((self >= 0) and (self <= 10))

typedef fortigate::vpn_ipsec_phase1_interface::eap_exclude_peergrp¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::vpn_ipsec_phase2_interface::encapsulation¶

Base type string
Type constraint (self in ['tunnel-mode', 'transport-mode'])

typedef fortigate::vpn_ipsec_phase1_interface::encapsulation_address¶

Base type string
Type constraint (self in ['ike', 'ipv4', 'ipv6'])

typedef fortigate::vpn_ipsec_phase1_interface::enforce_unique_id¶

Base type string
Type constraint (self in ['disable', 'keep-new', 'keep-old'])

typedef fortigate::vpn_ipsec_phase1_interface::fec_base¶

Base type int
Type constraint ((self >= 1) and (self <= 20))

typedef fortigate::vpn_ipsec_phase1_interface::fec_codec¶

Base type string
Type constraint (self in ['rs', 'xor'])

typedef fortigate::vpn_ipsec_phase1_interface::fec_health_check¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::vpn_ipsec_phase1_interface::fec_mapping_profile¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::vpn_ipsec_phase1_interface::fec_receive_timeout¶

Base type int
Type constraint ((self >= 1) and (self <= 1000))

typedef fortigate::vpn_ipsec_phase1_interface::fec_redundant¶

Base type int
Type constraint ((self >= 1) and (self <= 5))

typedef fortigate::vpn_ipsec_phase1_interface::fec_send_timeout¶

Base type int
Type constraint ((self >= 1) and (self <= 1000))

typedef fortigate::vpn_ipsec_phase1_interface::fragmentation_mtu¶

Base type int
Type constraint ((self >= 500) and (self <= 16000))

typedef fortigate::vpn_ipsec_phase1_interface::idle_timeoutinterval¶

Base type int
Type constraint ((self >= 5) and (self <= 43200))

typedef fortigate::vpn_ipsec_phase1_interface::ike_version¶

Base type string
Type constraint (self in ['1', '2'])

typedef fortigate::vpn_ipsec_phase1_interface::ip_delay_interval¶

Base type int
Type constraint ((self >= 0) and (self <= 28800))

typedef fortigate::vpn_ipsec_phase1_interface::ip_fragmentation¶

Base type string
Type constraint (self in ['pre-encapsulation', 'post-encapsulation'])

typedef fortigate::vpn_ipsec_phase1_interface::ipv6_prefix¶

Base type int
Type constraint ((self >= 1) and (self <= 128))

typedef fortigate::vpn_ipsec_phase1_interface::keepalive¶

Base type int
Type constraint ((self >= 10) and (self <= 900))

typedef fortigate::vpn_ipsec_phase1_interface::keylife¶

Base type int
Type constraint ((self >= 120) and (self <= 172800))

typedef fortigate::vpn_ipsec_phase1_interface::link_cost¶

Base type int
Type constraint ((self >= 0) and (self <= 255))

typedef fortigate::vpn_ipsec_phase1_interface::localid¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::vpn_ipsec_phase1_interface::localid_type¶

Base type string
Type constraint (self in ['auto', 'fqdn', 'user-fqdn', 'keyid', 'address', 'asn1dn'])

typedef fortigate::vpn_ipsec_phase1_interface::mesh_selector_type¶

Base type string
Type constraint (self in ['disable', 'subnet', 'host'])

typedef fortigate::vpn_ipsec_phase1_interface::monitor¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::vpn_ipsec_phase1_interface::monitor_hold_down_delay¶

Base type int
Type constraint ((self >= 0) and (self <= 31536000))

typedef fortigate::vpn_ipsec_phase1_interface::monitor_hold_down_type¶

Base type string
Type constraint (self in ['immediate', 'delay', 'time'])

typedef fortigate::vpn_ipsec_phase1_interface::monitor_hold_down_weekday¶

Base type string
Type constraint (self in ['everyday', 'sunday', 'monday', 'tuesday', 'wednesday', 'thursday', 'friday', 'saturday'])

typedef fortigate::vpn_ipsec_phase1_interface::nattraversal¶

Base type string
Type constraint (self in ['enable', 'disable', 'forced'])

typedef fortigate::vpn_ipsec_phase1_interface::negotiate_timeout¶

Base type int
Type constraint ((self >= 1) and (self <= 300))

typedef fortigate::vpn_ipsec_phase1_interface::network_id¶

Base type int
Type constraint ((self >= 0) and (self <= 255))

typedef fortigate::vpn_ipsec_phase1_interface::peer¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::vpn_ipsec_phase1_interface::peergrp¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::vpn_ipsec_phase1_interface::peerid¶

Base type string
Type constraint (std::length(self) <= 255)

typedef fortigate::vpn_ipsec_phase1_interface::peertype¶

Base type string
Type constraint (self in ['any', 'one', 'dialup', 'peer', 'peergrp'])

typedef fortigate::vpn_ipsec_phase1_interface::ppk¶

Base type string
Type constraint (self in ['disable', 'allow', 'require'])

typedef fortigate::vpn_ipsec_phase1_interface::ppk_identity¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::vpn_ipsec_phase2_interface::proposal¶

Base type string
Type constraint (self in ['null-md5', 'null-sha1', 'null-sha256', 'null-sha384', 'null-sha512', 'des-null', 'des-md5', 'des-sha1', 'des-sha256', 'des-sha384', 'des-sha512', '3des-null', '3des-md5', '3des-sha1', '3des-sha256', '3des-sha384', '3des-sha512', 'aes128-null', 'aes128-md5', 'aes128-sha1', 'aes128-sha256', 'aes128-sha384', 'aes128-sha512', 'aes128gcm', 'aes192-null', 'aes192-md5', 'aes192-sha1', 'aes192-sha256', 'aes192-sha384', 'aes192-sha512', 'aes256-null', 'aes256-md5', 'aes256-sha1', 'aes256-sha256', 'aes256-sha384', 'aes256-sha512', 'aes256gcm', 'chacha20poly1305', 'aria128-null', 'aria128-md5', 'aria128-sha1', 'aria128-sha256', 'aria128-sha384', 'aria128-sha512', 'aria192-null', 'aria192-md5', 'aria192-sha1', 'aria192-sha256', 'aria192-sha384', 'aria192-sha512', 'aria256-null', 'aria256-md5', 'aria256-sha1', 'aria256-sha256', 'aria256-sha384', 'aria256-sha512', 'seed-null', 'seed-md5', 'seed-sha1', 'seed-sha256', 'seed-sha384', 'seed-sha512'])

typedef fortigate::vpn_ipsec_phase1_interface::remotegw_ddns¶

Base type string
Type constraint (std::length(self) <= 63)

typedef fortigate::vpn_ipsec_phase1_interface::rsa_signature_format¶

Base type string
Type constraint (self in ['pkcs1', 'pss'])

typedef fortigate::vpn_ipsec_phase1_interface::signature_hash_alg¶

Base type string
Type constraint (self in ['sha1', 'sha2-256', 'sha2-384', 'sha2-512'])

typedef fortigate::vpn_ipsec_phase1_interface::suite_b¶

Base type string
Type constraint (self in ['disable', 'suite-b-gcm-128', 'suite-b-gcm-256'])

typedef fortigate::vpn_ipsec_phase1_interface::usrgrp¶

Base type string
Type constraint (std::length(self) <= 35)

typedef fortigate::vpn_ipsec_phase1_interface::vni¶

Base type int
Type constraint ((self >= 1) and (self <= 16777215))

typedef fortigate::vpn_ipsec_phase1_interface::wizard_type¶

Base type string
Type constraint (self in ['custom', 'dialup-forticlient', 'dialup-ios', 'dialup-android', 'dialup-windows', 'dialup-cisco', 'static-fortigate', 'dialup-fortigate', 'static-cisco', 'dialup-cisco-fw', 'simplified-static-fortigate', 'hub-fortigate-auto-discovery', 'spoke-fortigate-auto-discovery'])

typedef fortigate::vpn_ipsec_phase1_interface::xauthtype¶

Base type string
Type constraint (self in ['disable', 'client', 'pap', 'chap', 'auto'])

typedef fortigate::vpn_ipsec_phase2_interface::add_route¶

Base type string
Type constraint (self in ['phase1', 'enable', 'disable'])

typedef fortigate::vpn_ipsec_phase2_interface::auto_discovery_forwarder¶

Base type string
Type constraint (self in ['phase1', 'enable', 'disable'])

typedef fortigate::vpn_ipsec_phase2_interface::auto_discovery_sender¶

Base type string
Type constraint (self in ['phase1', 'enable', 'disable'])

typedef fortigate::vpn_ipsec_phase2_interface::dst_addr_type¶

Base type string
Type constraint (self in ['subnet', 'range', 'ip', 'name', 'subnet6', 'range6', 'ip6', 'name6'])

typedef fortigate::vpn_ipsec_phase2_interface::dst_port¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

typedef fortigate::vpn_ipsec_phase2_interface::inbound_dscp_copy¶

Base type string
Type constraint (self in ['phase1', 'enable', 'disable'])

typedef fortigate::vpn_ipsec_phase2_interface::keylife_type¶

Base type string
Type constraint (self in ['seconds', 'kbs', 'both'])

typedef fortigate::vpn_ipsec_phase2_interface::keylifekbs¶

Base type int
Type constraint ((self >= 5120) and (self <= 4294967295))

typedef fortigate::vpn_ipsec_phase2_interface::keylifeseconds¶

Base type int
Type constraint ((self >= 120) and (self <= 172800))

typedef fortigate::vpn_ipsec_phase2_interface::phase1name¶

Base type string
Type constraint (std::length(self) <= 15)

typedef fortigate::vpn_ipsec_phase2_interface::route_overlap¶

Base type string
Type constraint (self in ['use-old', 'use-new', 'allow'])

typedef fortigate::vpn_ipsec_phase2_interface::src_addr_type¶

Base type string
Type constraint (self in ['subnet', 'range', 'ip', 'name', 'subnet6', 'range6', 'ip6', 'name6'])

typedef fortigate::vpn_ipsec_phase2_interface::src_port¶

Base type int
Type constraint ((self >= 0) and (self <= 65535))

Entities¶

entity fortigate::Address¶

Parents: fortigate::base::VdomResource

attribute fortigate::common::enable_disable_t? allow_routing=null¶: Enable/disable use of this address in the static route configuration. enable:Enable use of this address in the static route configuration. disable:Disable use of this address in the static route configuration.

attribute fortigate::firewall_address::associated_interface? associated_interface=null¶: Network interface associated with address.

attribute fortigate::firewall_address::cache_ttl? cache_ttl=null¶: Defines the minimal TTL of individual IP addresses in FQDN cache measured in seconds.

attribute fortigate::firewall_address::clearpass_spt? clearpass_spt=null¶: SPT (System Posture Token) value. unknown:UNKNOWN. healthy:HEALTHY. quarantine:QUARANTINE. checkup:CHECKUP. transient:TRANSIENT. infected:INFECTED.

attribute fortigate::firewall_address::color? color=null¶: Color of icon on the GUI.

attribute fortigate::firewall_address::comment? comment=null¶: Comment.

attribute fortigate::firewall_address::country? country=null¶: IP addresses associated to a specific country.

attribute string? end_ip=null¶: Final IP address (inclusive) in the range for the address.

attribute fortigate::firewall_address::epg_name? epg_name=null¶: Endpoint group name.

attribute fortigate::common::enable_disable_t? fabric_object=null¶: Security Fabric global object setting. enable:Object is set as a security fabric-wide global object. disable:Object is local to this security fabric member.

attribute fortigate::firewall_address::filter? filter=null¶: Match criteria filter.

attribute fortigate::firewall_address::fqdn? fqdn=null¶: Fully Qualified Domain Name address.

attribute fortigate::firewall_address::interface? interface=null¶: Name of interface whose IP address is to be used.

attribute fortigate::common::name_t name¶: Address name.

attribute fortigate::common::enable_disable_t? node_ip_only=null¶: Enable/disable collection of node addresses only in Kubernetes. enable:Enable collection of node addresses only in Kubernetes. disable:Disable collection of node addresses only in Kubernetes.

attribute fortigate::firewall_address::obj_id? obj_id=null¶: Object ID for NSX.

attribute fortigate::firewall_address::obj_tag? obj_tag=null¶: Tag of dynamic address object.

attribute fortigate::firewall_address::obj_type? obj_type=null¶: Object type. ip:IP address. mac:MAC address

attribute fortigate::firewall_address::organization? organization=null¶: Organization domain name (Syntax: organization/domain).

attribute fortigate::firewall_address::policy_group? policy_group=null¶: Policy group name.

attribute fortigate::firewall_address::sdn? sdn=null¶: SDN.

attribute fortigate::firewall_address::sdn_addr_type? sdn_addr_type=null¶: Type of addresses to collect. private:Collect private addresses only. public:Collect public addresses only. all:Collect both public and private addresses.

attribute fortigate::firewall_address::sdn_tag? sdn_tag=null¶: SDN Tag.

attribute string? start_ip=null¶: First IP address (inclusive) in the range for the address.

attribute fortigate::firewall_address::sub_type? sub_type=null¶: Sub-type of address. sdn:SDN address. clearpass-spt:ClearPass SPT (System Posture Token) address. fsso:FSSO address. ems-tag:FortiClient EMS tag. fortivoice-tag:FortiVoice tag. fortinac-tag:FortiNAC tag. fortipolicy-tag:FortiPolicy tag. swc-tag:Switch Controller NAC policy tag.

attribute string? subnet=null¶: IP address and subnet mask of address.

attribute fortigate::firewall_address::subnet_name? subnet_name=null¶: Subnet name.

attribute fortigate::firewall_address::tag_detection_level? tag_detection_level=null¶: Tag detection level of dynamic address object.

attribute fortigate::firewall_address::tag_type? tag_type=null¶: Tag type of dynamic address object.

attribute fortigate::firewall_address::tenant? tenant=null¶: Tenant.

attribute fortigate::firewall_address::type? type=null¶: Type of address. ipmask:Standard IPv4 address with subnet mask. iprange:Range of IPv4 addresses between two specified addresses (inclusive). fqdn:Fully Qualified Domain Name address. geography:IP addresses from a specified country. wildcard:Standard IPv4 using a wildcard subnet mask. dynamic:Dynamic address object. interface-subnet:IP and subnet of interface. mac:Range of MAC addresses.

attribute string? uuid=null¶: Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

attribute string? wildcard=null¶: IP address and wildcard netmask.

attribute fortigate::firewall_address::wildcard_fqdn? wildcard_fqdn=null¶: Fully Qualified Domain Name with wildcard characters. :rel fsso_group: :rel list: :rel macaddr: :rel tagging:

relation fortigate::firewall_address::FssoGroup fsso_group [0:*]¶: other end: fortigate::firewall_address::FssoGroup._parent [1]

relation fortigate::firewall_address::List list [0:*]¶: other end: fortigate::firewall_address::List._parent [1]

relation fortigate::firewall_address::Macaddr macaddr [0:*]¶: other end: fortigate::firewall_address::Macaddr._parent [1]

relation fortigate::firewall_address::Tagging tagging [0:*]¶: other end: fortigate::firewall_address::Tagging._parent [1]

The following implements statements select implementations for this entity:

entity fortigate::Address6¶

Parents: fortigate::base::VdomResource

attribute fortigate::firewall_address6::cache_ttl? cache_ttl=null¶: Minimal TTL of individual IPv6 addresses in FQDN cache.

attribute fortigate::firewall_address6::color? color=null¶: Integer value to determine the color of the icon in the GUI (range 1 to 32, default = 0, which sets the value to 1).

attribute fortigate::firewall_address6::comment? comment=null¶: Comment.

attribute fortigate::firewall_address6::country? country=null¶: IPv6 addresses associated to a specific country.

attribute string? end_ip=null¶: Final IP address (inclusive) in the range for the address (format: xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx).

attribute fortigate::firewall_address6::epg_name? epg_name=null¶: Endpoint group name.

attribute fortigate::common::enable_disable_t? fabric_object=null¶: Security Fabric global object setting. enable:Object is set as a security fabric-wide global object. disable:Object is local to this security fabric member.

attribute fortigate::firewall_address6::fqdn? fqdn=null¶: Fully qualified domain name.

attribute string? host=null¶: Host Address.

attribute fortigate::firewall_address6::host_type? host_type=null¶: Host type. any:Wildcard. specific:Specific host address.

attribute string? ip6=null¶: IPv6 address prefix (format: xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx/xxx).

attribute fortigate::common::name_t name¶: Address name.

attribute fortigate::firewall_address6::obj_id? obj_id=null¶: Object ID for NSX.

attribute fortigate::firewall_address6::sdn? sdn=null¶: SDN.

attribute fortigate::firewall_address6::sdn_tag? sdn_tag=null¶: SDN Tag.

attribute string? start_ip=null¶: First IP address (inclusive) in the range for the address (format: xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx).

attribute fortigate::firewall_address6::template? template=null¶: IPv6 address template.

attribute fortigate::firewall_address6::tenant? tenant=null¶: Tenant.

attribute fortigate::firewall_address6::type? type=null¶: Type of IPv6 address object (default = ipprefix). ipprefix:Uses the IP prefix to define a range of IPv6 addresses. iprange:Range of IPv6 addresses between two specified addresses (inclusive). fqdn:Fully qualified domain name. geography:IPv6 addresses from a specified country. dynamic:Dynamic address object for SDN. template:Template. mac:Range of MAC addresses.

attribute string? uuid=null¶: Universally Unique Identifier (UUID; automatically assigned but can be manually reset). :rel list: :rel macaddr: :rel subnet_segment: :rel tagging:

relation fortigate::firewall_address6::List list [0:*]¶: other end: fortigate::firewall_address6::List._parent [1]

relation fortigate::firewall_address6::Macaddr macaddr [0:*]¶: other end: fortigate::firewall_address6::Macaddr._parent [1]

relation fortigate::firewall_address6::SubnetSegment subnet_segment [0:*]¶: other end: fortigate::firewall_address6::SubnetSegment._parent [1]

relation fortigate::firewall_address6::Tagging tagging [0:*]¶: other end: fortigate::firewall_address6::Tagging._parent [1]

The following implements statements select implementations for this entity:

entity fortigate::AddressGroup¶

Parents: fortigate::base::VdomResource

attribute fortigate::common::enable_disable_t? allow_routing=null¶: Enable/disable use of this group in the static route configuration. enable:Enable use of this group in the static route configuration. disable:Disable use of this group in the static route configuration.

attribute fortigate::firewall_addrgrp::category? category=null¶: Address group category. default:Default address group category (cannot be used as ztna-ems-tag/ztna-geo-tag in policy). ztna-ems-tag:Members must be ztna-ems-tag group or ems-tag address, can be used as ztna-ems-tag in policy. ztna-geo-tag:Members must be ztna-geo-tag group or geographic address, can be used as ztna-geo-tag in policy.

attribute fortigate::firewall_addrgrp::color? color=null¶: Color of icon on the GUI.

attribute fortigate::firewall_addrgrp::comment? comment=null¶: Comment.

attribute fortigate::common::enable_disable_t? exclude=null¶: Enable/disable address exclusion. enable:Enable address exclusion. disable:Disable address exclusion.

attribute fortigate::common::enable_disable_t? fabric_object=null¶: Security Fabric global object setting. enable:Object is set as a security fabric-wide global object. disable:Object is local to this security fabric member.

attribute fortigate::common::name_t name¶: Address group name.

attribute fortigate::firewall_addrgrp::type? type=null¶: Address group type. default:Default address group type (address may belong to multiple groups). folder:Address folder group (members may not belong to any other group).

attribute string? uuid=null¶: Universally Unique Identifier (UUID; automatically assigned but can be manually reset). :rel exclude_member: :rel member: :rel tagging:

relation fortigate::firewall_addrgrp::ExcludeMember exclude_member [0:*]¶: other end: fortigate::firewall_addrgrp::ExcludeMember._parent [1]

relation fortigate::firewall_addrgrp::Member member [0:*]¶: other end: fortigate::firewall_addrgrp::Member._parent [1]

relation fortigate::firewall_addrgrp::Tagging tagging [0:*]¶: other end: fortigate::firewall_addrgrp::Tagging._parent [1]

The following implements statements select implementations for this entity:

entity fortigate::AddressGroup6¶

Parents: fortigate::base::VdomResource

attribute fortigate::firewall_addrgrp6::color? color=null¶: Integer value to determine the color of the icon in the GUI (1 - 32, default = 0, which sets the value to 1).

attribute fortigate::firewall_addrgrp6::comment? comment=null¶: Comment.

attribute fortigate::common::enable_disable_t? fabric_object=null¶: Security Fabric global object setting. enable:Object is set as a security fabric-wide global object. disable:Object is local to this security fabric member.

attribute fortigate::common::name_t name¶: IPv6 address group name.

attribute string? uuid=null¶: Universally Unique Identifier (UUID; automatically assigned but can be manually reset). :rel member: :rel tagging:

relation fortigate::firewall_addrgrp6::Member member [0:*]¶: other end: fortigate::firewall_addrgrp6::Member._parent [1]

relation fortigate::firewall_addrgrp6::Tagging tagging [0:*]¶: other end: fortigate::firewall_addrgrp6::Tagging._parent [1]

The following implements statements select implementations for this entity:

entity fortigate::BGP¶

Parents: fortigate::base::VdomResource

attribute fortigate::common::enable_disable_t? additional_path=null¶: Enable/disable selection of BGP IPv4 additional paths. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? additional_path6=null¶: Enable/disable selection of BGP IPv6 additional paths. enable:Enable setting. disable:Disable setting.

attribute fortigate::router_bgp::additional_path_select? additional_path_select=null¶: Number of additional paths to be selected for each IPv4 NLRI.

attribute fortigate::router_bgp::additional_path_select6? additional_path_select6=null¶: Number of additional paths to be selected for each IPv6 NLRI.

attribute fortigate::router_bgp::additional_path_select_vpnv4? additional_path_select_vpnv4=null¶: Number of additional paths to be selected for each VPNv4 NLRI.

attribute fortigate::common::enable_disable_t? additional_path_vpnv4=null¶: Enable/disable selection of BGP VPNv4 additional paths. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? always_compare_med=null¶: Enable/disable always compare MED. enable:Enable setting. disable:Disable setting.

attribute string asn¶: Router AS number, asplain/asdot/asdot+ format, 0 to disable BGP.

attribute fortigate::common::enable_disable_t? bestpath_as_path_ignore=null¶: Enable/disable ignore AS path. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? bestpath_cmp_confed_aspath=null¶: Enable/disable compare federation AS path length. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? bestpath_cmp_routerid=null¶: Enable/disable compare router ID for identical EBGP paths. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? bestpath_med_confed=null¶: Enable/disable compare MED among confederation paths. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? bestpath_med_missing_as_worst=null¶: Enable/disable treat missing MED as least preferred. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? client_to_client_reflection=null¶: Enable/disable client-to-client route reflection. enable:Enable setting. disable:Disable setting.

attribute string? cluster_id=null¶: Route reflector cluster ID.

attribute fortigate::router_bgp::confederation_identifier? confederation_identifier=null¶: Confederation identifier.

attribute fortigate::common::enable_disable_t? dampening=null¶: Enable/disable route-flap dampening. enable:Enable setting. disable:Disable setting.

attribute fortigate::router_bgp::dampening_max_suppress_time? dampening_max_suppress_time=null¶: Maximum minutes a route can be suppressed.

attribute fortigate::router_bgp::dampening_reachability_half_life? dampening_reachability_half_life=null¶: Reachability half-life time for penalty (min).

attribute fortigate::router_bgp::dampening_reuse? dampening_reuse=null¶: Threshold to reuse routes.

attribute fortigate::router_bgp::dampening_route_map? dampening_route_map=null¶: Criteria for dampening.

attribute fortigate::router_bgp::dampening_suppress? dampening_suppress=null¶: Threshold to suppress routes.

attribute fortigate::router_bgp::dampening_unreachability_half_life? dampening_unreachability_half_life=null¶: Unreachability half-life time for penalty (min).

attribute fortigate::router_bgp::default_local_preference? default_local_preference=null¶: Default local preference.

attribute fortigate::common::enable_disable_t? deterministic_med=null¶: Enable/disable enforce deterministic comparison of MED. enable:Enable setting. disable:Disable setting.

attribute fortigate::router_bgp::distance_external? distance_external=null¶: Distance for routes external to the AS.

attribute fortigate::router_bgp::distance_internal? distance_internal=null¶: Distance for routes internal to the AS.

attribute fortigate::router_bgp::distance_local? distance_local=null¶: Distance for routes local to the AS.

attribute fortigate::common::enable_disable_t? ebgp_multipath=null¶: Enable/disable EBGP multi-path. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? enforce_first_as=null¶: Enable/disable enforce first AS for EBGP routes. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? fast_external_failover=null¶: Enable/disable reset peer BGP session if link goes down. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? graceful_end_on_timer=null¶: Enable/disable to exit graceful restart on timer only. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? graceful_restart=null¶: Enable/disable BGP graceful restart capabilities. enable:Enable setting. disable:Disable setting.

attribute fortigate::router_bgp::graceful_restart_time? graceful_restart_time=null¶: Time needed for neighbors to restart (sec).

attribute fortigate::router_bgp::graceful_stalepath_time? graceful_stalepath_time=null¶: Time to hold stale paths of restarting neighbor (sec).

attribute fortigate::router_bgp::graceful_update_delay? graceful_update_delay=null¶: Route advertisement/selection delay after restart (sec).

attribute fortigate::router_bgp::holdtime_timer? holdtime_timer=null¶: Number of seconds to mark peer as dead.

attribute fortigate::common::enable_disable_t? ibgp_multipath=null¶: Enable/disable IBGP multi-path. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? ignore_optional_capability=null¶: Do not send unknown optional capability notification message. enable:Enable setting. disable:Disable setting.

attribute fortigate::router_bgp::keepalive_timer? keepalive_timer=null¶: Frequency to send keep alive requests.

attribute fortigate::common::enable_disable_t? log_neighbour_changes=null¶: Log BGP neighbor changes. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? multipath_recursive_distance=null¶: Enable/disable use of recursive distance to select multipath. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? network_import_check=null¶: Enable/disable ensure BGP network route exists in IGP. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? recursive_inherit_priority=null¶: Enable/disable priority inheritance for recursive resolution. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? recursive_next_hop=null¶: Enable/disable recursive resolution of next-hop using BGP route. enable:Enable setting. disable:Disable setting.

attribute string? router_id=null¶: Router ID.

attribute fortigate::router_bgp::scan_time? scan_time=null¶: Background scanner interval (sec), 0 to disable it.

attribute fortigate::common::enable_disable_t? synchronization=null¶: Enable/disable only advertise routes from iBGP if routes present in an IGP. enable:Enable setting. disable:Disable setting.

attribute fortigate::router_bgp::tag_resolve_mode? tag_resolve_mode=null¶: Configure tag-match mode. Resolves BGP routes with other routes containing the same tag. disable:Disable tag-match mode. preferred:Use tag-match if a BGP route resolution with another route containing the same tag is successful. merge:Merge tag-match with best-match if they are using different routes. The result will exclude the next hops of tag-match whose interfaces have appeared in best-match. :rel admin_distance: :rel aggregate_address: :rel aggregate_address6: :rel confederation_peers: :rel neighbor: :rel neighbor_group: :rel neighbor_range: :rel neighbor_range6: :rel network: :rel network6: :rel redistribute: :rel redistribute6: :rel vrf: :rel vrf6:

relation fortigate::router_bgp::AdminDistance admin_distance [0:*]¶: other end: fortigate::router_bgp::AdminDistance._parent [1]

relation fortigate::router_bgp::AggregateAddress aggregate_address [0:*]¶: other end: fortigate::router_bgp::AggregateAddress._parent [1]

relation fortigate::router_bgp::AggregateAddress6 aggregate_address6 [0:*]¶: other end: fortigate::router_bgp::AggregateAddress6._parent [1]

relation fortigate::router_bgp::ConfederationPeers confederation_peers [0:*]¶: other end: fortigate::router_bgp::ConfederationPeers._parent [1]

relation fortigate::router_bgp::Neighbor neighbor [0:*]¶: other end: fortigate::router_bgp::Neighbor._parent [1]

relation fortigate::router_bgp::NeighborGroup neighbor_group [0:*]¶: other end: fortigate::router_bgp::NeighborGroup._parent [1]

relation fortigate::router_bgp::NeighborRange neighbor_range [0:*]¶: other end: fortigate::router_bgp::NeighborRange._parent [1]

relation fortigate::router_bgp::NeighborRange6 neighbor_range6 [0:*]¶: other end: fortigate::router_bgp::NeighborRange6._parent [1]

relation fortigate::router_bgp::Network network [0:*]¶: other end: fortigate::router_bgp::Network._parent [1]

relation fortigate::router_bgp::Network6 network6 [0:*]¶: other end: fortigate::router_bgp::Network6._parent [1]

relation fortigate::router_bgp::Redistribute redistribute [0:*]¶: other end: fortigate::router_bgp::Redistribute._parent [1]

relation fortigate::router_bgp::Redistribute6 redistribute6 [0:*]¶: other end: fortigate::router_bgp::Redistribute6._parent [1]

relation fortigate::router_bgp::Vrf vrf [0:*]¶: other end: fortigate::router_bgp::Vrf._parent [1]

relation fortigate::router_bgp::Vrf6 vrf6 [0:*]¶: other end: fortigate::router_bgp::Vrf6._parent [1]

The following implements statements select implementations for this entity:

entity fortigate::DosPolicy¶

Parents: fortigate::base::PolicyResource

attribute fortigate::firewall__dos_policy::comments? comments=null¶: Comment.

attribute fortigate::firewall__dos_policy::interface? interface=null¶: Incoming interface name from available interfaces.

attribute fortigate::firewall__dos_policy::name? name=null¶: Policy name.

attribute fortigate::firewall__dos_policy::policyid policyid¶: Policy ID.

attribute fortigate::common::enable_disable_t? status=null¶: Enable/disable this policy. enable:Enable this policy. disable:Disable this policy. :rel anomaly: :rel dstaddr: :rel service: :rel srcaddr:

relation fortigate::firewall__dos_policy::Anomaly anomaly [0:*]¶: other end: fortigate::firewall__dos_policy::Anomaly._parent [1]

relation fortigate::firewall__dos_policy::Dstaddr dstaddr [0:*]¶: other end: fortigate::firewall__dos_policy::Dstaddr._parent [1]

relation fortigate::firewall__dos_policy::Service service [0:*]¶: other end: fortigate::firewall__dos_policy::Service._parent [1]

relation fortigate::firewall__dos_policy::Srcaddr srcaddr [0:*]¶: other end: fortigate::firewall__dos_policy::Srcaddr._parent [1]

relation fortigate::base::DosPolicyRange parent [0:1]¶: other end: fortigate::base::DosPolicyRange.policies [0:*]

The following implements statements select implementations for this entity:

entity fortigate::DosPolicy6¶

Parents: fortigate::base::PolicyResource

attribute fortigate::firewall__dos_policy6::comments? comments=null¶: Comment.

attribute fortigate::firewall__dos_policy6::interface? interface=null¶: Incoming interface name from available interfaces.

attribute fortigate::firewall__dos_policy6::name? name=null¶: Policy name.

attribute fortigate::firewall__dos_policy6::policyid policyid¶: Policy ID.

attribute fortigate::common::enable_disable_t? status=null¶: Enable/disable this policy. enable:Enable this policy. disable:Disable this policy. :rel anomaly: :rel dstaddr: :rel service: :rel srcaddr:

relation fortigate::firewall__dos_policy6::Anomaly anomaly [0:*]¶: other end: fortigate::firewall__dos_policy6::Anomaly._parent [1]

relation fortigate::firewall__dos_policy6::Dstaddr dstaddr [0:*]¶: other end: fortigate::firewall__dos_policy6::Dstaddr._parent [1]

relation fortigate::firewall__dos_policy6::Service service [0:*]¶: other end: fortigate::firewall__dos_policy6::Service._parent [1]

relation fortigate::firewall__dos_policy6::Srcaddr srcaddr [0:*]¶: other end: fortigate::firewall__dos_policy6::Srcaddr._parent [1]

relation fortigate::base::DosPolicy6Range parent [0:1]¶: other end: fortigate::base::DosPolicy6Range.policies [0:*]

The following implements statements select implementations for this entity:

entity fortigate::Interface¶

Parents: fortigate::base::VdomResource

attribute fortigate::system_interface::ac_name? ac_name=null¶: PPPoE server name.

attribute fortigate::system_interface::aggregate? aggregate=null¶: Aggregate interface.

attribute fortigate::system_interface::aggregate_type? aggregate_type=null¶: Type of aggregation. physical:Physical interface aggregation. vxlan:VXLAN interface aggregation.

attribute fortigate::system_interface::algorithm? algorithm=null¶: Frame distribution algorithm. L2:Use layer 2 address for distribution. L3:Use layer 3 address for distribution. L4:Use layer 4 information for distribution. Source-MAC:Use source MAC address for distribution.

attribute fortigate::system_interface::alias? alias=null¶: Alias will be displayed with the interface name to make it easier to distinguish.

attribute fortigate::system_interface::allowaccess[]? allowaccess=null¶: Permitted types of management access to this interface. ping:PING access. https:HTTPS access. ssh:SSH access. snmp:SNMP access. http:HTTP access. telnet:TELNET access. fgfm:FortiManager access. radius-acct:RADIUS accounting access. probe-response:Probe access. fabric:Security Fabric access. ftm:FTM access. speed-test:Speed test access.

attribute fortigate::common::enable_disable_t? ap_discover=null¶: Enable/disable automatic registration of unknown FortiAP devices. enable:Enable automatic registration of unknown FortiAP devices. disable:Disable automatic registration of unknown FortiAP devices.

attribute fortigate::common::enable_disable_t? arpforward=null¶: Enable/disable ARP forwarding. enable:Enable ARP forwarding. disable:Disable ARP forwarding.

attribute fortigate::system_interface::auth_cert? auth_cert=null¶: HTTPS server certificate.

attribute fortigate::system_interface::auth_portal_addr? auth_portal_addr=null¶: Address of captive portal.

attribute fortigate::system_interface::auth_type? auth_type=null¶: PPP authentication type to use. auto:Automatically choose authentication. pap:PAP authentication. chap:CHAP authentication. mschapv1:MS-CHAPv1 authentication. mschapv2:MS-CHAPv2 authentication.

attribute fortigate::common::enable_disable_t? auto_auth_extension_device=null¶: Enable/disable automatic authorization of dedicated Fortinet extension device on this interface. enable:Enable automatic authorization of dedicated Fortinet extension device on this interface. disable:Disable automatic authorization of dedicated Fortinet extension device on this interface.

attribute fortigate::system_interface::bandwidth_measure_time? bandwidth_measure_time=null¶: Bandwidth measure time.

attribute fortigate::system_interface::bfd? bfd=null¶: Bidirectional Forwarding Detection (BFD) settings. global:BFD behavior of this interface will be based on global configuration. enable:Enable BFD on this interface and ignore global configuration. disable:Disable BFD on this interface and ignore global configuration.

attribute fortigate::system_interface::bfd_desired_min_tx? bfd_desired_min_tx=null¶: BFD desired minimal transmit interval.

attribute fortigate::system_interface::bfd_detect_mult? bfd_detect_mult=null¶: BFD detection multiplier.

attribute fortigate::system_interface::bfd_required_min_rx? bfd_required_min_rx=null¶: BFD required minimal receive interval.

attribute fortigate::common::enable_disable_t? broadcast_forward=null¶: Enable/disable broadcast forwarding. enable:Enable broadcast forwarding. disable:Disable broadcast forwarding.

attribute fortigate::system_interface::cli_conn_status? cli_conn_status=null¶: CLI connection status.

attribute fortigate::system_interface::color? color=null¶: Color of icon on the GUI.

attribute fortigate::system_interface::dedicated_to? dedicated_to=null¶: Configure interface for single purpose. none:Interface not dedicated for any purpose. management:Dedicate this interface for management purposes only.

attribute fortigate::common::enable_disable_t? defaultgw=null¶: Enable to get the gateway IP from the DHCP or PPPoE server. enable:Enable default gateway. disable:Disable default gateway.

attribute fortigate::system_interface::description? description=null¶: Description.

attribute fortigate::system_interface::detected_peer_mtu? detected_peer_mtu=null¶: MTU of detected peer (0 - 4294967295).

attribute fortigate::system_interface::detectprotocol? detectprotocol=null¶: Protocols used to detect the server. ping:PING. tcp-echo:TCP echo. udp-echo:UDP echo.

attribute string? detectserver=null¶: Gateway’s ping server for this IP.

attribute fortigate::common::enable_disable_t? device_identification=null¶: Enable/disable passively gathering of device identity information about the devices on the network connected to this interface. enable:Enable passive gathering of identity information about hosts. disable:Disable passive gathering of identity information about hosts.

attribute fortigate::common::enable_disable_t? device_user_identification=null¶: Enable/disable passive gathering of user identity information about users on this interface. enable:Enable passive gathering of user identity information about users. disable:Disable passive gathering of user identity information about users.

attribute fortigate::system_interface::devindex? devindex=null¶: Device Index.

attribute fortigate::common::enable_disable_t? dhcp_classless_route_addition=null¶: Enable/disable addition of classless static routes retrieved from DHCP server. enable:Enable addition of classless static routes retrieved from DHCP server. disable:Disable addition of classless static routes retrieved from DHCP server.

attribute fortigate::system_interface::dhcp_client_identifier? dhcp_client_identifier=null¶: DHCP client identifier.

attribute fortigate::common::enable_disable_t? dhcp_relay_agent_option=null¶: Enable/disable DHCP relay agent option. enable:Enable DHCP relay agent option. disable:Disable DHCP relay agent option.

attribute fortigate::system_interface::dhcp_relay_interface? dhcp_relay_interface=null¶: Specify outgoing interface to reach server.

attribute fortigate::system_interface::dhcp_relay_interface_select_method? dhcp_relay_interface_select_method=null¶: Specify how to select outgoing interface to reach server. auto:Set outgoing interface automatically. sdwan:Set outgoing interface by SD-WAN or policy routing rules. specify:Set outgoing interface manually.

attribute string? dhcp_relay_ip=null¶: DHCP relay IP address.

attribute string? dhcp_relay_link_selection=null¶: DHCP relay link selection.

attribute fortigate::common::enable_disable_t? dhcp_relay_request_all_server=null¶: Enable/disable sending of DHCP requests to all servers. disable:Send DHCP requests only to a matching server. enable:Send DHCP requests to all servers.

attribute fortigate::common::enable_disable_t? dhcp_relay_service=null¶: Enable/disable allowing this interface to act as a DHCP relay. disable:None. enable:DHCP relay agent.

attribute fortigate::system_interface::dhcp_relay_type? dhcp_relay_type=null¶: DHCP relay type (regular or IPsec). regular:Regular DHCP relay. ipsec:DHCP relay for IPsec.

attribute fortigate::system_interface::dhcp_renew_time? dhcp_renew_time=null¶: DHCP renew time in seconds (300-604800), 0 means use the renew time provided by the server.

attribute fortigate::system_interface::disc_retry_timeout? disc_retry_timeout=null¶: Time in seconds to wait before retrying to start a PPPoE discovery, 0 means no timeout.

attribute fortigate::system_interface::disconnect_threshold? disconnect_threshold=null¶: Time in milliseconds to wait before sending a notification that this interface is down or disconnected.

attribute fortigate::system_interface::distance? distance=null¶: Distance for routes learned through PPPoE or DHCP, lower distance indicates preferred route.

attribute fortigate::common::enable_disable_t? dns_server_override=null¶: Enable/disable use DNS acquired by DHCP or PPPoE. enable:Use DNS acquired by DHCP or PPPoE. disable:No not use DNS acquired by DHCP or PPPoE.

attribute fortigate::system_interface::dns_server_protocol? dns_server_protocol=null¶: DNS transport protocols. cleartext:DNS over UDP/53, DNS over TCP/53. dot:DNS over TLS/853. doh:DNS over HTTPS/443.

attribute fortigate::common::enable_disable_t? drop_fragment=null¶: Enable/disable drop fragment packets. enable:Enable/disable drop fragment packets. disable:Do not drop fragment packets.

attribute fortigate::common::enable_disable_t? drop_overlapped_fragment=null¶: Enable/disable drop overlapped fragment packets. enable:Enable drop of overlapped fragment packets. disable:Disable drop of overlapped fragment packets.

attribute fortigate::common::name_t? eap_ca_cert=null¶: EAP CA certificate name.

attribute fortigate::system_interface::eap_identity? eap_identity=null¶: EAP identity.

attribute fortigate::system_interface::eap_method? eap_method=null¶: EAP method. tls:TLS. peap:PEAP.

attribute string? eap_password=null¶: EAP password.

attribute fortigate::common::enable_disable_t? eap_supplicant=null¶: Enable/disable EAP-Supplicant. enable:Enable EAP Supplicant. disable:Disable EAP Supplicant.

attribute fortigate::system_interface::eap_user_cert? eap_user_cert=null¶: EAP user certificate name.

attribute fortigate::system_interface::egress_shaping_profile? egress_shaping_profile=null¶: Outgoing traffic shaping profile.

attribute fortigate::system_interface::estimated_downstream_bandwidth? estimated_downstream_bandwidth=null¶: Estimated maximum downstream bandwidth (kbps). Used to estimate link utilization.

attribute fortigate::system_interface::estimated_upstream_bandwidth? estimated_upstream_bandwidth=null¶: Estimated maximum upstream bandwidth (kbps). Used to estimate link utilization.

attribute fortigate::common::enable_disable_t? explicit_ftp_proxy=null¶: Enable/disable the explicit FTP proxy on this interface. enable:Enable explicit FTP proxy on this interface. disable:Disable explicit FTP proxy on this interface.

attribute fortigate::common::enable_disable_t? explicit_web_proxy=null¶: Enable/disable the explicit web proxy on this interface. enable:Enable explicit Web proxy on this interface. disable:Disable explicit Web proxy on this interface.

attribute fortigate::common::enable_disable_t? external=null¶: Enable/disable identifying the interface as an external interface (which usually means it’s connected to the Internet). enable:Enable identifying the interface as an external interface. disable:Disable identifying the interface as an external interface.

attribute fortigate::system_interface::fail_action_on_extender? fail_action_on_extender=null¶: Action on FortiExtender when interface fail. soft-restart:Soft-restart-on-extender. hard-restart:Hard-restart-on-extender. reboot:Reboot-on-extender.

attribute fortigate::system_interface::fail_alert_method? fail_alert_method=null¶: Select link-failed-signal or link-down method to alert about a failed link. link-failed-signal:Link-failed-signal. link-down:Link-down.

attribute fortigate::common::enable_disable_t? fail_detect=null¶: Enable/disable fail detection features for this interface. enable:Enable interface failed option status. disable:Disable interface failed option status.

attribute fortigate::system_interface::fail_detect_option? fail_detect_option=null¶: Options for detecting that this interface has failed. detectserver:Use a ping server to determine if the interface has failed. link-down:Use port detection to determine if the interface has failed.

attribute fortigate::common::enable_disable_t? fortilink=null¶: Enable FortiLink to dedicate this interface to manage other Fortinet devices. enable:Enable FortiLink to dedicated interface for managing FortiSwitch devices. disable:Disable FortiLink to dedicated interface for managing FortiSwitch devices.

attribute fortigate::system_interface::fortilink_backup_link? fortilink_backup_link=null¶: FortiLink split interface backup link.

attribute fortigate::system_interface::fortilink_neighbor_detect? fortilink_neighbor_detect=null¶: Protocol for FortiGate neighbor discovery. lldp:Detect FortiLink neighbors using LLDP protocol. fortilink:Detect FortiLink neighbors using FortiLink protocol.

attribute fortigate::common::enable_disable_t? fortilink_split_interface=null¶: Enable/disable FortiLink split interface to connect member link to different FortiSwitch in stack for uplink redundancy. enable:Enable FortiLink split interface to connect member link to different FortiSwitch in stack for uplink redundancy. disable:Disable FortiLink split interface.

attribute fortigate::system_interface::forward_domain? forward_domain=null¶: Transparent mode forward domain.

attribute fortigate::common::enable_disable_t? gwdetect=null¶: Enable/disable detect gateway alive for first. enable:Enable detect gateway alive for first. disable:Disable detect gateway alive for first.

attribute fortigate::system_interface::ha_priority? ha_priority=null¶: HA election priority for the PING server.

attribute fortigate::common::enable_disable_t? icmp_accept_redirect=null¶: Enable/disable ICMP accept redirect. enable:Enable ICMP accept redirect. disable:Disable ICMP accept redirect.

attribute fortigate::common::enable_disable_t? icmp_send_redirect=null¶: Enable/disable sending of ICMP redirects. enable:Enable sending of ICMP redirects. disable:Disable sending of ICMP redirects.

attribute fortigate::common::enable_disable_t? ident_accept=null¶: Enable/disable authentication for this interface. enable:Enable determining a user’s identity from packet identification. disable:Disable determining a user’s identity from packet identification.

attribute fortigate::system_interface::idle_timeout? idle_timeout=null¶: PPPoE auto disconnect after idle timeout seconds, 0 means no timeout.

attribute fortigate::system_interface::ike_saml_server? ike_saml_server=null¶: Configure IKE authentication SAML server.

attribute fortigate::system_interface::inbandwidth? inbandwidth=null¶: Bandwidth limit for incoming traffic (0 - 80000000 kbps), 0 means unlimited.

attribute fortigate::system_interface::ingress_shaping_profile? ingress_shaping_profile=null¶: Incoming traffic shaping profile.

attribute fortigate::system_interface::ingress_spillover_threshold? ingress_spillover_threshold=null¶: Ingress Spillover threshold (0 - 16776000 kbps), 0 means unlimited.

attribute fortigate::system_interface::interface? interface=null¶: Interface name.

attribute fortigate::system_interface::internal? internal=null¶: Implicitly created.

attribute string? ip=null¶: Interface IPv4 address and subnet mask, syntax: X.X.X.X/24.

attribute fortigate::common::enable_disable_t? ip_managed_by_fortiipam=null¶: Enable/disable automatic IP address assignment of this interface by FortiIPAM. enable:Enable automatic IP address assignment of this interface by FortiIPAM. disable:Disable automatic IP address assignment of this interface by FortiIPAM.

attribute fortigate::common::enable_disable_t? ipmac=null¶: Enable/disable IP/MAC binding. enable:Enable IP/MAC binding. disable:Disable IP/MAC binding.

attribute fortigate::common::enable_disable_t? ips_sniffer_mode=null¶: Enable/disable the use of this interface as a one-armed sniffer. enable:Enable IPS sniffer mode. disable:Disable IPS sniffer mode.

attribute string? ipunnumbered=null¶: Unnumbered IP used for PPPoE interfaces for which no unique local address is provided.

attribute fortigate::common::enable_disable_t? l2forward=null¶: Enable/disable l2 forwarding. enable:Enable L2 forwarding. disable:Disable L2 forwarding.

attribute fortigate::common::enable_disable_t? l2tp_client=null¶: Enable/disable this interface as a Layer 2 Tunnelling Protocol (L2TP) client. enable:Enable L2TP client. disable:Disable L2TP client.

attribute fortigate::common::enable_disable_t? lacp_ha_secondary=null¶: LACP HA secondary member. enable:Allow HA secondary member to send/receive LACP messages. disable:Block HA secondary member from sending/receiving LACP messages.

attribute fortigate::system_interface::lacp_mode? lacp_mode=null¶: LACP mode. static:Use static aggregation, do not send and ignore any LACP messages. passive:Passively use LACP to negotiate 802.3ad aggregation. active:Actively use LACP to negotiate 802.3ad aggregation.

attribute fortigate::system_interface::lacp_speed? lacp_speed=null¶: How often the interface sends LACP messages. slow:Send LACP message every 30 seconds. fast:Send LACP message every second.

attribute fortigate::system_interface::lcp_echo_interval? lcp_echo_interval=null¶: Time in seconds between PPPoE Link Control Protocol (LCP) echo requests.

attribute fortigate::system_interface::lcp_max_echo_fails? lcp_max_echo_fails=null¶: Maximum missed LCP echo messages before disconnect.

attribute fortigate::system_interface::link_up_delay? link_up_delay=null¶: Number of milliseconds to wait before considering a link is up.

attribute fortigate::system_interface::lldp_network_policy? lldp_network_policy=null¶: LLDP-MED network policy profile.

attribute fortigate::system_interface::lldp_reception? lldp_reception=null¶: Enable/disable Link Layer Discovery Protocol (LLDP) reception. enable:Enable reception of Link Layer Discovery Protocol (LLDP). disable:Disable reception of Link Layer Discovery Protocol (LLDP). vdom:Use VDOM Link Layer Discovery Protocol (LLDP) reception configuration setting.

attribute fortigate::system_interface::lldp_transmission? lldp_transmission=null¶: Enable/disable Link Layer Discovery Protocol (LLDP) transmission. enable:Enable transmission of Link Layer Discovery Protocol (LLDP). disable:Disable transmission of Link Layer Discovery Protocol (LLDP). vdom:Use VDOM Link Layer Discovery Protocol (LLDP) transmission configuration setting.

attribute string? macaddr=null¶: Change the interface’s MAC address.

attribute fortigate::system_interface::managed_subnetwork_size? managed_subnetwork_size=null¶: Number of IP addresses to be allocated by FortiIPAM and used by this FortiGate unit’s DHCP server settings. 32:Allocate a subnet with 32 IP addresses. 64:Allocate a subnet with 64 IP addresses. 128:Allocate a subnet with 128 IP addresses. 256:Allocate a subnet with 256 IP addresses. 512:Allocate a subnet with 512 IP addresses. 1024:Allocate a subnet with 1024 IP addresses. 2048:Allocate a subnet with 2048 IP addresses. 4096:Allocate a subnet with 4096 IP addresses. 8192:Allocate a subnet with 8192 IP addresses. 16384:Allocate a subnet with 16384 IP addresses. 32768:Allocate a subnet with 32768 IP addresses. 65536:Allocate a subnet with 65536 IP addresses.

attribute string? management_ip=null¶: High Availability in-band management IP address of this interface.

attribute fortigate::system_interface::measured_downstream_bandwidth? measured_downstream_bandwidth=null¶: Measured downstream bandwidth (kbps).

attribute fortigate::system_interface::measured_upstream_bandwidth? measured_upstream_bandwidth=null¶: Measured upstream bandwidth (kbps).

attribute fortigate::system_interface::min_links? min_links=null¶: Minimum number of aggregated ports that must be up.

attribute fortigate::system_interface::min_links_down? min_links_down=null¶: Action to take when less than the configured minimum number of links are active. operational:Set the aggregate operationally down. administrative:Set the aggregate administratively down.

attribute fortigate::system_interface::mode? mode=null¶: Addressing mode (static, DHCP, PPPoE). static:Static setting. dhcp:External DHCP client mode. pppoe:External PPPoE mode.

attribute fortigate::common::enable_disable_t? monitor_bandwidth=null¶: Enable monitoring bandwidth on this interface. enable:Enable monitoring bandwidth on this interface. disable:Disable monitoring bandwidth on this interface.

attribute fortigate::system_interface::mtu? mtu=null¶: MTU value for this interface.

attribute fortigate::common::enable_disable_t? mtu_override=null¶: Enable to set a custom MTU for this interface. enable:Override default MTU. disable:Use default MTU.

attribute fortigate::system_interface::name name¶: Name.

attribute fortigate::common::enable_disable_t? ndiscforward=null¶: Enable/disable NDISC forwarding. enable:Enable NDISC forwarding. disable:Disable NDISC forwarding.

attribute fortigate::common::enable_disable_t? netbios_forward=null¶: Enable/disable NETBIOS forwarding. disable:Disable NETBIOS forwarding. enable:Enable NETBIOS forwarding.

attribute fortigate::system_interface::netflow_sampler? netflow_sampler=null¶: Enable/disable NetFlow on this interface and set the data that NetFlow collects (rx, tx, or both). disable:Disable NetFlow protocol on this interface. tx:Monitor transmitted traffic on this interface. rx:Monitor received traffic on this interface. both:Monitor transmitted/received traffic on this interface.

attribute fortigate::system_interface::outbandwidth? outbandwidth=null¶: Bandwidth limit for outgoing traffic (0 - 80000000 kbps).

attribute fortigate::system_interface::padt_retry_timeout? padt_retry_timeout=null¶: PPPoE Active Discovery Terminate (PADT) used to terminate sessions after an idle time.

attribute string? password=null¶: PPPoE account’s password.

attribute string? physical=null¶: Print physical interface information.

attribute fortigate::system_interface::ping_serv_status? ping_serv_status=null¶: PING server status.

attribute fortigate::system_interface::polling_interval? polling_interval=null¶: sFlow polling interval in seconds (1 - 255).

attribute fortigate::common::enable_disable_t? pppoe_unnumbered_negotiate=null¶: Enable/disable PPPoE unnumbered negotiation. enable:Enable IP address negotiating for unnumbered. disable:Disable IP address negotiating for unnumbered.

attribute fortigate::system_interface::pptp_auth_type? pptp_auth_type=null¶: PPTP authentication type. auto:Automatically choose authentication. pap:PAP authentication. chap:CHAP authentication. mschapv1:MS-CHAPv1 authentication. mschapv2:MS-CHAPv2 authentication.

attribute fortigate::common::enable_disable_t? pptp_client=null¶: Enable/disable PPTP client. enable:Enable PPTP client. disable:Disable PPTP client.

attribute string? pptp_password=null¶: PPTP password.

attribute string? pptp_server_ip=null¶: PPTP server IP address.

attribute fortigate::system_interface::pptp_timeout? pptp_timeout=null¶: Idle timer in minutes (0 for disabled).

attribute fortigate::system_interface::pptp_user? pptp_user=null¶: PPTP user name.

attribute fortigate::common::enable_disable_t? preserve_session_route=null¶: Enable/disable preservation of session route when dirty. enable:Enable preservation of session route when dirty. disable:Disable preservation of session route when dirty.

attribute fortigate::system_interface::priority? priority=null¶: Priority of learned routes.

attribute fortigate::common::enable_disable_t? priority_override=null¶: Enable/disable fail back to higher priority port once recovered. enable:Enable fail back to higher priority port once recovered. disable:Disable fail back to higher priority port once recovered.

attribute fortigate::common::enable_disable_t? proxy_captive_portal=null¶: Enable/disable proxy captive portal on this interface. enable:Enable proxy captive portal on this interface. disable:Disable proxy captive portal on this interface.

attribute fortigate::system_interface::reachable_time? reachable_time=null¶: IPv4 reachable time in milliseconds (30000 - 3600000, default = 30000).

attribute fortigate::system_interface::redundant_interface? redundant_interface=null¶: Redundant interface.

attribute string? remote_ip=null¶: Remote IP address of tunnel.

attribute fortigate::system_interface::replacemsg_override_group? replacemsg_override_group=null¶: Replacement message override group.

attribute fortigate::system_interface::role? role=null¶: Interface role. lan:Connected to local network of endpoints. wan:Connected to Internet. dmz:Connected to server zone. undefined:Interface has no specific role.

attribute fortigate::system_interface::sample_direction? sample_direction=null¶: Data that NetFlow collects (rx, tx, or both). tx:Monitor transmitted traffic on this interface. rx:Monitor received traffic on this interface. both:Monitor transmitted/received traffic on this interface.

attribute fortigate::system_interface::sample_rate? sample_rate=null¶: sFlow sample rate (10 - 99999).

attribute fortigate::common::enable_disable_t? secondary_ip=null¶: Enable/disable adding a secondary IP to this interface. enable:Enable secondary IP. disable:Disable secondary IP.

attribute fortigate::system_interface::security_8021x_dynamic_vlan_id? security_8021x_dynamic_vlan_id=null¶: VLAN ID for virtual switch.

attribute fortigate::system_interface::security_8021x_master? security_8021x_master=null¶: 802.1X master virtual-switch.

attribute fortigate::system_interface::security_8021x_mode? security_8021x_mode=null¶: 802.1X mode. default:802.1X default mode. dynamic-vlan:802.1X dynamic VLAN (master) mode. fallback:802.1X fallback (master) mode. slave:802.1X slave mode.

attribute fortigate::system_interface::security_exempt_list? security_exempt_list=null¶: Name of security-exempt-list.

attribute fortigate::system_interface::security_external_logout? security_external_logout=null¶: URL of external authentication logout server.

attribute fortigate::system_interface::security_external_web? security_external_web=null¶: URL of external authentication web server.

attribute fortigate::system_interface::security_mac_auth_bypass? security_mac_auth_bypass=null¶: Enable/disable MAC authentication bypass. mac-auth-only:Enable MAC authentication bypass without EAP. enable:Enable MAC authentication bypass. disable:Disable MAC authentication bypass.

attribute fortigate::system_interface::security_mode? security_mode=null¶: Turn on captive portal authentication for this interface. none:No security option. captive-portal:Captive portal authentication. 802.1X:802.1X port-based authentication.

attribute fortigate::system_interface::security_redirect_url? security_redirect_url=null¶: URL redirection after disclaimer/authentication.

attribute fortigate::system_interface::service_name? service_name=null¶: PPPoE service name.

attribute fortigate::common::enable_disable_t? sflow_sampler=null¶: Enable/disable sFlow on this interface. enable:Enable sFlow protocol on this interface. disable:Disable sFlow protocol on this interface.

attribute fortigate::system_interface::snmp_index? snmp_index=null¶: Permanent SNMP Index of the interface.

attribute fortigate::system_interface::speed? speed=null¶: Interface speed. The default setting and the options available depend on the interface hardware. auto:Automatically adjust speed. 10full:10M full-duplex. 10half:10M half-duplex. 100full:100M full-duplex. 100half:100M half-duplex. 1000full:1000M full-duplex. 1000auto:1000M auto adjust.

attribute fortigate::system_interface::spillover_threshold? spillover_threshold=null¶: Egress Spillover threshold (0 - 16776000 kbps), 0 means unlimited.

attribute fortigate::common::enable_disable_t? src_check=null¶: Enable/disable source IP check. enable:Enable source IP check. disable:Disable source IP check.

attribute fortigate::system_interface::status? status=null¶: Bring the interface up or shut the interface down. up:Bring the interface up. down:Shut the interface down.

attribute fortigate::common::enable_disable_t? stp=null¶: Enable/disable STP. disable:Disable STP. enable:Enable STP.

attribute fortigate::system_interface::stp_ha_secondary? stp_ha_secondary=null¶: Control STP behavior on HA secondary. disable:Disable STP negotiation on HA secondary. enable:Enable STP negotiation on HA secondary. priority-adjust:Enable STP negotiation on HA secondary and make priority lower than HA primary.

attribute fortigate::common::enable_disable_t? stpforward=null¶: Enable/disable STP forwarding. enable:Enable STP forwarding. disable:Disable STP forwarding.

attribute fortigate::system_interface::stpforward_mode? stpforward_mode=null¶: Configure STP forwarding mode. rpl-all-ext-id:Replace all extension IDs (root, bridge). rpl-bridge-ext-id:Replace the bridge extension ID only. rpl-nothing:Replace nothing.

attribute fortigate::common::enable_disable_t? subst=null¶: Enable to always send packets from this interface to a destination MAC address. enable:Send packets from this interface. disable:Do not send packets from this interface.

attribute string? substitute_dst_mac=null¶: Destination MAC address that all packets are sent to from this interface.

attribute fortigate::system_interface::swc_first_create? swc_first_create=null¶: Initial create for switch-controller VLANs.

attribute fortigate::system_interface::swc_vlan? swc_vlan=null¶: Creation status for switch-controller VLANs.

attribute fortigate::system_interface::switch? switch=null¶: Contained in switch.

attribute fortigate::common::enable_disable_t? switch_controller_access_vlan=null¶: Block FortiSwitch port-to-port traffic. enable:Block FortiSwitch port-to-port traffic on the VLAN, only permitting traffic to and from the FortiGate. disable:Allow normal VLAN traffic.

attribute fortigate::common::enable_disable_t? switch_controller_arp_inspection=null¶: Enable/disable FortiSwitch ARP inspection. enable:Enable ARP inspection for FortiSwitch devices. disable:Disable ARP inspection for FortiSwitch devices.

attribute fortigate::common::enable_disable_t? switch_controller_dhcp_snooping=null¶: Switch controller DHCP snooping. enable:Enable DHCP snooping for FortiSwitch devices. disable:Disable DHCP snooping for FortiSwitch devices.

attribute fortigate::common::enable_disable_t? switch_controller_dhcp_snooping_option82=null¶: Switch controller DHCP snooping option82. enable:Enable DHCP snooping insert option82 for FortiSwitch devices. disable:Disable DHCP snooping insert option82 for FortiSwitch devices.

attribute fortigate::common::enable_disable_t? switch_controller_dhcp_snooping_verify_mac=null¶: Switch controller DHCP snooping verify MAC. enable:Enable DHCP snooping verify source MAC for FortiSwitch devices. disable:Disable DHCP snooping verify source MAC for FortiSwitch devices.

attribute fortigate::system_interface::switch_controller_dynamic? switch_controller_dynamic=null¶: Integrated FortiLink settings for managed FortiSwitch.

attribute fortigate::system_interface::switch_controller_feature? switch_controller_feature=null¶: Interface’s purpose when assigning traffic (read only). none:VLAN for generic purpose. default-vlan:Default VLAN (native) assigned to all switch ports upon discovery. quarantine:VLAN for quarantined traffic. rspan:VLAN for RSPAN/ERSPAN mirrored traffic. voice:VLAN dedicated for voice devices. video:VLAN dedicated for camera devices. nac:VLAN dedicated for NAC onboarding devices. nac-segment:VLAN dedicated for NAC segment devices.

attribute fortigate::common::enable_disable_t? switch_controller_igmp_snooping=null¶: Switch controller IGMP snooping. enable:Enable IGMP snooping. disable:Disable IGMP snooping.

attribute fortigate::common::enable_disable_t? switch_controller_igmp_snooping_fast_leave=null¶: Switch controller IGMP snooping fast-leave. enable:Enable IGMP snooping fast-leave. disable:Disable IGMP snooping fast-leave.

attribute fortigate::common::enable_disable_t? switch_controller_igmp_snooping_proxy=null¶: Switch controller IGMP snooping proxy. enable:Enable IGMP snooping proxy. disable:Disable IGMP snooping proxy.

attribute fortigate::common::enable_disable_t? switch_controller_iot_scanning=null¶: Enable/disable managed FortiSwitch IoT scanning. enable:Enable IoT scanning for managed FortiSwitch devices. disable:Disable IoT scanning for managed FortiSwitch devices.

attribute fortigate::system_interface::switch_controller_learning_limit? switch_controller_learning_limit=null¶: Limit the number of dynamic MAC addresses on this VLAN (1 - 128, 0 = no limit, default).

attribute fortigate::system_interface::switch_controller_mgmt_vlan? switch_controller_mgmt_vlan=null¶: VLAN to use for FortiLink management purposes.

attribute fortigate::system_interface::switch_controller_nac? switch_controller_nac=null¶: Integrated FortiLink settings for managed FortiSwitch.

attribute fortigate::common::enable_disable_t? switch_controller_netflow_collect=null¶: NetFlow collection and processing. disable:Disable NetFlow collection. enable:Enable NetFlow collection.

attribute fortigate::common::enable_disable_t? switch_controller_rspan_mode=null¶: Stop Layer2 MAC learning and interception of BPDUs and other packets on this interface. disable:Disable RSPAN passthrough mode on this VLAN interface. enable:Enable RSPAN passthrough mode on this VLAN interface.

attribute fortigate::system_interface::switch_controller_source_ip? switch_controller_source_ip=null¶: Source IP address used in FortiLink over L3 connections. outbound:Source IP address is that of the outbound interface. fixed:Source IP address is that of the FortiLink interface.

attribute fortigate::system_interface::switch_controller_traffic_policy? switch_controller_traffic_policy=null¶: Switch controller traffic policy for the VLAN.

attribute string? system_id=null¶: Define a system ID for the aggregate interface.

attribute fortigate::system_interface::system_id_type? system_id_type=null¶: Method in which system ID is generated. auto:Use the MAC address of the first member. user:User-defined system ID.

attribute fortigate::system_interface::tcp_mss? tcp_mss=null¶: TCP maximum segment size. 0 means do not change segment size.

attribute string? trust_ip6_1=null¶: Trusted IPv6 host for dedicated management traffic (::/0 for all hosts).

attribute string? trust_ip6_2=null¶: Trusted IPv6 host for dedicated management traffic (::/0 for all hosts).

attribute string? trust_ip6_3=null¶: Trusted IPv6 host for dedicated management traffic (::/0 for all hosts).

attribute string? trust_ip_1=null¶: Trusted host for dedicated management traffic (0.0.0.0/24 for all hosts).

attribute string? trust_ip_2=null¶: Trusted host for dedicated management traffic (0.0.0.0/24 for all hosts).

attribute string? trust_ip_3=null¶: Trusted host for dedicated management traffic (0.0.0.0/24 for all hosts).

attribute fortigate::system_interface::type? type=null¶: Interface type. physical:Physical interface. vlan:VLAN interface. aggregate:Aggregate interface. redundant:Redundant interface. tunnel:Tunnel interface. vdom-link:VDOM link interface. loopback:Loopback interface. switch:Software switch interface. hard-switch:Hardware switch interface. vap-switch:VAP interface. wl-mesh:WLAN mesh interface. fext-wan:FortiExtender interface. vxlan:VXLAN interface. geneve:GENEVE interface. hdlc:T1/E1 interface. switch-vlan:Switch VLAN interface. emac-vlan:EMAC VLAN interface. ssl:SSL VPN client interface. lan-extension:LAN extension interface.

attribute fortigate::system_interface::username? username=null¶: Username of the PPPoE account, provided by your ISP.

attribute string vdom¶: Interface is in this virtual domain (VDOM).

attribute fortigate::system_interface::vindex? vindex=null¶: Switch control interface VLAN ID.

attribute fortigate::system_interface::vlan_protocol? vlan_protocol=null¶: Ethernet protocol of VLAN. 8021q:IEEE 802.1Q. 8021ad:IEEE 802.1AD.

attribute fortigate::common::enable_disable_t? vlanforward=null¶: Enable/disable traffic forwarding between VLANs on this interface. enable:Enable traffic forwarding. disable:Disable traffic forwarding.

attribute fortigate::system_interface::vlanid? vlanid=null¶: VLAN ID (1 - 4094).

attribute fortigate::system_interface::vrf? vrf=null¶: Virtual Routing Forwarding ID.

attribute fortigate::common::enable_disable_t? vrrp_virtual_mac=null¶: Enable/disable use of virtual MAC for VRRP. enable:Enable use of virtual MAC for VRRP. disable:Disable use of virtual MAC for VRRP.

attribute fortigate::common::enable_disable_t? wccp=null¶: Enable/disable WCCP on this interface. Used for encapsulated WCCP communication between WCCP clients and servers. enable:Enable WCCP protocol on this interface. disable:Disable WCCP protocol on this interface.

attribute fortigate::system_interface::weight? weight=null¶: Default weight for static routes (if route has no weight configured).

attribute string? wins_ip=null¶: WINS server IP. :rel client_options: :rel dhcp_snooping_server_list: :rel fail_alert_interfaces: :rel ipv6: :rel l2tp_client_settings: :rel member: :rel secondaryip: :rel security_groups: :rel tagging: :rel vrrp:

relation fortigate::system_interface::ClientOptions client_options [0:*]¶: other end: fortigate::system_interface::ClientOptions._parent [1]

relation fortigate::system_interface::DhcpSnoopingServerList dhcp_snooping_server_list [0:*]¶: other end: fortigate::system_interface::DhcpSnoopingServerList._parent [1]

relation fortigate::system_interface::FailAlertInterfaces fail_alert_interfaces [0:*]¶: other end: fortigate::system_interface::FailAlertInterfaces._parent [1]

relation fortigate::system_interface::Ipv6 ipv6 [0:*]¶: other end: fortigate::system_interface::Ipv6._parent [1]

relation fortigate::system_interface::L2tpClientSettings l2tp_client_settings [0:*]¶: other end: fortigate::system_interface::L2tpClientSettings._parent [1]

relation fortigate::system_interface::Member member [0:*]¶: other end: fortigate::system_interface::Member._parent [1]

relation fortigate::system_interface::Secondaryip secondaryip [0:*]¶: other end: fortigate::system_interface::Secondaryip._parent [1]

relation fortigate::system_interface::SecurityGroups security_groups [0:*]¶: other end: fortigate::system_interface::SecurityGroups._parent [1]

relation fortigate::system_interface::Tagging tagging [0:*]¶: other end: fortigate::system_interface::Tagging._parent [1]

relation fortigate::system_interface::Vrrp vrrp [0:*]¶: other end: fortigate::system_interface::Vrrp._parent [1]

The following implements statements select implementations for this entity:

entity fortigate::IpSecPhase1Interface¶

Parents: fortigate::base::VdomResource, fortigate::base::SecretResource

attribute fortigate::common::enable_disable_t? acct_verify=null¶: Enable/disable verification of RADIUS accounting record. enable:Enable verification of RADIUS accounting record. disable:Disable verification of RADIUS accounting record.

attribute fortigate::common::enable_disable_t? add_gw_route=null¶: Enable/disable automatically add a route to the remote gateway. enable:Automatically add a route to the remote gateway. disable:Do not automatically add a route to the remote gateway.

attribute fortigate::common::enable_disable_t? add_route=null¶: Enable/disable control addition of a route to peer destination selector. disable:Do not add a route to destination of peer selector. enable:Add route to destination of peer selector.

attribute fortigate::common::enable_disable_t? aggregate_member=null¶: Enable/disable use as an aggregate member. enable:Enable use as an aggregate member. disable:Disable use as an aggregate member.

attribute fortigate::vpn_ipsec_phase1_interface::aggregate_weight? aggregate_weight=null¶: Link weight for aggregate.

attribute fortigate::common::enable_disable_t? assign_ip=null¶: Enable/disable assignment of IP to IPsec interface via configuration method. disable:Do not assign an IP address to the IPsec interface. enable:Assign an IP address to the IPsec interface.

attribute fortigate::vpn_ipsec_phase1_interface::assign_ip_from? assign_ip_from=null¶: Method by which the IP address will be assigned. range:Assign IP address from locally defined range. usrgrp:Assign IP address via user group. dhcp:Assign IP address via DHCP. name:Assign IP address from firewall address or group.

attribute fortigate::vpn_ipsec_phase1_interface::authmethod? authmethod=null¶: Authentication method. psk:PSK authentication method. signature:Signature authentication method.

attribute fortigate::vpn_ipsec_phase1_interface::authmethod_remote? authmethod_remote=null¶: Authentication method (remote side). psk:PSK authentication method. signature:Signature authentication method.

attribute string? authpasswd=null¶: XAuth password (max 35 characters).

attribute fortigate::vpn_ipsec_phase1_interface::authusr? authusr=null¶: XAuth user name.

attribute fortigate::vpn_ipsec_phase1_interface::authusrgrp? authusrgrp=null¶: Authentication user group.

attribute fortigate::vpn_ipsec_phase1_interface::auto_discovery_crossover? auto_discovery_crossover=null¶: Allow/block set-up of short-cut tunnels between different network IDs. allow:Allow set-up of short-cut tunnels between different network IDs. block:Block set-up of short-cut tunnels between different network IDs.

attribute fortigate::common::enable_disable_t? auto_discovery_forwarder=null¶: Enable/disable forwarding auto-discovery short-cut messages. enable:Enable forwarding auto-discovery short-cut messages. disable:Disable forwarding auto-discovery short-cut messages.

attribute fortigate::vpn_ipsec_phase1_interface::auto_discovery_offer_interval? auto_discovery_offer_interval=null¶: Interval between shortcut offer messages in seconds (1 - 300, default = 5).

attribute fortigate::common::enable_disable_t? auto_discovery_psk=null¶: Enable/disable use of pre-shared secrets for authentication of auto-discovery tunnels. enable:Enable use of pre-shared-secret authentication for auto-discovery tunnels. disable:Disable use of authentication defined by ‘authmethod’ for auto-discovery tunnels.

attribute fortigate::common::enable_disable_t? auto_discovery_receiver=null¶: Enable/disable accepting auto-discovery short-cut messages. enable:Enable receiving auto-discovery short-cut messages. disable:Disable receiving auto-discovery short-cut messages.

attribute fortigate::common::enable_disable_t? auto_discovery_sender=null¶: Enable/disable sending auto-discovery short-cut messages. enable:Enable sending auto-discovery short-cut messages. disable:Disable sending auto-discovery short-cut messages.

attribute fortigate::vpn_ipsec_phase1_interface::auto_discovery_shortcuts? auto_discovery_shortcuts=null¶: Control deletion of child short-cut tunnels when the parent tunnel goes down. independent:Short-cut tunnels remain up if the parent tunnel goes down. dependent:Short-cut tunnels are brought down if the parent tunnel goes down.

attribute fortigate::common::enable_disable_t? auto_negotiate=null¶: Enable/disable automatic initiation of IKE SA negotiation. enable:Enable automatic initiation of IKE SA negotiation. disable:Disable automatic initiation of IKE SA negotiation.

attribute fortigate::vpn_ipsec_phase1_interface::banner? banner=null¶: Message that unity client should display after connecting.

attribute fortigate::common::enable_disable_t? cert_id_validation=null¶: Enable/disable cross validation of peer ID and the identity in the peer’s certificate as specified in RFC 4945. enable:Enable cross validation of peer ID and the identity in the peer’s certificate as specified in RFC 4945. disable:Disable cross validation of peer ID and the identity in the peer’s certificate as specified in RFC 4945.

attribute fortigate::common::enable_disable_t? childless_ike=null¶: Enable/disable childless IKEv2 initiation (RFC 6023). enable:Enable childless IKEv2 initiation (RFC 6023). disable:Disable childless IKEv2 initiation (RFC 6023).

attribute fortigate::common::enable_disable_t? client_auto_negotiate=null¶: Enable/disable allowing the VPN client to bring up the tunnel when there is no traffic. disable:Disable allowing the VPN client to bring up the tunnel when there is no traffic. enable:Enable allowing the VPN client to bring up the tunnel when there is no traffic.

attribute fortigate::common::enable_disable_t? client_keep_alive=null¶: Enable/disable allowing the VPN client to keep the tunnel up when there is no traffic. disable:Disable allowing the VPN client to keep the tunnel up when there is no traffic. enable:Enable allowing the VPN client to keep the tunnel up when there is no traffic.

attribute fortigate::vpn_ipsec_phase1_interface::comments? comments=null¶: Comment.

attribute string? default_gw=null¶: IPv4 address of default route gateway to use for traffic exiting the interface.

attribute fortigate::vpn_ipsec_phase1_interface::default_gw_priority? default_gw_priority=null¶: Priority for default gateway route. A higher priority number signifies a less preferred route.

attribute fortigate::vpn_ipsec_phase1_interface::dev_id? dev_id=null¶: Device ID carried by the device ID notification.

attribute fortigate::common::enable_disable_t? dev_id_notification=null¶: Enable/disable device ID notification. disable:Disable device ID notification. enable:Enable device ID notification.

attribute string? dhcp6_ra_linkaddr=null¶: Relay agent IPv6 link address to use in DHCP6 requests.

attribute string? dhcp_ra_giaddr=null¶: Relay agent gateway IP address to use in the giaddr field of DHCP requests.

attribute fortigate::vpn_ipsec_phase1_interface::dhgrp? dhgrp=null¶: DH group. 1:DH Group 1. 2:DH Group 2. 5:DH Group 5. 14:DH Group 14. 15:DH Group 15. 16:DH Group 16. 17:DH Group 17. 18:DH Group 18. 19:DH Group 19. 20:DH Group 20. 21:DH Group 21. 27:DH Group 27. 28:DH Group 28. 29:DH Group 29. 30:DH Group 30. 31:DH Group 31. 32:DH Group 32.

attribute fortigate::common::enable_disable_t? digital_signature_auth=null¶: Enable/disable IKEv2 Digital Signature Authentication (RFC 7427). enable:Enable IKEv2 Digital Signature Authentication (RFC 7427). disable:Disable IKEv2 Digital Signature Authentication (RFC 7427).

attribute fortigate::vpn_ipsec_phase1_interface::distance? distance=null¶: Distance for routes added by IKE (1 - 255).

attribute fortigate::vpn_ipsec_phase1_interface::dns_mode? dns_mode=null¶: DNS server mode. manual:Manually configure DNS servers. auto:Use default DNS servers.

attribute fortigate::vpn_ipsec_phase1_interface::domain? domain=null¶: Instruct unity clients about the single default DNS domain.

attribute fortigate::vpn_ipsec_phase1_interface::dpd? dpd=null¶: Dead Peer Detection mode. disable:Disable Dead Peer Detection. on-idle:Trigger Dead Peer Detection when IPsec is idle. on-demand:Trigger Dead Peer Detection when IPsec traffic is sent but no reply is received from the peer.

attribute fortigate::vpn_ipsec_phase1_interface::dpd_retrycount? dpd_retrycount=null¶: Number of DPD retry attempts.

attribute string? dpd_retryinterval=null¶: DPD retry interval.

attribute fortigate::common::enable_disable_t? eap=null¶: Enable/disable IKEv2 EAP authentication. enable:Enable IKEv2 EAP authentication. disable:Disable IKEv2 EAP authentication.

attribute fortigate::vpn_ipsec_phase1_interface::eap_exclude_peergrp? eap_exclude_peergrp=null¶: Peer group excluded from EAP authentication.

attribute fortigate::vpn_ipsec_phase1_interface::eap_identity? eap_identity=null¶: IKEv2 EAP peer identity type. use-id-payload:Use IKEv2 IDi payload to resolve peer identity. send-request:Use EAP identity request to resolve peer identity.

attribute string? encap_local_gw4=null¶: Local IPv4 address of GRE/VXLAN tunnel.

attribute string? encap_local_gw6=null¶: Local IPv6 address of GRE/VXLAN tunnel.

attribute string? encap_remote_gw4=null¶: Remote IPv4 address of GRE/VXLAN tunnel.

attribute string? encap_remote_gw6=null¶: Remote IPv6 address of GRE/VXLAN tunnel.

attribute fortigate::vpn_ipsec_phase1_interface::encapsulation? encapsulation=null¶: Enable/disable GRE/VXLAN/VPNID encapsulation. none:No additional encapsulation. gre:GRE encapsulation. vxlan:VXLAN encapsulation. vpn-id-ipip:VPN ID with IPIP encapsulation.

attribute fortigate::vpn_ipsec_phase1_interface::encapsulation_address? encapsulation_address=null¶: Source for GRE/VXLAN tunnel address. ike:Use IKE/IPsec gateway addresses. ipv4:Specify separate GRE/VXLAN tunnel address. ipv6:Specify separate GRE/VXLAN tunnel address.

attribute fortigate::vpn_ipsec_phase1_interface::enforce_unique_id? enforce_unique_id=null¶: Enable/disable peer ID uniqueness check. disable:Disable peer ID uniqueness enforcement. keep-new:Enforce peer ID uniqueness, keep new connection if collision found. keep-old:Enforce peer ID uniqueness, keep old connection if collision found.

attribute fortigate::common::enable_disable_t? exchange_fgt_device_id=null¶: Enable/disable device identifier exchange with peer FortiGate units for use of VPN monitor data by FortiManager. enable:Enable exchange of FortiGate device identifier. disable:Disable exchange of FortiGate device identifier.

attribute fortigate::common::enable_disable_t? exchange_interface_ip=null¶: Enable/disable exchange of IPsec interface IP address. enable:Enable exchange of IPsec interface IP address. disable:Disable exchange of IPsec interface IP address.

attribute string? exchange_ip_addr4=null¶: IPv4 address to exchange with peers.

attribute string? exchange_ip_addr6=null¶: IPv6 address to exchange with peers.

attribute fortigate::vpn_ipsec_phase1_interface::fec_base? fec_base=null¶: Number of base Forward Error Correction packets (1 - 20).

attribute fortigate::vpn_ipsec_phase1_interface::fec_codec? fec_codec=null¶: Forward Error Correction encoding/decoding algorithm. rs:Reed-Solomon FEC algorithm. xor:XOR FEC algorithm.

attribute fortigate::common::enable_disable_t? fec_egress=null¶: Enable/disable Forward Error Correction for egress IPsec traffic. enable:Enable Forward Error Correction for egress IPsec traffic. disable:Disable Forward Error Correction for egress IPsec traffic.

attribute fortigate::vpn_ipsec_phase1_interface::fec_health_check? fec_health_check=null¶: SD-WAN health check.

attribute fortigate::common::enable_disable_t? fec_ingress=null¶: Enable/disable Forward Error Correction for ingress IPsec traffic. enable:Enable Forward Error Correction for ingress IPsec traffic. disable:Disable Forward Error Correction for ingress IPsec traffic.

attribute fortigate::vpn_ipsec_phase1_interface::fec_mapping_profile? fec_mapping_profile=null¶: Forward Error Correction (FEC) mapping profile.

attribute fortigate::vpn_ipsec_phase1_interface::fec_receive_timeout? fec_receive_timeout=null¶: Timeout in milliseconds before dropping Forward Error Correction packets (1 - 1000).

attribute fortigate::vpn_ipsec_phase1_interface::fec_redundant? fec_redundant=null¶: Number of redundant Forward Error Correction packets (1 - 5 for reed-solomon, 1 for xor).

attribute fortigate::vpn_ipsec_phase1_interface::fec_send_timeout? fec_send_timeout=null¶: Timeout in milliseconds before sending Forward Error Correction packets (1 - 1000).

attribute fortigate::common::enable_disable_t? fgsp_sync=null¶: Enable/disable IPsec syncing of tunnels for FGSP IPsec. enable:Enable IPsec syncing of tunnels to other cluster members. disable:Disable IPsec syncing of tunnels to other cluster members.

attribute fortigate::common::enable_disable_t? forticlient_enforcement=null¶: Enable/disable FortiClient enforcement. enable:Enable FortiClient enforcement. disable:Disable FortiClient enforcement.

attribute fortigate::common::enable_disable_t? fragmentation=null¶: Enable/disable fragment IKE message on re-transmission. enable:Enable intra-IKE fragmentation support on re-transmission. disable:Disable intra-IKE fragmentation support.

attribute fortigate::vpn_ipsec_phase1_interface::fragmentation_mtu? fragmentation_mtu=null¶: IKE fragmentation MTU (500 - 16000).

attribute fortigate::common::enable_disable_t? group_authentication=null¶: Enable/disable IKEv2 IDi group authentication. enable:Enable IKEv2 IDi group authentication. disable:Disable IKEv2 IDi group authentication.

attribute string? group_authentication_secret=null¶: Password for IKEv2 ID group authentication. ASCII string or hexadecimal indicated by a leading 0x.

attribute fortigate::common::enable_disable_t? ha_sync_esp_seqno=null¶: Enable/disable sequence number jump ahead for IPsec HA. enable:Enable HA syncing of ESP sequence numbers. disable:Disable HA syncing of ESP sequence numbers.

attribute fortigate::common::enable_disable_t? idle_timeout=null¶: Enable/disable IPsec tunnel idle timeout. enable:Enable IPsec tunnel idle timeout. disable:Disable IPsec tunnel idle timeout.

attribute fortigate::vpn_ipsec_phase1_interface::idle_timeoutinterval? idle_timeoutinterval=null¶: IPsec tunnel idle timeout in minutes (5 - 43200).

attribute fortigate::vpn_ipsec_phase1_interface::ike_version? ike_version=null¶: IKE protocol version. 1:Use IKEv1 protocol. 2:Use IKEv2 protocol.

attribute fortigate::common::enable_disable_t? inbound_dscp_copy=null¶: Enable/disable copy the dscp in the ESP header to the inner IP Header. enable:Enable copy the dscp in the ESP header to the inner IP Header. disable:Disable copy the dscp in the ESP header to the inner IP Header.

attribute fortigate::common::enable_disable_t? include_local_lan=null¶: Enable/disable allow local LAN access on unity clients. disable:Disable local LAN access on Unity clients. enable:Enable local LAN access on Unity clients.

attribute fortigate::vpn_ipsec_phase1_interface::interface? interface=null¶: Local physical, aggregate, or VLAN outgoing interface.

attribute fortigate::vpn_ipsec_phase1_interface::ip_delay_interval? ip_delay_interval=null¶: IP address reuse delay interval in seconds (0 - 28800).

attribute fortigate::vpn_ipsec_phase1_interface::ip_fragmentation? ip_fragmentation=null¶: Determine whether IP packets are fragmented before or after IPsec encapsulation. pre-encapsulation:Fragment before IPsec encapsulation. post-encapsulation:Fragment after IPsec encapsulation (RFC compliant).

attribute fortigate::vpn_ipsec_phase1_interface::ip_version? ip_version=null¶: IP version to use for VPN interface. 4:Use IPv4 addressing for gateways. 6:Use IPv6 addressing for gateways.

attribute string? ipv4_dns_server1=null¶: IPv4 DNS server 1.

attribute string? ipv4_dns_server2=null¶: IPv4 DNS server 2.

attribute string? ipv4_dns_server3=null¶: IPv4 DNS server 3.

attribute string? ipv4_end_ip=null¶: End of IPv4 range.

attribute fortigate::common::name_t? ipv4_name=null¶: IPv4 address name.

attribute string? ipv4_netmask=null¶: IPv4 Netmask.

attribute fortigate::common::name_t? ipv4_split_exclude=null¶: IPv4 subnets that should not be sent over the IPsec tunnel.

attribute fortigate::common::name_t? ipv4_split_include=null¶: IPv4 split-include subnets.

attribute string? ipv4_start_ip=null¶: Start of IPv4 range.

attribute string? ipv4_wins_server1=null¶: WINS server 1.

attribute string? ipv4_wins_server2=null¶: WINS server 2.

attribute string? ipv6_dns_server1=null¶: IPv6 DNS server 1.

attribute string? ipv6_dns_server2=null¶: IPv6 DNS server 2.

attribute string? ipv6_dns_server3=null¶: IPv6 DNS server 3.

attribute string? ipv6_end_ip=null¶: End of IPv6 range.

attribute fortigate::common::name_t? ipv6_name=null¶: IPv6 address name.

attribute fortigate::vpn_ipsec_phase1_interface::ipv6_prefix? ipv6_prefix=null¶: IPv6 prefix.

attribute fortigate::common::name_t? ipv6_split_exclude=null¶: IPv6 subnets that should not be sent over the IPsec tunnel.

attribute fortigate::common::name_t? ipv6_split_include=null¶: IPv6 split-include subnets.

attribute string? ipv6_start_ip=null¶: Start of IPv6 range.

attribute fortigate::vpn_ipsec_phase1_interface::keepalive? keepalive=null¶: NAT-T keep alive interval.

attribute fortigate::vpn_ipsec_phase1_interface::keylife? keylife=null¶: Time to wait in seconds before phase 1 encryption key expires.

attribute fortigate::vpn_ipsec_phase1_interface::link_cost? link_cost=null¶: VPN tunnel underlay link cost.

attribute string? local_gw=null¶: IPv4 address of the local gateway’s external interface.

attribute string? local_gw6=null¶: IPv6 address of the local gateway’s external interface.

attribute fortigate::vpn_ipsec_phase1_interface::localid? localid=null¶: Local ID.

attribute fortigate::vpn_ipsec_phase1_interface::localid_type? localid_type=null¶: Local ID type. auto:Select ID type automatically. fqdn:Use fully qualified domain name. user-fqdn:Use user fully qualified domain name. keyid:Use key-id string. address:Use local IP address. asn1dn:Use ASN.1 distinguished name.

attribute fortigate::common::enable_disable_t? loopback_asymroute=null¶: Enable/disable asymmetric routing for IKE traffic on loopback interface. enable:Allow ingress/egress IKE traffic to be routed over different interfaces. disable:Ingress/egress IKE traffic must be routed over the same interface.

attribute fortigate::vpn_ipsec_phase1_interface::mesh_selector_type? mesh_selector_type=null¶: Add selectors containing subsets of the configuration depending on traffic. disable:Disable. subnet:Enable addition of matching subnet selector. host:Enable addition of host to host selector.

attribute fortigate::vpn_ipsec_phase1_interface::mode? mode=null¶: The ID protection mode used to establish a secure channel. aggressive:Aggressive mode. main:Main mode.

attribute fortigate::common::enable_disable_t? mode_cfg=null¶: Enable/disable configuration method. disable:Disable Configuration Method. enable:Enable Configuration Method.

attribute fortigate::common::enable_disable_t? mode_cfg_allow_client_selector=null¶: Enable/disable mode-cfg client to use custom phase2 selectors. disable:Mode-cfg client to use wildcard selectors. enable:Mode-cfg client to use custom selectors.

attribute fortigate::vpn_ipsec_phase1_interface::monitor? monitor=null¶: IPsec interface as backup for primary interface.

attribute fortigate::vpn_ipsec_phase1_interface::monitor_hold_down_delay? monitor_hold_down_delay=null¶: Time to wait in seconds before recovery once primary re-establishes.

attribute string? monitor_hold_down_time=null¶: Time of day at which to fail back to primary after it re-establishes.

attribute fortigate::vpn_ipsec_phase1_interface::monitor_hold_down_type? monitor_hold_down_type=null¶: Recovery time method when primary interface re-establishes. immediate:Fail back immediately after primary recovers. delay:Number of seconds to delay fail back after primary recovers. time:Specify a time at which to fail back after primary recovers.

attribute fortigate::vpn_ipsec_phase1_interface::monitor_hold_down_weekday? monitor_hold_down_weekday=null¶: Day of the week to recover once primary re-establishes. everyday:Every Day. sunday:Sunday. monday:Monday. tuesday:Tuesday. wednesday:Wednesday. thursday:Thursday. friday:Friday. saturday:Saturday.

attribute fortigate::vpn_ipsec_phase1_interface::name name¶: IPsec remote gateway name.

attribute fortigate::vpn_ipsec_phase1_interface::nattraversal? nattraversal=null¶: Enable/disable NAT traversal. enable:Enable IPsec NAT traversal. disable:Disable IPsec NAT traversal. forced:Force IPsec NAT traversal on.

attribute fortigate::vpn_ipsec_phase1_interface::negotiate_timeout? negotiate_timeout=null¶: IKE SA negotiation timeout in seconds (1 - 300).

attribute fortigate::common::enable_disable_t? net_device=null¶: Enable/disable kernel device creation. enable:Create a kernel device for every tunnel. disable:Do not create a kernel device for tunnels.

attribute fortigate::vpn_ipsec_phase1_interface::network_id? network_id=null¶: VPN gateway network ID.

attribute fortigate::common::enable_disable_t? network_overlay=null¶: Enable/disable network overlays. disable:Disable network overlays. enable:Enable network overlays.

attribute fortigate::common::enable_disable_t? npu_offload=null¶: Enable/disable offloading NPU. enable:Enable NPU offloading. disable:Disable NPU offloading.

attribute fortigate::common::enable_disable_t? passive_mode=null¶: Enable/disable IPsec passive mode for static tunnels. enable:Enable IPsec passive mode. disable:Disable IPsec passive mode.

attribute fortigate::vpn_ipsec_phase1_interface::peer? peer=null¶: Accept this peer certificate.

attribute fortigate::vpn_ipsec_phase1_interface::peergrp? peergrp=null¶: Accept this peer certificate group.

attribute fortigate::vpn_ipsec_phase1_interface::peerid? peerid=null¶: Accept this peer identity.

attribute fortigate::vpn_ipsec_phase1_interface::peertype? peertype=null¶: Accept this peer type. any:Accept any peer ID. one:Accept this peer ID. dialup:Accept peer ID in dialup group. peer:Accept this peer certificate. peergrp:Accept this peer certificate group.

attribute fortigate::vpn_ipsec_phase1_interface::ppk? ppk=null¶: Enable/disable IKEv2 Postquantum Preshared Key (PPK). disable:Disable use of IKEv2 Postquantum Preshared Key (PPK). allow:Allow, but do not require, use of IKEv2 Postquantum Preshared Key (PPK). require:Require use of IKEv2 Postquantum Preshared Key (PPK).

attribute fortigate::vpn_ipsec_phase1_interface::ppk_identity? ppk_identity=null¶: IKEv2 Postquantum Preshared Key Identity.

attribute string? ppk_secret=null¶: IKEv2 Postquantum Preshared Key (ASCII string or hexadecimal encoded with a leading 0x).

attribute fortigate::vpn_ipsec_phase1_interface::priority? priority=null¶: Priority for routes added by IKE (1 - 65535).

attribute fortigate::vpn_ipsec_phase1_interface::proposal? proposal=null¶: Phase1 proposal. des-md5:des-md5 des-sha1:des-sha1 des-sha256:des-sha256 des-sha384:des-sha384 des-sha512:des-sha512 3des-md5:3des-md5 3des-sha1:3des-sha1 3des-sha256:3des-sha256 3des-sha384:3des-sha384 3des-sha512:3des-sha512 aes128-md5:aes128-md5 aes128-sha1:aes128-sha1 aes128-sha256:aes128-sha256 aes128-sha384:aes128-sha384 aes128-sha512:aes128-sha512 aes128gcm-prfsha1:aes128gcm-prfsha1 aes128gcm-prfsha256:aes128gcm-prfsha256 aes128gcm-prfsha384:aes128gcm-prfsha384 aes128gcm-prfsha512:aes128gcm-prfsha512 aes192-md5:aes192-md5 aes192-sha1:aes192-sha1 aes192-sha256:aes192-sha256 aes192-sha384:aes192-sha384 aes192-sha512:aes192-sha512 aes256-md5:aes256-md5 aes256-sha1:aes256-sha1 aes256-sha256:aes256-sha256 aes256-sha384:aes256-sha384 aes256-sha512:aes256-sha512 aes256gcm-prfsha1:aes256gcm-prfsha1 aes256gcm-prfsha256:aes256gcm-prfsha256 aes256gcm-prfsha384:aes256gcm-prfsha384 aes256gcm-prfsha512:aes256gcm-prfsha512 chacha20poly1305-prfsha1:chacha20poly1305-prfsha1 chacha20poly1305-prfsha256:chacha20poly1305-prfsha256 chacha20poly1305-prfsha384:chacha20poly1305-prfsha384 chacha20poly1305-prfsha512:chacha20poly1305-prfsha512 aria128-md5:aria128-md5 aria128-sha1:aria128-sha1 aria128-sha256:aria128-sha256 aria128-sha384:aria128-sha384 aria128-sha512:aria128-sha512 aria192-md5:aria192-md5 aria192-sha1:aria192-sha1 aria192-sha256:aria192-sha256 aria192-sha384:aria192-sha384 aria192-sha512:aria192-sha512 aria256-md5:aria256-md5 aria256-sha1:aria256-sha1 aria256-sha256:aria256-sha256 aria256-sha384:aria256-sha384 aria256-sha512:aria256-sha512 seed-md5:seed-md5 seed-sha1:seed-sha1 seed-sha256:seed-sha256 seed-sha384:seed-sha384 seed-sha512:seed-sha512

attribute string? psksecret=null¶: Pre-shared secret for PSK authentication (ASCII string or hexadecimal encoded with a leading 0x).

attribute string? psksecret_remote=null¶: Pre-shared secret for remote side PSK authentication (ASCII string or hexadecimal encoded with a leading 0x).

attribute fortigate::common::enable_disable_t? reauth=null¶: Enable/disable re-authentication upon IKE SA lifetime expiration. disable:Disable IKE SA re-authentication. enable:Enable IKE SA re-authentication.

attribute fortigate::common::enable_disable_t? rekey=null¶: Enable/disable phase1 rekey. enable:Enable phase1 rekey. disable:Disable phase1 rekey.

attribute string? remote_gw=null¶: IPv4 address of the remote gateway’s external interface.

attribute string? remote_gw6=null¶: IPv6 address of the remote gateway’s external interface.

attribute fortigate::vpn_ipsec_phase1_interface::remotegw_ddns? remotegw_ddns=null¶: Domain name of remote gateway. For example, name.ddns.com.

attribute fortigate::vpn_ipsec_phase1_interface::rsa_signature_format? rsa_signature_format=null¶: Digital Signature Authentication RSA signature format. pkcs1:RSASSA PKCS#1 v1.5. pss:RSASSA Probabilistic Signature Scheme (PSS).

attribute fortigate::common::enable_disable_t? rsa_signature_hash_override=null¶: Enable/disable IKEv2 RSA signature hash algorithm override. enable:Enable IKEv2 RSA signature hash algorithm override. disable:Disable IKEv2 RSA signature hash algorithm override.

attribute fortigate::common::enable_disable_t? save_password=null¶: Enable/disable saving XAuth username and password on VPN clients. disable:Disable saving XAuth username and password on VPN clients. enable:Enable saving XAuth username and password on VPN clients.

attribute fortigate::common::enable_disable_t? send_cert_chain=null¶: Enable/disable sending certificate chain. enable:Enable sending certificate chain. disable:Disable sending certificate chain.

attribute fortigate::vpn_ipsec_phase1_interface::signature_hash_alg? signature_hash_alg=null¶: Digital Signature Authentication hash algorithms. sha1:SHA1. sha2-256:SHA2-256. sha2-384:SHA2-384. sha2-512:SHA2-512.

attribute fortigate::common::name_t? split_include_service=null¶: Split-include services.

attribute fortigate::vpn_ipsec_phase1_interface::suite_b? suite_b=null¶: Use Suite-B. disable:Do not use UI suite. suite-b-gcm-128:Use Suite-B-GCM-128. suite-b-gcm-256:Use Suite-B-GCM-256.

attribute fortigate::vpn_ipsec_phase1_interface::type? type=null¶: Remote gateway type. static:Remote VPN gateway has fixed IP address. dynamic:Remote VPN gateway has dynamic IP address. ddns:Remote VPN gateway has dynamic IP address and is a dynamic DNS client.

attribute fortigate::common::enable_disable_t? unity_support=null¶: Enable/disable support for Cisco UNITY Configuration Method extensions. disable:Disable Cisco Unity Configuration Method Extensions. enable:Enable Cisco Unity Configuration Method Extensions.

attribute fortigate::vpn_ipsec_phase1_interface::usrgrp? usrgrp=null¶: User group name for dialup peers.

attribute fortigate::vpn_ipsec_phase1_interface::vni? vni=null¶: VNI of VXLAN tunnel.

attribute fortigate::vpn_ipsec_phase1_interface::wizard_type? wizard_type=null¶: GUI VPN Wizard Type. custom:Custom VPN configuration. dialup-forticlient:Dial Up - FortiClient Windows, Mac and Android. dialup-ios:Dial Up - iPhone / iPad Native IPsec Client. dialup-android:Dial Up - Android Native IPsec Client. dialup-windows:Dial Up - Windows Native IPsec Client. dialup-cisco:Dial Up - Cisco IPsec Client. static-fortigate:Site to Site - FortiGate. dialup-fortigate:Dial Up - FortiGate. static-cisco:Site to Site - Cisco. dialup-cisco-fw:Dialup Up - Cisco Firewall. simplified-static-fortigate:Site to Site - FortiGate (SD-WAN). hub-fortigate-auto-discovery:Hub role in a Hub-and-Spoke auto-discovery VPN. spoke-fortigate-auto-discovery:Spoke role in a Hub-and-Spoke auto-discovery VPN.

attribute fortigate::vpn_ipsec_phase1_interface::xauthtype? xauthtype=null¶: XAuth type. disable:Disable. client:Enable as client. pap:Enable as server PAP. chap:Enable as server CHAP. auto:Enable as server auto. :rel backup_gateway: :rel certificate: :rel ipv4_exclude_range: :rel ipv6_exclude_range:

relation fortigate::vpn_ipsec_phase1_interface::BackupGateway backup_gateway [0:*]¶: other end: fortigate::vpn_ipsec_phase1_interface::BackupGateway._parent [1]

relation fortigate::vpn_ipsec_phase1_interface::Certificate certificate [0:*]¶: other end: fortigate::vpn_ipsec_phase1_interface::Certificate._parent [1]

relation fortigate::vpn_ipsec_phase1_interface::Ipv4ExcludeRange ipv4_exclude_range [0:*]¶: other end: fortigate::vpn_ipsec_phase1_interface::Ipv4ExcludeRange._parent [1]

relation fortigate::vpn_ipsec_phase1_interface::Ipv6ExcludeRange ipv6_exclude_range [0:*]¶: other end: fortigate::vpn_ipsec_phase1_interface::Ipv6ExcludeRange._parent [1]

The following implements statements select implementations for this entity:

entity fortigate::IpSecPhase2Interface¶

Parents: fortigate::base::VdomResource

attribute fortigate::vpn_ipsec_phase2_interface::add_route? add_route=null¶: Enable/disable automatic route addition. phase1:Add route according to phase1 add-route setting. enable:Add route for remote proxy ID. disable:Do not add route for remote proxy ID.

attribute fortigate::vpn_ipsec_phase2_interface::auto_discovery_forwarder? auto_discovery_forwarder=null¶: Enable/disable forwarding short-cut messages. phase1:Forward short-cut messages according to the phase1 auto-discovery-forwarder setting. enable:Enable forwarding auto-discovery short-cut messages. disable:Disable forwarding auto-discovery short-cut messages.

attribute fortigate::vpn_ipsec_phase2_interface::auto_discovery_sender? auto_discovery_sender=null¶: Enable/disable sending short-cut messages. phase1:Send short-cut messages according to the phase1 auto-discovery-sender setting. enable:Enable sending auto-discovery short-cut messages. disable:Disable sending auto-discovery short-cut messages.

attribute fortigate::common::enable_disable_t? auto_negotiate=null¶: Enable/disable IPsec SA auto-negotiation. enable:Enable setting. disable:Disable setting.

attribute fortigate::vpn_ipsec_phase2_interface::comments? comments=null¶: Comment.

attribute fortigate::common::enable_disable_t? dhcp_ipsec=null¶: Enable/disable DHCP-IPsec. enable:Enable setting. disable:Disable setting.

attribute fortigate::vpn_ipsec_phase2_interface::dhgrp? dhgrp=null¶: Phase2 DH group. 1:DH Group 1. 2:DH Group 2. 5:DH Group 5. 14:DH Group 14. 15:DH Group 15. 16:DH Group 16. 17:DH Group 17. 18:DH Group 18. 19:DH Group 19. 20:DH Group 20. 21:DH Group 21. 27:DH Group 27. 28:DH Group 28. 29:DH Group 29. 30:DH Group 30. 31:DH Group 31. 32:DH Group 32.

attribute fortigate::common::enable_disable_t? diffserv=null¶: Enable/disable applying DSCP value to the IPsec tunnel outer IP header. enable:Enable setting. disable:Disable setting.

attribute string? diffservcode=null¶: DSCP value to be applied to the IPsec tunnel outer IP header.

attribute fortigate::vpn_ipsec_phase2_interface::dst_addr_type? dst_addr_type=null¶: Remote proxy ID type. subnet:IPv4 subnet. range:IPv4 range. ip:IPv4 IP. name:IPv4 firewall address or group name. subnet6:IPv6 subnet. range6:IPv6 range. ip6:IPv6 IP. name6:IPv6 firewall address or group name.

attribute string? dst_end_ip=null¶: Remote proxy ID IPv4 end.

attribute string? dst_end_ip6=null¶: Remote proxy ID IPv6 end.

attribute fortigate::common::name_t? dst_name=null¶: Remote proxy ID name.

attribute fortigate::common::name_t? dst_name6=null¶: Remote proxy ID name.

attribute fortigate::vpn_ipsec_phase2_interface::dst_port? dst_port=null¶: Quick mode destination port (1 - 65535 or 0 for all).

attribute string? dst_start_ip=null¶: Remote proxy ID IPv4 start.

attribute string? dst_start_ip6=null¶: Remote proxy ID IPv6 start.

attribute string? dst_subnet=null¶: Remote proxy ID IPv4 subnet.

attribute string? dst_subnet6=null¶: Remote proxy ID IPv6 subnet.

attribute fortigate::vpn_ipsec_phase2_interface::encapsulation? encapsulation=null¶: ESP encapsulation mode. tunnel-mode:Use tunnel mode encapsulation. transport-mode:Use transport mode encapsulation.

attribute fortigate::vpn_ipsec_phase2_interface::inbound_dscp_copy? inbound_dscp_copy=null¶: Enable/disable copying of the DSCP in the ESP header to the inner IP header. phase1:copy the DCSP in the ESP header to the inner IP Header according to the phase1 inbound_dscp_copy setting. enable:Enable copying of the DSCP in the ESP header to the inner IP header. disable:Disable copying of the DSCP in the ESP header to the inner IP header.

attribute fortigate::common::enable_disable_t? initiator_ts_narrow=null¶: Enable/disable traffic selector narrowing for IKEv2 initiator. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? ipv4_df=null¶: Enable/disable setting and resetting of IPv4 ‘Don’t Fragment’ bit. enable:Set IPv4 DF the same as original packet. disable:Reset IPv4 DF.

attribute fortigate::common::enable_disable_t? keepalive=null¶: Enable/disable keep alive. enable:Enable setting. disable:Disable setting.

attribute fortigate::vpn_ipsec_phase2_interface::keylife_type? keylife_type=null¶: Keylife type. seconds:Key life in seconds. kbs:Key life in kilobytes. both:Key life both.

attribute fortigate::vpn_ipsec_phase2_interface::keylifekbs? keylifekbs=null¶: Phase2 key life in number of kilobytes of traffic (5120 - 4294967295).

attribute fortigate::vpn_ipsec_phase2_interface::keylifeseconds? keylifeseconds=null¶: Phase2 key life in time in seconds (120 - 172800).

attribute fortigate::common::enable_disable_t? l2tp=null¶: Enable/disable L2TP over IPsec. enable:Enable L2TP over IPsec. disable:Disable L2TP over IPsec.

attribute fortigate::vpn_ipsec_phase2_interface::name name¶: IPsec tunnel name.

attribute fortigate::common::enable_disable_t? pfs=null¶: Enable/disable PFS feature. enable:Enable setting. disable:Disable setting.

attribute fortigate::vpn_ipsec_phase2_interface::phase1name? phase1name=null¶: Phase 1 determines the options required for phase 2.

attribute fortigate::vpn_ipsec_phase2_interface::proposal? proposal=null¶: Phase2 proposal. null-md5:null-md5 null-sha1:null-sha1 null-sha256:null-sha256 null-sha384:null-sha384 null-sha512:null-sha512 des-null:des-null des-md5:des-md5 des-sha1:des-sha1 des-sha256:des-sha256 des-sha384:des-sha384 des-sha512:des-sha512 3des-null:3des-null 3des-md5:3des-md5 3des-sha1:3des-sha1 3des-sha256:3des-sha256 3des-sha384:3des-sha384 3des-sha512:3des-sha512 aes128-null:aes128-null aes128-md5:aes128-md5 aes128-sha1:aes128-sha1 aes128-sha256:aes128-sha256 aes128-sha384:aes128-sha384 aes128-sha512:aes128-sha512 aes128gcm:aes128gcm aes192-null:aes192-null aes192-md5:aes192-md5 aes192-sha1:aes192-sha1 aes192-sha256:aes192-sha256 aes192-sha384:aes192-sha384 aes192-sha512:aes192-sha512 aes256-null:aes256-null aes256-md5:aes256-md5 aes256-sha1:aes256-sha1 aes256-sha256:aes256-sha256 aes256-sha384:aes256-sha384 aes256-sha512:aes256-sha512 aes256gcm:aes256gcm chacha20poly1305:chacha20poly1305 aria128-null:aria128-null aria128-md5:aria128-md5 aria128-sha1:aria128-sha1 aria128-sha256:aria128-sha256 aria128-sha384:aria128-sha384 aria128-sha512:aria128-sha512 aria192-null:aria192-null aria192-md5:aria192-md5 aria192-sha1:aria192-sha1 aria192-sha256:aria192-sha256 aria192-sha384:aria192-sha384 aria192-sha512:aria192-sha512 aria256-null:aria256-null aria256-md5:aria256-md5 aria256-sha1:aria256-sha1 aria256-sha256:aria256-sha256 aria256-sha384:aria256-sha384 aria256-sha512:aria256-sha512 seed-null:seed-null seed-md5:seed-md5 seed-sha1:seed-sha1 seed-sha256:seed-sha256 seed-sha384:seed-sha384 seed-sha512:seed-sha512

attribute fortigate::vpn_ipsec_phase2_interface::protocol? protocol=null¶: Quick mode protocol selector (1 - 255 or 0 for all).

attribute fortigate::common::enable_disable_t? replay=null¶: Enable/disable replay detection. enable:Enable setting. disable:Disable setting.

attribute fortigate::vpn_ipsec_phase2_interface::route_overlap? route_overlap=null¶: Action for overlapping routes. use-old:Use the old route and do not add the new route. use-new:Delete the old route and add the new route. allow:Allow overlapping routes.

attribute fortigate::common::enable_disable_t? single_source=null¶: Enable/disable single source IP restriction. enable:Only single source IP will be accepted. disable:Source IP range will be accepted.

attribute fortigate::vpn_ipsec_phase2_interface::src_addr_type? src_addr_type=null¶: Local proxy ID type. subnet:IPv4 subnet. range:IPv4 range. ip:IPv4 IP. name:IPv4 firewall address or group name. subnet6:IPv6 subnet. range6:IPv6 range. ip6:IPv6 IP. name6:IPv6 firewall address or group name.

attribute string? src_end_ip=null¶: Local proxy ID end.

attribute string? src_end_ip6=null¶: Local proxy ID IPv6 end.

attribute fortigate::common::name_t? src_name=null¶: Local proxy ID name.

attribute fortigate::common::name_t? src_name6=null¶: Local proxy ID name.

attribute fortigate::vpn_ipsec_phase2_interface::src_port? src_port=null¶: Quick mode source port (1 - 65535 or 0 for all).

attribute string? src_start_ip=null¶: Local proxy ID start.

attribute string? src_start_ip6=null¶: Local proxy ID IPv6 start.

attribute string? src_subnet=null¶: Local proxy ID subnet.

attribute string? src_subnet6=null¶: Local proxy ID IPv6 subnet.

The following implements statements select implementations for this entity:

entity fortigate::Licence¶

Parents: fortigate::base::BaseResource

attribute string? proxy_url=null¶: HTTP proxy URL in the form: http://user:pass@proxyip:proxyport.

attribute string token¶: VM license token.

The following implements statements select implementations for this entity:

entity fortigate::LocalInPolicy¶

Parents: fortigate::base::PolicyResource

attribute fortigate::firewall_local_in_policy::action? action=null¶: Action performed on traffic matching the policy (default = deny). accept:Allow traffic matching this policy. deny:Deny or block traffic matching this policy.

attribute fortigate::firewall_local_in_policy::comments? comments=null¶: Comment.

attribute fortigate::common::enable_disable_t? dstaddr_negate=null¶: When enabled dstaddr specifies what the destination address must NOT be. enable:Enable destination address negate. disable:Disable destination address negate.

attribute fortigate::common::enable_disable_t? ha_mgmt_intf_only=null¶: Enable/disable dedicating the HA management interface only for local-in policy. enable:Enable dedicating HA management interface only for local-in policy. disable:Disable dedicating HA management interface only for local-in policy.

attribute fortigate::firewall_local_in_policy::intf? intf=null¶: Incoming interface name from available options.

attribute fortigate::firewall_local_in_policy::policyid policyid¶: User defined local in policy ID.

attribute fortigate::firewall_local_in_policy::schedule? schedule=null¶: Schedule object from available options.

attribute fortigate::common::enable_disable_t? service_negate=null¶: When enabled service specifies what the service must NOT be. enable:Enable negated service match. disable:Disable negated service match.

attribute fortigate::common::enable_disable_t? srcaddr_negate=null¶: When enabled srcaddr specifies what the source address must NOT be. enable:Enable source address negate. disable:Disable source address negate.

attribute fortigate::common::enable_disable_t? status=null¶: Enable/disable this local-in policy. enable:Enable this local-in policy. disable:Disable this local-in policy.

attribute string? uuid=null¶: Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

attribute fortigate::common::enable_disable_t? virtual_patch=null¶: Enable/disable virtual patching. enable:Enable virtual patching. disable:Disable virtual patching. :rel dstaddr: :rel service: :rel srcaddr:

relation fortigate::firewall_local_in_policy::Dstaddr dstaddr [0:*]¶: other end: fortigate::firewall_local_in_policy::Dstaddr._parent [1]

relation fortigate::firewall_local_in_policy::Service service [0:*]¶: other end: fortigate::firewall_local_in_policy::Service._parent [1]

relation fortigate::firewall_local_in_policy::Srcaddr srcaddr [0:*]¶: other end: fortigate::firewall_local_in_policy::Srcaddr._parent [1]

relation fortigate::base::LocalInPolicyRange parent [0:1]¶: other end: fortigate::base::LocalInPolicyRange.policies [0:*]

The following implements statements select implementations for this entity:

entity fortigate::LocalInPolicy6¶

Parents: fortigate::base::PolicyResource

attribute fortigate::firewall_local_in_policy6::action? action=null¶: Action performed on traffic matching the policy (default = deny). accept:Allow local-in traffic matching this policy. deny:Deny or block local-in traffic matching this policy.

attribute fortigate::firewall_local_in_policy6::comments? comments=null¶: Comment.

attribute fortigate::common::enable_disable_t? dstaddr_negate=null¶: When enabled dstaddr specifies what the destination address must NOT be. enable:Enable destination address negate. disable:Disable destination address negate.

attribute fortigate::firewall_local_in_policy6::intf? intf=null¶: Incoming interface name from available options.

attribute fortigate::firewall_local_in_policy6::policyid policyid¶: User defined local in policy ID.

attribute fortigate::firewall_local_in_policy6::schedule? schedule=null¶: Schedule object from available options.

attribute fortigate::common::enable_disable_t? service_negate=null¶: When enabled service specifies what the service must NOT be. enable:Enable negated service match. disable:Disable negated service match.

attribute fortigate::common::enable_disable_t? srcaddr_negate=null¶: When enabled srcaddr specifies what the source address must NOT be. enable:Enable source address negate. disable:Disable source address negate.

attribute fortigate::common::enable_disable_t? status=null¶: Enable/disable this local-in policy. enable:Enable this local-in policy. disable:Disable this local-in policy.

attribute string? uuid=null¶: Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

attribute fortigate::common::enable_disable_t? virtual_patch=null¶: Enable/disable the virtual patching feature. enable:Enable setting. disable:Disable setting. :rel dstaddr: :rel service: :rel srcaddr:

relation fortigate::firewall_local_in_policy6::Dstaddr dstaddr [0:*]¶: other end: fortigate::firewall_local_in_policy6::Dstaddr._parent [1]

relation fortigate::firewall_local_in_policy6::Service service [0:*]¶: other end: fortigate::firewall_local_in_policy6::Service._parent [1]

relation fortigate::firewall_local_in_policy6::Srcaddr srcaddr [0:*]¶: other end: fortigate::firewall_local_in_policy6::Srcaddr._parent [1]

relation fortigate::base::LocalInPolicy6Range parent [0:1]¶: other end: fortigate::base::LocalInPolicy6Range.policies [0:*]

The following implements statements select implementations for this entity:

entity fortigate::MulticastPolicy¶

Parents: fortigate::base::PolicyResource

attribute fortigate::firewall_multicast_policy::action? action=null¶: Accept or deny traffic matching the policy. accept:Accept traffic matching the policy. deny:Deny or block traffic matching the policy.

attribute fortigate::common::enable_disable_t? auto_asic_offload=null¶: Enable/disable offloading policy traffic for hardware acceleration. enable:Enable hardware acceleration offloading. disable:Disable offloading for hardware acceleration.

attribute fortigate::firewall_multicast_policy::comments? comments=null¶: Comment.

attribute string? dnat=null¶: IPv4 DNAT address used for multicast destination addresses.

attribute fortigate::firewall_multicast_policy::dstintf? dstintf=null¶: Destination interface name.

attribute fortigate::firewall_multicast_policy::end_port? end_port=null¶: Integer value for ending TCP/UDP/SCTP destination port in range (1 - 65535, default = 1).

attribute fortigate::firewall_multicast_policy::id id¶: Policy ID ((0 - 4294967294).

attribute fortigate::common::enable_disable_t? logtraffic=null¶: Enable/disable logging traffic accepted by this policy. enable:Enable logging traffic accepted by this policy. disable:Disable logging traffic accepted by this policy.

attribute fortigate::firewall_multicast_policy::name? name=null¶: Policy name.

attribute fortigate::firewall_multicast_policy::protocol? protocol=null¶: Integer value for the protocol type as defined by IANA (0 - 255, default = 0).

attribute fortigate::common::enable_disable_t? snat=null¶: Enable/disable substitution of the outgoing interface IP address for the original source IP address (called source NAT or SNAT). enable:Enable source NAT. disable:Disable source NAT.

attribute string? snat_ip=null¶: IPv4 address to be used as the source address for NATed traffic.

attribute fortigate::firewall_multicast_policy::srcintf? srcintf=null¶: Source interface name.

attribute fortigate::firewall_multicast_policy::start_port? start_port=null¶: Integer value for starting TCP/UDP/SCTP destination port in range (1 - 65535, default = 1).

attribute fortigate::common::enable_disable_t? status=null¶: Enable/disable this policy. enable:Enable this policy. disable:Disable this policy.

attribute fortigate::firewall_multicast_policy::traffic_shaper? traffic_shaper=null¶: Traffic shaper to apply to traffic forwarded by the multicast policy.

attribute string? uuid=null¶: Universally Unique Identifier (UUID; automatically assigned but can be manually reset). :rel dstaddr: :rel srcaddr:

relation fortigate::firewall_multicast_policy::Dstaddr dstaddr [0:*]¶: other end: fortigate::firewall_multicast_policy::Dstaddr._parent [1]

relation fortigate::firewall_multicast_policy::Srcaddr srcaddr [0:*]¶: other end: fortigate::firewall_multicast_policy::Srcaddr._parent [1]

relation fortigate::base::MulticastPolicyRange parent [0:1]¶: other end: fortigate::base::MulticastPolicyRange.policies [0:*]

The following implements statements select implementations for this entity:

entity fortigate::MulticastPolicy6¶

Parents: fortigate::base::PolicyResource

attribute fortigate::firewall_multicast_policy6::action? action=null¶: Accept or deny traffic matching the policy. accept:Accept. deny:Deny.

attribute fortigate::common::enable_disable_t? auto_asic_offload=null¶: Enable/disable offloading policy traffic for hardware acceleration. enable:Enable offloading policy traffic for hardware acceleration. disable:Disable offloading policy traffic for hardware acceleration.

attribute fortigate::firewall_multicast_policy6::comments? comments=null¶: Comment.

attribute fortigate::firewall_multicast_policy6::dstintf? dstintf=null¶: IPv6 destination interface name.

attribute fortigate::firewall_multicast_policy6::end_port? end_port=null¶: Integer value for ending TCP/UDP/SCTP destination port in range (1 - 65535, default = 65535).

attribute fortigate::firewall_multicast_policy6::id id¶: Policy ID (0 - 4294967294).

attribute fortigate::common::enable_disable_t? logtraffic=null¶: Enable/disable logging traffic accepted by this policy. enable:Enable logging traffic accepted by this policy. disable:Disable logging traffic accepted by this policy.

attribute fortigate::firewall_multicast_policy6::name? name=null¶: Policy name.

attribute fortigate::firewall_multicast_policy6::protocol? protocol=null¶: Integer value for the protocol type as defined by IANA (0 - 255, default = 0).

attribute fortigate::firewall_multicast_policy6::srcintf? srcintf=null¶: IPv6 source interface name.

attribute fortigate::firewall_multicast_policy6::start_port? start_port=null¶: Integer value for starting TCP/UDP/SCTP destination port in range (1 - 65535, default = 1).

attribute fortigate::common::enable_disable_t? status=null¶: Enable/disable this policy. enable:Enable this policy. disable:Disable this policy.

attribute string? uuid=null¶: Universally Unique Identifier (UUID; automatically assigned but can be manually reset). :rel dstaddr: :rel srcaddr:

relation fortigate::firewall_multicast_policy6::Dstaddr dstaddr [0:*]¶: other end: fortigate::firewall_multicast_policy6::Dstaddr._parent [1]

relation fortigate::firewall_multicast_policy6::Srcaddr srcaddr [0:*]¶: other end: fortigate::firewall_multicast_policy6::Srcaddr._parent [1]

relation fortigate::base::MulticastPolicy6Range parent [0:1]¶: other end: fortigate::base::MulticastPolicy6Range.policies [0:*]

The following implements statements select implementations for this entity:

entity fortigate::Policy¶

Parents: fortigate::base::PolicyResource

attribute fortigate::firewall_policy::action? action=null¶: Policy action (accept/deny/ipsec). accept:Allows session that match the firewall policy. deny:Blocks sessions that match the firewall policy. ipsec:Firewall policy becomes a policy-based IPsec VPN policy.

attribute fortigate::common::enable_disable_t? anti_replay=null¶: Enable/disable anti-replay check. enable:Enable anti-replay check. disable:Disable anti-replay check.

attribute fortigate::firewall_policy::application_list? application_list=null¶: Name of an existing Application list.

attribute fortigate::firewall_policy::auth_cert? auth_cert=null¶: HTTPS server certificate for policy authentication.

attribute fortigate::common::enable_disable_t? auth_path=null¶: Enable/disable authentication-based routing. enable:Enable authentication-based routing. disable:Disable authentication-based routing.

attribute fortigate::firewall_policy::auth_redirect_addr? auth_redirect_addr=null¶: HTTP-to-HTTPS redirect address for firewall authentication.

attribute fortigate::common::enable_disable_t? auto_asic_offload=null¶: Enable/disable policy traffic ASIC offloading. enable:Enable auto ASIC offloading. disable:Disable ASIC offloading.

attribute fortigate::firewall_policy::av_profile? av_profile=null¶: Name of an existing Antivirus profile.

attribute fortigate::common::enable_disable_t? block_notification=null¶: Enable/disable block notification. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? captive_portal_exempt=null¶: Enable to exempt some users from the captive portal. enable:Enable exemption of captive portal. disable:Disable exemption of captive portal.

attribute fortigate::common::enable_disable_t? capture_packet=null¶: Enable/disable capture packets. enable:Enable capture packets. disable:Disable capture packets.

attribute fortigate::firewall_policy::cifs_profile? cifs_profile=null¶: Name of an existing CIFS profile.

attribute fortigate::firewall_policy::comments? comments=null¶: Comment.

attribute fortigate::firewall_policy::decrypted_traffic_mirror? decrypted_traffic_mirror=null¶: Decrypted traffic mirror.

attribute fortigate::common::enable_disable_t? delay_tcp_npu_session=null¶: Enable TCP NPU session delay to guarantee packet order of 3-way handshake. enable:Enable TCP NPU session delay in order to guarantee packet order of 3-way handshake. disable:Disable TCP NPU session delay in order to guarantee packet order of 3-way handshake.

attribute fortigate::common::enable_disable_t? diffserv_copy=null¶: Enable to copy packet’s DiffServ values from session’s original direction to its reply direction. enable:Enable DSCP copy. disable:Disable DSCP copy.

attribute fortigate::common::enable_disable_t? diffserv_forward=null¶: Enable to change packet’s DiffServ values to the specified diffservcode-forward value. enable:Enable setting forward (original) traffic Diffserv. disable:Disable setting forward (original) traffic Diffserv.

attribute fortigate::common::enable_disable_t? diffserv_reverse=null¶: Enable to change packet’s reverse (reply) DiffServ values to the specified diffservcode-rev value. enable:Enable setting reverse (reply) traffic DiffServ. disable:Disable setting reverse (reply) traffic DiffServ.

attribute string? diffservcode_forward=null¶: Change packet’s DiffServ to this value.

attribute string? diffservcode_rev=null¶: Change packet’s reverse (reply) DiffServ to this value.

attribute fortigate::common::enable_disable_t? disclaimer=null¶: Enable/disable user authentication disclaimer. enable:Enable user authentication disclaimer. disable:Disable user authentication disclaimer.

attribute fortigate::firewall_policy::dlp_profile? dlp_profile=null¶: Name of an existing DLP profile.

attribute fortigate::firewall_policy::dnsfilter_profile? dnsfilter_profile=null¶: Name of an existing DNS filter profile.

attribute fortigate::common::enable_disable_t? dsri=null¶: Enable DSRI to ignore HTTP server responses. enable:Enable DSRI. disable:Disable DSRI.

attribute fortigate::common::enable_disable_t? dstaddr6_negate=null¶: When enabled dstaddr6 specifies what the destination address must NOT be. enable:Enable IPv6 destination address negate. disable:Disable IPv6 destination address negate.

attribute fortigate::common::enable_disable_t? dstaddr_negate=null¶: When enabled dstaddr specifies what the destination address must NOT be. enable:Enable destination address negate. disable:Disable destination address negate.

attribute fortigate::common::enable_disable_t? dynamic_shaping=null¶: Enable/disable dynamic RADIUS defined traffic shaping. enable:Enable dynamic RADIUS defined traffic shaping. disable:Disable dynamic RADIUS defined traffic shaping.

attribute fortigate::common::enable_disable_t? email_collect=null¶: Enable/disable email collection. enable:Enable email collection. disable:Disable email collection.

attribute fortigate::firewall_policy::emailfilter_profile? emailfilter_profile=null¶: Name of an existing email filter profile.

attribute fortigate::common::enable_disable_t? fec=null¶: Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. enable:Enable Forward Error Correction. disable:Disable Forward Error Correction.

attribute fortigate::firewall_policy::file_filter_profile? file_filter_profile=null¶: Name of an existing file-filter profile.

attribute fortigate::firewall_policy::firewall_session_dirty? firewall_session_dirty=null¶: How to handle sessions if the configuration of this firewall policy changes. check-all:Flush all current sessions accepted by this policy. These sessions must be started and re-matched with policies. check-new:Continue to allow sessions already accepted by this policy.

attribute fortigate::common::enable_disable_t? fixedport=null¶: Enable to prevent source NAT from changing a session’s source port. enable:Enable setting. disable:Disable setting.

attribute fortigate::firewall_policy::fsso_agent_for_ntlm? fsso_agent_for_ntlm=null¶: FSSO agent to use for NTLM authentication.

attribute fortigate::common::enable_disable_t? geoip_anycast=null¶: Enable/disable recognition of anycast IP addresses using the geography IP database. enable:Enable recognition of anycast IP addresses using the geography IP database. disable:Disable recognition of anycast IP addresses using the geography IP database.

attribute fortigate::firewall_policy::geoip_match? geoip_match=null¶: Match geography address based either on its physical location or registered location. physical-location:Match geography address to its physical location using the geography IP database. registered-location:Match geography address to its registered location using the geography IP database.

attribute fortigate::common::enable_disable_t? http_policy_redirect=null¶: Redirect HTTP(S) traffic to matching transparent web proxy policy. enable:Enable HTTP(S) policy redirect. disable:Disable HTTP(S) policy redirect.

attribute fortigate::firewall_policy::icap_profile? icap_profile=null¶: Name of an existing ICAP profile.

attribute fortigate::firewall_policy::identity_based_route? identity_based_route=null¶: Name of identity-based routing rule.

attribute fortigate::common::enable_disable_t? inbound=null¶: Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. enable:Enable setting. disable:Disable setting.

attribute fortigate::firewall_policy::inspection_mode? inspection_mode=null¶: Policy inspection mode (Flow/proxy). Default is Flow mode. proxy:Proxy based inspection. flow:Flow based inspection.

attribute fortigate::common::enable_disable_t? internet_service=null¶: Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. enable:Enable use of Internet Services in policy. disable:Disable use of Internet Services in policy.

attribute fortigate::common::enable_disable_t? internet_service6=null¶: Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. enable:Enable use of IPv6 Internet Services in policy. disable:Disable use of IPv6 Internet Services in policy.

attribute fortigate::common::enable_disable_t? internet_service6_negate=null¶: When enabled internet-service6 specifies what the service must NOT be. enable:Enable negated IPv6 Internet Service match. disable:Disable negated IPv6 Internet Service match.

attribute fortigate::common::enable_disable_t? internet_service6_src=null¶: Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. enable:Enable use of IPv6 Internet Services source in policy. disable:Disable use of IPv6 Internet Services source in policy.

attribute fortigate::common::enable_disable_t? internet_service6_src_negate=null¶: When enabled internet-service6-src specifies what the service must NOT be. enable:Enable negated IPv6 Internet Service source match. disable:Disable negated IPv6 Internet Service source match.

attribute fortigate::common::enable_disable_t? internet_service_negate=null¶: When enabled internet-service specifies what the service must NOT be. enable:Enable negated Internet Service match. disable:Disable negated Internet Service match.

attribute fortigate::common::enable_disable_t? internet_service_src=null¶: Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. enable:Enable use of Internet Services source in policy. disable:Disable use of Internet Services source in policy.

attribute fortigate::common::enable_disable_t? internet_service_src_negate=null¶: When enabled internet-service-src specifies what the service must NOT be. enable:Enable negated Internet Service source match. disable:Disable negated Internet Service source match.

attribute fortigate::common::enable_disable_t? ippool=null¶: Enable to use IP Pools for source NAT. enable:Enable setting. disable:Disable setting.

attribute fortigate::firewall_policy::ips_sensor? ips_sensor=null¶: Name of an existing IPS sensor.

attribute fortigate::firewall_policy::ips_voip_filter? ips_voip_filter=null¶: Name of an existing VoIP (ips) profile.

attribute fortigate::firewall_policy::logtraffic? logtraffic=null¶: Enable or disable logging. Log all sessions or security profile sessions. all:Log all sessions accepted or denied by this policy. utm:Log traffic that has a security profile applied to it. disable:Disable all logging for this policy.

attribute fortigate::common::enable_disable_t? logtraffic_start=null¶: Record logs when a session starts. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? match_vip=null¶: Enable to match packets that have had their destination addresses changed by a VIP. enable:Match DNATed packet. disable:Do not match DNATed packet.

attribute fortigate::common::enable_disable_t? match_vip_only=null¶: Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. enable:Enable matching of only those packets that have had their destination addresses changed by a VIP. disable:Disable matching of only those packets that have had their destination addresses changed by a VIP.

attribute fortigate::firewall_policy::name? name=null¶: Policy name.

attribute fortigate::common::enable_disable_t? nat=null¶: Enable/disable source NAT. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? nat46=null¶: Enable/disable NAT46. enable:Enable NAT46. disable:Disable NAT46.

attribute fortigate::common::enable_disable_t? nat64=null¶: Enable/disable NAT64. enable:Enable NAT64. disable:Disable NAT64.

attribute fortigate::common::enable_disable_t? natinbound=null¶: Policy-based IPsec VPN: apply destination NAT to inbound traffic. enable:Enable setting. disable:Disable setting.

attribute string? natip=null¶: Policy-based IPsec VPN: source NAT IP address for outgoing traffic.

attribute fortigate::common::enable_disable_t? natoutbound=null¶: Policy-based IPsec VPN: apply source NAT to outbound traffic. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? np_acceleration=null¶: Enable/disable UTM Network Processor acceleration. enable:Enable UTM Network Processor acceleration. disable:Disable UTM Network Processor acceleration.

attribute fortigate::common::enable_disable_t? ntlm=null¶: Enable/disable NTLM authentication. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? ntlm_guest=null¶: Enable/disable NTLM guest user access. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? outbound=null¶: Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? passive_wan_health_measurement=null¶: Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. enable:Enable Passive WAN health measurement. disable:Disable Passive WAN health measurement.

attribute fortigate::firewall_policy::per_ip_shaper? per_ip_shaper=null¶: Per-IP traffic shaper.

attribute fortigate::common::enable_disable_t? permit_any_host=null¶: Accept UDP packets from any host. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? permit_stun_host=null¶: Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? policy_expiry=null¶: Enable/disable policy expiry. enable:Enable policy expiry. disable:Disable polcy expiry.

attribute string? policy_expiry_date=null¶: Policy expiry date (YYYY-MM-DD HH:MM:SS).

attribute string? policy_expiry_date_utc=null¶: Policy expiry date and time, in epoch format.

attribute fortigate::firewall_policy::policyid policyid¶: Policy ID (0 - 4294967294).

attribute fortigate::firewall_policy::profile_group? profile_group=null¶: Name of profile group.

attribute fortigate::firewall_policy::profile_protocol_options? profile_protocol_options=null¶: Name of an existing Protocol options profile.

attribute fortigate::firewall_policy::profile_type? profile_type=null¶: Determine whether the firewall policy allows security profile groups or single profiles only. single:Do not allow security profile groups. group:Allow security profile groups.

attribute fortigate::common::enable_disable_t? radius_mac_auth_bypass=null¶: Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. enable:Enable MAC authentication bypass. disable:Disable MAC authentication bypass.

attribute fortigate::firewall_policy::redirect_url? redirect_url=null¶: URL users are directed to after seeing and accepting the disclaimer or authenticating.

attribute fortigate::firewall_policy::replacemsg_override_group? replacemsg_override_group=null¶: Override the default replacement message group for this policy.

attribute fortigate::firewall_policy::reputation_direction? reputation_direction=null¶: Direction of the initial traffic for reputation to take effect. source:Check reputation for source address. destination:Check reputation for destination address.

attribute fortigate::firewall_policy::reputation_direction6? reputation_direction6=null¶: Direction of the initial traffic for IPv6 reputation to take effect. source:Check reputation for IPv6 source address. destination:Check reputation for IPv6 destination address.

attribute fortigate::firewall_policy::reputation_minimum? reputation_minimum=null¶: Minimum Reputation to take action.

attribute fortigate::firewall_policy::reputation_minimum6? reputation_minimum6=null¶: IPv6 Minimum Reputation to take action.

attribute fortigate::common::enable_disable_t? rtp_nat=null¶: Enable Real Time Protocol (RTP) NAT. disable:Disable setting. enable:Enable setting.

attribute fortigate::firewall_policy::schedule? schedule=null¶: Schedule name.

attribute fortigate::common::enable_disable_t? schedule_timeout=null¶: Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. enable:Enable schedule timeout. disable:Disable schedule timeout.

attribute fortigate::firewall_policy::sctp_filter_profile? sctp_filter_profile=null¶: Name of an existing SCTP filter profile.

attribute fortigate::common::enable_disable_t? send_deny_packet=null¶: Enable to send a reply when a session is denied or blocked by a firewall policy. disable:Disable deny-packet sending. enable:Enable deny-packet sending.

attribute fortigate::common::enable_disable_t? service_negate=null¶: When enabled service specifies what the service must NOT be. enable:Enable negated service match. disable:Disable negated service match.

attribute string? session_ttl=null¶: TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).

attribute fortigate::common::enable_disable_t? sgt_check=null¶: Enable/disable security group tags (SGT) check. enable:Enable SGT check. disable:Disable SGT check.

attribute fortigate::common::enable_disable_t? srcaddr6_negate=null¶: When enabled srcaddr6 specifies what the source address must NOT be. enable:Enable IPv6 source address negate. disable:Disable IPv6 source address negate.

attribute fortigate::common::enable_disable_t? srcaddr_negate=null¶: When enabled srcaddr specifies what the source address must NOT be. enable:Enable source address negate. disable:Disable source address negate.

attribute fortigate::firewall_policy::ssh_filter_profile? ssh_filter_profile=null¶: Name of an existing SSH filter profile.

attribute fortigate::common::enable_disable_t? ssh_policy_redirect=null¶: Redirect SSH traffic to matching transparent proxy policy. enable:Enable SSH policy redirect. disable:Disable SSH policy redirect.

attribute fortigate::firewall_policy::ssl_ssh_profile? ssl_ssh_profile=null¶: Name of an existing SSL SSH profile.

attribute fortigate::common::enable_disable_t? status=null¶: Enable or disable this policy. enable:Enable setting. disable:Disable setting.

attribute fortigate::firewall_policy::tcp_mss_receiver? tcp_mss_receiver=null¶: Receiver TCP maximum segment size (MSS).

attribute fortigate::firewall_policy::tcp_mss_sender? tcp_mss_sender=null¶: Sender TCP maximum segment size (MSS).

attribute fortigate::firewall_policy::tcp_session_without_syn? tcp_session_without_syn=null¶: Enable/disable creation of TCP session without SYN flag. all:Enable TCP session without SYN. data-only:Enable TCP session data only. disable:Disable TCP session without SYN.

attribute fortigate::common::enable_disable_t? timeout_send_rst=null¶: Enable/disable sending RST packets when TCP sessions expire. enable:Enable sending of RST packet upon TCP session expiration. disable:Disable sending of RST packet upon TCP session expiration.

attribute string? tos=null¶: ToS (Type of Service) value used for comparison.

attribute string? tos_mask=null¶: Non-zero bit positions are used for comparison while zero bit positions are ignored.

attribute fortigate::common::enable_disable_t? tos_negate=null¶: Enable negated TOS match. enable:Enable TOS match negate. disable:Disable TOS match negate.

attribute fortigate::firewall_policy::traffic_shaper? traffic_shaper=null¶: Traffic shaper.

attribute fortigate::firewall_policy::traffic_shaper_reverse? traffic_shaper_reverse=null¶: Reverse traffic shaper.

attribute fortigate::common::enable_disable_t? utm_status=null¶: Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. enable:Enable setting. disable:Disable setting.

attribute string? uuid=null¶: Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

attribute fortigate::firewall_policy::videofilter_profile? videofilter_profile=null¶: Name of an existing VideoFilter profile.

attribute fortigate::firewall_policy::vlan_cos_fwd? vlan_cos_fwd=null¶: VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.

attribute fortigate::firewall_policy::vlan_cos_rev? vlan_cos_rev=null¶: VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.

attribute string? vlan_filter=null¶: VLAN ranges to allow

attribute fortigate::firewall_policy::voip_profile? voip_profile=null¶: Name of an existing VoIP (voipd) profile.

attribute fortigate::firewall_policy::vpntunnel? vpntunnel=null¶: Policy-based IPsec VPN: name of the IPsec VPN Phase 1.

attribute fortigate::firewall_policy::waf_profile? waf_profile=null¶: Name of an existing Web application firewall profile.

attribute fortigate::common::enable_disable_t? wanopt=null¶: Enable/disable WAN optimization. enable:Enable setting. disable:Disable setting.

attribute fortigate::firewall_policy::wanopt_detection? wanopt_detection=null¶: WAN optimization auto-detection mode. active:Active WAN optimization peer auto-detection. passive:Passive WAN optimization peer auto-detection. off:Turn off WAN optimization peer auto-detection.

attribute fortigate::firewall_policy::wanopt_passive_opt? wanopt_passive_opt=null¶: WAN optimization passive mode options. This option decides what IP address will be used to connect server. default:Allow client side WAN opt peer to decide. transparent:Use address of client to connect to server. non-transparent:Use local FortiGate address to connect to server.

attribute fortigate::firewall_policy::wanopt_peer? wanopt_peer=null¶: WAN optimization peer.

attribute fortigate::firewall_policy::wanopt_profile? wanopt_profile=null¶: WAN optimization profile.

attribute fortigate::common::enable_disable_t? wccp=null¶: Enable/disable forwarding traffic matching this policy to a configured WCCP server. enable:Enable WCCP setting. disable:Disable WCCP setting.

attribute fortigate::common::enable_disable_t? webcache=null¶: Enable/disable web cache. enable:Enable setting. disable:Disable setting.

attribute fortigate::common::enable_disable_t? webcache_https=null¶: Enable/disable web cache for HTTPS. disable:Disable web cache for HTTPS. enable:Enable web cache for HTTPS.

attribute fortigate::firewall_policy::webfilter_profile? webfilter_profile=null¶: Name of an existing Web filter profile.

attribute fortigate::firewall_policy::webproxy_forward_server? webproxy_forward_server=null¶: Webproxy forward server name.

attribute fortigate::firewall_policy::webproxy_profile? webproxy_profile=null¶: Webproxy profile name.

attribute fortigate::common::enable_disable_t? ztna_device_ownership=null¶: Enable/disable zero trust device ownership. enable:Enable ZTNA device ownership check. disable:Disable ZTNA device ownership check.

attribute fortigate::common::enable_disable_t? ztna_policy_redirect=null¶: Redirect ZTNA traffic to matching Access-Proxy proxy-policy. enable:Enable ZTNA proxy-policy redirect. disable:Disable ZTNA proxy-policy redirect.

attribute fortigate::common::enable_disable_t? ztna_status=null¶: Enable/disable zero trust access. enable:Enable zero trust network access. disable:Disable zero trust network access.

attribute fortigate::firewall_policy::ztna_tags_match_logic? ztna_tags_match_logic=null¶: ZTNA tag matching logic. or:Match ZTNA tags using a logical OR operator. and:Match ZTNA tags using a logical AND operator. :rel custom_log_fields: :rel dstaddr: :rel dstaddr6: :rel dstintf: :rel fsso_groups: :rel groups: :rel internet_service6_custom: :rel internet_service6_custom_group: :rel internet_service6_group: :rel internet_service6_name: :rel internet_service6_src_custom: :rel internet_service6_src_custom_group: :rel internet_service6_src_group: :rel internet_service6_src_name: :rel internet_service_custom: :rel internet_service_custom_group: :rel internet_service_group: :rel internet_service_name: :rel internet_service_src_custom: :rel internet_service_src_custom_group: :rel internet_service_src_group: :rel internet_service_src_name: :rel network_service_dynamic: :rel network_service_src_dynamic: :rel ntlm_enabled_browsers: :rel poolname: :rel poolname6: :rel rtp_addr: :rel service: :rel sgt: :rel src_vendor_mac: :rel srcaddr: :rel srcaddr6: :rel srcintf: :rel users: :rel ztna_ems_tag: :rel ztna_geo_tag:

relation fortigate::firewall_policy::CustomLogFields custom_log_fields [0:*]¶: other end: fortigate::firewall_policy::CustomLogFields._parent [1]

relation fortigate::firewall_policy::Dstaddr dstaddr [0:*]¶: other end: fortigate::firewall_policy::Dstaddr._parent [1]

relation fortigate::firewall_policy::Dstaddr6 dstaddr6 [0:*]¶: other end: fortigate::firewall_policy::Dstaddr6._parent [1]

relation fortigate::firewall_policy::Dstintf dstintf [0:*]¶: other end: fortigate::firewall_policy::Dstintf._parent [1]

relation fortigate::firewall_policy::FssoGroups fsso_groups [0:*]¶: other end: fortigate::firewall_policy::FssoGroups._parent [1]

relation fortigate::firewall_policy::Groups groups [0:*]¶: other end: fortigate::firewall_policy::Groups._parent [1]

relation fortigate::firewall_policy::InternetService6Custom internet_service6_custom [0:*]¶: other end: fortigate::firewall_policy::InternetService6Custom._parent [1]

relation fortigate::firewall_policy::InternetService6CustomGroup internet_service6_custom_group [0:*]¶: other end: fortigate::firewall_policy::InternetService6CustomGroup._parent [1]

relation fortigate::firewall_policy::InternetService6Group internet_service6_group [0:*]¶: other end: fortigate::firewall_policy::InternetService6Group._parent [1]

relation fortigate::firewall_policy::InternetService6Name internet_service6_name [0:*]¶: other end: fortigate::firewall_policy::InternetService6Name._parent [1]

relation fortigate::firewall_policy::InternetService6SrcCustom internet_service6_src_custom [0:*]¶: other end: fortigate::firewall_policy::InternetService6SrcCustom._parent [1]

relation fortigate::firewall_policy::InternetService6SrcCustomGroup internet_service6_src_custom_group [0:*]¶: other end: fortigate::firewall_policy::InternetService6SrcCustomGroup._parent [1]

relation fortigate::firewall_policy::InternetService6SrcGroup internet_service6_src_group [0:*]¶: other end: fortigate::firewall_policy::InternetService6SrcGroup._parent [1]

relation fortigate::firewall_policy::InternetService6SrcName internet_service6_src_name [0:*]¶: other end: fortigate::firewall_policy::InternetService6SrcName._parent [1]

relation fortigate::firewall_policy::InternetServiceCustom internet_service_custom [0:*]¶: other end: fortigate::firewall_policy::InternetServiceCustom._parent [1]

relation fortigate::firewall_policy::InternetServiceCustomGroup internet_service_custom_group [0:*]¶: other end: fortigate::firewall_policy::InternetServiceCustomGroup._parent [1]

relation fortigate::firewall_policy::InternetServiceGroup internet_service_group [0:*]¶: other end: fortigate::firewall_policy::InternetServiceGroup._parent [1]

relation fortigate::firewall_policy::InternetServiceName internet_service_name [0:*]¶: other end: fortigate::firewall_policy::InternetServiceName._parent [1]

relation fortigate::firewall_policy::InternetServiceSrcCustom internet_service_src_custom [0:*]¶: other end: fortigate::firewall_policy::InternetServiceSrcCustom._parent [1]

relation fortigate::firewall_policy::InternetServiceSrcCustomGroup internet_service_src_custom_group [0:*]¶: other end: fortigate::firewall_policy::InternetServiceSrcCustomGroup._parent [1]

relation fortigate::firewall_policy::InternetServiceSrcGroup internet_service_src_group [0:*]¶: other end: fortigate::firewall_policy::InternetServiceSrcGroup._parent [1]

relation fortigate::firewall_policy::InternetServiceSrcName internet_service_src_name [0:*]¶: other end: fortigate::firewall_policy::InternetServiceSrcName._parent [1]

relation fortigate::firewall_policy::NetworkServiceDynamic network_service_dynamic [0:*]¶: other end: fortigate::firewall_policy::NetworkServiceDynamic._parent [1]

relation fortigate::firewall_policy::NetworkServiceSrcDynamic network_service_src_dynamic [0:*]¶: other end: fortigate::firewall_policy::NetworkServiceSrcDynamic._parent [1]

relation fortigate::firewall_policy::NtlmEnabledBrowsers ntlm_enabled_browsers [0:*]¶: other end: fortigate::firewall_policy::NtlmEnabledBrowsers._parent [1]

relation fortigate::firewall_policy::Poolname poolname [0:*]¶: other end: fortigate::firewall_policy::Poolname._parent [1]

relation fortigate::firewall_policy::Poolname6 poolname6 [0:*]¶: other end: fortigate::firewall_policy::Poolname6._parent [1]

relation fortigate::firewall_policy::RtpAddr rtp_addr [0:*]¶: other end: fortigate::firewall_policy::RtpAddr._parent [1]

relation fortigate::firewall_policy::Service service [0:*]¶: other end: fortigate::firewall_policy::Service._parent [1]

relation fortigate::firewall_policy::Sgt sgt [0:*]¶: other end: fortigate::firewall_policy::Sgt._parent [1]

relation fortigate::firewall_policy::SrcVendorMac src_vendor_mac [0:*]¶: other end: fortigate::firewall_policy::SrcVendorMac._parent [1]

relation fortigate::firewall_policy::Srcaddr srcaddr [0:*]¶: other end: fortigate::firewall_policy::Srcaddr._parent [1]

relation fortigate::firewall_policy::Srcaddr6 srcaddr6 [0:*]¶: other end: fortigate::firewall_policy::Srcaddr6._parent [1]

relation fortigate::firewall_policy::Srcintf srcintf [0:*]¶: other end: fortigate::firewall_policy::Srcintf._parent [1]

relation fortigate::firewall_policy::Users users [0:*]¶: other end: fortigate::firewall_policy::Users._parent [1]

relation fortigate::firewall_policy::ZtnaEmsTag ztna_ems_tag [0:*]¶: other end: fortigate::firewall_policy::ZtnaEmsTag._parent [1]

relation fortigate::firewall_policy::ZtnaGeoTag ztna_geo_tag [0:*]¶: other end: fortigate::firewall_policy::ZtnaGeoTag._parent [1]

relation fortigate::base::PolicyRange parent [0:1]¶: other end: fortigate::base::PolicyRange.policies [0:*]

The following implements statements select implementations for this entity:

entity fortigate::PrefixList¶

Parents: fortigate::base::VdomResource

attribute fortigate::router_prefix_list::comments? comments=null¶: Comment.

attribute fortigate::router_prefix_list::name name¶: Name. :rel rule:

relation fortigate::router_prefix_list::Rule rule [0:*]¶: other end: fortigate::router_prefix_list::Rule._parent [1]

The following implements statements select implementations for this entity:

entity fortigate::SDWan¶

Parents: fortigate::base::VdomResource

attribute fortigate::system_sdwan::duplication_max_num? duplication_max_num=null¶: Maximum number of interface members a packet is duplicated in the SD-WAN zone (2 - 4, default = 2; if set to 3, the original packet plus 2 more copies are created).

attribute fortigate::common::enable_disable_t? fail_detect=null¶: Enable/disable SD-WAN Internet connection status checking (failure detection). enable:Enable status checking. disable:Disable status checking.

attribute fortigate::system_sdwan::load_balance_mode? load_balance_mode=null¶: Algorithm or mode to use for load balancing Internet traffic to SD-WAN members. source-ip-based:Source IP load balancing. All traffic from a source IP is sent to the same interface. weight-based:Weight-based load balancing. Interfaces with higher weights have higher priority and get more traffic. usage-based:Usage-based load balancing. All traffic is sent to the first interface on the list. When the bandwidth on that interface exceeds the spill-over limit new traffic is sent to the next interface. source-dest-ip-based:Source and destination IP load balancing. All traffic from a source IP to a destination IP is sent to the same interface. measured-volume-based:Volume-based load balancing. Traffic is load balanced based on traffic volume (in bytes). More traffic is sent to interfaces with higher volume ratios.

attribute fortigate::system_sdwan::neighbor_hold_boot_time? neighbor_hold_boot_time=null¶: Waiting period in seconds when switching from the primary neighbor to the secondary neighbor from the neighbor start. (0 - 10000000, default = 0).