0

I am trying to add and execute Fortigate HA config in cli script section of Fortimanager using Ansible. The script is getting added successfully but unable to execute same script using Ansible. It is throwing error "meta": {"request_url": "/dvmdb/adom/XYZ/script/execute", "response_code": -8, "response_data": [], "response_message": "Invalid parameter"...". However, if the run the added cli script from Fortimanager Scripts section in a remote fortigate, it is successfully getting executed. I need to know what I am missing here OR what is invalid parameter. Kindly check and help. I have uploaded the script section from fortimanager as reference. I am adding input data from the below list using loop.

Error:

2022-11-09T11:42:41.4765516Z failed: [fmg1] (item={'adom': 'XYZ', 'content': 'config global\n config system virtual-switch\n edit internal\n config port\n delete internal5\n end\n end\nend\nconfig global\n config system global\n set hostname FW2101\nend\n\nconfig system ha\n set group-name FW2100\n set mode a-p\n set password xyz123\n set hbdev internal5 50\n set session-pickup enable\n set priority 200\nend', 'desc': 'Created by Ansible', 'filter_device': 'FGT12345', 'name': 'FGT123458_FGT12345_HA', 'scope': [{'name': 'FGT12345', 'vdom': 'root'}], 'target': 'remote_device', 'type': 'cli'}) => {"ansible_loop_var": "item", "changed": false, "item": {"adom": "XYZ", "content": "config global\n config system virtual-switch\n edit internal\n config port\n delete internal5\n end\n end\nend\nconfig global\n config system global\n set hostname FW2101\nend\n\nconfig system ha\n set group-name FW2100\n set mode a-p\n set password xyz123\n set hbdev internal5 50\n set session-pickup enable\n set priority 200\nend", "desc": "Created by Ansible", "filter_device": "FGT12345", "name": "FGT12345_FGT12345_HA", "scope": [{"name": "FGT12345", "vdom": "root"}], "target": "remote_device", "type": "cli"}, "meta": {"request_url": "/dvmdb/adom/XYZ/script/execute", "response_code": -8, "response_data": [], "response_message": "Invalid parameter", "system_information": {"Admin Domain Configuration": "Enabled", "BIOS version": "04000002", "Branch Point": "0254", "Build": "0254", "Current Time": "Wed Nov 09 11:42:41 GMT 2022", "Daylight Time Saving": "Yes", "FIPS Mode": "Disabled", "HA Mode": "Stand Alone", "Hostname": "FMG-VM64", "License Status": "Valid", "Major": 7, "Max Number of Admin Domains": 10000, "Max Number of Device Groups": 10000, "Minor": 0, "Offline Mode": "Disabled", "Patch": 3, "Platform Full Name": "FortiManager-VM64", "Platform Type": "FMG-VM64", "Release Version Information": " (GA)", "Serial Number": "FMG12345", "TZ": "GMT", "Time Zone": "(GMT) Greenwich Mean Time.", "Version": "v7.0.3-build0254 220202 (GA)", "x86-64 Applications": "Yes"}}, "rc": -8}

Input:

2022-11-09T11:41:34.8279698Z     "dvmdb_scripts": [
2022-11-09T11:41:34.8280388Z         {
2022-11-09T11:41:34.8280959Z             "adom": "XYZ",
2022-11-09T11:41:34.8284480Z             "content": "config global\n    config system virtual-switch\n    edit internal\n        config port\n        delete internal5\n                end\n    end\nend\nconfig global\n    config system global\n        set hostname FW2101\nend\n\nconfig system ha\n    set group-name FW2100\n    set mode a-p\n    set password xyz123\n    set hbdev internal5 50\n    set session-pickup enable\n    set priority 200\nend",
2022-11-09T11:41:34.8286670Z             "desc": "Created by Ansible",
2022-11-09T11:41:34.8287956Z             "filter_device": "fgtxyz",
2022-11-09T11:41:34.8288726Z             "name": "FGT12345_FGT12345_HA",
2022-11-09T11:41:34.8289413Z             "scope": [
2022-11-09T11:41:34.8289928Z                 {
2022-11-09T11:41:34.8290548Z                     "name": "FGT12345",
2022-11-09T11:41:34.8291201Z                     "vdom": "root"
2022-11-09T11:41:34.8291697Z                 }
2022-11-09T11:41:34.8292156Z             ],
2022-11-09T11:41:34.8292687Z             "target": "remote_device",
2022-11-09T11:41:34.8293254Z             "type": "cli"
2022-11-09T11:41:34.8293737Z         }
2022-11-09T11:41:34.8294355Z     ]
2022-11-09T11:41:34.8294889Z }

The above input is getting added as Script in Fortimanager successfully using the below Ansible role script.

- set_fact:
    dvmdb_scripts: []

- set_fact:
    dvmdb_scripts: "{{ dvmdb_scripts + [{
        'content': lookup('template', ha_config_template_path),
        'target': 'remote_device',
        'desc': 'Created by Ansible',
        'type': 'cli',
        'name': item.fgt_name + '_' + item.fgt_sn + '_HA',
        'adom': item.config.fmgr_adom,
        'filter_device': item.fgt_name,
        'scope': [{'name': item.fgt_name, 'vdom': item.config.fgt_vdom}]
        }] }}"
  loop: "{{ non_compliant_ha | list}}"

- debug: var=dvmdb_scripts

- name: Add dvmdb script
  fortinet.fortimanager.fmgr_dvmdb_script:
    adom: '{{ item.adom }}'
    workspace_locking_adom: '{{ item.adom }}'
    workspace_locking_timeout: 60
    proposed_method: add
    state: present
    rc_succeeded:
      - 0
      - -2 # already exists
    dvmdb_script:
        name: '{{ item.name }}'
        content: '{{ item.content }}'
        desc: '{{ item.desc }}'
        target: '{{ item.target }}'
        type: "{{ item.type }}"
  loop: "{{ dvmdb_scripts }}"

- pause:
    seconds: 60

The below dvmdb execution script is not working... I tried by adding workspace lock. No luck.

- name: Exec dvmdb script
  fortinet.fortimanager.fmgr_generic:
    method: exec
    rc_succeeded:
      - 0
      - -2 # already exists
    params:
      - url: '/dvmdb/adom/{{ item.adom }}/script/execute'
        data:
          script: '{{ item.name }}'
          adom: "{{ item.adom }}"
          scope: "{{ item.scope }}"
  register: running_task
  loop: "{{ dvmdb_scripts }}"

- name: Inspect the Task Status
  fortinet.fortimanager.fmgr_fact:
    facts:
        selector: 'task_task'
        params:
            task: '{{running_task.meta.response_data.task}}'
  register: taskinfo
  until: taskinfo.meta.response_data.percent == 100
  retries: 30
  delay: 3
  failed_when: taskinfo.meta.response_data.state == 'error'
James Z
  • 12,209
  • 10
  • 24
  • 44

0 Answers0