admin http session remains open

[ric293]

Using the fortios_monitor_fact and fortios_system_global modules without using api token based authentication creates an admin http session on the fortigate device. This is not removed when the playbook is finished.

Using an api token in the ansible task calling fortios_system_global does not result in a admin http session remaining after the playbook is finished.

Not using api token when using fortios_monitor_fact and then using api token for fortios_system_global within the same playbook results in two admin http sessions remaining after the playbook is finished. I didn't want to use api token when using fortios_monitor_fact because I wanted to do a config backup which needs admin account for a full backup.

I'm not specifying any api token in the ansible inventory, only in the ansible task.

Galaxy collection: fortinet.fortios 2.2.3 Ansible core: 2.14.5 Python: 3.9.13 FortiGate-VM64-KVM v7.0.5,build0304,220208 (GA), using evaluation license

Using 'get system info admin status' on the fortigate cli to check for sessions.

Inventory

---
all:
  hosts:
    fortigate:
      ansible_host: <ip address>
      ansible_user: admin
      ansible_password: <some password>
      ansible_connection: httpapi
      ansible_httpapi_port: 80
      ansible_httpapi_use_ssl: no
      ansible_httpapi_validate_certs: no
      ansible_network_os: "fortinet.fortios.fortios"
      ansible_host_key_checking: false

Playbook

---
- name: Fortigate playbook
  hosts: fortigate
  gather_facts: false
  tasks:
    - name: Get system config backup
      fortinet.fortios.fortios_monitor_fact:
        params:
          scope: 'global'
        selector: 'system_config_backup'
        vdom: 'root'
      register: backup

    - name: Configure system global
      fortinet.fortios.fortios_system_global:
        access_token: '{{ access_token | default(omit) }}'
        system_global:
          admin_login_max: 15

[MaxxLiu22]

Hi @ric293 ,

Thank you for raising this issue, I can reproduce it and have reported it to the development team, will let you know once it is fixed, Sorry for any inconvenience.

Thanks, Maxx

[JieX19]

Hi @ric293,

I just tested the sessions on my env and found the sessions are closed when the task is done. The two sessions you mentioned (http and console) are build when you log into your fortigate and type in the command on the CLI. These are not caused by any ansible tasks.

Thanks, Jie

[ric293]

I'm not sure if JieX19 is correct about the two sessions. If I deploy fortigate vm and open console connection, login as admin, and do get system info admin status, it shows only one logged in user which is admin on console.

If I open the web interface to the fortigate vm and login as admin, then as expected, there are two logged in users, one admin on console, and the other admin on http.

But it doesn't seem correct that if I run fortigate ansible module that it should leave an additonal admin http logged in user session. May be JieX19 is using later version of the fortinet.fortios collection than me and it doesn't have this problem.

I've re-tested on a later version of the fortinet.fortios galaxy collection and the problem still exists.

Galaxy collection: fortinet.fortios 2.3.1 Ansible core: 2.15.3 Python: 3.9.16 FortiGate-VM64-KVM v7.0.5,build0304,220208 (GA), using evaluation license

I'm using the same inventory as in the original description at the top above.

Playbook:

---
- name: This is a playbook for managing fortigate
  hosts: all
  gather_facts: false

  tasks:
    - name: Configure global attributes.
      fortinet.fortios.fortios_system_global:
        system_global:
            alias: my_new_alias

Steps taken:

1. Deploy new fortigate vm.
2. Use console connection to setup network interface connection and enable ssh.
3. In console run get system info admin status. This shows only one logged in admin user which is type 'console'.
4. Run the above playbook.
5. In console run 'get system info admin status'. This now shows two logged in admin users, one console and the other http.
6. Change the 'alias' value in the above playbook so it is 'my_new_alias_2'.
7. Run the playbook.
8. There are now three logged in admin users, one console, and two http.

[JieX19]

Hi @ric293

Thank you for your detailed info! I will look into the case again and get back to you later.

[JieX19]

Hi @ric293

The issue has been fixed in the collection, please try it again. I will close this issue at this moment, marking it as resolved or completed. If you have any further questions or concerns, please feel free to reopen the ticket or create a new one.