Closed vingertop closed 1 year ago
Hi @vingertop ,
Thank you for raising this question, for editing an entry under an object, we usually use member operation by setting "member_path" and "member_state" arguments in script, otherwise Ansible will replace all config with a latest config, and member operation can only be used on a existing object, my suggestion is run your script with "state: present" to create objects, then uncomment "member_path" and "member_state" to create entries like the example below. If you still have questions, feel free to let me know.
- hosts: fortigates
collections:
- fortinet.fortios
connection: httpapi
vars:
entries:
- { hostname: "EntryList-Host1-Zone1", ip: "1.1.1.6", zone: "zone1", entry_id: 1}
- { hostname: "EntryList-Host2-Zone1", ip: "1.1.1.7", zone: "zone1", entry_id: 2}
- { hostname: "EntryList-Host1-Zone2", ip: "1.1.1.8", zone: "zone2", entry_id: 3}
- { hostname: "EntryList-Host2-Zone2", ip: "1.1.1.9", zone: "zone2", entry_id: 4}
vdom: root
ansible_httpapi_use_ssl: true
ansible_httpapi_validate_certs: false
ansible_httpapi_port: 443
tasks:
- name: Configure DNS databases.
fortios_system_dns_database:
vdom: '{{ vdom }}'
state: present
#member_path : dns_entry:id # uncomment when you have created that object
#member_state : present # uncomment when you have created that object
access_token: 6Hjrf1GHzNsw837wdwnxNNwN0b8f8t
system_dns_database:
authoritative: "enable"
contact: "contactme"
domain: "{{item.zone}}"
name: "{{item.zone}}"
primary_name: "{{item.zone}}"
status: "enable"
ttl: "86400"
type: "primary"
view: "shadow"
rr_max: "16384"
dns_entry:
-
hostname: "{{item.hostname}}"
id: "{{item. entry_id}}"
ip: "{{item.ip}}"
preference: "10"
status: "enable"
ttl: "0"
type: "A"
loop: "{{ entries|list }}"
Thanks, Maxx
Thank you Maxx for clearing that up. I split it up in 2 tasks and this works nice.
tasks:
- name: Configure DNS databases zones.
fortios_system_dns_database:
state: "present"
access_token: "{{ fortios_access_token }}"
system_dns_database:
authoritative: "enable"
contact: "contactme"
domain: "{{ item }}"
name: "{{ item }}"
primary_name: "{{ item }}"
status: "enable"
ttl: "86400"
type: "primary"
view: "shadow"
rr_max: "16384"
loop: "{{ entries | map(attribute='zone') | unique }}"
- name: Configure DNS databases entries.
fortios_system_dns_database:
state: "present"
member_path: dns_entry:id
member_state: present
access_token: "{{ fortios_access_token }}"
system_dns_database:
name: "{{item.zone}}"
dns_entry:
-
hostname: "{{item.hostname}}"
id: "{{item.entry_id}}"
ip: "{{item.ip}}"
preference: "10"
status: "enable"
ttl: "0"
type: "A"
loop: "{{ entries | list }}"
I created a playbook with the idea to bulk add DNS entries on the fortigate based on entries in a vars file:
The dns-fortigate-entries.yml:
As for adding zones to the FortiGate DNS server this works ok in the loop:
The task recap gives the impression all records are processed:
But the DNS host entries for each zone do not work in the loop. The last entry in the loop overwrites and is the only one present after the play:
When I run a CLI debug on the FortiGate CLI I noticed it is deleting the first entry during the play:
I run these versions:
Is this a by-design choice where and am I simply not understanding why it cannot iterate over de dns entries ? Any clues on how to quick fix this for my use case ?