Collection 2.3.4 incompatibility with FortiOS 7.0.13

[jantari]

Hello,

haven't had to open an issue in a while - thanks a lot for the fanstastic work on this collection and the help in the past, I love it!

I have noticed after updating the ansible collection from 2.3.2 to 2.3.4 I have a compatibility issue in fortios_vpn_ipsec_phase1_interface with FortiOS 7.0.13 (probably other versions too like 7.2.x etc.)

I set the monitor setting on some phase1-interfaces, with the FortiOS collection v2.3.2 it worked like this:

- name: IPSec VPN Phase 1
  fortios_vpn_ipsec_phase1_interface:
    vdom: "{{ vdom }}"
    access_token: "{{ fortios_access_token | default(omit) }}"
    state: present
    vpn_ipsec_phase1_interface:
      name: 'VPN-wan2'
      interface: wan2
      keylife: 28800
      peertype: peergrp
      peergrp: vpn-peer <VERY_SECRET> Certs
      net_device: disable
      ike_version: '2'
      dhgrp:
        - 21
      proposal:
        - aes256-sha256
      auto_negotiate: enable
      comments: Internal Site-to-Site VPN to <VERY_SECRET>
      remote_gw: # <REDACTED PUBLIC IP>
      tunnel_search: nexthop
      exchange_interface_ip: disable
      authmethod: signature
      monitor: 'VPN-wan1'
      certificate:
        - name: '{{ location_short_name }} VPN Spoke'

but with FortiOS collection 2.3.4 this throws the error:

msg: dictionary requested, could not parse JSON or key=value

I checked the latest docs, and the new syntax for monitor is:

vpn_ipsec_phase1_interface:
  ...
  monitor:
    - name: <NAME>

so I tried that:

- name: IPSec VPN Phase 1
  fortios_vpn_ipsec_phase1_interface:
    vdom: "{{ vdom }}"
    access_token: "{{ fortios_access_token | default(omit) }}"
    state: present
    vpn_ipsec_phase1_interface:
      name: 'VPN-wan2'
      interface: wan2
      keylife: 28800
      peertype: peergrp
      peergrp: vpn-peer <VERY_SECRET> Certs
      net_device: disable
      ike_version: '2'
      dhgrp:
        - 21
      proposal:
        - aes256-sha256
      auto_negotiate: enable
      comments: Internal Site-to-Site VPN to <VERY_SECRET>
      remote_gw: # <REDACTED PUBLIC IP>
      tunnel_search: nexthop
      exchange_interface_ip: disable
      authmethod: signature
      monitor:
        - name: 'VPN-wan1'
      certificate:
        - name: '{{ location_short_name }} VPN Spoke'

but this throws the error:

  msg: Error in repo
  version_check_warning:
    matched: false
    mismatches:
    - option monitor.name(VPN-wan1) not supported since v6.0.0, before v7.4.1
    system_version: v7.0.13

so I believe I have to downgrade to 2.3.2 again for now and with 2.3.4+ it is impossible to configure a monitor on a FortiOS 7.0.x firewall? Because neither the old nor the new syntax will work.

Thanks a lot!

[MaxxLiu22]

Hi @fgtdev-hblu ,

Thank you for raising this issue, I can reproduce this, I have reported it to the development team and will let you know if there is any update.

Thanks, Maxx

[JieX19]

Hi @jantari

I've reproduced the issue and found the root cause. The data type is changed from string to dict, but the backend still accepts string. We will fix the issue in the next release.

Thanks, Jie

[JieX19]

Hi @jantari,

Can you please upgrade the firmware to 7.4.1 and ansible collection to 2.3.5 and try the second playbook again? It works well on my side now.

[jantari]

Hello,

I have retried with collection v2.3.5 and FortiOS 7.0.14 - we cannot switch to 7.4.1 yet because it is not a mature release, and officially not recommended.

collection v2.3.5 with old syntax

- name: IPSec VPN Phase 1
  fortios_vpn_ipsec_phase1_interface:
    vdom: "{{ vdom }}"
    access_token: "{{ fortios_access_token | default(omit) }}"
    state: present
    vpn_ipsec_phase1_interface:
      monitor: 'VPN-wan1'

I still get the error:

msg: dictionary requested, could not parse JSON or key=value

collection v2.3.5 with new syntax

- name: IPSec VPN Phase 1
  fortios_vpn_ipsec_phase1_interface:
    vdom: "{{ vdom }}"
    access_token: "{{ fortios_access_token | default(omit) }}"
    state: present
    vpn_ipsec_phase1_interface:
      monitor:
        - name: 'VPN-wan1'

I now get the error:

  msg: Error in repo
  version_check_warning:
    matched: false
    mismatches:
    - option monitor.name(VPN-wan1) Supported version ranges are v7.4.1 -> latest
    system_version: v7.0.14

[JieX19]

Hi @jantari

The reason is that the data type of "monitor" is changed to list from 7.4.1, and we did not catch it. so the workaround is to upgrade your firmware to 7.4.1 and use the latest Ansible collection 2.3.5, it will resolve the issue.

7.4.1 is already officially released and you can upgrade the fos firmware from GUI, it shows all the supported versions.

We will fix the issue to make the param compatible with both old and new versions.

[jantari]

We will fix the issue to make the param compatible with both old and new versions.

Thank you, looking forward to it.

[JieX19]

Hi @jantari

Please install the latest version 2.3.6 and try this module again. I'll close this ticket at the moment because the issue is fixed in this version already. Feel free to reopen it if you still experience the same issue.

Thanks, Jie