addIdentityRule

The addIdentityRule operation handles configuration related to IdentityRule model. 

Description

This API call is not allowed on the standby unit in an HA pair.

Data Parameters

Parameter Required Type Description
name True string A UTF string containing the name for the identity rule. The string can be up to 120 characters.
sourceZones False [object] An optional list of security zones object containing interfaces to match through which the traffic is entering the device.
Allowed types are: [SecurityZone, TunnelZone]
destinationZones False [object] An optional list of security zones objects containing interfaces to match through which the traffic is leaving the device from.
Allowed types are: [SecurityZone, TunnelZone]
sourceNetworks False [object] An optional list of network objects or geographical locations that defines the network addresses or location to match through which the traffic is entering the device.
Allowed types are: [Continent, Country, GeoLocation, NetworkObject, NetworkObjectGroup]
destinationNetworks False [object] An optional list of network objects or geographical locations that defines the network addresses or locations to match through which the traffic is leaving the device from.
Allowed types are: [Continent, Country, GeoLocation, NetworkObject, NetworkObjectGroup]
sourcePorts False [object] An optional list of port objects that defines the protocols used to match through which the traffic is entering the device.
Allowed types are: [ICMPv4PortObject, ICMPv6PortObject, PortObjectGroup, ProtocolObject, TCPPortObject, UDPPortObject]
destinationPorts False [object] An optional list of port objects that defines the protocols used to match through which the traffic is leaving the device from.
Allowed types are: [ICMPv4PortObject, ICMPv6PortObject, PortObjectGroup, ProtocolObject, TCPPortObject, UDPPortObject]
realm False object A directory realm and server that contains the user accounts for the network, or a Realm Sequence object that contains an ordered list of realms.
Allowed types are: [ActiveDirectoryRealm, LDAPRealm, RealmSequence, SpecialRealm]
guestAccessFallback False boolean A Boolean value, TRUE or FALSE. The TRUE value indicates to mark the users who fail authentication as Guest users. FALSE indicates the users failing authentication will be marked as Failed Authentication.
authType False string An enum value that specifies active authentication method (type) supported by the directory server.
Values can be one of the following.
HTTP Basic - Authenticate users using an unencrypted HTTP Basic Authentication (BA) connection. This is the default. Users log in to the network using their browser's default authentication popup window.
NTLM - Authenticate users using an NT LAN Manager (NTLM) connection. This setting is available only with AD realm. Users log in to the network using their browser's default authentication popup window, although you can configure IE and Firefox browsers to transparently authenticate using their Windows domain login.
HTTP Negotiate - Allow the device to negotiate the method between the user agent (the application the user is using to initiate the traffic flow) and the Active Directory server. Negotiation results in the strongest commonly supported method being used, in order, NTLM, then basic. Users log in to the network using their browser's default authentication popup window.
HTTP Response Page - Prompt users to authenticate using a system-provided web page. This is a form of HTTP Basic authentication.
action True string An enum value that specifies authentication action for directory servers.
Values can be one of the following.
ACTIVE - Use active authenticate to determine user identity and is applied to HTTP traffic only.
PASSIVE - Use passive authentication to determine user identity.
NO_AUTH - Do not obtain user identity. Identity-based access rules will not be applied to this traffic. These users are marked as No Authentication Required.
Field level constraints: cannot be null. (Note: Additional constraints might exist)
enabled False boolean A Boolean value, TRUE (the default) or FALSE. The TRUE value indicates that the rule is active. FALSE indicates the rule is not active and in use.
rulePosition False integer Transient field holding the index position for the rule
type True string A UTF8 string, all letters lower-case, that represents the class-type. This corresponds to the class name.

Path Parameters

Parameter Required Type Description
parentId True string

Query Parameters

Parameter Required Type Description
at False integer An integer representing where to add the new object in the ordered list. Use 0 to add it at the beginning of the list. If not specified, it will be added at the end of the list

Example

- name: Execute 'addIdentityRule' operation
  ftd_configuration:
    operation: "addIdentityRule"
    data:
        name: "{{ name }}"
        sourceZones: "{{ source_zones }}"
        destinationZones: "{{ destination_zones }}"
        sourceNetworks: "{{ source_networks }}"
        destinationNetworks: "{{ destination_networks }}"
        sourcePorts: "{{ source_ports }}"
        destinationPorts: "{{ destination_ports }}"
        realm: "{{ realm }}"
        guestAccessFallback: "{{ guest_access_fallback }}"
        authType: "{{ auth_type }}"
        action: "{{ action }}"
        enabled: "{{ enabled }}"
        rulePosition: "{{ rule_position }}"
        type: "{{ type }}"
    path_params:
        parentId: "{{ parent_id }}"
    query_params:
        at: "{{ at }}"