Claude 1

sophos-xgs-ansible/roles/sophos_vpn_site_to_site/defaults/main.yml

@@ -0,0 +1,11 @@
+---
+# Default VPN encryption settings
+sophos_default_ike_encryption: "aes256"
+sophos_default_ike_hash: "sha256"
+sophos_default_ike_dh_group: 14
+sophos_default_ike_lifetime: 28800
+
+sophos_default_ipsec_encryption: "aes256"
+sophos_default_ipsec_hash: "sha256"
+sophos_default_ipsec_pfs_group: 14
+sophos_default_ipsec_lifetime: 3600

sophos-xgs-ansible/roles/sophos_vpn_site_to_site/tasks/main.yml

@@ -0,0 +1,66 @@
+---
+# ============================================================================
+# Sophos Site-to-Site VPN Role - Main Tasks
+# ============================================================================
+
+- name: Display site-to-site VPN configuration overview
+  ansible.builtin.debug:
+    msg:
+      - "======================================"
+      - "Configuring Site-to-Site VPN Tunnels"
+      - "======================================"
+      - "Firewall: {{ inventory_hostname }}"
+      - "Tunnels: {{ sophos_site_to_site_vpns | default([]) | length }}"
+  tags: ['always']
+  when: sophos_site_to_site_vpns is defined
+
+- name: Skip site-to-site VPN configuration (not defined)
+  ansible.builtin.debug:
+    msg: "No site-to-site VPN tunnels defined for {{ inventory_hostname }}"
+  when: sophos_site_to_site_vpns is not defined or sophos_site_to_site_vpns | length == 0
+  tags: ['always']
+
+- name: Get current IPsec connections from firewall
+  ansible.builtin.uri:
+    url: "https://{{ sophos_mgmt_host }}:{{ sophos_mgmt_port }}/webconsole/APIController?reqxml=<Request><Login><Username>{{ sophos_api_username }}</Username><Password>{{ sophos_api_password }}</Password></Login><Get><IPSecConnection/></Get></Request>"
+    method: POST
+    validate_certs: "{{ sophos_validate_certs }}"
+    headers:
+      Content-Type: "application/x-www-form-urlencoded"
+    return_content: true
+    status_code: [200]
+  register: current_ipsec_connections
+  no_log: "{{ sophos_no_log_sensitive }}"
+  when: sophos_site_to_site_vpns is defined and sophos_site_to_site_vpns | length > 0
+  tags: ['vpn', 'site-to-site']
+
+- name: Parse current IPsec connection names
+  ansible.builtin.set_fact:
+    existing_ipsec_connections: "{{ current_ipsec_connections.content | regex_findall('<Name>(.*?)</Name>') }}"
+  when: sophos_site_to_site_vpns is defined and sophos_site_to_site_vpns | length > 0
+  tags: ['vpn', 'site-to-site']
+
+- name: Configure site-to-site VPN tunnel {{ item.name }}
+  ansible.builtin.uri:
+    url: "https://{{ sophos_mgmt_host }}:{{ sophos_mgmt_port }}/webconsole/APIController"
+    method: POST
+    validate_certs: "{{ sophos_validate_certs }}"
+    headers:
+      Content-Type: "application/x-www-form-urlencoded"
+    body: "reqxml={{ lookup('template', 'ipsec_connection.json.j2') | urlencode }}"
+    status_code: [200, 201]
+    timeout: "{{ sophos_api_timeout }}"
+  loop: "{{ sophos_site_to_site_vpns }}"
+  loop_control:
+    label: "{{ item.name }} ({{ item.local_gateway }} <-> {{ item.remote_gateway }})"
+  register: vpn_result
+  no_log: "{{ sophos_no_log_sensitive }}"
+  when: sophos_site_to_site_vpns is defined and sophos_site_to_site_vpns | length > 0
+  changed_when: "'successful' in vpn_result.content | lower"
+  tags: ['vpn', 'site-to-site']
+
+- name: Site-to-site VPN configuration completed
+  ansible.builtin.debug:
+    msg: "Configured {{ sophos_site_to_site_vpns | length }} site-to-site VPN tunnels successfully"
+  when: sophos_site_to_site_vpns is defined and sophos_site_to_site_vpns | length > 0
+  tags: ['always']

sophos-xgs-ansible/roles/sophos_vpn_site_to_site/templates/ipsec_connection.json.j2

@@ -0,0 +1,58 @@
+<Request>
+  <Login>
+    <Username>{{ sophos_api_username }}</Username>
+    <Password>{{ sophos_api_password }}</Password>
+  </Login>
+  <Set operation="{% if item.name in existing_ipsec_connections | default([]) %}update{% else %}add{% endif %}">
+    <IPSecConnection>
+      <Name>{{ item.name }}</Name>
+      <Description>{{ item.description | default('') }}</Description>
+      <Status>{{ 'Enable' if item.enabled | default(true) else 'Disable' }}</Status>
+      <ConnectionType>{{ item.connection_type | default('tunnel') }}</ConnectionType>
+
+      <!-- Local Settings -->
+      <LocalGateway>{{ item.local_gateway }}</LocalGateway>
+      <LocalID>{{ item.local_id | default(item.local_gateway) }}</LocalID>
+      <LocalNetworks>
+        {% for network in item.local_networks %}
+        <Network>{{ network }}</Network>
+        {% endfor %}
+      </LocalNetworks>
+
+      <!-- Remote Settings -->
+      <RemoteGateway>{{ item.remote_gateway }}</RemoteGateway>
+      <RemoteID>{{ item.remote_id | default(item.remote_gateway) }}</RemoteID>
+      <RemoteNetworks>
+        {% for network in item.remote_networks %}
+        <Network>{{ network }}</Network>
+        {% endfor %}
+      </RemoteNetworks>
+
+      <!-- Phase 1 (IKE) Settings -->
+      <IKEVersion>{{ item.ike_version | default(2) }}</IKEVersion>
+      <IKEEncryption>{{ item.ike_encryption | default(sophos_default_ike_encryption) }}</IKEEncryption>
+      <IKEHash>{{ item.ike_hash | default(sophos_default_ike_hash) }}</IKEHash>
+      <IKEDHGroup>{{ item.ike_dh_group | default(sophos_default_ike_dh_group) }}</IKEDHGroup>
+      <IKELifetime>{{ item.ike_lifetime | default(sophos_default_ike_lifetime) }}</IKELifetime>
+
+      <!-- Authentication -->
+      <AuthenticationMethod>{{ item.authentication_method | default('psk') }}</AuthenticationMethod>
+      {% if item.authentication_method | default('psk') == 'psk' %}
+      <PreSharedKey>{{ item.psk }}</PreSharedKey>
+      {% endif %}
+
+      <!-- Phase 2 (IPsec) Settings -->
+      <IPSecMode>{{ item.ipsec_mode | default('tunnel') }}</IPSecMode>
+      <IPSecEncryption>{{ item.ipsec_encryption | default(sophos_default_ipsec_encryption) }}</IPSecEncryption>
+      <IPSecHash>{{ item.ipsec_hash | default(sophos_default_ipsec_hash) }}</IPSecHash>
+      <IPSecPFSGroup>{{ item.ipsec_pfs_group | default(sophos_default_ipsec_pfs_group) }}</IPSecPFSGroup>
+      <IPSecLifetime>{{ item.ipsec_lifetime | default(sophos_default_ipsec_lifetime) }}</IPSecLifetime>
+
+      <!-- Advanced Settings -->
+      <DPDEnabled>{{ 'Enable' if item.dpd_enabled | default(true) else 'Disable' }}</DPDEnabled>
+      <DPDInterval>{{ item.dpd_interval | default(30) }}</DPDInterval>
+      <DPDRetries>{{ item.dpd_retries | default(3) }}</DPDRetries>
+      <NATTraversal>{{ 'Enable' if item.nat_traversal | default(true) else 'Disable' }}</NATTraversal>
+    </IPSecConnection>
+  </Set>
+</Request>