- Passes var spreadsheet_path which tells the role where to look for the import data.
- Generates FortiGate YAML files under {{ role_path }}/vars/fortigates/
- Uses Python script at {{ role_path}}/files/python/consume_branch_spreadsheet.py to parse the spreadsheet to YAML files.
- Python script also does the conversion from the Organizational Workflow Data Model (spreadsheet) to the Ansible ZTP Role Data Model (FortiGate YAML files).
- Converges Ansible ZTP Role Defaults with the FortiGate YAML files under {{ role_path }}/vars/fortigates/
- Uses Jinja2 template {{ role_path }}/templates/fortigates/spreadsheet_fgt_merge.j2
- Reads rendered FortiGates.
- Validates rendered FortiGates using Python Schema
- Python Schema @ {{ role_path }}/files/python/ansible_ztp_role_data_model/fortigate_schema.py
- Reads rendered FortiGates.
- For each FortiGate it renders each of the Jinja2 templates @ {{ role_path }}/templates/dvmdb_scripts/
- Each rendered script is stored in memory until all of them are rendered.
- After all rendering is done the scripts are stored as a list of dictionaries, converted to YAML, and written @ {{ role_path }}/files/tmp/dvmdb_scripts/rendered_dvmdb_scripts.yml.
- If you want to export these as actual files -- edit the task templates/render_dvmdb_scripts.yml
- Reads the rendered FortiGates.
- Used by many, many other playbooks on this list.
- Reads the rendered Policies as a flattened list of dictionaries.
- These dictionaries contain the policy, as well as the policy package name, if its global or adom, etc.
- This "flattened" list of dictionaries is the easist to process in Ansible
- Like 00.20_read-rendered-fortigates.yml this file is used often by other playbooks on this list.
- Reads the rendered FortiGates.
- Reads the Target ADOMs for FortiGates, and Global Policy Packages.
- Ensures the ADOMs actually exist.
- Will cause an error if ADOMs do not exist and will tell you what's wrong.
- Reads the rendered FortiGates.
- For each distinct Policy Package Name, it adds them to FortiManager if they don't already exist
- Reads the rendered FortiGates.
- For each distinct service object and service group, it adds them to FortiManager if they don't already exist
- Reads the rendered FortiGates.
- For each distinct address object and address group, it adds them to FortiManager if they don't already exist
- Reads the rendered FortiGates.
- For each distinct FortiGate device group, it adds them to FortiManager if they don't already exist
- Reads the rendered FortiGates.
- For each distinct security profile of any type (AV/AppControl/IPS/etc), if the name of that profile does not exist it will create it in FortiManager.
- We do not provide the means to define these security profiles specific details in this role. That is something that would have to be customized.
- It is recommended if you use security profiles in firewall policies, that the security profiles be pre-configured.
- Reads the rendered FortiGates.
- Adds the rendered FortiGates to the target FortiManager ADOM.
- Reads the rendered FortiGates.
- Adds the FortiGates to their specific device groups.
- Reads the rendered FortiGates.
- Reads the rendered DVMDB config scripts.
- Uploads the rendered DVMDB config scripts.
- Executes the rendered DVMDB config scripts -- keeps track of the FortiManager Task ID.
- Queries the FortiManager Task IDs until they are done.
- If all script executions were successful, the DVMDB config scripts are deleted.
- If not successful -- they are left on FortiManager for inspection.
- Reads the rendered FortiGates.
- Uses Jinja2 to render a list of "normalized interfaces" to assign in FortiManager.
- Adds any "normalized interfaces" that are not defined in FortiManager yet.
- Adds the "normalized interface dynamic mappings" that are generated via Jinja2 template.
- Reads the rendered FortiGates.
- Uses Jinja2 to render a list of SDWAN "normalized interfaces" to assign in FortiManager.
- Adds any SDWAN "normalized interfaces" that are not defined in FortiManager yet.
- Adds the SDWAN "normalized interface dynamic mappings" that are generated via Jinja2 template.
- Reads the rendered FortiGates.
- Adds Address Objects for WAN interfaces
- Adds address object dynamic mappings for WAN interfaces that are not DHCP.
- Reads the rendered FortiGates.
- Adds Address Objects for VLAN Interfaces
- Adds dynamic mappings from each FortiGate to Address Objects
- Reads the flattened list of firewall policies, from rendered FortiGates.
- For non-global policies it attempts to add them to the proper policy package.
- If a policy by the same name already exists it is skipped.
- Reads rendered FortiGates.
- Assigns ADOM Policy Packages to FortiGates.
- Reads rendered FortiGates.
- Assigns system templates ("Provisioning Templates" in GUI speak) to FortiGates.
- Reads rendered FortiGates.
- Tells FortiManager to commit all device setting changes to the FortiGates configuration.
- Reads rendered FortiGates.
- Tells FortiManager to commit all policy packages to the FortiGates configuration.
- Reads rendered FortiGates.
- Unassigns policy pacakges
- Reads rendered FortiGates.
- Unassigns system templates.
- Reads rendered FortiGates.
- Prints the rendered FortiGates to screen/terminal.
- Reads rendered FortiGates.
- Prints the ansible facts to screen/terminal.
- Reads rendered FortiGates.
- Gets all policy packages from the role-default ADOM in FortiManager -- referenced in the rendered FortiGates.
- Reads rendered FortiGates.
- Gets the policy
- Reads rendered FortiGates.
- Reads rendered DVMDB scripts.
- Uploads DVMDB scripts to FortiManager and leaves them there for inspection.
- Reads rendered FortiGates.
- Tests the Jinja2 template {{ role_path }}/templates/policy_packages/get_security_profiles.j2
- Prints output to screen.
- Reads rendered FortiGates.
- Deletes any DVMDB scripts from FortiManager that were added by the role.
- Reads rendered FortiGates.
- Deletes rendered FortiGates from target FortiManager.
- Deletes the contents of the folders:
- {{ role_path }}/files/tmp
- {{ role_path }}/vars/fortigates
Removes all imported FortiGates and deleting all rendered tmp files.
- Reads the rendered FortiGates.
- Attempts to delete the rendered FortiGates from the target FortiManager.
- Attempts to delete the rendered DVMDB scripts from the target Fortimanager.
- Runs the playbook 999.99_RESET-role-to-default.yml after deleting its content from the target Fortimanager.