Claude 1

sophos-xgs-ansible/roles/sophos_firewall_rules/defaults/main.yml

@@ -0,0 +1,4 @@
+---
+# Default firewall rule action
+sophos_default_rule_action: "deny"
+sophos_default_rule_log: true

sophos-xgs-ansible/roles/sophos_firewall_rules/tasks/main.yml

@@ -0,0 +1,61 @@
+---
+# ============================================================================
+# Sophos Firewall Rules Role - Main Tasks
+# ============================================================================
+
+- name: Display firewall rules configuration overview
+  ansible.builtin.debug:
+    msg:
+      - "======================================"
+      - "Configuring Firewall Rules"
+      - "======================================"
+      - "Firewall: {{ inventory_hostname }}"
+      - "Common Rules: {{ sophos_common_firewall_rules | default([]) | length }}"
+      - "Custom Rules: {{ sophos_firewall_rules | default([]) | length }}"
+  tags: ['always']
+
+- name: Get current firewall rules from firewall
+  ansible.builtin.uri:
+    url: "https://{{ sophos_mgmt_host }}:{{ sophos_mgmt_port }}/webconsole/APIController?reqxml=<Request><Login><Username>{{ sophos_api_username }}</Username><Password>{{ sophos_api_password }}</Password></Login><Get><FirewallRule/></Get></Request>"
+    method: POST
+    validate_certs: "{{ sophos_validate_certs }}"
+    headers:
+      Content-Type: "application/x-www-form-urlencoded"
+    return_content: true
+    status_code: [200]
+  register: current_firewall_rules
+  no_log: "{{ sophos_no_log_sensitive }}"
+  tags: ['rules']
+
+- name: Parse current firewall rule names
+  ansible.builtin.set_fact:
+    existing_firewall_rules: "{{ current_firewall_rules.content | regex_findall('<Name>(.*?)</Name>') }}"
+  tags: ['rules']
+
+- name: Combine common and custom firewall rules
+  ansible.builtin.set_fact:
+    all_firewall_rules: "{{ sophos_common_firewall_rules | default([]) + sophos_firewall_rules | default([]) }}"
+  tags: ['rules']
+
+- name: Configure firewall rule {{ item.name }}
+  ansible.builtin.uri:
+    url: "https://{{ sophos_mgmt_host }}:{{ sophos_mgmt_port }}/webconsole/APIController"
+    method: POST
+    validate_certs: "{{ sophos_validate_certs }}"
+    headers:
+      Content-Type: "application/x-www-form-urlencoded"
+    body: "reqxml={{ lookup('template', 'firewall_rule.json.j2') | urlencode }}"
+    status_code: [200, 201]
+    timeout: "{{ sophos_api_timeout }}"
+  loop: "{{ all_firewall_rules }}"
+  loop_control:
+    label: "{{ item.name }}"
+  register: fw_rule_result
+  no_log: "{{ sophos_no_log_sensitive }}"
+  changed_when: "'successful' in fw_rule_result.content | lower"
+  tags: ['rules']
+
+- name: Firewall rules configuration completed
+  ansible.builtin.debug:
+    msg: "Configured {{ all_firewall_rules | length }} firewall rules successfully"
+  tags: ['always']

sophos-xgs-ansible/roles/sophos_firewall_rules/templates/firewall_rule.json.j2

@@ -0,0 +1,43 @@
+<Request>
+  <Login>
+    <Username>{{ sophos_api_username }}</Username>
+    <Password>{{ sophos_api_password }}</Password>
+  </Login>
+  <Set operation="{% if item.name in existing_firewall_rules %}update{% else %}add{% endif %}">
+    <FirewallRule>
+      <Name>{{ item.name }}</Name>
+      <Description>{{ item.description | default('') }}</Description>
+      <Status>{{ 'Enable' if item.enabled | default(true) else 'Disable' }}</Status>
+      <Action>{{ item.action | upper }}</Action>
+      <LogTraffic>{{ 'Enable' if item.log | default(false) else 'Disable' }}</LogTraffic>
+      <SourceZones>
+        {% for zone in item.source_zones %}
+        <Zone>{{ zone }}</Zone>
+        {% endfor %}
+      </SourceZones>
+      <DestinationZones>
+        {% for zone in item.dest_zones %}
+        <Zone>{{ zone }}</Zone>
+        {% endfor %}
+      </DestinationZones>
+      <SourceNetworks>
+        {% for network in item.source_networks %}
+        <Network>{{ network }}</Network>
+        {% endfor %}
+      </SourceNetworks>
+      <DestinationNetworks>
+        {% for network in item.dest_networks %}
+        <Network>{{ network }}</Network>
+        {% endfor %}
+      </DestinationNetworks>
+      <Services>
+        {% for service in item.services %}
+        <Service>{{ service }}</Service>
+        {% endfor %}
+      </Services>
+      {% if item.position is defined %}
+      <Position>{{ item.position }}</Position>
+      {% endif %}
+    </FirewallRule>
+  </Set>
+</Request>