62 lines
2.5 KiB
YAML
62 lines
2.5 KiB
YAML
---
|
|
# ============================================================================
|
|
# Sophos Firewall Rules Role - Main Tasks
|
|
# ============================================================================
|
|
|
|
- name: Display firewall rules configuration overview
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "======================================"
|
|
- "Configuring Firewall Rules"
|
|
- "======================================"
|
|
- "Firewall: {{ inventory_hostname }}"
|
|
- "Common Rules: {{ sophos_common_firewall_rules | default([]) | length }}"
|
|
- "Custom Rules: {{ sophos_firewall_rules | default([]) | length }}"
|
|
tags: ['always']
|
|
|
|
- name: Get current firewall rules from firewall
|
|
ansible.builtin.uri:
|
|
url: "https://{{ sophos_mgmt_host }}:{{ sophos_mgmt_port }}/webconsole/APIController?reqxml=<Request><Login><Username>{{ sophos_api_username }}</Username><Password>{{ sophos_api_password }}</Password></Login><Get><FirewallRule/></Get></Request>"
|
|
method: POST
|
|
validate_certs: "{{ sophos_validate_certs }}"
|
|
headers:
|
|
Content-Type: "application/x-www-form-urlencoded"
|
|
return_content: true
|
|
status_code: [200]
|
|
register: current_firewall_rules
|
|
no_log: "{{ sophos_no_log_sensitive }}"
|
|
tags: ['rules']
|
|
|
|
- name: Parse current firewall rule names
|
|
ansible.builtin.set_fact:
|
|
existing_firewall_rules: "{{ current_firewall_rules.content | regex_findall('<Name>(.*?)</Name>') }}"
|
|
tags: ['rules']
|
|
|
|
- name: Combine common and custom firewall rules
|
|
ansible.builtin.set_fact:
|
|
all_firewall_rules: "{{ sophos_common_firewall_rules | default([]) + sophos_firewall_rules | default([]) }}"
|
|
tags: ['rules']
|
|
|
|
- name: Configure firewall rule {{ item.name }}
|
|
ansible.builtin.uri:
|
|
url: "https://{{ sophos_mgmt_host }}:{{ sophos_mgmt_port }}/webconsole/APIController"
|
|
method: POST
|
|
validate_certs: "{{ sophos_validate_certs }}"
|
|
headers:
|
|
Content-Type: "application/x-www-form-urlencoded"
|
|
body: "reqxml={{ lookup('template', 'firewall_rule.json.j2') | urlencode }}"
|
|
status_code: [200, 201]
|
|
timeout: "{{ sophos_api_timeout }}"
|
|
loop: "{{ all_firewall_rules }}"
|
|
loop_control:
|
|
label: "{{ item.name }}"
|
|
register: fw_rule_result
|
|
no_log: "{{ sophos_no_log_sensitive }}"
|
|
changed_when: "'successful' in fw_rule_result.content | lower"
|
|
tags: ['rules']
|
|
|
|
- name: Firewall rules configuration completed
|
|
ansible.builtin.debug:
|
|
msg: "Configured {{ all_firewall_rules | length }} firewall rules successfully"
|
|
tags: ['always']
|