Claude 1

sophos-xgs-ansible/roles/sophos_snmp_logging/defaults/main.yml

@@ -0,0 +1,4 @@
+---
+# Default SNMP and logging settings
+sophos_default_snmp_enabled: false
+sophos_default_logging_enabled: true

sophos-xgs-ansible/roles/sophos_snmp_logging/tasks/main.yml

@@ -0,0 +1,68 @@
+---
+# ============================================================================
+# Sophos SNMP and Logging Role - Main Tasks
+# ============================================================================
+
+- name: Display SNMP and logging configuration overview
+  ansible.builtin.debug:
+    msg:
+      - "======================================"
+      - "Configuring SNMP and Logging"
+      - "======================================"
+      - "Firewall: {{ inventory_hostname }}"
+      - "SNMP Enabled: {{ sophos_snmp.enabled | default(false) }}"
+      - "Syslog Servers: {{ sophos_logging.syslog_servers | default([]) | length }}"
+  tags: ['always']
+
+# Configure SNMP
+- name: Configure SNMP settings
+  ansible.builtin.uri:
+    url: "https://{{ sophos_mgmt_host }}:{{ sophos_mgmt_port }}/webconsole/APIController"
+    method: POST
+    validate_certs: "{{ sophos_validate_certs }}"
+    headers:
+      Content-Type: "application/x-www-form-urlencoded"
+    body: "reqxml={{ lookup('template', 'snmp_config.json.j2') | urlencode }}"
+    status_code: [200, 201]
+    timeout: "{{ sophos_api_timeout }}"
+  when: sophos_snmp is defined
+  no_log: "{{ sophos_no_log_sensitive }}"
+  tags: ['snmp']
+
+# Configure Syslog
+- name: Configure syslog servers
+  ansible.builtin.uri:
+    url: "https://{{ sophos_mgmt_host }}:{{ sophos_mgmt_port }}/webconsole/APIController"
+    method: POST
+    validate_certs: "{{ sophos_validate_certs }}"
+    headers:
+      Content-Type: "application/x-www-form-urlencoded"
+    body: "reqxml={{ lookup('template', 'syslog_server.json.j2') | urlencode }}"
+    status_code: [200, 201]
+    timeout: "{{ sophos_api_timeout }}"
+  loop: "{{ sophos_logging.syslog_servers | default([]) }}"
+  loop_control:
+    label: "{{ item.host }}"
+  when: sophos_logging is defined
+  no_log: "{{ sophos_no_log_sensitive }}"
+  tags: ['logging', 'syslog']
+
+# Configure NTP
+- name: Configure NTP settings
+  ansible.builtin.uri:
+    url: "https://{{ sophos_mgmt_host }}:{{ sophos_mgmt_port }}/webconsole/APIController"
+    method: POST
+    validate_certs: "{{ sophos_validate_certs }}"
+    headers:
+      Content-Type: "application/x-www-form-urlencoded"
+    body: "reqxml={{ lookup('template', 'ntp_config.json.j2') | urlencode }}"
+    status_code: [200, 201]
+    timeout: "{{ sophos_api_timeout }}"
+  when: sophos_ntp is defined
+  no_log: "{{ sophos_no_log_sensitive }}"
+  tags: ['ntp']
+
+- name: SNMP and logging configuration completed
+  ansible.builtin.debug:
+    msg: "SNMP, logging, and NTP configured successfully"
+  tags: ['always']

sophos-xgs-ansible/roles/sophos_snmp_logging/templates/ntp_config.json.j2

@@ -0,0 +1,16 @@
+<Request>
+  <Login>
+    <Username>{{ sophos_api_username }}</Username>
+    <Password>{{ sophos_api_password }}</Password>
+  </Login>
+  <Set operation="update">
+    <NTP>
+      <Servers>
+        {% for server in sophos_ntp.servers %}
+        <Server>{{ server }}</Server>
+        {% endfor %}
+      </Servers>
+      <Timezone>{{ sophos_ntp.timezone | default('UTC') }}</Timezone>
+    </NTP>
+  </Set>
+</Request>

sophos-xgs-ansible/roles/sophos_snmp_logging/templates/snmp_config.json.j2

@@ -0,0 +1,35 @@
+<Request>
+  <Login>
+    <Username>{{ sophos_api_username }}</Username>
+    <Password>{{ sophos_api_password }}</Password>
+  </Login>
+  <Set operation="update">
+    <SNMP>
+      <Status>{{ 'Enable' if sophos_snmp.enabled | default(false) else 'Disable' }}</Status>
+      <Version>{{ sophos_snmp.version | default('v2c') }}</Version>
+      {% if sophos_snmp.version | default('v2c') == 'v2c' %}
+      <Community>{{ sophos_snmp.community }}</Community>
+      {% endif %}
+      <Location>{{ sophos_snmp.location | default('') }}</Location>
+      <Contact>{{ sophos_snmp.contact | default('') }}</Contact>
+      {% if sophos_snmp.allowed_networks is defined %}
+      <AllowedNetworks>
+        {% for network in sophos_snmp.allowed_networks %}
+        <Network>{{ network }}</Network>
+        {% endfor %}
+      </AllowedNetworks>
+      {% endif %}
+      {% if sophos_snmp.trap_destinations is defined %}
+      <TrapDestinations>
+        {% for trap in sophos_snmp.trap_destinations %}
+        <Destination>
+          <Host>{{ trap.host }}</Host>
+          <Port>{{ trap.port | default(162) }}</Port>
+          <Community>{{ trap.community }}</Community>
+        </Destination>
+        {% endfor %}
+      </TrapDestinations>
+      {% endif %}
+    </SNMP>
+  </Set>
+</Request>

sophos-xgs-ansible/roles/sophos_snmp_logging/templates/syslog_server.json.j2

@@ -0,0 +1,15 @@
+<Request>
+  <Login>
+    <Username>{{ sophos_api_username }}</Username>
+    <Password>{{ sophos_api_password }}</Password>
+  </Login>
+  <Set operation="add">
+    <SyslogServer>
+      <Host>{{ item.host }}</Host>
+      <Port>{{ item.port | default(514) }}</Port>
+      <Protocol>{{ item.protocol | default('udp') | upper }}</Protocol>
+      <Facility>{{ item.facility | default('local0') }}</Facility>
+      <Severity>{{ item.severity | default('informational') }}</Severity>
+    </SyslogServer>
+  </Set>
+</Request>