sophos.sophos_firewall.sfos_web_policy module – Manage Web Filter Policies (Protect > Web > Policies)
Note
This module is part of the sophos.sophos_firewall collection (version 2.3.1).
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install sophos.sophos_firewall.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: sophos.sophos_firewall.sfos_web_policy.
New in sophos.sophos_firewall 2.3.0
Synopsis
Manage Web Filter Policies (Protect > Web > Policies) on Sophos Firewall
Requirements
The below requirements are needed on the host that executes this module.
sophosfirewall-python
Beginning in version 2.0.0, this module requires use of an httpapi connection plugin. See the HTTPAPI example for details.
Parameters
Parameter |
Comments |
|---|---|
Default action of the policy. Choices:
|
|
Specify Policy description. Max 255 chars. |
|
Specify maximum allowed file download size in MB (0-1536). Default: |
|
Enable or disable checking for maximum allowed file download size. Choices:
|
|
Select to enable reporting of policy. Choices:
|
|
Enable or disable limiting search results to Creative Commons licensed images. Choices:
|
|
Enable or disable blocking of pornography and explicit content in search results. Choices:
|
|
Comma-separated list of domains allowed to access Google services. Max 256 chars. |
|
Enable or disable specifying domains for Google services. Choices:
|
|
Specify a name for the Web Filter Policy. |
|
Domain ID allowed to access the Microsoft 365 service. Max 50 chars. |
|
Turn on or off specifying domains/IDs for Microsoft 365. Choices:
|
|
Comma-separated list of domain names and domain IDs allowed to access Microsoft 365. Max 4096 chars. |
|
Maximum allowed time (1-1440 minutes) for browsing restricted web content under quota policy action. Default: |
|
Action for rules when updating policies (‘add’ or ‘replace’). To remove rules, use ‘replace’ with the new complete list. Choices:
|
|
Specify the rules contained in this policy. |
|
List of rule categories. |
|
Category Name. |
|
Category type. Choices:
|
|
Enable or disable CCL rule. Choices:
|
|
Enable or disable following HTTP action. Choices:
|
|
HTTP action. Choices:
|
|
HTTPS action. Choices:
|
|
Enable or disable the policy rule. Choices:
|
|
Schedule name. Default: |
|
List of users to which the policy applies. Default: |
|
Use Choices:
|
|
Enable or disable X-Forwarded-For header. Choices:
|
|
Enable or disable YouTube Restricted Mode. Choices:
|
|
Adjust the policy used for YouTube Restricted Mode (true for strict, false for moderate). Choices:
|
Examples
- name: Create Web Filter Policy with basic settings
sophos.sophos_firewall.sfos_web_policy:
name: "Corporate Policy"
default_action: "Allow"
enable_reporting: "Enable"
description: "Corporate web filtering policy"
state: present
- name: Create Web Filter Policy with file size restriction
sophos.sophos_firewall.sfos_web_policy:
name: "Corporate Policy with Size Limit"
default_action: "Allow"
download_file_size_restriction: 100
enable_reporting: "Enable"
description: "Corporate web filtering policy with 100MB file size limit"
state: present
- name: Create Web Filter Policy with advanced settings
sophos.sophos_firewall.sfos_web_policy:
name: "Strict Policy"
default_action: "Deny"
download_file_size_restriction: 50
enable_reporting: "Enable"
download_file_size_restriction_enabled: true
youtube_filter_enabled: true
youtube_filter_is_strict: true
enforce_safe_search: true
enforce_image_licensing: true
quota_limit: 30
description: "Strict web filtering policy with content restrictions"
state: present
- name: Create Web Filter Policy with rules
sophos.sophos_firewall.sfos_web_policy:
name: "Business Policy"
default_action: "Allow"
download_file_size_restriction: 200
enable_reporting: "Enable"
description: "Business policy with category rules"
rules:
- categories:
- id: "Social Networking"
type: "WebCategory"
- id: "Gaming"
type: "WebCategory"
http_action: "Deny"
https_action: "Deny"
schedule: "Business Hours"
policy_rule_enabled: true
user_list:
- "Guest Group"
- "Unknown Users"
- categories:
- id: "Document Files"
type: "FileType"
http_action: "Allow"
https_action: "Allow"
policy_rule_enabled: true
state: present
- name: Create Web Filter Policy with Office 365 and Google settings
sophos.sophos_firewall.sfos_web_policy:
name: "Cloud Services Policy"
default_action: "Allow"
download_file_size_restriction: 500
enable_reporting: "Enable"
goog_app_domain_list: "example.com,test.org"
goog_app_domain_list_enabled: true
office_365_tenants_list: "tenant1.onmicrosoft.com,tenant2.onmicrosoft.com"
office_365_directory_id: "12345678-1234-1234-1234-123456789012"
office_365_enabled: true
xff_enabled: true
description: "Policy for cloud services access"
state: present
- name: Query Web Filter Policy
sophos.sophos_firewall.sfos_web_policy:
name: "Corporate Policy"
state: query
- name: Update Web Filter Policy
sophos.sophos_firewall.sfos_web_policy:
name: "Corporate Policy"
default_action: "Deny"
download_file_size_restriction: 75
description: "Updated corporate policy"
state: updated
- name: Update Web Filter Policy and replace all rules
sophos.sophos_firewall.sfos_web_policy:
name: "Business Policy"
description: "Updated business policy with new rules"
rules:
- categories:
- id: "Entertainment"
type: "WebCategory"
http_action: "Deny"
https_action: "Deny"
policy_rule_enabled: true
rule_action: "replace"
state: updated
- name: Update Web Filter Policy and add additional rules
sophos.sophos_firewall.sfos_web_policy:
name: "Business Policy"
description: "Business policy with additional rules"
rules:
- categories:
- id: "Video Files"
type: "FileType"
http_action: "Allow"
https_action: "Allow"
policy_rule_enabled: true
rule_action: "add"
state: updated
- name: Remove Web Filter Policy
sophos.sophos_firewall.sfos_web_policy:
name: "Corporate Policy"
state: absent
Return Values
Common return values are documented here, the following are the fields unique to this module:
Key |
Description |
|---|---|
Serialized object containing the API response. Returned: always |
Collection links
Warning
If the firewall is a member of a group in Central, the changes made by Ansible will override the settings of the group. The actual configuration on the firewall may then differ from what is displayed for the same setting in the Central group.