Claude 1

sophos-xgs-ansible/roles/sophos_device_access/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+# Default device access settings
+sophos_default_device_access_enabled: true

sophos-xgs-ansible/roles/sophos_device_access/tasks/main.yml

@@ -0,0 +1,35 @@
+---
+# ============================================================================
+# Sophos Device Access Role - Main Tasks
+# ============================================================================
+
+- name: Display device access configuration overview
+  ansible.builtin.debug:
+    msg:
+      - "======================================"
+      - "Configuring Device Access Policies"
+      - "======================================"
+      - "Firewall: {{ inventory_hostname }}"
+      - "Policies: {{ sophos_common_device_access_policies | default([]) | length }}"
+  tags: ['always']
+
+- name: Configure device access policies
+  ansible.builtin.uri:
+    url: "https://{{ sophos_mgmt_host }}:{{ sophos_mgmt_port }}/webconsole/APIController"
+    method: POST
+    validate_certs: "{{ sophos_validate_certs }}"
+    headers:
+      Content-Type: "application/x-www-form-urlencoded"
+    body: "reqxml={{ lookup('template', 'device_access_rule.json.j2') | urlencode }}"
+    status_code: [200, 201]
+    timeout: "{{ sophos_api_timeout }}"
+  loop: "{{ sophos_common_device_access_policies | default([]) }}"
+  loop_control:
+    label: "{{ item.service }}"
+  no_log: "{{ sophos_no_log_sensitive }}"
+  tags: ['device-access']
+
+- name: Device access configuration completed
+  ansible.builtin.debug:
+    msg: "Device access policies configured successfully"
+  tags: ['always']

sophos-xgs-ansible/roles/sophos_device_access/templates/device_access_rule.json.j2

@@ -0,0 +1,24 @@
+<Request>
+  <Login>
+    <Username>{{ sophos_api_username }}</Username>
+    <Password>{{ sophos_api_password }}</Password>
+  </Login>
+  <Set operation="update">
+    <DeviceAccess>
+      <Service>{{ item.service | upper }}</Service>
+      <Status>{{ 'Enable' if item.enabled | default(true) else 'Disable' }}</Status>
+      <AllowedZones>
+        {% for zone in item.allowed_zones %}
+        <Zone>{{ zone }}</Zone>
+        {% endfor %}
+      </AllowedZones>
+      {% if item.allowed_networks is defined and item.allowed_networks | length > 0 %}
+      <AllowedNetworks>
+        {% for network in item.allowed_networks %}
+        <Network>{{ network }}</Network>
+        {% endfor %}
+      </AllowedNetworks>
+      {% endif %}
+    </DeviceAccess>
+  </Set>
+</Request>