a10_slb_template_client_ssl
Synopsis
Client SSL Template
Parameters
Parameters |
Choices/Defaults |
Comment |
|
---|---|---|---|
state str/required |
[‘noop’, ‘present’, ‘absent’] |
State of the object to be created. |
|
ansible_host str/required |
Host for AXAPI authentication |
||
ansible_username str/required |
Username for AXAPI authentication |
||
ansible_password str/required |
Password for AXAPI authentication |
||
ansible_port int/required |
Port for AXAPI authentication |
||
a10_device_context_id int |
[‘1-8’] |
Device ID for aVCS configuration |
|
a10_partition str |
Destination/target partition for object/command |
||
name str/required |
Client SSL Template Name |
||
auth_username str |
Specify the Username Field in the Client Certificate(If multi-fields are specificed, prior one has higher priority) |
||
ca_certs list |
Field ca_certs |
||
ca_cert str |
CA Certificate (CA Certificate Name) |
||
ca_shared bool |
CA Certificate Partition Shared |
||
client_ocsp bool |
Specify ocsp authentication server(s) for client certificate verification |
||
client_ocsp_srvr str |
Specify authentication server |
||
client_ocsp_sg str |
Specify service-group (Service group name) |
||
chain_cert str |
Chain Certificate Name |
||
chain_cert_shared_str str |
Chain Certificate Name |
||
dh_type str |
‘1024’= 1024; ‘1024-dsa’= 1024-dsa; ‘2048’= 2048; |
||
ec_list list |
Field ec_list |
||
ec str |
‘secp256r1’= X9_62_prime256v1; ‘secp384r1’= secp384r1; ‘secp521r1’= secp521r1; ‘x25519’= x25519; |
||
local_logging bool |
Enable local logging |
||
ocsp_stapling bool |
Config OCSP stapling support |
||
ocspst_ca_cert str |
CA certificate |
||
ocspst_ocsp bool |
Specify OCSP Authentication |
||
ocspst_srvr str |
Specify OCSP authentication server |
||
ocspst_srvr_days int |
Specify update period, in days |
||
ocspst_srvr_hours int |
Specify update period, in hours |
||
ocspst_srvr_minutes int |
Specify update period, in minutes |
||
ocspst_srvr_timeout int |
Specify retry timeout (Default is 30 mins) |
||
ocspst_sg str |
Specify authentication service group |
||
ocspst_sg_days int |
Specify update period, in days |
||
ocspst_sg_hours int |
Specify update period, in hours |
||
ocspst_sg_minutes int |
Specify update period, in minutes |
||
ocspst_sg_timeout int |
Specify retry timeout (Default is 30 mins) |
||
ssli_inbound_enable bool |
Enable inbound SSLi |
||
ssli_logging bool |
SSLi logging level, default is error logging only |
||
sslilogging str |
‘disable’= Disable all logging; ‘all’= enable all logging(error, info); |
||
client_certificate str |
‘Ignore’= Don’t request client certificate; ‘Require’= Require client certificate; ‘Request’= Request client certificate; |
||
req_ca_lists list |
Field req_ca_lists |
||
client_certificate_Request_CA str |
Send CA lists in certificate request (CA Certificate Name) |
||
client_cert_req_ca_shared bool |
CA Certificate Partition Shared |
||
close_notify bool |
Send close notification when terminate connection |
||
crl_certs list |
Field crl_certs |
||
crl str |
Certificate Revocation Lists (Certificate Revocation Lists file name) |
||
crl_shared bool |
Certificate Revocation Lists Partition Shared |
||
forward_proxy_ca_cert str |
CA Certificate for forward proxy (SSL forward proxy CA Certificate Name) |
||
fp_ca_shared bool |
CA Certificate Partition Shared |
||
forward_proxy_ca_key str |
CA Private Key for forward proxy (SSL forward proxy CA Key Name) |
||
forward_passphrase str |
Password Phrase |
||
forward_encrypted str |
Do NOT use this option manually. (This is an A10 reserved keyword.) (The ENCRYPTED password string) |
||
fp_ca_key_shared bool |
CA Private Key Partition Shared |
||
fp_ca_certificate str |
CA Certificate for forward proxy (SSL forward proxy CA Certificate Name) |
||
fp_ca_key str |
CA Private Key for forward proxy (SSL forward proxy CA Key Name) |
||
fp_ca_key_passphrase str |
Password Phrase |
||
fp_ca_key_encrypted str |
Do NOT use this option manually. (This is an A10 reserved keyword.) (The ENCRYPTED password string) |
||
fp_ca_chain_cert str |
Chain Certificate (Chain Certificate Name) |
||
fp_ca_certificate_shared bool |
CA Private Key Partition Shared |
||
forward_proxy_alt_sign bool |
Forward proxy alternate signing cert and key |
||
fp_alt_cert str |
CA Certificate for forward proxy alternate signing (Certificate name) |
||
fp_alt_key str |
CA Private Key for forward proxy alternate signing (Key name) |
||
fp_alt_passphrase str |
Password Phrase |
||
fp_alt_encrypted str |
Do NOT use this option manually. (This is an A10 reserved keyword.) (The ENCRYPTED password string) |
||
fp_alt_chain_cert str |
Chain Certificate (Chain Certificate Name) |
||
fp_alt_shared bool |
Alternate CA Certificate and Private Key Partition Shared |
||
forward_proxy_trusted_ca_lists list |
Field forward_proxy_trusted_ca_lists |
||
forward_proxy_trusted_ca str |
Forward proxy trusted CA file (CA file name) |
||
fp_trusted_ca_shared bool |
Trusted CA Certificate Partition Shared |
||
forward_proxy_decrypted_dscp int |
Apply a DSCP to decrypted and bypassed traffic (DSCP to apply to decrypted traffic) |
||
forward_proxy_decrypted_dscp_bypass int |
DSCP to apply to bypassed traffic |
||
enable_tls_alert_logging bool |
Enable TLS alert logging |
||
alert_type str |
‘fatal’= Log fatal alerts; |
||
forward_proxy_verify_cert_fail_action bool |
Action taken if certificate verification fails, close the connection by default |
||
verify_cert_fail_action str |
‘bypass’= bypass SSLi processing; ‘continue’= continue the connection; ‘drop’= close the connection; ‘block’= block the connection with a warning page; |
||
forward_proxy_cert_revoke_action bool |
Action taken if a certificate is irreversibly revoked, bypass SSLi processing by default |
||
cert_revoke_action str |
‘bypass’= bypass SSLi processing; ‘continue’= continue the connection; ‘drop’= close the connection; ‘block’= block the connection with a warning page; |
||
forward_proxy_no_shared_cipher_action bool |
Action taken if handshake fails due to no shared ciper, close the connection by default |
||
no_shared_cipher_action str |
‘bypass’= bypass SSLi processing; ‘drop’= close the connection; |
||
forward_proxy_esni_action bool |
Action taken if receiving encrypted server name indication extension in client hello MSG, bypass the connection by default |
||
fp_esni_action str |
‘bypass’= bypass SSLi processing; ‘drop’= close the connection; |
||
forward_proxy_cert_unknown_action bool |
Action taken if a certificate revocation status is unknown, bypass SSLi processing by default |
||
cert_unknown_action str |
‘bypass’= bypass SSLi processing; ‘continue’= continue the connection; ‘drop’= close the connection; ‘block’= block the connection with a warning page; |
||
forward_proxy_block_message str |
Message to be included on the block page (Message, enclose in quotes if spaces are present) |
||
cache_persistence_list_name str |
Class List Name |
||
fp_cert_ext_crldp str |
CRL Distribution Point (CRL Distribution Point URI) |
||
fp_cert_ext_aia_ocsp str |
OCSP (Authority Information Access URI) |
||
fp_cert_ext_aia_ca_issuers str |
CA Issuers (Authority Information Access URI) |
||
notbefore bool |
notBefore date |
||
notbeforeday int |
Day |
||
notbeforemonth int |
Month |
||
notbeforeyear int |
Year |
||
notafter bool |
notAfter date |
||
notafterday int |
Day |
||
notaftermonth int |
Month |
||
notafteryear int |
Year |
||
forward_proxy_hash_persistence_interval int |
Set the time interval to save the hash persistence certs (Interval value, in minutes) |
||
forward_proxy_ssl_version int |
TLS/SSL version, default is TLS1.2 (TLS/SSL version= 31-TLSv1.0, 32-TLSv1.1, 33-TLSv1.2 and 34-TLSv1.3) |
||
forward_proxy_ocsp_disable bool |
Disable ocsp-stapling for forward proxy |
||
forward_proxy_crl_disable bool |
Disable Certificate Revocation List checking for forward proxy |
||
forward_proxy_cert_cache_timeout int |
Certificate cache timeout, default is 1 hour (seconds, set to 0 for never timeout) |
||
forward_proxy_cert_cache_limit int |
Certificate cache size limit, default is 524288 (set to 0 for unlimited size) |
||
forward_proxy_cert_expiry bool |
Adjust certificate expiry relative to the time when it is created on the device |
||
expire_hours int |
Certificate lifetime in hours |
||
forward_proxy_enable bool |
Enable SSL forward proxy |
||
handshake_logging_enable bool |
Enable SSL handshake logging |
||
forward_proxy_selfsign_redir bool |
Redirect connections to pages with self signed certs to a warning page |
||
forward_proxy_failsafe_disable bool |
Disable Failsafe for SSL forward proxy |
||
forward_proxy_log_disable bool |
Disable SSL forward proxy logging |
||
fp_cert_fetch_natpool_name str |
Specify NAT pool or pool group |
||
shared_partition_pool bool |
Reference a NAT pool or pool group from shared partition |
||
fp_cert_fetch_natpool_name_shared str |
Specify NAT pool or pool group |
||
fp_cert_fetch_natpool_precedence bool |
Set this NAT pool as higher precedence than other source NAT like configued under template policy |
||
fp_cert_fetch_autonat str |
‘auto’= Configure auto NAT for server certificate fetching; |
||
fp_cert_fetch_autonat_precedence bool |
Set this NAT pool as higher precedence than other source NAT like configued under template policy |
||
forward_proxy_no_sni_action str |
‘intercept’= intercept in no SNI case; ‘bypass’= bypass in no SNI case; ‘reset’= reset in no SNI case; |
||
case_insensitive bool |
Case insensitive forward proxy bypass |
||
class_list_name str |
Class List Name |
||
multi_class_list list |
Field multi_class_list |
||
multi_clist_name str |
Class List Name |
||
user_name_list str |
Forward proxy bypass if user-name matches class-list |
||
ad_group_list str |
Forward proxy bypass if ad-group matches class-list |
||
exception_user_name_list str |
Exceptions to forward proxy bypass if user-name matches class-list |
||
exception_ad_group_list str |
Exceptions to forward proxy bypass if ad-group matches class-list |
||
exception_sni_cl_name str |
Exceptions to forward-proxy-bypass |
||
inspect_list_name str |
Class List Name |
||
inspect_certificate_subject_cl_name str |
Forward proxy Inspect if Certificate Subject matches class-list |
||
inspect_certificate_issuer_cl_name str |
Forward proxy Inspect if Certificate issuer matches class-list |
||
inspect_certificate_san_cl_name str |
Forward proxy Inspect if Certificate Subject Alternative Name matches class- list |
||
contains_list list |
Field contains_list |
||
contains str |
Forward proxy bypass if SNI string contains another string |
||
ends_with_list list |
Field ends_with_list |
||
ends_with str |
Forward proxy bypass if SNI string ends with another string |
||
equals_list list |
Field equals_list |
||
equals str |
Forward proxy bypass if SNI string equals another string |
||
starts_with_list list |
Field starts_with_list |
||
starts_with str |
Forward proxy bypass if SNI string starts with another string |
||
certificate_subject_contains_list list |
Field certificate_subject_contains_list |
||
certificate_subject_contains str |
Forward proxy bypass if Certificate Subject contains another string |
||
bypass_cert_subject_class_list_name str |
Class List Name |
||
bypass_cert_subject_multi_class_list list |
Field bypass_cert_subject_multi_class_list |
||
bypass_cert_subject_multi_class_list_name str |
Class List Name |
||
exception_certificate_subject_cl_name str |
Exceptions to forward-proxy-bypass |
||
certificate_subject_ends_with_list list |
Field certificate_subject_ends_with_list |
||
certificate_subject_ends_with str |
Forward proxy bypass if Certificate Subject ends with another string |
||
certificate_subject_equals_list list |
Field certificate_subject_equals_list |
||
certificate_subject_equals str |
Forward proxy bypass if Certificate Subject equals another string |
||
certificate_subject_starts_with_list list |
Field certificate_subject_starts_with_list |
||
certificate_subject_starts str |
Forward proxy bypass if Certificate Subject starts with another string |
||
certificate_issuer_contains_list list |
Field certificate_issuer_contains_list |
||
certificate_issuer_contains str |
Forward proxy bypass if Certificate issuer contains another string (Certificate issuer) |
||
bypass_cert_issuer_class_list_name str |
Class List Name |
||
bypass_cert_issuer_multi_class_list list |
Field bypass_cert_issuer_multi_class_list |
||
bypass_cert_issuer_multi_class_list_name str |
Class List Name |
||
exception_certificate_issuer_cl_name str |
Exceptions to forward-proxy-bypass |
||
certificate_issuer_ends_with_list list |
Field certificate_issuer_ends_with_list |
||
certificate_issuer_ends_with str |
Forward proxy bypass if Certificate issuer ends with another string |
||
certificate_issuer_equals_list list |
Field certificate_issuer_equals_list |
||
certificate_issuer_equals str |
Forward proxy bypass if Certificate issuer equals another string |
||
certificate_issuer_starts_with_list list |
Field certificate_issuer_starts_with_list |
||
certificate_issuer_starts str |
Forward proxy bypass if Certificate issuer starts with another string |
||
certificate_san_contains_list list |
Field certificate_san_contains_list |
||
certificate_san_contains str |
Forward proxy bypass if Certificate SAN contains another string |
||
bypass_cert_san_class_list_name str |
Class List Name |
||
bypass_cert_san_multi_class_list list |
Field bypass_cert_san_multi_class_list |
||
bypass_cert_san_multi_class_list_name str |
Class List Name |
||
exception_certificate_san_cl_name str |
Exceptions to forward-proxy-bypass |
||
certificate_san_ends_with_list list |
Field certificate_san_ends_with_list |
||
certificate_san_ends_with str |
Forward proxy bypass if Certificate SAN ends with another string |
||
certificate_san_equals_list list |
Field certificate_san_equals_list |
||
certificate_san_equals str |
Forward proxy bypass if Certificate SAN equals another string |
||
certificate_san_starts_with_list list |
Field certificate_san_starts_with_list |
||
certificate_san_starts str |
Forward proxy bypass if Certificate SAN starts with another string |
||
client_auth_case_insensitive bool |
Case insensitive forward proxy client auth bypass |
||
client_auth_class_list str |
Forward proxy client auth bypass if SNI string matches class-list (Class List Name) |
||
client_auth_contains_list list |
Field client_auth_contains_list |
||
client_auth_contains str |
Forward proxy bypass if SNI string contains another string |
||
client_auth_ends_with_list list |
Field client_auth_ends_with_list |
||
client_auth_ends_with str |
Forward proxy bypass if SNI string ends with another string |
||
client_auth_equals_list list |
Field client_auth_equals_list |
||
client_auth_equals str |
Forward proxy bypass if SNI string equals another string |
||
client_auth_starts_with_list list |
Field client_auth_starts_with_list |
||
client_auth_starts_with str |
Forward proxy bypass if SNI string starts with another string |
||
forward_proxy_cert_not_ready_action str |
‘bypass’= bypass the connection; ‘reset’= reset the connection; ‘intercept’= wait for cert and then inspect the connection; |
||
web_reputation dict |
Field web_reputation |
||
bypass_trustworthy bool |
Bypass when reputation score is greater than or equal to 81 |
||
bypass_low_risk bool |
Bypass when reputation score is greater than or equal to 61 |
||
bypass_moderate_risk bool |
Bypass when reputation score is greater than or equal to 41 |
||
bypass_suspicious bool |
Bypass when reputation score is greater than or equal to 21 |
||
bypass_malicious bool |
Bypass when reputation score is greater than or equal to 1 |
||
bypass_threshold int |
Bypass when reputation score is greater than or equal to the customized score (1-100) |
||
exception_web_reputation dict |
Field exception_web_reputation |
||
exception_trustworthy bool |
Intercept when reputation score is less than or equal to 100 |
||
exception_low_risk bool |
Intercept when reputation score is less than or equal to 80 |
||
exception_moderate_risk bool |
Intercept when reputation score is less than or equal to 60 |
||
exception_suspicious bool |
Intercept when reputation score is less than or equal to 40 |
||
exception_malicious bool |
Intercept when reputation score is less than or equal to 20 |
||
exception_threshold int |
Intercept when reputation score is less than or equal to a customized value (1-100) |
||
web_category dict |
Field web_category |
||
bypassed_category str |
‘uncategorized’= Uncategorized URLs; ‘real-estate’= Category Real Estate; ‘computer-and-internet-security’= Category Computer and Internet Security; ‘financial-services’= Category Financial Services; ‘business-and-economy’= Category Business and Economy; ‘computer-and-internet-info’= Category Computer and Internet Info; ‘auctions’= Category Auctions; ‘shopping’= Category Shopping; ‘cult-and-occult’= Category Cult and Occult; ‘travel’= Category Travel; ‘drugs’= Category Abused Drugs; ‘adult-and-pornography’= Category Adult and Pornography; ‘home-and-garden’= Category Home and Garden; ‘military’= Category Military; ‘social-network’= Category Social Network; ‘dead-sites’= Category Dead Sites (db Ops only); ‘stock-advice-and-tools’= Category Stock Advice and Tools; ‘training-and-tools’= Category Training and Tools; ‘dating’= Category Dating; ‘sex-education’= Category Sex Education; ‘religion’= Category Religion; ‘entertainment-and-arts’= Category Entertainment and Arts; ‘personal- sites-and-blogs’= Category Personal sites and Blogs; ‘legal’= Category Legal; ‘local-information’= Category Local Information; ‘streaming-media’= Category Streaming Media; ‘job-search’= Category Job Search; ‘gambling’= Category Gambling; ‘translation’= Category Translation; ‘reference-and-research’= Category Reference and Research; ‘shareware-and-freeware’= Category Shareware and Freeware; ‘peer-to-peer’= Category Peer to Peer; ‘marijuana’= Category Marijuana; ‘hacking’= Category Hacking; ‘games’= Category Games; ‘philosophy- and-politics’= Category Philosophy and Political Advocacy; ‘weapons’= Category Weapons; ‘pay-to-surf’= Category Pay to Surf; ‘hunting-and-fishing’= Category Hunting and Fishing; ‘society’= Category Society; ‘educational-institutions’= Category Educational Institutions; ‘online-greeting-cards’= Category Online Greeting cards; ‘sports’= Category Sports; ‘swimsuits-and-intimate-apparel’= Category Swimsuits and Intimate Apparel; ‘questionable’= Category Questionable; ‘kids’= Category Kids; ‘hate-and-racism’= Category Hate and Racism; ‘personal- storage’= Category Personal Storage; ‘violence’= Category Violence; ‘keyloggers-and-monitoring’= Category Keyloggers and Monitoring; ‘search- engines’= Category Search Engines; ‘internet-portals’= Category Internet Portals; ‘web-advertisements’= Category Web Advertisements; ‘cheating’= Category Cheating; ‘gross’= Category Gross; ‘web-based-email’= Category Web based email; ‘malware-sites’= Category Malware Sites; ‘phishing-and-other- fraud’= Category Phishing and Other Frauds; ‘proxy-avoid-and-anonymizers’= Category Proxy Avoid and Anonymizers; ‘spyware-and-adware’= Category Spyware and Adware; ‘music’= Category Music; ‘government’= Category Government; ‘nudity’= Category Nudity; ‘news-and-media’= Category News and Media; ‘illegal’= Category Illegal; ‘cdns’= Category CDNs; ‘internet-communications’= Category Internet Communications; ‘bot-nets’= Category Bot Nets; ‘abortion’= Category Abortion; ‘health-and-medicine’= Category Health and Medicine; ‘spam- urls’= Category SPAM URLs; ‘dynamically-generated-content’= Category Dynamically Generated Content; ‘parked-domains’= Category Parked Domains; ‘alcohol-and-tobacco’= Category Alcohol and Tobacco; ‘image-and-video-search’= Category Image and Video Search; ‘fashion-and-beauty’= Category Fashion and Beauty; ‘recreation-and-hobbies’= Category Recreation and Hobbies; ‘motor- vehicles’= Category Motor Vehicles; ‘web-hosting-sites’= Category Web Hosting Sites; ‘self-harm’= Category Self Harm; ‘dns-over-https’= Category DNS over HTTPs; ‘low-thc-cannabis-products’= Category Low-THC Cannabis Products; ‘generative-ai’= Category Generative AI; ‘nudity-artistic’= Category Artistic Nudity; ‘illegal-pornography’= Category Illegal Pornography eg. Child Sexual Abuse; |
||
exception_web_category dict |
Field exception_web_category |
||
exception_category str |
‘uncategorized’= Uncategorized URLs; ‘real-estate’= Category Real Estate; ‘computer-and-internet-security’= Category Computer and Internet Security; ‘financial-services’= Category Financial Services; ‘business-and-economy’= Category Business and Economy; ‘computer-and-internet-info’= Category Computer and Internet Info; ‘auctions’= Category Auctions; ‘shopping’= Category Shopping; ‘cult-and-occult’= Category Cult and Occult; ‘travel’= Category Travel; ‘drugs’= Category Abused Drugs; ‘adult-and-pornography’= Category Adult and Pornography; ‘home-and-garden’= Category Home and Garden; ‘military’= Category Military; ‘social-network’= Category Social Network; ‘dead-sites’= Category Dead Sites (db Ops only); ‘stock-advice-and-tools’= Category Stock Advice and Tools; ‘training-and-tools’= Category Training and Tools; ‘dating’= Category Dating; ‘sex-education’= Category Sex Education; ‘religion’= Category Religion; ‘entertainment-and-arts’= Category Entertainment and Arts; ‘personal- sites-and-blogs’= Category Personal sites and Blogs; ‘legal’= Category Legal; ‘local-information’= Category Local Information; ‘streaming-media’= Category Streaming Media; ‘job-search’= Category Job Search; ‘gambling’= Category Gambling; ‘translation’= Category Translation; ‘reference-and-research’= Category Reference and Research; ‘shareware-and-freeware’= Category Shareware and Freeware; ‘peer-to-peer’= Category Peer to Peer; ‘marijuana’= Category Marijuana; ‘hacking’= Category Hacking; ‘games’= Category Games; ‘philosophy- and-politics’= Category Philosophy and Political Advocacy; ‘weapons’= Category Weapons; ‘pay-to-surf’= Category Pay to Surf; ‘hunting-and-fishing’= Category Hunting and Fishing; ‘society’= Category Society; ‘educational-institutions’= Category Educational Institutions; ‘online-greeting-cards’= Category Online Greeting cards; ‘sports’= Category Sports; ‘swimsuits-and-intimate-apparel’= Category Swimsuits and Intimate Apparel; ‘questionable’= Category Questionable; ‘kids’= Category Kids; ‘hate-and-racism’= Category Hate and Racism; ‘personal- storage’= Category Personal Storage; ‘violence’= Category Violence; ‘keyloggers-and-monitoring’= Category Keyloggers and Monitoring; ‘search- engines’= Category Search Engines; ‘internet-portals’= Category Internet Portals; ‘web-advertisements’= Category Web Advertisements; ‘cheating’= Category Cheating; ‘gross’= Category Gross; ‘web-based-email’= Category Web based email; ‘malware-sites’= Category Malware Sites; ‘phishing-and-other- fraud’= Category Phishing and Other Frauds; ‘proxy-avoid-and-anonymizers’= Category Proxy Avoid and Anonymizers; ‘spyware-and-adware’= Category Spyware and Adware; ‘music’= Category Music; ‘government’= Category Government; ‘nudity’= Category Nudity; ‘news-and-media’= Category News and Media; ‘illegal’= Category Illegal; ‘cdns’= Category CDNs; ‘internet-communications’= Category Internet Communications; ‘bot-nets’= Category Bot Nets; ‘abortion’= Category Abortion; ‘health-and-medicine’= Category Health and Medicine; ‘spam- urls’= Category SPAM URLs; ‘dynamically-generated-content’= Category Dynamically Generated Content; ‘parked-domains’= Category Parked Domains; ‘alcohol-and-tobacco’= Category Alcohol and Tobacco; ‘image-and-video-search’= Category Image and Video Search; ‘fashion-and-beauty’= Category Fashion and Beauty; ‘recreation-and-hobbies’= Category Recreation and Hobbies; ‘motor- vehicles’= Category Motor Vehicles; ‘web-hosting-sites’= Category Web Hosting Sites; ‘self-harm’= Category Self Harm; ‘dns-over-https’= Category DNS over HTTPs; ‘low-thc-cannabis-products’= Category Low-THC Cannabis Products; ‘generative-ai’= Category Generative AI; ‘nudity-artistic’= Category Artistic Nudity; ‘illegal-pornography’= Category Illegal Pornography eg. Child Sexual Abuse; |
||
require_web_category bool |
Wait for web category to be resolved before taking bypass decision |
||
client_ipv4_list list |
Field client_ipv4_list |
||
client_ipv4_list_name str |
IPV4 client class-list name |
||
client_ipv6_list list |
Field client_ipv6_list |
||
client_ipv6_list_name str |
IPV6 client class-list name |
||
server_ipv4_list list |
Field server_ipv4_list |
||
server_ipv4_list_name str |
IPV4 server class-list name |
||
server_ipv6_list list |
Field server_ipv6_list |
||
server_ipv6_list_name str |
IPV6 server class-list name |
||
exception_client_ipv4_list list |
Field exception_client_ipv4_list |
||
exception_client_ipv4_list_name str |
IPV4 exception client class-list name |
||
exception_client_ipv6_list list |
Field exception_client_ipv6_list |
||
exception_client_ipv6_list_name str |
IPV6 exception client class-list name |
||
exception_server_ipv4_list list |
Field exception_server_ipv4_list |
||
exception_server_ipv4_list_name str |
IPV4 exception server class-list name |
||
exception_server_ipv6_list list |
Field exception_server_ipv6_list |
||
exception_server_ipv6_list_name str |
IPV6 exception server class-list name |
||
local_cert_pin_list dict |
Field local_cert_pin_list |
||
local_cert_pin_list_bypass_fail_count int |
Set the connection fail count as bypass criteria (Bypass when connection failure count is greater than the criteria (1-65536)) |
||
central_cert_pin_list bool |
Forward proxy bypass if SNI string is contained in central updated cert- pinning-candidate list |
||
forward_proxy_require_sni_cert_matched str |
‘no-match-action-inspect’= Inspected if not matched; ‘no-match-action-drop’= Dropped if not matched; |
||
template_cipher str |
Cipher Template Name |
||
shared_partition_cipher_template bool |
Reference a cipher template from shared partition |
||
template_cipher_shared str |
Cipher Template Name |
||
template_hsm str |
HSM Template (HSM Template Name) |
||
hsm_type str |
‘thales-embed’= Thales embed key; ‘thales-hwcrhk’= Thales hwcrhk Key; |
||
cipher_without_prio_list list |
Field cipher_without_prio_list |
||
cipher_wo_prio str |
‘SSL3_RSA_DES_192_CBC3_SHA’= TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000A); ‘SSL3_RSA_RC4_128_MD5’= TLS_RSA_WITH_RC4_128_MD5 (0x0004); ‘SSL3_RSA_RC4_128_SHA’= TLS_RSA_WITH_RC4_128_SHA (0x0005); ‘TLS1_RSA_AES_128_SHA’= TLS_RSA_WITH_AES_128_CBC_SHA (0x002F); ‘TLS1_RSA_AES_256_SHA’= TLS_RSA_WITH_AES_256_CBC_SHA (0x0035); ‘TLS1_RSA_AES_128_SHA256’= TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003C); ‘TLS1_RSA_AES_256_SHA256’= TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003D); ‘TLS1_DHE_RSA_AES_128_GCM_SHA256’= TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x009E); ‘TLS1_DHE_RSA_AES_128_SHA’= TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033); ‘TLS1_DHE_RSA_AES_128_SHA256’= TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x0067); ‘TLS1_DHE_RSA_AES_256_GCM_SHA384’= TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x009F); ‘TLS1_DHE_RSA_AES_256_SHA’= TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039); ‘TLS1_DHE_RSA_AES_256_SHA256’= TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (0x006B); ‘TLS1_ECDHE_ECDSA_AES_128_GCM_SHA256’= TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xC02B); ‘TLS1_ECDHE_ECDSA_AES_128_SHA’= TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xC009); ‘TLS1_ECDHE_ECDSA_AES_128_SHA256’= TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xC023); ‘TLS1_ECDHE_ECDSA_AES_256_GCM_SHA384’= TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xC02C); ‘TLS1_ECDHE_ECDSA_AES_256_SHA’= TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xC00A); ‘TLS1_ECDHE_RSA_AES_128_GCM_SHA256’= TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xC02F); ‘TLS1_ECDHE_RSA_AES_128_SHA’= TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xC013); ‘TLS1_ECDHE_RSA_AES_128_SHA256’= TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xC027); ‘TLS1_ECDHE_RSA_AES_256_GCM_SHA384’= TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xC030); ‘TLS1_ECDHE_RSA_AES_256_SHA’= TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xC014); ‘TLS1_RSA_AES_128_GCM_SHA256’= TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009C); ‘TLS1_RSA_AES_256_GCM_SHA384’= TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009D); ‘TLS1_ECDHE_RSA_AES_256_SHA384’= TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xC028); ‘TLS1_ECDHE_ECDSA_AES_256_SHA384’= TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xC024); ‘TLS1_ECDHE_RSA_CHACHA20_POLY1305_SHA256’= TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xCCA8); ‘TLS1_ECDHE_ECDSA_CHACHA20_POLY1305_SHA256’= TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xCCA9); ‘TLS1_DHE_RSA_CHACHA20_POLY1305_SHA256’= TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xCCAA); |
||
server_name_list list |
Field server_name_list |
||
server_name str |
Server name indication in Client hello extension (Server name String) |
||
server_cert str |
Server Certificate associated to SNI (Server Certificate Name) |
||
server_chain str |
Server Certificate Chain associated to SNI (Server Certificate Chain Name) |
||
server_key str |
Server Private Key associated to SNI (Server Private Key Name) |
||
server_passphrase str |
help Password Phrase |
||
server_encrypted str |
Do NOT use this option manually. (This is an A10 reserved keyword.) (The ENCRYPTED password string) |
||
server_name_alternate bool |
Specific the second certifcate |
||
server_shared bool |
Server Name Partition Shared |
||
sni_template bool |
Template associated to SNI |
||
sni_template_client_ssl str |
Client SSL Template Name |
||
sni_shared_partition_client_ssl_template bool |
Reference a Client SSL template from shared partition |
||
sni_template_client_ssl_shared_name str |
Client SSL Template Name |
||
server_name_regex str |
Server name indication in Client hello extension with regular expression (Server name String with regex) |
||
server_cert_regex str |
Server Certificate associated to SNI regex (Server Certificate Name) |
||
server_chain_regex str |
Server Certificate Chain associated to SNI regex (Server Certificate Chain Name) |
||
server_key_regex str |
Server Private Key associated to SNI regex (Server Private Key Name) |
||
server_passphrase_regex str |
help Password Phrase |
||
server_encrypted_regex str |
Do NOT use this option manually. (This is an A10 reserved keyword.) (The ENCRYPTED password string) |
||
server_name_regex_alternate bool |
Specific the second certifcate |
||
server_shared_regex bool |
Server Name Partition Shared |
||
sni_regex_template bool |
Template associated to SNI regex |
||
sni_regex_template_client_ssl str |
Client SSL Template Name |
||
sni_regex_shared_partition_client_ssl_template bool |
Reference a Client SSL template from shared partition |
||
sni_regex_template_client_ssl_shared_name str |
Client SSL Template Name |
||
server_name_auto_map bool |
Enable automatic mapping of server name indication in Client hello extension |
||
sni_enable_log bool |
Enable logging of sni-auto-map failures. Disable by default |
||
sni_bypass_missing_cert bool |
Bypass when missing cert/key |
||
sni_bypass_expired_cert bool |
Bypass when certificate expired |
||
sni_bypass_explicit_list str |
Bypass when matched explicit bypass list (Specify class list name) |
||
sni_bypass_enable_log bool |
Enable logging when bypass event happens, disabled by default |
||
direct_client_server_auth bool |
Let backend server does SSL client authentication directly |
||
session_cache_size int |
Session Cache Size (Maximum cache size. Default value 0 (Session ID reuse disabled)) |
||
session_cache_timeout int |
Session Cache Timeout (Timeout value, in seconds. Default value 0 (Session cache timeout disabled)) |
||
session_ticket_disable bool |
Disable client side session ticket support |
||
session_ticket_lifetime int |
Session ticket lifetime in seconds from stateless session resumption (Lifetime value in seconds. Default value 0 (Session ticket lifetime is 7200 seconds)) |
||
ssl_false_start_disable bool |
disable SSL False Start |
||
disable_sslv3 bool |
Reject Client requests for SSL version 3 |
||
version int |
TLS/SSL version, default is the highest number supported (TLS/SSL version= 30-SSLv3.0, 31-TLSv1.0, 32-TLSv1.1, 33-TLSv1.2 and 34-TLSv1.3) |
||
dgversion int |
Lower TLS/SSL version can be downgraded |
||
renegotiation_disable bool |
Disable SSL renegotiation |
||
sslv2_bypass_service_group str |
Service Group for Bypass SSLV2 (Service Group Name) |
||
authorization bool |
Specify LDAP server for client SSL authorizaiton |
||
authen_name str |
Specify authorization LDAP server name |
||
ldap_base_dn_from_cert bool |
Use Subject DN as LDAP search base DN |
||
ldap_search_filter str |
Specify LDAP search filter |
||
auth_sg str |
Specify authorization LDAP service group |
||
auth_sg_dn bool |
Use Subject DN as LDAP search base DN |
||
auth_sg_filter str |
Specify LDAP search filter |
||
auth_username_attribute str |
Specify attribute name of username for client SSL authorization |
||
non_ssl_bypass_service_group str |
Service Group for Bypass non-ssl traffic (Service Group Name) |
||
non_ssl_bypass_l4session bool |
Handle the non-ssl session as L4 for performance optimization |
||
enable_ssli_ftp_alg int |
Enable SSLi FTP over TLS support at which port |
||
early_data bool |
Enable TLS 1.3 early data (0-RTT) |
||
no_anti_replay bool |
Disable anti-replay protection for TLS 1.3 early data (0-RTT data) |
||
ja3_enable bool |
Enable JA3 features |
||
ja3_insert_http_header str |
Insert the JA3 hash into this request as a HTTP header (HTTP Header Name) |
||
ja3_reject_class_list str |
Drop request if the JA3 hash matches this class-list (type string-case- insensitive) (Class-List Name) |
||
ja3_reject_max_number_per_host int |
Drop request if numbers of JA3 of this client address exceeded |
||
ja3_ttl int |
seconds to keep each JA3 record |
||
uuid str |
uuid of the object |
||
user_tag str |
Customized tag |
||
sampling_enable list |
Field sampling_enable |
||
counters1 str |
‘all’= all; ‘real-estate’= real estate category; ‘computer-and-internet- security’= computer and internet security category; ‘financial-services’= financial services category; ‘business-and-economy’= business and economy category; ‘computer-and-internet-info’= computer and internet info category; ‘auctions’= auctions category; ‘shopping’= shopping category; ‘cult-and- occult’= cult and occult category; ‘travel’= travel category; ‘drugs’= drugs category; ‘adult-and-pornography’= adult and pornography category; ‘home-and- garden’= home and garden category; ‘military’= military category; ‘social- network’= social network category; ‘dead-sites’= dead sites category; ‘stock- advice-and-tools’= stock advice and tools category; ‘training-and-tools’= training and tools category; ‘dating’= dating category; ‘sex-education’= sex education category; ‘religion’= religion category; ‘entertainment-and-arts’= entertainment and arts category; ‘personal-sites-and-blogs’= personal sites and blogs category; ‘legal’= legal category; ‘local-information’= local information category; ‘streaming-media’= streaming media category; ‘job-search’= job search category; ‘gambling’= gambling category; ‘translation’= translation category; ‘reference-and-research’= reference and research category; ‘shareware-and- freeware’= shareware and freeware category; ‘peer-to-peer’= peer to peer category; ‘marijuana’= marijuana category; ‘hacking’= hacking category; ‘games’= games category; ‘philosophy-and-politics’= philosophy and politics category; ‘weapons’= weapons category; ‘pay-to-surf’= pay to surf category; ‘hunting-and-fishing’= hunting and fishing category; ‘society’= society category; ‘educational-institutions’= educational institutions category; ‘online-greeting-cards’= online greeting cards category; ‘sports’= sports category; ‘swimsuits-and-intimate-apparel’= swimsuits and intimate apparel category; ‘questionable’= questionable category; ‘kids’= kids category; ‘hate- and-racism’= hate and racism category; ‘personal-storage’= personal storage category; ‘violence’= violence category; ‘keyloggers-and-monitoring’= keyloggers and monitoring category; ‘search-engines’= search engines category; ‘internet-portals’= internet portals category; ‘web-advertisements’= web advertisements category; ‘cheating’= cheating category; ‘gross’= gross category; ‘web-based-email’= web based email category; ‘malware-sites’= malware sites category; ‘phishing-and-other-fraud’= phishing and other fraud category; ‘proxy-avoid-and-anonymizers’= proxy avoid and anonymizers category; ‘spyware- and-adware’= spyware and adware category; ‘music’= music category; ‘government’= government category; ‘nudity’= nudity category; ‘news-and-media’= news and media category; ‘illegal’= illegal category; ‘CDNs’= content delivery networks category; ‘internet-communications’= internet communications category; ‘bot-nets’= bot nets category; ‘abortion’= abortion category; ‘health-and- medicine’= health and medicine category; ‘confirmed-SPAM-sources’= confirmed SPAM sources category; ‘SPAM-URLs’= SPAM URLs category; ‘unconfirmed-SPAM- sources’= unconfirmed SPAM sources category; ‘open-HTTP-proxies’= open HTTP proxies category; ‘dynamically-generated-content’= dynamically generated content category; ‘parked-domains’= parked domains category; ‘alcohol-and- tobacco’= alcohol and tobacco category; ‘private-IP-addresses’= private IP addresses category; ‘image-and-video-search’= image and video search category; ‘fashion-and-beauty’= fashion and beauty category; ‘recreation-and-hobbies’= recreation and hobbies category; ‘motor-vehicles’= motor vehicles category; ‘web-hosting-sites’= web hosting sites category; ‘food-and-dining’= food and dining category; ‘dummy-item’= dummy item category; ‘self-harm’= self harm category; ‘dns-over-https’= dns over https category; ‘low-thc-cannabis- products’= low-thc cannabis products; ‘generative-ai’= generative ai category; ‘nudity-artistic’= artistic nudity; ‘illegal-pornography’= illegal pornography eg. child sexual abuse; ‘uncategorised’= uncategorised; ‘other-category’= other category; ‘trustworthy’= Trustworthy level(81-100); ‘low-risk’= Low-risk level(61-80); ‘moderate-risk’= Moderate-risk level(41-60); ‘suspicious’= Suspicious level(21-40); ‘malicious’= Malicious level(1-20); |
||
certificate_list list |
Field certificate_list |
||
cert str |
Certificate Name |
||
key str |
Server Private Key (Key Name) |
||
passphrase str |
Password Phrase |
||
key_encrypted str |
Do NOT use this option manually. (This is an A10 reserved keyword.) (The ENCRYPTED password string) |
||
chain_cert str |
Chain Certificate (Chain Certificate Name) |
||
shared bool |
Server Certificate and Key Partition Shared |
||
uuid str |
uuid of the object |
||
oper dict |
Field oper |
||
cert_status_list list |
Field cert_status_list |
||
name str |
Client SSL Template Name |
||
stats dict |
Field stats |
||
real_estate str |
real estate category |
||
computer_and_internet_security str |
computer and internet security category |
||
financial_services str |
financial services category |
||
business_and_economy str |
business and economy category |
||
computer_and_internet_info str |
computer and internet info category |
||
auctions str |
auctions category |
||
shopping str |
shopping category |
||
cult_and_occult str |
cult and occult category |
||
travel str |
travel category |
||
drugs str |
drugs category |
||
adult_and_pornography str |
adult and pornography category |
||
home_and_garden str |
home and garden category |
||
military str |
military category |
||
social_network str |
social network category |
||
dead_sites str |
dead sites category |
||
stock_advice_and_tools str |
stock advice and tools category |
||
training_and_tools str |
training and tools category |
||
dating str |
dating category |
||
sex_education str |
sex education category |
||
religion str |
religion category |
||
entertainment_and_arts str |
entertainment and arts category |
||
personal_sites_and_blogs str |
personal sites and blogs category |
||
legal str |
legal category |
||
local_information str |
local information category |
||
streaming_media str |
streaming media category |
||
job_search str |
job search category |
||
gambling str |
gambling category |
||
translation str |
translation category |
||
reference_and_research str |
reference and research category |
||
shareware_and_freeware str |
shareware and freeware category |
||
peer_to_peer str |
peer to peer category |
||
marijuana str |
marijuana category |
||
hacking str |
hacking category |
||
games str |
games category |
||
philosophy_and_politics str |
philosophy and politics category |
||
weapons str |
weapons category |
||
pay_to_surf str |
pay to surf category |
||
hunting_and_fishing str |
hunting and fishing category |
||
society str |
society category |
||
educational_institutions str |
educational institutions category |
||
online_greeting_cards str |
online greeting cards category |
||
sports str |
sports category |
||
swimsuits_and_intimate_apparel str |
swimsuits and intimate apparel category |
||
questionable str |
questionable category |
||
kids str |
kids category |
||
hate_and_racism str |
hate and racism category |
||
personal_storage str |
personal storage category |
||
violence str |
violence category |
||
keyloggers_and_monitoring str |
keyloggers and monitoring category |
||
search_engines str |
search engines category |
||
internet_portals str |
internet portals category |
||
web_advertisements str |
web advertisements category |
||
cheating str |
cheating category |
||
gross str |
gross category |
||
web_based_email str |
web based email category |
||
malware_sites str |
malware sites category |
||
phishing_and_other_fraud str |
phishing and other fraud category |
||
proxy_avoid_and_anonymizers str |
proxy avoid and anonymizers category |
||
spyware_and_adware str |
spyware and adware category |
||
music str |
music category |
||
government str |
government category |
||
nudity str |
nudity category |
||
news_and_media str |
news and media category |
||
illegal str |
illegal category |
||
CDNs str |
content delivery networks category |
||
internet_communications str |
internet communications category |
||
bot_nets str |
bot nets category |
||
abortion str |
abortion category |
||
health_and_medicine str |
health and medicine category |
||
confirmed_SPAM_sources str |
confirmed SPAM sources category |
||
SPAM_URLs str |
SPAM URLs category |
||
unconfirmed_SPAM_sources str |
unconfirmed SPAM sources category |
||
open_HTTP_proxies str |
open HTTP proxies category |
||
dynamically_generated_content str |
dynamically generated content category |
||
parked_domains str |
parked domains category |
||
alcohol_and_tobacco str |
alcohol and tobacco category |
||
private_IP_addresses str |
private IP addresses category |
||
image_and_video_search str |
image and video search category |
||
fashion_and_beauty str |
fashion and beauty category |
||
recreation_and_hobbies str |
recreation and hobbies category |
||
motor_vehicles str |
motor vehicles category |
||
web_hosting_sites str |
web hosting sites category |
||
food_and_dining str |
food and dining category |
||
self_harm str |
self harm category |
||
dns_over_https str |
dns over https category |
||
low_thc_cannabis_products str |
low-thc cannabis products |
||
generative_ai str |
generative ai category |
||
nudity_artistic str |
artistic nudity |
||
illegal_pornography str |
illegal pornography eg. child sexual abuse |
||
uncategorised str |
uncategorised |
||
other_category str |
other category |
||
trustworthy str |
Trustworthy level(81-100) |
||
low_risk str |
Low-risk level(61-80) |
||
moderate_risk str |
Moderate-risk level(41-60) |
||
suspicious str |
Suspicious level(21-40) |
||
malicious str |
Malicious level(1-20) |
||
name str |
Client SSL Template Name |
Examples
Return Values
- modified_values (changed, dict, )
Values modified (or potential changes if using check_mode) as a result of task operation
- axapi_calls (always, list, )
Sequential list of AXAPI calls made by the task
- endpoint (, str, [‘/axapi/v3/slb/virtual_server’, ‘/axapi/v3/file/ssl-cert’])
The AXAPI endpoint being accessed.
- http_method (, str, [‘POST’, ‘GET’])
HTTP method being used by the primary task to interact with the AXAPI endpoint.
- request_body (, complex, )
Params used to query the AXAPI
- response_body (, complex, )
Response from the AXAPI
Status
This module is not guaranteed to have a backwards compatible interface. [preview]
This module is maintained by community.