I've got an Ansible playbook I'm using to do SNMP user operations on FortiGates using the with_subelements module. I tried using a loop, but that was exhibiting some very bizarre behavior (outlined in another question here). For some reason, I can't seem to get it to parse and execute properly. You can see the JSON info in the console error outputs where "meta" is the top level element. Do I need to convert the JSON data into a different format? Am I using the wrong syntax? Is what I'm trying to do just not going to work this way?
This is running on RHEL 9.4, Ansible 9.7, and Python 3.11.7. host_pinned is the strategy.
The code is pretty straightforward. It first does an API call to get all the SNMP user info. Then, it should use with_subelements to go through the output and remove any SNMP users not matching the conditional, i.e. standard users.
PLAYBOOK #1:
- name: Gather SNMP info
fortinet.fortios.fortios_json_generic:
vdom: "root"
json_generic:
method: "GET"
path: "/api/v2/cmdb/system.snmp/user"
register: snmp_output
- name: Remove non-standard usernames from FortiGate devices
fortinet.fortios.fortios_system_snmp_user:
vdom: "root"
state: "absent"
system_snmp_user:
name: "{{ item.1 }}"
with_subelements:
- "{{ snmp_output | default([]) }}"
- "{{ meta.results.name }}"
when:
- item.1 != "test1"
- item.1 != "test2"
This code yields the below output and corresponding error. Note how the error message starts flowing into the task before it, which may or may not be the console being weird though this behavior has been consistent.
***EDIT: Added in debug of snmp_output for added reference
WITH_SUBELEMENTS ERROR #1:
TASK [Gather SNMP info] ********************************************************
changed: [firewall1] => changed=true
meta:
build: 1577
http_method: GET
http_status: 200
matched_count: 2
name: user
next_idx: 1
path: system.snmp
results:
- auth-proto: sha
auth-pwd: ENC XXXX
events: cpu-high mem-low log-full intf-ip vpn-tun-up vpn-tun-down ha-switch ha-hb-failure ips-signature ips-anomaly av-virus av-oversize av-pattern av-fragmented fm-if-change bgp-established bgp-backward-transition ha-member-up ha-member-down ent-conf-change av-conserve av-bypass av-oversize-passed av-oversize-blocked ips-pkg-update ips-fail-open temperature-high voltage-alert power-supply-failure faz-disconnect wc-ap-up wc-ap-down fswctl-session-up fswctl-session-down load-balance-real-server-down per-cpu-high dhcp pool-usage ospf-nbr-state-change ospf-virtnbr-state-change
ha-direct: enable
mib-view: ''
name: test1
notify-hosts: XXXX
notify-hosts6: ''
priv-proto: aes
priv-pwd: ENC XXXX
q_origin_key: test1
queries: enable
query-port: 161
security-level: auth-priv
source-ip: 0.0.0.0
source-ipv6: '::'
status: enable
trap-lport: 162
trap-rport: 162
trap-status: disable
vdoms: []
- auth-proto: sha
auth-pwd: ENC XXXX
events: cpu-high mem-low log-full intf-ip vpn-tun-up vpn-tun-down ha-switch ha-hb-failure ips-signature ips-anomaly av-virus av-oversize av-pattern av-fragmented fm-if-change bgp-established bgp-backward-transition ha-member-up ha-member-down ent-conf-change av-conserve av-bypass av-oversize-passed av-oversize-blocked ips-pkg-update ips-fail-open temperature-high voltage-alert power-supply-failure faz-disconnect wc-ap-up wc-ap-down fswctl-session-up fswctl-session-down load-balance-real-server-down per-cpu-high dhcp pool-usage ospf-nbr-state-change ospf-virtnbr-state-change
ha-direct: enable
mib-view: ''
name: test2
notify-hosts: XXXX
notify-hosts6: ''
priv-proto: aes
priv-pwd: ENC XXXX
q_origin_key: test2
queries: enable
query-port: 161
security-level: auth-priv
source-ip: 0.0.0.0
source-ipv6: '::'
status: enable
trap-lport: 162
trap-rport: 162
trap-status: disable
vdoms: []
revision: XXXX
serial: XXXX
size: 2
status: success
vdom: root
version: v7.2.7
The conditional check 'item.1 != "test1"' failed. The error was: error while evaluating conditional (item.1 != "test1"): 'item' is undefined. 'item' is undefined
The error appears to be in '/home/svc-acct/_work/7/s/ansible/import_tasks/FortiOS_snmp_update-task.yml': line 61, column 3, but may
be elsewhere in the file depending on the exact syntax problem.
The offending line appears to be:
- name: Remove non-standard usernames from FortiGate devices
^ here
TASK [Debug snmp_output register] **************************************************
ok: [firewall1] =>
msg: 'Contents of snmp_output: {''changed'': True, ''meta'': {''http_method'': ''GET'', ''size'': 2, ''matched_count'': 2, ''next_idx'': 1, ''revision'': ''XXXX'', ''results'': [{''name'': ''test1'', ''q_origin_key'': ''test1'', ''status'': ''enable'', ''trap-status'': ''disable'', ''trap-lport'': 162, ''trap-rport'': 162, ''queries'': ''enable'', ''query-port'': 161, ''notify-hosts'': ''XXXX'', ''notify-hosts6'': '''', ''source-ip'': ''0.0.0.0'', ''source-ipv6'': ''::'', ''ha-direct'': ''enable'', ''events'': ''cpu-high mem-low log-full intf-ip vpn-tun-up vpn-tun-down ha-switch ha-hb-failure ips-signature ips-anomaly av-virus av-oversize av-pattern av-fragmented fm-if-change bgp-established bgp-backward-transition ha-member-up ha-member-down ent-conf-change av-conserve av-bypass av-oversize-passed av-oversize-blocked ips-pkg-update ips-fail-open temperature-high voltage-alert power-supply-failure faz-disconnect wc-ap-up wc-ap-down fswctl-session-up
fswctl-session-down load-balance-real-server-down per-cpu-high dhcp pool-usage ospf-nbr-state-change ospf-virtnbr-state-change'', ''mib-view'': '''', ''vdoms'': [], ''security-level'': ''auth-priv'', ''auth-proto'': ''sha'', ''auth-pwd'': ''ENC XXXX'', ''priv-proto'': ''aes'', ''priv-pwd'': ''ENC XXXX''}, {''name'': ''test2'', ''q_origin_key'': ''test2'', ''status'': ''enable'', ''trap-status'': ''disable'', ''trap-lport'': 162, ''trap-rport'': 162, ''queries'': ''enable'', ''query-port'': 161, ''notify-hosts'': ''XXXX'', ''notify-hosts6'': '''', ''source-ip'': ''0.0.0.0'', ''source-ipv6'': ''::'', ''ha-direct'': ''enable'', ''events'': ''cpu-high mem-low log-full intf-ip vpn-tun-up vpn-tun-down ha-switch ha-hb-failure ips-signature ips-anomaly av-virus av-oversize av-pattern av-fragmented fm-if-change bgp-established bgp-backward-transition ha-member-up ha-member-down ent-conf-change av-conserve
av-bypass av-oversize-passed av-oversize-blocked ips-pkg-update ips-fail-open temperature-high voltage-alert power-supply-failure faz-disconnect wc-ap-up wc-ap-down fswctl-session-up fswctl-session-down load-balance-real-server-down per-cpu-high dhcp pool-usage ospf-nbr-state-change ospf-virtnbr-state-change'', ''mib-view'': '''', ''vdoms'': [], ''security-level'': ''auth-priv'', ''auth-proto'': ''sha'', ''auth-pwd'': ''ENC XXXX'', ''priv-proto'': ''aes'', ''priv-pwd'': ''ENC XXXX''}], ''vdom'': ''root'', ''path'': ''system.snmp'', ''name'': ''user'', ''status'': ''success'', ''http_status'': 200, ''serial'': ''XXXX'', ''version'': ''v7.2.7'', ''build'': 1577}, ''failed'': False}'
TASK [Remove non-standard usernames from FortiGate devices] ********************
fatal: [firewall1]: FAILED! =>
msg: '''meta'' is undefined. ''meta'' is undefined'
TASK [Log failure and rescue] **************************************************
ok: [firewall1] =>
msg: firewall1 has experienced a failure
TASK [ansible.builtin.lineinfile] **********************************************
changed: [firewall1] => changed=true
backup: ''
msg: line added
PLAY RECAP *********************************************************************
firewall1 : ok=4 changed=2 unreachable=0 failed=0 skipped=0 rescued=1 ignored=0
If I tweak the with_subelements parameters a bit, I have the following (Gather SNMP info task output omitted from subsequent examples):
PLAYBOOK #2:
- name: Gather SNMP info
fortinet.fortios.fortios_json_generic:
vdom: "root"
json_generic:
method: "GET"
path: "/api/v2/cmdb/system.snmp/user"
register: snmp_output
- name: Remove non-standard usernames from FortiGate devices
fortinet.fortios.fortios_system_snmp_user:
vdom: "root"
state: "absent"
system_snmp_user:
name: "{{ item.1 }}"
with_subelements:
- "{{ snmp_output.meta.results | default([]) }}"
- name
when:
- item.1 != "test1"
- item.1 != "test2"
WITH_SUBELEMENTS ERROR #2:
TASK [Remove non-standard usernames from FortiGate devices] ********************
fatal: [uslb1m01fwl01-01]: FAILED! =>
msg: the key name should point to a list, got 'CPR-CTL-RO'
If I try a little differently, I get:
PLAYBOOK #3:
- name: Gather SNMP info
fortinet.fortios.fortios_json_generic:
vdom: "root"
json_generic:
method: "GET"
path: "/api/v2/cmdb/system.snmp/user"
register: snmp_output
- name: Remove non-standard usernames from FortiGate devices
fortinet.fortios.fortios_system_snmp_user:
vdom: "root"
state: "absent"
system_snmp_user:
name: "{{ item.1 }}"
with_subelements:
- "{{ snmp_output.meta | default([]) }}"
- name
when:
- item.1 != "test1"
- item.1 != "test2"
WITH_SUBELEMENTS ERROR #3:
TASK [Remove non-standard usernames from FortiGate devices] ********************
fatal: [firewall1]: FAILED! =>
msg: subelements lookup expects a dictionary, got 'test1'
And one last try...
PLAYBOOK #4:
- name: Gather SNMP info
fortinet.fortios.fortios_json_generic:
vdom: "root"
json_generic:
method: "GET"
path: "/api/v2/cmdb/system.snmp/user"
register: snmp_output
- name: Remove non-standard usernames from FortiGate devices
fortinet.fortios.fortios_system_snmp_user:
vdom: "root"
state: "absent"
system_snmp_user:
name: "{{ item.1 }}"
with_subelements:
- "{{ snmp_output.meta | default([]) }}"
- results.name
when:
- item.1 != "test1"
- item.1 != "test2"
WITH_SUBELEMENTS ERROR #4:
TASK [Remove non-standard usernames from FortiGate devices] ********************
fatal: [firewall1]: FAILED! =>
msg: subelements lookup expects a dictionary, got 'GET'
INVENTORY FILE SAMPLE:
inventory:
children:
lab:
#
lab:
hosts:
switch1:
ansible_host: 10.1.2.2
ansible_network_os: cisco.ios.ios
ansible_connection: ansible.netcommon.network_cli
#
firewall1:
ansible_host: 10.1.2.3
ansible_network_os: fortinet.fortios.fortios
ansible_connection: ansible.netcommon.httpapi
ansible_httpapi_use_ssl: yes
ansible_httpapi_validate_certs: no
ansible_httpapi_port: 4443
Let me know if any other info might be needed or is helpful. Thanks in advance!!!
Unless I totally missed the goal of your playbook, based on your first task output and the collected information, there's absolutely no need to use a subelements lookup here:
- name: Remove non-standard usernames from FortiGate devices
fortinet.fortios.fortios_system_snmp_user:
vdom: "root"
state: "absent"
system_snmp_user:
name: "{{ item.name }}"
loop: "{{ snmp_output.meta.results | default([]) }}"
when: item.name not in ["test1", "test2"]