zscaler.ziacloud.zia_advanced_settings module – Updates the advanced settings configuration in the ZIA Admin Portal
Note
This module is part of the zscaler.ziacloud collection (version 2.0.4).
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install zscaler.ziacloud.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: zscaler.ziacloud.zia_advanced_settings.
New in zscaler.ziacloud 2.0.0
Synopsis
Updates the advanced settings configuration in the ZIA Admin Portal
Requirements
The below requirements are needed on the host that executes this module.
Zscaler SDK Python can be obtained from PyPI https://pypi.org/project/zscaler-sdk-python/
Parameters
Parameter |
Comments |
|---|---|
A string that contains the obfuscated API key. |
|
Cloud applications that are exempted from cookie authentication |
|
URL categories that are exempted from cookie authentication |
|
Custom URLs that are exempted from cookie authentication for users |
|
Cloud applications that are exempted from Basic authentication |
|
URL categories that are exempted from Basic authentication |
|
Indicates whether CONNECT host and SNI mismatch i.e., CONNECT host doesn’t match the SSL/TLS client hello SNI is blocked or not Choices:
|
|
Applications that are exempted from domain fronting |
|
A Boolean value indicating whether to block HTTP and HTTPS transactions that have an FQDN mismatch Choices:
|
|
A Boolean value indicating whether HTTP CONNECT method requests to non-standard ports are allowed or not i.e., requests directed to ports other than the standard HTTP and HTTPS ports, 80 and 443 Choices:
|
|
Indicates whether to allow or block traffic that is not compliant with RFC HTTP protocol standards Choices:
|
|
Indicates whether non-HTTP Traffic on HTTP and HTTPS ports are allowed or blocked Choices:
|
|
Indicates whether to apply the URL Filtering policy even when the Cloud App Control policy already allows a transaction explicitly Choices:
|
|
The client ID for OAuth2 authentication. |
|
The client secret for OAuth2 authentication. |
|
The Zscaler cloud name provisioned for your organization. Choices:
|
|
Cloud applications that are exempted from Digest authentication |
|
URL categories that are exempted from Digest authentication |
|
Custom URLs that are exempted from Digest authentication |
|
Cloud applications to which DNS optimization on transparent proxy mode applies |
|
Cloud applications that are excluded from DNS optimization on transparent proxy mode |
|
URL categories that are excluded from DNS optimization on transparent proxy mode |
|
URLs that are excluded from DNS optimization on transparent proxy mode |
|
Cloud applications to which DNS optimization for IPv6 addresses on transparent proxy mode applies |
|
Cloud applications that are excluded from DNS optimization for IPv6 addresses on transparent proxy mode |
|
IPv6 URL categories that are excluded from DNS optimization on transparent proxy mode |
|
IPv6 URL categories to which DNS optimization on transparent proxy mode applies |
|
URL categories to which DNS optimization on transparent proxy mode applies |
|
URLs to which DNS optimization on transparent proxy mode applies |
|
URL categories that are exempted from domain fronting |
|
Indicates whether to dynamically update user risk score by tracking risky user activities in real time Choices:
|
|
Indicates whether or not to include the ECS option in all DNS queries, originating from all locations and remote users. Choices:
|
|
The ECS prefix that must be used in DNS queries when the ECS option is enabled. |
|
The ECS external ID. |
|
The internal ECS ID. |
|
The ECS name. |
|
Indicates whether ranks are enabled for admins to allow admin ranks in policy configuration and management Choices:
|
|
whether DNS optimization is enabled or disabled for Z-Tunnel 2.0 and transparent proxy mode traffic e.g., traffic via GRE or IPSec tunnels without a PAC file. Choices:
|
|
Indicates whether policy evaluation for global SSL bypass traffic is enabled or not Choices:
|
|
Indicates whether DNS optimization is enabled or disabled for all IPv6 transparent proxy traffic Choices:
|
|
whether DNS optimization is enabled or disabled for IPv6 traffic sent via Z-Tunnel 2.0 and transparent proxy mode traffic e.g., traffic via GRE or IPSec tunnels without a PAC file. Choices:
|
|
A Boolean value indicating whether Microsoft Office 365 One Click Configuration is enabled or not Choices:
|
|
Indicates whether policies that include user and department criteria can be configured and applied for unauthenticated traffic Choices:
|
|
Enforce Surrogate IP authentication for Windows app traffic Choices:
|
|
Indicates whether or not HTTP/2 should be the default web protocol for accessing various applications at your organizational level Choices:
|
|
URL categories for which HTTP range headers must be removed |
|
Cloud applications that are exempted from Kerberos authentication |
|
URL categories that are exempted from Kerberos authentication |
|
Custom URLs that are exempted from Kerberos authentication |
|
A Boolean value indicating whether to log internal IP address present in X-Forwarded-For (XFF) proxy header or not Choices:
|
|
A string that contains the password for the API admin. |
|
Indicates whether or not to use the SSL/TLS client hello Server Name Indication SNI for DNS resolution instead of the CONNECT host for forward proxy connections Choices:
|
|
Applications that are exempted from the preferSniOverConnHost setting |
|
The private key for JWT-based OAuth2 authentication. |
|
A dict containing authentication credentials. |
|
Obfuscated API key. |
|
OAuth2 client ID. |
|
OAuth2 client secret. |
|
Zscaler cloud name. Choices:
|
|
Password for the API admin. |
|
Private key for OAuth2 JWT. |
|
Sandbox Cloud environment. |
|
Sandbox API Key. |
|
Whether to use the legacy Zscaler API client. Choices:
|
|
Email ID of the API admin. |
|
Vanity domain for OAuth2. |
|
The Sandbox cloud environment for API access. |
|
A string that contains the Sandbox API Key. |
|
Indicates whether or not to insert XFF header to all traffic forwarded from ZIA to ZPA Including source IP-anchored and ZIA-inspected ZPA application traffic. Choices:
|
|
URL categories that are excluded from the preferSniOverConnHost setting i.e., prefer SSL/TLS client hello SNI for DNS resolution instead of the CONNECT host for forward proxy connections |
|
Specifies the desired state of the resource. Choices:
|
|
A Boolean value indicating whether to apply configured policies on tunneled HTTP traffic sent via a CONNECT method request on port 80 Choices:
|
|
Specifies the login session timeout for admins accessing the ZIA Admin Portal |
|
Whether to use the legacy Zscaler API client. Choices:
|
|
A string that contains the email ID of the API admin. |
|
The vanity domain provisioned by Zscaler for OAuth2 flows. |
|
Indicates whether to apply the Firewall rules configured without a specified location criteria or with the Road Warrior location to remote user traffic forwarded via Z-Tunnel 1.0 or PAC files Choices:
|
Notes
Note
Check mode is not supported.
Examples
- name: Gather Information Details of a cloud application control rule by Name
zscaler.ziacloud.zia_cloud_app_control_rules_info:
provider: '{{ provider }}'
auth_bypass_urls:
- ".newexample1.com"
- ".newexample2.com"
dns_resolution_on_transparent_proxy_apps:
- "CHATGPT_AI"
basic_bypass_url_categories:
- "NONE"
http_range_header_remove_url_categories:
- "NONE"
kerberos_bypass_urls:
- "test1.com"
kerberos_bypass_apps: []
dns_resolution_on_transparent_proxy_urls:
- "test1.com"
- "test2.com"
enable_dns_resolution_on_transparent_proxy: true
enable_evaluate_policy_on_global_ssl_bypass: true
enable_office365: true
log_internal_ip: true
enforce_surrogate_ip_for_windows_app: true
track_http_tunnel_on_http_ports: true
block_http_tunnel_on_non_http_ports: false
block_domain_fronting_on_host_header: false
zscaler_client_connector1_and_pac_road_warrior_in_firewall: true
cascade_url_filtering: true
enable_policy_for_unauthenticated_traffic: true
block_non_compliant_http_request_on_http_ports: true
enable_admin_rank_access: true
http2_nonbrowser_traffic_enabled: true
ecs_for_all_enabled: false
dynamic_user_risk_enabled: false
block_connect_host_sni_mismatch: false
prefer_sni_over_conn_host: false
sipa_xff_header_enabled: false
block_non_http_on_http_port_enabled: true
ui_session_timeout: 300
Return Values
Common return values are documented here, the following are the fields unique to this module:
Key |
Description |
|---|---|
A list of cloud application control rules that match the specified criteria. Returned: always Sample: |