TypeError: 'NoneType' object does not support item assignment when using fortios_firewall_policy move fonction

[greenspartan]

Hi guys,

Since 3 days, i have the following issue on my playbook used to move policy :

TypeError: 'NoneType' object does not support item assignment when using fortios_firewall_policy move fonction.

Here's my playbook which is quite simple :

---

- hosts: my_fortigate
  collections:
    - fortinet.fortios
  connection: httpapi
  gather_facts: False
  vars:
    ansible_httpapi_use_ssl: yes
    ansible_httpapi_validate_certs: no
    ansible_httpapi_port: 443 
    range_limit: 2000

  tasks:    

  - name: Move policy on my firewall
    fortinet.fortios.fortios_firewall_policy:
      vdom: "root"
      action: "move"
      self: 244
      before: 1

I've checked and policies ID 1 and 244 are existing on our Fortigate. We didn't change anything to our AAP installation and we are using :

Ansible : 2.15.12 AAP : 4.4.6 Fortinet.fortios : 2.3.8

Last time this playbook executed without any issue was on 10th of October on fortinet.fortios 2.3.7.

Could it be related to new version 2.3.8 that came 3 days ago ?

Thanks in advance if you have some ideas !

Adrien

[MaxxLiu22]

Hi @greenspartan ,

Thank you for bringing this issue to our attention. It appears that our regression test did not cover this case, but we have added it now. I have informed the development team, and they will be addressing it shortly. In the meantime, would it be possible for you to add a generic resource after your task? This will ensure that if the first task fails, the generic task can perform the same function. If needed, you can also temporarily downgrade to the previous version.

  vars:
    ansible_httpapi_use_ssl: yes
    ansible_httpapi_validate_certs: no
    ansible_httpapi_port: 443 
    range_limit: 2000
    self_policy: 2
    before_policy: 4

  tasks:    
  - name: Move policy on my firewall
    fortinet.fortios.fortios_firewall_policy:
      vdom: "root"
      action: "move"
      self: "{{ self_policy }}"
      before: "{{ before_policy }}"
    register: result_first_task   # Register result of the first task
    ignore_errors: yes            # Continue even if the task fails

  - name: Run second task only if the first one failed
    fortios_json_generic:
      vdom: "{{ vdom }}"
      json_generic:
        method: PUT
        path: "/api/v2/cmdb/firewall/policy/{{ self_policy }}"
        jsonbody: '{}'
        specialparams: action=move&before={{ before_policy }}&vdom=root

    when: result_first_task is failed  # Run only if the first task fails

Thanks, Maxx

[greenspartan]

Hi @MaxxLiu22 ,

Thanks for your quick reply ! Indeed i confirm the workaround you've proposed using direct Fortigate API works well ! I will use that workaround until issue is fixed in 2.3.9 😉.

Thanks and have a great day !

Adrien

[MaxxLiu22]

Hi @greenspartan ，

Thank you for your understanding, and we apologize for any inconvenience.

Thanks, Maxx

[jantari]

Following because I ran into the same error when moving central SNAT rules with:

- name: Move SNAT rule test
  fortios_firewall_central_snat_map:
    vdom: root
    access_token: "{{ fortios_access_token | default(omit) }}"
    action: move
    self: '11'
    after: '9'