# fmgr_secprof_voip – VOIP security profiles in FMG

New in version 2.8.

- Synopsis
- Parameters
- Notes
- Examples
- Return Values
- Status

## Synopsis

- Manage VOIP security profiles in FortiManager via API

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
adom - | Default: "root" | The ADOM the configuration should belong to.
comment - |  | Comment.

mode
-

Choices:
- add ←
- set
- delete
- update

Sets one of three modes for managing the object.
Allows use of soft-adds instead of overwriting existing values

name - |  | Profile name.

sccp
-

EXPERTS ONLY! KNOWLEDGE OF FMGR JSON API IS REQUIRED!
List of multiple child objects to be added. Expects a list of dictionaries.
Dictionaries must use FortiManager API parameters, not the ansible ones listed below.
If submitted, all other prefixed sub-parameters ARE IGNORED.
This object is MUTUALLY EXCLUSIVE with its options.
We expect that you know what you are doing with these list parameters, and are leveraging the JSON API Guide.
WHEN IN DOUBT, USE THE SUB OPTIONS BELOW INSTEAD TO CREATE OBJECTS WITH MULTIPLE TASKS

sccp_block_mcast
-

Choices:
- disable
- enable

Enable/disable block multicast RTP connections.
choice | disable | Disable status.
choice | enable | Enable status.

sccp_log_call_summary
-

Choices:
- disable
- enable

Enable/disable log summary of SCCP calls.
choice | disable | Disable status.
choice | enable | Enable status.

sccp_log_violations
-

Choices:
- disable
- enable

Enable/disable logging of SCCP violations.
choice | disable | Disable status.
choice | enable | Enable status.

sccp_max_calls - |  | Maximum calls per minute per SCCP client (max 65535).

sccp_status
-

Choices:
- disable
- enable

Enable/disable SCCP.
choice | disable | Disable status.
choice | enable | Enable status.

sccp_verify_header
-

Choices:
- disable
- enable

Enable/disable verify SCCP header content.
choice | disable | Disable status.
choice | enable | Enable status.

sip
-

EXPERTS ONLY! KNOWLEDGE OF FMGR JSON API IS REQUIRED!
List of multiple child objects to be added. Expects a list of dictionaries.
Dictionaries must use FortiManager API parameters, not the ansible ones listed below.
If submitted, all other prefixed sub-parameters ARE IGNORED.
This object is MUTUALLY EXCLUSIVE with its options.
We expect that you know what you are doing with these list parameters, and are leveraging the JSON API Guide.
WHEN IN DOUBT, USE THE SUB OPTIONS BELOW INSTEAD TO CREATE OBJECTS WITH MULTIPLE TASKS

sip_ack_rate - |  | ACK request rate limit (per second, per policy).

sip_block_ack
-

Choices:
- disable
- enable

Enable/disable block ACK requests.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_bye
-

Choices:
- disable
- enable

Enable/disable block BYE requests.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_cancel
-

Choices:
- disable
- enable

Enable/disable block CANCEL requests.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_geo_red_options
-

Choices:
- disable
- enable

Enable/disable block OPTIONS requests, but OPTIONS requests still notify for redundancy.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_info
-

Choices:
- disable
- enable

Enable/disable block INFO requests.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_invite
-

Choices:
- disable
- enable

Enable/disable block INVITE requests.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_long_lines
-

Choices:
- disable
- enable

Enable/disable block requests with headers exceeding max-line-length.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_message
-

Choices:
- disable
- enable

Enable/disable block MESSAGE requests.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_notify
-

Choices:
- disable
- enable

Enable/disable block NOTIFY requests.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_options
-

Choices:
- disable
- enable

Enable/disable block OPTIONS requests and no OPTIONS as notifying message for redundancy either.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_prack
-

Choices:
- disable
- enable

Enable/disable block prack requests.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_publish
-

Choices:
- disable
- enable

Enable/disable block PUBLISH requests.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_refer
-

Choices:
- disable
- enable

Enable/disable block REFER requests.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_register
-

Choices:
- disable
- enable

Enable/disable block REGISTER requests.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_subscribe
-

Choices:
- disable
- enable

Enable/disable block SUBSCRIBE requests.
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_unknown
-

Choices:
- disable
- enable

Block unrecognized SIP requests (enabled by default).
choice | disable | Disable status.
choice | enable | Enable status.

sip_block_update
-

Choices:
- disable
- enable

Enable/disable block UPDATE requests.
choice | disable | Disable status.
choice | enable | Enable status.

sip_bye_rate - |  | BYE request rate limit (per second, per policy).
sip_call_keepalive - |  | Continue tracking calls with no RTP for this many minutes.
sip_cancel_rate - |  | CANCEL request rate limit (per second, per policy).

sip_contact_fixup
-

Choices:
- disable
- enable

Fixup contact anyway even if contact's IP|port doesn't match session's IP|port.
choice | disable | Disable status.
choice | enable | Enable status.

sip_hnt_restrict_source_ip
-

Choices:
- disable
- enable

Enable/disable restrict RTP source IP to be the same as SIP source IP when HNT is enabled.
choice | disable | Disable status.
choice | enable | Enable status.

sip_hosted_nat_traversal
-

Choices:
- disable
- enable

Hosted NAT Traversal (HNT).
choice | disable | Disable status.
choice | enable | Enable status.

sip_info_rate - |  | INFO request rate limit (per second, per policy).
sip_invite_rate - |  | INVITE request rate limit (per second, per policy).

sip_ips_rtp
-

Choices:
- disable
- enable

Enable/disable allow IPS on RTP.
choice | disable | Disable status.
choice | enable | Enable status.

sip_log_call_summary
-

Choices:
- disable
- enable

Enable/disable logging of SIP call summary.
choice | disable | Disable status.
choice | enable | Enable status.

sip_log_violations
-

Choices:
- disable
- enable

Enable/disable logging of SIP violations.
choice | disable | Disable status.
choice | enable | Enable status.

sip_malformed_header_allow
-

Choices:
- pass
- discard
- respond

Action for malformed Allow header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_call_id
-

Choices:
- pass
- discard
- respond

Action for malformed Call-ID header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_contact
-

Choices:
- pass
- discard
- respond

Action for malformed Contact header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_content_length
-

Choices:
- pass
- discard
- respond

Action for malformed Content-Length header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_content_type
-

Choices:
- pass
- discard
- respond

Action for malformed Content-Type header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_cseq
-

Choices:
- pass
- discard
- respond

Action for malformed CSeq header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_expires
-

Choices:
- pass
- discard
- respond

Action for malformed Expires header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_from
-

Choices:
- pass
- discard
- respond

Action for malformed From header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_max_forwards
-

Choices:
- pass
- discard
- respond

Action for malformed Max-Forwards header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_p_asserted_identity
-

Choices:
- pass
- discard
- respond

Action for malformed P-Asserted-Identity header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_rack
-

Choices:
- pass
- discard
- respond

Action for malformed RAck header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_record_route
-

Choices:
- pass
- discard
- respond

Action for malformed Record-Route header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_route
-

Choices:
- pass
- discard
- respond

Action for malformed Route header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_rseq
-

Choices:
- pass
- discard
- respond

Action for malformed RSeq header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_sdp_a
-

Choices:
- pass
- discard
- respond

Action for malformed SDP a line.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_sdp_b
-

Choices:
- pass
- discard
- respond

Action for malformed SDP b line.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_sdp_c
-

Choices:
- pass
- discard
- respond

Action for malformed SDP c line.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_sdp_i
-

Choices:
- pass
- discard
- respond

Action for malformed SDP i line.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_sdp_k
-

Choices:
- pass
- discard
- respond

Action for malformed SDP k line.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_sdp_m
-

Choices:
- pass
- discard
- respond

Action for malformed SDP m line.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_sdp_o
-

Choices:
- pass
- discard
- respond

Action for malformed SDP o line.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_sdp_r
-

Choices:
- pass
- discard
- respond

Action for malformed SDP r line.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_sdp_s
-

Choices:
- pass
- discard
- respond

Action for malformed SDP s line.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_sdp_t
-

Choices:
- pass
- discard
- respond

Action for malformed SDP t line.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_sdp_v
-

Choices:
- pass
- discard
- respond

Action for malformed SDP v line.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_sdp_z
-

Choices:
- pass
- discard
- respond

Action for malformed SDP z line.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_to
-

Choices:
- pass
- discard
- respond

Action for malformed To header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_header_via
-

Choices:
- pass
- discard
- respond

Action for malformed VIA header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_malformed_request_line
-

Choices:
- pass
- discard
- respond

Action for malformed request line.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_max_body_length - |  | Maximum SIP message body length (0 meaning no limit).
sip_max_dialogs - |  | Maximum number of concurrent calls/dialogs (per policy).
sip_max_idle_dialogs - |  | Maximum number established but idle dialogs to retain (per policy).
sip_max_line_length - |  | Maximum SIP header line length (78-4096).
sip_message_rate - |  | MESSAGE request rate limit (per second, per policy).

sip_nat_trace
-

Choices:
- disable
- enable

Enable/disable preservation of original IP in SDP i line.
choice | disable | Disable status.
choice | enable | Enable status.

sip_no_sdp_fixup
-

Choices:
- disable
- enable

Enable/disable no SDP fix-up.
choice | disable | Disable status.
choice | enable | Enable status.

sip_notify_rate - |  | NOTIFY request rate limit (per second, per policy).

sip_open_contact_pinhole
-

Choices:
- disable
- enable

Enable/disable open pinhole for non-REGISTER Contact port.
choice | disable | Disable status.
choice | enable | Enable status.

sip_open_record_route_pinhole
-

Choices:
- disable
- enable

Enable/disable open pinhole for Record-Route port.
choice | disable | Disable status.
choice | enable | Enable status.

sip_open_register_pinhole
-

Choices:
- disable
- enable

Enable/disable open pinhole for REGISTER Contact port.
choice | disable | Disable status.
choice | enable | Enable status.

sip_open_via_pinhole
-

Choices:
- disable
- enable

Enable/disable open pinhole for Via port.
choice | disable | Disable status.
choice | enable | Enable status.

sip_options_rate - |  | OPTIONS request rate limit (per second, per policy).
sip_prack_rate - |  | PRACK request rate limit (per second, per policy).

sip_preserve_override
-

Choices:
- disable
- enable

Override i line to preserve original IPS (default| append).
choice | disable | Disable status.
choice | enable | Enable status.

sip_provisional_invite_expiry_time - |  | Expiry time for provisional INVITE (10 - 3600 sec).
sip_publish_rate - |  | PUBLISH request rate limit (per second, per policy).
sip_refer_rate - |  | REFER request rate limit (per second, per policy).

sip_register_contact_trace
-

Choices:
- disable
- enable

Enable/disable trace original IP/port within the contact header of REGISTER requests.
choice | disable | Disable status.
choice | enable | Enable status.

sip_register_rate - |  | REGISTER request rate limit (per second, per policy).

sip_rfc2543_branch
-

Choices:
- disable
- enable

Enable/disable support via branch compliant with RFC 2543.
choice | disable | Disable status.
choice | enable | Enable status.

sip_rtp
-

Choices:
- disable
- enable

Enable/disable create pinholes for RTP traffic to traverse firewall.
choice | disable | Disable status.
choice | enable | Enable status.

sip_ssl_algorithm
-

Choices:
- high
- medium
- low

Relative strength of encryption algorithms accepted in negotiation.
choice | high | High encryption. Allow only AES and ChaCha.
choice | medium | Medium encryption. Allow AES, ChaCha, 3DES, and RC4.
choice | low | Low encryption. Allow AES, ChaCha, 3DES, RC4, and DES.

sip_ssl_auth_client - |  | Require a client certificate and authenticate it with the peer/peergrp.
sip_ssl_auth_server - |  | Authenticate the server's certificate with the peer/peergrp.
sip_ssl_client_certificate - |  | Name of Certificate to offer to server if requested.

sip_ssl_client_renegotiation
-

Choices:
- allow
- deny
- secure

Allow/block client renegotiation by server.
choice | allow | Allow a SSL client to renegotiate.
choice | deny | Abort any SSL connection that attempts to renegotiate.
choice | secure | Reject any SSL connection that does not offer a RFC 5746 Secure Renegotiation Indication.

sip_ssl_max_version
-

Choices:
- ssl-3.0
- tls-1.0
- tls-1.1
- tls-1.2

Highest SSL/TLS version to negotiate.
choice | ssl-3.0 | SSL 3.0.
choice | tls-1.0 | TLS 1.0.
choice | tls-1.1 | TLS 1.1.
choice | tls-1.2 | TLS 1.2.

sip_ssl_min_version
-

Choices:
- ssl-3.0
- tls-1.0
- tls-1.1
- tls-1.2

Lowest SSL/TLS version to negotiate.
choice | ssl-3.0 | SSL 3.0.
choice | tls-1.0 | TLS 1.0.
choice | tls-1.1 | TLS 1.1.
choice | tls-1.2 | TLS 1.2.

sip_ssl_mode
-

Choices:
- off
- full

SSL/TLS mode for encryption &amp; decryption of traffic.
choice | off | No SSL.
choice | full | Client to FortiGate and FortiGate to Server SSL.

sip_ssl_pfs
-

Choices:
- require
- deny
- allow

SSL Perfect Forward Secrecy.
choice | require | PFS mandatory.
choice | deny | PFS rejected.
choice | allow | PFS allowed.

sip_ssl_send_empty_frags
-

Choices:
- disable
- enable

Send empty fragments to avoid attack on CBC IV (SSL 3.0 &amp; TLS 1.0 only).
choice | disable | Do not send empty fragments.
choice | enable | Send empty fragments.

sip_ssl_server_certificate - |  | Name of Certificate return to the client in every SSL connection.

sip_status
-

Choices:
- disable
- enable

Enable/disable SIP.
choice | disable | Disable status.
choice | enable | Enable status.

sip_strict_register
-

Choices:
- disable
- enable

Enable/disable only allow the registrar to connect.
choice | disable | Disable status.
choice | enable | Enable status.

sip_subscribe_rate - |  | SUBSCRIBE request rate limit (per second, per policy).

sip_unknown_header
-

Choices:
- pass
- discard
- respond

Action for unknown SIP header.
choice | pass | Bypass malformed messages.
choice | discard | Discard malformed messages.
choice | respond | Respond with error code.

sip_update_rate - |  | UPDATE request rate limit (per second, per policy).

## Notes

Note

- Full Documentation at https://ftnt-ansible-docs.readthedocs.io/en/latest/.

## Examples

    - name: DELETE Profile
      fmgr_secprof_voip:
        name: "Ansible_VOIP_Profile"
        mode: "delete"

    - name: Create FMGR_VOIP_PROFILE
      fmgr_secprof_voip:
        mode: "set"
        adom: "root"
        name: "Ansible_VOIP_Profile"
        comment: "Created by Ansible"
        sccp: {block-mcast: "enable", log-call-summary: "enable", log-violations: "enable", status: "enable"}

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
api_result string | always | full API response, includes status code and message

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by the Ansible Community. [community]

### Authors

- Luke Weighall (@lweighall)
- Andrew Welsh (@Ghilli3)
- Jim Huber (@p4r4n0y1ng)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.