Ansible/roles/sophos_customer_koenig_holding_gmbh/tasks/main.yml

---
# Customer-specific firewall policy preserved from the uploaded source.
- name: Update hostname settings
  sophos.sophos_firewall.sfos_admin_settings:
    hostname_settings:
      hostname: '{{ hostname }}'
    state: updated
- name: Netzwerke als IP-Hosts in der Firewall anlegen
  sophos.sophos_firewall.sfos_ip_host:
    name: '{{ item.value.name }}'
    network: '{{ item.value.network }}'
    mask: '{{ item.value.subnetmask }}'
    host_type: network
    state: present
  loop: '{{ network_objects | dict2items }}'
- name: Zonen erstellen
  sophos.sophos_firewall.sfos_zone:
    name: '{{ item.value.zone_name }}'
    description: '{{  item.value.zone_description }}'
    zone_type: '{{ item.value.zone_type }}'
    state: present
  loop: '{{ vlan_interfaces | dict2items }}'
  when: item.value.name != "LAN"
- name: Update Management Zone Admin Services
  sophos.sophos_firewall.sfos_zone:
    name: Management
    https: Enable
    ssh: Enable
    ad_sso: Disable
    captive_portal: Disable
    radius_sso: Disable
    client_authen: Disable
    chromebook_sso: Disable
    ping: Enable
    dns: Enable
    ipsec: Disable
    sslvpn: Disable
    vpn_portal: Disable
    red: Disable
    wireless_protection: Disable
    web_proxy: Disable
    user_portal: Disable
    smtp_relay: Disable
    snmp: Disable
    state: updated
- name: Update Server Zone Admin Services
  sophos.sophos_firewall.sfos_zone:
    name: Server
    https: Enable
    ssh: Disable
    ad_sso: Disable
    captive_portal: Disable
    radius_sso: Disable
    client_authen: Disable
    chromebook_sso: Disable
    ping: Enable
    dns: Enable
    ipsec: Disable
    sslvpn: Disable
    vpn_portal: Disable
    red: Disable
    wireless_protection: Disable
    web_proxy: Disable
    user_portal: Disable
    smtp_relay: Disable
    snmp: Disable
    state: updated
- name: Update Guest Zone Admin Services
  sophos.sophos_firewall.sfos_zone:
    name: Guest
    https: Disable
    ssh: Disable
    ad_sso: Disable
    captive_portal: Disable
    radius_sso: Disable
    client_authen: Disable
    chromebook_sso: Disable
    ping: Enable
    dns: Enable
    ipsec: Disable
    sslvpn: Disable
    vpn_portal: Disable
    red: Disable
    wireless_protection: Disable
    web_proxy: Disable
    user_portal: Disable
    smtp_relay: Disable
    snmp: Disable
    state: updated
- name: Update Facility Zone Admin Services
  sophos.sophos_firewall.sfos_zone:
    name: Facility
    https: Disable
    ssh: Disable
    ad_sso: Disable
    captive_portal: Disable
    radius_sso: Disable
    client_authen: Disable
    chromebook_sso: Disable
    ping: Enable
    dns: Enable
    ipsec: Disable
    sslvpn: Disable
    vpn_portal: Disable
    red: Disable
    wireless_protection: Disable
    web_proxy: Disable
    user_portal: Disable
    smtp_relay: Disable
    snmp: Disable
    state: updated
- name: Update VOIP Zone Admin Services
  sophos.sophos_firewall.sfos_zone:
    name: VOIP
    https: Disable
    ssh: Disable
    ad_sso: Disable
    captive_portal: Disable
    radius_sso: Disable
    client_authen: Disable
    chromebook_sso: Disable
    ping: Enable
    dns: Enable
    ipsec: Disable
    sslvpn: Disable
    vpn_portal: Disable
    red: Disable
    wireless_protection: Disable
    web_proxy: Disable
    user_portal: Disable
    smtp_relay: Disable
    snmp: Disable
    state: updated
- name: Add VLAN Interfaces
  sophos.sophos_firewall.sfos_xmlapi:
    xml_tag: VLAN
    data: |
      <VLAN>
          <Name>{{ item.value.name }}</Name>
          <Hardware>Port1</Hardware>
          <Interface>Port1</Interface>
          <Zone>{{ item.value.zone_name }}</Zone>
          <VLANID>{{ item.value.vlan_id }}</VLANID>
          <IPv4Configuration>Enable</IPv4Configuration>
          <IPv4Assignment>Static</IPv4Assignment>
          <IPAddress>{{ item.value.ip_address }}</IPAddress>
          <Netmask>{{ item.value.subnetmask }}</Netmask>
      </VLAN>
    state: present
  loop: '{{ vlan_interfaces | dict2items }}'
  loop_control:
    label: '{{ item.key }} -> VLAN {{ item.value.vlan_id }}'
- name: Erstelle 'LAN_to_WAN' Firewall-Regel
  sophos.sophos_firewall.sfos_firewall_rule:
    name: LAN_to_WAN
    action: accept
    description: Erlaubt Zugriff von LAN auf WAN
    log: enable
    status: enable
    position: bottom
    src_zones:
      - LAN
    dst_zones:
      - WAN
    src_networks:
      - '{{ network_objects.office.name }}'
    dst_networks:
      - Any
    service_list:
      - Any
    state: present
- name: Erstelle 'Server_to_WAN' Firewall-Regel
  sophos.sophos_firewall.sfos_firewall_rule:
    name: Server_to_WAN
    action: accept
    description: Erlaubt Zugriff von Server auf WAN
    log: enable
    status: enable
    position: bottom
    src_zones:
      - Server
    dst_zones:
      - WAN
    src_networks:
      - '{{ network_objects.server.name }}'
    dst_networks:
      - Any
    service_list:
      - Any
    state: present
- name: Erstelle 'Management_to_WAN' Firewall-Regel
  sophos.sophos_firewall.sfos_firewall_rule:
    name: Management_to_WAN
    action: accept
    description: Erlaubt Zugriff von Management auf WAN
    log: enable
    status: enable
    position: bottom
    src_zones:
      - Management
    dst_zones:
      - WAN
    src_networks:
      - '{{ network_objects.management.name }}'
    dst_networks:
      - Any
    service_list:
      - Any
    state: present
- name: Erstelle 'Guest_to_WAN' Firewall-Regel
  sophos.sophos_firewall.sfos_firewall_rule:
    name: Guest_to_WAN
    action: accept
    description: Erlaubt Zugriff von Guest auf WAN
    log: enable
    status: enable
    position: bottom
    src_zones:
      - Guest
    dst_zones:
      - WAN
    src_networks:
      - '{{ network_objects.guest.name }}'
    dst_networks:
      - Any
    service_list:
      - Any
    state: present
- name: Erstelle 'Facility_to_WAN' Firewall-Regel
  sophos.sophos_firewall.sfos_firewall_rule:
    name: Facility_to_WAN
    action: accept
    description: Erlaubt Zugriff von Facility auf WAN
    log: enable
    status: enable
    position: bottom
    src_zones:
      - Facility
    dst_zones:
      - WAN
    src_networks:
      - '{{ network_objects.facility.name }}'
    dst_networks:
      - Any
    service_list:
      - Any
    state: present
- name: Erstelle 'VOIP_to_WAN' Firewall-Regel
  sophos.sophos_firewall.sfos_firewall_rule:
    name: VOIP_to_WAN
    action: accept
    description: Erlaubt Zugriff von VOIP auf WAN
    log: enable
    status: enable
    position: bottom
    src_zones:
      - VOIP
    dst_zones:
      - WAN
    src_networks:
      - '{{ network_objects.voip.name }}'
    dst_networks:
      - Any
    service_list:
      - Any
    state: present
- name: Erstelle 'LAN_to_Management' Firewall-Regel
  sophos.sophos_firewall.sfos_firewall_rule:
    name: LAN_to_Management
    action: accept
    description: Erlaubt Zugriff von LAN auf Management
    log: enable
    status: disable
    position: bottom
    src_zones:
      - LAN
    dst_zones:
      - Management
    src_networks:
      - '{{ network_objects.office.name }}'
    dst_networks:
      - '{{ network_objects.management.name }}'
    service_list:
      - Any
    state: present
- name: Erstelle 'LAN_to_Server' Firewall-Regel
  sophos.sophos_firewall.sfos_firewall_rule:
    name: LAN_to_Server
    action: accept
    description: Erlaubt Zugriff von LAN auf Server
    log: enable
    status: enable
    position: bottom
    src_zones:
      - LAN
    dst_zones:
      - Server
    src_networks:
      - '{{ network_objects.office.name }}'
    dst_networks:
      - '{{ network_objects.server.name }}'
    service_list:
      - Any
    state: present
- name: Erstelle 'LAN_to_Facility' Firewall-Regel
  sophos.sophos_firewall.sfos_firewall_rule:
    name: LAN_to_Facility
    action: accept
    description: Erlaubt Zugriff von LAN auf Facility
    log: enable
    status: enable
    position: bottom
    src_zones:
      - LAN
    dst_zones:
      - Facility
    src_networks:
      - '{{ network_objects.office.name }}'
    dst_networks:
      - '{{ network_objects.facility.name }}'
    service_list:
      - Any
    state: present
- name: Erstelle 'LAN_to_VOIP' Firewall-Regel
  sophos.sophos_firewall.sfos_firewall_rule:
    name: LAN_to_VOIP
    action: accept
    description: Erlaubt Zugriff von LAN auf VOIP
    log: enable
    status: enable
    position: bottom
    src_zones:
      - LAN
    dst_zones:
      - VOIP
    src_networks:
      - '{{ network_objects.office.name }}'
    dst_networks:
      - '{{ network_objects.voip.name }}'
    service_list:
      - Any
    state: present
- name: Erstelle 'X to Management' Firewall-Regel Gruppe
  sophos.sophos_firewall.sfos_firewall_rulegroup:
    name: X to Management
    description: Zugriff auf Management-Netz
    policy_list:
      - LAN_to_Management
    policy_type: Any
    source_zones:
      - Any
    dest_zones:
      - Management
    state: present
- name: Erstelle 'X to Server' Firewall-Regel Gruppe
  sophos.sophos_firewall.sfos_firewall_rulegroup:
    name: X to Server
    description: Zugriff auf Server-Netz
    policy_list:
      - LAN_to_Server
    policy_type: Any
    source_zones:
      - Any
    dest_zones:
      - Server
    state: present
- name: Erstelle 'X to Facility' Firewall-Regel Gruppe
  sophos.sophos_firewall.sfos_firewall_rulegroup:
    name: X to Facility
    description: Zugriff auf Facility-Netz
    policy_list:
      - LAN_to_Facility
    policy_type: Any
    source_zones:
      - Any
    dest_zones:
      - Facility
    state: present
- name: Erstelle 'X to VOIP' Firewall-Regel Gruppe
  sophos.sophos_firewall.sfos_firewall_rulegroup:
    name: X to VOIP
    description: Zugriff auf VOIP-Netz
    policy_list:
      - LAN_to_VOIP
    policy_type: Any
    source_zones:
      - Any
    dest_zones:
      - VOIP
    state: present
- name: Erstelle 'X to WAN' Firewall-Regel Gruppe
  sophos.sophos_firewall.sfos_firewall_rulegroup:
    name: X to WAN
    description: X to WAN group
    policy_list:
      - LAN_to_WAN
      - Server_to_WAN
      - Management_to_WAN
      - Guest_to_WAN
      - Facility_to_WAN
      - VOIP_to_WAN
    policy_type: Any
    source_zones:
      - Any
    dest_zones:
      - WAN
    state: present