From d603765acb7747aec49e1f5b20884ac07bcf0cd8 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Tue, 9 Jun 2026 20:04:24 -0700 Subject: [PATCH 01/21] refactor: merge 3 SLE tools into unified mist_get_sle Consolidate mist_get_org_sle, mist_get_org_sites_sle, and mist_get_site_sle into a single mist_get_sle tool with a sle_scope parameter (org|org_sites|site). - All original parameters and API calls preserved - mist_list_site_sle_info kept separate (metadata tool) - Updated tool_helper.py and README.md references Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- README.md | 2 +- src/mistmcp/tool_helper.py | 4 +- src/mistmcp/tools/get_org_sites_sle.py | 93 ----- src/mistmcp/tools/get_org_sle.py | 90 ----- src/mistmcp/tools/get_site_sle.py | 311 ---------------- src/mistmcp/tools/get_sle.py | 485 +++++++++++++++++++++++++ 6 files changed, 487 insertions(+), 498 deletions(-) delete mode 100644 src/mistmcp/tools/get_org_sites_sle.py delete mode 100644 src/mistmcp/tools/get_org_sle.py delete mode 100644 src/mistmcp/tools/get_site_sle.py create mode 100644 src/mistmcp/tools/get_sle.py diff --git a/README.md b/README.md index 2e12583..c5d3536 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ The server exposes a focused set of tools grouped by workflow. This is the quick | Configuration read | `mist_get_configuration_objects`, `mist_get_configuration_object_schema`, `mist_search_device_config_history` | Inspect org or site configuration, discover valid schema fields, and review recent configuration history on devices. | | Configuration changes | `mist_update_configuration_objects`, `mist_change_configuration_objects` | Create, update, and delete supported configuration objects. These tools require `--enable-write-tools`. | | Monitoring and events | `mist_search_events`, `mist_search_audit_logs`, `mist_search_alarms`, `mist_get_stats` | Investigate events, audit history, alarms, and operational statistics across organizations, sites, devices, clients, and ports. | -| Assurance and AI insights | `mist_get_site_sle`, `mist_list_site_sle_info`, `mist_get_org_sle`, `mist_get_org_sites_sle`, `mist_get_insight_metrics`, `mist_get_site_rrm_info`, `mist_troubleshoot` | Explore SLEs, Mist AI insight metrics, radio resource management state, and Marvis troubleshooting output. | +| Assurance and AI insights | `mist_get_sle`, `mist_list_site_sle_info`, `mist_get_insight_metrics`, `mist_get_site_rrm_info`, `mist_troubleshoot` | Explore SLEs, Mist AI insight metrics, radio resource management state, and Marvis troubleshooting output. | | Device operations | `mist_utilities`, `mist_list_upgrades` | Run device-side diagnostics and maintenance helpers or inspect upgrade information. Call `mist_utilities` with only `device_type` to list the supported platform-specific utilities. Some state-changing utility actions require write tools, and the disruptive ones also trigger elicitation. | | Inventory and security context | `mist_get_org_licenses`, `mist_list_rogue_devices` | Review organization license usage and detect or inspect rogue AP activity seen by a site. | diff --git a/src/mistmcp/tool_helper.py b/src/mistmcp/tool_helper.py index 4ad2ca7..e7592f8 100644 --- a/src/mistmcp/tool_helper.py +++ b/src/mistmcp/tool_helper.py @@ -95,10 +95,8 @@ class McpToolsCategory(Enum): "sles": { "description": "SLEs, or Service-Level Expectations, are metrics used to monitor and report on the user experience of a Wireless, Wired or Wan network.\\n\\nThey are generated through data science and machine learning algorithms and provide insights into various aspects of the network, such as coverage, capacity, connectivity, and performance.\\n\\nMist SLEs help identify when users do not have sufficient network quality, when they face issues with connecting or roaming between access points, and when there are problems on the wired network.\\n\\n SLEs API Calls at the MSP level can be used to retrieve the SLEs summary for each Organization attached to the MSP account.", "tools": [ - "mist_get_site_sle", + "mist_get_sle", "mist_list_site_sle_info", - "mist_get_org_sle", - "mist_get_org_sites_sle", ], }, "stats": { diff --git a/src/mistmcp/tools/get_org_sites_sle.py b/src/mistmcp/tools/get_org_sites_sle.py deleted file mode 100644 index 8bdd07c..0000000 --- a/src/mistmcp/tools/get_org_sites_sle.py +++ /dev/null @@ -1,93 +0,0 @@ -""" --------------------------------------------------------------------------------- --------------------------------- Mist MCP SERVER ------------------------------- - - Written by: Thomas Munzer (tmunzer@juniper.net) - Github : https://github.com/tmunzer/mistmcp - - This package is licensed under the MIT License. - --------------------------------------------------------------------------------- -""" - -import mistapi -from fastmcp import Context -from fastmcp.exceptions import ToolError -from mistmcp.request_processor import get_apisession -from mistmcp.response_processor import process_response, handle_network_error -from mistmcp.response_formatter import format_response -from mistmcp.server import mcp -from mistmcp.logger import logger - -from pydantic import Field -from typing import Annotated -from uuid import UUID -from enum import Enum - - -class Sle(Enum): - WIFI = "wifi" - WIRED = "wired" - WAN = "wan" - - -@mcp.tool( - name="mist_get_org_sites_sle", - description="""Get SLE summary for the organization sites.""", - tags={"sles"}, - annotations={ - "title": "Get org sites sle", - "readOnlyHint": True, - "destructiveHint": False, - "openWorldHint": True, - "idempotentHint": True, - }, -) -async def get_org_sites_sle( - org_id: Annotated[UUID, Field(description="""Organization ID""")], - sle: Annotated[ - Sle, - Field( - description="""Type of SLE data to retrieve for the sites. Possible values are `wifi`, `wired`, and `wan`""" - ), - ], - start: Annotated[ - int, Field(description="""Start of time range (epoch seconds)""", default=None) - ], - end: Annotated[ - int, Field(description="""End of time range (epoch seconds)""", default=None) - ], - limit: Annotated[ - int, Field(description="""Max number of results per page""", default=20) - ] = 20, -) -> dict | list | str: - """Get SLE summary for the organization sites.""" - - logger.debug("Tool get_org_sites_sle called") - logger.debug( - "Input Parameters: org_id: %s, sle: %s, start: %s, end: %s, limit: %s", - org_id, - sle, - start, - end, - limit, - ) - - apisession, response_format = await get_apisession() - - try: - response = mistapi.api.v1.orgs.insights.getOrgSitesSle( - apisession, - org_id=str(org_id), - sle=sle.value, - start=str(start) if start else None, - end=str(end) if end else None, - limit=limit, - ) - await process_response(response) - except ToolError: - raise - except Exception as _exc: - await handle_network_error(_exc) - - return format_response(response, response_format) diff --git a/src/mistmcp/tools/get_org_sle.py b/src/mistmcp/tools/get_org_sle.py deleted file mode 100644 index a62e071..0000000 --- a/src/mistmcp/tools/get_org_sle.py +++ /dev/null @@ -1,90 +0,0 @@ -""" --------------------------------------------------------------------------------- --------------------------------- Mist MCP SERVER ------------------------------- - - Written by: Thomas Munzer (tmunzer@juniper.net) - Github : https://github.com/tmunzer/mistmcp - - This package is licensed under the MIT License. - --------------------------------------------------------------------------------- -""" - -import mistapi -from fastmcp import Context -from fastmcp.exceptions import ToolError -from mistmcp.request_processor import get_apisession -from mistmcp.response_processor import process_response, handle_network_error -from mistmcp.response_formatter import format_response -from mistmcp.server import mcp -from mistmcp.logger import logger - -from pydantic import Field -from typing import Annotated -from uuid import UUID - - -@mcp.tool( - name="mist_get_org_sle", - description="""Get Org SLEs (all/worst sites, Mx Edges, ...). Use the `mist_get_insight_metrics` tool to get the list of available SLE metrics""", - tags={"sles"}, - annotations={ - "title": "Get org sle", - "readOnlyHint": True, - "destructiveHint": False, - "openWorldHint": True, - "idempotentHint": True, - }, -) -async def get_org_sle( - org_id: Annotated[UUID, Field(description="""Organization ID""")], - metric: Annotated[ - str, - Field( - description="""Metric to look at. Use the `mist_get_insight_metrics` tool to get the list of available SLE metrics""" - ), - ], - sle: Annotated[ - str, - Field( - description="""Type of SLE data to retrieve for the organization sites. Use the `mist_get_insight_metrics` tool to get the list of available SLE metrics""", - default=None, - ), - ], - start: Annotated[ - int, Field(description="""Start of time range (epoch seconds)""", default=None) - ], - end: Annotated[ - int, Field(description="""End of time range (epoch seconds)""", default=None) - ], -) -> dict | list | str: - """Get Org SLEs (all/worst sites, Mx Edges, ...). Use the `mist_get_insight_metrics` tool to get the list of available SLE metrics""" - - logger.debug("Tool get_org_sle called") - logger.debug( - "Input Parameters: org_id: %s, metric: %s, sle: %s, start: %s, end: %s", - org_id, - metric, - sle, - start, - end, - ) - - apisession, response_format = await get_apisession() - - try: - response = mistapi.api.v1.orgs.insights.getOrgSle( - apisession, - org_id=str(org_id), - metric=str(metric), - sle=str(sle) if sle else None, - start=str(start) if start else None, - end=str(end) if end else None, - ) - await process_response(response) - except ToolError: - raise - except Exception as _exc: - await handle_network_error(_exc) - - return format_response(response, response_format) diff --git a/src/mistmcp/tools/get_site_sle.py b/src/mistmcp/tools/get_site_sle.py deleted file mode 100644 index 9149f10..0000000 --- a/src/mistmcp/tools/get_site_sle.py +++ /dev/null @@ -1,311 +0,0 @@ -""" --------------------------------------------------------------------------------- --------------------------------- Mist MCP SERVER ------------------------------- - - Written by: Thomas Munzer (tmunzer@juniper.net) - Github : https://github.com/tmunzer/mistmcp - - This package is licensed under the MIT License. - --------------------------------------------------------------------------------- -""" - -import mistapi -from fastmcp import Context -from fastmcp.exceptions import ToolError -from mistmcp.request_processor import get_apisession -from mistmcp.response_processor import process_response, handle_network_error -from mistmcp.response_formatter import format_response -from mistmcp.server import mcp -from mistmcp.logger import logger - -from pydantic import Field -from typing import Annotated -from uuid import UUID -from enum import Enum - - -class Scope(Enum): - CLIENT = "client" - AP = "ap" - GATEWAY = "gateway" - MXEDGE = "mxedge" - SWITCH = "switch" - SITE = "site" - - -class Object_type(Enum): - SUMMARY = "summary" - IMPACT_SUMMARY = "impact_summary" - SUMMARY_TREND = "summary_trend" - IMPACTED_APPLICATIONS = "impacted_applications" - IMPACTED_APS = "impacted_aps" - IMPACTED_GATEWAYS = "impacted_gateways" - IMPACTED_INTERFACES = "impacted_interfaces" - IMPACTED_SWITCHES = "impacted_switches" - IMPACTED_WIRELESS_CLIENTS = "impacted_wireless_clients" - IMPACTED_WIRED_CLIENTS = "impacted_wired_clients" - IMPACTED_CHASSIS = "impacted_chassis" - HISTOGRAM = "histogram" - CLASSIFIER_SUMMARY_TREND = "classifier_summary_trend" - THRESHOLD = "threshold" - - -@mcp.tool( - name="mist_get_site_sle", - description="""Provides Information about the Service Level Expectations (SLEs) for a given site. The SLEs are derived from the insight metrics and can be used to monitor the network user experience of the site against the defined SLEs""", - tags={"sles"}, - annotations={ - "title": "Get site sle", - "readOnlyHint": True, - "destructiveHint": False, - "openWorldHint": True, - "idempotentHint": True, - }, -) -async def get_site_sle( - site_id: Annotated[UUID, Field(description="""Site ID""")], - scope: Annotated[ - Scope, - Field( - description="""Scope of the SLEs to retrieve. Can be 'client', 'ap', 'gateway', 'mxedge', 'switch' or 'site'""" - ), - ], - scope_id: Annotated[str, Field(description="""ID of the Mist Scope""")], - metric: Annotated[ - str, - Field( - description="""Name of the metric to retrieve SLEs for. Use the tool`mist_get_constants` with `object_type=insight_metrics` to see available metrics""" - ), - ], - object_type: Annotated[ - Object_type, Field(description="""Type of object to retrieve metrics for""") - ], - start: Annotated[ - int, Field(description="""Start of time range (epoch seconds)""", default=None) - ], - end: Annotated[ - int, Field(description="""End of time range (epoch seconds)""", default=None) - ], - classifier: Annotated[ - str, - Field( - description="""Classifier name. Required when object_type is 'classifier_summary_trend'""", - default=None, - ), - ], - duration: Annotated[ - str, - Field(description="""Time range duration (e.g. 1d, 1h, 10m)""", default=None), - ], -) -> dict | list | str: - """Provides Information about the Service Level Expectations (SLEs) for a given site. The SLEs are derived from the insight metrics and can be used to monitor the network user experience of the site against the defined SLEs""" - - logger.debug("Tool get_site_sle called") - logger.debug( - "Input Parameters: site_id: %s, scope: %s, scope_id: %s, metric: %s, object_type: %s, start: %s, end: %s, classifier: %s, duration: %s", - site_id, - scope, - scope_id, - metric, - object_type, - start, - end, - classifier, - duration, - ) - - apisession, response_format = await get_apisession() - - try: - if object_type.value == "classifier_summary_trend": - if not classifier: - raise ToolError( - { - "status_code": 400, - "message": '`classifier` parameter is required when `test` is "classifier_summary_trend".', - } - ) - - match object_type.value: - case "summary": - response = mistapi.api.v1.sites.sle.getSiteSleSummary( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) - await process_response(response) - case "impact_summary": - response = mistapi.api.v1.sites.sle.getSiteSleImpactSummary( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) - await process_response(response) - case "summary_trend": - response = mistapi.api.v1.sites.sle.getSiteSleSummaryTrend( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) - await process_response(response) - case "impacted_applications": - response = mistapi.api.v1.sites.sle.listSiteSleImpactedApplications( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) - await process_response(response) - case "impacted_aps": - response = mistapi.api.v1.sites.sle.listSiteSleImpactedAps( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) - await process_response(response) - case "impacted_gateways": - response = mistapi.api.v1.sites.sle.listSiteSleImpactedGateways( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) - await process_response(response) - case "impacted_interfaces": - response = mistapi.api.v1.sites.sle.listSiteSleImpactedInterfaces( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) - await process_response(response) - case "impacted_switches": - response = mistapi.api.v1.sites.sle.listSiteSleImpactedSwitches( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) - await process_response(response) - case "impacted_wireless_clients": - response = mistapi.api.v1.sites.sle.listSiteSleImpactedWirelessClients( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) - await process_response(response) - case "impacted_wired_clients": - response = mistapi.api.v1.sites.sle.listSiteSleImpactedWiredClients( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) - await process_response(response) - case "impacted_chassis": - response = mistapi.api.v1.sites.sle.listSiteSleImpactedChassis( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) - await process_response(response) - case "histogram": - response = mistapi.api.v1.sites.sle.getSiteSleHistogram( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) - await process_response(response) - case "classifier_summary_trend": - response = mistapi.api.v1.sites.sle.getSiteSleClassifierSummaryTrend( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - classifier=classifier, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) - await process_response(response) - case "threshold": - response = mistapi.api.v1.sites.sle.getSiteSleThreshold( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - ) - await process_response(response) - - case _: - raise ToolError( - { - "status_code": 400, - "message": f"Invalid object_type: {object_type.value}. Valid values are: {[e.value for e in Object_type]}", - } - ) - - except ToolError: - raise - except Exception as _exc: - await handle_network_error(_exc) - - return format_response(response, response_format) diff --git a/src/mistmcp/tools/get_sle.py b/src/mistmcp/tools/get_sle.py new file mode 100644 index 0000000..3cea4ce --- /dev/null +++ b/src/mistmcp/tools/get_sle.py @@ -0,0 +1,485 @@ +""" +-------------------------------------------------------------------------------- +-------------------------------- Mist MCP SERVER ------------------------------- + + Written by: Thomas Munzer (tmunzer@juniper.net) + Github : https://github.com/tmunzer/mistmcp + + This package is licensed under the MIT License. + +-------------------------------------------------------------------------------- +""" + +import mistapi +from fastmcp.exceptions import ToolError +from mistmcp.request_processor import get_apisession +from mistmcp.response_processor import process_response, handle_network_error +from mistmcp.response_formatter import format_response +from mistmcp.server import mcp +from mistmcp.logger import logger + +from pydantic import Field +from typing import Annotated +from uuid import UUID +from enum import Enum + + +class SleScope(Enum): + ORG = "org" + ORG_SITES = "org_sites" + SITE = "site" + + +class OrgSitesSle(Enum): + WIFI = "wifi" + WIRED = "wired" + WAN = "wan" + + +class SiteSleScope(Enum): + CLIENT = "client" + AP = "ap" + GATEWAY = "gateway" + MXEDGE = "mxedge" + SWITCH = "switch" + SITE = "site" + + +class ObjectType(Enum): + SUMMARY = "summary" + IMPACT_SUMMARY = "impact_summary" + SUMMARY_TREND = "summary_trend" + IMPACTED_APPLICATIONS = "impacted_applications" + IMPACTED_APS = "impacted_aps" + IMPACTED_GATEWAYS = "impacted_gateways" + IMPACTED_INTERFACES = "impacted_interfaces" + IMPACTED_SWITCHES = "impacted_switches" + IMPACTED_WIRELESS_CLIENTS = "impacted_wireless_clients" + IMPACTED_WIRED_CLIENTS = "impacted_wired_clients" + IMPACTED_CHASSIS = "impacted_chassis" + HISTOGRAM = "histogram" + CLASSIFIER_SUMMARY_TREND = "classifier_summary_trend" + THRESHOLD = "threshold" + + +@mcp.tool( + name="mist_get_sle", + description="""Get SLE (Service Level Expectation) data at different scopes. +Use `sle_scope=org` to get org-level SLEs (all/worst sites, Mx Edges, ...). +Use `sle_scope=org_sites` to get SLE summary for all organization sites. +Use `sle_scope=site` to get detailed site-level SLE data (summary, trends, impacted devices/clients, histograms, thresholds). +Use the `mist_list_site_sle_info` tool to discover available SLE metrics and classifiers before querying.""", + tags={"sles"}, + annotations={ + "title": "Get SLE", + "readOnlyHint": True, + "destructiveHint": False, + "openWorldHint": True, + "idempotentHint": True, + }, +) +async def get_sle( + sle_scope: Annotated[ + SleScope, + Field( + description="""Scope of the SLE query. `org`: org-level SLEs; `org_sites`: SLE summary for all sites in the org; `site`: detailed site-level SLE data""" + ), + ], + org_id: Annotated[ + UUID, + Field( + description="""Organization ID. Required when sle_scope is `org` or `org_sites`""", + default=None, + ), + ], + site_id: Annotated[ + UUID, + Field( + description="""Site ID. Required when sle_scope is `site`""", + default=None, + ), + ], + metric: Annotated[ + str, + Field( + description="""SLE metric name. Required when sle_scope is `org` or `site`. Use `mist_list_site_sle_info` or `mist_get_constants` with `object_type=insight_metrics` to discover available metrics""", + default=None, + ), + ], + sle: Annotated[ + str, + Field( + description="""SLE type. When sle_scope is `org`: free-form SLE name. When sle_scope is `org_sites`: must be `wifi`, `wired`, or `wan`""", + default=None, + ), + ], + scope: Annotated[ + SiteSleScope, + Field( + description="""Site SLE scope. Required when sle_scope is `site`. Can be `client`, `ap`, `gateway`, `mxedge`, `switch`, or `site`""", + default=None, + ), + ], + scope_id: Annotated[ + str, + Field( + description="""ID of the scoped object. Required when sle_scope is `site`. Use `site_id` if `scope=site`; `device_id` if `scope=ap`, `switch`, or `gateway`; `MAC address` if `scope=client`""", + default=None, + ), + ], + object_type: Annotated[ + ObjectType, + Field( + description="""Type of SLE data to retrieve. Required when sle_scope is `site`""", + default=None, + ), + ], + start: Annotated[ + int, Field(description="""Start of time range (epoch seconds)""", default=None) + ], + end: Annotated[ + int, Field(description="""End of time range (epoch seconds)""", default=None) + ], + classifier: Annotated[ + str, + Field( + description="""Classifier name. Required when sle_scope is `site` and object_type is `classifier_summary_trend`""", + default=None, + ), + ], + duration: Annotated[ + str, + Field( + description="""Time range duration (e.g. 1d, 1h, 10m). Only used when sle_scope is `site`""", + default=None, + ), + ], + limit: Annotated[ + int, + Field( + description="""Max number of results per page. Only used when sle_scope is `org_sites`""", + default=20, + ), + ] = 20, +) -> dict | list | str: + """Get SLE data at org, org_sites, or site scope.""" + + logger.debug("Tool get_sle called") + logger.debug( + "Input Parameters: sle_scope: %s, org_id: %s, site_id: %s, metric: %s, sle: %s, scope: %s, scope_id: %s, object_type: %s, start: %s, end: %s, limit: %s, classifier: %s, duration: %s", + sle_scope, + org_id, + site_id, + metric, + sle, + scope, + scope_id, + object_type, + start, + end, + limit, + classifier, + duration, + ) + + apisession, response_format = await get_apisession() + + try: + match sle_scope: + case SleScope.ORG: + if not org_id: + raise ToolError( + { + "status_code": 400, + "message": "`org_id` is required when `sle_scope` is `org`.", + } + ) + if not metric: + raise ToolError( + { + "status_code": 400, + "message": "`metric` is required when `sle_scope` is `org`.", + } + ) + response = mistapi.api.v1.orgs.insights.getOrgSle( + apisession, + org_id=str(org_id), + metric=str(metric), + sle=str(sle) if sle else None, + start=str(start) if start else None, + end=str(end) if end else None, + ) + await process_response(response) + + case SleScope.ORG_SITES: + if not org_id: + raise ToolError( + { + "status_code": 400, + "message": "`org_id` is required when `sle_scope` is `org_sites`.", + } + ) + if not sle: + raise ToolError( + { + "status_code": 400, + "message": "`sle` is required when `sle_scope` is `org_sites`. Must be `wifi`, `wired`, or `wan`.", + } + ) + sle_value = sle + valid_sle_values = [e.value for e in OrgSitesSle] + if sle_value not in valid_sle_values: + raise ToolError( + { + "status_code": 400, + "message": f"Invalid `sle` value: {sle_value}. Must be one of: {valid_sle_values}", + } + ) + response = mistapi.api.v1.orgs.insights.getOrgSitesSle( + apisession, + org_id=str(org_id), + sle=sle_value, + start=str(start) if start else None, + end=str(end) if end else None, + limit=limit, + ) + await process_response(response) + + case SleScope.SITE: + if not site_id: + raise ToolError( + { + "status_code": 400, + "message": "`site_id` is required when `sle_scope` is `site`.", + } + ) + if not scope: + raise ToolError( + { + "status_code": 400, + "message": "`scope` is required when `sle_scope` is `site`.", + } + ) + if not scope_id: + raise ToolError( + { + "status_code": 400, + "message": "`scope_id` is required when `sle_scope` is `site`.", + } + ) + if not metric: + raise ToolError( + { + "status_code": 400, + "message": "`metric` is required when `sle_scope` is `site`.", + } + ) + if not object_type: + raise ToolError( + { + "status_code": 400, + "message": "`object_type` is required when `sle_scope` is `site`.", + } + ) + + if object_type == ObjectType.CLASSIFIER_SUMMARY_TREND: + if not classifier: + raise ToolError( + { + "status_code": 400, + "message": "`classifier` parameter is required when `object_type` is `classifier_summary_trend`.", + } + ) + + match object_type: + case ObjectType.SUMMARY: + response = mistapi.api.v1.sites.sle.getSiteSleSummary( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + case ObjectType.IMPACT_SUMMARY: + response = mistapi.api.v1.sites.sle.getSiteSleImpactSummary( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + case ObjectType.SUMMARY_TREND: + response = mistapi.api.v1.sites.sle.getSiteSleSummaryTrend( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + case ObjectType.IMPACTED_APPLICATIONS: + response = ( + mistapi.api.v1.sites.sle.listSiteSleImpactedApplications( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.IMPACTED_APS: + response = mistapi.api.v1.sites.sle.listSiteSleImpactedAps( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + case ObjectType.IMPACTED_GATEWAYS: + response = ( + mistapi.api.v1.sites.sle.listSiteSleImpactedGateways( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.IMPACTED_INTERFACES: + response = ( + mistapi.api.v1.sites.sle.listSiteSleImpactedInterfaces( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.IMPACTED_SWITCHES: + response = ( + mistapi.api.v1.sites.sle.listSiteSleImpactedSwitches( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.IMPACTED_WIRELESS_CLIENTS: + response = ( + mistapi.api.v1.sites.sle.listSiteSleImpactedWirelessClients( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.IMPACTED_WIRED_CLIENTS: + response = ( + mistapi.api.v1.sites.sle.listSiteSleImpactedWiredClients( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.IMPACTED_CHASSIS: + response = ( + mistapi.api.v1.sites.sle.listSiteSleImpactedChassis( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.HISTOGRAM: + response = mistapi.api.v1.sites.sle.getSiteSleHistogram( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + case ObjectType.CLASSIFIER_SUMMARY_TREND: + response = ( + mistapi.api.v1.sites.sle.getSiteSleClassifierSummaryTrend( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + classifier=classifier, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.THRESHOLD: + response = mistapi.api.v1.sites.sle.getSiteSleThreshold( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + ) + case _: + raise ToolError( + { + "status_code": 400, + "message": f"Invalid object_type: {object_type.value}. Valid values are: {[e.value for e in ObjectType]}", + } + ) + await process_response(response) + + case _: + raise ToolError( + { + "status_code": 400, + "message": f"Invalid sle_scope: {sle_scope.value}. Valid values are: {[e.value for e in SleScope]}", + } + ) + + except ToolError: + raise + except Exception as _exc: + await handle_network_error(_exc) + + return format_response(response, response_format) From f4891a9cc8d188c430e33d5bbbd34da3b3a09ea4 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 08:07:43 -0700 Subject: [PATCH 02/21] feat: merge get_org_or_site_info into get_configuration_objects --- .../tmpl_get_configuration_objets.py | 41 ++++++- mcp_generator/tools_optimization.yaml | 80 +++++++------- .../tools/get_configuration_objects.py | 46 ++++++-- src/mistmcp/tools/get_org_or_site_info.py | 100 ------------------ 4 files changed, 111 insertions(+), 156 deletions(-) delete mode 100644 src/mistmcp/tools/get_org_or_site_info.py diff --git a/mcp_generator/templates/tmpl_get_configuration_objets.py b/mcp_generator/templates/tmpl_get_configuration_objets.py index 4ed7ecc..414b6e0 100644 --- a/mcp_generator/templates/tmpl_get_configuration_objets.py +++ b/mcp_generator/templates/tmpl_get_configuration_objets.py @@ -1,4 +1,8 @@ GET_CONFIGURATION_OBJECTS_OPERATION_IDS = [ + "getOrg", + "getOrgSettings", + "getSiteInfo", + "getSiteSettings", "listSiteWxTags", "getSiteWxTag", "listSiteWxRules", @@ -103,7 +107,8 @@ class Object_type(Enum): - ORG = "org" + ORG_INFO = "org_info" + ORG_SETTINGS = "org_settings" ORG_ALARMTEMPLATES = "org_alarmtemplates" ORG_WLANS = "org_wlans" ORG_SITEGROUPS = "org_sitegroups" @@ -131,6 +136,8 @@ class Object_type(Enum): ORG_WLANTEMPLATES = "org_wlantemplates" ORG_WXRULES = "org_wxrules" ORG_WXTAGS = "org_wxtags" + SITE_INFO = "site_info" + SITE_SETTINGS = "site_settings" SITE_EVPN_TOPOLOGIES = "site_evpn_topologies" SITE_MAPS = "site_maps" SITE_MXEDGES = "site_mxedges" @@ -226,7 +233,7 @@ async def get_configuration_objects( str, Field( default=None, - description="""Name of the specific configuration object to retrieve. Not supported when `object_type` is `site_devices` (use the `mist_search_device` tool if you need to find a specific device). If not provided, all objects of the specified type will be retrieved. Case insensitive. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported""", + description="""Name of the specific configuration object to retrieve. Not supported when `object_type` is `org_info`, `org_settings`, `site_info`, `site_settings` or `site_devices` (use the `mist_search_device` tool if you need to find a specific device). If not provided, all objects of the specified type will be retrieved. Case insensitive. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported""", ), ], computed: Annotated[ @@ -240,14 +247,23 @@ async def get_configuration_objects( int, Field( default=20, - description="""Max number of results per page. Default is 20, Max is 1000""", + description="""Max number of results per page. Default is 20, Max is 1000. Not supported when `object_type` is `org_info`, `org_settings`, `site_info` or `site_settings`""", ), ] = 20, ) -> dict | list | str: """Retrieve configuration objects from a specified organization or site. For the site configuration objects, set the attribute `computed` to `true` to retrieve the computed configuration including all configuration objects defined at the org level and assigned to the site. This tool allows you to retrieve a list of configuration objects (e.g. wlans, device profiles, network templates) or to filter them providing their ID.""" logger.debug("Tool get_configuration_objects called") - logger.debug("Input Parameters: org_id=%s, object_type=%s, site_id=%s, object_id=%s, name=%s, computed=%s, limit=%s", org_id, object_type, site_id, object_id, name, computed, limit) + logger.debug( + "Input Parameters: org_id=%s, object_type=%s, site_id=%s, object_id=%s, name=%s, computed=%s, limit=%s", + org_id, + object_type, + site_id, + object_id, + name, + computed, + limit, + ) apisession, response_format = await get_apisession() @@ -306,7 +322,12 @@ async def _org_configuration_objects_getter( limit: int = 20, ) -> _APIResponse: match object_type: - case "org": + case "org_info": + response = mistapi.api.v1.orgs.orgs.getOrg( + apisession, org_id=str(org_id) + ) + await process_response(response) + case "org_settings": response = mistapi.api.v1.orgs.setting.getOrgSettings( apisession, org_id=str(org_id) ) @@ -931,6 +952,16 @@ async def _site_configuration_objects_getter( limit: int = 20, ) -> _APIResponse: match object_type: + case "site_info": + response = mistapi.api.v1.sites.sites.getSiteInfo( + apisession, site_id=str(site_id) + ) + await process_response(response) + case "site_settings": + response = mistapi.api.v1.sites.setting.getSiteSetting( + apisession, site_id=str(site_id) + ) + await process_response(response) case "site_devices": return await _get_site_devices( apisession, org_id, site_id, object_id, name, computed, limit diff --git a/mcp_generator/tools_optimization.yaml b/mcp_generator/tools_optimization.yaml index 7a3cf0f..931c120 100644 --- a/mcp_generator/tools_optimization.yaml +++ b/mcp_generator/tools_optimization.yaml @@ -1080,46 +1080,46 @@ searchGuestAuthorization: operationId: getSiteGuestAuthorization function: mistapi.api.v1.sites.guests.getSiteGuestAuthorization(apisession, site_id=str(site_id), guest_mac=str(guest_mac) ) -getOrgOrSiteInfo: - type: tool_consolidation - tags: [info] - description: |- - Search information about the organizations or sites - read_only_hint: true - destructive_hint: false - parameters: - - name: info_type - schema: - type: string - enum: [org, site] - description: Type of information to search for. Possible values are `org` and `site` - required: true - - name: org_id - schema: - type: string - format: uuid - description: ID of the organization to search for information in - required: true - - name: site_id - schema: - type: string - format: uuid - description: ID of the site to search for information in - required: false - match_name: info_type - if_filter: site_id - requests: - org: - get: - operationId: getOrg - function: mistapi.api.v1.orgs.orgs.getOrg(apisession, org_id=str(org_id)) - site: - list: - operationId: listOrgSites - function: mistapi.api.v1.orgs.sites.listOrgSites(apisession, org_id=str(org_id)) - get: - operationId: getSiteInfo - function: mistapi.api.v1.sites.sites.getSiteInfo(apisession, site_id=str(site_id) ) +# getOrgOrSiteInfo: +# type: tool_consolidation +# tags: [info] +# description: |- +# Search information about the organizations or sites +# read_only_hint: true +# destructive_hint: false +# parameters: +# - name: info_type +# schema: +# type: string +# enum: [org, site] +# description: Type of information to search for. Possible values are `org` and `site` +# required: true +# - name: org_id +# schema: +# type: string +# format: uuid +# description: ID of the organization to search for information in +# required: true +# - name: site_id +# schema: +# type: string +# format: uuid +# description: ID of the site to search for information in +# required: false +# match_name: info_type +# if_filter: site_id +# requests: +# org: +# get: +# operationId: getOrg +# function: mistapi.api.v1.orgs.orgs.getOrg(apisession, org_id=str(org_id)) +# site: +# list: +# operationId: listOrgSites +# function: mistapi.api.v1.orgs.sites.listOrgSites(apisession, org_id=str(org_id)) +# get: +# operationId: getSiteInfo +# function: mistapi.api.v1.sites.sites.getSiteInfo(apisession, site_id=str(site_id) ) searchAuditLogs: type: tool_consolidation diff --git a/src/mistmcp/tools/get_configuration_objects.py b/src/mistmcp/tools/get_configuration_objects.py index 470e1d2..f7aeecf 100644 --- a/src/mistmcp/tools/get_configuration_objects.py +++ b/src/mistmcp/tools/get_configuration_objects.py @@ -28,7 +28,8 @@ class Object_type(Enum): - ORG = "org" + ORG_INFO = "org_info" + ORG_SETTINGS = "org_settings" ORG_ALARMTEMPLATES = "org_alarmtemplates" ORG_WLANS = "org_wlans" ORG_SITEGROUPS = "org_sitegroups" @@ -56,6 +57,8 @@ class Object_type(Enum): ORG_WLANTEMPLATES = "org_wlantemplates" ORG_WXRULES = "org_wxrules" ORG_WXTAGS = "org_wxtags" + SITE_INFO = "site_info" + SITE_SETTINGS = "site_settings" SITE_EVPN_TOPOLOGIES = "site_evpn_topologies" SITE_MAPS = "site_maps" SITE_MXEDGES = "site_mxedges" @@ -130,7 +133,8 @@ class Object_type(Enum): async def get_configuration_objects( org_id: Annotated[UUID, Field(description="""Organization ID""")], object_type: Annotated[ - Object_type, Field(description="""Type of configuration object to retrieve""") + Object_type, Field( + description="""Type of configuration object to retrieve""") ], site_id: Annotated[ UUID, @@ -150,7 +154,7 @@ async def get_configuration_objects( str, Field( default=None, - description="""Name of the specific configuration object to retrieve. Not supported when `object_type` is `site_devices` (use the `mist_search_device` tool if you need to find a specific device). If not provided, all objects of the specified type will be retrieved. Case insensitive. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported""", + description="""Name of the specific configuration object to retrieve. Not supported when `object_type` is `org_info`, `org_settings`, `site_info`, `site_settings` or `site_devices` (use the `mist_search_device` tool if you need to find a specific device). If not provided, all objects of the specified type will be retrieved. Case insensitive. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported""", ), ], computed: Annotated[ @@ -164,7 +168,7 @@ async def get_configuration_objects( int, Field( default=20, - description="""Max number of results per page. Default is 20, Max is 1000""", + description="""Max number of results per page. Default is 20, Max is 1000. Not supported when `object_type` is `org_info`, `org_settings`, `site_info` or `site_settings`""", ), ] = 20, ) -> dict | list | str: @@ -239,7 +243,12 @@ async def _org_configuration_objects_getter( limit: int = 20, ) -> _APIResponse: match object_type: - case "org": + case "org_info": + response = mistapi.api.v1.orgs.orgs.getOrg( + apisession, org_id=str(org_id) + ) + await process_response(response) + case "org_settings": response = mistapi.api.v1.orgs.setting.getOrgSettings( apisession, org_id=str(org_id) ) @@ -864,6 +873,16 @@ async def _site_configuration_objects_getter( limit: int = 20, ) -> _APIResponse: match object_type: + case "site_info": + response = mistapi.api.v1.sites.sites.getSiteInfo( + apisession, site_id=str(site_id) + ) + await process_response(response) + case "site_settings": + response = mistapi.api.v1.sites.setting.getSiteSetting( + apisession, site_id=str(site_id) + ) + await process_response(response) case "site_devices": return await _get_site_devices( apisession, org_id, site_id, object_id, name, computed, limit @@ -1128,7 +1147,8 @@ async def _get_computed_device_configuration( elif isinstance(value, dict) and isinstance( switch_data.get(key, {}), dict ): - switch_data[key] = {**switch_data.get(key, {}), **value} + switch_data[key] = { + **switch_data.get(key, {}), **value} elif isinstance(value, list) and isinstance( switch_data.get(key, []), list ): @@ -1143,7 +1163,8 @@ async def _get_computed_device_configuration( ) await process_response(site_data) if isinstance(site_data.data, dict): - gateway_template_id = site_data.data.get("gatewaytemplate_id") + gateway_template_id = site_data.data.get( + "gatewaytemplate_id") if gateway_template_id: response = ( mistapi.api.v1.orgs.gatewaytemplates.getOrgGatewayTemplate( @@ -1168,7 +1189,8 @@ async def _get_computed_device_configuration( elif isinstance(value, list) and isinstance( gateway_data.get(key, []), list ): - gateway_data[key] = gateway_data.get(key, []) + value + gateway_data[key] = gateway_data.get( + key, []) + value else: gateway_data[key] = value device_data.data = gateway_data @@ -1233,7 +1255,8 @@ def _process_switch_rule( elif k.startswith("match_model"): match_model_enabled = True del rule_cleansed[k] - match_model_true = _process_switch_rule_match(switch_model, k, v) + match_model_true = _process_switch_rule_match( + switch_model, k, v) elif k == "match_role": match_role_enabled = True match_role_true = _process_switch_rule_match(switch_role, k, v) @@ -1260,11 +1283,12 @@ def _process_switch_rule_match( switch_value: str, match_key: str, match_value: str ) -> bool: if ":" in match_key: - match_start, match_stop = match_key.replace("]", "").split("[")[1].split(":") + match_start, match_stop = match_key.replace( + "]", "").split("[")[1].split(":") try: if ( len(switch_value) > int(match_stop) - and switch_value[int(match_start) : int(match_stop)].lower() + and switch_value[int(match_start): int(match_stop)].lower() == match_value.lower() ): return True diff --git a/src/mistmcp/tools/get_org_or_site_info.py b/src/mistmcp/tools/get_org_or_site_info.py deleted file mode 100644 index 3b385f5..0000000 --- a/src/mistmcp/tools/get_org_or_site_info.py +++ /dev/null @@ -1,100 +0,0 @@ -""" --------------------------------------------------------------------------------- --------------------------------- Mist MCP SERVER ------------------------------- - - Written by: Thomas Munzer (tmunzer@juniper.net) - Github : https://github.com/tmunzer/mistmcp - - This package is licensed under the MIT License. - --------------------------------------------------------------------------------- -""" - -import mistapi -from fastmcp import Context -from fastmcp.exceptions import ToolError -from mistmcp.request_processor import get_apisession -from mistmcp.response_processor import process_response, handle_network_error -from mistmcp.response_formatter import format_response -from mistmcp.server import mcp -from mistmcp.logger import logger - -from pydantic import Field -from typing import Annotated -from enum import Enum -from uuid import UUID - - -class Info_type(Enum): - ORG = "org" - SITE = "site" - - -@mcp.tool( - name="mist_get_org_or_site_info", - description="""Search information about the organizations or sites""", - tags={"info"}, - annotations={ - "title": "Get org or site info", - "readOnlyHint": True, - "destructiveHint": False, - "openWorldHint": True, - "idempotentHint": True, - }, -) -async def get_org_or_site_info( - info_type: Annotated[ - Info_type, - Field( - description="""Type of information to search for. Possible values are `org` and `site`""" - ), - ], - org_id: Annotated[UUID, Field(description="""Organization ID""")], - site_id: Annotated[UUID, Field(description="""Site ID""", default=None)], -) -> dict | list | str: - """Search information about the organizations or sites""" - - logger.debug("Tool get_org_or_site_info called") - logger.debug( - "Input Parameters: info_type: %s, org_id: %s, site_id: %s", - info_type, - org_id, - site_id, - ) - - apisession, response_format = await get_apisession() - - try: - object_type = info_type - match object_type.value: - case "org": - response = mistapi.api.v1.orgs.orgs.getOrg( - apisession, org_id=str(org_id) - ) - await process_response(response) - case "site": - if site_id: - response = mistapi.api.v1.sites.sites.getSiteInfo( - apisession, site_id=str(site_id) - ) - await process_response(response) - else: - response = mistapi.api.v1.orgs.sites.listOrgSites( - apisession, org_id=str(org_id) - ) - await process_response(response) - - case _: - raise ToolError( - { - "status_code": 400, - "message": f"Invalid object_type: {object_type.value}. Valid values are: {[e.value for e in Info_type]}", - } - ) - - except ToolError: - raise - except Exception as _exc: - await handle_network_error(_exc) - - return format_response(response, response_format) From 79a2ed683966de70a5eb9c60b4d694faf68b28f0 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 08:13:24 -0700 Subject: [PATCH 03/21] refactor: merge list_site_sle_info into mist_get_sle Add sle_scope=site_metrics and sle_scope=site_classifiers to the unified mist_get_sle tool, replacing the separate mist_list_site_sle_info tool. All 4 original SLE tools are now consolidated into a single tool. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- README.md | 2 +- src/mistmcp/server.py | 2 +- src/mistmcp/tool_helper.py | 1 - src/mistmcp/tools/get_sle.py | 84 +++++++++++++- src/mistmcp/tools/list_site_sle_info.py | 139 ------------------------ 5 files changed, 80 insertions(+), 148 deletions(-) delete mode 100644 src/mistmcp/tools/list_site_sle_info.py diff --git a/README.md b/README.md index c5d3536..4c8c2cb 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ The server exposes a focused set of tools grouped by workflow. This is the quick | Configuration read | `mist_get_configuration_objects`, `mist_get_configuration_object_schema`, `mist_search_device_config_history` | Inspect org or site configuration, discover valid schema fields, and review recent configuration history on devices. | | Configuration changes | `mist_update_configuration_objects`, `mist_change_configuration_objects` | Create, update, and delete supported configuration objects. These tools require `--enable-write-tools`. | | Monitoring and events | `mist_search_events`, `mist_search_audit_logs`, `mist_search_alarms`, `mist_get_stats` | Investigate events, audit history, alarms, and operational statistics across organizations, sites, devices, clients, and ports. | -| Assurance and AI insights | `mist_get_sle`, `mist_list_site_sle_info`, `mist_get_insight_metrics`, `mist_get_site_rrm_info`, `mist_troubleshoot` | Explore SLEs, Mist AI insight metrics, radio resource management state, and Marvis troubleshooting output. | +| Assurance and AI insights | `mist_get_sle`, `mist_get_insight_metrics`, `mist_get_site_rrm_info`, `mist_troubleshoot` | Explore SLEs, Mist AI insight metrics, radio resource management state, and Marvis troubleshooting output. | | Device operations | `mist_utilities`, `mist_list_upgrades` | Run device-side diagnostics and maintenance helpers or inspect upgrade information. Call `mist_utilities` with only `device_type` to list the supported platform-specific utilities. Some state-changing utility actions require write tools, and the disruptive ones also trigger elicitation. | | Inventory and security context | `mist_get_org_licenses`, `mist_list_rogue_devices` | Review organization license usage and detect or inspect rogue AP activity seen by a site. | diff --git a/src/mistmcp/server.py b/src/mistmcp/server.py index a11e319..bfd3a2e 100644 --- a/src/mistmcp/server.py +++ b/src/mistmcp/server.py @@ -77,7 +77,7 @@ # KEY WORKFLOWS - Use `mist_get_constants` to discover valid event_type or insight metric names before searching. -- Use `mist_list_site_sle_info` to discover available SLE metrics before querying SLE data. +- Use `mist_get_sle` with `sle_scope=site_metrics` to discover available SLE metrics before querying SLE data. - Use `mist_get_configuration_object_schema(verbose=True)` to understand config fields before writing. - Use `mist_update_configuration_objects` for create/update and `mist_change_configuration_objects` for create/update/delete. - `mist_search_device` returns a normalized `device_id`; reuse that value directly in tools requiring a device UUID. diff --git a/src/mistmcp/tool_helper.py b/src/mistmcp/tool_helper.py index e7592f8..4752684 100644 --- a/src/mistmcp/tool_helper.py +++ b/src/mistmcp/tool_helper.py @@ -96,7 +96,6 @@ class McpToolsCategory(Enum): "description": "SLEs, or Service-Level Expectations, are metrics used to monitor and report on the user experience of a Wireless, Wired or Wan network.\\n\\nThey are generated through data science and machine learning algorithms and provide insights into various aspects of the network, such as coverage, capacity, connectivity, and performance.\\n\\nMist SLEs help identify when users do not have sufficient network quality, when they face issues with connecting or roaming between access points, and when there are problems on the wired network.\\n\\n SLEs API Calls at the MSP level can be used to retrieve the SLEs summary for each Organization attached to the MSP account.", "tools": [ "mist_get_sle", - "mist_list_site_sle_info", ], }, "stats": { diff --git a/src/mistmcp/tools/get_sle.py b/src/mistmcp/tools/get_sle.py index 3cea4ce..352aaa7 100644 --- a/src/mistmcp/tools/get_sle.py +++ b/src/mistmcp/tools/get_sle.py @@ -28,6 +28,8 @@ class SleScope(Enum): ORG = "org" ORG_SITES = "org_sites" SITE = "site" + SITE_METRICS = "site_metrics" + SITE_CLASSIFIERS = "site_classifiers" class OrgSitesSle(Enum): @@ -68,7 +70,9 @@ class ObjectType(Enum): Use `sle_scope=org` to get org-level SLEs (all/worst sites, Mx Edges, ...). Use `sle_scope=org_sites` to get SLE summary for all organization sites. Use `sle_scope=site` to get detailed site-level SLE data (summary, trends, impacted devices/clients, histograms, thresholds). -Use the `mist_list_site_sle_info` tool to discover available SLE metrics and classifiers before querying.""", +Use `sle_scope=site_metrics` to discover available SLE metrics for a given site scope. +Use `sle_scope=site_classifiers` to list classifiers for a specific SLE metric (requires `metric` parameter). +Use `sle_scope=site_metrics` first to discover metric names before querying SLE data.""", tags={"sles"}, annotations={ "title": "Get SLE", @@ -82,7 +86,7 @@ async def get_sle( sle_scope: Annotated[ SleScope, Field( - description="""Scope of the SLE query. `org`: org-level SLEs; `org_sites`: SLE summary for all sites in the org; `site`: detailed site-level SLE data""" + description="""Scope of the SLE query. `org`: org-level SLEs; `org_sites`: SLE summary for all sites in the org; `site`: detailed site-level SLE data; `site_metrics`: list available SLE metrics for a site scope; `site_classifiers`: list classifiers for a specific metric""" ), ], org_id: Annotated[ @@ -95,14 +99,14 @@ async def get_sle( site_id: Annotated[ UUID, Field( - description="""Site ID. Required when sle_scope is `site`""", + description="""Site ID. Required when sle_scope is `site`, `site_metrics`, or `site_classifiers`""", default=None, ), ], metric: Annotated[ str, Field( - description="""SLE metric name. Required when sle_scope is `org` or `site`. Use `mist_list_site_sle_info` or `mist_get_constants` with `object_type=insight_metrics` to discover available metrics""", + description="""SLE metric name. Required when sle_scope is `org`, `site`, or `site_classifiers`. Use `sle_scope=site_metrics` or `mist_get_constants` with `object_type=insight_metrics` to discover available metrics""", default=None, ), ], @@ -116,14 +120,14 @@ async def get_sle( scope: Annotated[ SiteSleScope, Field( - description="""Site SLE scope. Required when sle_scope is `site`. Can be `client`, `ap`, `gateway`, `mxedge`, `switch`, or `site`""", + description="""Site SLE scope. Required when sle_scope is `site`, `site_metrics`, or `site_classifiers`. Can be `client`, `ap`, `gateway`, `mxedge`, `switch`, or `site`""", default=None, ), ], scope_id: Annotated[ str, Field( - description="""ID of the scoped object. Required when sle_scope is `site`. Use `site_id` if `scope=site`; `device_id` if `scope=ap`, `switch`, or `gateway`; `MAC address` if `scope=client`""", + description="""ID of the scoped object. Required when sle_scope is `site`, `site_metrics`, or `site_classifiers`. Use `site_id` if `scope=site`; `device_id` if `scope=ap`, `switch`, or `gateway`; `MAC address` if `scope=client`""", default=None, ), ], @@ -469,6 +473,74 @@ async def get_sle( ) await process_response(response) + case SleScope.SITE_METRICS: + if not site_id: + raise ToolError( + { + "status_code": 400, + "message": "`site_id` is required when `sle_scope` is `site_metrics`.", + } + ) + if not scope: + raise ToolError( + { + "status_code": 400, + "message": "`scope` is required when `sle_scope` is `site_metrics`.", + } + ) + if not scope_id: + raise ToolError( + { + "status_code": 400, + "message": "`scope_id` is required when `sle_scope` is `site_metrics`.", + } + ) + response = mistapi.api.v1.sites.sle.listSiteSlesMetrics( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + ) + await process_response(response) + + case SleScope.SITE_CLASSIFIERS: + if not site_id: + raise ToolError( + { + "status_code": 400, + "message": "`site_id` is required when `sle_scope` is `site_classifiers`.", + } + ) + if not scope: + raise ToolError( + { + "status_code": 400, + "message": "`scope` is required when `sle_scope` is `site_classifiers`.", + } + ) + if not scope_id: + raise ToolError( + { + "status_code": 400, + "message": "`scope_id` is required when `sle_scope` is `site_classifiers`.", + } + ) + if not metric: + raise ToolError( + { + "status_code": 400, + "message": "`metric` is required when `sle_scope` is `site_classifiers`. Use `sle_scope=site_metrics` first to discover available metric names.", + } + ) + response = mistapi.api.v1.sites.sle.listSiteSleMetricClassifiers( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + ) + await process_response(response) + case _: raise ToolError( { diff --git a/src/mistmcp/tools/list_site_sle_info.py b/src/mistmcp/tools/list_site_sle_info.py deleted file mode 100644 index 159e815..0000000 --- a/src/mistmcp/tools/list_site_sle_info.py +++ /dev/null @@ -1,139 +0,0 @@ -""" --------------------------------------------------------------------------------- --------------------------------- Mist MCP SERVER ------------------------------- - - Written by: Thomas Munzer (tmunzer@juniper.net) - Github : https://github.com/tmunzer/mistmcp - - This package is licensed under the MIT License. - --------------------------------------------------------------------------------- -""" - -import mistapi -from fastmcp import Context -from fastmcp.exceptions import ToolError -from mistmcp.request_processor import get_apisession -from mistmcp.response_processor import process_response, handle_network_error -from mistmcp.response_formatter import format_response -from mistmcp.server import mcp -from mistmcp.logger import logger - -from pydantic import Field -from typing import Annotated -from uuid import UUID -from enum import Enum - - -class Query_type(Enum): - METRICS = "metrics" - CLASSIFIERS = "classifiers" - - -class Scope(Enum): - AP = "ap" - CLIENT = "client" - GATEWAY = "gateway" - SITE = "site" - SWITCH = "switch" - - -@mcp.tool( - name="mist_list_site_sle_info", - description="""List SLE metadata for a site scope. Use metrics to list available SLE metrics for a given scope, or classifiers to list the classifiers available for a specific metric.""", - tags={"sles"}, - annotations={ - "title": "List site sle info", - "readOnlyHint": True, - "destructiveHint": False, - "openWorldHint": True, - "idempotentHint": True, - }, -) -async def list_site_sle_info( - site_id: Annotated[UUID, Field(description="""Site ID""")], - query_type: Annotated[ - Query_type, - Field( - description="""Type of metadata to retrieve: metrics returns the list of available SLE metrics for the given scope; classifiers returns the list of classifiers for a specific metric (requires metric parameter)""" - ), - ], - scope: Annotated[ - Scope, - Field( - description="""Scope of the SLE data: site, ap, client, gateway, or switch""" - ), - ], - scope_id: Annotated[ - str, - Field( - description="""ID of the scoped object: `site_id` if `scope=site`; `device_id` if `scope=ap`, `switch`, or `gateway`; `MAC address` if `scope=client`""" - ), - ], - metric: Annotated[ - str, - Field( - description="""SLE metric name to retrieve classifiers for. Required when query_type is classifiers. Use query_type=metrics first to discover available metric names""", - default=None, - ), - ], -) -> dict | list | str: - """List SLE metadata for a site scope. Use metrics to list available SLE metrics for a given scope, or classifiers to list the classifiers available for a specific metric.""" - - logger.debug("Tool list_site_sle_info called") - logger.debug( - "Input Parameters: site_id: %s, query_type: %s, scope: %s, scope_id: %s, metric: %s", - site_id, - query_type, - scope, - scope_id, - metric, - ) - - apisession, response_format = await get_apisession() - - try: - object_type = query_type - - if object_type.value == "classifiers": - if not metric: - raise ToolError( - { - "status_code": 400, - "message": '`metric` parameter is required when `test` is "classifiers".', - } - ) - - match object_type.value: - case "metrics": - response = mistapi.api.v1.sites.sle.listSiteSlesMetrics( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - ) - await process_response(response) - case "classifiers": - response = mistapi.api.v1.sites.sle.listSiteSleMetricClassifiers( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - ) - await process_response(response) - - case _: - raise ToolError( - { - "status_code": 400, - "message": f"Invalid object_type: {object_type.value}. Valid values are: {[e.value for e in Query_type]}", - } - ) - - except ToolError: - raise - except Exception as _exc: - await handle_network_error(_exc) - - return format_response(response, response_format) From 5483126cdecf2713b6ef148386d8c6a508747652 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 08:24:23 -0700 Subject: [PATCH 04/21] fix: improve SLE tool descriptions for accuracy - Update docstring to mention all 5 sle_scope values - Restore mist_get_insight_metrics hint for org-scope sle parameter Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/mistmcp/tools/get_sle.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/mistmcp/tools/get_sle.py b/src/mistmcp/tools/get_sle.py index 352aaa7..214ba09 100644 --- a/src/mistmcp/tools/get_sle.py +++ b/src/mistmcp/tools/get_sle.py @@ -113,7 +113,7 @@ async def get_sle( sle: Annotated[ str, Field( - description="""SLE type. When sle_scope is `org`: free-form SLE name. When sle_scope is `org_sites`: must be `wifi`, `wired`, or `wan`""", + description="""SLE type. When sle_scope is `org`: SLE name to filter on (use `mist_get_insight_metrics` to discover available values). When sle_scope is `org_sites`: must be `wifi`, `wired`, or `wan`""", default=None, ), ], @@ -166,7 +166,7 @@ async def get_sle( ), ] = 20, ) -> dict | list | str: - """Get SLE data at org, org_sites, or site scope.""" + """Get SLE data at org, org_sites, site, site_metrics, or site_classifiers scope.""" logger.debug("Tool get_sle called") logger.debug( From 438409967209b21df5b18570790ddaf28e90e41c Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 08:35:40 -0700 Subject: [PATCH 05/21] fix: clarify SLE metadata scopes Clarify that mxedge is valid for detailed site SLE data but not for the site_metrics or site_classifiers metadata scopes inherited from mist_list_site_sle_info. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/mistmcp/tools/get_sle.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/mistmcp/tools/get_sle.py b/src/mistmcp/tools/get_sle.py index 214ba09..20e3951 100644 --- a/src/mistmcp/tools/get_sle.py +++ b/src/mistmcp/tools/get_sle.py @@ -120,14 +120,14 @@ async def get_sle( scope: Annotated[ SiteSleScope, Field( - description="""Site SLE scope. Required when sle_scope is `site`, `site_metrics`, or `site_classifiers`. Can be `client`, `ap`, `gateway`, `mxedge`, `switch`, or `site`""", + description="""Site SLE scope. Required when sle_scope is `site`, `site_metrics`, or `site_classifiers`. For `sle_scope=site`, can be `client`, `ap`, `gateway`, `mxedge`, `switch`, or `site`. For `sle_scope=site_metrics` or `site_classifiers`, can be `client`, `ap`, `gateway`, `switch`, or `site`""", default=None, ), ], scope_id: Annotated[ str, Field( - description="""ID of the scoped object. Required when sle_scope is `site`, `site_metrics`, or `site_classifiers`. Use `site_id` if `scope=site`; `device_id` if `scope=ap`, `switch`, or `gateway`; `MAC address` if `scope=client`""", + description="""ID of the scoped object. Required when sle_scope is `site`, `site_metrics`, or `site_classifiers`. Use `site_id` if `scope=site`; `device_id` if `scope=ap`, `switch`, `gateway`, or `mxedge`; `MAC address` if `scope=client`""", default=None, ), ], From d44c77e228da06b14e73323e185cfcbda536f357 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 08:51:15 -0700 Subject: [PATCH 06/21] feat: add operation IDs for change configuration objects --- mcp_generator/generate_from_openapi.py | 4 +- .../tmpl_tool_change_configuration_objects.py | 93 +++++++++++++++++++ 2 files changed, 96 insertions(+), 1 deletion(-) diff --git a/mcp_generator/generate_from_openapi.py b/mcp_generator/generate_from_openapi.py index 65d991d..306a4d9 100644 --- a/mcp_generator/generate_from_openapi.py +++ b/mcp_generator/generate_from_openapi.py @@ -59,6 +59,7 @@ REQ_TEMPLATE, ) from mcp_generator.templates.tmpl_tool_change_configuration_objects import ( + CHANGE_CONFIGURATION_OBJECTS_OPERATION_IDS, CHANGE_CONFIGURATION_OBJECTS_TEMPLATE, ) from mcp_generator.templates.tmpl_tool_read import TOOL_TEMPLATE_READ @@ -85,6 +86,7 @@ from templates.tmpl_init import INIT_TEMPLATE from templates.tmpl_req import REQ_OPTIMIZED_TEMPLATE, REQ_TEMPLATE from templates.tmpl_tool_change_configuration_objects import ( + CHANGE_CONFIGURATION_OBJECTS_OPERATION_IDS, CHANGE_CONFIGURATION_OBJECTS_TEMPLATE, ) from templates.tmpl_tool_read import TOOL_TEMPLATE_READ @@ -145,7 +147,7 @@ "name": "change_configuration_objects", "template": CHANGE_CONFIGURATION_OBJECTS_TEMPLATE, "tag": "write_delete", - "operation_ids": [], + "operation_ids": CHANGE_CONFIGURATION_OBJECTS_OPERATION_IDS, }, { "name": "update_configuration_objects", diff --git a/mcp_generator/templates/tmpl_tool_change_configuration_objects.py b/mcp_generator/templates/tmpl_tool_change_configuration_objects.py index 2721ba0..2d70527 100644 --- a/mcp_generator/templates/tmpl_tool_change_configuration_objects.py +++ b/mcp_generator/templates/tmpl_tool_change_configuration_objects.py @@ -1,3 +1,96 @@ +CHANGE_CONFIGURATION_OBJECTS_OPERATION_IDS = [ + "updateOrg", + "updateOrgSettings", + "updateOrgAlarmTemplate", + "createOrgAlarmTemplate", + "deleteOrgAlarmTemplate", + "updateOrgWlan", + "createOrgWlan", + "deleteOrgWlan", + "updateOrgSiteGroup", + "createOrgSiteGroup", + "deleteOrgSiteGroup", + "createOrgSite", + "updateOrgAntivirusProfile", + "createOrgAntivirusProfile", + "deleteOrgAntivirusProfile", + "updateOrgDeviceProfile", + "createOrgDeviceProfile", + "deleteOrgDeviceProfile", + "updateOrgGatewayTemplate", + "createOrgGatewayTemplate", + "deleteOrgGatewayTemplate", + "updateOrgIdpProfile", + "createOrgIdpProfile", + "deleteOrgIdpProfile", + "updateOrgAAMWProfile", + "createOrgAAMWProfile", + "deleteOrgAAMWProfile", + "updateOrgNacTag", + "createOrgNacTag", + "deleteOrgNacTag", + "updateOrgNacRule", + "createOrgNacRule", + "deleteOrgNacRule", + "updateOrgNetworkTemplate", + "createOrgNetworkTemplate", + "deleteOrgNetworkTemplate", + "updateOrgNetwork", + "createOrgNetwork", + "deleteOrgNetwork", + "updateOrgPsk", + "createOrgPsk", + "deleteOrgPsk", + "updateOrgRfTemplate", + "createOrgRfTemplate", + "deleteOrgRfTemplate", + "updateOrgService", + "createOrgService", + "deleteOrgService", + "updateOrgServicePolicy", + "createOrgServicePolicy", + "deleteOrgServicePolicy", + "updateOrgSiteTemplate", + "createOrgSiteTemplate", + "deleteOrgSiteTemplate", + "updateOrgVpn", + "createOrgVpn", + "deleteOrgVpn", + "updateOrgWebhook", + "createOrgWebhook", + "deleteOrgWebhook", + "updateOrgTemplate", + "createOrgTemplate", + "deleteOrgTemplate", + "updateOrgWxRule", + "createOrgWxRule", + "deleteOrgWxRule", + "updateOrgWxTag", + "createOrgWxTag", + "deleteOrgWxTag", + "Site Operations:", + "updateSiteInfo", + "deleteSite", + "updateSiteSettings", + "updateSiteDevice", + "updateSitePsk", + "createSitePsk", + "deleteSitePsk", + "updateSiteWebhook", + "createSiteWebhook", + "deleteSiteWebhook", + "updateSiteWlan", + "createSiteWlan", + "deleteSiteWlan", + "updateSiteWxRule", + "createSiteWxRule", + "deleteSiteWxRule", + "updateSiteWxTag", + "createSiteWxTag", + "deleteSiteWxTag", +] + + CHANGE_CONFIGURATION_OBJECTS_TEMPLATE = r''' """ -------------------------------------------------------------------------------- From 2bf078f218d6b9569b4e251f8929687a94d8723f Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 08:52:01 -0700 Subject: [PATCH 07/21] fix: correct getSiteSettings to getSiteSetting and add missing operation IDs --- mcp_generator/templates/tmpl_get_configuration_objets.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/mcp_generator/templates/tmpl_get_configuration_objets.py b/mcp_generator/templates/tmpl_get_configuration_objets.py index 414b6e0..7a7ce13 100644 --- a/mcp_generator/templates/tmpl_get_configuration_objets.py +++ b/mcp_generator/templates/tmpl_get_configuration_objets.py @@ -2,7 +2,9 @@ "getOrg", "getOrgSettings", "getSiteInfo", - "getSiteSettings", + "getSiteSetting", + "listOrgSites", + "searchSiteDevices", "listSiteWxTags", "getSiteWxTag", "listSiteWxRules", From 72812887d62ac4af92bd159b97b9d8aabb7dc271 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 08:55:06 -0700 Subject: [PATCH 08/21] feat: add get_sle operation with associated template and operation IDs --- mcp_generator/generate_from_openapi.py | 8 + mcp_generator/templates/tmpl_get_sle.py | 580 ++++++++++++++++++++++++ 2 files changed, 588 insertions(+) create mode 100644 mcp_generator/templates/tmpl_get_sle.py diff --git a/mcp_generator/generate_from_openapi.py b/mcp_generator/generate_from_openapi.py index 306a4d9..77068a6 100644 --- a/mcp_generator/generate_from_openapi.py +++ b/mcp_generator/generate_from_openapi.py @@ -42,6 +42,7 @@ # - running as script: `python mcp_generator/generate_from_openapi.py` # - running as module: `python -m mcp_generator.generate_from_openapi` try: + from templates.tmpl_get_sle import GET_SLE_OPERATION_IDS, GET_SLE_TEMPLATE from templates.tmpl_tool_utilities import UTILITIES_TEMPLATE from mcp_generator.templates.tmpl_get_configuration_object_schema import ( @@ -81,6 +82,7 @@ GET_CONFIGURATION_OBJECTS_OPERATION_IDS, GET_CONFIGURATION_OBJECTS_TEMPLATE, ) + from templates.tmpl_get_sle import GET_SLE_OPERATION_IDS, GET_SLE_TEMPLATE from templates.tmpl_getnextpage import GET_NEXT_PAGE_TEMPLATE from templates.tmpl_helper import TOOLS_HELPER from templates.tmpl_init import INIT_TEMPLATE @@ -161,6 +163,12 @@ "tag": "utilities", "operation_ids": [], }, + { + "name": "get_sle", + "template": GET_SLE_TEMPLATE, + "tag": "sles", + "operation_ids": GET_SLE_OPERATION_IDS, + }, ] # Global read-only hint for tool generation READ_ONLY_HINT = True diff --git a/mcp_generator/templates/tmpl_get_sle.py b/mcp_generator/templates/tmpl_get_sle.py new file mode 100644 index 0000000..29de677 --- /dev/null +++ b/mcp_generator/templates/tmpl_get_sle.py @@ -0,0 +1,580 @@ +GET_SLE_OPERATION_IDS = [ + "getOrgSitesSle", + "getOrgSle", + "getSiteSleClassifierSummaryTrend", + "getSiteSleHistogram", + "getSiteSleImpactSummary", + "getSiteSleSummary", + "getSiteSleSummaryTrend", + "getSiteSleThreshold", + "listSiteSleImpactedApplications", + "listSiteSleImpactedAps", + "listSiteSleImpactedChassis", + "listSiteSleImpactedGateways", + "listSiteSleImpactedInterfaces", + "listSiteSleImpactedSwitches", + "listSiteSleImpactedWiredClients", + "listSiteSleImpactedWirelessClients", + "listSiteSleMetricClassifiers", + "listSiteSlesMetrics", +] + +GET_SLE_TEMPLATE = '''""" +-------------------------------------------------------------------------------- +-------------------------------- Mist MCP SERVER ------------------------------- + + Written by: Thomas Munzer (tmunzer@juniper.net) + Github : https://github.com/tmunzer/mistmcp + + This package is licensed under the MIT License. + +-------------------------------------------------------------------------------- +""" + +import mistapi +from fastmcp.exceptions import ToolError +from mistmcp.request_processor import get_apisession +from mistmcp.response_processor import process_response, handle_network_error +from mistmcp.response_formatter import format_response +from mistmcp.server import mcp +from mistmcp.logger import logger + +from pydantic import Field +from typing import Annotated +from uuid import UUID +from enum import Enum + + +class SleScope(Enum): + ORG = "org" + ORG_SITES = "org_sites" + SITE = "site" + SITE_METRICS = "site_metrics" + SITE_CLASSIFIERS = "site_classifiers" + + +class OrgSitesSle(Enum): + WIFI = "wifi" + WIRED = "wired" + WAN = "wan" + + +class SiteSleScope(Enum): + CLIENT = "client" + AP = "ap" + GATEWAY = "gateway" + MXEDGE = "mxedge" + SWITCH = "switch" + SITE = "site" + + +class ObjectType(Enum): + SUMMARY = "summary" + IMPACT_SUMMARY = "impact_summary" + SUMMARY_TREND = "summary_trend" + IMPACTED_APPLICATIONS = "impacted_applications" + IMPACTED_APS = "impacted_aps" + IMPACTED_GATEWAYS = "impacted_gateways" + IMPACTED_INTERFACES = "impacted_interfaces" + IMPACTED_SWITCHES = "impacted_switches" + IMPACTED_WIRELESS_CLIENTS = "impacted_wireless_clients" + IMPACTED_WIRED_CLIENTS = "impacted_wired_clients" + IMPACTED_CHASSIS = "impacted_chassis" + HISTOGRAM = "histogram" + CLASSIFIER_SUMMARY_TREND = "classifier_summary_trend" + THRESHOLD = "threshold" + + +@mcp.tool( + name="mist_get_sle", + description="""Get SLE (Service Level Expectation) data at different scopes. +Use `sle_scope=org` to get org-level SLEs (all/worst sites, Mx Edges, ...). +Use `sle_scope=org_sites` to get SLE summary for all organization sites. +Use `sle_scope=site` to get detailed site-level SLE data (summary, trends, impacted devices/clients, histograms, thresholds). +Use `sle_scope=site_metrics` to discover available SLE metrics for a given site scope. +Use `sle_scope=site_classifiers` to list classifiers for a specific SLE metric (requires `metric` parameter). +Use `sle_scope=site_metrics` first to discover metric names before querying SLE data.""", + tags={"sles"}, + annotations={ + "title": "Get SLE", + "readOnlyHint": True, + "destructiveHint": False, + "openWorldHint": True, + "idempotentHint": True, + }, +) +async def get_sle( + sle_scope: Annotated[ + SleScope, + Field( + description="""Scope of the SLE query. `org`: org-level SLEs; `org_sites`: SLE summary for all sites in the org; `site`: detailed site-level SLE data; `site_metrics`: list available SLE metrics for a site scope; `site_classifiers`: list classifiers for a specific metric""" + ), + ], + org_id: Annotated[ + UUID, + Field( + description="""Organization ID. Required when sle_scope is `org` or `org_sites`""", + default=None, + ), + ], + site_id: Annotated[ + UUID, + Field( + description="""Site ID. Required when sle_scope is `site`, `site_metrics`, or `site_classifiers`""", + default=None, + ), + ], + metric: Annotated[ + str, + Field( + description="""SLE metric name. Required when sle_scope is `org`, `site`, or `site_classifiers`. Use `sle_scope=site_metrics` or `mist_get_constants` with `object_type=insight_metrics` to discover available metrics""", + default=None, + ), + ], + sle: Annotated[ + str, + Field( + description="""SLE type. When sle_scope is `org`: SLE name to filter on (use `mist_get_insight_metrics` to discover available values). When sle_scope is `org_sites`: must be `wifi`, `wired`, or `wan`""", + default=None, + ), + ], + scope: Annotated[ + SiteSleScope, + Field( + description="""Site SLE scope. Required when sle_scope is `site`, `site_metrics`, or `site_classifiers`. For `sle_scope=site`, can be `client`, `ap`, `gateway`, `mxedge`, `switch`, or `site`. For `sle_scope=site_metrics` or `site_classifiers`, can be `client`, `ap`, `gateway`, `switch`, or `site`""", + default=None, + ), + ], + scope_id: Annotated[ + str, + Field( + description="""ID of the scoped object. Required when sle_scope is `site`, `site_metrics`, or `site_classifiers`. Use `site_id` if `scope=site`; `device_id` if `scope=ap`, `switch`, `gateway`, or `mxedge`; `MAC address` if `scope=client`""", + default=None, + ), + ], + object_type: Annotated[ + ObjectType, + Field( + description="""Type of SLE data to retrieve. Required when sle_scope is `site`""", + default=None, + ), + ], + start: Annotated[ + int, Field(description="""Start of time range (epoch seconds)""", default=None) + ], + end: Annotated[ + int, Field(description="""End of time range (epoch seconds)""", default=None) + ], + classifier: Annotated[ + str, + Field( + description="""Classifier name. Required when sle_scope is `site` and object_type is `classifier_summary_trend`""", + default=None, + ), + ], + duration: Annotated[ + str, + Field( + description="""Time range duration (e.g. 1d, 1h, 10m). Only used when sle_scope is `site`""", + default=None, + ), + ], + limit: Annotated[ + int, + Field( + description="""Max number of results per page. Only used when sle_scope is `org_sites`""", + default=20, + ), + ] = 20, +) -> dict | list | str: + """Get SLE data at org, org_sites, site, site_metrics, or site_classifiers scope.""" + + logger.debug("Tool get_sle called") + logger.debug( + "Input Parameters: sle_scope: %s, org_id: %s, site_id: %s, metric: %s, sle: %s, scope: %s, scope_id: %s, object_type: %s, start: %s, end: %s, limit: %s, classifier: %s, duration: %s", + sle_scope, + org_id, + site_id, + metric, + sle, + scope, + scope_id, + object_type, + start, + end, + limit, + classifier, + duration, + ) + + apisession, response_format = await get_apisession() + + try: + match sle_scope: + case SleScope.ORG: + if not org_id: + raise ToolError( + { + "status_code": 400, + "message": "`org_id` is required when `sle_scope` is `org`.", + } + ) + if not metric: + raise ToolError( + { + "status_code": 400, + "message": "`metric` is required when `sle_scope` is `org`.", + } + ) + response = mistapi.api.v1.orgs.insights.getOrgSle( + apisession, + org_id=str(org_id), + metric=str(metric), + sle=str(sle) if sle else None, + start=str(start) if start else None, + end=str(end) if end else None, + ) + await process_response(response) + + case SleScope.ORG_SITES: + if not org_id: + raise ToolError( + { + "status_code": 400, + "message": "`org_id` is required when `sle_scope` is `org_sites`.", + } + ) + if not sle: + raise ToolError( + { + "status_code": 400, + "message": "`sle` is required when `sle_scope` is `org_sites`. Must be `wifi`, `wired`, or `wan`.", + } + ) + sle_value = sle + valid_sle_values = [e.value for e in OrgSitesSle] + if sle_value not in valid_sle_values: + raise ToolError( + { + "status_code": 400, + "message": f"Invalid `sle` value: {sle_value}. Must be one of: {valid_sle_values}", + } + ) + response = mistapi.api.v1.orgs.insights.getOrgSitesSle( + apisession, + org_id=str(org_id), + sle=sle_value, + start=str(start) if start else None, + end=str(end) if end else None, + limit=limit, + ) + await process_response(response) + + case SleScope.SITE: + if not site_id: + raise ToolError( + { + "status_code": 400, + "message": "`site_id` is required when `sle_scope` is `site`.", + } + ) + if not scope: + raise ToolError( + { + "status_code": 400, + "message": "`scope` is required when `sle_scope` is `site`.", + } + ) + if not scope_id: + raise ToolError( + { + "status_code": 400, + "message": "`scope_id` is required when `sle_scope` is `site`.", + } + ) + if not metric: + raise ToolError( + { + "status_code": 400, + "message": "`metric` is required when `sle_scope` is `site`.", + } + ) + if not object_type: + raise ToolError( + { + "status_code": 400, + "message": "`object_type` is required when `sle_scope` is `site`.", + } + ) + + if object_type == ObjectType.CLASSIFIER_SUMMARY_TREND: + if not classifier: + raise ToolError( + { + "status_code": 400, + "message": "`classifier` parameter is required when `object_type` is `classifier_summary_trend`.", + } + ) + + match object_type: + case ObjectType.SUMMARY: + response = mistapi.api.v1.sites.sle.getSiteSleSummary( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + case ObjectType.IMPACT_SUMMARY: + response = mistapi.api.v1.sites.sle.getSiteSleImpactSummary( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + case ObjectType.SUMMARY_TREND: + response = mistapi.api.v1.sites.sle.getSiteSleSummaryTrend( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + case ObjectType.IMPACTED_APPLICATIONS: + response = ( + mistapi.api.v1.sites.sle.listSiteSleImpactedApplications( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.IMPACTED_APS: + response = mistapi.api.v1.sites.sle.listSiteSleImpactedAps( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + case ObjectType.IMPACTED_GATEWAYS: + response = ( + mistapi.api.v1.sites.sle.listSiteSleImpactedGateways( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.IMPACTED_INTERFACES: + response = ( + mistapi.api.v1.sites.sle.listSiteSleImpactedInterfaces( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.IMPACTED_SWITCHES: + response = ( + mistapi.api.v1.sites.sle.listSiteSleImpactedSwitches( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.IMPACTED_WIRELESS_CLIENTS: + response = ( + mistapi.api.v1.sites.sle.listSiteSleImpactedWirelessClients( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.IMPACTED_WIRED_CLIENTS: + response = ( + mistapi.api.v1.sites.sle.listSiteSleImpactedWiredClients( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.IMPACTED_CHASSIS: + response = ( + mistapi.api.v1.sites.sle.listSiteSleImpactedChassis( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.HISTOGRAM: + response = mistapi.api.v1.sites.sle.getSiteSleHistogram( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + case ObjectType.CLASSIFIER_SUMMARY_TREND: + response = ( + mistapi.api.v1.sites.sle.getSiteSleClassifierSummaryTrend( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + classifier=classifier, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, + ) + ) + case ObjectType.THRESHOLD: + response = mistapi.api.v1.sites.sle.getSiteSleThreshold( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + ) + case _: + raise ToolError( + { + "status_code": 400, + "message": f"Invalid object_type: {object_type.value}. Valid values are: {[e.value for e in ObjectType]}", + } + ) + await process_response(response) + + case SleScope.SITE_METRICS: + if not site_id: + raise ToolError( + { + "status_code": 400, + "message": "`site_id` is required when `sle_scope` is `site_metrics`.", + } + ) + if not scope: + raise ToolError( + { + "status_code": 400, + "message": "`scope` is required when `sle_scope` is `site_metrics`.", + } + ) + if not scope_id: + raise ToolError( + { + "status_code": 400, + "message": "`scope_id` is required when `sle_scope` is `site_metrics`.", + } + ) + response = mistapi.api.v1.sites.sle.listSiteSlesMetrics( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + ) + await process_response(response) + + case SleScope.SITE_CLASSIFIERS: + if not site_id: + raise ToolError( + { + "status_code": 400, + "message": "`site_id` is required when `sle_scope` is `site_classifiers`.", + } + ) + if not scope: + raise ToolError( + { + "status_code": 400, + "message": "`scope` is required when `sle_scope` is `site_classifiers`.", + } + ) + if not scope_id: + raise ToolError( + { + "status_code": 400, + "message": "`scope_id` is required when `sle_scope` is `site_classifiers`.", + } + ) + if not metric: + raise ToolError( + { + "status_code": 400, + "message": "`metric` is required when `sle_scope` is `site_classifiers`. Use `sle_scope=site_metrics` first to discover available metric names.", + } + ) + response = mistapi.api.v1.sites.sle.listSiteSleMetricClassifiers( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + ) + await process_response(response) + + case _: + raise ToolError( + { + "status_code": 400, + "message": f"Invalid sle_scope: {sle_scope.value}. Valid values are: {[e.value for e in SleScope]}", + } + ) + + except ToolError: + raise + except Exception as _exc: + await handle_network_error(_exc) + + return format_response(response, response_format) + +''' From 1bb36137eaa3a8d5c6c9e1ce238352b4d251557e Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 08:59:21 -0700 Subject: [PATCH 09/21] fix: improve formatting and readability in utility functions --- mcp_generator/templates/tmpl_tool_utilities.py | 10 +++++++--- src/mistmcp/tools/utilities.py | 15 ++++++++------- 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/mcp_generator/templates/tmpl_tool_utilities.py b/mcp_generator/templates/tmpl_tool_utilities.py index 0846b84..c392ef0 100644 --- a/mcp_generator/templates/tmpl_tool_utilities.py +++ b/mcp_generator/templates/tmpl_tool_utilities.py @@ -209,7 +209,11 @@ def _format_default_value(default: Any, annotation: Any) -> Any: return None target = _strip_optional(annotation) - if inspect.isclass(target) and issubclass(target, Enum) and isinstance(default, target): + if ( + inspect.isclass(target) + and issubclass(target, Enum) + and isinstance(default, target) + ): return default.value return default @@ -311,7 +315,7 @@ def _build_parameters_field_description() -> str: f"Example: `{example_text}`" ) - return "\n".join(lines) + return "\\n".join(lines) PARAMETERS_FIELD_DESCRIPTION = _build_parameters_field_description() @@ -583,7 +587,7 @@ def _format_device_utility_result( if result["stream_output"] and all( isinstance(item, str) for item in result["stream_output"] ): - result["stream_output_text"] = "\n".join(result["stream_output"]) + result["stream_output_text"] = "\\n".join(result["stream_output"]) if not completed: result["message"] = ( diff --git a/src/mistmcp/tools/utilities.py b/src/mistmcp/tools/utilities.py index 1f328e7..7f4a82a 100644 --- a/src/mistmcp/tools/utilities.py +++ b/src/mistmcp/tools/utilities.py @@ -207,7 +207,11 @@ def _format_default_value(default: Any, annotation: Any) -> Any: return None target = _strip_optional(annotation) - if inspect.isclass(target) and issubclass(target, Enum) and isinstance(default, target): + if ( + inspect.isclass(target) + and issubclass(target, Enum) + and isinstance(default, target) + ): return default.value return default @@ -226,8 +230,7 @@ def _build_parameters_field_description() -> str: lines.append(f"Supported utilities: {', '.join(utility_names)}.") lines.append("Parameter schemas (deduplicated by utility signature):") - grouped_schemas: dict[tuple[str, - tuple[tuple[Any, ...], ...]], dict[str, Any]] = {} + grouped_schemas: dict[tuple[str, tuple[tuple[Any, ...], ...]], dict[str, Any]] = {} for device_type, device_utilities in SUPPORTED_DEVICE_UTILITIES.items(): for utility_name, utility_callable in device_utilities.items(): @@ -255,8 +258,7 @@ def _build_parameters_field_description() -> str: requirement_text = "required" if required else "optional" default_value = None if parameter.default is not inspect.Signature.empty: - default_value = _format_default_value( - parameter.default, annotation) + default_value = _format_default_value(parameter.default, annotation) details = f"{parameter_name} ({type_description}, {requirement_text})" if default_value is not None: @@ -657,8 +659,7 @@ async def run_utilities( } ) - canonical_utility, utility_callable = _resolve_utility( - device_type, utility) + canonical_utility, utility_callable = _resolve_utility(device_type, utility) if canonical_utility in MUTATING_DEVICE_UTILITIES and not config.enable_write_tools: raise ToolError( { From 5e25da89ef36d87a4b6cfe0678f3aa823b1c8618 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 08:59:42 -0700 Subject: [PATCH 10/21] Implement code changes to enhance functionality and improve performance --- src/mistmcp/tools/schemas_data.py | 7958 +++++++++++++++++++---------- 1 file changed, 5255 insertions(+), 2703 deletions(-) diff --git a/src/mistmcp/tools/schemas_data.py b/src/mistmcp/tools/schemas_data.py index 76d4bff..98be6ef 100644 --- a/src/mistmcp/tools/schemas_data.py +++ b/src/mistmcp/tools/schemas_data.py @@ -34,7 +34,7 @@ }, "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled", "examples": [ 0 ], @@ -43,22 +43,24 @@ "type": "integer" }, "acct_servers": { - "description": "List of RADIUS accounting servers, optional, order matters where the first one is treated as primary", + "description": "RADIUS accounting servers used by this WLAN", "items": { "additionalProperties": false, + "description": "RADIUS accounting server settings", "properties": { "host": { - "description": "IP/ hostname of RADIUS server", + "description": "Address or hostname of the RADIUS accounting server", "examples": [ "1.2.3.4" ], "type": "string" }, "keywrap_enabled": { + "description": "Whether RADIUS keywrap is enabled for messages sent to this accounting server", "type": "boolean" }, "keywrap_format": { - "description": "enum: `ascii`, `hex`", + "description": "Encoding format for RADIUS keywrap KEK and MACK values", "enum": [ "ascii", "hex" @@ -66,12 +68,14 @@ "type": "string" }, "keywrap_kek": { + "description": "RADIUS keywrap key encryption key (KEK)", "examples": [ "1122334455" ], "type": "string" }, "keywrap_mack": { + "description": "RADIUS keywrap message authentication code key (MACK)", "examples": [ "1122334455" ], @@ -88,10 +92,10 @@ "type": "string" } ], - "description": "Radius Auth Port, value from 1 to 65535, default is 1813" + "description": "UDP port used by the RADIUS accounting server" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS accounting server", "examples": [ "testing123" ], @@ -109,11 +113,11 @@ }, "airwatch": { "additionalProperties": false, - "description": "Airwatch wlan settings", + "description": "Integration settings for AirWatch device compliance on this WLAN", "properties": { "api_key": { "default": "", - "description": "API Key", + "description": "API key used to authenticate to the AirWatch service", "examples": [ "aHhlbGxvYXNkZmFzZGZhc2Rmc2RmCg==\\"" ], @@ -121,7 +125,7 @@ }, "console_url": { "default": "", - "description": "Console URL", + "description": "Base console URL of the AirWatch deployment", "examples": [ "https://hs1.airwatchportals.com" ], @@ -129,11 +133,12 @@ }, "enabled": { "default": false, + "description": "Whether AirWatch integration is enabled for the WLAN", "type": "boolean" }, "password": { "default": "", - "description": "Password", + "description": "AirWatch integration account password for this WLAN", "examples": [ "user1" ], @@ -142,7 +147,7 @@ }, "username": { "default": "", - "description": "Username", + "description": "AirWatch integration account username for this WLAN", "examples": [ "test123" ], @@ -167,7 +172,7 @@ "type": "boolean" }, "ap_ids": { - "description": "List of device ids", + "description": "Access point identifiers used when `apply_to`==`aps`", "items": { "format": "uuid", "type": "string" @@ -179,7 +184,7 @@ }, "app_limit": { "additionalProperties": false, - "description": "Bandwidth limiting for apps (applies to up/down)", + "description": "Bandwidth limits for applications on this WLAN", "properties": { "apps": { "additionalProperties": { @@ -197,6 +202,7 @@ }, "enabled": { "default": false, + "description": "Whether application bandwidth limits are enabled for this WLAN", "type": "boolean" }, "wxtag_ids": { @@ -217,11 +223,12 @@ }, "app_qos": { "additionalProperties": false, - "description": "APP qos wlan settings", + "description": "QoS rules for application traffic on this WLAN", "properties": { "apps": { "additionalProperties": { "additionalProperties": false, + "description": "QoS rewrite settings for traffic matching a named application", "properties": { "dscp": { "anyOf": [ @@ -234,7 +241,7 @@ "type": "integer" } ], - "description": "DSCP value range between 0 and 63" + "description": "Differentiated Services Code Point value applied to matching application traffic" }, "dst_subnet": { "description": "Subnet filter is not required but helps AP to only inspect certain traffic (thus reducing AP load)", @@ -248,6 +255,7 @@ "type": "object" }, "default": {}, + "description": "Map of application keys to QoS rewrite settings", "examples": [ { "skype-business-video": { @@ -261,11 +269,14 @@ }, "enabled": { "default": false, + "description": "Whether application QoS rewrite rules are enabled for this WLAN", "type": "boolean" }, "others": { + "description": "Custom traffic QoS rules that are not tied to named applications", "items": { "additionalProperties": false, + "description": "Custom QoS rewrite rule for traffic not matched by a named application", "properties": { "dscp": { "anyOf": [ @@ -278,27 +289,31 @@ "type": "integer" } ], - "description": "DSCP value range between 0 and 63" + "description": "Differentiated Services Code Point value applied to matching traffic" }, "dst_subnet": { + "description": "Destination subnet filter for this custom QoS rule", "examples": [ "10.2.0.0/16" ], "type": "string" }, "port_ranges": { + "description": "TCP or UDP port ranges matched by this custom QoS rule", "examples": [ "80,1024-6553" ], "type": "string" }, "protocol": { + "description": "IP protocol matched by this custom QoS rule", "examples": [ "udp" ], "type": "string" }, "src_subnet": { + "description": "Source subnet filter for this custom QoS rule", "examples": [ "10.2.0.0/16" ], @@ -314,7 +329,7 @@ "type": "object" }, "apply_to": { - "description": "enum: `aps`, `site`, `wxtags`", + "description": "Scope that determines where this WLAN is applied", "enum": [ "aps", "site", @@ -329,7 +344,7 @@ }, "auth": { "additionalProperties": false, - "description": "Authentication wlan settings", + "description": "Settings that control client authentication for this WLAN", "properties": { "anticlog_threshold": { "default": 16, @@ -363,14 +378,14 @@ }, "key_idx": { "default": 1, - "description": "When `type`==`wep`", + "description": "When `type`==`wep`, index of the WEP key used as the default transmit key", "maximum": 4, "minimum": 1, "type": "integer" }, "keys": { "default": [], - "description": "When type=wep, four 10-character or 26-character hex string, null can be used. All keys, if provided, have to be in the same length", + "description": "When `type`==`wep`, WEP keys configured for this WLAN", "items": { "type": [ "string", @@ -386,7 +401,7 @@ }, "owe": { "default": "disabled", - "description": "if `type`==`open`. enum: `disabled`, `enabled` (means transition mode), `required`", + "description": "When `type`==`open`, Opportunistic Wireless Encryption mode for this WLAN", "enum": [ "disabled", "enabled", @@ -398,7 +413,7 @@ "default": [ "wpa2-ccmp" ], - "description": "When `type`=`psk` or `type`=`eap`, one or more of `wpa1-ccmp`, `wpa1-tkip`, `wpa2-ccmp`, `wpa2-tkip`, `wpa3`", + "description": "When `type`==`psk` or `type`==`eap`, pairwise cipher suites allowed for this WLAN", "items": { "description": "enum: `wpa1-ccmp`, `wpa1-tkip`, `wpa2-ccmp`, `wpa2-tkip`, `wpa3`", "enum": [ @@ -438,7 +453,7 @@ }, "type": { "default": "open", - "description": "enum: `eap`, `eap192`, `open`, `psk`, `psk-tkip`, `psk-wpa2-tkip`, `wep`", + "description": "Authentication mode used by this WLAN", "enum": [ "eap", "eap192", @@ -466,7 +481,7 @@ }, "auth_server_selection": { "default": "ordered", - "description": "When ordered, AP will prefer and go back to the first server if possible. enum: `ordered`, `unordered`", + "description": "RADIUS authentication server selection behavior for this WLAN", "enum": [ "ordered", "unordered" @@ -477,23 +492,24 @@ "type": "string" }, "auth_servers": { - "description": "List of RADIUS authentication servers, at least one is needed if `auth type`==`eap`, order matters where the first one is treated as primary", + "description": "RADIUS authentication servers used by this WLAN. Required when `auth.type`==`eap`", "items": { "additionalProperties": false, - "description": "Authentication Server", + "description": "RADIUS authentication server settings", "properties": { "host": { - "description": "IP/ hostname of RADIUS server", + "description": "Address or hostname of the RADIUS authentication server", "examples": [ "1.2.3.4" ], "type": "string" }, "keywrap_enabled": { + "description": "Whether RADIUS keywrap is enabled for messages sent to this authentication server", "type": "boolean" }, "keywrap_format": { - "description": "enum: `ascii`, `hex`", + "description": "Encoding format for RADIUS keywrap KEK and MACK values", "enum": [ "ascii", "hex" @@ -501,12 +517,14 @@ "type": "string" }, "keywrap_kek": { + "description": "RADIUS keywrap key encryption key (KEK)", "examples": [ "1122334455" ], "type": "string" }, "keywrap_mack": { + "description": "RADIUS keywrap message authentication code key (MACK)", "examples": [ "1122334455" ], @@ -523,7 +541,7 @@ "type": "string" } ], - "description": "Radius Auth Port, value from 1 to 65535, default is 1812" + "description": "UDP port used by the RADIUS authentication server" }, "require_message_authenticator": { "default": false, @@ -531,7 +549,7 @@ "type": "boolean" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS authentication server", "examples": [ "testing123" ], @@ -569,7 +587,7 @@ }, "auth_servers_retries": { "default": 2, - "description": "Radius auth session retries. Following fast timers are set if \\"fast_dot1x_timers\\" knob is enabled. ‘retries’ are set to value of auth_servers_retries. ‘max-requests’ is also set when setting auth_servers_retries and is set to default value to 3.", + "description": "RADIUS auth session retries. Following fast timers are set if \\"fast_dot1x_timers\\" knob is enabled. ‘retries’ are set to value of auth_servers_retries. ‘max-requests’ is also set when setting auth_servers_retries and is set to default value to 3.", "examples": [ 5 ], @@ -577,12 +595,12 @@ }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout. Following fast timers are set if \\"fast_dot1x_timers\\" knob is enabled. ‘quite-period’ and ‘transmit-period’ are set to half the value of auth_servers_timeout. ‘supplicant-timeout’ is also set when setting auth_servers_timeout and is set to default value of 10.", + "description": "RADIUS auth session timeout. Following fast timers are set if \\"fast_dot1x_timers\\" knob is enabled. ‘quite-period’ and ‘transmit-period’ are set to half the value of auth_servers_timeout. ‘supplicant-timeout’ is also set when setting auth_servers_timeout and is set to default value of 10.", "type": "integer" }, "band": { "deprecated": true, - "description": "`band` is deprecated and kept for backward compatibility. Use bands instead", + "description": "`band` is deprecated and kept for backward compatibility. Use `bands` instead", "type": "string" }, "band_steer": { @@ -601,7 +619,7 @@ "5", "6" ], - "description": "List of radios that the wlan should apply to. enum: `24`, `5`, `5-dedicated`, `5-selectable`, `6`, `6-dedicated`, `6-selectable`", + "description": "Radio bands on which this WLAN is broadcast", "items": { "description": "enum: `24`, `5`, `5-dedicated`, `5-selectable`, `6`, `6-dedicated`, `6-selectable`", "enum": [ @@ -624,7 +642,7 @@ }, "bonjour": { "additionalProperties": false, - "description": "Bonjour gateway wlan settings", + "description": "Service discovery gateway settings for Bonjour traffic on this WLAN", "properties": { "additional_vlan_ids": { "anyOf": [ @@ -632,7 +650,9 @@ "type": "string" }, { + "description": "Additional VLAN IDs represented as an array", "items": { + "description": "VLAN ID, either numeric or expressed as a template variable string", "oneOf": [ { "type": "string" @@ -647,7 +667,7 @@ "type": "array" } ], - "description": "List or Comma separated list of additional VLAN IDs (on the LAN side or from other WLANs) should we be forwarding bonjour queries/responses" + "description": "VLAN IDs, beyond the client VLAN, where Bonjour queries and responses are forwarded" }, "enabled": { "default": false, @@ -657,6 +677,7 @@ "services": { "additionalProperties": { "additionalProperties": false, + "description": "Bonjour service discovery settings for one advertised service", "properties": { "disable_local": { "default": false, @@ -664,7 +685,7 @@ "type": "boolean" }, "radius_groups": { - "description": "Optional, if the service is further restricted for certain RADIUS groups", + "description": "RADIUS groups allowed to discover this Bonjour service, when restricted", "items": { "type": "string" }, @@ -672,7 +693,7 @@ }, "scope": { "default": "same_site", - "description": "how bonjour services should be discovered for the same WLAN. enum: `same_ap`, `same_map`, `same_site`", + "description": "Discovery scope for this Bonjour service on the WLAN", "enum": [ "same_ap", "same_map", @@ -701,10 +722,10 @@ }, "cisco_cwa": { "additionalProperties": false, - "description": "Cisco CWA (central web authentication) required RADIUS with COA in order to work. See CWA: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html", + "description": "Central web authentication settings for Cisco CWA on this WLAN", "properties": { "allowed_hostnames": { - "description": "List of hostnames without http(s):// (matched by substring)", + "description": "Hostnames allowed for Cisco CWA client access before authorization", "items": { "examples": [ "snapchat.com" @@ -714,7 +735,7 @@ "type": "array" }, "allowed_subnets": { - "description": "List of CIDRs", + "description": "CIDR subnets allowed for Cisco CWA client access before authorization", "items": { "examples": [ "63.5.3.0/24" @@ -724,7 +745,7 @@ "type": "array" }, "blocked_subnets": { - "description": "List of blocked CIDRs", + "description": "CIDR subnets blocked for Cisco CWA client access", "items": { "examples": [ "192.168.0.0/16" @@ -735,6 +756,7 @@ }, "enabled": { "default": false, + "description": "Whether Cisco CWA is enabled for this WLAN", "type": "boolean" } }, @@ -751,7 +773,7 @@ "type": "string" } ], - "description": "In kbps, value from 1 to 999000" + "description": "Downlink bandwidth limit applied per client" }, "client_limit_down_enabled": { "default": false, @@ -769,7 +791,7 @@ "type": "string" } ], - "description": "In kbps, value from 1 to 999000" + "description": "Uplink bandwidth limit applied per client" }, "client_limit_up_enabled": { "default": false, @@ -777,10 +799,10 @@ "type": "boolean" }, "coa_servers": { - "description": "List of COA (change of authorization) servers, optional", + "description": "RADIUS Change of Authorization servers available to this WLAN", "items": { "additionalProperties": false, - "description": "CoA Server", + "description": "RADIUS Change of Authorization (CoA) server settings", "properties": { "disable_event_timestamp_check": { "default": false, @@ -789,9 +811,11 @@ }, "enabled": { "default": false, + "description": "Whether this RADIUS CoA server is enabled", "type": "boolean" }, "ip": { + "description": "Server IPv4 address for RADIUS CoA messages", "examples": [ "1.2.3.4" ], @@ -809,9 +833,10 @@ "type": "string" } ], - "description": "Radius CoA Port, value from 1 to 65535, default is 3799" + "description": "UDP port used to send RADIUS CoA messages to the server" }, "secret": { + "description": "Shared secret used to authenticate RADIUS CoA messages", "examples": [ "testing456" ], @@ -827,7 +852,7 @@ "type": "array" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Time when this WLAN was created, in epoch seconds", "format": "double", "readOnly": true, "type": "number" @@ -874,6 +899,7 @@ }, "disable_when_mxtunnel_down": { "default": false, + "description": "Whether to disable this WLAN when the configured Mist tunnel is down", "type": "boolean" }, "disable_wmm": { @@ -883,10 +909,11 @@ }, "dns_server_rewrite": { "additionalProperties": false, - "description": "For radius_group-based DNS server (rewrite DNS request depending on the Group RADIUS server returns)", + "description": "RADIUS group based DNS server rewrite settings for this WLAN", "properties": { "enabled": { "default": false, + "description": "Whether DNS server rewrite by RADIUS group is enabled for this WLAN", "type": "boolean" }, "radius_groups": { @@ -910,11 +937,12 @@ }, "dtim": { "default": 2, + "description": "Delivery Traffic Indication Message interval for this WLAN", "type": "integer" }, "dynamic_psk": { "additionalProperties": false, - "description": "For dynamic PSK where we get per_user PSK from Radius. dynamic_psk allows PSK to be selected at runtime depending on context (wlan/site/user/...) thus following configurations are assumed (currently)\\n * PSK will come from RADIUS server\\n * AP sends client MAC as username and password (i.e. `enable_mac_auth` is assumed)\\n * AP sends BSSID:SSID as Caller-Station-ID\\n * `auth_servers` is required\\n * PSK will come from cloud WLC if source is cloud_psks\\n * default_psk will be used if cloud WLC is not available\\n * `multi_psk_only` and `psk` is ignored\\n * `pairwise` can only be wpa2-ccmp (for now, wpa3 support on the roadmap)", + "description": "Per-user PSK selection settings for this WLAN", "properties": { "default_psk": { "description": "Default PSK to use if cloud WLC is not available, 8-63 characters", @@ -926,6 +954,7 @@ "type": "string" }, "default_vlan_id": { + "description": "Default VLAN ID used when dynamic PSK lookup does not return a VLAN", "oneOf": [ { "type": "string" @@ -939,6 +968,7 @@ }, "enabled": { "default": false, + "description": "Whether dynamic PSK is enabled for this WLAN", "type": "boolean" }, "force_lookup": { @@ -948,7 +978,7 @@ }, "source": { "default": "radius", - "description": "enum: `cloud_psks`, `radius`", + "description": "Origin used to retrieve per-user PSKs", "enum": [ "cloud_psks", "radius" @@ -966,11 +996,11 @@ }, "dynamic_vlan": { "additionalProperties": false, - "description": "For 802.1x", + "description": "VLAN assignment settings for 802.1X dynamic VLANs", "properties": { "default_vlan_id": { "deprecated": true, - "description": "vlan_id to use when there’s no match from RADIUS", + "description": "Deprecated default VLAN ID used when no RADIUS VLAN match is returned. Please use `default_vlan_ids` instead, which can support VLAN pools.", "oneOf": [ { "type": "string" @@ -984,7 +1014,7 @@ ] }, "default_vlan_ids": { - "description": "Default VLAN ID(s) can be a number, a range of VLAN IDs, a variable or multiple numbers, ranges or variables as a VLAN pool. Default VLAN as a pool of VLANS requires 0.14.x or newer firmware", + "description": "Fallback VLAN IDs, ranges, or variables used when no RADIUS VLAN match is returned", "items": { "description": "VLAN ID, VLAN range or variable to use when there’s no match from RADIUS", "oneOf": [ @@ -1007,8 +1037,9 @@ "type": "boolean" }, "local_vlan_ids": { - "description": "VLAN_ids to be locally bridged", + "description": "VLAN IDs that should be locally bridged for dynamic VLAN assignment", "items": { + "description": "VLAN ID, either numeric or expressed as a template variable string", "oneOf": [ { "type": "string" @@ -1024,7 +1055,7 @@ }, "type": { "default": "standard", - "description": "standard (using Tunnel-Private-Group-ID, widely supported), airespace-interface-name (Airespace/Cisco). enum: `airespace-interface-name`, `standard`", + "description": "Dynamic VLAN mapping method used for RADIUS-provided VLAN attributes", "enum": [ "airespace-interface-name", "standard" @@ -1038,7 +1069,7 @@ "additionalProperties": { "type": "string" }, - "description": "Map between vlan_id (as string) to airespace interface names (comma-separated) or null for standard mapping\\n * if `dynamic_vlan.type`==`standard`, property key is the Vlan ID and property value is \\\\\\"\\\\\\"\\n * if `dynamic_vlan.type`==`airespace-interface-name`, property key is the Vlan ID and property value is the Airespace Interface Name", + "description": "Map between vlan_id (as string) to airespace interface names (comma-separated) or null for standard mapping\\n * if `dynamic_vlan.type`==`standard`, property key is the VLAN ID and property value is \\\\\\"\\\\\\"\\n * if `dynamic_vlan.type`==`airespace-interface-name`, property key is the VLAN ID and property value is the Airespace Interface Name", "examples": [ { "131": "default", @@ -1079,6 +1110,7 @@ "type": "boolean" }, "for_site": { + "description": "Whether this WLAN record is scoped to a site", "readOnly": true, "type": "boolean" }, @@ -1094,9 +1126,10 @@ }, "hotspot20": { "additionalProperties": false, - "description": "Hostspot 2.0 wlan settings", + "description": "Passpoint and Hotspot 2.0 settings for this WLAN", "properties": { "domain_name": { + "description": "Advertised domain names for Hotspot 2.0 clients", "examples": [ [ "mist.com" @@ -1112,6 +1145,7 @@ "type": "boolean" }, "nai_realms": { + "description": "NAI realms advertised for Hotspot 2.0 authentication", "items": { "type": "string" }, @@ -1119,7 +1153,7 @@ "uniqueItems": true }, "operators": { - "description": "List of operators to support", + "description": "Operator profiles supported by this Hotspot 2.0 configuration", "examples": [ [ "google", @@ -1149,6 +1183,7 @@ "type": "array" }, "rcoi": { + "description": "Roaming Consortium Organization Identifiers advertised for Hotspot 2.0", "examples": [ [ "5A03BA0000" @@ -1170,7 +1205,7 @@ "type": "object" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier for this WLAN", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -1180,6 +1215,7 @@ }, "inject_dhcp_option_82": { "additionalProperties": false, + "description": "DHCP Option 82 insertion settings for this WLAN", "properties": { "circuit_id": { "description": "Information to set in the `circuit_id` field of the DHCP Option 82. It is possible to use static string or the following variables (e.g. `{{SSID}}:{{AP_MAC}}`):\\n * {{AP_MAC}}\\n * {{AP_MAC_DASHED}}\\n * {{AP_MODEL}}\\n * {{AP_NAME}}\\n * {{SITE_NAME}}\\n * {{SSID}}", @@ -1198,7 +1234,7 @@ }, "interface": { "default": "all", - "description": "where this WLAN will be connected to. enum: `all`, `eth0`, `eth1`, `eth2`, `eth3`, `mxtunnel`, `site_mxedge`, `wxtunnel`", + "description": "Network interface or tunnel where this WLAN bridges client traffic", "enum": [ "all", "eth0", @@ -1258,10 +1294,11 @@ }, "mist_nac": { "additionalProperties": false, + "description": "Juniper Mist NAC settings used by this WLAN", "properties": { "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled.", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled.", "examples": [ 60 ], @@ -1271,7 +1308,7 @@ }, "auth_servers_retries": { "default": 2, - "description": "Radius auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"retries\\" are set to value of `auth_servers_timeout`. \\"max-requests\\" is also set when setting `auth_servers_retries` is set to default value to 3.", + "description": "RADIUS auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"retries\\" are set to value of `auth_servers_timeout`. \\"max-requests\\" is also set when setting `auth_servers_retries` is set to default value to 3.", "examples": [ 3 ], @@ -1281,7 +1318,7 @@ }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"quite-period\\" and \\"transmit-period\\" are set to half the value of `auth_servers_timeout`. \\"supplicant-timeout\\" is also set when setting `auth_servers_timeout` is set to default value of 10.", + "description": "RADIUS auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"quite-period\\" and \\"transmit-period\\" are set to half the value of `auth_servers_timeout`. \\"supplicant-timeout\\" is also set when setting `auth_servers_timeout` is set to default value of 10.", "examples": [ 5 ], @@ -1337,12 +1374,13 @@ "type": "object" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Time when this WLAN was last modified, in epoch seconds", "format": "double", "readOnly": true, "type": "number" }, "msp_id": { + "description": "Managed service provider identifier associated with this WLAN", "examples": [ "b9d42c2e-88ee-41f8-b798-f009ce7fe909" ], @@ -1357,7 +1395,7 @@ "type": "string" }, "mxtunnel_ids": { - "description": "When `interface`=`mxtunnel`, id of the Mist Tunnel", + "description": "Mist Tunnel identifiers used when `interface`==`mxtunnel`", "format": "uuid", "items": { "examples": [ @@ -1368,7 +1406,7 @@ "type": "array" }, "mxtunnel_name": { - "description": "When `interface`=`site_mxedge`, name of the mxtunnel that in mxtunnels under Site Setting", + "description": "Mist Tunnel names used when `interface`==`site_mxedge`", "items": { "default": "default", "examples": [ @@ -1389,6 +1427,7 @@ "type": "boolean" }, "org_id": { + "description": "Owning organization associated with this WLAN", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -1398,7 +1437,7 @@ }, "portal": { "additionalProperties": false, - "description": "Portal wlan settings", + "description": "Guest portal settings for this WLAN", "properties": { "allow_wlan_id_roam": { "default": false, @@ -1416,6 +1455,7 @@ "amazon_client_secret": { "default": "", "description": "Optional if `amazon_enabled`==`true`. Amazon OAuth2 client secret. If amazon_client_id was provided, provide a corresponding value. Else leave blank.", + "format": "password", "type": [ "string", "null" @@ -1423,7 +1463,7 @@ }, "amazon_email_domains": { "default": [], - "description": "Optional if `amazon_enabled`==`true`. Matches authenticated user email against provided domains. If null or [], all authenticated emails will be allowed.", + "description": "Optional if `amazon_enabled`==`true`. Email domains allowed for Amazon-authenticated guest users. If null or empty, any authenticated Amazon email domain is allowed.", "items": { "type": "string" }, @@ -1444,7 +1484,7 @@ }, "auth": { "default": "none", - "description": "authentication scheme. enum: `amazon`, `azure`, `email`, `external`, `facebook`, `google`, `microsoft`, `multi`, `none`, `password`, `sms`, `sponsor`, `sso`", + "description": "Guest portal login scheme used by the WLAN", "enum": [ "amazon", "azure", @@ -1476,6 +1516,7 @@ "azure_client_secret": { "default": "", "description": "Required if `azure_enabled`==`true`. Azure active directory app client secret", + "format": "password", "type": [ "string", "null" @@ -1504,7 +1545,7 @@ }, "broadnet_password": { "default": "", - "description": "Required if `sms_provider`==`broadnet`", + "description": "Required if `sms_provider`==`broadnet`. Password for the Broadnet SMS provider account", "examples": [ "password" ], @@ -1512,14 +1553,14 @@ "type": "string" }, "broadnet_sid": { - "description": "Required if `sms_provider`==`broadnet`", + "description": "Required if `sms_provider`==`broadnet`. SID for the Broadnet SMS provider account", "examples": [ "MIST" ], "type": "string" }, "broadnet_user_id": { - "description": "Required if `sms_provider`==`broadnet`", + "description": "Required if `sms_provider`==`broadnet`. User ID for the Broadnet SMS provider account", "examples": [ "juniper" ], @@ -1531,7 +1572,7 @@ "type": "boolean" }, "clickatell_api_key": { - "description": "Required if `sms_provider`==`clickatell`", + "description": "Required if `sms_provider`==`clickatell`. API key for the Clickatell SMS provider account", "type": "string" }, "cross_site": { @@ -1573,6 +1614,7 @@ "facebook_client_secret": { "default": "", "description": "Required if `facebook_enabled`==`true`. Facebook OAuth2 app secret. If facebook_client_id was provided, provide a corresponding value. Else leave blank.", + "format": "password", "type": [ "string", "null" @@ -1580,7 +1622,7 @@ }, "facebook_email_domains": { "default": [], - "description": "Optional if `facebook_enabled`==`true`. Matches authenticated user email against provided domains. If null or [], all authenticated emails will be allowed.", + "description": "Optional if `facebook_enabled`==`true`. Email domains allowed for Facebook-authenticated guest users. If null or empty, any authenticated Facebook email domain is allowed.", "items": { "type": "string" }, @@ -1626,6 +1668,7 @@ "google_client_secret": { "default": "", "description": "Optional if `google_enabled`==`true`. Google OAuth2 app secret. If google_client_id was provided, provide a corresponding value. Else leave blank.", + "format": "password", "type": [ "string", "null" @@ -1633,7 +1676,7 @@ }, "google_email_domains": { "default": [], - "description": "Optional if `google_enabled`==`true`. Matches authenticated user email against provided domains. If null or [], all authenticated emails will be allowed.", + "description": "Optional if `google_enabled`==`true`. Email domains allowed for Google-authenticated guest users. If null or empty, any authenticated Google email domain is allowed.", "examples": [ [ "mydomain.edu", @@ -1659,12 +1702,12 @@ ] }, "gupshup_password": { - "description": "Required if `sms_provider`==`gupshup`", + "description": "Required if `sms_provider`==`gupshup`. Password for the Gupshup SMS provider account", "format": "password", "type": "string" }, "gupshup_userid": { - "description": "Required if `sms_provider`==`gupshup`", + "description": "Required if `sms_provider`==`gupshup`. User ID for the Gupshup SMS provider account", "type": "string" }, "microsoft_client_id": { @@ -1678,6 +1721,7 @@ "microsoft_client_secret": { "default": "", "description": "Optional if `microsoft_enabled`==`true`. Microsoft 365 OAuth2 client secret. If microsoft_client_id was provided, provide a corresponding value. Else leave blank.", + "format": "password", "type": [ "string", "null" @@ -1685,7 +1729,7 @@ }, "microsoft_email_domains": { "default": [], - "description": "Optional if `microsoft_enabled`==`true`. Matches authenticated user email against provided domains. If null or [], all authenticated emails will be allowed.", + "description": "Optional if `microsoft_enabled`==`true`. Email domains allowed for Microsoft 365-authenticated guest users. If null or empty, any authenticated Microsoft 365 email domain is allowed.", "items": { "type": "string" }, @@ -1719,7 +1763,7 @@ }, "password": { "default": "", - "description": "Required if `passphrase_enabled`==`true`.", + "description": "Required if `passphrase_enabled`==`true`. Passphrase guests must enter when passphrase authentication is enabled", "examples": [ "let me in" ], @@ -1740,19 +1784,20 @@ }, "privacy": { "default": false, + "description": "Whether to show the privacy policy in the WLAN guest portal", "type": "boolean" }, "puzzel_password": { - "description": "Required if `sms_provider`==`puzzel`", + "description": "Required if `sms_provider`==`puzzel`. Password for the Puzzel SMS provider account", "format": "password", "type": "string" }, "puzzel_service_id": { - "description": "Required if `sms_provider`==`puzzel`", + "description": "Required if `sms_provider`==`puzzel`. Service ID for the Puzzel SMS provider account", "type": "string" }, "puzzel_username": { - "description": "Required if `sms_provider`==`puzzel`", + "description": "Required if `sms_provider`==`puzzel`. Username for the Puzzel SMS provider account", "type": "string" }, "smsMessageFormat": { @@ -1775,7 +1820,7 @@ }, "sms_provider": { "default": "manual", - "description": "Optional if `sms_enabled`==`true`. enum: `broadnet`, `clickatell`, `gupshup`, `manual`, `puzzel`, `smsglobal`, `telstra`, `twilio`", + "description": "Optional if `sms_enabled`==`true`. SMS provider used to deliver guest portal access codes", "enum": [ "broadnet", "clickatell", @@ -1806,7 +1851,7 @@ "type": "boolean" }, "sponsor_email_domains": { - "description": "List of domain allowed for sponsor email. Required if `sponsor_enabled` is `true` and `sponsors` is empty.", + "description": "Email domains allowed for sponsor email addresses. Required if `sponsor_enabled` is `true` and `sponsors` is empty.", "examples": [ [ "reserved.net", @@ -1843,7 +1888,7 @@ "type": "string" } ], - "description": "Optional if `sponsor_enabled`==`true`. How long to remain valid sponsored guest request approve/deny link received in email, in minutes. Value is between 5 and 60." + "description": "Optional if `sponsor_enabled`==`true`. Validity duration, in minutes, for approve or deny links in sponsor emails. Valid values are 5 to 60." }, "sponsor_notify_all": { "default": false, @@ -1856,9 +1901,10 @@ "type": "boolean" }, "sponsors": { - "description": "Object of allowed sponsors email with name. Required if `sponsor_enabled` is `true` and `sponsor_email_domains` is empty. Property key is the sponsor email, Property value is the sponsor name. List of email allowed for backward compatibility", + "description": "Allowed sponsor email addresses and display names. Required if `sponsor_enabled` is `true` and `sponsor_email_domains` is empty.", "oneOf": [ { + "description": "Allowed sponsor email addresses for guest portal sponsor approval", "items": { "type": "string" }, @@ -1868,6 +1914,7 @@ "additionalProperties": { "type": "string" }, + "description": "Allowed guest portal sponsors keyed by email address with sponsor names as values", "examples": [ { "sponsor1@company.com": "FirstName1 LastName1", @@ -1885,7 +1932,7 @@ }, "sso_forced_role": { "default": "", - "description": "Optional if `wlan_portal_auth`==`sso`", + "description": "Optional if `wlan_portal_auth`==`sso`. Role assigned to authenticated users when guest SSO is used", "type": "string" }, "sso_idp_cert": { @@ -1895,7 +1942,7 @@ }, "sso_idp_sign_algo": { "default": "sha1", - "description": "Optional if `wlan_portal_auth`==`sso`, Signing algorithm for SAML Assertion. enum: `sha1`, `sha256`, `sha384`, `sha512`", + "description": "Optional if `wlan_portal_auth`==`sso`. Signing algorithm used for SAML assertions from the identity provider", "enum": [ "sha1", "sha256", @@ -1916,7 +1963,7 @@ }, "sso_nameid_format": { "default": "email", - "description": "Optional if `wlan_portal_auth`==`sso`. enum: `email`, `unspecified`", + "description": "Optional if `wlan_portal_auth`==`sso`. SAML NameID format expected from the identity provider", "enum": [ "email", "unspecified" @@ -1937,6 +1984,7 @@ "examples": [ "af9dac44c344a875ab5d31cb7abcdefg" ], + "format": "password", "type": [ "string", "null" @@ -1967,7 +2015,7 @@ }, "portal_allowed_hostnames": { "default": [], - "description": "List of hostnames without http(s):// (matched by substring)", + "description": "Guest portal hostnames that clients may reach before authorization", "examples": [ [ "snapchat.com", @@ -1981,7 +2029,7 @@ }, "portal_allowed_subnets": { "default": [], - "description": "List of CIDRs", + "description": "Guest portal CIDR subnets that clients may reach before authorization", "examples": [ [ "63.5.3.0/24" @@ -2005,7 +2053,7 @@ }, "portal_denied_hostnames": { "default": [], - "description": "List of hostnames without http(s):// (matched by substring), this takes precedence over portal_allowed_hostnames", + "description": "Guest portal hostnames denied before authorization, taking precedence over allowed hostnames", "examples": [ [ "msg.snapchat.com" @@ -2048,10 +2096,11 @@ }, "qos": { "additionalProperties": false, + "description": "Quality-of-service settings for WLAN client traffic", "properties": { "class": { "default": "best_effort", - "description": "enum: `background`, `best_effort`, `video`, `voice`", + "description": "QoS traffic class applied when WLAN QoS override is enabled", "enum": [ "background", "best_effort", @@ -2073,13 +2122,15 @@ }, "radsec": { "additionalProperties": false, - "description": "RadSec settings", + "description": "TLS-secured RADIUS transport settings for this WLAN", "properties": { "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled for RadSec traffic", "type": "boolean" }, "enabled": { + "description": "Whether RadSec is enabled", "type": "boolean" }, "idle_timeout": { @@ -2092,10 +2143,10 @@ "type": "string" } ], - "description": "Radsec Idle Timeout in seconds. Default is 60" + "description": "Idle timeout, in seconds, for RadSec connections" }, "mxcluster_ids": { - "description": "To use Org mxedges when this WLAN does not use mxtunnel, specify their mxcluster_ids. Org mxedge(s) identified by mxcluster_ids", + "description": "Mist Edge cluster IDs used as RadSec proxies when the WLAN does not use mxtunnel", "items": { "examples": [ "572586b7-f97b-a22b-526c-8b97a3f609c4" @@ -2106,7 +2157,7 @@ "type": "array" }, "proxy_hosts": { - "description": "Default is site.mxedge.radsec.proxy_hosts which must be a superset of all `wlans[*].radsec.proxy_hosts`. When `radsec.proxy_hosts` are not used, tunnel peers (org or site mxedges) are used irrespective of `use_site_mxedge`", + "description": "RadSec proxy hostnames advertised to APs", "items": { "examples": [ "mxedge1.local" @@ -2116,24 +2167,27 @@ "type": "array" }, "server_name": { - "description": "Name of the server to verify (against the cacerts in Org Setting). Only if not Mist Edge.", + "description": "TLS server name to verify against the CA certificates in Org Setting. Only if not Mist Edge.", "examples": [ "radsec.abc.com" ], "type": "string" }, "servers": { - "description": "List of RadSec Servers. Only if not Mist Edge.", + "description": "External RadSec servers. Only if not Mist Edge.", "items": { "additionalProperties": false, + "description": "External RadSec server settings", "properties": { "host": { + "description": "Address or hostname of the RadSec server", "examples": [ "1.1.1.1" ], "type": "string" }, "port": { + "description": "TCP port used by the RadSec server", "examples": [ 1812 ], @@ -2148,12 +2202,12 @@ "uniqueItems": true }, "use_mxedge": { - "description": "use mxedge(s) as RadSec Proxy", + "description": "Whether to use organization Mist Edge instances as RadSec proxies", "type": "boolean" }, "use_site_mxedge": { "default": false, - "description": "To use Site mxedges when this WLAN does not use mxtunnel", + "description": "Whether to use site Mist Edge instances when this WLAN does not use mxtunnel", "type": "boolean" } }, @@ -2195,7 +2249,7 @@ ] }, "legacy": { - "description": "If `template`==`custom`. List of supported rates (IE=1) and extended supported rates (IE=50) for custom template, append ‘b’ at the end to indicate a rate being basic/mandatory. If `template`==`custom` is configured and legacy does not define at least one basic rate, it will use `no-legacy` default values", + "description": "If `template`==`custom`, legacy 802.11 data rates allowed on this WLAN", "examples": [ [ "6", @@ -2250,7 +2304,7 @@ }, "template": { "default": "compatible", - "description": "Data Rates template to apply. enum: \\n * `no-legacy`: no 11b\\n * `compatible`: all, like before, default setting that Broadcom/Atheros used\\n * `legacy-only`: disable 802.11n and 802.11ac\\n * `high-density`: no 11b, no low rates\\n * `custom`: user defined", + "description": "Data rate template used to derive WLAN rate settings", "enum": [ "compatible", "legacy-only", @@ -2276,7 +2330,7 @@ }, "type": "object" }, - "description": "Property key is the RF band. enum: `24`, `5`, `6`", + "description": "Data rate settings by RF band for this WLAN", "type": "object" }, "reconnect_clients_when_roaming_mxcluster": { @@ -2286,7 +2340,7 @@ }, "roam_mode": { "default": "NONE", - "description": "enum: `11r`, `OKC`, `NONE`", + "description": "Fast roaming mode configured for this WLAN", "enum": [ "11r", "NONE", @@ -2299,19 +2353,20 @@ }, "schedule": { "additionalProperties": false, - "description": "WLAN operating schedule, default is disabled", + "description": "Operating schedule controlling when this WLAN is active", "properties": { "enabled": { "default": false, + "description": "Whether the WLAN operating schedule is enabled", "type": "boolean" }, "hours": { "additionalProperties": false, - "description": "Days/Hours of operation filter, the available days (mon, tue, wed, thu, fri, sat, sun)", + "description": "Time ranges when the WLAN is scheduled to operate", "properties": { "fri": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Friday", "examples": [ "09:00-17:00" ], @@ -2319,7 +2374,7 @@ }, "mon": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Monday", "examples": [ "09:00-17:00" ], @@ -2327,7 +2382,7 @@ }, "sat": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Saturday", "examples": [ "09:00-17:00" ], @@ -2335,7 +2390,7 @@ }, "sun": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Sunday", "examples": [ "09:00-17:00" ], @@ -2343,7 +2398,7 @@ }, "thu": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Thursday", "examples": [ "09:00-17:00" ], @@ -2351,7 +2406,7 @@ }, "tue": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Tuesday", "examples": [ "09:00-17:00" ], @@ -2359,7 +2414,7 @@ }, "wed": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Wednesday", "examples": [ "09:00-17:00" ], @@ -2372,6 +2427,7 @@ "type": "object" }, "site_id": { + "description": "Mist site associated with this WLAN, when site-scoped", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -2393,6 +2449,7 @@ }, "template_id": { "default": "", + "description": "Identifier of the WLAN template associated with this WLAN", "format": "uuid", "type": [ "string", @@ -2420,6 +2477,7 @@ "type": "boolean" }, "vlan_id": { + "description": "Default VLAN ID, range, or variable used when `vlan_enabled`==`true`", "oneOf": [ { "type": "string" @@ -2435,6 +2493,7 @@ ] }, "vlan_ids": { + "description": "Pool of VLAN IDs used when `vlan_enabled`==`true` and `vlan_pooling`==`true`", "oneOf": [ { "description": "If `vlan_enabled`==`true` and `vlan_pooling`==`true`. List of VLAN IDs to be used in the VLAN Pool", @@ -2453,6 +2512,7 @@ ] ], "items": { + "description": "VLAN ID, either numeric or expressed as a template variable string", "oneOf": [ { "type": "string" @@ -2484,7 +2544,7 @@ "type": "string" } ], - "description": "In kbps, value from 1 to 999000" + "description": "Downlink bandwidth limit applied to the whole WLAN" }, "wlan_limit_down_enabled": { "default": false, @@ -2502,7 +2562,7 @@ "type": "string" } ], - "description": "In kbps, value from 1 to 999000" + "description": "Uplink bandwidth limit applied to the whole WLAN" }, "wlan_limit_up_enabled": { "default": false, @@ -2510,7 +2570,7 @@ "type": "boolean" }, "wxtag_ids": { - "description": "List of wxtag_ids", + "description": "Identifiers of WxLAN tags used when `apply_to`==`wxtags`", "items": { "format": "uuid", "type": "string" @@ -2555,7 +2615,7 @@ }, "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled", "examples": [ 0 ], @@ -2564,22 +2624,24 @@ "type": "integer" }, "acct_servers": { - "description": "List of RADIUS accounting servers, optional, order matters where the first one is treated as primary", + "description": "RADIUS accounting servers used by this WLAN", "items": { "additionalProperties": false, + "description": "RADIUS accounting server settings", "properties": { "host": { - "description": "IP/ hostname of RADIUS server", + "description": "Address or hostname of the RADIUS accounting server", "examples": [ "1.2.3.4" ], "type": "string" }, "keywrap_enabled": { + "description": "Whether RADIUS keywrap is enabled for messages sent to this accounting server", "type": "boolean" }, "keywrap_format": { - "description": "enum: `ascii`, `hex`", + "description": "Encoding format for RADIUS keywrap KEK and MACK values", "enum": [ "ascii", "hex" @@ -2587,12 +2649,14 @@ "type": "string" }, "keywrap_kek": { + "description": "RADIUS keywrap key encryption key (KEK)", "examples": [ "1122334455" ], "type": "string" }, "keywrap_mack": { + "description": "RADIUS keywrap message authentication code key (MACK)", "examples": [ "1122334455" ], @@ -2609,10 +2673,10 @@ "type": "string" } ], - "description": "Radius Auth Port, value from 1 to 65535, default is 1813" + "description": "UDP port used by the RADIUS accounting server" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS accounting server", "examples": [ "testing123" ], @@ -2630,11 +2694,11 @@ }, "airwatch": { "additionalProperties": false, - "description": "Airwatch wlan settings", + "description": "Integration settings for AirWatch device compliance on this WLAN", "properties": { "api_key": { "default": "", - "description": "API Key", + "description": "API key used to authenticate to the AirWatch service", "examples": [ "aHhlbGxvYXNkZmFzZGZhc2Rmc2RmCg==\\"" ], @@ -2642,7 +2706,7 @@ }, "console_url": { "default": "", - "description": "Console URL", + "description": "Base console URL of the AirWatch deployment", "examples": [ "https://hs1.airwatchportals.com" ], @@ -2650,11 +2714,12 @@ }, "enabled": { "default": false, + "description": "Whether AirWatch integration is enabled for the WLAN", "type": "boolean" }, "password": { "default": "", - "description": "Password", + "description": "AirWatch integration account password for this WLAN", "examples": [ "user1" ], @@ -2663,7 +2728,7 @@ }, "username": { "default": "", - "description": "Username", + "description": "AirWatch integration account username for this WLAN", "examples": [ "test123" ], @@ -2688,7 +2753,7 @@ "type": "boolean" }, "ap_ids": { - "description": "List of device ids", + "description": "Access point identifiers used when `apply_to`==`aps`", "items": { "format": "uuid", "type": "string" @@ -2700,7 +2765,7 @@ }, "app_limit": { "additionalProperties": false, - "description": "Bandwidth limiting for apps (applies to up/down)", + "description": "Bandwidth limits for applications on this WLAN", "properties": { "apps": { "additionalProperties": { @@ -2718,6 +2783,7 @@ }, "enabled": { "default": false, + "description": "Whether application bandwidth limits are enabled for this WLAN", "type": "boolean" }, "wxtag_ids": { @@ -2738,11 +2804,12 @@ }, "app_qos": { "additionalProperties": false, - "description": "APP qos wlan settings", + "description": "QoS rules for application traffic on this WLAN", "properties": { "apps": { "additionalProperties": { "additionalProperties": false, + "description": "QoS rewrite settings for traffic matching a named application", "properties": { "dscp": { "anyOf": [ @@ -2755,7 +2822,7 @@ "type": "integer" } ], - "description": "DSCP value range between 0 and 63" + "description": "Differentiated Services Code Point value applied to matching application traffic" }, "dst_subnet": { "description": "Subnet filter is not required but helps AP to only inspect certain traffic (thus reducing AP load)", @@ -2769,6 +2836,7 @@ "type": "object" }, "default": {}, + "description": "Map of application keys to QoS rewrite settings", "examples": [ { "skype-business-video": { @@ -2782,11 +2850,14 @@ }, "enabled": { "default": false, + "description": "Whether application QoS rewrite rules are enabled for this WLAN", "type": "boolean" }, "others": { + "description": "Custom traffic QoS rules that are not tied to named applications", "items": { "additionalProperties": false, + "description": "Custom QoS rewrite rule for traffic not matched by a named application", "properties": { "dscp": { "anyOf": [ @@ -2799,27 +2870,31 @@ "type": "integer" } ], - "description": "DSCP value range between 0 and 63" + "description": "Differentiated Services Code Point value applied to matching traffic" }, "dst_subnet": { + "description": "Destination subnet filter for this custom QoS rule", "examples": [ "10.2.0.0/16" ], "type": "string" }, "port_ranges": { + "description": "TCP or UDP port ranges matched by this custom QoS rule", "examples": [ "80,1024-6553" ], "type": "string" }, "protocol": { + "description": "IP protocol matched by this custom QoS rule", "examples": [ "udp" ], "type": "string" }, "src_subnet": { + "description": "Source subnet filter for this custom QoS rule", "examples": [ "10.2.0.0/16" ], @@ -2835,7 +2910,7 @@ "type": "object" }, "apply_to": { - "description": "enum: `aps`, `site`, `wxtags`", + "description": "Scope that determines where this WLAN is applied", "enum": [ "aps", "site", @@ -2850,7 +2925,7 @@ }, "auth": { "additionalProperties": false, - "description": "Authentication wlan settings", + "description": "Settings that control client authentication for this WLAN", "properties": { "anticlog_threshold": { "default": 16, @@ -2884,14 +2959,14 @@ }, "key_idx": { "default": 1, - "description": "When `type`==`wep`", + "description": "When `type`==`wep`, index of the WEP key used as the default transmit key", "maximum": 4, "minimum": 1, "type": "integer" }, "keys": { "default": [], - "description": "When type=wep, four 10-character or 26-character hex string, null can be used. All keys, if provided, have to be in the same length", + "description": "When `type`==`wep`, WEP keys configured for this WLAN", "items": { "type": [ "string", @@ -2907,7 +2982,7 @@ }, "owe": { "default": "disabled", - "description": "if `type`==`open`. enum: `disabled`, `enabled` (means transition mode), `required`", + "description": "When `type`==`open`, Opportunistic Wireless Encryption mode for this WLAN", "enum": [ "disabled", "enabled", @@ -2919,7 +2994,7 @@ "default": [ "wpa2-ccmp" ], - "description": "When `type`=`psk` or `type`=`eap`, one or more of `wpa1-ccmp`, `wpa1-tkip`, `wpa2-ccmp`, `wpa2-tkip`, `wpa3`", + "description": "When `type`==`psk` or `type`==`eap`, pairwise cipher suites allowed for this WLAN", "items": { "description": "enum: `wpa1-ccmp`, `wpa1-tkip`, `wpa2-ccmp`, `wpa2-tkip`, `wpa3`", "enum": [ @@ -2959,7 +3034,7 @@ }, "type": { "default": "open", - "description": "enum: `eap`, `eap192`, `open`, `psk`, `psk-tkip`, `psk-wpa2-tkip`, `wep`", + "description": "Authentication mode used by this WLAN", "enum": [ "eap", "eap192", @@ -2987,7 +3062,7 @@ }, "auth_server_selection": { "default": "ordered", - "description": "When ordered, AP will prefer and go back to the first server if possible. enum: `ordered`, `unordered`", + "description": "RADIUS authentication server selection behavior for this WLAN", "enum": [ "ordered", "unordered" @@ -2998,23 +3073,24 @@ "type": "string" }, "auth_servers": { - "description": "List of RADIUS authentication servers, at least one is needed if `auth type`==`eap`, order matters where the first one is treated as primary", + "description": "RADIUS authentication servers used by this WLAN. Required when `auth.type`==`eap`", "items": { "additionalProperties": false, - "description": "Authentication Server", + "description": "RADIUS authentication server settings", "properties": { "host": { - "description": "IP/ hostname of RADIUS server", + "description": "Address or hostname of the RADIUS authentication server", "examples": [ "1.2.3.4" ], "type": "string" }, "keywrap_enabled": { + "description": "Whether RADIUS keywrap is enabled for messages sent to this authentication server", "type": "boolean" }, "keywrap_format": { - "description": "enum: `ascii`, `hex`", + "description": "Encoding format for RADIUS keywrap KEK and MACK values", "enum": [ "ascii", "hex" @@ -3022,12 +3098,14 @@ "type": "string" }, "keywrap_kek": { + "description": "RADIUS keywrap key encryption key (KEK)", "examples": [ "1122334455" ], "type": "string" }, "keywrap_mack": { + "description": "RADIUS keywrap message authentication code key (MACK)", "examples": [ "1122334455" ], @@ -3044,7 +3122,7 @@ "type": "string" } ], - "description": "Radius Auth Port, value from 1 to 65535, default is 1812" + "description": "UDP port used by the RADIUS authentication server" }, "require_message_authenticator": { "default": false, @@ -3052,7 +3130,7 @@ "type": "boolean" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS authentication server", "examples": [ "testing123" ], @@ -3090,7 +3168,7 @@ }, "auth_servers_retries": { "default": 2, - "description": "Radius auth session retries. Following fast timers are set if \\"fast_dot1x_timers\\" knob is enabled. ‘retries’ are set to value of auth_servers_retries. ‘max-requests’ is also set when setting auth_servers_retries and is set to default value to 3.", + "description": "RADIUS auth session retries. Following fast timers are set if \\"fast_dot1x_timers\\" knob is enabled. ‘retries’ are set to value of auth_servers_retries. ‘max-requests’ is also set when setting auth_servers_retries and is set to default value to 3.", "examples": [ 5 ], @@ -3098,12 +3176,12 @@ }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout. Following fast timers are set if \\"fast_dot1x_timers\\" knob is enabled. ‘quite-period’ and ‘transmit-period’ are set to half the value of auth_servers_timeout. ‘supplicant-timeout’ is also set when setting auth_servers_timeout and is set to default value of 10.", + "description": "RADIUS auth session timeout. Following fast timers are set if \\"fast_dot1x_timers\\" knob is enabled. ‘quite-period’ and ‘transmit-period’ are set to half the value of auth_servers_timeout. ‘supplicant-timeout’ is also set when setting auth_servers_timeout and is set to default value of 10.", "type": "integer" }, "band": { "deprecated": true, - "description": "`band` is deprecated and kept for backward compatibility. Use bands instead", + "description": "`band` is deprecated and kept for backward compatibility. Use `bands` instead", "type": "string" }, "band_steer": { @@ -3122,7 +3200,7 @@ "5", "6" ], - "description": "List of radios that the wlan should apply to. enum: `24`, `5`, `5-dedicated`, `5-selectable`, `6`, `6-dedicated`, `6-selectable`", + "description": "Radio bands on which this WLAN is broadcast", "items": { "description": "enum: `24`, `5`, `5-dedicated`, `5-selectable`, `6`, `6-dedicated`, `6-selectable`", "enum": [ @@ -3145,7 +3223,7 @@ }, "bonjour": { "additionalProperties": false, - "description": "Bonjour gateway wlan settings", + "description": "Service discovery gateway settings for Bonjour traffic on this WLAN", "properties": { "additional_vlan_ids": { "anyOf": [ @@ -3153,7 +3231,9 @@ "type": "string" }, { + "description": "Additional VLAN IDs represented as an array", "items": { + "description": "VLAN ID, either numeric or expressed as a template variable string", "oneOf": [ { "type": "string" @@ -3168,7 +3248,7 @@ "type": "array" } ], - "description": "List or Comma separated list of additional VLAN IDs (on the LAN side or from other WLANs) should we be forwarding bonjour queries/responses" + "description": "VLAN IDs, beyond the client VLAN, where Bonjour queries and responses are forwarded" }, "enabled": { "default": false, @@ -3178,6 +3258,7 @@ "services": { "additionalProperties": { "additionalProperties": false, + "description": "Bonjour service discovery settings for one advertised service", "properties": { "disable_local": { "default": false, @@ -3185,7 +3266,7 @@ "type": "boolean" }, "radius_groups": { - "description": "Optional, if the service is further restricted for certain RADIUS groups", + "description": "RADIUS groups allowed to discover this Bonjour service, when restricted", "items": { "type": "string" }, @@ -3193,7 +3274,7 @@ }, "scope": { "default": "same_site", - "description": "how bonjour services should be discovered for the same WLAN. enum: `same_ap`, `same_map`, `same_site`", + "description": "Discovery scope for this Bonjour service on the WLAN", "enum": [ "same_ap", "same_map", @@ -3222,10 +3303,10 @@ }, "cisco_cwa": { "additionalProperties": false, - "description": "Cisco CWA (central web authentication) required RADIUS with COA in order to work. See CWA: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html", + "description": "Central web authentication settings for Cisco CWA on this WLAN", "properties": { "allowed_hostnames": { - "description": "List of hostnames without http(s):// (matched by substring)", + "description": "Hostnames allowed for Cisco CWA client access before authorization", "items": { "examples": [ "snapchat.com" @@ -3235,7 +3316,7 @@ "type": "array" }, "allowed_subnets": { - "description": "List of CIDRs", + "description": "CIDR subnets allowed for Cisco CWA client access before authorization", "items": { "examples": [ "63.5.3.0/24" @@ -3245,7 +3326,7 @@ "type": "array" }, "blocked_subnets": { - "description": "List of blocked CIDRs", + "description": "CIDR subnets blocked for Cisco CWA client access", "items": { "examples": [ "192.168.0.0/16" @@ -3256,6 +3337,7 @@ }, "enabled": { "default": false, + "description": "Whether Cisco CWA is enabled for this WLAN", "type": "boolean" } }, @@ -3272,7 +3354,7 @@ "type": "string" } ], - "description": "In kbps, value from 1 to 999000" + "description": "Downlink bandwidth limit applied per client" }, "client_limit_down_enabled": { "default": false, @@ -3290,7 +3372,7 @@ "type": "string" } ], - "description": "In kbps, value from 1 to 999000" + "description": "Uplink bandwidth limit applied per client" }, "client_limit_up_enabled": { "default": false, @@ -3298,10 +3380,10 @@ "type": "boolean" }, "coa_servers": { - "description": "List of COA (change of authorization) servers, optional", + "description": "RADIUS Change of Authorization servers available to this WLAN", "items": { "additionalProperties": false, - "description": "CoA Server", + "description": "RADIUS Change of Authorization (CoA) server settings", "properties": { "disable_event_timestamp_check": { "default": false, @@ -3310,9 +3392,11 @@ }, "enabled": { "default": false, + "description": "Whether this RADIUS CoA server is enabled", "type": "boolean" }, "ip": { + "description": "Server IPv4 address for RADIUS CoA messages", "examples": [ "1.2.3.4" ], @@ -3330,9 +3414,10 @@ "type": "string" } ], - "description": "Radius CoA Port, value from 1 to 65535, default is 3799" + "description": "UDP port used to send RADIUS CoA messages to the server" }, "secret": { + "description": "Shared secret used to authenticate RADIUS CoA messages", "examples": [ "testing456" ], @@ -3348,7 +3433,7 @@ "type": "array" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Time when this WLAN was created, in epoch seconds", "format": "double", "readOnly": true, "type": "number" @@ -3395,6 +3480,7 @@ }, "disable_when_mxtunnel_down": { "default": false, + "description": "Whether to disable this WLAN when the configured Mist tunnel is down", "type": "boolean" }, "disable_wmm": { @@ -3404,10 +3490,11 @@ }, "dns_server_rewrite": { "additionalProperties": false, - "description": "For radius_group-based DNS server (rewrite DNS request depending on the Group RADIUS server returns)", + "description": "RADIUS group based DNS server rewrite settings for this WLAN", "properties": { "enabled": { "default": false, + "description": "Whether DNS server rewrite by RADIUS group is enabled for this WLAN", "type": "boolean" }, "radius_groups": { @@ -3431,11 +3518,12 @@ }, "dtim": { "default": 2, + "description": "Delivery Traffic Indication Message interval for this WLAN", "type": "integer" }, "dynamic_psk": { "additionalProperties": false, - "description": "For dynamic PSK where we get per_user PSK from Radius. dynamic_psk allows PSK to be selected at runtime depending on context (wlan/site/user/...) thus following configurations are assumed (currently)\\n * PSK will come from RADIUS server\\n * AP sends client MAC as username and password (i.e. `enable_mac_auth` is assumed)\\n * AP sends BSSID:SSID as Caller-Station-ID\\n * `auth_servers` is required\\n * PSK will come from cloud WLC if source is cloud_psks\\n * default_psk will be used if cloud WLC is not available\\n * `multi_psk_only` and `psk` is ignored\\n * `pairwise` can only be wpa2-ccmp (for now, wpa3 support on the roadmap)", + "description": "Per-user PSK selection settings for this WLAN", "properties": { "default_psk": { "description": "Default PSK to use if cloud WLC is not available, 8-63 characters", @@ -3447,6 +3535,7 @@ "type": "string" }, "default_vlan_id": { + "description": "Default VLAN ID used when dynamic PSK lookup does not return a VLAN", "oneOf": [ { "type": "string" @@ -3460,6 +3549,7 @@ }, "enabled": { "default": false, + "description": "Whether dynamic PSK is enabled for this WLAN", "type": "boolean" }, "force_lookup": { @@ -3469,7 +3559,7 @@ }, "source": { "default": "radius", - "description": "enum: `cloud_psks`, `radius`", + "description": "Origin used to retrieve per-user PSKs", "enum": [ "cloud_psks", "radius" @@ -3487,11 +3577,11 @@ }, "dynamic_vlan": { "additionalProperties": false, - "description": "For 802.1x", + "description": "VLAN assignment settings for 802.1X dynamic VLANs", "properties": { "default_vlan_id": { "deprecated": true, - "description": "vlan_id to use when there’s no match from RADIUS", + "description": "Deprecated default VLAN ID used when no RADIUS VLAN match is returned. Please use `default_vlan_ids` instead, which can support VLAN pools.", "oneOf": [ { "type": "string" @@ -3505,7 +3595,7 @@ ] }, "default_vlan_ids": { - "description": "Default VLAN ID(s) can be a number, a range of VLAN IDs, a variable or multiple numbers, ranges or variables as a VLAN pool. Default VLAN as a pool of VLANS requires 0.14.x or newer firmware", + "description": "Fallback VLAN IDs, ranges, or variables used when no RADIUS VLAN match is returned", "items": { "description": "VLAN ID, VLAN range or variable to use when there’s no match from RADIUS", "oneOf": [ @@ -3528,8 +3618,9 @@ "type": "boolean" }, "local_vlan_ids": { - "description": "VLAN_ids to be locally bridged", + "description": "VLAN IDs that should be locally bridged for dynamic VLAN assignment", "items": { + "description": "VLAN ID, either numeric or expressed as a template variable string", "oneOf": [ { "type": "string" @@ -3545,7 +3636,7 @@ }, "type": { "default": "standard", - "description": "standard (using Tunnel-Private-Group-ID, widely supported), airespace-interface-name (Airespace/Cisco). enum: `airespace-interface-name`, `standard`", + "description": "Dynamic VLAN mapping method used for RADIUS-provided VLAN attributes", "enum": [ "airespace-interface-name", "standard" @@ -3559,7 +3650,7 @@ "additionalProperties": { "type": "string" }, - "description": "Map between vlan_id (as string) to airespace interface names (comma-separated) or null for standard mapping\\n * if `dynamic_vlan.type`==`standard`, property key is the Vlan ID and property value is \\\\\\"\\\\\\"\\n * if `dynamic_vlan.type`==`airespace-interface-name`, property key is the Vlan ID and property value is the Airespace Interface Name", + "description": "Map between vlan_id (as string) to airespace interface names (comma-separated) or null for standard mapping\\n * if `dynamic_vlan.type`==`standard`, property key is the VLAN ID and property value is \\\\\\"\\\\\\"\\n * if `dynamic_vlan.type`==`airespace-interface-name`, property key is the VLAN ID and property value is the Airespace Interface Name", "examples": [ { "131": "default", @@ -3600,6 +3691,7 @@ "type": "boolean" }, "for_site": { + "description": "Whether this WLAN record is scoped to a site", "readOnly": true, "type": "boolean" }, @@ -3615,9 +3707,10 @@ }, "hotspot20": { "additionalProperties": false, - "description": "Hostspot 2.0 wlan settings", + "description": "Passpoint and Hotspot 2.0 settings for this WLAN", "properties": { "domain_name": { + "description": "Advertised domain names for Hotspot 2.0 clients", "examples": [ [ "mist.com" @@ -3633,6 +3726,7 @@ "type": "boolean" }, "nai_realms": { + "description": "NAI realms advertised for Hotspot 2.0 authentication", "items": { "type": "string" }, @@ -3640,7 +3734,7 @@ "uniqueItems": true }, "operators": { - "description": "List of operators to support", + "description": "Operator profiles supported by this Hotspot 2.0 configuration", "examples": [ [ "google", @@ -3670,6 +3764,7 @@ "type": "array" }, "rcoi": { + "description": "Roaming Consortium Organization Identifiers advertised for Hotspot 2.0", "examples": [ [ "5A03BA0000" @@ -3691,7 +3786,7 @@ "type": "object" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier for this WLAN", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -3701,6 +3796,7 @@ }, "inject_dhcp_option_82": { "additionalProperties": false, + "description": "DHCP Option 82 insertion settings for this WLAN", "properties": { "circuit_id": { "description": "Information to set in the `circuit_id` field of the DHCP Option 82. It is possible to use static string or the following variables (e.g. `{{SSID}}:{{AP_MAC}}`):\\n * {{AP_MAC}}\\n * {{AP_MAC_DASHED}}\\n * {{AP_MODEL}}\\n * {{AP_NAME}}\\n * {{SITE_NAME}}\\n * {{SSID}}", @@ -3719,7 +3815,7 @@ }, "interface": { "default": "all", - "description": "where this WLAN will be connected to. enum: `all`, `eth0`, `eth1`, `eth2`, `eth3`, `mxtunnel`, `site_mxedge`, `wxtunnel`", + "description": "Network interface or tunnel where this WLAN bridges client traffic", "enum": [ "all", "eth0", @@ -3779,10 +3875,11 @@ }, "mist_nac": { "additionalProperties": false, + "description": "Juniper Mist NAC settings used by this WLAN", "properties": { "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled.", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled.", "examples": [ 60 ], @@ -3792,7 +3889,7 @@ }, "auth_servers_retries": { "default": 2, - "description": "Radius auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"retries\\" are set to value of `auth_servers_timeout`. \\"max-requests\\" is also set when setting `auth_servers_retries` is set to default value to 3.", + "description": "RADIUS auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"retries\\" are set to value of `auth_servers_timeout`. \\"max-requests\\" is also set when setting `auth_servers_retries` is set to default value to 3.", "examples": [ 3 ], @@ -3802,7 +3899,7 @@ }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"quite-period\\" and \\"transmit-period\\" are set to half the value of `auth_servers_timeout`. \\"supplicant-timeout\\" is also set when setting `auth_servers_timeout` is set to default value of 10.", + "description": "RADIUS auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"quite-period\\" and \\"transmit-period\\" are set to half the value of `auth_servers_timeout`. \\"supplicant-timeout\\" is also set when setting `auth_servers_timeout` is set to default value of 10.", "examples": [ 5 ], @@ -3858,12 +3955,13 @@ "type": "object" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Time when this WLAN was last modified, in epoch seconds", "format": "double", "readOnly": true, "type": "number" }, "msp_id": { + "description": "Managed service provider identifier associated with this WLAN", "examples": [ "b9d42c2e-88ee-41f8-b798-f009ce7fe909" ], @@ -3878,7 +3976,7 @@ "type": "string" }, "mxtunnel_ids": { - "description": "When `interface`=`mxtunnel`, id of the Mist Tunnel", + "description": "Mist Tunnel identifiers used when `interface`==`mxtunnel`", "format": "uuid", "items": { "examples": [ @@ -3889,7 +3987,7 @@ "type": "array" }, "mxtunnel_name": { - "description": "When `interface`=`site_mxedge`, name of the mxtunnel that in mxtunnels under Site Setting", + "description": "Mist Tunnel names used when `interface`==`site_mxedge`", "items": { "default": "default", "examples": [ @@ -3910,6 +4008,7 @@ "type": "boolean" }, "org_id": { + "description": "Owning organization associated with this WLAN", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -3919,7 +4018,7 @@ }, "portal": { "additionalProperties": false, - "description": "Portal wlan settings", + "description": "Guest portal settings for this WLAN", "properties": { "allow_wlan_id_roam": { "default": false, @@ -3937,6 +4036,7 @@ "amazon_client_secret": { "default": "", "description": "Optional if `amazon_enabled`==`true`. Amazon OAuth2 client secret. If amazon_client_id was provided, provide a corresponding value. Else leave blank.", + "format": "password", "type": [ "string", "null" @@ -3944,7 +4044,7 @@ }, "amazon_email_domains": { "default": [], - "description": "Optional if `amazon_enabled`==`true`. Matches authenticated user email against provided domains. If null or [], all authenticated emails will be allowed.", + "description": "Optional if `amazon_enabled`==`true`. Email domains allowed for Amazon-authenticated guest users. If null or empty, any authenticated Amazon email domain is allowed.", "items": { "type": "string" }, @@ -3965,7 +4065,7 @@ }, "auth": { "default": "none", - "description": "authentication scheme. enum: `amazon`, `azure`, `email`, `external`, `facebook`, `google`, `microsoft`, `multi`, `none`, `password`, `sms`, `sponsor`, `sso`", + "description": "Guest portal login scheme used by the WLAN", "enum": [ "amazon", "azure", @@ -3997,6 +4097,7 @@ "azure_client_secret": { "default": "", "description": "Required if `azure_enabled`==`true`. Azure active directory app client secret", + "format": "password", "type": [ "string", "null" @@ -4025,7 +4126,7 @@ }, "broadnet_password": { "default": "", - "description": "Required if `sms_provider`==`broadnet`", + "description": "Required if `sms_provider`==`broadnet`. Password for the Broadnet SMS provider account", "examples": [ "password" ], @@ -4033,14 +4134,14 @@ "type": "string" }, "broadnet_sid": { - "description": "Required if `sms_provider`==`broadnet`", + "description": "Required if `sms_provider`==`broadnet`. SID for the Broadnet SMS provider account", "examples": [ "MIST" ], "type": "string" }, "broadnet_user_id": { - "description": "Required if `sms_provider`==`broadnet`", + "description": "Required if `sms_provider`==`broadnet`. User ID for the Broadnet SMS provider account", "examples": [ "juniper" ], @@ -4052,7 +4153,7 @@ "type": "boolean" }, "clickatell_api_key": { - "description": "Required if `sms_provider`==`clickatell`", + "description": "Required if `sms_provider`==`clickatell`. API key for the Clickatell SMS provider account", "type": "string" }, "cross_site": { @@ -4094,6 +4195,7 @@ "facebook_client_secret": { "default": "", "description": "Required if `facebook_enabled`==`true`. Facebook OAuth2 app secret. If facebook_client_id was provided, provide a corresponding value. Else leave blank.", + "format": "password", "type": [ "string", "null" @@ -4101,7 +4203,7 @@ }, "facebook_email_domains": { "default": [], - "description": "Optional if `facebook_enabled`==`true`. Matches authenticated user email against provided domains. If null or [], all authenticated emails will be allowed.", + "description": "Optional if `facebook_enabled`==`true`. Email domains allowed for Facebook-authenticated guest users. If null or empty, any authenticated Facebook email domain is allowed.", "items": { "type": "string" }, @@ -4147,6 +4249,7 @@ "google_client_secret": { "default": "", "description": "Optional if `google_enabled`==`true`. Google OAuth2 app secret. If google_client_id was provided, provide a corresponding value. Else leave blank.", + "format": "password", "type": [ "string", "null" @@ -4154,7 +4257,7 @@ }, "google_email_domains": { "default": [], - "description": "Optional if `google_enabled`==`true`. Matches authenticated user email against provided domains. If null or [], all authenticated emails will be allowed.", + "description": "Optional if `google_enabled`==`true`. Email domains allowed for Google-authenticated guest users. If null or empty, any authenticated Google email domain is allowed.", "examples": [ [ "mydomain.edu", @@ -4180,12 +4283,12 @@ ] }, "gupshup_password": { - "description": "Required if `sms_provider`==`gupshup`", + "description": "Required if `sms_provider`==`gupshup`. Password for the Gupshup SMS provider account", "format": "password", "type": "string" }, "gupshup_userid": { - "description": "Required if `sms_provider`==`gupshup`", + "description": "Required if `sms_provider`==`gupshup`. User ID for the Gupshup SMS provider account", "type": "string" }, "microsoft_client_id": { @@ -4199,6 +4302,7 @@ "microsoft_client_secret": { "default": "", "description": "Optional if `microsoft_enabled`==`true`. Microsoft 365 OAuth2 client secret. If microsoft_client_id was provided, provide a corresponding value. Else leave blank.", + "format": "password", "type": [ "string", "null" @@ -4206,7 +4310,7 @@ }, "microsoft_email_domains": { "default": [], - "description": "Optional if `microsoft_enabled`==`true`. Matches authenticated user email against provided domains. If null or [], all authenticated emails will be allowed.", + "description": "Optional if `microsoft_enabled`==`true`. Email domains allowed for Microsoft 365-authenticated guest users. If null or empty, any authenticated Microsoft 365 email domain is allowed.", "items": { "type": "string" }, @@ -4240,7 +4344,7 @@ }, "password": { "default": "", - "description": "Required if `passphrase_enabled`==`true`.", + "description": "Required if `passphrase_enabled`==`true`. Passphrase guests must enter when passphrase authentication is enabled", "examples": [ "let me in" ], @@ -4261,19 +4365,20 @@ }, "privacy": { "default": false, + "description": "Whether to show the privacy policy in the WLAN guest portal", "type": "boolean" }, "puzzel_password": { - "description": "Required if `sms_provider`==`puzzel`", + "description": "Required if `sms_provider`==`puzzel`. Password for the Puzzel SMS provider account", "format": "password", "type": "string" }, "puzzel_service_id": { - "description": "Required if `sms_provider`==`puzzel`", + "description": "Required if `sms_provider`==`puzzel`. Service ID for the Puzzel SMS provider account", "type": "string" }, "puzzel_username": { - "description": "Required if `sms_provider`==`puzzel`", + "description": "Required if `sms_provider`==`puzzel`. Username for the Puzzel SMS provider account", "type": "string" }, "smsMessageFormat": { @@ -4296,7 +4401,7 @@ }, "sms_provider": { "default": "manual", - "description": "Optional if `sms_enabled`==`true`. enum: `broadnet`, `clickatell`, `gupshup`, `manual`, `puzzel`, `smsglobal`, `telstra`, `twilio`", + "description": "Optional if `sms_enabled`==`true`. SMS provider used to deliver guest portal access codes", "enum": [ "broadnet", "clickatell", @@ -4327,7 +4432,7 @@ "type": "boolean" }, "sponsor_email_domains": { - "description": "List of domain allowed for sponsor email. Required if `sponsor_enabled` is `true` and `sponsors` is empty.", + "description": "Email domains allowed for sponsor email addresses. Required if `sponsor_enabled` is `true` and `sponsors` is empty.", "examples": [ [ "reserved.net", @@ -4364,7 +4469,7 @@ "type": "string" } ], - "description": "Optional if `sponsor_enabled`==`true`. How long to remain valid sponsored guest request approve/deny link received in email, in minutes. Value is between 5 and 60." + "description": "Optional if `sponsor_enabled`==`true`. Validity duration, in minutes, for approve or deny links in sponsor emails. Valid values are 5 to 60." }, "sponsor_notify_all": { "default": false, @@ -4377,9 +4482,10 @@ "type": "boolean" }, "sponsors": { - "description": "Object of allowed sponsors email with name. Required if `sponsor_enabled` is `true` and `sponsor_email_domains` is empty. Property key is the sponsor email, Property value is the sponsor name. List of email allowed for backward compatibility", + "description": "Allowed sponsor email addresses and display names. Required if `sponsor_enabled` is `true` and `sponsor_email_domains` is empty.", "oneOf": [ { + "description": "Allowed sponsor email addresses for guest portal sponsor approval", "items": { "type": "string" }, @@ -4389,6 +4495,7 @@ "additionalProperties": { "type": "string" }, + "description": "Allowed guest portal sponsors keyed by email address with sponsor names as values", "examples": [ { "sponsor1@company.com": "FirstName1 LastName1", @@ -4406,7 +4513,7 @@ }, "sso_forced_role": { "default": "", - "description": "Optional if `wlan_portal_auth`==`sso`", + "description": "Optional if `wlan_portal_auth`==`sso`. Role assigned to authenticated users when guest SSO is used", "type": "string" }, "sso_idp_cert": { @@ -4416,7 +4523,7 @@ }, "sso_idp_sign_algo": { "default": "sha1", - "description": "Optional if `wlan_portal_auth`==`sso`, Signing algorithm for SAML Assertion. enum: `sha1`, `sha256`, `sha384`, `sha512`", + "description": "Optional if `wlan_portal_auth`==`sso`. Signing algorithm used for SAML assertions from the identity provider", "enum": [ "sha1", "sha256", @@ -4437,7 +4544,7 @@ }, "sso_nameid_format": { "default": "email", - "description": "Optional if `wlan_portal_auth`==`sso`. enum: `email`, `unspecified`", + "description": "Optional if `wlan_portal_auth`==`sso`. SAML NameID format expected from the identity provider", "enum": [ "email", "unspecified" @@ -4458,6 +4565,7 @@ "examples": [ "af9dac44c344a875ab5d31cb7abcdefg" ], + "format": "password", "type": [ "string", "null" @@ -4488,7 +4596,7 @@ }, "portal_allowed_hostnames": { "default": [], - "description": "List of hostnames without http(s):// (matched by substring)", + "description": "Guest portal hostnames that clients may reach before authorization", "examples": [ [ "snapchat.com", @@ -4502,7 +4610,7 @@ }, "portal_allowed_subnets": { "default": [], - "description": "List of CIDRs", + "description": "Guest portal CIDR subnets that clients may reach before authorization", "examples": [ [ "63.5.3.0/24" @@ -4526,7 +4634,7 @@ }, "portal_denied_hostnames": { "default": [], - "description": "List of hostnames without http(s):// (matched by substring), this takes precedence over portal_allowed_hostnames", + "description": "Guest portal hostnames denied before authorization, taking precedence over allowed hostnames", "examples": [ [ "msg.snapchat.com" @@ -4569,10 +4677,11 @@ }, "qos": { "additionalProperties": false, + "description": "Quality-of-service settings for WLAN client traffic", "properties": { "class": { "default": "best_effort", - "description": "enum: `background`, `best_effort`, `video`, `voice`", + "description": "QoS traffic class applied when WLAN QoS override is enabled", "enum": [ "background", "best_effort", @@ -4594,13 +4703,15 @@ }, "radsec": { "additionalProperties": false, - "description": "RadSec settings", + "description": "TLS-secured RADIUS transport settings for this WLAN", "properties": { "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled for RadSec traffic", "type": "boolean" }, "enabled": { + "description": "Whether RadSec is enabled", "type": "boolean" }, "idle_timeout": { @@ -4613,10 +4724,10 @@ "type": "string" } ], - "description": "Radsec Idle Timeout in seconds. Default is 60" + "description": "Idle timeout, in seconds, for RadSec connections" }, "mxcluster_ids": { - "description": "To use Org mxedges when this WLAN does not use mxtunnel, specify their mxcluster_ids. Org mxedge(s) identified by mxcluster_ids", + "description": "Mist Edge cluster IDs used as RadSec proxies when the WLAN does not use mxtunnel", "items": { "examples": [ "572586b7-f97b-a22b-526c-8b97a3f609c4" @@ -4627,7 +4738,7 @@ "type": "array" }, "proxy_hosts": { - "description": "Default is site.mxedge.radsec.proxy_hosts which must be a superset of all `wlans[*].radsec.proxy_hosts`. When `radsec.proxy_hosts` are not used, tunnel peers (org or site mxedges) are used irrespective of `use_site_mxedge`", + "description": "RadSec proxy hostnames advertised to APs", "items": { "examples": [ "mxedge1.local" @@ -4637,24 +4748,27 @@ "type": "array" }, "server_name": { - "description": "Name of the server to verify (against the cacerts in Org Setting). Only if not Mist Edge.", + "description": "TLS server name to verify against the CA certificates in Org Setting. Only if not Mist Edge.", "examples": [ "radsec.abc.com" ], "type": "string" }, "servers": { - "description": "List of RadSec Servers. Only if not Mist Edge.", + "description": "External RadSec servers. Only if not Mist Edge.", "items": { "additionalProperties": false, + "description": "External RadSec server settings", "properties": { "host": { + "description": "Address or hostname of the RadSec server", "examples": [ "1.1.1.1" ], "type": "string" }, "port": { + "description": "TCP port used by the RadSec server", "examples": [ 1812 ], @@ -4669,12 +4783,12 @@ "uniqueItems": true }, "use_mxedge": { - "description": "use mxedge(s) as RadSec Proxy", + "description": "Whether to use organization Mist Edge instances as RadSec proxies", "type": "boolean" }, "use_site_mxedge": { "default": false, - "description": "To use Site mxedges when this WLAN does not use mxtunnel", + "description": "Whether to use site Mist Edge instances when this WLAN does not use mxtunnel", "type": "boolean" } }, @@ -4716,7 +4830,7 @@ ] }, "legacy": { - "description": "If `template`==`custom`. List of supported rates (IE=1) and extended supported rates (IE=50) for custom template, append ‘b’ at the end to indicate a rate being basic/mandatory. If `template`==`custom` is configured and legacy does not define at least one basic rate, it will use `no-legacy` default values", + "description": "If `template`==`custom`, legacy 802.11 data rates allowed on this WLAN", "examples": [ [ "6", @@ -4771,7 +4885,7 @@ }, "template": { "default": "compatible", - "description": "Data Rates template to apply. enum: \\n * `no-legacy`: no 11b\\n * `compatible`: all, like before, default setting that Broadcom/Atheros used\\n * `legacy-only`: disable 802.11n and 802.11ac\\n * `high-density`: no 11b, no low rates\\n * `custom`: user defined", + "description": "Data rate template used to derive WLAN rate settings", "enum": [ "compatible", "legacy-only", @@ -4797,7 +4911,7 @@ }, "type": "object" }, - "description": "Property key is the RF band. enum: `24`, `5`, `6`", + "description": "Data rate settings by RF band for this WLAN", "type": "object" }, "reconnect_clients_when_roaming_mxcluster": { @@ -4807,7 +4921,7 @@ }, "roam_mode": { "default": "NONE", - "description": "enum: `11r`, `OKC`, `NONE`", + "description": "Fast roaming mode configured for this WLAN", "enum": [ "11r", "NONE", @@ -4820,19 +4934,20 @@ }, "schedule": { "additionalProperties": false, - "description": "WLAN operating schedule, default is disabled", + "description": "Operating schedule controlling when this WLAN is active", "properties": { "enabled": { "default": false, + "description": "Whether the WLAN operating schedule is enabled", "type": "boolean" }, "hours": { "additionalProperties": false, - "description": "Days/Hours of operation filter, the available days (mon, tue, wed, thu, fri, sat, sun)", + "description": "Time ranges when the WLAN is scheduled to operate", "properties": { "fri": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Friday", "examples": [ "09:00-17:00" ], @@ -4840,7 +4955,7 @@ }, "mon": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Monday", "examples": [ "09:00-17:00" ], @@ -4848,7 +4963,7 @@ }, "sat": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Saturday", "examples": [ "09:00-17:00" ], @@ -4856,7 +4971,7 @@ }, "sun": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Sunday", "examples": [ "09:00-17:00" ], @@ -4864,7 +4979,7 @@ }, "thu": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Thursday", "examples": [ "09:00-17:00" ], @@ -4872,7 +4987,7 @@ }, "tue": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Tuesday", "examples": [ "09:00-17:00" ], @@ -4880,7 +4995,7 @@ }, "wed": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Wednesday", "examples": [ "09:00-17:00" ], @@ -4893,6 +5008,7 @@ "type": "object" }, "site_id": { + "description": "Mist site associated with this WLAN, when site-scoped", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -4914,6 +5030,7 @@ }, "template_id": { "default": "", + "description": "Identifier of the WLAN template associated with this WLAN", "format": "uuid", "type": [ "string", @@ -4941,6 +5058,7 @@ "type": "boolean" }, "vlan_id": { + "description": "Default VLAN ID, range, or variable used when `vlan_enabled`==`true`", "oneOf": [ { "type": "string" @@ -4956,6 +5074,7 @@ ] }, "vlan_ids": { + "description": "Pool of VLAN IDs used when `vlan_enabled`==`true` and `vlan_pooling`==`true`", "oneOf": [ { "description": "If `vlan_enabled`==`true` and `vlan_pooling`==`true`. List of VLAN IDs to be used in the VLAN Pool", @@ -4974,6 +5093,7 @@ ] ], "items": { + "description": "VLAN ID, either numeric or expressed as a template variable string", "oneOf": [ { "type": "string" @@ -5005,7 +5125,7 @@ "type": "string" } ], - "description": "In kbps, value from 1 to 999000" + "description": "Downlink bandwidth limit applied to the whole WLAN" }, "wlan_limit_down_enabled": { "default": false, @@ -5023,7 +5143,7 @@ "type": "string" } ], - "description": "In kbps, value from 1 to 999000" + "description": "Uplink bandwidth limit applied to the whole WLAN" }, "wlan_limit_up_enabled": { "default": false, @@ -5031,7 +5151,7 @@ "type": "boolean" }, "wxtag_ids": { - "description": "List of wxtag_ids", + "description": "Identifiers of WxLAN tags used when `apply_to`==`wxtags`", "items": { "format": "uuid", "type": "string" @@ -5067,27 +5187,32 @@ }, "org_rftemplate": { "schema": { - "description": "RF Template", + "description": "RF template used by the current RRM calculation", "properties": { "ant_gain_24": { + "description": "External antenna gain for the 2.4 GHz radio", "type": "integer" }, "ant_gain_5": { + "description": "External antenna gain for the 5 GHz radio", "type": "integer" }, "ant_gain_6": { + "description": "External antenna gain for the 6 GHz radio", "type": "integer" }, "band_24": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "2.4 GHz radio settings in this RF template", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 2.4 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 2.4 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -5097,7 +5222,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 2.4 GHz radio", "enum": [ "1x1", "2x2", @@ -5112,7 +5237,7 @@ }, "bandwidth": { "default": 20, - "description": "channel width for the 2.4GHz band. enum: `0`(disabled, response only), `20`, `40`", + "description": "Channel width configured for the 2.4 GHz radio", "enum": [ 0, 20, @@ -5125,7 +5250,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 2.4 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -5174,7 +5299,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 2.4 GHz radio", "enum": [ "auto", "long", @@ -5186,7 +5311,7 @@ "type": "object" }, "band_24_usage": { - "description": "enum: `24`, `5`, `6`, `auto`", + "description": "Radio usage mode for the 2.4 GHz-capable radio in this RF template", "enum": [ "24", "5", @@ -5197,14 +5322,16 @@ }, "band_5": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "5 GHz radio settings in this RF template", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 5 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 5 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -5214,7 +5341,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 5 GHz radio", "enum": [ "1x1", "2x2", @@ -5229,7 +5356,7 @@ }, "bandwidth": { "default": 40, - "description": "channel width for the 5GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`", + "description": "Channel width configured for the 5 GHz radio", "enum": [ 0, 20, @@ -5243,7 +5370,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -5292,7 +5419,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 5 GHz radio", "enum": [ "auto", "long", @@ -5305,14 +5432,16 @@ }, "band_5_on_24_radio": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "5 GHz settings used when the 2.4 GHz radio operates in 5 GHz mode", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 5 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 5 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -5322,7 +5451,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 5 GHz radio", "enum": [ "1x1", "2x2", @@ -5337,7 +5466,7 @@ }, "bandwidth": { "default": 40, - "description": "channel width for the 5GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`", + "description": "Channel width configured for the 5 GHz radio", "enum": [ 0, 20, @@ -5351,7 +5480,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -5400,7 +5529,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 5 GHz radio", "enum": [ "auto", "long", @@ -5413,14 +5542,16 @@ }, "band_6": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "6 GHz radio settings in this RF template", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 6 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 6 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -5430,7 +5561,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 6 GHz radio", "enum": [ "1x1", "2x2", @@ -5445,7 +5576,7 @@ }, "bandwidth": { "default": 80, - "description": "channel width for the 6GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`, `160`", + "description": "Channel width configured for the 6 GHz radio", "enum": [ 0, 20, @@ -5460,7 +5591,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 6 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -5509,7 +5640,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 6 GHz radio", "enum": [ "auto", "long", @@ -5530,17 +5661,18 @@ "type": "string" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the RF template was created", "format": "double", "readOnly": true, "type": "number" }, "for_site": { + "description": "Whether the RF template is scoped to a site rather than the organization", "readOnly": true, "type": "boolean" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the RF template", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -5551,29 +5683,35 @@ "model_specific": { "additionalProperties": { "additionalProperties": false, + "description": "AP model-specific RF overrides for an RF template", "properties": { "ant_gain_24": { "default": 0, + "description": "Model-specific external antenna gain for the 2.4 GHz radio", "type": "integer" }, "ant_gain_5": { "default": 0, + "description": "Model-specific external antenna gain for the 5 GHz radio", "type": "integer" }, "ant_gain_6": { "default": 0, + "description": "Model-specific external antenna gain for the 6 GHz radio", "type": "integer" }, "band_24": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "Model-specific 2.4 GHz radio settings that override RF template defaults", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 2.4 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 2.4 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -5583,7 +5721,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 2.4 GHz radio", "enum": [ "1x1", "2x2", @@ -5598,7 +5736,7 @@ }, "bandwidth": { "default": 20, - "description": "channel width for the 2.4GHz band. enum: `0`(disabled, response only), `20`, `40`", + "description": "Channel width configured for the 2.4 GHz radio", "enum": [ 0, 20, @@ -5611,7 +5749,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 2.4 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -5660,7 +5798,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 2.4 GHz radio", "enum": [ "auto", "long", @@ -5672,7 +5810,7 @@ "type": "object" }, "band_24_usage": { - "description": "enum: `24`, `5`, `6`, `auto`", + "description": "Model-specific radio usage mode for the 2.4 GHz-capable radio", "enum": [ "24", "5", @@ -5683,14 +5821,16 @@ }, "band_5": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "Model-specific 5 GHz radio settings that override RF template defaults", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 5 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 5 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -5700,7 +5840,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 5 GHz radio", "enum": [ "1x1", "2x2", @@ -5715,7 +5855,7 @@ }, "bandwidth": { "default": 40, - "description": "channel width for the 5GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`", + "description": "Channel width configured for the 5 GHz radio", "enum": [ 0, 20, @@ -5729,7 +5869,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -5778,7 +5918,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 5 GHz radio", "enum": [ "auto", "long", @@ -5791,14 +5931,16 @@ }, "band_5_on_24_radio": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "Model-specific 5 GHz settings used when the 2.4 GHz radio operates in 5 GHz mode", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 5 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 5 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -5808,7 +5950,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 5 GHz radio", "enum": [ "1x1", "2x2", @@ -5823,7 +5965,7 @@ }, "bandwidth": { "default": 40, - "description": "channel width for the 5GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`", + "description": "Channel width configured for the 5 GHz radio", "enum": [ 0, 20, @@ -5837,7 +5979,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -5886,7 +6028,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 5 GHz radio", "enum": [ "auto", "long", @@ -5899,14 +6041,16 @@ }, "band_6": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "Model-specific 6 GHz radio settings that override RF template defaults", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 6 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 6 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -5916,7 +6060,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 6 GHz radio", "enum": [ "1x1", "2x2", @@ -5931,7 +6075,7 @@ }, "bandwidth": { "default": 80, - "description": "channel width for the 6GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`, `160`", + "description": "Channel width configured for the 6 GHz radio", "enum": [ 0, 20, @@ -5946,7 +6090,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 6 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -5995,7 +6139,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 6 GHz radio", "enum": [ "auto", "long", @@ -6018,7 +6162,7 @@ "type": "object" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the RF template was last modified", "format": "double", "readOnly": true, "type": "number" @@ -6028,6 +6172,7 @@ "type": "string" }, "org_id": { + "description": "Organization that owns this RF template", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -6049,22 +6194,26 @@ }, "org_networktemplate": { "schema": { - "description": "Network Template", + "description": "Network template configuration applied to sites or site groups", "properties": { "acl_policies": { + "description": "ACL policy defaults provided by this network template", "items": { "additionalProperties": false, "description": "ACL Policy:\\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to", "properties": { "actions": { - "description": "ACL Policy Actions:\\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to", + "description": "Destination tag actions evaluated for sources matching this ACL policy", "items": { "additionalProperties": false, + "description": "Action applied to traffic that matches a destination ACL tag", "properties": { "action": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Allow or deny decision applied to traffic matching the destination tag" }, "dst_tag": { + "description": "Destination ACL tag matched by this policy action", "examples": [ "corp" ], @@ -6079,13 +6228,14 @@ "type": "array" }, "name": { + "description": "Display name of the ACL policy", "examples": [ "guest access" ], "type": "string" }, "src_tags": { - "description": "ACL Policy Source Tags:\\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to", + "description": "Source ACL tags that select traffic for this ACL policy", "items": { "examples": [ "macs" @@ -6108,7 +6258,7 @@ "default": [ "any" ], - "description": "ARP / IPv6. Default is `any`", + "description": "Layer 2 EtherTypes matched by this ACL tag; defaults to `any`", "items": { "type": "string" }, @@ -6119,7 +6269,7 @@ "type": "integer" }, "macs": { - "description": "Required if \\n- `type`==`mac`\\n- `type`==`static_gbp` if from matching mac", + "description": "Client or resource MAC addresses matched by this ACL tag", "items": { "type": "string" }, @@ -6130,7 +6280,7 @@ "type": "string" }, "port_usage": { - "description": "Required if `type`==`port_usage`", + "description": "Required if `type`==`port_usage`. Switch port usage name matched by this ACL tag", "type": "string" }, "radius_group": { @@ -6138,9 +6288,10 @@ "type": "string" }, "specs": { - "description": "If `type`==`resource`, `type`==`radius_group`, `type`==`port_usage` or `type`==`gbp_resource`. Empty means unrestricted, i.e. any", + "description": "Layer 4 protocol and destination-port constraints for this ACL tag", "items": { "additionalProperties": false, + "description": "Layer 4 protocol and destination-port match constraint for an ACL tag", "properties": { "port_range": { "default": "0", @@ -6158,14 +6309,14 @@ "type": "array" }, "subnets": { - "description": "If \\n- `type`==`subnet` \\n- `type`==`resource` (optional. default is `any`)\\n- `type`==`static_gbp` if from matching subnet", + "description": "IP subnets matched by this ACL tag", "items": { "type": "string" }, "type": "array" }, "type": { - "description": "enum: \\n * `any`: matching anything not identified\\n * `dynamic_gbp`: from the gbp_tag received from RADIUS\\n * `gbp_resource`: can only be used in `dst_tags`\\n * `mac`\\n * `network`\\n * `port_usage`\\n * `radius_group`\\n * `resource`: can only be used in `dst_tags`\\n * `static_gbp`: applying gbp tag against matching conditions\\n * `subnet`'", + "description": "Classifier type that determines which ACL tag fields are evaluated", "enum": [ "any", "dynamic_gbp", @@ -6186,11 +6337,11 @@ ], "type": "object" }, - "description": "ACL Tags to identify traffic source or destination. Key name is the tag name", + "description": "ACL tags available to access policies in this network template", "type": "object" }, "additional_config_cmds": { - "description": "additional CLI commands to append to the generated Junos config. **Note**: no check is done", + "description": "Additional CLI configuration commands provided by this network template", "items": { "description": "JUNOS \\"set\\" command to add to the generated configuration", "examples": [ @@ -6203,8 +6354,10 @@ "bgp_config": { "additionalProperties": { "additionalProperties": false, + "description": "Switch BGP configuration for a routing instance", "properties": { "auth_key": { + "description": "Authentication key used for BGP neighbor sessions, when configured", "type": "string" }, "bfd_minimum_interval": { @@ -6218,15 +6371,17 @@ "type": "string" }, "hold_time": { - "description": "Hold time is three times the interval at which keepalive messages are sent. It indicates to the peer the length of time that it should consider the sender valid. Must be 0 or a number in the range 3-65535.", + "description": "Default BGP hold time for switch BGP sessions", "oneOf": [ { + "description": "BGP hold time value of 0", "enum": [ 0 ], "type": "integer" }, { + "description": "BGP hold time value from 3 to 65535 seconds", "maximum": 65535, "minimum": 3, "type": "integer" @@ -6248,7 +6403,7 @@ "type": "integer" } ], - "description": "BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}` )", + "description": "Local BGP Autonomous System (AS) number for the switch", "examples": [ 65000 ] @@ -6256,13 +6411,14 @@ "neighbors": { "additionalProperties": { "additionalProperties": false, + "description": "Per-neighbor switch BGP session settings", "properties": { "export_policy": { "description": "Export policy must match one of the policy names defined in the `routing_policies` property.", "type": "string" }, "hold_time": { - "description": "Hold time is three times the interval at which keepalive messages are sent. It indicates to the peer the length of time that it should consider the sender valid. Must be 0 or a number in the range 3-65535.", + "description": "BGP hold time for this neighbor", "oneOf": [ { "$comment": "max depth reached" @@ -6277,6 +6433,7 @@ "type": "string" }, "multihop_ttl": { + "description": "Time-to-live value for multihop BGP sessions to this neighbor", "maximum": 255, "minimum": 1, "type": "integer" @@ -6301,18 +6458,18 @@ ], "type": "object" }, - "description": "Property key is the BGP Neighbor IP Address.", + "description": "BGP neighbor settings keyed by neighbor IP address", "type": "object" }, "networks": { - "description": "List of network names for BGP configuration. When a network is specified, a BGP group will be added to the VRF that network is part of.", + "description": "Network names used to add BGP groups to the corresponding VRFs", "items": { "type": "string" }, "type": "array" }, "type": { - "description": "enum: `external`, `internal`", + "description": "BGP session type for this switch BGP configuration", "enum": [ "external", "internal" @@ -6326,18 +6483,21 @@ ], "type": "object" }, + "description": "BGP routing defaults for this network template. Property key is the BGP session name", "type": "object" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the network template was created", "format": "double", "readOnly": true, "type": "number" }, "dhcp_snooping": { "additionalProperties": false, + "description": "DHCP snooping defaults provided by this network template", "properties": { "all_networks": { + "description": "Whether DHCP snooping applies to all configured networks", "type": "boolean" }, "enable_arp_spoof_check": { @@ -6349,10 +6509,11 @@ "type": "boolean" }, "enabled": { + "description": "Whether DHCP snooping is enabled", "type": "boolean" }, "networks": { - "description": "If `all_networks`==`false`, list of network with DHCP snooping enabled", + "description": "Network names with DHCP snooping enabled when `all_networks`==`false`", "items": { "type": "string" }, @@ -6362,14 +6523,14 @@ "type": "object" }, "dns_servers": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS servers provided by this network template", "items": { "type": "string" }, "type": "array" }, "dns_suffix": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS search suffixes provided by this network template", "items": { "type": "string" }, @@ -6378,13 +6539,15 @@ "extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "IPv4 static route settings for a destination prefix", "properties": { "discard": { "default": false, - "description": "This takes precedence", + "description": "Whether to install a discard route; this takes precedence over next-hop settings", "type": "boolean" }, "metric": { + "description": "Route metric for the IPv4 static route", "examples": [ null ], @@ -6398,14 +6561,17 @@ "next_qualified": { "additionalProperties": { "additionalProperties": false, + "description": "Qualified next-hop attributes for an IPv4 static route", "properties": { "metric": { + "description": "Route metric for this qualified IPv4 next hop", "type": [ "integer", "null" ] }, "preference": { + "description": "Route preference for this qualified IPv4 next hop", "type": [ "integer", "null" @@ -6414,6 +6580,7 @@ }, "type": "object" }, + "description": "Qualified next-hop settings keyed by IPv4 next-hop address", "examples": [ { "10.3.1.1": { @@ -6426,9 +6593,11 @@ }, "no_resolve": { "default": false, + "description": "Whether to prevent recursive next-hop resolution for the IPv4 static route", "type": "boolean" }, "preference": { + "description": "Route preference for the IPv4 static route", "examples": [ 30 ], @@ -6440,7 +6609,7 @@ ] }, "via": { - "description": "Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.", + "description": "Next-hop IPv4 address or ECMP next-hop IPv4 addresses for the route", "examples": [ "10.2.1.1", [ @@ -6463,7 +6632,7 @@ }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"10.0.0.0/8\\")", + "description": "Additional IPv4 route defaults in this network template", "examples": [ { "0.0.0.0/0": { @@ -6476,13 +6645,15 @@ "extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "IPv6 static route settings for a destination prefix", "properties": { "discard": { "default": false, - "description": "This takes precedence", + "description": "Whether to install a discard route; this takes precedence over next-hop settings", "type": "boolean" }, "metric": { + "description": "Route metric for the IPv6 static route", "examples": [ null ], @@ -6496,14 +6667,17 @@ "next_qualified": { "additionalProperties": { "additionalProperties": false, + "description": "Qualified next-hop attributes for an IPv6 static route", "properties": { "metric": { + "description": "Route metric for this qualified IPv6 next hop", "type": [ "integer", "null" ] }, "preference": { + "description": "Route preference for this qualified IPv6 next hop", "type": [ "integer", "null" @@ -6512,6 +6686,7 @@ }, "type": "object" }, + "description": "Qualified next-hop settings keyed by IPv6 next-hop address", "examples": [ { "2a02:1234:200a::100": { @@ -6524,9 +6699,11 @@ }, "no_resolve": { "default": false, + "description": "Whether to prevent recursive next-hop resolution for the IPv6 static route", "type": "boolean" }, "preference": { + "description": "Route preference for the IPv6 static route", "examples": [ 30 ], @@ -6538,7 +6715,7 @@ ] }, "via": { - "description": "Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.", + "description": "Next-hop IPv6 address or ECMP next-hop IPv6 addresses for the route", "examples": [ "10.2.1.1", [ @@ -6561,7 +6738,7 @@ }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "Additional IPv6 route defaults in this network template", "examples": [ { "2a02:1234:420a:10c9::/64": { @@ -6572,7 +6749,7 @@ "type": "object" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the network template", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -6581,7 +6758,7 @@ "type": "string" }, "import_org_networks": { - "description": "Org Networks that we'd like to import", + "description": "Organization network names imported into this network template", "items": { "examples": [ "ap" @@ -6592,24 +6769,27 @@ }, "mist_nac": { "additionalProperties": false, - "description": "Enable mist_nac to use RadSec", + "description": "Mist NAC defaults applied by this network template", "properties": { "enabled": { + "description": "Whether Mist NAC RadSec is enabled for the switch", "type": "boolean" }, "network": { + "description": "Switch network used for Mist NAC RadSec connectivity", "type": "string" } }, "type": "object" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the network template was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the network template", "type": "string" }, "networks": { @@ -6631,6 +6811,7 @@ "type": "boolean" }, "isolation_vlan_id": { + "description": "Required when `isolation`==`true`. Unique VLAN ID used for client isolation", "examples": [ "3070" ], @@ -6645,6 +6826,7 @@ "type": "string" }, "vlan_id": { + "description": "VLAN identifier for this switch network", "oneOf": [ { "type": "string" @@ -6662,17 +6844,18 @@ ], "type": "object" }, - "description": "Property key is network name", + "description": "Layer 3 networks configured by this network template", "type": "object" }, "ntp_servers": { - "description": "List of NTP servers specific to this device. By default, those in Site Settings will be used", + "description": "NTP servers provided by this network template", "items": { "type": "string" }, "type": "array" }, "org_id": { + "description": "Organization that owns this network template", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -6687,6 +6870,7 @@ "properties": { "include_loopback": { "default": false, + "description": "Whether loopback interfaces are included in this OSPF area", "type": "boolean" }, "networks": { @@ -6715,7 +6899,7 @@ }, "auth_type": { "default": "none", - "description": "auth type. enum: `md5`, `none`, `password`", + "description": "Authentication method used by this OSPF network", "enum": [ "md5", "none", @@ -6727,6 +6911,7 @@ "type": "string" }, "bfd_minimum_interval": { + "description": "Minimum BFD interval for this OSPF network, in milliseconds", "examples": [ 500 ], @@ -6735,6 +6920,7 @@ "type": "integer" }, "dead_interval": { + "description": "OSPF dead interval for this network, in seconds", "examples": [ 40 ], @@ -6743,17 +6929,20 @@ "type": "integer" }, "export_policy": { + "description": "Routing policy used to export routes from this OSPF network", "examples": [ "export_policy" ], "type": "string" }, "hello_interval": { + "description": "OSPF hello interval for this network, in seconds", "maximum": 255, "minimum": 1, "type": "integer" }, "import_policy": { + "description": "Routing policy used to import routes for this OSPF network", "examples": [ "import_policy" ], @@ -6761,7 +6950,7 @@ }, "interface_type": { "default": "broadcast", - "description": "interface type (nbma = non-broadcast multi-access). enum: `broadcast`, `nbma`, `p2mp`, `p2p`", + "description": "OSPF interface type used for this network", "enum": [ "broadcast", "nbma", @@ -6771,6 +6960,7 @@ "type": "string" }, "metric": { + "description": "OSPF metric assigned to this network", "examples": [ 10000 ], @@ -6794,6 +6984,7 @@ }, "type": "object" }, + "description": "OSPF network settings keyed by network name", "examples": [ { "corp": { @@ -6816,7 +7007,7 @@ }, "type": { "default": "default", - "description": "OSPF type. enum: `default`, `nssa`, `stub`", + "description": "Area type for this OSPF area", "enum": [ "default", "nssa", @@ -6830,15 +7021,16 @@ }, "type": "object" }, - "description": "Junos OSPF areas. Property key is the OSPF Area (Area should be a number (0-255) / IP address)", + "description": "OSPF area defaults provided by this network template", "type": "object" }, "port_mirroring": { "additionalProperties": { "additionalProperties": false, + "description": "Input and output settings for one switch port mirroring session", "properties": { "input_networks_ingress": { - "description": "At least one of the `input_port_ids_ingress`, `input_port_ids_egress` or `input_networks_ingress ` should be specified", + "description": "At least one mirror input source should be specified. Networks whose ingress traffic is mirrored", "items": { "examples": [ "corp" @@ -6848,7 +7040,7 @@ "type": "array" }, "input_port_ids_egress": { - "description": "At least one of the `input_port_ids_ingress`, `input_port_ids_egress` or `input_networks_ingress ` should be specified", + "description": "At least one mirror input source should be specified. Switch ports whose egress traffic is mirrored", "items": { "examples": [ "ge-0/0/3" @@ -6858,7 +7050,7 @@ "type": "array" }, "input_port_ids_ingress": { - "description": "At least one of the `input_port_ids_ingress`, `input_port_ids_egress` or `input_networks_ingress ` should be specified", + "description": "At least one mirror input source should be specified. Switch ports whose ingress traffic is mirrored", "items": { "examples": [ "ge-0/0/3" @@ -6891,13 +7083,13 @@ }, "type": "object" }, - "description": "Property key is the port mirroring instance name. `port_mirroring` can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 mirroring ports is allowed", + "description": "Port mirroring defaults provided by this network template", "type": "object" }, "port_usages": { "additionalProperties": { "additionalProperties": false, - "description": "Junos port usages", + "description": "Junos switch port usage template and authentication settings", "properties": { "all_networks": { "default": false, @@ -6948,7 +7140,7 @@ }, "duplex": { "default": "auto", - "description": "Only if `mode`!=`dynamic`. Link connection mode. enum: `auto`, `full`, `half`", + "description": "Only if `mode`!=`dynamic`. Link duplex mode for this port usage", "enum": [ "auto", "full", @@ -6957,7 +7149,7 @@ "type": "string" }, "dynamic_vlan_networks": { - "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`, if dynamic vlan is used, specify the possible networks/vlans RADIUS can return", + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Networks or VLANs that RADIUS can return for dynamic VLAN assignment", "examples": [ [ "corp", @@ -7006,7 +7198,7 @@ }, "mac_auth_protocol": { "default": "eap-md5", - "description": "Only if `mode`!=`dynamic` and `enable_mac_auth` ==`true`. This type is ignored if mist_nac is enabled. enum: `eap-md5`, `eap-peap`, `pap`", + "description": "Only if `mode`!=`dynamic` and `enable_mac_auth`==`true`. MAC authentication protocol to use; ignored if Mist NAC is enabled", "enum": [ "eap-md5", "eap-peap", @@ -7026,10 +7218,10 @@ "type": "string" } ], - "description": "Only if `mode`!=`dynamic`, max number of mac addresses, default is 0 for unlimited, otherwise range is 1 to 16383 (upper bound constrained by platform)" + "description": "Only if `mode`!=`dynamic`. Maximum number of MAC addresses allowed on the port; 0 means unlimited" }, "mode": { - "description": "`mode`==`dynamic` must only be used if the port usage name is `dynamic`. enum: `access`, `dynamic`, `inet`, `trunk`", + "description": "Switching mode for this port usage", "enum": [ "access", "dynamic", @@ -7052,10 +7244,10 @@ "type": "null" } ], - "description": "Only if `mode`!=`dynamic` media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation. The default value is 1514." + "description": "Only if `mode`!=`dynamic`. MTU for ports using this port usage" }, "networks": { - "description": "Only if `mode`==`trunk`, the list of network/vlans", + "description": "Only if `mode`==`trunk`. Network or VLAN names to trunk", "items": { "type": "string" }, @@ -7077,7 +7269,7 @@ "type": "boolean" }, "poe_priority": { - "description": "PoE priority. enum: `low`, `high`", + "description": "Only if `mode`!=`dynamic`. PoE priority for ports using this port usage", "enum": [ "low", "high" @@ -7085,7 +7277,7 @@ "type": "string" }, "port_auth": { - "description": "Only if `mode`!=`dynamic`. If dot1x is desired, set to dot1x. enum: `dot1x`", + "description": "Only if `mode`!=`dynamic`. 802.1X authentication mode for this port usage", "enum": [ "dot1x" ], @@ -7110,11 +7302,11 @@ "type": "string" } ], - "description": "Only if `mode`!=`dynamic` and `port_auth`=`dot1x` reauthentication interval range (min: 10, max: 65535, default: 3600). Set to 0 to disable reauthentication (no-reauthentication)." + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. RADIUS reauthentication interval for clients on the port" }, "reset_default_when": { "default": "link_down", - "description": "Only if `mode`==`dynamic` Control when the DPC port should be changed to the default port usage. enum: `link_down`, `none` (let the DPC port keep at the current port usage)", + "description": "Only if `mode`==`dynamic`. Condition that resets a dynamic port to the default port usage", "enum": [ "link_down", "none" @@ -7125,29 +7317,33 @@ "type": "string" }, "rules": { - "description": "Only if `mode`==`dynamic`", + "description": "Only if `mode`==`dynamic`. Dynamic matching rules that select the port usage to apply", "items": { "additionalProperties": false, + "description": "Dynamic port usage rule evaluated against LLDP, RADIUS, or peer MAC attributes", "properties": { "description": { "description": "Optional description of the rule", "type": "string" }, "equals": { + "description": "Exact value that the selected source attribute must match", "type": "string" }, "equals_any": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "List of values where any match satisfies this dynamic rule" }, "expression": { "description": "\\"[0:3]\\":\\"abcdef\\" -> \\"abc\\"\\n\\"split(.)[1]\\": \\"a.b.c\\" -> \\"b\\"\\n\\"split(-)[1][0:3]: \\"a1234-b5678-c90\\" -> \\"b56\\"", "type": "string" }, "src": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source attribute evaluated by this dynamic rule" }, "usage": { - "description": "`port_usage` name", + "description": "Port usage name to apply when this dynamic rule matches", "type": "string" } }, @@ -7166,7 +7362,7 @@ ] }, "server_reject_network": { - "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. When radius server reject / fails", + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. When RADIUS server reject / fails", "type": [ "string", "null" @@ -7174,7 +7370,7 @@ }, "speed": { "default": "auto", - "description": "Only if `mode`!=`dynamic`, Port speed, default is auto to automatically negotiate speed enum: `100m`, `10m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`,`auto`", + "description": "Only if `mode`!=`dynamic`. Link speed for this port usage", "enum": [ "10m", "100m", @@ -7191,7 +7387,7 @@ }, "storm_control": { "additionalProperties": false, - "description": "Switch storm control. Only if `mode`!=`dynamic`", + "description": "Only if `mode`!=`dynamic`. Storm-control settings for this port usage", "properties": { "disable_port": { "default": false, @@ -7273,39 +7469,43 @@ }, "type": "object" }, - "description": "Property key is the port usage name. Defines the profiles of port configuration configured on the switch", + "description": "Reusable switch port usage profiles provided by this network template", "type": "object" }, "radius_config": { "additionalProperties": false, - "description": "Junos Radius config", + "description": "RADIUS authentication and accounting defaults in this network template", "properties": { "acct_immediate_update": { + "description": "Whether immediate RADIUS accounting updates are sent", "type": "boolean" }, "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled", "maximum": 65535, "minimum": 0, "type": "integer" }, "acct_servers": { + "description": "RADIUS accounting servers used by this switch configuration", "items": { "additionalProperties": false, + "description": "RADIUS accounting server settings", "properties": { "host": { - "description": "IP/ hostname of RADIUS server", + "description": "Address or hostname of the RADIUS accounting server", "examples": [ "1.2.3.4" ], "type": "string" }, "keywrap_enabled": { + "description": "Whether RADIUS keywrap is enabled for messages sent to this accounting server", "type": "boolean" }, "keywrap_format": { - "description": "enum: `ascii`, `hex`", + "description": "Encoding format for RADIUS keywrap KEK and MACK values", "enum": [ "ascii", "hex" @@ -7313,12 +7513,14 @@ "type": "string" }, "keywrap_kek": { + "description": "RADIUS keywrap key encryption key (KEK)", "examples": [ "1122334455" ], "type": "string" }, "keywrap_mack": { + "description": "RADIUS keywrap message authentication code key (MACK)", "examples": [ "1122334455" ], @@ -7335,10 +7537,10 @@ "type": "string" } ], - "description": "Radius Auth Port, value from 1 to 65535, default is 1813" + "description": "UDP port used by the RADIUS accounting server" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS accounting server", "examples": [ "testing123" ], @@ -7357,7 +7559,7 @@ }, "auth_server_selection": { "default": "ordered", - "description": "enum: `ordered`, `unordered`", + "description": "Selection strategy for RADIUS authentication servers", "enum": [ "ordered", "unordered" @@ -7365,22 +7567,24 @@ "type": "string" }, "auth_servers": { + "description": "RADIUS authentication servers used by this switch configuration", "items": { "additionalProperties": false, - "description": "Authentication Server", + "description": "RADIUS authentication server settings", "properties": { "host": { - "description": "IP/ hostname of RADIUS server", + "description": "Address or hostname of the RADIUS authentication server", "examples": [ "1.2.3.4" ], "type": "string" }, "keywrap_enabled": { + "description": "Whether RADIUS keywrap is enabled for messages sent to this authentication server", "type": "boolean" }, "keywrap_format": { - "description": "enum: `ascii`, `hex`", + "description": "Encoding format for RADIUS keywrap KEK and MACK values", "enum": [ "ascii", "hex" @@ -7388,12 +7592,14 @@ "type": "string" }, "keywrap_kek": { + "description": "RADIUS keywrap key encryption key (KEK)", "examples": [ "1122334455" ], "type": "string" }, "keywrap_mack": { + "description": "RADIUS keywrap message authentication code key (MACK)", "examples": [ "1122334455" ], @@ -7410,7 +7616,7 @@ "type": "string" } ], - "description": "Radius Auth Port, value from 1 to 65535, default is 1812" + "description": "UDP port used by the RADIUS authentication server" }, "require_message_authenticator": { "default": false, @@ -7418,7 +7624,7 @@ "type": "boolean" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS authentication server", "examples": [ "testing123" ], @@ -7437,16 +7643,17 @@ }, "auth_servers_retries": { "default": 3, - "description": "Radius auth session retries", + "description": "RADIUS auth session retries", "type": "integer" }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout", + "description": "RADIUS auth session timeout", "type": "integer" }, "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled", "type": "boolean" }, "coa_port": { @@ -7460,10 +7667,11 @@ "type": "string" } ], - "description": "Radius CoA Port, value from 1 to 65535, default is 3799" + "description": "UDP port used for RADIUS Change of Authorization (CoA)" }, "fast_dot1x_timers": { "default": false, + "description": "Whether fast 802.1X timers are enabled for RADIUS authentication", "type": "boolean" }, "network": { @@ -7471,7 +7679,7 @@ "type": "string" }, "source_ip": { - "description": "Use `network`or `source_ip`", + "description": "Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic", "type": "string" } }, @@ -7479,9 +7687,11 @@ }, "remote_syslog": { "additionalProperties": false, + "description": "Remote syslog defaults provided by this network template", "properties": { "archive": { "additionalProperties": false, + "description": "Retention settings for generated syslog archive files", "properties": { "files": { "anyOf": [ @@ -7492,11 +7702,13 @@ "type": "integer" } ], + "description": "Number of archived syslog files to retain", "examples": [ 20 ] }, "size": { + "description": "Maximum size of each archived syslog file, such as 5m", "examples": [ "5m" ], @@ -7506,6 +7718,7 @@ "type": "object" }, "cacerts": { + "description": "CA certificates used to verify TLS syslog servers", "examples": [ [ "-----BEGIN CERTIFICATE-----\\\\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\\\\n-----END CERTIFICATE-----", @@ -7519,16 +7732,21 @@ }, "console": { "additionalProperties": false, + "description": "Log forwarding filters for console messages sent to remote syslog", "properties": { "contents": { + "description": "Syslog facilities and severities forwarded from console logs", "items": { "additionalProperties": false, + "description": "Syslog message content selector for remote logging", "properties": { "facility": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Syslog facility to match for this selector" }, "severity": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Syslog severity to match for this selector" } }, "type": "object" @@ -7540,19 +7758,25 @@ }, "enabled": { "default": false, + "description": "Whether remote syslog forwarding is enabled", "type": "boolean" }, "files": { + "description": "Local syslog file definitions to generate and forward", "items": { "additionalProperties": false, + "description": "Generated syslog file output settings", "properties": { "archive": { "additionalProperties": false, + "description": "Retention settings for this generated syslog file", "properties": { "files": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Number of archived syslog files to retain" }, "size": { + "description": "Maximum size of each archived syslog file, such as 5m", "examples": [ "5m" ], @@ -7562,31 +7786,36 @@ "type": "object" }, "contents": { + "description": "Syslog facilities and severities written to this file", "items": { "$comment": "max depth reached" }, "type": "array" }, "enable_tls": { - "description": "Only if `protocol`==`tcp`", + "description": "Only if `protocol`==`tcp`, enable TLS for this syslog file destination", "type": "boolean" }, "explicit_priority": { + "description": "Whether to include explicit syslog priority values in file output", "type": "boolean" }, "file": { + "description": "Generated syslog file name", "examples": [ "file-name" ], "type": "string" }, "match": { + "description": "Expression used to filter log messages written to this file", "examples": [ "!alarm|ntp|errors.crc_error[chan]" ], "type": "string" }, "structured_data": { + "description": "Whether to include structured syslog data in file output", "type": "boolean" } }, @@ -7595,7 +7824,7 @@ "type": "array" }, "network": { - "description": "If source_address is configured, will use the vlan firstly otherwise use source_ip", + "description": "Source network used for syslog traffic. If `source_address` is configured, Mist uses the VLAN first; otherwise it uses `source_ip`", "examples": [ "default" ], @@ -7603,9 +7832,11 @@ }, "send_to_all_servers": { "default": false, + "description": "Whether each log entry is sent to all configured remote syslog servers", "type": "boolean" }, "servers": { + "description": "Remote syslog server destinations", "examples": [ [ { @@ -7620,19 +7851,22 @@ ], "items": { "additionalProperties": false, + "description": "Remote syslog server destination settings", "properties": { "contents": { + "description": "Syslog facilities and severities sent to this server", "items": { "$comment": "max depth reached" }, "type": "array" }, "explicit_priority": { + "description": "Whether to include explicit syslog priority values in messages sent to this server", "type": "boolean" }, "facility": { "default": "any", - "description": "enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`", + "description": "Default syslog facility for messages sent to this server", "enum": [ "any", "authorization", @@ -7657,12 +7891,14 @@ "type": "string" }, "host": { + "description": "Address or hostname of the remote syslog server", "examples": [ "syslogd.internal" ], "type": "string" }, "match": { + "description": "Expression used to filter log messages sent to this server", "examples": [ "!alarm|ntp|errors.crc_error[chan]" ], @@ -7680,11 +7916,11 @@ "type": "string" } ], - "description": "Syslog Service Port, value from 1 to 65535" + "description": "Network port used by the remote syslog server" }, "protocol": { "default": "udp", - "description": "enum: `tcp`, `udp`", + "description": "Transport protocol used for this remote syslog server", "enum": [ "tcp", "udp" @@ -7692,13 +7928,14 @@ "type": "string" }, "routing_instance": { + "description": "Routing instance used to reach this remote syslog server", "examples": [ "routing-instance-name" ], "type": "string" }, "server_name": { - "description": "Name of the server", + "description": "TLS server name used when verifying the remote syslog server certificate", "examples": [ "syslogd.internal" ], @@ -7706,7 +7943,7 @@ }, "severity": { "default": "any", - "description": "enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`", + "description": "Default syslog severity for messages sent to this server", "enum": [ "alert", "any", @@ -7720,13 +7957,15 @@ "type": "string" }, "source_address": { - "description": "If source_address is configured, will use the vlan firstly otherwise use source_ip", + "description": "Source address for syslog traffic. If configured, Mist uses the VLAN first; otherwise it uses `source_ip`", "type": "string" }, "structured_data": { + "description": "Whether to include structured syslog data in messages sent to this server", "type": "boolean" }, "tag": { + "description": "Syslog tag value added to messages sent to this server", "type": "string" } }, @@ -7735,7 +7974,7 @@ "type": "array" }, "time_format": { - "description": "enum: `millisecond`, `year`, `year millisecond`", + "description": "Timestamp format used in forwarded syslog messages", "enum": [ "millisecond", "year", @@ -7747,22 +7986,27 @@ "type": "string" }, "users": { + "description": "User-specific syslog logging rules", "items": { "additionalProperties": false, + "description": "User-specific syslog logging rule", "properties": { "contents": { + "description": "Syslog facilities and severities logged for this user rule", "items": { "$comment": "max depth reached" }, "type": "array" }, "match": { + "description": "Expression used to filter user log messages", "examples": [ "\\"!alarm|ntp|errors.crc_error[chan]\\"" ], "type": "string" }, "user": { + "description": "Account name or wildcard matched by this syslog rule", "examples": [ "*" ], @@ -7784,19 +8028,24 @@ "routing_policies": { "additionalProperties": { "additionalProperties": false, + "description": "Switch routing policy made of ordered match-action terms", "properties": { "terms": { - "description": "at least criteria/filter must be specified to match the term, all criteria have to be met", + "description": "Ordered terms evaluated by this switch routing policy", "items": { "additionalProperties": false, + "description": "Switch routing policy term with match criteria and actions", "properties": { "actions": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Policy actions applied when this routing policy term matches" }, "matching": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Route match criteria that must be satisfied before actions are applied" }, "name": { + "description": "Display name of the switch routing policy term", "type": "string" } }, @@ -7812,23 +8061,28 @@ }, "type": "object" }, - "description": "Property key is the routing policy name", + "description": "Routing policy defaults applied by this network template", "type": "object" }, "snmp_config": { "additionalProperties": false, + "description": "SNMP defaults provided by this network template", "properties": { "client_list": { + "description": "SNMP client allowlists that can be referenced by communities", "items": { "additionalProperties": false, + "description": "SNMP client allowlist definition", "properties": { "client_list_name": { + "description": "Name of the SNMP client list", "examples": [ "clist-1" ], "type": "string" }, "clients": { + "description": "SNMP client IP addresses or CIDR ranges allowed by this list", "items": { "examples": [ "151.140.101.218/32" @@ -7843,12 +8097,14 @@ "type": "array" }, "contact": { + "description": "Administrative contact string advertised through SNMP", "examples": [ "cns@juniper.net" ], "type": "string" }, "description": { + "description": "Device description string advertised through SNMP", "examples": [ "Juniper QFX Series Switch - 1K_5LA" ], @@ -7856,15 +8112,17 @@ }, "enabled": { "default": true, + "description": "Whether SNMP is enabled", "type": "boolean" }, "engine_id": { + "description": "SNMP engine ID used for SNMPv3", "maxLength": 27, "type": "string" }, "engine_id_type": { "default": "local", - "description": "enum: `local`, `use_mac_address`", + "description": "Method used to derive the SNMP engine ID", "enum": [ "local", "use_mac_address" @@ -7872,12 +8130,14 @@ "type": "string" }, "location": { + "description": "Physical location string advertised through SNMP", "examples": [ "Las Vegas, NV" ], "type": "string" }, "name": { + "description": "System name advertised through SNMP", "examples": [ "TGH-1K-QFX10K" ], @@ -7885,13 +8145,17 @@ }, "network": { "default": "default", + "description": "Management network used for SNMP traffic", "type": "string" }, "trap_groups": { + "description": "SNMP trap group definitions", "items": { "additionalProperties": false, + "description": "SNMP trap group definition", "properties": { "categories": { + "description": "Trap categories included in this SNMP trap group", "items": { "examples": [ "authentication" @@ -7901,13 +8165,14 @@ "type": "array" }, "group_name": { - "description": "Categories list can refer to https://www.juniper.net/documentation/software/topics/task/configuration/snmp_trap-groups-configuring-junos-nm.html", + "description": "Trap group name for this SNMP trap group", "examples": [ "profiler" ], "type": "string" }, "targets": { + "description": "Trap target addresses for this SNMP trap group", "items": { "examples": [ "172.29.158.19" @@ -7918,7 +8183,7 @@ }, "version": { "default": "v2", - "description": "enum: `all`, `v1`, `v2`", + "description": "SNMP trap protocol version used by this group", "enum": [ "all", "v1", @@ -7932,30 +8197,34 @@ "type": "array" }, "v2c_config": { + "description": "SNMPv2c community configuration entries for this SNMP profile", "items": { "additionalProperties": false, + "description": "SNMPv2c community configuration entry", "properties": { "authorization": { + "description": "Access level for the SNMPv2c community", "examples": [ "read-only" ], "type": "string" }, "client_list_name": { - "description": "Client_list_name here should refer to client_list above", + "description": "SNMP client list name referenced by this community", "examples": [ "clist-1" ], "type": "string" }, "community_name": { + "description": "SNMPv2c community string name", "examples": [ "abc123" ], "type": "string" }, "view": { - "description": "View name here should be defined in views above", + "description": "SNMP view name that must be defined in the views list", "examples": [ "all" ], @@ -7968,19 +8237,25 @@ }, "v3_config": { "additionalProperties": false, + "description": "SNMPv3 user, VACM, notify, and target configuration", "properties": { "notify": { + "description": "SNMPv3 notification definitions used for traps and informs", "items": { "additionalProperties": false, + "description": "SNMPv3 notification definition for traps or informs", "properties": { "name": { + "description": "Identifier for this SNMPv3 notification definition", "type": "string" }, "tag": { + "description": "Notification tag used to select target addresses", "type": "string" }, "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Delivery mode for this SNMPv3 notification, such as trap or inform" } }, "type": "object" @@ -7988,13 +8263,17 @@ "type": "array" }, "notify_filter": { + "description": "SNMPv3 notification filter profiles", "items": { "additionalProperties": false, + "description": "SNMPv3 notification filter profile", "properties": { "contents": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "OID filter rules in this notification filter profile" }, "profile_name": { + "description": "Notification filter profile name", "type": "string" } }, @@ -8003,16 +8282,20 @@ "type": "array" }, "target_address": { + "description": "SNMPv3 notification target addresses", "items": { "additionalProperties": false, + "description": "SNMPv3 notification target address entry", "properties": { "address": { + "description": "IP address or hostname of the SNMP target", "examples": [ "10.11.0.2" ], "type": "string" }, "address_mask": { + "description": "Mask applied to the SNMP target address", "examples": [ "255.255.255.0" ], @@ -8020,23 +8303,25 @@ }, "port": { "default": "161", + "description": "UDP port used by the SNMP target", "type": [ "string", "null" ] }, "tag_list": { - "description": "Refer to notify tag, can be multiple with blank", + "description": "Set of notification tags for this target address; use spaces between multiple tags", "type": "string" }, "target_address_name": { + "description": "Name of the SNMP target address entry", "examples": [ "target_address_name" ], "type": "string" }, "target_parameters": { - "description": "Refer to notify target parameters name", + "description": "Target parameter profile referenced by this target address", "type": "string" } }, @@ -8045,27 +8330,33 @@ "type": "array" }, "target_parameters": { + "description": "SNMPv3 target parameter profiles", "items": { "additionalProperties": false, + "description": "SNMPv3 target parameter profile", "properties": { "message_processing_model": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMP message processing model used by this target parameter profile" }, "name": { + "description": "Target parameter profile name", "type": "string" }, "notify_filter": { - "description": "Refer to profile-name in notify_filter", + "description": "Notification filter profile referenced by this target parameter profile", "type": "string" }, "security_level": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Required security level for this target parameter profile" }, "security_model": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Required security model for this target parameter profile" }, "security_name": { - "description": "Refer to security_name in usm", + "description": "USM security name referenced by this target parameter profile", "examples": [ "m01620" ], @@ -8077,11 +8368,14 @@ "type": "array" }, "usm": { + "description": "SNMPv3 USM engine configurations", "items": { "additionalProperties": false, + "description": "SNMPv3 User-based Security Model configuration", "properties": { "engine_type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMP engine type used for this USM configuration" }, "remote_engine_id": { "description": "Required only if `engine_type`==`remote_engine`", @@ -8091,7 +8385,8 @@ "type": "string" }, "users": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMPv3 USM users for this engine" } }, "type": "object" @@ -8100,8 +8395,10 @@ }, "vacm": { "additionalProperties": false, + "description": "SNMPv3 VACM access control configuration", "properties": { "access": { + "description": "VACM access rules for SNMPv3", "items": { "$comment": "max depth reached" }, @@ -8109,12 +8406,15 @@ }, "security_to_group": { "additionalProperties": false, + "description": "VACM security-name to group mappings", "properties": { "content": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "VACM security-name to group mapping entries" }, "security_model": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Required security model for these VACM group mappings" } }, "type": "object" @@ -8126,20 +8426,24 @@ "type": "object" }, "views": { + "description": "SNMP MIB view definitions", "items": { "additionalProperties": false, + "description": "SNMP MIB view definition", "properties": { "include": { - "description": "If the root oid configured is included", + "description": "Whether the root OID is included in this SNMP view", "type": "boolean" }, "oid": { + "description": "Root OID for this SNMP view", "examples": [ "1.3.6.1" ], "type": "string" }, "view_name": { + "description": "Name of the SNMP MIB view definition", "examples": [ "all" ], @@ -8155,12 +8459,14 @@ }, "switch_matching": { "additionalProperties": false, - "description": "Defines custom switch configuration based on different criteria", + "description": "Matching rules that select switches for this network template", "properties": { "enable": { + "description": "Whether custom switch matching rules are enabled", "type": "boolean" }, "rules": { + "description": "Switch matching rules evaluated to apply custom configuration", "items": { "additionalProperties": { "type": "string" @@ -8174,7 +8480,7 @@ ], "properties": { "additional_config_cmds": { - "description": "additional CLI commands to append to the generated Junos config. **Note**: no check is done", + "description": "Additional Junos CLI commands applied when this matching rule matches", "items": { "description": "JUNOS \\"set\\" command to add to the generated configuration", "examples": [ @@ -8191,14 +8497,15 @@ }, "ip_config": { "additionalProperties": false, - "description": "In-Band Management interface configuration", + "description": "In-band management IP configuration applied when this matching rule matches", "properties": { "network": { "description": "VLAN Name for the management interface", "type": "string" }, "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "IP assignment mode for in-band switch management" } }, "type": "object" @@ -8211,10 +8518,11 @@ }, "oob_ip_config": { "additionalProperties": false, - "description": "Out-of-Band Management interface configuration", + "description": "Out-of-band management IP configuration applied when this matching rule matches", "properties": { "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "IP assignment mode for out-of-band switch management" }, "use_mgmt_vrf": { "default": false, @@ -8233,18 +8541,19 @@ "additionalProperties": { "$comment": "max depth reached" }, - "description": "Property key is the port name or range (e.g. \\"ge-0/0/0-10\\")", + "description": "Per-port wired configuration applied when this matching rule matches", "type": "object" }, "port_mirroring": { "additionalProperties": { "$comment": "max depth reached" }, - "description": "Property key is the port mirroring instance name. `port_mirroring` can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 mirroring ports is allowed", + "description": "Port mirroring configuration applied when this matching rule matches", "type": "object" }, "stp_config": { "additionalProperties": false, + "description": "Spanning Tree Protocol configuration applied when this matching rule matches", "properties": { "bridge_priority": { "default": "32k", @@ -8259,11 +8568,11 @@ }, "switch_mgmt": { "additionalProperties": false, - "description": "Switch Management settings", + "description": "Management-plane settings applied when this matching rule matches", "properties": { "ap_affinity_threshold": { "default": 10, - "description": "AP_affinity_threshold ap_affinity_threshold can be added as a field under site/setting. By default, this value is set to 12. If the field is set in both site/setting and org/setting, the value from site/setting will be used.", + "description": "AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used.", "type": "integer" }, "cli_banner": { @@ -8292,27 +8601,33 @@ "type": "boolean" }, "disable_oob_down_alarm": { + "description": "Whether to suppress alarms when the switch out-of-band management interface is down", "type": "boolean" }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the switch", "type": "boolean" }, "local_accounts": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Local switch user accounts keyed by username" }, "mxedge_proxy_host": { - "description": "IP Address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud", + "description": "IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud", "type": "string" }, "mxedge_proxy_port": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Mist Edge proxy port used for switch management traffic" }, "protect_re": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Control-plane protection settings for the switch" }, "radius": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Management authentication settings using RADIUS" }, "remove_existing_configs": { "default": false, @@ -8320,14 +8635,16 @@ "type": "boolean" }, "root_password": { + "description": "Root password for local switch access", "format": "password", "type": "string" }, "tacacs": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Management authentication settings using TACACS+" }, "use_mxedge_proxy": { - "description": "To use mxedge as proxy", + "description": "Whether to use Mist Edge as a proxy for switch management traffic", "type": "boolean" } }, @@ -8344,11 +8661,11 @@ }, "switch_mgmt": { "additionalProperties": false, - "description": "Switch Management settings", + "description": "Management-plane defaults provided by this network template", "properties": { "ap_affinity_threshold": { "default": 10, - "description": "AP_affinity_threshold ap_affinity_threshold can be added as a field under site/setting. By default, this value is set to 12. If the field is set in both site/setting and org/setting, the value from site/setting will be used.", + "description": "AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used.", "type": "integer" }, "cli_banner": { @@ -8377,17 +8694,21 @@ "type": "boolean" }, "disable_oob_down_alarm": { + "description": "Whether to suppress alarms when the switch out-of-band management interface is down", "type": "boolean" }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the switch", "type": "boolean" }, "local_accounts": { "additionalProperties": { "additionalProperties": false, + "description": "Local switch user account credentials and access role", "properties": { "password": { + "description": "Local password for the switch user account", "examples": [ "Juniper123" ], @@ -8396,7 +8717,7 @@ }, "role": { "default": "none", - "description": "enum: `admin`, `helpdesk`, `none`, `read`", + "description": "Access role granted to the local switch user account", "enum": [ "admin", "helpdesk", @@ -8408,11 +8729,11 @@ }, "type": "object" }, - "description": "Property key is the user name. For Local user authentication", + "description": "Local switch user accounts keyed by username", "type": "object" }, "mxedge_proxy_host": { - "description": "IP Address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud", + "description": "IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud", "type": "string" }, "mxedge_proxy_port": { @@ -8427,14 +8748,14 @@ "type": "string" } ], - "description": "Mist Edge port used to proxy the switch management traffic to the Mist Cloud. Value in range 1-65535" + "description": "Mist Edge proxy port used for switch management traffic" }, "protect_re": { "additionalProperties": false, - "description": "Restrict inbound-traffic to host\\nwhen enabled, all traffic that is not essential to our operation will be dropped \\ne.g. ntp / dns / traffic to mist will be allowed by default, if dhcpd is enabled, we'll make sure it works", + "description": "Control-plane protection settings for the switch", "properties": { "allowed_services": { - "description": "Optionally, services we'll allow", + "description": "Built-in services explicitly allowed by the Protect RE policy", "examples": [ [ "icmp", @@ -8442,7 +8763,7 @@ ] ], "items": { - "description": "enum: `icmp`, `ssh`", + "description": "Services allowed through protect-RE filters. enum: `icmp`, `ssh`", "enum": [ "icmp", "ssh" @@ -8452,9 +8773,10 @@ "type": "array" }, "custom": { + "description": "Additional ACL entries allowed by the Protect RE policy", "items": { "additionalProperties": false, - "description": "Custom acls", + "description": "Custom Protect RE ACL entry", "properties": { "port_range": { "default": "0", @@ -8465,10 +8787,12 @@ "type": "string" }, "protocol": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Transport protocol matched by this custom Protect RE ACL" }, "subnets": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source subnets matched by this custom Protect RE ACL" } }, "type": "object" @@ -8486,7 +8810,7 @@ "type": "boolean" }, "trusted_hosts": { - "description": "host/subnets we'll allow traffic to/from", + "description": "Trusted host or subnet entries allowed by the Protect RE policy", "items": { "examples": [ "10.242.3.0/24" @@ -8500,26 +8824,29 @@ }, "radius": { "additionalProperties": false, - "description": "By default, `radius_config` will be used. if a different one has to be used set `use_different_radius", + "description": "Management authentication settings using RADIUS", "properties": { "enabled": { + "description": "Whether RADIUS is enabled for switch management authentication", "type": "boolean" }, "radius_config": { "additionalProperties": false, - "description": "Junos Radius config", + "description": "RADIUS configuration used when alternate RADIUS settings are required", "properties": { "acct_immediate_update": { + "description": "Whether immediate RADIUS accounting updates are sent", "type": "boolean" }, "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled", "maximum": 65535, "minimum": 0, "type": "integer" }, "acct_servers": { + "description": "RADIUS accounting servers used by this switch configuration", "items": { "$comment": "max depth reached" }, @@ -8528,7 +8855,7 @@ }, "auth_server_selection": { "default": "ordered", - "description": "enum: `ordered`, `unordered`", + "description": "Selection strategy for RADIUS authentication servers", "enum": [ "ordered", "unordered" @@ -8536,6 +8863,7 @@ "type": "string" }, "auth_servers": { + "description": "RADIUS authentication servers used by this switch configuration", "items": { "$comment": "max depth reached" }, @@ -8544,16 +8872,17 @@ }, "auth_servers_retries": { "default": 3, - "description": "Radius auth session retries", + "description": "RADIUS auth session retries", "type": "integer" }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout", + "description": "RADIUS auth session timeout", "type": "integer" }, "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled", "type": "boolean" }, "coa_port": { @@ -8567,10 +8896,11 @@ "type": "string" } ], - "description": "Radius CoA Port, value from 1 to 65535, default is 3799" + "description": "UDP port used for RADIUS Change of Authorization (CoA)" }, "fast_dot1x_timers": { "default": false, + "description": "Whether fast 802.1X timers are enabled for RADIUS authentication", "type": "boolean" }, "network": { @@ -8578,13 +8908,14 @@ "type": "string" }, "source_ip": { - "description": "Use `network`or `source_ip`", + "description": "Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic", "type": "string" } }, "type": "object" }, "use_different_radius": { + "description": "Selector for alternate RADIUS settings instead of the default switch `radius_config`", "type": "string" } }, @@ -8596,28 +8927,36 @@ "type": "boolean" }, "root_password": { + "description": "Root password for local switch access", "format": "password", "type": "string" }, "tacacs": { "additionalProperties": false, + "description": "Management authentication settings using TACACS+", "properties": { "acct_servers": { + "description": "TACACS+ accounting servers used for switch management sessions", "items": { "additionalProperties": false, + "description": "TACACS+ accounting server settings", "properties": { "host": { + "description": "Address or hostname of the TACACS+ accounting server", "type": "string" }, "port": { + "description": "TCP port used by the TACACS+ accounting server", "type": "string" }, "secret": { + "description": "Shared secret used with this TACACS+ accounting server", "format": "password", "type": "string" }, "timeout": { "default": 10, + "description": "TACACS+ accounting server timeout, in seconds", "type": "integer" } }, @@ -8627,7 +8966,7 @@ }, "default_role": { "default": "none", - "description": "enum: `admin`, `helpdesk`, `none`, `read`", + "description": "Default switch-management role to use for TACACS+ logins", "enum": [ "admin", "helpdesk", @@ -8637,28 +8976,35 @@ "type": "string" }, "enabled": { + "description": "Whether TACACS+ is enabled for switch management authentication", "type": "boolean" }, "network": { - "description": "Which network the TACACS server resides", + "description": "Source network used for connectivity to the TACACS+ servers", "type": "string" }, "tacplus_servers": { + "description": "TACACS+ authentication servers used for switch management logins", "items": { "additionalProperties": false, + "description": "TACACS+ authentication server settings", "properties": { "host": { + "description": "Address or hostname of the TACACS+ authentication server", "type": "string" }, "port": { + "description": "TCP port used by the TACACS+ authentication server", "type": "string" }, "secret": { + "description": "Shared secret used with this TACACS+ authentication server", "format": "password", "type": "string" }, "timeout": { "default": 10, + "description": "TACACS+ authentication server timeout, in seconds", "type": "integer" } }, @@ -8670,7 +9016,7 @@ "type": "object" }, "use_mxedge_proxy": { - "description": "To use mxedge as proxy", + "description": "Whether to use Mist Edge as a proxy for switch management traffic", "type": "boolean" } }, @@ -8678,6 +9024,7 @@ }, "vrf_config": { "additionalProperties": false, + "description": "VRF defaults applied by this network template", "properties": { "enabled": { "description": "Whether to enable VRF (when supported on the device)", @@ -8689,6 +9036,7 @@ "vrf_instances": { "additionalProperties": { "additionalProperties": false, + "description": "Switch VRF instance routing and network membership settings", "examples": [ { "extra_routes": { @@ -8705,12 +9053,15 @@ "aggregate_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Aggregate route configuration for a network or routing instance", "properties": { "discard": { "default": false, + "description": "Whether to install the aggregate route as a discard route", "type": "boolean" }, "metric": { + "description": "Routing metric assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -8719,6 +9070,7 @@ ] }, "preference": { + "description": "Route preference assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -8729,7 +9081,7 @@ }, "type": "object" }, - "description": "Property key is the destination subnet (e.g. \\"172.16.3.0/24\\")", + "description": "IPv4 aggregate routes configured for this VRF instance", "examples": [ { "172.16.3.0/24": { @@ -8744,12 +9096,15 @@ "aggregate_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Aggregate route configuration for a network or routing instance", "properties": { "discard": { "default": false, + "description": "Whether to install the aggregate route as a discard route", "type": "boolean" }, "metric": { + "description": "Routing metric assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -8758,6 +9113,7 @@ ] }, "preference": { + "description": "Route preference assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -8768,7 +9124,7 @@ }, "type": "object" }, - "description": "Property key is the destination subnet (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "IPv6 aggregate routes configured for this VRF instance", "example": { "2a02:1234:420a:10c9::/64": { "discard": false, @@ -8779,27 +9135,30 @@ "type": "object" }, "evpn_auto_loopback_subnet": { + "description": "IPv4 subnet used for automatic EVPN loopback addresses in this VRF instance", "examples": [ "100.101.0.0/24" ], "type": "string" }, "evpn_auto_loopback_subnet6": { + "description": "IPv6 subnet used for automatic EVPN loopback addresses in this VRF instance", "type": "string" }, "extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv4 static route for a VRF instance", "properties": { "via": { - "description": "Next-hop address", + "description": "IPv4 next-hop address for this VRF extra route", "format": "ipv4", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"10.0.0.0/8\\")", + "description": "Additional IPv4 static routes configured for this VRF instance", "examples": [ { "0.0.0.0/0": { @@ -8812,16 +9171,17 @@ "extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv6 static route for a VRF instance", "properties": { "via": { - "description": "Next-hop address", + "description": "IPv6 next-hop address for this VRF extra route", "format": "ipv6", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "Additional IPv6 static routes configured for this VRF instance", "examples": [ { "2a02:1234:420a:10c9::/64": { @@ -8832,6 +9192,7 @@ "type": "object" }, "networks": { + "description": "Names of switch networks included in this VRF instance", "items": { "type": "string" }, @@ -8841,7 +9202,7 @@ }, "type": "object" }, - "description": "Property key is the network name", + "description": "VRF instances configured by this network template", "examples": [ { "guest": { @@ -8868,7 +9229,7 @@ "description": "Gateway Template is applied to a site for gateway(s) in a site.", "properties": { "additional_config_cmds": { - "description": "additional CLI commands to append to the generated Junos config. **Note**: no check is done", + "description": "Additional CLI configuration commands provided by this gateway template", "items": { "description": "JUNOS \\"set\\" command to add to the generated configuration", "examples": [ @@ -8881,7 +9242,7 @@ "bgp_config": { "additionalProperties": { "additionalProperties": false, - "description": "BFD is enabled when either bfd_minimum_interval or bfd_multiplier is configured", + "description": "BGP session configuration. BFD is enabled when either bfd_minimum_interval or bfd_multiplier is configured", "properties": { "auth_key": { "description": "Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`", @@ -8913,6 +9274,7 @@ "type": "boolean" }, "export": { + "description": "Routing policy applied to routes exported by this BGP session", "type": "string" }, "export_policy": { @@ -8938,6 +9300,7 @@ "type": "integer" }, "import": { + "description": "Routing policy applied to routes imported by this BGP session", "type": "string" }, "import_policy": { @@ -8955,7 +9318,7 @@ "type": "integer" } ], - "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. BGP AS, value in range 1-4294967295", + "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; local BGP Autonomous System (AS) number", "examples": [ 65000 ] @@ -8971,7 +9334,7 @@ "type": "integer" } ], - "description": "BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}` )", + "description": "Default BGP neighbor Autonomous System (AS) number for this session", "examples": [ 65000 ] @@ -8979,6 +9342,7 @@ "neighbors": { "additionalProperties": { "additionalProperties": false, + "description": "Per-neighbor BGP session settings", "properties": { "disabled": { "default": false, @@ -8986,15 +9350,18 @@ "type": "boolean" }, "export_policy": { + "description": "Export policy applied only to this BGP neighbor", "type": "string" }, "hold_time": { "default": 90, + "description": "BGP hold time for this neighbor, in seconds", "maximum": 65535, "minimum": 0, "type": "integer" }, "import_policy": { + "description": "Import policy applied only to this BGP neighbor", "type": "string" }, "multihop_ttl": { @@ -9014,14 +9381,14 @@ "type": "integer" } ], - "description": "BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}` )", + "description": "Autonomous System (AS) number of this BGP neighbor", "examples": [ 65000 ] }, "tunnel_via": { "default": "primary", - "description": "If `via`==`tunnel`, specifies which tunnel (primary/secondary) this neighbor is associated with. enum: `primary`, `secondary`", + "description": "If `via`==`tunnel`, primary or secondary tunnel associated with this BGP neighbor", "enum": [ "primary", "secondary" @@ -9038,7 +9405,7 @@ "type": "object" }, "networks": { - "description": "Optional if `via`==`lan`. List of networks where we expect BGP neighbor to connect to/from", + "description": "Optional if `via`==`lan`; networks where BGP neighbors can connect to or from", "items": { "type": "string" }, @@ -9055,11 +9422,11 @@ "type": "boolean" }, "tunnel_name": { - "description": "Optional if `via`==`tunnel`", + "description": "Optional if `via`==`tunnel`; tunnel name used for this BGP session", "type": "string" }, "type": { - "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. enum: `external`, `internal`", + "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; BGP session type, internal or external", "enum": [ "external", "internal" @@ -9069,7 +9436,7 @@ }, "via": { "default": "lan", - "description": "enum: `lan`, `tunnel`, `vpn`, `wan`", + "description": "Transport used for this BGP session, such as LAN, tunnel, VPN, or WAN", "enum": [ "lan", "tunnel", @@ -9079,11 +9446,11 @@ "type": "string" }, "vpn_name": { - "description": "Optional if `via`==`vpn`", + "description": "Optional if `via`==`vpn`; VPN name used for this BGP session", "type": "string" }, "wan_name": { - "description": "Optional if `via`==`wan`", + "description": "Optional if `via`==`wan`; WAN interface name used for this BGP session", "type": "string" } }, @@ -9092,10 +9459,11 @@ ], "type": "object" }, + "description": "BGP routing defaults for this gateway template. Property key is the BGP session name", "type": "object" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the gateway template was created", "format": "double", "readOnly": true, "type": "number" @@ -9103,9 +9471,10 @@ "dhcpd_config": { "additionalProperties": { "additionalProperties": false, + "description": "DHCP server or relay configuration for one network", "properties": { "dns_servers": { - "description": "If `type`==`local` or `type6`==`local` - optional, if not defined, system one will be used", + "description": "If `type`==`local` or `type6`==`local`, DNS servers advertised to DHCP clients", "examples": [ [ "8.8.8.8", @@ -9119,7 +9488,7 @@ "type": "array" }, "dns_suffix": { - "description": "If `type`==`local` or `type6`==`local` - optional, if not defined, system one will be used", + "description": "If `type`==`local` or `type6`==`local`, DNS search suffixes advertised to DHCP clients", "examples": [ [ ".mist.local", @@ -9134,26 +9503,30 @@ "fixed_bindings": { "additionalProperties": { "additionalProperties": false, + "description": "Static DHCP binding for a client MAC address", "properties": { "ip": { + "description": "Reserved IPv4 address for this fixed DHCP binding", "examples": [ "192.168.70.35" ], "type": "string" }, "ip6": { + "description": "Reserved IPv6 address for this fixed DHCP binding", "examples": [ "2607:f8b0:4005:808::2" ], "type": "string" }, "name": { + "description": "Friendly name for this fixed DHCP binding", "type": "string" } }, "type": "object" }, - "description": "If `type`==`local` or `type6`==`local`. Property key is the MAC Address. Format is `[0-9a-f]{12}` (e.g. \\"5684dae9ac8b\\")", + "description": "If `type`==`local` or `type6`==`local`, fixed client bindings for local DHCP service", "examples": [ { "5684dae9ac8b": { @@ -9172,28 +9545,28 @@ "type": "string" }, "ip6_end": { - "description": "If `type6`==`local`", + "description": "If `type6`==`local`, ending IPv6 address for the DHCP lease pool", "examples": [ "2607:f8b0:4005:808::ff" ], "type": "string" }, "ip6_start": { - "description": "If `type6`==`local`", + "description": "If `type6`==`local`, starting IPv6 address for the DHCP lease pool", "examples": [ "2607:f8b0:4005:808::2" ], "type": "string" }, "ip_end": { - "description": "If `type`==`local`", + "description": "If `type`==`local`, ending IPv4 address for the DHCP lease pool", "examples": [ "192.168.70.200" ], "type": "string" }, "ip_start": { - "description": "If `type`==`local`", + "description": "If `type`==`local`, starting IPv4 address for the DHCP lease pool", "examples": [ "192.168.70.100" ], @@ -9209,17 +9582,20 @@ "options": { "additionalProperties": { "additionalProperties": false, + "description": "Custom DHCP option value", "properties": { "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Data type used to encode this DHCP option value" }, "value": { + "description": "Option value to send for this DHCP option", "type": "string" } }, "type": "object" }, - "description": "If `type`==`local` or `type6`==`local`. Property key is the DHCP option number", + "description": "If `type`==`local` or `type6`==`local`, custom DHCP options advertised to clients", "type": "object" }, "server_id_override": { @@ -9228,7 +9604,7 @@ "type": "boolean" }, "servers": { - "description": "If `type`==`relay`", + "description": "If `type`==`relay`, upstream IPv4 DHCP servers", "examples": [ [ "11.2.3.4" @@ -9240,7 +9616,7 @@ "type": "array" }, "serversv6": { - "description": "If `type6`==`relay`", + "description": "If `type6`==`relay`, upstream IPv6 DHCP servers", "examples": [ [ "2607:f8b0:4005:808::64" @@ -9253,7 +9629,7 @@ }, "type": { "default": "local", - "description": "enum: `local` (DHCP Server), `none`, `relay` (DHCP Relay)", + "description": "IPv4 DHCP mode for this network", "enum": [ "local", "none", @@ -9263,7 +9639,7 @@ }, "type6": { "default": "none", - "description": "enum: `local` (DHCP Server), `none`, `relay` (DHCP Relay)", + "description": "IPv6 DHCP mode for this network", "enum": [ "local", "none", @@ -9274,22 +9650,26 @@ "vendor_encapsulated": { "additionalProperties": { "additionalProperties": false, + "description": "Vendor-encapsulated DHCP option value", "properties": { "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Data type used to encode this vendor option value" }, "value": { + "description": "Option value to send for this vendor option", "type": "string" } }, "type": "object" }, - "description": "If `type`==`local` or `type6`==`local`. Property key is :, with\\n * enterprise number: 1-65535 (https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers)\\n * sub option code: 1-255, sub-option code", + "description": "If `type`==`local` or `type6`==`local`, vendor-encapsulated DHCP options advertised to clients", "type": "object" } }, "type": "object" }, + "description": "DHCP server defaults provided by this gateway template", "properties": { "enabled": { "default": true, @@ -9301,17 +9681,18 @@ }, "dnsOverride": { "default": false, + "description": "Whether DNS server and suffix settings in this template override inherited values", "type": "boolean" }, "dns_servers": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS servers provided by this gateway template", "items": { "type": "string" }, "type": "array" }, "dns_suffix": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS search suffixes provided by this gateway template", "items": { "type": "string" }, @@ -9320,29 +9701,33 @@ "extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway IPv4 extra route next-hop settings", "properties": { "via": { + "description": "Next-hop IPv4 address for the gateway extra route", "format": "ipv4", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"10.0.0.0/8\\"), the destination Network name or a variable (e.g. \\"{{myvar}}\\")", + "description": "Additional IPv4 route defaults in this gateway template", "type": "object" }, "extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway IPv6 extra route next-hop settings", "properties": { "via": { + "description": "Next-hop IPv6 address for the gateway extra route", "format": "ipv6", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"2a02:1234:420a:10c9::/64\\"), the destination Network name or a variable (e.g. \\"{{myvar}}\\")", + "description": "Additional IPv6 route defaults in this gateway template", "examples": [ { "2a02:1234:420a:10c9::/64": { @@ -9354,20 +9739,23 @@ }, "gateway_matching": { "additionalProperties": false, - "description": "Gateway matching", + "description": "Matching rules that select gateways for this template", "properties": { "enable": { + "description": "Whether gateway matching is enabled", "type": "boolean" }, "rules": { + "description": "Gateway matching rules evaluated for this configuration", "items": { "additionalProperties": { "description": "Property key defines the type of matching. e.g: `match_name[0:3]`, `match_model[0-6]` or `match_role`", "type": "string" }, + "description": "Gateway matching rule that applies settings when its match keys select a gateway", "properties": { "additional_config_cmds": { - "description": "additional CLI commands to append to the generated Junos config. **Note**: no check is done", + "description": "For SRX only, additional Junos CLI commands appended when this gateway matching rule applies", "items": { "description": "JUNOS \\"set\\" command to add to the generated configuration", "examples": [ @@ -9378,12 +9766,13 @@ "type": "array" }, "name": { + "description": "Display name for the gateway matching rule", "type": "string" }, "port_config": { "additionalProperties": { "additionalProperties": false, - "description": "Gateway port config", + "description": "Gateway port configuration for LAN, WAN, tunnel, and HA interfaces", "properties": { "ae_disable_lacp": { "$comment": "max depth reached" @@ -9549,10 +9938,10 @@ }, "gateway_mgmt": { "additionalProperties": false, - "description": "Gateway Management settings", + "description": "Management-plane defaults provided by this gateway template", "properties": { "admin_sshkeys": { - "description": "For SSR only, as direct root access is not allowed", + "description": "SSR-only SSH public keys for administrative access", "examples": [ [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA...Wxa6p6UW0ZbcP john@host" @@ -9565,9 +9954,10 @@ }, "app_probing": { "additionalProperties": false, + "description": "Application probing configuration for gateway monitoring", "properties": { "apps": { - "description": "APp-keys from [List Applications](/#operations/listApplications)", + "description": "Predefined application keys to probe", "examples": [ [ "facebook" @@ -9579,54 +9969,63 @@ "type": "array" }, "custom_apps": { + "description": "User-defined application probe definitions", "items": { "additionalProperties": false, + "description": "User-defined application probe definition", "properties": { "address": { - "description": "Required if `protocol`==`icmp`", + "description": "Required if `protocol`==`icmp`. IP address probed by the ICMP custom app", "examples": [ "192.168.1.1" ], "type": "string" }, "app_type": { + "description": "Category label used for this custom application probe", "type": "string" }, "hostnames": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "If `protocol`==`http`. Hostnames or URLs probed by this custom app" }, "key": { + "description": "Stable key used to identify this custom application probe", "type": "string" }, "name": { + "description": "Display name for this custom application probe", "examples": [ "pos_app" ], "type": "string" }, "network": { + "description": "Gateway network used as the source context for this probe", "examples": [ "lan" ], "type": "string" }, "packetSize": { - "description": "If `protocol`==`icmp`", + "description": "If `protocol`==`icmp`. ICMP packet size used by this custom app probe", "maximum": 65400, "minimum": 0, "type": "integer" }, "protocol": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Probe protocol used by this custom application definition" }, "url": { - "description": "If `protocol`==`http`", + "description": "If `protocol`==`http`. HTTP URL or hostname probed by this custom app", "examples": [ "www.abc.com" ], "type": "string" }, "vrf": { + "description": "Gateway VRF used as the source context for this probe", "examples": [ "lan" ], @@ -9638,6 +10037,7 @@ "type": "array" }, "enabled": { + "description": "Whether gateway application probing is enabled", "type": "boolean" } }, @@ -9649,9 +10049,10 @@ }, "auto_signature_update": { "additionalProperties": false, + "description": "Schedule for automatic security signature updates", "properties": { "day_of_week": { - "description": "enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`", + "description": "Scheduled weekday for automatic signature updates", "enum": [ "any", "fri", @@ -9666,6 +10067,7 @@ }, "enable": { "default": true, + "description": "Whether automatic security signature updates are enabled", "type": "boolean" }, "time_of_day": { @@ -9699,9 +10101,11 @@ }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the gateway", "type": "boolean" }, "probe_hosts": { + "description": "IPv4 probe targets used for gateway connectivity checks", "examples": [ [ "8.8.8.8" @@ -9714,6 +10118,7 @@ "type": "array" }, "probe_hostsv6": { + "description": "IPv6 probe targets used for gateway connectivity checks", "examples": [ [ "2001:4860:4860::8888" @@ -9727,10 +10132,10 @@ }, "protect_re": { "additionalProperties": false, - "description": "Restrict inbound-traffic to host\\nwhen enabled, all traffic that is not essential to our operation will be dropped \\ne.g. ntp / dns / traffic to mist will be allowed by default, if dhcpd is enabled, we'll make sure it works", + "description": "Control-plane protection settings for the gateway", "properties": { "allowed_services": { - "description": "Optionally, services we'll allow", + "description": "Built-in services explicitly allowed by the Protect RE policy", "examples": [ [ "icmp", @@ -9738,7 +10143,7 @@ ] ], "items": { - "description": "enum: `icmp`, `ssh`", + "description": "Services allowed through protect-RE filters. enum: `icmp`, `ssh`", "enum": [ "icmp", "ssh" @@ -9748,9 +10153,10 @@ "type": "array" }, "custom": { + "description": "Additional ACL entries allowed by the Protect RE policy", "items": { "additionalProperties": false, - "description": "Custom acls", + "description": "Custom Protect RE ACL entry", "properties": { "port_range": { "default": "0", @@ -9761,10 +10167,12 @@ "type": "string" }, "protocol": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Transport protocol matched by this custom Protect RE ACL" }, "subnets": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source subnets matched by this custom Protect RE ACL" } }, "type": "object" @@ -9782,7 +10190,7 @@ "type": "boolean" }, "trusted_hosts": { - "description": "host/subnets we'll allow traffic to/from", + "description": "Trusted host or subnet entries allowed by the Protect RE policy", "items": { "examples": [ "10.242.3.0/24" @@ -9795,11 +10203,12 @@ "type": "object" }, "root_password": { - "description": "SRX only", + "description": "SRX only. Root password for local gateway access", "format": "password", "type": "string" }, "security_log_source_address": { + "description": "IPv4 source address used for gateway security log traffic", "examples": [ "192.168.1.1" ], @@ -9807,6 +10216,7 @@ "type": "string" }, "security_log_source_interface": { + "description": "Source interface used for gateway security log traffic", "examples": [ "ge-0/0/1.0" ], @@ -9816,7 +10226,7 @@ "type": "object" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the gateway template", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -9826,9 +10236,10 @@ }, "idp_profiles": { "additionalProperties": { + "description": "Organization IDP profile with a base profile and targeted overwrite rules", "properties": { "base_profile": { - "description": "enum: `critical`, `standard`, `strict`", + "description": "Built-in IDP baseline profile inherited before applying overwrites", "enum": [ "critical", "standard", @@ -9840,13 +10251,13 @@ "type": "string" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the IDP profile was created", "format": "double", "readOnly": true, "type": "number" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the IDP profile", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -9855,18 +10266,20 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the IDP profile was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the IDP profile", "examples": [ "relaxed" ], "type": "string" }, "org_id": { + "description": "Owning organization for the IDP profile", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -9875,16 +10288,21 @@ "type": "string" }, "overwrites": { + "description": "IDP signature override rules applied on top of the base profile", "items": { "additionalProperties": false, + "description": "Override rule that changes the IDP action for matching signatures", "properties": { "action": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Enforcement action applied when this overwrite rule matches" }, "matching": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Criteria that select signatures for this overwrite rule" }, "name": { + "description": "Display name for this IDP profile overwrite rule", "type": "string" } }, @@ -9895,35 +10313,40 @@ }, "type": "object" }, - "description": "Property key is the profile name", + "description": "Intrusion detection and prevention profile defaults in this gateway template", "type": "object" }, "ip_configs": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway network interface IP configuration", "properties": { "ip": { + "description": "Static IPv4 address for the gateway network interface when `type`==`static`", "format": "ipv4", "type": "string" }, "ip6": { + "description": "Static IPv6 address for the gateway network interface when `type6`==`static`", "format": "ipv6", "type": "string" }, "netmask": { + "description": "IPv4 netmask or prefix length for the gateway network interface when `type`==`static`", "examples": [ "/24" ], "type": "string" }, "netmask6": { + "description": "IPv6 netmask or prefix length for the gateway network interface when `type6`==`static`", "examples": [ "2001:db8:abcd:12::1" ], "type": "string" }, "secondary_ips": { - "description": "Optional list of secondary IPs in CIDR format", + "description": "Additional IPv4 addresses in CIDR notation for this gateway network interface", "examples": [ [ "192.168.50.1/24", @@ -9937,7 +10360,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IPv4 address assignment mode for this gateway network interface", "enum": [ "dhcp", "static" @@ -9949,7 +10372,7 @@ }, "type6": { "default": "disabled", - "description": "enum: `autoconf`, `dhcp`, `disabled`, `static`", + "description": "IPv6 address assignment mode for this gateway network interface", "enum": [ "autoconf", "dhcp", @@ -9964,27 +10387,29 @@ }, "type": "object" }, - "description": "Property key is the network name", + "description": "Gateway interface IP configuration defaults by network name", "type": "object" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the gateway template was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the gateway template", "examples": [ "gw_template" ], "type": "string" }, "networks": { + "description": "Layer 3 networks configured by this gateway template", "items": { - "description": "Networks are usually subnets that have cross-site significance. `networks`in Org Settings will got merged into `networks`in Site Setting. For gateways, they can be used to define Service Routes.", + "description": "Organization-level Layer 3 network definition that can be merged into site settings and used for service routes. Networks are used to define the service routes in the Gateway settings or templates", "properties": { "created_time": { - "description": "When the object has been created, in epoch", + "description": "Epoch timestamp when the network was created", "format": "double", "readOnly": true, "type": "number" @@ -9995,6 +10420,7 @@ "type": "boolean" }, "gateway": { + "description": "IPv4 gateway address for this network", "examples": [ "192.168.70.1" ], @@ -10002,6 +10428,7 @@ "type": "string" }, "gateway6": { + "description": "IPv6 gateway address for this network", "examples": [ "fdad:b0bc:f29e::1" ], @@ -10009,7 +10436,7 @@ "type": "string" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the network", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -10019,8 +10446,10 @@ }, "internal_access": { "additionalProperties": false, + "description": "Internal access settings for this network", "properties": { "enabled": { + "description": "Whether internal access is enabled for this network", "type": "boolean" } }, @@ -10028,20 +10457,22 @@ }, "internet_access": { "additionalProperties": false, - "description": "Whether this network has direct internet access", + "description": "Direct internet access and NAT settings for this network", "properties": { "create_simple_service_policy": { "default": false, + "description": "Whether Mist should create simple service policies for restricted internet access", "type": "boolean" }, "destination_nat": { "additionalProperties": { "$comment": "max depth reached" }, - "description": "Property key can be an External IP (i.e. \\"63.16.0.3\\"), an External IP:Port (i.e. \\"63.16.0.3:443\\"), an External Port (i.e. \\":443\\"), an External CIDR (i.e. \\"63.16.0.0/30\\"), an External CIDR:Port (i.e. \\"63.16.0.0/30:443\\") or a Variable (i.e. \\"{{myvar}}\\"). At least one of the `internal_ip` or `port` must be defined", + "description": "Destination NAT rules for direct internet access", "type": "object" }, "enabled": { + "description": "Whether direct internet access is enabled for this network", "type": "boolean" }, "restricted": { @@ -10053,7 +10484,7 @@ "additionalProperties": { "$comment": "max depth reached" }, - "description": "Property key may be an External IP Address (i.e. \\"63.16.0.3\\"), a CIDR (i.e. \\"63.16.0.12/20\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Static NAT rules for direct internet access", "type": "object" } }, @@ -10064,14 +10495,14 @@ "type": "boolean" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Epoch timestamp when the network was last modified", "format": "double", "readOnly": true, "type": "number" }, "multicast": { "additionalProperties": false, - "description": "Whether to enable multicast support (only PIM-sparse mode is supported)", + "description": "Settings for multicast routing on this network", "properties": { "disable_igmp": { "default": false, @@ -10080,22 +10511,25 @@ }, "enabled": { "default": false, + "description": "Whether multicast support is enabled for this network", "type": "boolean" }, "groups": { "additionalProperties": { "$comment": "max depth reached" }, - "description": "Group address to RP (rendezvous point) mapping. Property Key is the CIDR (example \\"225.1.0.3/32\\")", + "description": "Multicast group-to-RP mappings for this network", "type": "object" } }, "type": "object" }, "name": { + "description": "Display name of the organization network", "type": "string" }, "org_id": { + "description": "Organization that owns this network", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -10104,7 +10538,7 @@ "type": "string" }, "routed_for_networks": { - "description": "For a Network (usually LAN), it can be routable to other networks (e.g. OSPF)", + "description": "Other network names this network can route to, for example through BGP, OSPF or static routes", "items": { "examples": [ "pos" @@ -10114,12 +10548,14 @@ "type": "array" }, "subnet": { + "description": "IPv4 subnet CIDR for this network", "examples": [ "192.168.70.0/24" ], "type": "string" }, "subnet6": { + "description": "IPv6 subnet CIDR for this network", "examples": [ "fdad:b0bc:f29e::/32" ], @@ -10128,17 +10564,20 @@ "tenants": { "additionalProperties": { "additionalProperties": false, + "description": "Tenant address entry for a network", "properties": { "addresses": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "IP addresses or subnets assigned to this tenant in the network" } }, "type": "object" }, - "description": "Property key must be the user/tenant name (i.e. \\"printer-1\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Tenant address mappings associated with this network", "type": "object" }, "vlan_id": { + "description": "VLAN ID or variable associated with this network", "oneOf": [ { "type": "string" @@ -10153,6 +10592,7 @@ "vpn_access": { "additionalProperties": { "additionalProperties": false, + "description": "VPN access settings for a network and VPN pair", "properties": { "advertised_subnet": { "description": "If `routed`==`true`, whether to advertise an aggregated subnet toward HUB this is useful when there are multiple networks on SPOKE's side", @@ -10166,7 +10606,8 @@ "type": "boolean" }, "destination_nat": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Destination NAT rules applied for VPN access to this network" }, "nat_pool": { "description": "If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub, a subnet is required to create and advertise the route to Hub", @@ -10190,17 +10631,20 @@ "type": "boolean" }, "other_vrfs": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Other VRFs that can receive leaked routes from this spoke network" }, "routed": { "description": "Whether this network is routable", "type": "boolean" }, "source_nat": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source NAT settings used when non-routed spoke hosts must be reachable from the hub" }, "static_nat": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Static NAT rules applied for VPN access to this network" }, "summarized_subnet": { "description": "toward overlay, how HUB should deal with routes it received from Spokes", @@ -10226,7 +10670,7 @@ }, "type": "object" }, - "description": "Property key is the VPN name. Whether this network can be accessed from vpn", + "description": "VPN access settings keyed by VPN name for this network", "type": "object" } }, @@ -10239,10 +10683,11 @@ }, "ntpOverride": { "default": false, + "description": "Whether NTP servers in this template override inherited values", "type": "boolean" }, "ntp_servers": { - "description": "List of NTP servers specific to this device. By default, those in Site Settings will be used", + "description": "NTP servers provided by this gateway template", "items": { "type": "string" }, @@ -10250,38 +10695,39 @@ }, "oob_ip_config": { "additionalProperties": false, - "description": "Out-of-band (vme/em0/fxp0) IP config", + "description": "Out-of-band management IP defaults in this gateway template", "properties": { "gateway": { - "description": "If `type`==`static`", + "description": "Default gateway for the out-of-band management interface when `type`==`static`", "type": "string" }, "ip": { - "description": "If `type`==`static`", + "description": "Static IPv4 address for the out-of-band management interface when `type`==`static`", "type": "string" }, "netmask": { - "description": "If `type`==`static`", + "description": "IPv4 netmask or prefix length for the out-of-band management interface when `type`==`static`", "type": "string" }, "node1": { "additionalProperties": false, - "description": "For HA Cluster, node1 can have different IP Config", + "description": "Out-of-band management IP configuration override for node1 in an HA cluster", "properties": { "gateway": { - "description": "If `type`==`static`", + "description": "Default gateway for the node1 out-of-band management interface when `type`==`static`", "type": "string" }, "ip": { + "description": "Static IPv4 address for the node1 out-of-band management interface when `type`==`static`", "type": "string" }, "netmask": { - "description": "Used only if `subnet` is not specified in `networks`", + "description": "IPv4 netmask or prefix length for the node1 out-of-band management interface when `type`==`static`; used only if `subnet` is not specified in `networks`", "type": "string" }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IP assignment mode for the node1 out-of-band management interface", "enum": [ "dhcp", "static" @@ -10302,7 +10748,7 @@ "type": "boolean" }, "vlan_id": { - "description": "If WAN interface is on a VLAN. Can be the VLAN ID (i.e. \\"10\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "VLAN ID used for node1 out-of-band management traffic", "oneOf": [ { "type": "string" @@ -10319,7 +10765,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IP assignment mode for the out-of-band management interface", "enum": [ "dhcp", "static" @@ -10340,7 +10786,7 @@ "type": "boolean" }, "vlan_id": { - "description": "If WAN interface is on a VLAN. Can be the VLAN ID (i.e. \\"10\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "VLAN ID used for out-of-band management traffic", "oneOf": [ { "type": "string" @@ -10356,6 +10802,7 @@ "type": "object" }, "org_id": { + "description": "Organization that owns this gateway template", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -10366,12 +10813,16 @@ "path_preferences": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway path preference that selects among one or more local, WAN, VPN, or tunnel paths", "properties": { "paths": { + "description": "Candidate paths evaluated for this gateway path preference", "items": { "additionalProperties": false, + "description": "Candidate path within a gateway path preference", "properties": { "cost": { + "description": "Relative cost assigned to this path for gateway path selection", "type": "integer" }, "disabled": { @@ -10391,21 +10842,21 @@ "type": "string" }, "networks": { - "description": "Required when `type`==`local`", + "description": "List of network names used when `type`==`local`", "items": { "$comment": "max depth reached" }, "type": "array" }, "target_ips": { - "description": "If `type`==`local`, if destination IP is to be replaced", + "description": "List of destination IP addresses to replace when `type`==`local`", "items": { "$comment": "max depth reached" }, "type": "array" }, "type": { - "description": "enum: `local`, `tunnel`, `vpn`, `wan`", + "description": "Gateway path source type, such as local network, WAN interface, VPN path, or tunnel", "enum": [ "local", "tunnel", @@ -10415,7 +10866,7 @@ "type": "string" }, "wan_name": { - "description": "Optional if `type`==`vpn`", + "description": "Optional if `type`==`vpn`; WAN interface name associated with the VPN path", "examples": [ "wan0" ], @@ -10431,7 +10882,7 @@ }, "strategy": { "default": "ordered", - "description": "enum: `ecmp`, `ordered`, `weighted`", + "description": "Selection strategy used to evaluate the candidate paths", "enum": [ "ecmp", "ordered", @@ -10448,7 +10899,7 @@ "port_config": { "additionalProperties": { "additionalProperties": false, - "description": "Gateway port config", + "description": "Gateway port configuration for LAN, WAN, tunnel, and HA interfaces", "properties": { "ae_disable_lacp": { "default": false, @@ -10469,6 +10920,7 @@ }, "aggregated": { "default": false, + "description": "Whether the port participates in an aggregated Ethernet interface", "type": "boolean" }, "critical": { @@ -10482,6 +10934,7 @@ }, "disable_autoneg": { "default": false, + "description": "Whether Ethernet autonegotiation is disabled on the port", "type": "boolean" }, "disabled": { @@ -10491,7 +10944,7 @@ }, "dsl_type": { "default": "vdsl", - "description": "if `wan_type`==`dsl`. enum: `adsl`, `vdsl`", + "description": "If `wan_type`==`dsl`. DSL technology used by the WAN port", "enum": [ "adsl", "vdsl" @@ -10510,7 +10963,7 @@ }, "duplex": { "default": "auto", - "description": "enum: `auto`, `full`, `half`", + "description": "Ethernet duplex mode configured on the port", "enum": [ "auto", "full", @@ -10523,24 +10976,24 @@ }, "ip_config": { "additionalProperties": false, - "description": "Junos IP Config", + "description": "Layer 3 IP configuration for the port", "properties": { "dns": { - "description": "Except for out-of_band interface (vme/em0/fxp0)", + "description": "Resolver server IP addresses used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0", "items": { "type": "string" }, "type": "array" }, "dns_suffix": { - "description": "Except for out-of_band interface (vme/em0/fxp0)", + "description": "DNS search suffixes used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0", "items": { "type": "string" }, "type": "array" }, "gateway": { - "description": "Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP Address (i.e. \\"192.168.1.1\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP address (i.e. \\"192.168.1.1\\") or a Variable (i.e. \\"{{myvar}}\\")", "examples": [ "192.168.1.1" ], @@ -10554,7 +11007,7 @@ "type": "string" }, "ip": { - "description": "Interface IP Address (i.e. \\"192.168.1.8\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Interface IP address (i.e. \\"192.168.1.8\\") or a Variable (i.e. \\"{{myvar}}\\")", "examples": [ "192.168.1.8" ], @@ -10588,12 +11041,13 @@ "type": "string" }, "poser_password": { - "description": "If `type`==`pppoe`", + "description": "Password used for PPPoE when `type`==`pppoe`", + "format": "password", "type": "string" }, "pppoe_auth": { "default": "none", - "description": "if `type`==`pppoe`. enum: `chap`, `none`, `pap`", + "description": "Authentication protocol used for PPPoE when `type`==`pppoe`", "enum": [ "chap", "none", @@ -10602,12 +11056,12 @@ "type": "string" }, "pppoe_username": { - "description": "If `type`==`pppoe`", + "description": "Username used for PPPoE when `type`==`pppoe`", "type": "string" }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `pppoe`, `static`", + "description": "IPv4 assignment mode for this gateway port interface", "enum": [ "dhcp", "pppoe", @@ -10617,7 +11071,7 @@ }, "type6": { "default": "autoconf", - "description": "enum: `autoconf`, `dhcp`, `static`", + "description": "IPv6 assignment mode for this gateway port interface", "enum": [ "autoconf", "dhcp", @@ -10629,12 +11083,12 @@ "type": "object" }, "lte_apn": { - "description": "If `wan_type`==`lte`", + "description": "If `wan_type`==`lte`. APN used by the LTE uplink", "type": "string" }, "lte_auth": { "default": "none", - "description": "if `wan_type`==`lte`. enum: `chap`, `none`, `pap`", + "description": "If `wan_type`==`lte`. Authentication method used by the LTE uplink", "enum": [ "chap", "none", @@ -10643,36 +11097,40 @@ "type": "string" }, "lte_backup": { + "description": "Whether the LTE uplink is used as a backup WAN connection", "type": "boolean" }, "lte_password": { - "description": "If `wan_type`==`lte`", + "description": "If `wan_type`==`lte`. Password used for LTE uplink authentication", + "format": "password", "type": "string" }, "lte_username": { - "description": "If `wan_type`==`lte`", + "description": "If `wan_type`==`lte`. Username used for LTE uplink authentication", "type": "string" }, "mtu": { + "description": "Layer 3 MTU configured on the port", "type": "integer" }, "name": { - "description": "Name that we'll use to derive config", + "description": "Interface name used to derive device configuration", "type": "string" }, "networks": { - "description": "If `usage`==`lan`, name of the [networks]($h/Orgs%20Networks/_overview) to attach to the interface", + "description": "If `usage`==`lan`. Networks attached to the interface", "items": { "type": "string" }, "type": "array" }, "outer_vlan_id": { - "description": "For Q-in-Q", + "description": "For Q-in-Q. Outer VLAN ID used for QinQ encapsulation", "type": "integer" }, "poe_disabled": { "default": false, + "description": "Whether PoE output is disabled on the port", "type": "boolean" }, "poe_keep_state_when_reboot": { @@ -10690,7 +11148,7 @@ "type": "boolean" }, "redundant": { - "description": "If HA mode", + "description": "If HA mode. Whether the port participates in the redundant Ethernet configuration", "type": "boolean" }, "redundant_group": { @@ -10708,14 +11166,14 @@ "type": "string" } ], - "description": "For SRX only and if HA Mode. `-1` means it will be managed by the device. Use `>= 0` values to manage it manually. Ensure no conflicting values are assigned across all ports." + "description": "If HA mode and for SRX only. Redundant Ethernet interface index assigned to the port" }, "reth_node": { - "description": "If HA mode", + "description": "If HA mode. Node associated with the redundant Ethernet interface", "type": "string" }, "reth_nodes": { - "description": "SSR only - supporting vlan-based redundancy (matching the size of `networks`)", + "description": "If HA mode and for SSR only. Per-network node assignment used for VLAN-based redundancy", "examples": [ [ "node0", @@ -10729,6 +11187,7 @@ }, "speed": { "default": "auto", + "description": "Link speed configured on the port", "examples": [ "1g" ], @@ -10741,7 +11200,7 @@ }, "svr_port_range": { "default": "none", - "description": "For SSR only", + "description": "For SSR only. Port range configured on the interface", "examples": [ "60000-60005" ], @@ -10749,9 +11208,10 @@ }, "traffic_shaping": { "additionalProperties": false, + "description": "Traffic shaping settings applied to the port", "properties": { "class_percentages": { - "description": "percentages for different class of traffic: high / medium / low / best-effort. Sum must be equal to 100", + "description": "Traffic class bandwidth percentages for high, medium, low, and best-effort queues", "items": { "type": "integer" }, @@ -10759,17 +11219,18 @@ }, "enabled": { "default": false, + "description": "Whether traffic shaping is enabled", "type": "boolean" }, "max_tx_kbps": { - "description": "Interface Transmit Cap in kbps", + "description": "Maximum transmit bandwidth for the interface, in Kbps", "type": "integer" } }, "type": "object" }, "usage": { - "description": "port usage name. enum: `ha_control`, `ha_data`, `lan`, `wan`", + "description": "Logical usage assigned to the port", "enum": [ "ha_control", "ha_data", @@ -10779,7 +11240,7 @@ "type": "string" }, "vlan_id": { - "description": "If WAN interface is on a VLAN. Can be the VLAN ID (i.e. \\"10\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "VLAN ID or variable used when the WAN interface is carried on a VLAN", "oneOf": [ { "type": "string" @@ -10794,10 +11255,11 @@ "vpn_paths": { "additionalProperties": { "additionalProperties": false, + "description": "VPN path settings for traffic that uses a gateway port", "properties": { "bfd_profile": { "default": "broadband", - "description": "Only if the VPN `type`==`hub_spoke`. enum: `broadband`, `lte`", + "description": "BFD profile used for this VPN path when the VPN `type`==`hub_spoke`", "enum": [ "broadband", "lte" @@ -10815,7 +11277,7 @@ }, "role": { "default": "spoke", - "description": "If the VPN `type`==`hub_spoke`, enum: `hub`, `spoke`. If the VPN `type`==`mesh`, enum: `mesh`", + "description": "Gateway role for this VPN path; valid values depend on the VPN `type`", "enum": [ "hub", "mesh", @@ -10825,6 +11287,7 @@ }, "traffic_shaping": { "additionalProperties": false, + "description": "Traffic shaping settings applied to this VPN path", "properties": { "class_percentages": { "$comment": "max depth reached" @@ -10841,12 +11304,12 @@ }, "type": "object" }, - "description": "Property key is the VPN name", + "description": "Per-VPN path settings for traffic that uses this port", "type": "object" }, "wan_arp_policer": { "default": "default", - "description": "Only when `wan_type`==`broadband`. enum: `default`, `max`, `recommended`", + "description": "Only when `wan_type`==`broadband`. ARP policer profile applied to the WAN port", "enum": [ "default", "max", @@ -10871,8 +11334,10 @@ "wan_extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv4 route for a WAN interface", "properties": { "via": { + "description": "IPv4 next-hop address for this WAN extra route", "format": "ipv4", "type": "string" } @@ -10885,8 +11350,10 @@ "wan_extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv6 route for a WAN interface", "properties": { "via": { + "description": "IPv6 next-hop address for this WAN extra route", "format": "ipv6", "type": "string" } @@ -10897,7 +11364,7 @@ "type": "object" }, "wan_networks": { - "description": "Only if `usage`==`wan`. If some networks are connected to this WAN port, it can be added here so policies can be defined", + "description": "Only if `usage`==`wan`. Networks reachable through this WAN port for policy definition", "items": { "type": "string" }, @@ -10905,9 +11372,10 @@ }, "wan_probe_override": { "additionalProperties": false, - "description": "Only if `usage`==`wan`", + "description": "Optional WAN health probe override settings for this port", "properties": { "ip6s": { + "description": "List of IPv6 probe host addresses used by this WAN override", "items": { "type": "string" }, @@ -10915,6 +11383,7 @@ "uniqueItems": true }, "ips": { + "description": "List of IPv4 probe host addresses used by this WAN override", "items": { "type": "string" }, @@ -10923,7 +11392,7 @@ }, "probe_profile": { "default": "broadband", - "description": "enum: `broadband`, `lte`", + "description": "WAN probe profile used for health checks on this port", "enum": [ "broadband", "lte" @@ -10935,7 +11404,7 @@ }, "wan_source_nat": { "additionalProperties": false, - "description": "Only if `usage`==`wan`, optional. By default, source-NAT is performed on all WAN Ports using the interface-ip", + "description": "Source NAT settings applied to traffic leaving this WAN port", "properties": { "disabled": { "default": false, @@ -10961,7 +11430,7 @@ }, "wan_speedtest_mode": { "default": "auto", - "description": "Controls whether Marvis/scheduler can run speedtest on this port. enum: `auto`, `enabled`, `disabled`", + "description": "Controls whether Marvis or the scheduler can run speed tests on this WAN port", "enum": [ "auto", "enabled", @@ -10974,7 +11443,7 @@ }, "wan_type": { "default": "broadband", - "description": "Only if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`", + "description": "Only if `usage`==`wan`. WAN uplink type configured on the port", "enum": [ "broadband", "dsl", @@ -11001,17 +11470,21 @@ "routing_policies": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway routing policy made of ordered match-action terms", "properties": { "terms": { - "description": "zero or more criteria/filter can be specified to match the term, all criteria have to be met", + "description": "Ordered terms evaluated by this gateway routing policy", "items": { "additionalProperties": false, + "description": "Gateway routing policy term with match criteria and actions", "properties": { "actions": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Policy actions applied when this routing policy term matches" }, "matching": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Route match criteria that must be satisfied before actions are applied" } }, "type": "object" @@ -11022,15 +11495,17 @@ }, "type": "object" }, - "description": "Property key is the routing policy name", + "description": "Routing policy defaults applied by this gateway template", "type": "object" }, "service_policies": { + "description": "Traffic service policy defaults enforced by this gateway template", "items": { "additionalProperties": false, + "description": "Site-level service policy that allows or denies traffic for tenants and services", "properties": { "action": { - "description": "enum: `allow`, `deny`", + "description": "Allow or deny action for traffic matched by this service policy", "enum": [ "allow", "deny" @@ -11039,19 +11514,20 @@ }, "antivirus": { "additionalProperties": false, - "description": "For SRX-only", + "description": "Malware and virus inspection settings applied by this service policy", "properties": { "avprofile_id": { - "description": "org-level AV Profile can be used, this takes precedence over 'profile'", + "description": "Organization-level antivirus profile ID; takes precedence over inline `profile` settings", "format": "uuid", "type": "string" }, "enabled": { "default": false, + "description": "Whether antivirus inspection is enabled for the service policy", "type": "boolean" }, "profile": { - "description": "Default / noftp / httponly / or keys from av_profiles", + "description": "Antivirus profile name to apply, such as `default`, `noftp`, `httponly`, or an AV profile key", "type": "string" } }, @@ -11059,23 +11535,28 @@ }, "appqoe": { "additionalProperties": false, - "description": "SRX only", + "description": "Application QoE settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether application QoE is enabled for the service policy", "type": "boolean" } }, "type": "object" }, "ewf": { + "description": "Enhanced web filtering rules applied by this service policy", "items": { "additionalProperties": false, + "description": "Enhanced web filtering rule applied by a service policy", "properties": { "alert_only": { + "description": "Whether matching enhanced web filtering traffic is logged without being blocked", "type": "boolean" }, "block_message": { + "description": "Message returned when enhanced web filtering blocks a request", "examples": [ "Access to this URL Category has been blocked" ], @@ -11083,10 +11564,12 @@ }, "enabled": { "default": false, + "description": "Whether this enhanced web filtering rule is enabled", "type": "boolean" }, "profile": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Enhanced web filtering profile applied by this rule" } }, "type": "object" @@ -11095,12 +11578,15 @@ }, "idp": { "additionalProperties": false, + "description": "Intrusion detection and prevention settings applied by this service policy", "properties": { "alert_only": { + "description": "Whether to alert without enforcing IDP prevention actions", "type": "boolean" }, "enabled": { "default": false, + "description": "Whether IDP inspection is enabled for the policy", "type": "boolean" }, "idpprofile_id": { @@ -11120,10 +11606,11 @@ "type": "object" }, "local_routing": { - "description": "access within the same VRF", + "description": "Whether the policy permits access within the same VRF", "type": "boolean" }, "name": { + "description": "Display name of the service policy", "type": "string" }, "path_preference": { @@ -11132,15 +11619,16 @@ }, "secintel": { "additionalProperties": false, - "description": "SRX only", + "description": "Threat intelligence settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether SecIntel inspection is enabled for the service policy", "type": "boolean" }, "profile": { "default": "default", - "description": "enum: `default`, `standard`, `strict`", + "description": "Protection level applied by SecIntel inspection", "enum": [ "default", "standard", @@ -11149,18 +11637,19 @@ "type": "string" }, "secintelprofile_id": { - "description": "org-level secintel Profile can be used, this takes precedence over 'profile'", + "description": "Organization-level SecIntel profile ID; takes precedence over inline `profile` settings", "type": "string" } }, "type": "object" }, "servicepolicy_id": { - "description": "Used to link servicepolicy defined at org level and overwrite some attributes", + "description": "Organization-level service policy identifier used to link and override selected attributes", "format": "uuid", "type": "string" }, "services": { + "description": "Application services or service groups matched by this policy", "items": { "type": "string" }, @@ -11169,48 +11658,59 @@ }, "skyatp": { "additionalProperties": false, - "description": "SRX only", + "description": "Threat inspection settings provided by Sky ATP for this service policy", "properties": { "dns_dga_detection": { "additionalProperties": false, + "description": "Detection settings for DNS DGA threats provided by Sky ATP", "properties": { "enabled": { + "description": "Whether Sky ATP DNS DGA detection is enabled", "type": "boolean" }, "profile": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Sky ATP DNS DGA detection profile to apply" } }, "type": "object" }, "dns_tunnel_detection": { "additionalProperties": false, + "description": "Detection settings for DNS tunneling threats provided by Sky ATP", "properties": { "enabled": { + "description": "Whether Sky ATP DNS tunneling detection is enabled", "type": "boolean" }, "profile": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Sky ATP DNS tunneling detection profile to apply" } }, "type": "object" }, "http_inspection": { "additionalProperties": false, + "description": "Web traffic inspection settings provided by Sky ATP", "properties": { "enabled": { + "description": "Whether Sky ATP HTTP inspection is enabled", "type": "boolean" }, "profile": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Sky ATP HTTP inspection profile to apply" } }, "type": "object" }, "iot_device_policy": { "additionalProperties": false, + "description": "Device threat policy settings provided by Sky ATP for IoT clients", "properties": { "enabled": { + "description": "Whether Sky ATP IoT device policy inspection is enabled", "type": "boolean" } }, @@ -11221,11 +11721,11 @@ }, "ssl_proxy": { "additionalProperties": false, - "description": "For SRX-only", + "description": "TLS inspection settings applied by this service policy", "properties": { "ciphers_category": { "default": "strong", - "description": "enum: `medium`, `strong`, `weak`", + "description": "Allowed cipher strength category for SSL proxy inspection", "enum": [ "medium", "strong", @@ -11235,6 +11735,7 @@ }, "enabled": { "default": false, + "description": "Whether SSL proxy inspection is enabled for the service policy", "type": "boolean" } }, @@ -11242,13 +11743,15 @@ }, "syslog": { "additionalProperties": false, - "description": "Required for syslog logging", + "description": "Remote logging settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether syslog logging is enabled for the service policy", "type": "boolean" }, "server_names": { + "description": "Names of syslog servers that receive logs for this service policy", "examples": [ [ "dc_syslog_server" @@ -11263,6 +11766,7 @@ "type": "object" }, "tenants": { + "description": "User or network tenants matched by this service policy", "items": { "type": "string" }, @@ -11277,10 +11781,11 @@ "tunnel_configs": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway tunnel configuration for provider-managed or custom tunnels", "properties": { "auto_provision": { "additionalProperties": false, - "description": "Auto Provisioning configuration for the tunne. This takes precedence over the `primary` and `secondary` nodes.", + "description": "Provider auto-provisioning settings for tunnel endpoints", "properties": { "enabled": { "description": "Enable auto provisioning for the tunnel. If enabled, the `primary` and `secondary` nodes will be ignored.", @@ -11288,9 +11793,10 @@ }, "latlng": { "additionalProperties": false, - "description": "API override for POP selection", + "description": "Geographic coordinate override used for tunnel POP selection", "properties": { "lat": { + "description": "Geographic latitude used for POP selection override", "examples": [ 37.295833 ], @@ -11298,6 +11804,7 @@ "type": "number" }, "lng": { + "description": "Geographic longitude used for POP selection override", "examples": [ -122.032946 ], @@ -11312,8 +11819,10 @@ "type": "object" }, "primary": { + "description": "Main auto-provisioned tunnel endpoint settings", "properties": { "probe_ips": { + "description": "Probe IP addresses used to monitor auto-provisioned tunnel reachability", "items": { "$comment": "max depth reached" }, @@ -11321,7 +11830,7 @@ "uniqueItems": true }, "wan_names": { - "description": "Optional, only needed if `vars_only`==`false`", + "description": "WAN interface names used by the auto-provisioned tunnel endpoint", "items": { "$comment": "max depth reached" }, @@ -11330,7 +11839,7 @@ } }, "provider": { - "description": "enum: `jse-ipsec`, `zscaler-ipsec`", + "description": "Tunnel provider used for automatic endpoint provisioning", "enum": [ "jse-ipsec", "zscaler-ipsec" @@ -11342,8 +11851,10 @@ "type": "string" }, "secondary": { + "description": "Backup auto-provisioned tunnel endpoint settings", "properties": { "probe_ips": { + "description": "Probe IP addresses used to monitor auto-provisioned tunnel reachability", "items": { "$comment": "max depth reached" }, @@ -11351,7 +11862,7 @@ "uniqueItems": true }, "wan_names": { - "description": "Optional, only needed if `vars_only`==`false`", + "description": "WAN interface names used by the auto-provisioned tunnel endpoint", "items": { "$comment": "max depth reached" }, @@ -11373,12 +11884,12 @@ "type": "object" }, "ike_lifetime": { - "description": "Only if `provider`==`custom-ipsec`", + "description": "Only if `provider`==`custom-ipsec`. IKE lifetime configured for the custom IPsec tunnel", "type": "integer" }, "ike_mode": { "default": "main", - "description": "Only if `provider`==`custom-ipsec`. enum: `aggressive`, `main`", + "description": "Only if `provider`==`custom-ipsec`. IKE negotiation mode for the tunnel", "enum": [ "aggressive", "main" @@ -11386,12 +11897,13 @@ "type": "string" }, "ike_proposals": { - "description": "If `provider`==`custom-ipsec`", + "description": "If `provider`==`custom-ipsec`, IKE proposals used for custom IPsec negotiation", "items": { "additionalProperties": false, + "description": "IKE proposal settings for custom IPsec tunnels", "properties": { "auth_algo": { - "description": "enum: `md5`, `sha1`, `sha2`", + "description": "Integrity algorithm used by this IKE proposal", "enum": [ "md5", "sha1", @@ -11401,7 +11913,7 @@ }, "dh_group": { "default": "14", - "description": "enum:\\n * 1\\n * 2 (1024-bit)\\n * 5\\n * 14 (default, 2048-bit)\\n * 15 (3072-bit)\\n * 16 (4096-bit)\\n * 19 (256-bit ECP)\\n * 20 (384-bit ECP)\\n * 21 (521-bit ECP)\\n * 24 (2048-bit ECP)", + "description": "Diffie-Hellman group used by this IKE proposal", "enum": [ "1", "14", @@ -11418,7 +11930,7 @@ }, "enc_algo": { "default": "aes256", - "description": "enum: `3des`, `aes128`, `aes256`, `aes_gcm128`, `aes_gcm256`", + "description": "Cipher algorithm used by this IKE proposal", "enum": [ "3des", "aes128", @@ -11437,16 +11949,17 @@ "type": "array" }, "ipsec_lifetime": { - "description": "If `provider`==`custom-ipsec`", + "description": "If `provider`==`custom-ipsec`, IPsec lifetime configured for the custom tunnel", "type": "integer" }, "ipsec_proposals": { - "description": "Only if `provider`==`custom-ipsec`", + "description": "Only if `provider`==`custom-ipsec`. IPsec proposals used for custom IPsec negotiation", "items": { "additionalProperties": false, + "description": "IPsec proposal settings for custom IPsec tunnels", "properties": { "auth_algo": { - "description": "enum: `md5`, `sha1`, `sha2`", + "description": "Integrity algorithm used by this IPsec proposal", "enum": [ "md5", "sha1", @@ -11456,7 +11969,7 @@ }, "dh_group": { "default": "14", - "description": "Only if `provider`==`custom-ipsec`. enum:\\n * 1\\n * 2 (1024-bit)\\n * 5\\n * 14 (default, 2048-bit)\\n * 15 (3072-bit)\\n * 16 (4096-bit)\\n * 19 (256-bit ECP)\\n * 20 (384-bit ECP)\\n * 21 (521-bit ECP)\\n * 24 (2048-bit ECP)", + "description": "Diffie-Hellman group used by this IPsec proposal", "enum": [ "1", "14", @@ -11473,7 +11986,7 @@ }, "enc_algo": { "default": "aes256", - "description": "enum: `3des`, `aes128`, `aes256`, `aes_gcm128`, `aes_gcm256`", + "description": "Cipher algorithm used by this IPsec proposal", "enum": [ "3des", "aes128", @@ -11496,7 +12009,7 @@ "type": "string" }, "local_subnets": { - "description": "List of Local protected subnet for policy-based IPSec negotiation", + "description": "Local protected subnets advertised by this tunnel", "items": { "type": "string" }, @@ -11504,7 +12017,7 @@ }, "mode": { "default": "active-standby", - "description": "Required if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`. enum: `active-active`, `active-standby`", + "description": "Tunnel failover mode used for primary and secondary endpoints", "enum": [ "active-active", "active-standby" @@ -11512,7 +12025,7 @@ "type": "string" }, "networks": { - "description": "If `provider`==`custom-ipsec` or `provider`==`prisma-ipsec`, networks reachable via this tunnel", + "description": "Destination networks reachable through this tunnel", "items": { "type": "string" }, @@ -11520,23 +12033,25 @@ }, "primary": { "additionalProperties": false, - "description": "Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "Main remote tunnel endpoint settings", "properties": { "hosts": { + "description": "Remote gateway host addresses for this tunnel node", "items": { - "description": "IP Address of the remote host", + "description": "IP address of the remote host", "type": "string" }, "type": "array" }, "internal_ips": { - "description": "Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`", + "description": "Internal IP addresses configured on this tunnel node", "items": { "type": "string" }, "type": "array" }, "probe_ips": { + "description": "Health-check IP addresses used to monitor this tunnel node", "items": { "type": "string" }, @@ -11544,13 +12059,14 @@ "uniqueItems": true }, "remote_ids": { - "description": "Only if `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "IKE identities expected from this tunnel node", "items": { "type": "string" }, "type": "array" }, "wan_names": { + "description": "Interface names that source tunnel traffic for this node", "items": { "type": "string" }, @@ -11565,7 +12081,7 @@ }, "probe": { "additionalProperties": false, - "description": "Only if `provider`==`custom-ipsec`", + "description": "Tunnel health probe settings", "properties": { "interval": { "description": "How often to trigger the probe", @@ -11581,7 +12097,7 @@ }, "type": { "default": "icmp", - "description": "enum: `http`, `icmp`", + "description": "Protocol used by the custom IPsec tunnel health probe", "enum": [ "http", "icmp" @@ -11592,7 +12108,7 @@ "type": "object" }, "protocol": { - "description": "Only if `provider`==`custom-ipsec`. enum: `gre`, `ipsec`", + "description": "Only if `provider`==`custom-ipsec`. Tunnel protocol for custom tunnel negotiation", "enum": [ "gre", "ipsec" @@ -11600,7 +12116,7 @@ "type": "string" }, "provider": { - "description": "Only if `auto_provision.enabled`==`false`. enum: `custom-ipsec`, `custom-gre`, `jse-ipsec`, `prisma-ipsec`, `zscaler-gre`, `zscaler-ipsec`", + "description": "Tunnel provider used when auto provisioning is disabled", "enum": [ "custom-ipsec", "custom-gre", @@ -11616,7 +12132,7 @@ "type": "string" }, "remote_subnets": { - "description": "List of Remote protected subnet for policy-based IPSec negotiation", + "description": "Remote protected subnets reached through policy-based IPsec", "items": { "type": "string" }, @@ -11624,23 +12140,25 @@ }, "secondary": { "additionalProperties": false, - "description": "Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "Backup remote tunnel endpoint settings", "properties": { "hosts": { + "description": "Remote gateway host addresses for this tunnel node", "items": { - "description": "IP Address of the remote host", + "description": "IP address of the remote host", "type": "string" }, "type": "array" }, "internal_ips": { - "description": "Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`", + "description": "Internal IP addresses configured on this tunnel node", "items": { "type": "string" }, "type": "array" }, "probe_ips": { + "description": "Health-check IP addresses used to monitor this tunnel node", "items": { "type": "string" }, @@ -11648,13 +12166,14 @@ "uniqueItems": true }, "remote_ids": { - "description": "Only if `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "IKE identities expected from this tunnel node", "items": { "type": "string" }, "type": "array" }, "wan_names": { + "description": "Interface names that source tunnel traffic for this node", "items": { "type": "string" }, @@ -11669,7 +12188,7 @@ }, "version": { "default": "2", - "description": "Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. enum: `1`, `2`", + "description": "Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. Tunnel version value for custom tunnel configuration", "enum": [ "1", "2" @@ -11684,12 +12203,14 @@ }, "tunnel_provider_options": { "additionalProperties": false, + "description": "Provider-specific tunnel options defined by this gateway template", "properties": { "jse": { "additionalProperties": false, - "description": "For jse-ipsec, this allows provisioning of adequate resource on JSE. Make sure adequate licenses are added", + "description": "Juniper Secure Edge provisioning options for tunnel endpoints", "properties": { "num_users": { + "description": "User capacity to provision on Juniper Secure Edge", "examples": [ 5 ], @@ -11707,6 +12228,7 @@ }, "prisma": { "additionalProperties": false, + "description": "Palo Alto Prisma Access provisioning options for tunnel endpoints", "properties": { "service_account_name": { "description": "For prisma-ipsec, service account name to used for tunnel auto provisioning", @@ -11720,10 +12242,11 @@ }, "zscaler": { "additionalProperties": false, - "description": "For zscaler-ipsec and zscaler-gre", + "description": "Provider settings for Zscaler tunnel endpoints", "properties": { "aup_block_internet_until_accepted": { "default": false, + "description": "Whether Zscaler blocks internet access until the Acceptable Use Policy is accepted", "type": "boolean" }, "aup_enabled": { @@ -11777,12 +12300,14 @@ "type": "boolean" }, "sub_locations": { - "description": "`sub-locations` can be used for specific uses cases to define different configuration based on the user network", + "description": "Per-network Zscaler sub-location settings", "items": { "additionalProperties": false, + "description": "Zscaler sub-location settings for a specific network", "properties": { "aup_block_internet_until_accepted": { "default": false, + "description": "Whether this sub-location blocks internet access until the Acceptable Use Policy is accepted", "type": "boolean" }, "aup_enabled": { @@ -11913,7 +12438,7 @@ }, "type": { "default": "standalone", - "description": "enum: `spoke`, `standalone`", + "description": "Gateway template deployment type", "enum": [ "spoke", "standalone" @@ -11933,6 +12458,7 @@ }, "vrf_config": { "additionalProperties": false, + "description": "VRF defaults applied by this gateway template", "properties": { "enabled": { "description": "Whether to enable VRF (when supported on the device)", @@ -11944,6 +12470,7 @@ "vrf_instances": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway VRF instance and its member networks", "examples": [ { "networks": [ @@ -11954,6 +12481,7 @@ ], "properties": { "networks": { + "description": "Network names included in this gateway VRF instance", "items": { "type": "string" }, @@ -11963,7 +12491,7 @@ }, "type": "object" }, - "description": "Property key is the network name", + "description": "VRF instances configured by this gateway template", "examples": [ { "CORP_VRF": { @@ -11986,20 +12514,20 @@ }, "org_alarmtemplate": { "schema": { - "description": "Alarm Template", + "description": "Alarm template defining default delivery and per-alarm rules", "properties": { "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the alarm template was created", "format": "double", "readOnly": true, "type": "number" }, "delivery": { "additionalProperties": false, - "description": "Delivery object to configure the alarm delivery", + "description": "Default alarm delivery settings for rules in this template", "properties": { "additional_emails": { - "description": "List of additional email string to deliver the alarms via emails", + "description": "Additional email recipients for alarm delivery", "items": { "examples": [ "john@mycorp.com" @@ -12036,7 +12564,7 @@ "type": "object" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the alarm template", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -12045,7 +12573,7 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the alarm template was last modified", "format": "double", "readOnly": true, "type": "number" @@ -12058,6 +12586,7 @@ "type": "string" }, "org_id": { + "description": "Organization that owns this alarm template", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -12068,13 +12597,14 @@ "rules": { "additionalProperties": { "additionalProperties": false, + "description": "Per-alarm enablement and delivery override in an alarm template", "properties": { "delivery": { "additionalProperties": false, - "description": "Delivery object to configure the alarm delivery", + "description": "Overrides for the alarm template delivery defaults for this alarm rule", "properties": { "additional_emails": { - "description": "List of additional email string to deliver the alarms via emails", + "description": "Additional email recipients for alarm delivery", "items": { "examples": [ "john@mycorp.com" @@ -12111,6 +12641,7 @@ "type": "object" }, "enabled": { + "description": "Whether this alarm rule is enabled in the template", "type": "boolean" } }, @@ -12157,11 +12688,11 @@ "site_device_ap": { "schema": { "additionalProperties": false, - "description": "AP", + "description": "Access point configuration and placement data", "properties": { "aeroscout": { "additionalProperties": false, - "description": "Aeroscout AP settings", + "description": "Location integration settings for AeroScout on this access point", "properties": { "enabled": { "default": false, @@ -12186,6 +12717,7 @@ }, "port": { "default": 1144, + "description": "Optional if enabled, Aeroscout server port. Defaults to 1144", "type": [ "integer", "null" @@ -12196,6 +12728,7 @@ }, "airista": { "additionalProperties": false, + "description": "Location integration settings for Airista on this access point", "properties": { "enabled": { "default": false, @@ -12215,6 +12748,7 @@ }, "port": { "default": 1144, + "description": "Optional if enabled, Airista server port. Defaults to 1144", "type": [ "integer", "null" @@ -12225,7 +12759,7 @@ }, "ble_config": { "additionalProperties": false, - "description": "BLE AP settings", + "description": "Bluetooth Low Energy beacon and asset settings for this access point", "properties": { "beacon_enabled": { "default": true, @@ -12241,7 +12775,7 @@ }, "beacon_rate_mode": { "default": "default", - "description": "enum: `custom`, `default`", + "description": "Beacon rate mode for Mist BLE beacons; use custom to set beacon_rate", "enum": [ "custom", "default" @@ -12252,7 +12786,7 @@ "type": "string" }, "beam_disabled": { - "description": "List of AP BLE location beam numbers (1-8) which should be disabled at the AP and not transmit location information (where beam 1 is oriented at the top the AP, growing counter-clock-wise, with 9 being the omni BLE beam)", + "description": "AP BLE beam numbers disabled for location advertisements", "examples": [ [ 1, @@ -12299,6 +12833,7 @@ }, "eddystone_uid_beams": { "default": "", + "description": "BLE beams used to transmit Eddystone-UID advertisements, expressed as ranges such as `2-4,7`", "examples": [ "2-4,7" ], @@ -12327,7 +12862,7 @@ }, "eddystone_uid_namespace": { "default": "", - "description": "Eddystone-UID namespace", + "description": "Eddystone-UID namespace broadcast by the AP, as a 10-byte hex string", "examples": [ "2818e3868dec25629ede" ], @@ -12345,6 +12880,7 @@ }, "eddystone_url_beams": { "default": "", + "description": "BLE beams used to transmit Eddystone-URL advertisements, expressed as ranges such as `2-4,7`", "examples": [ "2-4,7" ], @@ -12357,7 +12893,7 @@ }, "eddystone_url_freq_msec": { "default": 0, - "description": "Frequency (msec) of data emit by Eddystone-UID beacon", + "description": "Frequency (msec) of data emitted by Eddystone-URL beacon", "examples": [ 1000 ], @@ -12383,6 +12919,7 @@ }, "ibeacon_beams": { "default": "", + "description": "BLE beams used to transmit iBeacon advertisements, expressed as ranges such as `2-4,7`", "examples": [ "2-4,7" ], @@ -12399,7 +12936,7 @@ "type": "integer" }, "ibeacon_major": { - "description": "Major number for iBeacon", + "description": "iBeacon major value broadcast by the AP", "examples": [ 1234 ], @@ -12411,7 +12948,7 @@ ] }, "ibeacon_minor": { - "description": "Minor number for iBeacon", + "description": "iBeacon minor value broadcast by the AP", "examples": [ 1234 ], @@ -12443,7 +12980,7 @@ }, "power_mode": { "default": "default", - "description": "enum: `custom`, `default`", + "description": "Transmit power mode for BLE beacons; use custom to set `power`", "enum": [ "custom", "default" @@ -12458,9 +12995,11 @@ }, "centrak": { "additionalProperties": false, + "description": "Location integration settings for Centrak on this access point", "properties": { "enabled": { "default": false, + "description": "Whether to enable Centrak config", "type": "boolean" } }, @@ -12468,11 +13007,14 @@ }, "client_bridge": { "additionalProperties": false, + "description": "Wireless client bridge settings for this access point", "properties": { "auth": { "additionalProperties": false, + "description": "Credentials and security mode used when the AP connects as a wireless client bridge", "properties": { "psk": { + "description": "Pre-shared key used when `type`==`psk` for client bridge authentication", "examples": [ "foryoureyesonly" ], @@ -12482,7 +13024,7 @@ }, "type": { "default": "psk", - "description": "wpa2-AES/CCMPp is assumed when `type`==`psk`. enum: `open`, `psk`", + "description": "Authentication mode for the client bridge connection", "enum": [ "open", "psk" @@ -12502,6 +13044,7 @@ "type": "boolean" }, "ssid": { + "description": "Uplink SSID used by the AP when client bridge mode is enabled", "examples": [ "Uplink-SSID" ], @@ -12512,12 +13055,13 @@ "type": "object" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the access point object was created", "format": "double", "readOnly": true, "type": "number" }, "deviceprofile_id": { + "description": "Device profile assigned to this access point", "examples": [ "6f4bf402-45f9-2a56-6c8b-7f83d3bc98e9" ], @@ -12549,6 +13093,7 @@ }, "esl_config": { "additionalProperties": false, + "description": "Electronic shelf label integration settings for this access point", "properties": { "cacert": { "description": "Only if `type`==`imagotag` or `type`==`native`", @@ -12584,7 +13129,7 @@ "type": "integer" }, "type": { - "description": "note: ble_config will be ignored if esl_config is enabled and with native mode. enum: `hanshow`, `imagotag`, `native`, `solum`", + "description": "ESL integration type to enable on the AP", "enum": [ "hanshow", "imagotag", @@ -12617,11 +13162,12 @@ "type": "boolean" }, "for_site": { + "description": "Whether the access point configuration is scoped directly to a site", "readOnly": true, "type": "boolean" }, "height": { - "description": "Height, in meters, optional", + "description": "Installation height of the AP, in meters", "examples": [ 2.75 ], @@ -12629,7 +13175,7 @@ "type": "number" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the access point object", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -12638,18 +13184,21 @@ "type": "string" }, "image1_url": { + "description": "First custom image URL associated with the access point", "type": [ "string", "null" ] }, "image2_url": { + "description": "Second custom image URL associated with the access point", "type": [ "string", "null" ] }, "image3_url": { + "description": "Third custom image URL associated with the access point", "type": [ "string", "null" @@ -12657,11 +13206,11 @@ }, "iot_config": { "additionalProperties": false, - "description": "IoT AP settings", + "description": "Digital and analog IoT pin settings for this access point", "properties": { "A1": { "additionalProperties": false, - "description": "IoT output AP settings", + "description": "Analog-capable IoT pin A1 output settings", "properties": { "enabled": { "default": false, @@ -12684,7 +13233,7 @@ }, "pullup": { "default": "none", - "description": "the type of pull-up the pin uses. enum: `external`, `internal`, `none`", + "description": "Selects the pull-up resistor mode applied to the output pin", "enum": [ "external", "internal", @@ -12704,7 +13253,7 @@ }, "A2": { "additionalProperties": false, - "description": "IoT output AP settings", + "description": "Analog-capable IoT pin A2 output settings", "properties": { "enabled": { "default": false, @@ -12727,7 +13276,7 @@ }, "pullup": { "default": "none", - "description": "the type of pull-up the pin uses. enum: `external`, `internal`, `none`", + "description": "Selects the pull-up resistor mode applied to the output pin", "enum": [ "external", "internal", @@ -12747,7 +13296,7 @@ }, "A3": { "additionalProperties": false, - "description": "IoT output AP settings", + "description": "Analog-capable IoT pin A3 output settings", "properties": { "enabled": { "default": false, @@ -12770,7 +13319,7 @@ }, "pullup": { "default": "none", - "description": "the type of pull-up the pin uses. enum: `external`, `internal`, `none`", + "description": "Selects the pull-up resistor mode applied to the output pin", "enum": [ "external", "internal", @@ -12790,7 +13339,7 @@ }, "A4": { "additionalProperties": false, - "description": "IoT output AP settings", + "description": "Analog-capable IoT pin A4 output settings", "properties": { "enabled": { "default": false, @@ -12813,7 +13362,7 @@ }, "pullup": { "default": "none", - "description": "the type of pull-up the pin uses. enum: `external`, `internal`, `none`", + "description": "Selects the pull-up resistor mode applied to the output pin", "enum": [ "external", "internal", @@ -12833,7 +13382,7 @@ }, "DI1": { "additionalProperties": false, - "description": "IoT Input AP settings", + "description": "Digital input pin DI1 settings", "properties": { "enabled": { "default": false, @@ -12849,7 +13398,7 @@ }, "pullup": { "default": "none", - "description": "the type of pull-up the pin uses. enum: `external`, `internal`, `none`", + "description": "Selects the pull-up resistor mode applied to the input pin", "enum": [ "external", "internal", @@ -12862,7 +13411,7 @@ }, "DI2": { "additionalProperties": false, - "description": "IoT Input AP settings", + "description": "Digital input pin DI2 settings", "properties": { "enabled": { "default": false, @@ -12878,7 +13427,7 @@ }, "pullup": { "default": "none", - "description": "the type of pull-up the pin uses. enum: `external`, `internal`, `none`", + "description": "Selects the pull-up resistor mode applied to the input pin", "enum": [ "external", "internal", @@ -12891,7 +13440,7 @@ }, "DO": { "additionalProperties": false, - "description": "IoT output AP settings", + "description": "Digital output pin DO settings", "properties": { "enabled": { "default": false, @@ -12914,7 +13463,7 @@ }, "pullup": { "default": "none", - "description": "the type of pull-up the pin uses. enum: `external`, `internal`, `none`", + "description": "Selects the pull-up resistor mode applied to the output pin", "enum": [ "external", "internal", @@ -12937,10 +13486,10 @@ }, "ip_config": { "additionalProperties": false, - "description": "IP AP settings", + "description": "Management IP addressing settings for this access point", "properties": { "dns": { - "description": "If `type`==`static`", + "description": "If `type`==`static`. DNS server IP addresses for AP management traffic", "examples": [ [ "8.8.8.8", @@ -12953,7 +13502,7 @@ "type": "array" }, "dns_suffix": { - "description": "Required if `type`==`static`", + "description": "If `type`==`static`. DNS search suffixes applied to AP management lookups", "examples": [ [ ".mist.local", @@ -12966,7 +13515,7 @@ "type": "array" }, "gateway": { - "description": "Required if `type`==`static`", + "description": "Required if `type`==`static`. IPv4 default gateway for AP management traffic", "examples": [ "10.2.1.254" ], @@ -12974,6 +13523,7 @@ "type": "string" }, "gateway6": { + "description": "Required if `type6`==`static`. IPv6 default gateway for AP management traffic when static IPv6 addressing is used", "examples": [ "2607:f8b0:4005:808::1" ], @@ -12981,7 +13531,7 @@ "type": "string" }, "ip": { - "description": "Required if `type`==`static`", + "description": "Required if `type`==`static`. Static IPv4 address for the AP management interface", "examples": [ "10.2.1.1" ], @@ -12989,6 +13539,7 @@ "type": "string" }, "ip6": { + "description": "Required if `type6`==`static`. Static IPv6 address for the AP management interface", "examples": [ "2607:f8b0:4005:808::2004" ], @@ -12996,19 +13547,21 @@ "type": "string" }, "mtu": { + "description": "Maximum transmission unit for AP management traffic", "examples": [ 0 ], "type": "integer" }, "netmask": { - "description": "Required if `type`==`static`", + "description": "Required if `type`==`static`. IPv4 netmask for the AP management interface", "examples": [ "255.255.255.0" ], "type": "string" }, "netmask6": { + "description": "Required if `type6`==`static`. IPv6 prefix length for the AP management interface", "examples": [ "/32" ], @@ -13016,7 +13569,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IPv4 address assignment mode for AP management traffic", "enum": [ "dhcp", "static" @@ -13028,7 +13581,7 @@ }, "type6": { "default": "disabled", - "description": "enum: `autoconf`, `dhcp`, `disabled`, `static`", + "description": "IPv6 address assignment mode for AP management traffic", "enum": [ "autoconf", "dhcp", @@ -13042,7 +13595,7 @@ }, "vlan_id": { "default": 1, - "description": "Management VLAN id, default is 1 (untagged)", + "description": "Management VLAN ID, default is 1 (untagged)", "examples": [ 1 ], @@ -13053,9 +13606,11 @@ }, "lacp_config": { "additionalProperties": false, + "description": "Link aggregation settings for supported AP Ethernet uplinks", "properties": { "enabled": { "default": false, + "description": "Whether to enable LACP on supported AP Ethernet uplinks", "type": "boolean" } }, @@ -13063,10 +13618,11 @@ }, "led": { "additionalProperties": false, - "description": "LED AP settings", + "description": "Indicator light behavior settings for this access point", "properties": { "brightness": { "default": 255, + "description": "Indicator LED brightness level from 0 to 255", "examples": [ 255 ], @@ -13076,6 +13632,7 @@ }, "enabled": { "default": true, + "description": "Whether the AP indicator LED is enabled", "type": "boolean" } }, @@ -13086,7 +13643,7 @@ "type": "boolean" }, "mac": { - "description": "Device MAC address", + "description": "Access point MAC address used to identify the device", "readOnly": true, "type": "string" }, @@ -13100,10 +13657,10 @@ }, "mesh": { "additionalProperties": false, - "description": "Mesh AP settings", + "description": "Wireless mesh role and band settings for this access point", "properties": { "bands": { - "description": "List of bands that the mesh should apply to. For relay, the first viable one will be picked. For relay, the first viable one will be picked. enum: `24`, `5`, `6`", + "description": "Radio bands allowed for AP mesh links", "items": { "description": "enum: `24`, `5`, `5-dedicated`, `5-selectable`, `6`, `6-dedicated`, `6-selectable`", "enum": [ @@ -13137,7 +13694,7 @@ ] }, "role": { - "description": "enum: `base`, `remote`", + "description": "Mesh role for this AP, either base or remote", "enum": [ "base", "remote" @@ -13156,17 +13713,18 @@ "type": "object" }, "model": { - "description": "Device Model", + "description": "Hardware model reported for the access point", "readOnly": true, "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the access point object was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Configured hostname assigned to the access point", "examples": [ "conference room" ], @@ -13180,6 +13738,7 @@ "type": "string" }, "ntp_servers": { + "description": "NTP servers used by this access point", "items": { "type": "string" }, @@ -13187,6 +13746,7 @@ "uniqueItems": true }, "org_id": { + "description": "Organization that owns this access point", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -13195,7 +13755,7 @@ "type": "string" }, "orientation": { - "description": "Orientation, 0-359, in degrees, up is 0, right is 90.", + "description": "AP orientation in degrees from 0 to 359, where 0 is up and 90 is right", "examples": [ 45 ], @@ -13211,16 +13771,19 @@ "port_config": { "additionalProperties": { "additionalProperties": false, + "description": "Ethernet port behavior settings for an access point", "properties": { "disabled": { "default": false, + "description": "Whether this AP Ethernet port is disabled", "type": "boolean" }, "dynamic_vlan": { "additionalProperties": false, - "description": "Optional dynamic vlan", + "description": "RADIUS-assigned VLAN settings for AP port authentication", "properties": { "default_vlan_id": { + "description": "Fallback VLAN ID used when RADIUS does not return a dynamic VLAN match", "examples": [ 999 ], @@ -13229,9 +13792,15 @@ "type": "integer" }, "enabled": { + "description": "Whether dynamic VLAN assignment is enabled for this AP port", "type": "boolean" }, "type": { + "description": "Mapping mode for interpreting dynamic VLAN attributes returned by RADIUS", + "enum": [ + "airespace-interface-name", + "standard" + ], "type": "string" }, "vlans": { @@ -13241,10 +13810,11 @@ "null" ] }, + "description": "Mapping entries for RADIUS-assigned VLAN values on this AP port. For `type`==`airespace-interface-name`, the property key is the Airespace interface name returned by RADIUS (e.g. \\"guest\\"), and the value is the corresponding VLAN ID (e.g. 100). For `type`==`standard`, the property key is the VLAN ID number returned by RADIUS, and the value is ignored.", "examples": [ { "1-10": null, - "user": null + "user": 10 } ], "type": "object" @@ -13254,11 +13824,12 @@ }, "enable_mac_auth": { "default": false, + "description": "Whether MAC authentication is enabled on this AP port", "type": "boolean" }, "forwarding": { "default": "all", - "description": "enum: \\n * `all`: local breakout, All VLANs\\n * `limited`: local breakout, only the VLANs configured in `port_vlan_id` and `vlan_ids`\\n * `mxtunnel`: central breakout to an Org Mist Edge (requires `mxtunnel_id`)\\n * `site_mxedge`: central breakout to a Site Mist Edge (requires `mxtunnel_name`)\\n * `wxtunnel`': central breakout to an Org WxTunnel (requires `wxtunnel_id`)", + "description": "Traffic forwarding mode for this AP Ethernet port", "enum": [ "all", "limited", @@ -13278,7 +13849,7 @@ }, "mac_auth_protocol": { "default": "pap", - "description": "if `enable_mac_auth`==`true`, allows user to select an authentication protocol. enum: `eap-md5`, `eap-peap`, `pap`", + "description": "Protocol used for MAC authentication when `enable_mac_auth` is `true`", "enum": [ "eap-md5", "eap-peap", @@ -13288,10 +13859,11 @@ }, "mist_nac": { "additionalProperties": false, + "description": "Juniper Mist NAC settings used by AP port authentication", "properties": { "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled.", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled.", "examples": [ 60 ], @@ -13301,7 +13873,7 @@ }, "auth_servers_retries": { "default": 2, - "description": "Radius auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"retries\\" are set to value of `auth_servers_timeout`. \\"max-requests\\" is also set when setting `auth_servers_retries` is set to default value to 3.", + "description": "RADIUS auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"retries\\" are set to value of `auth_servers_timeout`. \\"max-requests\\" is also set when setting `auth_servers_retries` is set to default value to 3.", "examples": [ 3 ], @@ -13311,7 +13883,7 @@ }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"quite-period\\" and \\"transmit-period\\" are set to half the value of `auth_servers_timeout`. \\"supplicant-timeout\\" is also set when setting `auth_servers_timeout` is set to default value of 10.", + "description": "RADIUS auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"quite-period\\" and \\"transmit-period\\" are set to half the value of `auth_servers_timeout`. \\"supplicant-timeout\\" is also set when setting `auth_servers_timeout` is set to default value of 10.", "examples": [ 5 ], @@ -13382,7 +13954,7 @@ }, "port_auth": { "default": "none", - "description": "When doing port auth. enum: `dot1x`, `none`", + "description": "Authentication mode for this AP Ethernet port", "enum": [ "dot1x", "none" @@ -13393,7 +13965,7 @@ "type": "string" }, "port_vlan_id": { - "description": "If `forwarding`==`limited`", + "description": "If `forwarding`==`limited`. VLAN ID allowed on this AP Ethernet port", "examples": [ 1 ], @@ -13403,18 +13975,20 @@ }, "radius_config": { "additionalProperties": false, - "description": "Junos Radius config", + "description": "RADIUS authentication and accounting settings for this AP port", "properties": { "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled", "maximum": 65535, "minimum": 0, "type": "integer" }, "acct_servers": { + "description": "RADIUS accounting servers used by this Junos configuration", "items": { "additionalProperties": false, + "description": "RADIUS accounting server settings", "properties": { "host": { "$comment": "max depth reached" @@ -13448,9 +14022,10 @@ "uniqueItems": true }, "auth_servers": { + "description": "RADIUS authentication servers used by this Junos configuration", "items": { "additionalProperties": false, - "description": "Authentication Server", + "description": "RADIUS authentication server settings", "properties": { "host": { "$comment": "max depth reached" @@ -13488,30 +14063,32 @@ }, "auth_servers_retries": { "default": 3, - "description": "radius auth session retries", + "description": "Number of RADIUS authentication request retries before failover", "type": "integer" }, "auth_servers_timeout": { "default": 5, - "description": "radius auth session timeout", + "description": "RADIUS authentication server timeout, in seconds", "type": "integer" }, "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled", "type": "boolean" }, "coa_port": { "default": 3799, + "description": "UDP port used for RADIUS Change of Authorization (CoA)", "maximum": 65535, "minimum": 1, "type": "integer" }, "network": { - "description": "use `network`or `source_ip`, which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip", + "description": "Use `network` or `source_ip`. Network where the RADIUS server resides; if the network has a static IP, Mist uses it as the source IP", "type": "string" }, "source_ip": { - "description": "use `network`or `source_ip`", + "description": "Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic", "type": "string" } }, @@ -13519,13 +14096,15 @@ }, "radsec": { "additionalProperties": false, - "description": "RadSec settings", + "description": "TLS-secured RADIUS settings for this AP port", "properties": { "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled for RadSec traffic", "type": "boolean" }, "enabled": { + "description": "Whether RadSec is enabled", "type": "boolean" }, "idle_timeout": { @@ -13538,10 +14117,10 @@ "type": "string" } ], - "description": "Radsec Idle Timeout in seconds. Default is 60" + "description": "Idle timeout, in seconds, for RadSec connections" }, "mxcluster_ids": { - "description": "To use Org mxedges when this WLAN does not use mxtunnel, specify their mxcluster_ids. Org mxedge(s) identified by mxcluster_ids", + "description": "Mist Edge cluster IDs used as RadSec proxies when the WLAN does not use mxtunnel", "items": { "examples": [ "572586b7-f97b-a22b-526c-8b97a3f609c4" @@ -13552,7 +14131,7 @@ "type": "array" }, "proxy_hosts": { - "description": "Default is site.mxedge.radsec.proxy_hosts which must be a superset of all `wlans[*].radsec.proxy_hosts`. When `radsec.proxy_hosts` are not used, tunnel peers (org or site mxedges) are used irrespective of `use_site_mxedge`", + "description": "RadSec proxy hostnames advertised to APs", "items": { "examples": [ "mxedge1.local" @@ -13562,16 +14141,17 @@ "type": "array" }, "server_name": { - "description": "Name of the server to verify (against the cacerts in Org Setting). Only if not Mist Edge.", + "description": "TLS server name to verify against the CA certificates in Org Setting. Only if not Mist Edge.", "examples": [ "radsec.abc.com" ], "type": "string" }, "servers": { - "description": "List of RadSec Servers. Only if not Mist Edge.", + "description": "External RadSec servers. Only if not Mist Edge.", "items": { "additionalProperties": false, + "description": "External RadSec server settings", "properties": { "host": { "$comment": "max depth reached" @@ -13586,19 +14166,19 @@ "uniqueItems": true }, "use_mxedge": { - "description": "use mxedge(s) as RadSec Proxy", + "description": "Whether to use organization Mist Edge instances as RadSec proxies", "type": "boolean" }, "use_site_mxedge": { "default": false, - "description": "To use Site mxedges when this WLAN does not use mxtunnel", + "description": "Whether to use site Mist Edge instances when this WLAN does not use mxtunnel", "type": "boolean" } }, "type": "object" }, "vlan_id": { - "description": "Optional to specify the vlan id for a tunnel if forwarding is for `wxtunnel`, `mxtunnel` or `site_mxedge`.\\n * if vlan_id is not specified then it will use first one in vlan_ids[] of the mxtunnel.\\n * if forwarding == site_mxedge, vlan_ids comes from site_mxedge (`mxtunnels` under site setting)", + "description": "Optional to specify the VLAN ID for a tunnel if forwarding is for `wxtunnel`, `mxtunnel` or `site_mxedge`.\\n * if vlan_id is not specified then it will use first one in vlan_ids[] of the mxtunnel.\\n * if forwarding == site_mxedge, vlan_ids comes from site_mxedge (`mxtunnels` under site setting)", "examples": [ 9 ], @@ -13607,7 +14187,7 @@ "type": "integer" }, "vlan_ids": { - "description": "If `forwarding`==`limited`, comma separated list of additional vlan ids allowed on this port", + "description": "If `forwarding`==`limited`, comma separated list of additional VLAN IDs allowed on this port", "examples": [ "10,20,30" ], @@ -13638,7 +14218,7 @@ }, "pwr_config": { "additionalProperties": false, - "description": "Power related configs", + "description": "Power negotiation and peripheral power settings for this access point", "properties": { "base": { "default": 0, @@ -13658,10 +14238,11 @@ }, "radio_config": { "additionalProperties": false, - "description": "Radio AP settings", + "description": "Radio configuration overrides for this access point", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM can be disabled for individual radio-band settings", "type": "boolean" }, "ant_gain_24": { @@ -13690,7 +14271,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Selected radio chain mode for AP models that support antenna mode control", "enum": [ "1x1", "2x2", @@ -13701,7 +14282,7 @@ "type": "string" }, "antenna_select": { - "description": "Antenna Mode for AP which supports selectable antennas. enum: `\\"\\"` (default), `external`, `internal`", + "description": "Internal or external antenna selection for AP models with selectable antennas", "enum": [ "", "external", @@ -13714,14 +14295,16 @@ }, "band_24": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "2.4 GHz radio settings for this access point", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 2.4 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 2.4 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -13731,7 +14314,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 2.4 GHz radio", "enum": [ "1x1", "2x2", @@ -13746,7 +14329,7 @@ }, "bandwidth": { "default": 20, - "description": "channel width for the 2.4GHz band. enum: `0`(disabled, response only), `20`, `40`", + "description": "Channel width configured for the 2.4 GHz radio", "enum": [ 0, 20, @@ -13772,7 +14355,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 2.4 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -13821,7 +14404,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 2.4 GHz radio", "enum": [ "auto", "long", @@ -13833,7 +14416,7 @@ "type": "object" }, "band_24_usage": { - "description": "enum: `24`, `5`, `6`, `auto`", + "description": "Radio usage mode for the 2.4 GHz-capable radio", "enum": [ "24", "5", @@ -13844,14 +14427,16 @@ }, "band_5": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "5 GHz radio settings for this access point", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 5 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 5 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -13860,7 +14445,7 @@ ] }, "antenna_beam_pattern": { - "description": "enum: `narrow`, `medium`, `wide`", + "description": "Beam pattern used by the 5 GHz radio antenna", "enum": [ "narrow", "medium", @@ -13870,7 +14455,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 5 GHz radio", "enum": [ "1x1", "2x2", @@ -13885,7 +14470,7 @@ }, "bandwidth": { "default": 40, - "description": "channel width for the 5GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`", + "description": "Channel width configured for the 5 GHz radio", "enum": [ 0, 20, @@ -13910,7 +14495,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -13959,7 +14544,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 5 GHz radio", "enum": [ "auto", "long", @@ -13972,14 +14557,16 @@ }, "band_5_on_24_radio": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "5 GHz settings used when the 2.4 GHz radio operates in 5 GHz mode", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 5 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 5 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -13988,7 +14575,7 @@ ] }, "antenna_beam_pattern": { - "description": "enum: `narrow`, `medium`, `wide`", + "description": "Beam pattern used by the 5 GHz radio antenna", "enum": [ "narrow", "medium", @@ -13998,7 +14585,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 5 GHz radio", "enum": [ "1x1", "2x2", @@ -14013,7 +14600,7 @@ }, "bandwidth": { "default": 40, - "description": "channel width for the 5GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`", + "description": "Channel width configured for the 5 GHz radio", "enum": [ 0, 20, @@ -14038,7 +14625,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -14087,7 +14674,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 5 GHz radio", "enum": [ "auto", "long", @@ -14100,14 +14687,16 @@ }, "band_6": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "6 GHz radio settings for this access point", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 6 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 6 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -14116,7 +14705,7 @@ ] }, "antenna_beam_pattern": { - "description": "enum: `narrow`, `medium`, `wide`", + "description": "Beam pattern used by the 6 GHz radio antenna", "enum": [ "narrow", "medium", @@ -14126,7 +14715,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 6 GHz radio", "enum": [ "1x1", "2x2", @@ -14141,7 +14730,7 @@ }, "bandwidth": { "default": 80, - "description": "channel width for the 6GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`, `160`", + "description": "Channel width configured for the 6 GHz radio", "enum": [ 0, 20, @@ -14167,7 +14756,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 6 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -14216,7 +14805,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 6 GHz radio", "enum": [ "auto", "long", @@ -14257,11 +14846,12 @@ "type": "object" }, "serial": { - "description": "Device Serial", + "description": "Manufacturer serial number for the access point", "readOnly": true, "type": "string" }, "site_id": { + "description": "Site where this access point is assigned", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -14270,7 +14860,7 @@ "type": "string" }, "type": { - "description": "Device Type. enum: `ap`", + "description": "Device type discriminator for access point records", "enum": [ "ap" ], @@ -14279,7 +14869,7 @@ }, "uplink_port_config": { "additionalProperties": false, - "description": "AP Uplink port configuration", + "description": "Authentication and failover behavior for AP uplink ports", "properties": { "dot1x": { "default": false, @@ -14296,10 +14886,10 @@ }, "usb_config": { "additionalProperties": false, - "description": "USB AP settings\\n - Note: if native imagotag is enabled, BLE will be disabled automatically\\n - Note: legacy, new config moved to ESL Config.", + "description": "Legacy USB integration settings for this access point", "properties": { "cacert": { - "description": "Only if `type`==`imagotag`", + "description": "Only if `type`==`imagotag`. CA certificate used to validate the Imagotag service certificate", "type": [ "string", "null" @@ -14317,7 +14907,7 @@ "type": "boolean" }, "host": { - "description": "Only if `type`==`imagotag`", + "description": "Only if `type`==`imagotag`. Imagotag service host or IP address contacted by the AP", "examples": [ "1.1.1.1" ], @@ -14325,14 +14915,14 @@ }, "port": { "default": 0, - "description": "Only if `type`==`imagotag`", + "description": "Only if `type`==`imagotag`. TCP port used to reach the Imagotag service", "examples": [ 0 ], "type": "integer" }, "type": { - "description": "usb config type. enum: `hanshow`, `imagotag`, `solum`", + "description": "USB integration type for this legacy AP USB configuration", "enum": [ "hanshow", "imagotag", @@ -14359,7 +14949,7 @@ "additionalProperties": { "type": "string" }, - "description": "Dictionary of name->value, the vars can then be used in Wlans. This can overwrite those from Site Vars", + "description": "Variable values that override site variables for this access point", "examples": [ { "RADIUS_IP1": "172.31.2.5", @@ -14369,7 +14959,7 @@ "type": "object" }, "x": { - "description": "X in pixel", + "description": "Horizontal map position of the AP, in pixels", "examples": [ 53.5 ], @@ -14377,7 +14967,7 @@ "type": "number" }, "y": { - "description": "Y in pixel", + "description": "Vertical map position of the AP, in pixels", "examples": [ 173.1 ], @@ -14386,11 +14976,11 @@ }, "zigbee_config": { "additionalProperties": false, - "description": "Zigbee AP settings", + "description": "Zigbee radio and network settings for this access point", "properties": { "allow_join": { "default": "manual", - "description": "Controls whether new Zigbee devices are allowed to join the network. enum: `always`, `manual`", + "description": "Join policy for new Zigbee devices on this AP", "enum": [ "always", "manual" @@ -14452,19 +15042,23 @@ "description": "You can configure `port_usages` and `networks` settings at the device level, but most of the time it's better use the Site Setting to achieve better consistency and be able to re-use the same settings across switches entries defined here will \\"replace\\" those defined in Site Setting/Network Template\\nIn addition it is possible to use the `port_config_overwrite` to overwrite some attributes of the port_usage without having to create a new port_usage.", "properties": { "acl_policies": { + "description": "ACL policies applied to traffic handled by this switch", "items": { "additionalProperties": false, "description": "ACL Policy:\\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to", "properties": { "actions": { - "description": "ACL Policy Actions:\\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to", + "description": "Destination tag actions evaluated for sources matching this ACL policy", "items": { "additionalProperties": false, + "description": "Action applied to traffic that matches a destination ACL tag", "properties": { "action": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Allow or deny decision applied to traffic matching the destination tag" }, "dst_tag": { + "description": "Destination ACL tag matched by this policy action", "examples": [ "corp" ], @@ -14479,13 +15073,14 @@ "type": "array" }, "name": { + "description": "Display name of the ACL policy", "examples": [ "guest access" ], "type": "string" }, "src_tags": { - "description": "ACL Policy Source Tags:\\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to", + "description": "Source ACL tags that select traffic for this ACL policy", "items": { "examples": [ "macs" @@ -14508,7 +15103,7 @@ "default": [ "any" ], - "description": "ARP / IPv6. Default is `any`", + "description": "Layer 2 EtherTypes matched by this ACL tag; defaults to `any`", "items": { "type": "string" }, @@ -14519,7 +15114,7 @@ "type": "integer" }, "macs": { - "description": "Required if \\n- `type`==`mac`\\n- `type`==`static_gbp` if from matching mac", + "description": "Client or resource MAC addresses matched by this ACL tag", "items": { "type": "string" }, @@ -14530,7 +15125,7 @@ "type": "string" }, "port_usage": { - "description": "Required if `type`==`port_usage`", + "description": "Required if `type`==`port_usage`. Switch port usage name matched by this ACL tag", "type": "string" }, "radius_group": { @@ -14538,9 +15133,10 @@ "type": "string" }, "specs": { - "description": "If `type`==`resource`, `type`==`radius_group`, `type`==`port_usage` or `type`==`gbp_resource`. Empty means unrestricted, i.e. any", + "description": "Layer 4 protocol and destination-port constraints for this ACL tag", "items": { "additionalProperties": false, + "description": "Layer 4 protocol and destination-port match constraint for an ACL tag", "properties": { "port_range": { "default": "0", @@ -14558,14 +15154,14 @@ "type": "array" }, "subnets": { - "description": "If \\n- `type`==`subnet` \\n- `type`==`resource` (optional. default is `any`)\\n- `type`==`static_gbp` if from matching subnet", + "description": "IP subnets matched by this ACL tag", "items": { "type": "string" }, "type": "array" }, "type": { - "description": "enum: \\n * `any`: matching anything not identified\\n * `dynamic_gbp`: from the gbp_tag received from RADIUS\\n * `gbp_resource`: can only be used in `dst_tags`\\n * `mac`\\n * `network`\\n * `port_usage`\\n * `radius_group`\\n * `resource`: can only be used in `dst_tags`\\n * `static_gbp`: applying gbp tag against matching conditions\\n * `subnet`'", + "description": "Classifier type that determines which ACL tag fields are evaluated", "enum": [ "any", "dynamic_gbp", @@ -14586,11 +15182,11 @@ ], "type": "object" }, - "description": "ACL Tags to identify traffic source or destination. Key name is the tag name", + "description": "ACL tags used by switch access policies", "type": "object" }, "additional_config_cmds": { - "description": "additional CLI commands to append to the generated Junos config. **Note**: no check is done", + "description": "Additional CLI configuration commands to apply to this switch", "items": { "description": "JUNOS \\"set\\" command to add to the generated configuration", "examples": [ @@ -14603,12 +15199,15 @@ "aggregate_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Aggregate route configuration for a network or routing instance", "properties": { "discard": { "default": false, + "description": "Whether to install the aggregate route as a discard route", "type": "boolean" }, "metric": { + "description": "Routing metric assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -14617,6 +15216,7 @@ ] }, "preference": { + "description": "Route preference assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -14627,7 +15227,7 @@ }, "type": "object" }, - "description": "Property key is the destination subnet (e.g. \\"172.16.3.0/24\\")", + "description": "Additional IPv4 aggregate routes configured on this switch", "examples": [ { "172.16.3.0/24": { @@ -14642,12 +15242,15 @@ "aggregate_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Aggregate route configuration for a network or routing instance", "properties": { "discard": { "default": false, + "description": "Whether to install the aggregate route as a discard route", "type": "boolean" }, "metric": { + "description": "Routing metric assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -14656,6 +15259,7 @@ ] }, "preference": { + "description": "Route preference assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -14666,7 +15270,7 @@ }, "type": "object" }, - "description": "Property key is the destination subnet (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "Additional IPv6 aggregate routes configured on this switch", "example": { "2a02:1234:420a:10c9::/64": { "discard": false, @@ -14679,8 +15283,10 @@ "bgp_config": { "additionalProperties": { "additionalProperties": false, + "description": "Switch BGP configuration for a routing instance", "properties": { "auth_key": { + "description": "Authentication key used for BGP neighbor sessions, when configured", "type": "string" }, "bfd_minimum_interval": { @@ -14694,15 +15300,17 @@ "type": "string" }, "hold_time": { - "description": "Hold time is three times the interval at which keepalive messages are sent. It indicates to the peer the length of time that it should consider the sender valid. Must be 0 or a number in the range 3-65535.", + "description": "Default BGP hold time for switch BGP sessions", "oneOf": [ { + "description": "BGP hold time value of 0", "enum": [ 0 ], "type": "integer" }, { + "description": "BGP hold time value from 3 to 65535 seconds", "maximum": 65535, "minimum": 3, "type": "integer" @@ -14724,7 +15332,7 @@ "type": "integer" } ], - "description": "BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}` )", + "description": "Local BGP Autonomous System (AS) number for the switch", "examples": [ 65000 ] @@ -14732,13 +15340,14 @@ "neighbors": { "additionalProperties": { "additionalProperties": false, + "description": "Per-neighbor switch BGP session settings", "properties": { "export_policy": { "description": "Export policy must match one of the policy names defined in the `routing_policies` property.", "type": "string" }, "hold_time": { - "description": "Hold time is three times the interval at which keepalive messages are sent. It indicates to the peer the length of time that it should consider the sender valid. Must be 0 or a number in the range 3-65535.", + "description": "BGP hold time for this neighbor", "oneOf": [ { "$comment": "max depth reached" @@ -14753,6 +15362,7 @@ "type": "string" }, "multihop_ttl": { + "description": "Time-to-live value for multihop BGP sessions to this neighbor", "maximum": 255, "minimum": 1, "type": "integer" @@ -14777,18 +15387,18 @@ ], "type": "object" }, - "description": "Property key is the BGP Neighbor IP Address.", + "description": "BGP neighbor settings keyed by neighbor IP address", "type": "object" }, "networks": { - "description": "List of network names for BGP configuration. When a network is specified, a BGP group will be added to the VRF that network is part of.", + "description": "Network names used to add BGP groups to the corresponding VRFs", "items": { "type": "string" }, "type": "array" }, "type": { - "description": "enum: `external`, `internal`", + "description": "BGP session type for this switch BGP configuration", "enum": [ "external", "internal" @@ -14802,10 +15412,11 @@ ], "type": "object" }, + "description": "BGP routing configuration for this switch. Property key is the BGP session name", "type": "object" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the switch object was created", "format": "double", "readOnly": true, "type": "number" @@ -14816,14 +15427,17 @@ "type": "string" }, "deviceprofile_id": { + "description": "Device profile associated with this switch", "format": "uuid", "readOnly": true, "type": "string" }, "dhcp_snooping": { "additionalProperties": false, + "description": "DHCP snooping configuration for this switch", "properties": { "all_networks": { + "description": "Whether DHCP snooping applies to all configured networks", "type": "boolean" }, "enable_arp_spoof_check": { @@ -14835,10 +15449,11 @@ "type": "boolean" }, "enabled": { + "description": "Whether DHCP snooping is enabled", "type": "boolean" }, "networks": { - "description": "If `all_networks`==`false`, list of network with DHCP snooping enabled", + "description": "Network names with DHCP snooping enabled when `all_networks`==`false`", "items": { "type": "string" }, @@ -14850,10 +15465,10 @@ "dhcpd_config": { "additionalProperties": { "additionalProperties": false, - "description": "the Property key is the network name. In case of DHCP relay, it's common for many networks to use the same dhcp relay, comma-separated network names can be used here (e.g. \\"net1,net2\\")", + "description": "DHCP server or relay configuration for one switch network. The property key is the network name. In case of DHCP relay, it's common for many networks to use the same dhcp relay, comma-separated network names can be used here (e.g. \\"net1,net2\\")", "properties": { "dns_servers": { - "description": "If `type`==`server` or `type6`==`server` - optional, if not defined, system one will be used", + "description": "If `type`==`server` or `type6`==`server`, DNS servers advertised to DHCP clients", "examples": [ [ "8.8.8.8", @@ -14867,7 +15482,7 @@ "type": "array" }, "dns_suffix": { - "description": "If `type`==`server` or `type6`==`server` - optional, if not defined, system one will be used", + "description": "If `type`==`server` or `type6`==`server`, DNS search suffixes advertised to DHCP clients", "examples": [ [ ".mist.local", @@ -14882,26 +15497,30 @@ "fixed_bindings": { "additionalProperties": { "additionalProperties": false, + "description": "Static DHCP binding for a client MAC address", "properties": { "ip": { + "description": "Reserved IPv4 address for this fixed DHCP binding", "examples": [ "192.168.70.35" ], "type": "string" }, "ip6": { + "description": "Reserved IPv6 address for this fixed DHCP binding", "examples": [ "2607:f8b0:4005:808::2" ], "type": "string" }, "name": { + "description": "Friendly name for this fixed DHCP binding", "type": "string" } }, "type": "object" }, - "description": "If `type`==`server` or `type6`==`server`. Property key is the MAC Address. Format is `[0-9a-f]{12}` (e.g. \\"5684dae9ac8b\\")", + "description": "If `type`==`server` or `type6`==`server`, fixed client bindings for DHCP service", "examples": [ { "5684dae9ac8b": { @@ -14920,28 +15539,28 @@ "type": "string" }, "ip_end": { - "description": "If `type`==`server`", + "description": "If `type`==`server`, ending IPv4 address for the DHCP lease pool", "examples": [ "192.168.70.200" ], "type": "string" }, "ip_end6": { - "description": "If `type6`==`server`", + "description": "If `type6`==`server`, ending IPv6 address for the DHCP lease pool", "examples": [ "2607:f8b0:4005:808::ff" ], "type": "string" }, "ip_start": { - "description": "If `type`==`server`", + "description": "If `type`==`server`, starting IPv4 address for the DHCP lease pool", "examples": [ "192.168.70.100" ], "type": "string" }, "ip_start6": { - "description": "If `type6`==`server`", + "description": "If `type6`==`server`, starting IPv6 address for the DHCP lease pool", "examples": [ "2607:f8b0:4005:808::2" ], @@ -14957,17 +15576,20 @@ "options": { "additionalProperties": { "additionalProperties": false, + "description": "Custom DHCP option value", "properties": { "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Data type used to encode this DHCP option value" }, "value": { + "description": "Option value to send for this DHCP option", "type": "string" } }, "type": "object" }, - "description": "If `type`==`server` or `type6`==`server`. Property key is the DHCP option number", + "description": "If `type`==`server` or `type6`==`server`, custom DHCP options advertised to clients", "type": "object" }, "server_id_override": { @@ -14976,7 +15598,7 @@ "type": "boolean" }, "servers": { - "description": "If `type`==`relay`", + "description": "If `type`==`relay`, upstream IPv4 DHCP servers", "examples": [ [ "11.2.3.4" @@ -14988,7 +15610,7 @@ "type": "array" }, "servers6": { - "description": "If `type6`==`relay`", + "description": "If `type6`==`relay`, upstream IPv6 DHCP servers", "examples": [ [ "2607:f8b0:4005:808::64" @@ -15000,7 +15622,7 @@ "type": "array" }, "type": { - "description": "enum: `none`, `relay` (DHCP Relay), `server` (DHCP Server)", + "description": "IPv4 DHCP mode for this switch network", "enum": [ "none", "relay", @@ -15010,7 +15632,7 @@ }, "type6": { "default": "none", - "description": "enum: `none`, `relay` (DHCP Relay), `server` (DHCP Server)", + "description": "IPv6 DHCP mode for this switch network", "enum": [ "none", "relay", @@ -15021,26 +15643,30 @@ "vendor_encapsulated": { "additionalProperties": { "additionalProperties": false, + "description": "Vendor-encapsulated DHCP option value", "properties": { "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Data type used to encode this vendor option value" }, "value": { + "description": "Option value to send for this vendor option", "type": "string" } }, "type": "object" }, - "description": "If `type`==`server` or `type6`==`server`. Property key is :, with\\n * enterprise number: 1-65535 (https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers)\\n * sub option code: 1-255, sub-option code'", + "description": "If `type`==`server` or `type6`==`server`, vendor-encapsulated DHCP options advertised to clients", "type": "object" } }, "type": "object" }, + "description": "DHCP server configuration served by this switch", "properties": { "enabled": { "default": false, - "description": "If set to `true`, enable the DHCP server", + "description": "Whether switch DHCP server or relay configuration is enabled", "type": "boolean" } }, @@ -15052,14 +15678,14 @@ "type": "boolean" }, "dns_servers": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS servers configured for this switch", "items": { "type": "string" }, "type": "array" }, "dns_suffix": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS search suffixes configured for this switch", "items": { "type": "string" }, @@ -15067,14 +15693,15 @@ }, "evpn_config": { "additionalProperties": false, - "description": "EVPN Junos settings", + "description": "EVPN configuration applied to this switch", "properties": { "enabled": { + "description": "Whether EVPN configuration is enabled on the switch", "readOnly": true, "type": "boolean" }, "role": { - "description": "enum: `access`, `border`, `collapsed-core`, `core`, `distribution`, `esilag-access`, `none`", + "description": "EVPN topology role for the switch", "enum": [ "access", "border", @@ -15094,13 +15721,15 @@ "extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "IPv4 static route settings for a destination prefix", "properties": { "discard": { "default": false, - "description": "This takes precedence", + "description": "Whether to install a discard route; this takes precedence over next-hop settings", "type": "boolean" }, "metric": { + "description": "Route metric for the IPv4 static route", "examples": [ null ], @@ -15114,14 +15743,17 @@ "next_qualified": { "additionalProperties": { "additionalProperties": false, + "description": "Qualified next-hop attributes for an IPv4 static route", "properties": { "metric": { + "description": "Route metric for this qualified IPv4 next hop", "type": [ "integer", "null" ] }, "preference": { + "description": "Route preference for this qualified IPv4 next hop", "type": [ "integer", "null" @@ -15130,6 +15762,7 @@ }, "type": "object" }, + "description": "Qualified next-hop settings keyed by IPv4 next-hop address", "examples": [ { "10.3.1.1": { @@ -15142,9 +15775,11 @@ }, "no_resolve": { "default": false, + "description": "Whether to prevent recursive next-hop resolution for the IPv4 static route", "type": "boolean" }, "preference": { + "description": "Route preference for the IPv4 static route", "examples": [ 30 ], @@ -15156,7 +15791,7 @@ ] }, "via": { - "description": "Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.", + "description": "Next-hop IPv4 address or ECMP next-hop IPv4 addresses for the route", "examples": [ "10.2.1.1", [ @@ -15179,7 +15814,7 @@ }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"10.0.0.0/8\\")", + "description": "Additional IPv4 routes configured on this switch", "examples": [ { "0.0.0.0/0": { @@ -15192,13 +15827,15 @@ "extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "IPv6 static route settings for a destination prefix", "properties": { "discard": { "default": false, - "description": "This takes precedence", + "description": "Whether to install a discard route; this takes precedence over next-hop settings", "type": "boolean" }, "metric": { + "description": "Route metric for the IPv6 static route", "examples": [ null ], @@ -15212,14 +15849,17 @@ "next_qualified": { "additionalProperties": { "additionalProperties": false, + "description": "Qualified next-hop attributes for an IPv6 static route", "properties": { "metric": { + "description": "Route metric for this qualified IPv6 next hop", "type": [ "integer", "null" ] }, "preference": { + "description": "Route preference for this qualified IPv6 next hop", "type": [ "integer", "null" @@ -15228,6 +15868,7 @@ }, "type": "object" }, + "description": "Qualified next-hop settings keyed by IPv6 next-hop address", "examples": [ { "2a02:1234:200a::100": { @@ -15240,9 +15881,11 @@ }, "no_resolve": { "default": false, + "description": "Whether to prevent recursive next-hop resolution for the IPv6 static route", "type": "boolean" }, "preference": { + "description": "Route preference for the IPv6 static route", "examples": [ 30 ], @@ -15254,7 +15897,7 @@ ] }, "via": { - "description": "Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.", + "description": "Next-hop IPv6 address or ECMP next-hop IPv6 addresses for the route", "examples": [ "10.2.1.1", [ @@ -15277,7 +15920,7 @@ }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "Additional IPv6 routes configured on this switch", "examples": [ { "2a02:1234:420a:10c9::/64": { @@ -15288,7 +15931,7 @@ "type": "object" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the switch object", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -15297,18 +15940,21 @@ "type": "string" }, "image1_url": { + "description": "First custom image URL associated with the switch", "type": [ "string", "null" ] }, "image2_url": { + "description": "Second custom image URL associated with the switch", "type": [ "string", "null" ] }, "image3_url": { + "description": "Third custom image URL associated with the switch", "type": [ "string", "null" @@ -15321,7 +15967,7 @@ "properties": { "alarm_class": { "default": "minor", - "description": "Alarm class for the switch iot port in. enum: `minor`, `major`", + "description": "Alarm severity class raised for input-triggered switch IOT port events", "enum": [ "minor", "major" @@ -15330,11 +15976,12 @@ }, "enabled": { "default": false, + "description": "Whether this switch IOT port is enabled", "type": "boolean" }, "input_src": { "default": "IN0", - "description": "Only for \\"OUT\\" ports, input source for the switch iot port out. enum: `IN0`, `IN1`", + "description": "Only for `OUT` ports. Input port that triggers this output port", "enum": [ "IN0", "IN1" @@ -15342,19 +15989,21 @@ "type": "string" }, "name": { + "description": "Display name for the switch IOT port", "type": "string" } }, "type": "object" }, - "description": "Property Key is the IOT port name, e.g.: \\n * `IN0` or `IN1` for the FPC0 input port with 5V triggered inputs\\n * `OUT1` for the FPC0 output port (can only be triggered by either IN0 or IN1)\\n * \\"X/IN0`, `X/IN1` and `X/OUT` are used to define IOT ports on VC members", + "description": "IoT port settings for this switch", "type": "object" }, "ip_config": { "additionalProperties": false, - "description": "Junos IP Config", + "description": "Management IP addressing settings for this switch", "properties": { "dns": { + "description": "Configured DNS server addresses for Junos management traffic", "items": { "type": "string" }, @@ -15362,6 +16011,7 @@ "uniqueItems": true }, "dns_suffix": { + "description": "DNS search suffixes configured for Junos management traffic", "items": { "type": "string" }, @@ -15369,9 +16019,11 @@ "uniqueItems": true }, "gateway": { + "description": "Default gateway IPv4 address for this Junos IP configuration", "type": "string" }, "ip": { + "description": "Configured IPv4 address for this Junos IP configuration", "type": "string" }, "netmask": { @@ -15379,12 +16031,12 @@ "type": "string" }, "network": { - "description": "Network where this mgmt IP reside, this will be used as default network for outbound-ssh, dns, ntp, dns, tacplus, radius, syslog, snmp", + "description": "Management network for this IP configuration; used as the default source network for outbound SSH, DNS, NTP, TACACS+, RADIUS, syslog, and SNMP", "type": "string" }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IP assignment mode for this Junos IP configuration", "enum": [ "dhcp", "static" @@ -15400,7 +16052,7 @@ "local_port_config": { "additionalProperties": { "additionalProperties": false, - "description": "Switch port config", + "description": "Per-port Switch Port Operator (SPO) override configuration used in `local_port_config` to customize settings inherited from `port_config`", "properties": { "all_networks": { "default": false, @@ -15413,6 +16065,7 @@ }, "allow_multiple_supplicants": { "default": false, + "description": "Whether multiple supplicants may authenticate on the port", "type": "boolean" }, "bypass_auth_when_server_down": { @@ -15426,6 +16079,7 @@ "type": "boolean" }, "description": { + "description": "Human-readable description for this local port configuration", "type": "string" }, "disable_autoneg": { @@ -15440,7 +16094,7 @@ }, "duplex": { "default": "auto", - "description": "link connection mode. enum: `auto`, `full`, `half`", + "description": "Link duplex mode for this local port configuration", "enum": [ "auto", "full", @@ -15449,7 +16103,7 @@ "type": "string" }, "dynamic_vlan_networks": { - "description": "Only if `port_auth`==`dot1x`, if dynamic vlan is used, specify the possible networks/vlans RADIUS can return", + "description": "Only if `port_auth`==`dot1x`, networks or VLANs that RADIUS can return for dynamic VLAN assignment", "examples": [ [ "corp", @@ -15468,6 +16122,7 @@ }, "enable_qos": { "default": false, + "description": "Whether QoS is enabled on ports using this local configuration", "type": "boolean" }, "guest_network": { @@ -15479,11 +16134,11 @@ }, "inter_switch_link": { "default": false, - "description": "inter_switch_link is used together with \\"isolation\\" under networks. NOTE: inter_switch_link works only between Juniper devices. This has to be applied to both ports connected together", + "description": "Used together with \\"isolation\\" under networks for links between Juniper devices; must be applied to both connected ports", "type": "boolean" }, "mac_auth_only": { - "description": "Only if `enable_mac_auth`==`true`", + "description": "Only if `enable_mac_auth`==`true`, whether to use MAC authentication without 802.1X", "type": "boolean" }, "mac_auth_preferred": { @@ -15492,7 +16147,7 @@ }, "mac_auth_protocol": { "default": "eap-md5", - "description": "Only if `enable_mac_auth` ==`true`. This type is ignored if mist_nac is enabled. enum: `eap-md5`, `eap-peap`, `pap`", + "description": "Only if `enable_mac_auth`==`true`, MAC authentication protocol to use", "enum": [ "eap-md5", "eap-peap", @@ -15502,12 +16157,12 @@ }, "mac_limit": { "default": 0, - "description": "Max number of mac addresses, default is 0 for unlimited, otherwise range is 1 or higher, with upper bound constrained by platform", + "description": "Max number of MAC addresses, default is 0 for unlimited, otherwise range is 1 or higher, with upper bound constrained by platform", "minimum": 0, "type": "integer" }, "mode": { - "description": "enum: `access`, `inet`, `trunk`", + "description": "Switching mode for this local port configuration", "enum": [ "access", "inet", @@ -15520,7 +16175,7 @@ "type": "integer" }, "networks": { - "description": "Only if `mode`==`trunk`, the list of network/vlans", + "description": "Only if `mode`==`trunk`, network or VLAN names to trunk", "items": { "type": "string" }, @@ -15544,7 +16199,7 @@ "type": "boolean" }, "port_auth": { - "description": "if dot1x is desired, set to dot1x. enum: `dot1x`", + "description": "802.1X authentication mode for this local port configuration", "enum": [ "dot1x" ], @@ -15569,7 +16224,7 @@ "type": "string" } ], - "description": "Only if `mode`!=`dynamic` and `port_auth`=`dot1x` reauthentication interval range (min: 10, max: 65535, default: 3600). Set to 0 to disable reauthentication (no-reauthentication)." + "description": "Only if `port_auth`==`dot1x`, RADIUS reauthentication interval for clients on the port" }, "server_fail_network": { "description": "Only if `port_auth`==`dot1x` sets server fail fallback vlan", @@ -15579,7 +16234,7 @@ ] }, "server_reject_network": { - "description": "Only if `port_auth`==`dot1x` when radius server reject / fails", + "description": "Only if `port_auth`==`dot1x` when RADIUS server reject / fails", "type": [ "string", "null" @@ -15587,7 +16242,7 @@ }, "speed": { "default": "auto", - "description": "enum: `100m`, `10m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`,`auto`", + "description": "Link speed for this local port configuration", "enum": [ "10m", "100m", @@ -15604,7 +16259,7 @@ }, "storm_control": { "additionalProperties": false, - "description": "Switch storm control", + "description": "Storm-control settings for this local port configuration", "properties": { "disable_port": { "default": false, @@ -15648,14 +16303,16 @@ }, "stp_no_root_port": { "default": false, + "description": "Whether STP should prevent this port from becoming a root port", "type": "boolean" }, "stp_p2p": { "default": false, + "description": "Whether STP treats this port as a point-to-point link", "type": "boolean" }, "usage": { - "description": "Port usage name.", + "description": "Port usage profile name for this local port configuration", "type": "string" }, "use_vstp": { @@ -15673,11 +16330,11 @@ ], "type": "object" }, - "description": "Local port override, overriding the port configuration from `port_config`. Property key is the port name or range (e.g. \\"ge-0/0/0-10\\")", + "description": "Local port configuration settings for this switch", "type": "object" }, "mac": { - "description": "Device MAC address", + "description": "Switch MAC address used to identify the device", "readOnly": true, "type": "string" }, @@ -15701,29 +16358,32 @@ }, "mist_nac": { "additionalProperties": false, - "description": "Enable mist_nac to use RadSec", + "description": "Mist NAC settings applied to this switch", "properties": { "enabled": { + "description": "Whether Mist NAC RadSec is enabled for the switch", "type": "boolean" }, "network": { + "description": "Switch network used for Mist NAC RadSec connectivity", "type": "string" } }, "type": "object" }, "model": { - "description": "Device Model", + "description": "Switch model reported for the device", "readOnly": true, "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the switch object was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Friendly display name assigned to the switch", "type": "string" }, "networks": { @@ -15745,6 +16405,7 @@ "type": "boolean" }, "isolation_vlan_id": { + "description": "Required when `isolation`==`true`. Unique VLAN ID used for client isolation", "examples": [ "3070" ], @@ -15759,6 +16420,7 @@ "type": "string" }, "vlan_id": { + "description": "VLAN identifier for this switch network", "oneOf": [ { "type": "string" @@ -15776,14 +16438,15 @@ ], "type": "object" }, - "description": "Property key is network name", + "description": "Layer 3 networks configured for use by this switch", "type": "object" }, "notes": { + "description": "Free-form administrative notes for this switch", "type": "string" }, "ntp_servers": { - "description": "List of NTP servers specific to this device. By default, those in Site Settings will be used", + "description": "NTP servers used by this switch", "items": { "type": "string" }, @@ -15791,12 +16454,14 @@ }, "oob_ip_config": { "additionalProperties": false, - "description": "Switch OOB IP Config:\\n - If HA configuration: key parameter will be nodeX (eg: node1)\\n - If there are 2 routing engines, re1 mgmt IP has to be set separately (if desired): key parameter = `re1`", + "description": "Out-of-band management IP configuration for this switch", "properties": { "gateway": { + "description": "Default gateway for the out-of-band management interface when `type`==`static`", "type": "string" }, "ip": { + "description": "Static IPv4 address for the out-of-band management interface when `type`==`static`", "type": "string" }, "netmask": { @@ -15809,7 +16474,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IP assignment mode for the out-of-band management interface", "enum": [ "dhcp", "static" @@ -15833,6 +16498,7 @@ "type": "object" }, "org_id": { + "description": "Organization that owns this switch", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -15847,6 +16513,7 @@ "properties": { "include_loopback": { "default": false, + "description": "Whether loopback interfaces are included in this OSPF area", "type": "boolean" }, "networks": { @@ -15875,7 +16542,7 @@ }, "auth_type": { "default": "none", - "description": "auth type. enum: `md5`, `none`, `password`", + "description": "Authentication method used by this OSPF network", "enum": [ "md5", "none", @@ -15887,6 +16554,7 @@ "type": "string" }, "bfd_minimum_interval": { + "description": "Minimum BFD interval for this OSPF network, in milliseconds", "examples": [ 500 ], @@ -15895,6 +16563,7 @@ "type": "integer" }, "dead_interval": { + "description": "OSPF dead interval for this network, in seconds", "examples": [ 40 ], @@ -15903,17 +16572,20 @@ "type": "integer" }, "export_policy": { + "description": "Routing policy used to export routes from this OSPF network", "examples": [ "export_policy" ], "type": "string" }, "hello_interval": { + "description": "OSPF hello interval for this network, in seconds", "maximum": 255, "minimum": 1, "type": "integer" }, "import_policy": { + "description": "Routing policy used to import routes for this OSPF network", "examples": [ "import_policy" ], @@ -15921,7 +16593,7 @@ }, "interface_type": { "default": "broadcast", - "description": "interface type (nbma = non-broadcast multi-access). enum: `broadcast`, `nbma`, `p2mp`, `p2p`", + "description": "OSPF interface type used for this network", "enum": [ "broadcast", "nbma", @@ -15931,6 +16603,7 @@ "type": "string" }, "metric": { + "description": "OSPF metric assigned to this network", "examples": [ 10000 ], @@ -15954,6 +16627,7 @@ }, "type": "object" }, + "description": "OSPF network settings keyed by network name", "examples": [ { "corp": { @@ -15976,7 +16650,7 @@ }, "type": { "default": "default", - "description": "OSPF type. enum: `default`, `nssa`, `stub`", + "description": "Area type for this OSPF area", "enum": [ "default", "nssa", @@ -15990,13 +16664,15 @@ }, "type": "object" }, - "description": "Junos OSPF areas. Property key is the OSPF Area (Area should be a number (0-255) / IP address)", + "description": "OSPF area configuration for this switch", "type": "object" }, "ospf_config": { + "description": "OSPF routing configuration for this switch", "properties": { "areas": { "additionalProperties": { + "description": "Settings for a single OSPF area on a switch", "properties": { "no_summary": { "default": false, @@ -16005,7 +16681,7 @@ } } }, - "description": "Property key is the area name. Defines the OSPF areas configured on the switch.", + "description": "OSPF areas configured on the switch", "type": "object" }, "enabled": { @@ -16030,7 +16706,7 @@ "type": "string" } ], - "description": "Reference bandwidth. Integer(100000) or String (10g)", + "description": "Reference bandwidth used for OSPF cost calculation", "examples": [ 100000 ] @@ -16040,36 +16716,36 @@ "other_ip_configs": { "additionalProperties": { "additionalProperties": false, - "description": "Optional, if it's required to have switch's L3 presence on a network/vlan", + "description": "Optional switch L3 presence on an additional network or VLAN", "properties": { "evpn_anycast": { "default": false, - "description": "For EVPN, if anycast is desired", + "description": "For EVPN, whether anycast is desired", "type": "boolean" }, "ip": { - "description": "Required if `type`==`static`", + "description": "Required if `type`==`static`; IPv4 address for the additional Junos L3 presence", "examples": [ "10.3.3.1" ], "type": "string" }, "ip6": { - "description": "Required if `type6`==`static`", + "description": "Required if `type6`==`static`; IPv6 address for the additional Junos L3 presence", "examples": [ "fdad:b0bc:f29e::3d16" ], "type": "string" }, "netmask": { - "description": "Optional, `subnet` from `network` definition will be used if defined", + "description": "Optional IPv4 netmask; `subnet` from `network` definition will be used if defined", "examples": [ "255.255.255.0" ], "type": "string" }, "netmask6": { - "description": "Optional, `subnet` from `network` definition will be used if defined", + "description": "Optional IPv6 prefix length; `subnet` from `network` definition will be used if defined", "examples": [ "/64" ], @@ -16077,7 +16753,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IPv4 assignment mode for the additional Junos L3 presence", "enum": [ "dhcp", "static" @@ -16089,7 +16765,7 @@ }, "type6": { "default": "disabled", - "description": "enum: `autoconf`, `dhcp`, `disabled`, `static`", + "description": "IPv6 assignment mode for the additional Junos L3 presence", "enum": [ "autoconf", "dhcp", @@ -16110,7 +16786,7 @@ "port_config": { "additionalProperties": { "additionalProperties": false, - "description": "Switch port config", + "description": "Junos switch port configuration", "properties": { "ae_disable_lacp": { "description": "To disable LACP support for the AE interface", @@ -16131,6 +16807,7 @@ }, "aggregated": { "default": false, + "description": "Whether this port is configured as an aggregated Ethernet member", "type": "boolean" }, "critical": { @@ -16139,6 +16816,7 @@ "type": "boolean" }, "description": { + "description": "Human-readable description for this Junos port", "type": "string" }, "disable_autoneg": { @@ -16148,7 +16826,7 @@ }, "duplex": { "default": "auto", - "description": "enum: `auto`, `full`, `half`", + "description": "Link duplex mode for this Junos port", "enum": [ "auto", "full", @@ -16164,6 +16842,7 @@ ] }, "esilag": { + "description": "Whether this Junos port participates in an ESI-LAG", "type": "boolean" }, "mtu": { @@ -16185,6 +16864,7 @@ }, "poe_disabled": { "default": false, + "description": "Whether PoE capabilities are disabled for this Junos port", "type": "boolean" }, "port_network": { @@ -16193,7 +16873,7 @@ }, "speed": { "default": "auto", - "description": "enum: `100m`, `10m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`,`auto`", + "description": "Link speed for this Junos port", "enum": [ "10m", "100m", @@ -16218,15 +16898,16 @@ ], "type": "object" }, - "description": "Property key is the port name or range (e.g. \\"ge-0/0/0-10\\")", + "description": "Per-port wired configuration for this switch", "type": "object" }, "port_config_overwrite": { "additionalProperties": { "additionalProperties": false, - "description": "Switch port config", + "description": "Switch port configuration overrides", "properties": { "description": { + "description": "Administrative description applied to the switch port override", "type": "string" }, "disabled": { @@ -16236,7 +16917,7 @@ }, "duplex": { "default": "auto", - "description": "Link connection mode. enum: `auto`, `full`, `half`", + "description": "Link duplex mode override for the switch port", "enum": [ "auto", "full", @@ -16256,7 +16937,7 @@ "type": "string" } ], - "description": "Max number of mac addresses, default is 0 for unlimited, otherwise range is 1 to 16383 (upper bound constrained by platform)" + "description": "MAC address learning limit override for the switch port" }, "poe_disabled": { "default": false, @@ -16274,7 +16955,7 @@ }, "speed": { "default": "auto", - "description": "Port Speed, default is auto to automatically negotiate speed enum: `100m`, `10m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`,`auto`", + "description": "Link speed override for the switch port", "enum": [ "10m", "100m", @@ -16292,15 +16973,16 @@ }, "type": "object" }, - "description": "Property key is the port name or range (e.g. \\"ge-0/0/0-10\\"). This can be used to override some attributes of the port_usage without having to create a new port_usage.", + "description": "Per-port overrides for switch port usage attributes", "type": "object" }, "port_mirroring": { "additionalProperties": { "additionalProperties": false, + "description": "Input and output settings for one switch port mirroring session", "properties": { "input_networks_ingress": { - "description": "At least one of the `input_port_ids_ingress`, `input_port_ids_egress` or `input_networks_ingress ` should be specified", + "description": "At least one mirror input source should be specified. Networks whose ingress traffic is mirrored", "items": { "examples": [ "corp" @@ -16310,7 +16992,7 @@ "type": "array" }, "input_port_ids_egress": { - "description": "At least one of the `input_port_ids_ingress`, `input_port_ids_egress` or `input_networks_ingress ` should be specified", + "description": "At least one mirror input source should be specified. Switch ports whose egress traffic is mirrored", "items": { "examples": [ "ge-0/0/3" @@ -16320,7 +17002,7 @@ "type": "array" }, "input_port_ids_ingress": { - "description": "At least one of the `input_port_ids_ingress`, `input_port_ids_egress` or `input_networks_ingress ` should be specified", + "description": "At least one mirror input source should be specified. Switch ports whose ingress traffic is mirrored", "items": { "examples": [ "ge-0/0/3" @@ -16353,13 +17035,13 @@ }, "type": "object" }, - "description": "Property key is the port mirroring instance name. `port_mirroring` can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 mirroring ports is allowed", + "description": "Port mirroring configuration for this switch", "type": "object" }, "port_usages": { "additionalProperties": { "additionalProperties": false, - "description": "Junos port usages", + "description": "Junos switch port usage template and authentication settings", "properties": { "all_networks": { "default": false, @@ -16410,7 +17092,7 @@ }, "duplex": { "default": "auto", - "description": "Only if `mode`!=`dynamic`. Link connection mode. enum: `auto`, `full`, `half`", + "description": "Only if `mode`!=`dynamic`. Link duplex mode for this port usage", "enum": [ "auto", "full", @@ -16419,7 +17101,7 @@ "type": "string" }, "dynamic_vlan_networks": { - "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`, if dynamic vlan is used, specify the possible networks/vlans RADIUS can return", + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Networks or VLANs that RADIUS can return for dynamic VLAN assignment", "examples": [ [ "corp", @@ -16468,7 +17150,7 @@ }, "mac_auth_protocol": { "default": "eap-md5", - "description": "Only if `mode`!=`dynamic` and `enable_mac_auth` ==`true`. This type is ignored if mist_nac is enabled. enum: `eap-md5`, `eap-peap`, `pap`", + "description": "Only if `mode`!=`dynamic` and `enable_mac_auth`==`true`. MAC authentication protocol to use; ignored if Mist NAC is enabled", "enum": [ "eap-md5", "eap-peap", @@ -16488,10 +17170,10 @@ "type": "string" } ], - "description": "Only if `mode`!=`dynamic`, max number of mac addresses, default is 0 for unlimited, otherwise range is 1 to 16383 (upper bound constrained by platform)" + "description": "Only if `mode`!=`dynamic`. Maximum number of MAC addresses allowed on the port; 0 means unlimited" }, "mode": { - "description": "`mode`==`dynamic` must only be used if the port usage name is `dynamic`. enum: `access`, `dynamic`, `inet`, `trunk`", + "description": "Switching mode for this port usage", "enum": [ "access", "dynamic", @@ -16514,10 +17196,10 @@ "type": "null" } ], - "description": "Only if `mode`!=`dynamic` media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation. The default value is 1514." + "description": "Only if `mode`!=`dynamic`. MTU for ports using this port usage" }, "networks": { - "description": "Only if `mode`==`trunk`, the list of network/vlans", + "description": "Only if `mode`==`trunk`. Network or VLAN names to trunk", "items": { "type": "string" }, @@ -16539,7 +17221,7 @@ "type": "boolean" }, "poe_priority": { - "description": "PoE priority. enum: `low`, `high`", + "description": "Only if `mode`!=`dynamic`. PoE priority for ports using this port usage", "enum": [ "low", "high" @@ -16547,7 +17229,7 @@ "type": "string" }, "port_auth": { - "description": "Only if `mode`!=`dynamic`. If dot1x is desired, set to dot1x. enum: `dot1x`", + "description": "Only if `mode`!=`dynamic`. 802.1X authentication mode for this port usage", "enum": [ "dot1x" ], @@ -16572,11 +17254,11 @@ "type": "string" } ], - "description": "Only if `mode`!=`dynamic` and `port_auth`=`dot1x` reauthentication interval range (min: 10, max: 65535, default: 3600). Set to 0 to disable reauthentication (no-reauthentication)." + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. RADIUS reauthentication interval for clients on the port" }, "reset_default_when": { "default": "link_down", - "description": "Only if `mode`==`dynamic` Control when the DPC port should be changed to the default port usage. enum: `link_down`, `none` (let the DPC port keep at the current port usage)", + "description": "Only if `mode`==`dynamic`. Condition that resets a dynamic port to the default port usage", "enum": [ "link_down", "none" @@ -16587,29 +17269,33 @@ "type": "string" }, "rules": { - "description": "Only if `mode`==`dynamic`", + "description": "Only if `mode`==`dynamic`. Dynamic matching rules that select the port usage to apply", "items": { "additionalProperties": false, + "description": "Dynamic port usage rule evaluated against LLDP, RADIUS, or peer MAC attributes", "properties": { "description": { "description": "Optional description of the rule", "type": "string" }, "equals": { + "description": "Exact value that the selected source attribute must match", "type": "string" }, "equals_any": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "List of values where any match satisfies this dynamic rule" }, "expression": { "description": "\\"[0:3]\\":\\"abcdef\\" -> \\"abc\\"\\n\\"split(.)[1]\\": \\"a.b.c\\" -> \\"b\\"\\n\\"split(-)[1][0:3]: \\"a1234-b5678-c90\\" -> \\"b56\\"", "type": "string" }, "src": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source attribute evaluated by this dynamic rule" }, "usage": { - "description": "`port_usage` name", + "description": "Port usage name to apply when this dynamic rule matches", "type": "string" } }, @@ -16628,7 +17314,7 @@ ] }, "server_reject_network": { - "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. When radius server reject / fails", + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. When RADIUS server reject / fails", "type": [ "string", "null" @@ -16636,7 +17322,7 @@ }, "speed": { "default": "auto", - "description": "Only if `mode`!=`dynamic`, Port speed, default is auto to automatically negotiate speed enum: `100m`, `10m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`,`auto`", + "description": "Only if `mode`!=`dynamic`. Link speed for this port usage", "enum": [ "10m", "100m", @@ -16653,7 +17339,7 @@ }, "storm_control": { "additionalProperties": false, - "description": "Switch storm control. Only if `mode`!=`dynamic`", + "description": "Only if `mode`!=`dynamic`. Storm-control settings for this port usage", "properties": { "disable_port": { "default": false, @@ -16735,39 +17421,43 @@ }, "type": "object" }, - "description": "Property key is the port usage name. Defines the profiles of port configuration configured on the switch", + "description": "Reusable switch port usage profiles available on this switch", "type": "object" }, "radius_config": { "additionalProperties": false, - "description": "Junos Radius config", + "description": "RADIUS authentication and accounting settings for this switch", "properties": { "acct_immediate_update": { + "description": "Whether immediate RADIUS accounting updates are sent", "type": "boolean" }, "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled", "maximum": 65535, "minimum": 0, "type": "integer" }, "acct_servers": { + "description": "RADIUS accounting servers used by this switch configuration", "items": { "additionalProperties": false, + "description": "RADIUS accounting server settings", "properties": { "host": { - "description": "IP/ hostname of RADIUS server", + "description": "Address or hostname of the RADIUS accounting server", "examples": [ "1.2.3.4" ], "type": "string" }, "keywrap_enabled": { + "description": "Whether RADIUS keywrap is enabled for messages sent to this accounting server", "type": "boolean" }, "keywrap_format": { - "description": "enum: `ascii`, `hex`", + "description": "Encoding format for RADIUS keywrap KEK and MACK values", "enum": [ "ascii", "hex" @@ -16775,12 +17465,14 @@ "type": "string" }, "keywrap_kek": { + "description": "RADIUS keywrap key encryption key (KEK)", "examples": [ "1122334455" ], "type": "string" }, "keywrap_mack": { + "description": "RADIUS keywrap message authentication code key (MACK)", "examples": [ "1122334455" ], @@ -16797,10 +17489,10 @@ "type": "string" } ], - "description": "Radius Auth Port, value from 1 to 65535, default is 1813" + "description": "UDP port used by the RADIUS accounting server" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS accounting server", "examples": [ "testing123" ], @@ -16819,7 +17511,7 @@ }, "auth_server_selection": { "default": "ordered", - "description": "enum: `ordered`, `unordered`", + "description": "Selection strategy for RADIUS authentication servers", "enum": [ "ordered", "unordered" @@ -16827,22 +17519,24 @@ "type": "string" }, "auth_servers": { + "description": "RADIUS authentication servers used by this switch configuration", "items": { "additionalProperties": false, - "description": "Authentication Server", + "description": "RADIUS authentication server settings", "properties": { "host": { - "description": "IP/ hostname of RADIUS server", + "description": "Address or hostname of the RADIUS authentication server", "examples": [ "1.2.3.4" ], "type": "string" }, "keywrap_enabled": { + "description": "Whether RADIUS keywrap is enabled for messages sent to this authentication server", "type": "boolean" }, "keywrap_format": { - "description": "enum: `ascii`, `hex`", + "description": "Encoding format for RADIUS keywrap KEK and MACK values", "enum": [ "ascii", "hex" @@ -16850,12 +17544,14 @@ "type": "string" }, "keywrap_kek": { + "description": "RADIUS keywrap key encryption key (KEK)", "examples": [ "1122334455" ], "type": "string" }, "keywrap_mack": { + "description": "RADIUS keywrap message authentication code key (MACK)", "examples": [ "1122334455" ], @@ -16872,7 +17568,7 @@ "type": "string" } ], - "description": "Radius Auth Port, value from 1 to 65535, default is 1812" + "description": "UDP port used by the RADIUS authentication server" }, "require_message_authenticator": { "default": false, @@ -16880,7 +17576,7 @@ "type": "boolean" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS authentication server", "examples": [ "testing123" ], @@ -16899,16 +17595,17 @@ }, "auth_servers_retries": { "default": 3, - "description": "Radius auth session retries", + "description": "RADIUS auth session retries", "type": "integer" }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout", + "description": "RADIUS auth session timeout", "type": "integer" }, "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled", "type": "boolean" }, "coa_port": { @@ -16922,10 +17619,11 @@ "type": "string" } ], - "description": "Radius CoA Port, value from 1 to 65535, default is 3799" + "description": "UDP port used for RADIUS Change of Authorization (CoA)" }, "fast_dot1x_timers": { "default": false, + "description": "Whether fast 802.1X timers are enabled for RADIUS authentication", "type": "boolean" }, "network": { @@ -16933,7 +17631,7 @@ "type": "string" }, "source_ip": { - "description": "Use `network`or `source_ip`", + "description": "Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic", "type": "string" } }, @@ -16941,9 +17639,11 @@ }, "remote_syslog": { "additionalProperties": false, + "description": "Remote syslog settings for this switch", "properties": { "archive": { "additionalProperties": false, + "description": "Retention settings for generated syslog archive files", "properties": { "files": { "anyOf": [ @@ -16954,11 +17654,13 @@ "type": "integer" } ], + "description": "Number of archived syslog files to retain", "examples": [ 20 ] }, "size": { + "description": "Maximum size of each archived syslog file, such as 5m", "examples": [ "5m" ], @@ -16968,6 +17670,7 @@ "type": "object" }, "cacerts": { + "description": "CA certificates used to verify TLS syslog servers", "examples": [ [ "-----BEGIN CERTIFICATE-----\\\\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\\\\n-----END CERTIFICATE-----", @@ -16981,16 +17684,21 @@ }, "console": { "additionalProperties": false, + "description": "Log forwarding filters for console messages sent to remote syslog", "properties": { "contents": { + "description": "Syslog facilities and severities forwarded from console logs", "items": { "additionalProperties": false, + "description": "Syslog message content selector for remote logging", "properties": { "facility": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Syslog facility to match for this selector" }, "severity": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Syslog severity to match for this selector" } }, "type": "object" @@ -17002,19 +17710,25 @@ }, "enabled": { "default": false, + "description": "Whether remote syslog forwarding is enabled", "type": "boolean" }, "files": { + "description": "Local syslog file definitions to generate and forward", "items": { "additionalProperties": false, + "description": "Generated syslog file output settings", "properties": { "archive": { "additionalProperties": false, + "description": "Retention settings for this generated syslog file", "properties": { "files": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Number of archived syslog files to retain" }, "size": { + "description": "Maximum size of each archived syslog file, such as 5m", "examples": [ "5m" ], @@ -17024,31 +17738,36 @@ "type": "object" }, "contents": { + "description": "Syslog facilities and severities written to this file", "items": { "$comment": "max depth reached" }, "type": "array" }, "enable_tls": { - "description": "Only if `protocol`==`tcp`", + "description": "Only if `protocol`==`tcp`, enable TLS for this syslog file destination", "type": "boolean" }, "explicit_priority": { + "description": "Whether to include explicit syslog priority values in file output", "type": "boolean" }, "file": { + "description": "Generated syslog file name", "examples": [ "file-name" ], "type": "string" }, "match": { + "description": "Expression used to filter log messages written to this file", "examples": [ "!alarm|ntp|errors.crc_error[chan]" ], "type": "string" }, "structured_data": { + "description": "Whether to include structured syslog data in file output", "type": "boolean" } }, @@ -17057,7 +17776,7 @@ "type": "array" }, "network": { - "description": "If source_address is configured, will use the vlan firstly otherwise use source_ip", + "description": "Source network used for syslog traffic. If `source_address` is configured, Mist uses the VLAN first; otherwise it uses `source_ip`", "examples": [ "default" ], @@ -17065,9 +17784,11 @@ }, "send_to_all_servers": { "default": false, + "description": "Whether each log entry is sent to all configured remote syslog servers", "type": "boolean" }, "servers": { + "description": "Remote syslog server destinations", "examples": [ [ { @@ -17082,19 +17803,22 @@ ], "items": { "additionalProperties": false, + "description": "Remote syslog server destination settings", "properties": { "contents": { + "description": "Syslog facilities and severities sent to this server", "items": { "$comment": "max depth reached" }, "type": "array" }, "explicit_priority": { + "description": "Whether to include explicit syslog priority values in messages sent to this server", "type": "boolean" }, "facility": { "default": "any", - "description": "enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`", + "description": "Default syslog facility for messages sent to this server", "enum": [ "any", "authorization", @@ -17119,12 +17843,14 @@ "type": "string" }, "host": { + "description": "Address or hostname of the remote syslog server", "examples": [ "syslogd.internal" ], "type": "string" }, "match": { + "description": "Expression used to filter log messages sent to this server", "examples": [ "!alarm|ntp|errors.crc_error[chan]" ], @@ -17142,11 +17868,11 @@ "type": "string" } ], - "description": "Syslog Service Port, value from 1 to 65535" + "description": "Network port used by the remote syslog server" }, "protocol": { "default": "udp", - "description": "enum: `tcp`, `udp`", + "description": "Transport protocol used for this remote syslog server", "enum": [ "tcp", "udp" @@ -17154,13 +17880,14 @@ "type": "string" }, "routing_instance": { + "description": "Routing instance used to reach this remote syslog server", "examples": [ "routing-instance-name" ], "type": "string" }, "server_name": { - "description": "Name of the server", + "description": "TLS server name used when verifying the remote syslog server certificate", "examples": [ "syslogd.internal" ], @@ -17168,7 +17895,7 @@ }, "severity": { "default": "any", - "description": "enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`", + "description": "Default syslog severity for messages sent to this server", "enum": [ "alert", "any", @@ -17182,13 +17909,15 @@ "type": "string" }, "source_address": { - "description": "If source_address is configured, will use the vlan firstly otherwise use source_ip", + "description": "Source address for syslog traffic. If configured, Mist uses the VLAN first; otherwise it uses `source_ip`", "type": "string" }, "structured_data": { + "description": "Whether to include structured syslog data in messages sent to this server", "type": "boolean" }, "tag": { + "description": "Syslog tag value added to messages sent to this server", "type": "string" } }, @@ -17197,7 +17926,7 @@ "type": "array" }, "time_format": { - "description": "enum: `millisecond`, `year`, `year millisecond`", + "description": "Timestamp format used in forwarded syslog messages", "enum": [ "millisecond", "year", @@ -17209,22 +17938,27 @@ "type": "string" }, "users": { + "description": "User-specific syslog logging rules", "items": { "additionalProperties": false, + "description": "User-specific syslog logging rule", "properties": { "contents": { + "description": "Syslog facilities and severities logged for this user rule", "items": { "$comment": "max depth reached" }, "type": "array" }, "match": { + "description": "Expression used to filter user log messages", "examples": [ "\\"!alarm|ntp|errors.crc_error[chan]\\"" ], "type": "string" }, "user": { + "description": "Account name or wildcard matched by this syslog rule", "examples": [ "*" ], @@ -17239,6 +17973,7 @@ "type": "object" }, "role": { + "description": "Deployment role label for this switch", "type": "string" }, "router_id": { @@ -17251,19 +17986,24 @@ "routing_policies": { "additionalProperties": { "additionalProperties": false, + "description": "Switch routing policy made of ordered match-action terms", "properties": { "terms": { - "description": "at least criteria/filter must be specified to match the term, all criteria have to be met", + "description": "Ordered terms evaluated by this switch routing policy", "items": { "additionalProperties": false, + "description": "Switch routing policy term with match criteria and actions", "properties": { "actions": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Policy actions applied when this routing policy term matches" }, "matching": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Route match criteria that must be satisfied before actions are applied" }, "name": { + "description": "Display name of the switch routing policy term", "type": "string" } }, @@ -17279,15 +18019,16 @@ }, "type": "object" }, - "description": "Property key is the routing policy name", + "description": "Routing policies applied by this switch", "type": "object" }, "serial": { - "description": "Device Serial", + "description": "Manufacturer serial number for the switch", "readOnly": true, "type": "string" }, "site_id": { + "description": "Site where this switch is assigned", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -17297,18 +18038,23 @@ }, "snmp_config": { "additionalProperties": false, + "description": "SNMP configuration for this switch", "properties": { "client_list": { + "description": "SNMP client allowlists that can be referenced by communities", "items": { "additionalProperties": false, + "description": "SNMP client allowlist definition", "properties": { "client_list_name": { + "description": "Name of the SNMP client list", "examples": [ "clist-1" ], "type": "string" }, "clients": { + "description": "SNMP client IP addresses or CIDR ranges allowed by this list", "items": { "examples": [ "151.140.101.218/32" @@ -17323,12 +18069,14 @@ "type": "array" }, "contact": { + "description": "Administrative contact string advertised through SNMP", "examples": [ "cns@juniper.net" ], "type": "string" }, "description": { + "description": "Device description string advertised through SNMP", "examples": [ "Juniper QFX Series Switch - 1K_5LA" ], @@ -17336,15 +18084,17 @@ }, "enabled": { "default": true, + "description": "Whether SNMP is enabled", "type": "boolean" }, "engine_id": { + "description": "SNMP engine ID used for SNMPv3", "maxLength": 27, "type": "string" }, "engine_id_type": { "default": "local", - "description": "enum: `local`, `use_mac_address`", + "description": "Method used to derive the SNMP engine ID", "enum": [ "local", "use_mac_address" @@ -17352,12 +18102,14 @@ "type": "string" }, "location": { + "description": "Physical location string advertised through SNMP", "examples": [ "Las Vegas, NV" ], "type": "string" }, "name": { + "description": "System name advertised through SNMP", "examples": [ "TGH-1K-QFX10K" ], @@ -17365,13 +18117,17 @@ }, "network": { "default": "default", + "description": "Management network used for SNMP traffic", "type": "string" }, "trap_groups": { + "description": "SNMP trap group definitions", "items": { "additionalProperties": false, + "description": "SNMP trap group definition", "properties": { "categories": { + "description": "Trap categories included in this SNMP trap group", "items": { "examples": [ "authentication" @@ -17381,13 +18137,14 @@ "type": "array" }, "group_name": { - "description": "Categories list can refer to https://www.juniper.net/documentation/software/topics/task/configuration/snmp_trap-groups-configuring-junos-nm.html", + "description": "Trap group name for this SNMP trap group", "examples": [ "profiler" ], "type": "string" }, "targets": { + "description": "Trap target addresses for this SNMP trap group", "items": { "examples": [ "172.29.158.19" @@ -17398,7 +18155,7 @@ }, "version": { "default": "v2", - "description": "enum: `all`, `v1`, `v2`", + "description": "SNMP trap protocol version used by this group", "enum": [ "all", "v1", @@ -17412,30 +18169,34 @@ "type": "array" }, "v2c_config": { + "description": "SNMPv2c community configuration entries for this SNMP profile", "items": { "additionalProperties": false, + "description": "SNMPv2c community configuration entry", "properties": { "authorization": { + "description": "Access level for the SNMPv2c community", "examples": [ "read-only" ], "type": "string" }, "client_list_name": { - "description": "Client_list_name here should refer to client_list above", + "description": "SNMP client list name referenced by this community", "examples": [ "clist-1" ], "type": "string" }, "community_name": { + "description": "SNMPv2c community string name", "examples": [ "abc123" ], "type": "string" }, "view": { - "description": "View name here should be defined in views above", + "description": "SNMP view name that must be defined in the views list", "examples": [ "all" ], @@ -17448,19 +18209,25 @@ }, "v3_config": { "additionalProperties": false, + "description": "SNMPv3 user, VACM, notify, and target configuration", "properties": { "notify": { + "description": "SNMPv3 notification definitions used for traps and informs", "items": { "additionalProperties": false, + "description": "SNMPv3 notification definition for traps or informs", "properties": { "name": { + "description": "Identifier for this SNMPv3 notification definition", "type": "string" }, "tag": { + "description": "Notification tag used to select target addresses", "type": "string" }, "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Delivery mode for this SNMPv3 notification, such as trap or inform" } }, "type": "object" @@ -17468,13 +18235,17 @@ "type": "array" }, "notify_filter": { + "description": "SNMPv3 notification filter profiles", "items": { "additionalProperties": false, + "description": "SNMPv3 notification filter profile", "properties": { "contents": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "OID filter rules in this notification filter profile" }, "profile_name": { + "description": "Notification filter profile name", "type": "string" } }, @@ -17483,16 +18254,20 @@ "type": "array" }, "target_address": { + "description": "SNMPv3 notification target addresses", "items": { "additionalProperties": false, + "description": "SNMPv3 notification target address entry", "properties": { "address": { + "description": "IP address or hostname of the SNMP target", "examples": [ "10.11.0.2" ], "type": "string" }, "address_mask": { + "description": "Mask applied to the SNMP target address", "examples": [ "255.255.255.0" ], @@ -17500,23 +18275,25 @@ }, "port": { "default": "161", + "description": "UDP port used by the SNMP target", "type": [ "string", "null" ] }, "tag_list": { - "description": "Refer to notify tag, can be multiple with blank", + "description": "Set of notification tags for this target address; use spaces between multiple tags", "type": "string" }, "target_address_name": { + "description": "Name of the SNMP target address entry", "examples": [ "target_address_name" ], "type": "string" }, "target_parameters": { - "description": "Refer to notify target parameters name", + "description": "Target parameter profile referenced by this target address", "type": "string" } }, @@ -17525,27 +18302,33 @@ "type": "array" }, "target_parameters": { + "description": "SNMPv3 target parameter profiles", "items": { "additionalProperties": false, + "description": "SNMPv3 target parameter profile", "properties": { "message_processing_model": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMP message processing model used by this target parameter profile" }, "name": { + "description": "Target parameter profile name", "type": "string" }, "notify_filter": { - "description": "Refer to profile-name in notify_filter", + "description": "Notification filter profile referenced by this target parameter profile", "type": "string" }, "security_level": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Required security level for this target parameter profile" }, "security_model": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Required security model for this target parameter profile" }, "security_name": { - "description": "Refer to security_name in usm", + "description": "USM security name referenced by this target parameter profile", "examples": [ "m01620" ], @@ -17557,11 +18340,14 @@ "type": "array" }, "usm": { + "description": "SNMPv3 USM engine configurations", "items": { "additionalProperties": false, + "description": "SNMPv3 User-based Security Model configuration", "properties": { "engine_type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMP engine type used for this USM configuration" }, "remote_engine_id": { "description": "Required only if `engine_type`==`remote_engine`", @@ -17571,7 +18357,8 @@ "type": "string" }, "users": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMPv3 USM users for this engine" } }, "type": "object" @@ -17580,8 +18367,10 @@ }, "vacm": { "additionalProperties": false, + "description": "SNMPv3 VACM access control configuration", "properties": { "access": { + "description": "VACM access rules for SNMPv3", "items": { "$comment": "max depth reached" }, @@ -17589,12 +18378,15 @@ }, "security_to_group": { "additionalProperties": false, + "description": "VACM security-name to group mappings", "properties": { "content": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "VACM security-name to group mapping entries" }, "security_model": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Required security model for these VACM group mappings" } }, "type": "object" @@ -17606,20 +18398,24 @@ "type": "object" }, "views": { + "description": "SNMP MIB view definitions", "items": { "additionalProperties": false, + "description": "SNMP MIB view definition", "properties": { "include": { - "description": "If the root oid configured is included", + "description": "Whether the root OID is included in this SNMP view", "type": "boolean" }, "oid": { + "description": "Root OID for this SNMP view", "examples": [ "1.3.6.1" ], "type": "string" }, "view_name": { + "description": "Name of the SNMP MIB view definition", "examples": [ "all" ], @@ -17635,6 +18431,7 @@ }, "stp_config": { "additionalProperties": false, + "description": "Spanning Tree Protocol configuration for this switch", "properties": { "bridge_priority": { "default": "32k", @@ -17649,11 +18446,11 @@ }, "switch_mgmt": { "additionalProperties": false, - "description": "Switch Management settings", + "description": "Management-plane settings for this switch", "properties": { "ap_affinity_threshold": { "default": 10, - "description": "AP_affinity_threshold ap_affinity_threshold can be added as a field under site/setting. By default, this value is set to 12. If the field is set in both site/setting and org/setting, the value from site/setting will be used.", + "description": "AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used.", "type": "integer" }, "cli_banner": { @@ -17682,17 +18479,21 @@ "type": "boolean" }, "disable_oob_down_alarm": { + "description": "Whether to suppress alarms when the switch out-of-band management interface is down", "type": "boolean" }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the switch", "type": "boolean" }, "local_accounts": { "additionalProperties": { "additionalProperties": false, + "description": "Local switch user account credentials and access role", "properties": { "password": { + "description": "Local password for the switch user account", "examples": [ "Juniper123" ], @@ -17701,7 +18502,7 @@ }, "role": { "default": "none", - "description": "enum: `admin`, `helpdesk`, `none`, `read`", + "description": "Access role granted to the local switch user account", "enum": [ "admin", "helpdesk", @@ -17713,11 +18514,11 @@ }, "type": "object" }, - "description": "Property key is the user name. For Local user authentication", + "description": "Local switch user accounts keyed by username", "type": "object" }, "mxedge_proxy_host": { - "description": "IP Address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud", + "description": "IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud", "type": "string" }, "mxedge_proxy_port": { @@ -17732,14 +18533,14 @@ "type": "string" } ], - "description": "Mist Edge port used to proxy the switch management traffic to the Mist Cloud. Value in range 1-65535" + "description": "Mist Edge proxy port used for switch management traffic" }, "protect_re": { "additionalProperties": false, - "description": "Restrict inbound-traffic to host\\nwhen enabled, all traffic that is not essential to our operation will be dropped \\ne.g. ntp / dns / traffic to mist will be allowed by default, if dhcpd is enabled, we'll make sure it works", + "description": "Control-plane protection settings for the switch", "properties": { "allowed_services": { - "description": "Optionally, services we'll allow", + "description": "Built-in services explicitly allowed by the Protect RE policy", "examples": [ [ "icmp", @@ -17747,7 +18548,7 @@ ] ], "items": { - "description": "enum: `icmp`, `ssh`", + "description": "Services allowed through protect-RE filters. enum: `icmp`, `ssh`", "enum": [ "icmp", "ssh" @@ -17757,9 +18558,10 @@ "type": "array" }, "custom": { + "description": "Additional ACL entries allowed by the Protect RE policy", "items": { "additionalProperties": false, - "description": "Custom acls", + "description": "Custom Protect RE ACL entry", "properties": { "port_range": { "default": "0", @@ -17770,10 +18572,12 @@ "type": "string" }, "protocol": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Transport protocol matched by this custom Protect RE ACL" }, "subnets": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source subnets matched by this custom Protect RE ACL" } }, "type": "object" @@ -17791,7 +18595,7 @@ "type": "boolean" }, "trusted_hosts": { - "description": "host/subnets we'll allow traffic to/from", + "description": "Trusted host or subnet entries allowed by the Protect RE policy", "items": { "examples": [ "10.242.3.0/24" @@ -17805,26 +18609,29 @@ }, "radius": { "additionalProperties": false, - "description": "By default, `radius_config` will be used. if a different one has to be used set `use_different_radius", + "description": "Management authentication settings using RADIUS", "properties": { "enabled": { + "description": "Whether RADIUS is enabled for switch management authentication", "type": "boolean" }, "radius_config": { "additionalProperties": false, - "description": "Junos Radius config", + "description": "RADIUS configuration used when alternate RADIUS settings are required", "properties": { "acct_immediate_update": { + "description": "Whether immediate RADIUS accounting updates are sent", "type": "boolean" }, "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled", "maximum": 65535, "minimum": 0, "type": "integer" }, "acct_servers": { + "description": "RADIUS accounting servers used by this switch configuration", "items": { "$comment": "max depth reached" }, @@ -17833,7 +18640,7 @@ }, "auth_server_selection": { "default": "ordered", - "description": "enum: `ordered`, `unordered`", + "description": "Selection strategy for RADIUS authentication servers", "enum": [ "ordered", "unordered" @@ -17841,6 +18648,7 @@ "type": "string" }, "auth_servers": { + "description": "RADIUS authentication servers used by this switch configuration", "items": { "$comment": "max depth reached" }, @@ -17849,16 +18657,17 @@ }, "auth_servers_retries": { "default": 3, - "description": "Radius auth session retries", + "description": "RADIUS auth session retries", "type": "integer" }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout", + "description": "RADIUS auth session timeout", "type": "integer" }, "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled", "type": "boolean" }, "coa_port": { @@ -17872,10 +18681,11 @@ "type": "string" } ], - "description": "Radius CoA Port, value from 1 to 65535, default is 3799" + "description": "UDP port used for RADIUS Change of Authorization (CoA)" }, "fast_dot1x_timers": { "default": false, + "description": "Whether fast 802.1X timers are enabled for RADIUS authentication", "type": "boolean" }, "network": { @@ -17883,13 +18693,14 @@ "type": "string" }, "source_ip": { - "description": "Use `network`or `source_ip`", + "description": "Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic", "type": "string" } }, "type": "object" }, "use_different_radius": { + "description": "Selector for alternate RADIUS settings instead of the default switch `radius_config`", "type": "string" } }, @@ -17901,28 +18712,36 @@ "type": "boolean" }, "root_password": { + "description": "Root password for local switch access", "format": "password", "type": "string" }, "tacacs": { "additionalProperties": false, + "description": "Management authentication settings using TACACS+", "properties": { "acct_servers": { + "description": "TACACS+ accounting servers used for switch management sessions", "items": { "additionalProperties": false, + "description": "TACACS+ accounting server settings", "properties": { "host": { + "description": "Address or hostname of the TACACS+ accounting server", "type": "string" }, "port": { + "description": "TCP port used by the TACACS+ accounting server", "type": "string" }, "secret": { + "description": "Shared secret used with this TACACS+ accounting server", "format": "password", "type": "string" }, "timeout": { "default": 10, + "description": "TACACS+ accounting server timeout, in seconds", "type": "integer" } }, @@ -17932,7 +18751,7 @@ }, "default_role": { "default": "none", - "description": "enum: `admin`, `helpdesk`, `none`, `read`", + "description": "Default switch-management role to use for TACACS+ logins", "enum": [ "admin", "helpdesk", @@ -17942,28 +18761,35 @@ "type": "string" }, "enabled": { + "description": "Whether TACACS+ is enabled for switch management authentication", "type": "boolean" }, "network": { - "description": "Which network the TACACS server resides", + "description": "Source network used for connectivity to the TACACS+ servers", "type": "string" }, "tacplus_servers": { + "description": "TACACS+ authentication servers used for switch management logins", "items": { "additionalProperties": false, + "description": "TACACS+ authentication server settings", "properties": { "host": { + "description": "Address or hostname of the TACACS+ authentication server", "type": "string" }, "port": { + "description": "TCP port used by the TACACS+ authentication server", "type": "string" }, "secret": { + "description": "Shared secret used with this TACACS+ authentication server", "format": "password", "type": "string" }, "timeout": { "default": 10, + "description": "TACACS+ authentication server timeout, in seconds", "type": "integer" } }, @@ -17975,14 +18801,14 @@ "type": "object" }, "use_mxedge_proxy": { - "description": "To use mxedge as proxy", + "description": "Whether to use Mist Edge as a proxy for switch management traffic", "type": "boolean" } }, "type": "object" }, "type": { - "description": "Device Type. enum: `switch`", + "description": "Device type discriminator for switch records", "enum": [ "switch" ], @@ -17998,7 +18824,7 @@ "additionalProperties": { "type": "string" }, - "description": "Dictionary of name->value, the vars can then be used in Wlans. This can overwrite those from Site Vars", + "description": "Variable values that override site variables for this switch", "examples": [ { "RADIUS_IP1": "172.31.2.5", @@ -18009,25 +18835,27 @@ }, "virtual_chassis": { "additionalProperties": false, - "description": "Required for preprovisioned Virtual Chassis", + "description": "Virtual Chassis membership and provisioning settings for this switch", "properties": { "members": { - "description": "List of Virtual Chassis members", + "description": "Virtual Chassis members and their expected roles", "items": { "additionalProperties": false, + "description": "Virtual Chassis member identified by MAC address and role", "properties": { "mac": { - "description": "fpc0, same as the mac of device_id", + "description": "Virtual Chassis member MAC address; for FPC0 this matches the device ID MAC", "examples": [ "aff827549235" ], "type": "string" }, "member_id": { + "description": "Virtual Chassis member identifier", "type": "integer" }, "vc_role": { - "description": "Both vc_role master and backup will be matched to routing-engine role in Junos preprovisioned VC config. enum: `backup`, `linecard`, `master`", + "description": "Role of this member in the Virtual Chassis", "enum": [ "backup", "linecard", @@ -18055,6 +18883,7 @@ }, "vrf_config": { "additionalProperties": false, + "description": "VRF configuration applied to this switch", "properties": { "enabled": { "description": "Whether to enable VRF (when supported on the device)", @@ -18066,6 +18895,7 @@ "vrf_instances": { "additionalProperties": { "additionalProperties": false, + "description": "Switch VRF instance routing and network membership settings", "examples": [ { "extra_routes": { @@ -18082,12 +18912,15 @@ "aggregate_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Aggregate route configuration for a network or routing instance", "properties": { "discard": { "default": false, + "description": "Whether to install the aggregate route as a discard route", "type": "boolean" }, "metric": { + "description": "Routing metric assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -18096,6 +18929,7 @@ ] }, "preference": { + "description": "Route preference assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -18106,7 +18940,7 @@ }, "type": "object" }, - "description": "Property key is the destination subnet (e.g. \\"172.16.3.0/24\\")", + "description": "IPv4 aggregate routes configured for this VRF instance", "examples": [ { "172.16.3.0/24": { @@ -18121,12 +18955,15 @@ "aggregate_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Aggregate route configuration for a network or routing instance", "properties": { "discard": { "default": false, + "description": "Whether to install the aggregate route as a discard route", "type": "boolean" }, "metric": { + "description": "Routing metric assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -18135,6 +18972,7 @@ ] }, "preference": { + "description": "Route preference assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -18145,7 +18983,7 @@ }, "type": "object" }, - "description": "Property key is the destination subnet (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "IPv6 aggregate routes configured for this VRF instance", "example": { "2a02:1234:420a:10c9::/64": { "discard": false, @@ -18156,27 +18994,30 @@ "type": "object" }, "evpn_auto_loopback_subnet": { + "description": "IPv4 subnet used for automatic EVPN loopback addresses in this VRF instance", "examples": [ "100.101.0.0/24" ], "type": "string" }, "evpn_auto_loopback_subnet6": { + "description": "IPv6 subnet used for automatic EVPN loopback addresses in this VRF instance", "type": "string" }, "extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv4 static route for a VRF instance", "properties": { "via": { - "description": "Next-hop address", + "description": "IPv4 next-hop address for this VRF extra route", "format": "ipv4", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"10.0.0.0/8\\")", + "description": "Additional IPv4 static routes configured for this VRF instance", "examples": [ { "0.0.0.0/0": { @@ -18189,16 +19030,17 @@ "extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv6 static route for a VRF instance", "properties": { "via": { - "description": "Next-hop address", + "description": "IPv6 next-hop address for this VRF extra route", "format": "ipv6", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "Additional IPv6 static routes configured for this VRF instance", "examples": [ { "2a02:1234:420a:10c9::/64": { @@ -18209,6 +19051,7 @@ "type": "object" }, "networks": { + "description": "Names of switch networks included in this VRF instance", "items": { "type": "string" }, @@ -18218,7 +19061,7 @@ }, "type": "object" }, - "description": "Property key is the network name", + "description": "VRF instances configured on this switch", "examples": [ { "guest": { @@ -18237,14 +19080,16 @@ }, "vrrp_config": { "additionalProperties": false, - "description": "Junos VRRP config", + "description": "VRRP configuration applied to this switch", "properties": { "enabled": { + "description": "Whether VRRP configuration is enabled", "type": "boolean" }, "groups": { "additionalProperties": { "additionalProperties": false, + "description": "VRRP group behavior settings", "properties": { "preempt": { "default": false, @@ -18252,19 +19097,20 @@ "type": "boolean" }, "priority": { + "description": "VRRP priority for this router in the group", "type": "integer" } }, "type": "object" }, - "description": "Property key is the VRRP name", + "description": "VRRP groups keyed by group name", "type": "object" } }, "type": "object" }, "x": { - "description": "X in pixel", + "description": "Horizontal map position of the switch, in pixels", "examples": [ 53.5 ], @@ -18272,7 +19118,7 @@ "type": "number" }, "y": { - "description": "Y in pixel", + "description": "Vertical map position of the switch, in pixels", "examples": [ 173.1 ], @@ -18290,10 +19136,10 @@ "site_device_gateway": { "schema": { "additionalProperties": false, - "description": "Device gateway", + "description": "Gateway configuration and placement data", "properties": { "additional_config_cmds": { - "description": "additional CLI commands to append to the generated Junos config. **Note**: no check is done", + "description": "Additional CLI configuration commands to apply to this gateway", "items": { "description": "JUNOS \\"set\\" command to add to the generated configuration", "examples": [ @@ -18306,7 +19152,7 @@ "bgp_config": { "additionalProperties": { "additionalProperties": false, - "description": "BFD is enabled when either bfd_minimum_interval or bfd_multiplier is configured", + "description": "BGP session configuration. BFD is enabled when either bfd_minimum_interval or bfd_multiplier is configured", "properties": { "auth_key": { "description": "Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`", @@ -18338,6 +19184,7 @@ "type": "boolean" }, "export": { + "description": "Routing policy applied to routes exported by this BGP session", "type": "string" }, "export_policy": { @@ -18363,6 +19210,7 @@ "type": "integer" }, "import": { + "description": "Routing policy applied to routes imported by this BGP session", "type": "string" }, "import_policy": { @@ -18380,7 +19228,7 @@ "type": "integer" } ], - "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. BGP AS, value in range 1-4294967295", + "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; local BGP Autonomous System (AS) number", "examples": [ 65000 ] @@ -18396,7 +19244,7 @@ "type": "integer" } ], - "description": "BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}` )", + "description": "Default BGP neighbor Autonomous System (AS) number for this session", "examples": [ 65000 ] @@ -18404,6 +19252,7 @@ "neighbors": { "additionalProperties": { "additionalProperties": false, + "description": "Per-neighbor BGP session settings", "properties": { "disabled": { "default": false, @@ -18411,15 +19260,18 @@ "type": "boolean" }, "export_policy": { + "description": "Export policy applied only to this BGP neighbor", "type": "string" }, "hold_time": { "default": 90, + "description": "BGP hold time for this neighbor, in seconds", "maximum": 65535, "minimum": 0, "type": "integer" }, "import_policy": { + "description": "Import policy applied only to this BGP neighbor", "type": "string" }, "multihop_ttl": { @@ -18439,14 +19291,14 @@ "type": "integer" } ], - "description": "BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}` )", + "description": "Autonomous System (AS) number of this BGP neighbor", "examples": [ 65000 ] }, "tunnel_via": { "default": "primary", - "description": "If `via`==`tunnel`, specifies which tunnel (primary/secondary) this neighbor is associated with. enum: `primary`, `secondary`", + "description": "If `via`==`tunnel`, primary or secondary tunnel associated with this BGP neighbor", "enum": [ "primary", "secondary" @@ -18463,7 +19315,7 @@ "type": "object" }, "networks": { - "description": "Optional if `via`==`lan`. List of networks where we expect BGP neighbor to connect to/from", + "description": "Optional if `via`==`lan`; networks where BGP neighbors can connect to or from", "items": { "type": "string" }, @@ -18480,11 +19332,11 @@ "type": "boolean" }, "tunnel_name": { - "description": "Optional if `via`==`tunnel`", + "description": "Optional if `via`==`tunnel`; tunnel name used for this BGP session", "type": "string" }, "type": { - "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. enum: `external`, `internal`", + "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; BGP session type, internal or external", "enum": [ "external", "internal" @@ -18494,7 +19346,7 @@ }, "via": { "default": "lan", - "description": "enum: `lan`, `tunnel`, `vpn`, `wan`", + "description": "Transport used for this BGP session, such as LAN, tunnel, VPN, or WAN", "enum": [ "lan", "tunnel", @@ -18504,11 +19356,11 @@ "type": "string" }, "vpn_name": { - "description": "Optional if `via`==`vpn`", + "description": "Optional if `via`==`vpn`; VPN name used for this BGP session", "type": "string" }, "wan_name": { - "description": "Optional if `via`==`wan`", + "description": "Optional if `via`==`wan`; WAN interface name used for this BGP session", "type": "string" } }, @@ -18517,15 +19369,17 @@ ], "type": "object" }, + "description": "BGP routing configuration for this gateway. Property key is the BGP session name", "type": "object" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the gateway object was created", "format": "double", "readOnly": true, "type": "number" }, "deviceprofile_id": { + "description": "Device profile associated with this gateway", "format": "uuid", "readOnly": true, "type": "string" @@ -18533,9 +19387,10 @@ "dhcpd_config": { "additionalProperties": { "additionalProperties": false, + "description": "DHCP server or relay configuration for one network", "properties": { "dns_servers": { - "description": "If `type`==`local` or `type6`==`local` - optional, if not defined, system one will be used", + "description": "If `type`==`local` or `type6`==`local`, DNS servers advertised to DHCP clients", "examples": [ [ "8.8.8.8", @@ -18549,7 +19404,7 @@ "type": "array" }, "dns_suffix": { - "description": "If `type`==`local` or `type6`==`local` - optional, if not defined, system one will be used", + "description": "If `type`==`local` or `type6`==`local`, DNS search suffixes advertised to DHCP clients", "examples": [ [ ".mist.local", @@ -18564,26 +19419,30 @@ "fixed_bindings": { "additionalProperties": { "additionalProperties": false, + "description": "Static DHCP binding for a client MAC address", "properties": { "ip": { + "description": "Reserved IPv4 address for this fixed DHCP binding", "examples": [ "192.168.70.35" ], "type": "string" }, "ip6": { + "description": "Reserved IPv6 address for this fixed DHCP binding", "examples": [ "2607:f8b0:4005:808::2" ], "type": "string" }, "name": { + "description": "Friendly name for this fixed DHCP binding", "type": "string" } }, "type": "object" }, - "description": "If `type`==`local` or `type6`==`local`. Property key is the MAC Address. Format is `[0-9a-f]{12}` (e.g. \\"5684dae9ac8b\\")", + "description": "If `type`==`local` or `type6`==`local`, fixed client bindings for local DHCP service", "examples": [ { "5684dae9ac8b": { @@ -18602,28 +19461,28 @@ "type": "string" }, "ip6_end": { - "description": "If `type6`==`local`", + "description": "If `type6`==`local`, ending IPv6 address for the DHCP lease pool", "examples": [ "2607:f8b0:4005:808::ff" ], "type": "string" }, "ip6_start": { - "description": "If `type6`==`local`", + "description": "If `type6`==`local`, starting IPv6 address for the DHCP lease pool", "examples": [ "2607:f8b0:4005:808::2" ], "type": "string" }, "ip_end": { - "description": "If `type`==`local`", + "description": "If `type`==`local`, ending IPv4 address for the DHCP lease pool", "examples": [ "192.168.70.200" ], "type": "string" }, "ip_start": { - "description": "If `type`==`local`", + "description": "If `type`==`local`, starting IPv4 address for the DHCP lease pool", "examples": [ "192.168.70.100" ], @@ -18639,17 +19498,20 @@ "options": { "additionalProperties": { "additionalProperties": false, + "description": "Custom DHCP option value", "properties": { "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Data type used to encode this DHCP option value" }, "value": { + "description": "Option value to send for this DHCP option", "type": "string" } }, "type": "object" }, - "description": "If `type`==`local` or `type6`==`local`. Property key is the DHCP option number", + "description": "If `type`==`local` or `type6`==`local`, custom DHCP options advertised to clients", "type": "object" }, "server_id_override": { @@ -18658,7 +19520,7 @@ "type": "boolean" }, "servers": { - "description": "If `type`==`relay`", + "description": "If `type`==`relay`, upstream IPv4 DHCP servers", "examples": [ [ "11.2.3.4" @@ -18670,7 +19532,7 @@ "type": "array" }, "serversv6": { - "description": "If `type6`==`relay`", + "description": "If `type6`==`relay`, upstream IPv6 DHCP servers", "examples": [ [ "2607:f8b0:4005:808::64" @@ -18683,7 +19545,7 @@ }, "type": { "default": "local", - "description": "enum: `local` (DHCP Server), `none`, `relay` (DHCP Relay)", + "description": "IPv4 DHCP mode for this network", "enum": [ "local", "none", @@ -18693,7 +19555,7 @@ }, "type6": { "default": "none", - "description": "enum: `local` (DHCP Server), `none`, `relay` (DHCP Relay)", + "description": "IPv6 DHCP mode for this network", "enum": [ "local", "none", @@ -18704,22 +19566,26 @@ "vendor_encapsulated": { "additionalProperties": { "additionalProperties": false, + "description": "Vendor-encapsulated DHCP option value", "properties": { "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Data type used to encode this vendor option value" }, "value": { + "description": "Option value to send for this vendor option", "type": "string" } }, "type": "object" }, - "description": "If `type`==`local` or `type6`==`local`. Property key is :, with\\n * enterprise number: 1-65535 (https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers)\\n * sub option code: 1-255, sub-option code", + "description": "If `type`==`local` or `type6`==`local`, vendor-encapsulated DHCP options advertised to clients", "type": "object" } }, "type": "object" }, + "description": "DHCP server configuration served by this gateway", "properties": { "enabled": { "default": true, @@ -18730,14 +19596,14 @@ "type": "object" }, "dns_servers": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS servers configured for this gateway", "items": { "type": "string" }, "type": "array" }, "dns_suffix": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS search suffixes configured for this gateway", "items": { "type": "string" }, @@ -18746,29 +19612,33 @@ "extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway IPv4 extra route next-hop settings", "properties": { "via": { + "description": "Next-hop IPv4 address for the gateway extra route", "format": "ipv4", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"10.0.0.0/8\\"), the destination Network name or a variable (e.g. \\"{{myvar}}\\")", + "description": "Additional IPv4 routes configured on this gateway", "type": "object" }, "extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway IPv6 extra route next-hop settings", "properties": { "via": { + "description": "Next-hop IPv6 address for the gateway extra route", "format": "ipv6", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"2a02:1234:420a:10c9::/64\\"), the destination Network name or a variable (e.g. \\"{{myvar}}\\")", + "description": "Additional IPv6 routes configured on this gateway", "examples": [ { "2a02:1234:420a:10c9::/64": { @@ -18779,15 +19649,16 @@ "type": "object" }, "for_site": { + "description": "Whether the gateway configuration is scoped directly to a site", "readOnly": true, "type": "boolean" }, "gateway_mgmt": { "additionalProperties": false, - "description": "Gateway Management settings", + "description": "Management-plane settings for this gateway", "properties": { "admin_sshkeys": { - "description": "For SSR only, as direct root access is not allowed", + "description": "SSR-only SSH public keys for administrative access", "examples": [ [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA...Wxa6p6UW0ZbcP john@host" @@ -18800,9 +19671,10 @@ }, "app_probing": { "additionalProperties": false, + "description": "Application probing configuration for gateway monitoring", "properties": { "apps": { - "description": "APp-keys from [List Applications](/#operations/listApplications)", + "description": "Predefined application keys to probe", "examples": [ [ "facebook" @@ -18814,54 +19686,63 @@ "type": "array" }, "custom_apps": { + "description": "User-defined application probe definitions", "items": { "additionalProperties": false, + "description": "User-defined application probe definition", "properties": { "address": { - "description": "Required if `protocol`==`icmp`", + "description": "Required if `protocol`==`icmp`. IP address probed by the ICMP custom app", "examples": [ "192.168.1.1" ], "type": "string" }, "app_type": { + "description": "Category label used for this custom application probe", "type": "string" }, "hostnames": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "If `protocol`==`http`. Hostnames or URLs probed by this custom app" }, "key": { + "description": "Stable key used to identify this custom application probe", "type": "string" }, "name": { + "description": "Display name for this custom application probe", "examples": [ "pos_app" ], "type": "string" }, "network": { + "description": "Gateway network used as the source context for this probe", "examples": [ "lan" ], "type": "string" }, "packetSize": { - "description": "If `protocol`==`icmp`", + "description": "If `protocol`==`icmp`. ICMP packet size used by this custom app probe", "maximum": 65400, "minimum": 0, "type": "integer" }, "protocol": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Probe protocol used by this custom application definition" }, "url": { - "description": "If `protocol`==`http`", + "description": "If `protocol`==`http`. HTTP URL or hostname probed by this custom app", "examples": [ "www.abc.com" ], "type": "string" }, "vrf": { + "description": "Gateway VRF used as the source context for this probe", "examples": [ "lan" ], @@ -18873,6 +19754,7 @@ "type": "array" }, "enabled": { + "description": "Whether gateway application probing is enabled", "type": "boolean" } }, @@ -18884,9 +19766,10 @@ }, "auto_signature_update": { "additionalProperties": false, + "description": "Schedule for automatic security signature updates", "properties": { "day_of_week": { - "description": "enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`", + "description": "Scheduled weekday for automatic signature updates", "enum": [ "any", "fri", @@ -18901,6 +19784,7 @@ }, "enable": { "default": true, + "description": "Whether automatic security signature updates are enabled", "type": "boolean" }, "time_of_day": { @@ -18934,9 +19818,11 @@ }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the gateway", "type": "boolean" }, "probe_hosts": { + "description": "IPv4 probe targets used for gateway connectivity checks", "examples": [ [ "8.8.8.8" @@ -18949,6 +19835,7 @@ "type": "array" }, "probe_hostsv6": { + "description": "IPv6 probe targets used for gateway connectivity checks", "examples": [ [ "2001:4860:4860::8888" @@ -18962,10 +19849,10 @@ }, "protect_re": { "additionalProperties": false, - "description": "Restrict inbound-traffic to host\\nwhen enabled, all traffic that is not essential to our operation will be dropped \\ne.g. ntp / dns / traffic to mist will be allowed by default, if dhcpd is enabled, we'll make sure it works", + "description": "Control-plane protection settings for the gateway", "properties": { "allowed_services": { - "description": "Optionally, services we'll allow", + "description": "Built-in services explicitly allowed by the Protect RE policy", "examples": [ [ "icmp", @@ -18973,7 +19860,7 @@ ] ], "items": { - "description": "enum: `icmp`, `ssh`", + "description": "Services allowed through protect-RE filters. enum: `icmp`, `ssh`", "enum": [ "icmp", "ssh" @@ -18983,9 +19870,10 @@ "type": "array" }, "custom": { + "description": "Additional ACL entries allowed by the Protect RE policy", "items": { "additionalProperties": false, - "description": "Custom acls", + "description": "Custom Protect RE ACL entry", "properties": { "port_range": { "default": "0", @@ -18996,10 +19884,12 @@ "type": "string" }, "protocol": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Transport protocol matched by this custom Protect RE ACL" }, "subnets": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source subnets matched by this custom Protect RE ACL" } }, "type": "object" @@ -19017,7 +19907,7 @@ "type": "boolean" }, "trusted_hosts": { - "description": "host/subnets we'll allow traffic to/from", + "description": "Trusted host or subnet entries allowed by the Protect RE policy", "items": { "examples": [ "10.242.3.0/24" @@ -19030,11 +19920,12 @@ "type": "object" }, "root_password": { - "description": "SRX only", + "description": "SRX only. Root password for local gateway access", "format": "password", "type": "string" }, "security_log_source_address": { + "description": "IPv4 source address used for gateway security log traffic", "examples": [ "192.168.1.1" ], @@ -19042,6 +19933,7 @@ "type": "string" }, "security_log_source_interface": { + "description": "Source interface used for gateway security log traffic", "examples": [ "ge-0/0/1.0" ], @@ -19051,7 +19943,7 @@ "type": "object" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the gateway object", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -19061,9 +19953,10 @@ }, "idp_profiles": { "additionalProperties": { + "description": "Organization IDP profile with a base profile and targeted overwrite rules", "properties": { "base_profile": { - "description": "enum: `critical`, `standard`, `strict`", + "description": "Built-in IDP baseline profile inherited before applying overwrites", "enum": [ "critical", "standard", @@ -19075,13 +19968,13 @@ "type": "string" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the IDP profile was created", "format": "double", "readOnly": true, "type": "number" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the IDP profile", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -19090,18 +19983,20 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the IDP profile was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the IDP profile", "examples": [ "relaxed" ], "type": "string" }, "org_id": { + "description": "Owning organization for the IDP profile", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -19110,16 +20005,21 @@ "type": "string" }, "overwrites": { + "description": "IDP signature override rules applied on top of the base profile", "items": { "additionalProperties": false, + "description": "Override rule that changes the IDP action for matching signatures", "properties": { "action": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Enforcement action applied when this overwrite rule matches" }, "matching": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Criteria that select signatures for this overwrite rule" }, "name": { + "description": "Display name for this IDP profile overwrite rule", "type": "string" } }, @@ -19130,22 +20030,25 @@ }, "type": "object" }, - "description": "Property key is the profile name", + "description": "Intrusion detection and prevention profiles configured for this gateway", "type": "object" }, "image1_url": { + "description": "First custom image URL associated with the gateway", "type": [ "string", "null" ] }, "image2_url": { + "description": "Second custom image URL associated with the gateway", "type": [ "string", "null" ] }, "image3_url": { + "description": "Third custom image URL associated with the gateway", "type": [ "string", "null" @@ -19154,29 +20057,34 @@ "ip_configs": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway network interface IP configuration", "properties": { "ip": { + "description": "Static IPv4 address for the gateway network interface when `type`==`static`", "format": "ipv4", "type": "string" }, "ip6": { + "description": "Static IPv6 address for the gateway network interface when `type6`==`static`", "format": "ipv6", "type": "string" }, "netmask": { + "description": "IPv4 netmask or prefix length for the gateway network interface when `type`==`static`", "examples": [ "/24" ], "type": "string" }, "netmask6": { + "description": "IPv6 netmask or prefix length for the gateway network interface when `type6`==`static`", "examples": [ "2001:db8:abcd:12::1" ], "type": "string" }, "secondary_ips": { - "description": "Optional list of secondary IPs in CIDR format", + "description": "Additional IPv4 addresses in CIDR notation for this gateway network interface", "examples": [ [ "192.168.50.1/24", @@ -19190,7 +20098,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IPv4 address assignment mode for this gateway network interface", "enum": [ "dhcp", "static" @@ -19202,7 +20110,7 @@ }, "type6": { "default": "disabled", - "description": "enum: `autoconf`, `dhcp`, `disabled`, `static`", + "description": "IPv6 address assignment mode for this gateway network interface", "enum": [ "autoconf", "dhcp", @@ -19217,11 +20125,11 @@ }, "type": "object" }, - "description": "Property key is the network name", + "description": "Gateway interface IP configurations by network name", "type": "object" }, "mac": { - "description": "Device MAC address", + "description": "Gateway MAC address used to identify the device", "readOnly": true, "type": "string" }, @@ -19243,17 +20151,18 @@ "type": "boolean" }, "model": { - "description": "Device Model", + "description": "Gateway model reported for the device", "readOnly": true, "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the gateway object was last modified", "format": "double", "readOnly": true, "type": "number" }, "msp_id": { + "description": "MSP that manages this gateway, when applicable", "examples": [ "b9d42c2e-88ee-41f8-b798-f009ce7fe909" ], @@ -19262,14 +20171,16 @@ "type": "string" }, "name": { + "description": "Friendly display name assigned to the gateway", "type": "string" }, "networks": { + "description": "Layer 3 networks configured for use by this gateway", "items": { - "description": "Networks are usually subnets that have cross-site significance. `networks`in Org Settings will got merged into `networks`in Site Setting. For gateways, they can be used to define Service Routes.", + "description": "Organization-level Layer 3 network definition that can be merged into site settings and used for service routes. Networks are used to define the service routes in the Gateway settings or templates", "properties": { "created_time": { - "description": "When the object has been created, in epoch", + "description": "Epoch timestamp when the network was created", "format": "double", "readOnly": true, "type": "number" @@ -19280,6 +20191,7 @@ "type": "boolean" }, "gateway": { + "description": "IPv4 gateway address for this network", "examples": [ "192.168.70.1" ], @@ -19287,6 +20199,7 @@ "type": "string" }, "gateway6": { + "description": "IPv6 gateway address for this network", "examples": [ "fdad:b0bc:f29e::1" ], @@ -19294,7 +20207,7 @@ "type": "string" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the network", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -19304,8 +20217,10 @@ }, "internal_access": { "additionalProperties": false, + "description": "Internal access settings for this network", "properties": { "enabled": { + "description": "Whether internal access is enabled for this network", "type": "boolean" } }, @@ -19313,20 +20228,22 @@ }, "internet_access": { "additionalProperties": false, - "description": "Whether this network has direct internet access", + "description": "Direct internet access and NAT settings for this network", "properties": { "create_simple_service_policy": { "default": false, + "description": "Whether Mist should create simple service policies for restricted internet access", "type": "boolean" }, "destination_nat": { "additionalProperties": { "$comment": "max depth reached" }, - "description": "Property key can be an External IP (i.e. \\"63.16.0.3\\"), an External IP:Port (i.e. \\"63.16.0.3:443\\"), an External Port (i.e. \\":443\\"), an External CIDR (i.e. \\"63.16.0.0/30\\"), an External CIDR:Port (i.e. \\"63.16.0.0/30:443\\") or a Variable (i.e. \\"{{myvar}}\\"). At least one of the `internal_ip` or `port` must be defined", + "description": "Destination NAT rules for direct internet access", "type": "object" }, "enabled": { + "description": "Whether direct internet access is enabled for this network", "type": "boolean" }, "restricted": { @@ -19338,7 +20255,7 @@ "additionalProperties": { "$comment": "max depth reached" }, - "description": "Property key may be an External IP Address (i.e. \\"63.16.0.3\\"), a CIDR (i.e. \\"63.16.0.12/20\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Static NAT rules for direct internet access", "type": "object" } }, @@ -19349,14 +20266,14 @@ "type": "boolean" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Epoch timestamp when the network was last modified", "format": "double", "readOnly": true, "type": "number" }, "multicast": { "additionalProperties": false, - "description": "Whether to enable multicast support (only PIM-sparse mode is supported)", + "description": "Settings for multicast routing on this network", "properties": { "disable_igmp": { "default": false, @@ -19365,22 +20282,25 @@ }, "enabled": { "default": false, + "description": "Whether multicast support is enabled for this network", "type": "boolean" }, "groups": { "additionalProperties": { "$comment": "max depth reached" }, - "description": "Group address to RP (rendezvous point) mapping. Property Key is the CIDR (example \\"225.1.0.3/32\\")", + "description": "Multicast group-to-RP mappings for this network", "type": "object" } }, "type": "object" }, "name": { + "description": "Display name of the organization network", "type": "string" }, "org_id": { + "description": "Organization that owns this network", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -19389,7 +20309,7 @@ "type": "string" }, "routed_for_networks": { - "description": "For a Network (usually LAN), it can be routable to other networks (e.g. OSPF)", + "description": "Other network names this network can route to, for example through BGP, OSPF or static routes", "items": { "examples": [ "pos" @@ -19399,12 +20319,14 @@ "type": "array" }, "subnet": { + "description": "IPv4 subnet CIDR for this network", "examples": [ "192.168.70.0/24" ], "type": "string" }, "subnet6": { + "description": "IPv6 subnet CIDR for this network", "examples": [ "fdad:b0bc:f29e::/32" ], @@ -19413,17 +20335,20 @@ "tenants": { "additionalProperties": { "additionalProperties": false, + "description": "Tenant address entry for a network", "properties": { "addresses": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "IP addresses or subnets assigned to this tenant in the network" } }, "type": "object" }, - "description": "Property key must be the user/tenant name (i.e. \\"printer-1\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Tenant address mappings associated with this network", "type": "object" }, "vlan_id": { + "description": "VLAN ID or variable associated with this network", "oneOf": [ { "type": "string" @@ -19438,6 +20363,7 @@ "vpn_access": { "additionalProperties": { "additionalProperties": false, + "description": "VPN access settings for a network and VPN pair", "properties": { "advertised_subnet": { "description": "If `routed`==`true`, whether to advertise an aggregated subnet toward HUB this is useful when there are multiple networks on SPOKE's side", @@ -19451,7 +20377,8 @@ "type": "boolean" }, "destination_nat": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Destination NAT rules applied for VPN access to this network" }, "nat_pool": { "description": "If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub, a subnet is required to create and advertise the route to Hub", @@ -19475,17 +20402,20 @@ "type": "boolean" }, "other_vrfs": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Other VRFs that can receive leaked routes from this spoke network" }, "routed": { "description": "Whether this network is routable", "type": "boolean" }, "source_nat": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source NAT settings used when non-routed spoke hosts must be reachable from the hub" }, "static_nat": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Static NAT rules applied for VPN access to this network" }, "summarized_subnet": { "description": "toward overlay, how HUB should deal with routes it received from Spokes", @@ -19511,7 +20441,7 @@ }, "type": "object" }, - "description": "Property key is the VPN name. Whether this network can be accessed from vpn", + "description": "VPN access settings keyed by VPN name for this network", "type": "object" } }, @@ -19523,9 +20453,11 @@ "type": "array" }, "notes": { + "description": "Free-form administrative notes for this gateway", "type": "string" }, "ntp_servers": { + "description": "NTP servers used by this gateway", "items": { "type": "string" }, @@ -19534,38 +20466,39 @@ }, "oob_ip_config": { "additionalProperties": false, - "description": "Out-of-band (vme/em0/fxp0) IP config", + "description": "Out-of-band management IP configuration for this gateway", "properties": { "gateway": { - "description": "If `type`==`static`", + "description": "Default gateway for the out-of-band management interface when `type`==`static`", "type": "string" }, "ip": { - "description": "If `type`==`static`", + "description": "Static IPv4 address for the out-of-band management interface when `type`==`static`", "type": "string" }, "netmask": { - "description": "If `type`==`static`", + "description": "IPv4 netmask or prefix length for the out-of-band management interface when `type`==`static`", "type": "string" }, "node1": { "additionalProperties": false, - "description": "For HA Cluster, node1 can have different IP Config", + "description": "Out-of-band management IP configuration override for node1 in an HA cluster", "properties": { "gateway": { - "description": "If `type`==`static`", + "description": "Default gateway for the node1 out-of-band management interface when `type`==`static`", "type": "string" }, "ip": { + "description": "Static IPv4 address for the node1 out-of-band management interface when `type`==`static`", "type": "string" }, "netmask": { - "description": "Used only if `subnet` is not specified in `networks`", + "description": "IPv4 netmask or prefix length for the node1 out-of-band management interface when `type`==`static`; used only if `subnet` is not specified in `networks`", "type": "string" }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IP assignment mode for the node1 out-of-band management interface", "enum": [ "dhcp", "static" @@ -19586,7 +20519,7 @@ "type": "boolean" }, "vlan_id": { - "description": "If WAN interface is on a VLAN. Can be the VLAN ID (i.e. \\"10\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "VLAN ID used for node1 out-of-band management traffic", "oneOf": [ { "type": "string" @@ -19603,7 +20536,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IP assignment mode for the out-of-band management interface", "enum": [ "dhcp", "static" @@ -19624,7 +20557,7 @@ "type": "boolean" }, "vlan_id": { - "description": "If WAN interface is on a VLAN. Can be the VLAN ID (i.e. \\"10\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "VLAN ID used for out-of-band management traffic", "oneOf": [ { "type": "string" @@ -19640,6 +20573,7 @@ "type": "object" }, "org_id": { + "description": "Organization that owns this gateway", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -19650,12 +20584,16 @@ "path_preferences": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway path preference that selects among one or more local, WAN, VPN, or tunnel paths", "properties": { "paths": { + "description": "Candidate paths evaluated for this gateway path preference", "items": { "additionalProperties": false, + "description": "Candidate path within a gateway path preference", "properties": { "cost": { + "description": "Relative cost assigned to this path for gateway path selection", "type": "integer" }, "disabled": { @@ -19675,21 +20613,21 @@ "type": "string" }, "networks": { - "description": "Required when `type`==`local`", + "description": "List of network names used when `type`==`local`", "items": { "$comment": "max depth reached" }, "type": "array" }, "target_ips": { - "description": "If `type`==`local`, if destination IP is to be replaced", + "description": "List of destination IP addresses to replace when `type`==`local`", "items": { "$comment": "max depth reached" }, "type": "array" }, "type": { - "description": "enum: `local`, `tunnel`, `vpn`, `wan`", + "description": "Gateway path source type, such as local network, WAN interface, VPN path, or tunnel", "enum": [ "local", "tunnel", @@ -19699,7 +20637,7 @@ "type": "string" }, "wan_name": { - "description": "Optional if `type`==`vpn`", + "description": "Optional if `type`==`vpn`; WAN interface name associated with the VPN path", "examples": [ "wan0" ], @@ -19715,7 +20653,7 @@ }, "strategy": { "default": "ordered", - "description": "enum: `ecmp`, `ordered`, `weighted`", + "description": "Selection strategy used to evaluate the candidate paths", "enum": [ "ecmp", "ordered", @@ -19732,7 +20670,7 @@ "port_config": { "additionalProperties": { "additionalProperties": false, - "description": "Gateway port config", + "description": "Gateway port configuration for LAN, WAN, tunnel, and HA interfaces", "properties": { "ae_disable_lacp": { "default": false, @@ -19753,6 +20691,7 @@ }, "aggregated": { "default": false, + "description": "Whether the port participates in an aggregated Ethernet interface", "type": "boolean" }, "critical": { @@ -19766,6 +20705,7 @@ }, "disable_autoneg": { "default": false, + "description": "Whether Ethernet autonegotiation is disabled on the port", "type": "boolean" }, "disabled": { @@ -19775,7 +20715,7 @@ }, "dsl_type": { "default": "vdsl", - "description": "if `wan_type`==`dsl`. enum: `adsl`, `vdsl`", + "description": "If `wan_type`==`dsl`. DSL technology used by the WAN port", "enum": [ "adsl", "vdsl" @@ -19794,7 +20734,7 @@ }, "duplex": { "default": "auto", - "description": "enum: `auto`, `full`, `half`", + "description": "Ethernet duplex mode configured on the port", "enum": [ "auto", "full", @@ -19807,24 +20747,24 @@ }, "ip_config": { "additionalProperties": false, - "description": "Junos IP Config", + "description": "Layer 3 IP configuration for the port", "properties": { "dns": { - "description": "Except for out-of_band interface (vme/em0/fxp0)", + "description": "Resolver server IP addresses used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0", "items": { "type": "string" }, "type": "array" }, "dns_suffix": { - "description": "Except for out-of_band interface (vme/em0/fxp0)", + "description": "DNS search suffixes used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0", "items": { "type": "string" }, "type": "array" }, "gateway": { - "description": "Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP Address (i.e. \\"192.168.1.1\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP address (i.e. \\"192.168.1.1\\") or a Variable (i.e. \\"{{myvar}}\\")", "examples": [ "192.168.1.1" ], @@ -19838,7 +20778,7 @@ "type": "string" }, "ip": { - "description": "Interface IP Address (i.e. \\"192.168.1.8\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Interface IP address (i.e. \\"192.168.1.8\\") or a Variable (i.e. \\"{{myvar}}\\")", "examples": [ "192.168.1.8" ], @@ -19872,12 +20812,13 @@ "type": "string" }, "poser_password": { - "description": "If `type`==`pppoe`", + "description": "Password used for PPPoE when `type`==`pppoe`", + "format": "password", "type": "string" }, "pppoe_auth": { "default": "none", - "description": "if `type`==`pppoe`. enum: `chap`, `none`, `pap`", + "description": "Authentication protocol used for PPPoE when `type`==`pppoe`", "enum": [ "chap", "none", @@ -19886,12 +20827,12 @@ "type": "string" }, "pppoe_username": { - "description": "If `type`==`pppoe`", + "description": "Username used for PPPoE when `type`==`pppoe`", "type": "string" }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `pppoe`, `static`", + "description": "IPv4 assignment mode for this gateway port interface", "enum": [ "dhcp", "pppoe", @@ -19901,7 +20842,7 @@ }, "type6": { "default": "autoconf", - "description": "enum: `autoconf`, `dhcp`, `static`", + "description": "IPv6 assignment mode for this gateway port interface", "enum": [ "autoconf", "dhcp", @@ -19913,12 +20854,12 @@ "type": "object" }, "lte_apn": { - "description": "If `wan_type`==`lte`", + "description": "If `wan_type`==`lte`. APN used by the LTE uplink", "type": "string" }, "lte_auth": { "default": "none", - "description": "if `wan_type`==`lte`. enum: `chap`, `none`, `pap`", + "description": "If `wan_type`==`lte`. Authentication method used by the LTE uplink", "enum": [ "chap", "none", @@ -19927,36 +20868,40 @@ "type": "string" }, "lte_backup": { + "description": "Whether the LTE uplink is used as a backup WAN connection", "type": "boolean" }, "lte_password": { - "description": "If `wan_type`==`lte`", + "description": "If `wan_type`==`lte`. Password used for LTE uplink authentication", + "format": "password", "type": "string" }, "lte_username": { - "description": "If `wan_type`==`lte`", + "description": "If `wan_type`==`lte`. Username used for LTE uplink authentication", "type": "string" }, "mtu": { + "description": "Layer 3 MTU configured on the port", "type": "integer" }, "name": { - "description": "Name that we'll use to derive config", + "description": "Interface name used to derive device configuration", "type": "string" }, "networks": { - "description": "If `usage`==`lan`, name of the [networks]($h/Orgs%20Networks/_overview) to attach to the interface", + "description": "If `usage`==`lan`. Networks attached to the interface", "items": { "type": "string" }, "type": "array" }, "outer_vlan_id": { - "description": "For Q-in-Q", + "description": "For Q-in-Q. Outer VLAN ID used for QinQ encapsulation", "type": "integer" }, "poe_disabled": { "default": false, + "description": "Whether PoE output is disabled on the port", "type": "boolean" }, "poe_keep_state_when_reboot": { @@ -19974,7 +20919,7 @@ "type": "boolean" }, "redundant": { - "description": "If HA mode", + "description": "If HA mode. Whether the port participates in the redundant Ethernet configuration", "type": "boolean" }, "redundant_group": { @@ -19992,14 +20937,14 @@ "type": "string" } ], - "description": "For SRX only and if HA Mode. `-1` means it will be managed by the device. Use `>= 0` values to manage it manually. Ensure no conflicting values are assigned across all ports." + "description": "If HA mode and for SRX only. Redundant Ethernet interface index assigned to the port" }, "reth_node": { - "description": "If HA mode", + "description": "If HA mode. Node associated with the redundant Ethernet interface", "type": "string" }, "reth_nodes": { - "description": "SSR only - supporting vlan-based redundancy (matching the size of `networks`)", + "description": "If HA mode and for SSR only. Per-network node assignment used for VLAN-based redundancy", "examples": [ [ "node0", @@ -20013,6 +20958,7 @@ }, "speed": { "default": "auto", + "description": "Link speed configured on the port", "examples": [ "1g" ], @@ -20025,7 +20971,7 @@ }, "svr_port_range": { "default": "none", - "description": "For SSR only", + "description": "For SSR only. Port range configured on the interface", "examples": [ "60000-60005" ], @@ -20033,9 +20979,10 @@ }, "traffic_shaping": { "additionalProperties": false, + "description": "Traffic shaping settings applied to the port", "properties": { "class_percentages": { - "description": "percentages for different class of traffic: high / medium / low / best-effort. Sum must be equal to 100", + "description": "Traffic class bandwidth percentages for high, medium, low, and best-effort queues", "items": { "type": "integer" }, @@ -20043,17 +20990,18 @@ }, "enabled": { "default": false, + "description": "Whether traffic shaping is enabled", "type": "boolean" }, "max_tx_kbps": { - "description": "Interface Transmit Cap in kbps", + "description": "Maximum transmit bandwidth for the interface, in Kbps", "type": "integer" } }, "type": "object" }, "usage": { - "description": "port usage name. enum: `ha_control`, `ha_data`, `lan`, `wan`", + "description": "Logical usage assigned to the port", "enum": [ "ha_control", "ha_data", @@ -20063,7 +21011,7 @@ "type": "string" }, "vlan_id": { - "description": "If WAN interface is on a VLAN. Can be the VLAN ID (i.e. \\"10\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "VLAN ID or variable used when the WAN interface is carried on a VLAN", "oneOf": [ { "type": "string" @@ -20078,10 +21026,11 @@ "vpn_paths": { "additionalProperties": { "additionalProperties": false, + "description": "VPN path settings for traffic that uses a gateway port", "properties": { "bfd_profile": { "default": "broadband", - "description": "Only if the VPN `type`==`hub_spoke`. enum: `broadband`, `lte`", + "description": "BFD profile used for this VPN path when the VPN `type`==`hub_spoke`", "enum": [ "broadband", "lte" @@ -20099,7 +21048,7 @@ }, "role": { "default": "spoke", - "description": "If the VPN `type`==`hub_spoke`, enum: `hub`, `spoke`. If the VPN `type`==`mesh`, enum: `mesh`", + "description": "Gateway role for this VPN path; valid values depend on the VPN `type`", "enum": [ "hub", "mesh", @@ -20109,6 +21058,7 @@ }, "traffic_shaping": { "additionalProperties": false, + "description": "Traffic shaping settings applied to this VPN path", "properties": { "class_percentages": { "$comment": "max depth reached" @@ -20125,12 +21075,12 @@ }, "type": "object" }, - "description": "Property key is the VPN name", + "description": "Per-VPN path settings for traffic that uses this port", "type": "object" }, "wan_arp_policer": { "default": "default", - "description": "Only when `wan_type`==`broadband`. enum: `default`, `max`, `recommended`", + "description": "Only when `wan_type`==`broadband`. ARP policer profile applied to the WAN port", "enum": [ "default", "max", @@ -20155,8 +21105,10 @@ "wan_extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv4 route for a WAN interface", "properties": { "via": { + "description": "IPv4 next-hop address for this WAN extra route", "format": "ipv4", "type": "string" } @@ -20169,8 +21121,10 @@ "wan_extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv6 route for a WAN interface", "properties": { "via": { + "description": "IPv6 next-hop address for this WAN extra route", "format": "ipv6", "type": "string" } @@ -20181,7 +21135,7 @@ "type": "object" }, "wan_networks": { - "description": "Only if `usage`==`wan`. If some networks are connected to this WAN port, it can be added here so policies can be defined", + "description": "Only if `usage`==`wan`. Networks reachable through this WAN port for policy definition", "items": { "type": "string" }, @@ -20189,9 +21143,10 @@ }, "wan_probe_override": { "additionalProperties": false, - "description": "Only if `usage`==`wan`", + "description": "Optional WAN health probe override settings for this port", "properties": { "ip6s": { + "description": "List of IPv6 probe host addresses used by this WAN override", "items": { "type": "string" }, @@ -20199,6 +21154,7 @@ "uniqueItems": true }, "ips": { + "description": "List of IPv4 probe host addresses used by this WAN override", "items": { "type": "string" }, @@ -20207,7 +21163,7 @@ }, "probe_profile": { "default": "broadband", - "description": "enum: `broadband`, `lte`", + "description": "WAN probe profile used for health checks on this port", "enum": [ "broadband", "lte" @@ -20219,7 +21175,7 @@ }, "wan_source_nat": { "additionalProperties": false, - "description": "Only if `usage`==`wan`, optional. By default, source-NAT is performed on all WAN Ports using the interface-ip", + "description": "Source NAT settings applied to traffic leaving this WAN port", "properties": { "disabled": { "default": false, @@ -20245,7 +21201,7 @@ }, "wan_speedtest_mode": { "default": "auto", - "description": "Controls whether Marvis/scheduler can run speedtest on this port. enum: `auto`, `enabled`, `disabled`", + "description": "Controls whether Marvis or the scheduler can run speed tests on this WAN port", "enum": [ "auto", "enabled", @@ -20258,7 +21214,7 @@ }, "wan_type": { "default": "broadband", - "description": "Only if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`", + "description": "Only if `usage`==`wan`. WAN uplink type configured on the port", "enum": [ "broadband", "dsl", @@ -20277,14 +21233,18 @@ }, "port_mirroring": { "additionalProperties": false, + "description": "Port mirroring configuration for this gateway", "properties": { "port_mirror": { "additionalProperties": false, + "description": "Mirroring rule that copies ingress traffic from source ports to an output port", "properties": { "family_type": { + "description": "Packet family used for this port mirroring rule", "type": "string" }, "ingress_port_ids": { + "description": "Source gateway port IDs whose ingress traffic is mirrored", "items": { "examples": [ "ge-0/0/3" @@ -20294,15 +21254,18 @@ "type": "array" }, "output_port_id": { + "description": "Destination gateway port ID that receives mirrored traffic", "examples": [ "ge-0/0/5" ], "type": "string" }, "rate": { + "description": "Sampling rate applied to mirrored traffic", "type": "integer" }, "run_length": { + "description": "Number of bytes copied from each mirrored packet", "minimum": 0, "type": "integer" } @@ -20322,17 +21285,21 @@ "routing_policies": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway routing policy made of ordered match-action terms", "properties": { "terms": { - "description": "zero or more criteria/filter can be specified to match the term, all criteria have to be met", + "description": "Ordered terms evaluated by this gateway routing policy", "items": { "additionalProperties": false, + "description": "Gateway routing policy term with match criteria and actions", "properties": { "actions": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Policy actions applied when this routing policy term matches" }, "matching": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Route match criteria that must be satisfied before actions are applied" } }, "type": "object" @@ -20343,20 +21310,22 @@ }, "type": "object" }, - "description": "Property key is the routing policy name", + "description": "Routing policies applied by this gateway", "type": "object" }, "serial": { - "description": "Device Serial", + "description": "Manufacturer serial number for the gateway", "readOnly": true, "type": "string" }, "service_policies": { + "description": "Traffic service policies enforced by this gateway", "items": { "additionalProperties": false, + "description": "Site-level service policy that allows or denies traffic for tenants and services", "properties": { "action": { - "description": "enum: `allow`, `deny`", + "description": "Allow or deny action for traffic matched by this service policy", "enum": [ "allow", "deny" @@ -20365,19 +21334,20 @@ }, "antivirus": { "additionalProperties": false, - "description": "For SRX-only", + "description": "Malware and virus inspection settings applied by this service policy", "properties": { "avprofile_id": { - "description": "org-level AV Profile can be used, this takes precedence over 'profile'", + "description": "Organization-level antivirus profile ID; takes precedence over inline `profile` settings", "format": "uuid", "type": "string" }, "enabled": { "default": false, + "description": "Whether antivirus inspection is enabled for the service policy", "type": "boolean" }, "profile": { - "description": "Default / noftp / httponly / or keys from av_profiles", + "description": "Antivirus profile name to apply, such as `default`, `noftp`, `httponly`, or an AV profile key", "type": "string" } }, @@ -20385,23 +21355,28 @@ }, "appqoe": { "additionalProperties": false, - "description": "SRX only", + "description": "Application QoE settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether application QoE is enabled for the service policy", "type": "boolean" } }, "type": "object" }, "ewf": { + "description": "Enhanced web filtering rules applied by this service policy", "items": { "additionalProperties": false, + "description": "Enhanced web filtering rule applied by a service policy", "properties": { "alert_only": { + "description": "Whether matching enhanced web filtering traffic is logged without being blocked", "type": "boolean" }, "block_message": { + "description": "Message returned when enhanced web filtering blocks a request", "examples": [ "Access to this URL Category has been blocked" ], @@ -20409,10 +21384,12 @@ }, "enabled": { "default": false, + "description": "Whether this enhanced web filtering rule is enabled", "type": "boolean" }, "profile": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Enhanced web filtering profile applied by this rule" } }, "type": "object" @@ -20421,12 +21398,15 @@ }, "idp": { "additionalProperties": false, + "description": "Intrusion detection and prevention settings applied by this service policy", "properties": { "alert_only": { + "description": "Whether to alert without enforcing IDP prevention actions", "type": "boolean" }, "enabled": { "default": false, + "description": "Whether IDP inspection is enabled for the policy", "type": "boolean" }, "idpprofile_id": { @@ -20446,10 +21426,11 @@ "type": "object" }, "local_routing": { - "description": "access within the same VRF", + "description": "Whether the policy permits access within the same VRF", "type": "boolean" }, "name": { + "description": "Display name of the service policy", "type": "string" }, "path_preference": { @@ -20458,15 +21439,16 @@ }, "secintel": { "additionalProperties": false, - "description": "SRX only", + "description": "Threat intelligence settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether SecIntel inspection is enabled for the service policy", "type": "boolean" }, "profile": { "default": "default", - "description": "enum: `default`, `standard`, `strict`", + "description": "Protection level applied by SecIntel inspection", "enum": [ "default", "standard", @@ -20475,18 +21457,19 @@ "type": "string" }, "secintelprofile_id": { - "description": "org-level secintel Profile can be used, this takes precedence over 'profile'", + "description": "Organization-level SecIntel profile ID; takes precedence over inline `profile` settings", "type": "string" } }, "type": "object" }, "servicepolicy_id": { - "description": "Used to link servicepolicy defined at org level and overwrite some attributes", + "description": "Organization-level service policy identifier used to link and override selected attributes", "format": "uuid", "type": "string" }, "services": { + "description": "Application services or service groups matched by this policy", "items": { "type": "string" }, @@ -20495,48 +21478,59 @@ }, "skyatp": { "additionalProperties": false, - "description": "SRX only", + "description": "Threat inspection settings provided by Sky ATP for this service policy", "properties": { "dns_dga_detection": { "additionalProperties": false, + "description": "Detection settings for DNS DGA threats provided by Sky ATP", "properties": { "enabled": { + "description": "Whether Sky ATP DNS DGA detection is enabled", "type": "boolean" }, "profile": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Sky ATP DNS DGA detection profile to apply" } }, "type": "object" }, "dns_tunnel_detection": { "additionalProperties": false, + "description": "Detection settings for DNS tunneling threats provided by Sky ATP", "properties": { "enabled": { + "description": "Whether Sky ATP DNS tunneling detection is enabled", "type": "boolean" }, "profile": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Sky ATP DNS tunneling detection profile to apply" } }, "type": "object" }, "http_inspection": { "additionalProperties": false, + "description": "Web traffic inspection settings provided by Sky ATP", "properties": { "enabled": { + "description": "Whether Sky ATP HTTP inspection is enabled", "type": "boolean" }, "profile": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Sky ATP HTTP inspection profile to apply" } }, "type": "object" }, "iot_device_policy": { "additionalProperties": false, + "description": "Device threat policy settings provided by Sky ATP for IoT clients", "properties": { "enabled": { + "description": "Whether Sky ATP IoT device policy inspection is enabled", "type": "boolean" } }, @@ -20547,11 +21541,11 @@ }, "ssl_proxy": { "additionalProperties": false, - "description": "For SRX-only", + "description": "TLS inspection settings applied by this service policy", "properties": { "ciphers_category": { "default": "strong", - "description": "enum: `medium`, `strong`, `weak`", + "description": "Allowed cipher strength category for SSL proxy inspection", "enum": [ "medium", "strong", @@ -20561,6 +21555,7 @@ }, "enabled": { "default": false, + "description": "Whether SSL proxy inspection is enabled for the service policy", "type": "boolean" } }, @@ -20568,13 +21563,15 @@ }, "syslog": { "additionalProperties": false, - "description": "Required for syslog logging", + "description": "Remote logging settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether syslog logging is enabled for the service policy", "type": "boolean" }, "server_names": { + "description": "Names of syslog servers that receive logs for this service policy", "examples": [ [ "dc_syslog_server" @@ -20589,6 +21586,7 @@ "type": "object" }, "tenants": { + "description": "User or network tenants matched by this service policy", "items": { "type": "string" }, @@ -20601,6 +21599,7 @@ "type": "array" }, "site_id": { + "description": "Site where this gateway is assigned", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -20611,10 +21610,11 @@ "tunnel_configs": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway tunnel configuration for provider-managed or custom tunnels", "properties": { "auto_provision": { "additionalProperties": false, - "description": "Auto Provisioning configuration for the tunne. This takes precedence over the `primary` and `secondary` nodes.", + "description": "Provider auto-provisioning settings for tunnel endpoints", "properties": { "enabled": { "description": "Enable auto provisioning for the tunnel. If enabled, the `primary` and `secondary` nodes will be ignored.", @@ -20622,9 +21622,10 @@ }, "latlng": { "additionalProperties": false, - "description": "API override for POP selection", + "description": "Geographic coordinate override used for tunnel POP selection", "properties": { "lat": { + "description": "Geographic latitude used for POP selection override", "examples": [ 37.295833 ], @@ -20632,6 +21633,7 @@ "type": "number" }, "lng": { + "description": "Geographic longitude used for POP selection override", "examples": [ -122.032946 ], @@ -20646,8 +21648,10 @@ "type": "object" }, "primary": { + "description": "Main auto-provisioned tunnel endpoint settings", "properties": { "probe_ips": { + "description": "Probe IP addresses used to monitor auto-provisioned tunnel reachability", "items": { "$comment": "max depth reached" }, @@ -20655,7 +21659,7 @@ "uniqueItems": true }, "wan_names": { - "description": "Optional, only needed if `vars_only`==`false`", + "description": "WAN interface names used by the auto-provisioned tunnel endpoint", "items": { "$comment": "max depth reached" }, @@ -20664,7 +21668,7 @@ } }, "provider": { - "description": "enum: `jse-ipsec`, `zscaler-ipsec`", + "description": "Tunnel provider used for automatic endpoint provisioning", "enum": [ "jse-ipsec", "zscaler-ipsec" @@ -20676,8 +21680,10 @@ "type": "string" }, "secondary": { + "description": "Backup auto-provisioned tunnel endpoint settings", "properties": { "probe_ips": { + "description": "Probe IP addresses used to monitor auto-provisioned tunnel reachability", "items": { "$comment": "max depth reached" }, @@ -20685,7 +21691,7 @@ "uniqueItems": true }, "wan_names": { - "description": "Optional, only needed if `vars_only`==`false`", + "description": "WAN interface names used by the auto-provisioned tunnel endpoint", "items": { "$comment": "max depth reached" }, @@ -20707,12 +21713,12 @@ "type": "object" }, "ike_lifetime": { - "description": "Only if `provider`==`custom-ipsec`", + "description": "Only if `provider`==`custom-ipsec`. IKE lifetime configured for the custom IPsec tunnel", "type": "integer" }, "ike_mode": { "default": "main", - "description": "Only if `provider`==`custom-ipsec`. enum: `aggressive`, `main`", + "description": "Only if `provider`==`custom-ipsec`. IKE negotiation mode for the tunnel", "enum": [ "aggressive", "main" @@ -20720,12 +21726,13 @@ "type": "string" }, "ike_proposals": { - "description": "If `provider`==`custom-ipsec`", + "description": "If `provider`==`custom-ipsec`, IKE proposals used for custom IPsec negotiation", "items": { "additionalProperties": false, + "description": "IKE proposal settings for custom IPsec tunnels", "properties": { "auth_algo": { - "description": "enum: `md5`, `sha1`, `sha2`", + "description": "Integrity algorithm used by this IKE proposal", "enum": [ "md5", "sha1", @@ -20735,7 +21742,7 @@ }, "dh_group": { "default": "14", - "description": "enum:\\n * 1\\n * 2 (1024-bit)\\n * 5\\n * 14 (default, 2048-bit)\\n * 15 (3072-bit)\\n * 16 (4096-bit)\\n * 19 (256-bit ECP)\\n * 20 (384-bit ECP)\\n * 21 (521-bit ECP)\\n * 24 (2048-bit ECP)", + "description": "Diffie-Hellman group used by this IKE proposal", "enum": [ "1", "14", @@ -20752,7 +21759,7 @@ }, "enc_algo": { "default": "aes256", - "description": "enum: `3des`, `aes128`, `aes256`, `aes_gcm128`, `aes_gcm256`", + "description": "Cipher algorithm used by this IKE proposal", "enum": [ "3des", "aes128", @@ -20771,16 +21778,17 @@ "type": "array" }, "ipsec_lifetime": { - "description": "If `provider`==`custom-ipsec`", + "description": "If `provider`==`custom-ipsec`, IPsec lifetime configured for the custom tunnel", "type": "integer" }, "ipsec_proposals": { - "description": "Only if `provider`==`custom-ipsec`", + "description": "Only if `provider`==`custom-ipsec`. IPsec proposals used for custom IPsec negotiation", "items": { "additionalProperties": false, + "description": "IPsec proposal settings for custom IPsec tunnels", "properties": { "auth_algo": { - "description": "enum: `md5`, `sha1`, `sha2`", + "description": "Integrity algorithm used by this IPsec proposal", "enum": [ "md5", "sha1", @@ -20790,7 +21798,7 @@ }, "dh_group": { "default": "14", - "description": "Only if `provider`==`custom-ipsec`. enum:\\n * 1\\n * 2 (1024-bit)\\n * 5\\n * 14 (default, 2048-bit)\\n * 15 (3072-bit)\\n * 16 (4096-bit)\\n * 19 (256-bit ECP)\\n * 20 (384-bit ECP)\\n * 21 (521-bit ECP)\\n * 24 (2048-bit ECP)", + "description": "Diffie-Hellman group used by this IPsec proposal", "enum": [ "1", "14", @@ -20807,7 +21815,7 @@ }, "enc_algo": { "default": "aes256", - "description": "enum: `3des`, `aes128`, `aes256`, `aes_gcm128`, `aes_gcm256`", + "description": "Cipher algorithm used by this IPsec proposal", "enum": [ "3des", "aes128", @@ -20830,7 +21838,7 @@ "type": "string" }, "local_subnets": { - "description": "List of Local protected subnet for policy-based IPSec negotiation", + "description": "Local protected subnets advertised by this tunnel", "items": { "type": "string" }, @@ -20838,7 +21846,7 @@ }, "mode": { "default": "active-standby", - "description": "Required if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`. enum: `active-active`, `active-standby`", + "description": "Tunnel failover mode used for primary and secondary endpoints", "enum": [ "active-active", "active-standby" @@ -20846,7 +21854,7 @@ "type": "string" }, "networks": { - "description": "If `provider`==`custom-ipsec` or `provider`==`prisma-ipsec`, networks reachable via this tunnel", + "description": "Destination networks reachable through this tunnel", "items": { "type": "string" }, @@ -20854,23 +21862,25 @@ }, "primary": { "additionalProperties": false, - "description": "Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "Main remote tunnel endpoint settings", "properties": { "hosts": { + "description": "Remote gateway host addresses for this tunnel node", "items": { - "description": "IP Address of the remote host", + "description": "IP address of the remote host", "type": "string" }, "type": "array" }, "internal_ips": { - "description": "Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`", + "description": "Internal IP addresses configured on this tunnel node", "items": { "type": "string" }, "type": "array" }, "probe_ips": { + "description": "Health-check IP addresses used to monitor this tunnel node", "items": { "type": "string" }, @@ -20878,13 +21888,14 @@ "uniqueItems": true }, "remote_ids": { - "description": "Only if `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "IKE identities expected from this tunnel node", "items": { "type": "string" }, "type": "array" }, "wan_names": { + "description": "Interface names that source tunnel traffic for this node", "items": { "type": "string" }, @@ -20899,7 +21910,7 @@ }, "probe": { "additionalProperties": false, - "description": "Only if `provider`==`custom-ipsec`", + "description": "Tunnel health probe settings", "properties": { "interval": { "description": "How often to trigger the probe", @@ -20915,7 +21926,7 @@ }, "type": { "default": "icmp", - "description": "enum: `http`, `icmp`", + "description": "Protocol used by the custom IPsec tunnel health probe", "enum": [ "http", "icmp" @@ -20926,7 +21937,7 @@ "type": "object" }, "protocol": { - "description": "Only if `provider`==`custom-ipsec`. enum: `gre`, `ipsec`", + "description": "Only if `provider`==`custom-ipsec`. Tunnel protocol for custom tunnel negotiation", "enum": [ "gre", "ipsec" @@ -20934,7 +21945,7 @@ "type": "string" }, "provider": { - "description": "Only if `auto_provision.enabled`==`false`. enum: `custom-ipsec`, `custom-gre`, `jse-ipsec`, `prisma-ipsec`, `zscaler-gre`, `zscaler-ipsec`", + "description": "Tunnel provider used when auto provisioning is disabled", "enum": [ "custom-ipsec", "custom-gre", @@ -20950,7 +21961,7 @@ "type": "string" }, "remote_subnets": { - "description": "List of Remote protected subnet for policy-based IPSec negotiation", + "description": "Remote protected subnets reached through policy-based IPsec", "items": { "type": "string" }, @@ -20958,23 +21969,25 @@ }, "secondary": { "additionalProperties": false, - "description": "Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "Backup remote tunnel endpoint settings", "properties": { "hosts": { + "description": "Remote gateway host addresses for this tunnel node", "items": { - "description": "IP Address of the remote host", + "description": "IP address of the remote host", "type": "string" }, "type": "array" }, "internal_ips": { - "description": "Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`", + "description": "Internal IP addresses configured on this tunnel node", "items": { "type": "string" }, "type": "array" }, "probe_ips": { + "description": "Health-check IP addresses used to monitor this tunnel node", "items": { "type": "string" }, @@ -20982,13 +21995,14 @@ "uniqueItems": true }, "remote_ids": { - "description": "Only if `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "IKE identities expected from this tunnel node", "items": { "type": "string" }, "type": "array" }, "wan_names": { + "description": "Interface names that source tunnel traffic for this node", "items": { "type": "string" }, @@ -21003,7 +22017,7 @@ }, "version": { "default": "2", - "description": "Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. enum: `1`, `2`", + "description": "Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. Tunnel version value for custom tunnel configuration", "enum": [ "1", "2" @@ -21018,12 +22032,14 @@ }, "tunnel_provider_options": { "additionalProperties": false, + "description": "Provider-specific options for tunnels terminated by this gateway", "properties": { "jse": { "additionalProperties": false, - "description": "For jse-ipsec, this allows provisioning of adequate resource on JSE. Make sure adequate licenses are added", + "description": "Juniper Secure Edge provisioning options for tunnel endpoints", "properties": { "num_users": { + "description": "User capacity to provision on Juniper Secure Edge", "examples": [ 5 ], @@ -21041,6 +22057,7 @@ }, "prisma": { "additionalProperties": false, + "description": "Palo Alto Prisma Access provisioning options for tunnel endpoints", "properties": { "service_account_name": { "description": "For prisma-ipsec, service account name to used for tunnel auto provisioning", @@ -21054,10 +22071,11 @@ }, "zscaler": { "additionalProperties": false, - "description": "For zscaler-ipsec and zscaler-gre", + "description": "Provider settings for Zscaler tunnel endpoints", "properties": { "aup_block_internet_until_accepted": { "default": false, + "description": "Whether Zscaler blocks internet access until the Acceptable Use Policy is accepted", "type": "boolean" }, "aup_enabled": { @@ -21111,12 +22129,14 @@ "type": "boolean" }, "sub_locations": { - "description": "`sub-locations` can be used for specific uses cases to define different configuration based on the user network", + "description": "Per-network Zscaler sub-location settings", "items": { "additionalProperties": false, + "description": "Zscaler sub-location settings for a specific network", "properties": { "aup_block_internet_until_accepted": { "default": false, + "description": "Whether this sub-location blocks internet access until the Acceptable Use Policy is accepted", "type": "boolean" }, "aup_enabled": { @@ -21246,7 +22266,7 @@ "type": "object" }, "type": { - "description": "Device Type. enum: `gateway`", + "description": "Device type discriminator for gateway records", "enum": [ "gateway" ], @@ -21265,7 +22285,7 @@ "additionalProperties": { "type": "string" }, - "description": "Dictionary of name->value, the vars can then be used in Wlans. This can overwrite those from Site Vars", + "description": "Variable values that override site variables for this gateway", "examples": [ { "RADIUS_IP1": "172.31.2.5", @@ -21276,6 +22296,7 @@ }, "vrf_config": { "additionalProperties": false, + "description": "VRF configuration applied to this gateway", "properties": { "enabled": { "description": "Whether to enable VRF (when supported on the device)", @@ -21287,6 +22308,7 @@ "vrf_instances": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway VRF instance and its member networks", "examples": [ { "networks": [ @@ -21297,6 +22319,7 @@ ], "properties": { "networks": { + "description": "Network names included in this gateway VRF instance", "items": { "type": "string" }, @@ -21306,7 +22329,7 @@ }, "type": "object" }, - "description": "Property key is the network name", + "description": "VRF instances configured on this gateway", "examples": [ { "CORP_VRF": { @@ -21320,7 +22343,7 @@ "type": "object" }, "x": { - "description": "X in pixel", + "description": "Horizontal map position of the gateway, in pixels", "examples": [ 53.5 ], @@ -21328,7 +22351,7 @@ "type": "number" }, "y": { - "description": "Y in pixel", + "description": "Vertical map position of the gateway, in pixels", "examples": [ 173.1 ], @@ -21346,11 +22369,11 @@ "org_deviceprofile_ap": { "schema": { "additionalProperties": false, - "description": "Device Profile", + "description": "AP device profile configuration applied to APs at a site or organization", "properties": { "aeroscout": { "additionalProperties": false, - "description": "Aeroscout AP settings", + "description": "Location integration defaults for AeroScout in this AP profile", "properties": { "enabled": { "default": false, @@ -21375,6 +22398,7 @@ }, "port": { "default": 1144, + "description": "Optional if enabled, Aeroscout server port. Defaults to 1144", "type": [ "integer", "null" @@ -21385,6 +22409,7 @@ }, "airista": { "additionalProperties": false, + "description": "Location integration defaults for Airista in this AP profile", "properties": { "enabled": { "default": false, @@ -21404,6 +22429,7 @@ }, "port": { "default": 1144, + "description": "Optional if enabled, Airista server port. Defaults to 1144", "type": [ "integer", "null" @@ -21414,7 +22440,7 @@ }, "ble_config": { "additionalProperties": false, - "description": "BLE AP settings", + "description": "Bluetooth Low Energy beacon and asset defaults in this AP profile", "properties": { "beacon_enabled": { "default": true, @@ -21430,7 +22456,7 @@ }, "beacon_rate_mode": { "default": "default", - "description": "enum: `custom`, `default`", + "description": "Beacon rate mode for Mist BLE beacons; use custom to set beacon_rate", "enum": [ "custom", "default" @@ -21441,7 +22467,7 @@ "type": "string" }, "beam_disabled": { - "description": "List of AP BLE location beam numbers (1-8) which should be disabled at the AP and not transmit location information (where beam 1 is oriented at the top the AP, growing counter-clock-wise, with 9 being the omni BLE beam)", + "description": "AP BLE beam numbers disabled for location advertisements", "examples": [ [ 1, @@ -21488,6 +22514,7 @@ }, "eddystone_uid_beams": { "default": "", + "description": "BLE beams used to transmit Eddystone-UID advertisements, expressed as ranges such as `2-4,7`", "examples": [ "2-4,7" ], @@ -21516,7 +22543,7 @@ }, "eddystone_uid_namespace": { "default": "", - "description": "Eddystone-UID namespace", + "description": "Eddystone-UID namespace broadcast by the AP, as a 10-byte hex string", "examples": [ "2818e3868dec25629ede" ], @@ -21534,6 +22561,7 @@ }, "eddystone_url_beams": { "default": "", + "description": "BLE beams used to transmit Eddystone-URL advertisements, expressed as ranges such as `2-4,7`", "examples": [ "2-4,7" ], @@ -21546,7 +22574,7 @@ }, "eddystone_url_freq_msec": { "default": 0, - "description": "Frequency (msec) of data emit by Eddystone-UID beacon", + "description": "Frequency (msec) of data emitted by Eddystone-URL beacon", "examples": [ 1000 ], @@ -21572,6 +22600,7 @@ }, "ibeacon_beams": { "default": "", + "description": "BLE beams used to transmit iBeacon advertisements, expressed as ranges such as `2-4,7`", "examples": [ "2-4,7" ], @@ -21588,7 +22617,7 @@ "type": "integer" }, "ibeacon_major": { - "description": "Major number for iBeacon", + "description": "iBeacon major value broadcast by the AP", "examples": [ 1234 ], @@ -21600,7 +22629,7 @@ ] }, "ibeacon_minor": { - "description": "Minor number for iBeacon", + "description": "iBeacon minor value broadcast by the AP", "examples": [ 1234 ], @@ -21632,7 +22661,7 @@ }, "power_mode": { "default": "default", - "description": "enum: `custom`, `default`", + "description": "Transmit power mode for BLE beacons; use custom to set `power`", "enum": [ "custom", "default" @@ -21646,7 +22675,7 @@ "type": "object" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the AP device profile was created", "format": "double", "readOnly": true, "type": "number" @@ -21673,6 +22702,7 @@ }, "esl_config": { "additionalProperties": false, + "description": "Electronic shelf label integration defaults in this AP profile", "properties": { "cacert": { "description": "Only if `type`==`imagotag` or `type`==`native`", @@ -21708,7 +22738,7 @@ "type": "integer" }, "type": { - "description": "note: ble_config will be ignored if esl_config is enabled and with native mode. enum: `hanshow`, `imagotag`, `native`, `solum`", + "description": "ESL integration type to enable on the AP", "enum": [ "hanshow", "imagotag", @@ -21736,11 +22766,12 @@ "type": "object" }, "for_site": { + "description": "Whether this AP profile is scoped directly to a site", "readOnly": true, "type": "boolean" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the AP device profile", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -21750,11 +22781,11 @@ }, "iot_config": { "additionalProperties": false, - "description": "IoT AP settings", + "description": "Digital and analog IoT pin defaults in this AP profile", "properties": { "A1": { "additionalProperties": false, - "description": "IoT output AP settings", + "description": "Analog-capable IoT pin A1 output settings", "properties": { "enabled": { "default": false, @@ -21777,7 +22808,7 @@ }, "pullup": { "default": "none", - "description": "the type of pull-up the pin uses. enum: `external`, `internal`, `none`", + "description": "Selects the pull-up resistor mode applied to the output pin", "enum": [ "external", "internal", @@ -21797,7 +22828,7 @@ }, "A2": { "additionalProperties": false, - "description": "IoT output AP settings", + "description": "Analog-capable IoT pin A2 output settings", "properties": { "enabled": { "default": false, @@ -21820,7 +22851,7 @@ }, "pullup": { "default": "none", - "description": "the type of pull-up the pin uses. enum: `external`, `internal`, `none`", + "description": "Selects the pull-up resistor mode applied to the output pin", "enum": [ "external", "internal", @@ -21840,7 +22871,7 @@ }, "A3": { "additionalProperties": false, - "description": "IoT output AP settings", + "description": "Analog-capable IoT pin A3 output settings", "properties": { "enabled": { "default": false, @@ -21863,7 +22894,7 @@ }, "pullup": { "default": "none", - "description": "the type of pull-up the pin uses. enum: `external`, `internal`, `none`", + "description": "Selects the pull-up resistor mode applied to the output pin", "enum": [ "external", "internal", @@ -21883,7 +22914,7 @@ }, "A4": { "additionalProperties": false, - "description": "IoT output AP settings", + "description": "Analog-capable IoT pin A4 output settings", "properties": { "enabled": { "default": false, @@ -21906,7 +22937,7 @@ }, "pullup": { "default": "none", - "description": "the type of pull-up the pin uses. enum: `external`, `internal`, `none`", + "description": "Selects the pull-up resistor mode applied to the output pin", "enum": [ "external", "internal", @@ -21926,7 +22957,7 @@ }, "DI1": { "additionalProperties": false, - "description": "IoT Input AP settings", + "description": "Digital input pin DI1 settings", "properties": { "enabled": { "default": false, @@ -21942,7 +22973,7 @@ }, "pullup": { "default": "none", - "description": "the type of pull-up the pin uses. enum: `external`, `internal`, `none`", + "description": "Selects the pull-up resistor mode applied to the input pin", "enum": [ "external", "internal", @@ -21955,7 +22986,7 @@ }, "DI2": { "additionalProperties": false, - "description": "IoT Input AP settings", + "description": "Digital input pin DI2 settings", "properties": { "enabled": { "default": false, @@ -21971,7 +23002,7 @@ }, "pullup": { "default": "none", - "description": "the type of pull-up the pin uses. enum: `external`, `internal`, `none`", + "description": "Selects the pull-up resistor mode applied to the input pin", "enum": [ "external", "internal", @@ -21984,7 +23015,7 @@ }, "DO": { "additionalProperties": false, - "description": "IoT output AP settings", + "description": "Digital output pin DO settings", "properties": { "enabled": { "default": false, @@ -22007,7 +23038,7 @@ }, "pullup": { "default": "none", - "description": "the type of pull-up the pin uses. enum: `external`, `internal`, `none`", + "description": "Selects the pull-up resistor mode applied to the output pin", "enum": [ "external", "internal", @@ -22030,10 +23061,10 @@ }, "ip_config": { "additionalProperties": false, - "description": "IP AP settings", + "description": "Management IP addressing defaults in this AP profile", "properties": { "dns": { - "description": "If `type`==`static`", + "description": "If `type`==`static`. DNS server IP addresses for AP management traffic", "examples": [ [ "8.8.8.8", @@ -22046,7 +23077,7 @@ "type": "array" }, "dns_suffix": { - "description": "Required if `type`==`static`", + "description": "If `type`==`static`. DNS search suffixes applied to AP management lookups", "examples": [ [ ".mist.local", @@ -22059,7 +23090,7 @@ "type": "array" }, "gateway": { - "description": "Required if `type`==`static`", + "description": "Required if `type`==`static`. IPv4 default gateway for AP management traffic", "examples": [ "10.2.1.254" ], @@ -22067,6 +23098,7 @@ "type": "string" }, "gateway6": { + "description": "Required if `type6`==`static`. IPv6 default gateway for AP management traffic when static IPv6 addressing is used", "examples": [ "2607:f8b0:4005:808::1" ], @@ -22074,7 +23106,7 @@ "type": "string" }, "ip": { - "description": "Required if `type`==`static`", + "description": "Required if `type`==`static`. Static IPv4 address for the AP management interface", "examples": [ "10.2.1.1" ], @@ -22082,6 +23114,7 @@ "type": "string" }, "ip6": { + "description": "Required if `type6`==`static`. Static IPv6 address for the AP management interface", "examples": [ "2607:f8b0:4005:808::2004" ], @@ -22089,19 +23122,21 @@ "type": "string" }, "mtu": { + "description": "Maximum transmission unit for AP management traffic", "examples": [ 0 ], "type": "integer" }, "netmask": { - "description": "Required if `type`==`static`", + "description": "Required if `type`==`static`. IPv4 netmask for the AP management interface", "examples": [ "255.255.255.0" ], "type": "string" }, "netmask6": { + "description": "Required if `type6`==`static`. IPv6 prefix length for the AP management interface", "examples": [ "/32" ], @@ -22109,7 +23144,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IPv4 address assignment mode for AP management traffic", "enum": [ "dhcp", "static" @@ -22121,7 +23156,7 @@ }, "type6": { "default": "disabled", - "description": "enum: `autoconf`, `dhcp`, `disabled`, `static`", + "description": "IPv6 address assignment mode for AP management traffic", "enum": [ "autoconf", "dhcp", @@ -22135,7 +23170,7 @@ }, "vlan_id": { "default": 1, - "description": "Management VLAN id, default is 1 (untagged)", + "description": "Management VLAN ID, default is 1 (untagged)", "examples": [ 1 ], @@ -22146,9 +23181,11 @@ }, "lacp_config": { "additionalProperties": false, + "description": "Link aggregation defaults for supported AP Ethernet uplinks", "properties": { "enabled": { "default": false, + "description": "Whether to enable LACP on supported AP Ethernet uplinks", "type": "boolean" } }, @@ -22156,10 +23193,11 @@ }, "led": { "additionalProperties": false, - "description": "LED AP settings", + "description": "Indicator light behavior defaults in this AP profile", "properties": { "brightness": { "default": 255, + "description": "Indicator LED brightness level from 0 to 255", "examples": [ 255 ], @@ -22169,6 +23207,7 @@ }, "enabled": { "default": true, + "description": "Whether the AP indicator LED is enabled", "type": "boolean" } }, @@ -22176,10 +23215,10 @@ }, "mesh": { "additionalProperties": false, - "description": "Mesh AP settings", + "description": "Wireless mesh role and band defaults in this AP profile", "properties": { "bands": { - "description": "List of bands that the mesh should apply to. For relay, the first viable one will be picked. For relay, the first viable one will be picked. enum: `24`, `5`, `6`", + "description": "Radio bands allowed for AP mesh links", "items": { "description": "enum: `24`, `5`, `5-dedicated`, `5-selectable`, `6`, `6-dedicated`, `6-selectable`", "enum": [ @@ -22213,7 +23252,7 @@ ] }, "role": { - "description": "enum: `base`, `remote`", + "description": "Mesh role for this AP, either base or remote", "enum": [ "base", "remote" @@ -22232,18 +23271,20 @@ "type": "object" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the AP device profile was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the AP device profile", "type": [ "string", "null" ] }, "ntp_servers": { + "description": "NTP servers configured by this AP profile", "items": { "type": "string" }, @@ -22251,6 +23292,7 @@ "uniqueItems": true }, "org_id": { + "description": "Organization that owns this AP device profile", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -22266,16 +23308,19 @@ "port_config": { "additionalProperties": { "additionalProperties": false, + "description": "Ethernet port behavior settings for an access point", "properties": { "disabled": { "default": false, + "description": "Whether this AP Ethernet port is disabled", "type": "boolean" }, "dynamic_vlan": { "additionalProperties": false, - "description": "Optional dynamic vlan", + "description": "RADIUS-assigned VLAN settings for AP port authentication", "properties": { "default_vlan_id": { + "description": "Fallback VLAN ID used when RADIUS does not return a dynamic VLAN match", "examples": [ 999 ], @@ -22284,9 +23329,15 @@ "type": "integer" }, "enabled": { + "description": "Whether dynamic VLAN assignment is enabled for this AP port", "type": "boolean" }, "type": { + "description": "Mapping mode for interpreting dynamic VLAN attributes returned by RADIUS", + "enum": [ + "airespace-interface-name", + "standard" + ], "type": "string" }, "vlans": { @@ -22296,10 +23347,11 @@ "null" ] }, + "description": "Mapping entries for RADIUS-assigned VLAN values on this AP port. For `type`==`airespace-interface-name`, the property key is the Airespace interface name returned by RADIUS (e.g. \\"guest\\"), and the value is the corresponding VLAN ID (e.g. 100). For `type`==`standard`, the property key is the VLAN ID number returned by RADIUS, and the value is ignored.", "examples": [ { "1-10": null, - "user": null + "user": 10 } ], "type": "object" @@ -22309,11 +23361,12 @@ }, "enable_mac_auth": { "default": false, + "description": "Whether MAC authentication is enabled on this AP port", "type": "boolean" }, "forwarding": { "default": "all", - "description": "enum: \\n * `all`: local breakout, All VLANs\\n * `limited`: local breakout, only the VLANs configured in `port_vlan_id` and `vlan_ids`\\n * `mxtunnel`: central breakout to an Org Mist Edge (requires `mxtunnel_id`)\\n * `site_mxedge`: central breakout to a Site Mist Edge (requires `mxtunnel_name`)\\n * `wxtunnel`': central breakout to an Org WxTunnel (requires `wxtunnel_id`)", + "description": "Traffic forwarding mode for this AP Ethernet port", "enum": [ "all", "limited", @@ -22333,7 +23386,7 @@ }, "mac_auth_protocol": { "default": "pap", - "description": "if `enable_mac_auth`==`true`, allows user to select an authentication protocol. enum: `eap-md5`, `eap-peap`, `pap`", + "description": "Protocol used for MAC authentication when `enable_mac_auth` is `true`", "enum": [ "eap-md5", "eap-peap", @@ -22343,10 +23396,11 @@ }, "mist_nac": { "additionalProperties": false, + "description": "Juniper Mist NAC settings used by AP port authentication", "properties": { "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled.", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled.", "examples": [ 60 ], @@ -22356,7 +23410,7 @@ }, "auth_servers_retries": { "default": 2, - "description": "Radius auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"retries\\" are set to value of `auth_servers_timeout`. \\"max-requests\\" is also set when setting `auth_servers_retries` is set to default value to 3.", + "description": "RADIUS auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"retries\\" are set to value of `auth_servers_timeout`. \\"max-requests\\" is also set when setting `auth_servers_retries` is set to default value to 3.", "examples": [ 3 ], @@ -22366,7 +23420,7 @@ }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"quite-period\\" and \\"transmit-period\\" are set to half the value of `auth_servers_timeout`. \\"supplicant-timeout\\" is also set when setting `auth_servers_timeout` is set to default value of 10.", + "description": "RADIUS auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"quite-period\\" and \\"transmit-period\\" are set to half the value of `auth_servers_timeout`. \\"supplicant-timeout\\" is also set when setting `auth_servers_timeout` is set to default value of 10.", "examples": [ 5 ], @@ -22437,7 +23491,7 @@ }, "port_auth": { "default": "none", - "description": "When doing port auth. enum: `dot1x`, `none`", + "description": "Authentication mode for this AP Ethernet port", "enum": [ "dot1x", "none" @@ -22448,7 +23502,7 @@ "type": "string" }, "port_vlan_id": { - "description": "If `forwarding`==`limited`", + "description": "If `forwarding`==`limited`. VLAN ID allowed on this AP Ethernet port", "examples": [ 1 ], @@ -22458,18 +23512,20 @@ }, "radius_config": { "additionalProperties": false, - "description": "Junos Radius config", + "description": "RADIUS authentication and accounting settings for this AP port", "properties": { "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled", "maximum": 65535, "minimum": 0, "type": "integer" }, "acct_servers": { + "description": "RADIUS accounting servers used by this Junos configuration", "items": { "additionalProperties": false, + "description": "RADIUS accounting server settings", "properties": { "host": { "$comment": "max depth reached" @@ -22503,9 +23559,10 @@ "uniqueItems": true }, "auth_servers": { + "description": "RADIUS authentication servers used by this Junos configuration", "items": { "additionalProperties": false, - "description": "Authentication Server", + "description": "RADIUS authentication server settings", "properties": { "host": { "$comment": "max depth reached" @@ -22543,30 +23600,32 @@ }, "auth_servers_retries": { "default": 3, - "description": "radius auth session retries", + "description": "Number of RADIUS authentication request retries before failover", "type": "integer" }, "auth_servers_timeout": { "default": 5, - "description": "radius auth session timeout", + "description": "RADIUS authentication server timeout, in seconds", "type": "integer" }, "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled", "type": "boolean" }, "coa_port": { "default": 3799, + "description": "UDP port used for RADIUS Change of Authorization (CoA)", "maximum": 65535, "minimum": 1, "type": "integer" }, "network": { - "description": "use `network`or `source_ip`, which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip", + "description": "Use `network` or `source_ip`. Network where the RADIUS server resides; if the network has a static IP, Mist uses it as the source IP", "type": "string" }, "source_ip": { - "description": "use `network`or `source_ip`", + "description": "Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic", "type": "string" } }, @@ -22574,13 +23633,15 @@ }, "radsec": { "additionalProperties": false, - "description": "RadSec settings", + "description": "TLS-secured RADIUS settings for this AP port", "properties": { "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled for RadSec traffic", "type": "boolean" }, "enabled": { + "description": "Whether RadSec is enabled", "type": "boolean" }, "idle_timeout": { @@ -22593,10 +23654,10 @@ "type": "string" } ], - "description": "Radsec Idle Timeout in seconds. Default is 60" + "description": "Idle timeout, in seconds, for RadSec connections" }, "mxcluster_ids": { - "description": "To use Org mxedges when this WLAN does not use mxtunnel, specify their mxcluster_ids. Org mxedge(s) identified by mxcluster_ids", + "description": "Mist Edge cluster IDs used as RadSec proxies when the WLAN does not use mxtunnel", "items": { "examples": [ "572586b7-f97b-a22b-526c-8b97a3f609c4" @@ -22607,7 +23668,7 @@ "type": "array" }, "proxy_hosts": { - "description": "Default is site.mxedge.radsec.proxy_hosts which must be a superset of all `wlans[*].radsec.proxy_hosts`. When `radsec.proxy_hosts` are not used, tunnel peers (org or site mxedges) are used irrespective of `use_site_mxedge`", + "description": "RadSec proxy hostnames advertised to APs", "items": { "examples": [ "mxedge1.local" @@ -22617,16 +23678,17 @@ "type": "array" }, "server_name": { - "description": "Name of the server to verify (against the cacerts in Org Setting). Only if not Mist Edge.", + "description": "TLS server name to verify against the CA certificates in Org Setting. Only if not Mist Edge.", "examples": [ "radsec.abc.com" ], "type": "string" }, "servers": { - "description": "List of RadSec Servers. Only if not Mist Edge.", + "description": "External RadSec servers. Only if not Mist Edge.", "items": { "additionalProperties": false, + "description": "External RadSec server settings", "properties": { "host": { "$comment": "max depth reached" @@ -22641,19 +23703,19 @@ "uniqueItems": true }, "use_mxedge": { - "description": "use mxedge(s) as RadSec Proxy", + "description": "Whether to use organization Mist Edge instances as RadSec proxies", "type": "boolean" }, "use_site_mxedge": { "default": false, - "description": "To use Site mxedges when this WLAN does not use mxtunnel", + "description": "Whether to use site Mist Edge instances when this WLAN does not use mxtunnel", "type": "boolean" } }, "type": "object" }, "vlan_id": { - "description": "Optional to specify the vlan id for a tunnel if forwarding is for `wxtunnel`, `mxtunnel` or `site_mxedge`.\\n * if vlan_id is not specified then it will use first one in vlan_ids[] of the mxtunnel.\\n * if forwarding == site_mxedge, vlan_ids comes from site_mxedge (`mxtunnels` under site setting)", + "description": "Optional to specify the VLAN ID for a tunnel if forwarding is for `wxtunnel`, `mxtunnel` or `site_mxedge`.\\n * if vlan_id is not specified then it will use first one in vlan_ids[] of the mxtunnel.\\n * if forwarding == site_mxedge, vlan_ids comes from site_mxedge (`mxtunnels` under site setting)", "examples": [ 9 ], @@ -22662,7 +23724,7 @@ "type": "integer" }, "vlan_ids": { - "description": "If `forwarding`==`limited`, comma separated list of additional vlan ids allowed on this port", + "description": "If `forwarding`==`limited`, comma separated list of additional VLAN IDs allowed on this port", "examples": [ "10,20,30" ], @@ -22693,7 +23755,7 @@ }, "pwr_config": { "additionalProperties": false, - "description": "Power related configs", + "description": "Power negotiation and peripheral power defaults in this AP profile", "properties": { "base": { "default": 0, @@ -22713,10 +23775,11 @@ }, "radio_config": { "additionalProperties": false, - "description": "Radio AP settings", + "description": "Radio configuration defaults in this AP profile", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM can be disabled for individual radio-band settings", "type": "boolean" }, "ant_gain_24": { @@ -22745,7 +23808,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Selected radio chain mode for AP models that support antenna mode control", "enum": [ "1x1", "2x2", @@ -22756,7 +23819,7 @@ "type": "string" }, "antenna_select": { - "description": "Antenna Mode for AP which supports selectable antennas. enum: `\\"\\"` (default), `external`, `internal`", + "description": "Internal or external antenna selection for AP models with selectable antennas", "enum": [ "", "external", @@ -22769,14 +23832,16 @@ }, "band_24": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "2.4 GHz radio settings for this access point", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 2.4 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 2.4 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -22786,7 +23851,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 2.4 GHz radio", "enum": [ "1x1", "2x2", @@ -22801,7 +23866,7 @@ }, "bandwidth": { "default": 20, - "description": "channel width for the 2.4GHz band. enum: `0`(disabled, response only), `20`, `40`", + "description": "Channel width configured for the 2.4 GHz radio", "enum": [ 0, 20, @@ -22827,7 +23892,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 2.4 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -22876,7 +23941,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 2.4 GHz radio", "enum": [ "auto", "long", @@ -22888,7 +23953,7 @@ "type": "object" }, "band_24_usage": { - "description": "enum: `24`, `5`, `6`, `auto`", + "description": "Radio usage mode for the 2.4 GHz-capable radio", "enum": [ "24", "5", @@ -22899,14 +23964,16 @@ }, "band_5": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "5 GHz radio settings for this access point", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 5 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 5 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -22915,7 +23982,7 @@ ] }, "antenna_beam_pattern": { - "description": "enum: `narrow`, `medium`, `wide`", + "description": "Beam pattern used by the 5 GHz radio antenna", "enum": [ "narrow", "medium", @@ -22925,7 +23992,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 5 GHz radio", "enum": [ "1x1", "2x2", @@ -22940,7 +24007,7 @@ }, "bandwidth": { "default": 40, - "description": "channel width for the 5GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`", + "description": "Channel width configured for the 5 GHz radio", "enum": [ 0, 20, @@ -22965,7 +24032,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -23014,7 +24081,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 5 GHz radio", "enum": [ "auto", "long", @@ -23027,14 +24094,16 @@ }, "band_5_on_24_radio": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "5 GHz settings used when the 2.4 GHz radio operates in 5 GHz mode", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 5 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 5 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -23043,7 +24112,7 @@ ] }, "antenna_beam_pattern": { - "description": "enum: `narrow`, `medium`, `wide`", + "description": "Beam pattern used by the 5 GHz radio antenna", "enum": [ "narrow", "medium", @@ -23053,7 +24122,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 5 GHz radio", "enum": [ "1x1", "2x2", @@ -23068,7 +24137,7 @@ }, "bandwidth": { "default": 40, - "description": "channel width for the 5GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`", + "description": "Channel width configured for the 5 GHz radio", "enum": [ 0, 20, @@ -23093,7 +24162,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -23142,7 +24211,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 5 GHz radio", "enum": [ "auto", "long", @@ -23155,14 +24224,16 @@ }, "band_6": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "6 GHz radio settings for this access point", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 6 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 6 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -23171,7 +24242,7 @@ ] }, "antenna_beam_pattern": { - "description": "enum: `narrow`, `medium`, `wide`", + "description": "Beam pattern used by the 6 GHz radio antenna", "enum": [ "narrow", "medium", @@ -23181,7 +24252,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 6 GHz radio", "enum": [ "1x1", "2x2", @@ -23196,7 +24267,7 @@ }, "bandwidth": { "default": 80, - "description": "channel width for the 6GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`, `160`", + "description": "Channel width configured for the 6 GHz radio", "enum": [ 0, 20, @@ -23222,7 +24293,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 6 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -23271,7 +24342,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 6 GHz radio", "enum": [ "auto", "long", @@ -23312,6 +24383,7 @@ "type": "object" }, "site_id": { + "description": "Site where this AP device profile is defined, when scoped to a site", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -23322,16 +24394,19 @@ "switch_config": { "additionalProperties": false, "deprecated": true, - "description": "For people who want to fully control the vlans (advanced)", + "description": "Deprecated AP switch configuration defaults in this profile", "properties": { "enabled": { "default": false, + "description": "Whether deprecated AP switch VLAN control is enabled", "type": "boolean" }, "eth0": { "additionalProperties": false, + "description": "VLAN settings for AP eth0", "properties": { "enable_vlan": { + "description": "Whether VLAN tagging is enabled for this AP switch-config port", "type": "boolean" }, "port_vlan_id": { @@ -23345,10 +24420,10 @@ "type": "string" } ], - "description": "Native VLAN id, optional" + "description": "Native VLAN ID for this AP switch-config port" }, "vlan_ids": { - "description": "List of VLAN ids", + "description": "Allowed VLAN IDs for this AP switch-config port", "items": { "maximum": 4094, "minimum": 1, @@ -23361,8 +24436,10 @@ }, "eth1": { "additionalProperties": false, + "description": "VLAN settings for AP eth1", "properties": { "enable_vlan": { + "description": "Whether VLAN tagging is enabled for this AP switch-config port", "type": "boolean" }, "port_vlan_id": { @@ -23376,10 +24453,10 @@ "type": "string" } ], - "description": "Native VLAN id, optional" + "description": "Native VLAN ID for this AP switch-config port" }, "vlan_ids": { - "description": "List of VLAN ids", + "description": "Allowed VLAN IDs for this AP switch-config port", "items": { "maximum": 4094, "minimum": 1, @@ -23392,8 +24469,10 @@ }, "eth2": { "additionalProperties": false, + "description": "VLAN settings for AP eth2", "properties": { "enable_vlan": { + "description": "Whether VLAN tagging is enabled for this AP switch-config port", "type": "boolean" }, "port_vlan_id": { @@ -23407,10 +24486,10 @@ "type": "string" } ], - "description": "Native VLAN id, optional" + "description": "Native VLAN ID for this AP switch-config port" }, "vlan_ids": { - "description": "List of VLAN ids", + "description": "Allowed VLAN IDs for this AP switch-config port", "items": { "maximum": 4094, "minimum": 1, @@ -23423,8 +24502,10 @@ }, "eth3": { "additionalProperties": false, + "description": "VLAN settings for AP eth3", "properties": { "enable_vlan": { + "description": "Whether VLAN tagging is enabled for this AP switch-config port", "type": "boolean" }, "port_vlan_id": { @@ -23438,10 +24519,10 @@ "type": "string" } ], - "description": "Native VLAN id, optional" + "description": "Native VLAN ID for this AP switch-config port" }, "vlan_ids": { - "description": "List of VLAN ids", + "description": "Allowed VLAN IDs for this AP switch-config port", "items": { "maximum": 4094, "minimum": 1, @@ -23454,8 +24535,10 @@ }, "module": { "additionalProperties": false, + "description": "VLAN settings for the AP module port", "properties": { "enable_vlan": { + "description": "Whether VLAN tagging is enabled for this AP switch-config port", "type": "boolean" }, "port_vlan_id": { @@ -23469,10 +24552,10 @@ "type": "string" } ], - "description": "Native VLAN id, optional" + "description": "Native VLAN ID for this AP switch-config port" }, "vlan_ids": { - "description": "List of VLAN ids", + "description": "Allowed VLAN IDs for this AP switch-config port", "items": { "maximum": 4094, "minimum": 1, @@ -23485,8 +24568,10 @@ }, "wds": { "additionalProperties": false, + "description": "VLAN settings for WDS traffic on the AP", "properties": { "enable_vlan": { + "description": "Whether VLAN tagging is enabled for this AP switch-config port", "type": "boolean" }, "port_vlan_id": { @@ -23500,10 +24585,10 @@ "type": "string" } ], - "description": "Native VLAN id, optional" + "description": "Native VLAN ID for this AP switch-config port" }, "vlan_ids": { - "description": "List of VLAN ids", + "description": "Allowed VLAN IDs for this AP switch-config port", "items": { "maximum": 4094, "minimum": 1, @@ -23518,7 +24603,7 @@ "type": "object" }, "type": { - "description": "Device Type. enum: `ap`", + "description": "Device type discriminator for AP device profiles", "enum": [ "ap" ], @@ -23526,7 +24611,7 @@ }, "uplink_port_config": { "additionalProperties": false, - "description": "AP Uplink port configuration", + "description": "Authentication and failover defaults for AP uplink ports", "properties": { "dot1x": { "default": false, @@ -23543,10 +24628,10 @@ }, "usb_config": { "additionalProperties": false, - "description": "USB AP settings\\n - Note: if native imagotag is enabled, BLE will be disabled automatically\\n - Note: legacy, new config moved to ESL Config.", + "description": "Legacy USB integration defaults in this AP profile", "properties": { "cacert": { - "description": "Only if `type`==`imagotag`", + "description": "Only if `type`==`imagotag`. CA certificate used to validate the Imagotag service certificate", "type": [ "string", "null" @@ -23564,7 +24649,7 @@ "type": "boolean" }, "host": { - "description": "Only if `type`==`imagotag`", + "description": "Only if `type`==`imagotag`. Imagotag service host or IP address contacted by the AP", "examples": [ "1.1.1.1" ], @@ -23572,14 +24657,14 @@ }, "port": { "default": 0, - "description": "Only if `type`==`imagotag`", + "description": "Only if `type`==`imagotag`. TCP port used to reach the Imagotag service", "examples": [ 0 ], "type": "integer" }, "type": { - "description": "usb config type. enum: `hanshow`, `imagotag`, `solum`", + "description": "USB integration type for this legacy AP USB configuration", "enum": [ "hanshow", "imagotag", @@ -23606,7 +24691,7 @@ "additionalProperties": { "type": "string" }, - "description": "Dictionary of name->value, the vars can then be used in Wlans. This can overwrite those from Site Vars", + "description": "Variable values provided by this AP device profile", "examples": [ { "RADIUS_IP1": "172.31.2.5", @@ -23617,11 +24702,11 @@ }, "zigbee_config": { "additionalProperties": false, - "description": "Zigbee AP settings", + "description": "Zigbee radio and network defaults in this AP profile", "properties": { "allow_join": { "default": "manual", - "description": "Controls whether new Zigbee devices are allowed to join the network. enum: `always`, `manual`", + "description": "Join policy for new Zigbee devices on this AP", "enum": [ "always", "manual" @@ -23683,19 +24768,23 @@ "description": "Switch Device Profiles can be applied to one or multiple switches. The settings from the Device Profile will override the settings from the Switch Template and the Site Settings.", "properties": { "acl_policies": { + "description": "ACL policy defaults provided by this switch profile", "items": { "additionalProperties": false, "description": "ACL Policy:\\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to", "properties": { "actions": { - "description": "ACL Policy Actions:\\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to", + "description": "Destination tag actions evaluated for sources matching this ACL policy", "items": { "additionalProperties": false, + "description": "Action applied to traffic that matches a destination ACL tag", "properties": { "action": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Allow or deny decision applied to traffic matching the destination tag" }, "dst_tag": { + "description": "Destination ACL tag matched by this policy action", "examples": [ "corp" ], @@ -23710,13 +24799,14 @@ "type": "array" }, "name": { + "description": "Display name of the ACL policy", "examples": [ "guest access" ], "type": "string" }, "src_tags": { - "description": "ACL Policy Source Tags:\\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to", + "description": "Source ACL tags that select traffic for this ACL policy", "items": { "examples": [ "macs" @@ -23739,7 +24829,7 @@ "default": [ "any" ], - "description": "ARP / IPv6. Default is `any`", + "description": "Layer 2 EtherTypes matched by this ACL tag; defaults to `any`", "items": { "type": "string" }, @@ -23750,7 +24840,7 @@ "type": "integer" }, "macs": { - "description": "Required if \\n- `type`==`mac`\\n- `type`==`static_gbp` if from matching mac", + "description": "Client or resource MAC addresses matched by this ACL tag", "items": { "type": "string" }, @@ -23761,7 +24851,7 @@ "type": "string" }, "port_usage": { - "description": "Required if `type`==`port_usage`", + "description": "Required if `type`==`port_usage`. Switch port usage name matched by this ACL tag", "type": "string" }, "radius_group": { @@ -23769,9 +24859,10 @@ "type": "string" }, "specs": { - "description": "If `type`==`resource`, `type`==`radius_group`, `type`==`port_usage` or `type`==`gbp_resource`. Empty means unrestricted, i.e. any", + "description": "Layer 4 protocol and destination-port constraints for this ACL tag", "items": { "additionalProperties": false, + "description": "Layer 4 protocol and destination-port match constraint for an ACL tag", "properties": { "port_range": { "default": "0", @@ -23789,14 +24880,14 @@ "type": "array" }, "subnets": { - "description": "If \\n- `type`==`subnet` \\n- `type`==`resource` (optional. default is `any`)\\n- `type`==`static_gbp` if from matching subnet", + "description": "IP subnets matched by this ACL tag", "items": { "type": "string" }, "type": "array" }, "type": { - "description": "enum: \\n * `any`: matching anything not identified\\n * `dynamic_gbp`: from the gbp_tag received from RADIUS\\n * `gbp_resource`: can only be used in `dst_tags`\\n * `mac`\\n * `network`\\n * `port_usage`\\n * `radius_group`\\n * `resource`: can only be used in `dst_tags`\\n * `static_gbp`: applying gbp tag against matching conditions\\n * `subnet`'", + "description": "Classifier type that determines which ACL tag fields are evaluated", "enum": [ "any", "dynamic_gbp", @@ -23817,11 +24908,11 @@ ], "type": "object" }, - "description": "ACL Tags to identify traffic source or destination. Key name is the tag name", + "description": "ACL tags available to switch access policies in this profile", "type": "object" }, "additional_config_cmds": { - "description": "additional CLI commands to append to the generated Junos config. **Note**: no check is done", + "description": "Additional CLI configuration commands provided by this switch profile", "items": { "description": "JUNOS \\"set\\" command to add to the generated configuration", "examples": [ @@ -23834,12 +24925,15 @@ "aggregate_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Aggregate route configuration for a network or routing instance", "properties": { "discard": { "default": false, + "description": "Whether to install the aggregate route as a discard route", "type": "boolean" }, "metric": { + "description": "Routing metric assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -23848,6 +24942,7 @@ ] }, "preference": { + "description": "Route preference assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -23858,7 +24953,7 @@ }, "type": "object" }, - "description": "Property key is the destination subnet (e.g. \\"172.16.3.0/24\\")", + "description": "Additional IPv4 aggregate route defaults in this switch profile", "examples": [ { "172.16.3.0/24": { @@ -23873,12 +24968,15 @@ "aggregate_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Aggregate route configuration for a network or routing instance", "properties": { "discard": { "default": false, + "description": "Whether to install the aggregate route as a discard route", "type": "boolean" }, "metric": { + "description": "Routing metric assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -23887,6 +24985,7 @@ ] }, "preference": { + "description": "Route preference assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -23897,7 +24996,7 @@ }, "type": "object" }, - "description": "Property key is the destination subnet (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "Additional IPv6 aggregate route defaults in this switch profile", "example": { "2a02:1234:420a:10c9::/64": { "discard": false, @@ -23908,15 +25007,17 @@ "type": "object" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the switch profile was created", "format": "double", "readOnly": true, "type": "number" }, "dhcp_snooping": { "additionalProperties": false, + "description": "DHCP snooping defaults provided by this switch profile", "properties": { "all_networks": { + "description": "Whether DHCP snooping applies to all configured networks", "type": "boolean" }, "enable_arp_spoof_check": { @@ -23928,10 +25029,11 @@ "type": "boolean" }, "enabled": { + "description": "Whether DHCP snooping is enabled", "type": "boolean" }, "networks": { - "description": "If `all_networks`==`false`, list of network with DHCP snooping enabled", + "description": "Network names with DHCP snooping enabled when `all_networks`==`false`", "items": { "type": "string" }, @@ -23943,10 +25045,10 @@ "dhcpd_config": { "additionalProperties": { "additionalProperties": false, - "description": "the Property key is the network name. In case of DHCP relay, it's common for many networks to use the same dhcp relay, comma-separated network names can be used here (e.g. \\"net1,net2\\")", + "description": "DHCP server or relay configuration for one switch network. The property key is the network name. In case of DHCP relay, it's common for many networks to use the same dhcp relay, comma-separated network names can be used here (e.g. \\"net1,net2\\")", "properties": { "dns_servers": { - "description": "If `type`==`server` or `type6`==`server` - optional, if not defined, system one will be used", + "description": "If `type`==`server` or `type6`==`server`, DNS servers advertised to DHCP clients", "examples": [ [ "8.8.8.8", @@ -23960,7 +25062,7 @@ "type": "array" }, "dns_suffix": { - "description": "If `type`==`server` or `type6`==`server` - optional, if not defined, system one will be used", + "description": "If `type`==`server` or `type6`==`server`, DNS search suffixes advertised to DHCP clients", "examples": [ [ ".mist.local", @@ -23975,26 +25077,30 @@ "fixed_bindings": { "additionalProperties": { "additionalProperties": false, + "description": "Static DHCP binding for a client MAC address", "properties": { "ip": { + "description": "Reserved IPv4 address for this fixed DHCP binding", "examples": [ "192.168.70.35" ], "type": "string" }, "ip6": { + "description": "Reserved IPv6 address for this fixed DHCP binding", "examples": [ "2607:f8b0:4005:808::2" ], "type": "string" }, "name": { + "description": "Friendly name for this fixed DHCP binding", "type": "string" } }, "type": "object" }, - "description": "If `type`==`server` or `type6`==`server`. Property key is the MAC Address. Format is `[0-9a-f]{12}` (e.g. \\"5684dae9ac8b\\")", + "description": "If `type`==`server` or `type6`==`server`, fixed client bindings for DHCP service", "examples": [ { "5684dae9ac8b": { @@ -24013,28 +25119,28 @@ "type": "string" }, "ip_end": { - "description": "If `type`==`server`", + "description": "If `type`==`server`, ending IPv4 address for the DHCP lease pool", "examples": [ "192.168.70.200" ], "type": "string" }, "ip_end6": { - "description": "If `type6`==`server`", + "description": "If `type6`==`server`, ending IPv6 address for the DHCP lease pool", "examples": [ "2607:f8b0:4005:808::ff" ], "type": "string" }, "ip_start": { - "description": "If `type`==`server`", + "description": "If `type`==`server`, starting IPv4 address for the DHCP lease pool", "examples": [ "192.168.70.100" ], "type": "string" }, "ip_start6": { - "description": "If `type6`==`server`", + "description": "If `type6`==`server`, starting IPv6 address for the DHCP lease pool", "examples": [ "2607:f8b0:4005:808::2" ], @@ -24050,17 +25156,20 @@ "options": { "additionalProperties": { "additionalProperties": false, + "description": "Custom DHCP option value", "properties": { "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Data type used to encode this DHCP option value" }, "value": { + "description": "Option value to send for this DHCP option", "type": "string" } }, "type": "object" }, - "description": "If `type`==`server` or `type6`==`server`. Property key is the DHCP option number", + "description": "If `type`==`server` or `type6`==`server`, custom DHCP options advertised to clients", "type": "object" }, "server_id_override": { @@ -24069,7 +25178,7 @@ "type": "boolean" }, "servers": { - "description": "If `type`==`relay`", + "description": "If `type`==`relay`, upstream IPv4 DHCP servers", "examples": [ [ "11.2.3.4" @@ -24081,7 +25190,7 @@ "type": "array" }, "servers6": { - "description": "If `type6`==`relay`", + "description": "If `type6`==`relay`, upstream IPv6 DHCP servers", "examples": [ [ "2607:f8b0:4005:808::64" @@ -24093,7 +25202,7 @@ "type": "array" }, "type": { - "description": "enum: `none`, `relay` (DHCP Relay), `server` (DHCP Server)", + "description": "IPv4 DHCP mode for this switch network", "enum": [ "none", "relay", @@ -24103,7 +25212,7 @@ }, "type6": { "default": "none", - "description": "enum: `none`, `relay` (DHCP Relay), `server` (DHCP Server)", + "description": "IPv6 DHCP mode for this switch network", "enum": [ "none", "relay", @@ -24114,40 +25223,44 @@ "vendor_encapsulated": { "additionalProperties": { "additionalProperties": false, + "description": "Vendor-encapsulated DHCP option value", "properties": { "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Data type used to encode this vendor option value" }, "value": { + "description": "Option value to send for this vendor option", "type": "string" } }, "type": "object" }, - "description": "If `type`==`server` or `type6`==`server`. Property key is :, with\\n * enterprise number: 1-65535 (https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers)\\n * sub option code: 1-255, sub-option code'", + "description": "If `type`==`server` or `type6`==`server`, vendor-encapsulated DHCP options advertised to clients", "type": "object" } }, "type": "object" }, + "description": "DHCP server defaults provided by this switch profile", "properties": { "enabled": { "default": false, - "description": "If set to `true`, enable the DHCP server", + "description": "Whether switch DHCP server or relay configuration is enabled", "type": "boolean" } }, "type": "object" }, "dns_servers": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS servers provided by this switch profile", "items": { "type": "string" }, "type": "array" }, "dns_suffix": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS search suffixes provided by this switch profile", "items": { "type": "string" }, @@ -24155,14 +25268,15 @@ }, "evpn_config": { "additionalProperties": false, - "description": "EVPN Junos settings", + "description": "EVPN defaults applied by this switch profile", "properties": { "enabled": { + "description": "Whether EVPN configuration is enabled on the switch", "readOnly": true, "type": "boolean" }, "role": { - "description": "enum: `access`, `border`, `collapsed-core`, `core`, `distribution`, `esilag-access`, `none`", + "description": "EVPN topology role for the switch", "enum": [ "access", "border", @@ -24182,13 +25296,15 @@ "extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "IPv4 static route settings for a destination prefix", "properties": { "discard": { "default": false, - "description": "This takes precedence", + "description": "Whether to install a discard route; this takes precedence over next-hop settings", "type": "boolean" }, "metric": { + "description": "Route metric for the IPv4 static route", "examples": [ null ], @@ -24202,14 +25318,17 @@ "next_qualified": { "additionalProperties": { "additionalProperties": false, + "description": "Qualified next-hop attributes for an IPv4 static route", "properties": { "metric": { + "description": "Route metric for this qualified IPv4 next hop", "type": [ "integer", "null" ] }, "preference": { + "description": "Route preference for this qualified IPv4 next hop", "type": [ "integer", "null" @@ -24218,6 +25337,7 @@ }, "type": "object" }, + "description": "Qualified next-hop settings keyed by IPv4 next-hop address", "examples": [ { "10.3.1.1": { @@ -24230,9 +25350,11 @@ }, "no_resolve": { "default": false, + "description": "Whether to prevent recursive next-hop resolution for the IPv4 static route", "type": "boolean" }, "preference": { + "description": "Route preference for the IPv4 static route", "examples": [ 30 ], @@ -24244,7 +25366,7 @@ ] }, "via": { - "description": "Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.", + "description": "Next-hop IPv4 address or ECMP next-hop IPv4 addresses for the route", "examples": [ "10.2.1.1", [ @@ -24267,7 +25389,7 @@ }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"10.0.0.0/8\\")", + "description": "Additional IPv4 route defaults in this switch profile", "examples": [ { "0.0.0.0/0": { @@ -24280,13 +25402,15 @@ "extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "IPv6 static route settings for a destination prefix", "properties": { "discard": { "default": false, - "description": "This takes precedence", + "description": "Whether to install a discard route; this takes precedence over next-hop settings", "type": "boolean" }, "metric": { + "description": "Route metric for the IPv6 static route", "examples": [ null ], @@ -24300,14 +25424,17 @@ "next_qualified": { "additionalProperties": { "additionalProperties": false, + "description": "Qualified next-hop attributes for an IPv6 static route", "properties": { "metric": { + "description": "Route metric for this qualified IPv6 next hop", "type": [ "integer", "null" ] }, "preference": { + "description": "Route preference for this qualified IPv6 next hop", "type": [ "integer", "null" @@ -24316,6 +25443,7 @@ }, "type": "object" }, + "description": "Qualified next-hop settings keyed by IPv6 next-hop address", "examples": [ { "2a02:1234:200a::100": { @@ -24328,9 +25456,11 @@ }, "no_resolve": { "default": false, + "description": "Whether to prevent recursive next-hop resolution for the IPv6 static route", "type": "boolean" }, "preference": { + "description": "Route preference for the IPv6 static route", "examples": [ 30 ], @@ -24342,7 +25472,7 @@ ] }, "via": { - "description": "Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.", + "description": "Next-hop IPv6 address or ECMP next-hop IPv6 addresses for the route", "examples": [ "10.2.1.1", [ @@ -24365,7 +25495,7 @@ }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "Additional IPv6 route defaults in this switch profile", "examples": [ { "2a02:1234:420a:10c9::/64": { @@ -24376,7 +25506,7 @@ "type": "object" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the switch profile", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -24391,7 +25521,7 @@ "properties": { "alarm_class": { "default": "minor", - "description": "Alarm class for the switch iot port in. enum: `minor`, `major`", + "description": "Alarm severity class raised for input-triggered switch IOT port events", "enum": [ "minor", "major" @@ -24400,11 +25530,12 @@ }, "enabled": { "default": false, + "description": "Whether this switch IOT port is enabled", "type": "boolean" }, "input_src": { "default": "IN0", - "description": "Only for \\"OUT\\" ports, input source for the switch iot port out. enum: `IN0`, `IN1`", + "description": "Only for `OUT` ports. Input port that triggers this output port", "enum": [ "IN0", "IN1" @@ -24412,19 +25543,21 @@ "type": "string" }, "name": { + "description": "Display name for the switch IOT port", "type": "string" } }, "type": "object" }, - "description": "Property Key is the IOT port name, e.g.: \\n * `IN0` or `IN1` for the FPC0 input port with 5V triggered inputs\\n * `OUT1` for the FPC0 output port (can only be triggered by either IN0 or IN1)\\n * \\"X/IN0`, `X/IN1` and `X/OUT` are used to define IOT ports on VC members", + "description": "IoT port defaults provided by this switch profile", "type": "object" }, "ip_config": { "additionalProperties": false, - "description": "Junos IP Config", + "description": "Management IP addressing defaults in this switch profile", "properties": { "dns": { + "description": "Configured DNS server addresses for Junos management traffic", "items": { "type": "string" }, @@ -24432,6 +25565,7 @@ "uniqueItems": true }, "dns_suffix": { + "description": "DNS search suffixes configured for Junos management traffic", "items": { "type": "string" }, @@ -24439,9 +25573,11 @@ "uniqueItems": true }, "gateway": { + "description": "Default gateway IPv4 address for this Junos IP configuration", "type": "string" }, "ip": { + "description": "Configured IPv4 address for this Junos IP configuration", "type": "string" }, "netmask": { @@ -24449,12 +25585,12 @@ "type": "string" }, "network": { - "description": "Network where this mgmt IP reside, this will be used as default network for outbound-ssh, dns, ntp, dns, tacplus, radius, syslog, snmp", + "description": "Management network for this IP configuration; used as the default source network for outbound SSH, DNS, NTP, TACACS+, RADIUS, syslog, and SNMP", "type": "string" }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IP assignment mode for this Junos IP configuration", "enum": [ "dhcp", "static" @@ -24469,24 +25605,27 @@ }, "mist_nac": { "additionalProperties": false, - "description": "Enable mist_nac to use RadSec", + "description": "Mist NAC defaults applied by this switch profile", "properties": { "enabled": { + "description": "Whether Mist NAC RadSec is enabled for the switch", "type": "boolean" }, "network": { + "description": "Switch network used for Mist NAC RadSec connectivity", "type": "string" } }, "type": "object" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the switch profile was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the switch profile", "type": "string" }, "networks": { @@ -24508,6 +25647,7 @@ "type": "boolean" }, "isolation_vlan_id": { + "description": "Required when `isolation`==`true`. Unique VLAN ID used for client isolation", "examples": [ "3070" ], @@ -24522,6 +25662,7 @@ "type": "string" }, "vlan_id": { + "description": "VLAN identifier for this switch network", "oneOf": [ { "type": "string" @@ -24539,11 +25680,11 @@ ], "type": "object" }, - "description": "Property key is network name", + "description": "Layer 3 networks configured by this switch profile", "type": "object" }, "ntp_servers": { - "description": "List of NTP servers specific to this device. By default, those in Site Settings will be used", + "description": "NTP servers provided by this switch profile", "items": { "type": "string" }, @@ -24551,12 +25692,14 @@ }, "oob_ip_config": { "additionalProperties": false, - "description": "Switch OOB IP Config:\\n - If HA configuration: key parameter will be nodeX (eg: node1)\\n - If there are 2 routing engines, re1 mgmt IP has to be set separately (if desired): key parameter = `re1`", + "description": "Out-of-band management IP defaults in this switch profile", "properties": { "gateway": { + "description": "Default gateway for the out-of-band management interface when `type`==`static`", "type": "string" }, "ip": { + "description": "Static IPv4 address for the out-of-band management interface when `type`==`static`", "type": "string" }, "netmask": { @@ -24569,7 +25712,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IP assignment mode for the out-of-band management interface", "enum": [ "dhcp", "static" @@ -24593,6 +25736,7 @@ "type": "object" }, "org_id": { + "description": "Organization that owns this switch profile", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -24607,6 +25751,7 @@ "properties": { "include_loopback": { "default": false, + "description": "Whether loopback interfaces are included in this OSPF area", "type": "boolean" }, "networks": { @@ -24635,7 +25780,7 @@ }, "auth_type": { "default": "none", - "description": "auth type. enum: `md5`, `none`, `password`", + "description": "Authentication method used by this OSPF network", "enum": [ "md5", "none", @@ -24647,6 +25792,7 @@ "type": "string" }, "bfd_minimum_interval": { + "description": "Minimum BFD interval for this OSPF network, in milliseconds", "examples": [ 500 ], @@ -24655,6 +25801,7 @@ "type": "integer" }, "dead_interval": { + "description": "OSPF dead interval for this network, in seconds", "examples": [ 40 ], @@ -24663,17 +25810,20 @@ "type": "integer" }, "export_policy": { + "description": "Routing policy used to export routes from this OSPF network", "examples": [ "export_policy" ], "type": "string" }, "hello_interval": { + "description": "OSPF hello interval for this network, in seconds", "maximum": 255, "minimum": 1, "type": "integer" }, "import_policy": { + "description": "Routing policy used to import routes for this OSPF network", "examples": [ "import_policy" ], @@ -24681,7 +25831,7 @@ }, "interface_type": { "default": "broadcast", - "description": "interface type (nbma = non-broadcast multi-access). enum: `broadcast`, `nbma`, `p2mp`, `p2p`", + "description": "OSPF interface type used for this network", "enum": [ "broadcast", "nbma", @@ -24691,6 +25841,7 @@ "type": "string" }, "metric": { + "description": "OSPF metric assigned to this network", "examples": [ 10000 ], @@ -24714,6 +25865,7 @@ }, "type": "object" }, + "description": "OSPF network settings keyed by network name", "examples": [ { "corp": { @@ -24736,7 +25888,7 @@ }, "type": { "default": "default", - "description": "OSPF type. enum: `default`, `nssa`, `stub`", + "description": "Area type for this OSPF area", "enum": [ "default", "nssa", @@ -24750,42 +25902,42 @@ }, "type": "object" }, - "description": "Junos OSPF areas. Property key is the OSPF Area (Area should be a number (0-255) / IP address)", + "description": "OSPF area defaults provided by this switch profile", "type": "object" }, "other_ip_configs": { "additionalProperties": { "additionalProperties": false, - "description": "Optional, if it's required to have switch's L3 presence on a network/vlan", + "description": "Optional switch L3 presence on an additional network or VLAN", "properties": { "evpn_anycast": { "default": false, - "description": "For EVPN, if anycast is desired", + "description": "For EVPN, whether anycast is desired", "type": "boolean" }, "ip": { - "description": "Required if `type`==`static`", + "description": "Required if `type`==`static`; IPv4 address for the additional Junos L3 presence", "examples": [ "10.3.3.1" ], "type": "string" }, "ip6": { - "description": "Required if `type6`==`static`", + "description": "Required if `type6`==`static`; IPv6 address for the additional Junos L3 presence", "examples": [ "fdad:b0bc:f29e::3d16" ], "type": "string" }, "netmask": { - "description": "Optional, `subnet` from `network` definition will be used if defined", + "description": "Optional IPv4 netmask; `subnet` from `network` definition will be used if defined", "examples": [ "255.255.255.0" ], "type": "string" }, "netmask6": { - "description": "Optional, `subnet` from `network` definition will be used if defined", + "description": "Optional IPv6 prefix length; `subnet` from `network` definition will be used if defined", "examples": [ "/64" ], @@ -24793,7 +25945,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IPv4 assignment mode for the additional Junos L3 presence", "enum": [ "dhcp", "static" @@ -24805,7 +25957,7 @@ }, "type6": { "default": "disabled", - "description": "enum: `autoconf`, `dhcp`, `disabled`, `static`", + "description": "IPv6 assignment mode for the additional Junos L3 presence", "enum": [ "autoconf", "dhcp", @@ -24826,7 +25978,7 @@ "port_config": { "additionalProperties": { "additionalProperties": false, - "description": "Switch port config", + "description": "Junos switch port configuration", "properties": { "ae_disable_lacp": { "description": "To disable LACP support for the AE interface", @@ -24847,6 +25999,7 @@ }, "aggregated": { "default": false, + "description": "Whether this port is configured as an aggregated Ethernet member", "type": "boolean" }, "critical": { @@ -24855,6 +26008,7 @@ "type": "boolean" }, "description": { + "description": "Human-readable description for this Junos port", "type": "string" }, "disable_autoneg": { @@ -24864,7 +26018,7 @@ }, "duplex": { "default": "auto", - "description": "enum: `auto`, `full`, `half`", + "description": "Link duplex mode for this Junos port", "enum": [ "auto", "full", @@ -24880,6 +26034,7 @@ ] }, "esilag": { + "description": "Whether this Junos port participates in an ESI-LAG", "type": "boolean" }, "mtu": { @@ -24901,6 +26056,7 @@ }, "poe_disabled": { "default": false, + "description": "Whether PoE capabilities are disabled for this Junos port", "type": "boolean" }, "port_network": { @@ -24909,7 +26065,7 @@ }, "speed": { "default": "auto", - "description": "enum: `100m`, `10m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`,`auto`", + "description": "Link speed for this Junos port", "enum": [ "10m", "100m", @@ -24934,15 +26090,16 @@ ], "type": "object" }, - "description": "Property key is the port name or range (e.g. \\"ge-0/0/0-10\\")", + "description": "Per-port wired defaults provided by this switch profile", "type": "object" }, "port_mirroring": { "additionalProperties": { "additionalProperties": false, + "description": "Input and output settings for one switch port mirroring session", "properties": { "input_networks_ingress": { - "description": "At least one of the `input_port_ids_ingress`, `input_port_ids_egress` or `input_networks_ingress ` should be specified", + "description": "At least one mirror input source should be specified. Networks whose ingress traffic is mirrored", "items": { "examples": [ "corp" @@ -24952,7 +26109,7 @@ "type": "array" }, "input_port_ids_egress": { - "description": "At least one of the `input_port_ids_ingress`, `input_port_ids_egress` or `input_networks_ingress ` should be specified", + "description": "At least one mirror input source should be specified. Switch ports whose egress traffic is mirrored", "items": { "examples": [ "ge-0/0/3" @@ -24962,7 +26119,7 @@ "type": "array" }, "input_port_ids_ingress": { - "description": "At least one of the `input_port_ids_ingress`, `input_port_ids_egress` or `input_networks_ingress ` should be specified", + "description": "At least one mirror input source should be specified. Switch ports whose ingress traffic is mirrored", "items": { "examples": [ "ge-0/0/3" @@ -24995,13 +26152,13 @@ }, "type": "object" }, - "description": "Property key is the port mirroring instance name. `port_mirroring` can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 mirroring ports is allowed", + "description": "Port mirroring defaults provided by this switch profile", "type": "object" }, "port_usages": { "additionalProperties": { "additionalProperties": false, - "description": "Junos port usages", + "description": "Junos switch port usage template and authentication settings", "properties": { "all_networks": { "default": false, @@ -25052,7 +26209,7 @@ }, "duplex": { "default": "auto", - "description": "Only if `mode`!=`dynamic`. Link connection mode. enum: `auto`, `full`, `half`", + "description": "Only if `mode`!=`dynamic`. Link duplex mode for this port usage", "enum": [ "auto", "full", @@ -25061,7 +26218,7 @@ "type": "string" }, "dynamic_vlan_networks": { - "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`, if dynamic vlan is used, specify the possible networks/vlans RADIUS can return", + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Networks or VLANs that RADIUS can return for dynamic VLAN assignment", "examples": [ [ "corp", @@ -25110,7 +26267,7 @@ }, "mac_auth_protocol": { "default": "eap-md5", - "description": "Only if `mode`!=`dynamic` and `enable_mac_auth` ==`true`. This type is ignored if mist_nac is enabled. enum: `eap-md5`, `eap-peap`, `pap`", + "description": "Only if `mode`!=`dynamic` and `enable_mac_auth`==`true`. MAC authentication protocol to use; ignored if Mist NAC is enabled", "enum": [ "eap-md5", "eap-peap", @@ -25130,10 +26287,10 @@ "type": "string" } ], - "description": "Only if `mode`!=`dynamic`, max number of mac addresses, default is 0 for unlimited, otherwise range is 1 to 16383 (upper bound constrained by platform)" + "description": "Only if `mode`!=`dynamic`. Maximum number of MAC addresses allowed on the port; 0 means unlimited" }, "mode": { - "description": "`mode`==`dynamic` must only be used if the port usage name is `dynamic`. enum: `access`, `dynamic`, `inet`, `trunk`", + "description": "Switching mode for this port usage", "enum": [ "access", "dynamic", @@ -25156,10 +26313,10 @@ "type": "null" } ], - "description": "Only if `mode`!=`dynamic` media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation. The default value is 1514." + "description": "Only if `mode`!=`dynamic`. MTU for ports using this port usage" }, "networks": { - "description": "Only if `mode`==`trunk`, the list of network/vlans", + "description": "Only if `mode`==`trunk`. Network or VLAN names to trunk", "items": { "type": "string" }, @@ -25181,7 +26338,7 @@ "type": "boolean" }, "poe_priority": { - "description": "PoE priority. enum: `low`, `high`", + "description": "Only if `mode`!=`dynamic`. PoE priority for ports using this port usage", "enum": [ "low", "high" @@ -25189,7 +26346,7 @@ "type": "string" }, "port_auth": { - "description": "Only if `mode`!=`dynamic`. If dot1x is desired, set to dot1x. enum: `dot1x`", + "description": "Only if `mode`!=`dynamic`. 802.1X authentication mode for this port usage", "enum": [ "dot1x" ], @@ -25214,11 +26371,11 @@ "type": "string" } ], - "description": "Only if `mode`!=`dynamic` and `port_auth`=`dot1x` reauthentication interval range (min: 10, max: 65535, default: 3600). Set to 0 to disable reauthentication (no-reauthentication)." + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. RADIUS reauthentication interval for clients on the port" }, "reset_default_when": { "default": "link_down", - "description": "Only if `mode`==`dynamic` Control when the DPC port should be changed to the default port usage. enum: `link_down`, `none` (let the DPC port keep at the current port usage)", + "description": "Only if `mode`==`dynamic`. Condition that resets a dynamic port to the default port usage", "enum": [ "link_down", "none" @@ -25229,29 +26386,33 @@ "type": "string" }, "rules": { - "description": "Only if `mode`==`dynamic`", + "description": "Only if `mode`==`dynamic`. Dynamic matching rules that select the port usage to apply", "items": { "additionalProperties": false, + "description": "Dynamic port usage rule evaluated against LLDP, RADIUS, or peer MAC attributes", "properties": { "description": { "description": "Optional description of the rule", "type": "string" }, "equals": { + "description": "Exact value that the selected source attribute must match", "type": "string" }, "equals_any": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "List of values where any match satisfies this dynamic rule" }, "expression": { "description": "\\"[0:3]\\":\\"abcdef\\" -> \\"abc\\"\\n\\"split(.)[1]\\": \\"a.b.c\\" -> \\"b\\"\\n\\"split(-)[1][0:3]: \\"a1234-b5678-c90\\" -> \\"b56\\"", "type": "string" }, "src": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source attribute evaluated by this dynamic rule" }, "usage": { - "description": "`port_usage` name", + "description": "Port usage name to apply when this dynamic rule matches", "type": "string" } }, @@ -25270,7 +26431,7 @@ ] }, "server_reject_network": { - "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. When radius server reject / fails", + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. When RADIUS server reject / fails", "type": [ "string", "null" @@ -25278,7 +26439,7 @@ }, "speed": { "default": "auto", - "description": "Only if `mode`!=`dynamic`, Port speed, default is auto to automatically negotiate speed enum: `100m`, `10m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`,`auto`", + "description": "Only if `mode`!=`dynamic`. Link speed for this port usage", "enum": [ "10m", "100m", @@ -25295,7 +26456,7 @@ }, "storm_control": { "additionalProperties": false, - "description": "Switch storm control. Only if `mode`!=`dynamic`", + "description": "Only if `mode`!=`dynamic`. Storm-control settings for this port usage", "properties": { "disable_port": { "default": false, @@ -25377,39 +26538,43 @@ }, "type": "object" }, - "description": "Property key is the port usage name. Defines the profiles of port configuration configured on the switch", + "description": "Reusable switch port usage profiles provided by this switch profile", "type": "object" }, "radius_config": { "additionalProperties": false, - "description": "Junos Radius config", + "description": "RADIUS authentication and accounting defaults in this switch profile", "properties": { "acct_immediate_update": { + "description": "Whether immediate RADIUS accounting updates are sent", "type": "boolean" }, "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled", "maximum": 65535, "minimum": 0, "type": "integer" }, "acct_servers": { + "description": "RADIUS accounting servers used by this switch configuration", "items": { "additionalProperties": false, + "description": "RADIUS accounting server settings", "properties": { "host": { - "description": "IP/ hostname of RADIUS server", + "description": "Address or hostname of the RADIUS accounting server", "examples": [ "1.2.3.4" ], "type": "string" }, "keywrap_enabled": { + "description": "Whether RADIUS keywrap is enabled for messages sent to this accounting server", "type": "boolean" }, "keywrap_format": { - "description": "enum: `ascii`, `hex`", + "description": "Encoding format for RADIUS keywrap KEK and MACK values", "enum": [ "ascii", "hex" @@ -25417,12 +26582,14 @@ "type": "string" }, "keywrap_kek": { + "description": "RADIUS keywrap key encryption key (KEK)", "examples": [ "1122334455" ], "type": "string" }, "keywrap_mack": { + "description": "RADIUS keywrap message authentication code key (MACK)", "examples": [ "1122334455" ], @@ -25439,10 +26606,10 @@ "type": "string" } ], - "description": "Radius Auth Port, value from 1 to 65535, default is 1813" + "description": "UDP port used by the RADIUS accounting server" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS accounting server", "examples": [ "testing123" ], @@ -25461,7 +26628,7 @@ }, "auth_server_selection": { "default": "ordered", - "description": "enum: `ordered`, `unordered`", + "description": "Selection strategy for RADIUS authentication servers", "enum": [ "ordered", "unordered" @@ -25469,22 +26636,24 @@ "type": "string" }, "auth_servers": { + "description": "RADIUS authentication servers used by this switch configuration", "items": { "additionalProperties": false, - "description": "Authentication Server", + "description": "RADIUS authentication server settings", "properties": { "host": { - "description": "IP/ hostname of RADIUS server", + "description": "Address or hostname of the RADIUS authentication server", "examples": [ "1.2.3.4" ], "type": "string" }, "keywrap_enabled": { + "description": "Whether RADIUS keywrap is enabled for messages sent to this authentication server", "type": "boolean" }, "keywrap_format": { - "description": "enum: `ascii`, `hex`", + "description": "Encoding format for RADIUS keywrap KEK and MACK values", "enum": [ "ascii", "hex" @@ -25492,12 +26661,14 @@ "type": "string" }, "keywrap_kek": { + "description": "RADIUS keywrap key encryption key (KEK)", "examples": [ "1122334455" ], "type": "string" }, "keywrap_mack": { + "description": "RADIUS keywrap message authentication code key (MACK)", "examples": [ "1122334455" ], @@ -25514,7 +26685,7 @@ "type": "string" } ], - "description": "Radius Auth Port, value from 1 to 65535, default is 1812" + "description": "UDP port used by the RADIUS authentication server" }, "require_message_authenticator": { "default": false, @@ -25522,7 +26693,7 @@ "type": "boolean" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS authentication server", "examples": [ "testing123" ], @@ -25541,16 +26712,17 @@ }, "auth_servers_retries": { "default": 3, - "description": "Radius auth session retries", + "description": "RADIUS auth session retries", "type": "integer" }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout", + "description": "RADIUS auth session timeout", "type": "integer" }, "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled", "type": "boolean" }, "coa_port": { @@ -25564,10 +26736,11 @@ "type": "string" } ], - "description": "Radius CoA Port, value from 1 to 65535, default is 3799" + "description": "UDP port used for RADIUS Change of Authorization (CoA)" }, "fast_dot1x_timers": { "default": false, + "description": "Whether fast 802.1X timers are enabled for RADIUS authentication", "type": "boolean" }, "network": { @@ -25575,7 +26748,7 @@ "type": "string" }, "source_ip": { - "description": "Use `network`or `source_ip`", + "description": "Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic", "type": "string" } }, @@ -25583,9 +26756,11 @@ }, "remote_syslog": { "additionalProperties": false, + "description": "Remote syslog defaults provided by this switch profile", "properties": { "archive": { "additionalProperties": false, + "description": "Retention settings for generated syslog archive files", "properties": { "files": { "anyOf": [ @@ -25596,11 +26771,13 @@ "type": "integer" } ], + "description": "Number of archived syslog files to retain", "examples": [ 20 ] }, "size": { + "description": "Maximum size of each archived syslog file, such as 5m", "examples": [ "5m" ], @@ -25610,6 +26787,7 @@ "type": "object" }, "cacerts": { + "description": "CA certificates used to verify TLS syslog servers", "examples": [ [ "-----BEGIN CERTIFICATE-----\\\\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\\\\n-----END CERTIFICATE-----", @@ -25623,16 +26801,21 @@ }, "console": { "additionalProperties": false, + "description": "Log forwarding filters for console messages sent to remote syslog", "properties": { "contents": { + "description": "Syslog facilities and severities forwarded from console logs", "items": { "additionalProperties": false, + "description": "Syslog message content selector for remote logging", "properties": { "facility": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Syslog facility to match for this selector" }, "severity": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Syslog severity to match for this selector" } }, "type": "object" @@ -25644,19 +26827,25 @@ }, "enabled": { "default": false, + "description": "Whether remote syslog forwarding is enabled", "type": "boolean" }, "files": { + "description": "Local syslog file definitions to generate and forward", "items": { "additionalProperties": false, + "description": "Generated syslog file output settings", "properties": { "archive": { "additionalProperties": false, + "description": "Retention settings for this generated syslog file", "properties": { "files": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Number of archived syslog files to retain" }, "size": { + "description": "Maximum size of each archived syslog file, such as 5m", "examples": [ "5m" ], @@ -25666,31 +26855,36 @@ "type": "object" }, "contents": { + "description": "Syslog facilities and severities written to this file", "items": { "$comment": "max depth reached" }, "type": "array" }, "enable_tls": { - "description": "Only if `protocol`==`tcp`", + "description": "Only if `protocol`==`tcp`, enable TLS for this syslog file destination", "type": "boolean" }, "explicit_priority": { + "description": "Whether to include explicit syslog priority values in file output", "type": "boolean" }, "file": { + "description": "Generated syslog file name", "examples": [ "file-name" ], "type": "string" }, "match": { + "description": "Expression used to filter log messages written to this file", "examples": [ "!alarm|ntp|errors.crc_error[chan]" ], "type": "string" }, "structured_data": { + "description": "Whether to include structured syslog data in file output", "type": "boolean" } }, @@ -25699,7 +26893,7 @@ "type": "array" }, "network": { - "description": "If source_address is configured, will use the vlan firstly otherwise use source_ip", + "description": "Source network used for syslog traffic. If `source_address` is configured, Mist uses the VLAN first; otherwise it uses `source_ip`", "examples": [ "default" ], @@ -25707,9 +26901,11 @@ }, "send_to_all_servers": { "default": false, + "description": "Whether each log entry is sent to all configured remote syslog servers", "type": "boolean" }, "servers": { + "description": "Remote syslog server destinations", "examples": [ [ { @@ -25724,19 +26920,22 @@ ], "items": { "additionalProperties": false, + "description": "Remote syslog server destination settings", "properties": { "contents": { + "description": "Syslog facilities and severities sent to this server", "items": { "$comment": "max depth reached" }, "type": "array" }, "explicit_priority": { + "description": "Whether to include explicit syslog priority values in messages sent to this server", "type": "boolean" }, "facility": { "default": "any", - "description": "enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`", + "description": "Default syslog facility for messages sent to this server", "enum": [ "any", "authorization", @@ -25761,12 +26960,14 @@ "type": "string" }, "host": { + "description": "Address or hostname of the remote syslog server", "examples": [ "syslogd.internal" ], "type": "string" }, "match": { + "description": "Expression used to filter log messages sent to this server", "examples": [ "!alarm|ntp|errors.crc_error[chan]" ], @@ -25784,11 +26985,11 @@ "type": "string" } ], - "description": "Syslog Service Port, value from 1 to 65535" + "description": "Network port used by the remote syslog server" }, "protocol": { "default": "udp", - "description": "enum: `tcp`, `udp`", + "description": "Transport protocol used for this remote syslog server", "enum": [ "tcp", "udp" @@ -25796,13 +26997,14 @@ "type": "string" }, "routing_instance": { + "description": "Routing instance used to reach this remote syslog server", "examples": [ "routing-instance-name" ], "type": "string" }, "server_name": { - "description": "Name of the server", + "description": "TLS server name used when verifying the remote syslog server certificate", "examples": [ "syslogd.internal" ], @@ -25810,7 +27012,7 @@ }, "severity": { "default": "any", - "description": "enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`", + "description": "Default syslog severity for messages sent to this server", "enum": [ "alert", "any", @@ -25824,13 +27026,15 @@ "type": "string" }, "source_address": { - "description": "If source_address is configured, will use the vlan firstly otherwise use source_ip", + "description": "Source address for syslog traffic. If configured, Mist uses the VLAN first; otherwise it uses `source_ip`", "type": "string" }, "structured_data": { + "description": "Whether to include structured syslog data in messages sent to this server", "type": "boolean" }, "tag": { + "description": "Syslog tag value added to messages sent to this server", "type": "string" } }, @@ -25839,7 +27043,7 @@ "type": "array" }, "time_format": { - "description": "enum: `millisecond`, `year`, `year millisecond`", + "description": "Timestamp format used in forwarded syslog messages", "enum": [ "millisecond", "year", @@ -25851,22 +27055,27 @@ "type": "string" }, "users": { + "description": "User-specific syslog logging rules", "items": { "additionalProperties": false, + "description": "User-specific syslog logging rule", "properties": { "contents": { + "description": "Syslog facilities and severities logged for this user rule", "items": { "$comment": "max depth reached" }, "type": "array" }, "match": { + "description": "Expression used to filter user log messages", "examples": [ "\\"!alarm|ntp|errors.crc_error[chan]\\"" ], "type": "string" }, "user": { + "description": "Account name or wildcard matched by this syslog rule", "examples": [ "*" ], @@ -25883,19 +27092,24 @@ "routing_policies": { "additionalProperties": { "additionalProperties": false, + "description": "Switch routing policy made of ordered match-action terms", "properties": { "terms": { - "description": "at least criteria/filter must be specified to match the term, all criteria have to be met", + "description": "Ordered terms evaluated by this switch routing policy", "items": { "additionalProperties": false, + "description": "Switch routing policy term with match criteria and actions", "properties": { "actions": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Policy actions applied when this routing policy term matches" }, "matching": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Route match criteria that must be satisfied before actions are applied" }, "name": { + "description": "Display name of the switch routing policy term", "type": "string" } }, @@ -25911,10 +27125,11 @@ }, "type": "object" }, - "description": "Property key is the routing policy name", + "description": "Routing policy defaults applied by this switch profile", "type": "object" }, "site_id": { + "description": "Site where this switch profile is defined, when scoped to a site", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -25924,18 +27139,23 @@ }, "snmp_config": { "additionalProperties": false, + "description": "SNMP defaults provided by this switch profile", "properties": { "client_list": { + "description": "SNMP client allowlists that can be referenced by communities", "items": { "additionalProperties": false, + "description": "SNMP client allowlist definition", "properties": { "client_list_name": { + "description": "Name of the SNMP client list", "examples": [ "clist-1" ], "type": "string" }, "clients": { + "description": "SNMP client IP addresses or CIDR ranges allowed by this list", "items": { "examples": [ "151.140.101.218/32" @@ -25950,12 +27170,14 @@ "type": "array" }, "contact": { + "description": "Administrative contact string advertised through SNMP", "examples": [ "cns@juniper.net" ], "type": "string" }, "description": { + "description": "Device description string advertised through SNMP", "examples": [ "Juniper QFX Series Switch - 1K_5LA" ], @@ -25963,15 +27185,17 @@ }, "enabled": { "default": true, + "description": "Whether SNMP is enabled", "type": "boolean" }, "engine_id": { + "description": "SNMP engine ID used for SNMPv3", "maxLength": 27, "type": "string" }, "engine_id_type": { "default": "local", - "description": "enum: `local`, `use_mac_address`", + "description": "Method used to derive the SNMP engine ID", "enum": [ "local", "use_mac_address" @@ -25979,12 +27203,14 @@ "type": "string" }, "location": { + "description": "Physical location string advertised through SNMP", "examples": [ "Las Vegas, NV" ], "type": "string" }, "name": { + "description": "System name advertised through SNMP", "examples": [ "TGH-1K-QFX10K" ], @@ -25992,13 +27218,17 @@ }, "network": { "default": "default", + "description": "Management network used for SNMP traffic", "type": "string" }, "trap_groups": { + "description": "SNMP trap group definitions", "items": { "additionalProperties": false, + "description": "SNMP trap group definition", "properties": { "categories": { + "description": "Trap categories included in this SNMP trap group", "items": { "examples": [ "authentication" @@ -26008,13 +27238,14 @@ "type": "array" }, "group_name": { - "description": "Categories list can refer to https://www.juniper.net/documentation/software/topics/task/configuration/snmp_trap-groups-configuring-junos-nm.html", + "description": "Trap group name for this SNMP trap group", "examples": [ "profiler" ], "type": "string" }, "targets": { + "description": "Trap target addresses for this SNMP trap group", "items": { "examples": [ "172.29.158.19" @@ -26025,7 +27256,7 @@ }, "version": { "default": "v2", - "description": "enum: `all`, `v1`, `v2`", + "description": "SNMP trap protocol version used by this group", "enum": [ "all", "v1", @@ -26039,30 +27270,34 @@ "type": "array" }, "v2c_config": { + "description": "SNMPv2c community configuration entries for this SNMP profile", "items": { "additionalProperties": false, + "description": "SNMPv2c community configuration entry", "properties": { "authorization": { + "description": "Access level for the SNMPv2c community", "examples": [ "read-only" ], "type": "string" }, "client_list_name": { - "description": "Client_list_name here should refer to client_list above", + "description": "SNMP client list name referenced by this community", "examples": [ "clist-1" ], "type": "string" }, "community_name": { + "description": "SNMPv2c community string name", "examples": [ "abc123" ], "type": "string" }, "view": { - "description": "View name here should be defined in views above", + "description": "SNMP view name that must be defined in the views list", "examples": [ "all" ], @@ -26075,19 +27310,25 @@ }, "v3_config": { "additionalProperties": false, + "description": "SNMPv3 user, VACM, notify, and target configuration", "properties": { "notify": { + "description": "SNMPv3 notification definitions used for traps and informs", "items": { "additionalProperties": false, + "description": "SNMPv3 notification definition for traps or informs", "properties": { "name": { + "description": "Identifier for this SNMPv3 notification definition", "type": "string" }, "tag": { + "description": "Notification tag used to select target addresses", "type": "string" }, "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Delivery mode for this SNMPv3 notification, such as trap or inform" } }, "type": "object" @@ -26095,13 +27336,17 @@ "type": "array" }, "notify_filter": { + "description": "SNMPv3 notification filter profiles", "items": { "additionalProperties": false, + "description": "SNMPv3 notification filter profile", "properties": { "contents": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "OID filter rules in this notification filter profile" }, "profile_name": { + "description": "Notification filter profile name", "type": "string" } }, @@ -26110,16 +27355,20 @@ "type": "array" }, "target_address": { + "description": "SNMPv3 notification target addresses", "items": { "additionalProperties": false, + "description": "SNMPv3 notification target address entry", "properties": { "address": { + "description": "IP address or hostname of the SNMP target", "examples": [ "10.11.0.2" ], "type": "string" }, "address_mask": { + "description": "Mask applied to the SNMP target address", "examples": [ "255.255.255.0" ], @@ -26127,23 +27376,25 @@ }, "port": { "default": "161", + "description": "UDP port used by the SNMP target", "type": [ "string", "null" ] }, "tag_list": { - "description": "Refer to notify tag, can be multiple with blank", + "description": "Set of notification tags for this target address; use spaces between multiple tags", "type": "string" }, "target_address_name": { + "description": "Name of the SNMP target address entry", "examples": [ "target_address_name" ], "type": "string" }, "target_parameters": { - "description": "Refer to notify target parameters name", + "description": "Target parameter profile referenced by this target address", "type": "string" } }, @@ -26152,27 +27403,33 @@ "type": "array" }, "target_parameters": { + "description": "SNMPv3 target parameter profiles", "items": { "additionalProperties": false, + "description": "SNMPv3 target parameter profile", "properties": { "message_processing_model": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMP message processing model used by this target parameter profile" }, "name": { + "description": "Target parameter profile name", "type": "string" }, "notify_filter": { - "description": "Refer to profile-name in notify_filter", + "description": "Notification filter profile referenced by this target parameter profile", "type": "string" }, "security_level": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Required security level for this target parameter profile" }, "security_model": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Required security model for this target parameter profile" }, "security_name": { - "description": "Refer to security_name in usm", + "description": "USM security name referenced by this target parameter profile", "examples": [ "m01620" ], @@ -26184,11 +27441,14 @@ "type": "array" }, "usm": { + "description": "SNMPv3 USM engine configurations", "items": { "additionalProperties": false, + "description": "SNMPv3 User-based Security Model configuration", "properties": { "engine_type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMP engine type used for this USM configuration" }, "remote_engine_id": { "description": "Required only if `engine_type`==`remote_engine`", @@ -26198,7 +27458,8 @@ "type": "string" }, "users": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMPv3 USM users for this engine" } }, "type": "object" @@ -26207,8 +27468,10 @@ }, "vacm": { "additionalProperties": false, + "description": "SNMPv3 VACM access control configuration", "properties": { "access": { + "description": "VACM access rules for SNMPv3", "items": { "$comment": "max depth reached" }, @@ -26216,12 +27479,15 @@ }, "security_to_group": { "additionalProperties": false, + "description": "VACM security-name to group mappings", "properties": { "content": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "VACM security-name to group mapping entries" }, "security_model": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Required security model for these VACM group mappings" } }, "type": "object" @@ -26233,20 +27499,24 @@ "type": "object" }, "views": { + "description": "SNMP MIB view definitions", "items": { "additionalProperties": false, + "description": "SNMP MIB view definition", "properties": { "include": { - "description": "If the root oid configured is included", + "description": "Whether the root OID is included in this SNMP view", "type": "boolean" }, "oid": { + "description": "Root OID for this SNMP view", "examples": [ "1.3.6.1" ], "type": "string" }, "view_name": { + "description": "Name of the SNMP MIB view definition", "examples": [ "all" ], @@ -26262,6 +27532,7 @@ }, "stp_config": { "additionalProperties": false, + "description": "Spanning Tree Protocol defaults provided by this switch profile", "properties": { "bridge_priority": { "default": "32k", @@ -26276,11 +27547,11 @@ }, "switch_mgmt": { "additionalProperties": false, - "description": "Switch Management settings", + "description": "Management-plane defaults provided by this switch profile", "properties": { "ap_affinity_threshold": { "default": 10, - "description": "AP_affinity_threshold ap_affinity_threshold can be added as a field under site/setting. By default, this value is set to 12. If the field is set in both site/setting and org/setting, the value from site/setting will be used.", + "description": "AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used.", "type": "integer" }, "cli_banner": { @@ -26309,17 +27580,21 @@ "type": "boolean" }, "disable_oob_down_alarm": { + "description": "Whether to suppress alarms when the switch out-of-band management interface is down", "type": "boolean" }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the switch", "type": "boolean" }, "local_accounts": { "additionalProperties": { "additionalProperties": false, + "description": "Local switch user account credentials and access role", "properties": { "password": { + "description": "Local password for the switch user account", "examples": [ "Juniper123" ], @@ -26328,7 +27603,7 @@ }, "role": { "default": "none", - "description": "enum: `admin`, `helpdesk`, `none`, `read`", + "description": "Access role granted to the local switch user account", "enum": [ "admin", "helpdesk", @@ -26340,11 +27615,11 @@ }, "type": "object" }, - "description": "Property key is the user name. For Local user authentication", + "description": "Local switch user accounts keyed by username", "type": "object" }, "mxedge_proxy_host": { - "description": "IP Address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud", + "description": "IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud", "type": "string" }, "mxedge_proxy_port": { @@ -26359,14 +27634,14 @@ "type": "string" } ], - "description": "Mist Edge port used to proxy the switch management traffic to the Mist Cloud. Value in range 1-65535" + "description": "Mist Edge proxy port used for switch management traffic" }, "protect_re": { "additionalProperties": false, - "description": "Restrict inbound-traffic to host\\nwhen enabled, all traffic that is not essential to our operation will be dropped \\ne.g. ntp / dns / traffic to mist will be allowed by default, if dhcpd is enabled, we'll make sure it works", + "description": "Control-plane protection settings for the switch", "properties": { "allowed_services": { - "description": "Optionally, services we'll allow", + "description": "Built-in services explicitly allowed by the Protect RE policy", "examples": [ [ "icmp", @@ -26374,7 +27649,7 @@ ] ], "items": { - "description": "enum: `icmp`, `ssh`", + "description": "Services allowed through protect-RE filters. enum: `icmp`, `ssh`", "enum": [ "icmp", "ssh" @@ -26384,9 +27659,10 @@ "type": "array" }, "custom": { + "description": "Additional ACL entries allowed by the Protect RE policy", "items": { "additionalProperties": false, - "description": "Custom acls", + "description": "Custom Protect RE ACL entry", "properties": { "port_range": { "default": "0", @@ -26397,10 +27673,12 @@ "type": "string" }, "protocol": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Transport protocol matched by this custom Protect RE ACL" }, "subnets": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source subnets matched by this custom Protect RE ACL" } }, "type": "object" @@ -26418,7 +27696,7 @@ "type": "boolean" }, "trusted_hosts": { - "description": "host/subnets we'll allow traffic to/from", + "description": "Trusted host or subnet entries allowed by the Protect RE policy", "items": { "examples": [ "10.242.3.0/24" @@ -26432,26 +27710,29 @@ }, "radius": { "additionalProperties": false, - "description": "By default, `radius_config` will be used. if a different one has to be used set `use_different_radius", + "description": "Management authentication settings using RADIUS", "properties": { "enabled": { + "description": "Whether RADIUS is enabled for switch management authentication", "type": "boolean" }, "radius_config": { "additionalProperties": false, - "description": "Junos Radius config", + "description": "RADIUS configuration used when alternate RADIUS settings are required", "properties": { "acct_immediate_update": { + "description": "Whether immediate RADIUS accounting updates are sent", "type": "boolean" }, "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled", "maximum": 65535, "minimum": 0, "type": "integer" }, "acct_servers": { + "description": "RADIUS accounting servers used by this switch configuration", "items": { "$comment": "max depth reached" }, @@ -26460,7 +27741,7 @@ }, "auth_server_selection": { "default": "ordered", - "description": "enum: `ordered`, `unordered`", + "description": "Selection strategy for RADIUS authentication servers", "enum": [ "ordered", "unordered" @@ -26468,6 +27749,7 @@ "type": "string" }, "auth_servers": { + "description": "RADIUS authentication servers used by this switch configuration", "items": { "$comment": "max depth reached" }, @@ -26476,16 +27758,17 @@ }, "auth_servers_retries": { "default": 3, - "description": "Radius auth session retries", + "description": "RADIUS auth session retries", "type": "integer" }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout", + "description": "RADIUS auth session timeout", "type": "integer" }, "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled", "type": "boolean" }, "coa_port": { @@ -26499,10 +27782,11 @@ "type": "string" } ], - "description": "Radius CoA Port, value from 1 to 65535, default is 3799" + "description": "UDP port used for RADIUS Change of Authorization (CoA)" }, "fast_dot1x_timers": { "default": false, + "description": "Whether fast 802.1X timers are enabled for RADIUS authentication", "type": "boolean" }, "network": { @@ -26510,13 +27794,14 @@ "type": "string" }, "source_ip": { - "description": "Use `network`or `source_ip`", + "description": "Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic", "type": "string" } }, "type": "object" }, "use_different_radius": { + "description": "Selector for alternate RADIUS settings instead of the default switch `radius_config`", "type": "string" } }, @@ -26528,28 +27813,36 @@ "type": "boolean" }, "root_password": { + "description": "Root password for local switch access", "format": "password", "type": "string" }, "tacacs": { "additionalProperties": false, + "description": "Management authentication settings using TACACS+", "properties": { "acct_servers": { + "description": "TACACS+ accounting servers used for switch management sessions", "items": { "additionalProperties": false, + "description": "TACACS+ accounting server settings", "properties": { "host": { + "description": "Address or hostname of the TACACS+ accounting server", "type": "string" }, "port": { + "description": "TCP port used by the TACACS+ accounting server", "type": "string" }, "secret": { + "description": "Shared secret used with this TACACS+ accounting server", "format": "password", "type": "string" }, "timeout": { "default": 10, + "description": "TACACS+ accounting server timeout, in seconds", "type": "integer" } }, @@ -26559,7 +27852,7 @@ }, "default_role": { "default": "none", - "description": "enum: `admin`, `helpdesk`, `none`, `read`", + "description": "Default switch-management role to use for TACACS+ logins", "enum": [ "admin", "helpdesk", @@ -26569,28 +27862,35 @@ "type": "string" }, "enabled": { + "description": "Whether TACACS+ is enabled for switch management authentication", "type": "boolean" }, "network": { - "description": "Which network the TACACS server resides", + "description": "Source network used for connectivity to the TACACS+ servers", "type": "string" }, "tacplus_servers": { + "description": "TACACS+ authentication servers used for switch management logins", "items": { "additionalProperties": false, + "description": "TACACS+ authentication server settings", "properties": { "host": { + "description": "Address or hostname of the TACACS+ authentication server", "type": "string" }, "port": { + "description": "TCP port used by the TACACS+ authentication server", "type": "string" }, "secret": { + "description": "Shared secret used with this TACACS+ authentication server", "format": "password", "type": "string" }, "timeout": { "default": 10, + "description": "TACACS+ authentication server timeout, in seconds", "type": "integer" } }, @@ -26602,14 +27902,14 @@ "type": "object" }, "use_mxedge_proxy": { - "description": "To use mxedge as proxy", + "description": "Whether to use Mist Edge as a proxy for switch management traffic", "type": "boolean" } }, "type": "object" }, "type": { - "description": "Device Type. enum: `switch`", + "description": "Device type discriminator for switch profiles", "enum": [ "switch" ], @@ -26623,6 +27923,7 @@ }, "vrf_config": { "additionalProperties": false, + "description": "VRF defaults applied by this switch profile", "properties": { "enabled": { "description": "Whether to enable VRF (when supported on the device)", @@ -26634,6 +27935,7 @@ "vrf_instances": { "additionalProperties": { "additionalProperties": false, + "description": "Switch VRF instance routing and network membership settings", "examples": [ { "extra_routes": { @@ -26650,12 +27952,15 @@ "aggregate_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Aggregate route configuration for a network or routing instance", "properties": { "discard": { "default": false, + "description": "Whether to install the aggregate route as a discard route", "type": "boolean" }, "metric": { + "description": "Routing metric assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -26664,6 +27969,7 @@ ] }, "preference": { + "description": "Route preference assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -26674,7 +27980,7 @@ }, "type": "object" }, - "description": "Property key is the destination subnet (e.g. \\"172.16.3.0/24\\")", + "description": "IPv4 aggregate routes configured for this VRF instance", "examples": [ { "172.16.3.0/24": { @@ -26689,12 +27995,15 @@ "aggregate_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Aggregate route configuration for a network or routing instance", "properties": { "discard": { "default": false, + "description": "Whether to install the aggregate route as a discard route", "type": "boolean" }, "metric": { + "description": "Routing metric assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -26703,6 +28012,7 @@ ] }, "preference": { + "description": "Route preference assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -26713,7 +28023,7 @@ }, "type": "object" }, - "description": "Property key is the destination subnet (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "IPv6 aggregate routes configured for this VRF instance", "example": { "2a02:1234:420a:10c9::/64": { "discard": false, @@ -26724,27 +28034,30 @@ "type": "object" }, "evpn_auto_loopback_subnet": { + "description": "IPv4 subnet used for automatic EVPN loopback addresses in this VRF instance", "examples": [ "100.101.0.0/24" ], "type": "string" }, "evpn_auto_loopback_subnet6": { + "description": "IPv6 subnet used for automatic EVPN loopback addresses in this VRF instance", "type": "string" }, "extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv4 static route for a VRF instance", "properties": { "via": { - "description": "Next-hop address", + "description": "IPv4 next-hop address for this VRF extra route", "format": "ipv4", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"10.0.0.0/8\\")", + "description": "Additional IPv4 static routes configured for this VRF instance", "examples": [ { "0.0.0.0/0": { @@ -26757,16 +28070,17 @@ "extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv6 static route for a VRF instance", "properties": { "via": { - "description": "Next-hop address", + "description": "IPv6 next-hop address for this VRF extra route", "format": "ipv6", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "Additional IPv6 static routes configured for this VRF instance", "examples": [ { "2a02:1234:420a:10c9::/64": { @@ -26777,6 +28091,7 @@ "type": "object" }, "networks": { + "description": "Names of switch networks included in this VRF instance", "items": { "type": "string" }, @@ -26786,7 +28101,7 @@ }, "type": "object" }, - "description": "Property key is the network name", + "description": "VRF instances configured by this switch profile", "examples": [ { "guest": { @@ -26805,14 +28120,16 @@ }, "vrrp_config": { "additionalProperties": false, - "description": "Junos VRRP config", + "description": "VRRP defaults applied by this switch profile", "properties": { "enabled": { + "description": "Whether VRRP configuration is enabled", "type": "boolean" }, "groups": { "additionalProperties": { "additionalProperties": false, + "description": "VRRP group behavior settings", "properties": { "preempt": { "default": false, @@ -26820,12 +28137,13 @@ "type": "boolean" }, "priority": { + "description": "VRRP priority for this router in the group", "type": "integer" } }, "type": "object" }, - "description": "Property key is the VRRP name", + "description": "VRRP groups keyed by group name", "type": "object" } }, @@ -26846,7 +28164,7 @@ "description": "Gateway Template is applied to a site for gateway(s) in a site.", "properties": { "additional_config_cmds": { - "description": "additional CLI commands to append to the generated Junos config. **Note**: no check is done", + "description": "Additional CLI configuration commands provided by this gateway profile", "items": { "description": "JUNOS \\"set\\" command to add to the generated configuration", "examples": [ @@ -26859,7 +28177,7 @@ "bgp_config": { "additionalProperties": { "additionalProperties": false, - "description": "BFD is enabled when either bfd_minimum_interval or bfd_multiplier is configured", + "description": "BGP session configuration. BFD is enabled when either bfd_minimum_interval or bfd_multiplier is configured", "properties": { "auth_key": { "description": "Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`", @@ -26891,6 +28209,7 @@ "type": "boolean" }, "export": { + "description": "Routing policy applied to routes exported by this BGP session", "type": "string" }, "export_policy": { @@ -26916,6 +28235,7 @@ "type": "integer" }, "import": { + "description": "Routing policy applied to routes imported by this BGP session", "type": "string" }, "import_policy": { @@ -26933,7 +28253,7 @@ "type": "integer" } ], - "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. BGP AS, value in range 1-4294967295", + "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; local BGP Autonomous System (AS) number", "examples": [ 65000 ] @@ -26949,7 +28269,7 @@ "type": "integer" } ], - "description": "BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}` )", + "description": "Default BGP neighbor Autonomous System (AS) number for this session", "examples": [ 65000 ] @@ -26957,6 +28277,7 @@ "neighbors": { "additionalProperties": { "additionalProperties": false, + "description": "Per-neighbor BGP session settings", "properties": { "disabled": { "default": false, @@ -26964,15 +28285,18 @@ "type": "boolean" }, "export_policy": { + "description": "Export policy applied only to this BGP neighbor", "type": "string" }, "hold_time": { "default": 90, + "description": "BGP hold time for this neighbor, in seconds", "maximum": 65535, "minimum": 0, "type": "integer" }, "import_policy": { + "description": "Import policy applied only to this BGP neighbor", "type": "string" }, "multihop_ttl": { @@ -26992,14 +28316,14 @@ "type": "integer" } ], - "description": "BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}` )", + "description": "Autonomous System (AS) number of this BGP neighbor", "examples": [ 65000 ] }, "tunnel_via": { "default": "primary", - "description": "If `via`==`tunnel`, specifies which tunnel (primary/secondary) this neighbor is associated with. enum: `primary`, `secondary`", + "description": "If `via`==`tunnel`, primary or secondary tunnel associated with this BGP neighbor", "enum": [ "primary", "secondary" @@ -27016,7 +28340,7 @@ "type": "object" }, "networks": { - "description": "Optional if `via`==`lan`. List of networks where we expect BGP neighbor to connect to/from", + "description": "Optional if `via`==`lan`; networks where BGP neighbors can connect to or from", "items": { "type": "string" }, @@ -27033,11 +28357,11 @@ "type": "boolean" }, "tunnel_name": { - "description": "Optional if `via`==`tunnel`", + "description": "Optional if `via`==`tunnel`; tunnel name used for this BGP session", "type": "string" }, "type": { - "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. enum: `external`, `internal`", + "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; BGP session type, internal or external", "enum": [ "external", "internal" @@ -27047,7 +28371,7 @@ }, "via": { "default": "lan", - "description": "enum: `lan`, `tunnel`, `vpn`, `wan`", + "description": "Transport used for this BGP session, such as LAN, tunnel, VPN, or WAN", "enum": [ "lan", "tunnel", @@ -27057,11 +28381,11 @@ "type": "string" }, "vpn_name": { - "description": "Optional if `via`==`vpn`", + "description": "Optional if `via`==`vpn`; VPN name used for this BGP session", "type": "string" }, "wan_name": { - "description": "Optional if `via`==`wan`", + "description": "Optional if `via`==`wan`; WAN interface name used for this BGP session", "type": "string" } }, @@ -27070,10 +28394,11 @@ ], "type": "object" }, + "description": "BGP routing defaults for this gateway profile. Property key is the BGP session name", "type": "object" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the gateway profile was created", "format": "double", "readOnly": true, "type": "number" @@ -27081,9 +28406,10 @@ "dhcpd_config": { "additionalProperties": { "additionalProperties": false, + "description": "DHCP server or relay configuration for one network", "properties": { "dns_servers": { - "description": "If `type`==`local` or `type6`==`local` - optional, if not defined, system one will be used", + "description": "If `type`==`local` or `type6`==`local`, DNS servers advertised to DHCP clients", "examples": [ [ "8.8.8.8", @@ -27097,7 +28423,7 @@ "type": "array" }, "dns_suffix": { - "description": "If `type`==`local` or `type6`==`local` - optional, if not defined, system one will be used", + "description": "If `type`==`local` or `type6`==`local`, DNS search suffixes advertised to DHCP clients", "examples": [ [ ".mist.local", @@ -27112,26 +28438,30 @@ "fixed_bindings": { "additionalProperties": { "additionalProperties": false, + "description": "Static DHCP binding for a client MAC address", "properties": { "ip": { + "description": "Reserved IPv4 address for this fixed DHCP binding", "examples": [ "192.168.70.35" ], "type": "string" }, "ip6": { + "description": "Reserved IPv6 address for this fixed DHCP binding", "examples": [ "2607:f8b0:4005:808::2" ], "type": "string" }, "name": { + "description": "Friendly name for this fixed DHCP binding", "type": "string" } }, "type": "object" }, - "description": "If `type`==`local` or `type6`==`local`. Property key is the MAC Address. Format is `[0-9a-f]{12}` (e.g. \\"5684dae9ac8b\\")", + "description": "If `type`==`local` or `type6`==`local`, fixed client bindings for local DHCP service", "examples": [ { "5684dae9ac8b": { @@ -27150,28 +28480,28 @@ "type": "string" }, "ip6_end": { - "description": "If `type6`==`local`", + "description": "If `type6`==`local`, ending IPv6 address for the DHCP lease pool", "examples": [ "2607:f8b0:4005:808::ff" ], "type": "string" }, "ip6_start": { - "description": "If `type6`==`local`", + "description": "If `type6`==`local`, starting IPv6 address for the DHCP lease pool", "examples": [ "2607:f8b0:4005:808::2" ], "type": "string" }, "ip_end": { - "description": "If `type`==`local`", + "description": "If `type`==`local`, ending IPv4 address for the DHCP lease pool", "examples": [ "192.168.70.200" ], "type": "string" }, "ip_start": { - "description": "If `type`==`local`", + "description": "If `type`==`local`, starting IPv4 address for the DHCP lease pool", "examples": [ "192.168.70.100" ], @@ -27187,17 +28517,20 @@ "options": { "additionalProperties": { "additionalProperties": false, + "description": "Custom DHCP option value", "properties": { "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Data type used to encode this DHCP option value" }, "value": { + "description": "Option value to send for this DHCP option", "type": "string" } }, "type": "object" }, - "description": "If `type`==`local` or `type6`==`local`. Property key is the DHCP option number", + "description": "If `type`==`local` or `type6`==`local`, custom DHCP options advertised to clients", "type": "object" }, "server_id_override": { @@ -27206,7 +28539,7 @@ "type": "boolean" }, "servers": { - "description": "If `type`==`relay`", + "description": "If `type`==`relay`, upstream IPv4 DHCP servers", "examples": [ [ "11.2.3.4" @@ -27218,7 +28551,7 @@ "type": "array" }, "serversv6": { - "description": "If `type6`==`relay`", + "description": "If `type6`==`relay`, upstream IPv6 DHCP servers", "examples": [ [ "2607:f8b0:4005:808::64" @@ -27231,7 +28564,7 @@ }, "type": { "default": "local", - "description": "enum: `local` (DHCP Server), `none`, `relay` (DHCP Relay)", + "description": "IPv4 DHCP mode for this network", "enum": [ "local", "none", @@ -27241,7 +28574,7 @@ }, "type6": { "default": "none", - "description": "enum: `local` (DHCP Server), `none`, `relay` (DHCP Relay)", + "description": "IPv6 DHCP mode for this network", "enum": [ "local", "none", @@ -27252,22 +28585,26 @@ "vendor_encapsulated": { "additionalProperties": { "additionalProperties": false, + "description": "Vendor-encapsulated DHCP option value", "properties": { "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Data type used to encode this vendor option value" }, "value": { + "description": "Option value to send for this vendor option", "type": "string" } }, "type": "object" }, - "description": "If `type`==`local` or `type6`==`local`. Property key is :, with\\n * enterprise number: 1-65535 (https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers)\\n * sub option code: 1-255, sub-option code", + "description": "If `type`==`local` or `type6`==`local`, vendor-encapsulated DHCP options advertised to clients", "type": "object" } }, "type": "object" }, + "description": "DHCP server defaults provided by this gateway profile", "properties": { "enabled": { "default": true, @@ -27279,17 +28616,18 @@ }, "dnsOverride": { "default": false, + "description": "Whether DNS server and suffix settings in this profile override inherited values", "type": "boolean" }, "dns_servers": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS servers provided by this gateway profile", "items": { "type": "string" }, "type": "array" }, "dns_suffix": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS search suffixes provided by this gateway profile", "items": { "type": "string" }, @@ -27298,29 +28636,33 @@ "extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway IPv4 extra route next-hop settings", "properties": { "via": { + "description": "Next-hop IPv4 address for the gateway extra route", "format": "ipv4", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"10.0.0.0/8\\"), the destination Network name or a variable (e.g. \\"{{myvar}}\\")", + "description": "Additional IPv4 route defaults in this gateway profile", "type": "object" }, "extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway IPv6 extra route next-hop settings", "properties": { "via": { + "description": "Next-hop IPv6 address for the gateway extra route", "format": "ipv6", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"2a02:1234:420a:10c9::/64\\"), the destination Network name or a variable (e.g. \\"{{myvar}}\\")", + "description": "Additional IPv6 route defaults in this gateway profile", "examples": [ { "2a02:1234:420a:10c9::/64": { @@ -27332,20 +28674,23 @@ }, "gateway_matching": { "additionalProperties": false, - "description": "Gateway matching", + "description": "Matching rules that select gateways for this profile", "properties": { "enable": { + "description": "Whether gateway matching is enabled", "type": "boolean" }, "rules": { + "description": "Gateway matching rules evaluated for this configuration", "items": { "additionalProperties": { "description": "Property key defines the type of matching. e.g: `match_name[0:3]`, `match_model[0-6]` or `match_role`", "type": "string" }, + "description": "Gateway matching rule that applies settings when its match keys select a gateway", "properties": { "additional_config_cmds": { - "description": "additional CLI commands to append to the generated Junos config. **Note**: no check is done", + "description": "For SRX only, additional Junos CLI commands appended when this gateway matching rule applies", "items": { "description": "JUNOS \\"set\\" command to add to the generated configuration", "examples": [ @@ -27356,12 +28701,13 @@ "type": "array" }, "name": { + "description": "Display name for the gateway matching rule", "type": "string" }, "port_config": { "additionalProperties": { "additionalProperties": false, - "description": "Gateway port config", + "description": "Gateway port configuration for LAN, WAN, tunnel, and HA interfaces", "properties": { "ae_disable_lacp": { "$comment": "max depth reached" @@ -27526,7 +28872,7 @@ "type": "object" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the gateway profile", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -27536,9 +28882,10 @@ }, "idp_profiles": { "additionalProperties": { + "description": "Organization IDP profile with a base profile and targeted overwrite rules", "properties": { "base_profile": { - "description": "enum: `critical`, `standard`, `strict`", + "description": "Built-in IDP baseline profile inherited before applying overwrites", "enum": [ "critical", "standard", @@ -27550,13 +28897,13 @@ "type": "string" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the IDP profile was created", "format": "double", "readOnly": true, "type": "number" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the IDP profile", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -27565,18 +28912,20 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the IDP profile was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the IDP profile", "examples": [ "relaxed" ], "type": "string" }, "org_id": { + "description": "Owning organization for the IDP profile", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -27585,16 +28934,21 @@ "type": "string" }, "overwrites": { + "description": "IDP signature override rules applied on top of the base profile", "items": { "additionalProperties": false, + "description": "Override rule that changes the IDP action for matching signatures", "properties": { "action": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Enforcement action applied when this overwrite rule matches" }, "matching": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Criteria that select signatures for this overwrite rule" }, "name": { + "description": "Display name for this IDP profile overwrite rule", "type": "string" } }, @@ -27605,35 +28959,40 @@ }, "type": "object" }, - "description": "Property key is the profile name", + "description": "Intrusion detection and prevention profile defaults in this gateway profile", "type": "object" }, "ip_configs": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway network interface IP configuration", "properties": { "ip": { + "description": "Static IPv4 address for the gateway network interface when `type`==`static`", "format": "ipv4", "type": "string" }, "ip6": { + "description": "Static IPv6 address for the gateway network interface when `type6`==`static`", "format": "ipv6", "type": "string" }, "netmask": { + "description": "IPv4 netmask or prefix length for the gateway network interface when `type`==`static`", "examples": [ "/24" ], "type": "string" }, "netmask6": { + "description": "IPv6 netmask or prefix length for the gateway network interface when `type6`==`static`", "examples": [ "2001:db8:abcd:12::1" ], "type": "string" }, "secondary_ips": { - "description": "Optional list of secondary IPs in CIDR format", + "description": "Additional IPv4 addresses in CIDR notation for this gateway network interface", "examples": [ [ "192.168.50.1/24", @@ -27647,7 +29006,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IPv4 address assignment mode for this gateway network interface", "enum": [ "dhcp", "static" @@ -27659,7 +29018,7 @@ }, "type6": { "default": "disabled", - "description": "enum: `autoconf`, `dhcp`, `disabled`, `static`", + "description": "IPv6 address assignment mode for this gateway network interface", "enum": [ "autoconf", "dhcp", @@ -27674,27 +29033,29 @@ }, "type": "object" }, - "description": "Property key is the network name", + "description": "Gateway interface IP configuration defaults by network name", "type": "object" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the gateway profile was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the gateway profile", "examples": [ "gw_template" ], "type": "string" }, "networks": { + "description": "Layer 3 networks configured by this gateway profile", "items": { - "description": "Networks are usually subnets that have cross-site significance. `networks`in Org Settings will got merged into `networks`in Site Setting. For gateways, they can be used to define Service Routes.", + "description": "Organization-level Layer 3 network definition that can be merged into site settings and used for service routes. Networks are used to define the service routes in the Gateway settings or templates", "properties": { "created_time": { - "description": "When the object has been created, in epoch", + "description": "Epoch timestamp when the network was created", "format": "double", "readOnly": true, "type": "number" @@ -27705,6 +29066,7 @@ "type": "boolean" }, "gateway": { + "description": "IPv4 gateway address for this network", "examples": [ "192.168.70.1" ], @@ -27712,6 +29074,7 @@ "type": "string" }, "gateway6": { + "description": "IPv6 gateway address for this network", "examples": [ "fdad:b0bc:f29e::1" ], @@ -27719,7 +29082,7 @@ "type": "string" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the network", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -27729,8 +29092,10 @@ }, "internal_access": { "additionalProperties": false, + "description": "Internal access settings for this network", "properties": { "enabled": { + "description": "Whether internal access is enabled for this network", "type": "boolean" } }, @@ -27738,20 +29103,22 @@ }, "internet_access": { "additionalProperties": false, - "description": "Whether this network has direct internet access", + "description": "Direct internet access and NAT settings for this network", "properties": { "create_simple_service_policy": { "default": false, + "description": "Whether Mist should create simple service policies for restricted internet access", "type": "boolean" }, "destination_nat": { "additionalProperties": { "$comment": "max depth reached" }, - "description": "Property key can be an External IP (i.e. \\"63.16.0.3\\"), an External IP:Port (i.e. \\"63.16.0.3:443\\"), an External Port (i.e. \\":443\\"), an External CIDR (i.e. \\"63.16.0.0/30\\"), an External CIDR:Port (i.e. \\"63.16.0.0/30:443\\") or a Variable (i.e. \\"{{myvar}}\\"). At least one of the `internal_ip` or `port` must be defined", + "description": "Destination NAT rules for direct internet access", "type": "object" }, "enabled": { + "description": "Whether direct internet access is enabled for this network", "type": "boolean" }, "restricted": { @@ -27763,7 +29130,7 @@ "additionalProperties": { "$comment": "max depth reached" }, - "description": "Property key may be an External IP Address (i.e. \\"63.16.0.3\\"), a CIDR (i.e. \\"63.16.0.12/20\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Static NAT rules for direct internet access", "type": "object" } }, @@ -27774,14 +29141,14 @@ "type": "boolean" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Epoch timestamp when the network was last modified", "format": "double", "readOnly": true, "type": "number" }, "multicast": { "additionalProperties": false, - "description": "Whether to enable multicast support (only PIM-sparse mode is supported)", + "description": "Settings for multicast routing on this network", "properties": { "disable_igmp": { "default": false, @@ -27790,22 +29157,25 @@ }, "enabled": { "default": false, + "description": "Whether multicast support is enabled for this network", "type": "boolean" }, "groups": { "additionalProperties": { "$comment": "max depth reached" }, - "description": "Group address to RP (rendezvous point) mapping. Property Key is the CIDR (example \\"225.1.0.3/32\\")", + "description": "Multicast group-to-RP mappings for this network", "type": "object" } }, "type": "object" }, "name": { + "description": "Display name of the organization network", "type": "string" }, "org_id": { + "description": "Organization that owns this network", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -27814,7 +29184,7 @@ "type": "string" }, "routed_for_networks": { - "description": "For a Network (usually LAN), it can be routable to other networks (e.g. OSPF)", + "description": "Other network names this network can route to, for example through BGP, OSPF or static routes", "items": { "examples": [ "pos" @@ -27824,12 +29194,14 @@ "type": "array" }, "subnet": { + "description": "IPv4 subnet CIDR for this network", "examples": [ "192.168.70.0/24" ], "type": "string" }, "subnet6": { + "description": "IPv6 subnet CIDR for this network", "examples": [ "fdad:b0bc:f29e::/32" ], @@ -27838,17 +29210,20 @@ "tenants": { "additionalProperties": { "additionalProperties": false, + "description": "Tenant address entry for a network", "properties": { "addresses": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "IP addresses or subnets assigned to this tenant in the network" } }, "type": "object" }, - "description": "Property key must be the user/tenant name (i.e. \\"printer-1\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Tenant address mappings associated with this network", "type": "object" }, "vlan_id": { + "description": "VLAN ID or variable associated with this network", "oneOf": [ { "type": "string" @@ -27863,6 +29238,7 @@ "vpn_access": { "additionalProperties": { "additionalProperties": false, + "description": "VPN access settings for a network and VPN pair", "properties": { "advertised_subnet": { "description": "If `routed`==`true`, whether to advertise an aggregated subnet toward HUB this is useful when there are multiple networks on SPOKE's side", @@ -27876,7 +29252,8 @@ "type": "boolean" }, "destination_nat": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Destination NAT rules applied for VPN access to this network" }, "nat_pool": { "description": "If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub, a subnet is required to create and advertise the route to Hub", @@ -27900,17 +29277,20 @@ "type": "boolean" }, "other_vrfs": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Other VRFs that can receive leaked routes from this spoke network" }, "routed": { "description": "Whether this network is routable", "type": "boolean" }, "source_nat": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source NAT settings used when non-routed spoke hosts must be reachable from the hub" }, "static_nat": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Static NAT rules applied for VPN access to this network" }, "summarized_subnet": { "description": "toward overlay, how HUB should deal with routes it received from Spokes", @@ -27936,7 +29316,7 @@ }, "type": "object" }, - "description": "Property key is the VPN name. Whether this network can be accessed from vpn", + "description": "VPN access settings keyed by VPN name for this network", "type": "object" } }, @@ -27949,10 +29329,11 @@ }, "ntpOverride": { "default": false, + "description": "Whether NTP servers in this profile override inherited values", "type": "boolean" }, "ntp_servers": { - "description": "List of NTP servers specific to this device. By default, those in Site Settings will be used", + "description": "NTP servers provided by this gateway profile", "items": { "type": "string" }, @@ -27960,38 +29341,39 @@ }, "oob_ip_config": { "additionalProperties": false, - "description": "Out-of-band (vme/em0/fxp0) IP config", + "description": "Out-of-band management IP defaults in this gateway profile", "properties": { "gateway": { - "description": "If `type`==`static`", + "description": "Default gateway for the out-of-band management interface when `type`==`static`", "type": "string" }, "ip": { - "description": "If `type`==`static`", + "description": "Static IPv4 address for the out-of-band management interface when `type`==`static`", "type": "string" }, "netmask": { - "description": "If `type`==`static`", + "description": "IPv4 netmask or prefix length for the out-of-band management interface when `type`==`static`", "type": "string" }, "node1": { "additionalProperties": false, - "description": "For HA Cluster, node1 can have different IP Config", + "description": "Out-of-band management IP configuration override for node1 in an HA cluster", "properties": { "gateway": { - "description": "If `type`==`static`", + "description": "Default gateway for the node1 out-of-band management interface when `type`==`static`", "type": "string" }, "ip": { + "description": "Static IPv4 address for the node1 out-of-band management interface when `type`==`static`", "type": "string" }, "netmask": { - "description": "Used only if `subnet` is not specified in `networks`", + "description": "IPv4 netmask or prefix length for the node1 out-of-band management interface when `type`==`static`; used only if `subnet` is not specified in `networks`", "type": "string" }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IP assignment mode for the node1 out-of-band management interface", "enum": [ "dhcp", "static" @@ -28012,7 +29394,7 @@ "type": "boolean" }, "vlan_id": { - "description": "If WAN interface is on a VLAN. Can be the VLAN ID (i.e. \\"10\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "VLAN ID used for node1 out-of-band management traffic", "oneOf": [ { "type": "string" @@ -28029,7 +29411,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IP assignment mode for the out-of-band management interface", "enum": [ "dhcp", "static" @@ -28050,7 +29432,7 @@ "type": "boolean" }, "vlan_id": { - "description": "If WAN interface is on a VLAN. Can be the VLAN ID (i.e. \\"10\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "VLAN ID used for out-of-band management traffic", "oneOf": [ { "type": "string" @@ -28066,6 +29448,7 @@ "type": "object" }, "org_id": { + "description": "Organization that owns this gateway profile", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -28076,12 +29459,16 @@ "path_preferences": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway path preference that selects among one or more local, WAN, VPN, or tunnel paths", "properties": { "paths": { + "description": "Candidate paths evaluated for this gateway path preference", "items": { "additionalProperties": false, + "description": "Candidate path within a gateway path preference", "properties": { "cost": { + "description": "Relative cost assigned to this path for gateway path selection", "type": "integer" }, "disabled": { @@ -28101,21 +29488,21 @@ "type": "string" }, "networks": { - "description": "Required when `type`==`local`", + "description": "List of network names used when `type`==`local`", "items": { "$comment": "max depth reached" }, "type": "array" }, "target_ips": { - "description": "If `type`==`local`, if destination IP is to be replaced", + "description": "List of destination IP addresses to replace when `type`==`local`", "items": { "$comment": "max depth reached" }, "type": "array" }, "type": { - "description": "enum: `local`, `tunnel`, `vpn`, `wan`", + "description": "Gateway path source type, such as local network, WAN interface, VPN path, or tunnel", "enum": [ "local", "tunnel", @@ -28125,7 +29512,7 @@ "type": "string" }, "wan_name": { - "description": "Optional if `type`==`vpn`", + "description": "Optional if `type`==`vpn`; WAN interface name associated with the VPN path", "examples": [ "wan0" ], @@ -28141,7 +29528,7 @@ }, "strategy": { "default": "ordered", - "description": "enum: `ecmp`, `ordered`, `weighted`", + "description": "Selection strategy used to evaluate the candidate paths", "enum": [ "ecmp", "ordered", @@ -28158,7 +29545,7 @@ "port_config": { "additionalProperties": { "additionalProperties": false, - "description": "Gateway port config", + "description": "Gateway port configuration for LAN, WAN, tunnel, and HA interfaces", "properties": { "ae_disable_lacp": { "default": false, @@ -28179,6 +29566,7 @@ }, "aggregated": { "default": false, + "description": "Whether the port participates in an aggregated Ethernet interface", "type": "boolean" }, "critical": { @@ -28192,6 +29580,7 @@ }, "disable_autoneg": { "default": false, + "description": "Whether Ethernet autonegotiation is disabled on the port", "type": "boolean" }, "disabled": { @@ -28201,7 +29590,7 @@ }, "dsl_type": { "default": "vdsl", - "description": "if `wan_type`==`dsl`. enum: `adsl`, `vdsl`", + "description": "If `wan_type`==`dsl`. DSL technology used by the WAN port", "enum": [ "adsl", "vdsl" @@ -28220,7 +29609,7 @@ }, "duplex": { "default": "auto", - "description": "enum: `auto`, `full`, `half`", + "description": "Ethernet duplex mode configured on the port", "enum": [ "auto", "full", @@ -28233,24 +29622,24 @@ }, "ip_config": { "additionalProperties": false, - "description": "Junos IP Config", + "description": "Layer 3 IP configuration for the port", "properties": { "dns": { - "description": "Except for out-of_band interface (vme/em0/fxp0)", + "description": "Resolver server IP addresses used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0", "items": { "type": "string" }, "type": "array" }, "dns_suffix": { - "description": "Except for out-of_band interface (vme/em0/fxp0)", + "description": "DNS search suffixes used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0", "items": { "type": "string" }, "type": "array" }, "gateway": { - "description": "Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP Address (i.e. \\"192.168.1.1\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP address (i.e. \\"192.168.1.1\\") or a Variable (i.e. \\"{{myvar}}\\")", "examples": [ "192.168.1.1" ], @@ -28264,7 +29653,7 @@ "type": "string" }, "ip": { - "description": "Interface IP Address (i.e. \\"192.168.1.8\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Interface IP address (i.e. \\"192.168.1.8\\") or a Variable (i.e. \\"{{myvar}}\\")", "examples": [ "192.168.1.8" ], @@ -28298,12 +29687,13 @@ "type": "string" }, "poser_password": { - "description": "If `type`==`pppoe`", + "description": "Password used for PPPoE when `type`==`pppoe`", + "format": "password", "type": "string" }, "pppoe_auth": { "default": "none", - "description": "if `type`==`pppoe`. enum: `chap`, `none`, `pap`", + "description": "Authentication protocol used for PPPoE when `type`==`pppoe`", "enum": [ "chap", "none", @@ -28312,12 +29702,12 @@ "type": "string" }, "pppoe_username": { - "description": "If `type`==`pppoe`", + "description": "Username used for PPPoE when `type`==`pppoe`", "type": "string" }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `pppoe`, `static`", + "description": "IPv4 assignment mode for this gateway port interface", "enum": [ "dhcp", "pppoe", @@ -28327,7 +29717,7 @@ }, "type6": { "default": "autoconf", - "description": "enum: `autoconf`, `dhcp`, `static`", + "description": "IPv6 assignment mode for this gateway port interface", "enum": [ "autoconf", "dhcp", @@ -28339,12 +29729,12 @@ "type": "object" }, "lte_apn": { - "description": "If `wan_type`==`lte`", + "description": "If `wan_type`==`lte`. APN used by the LTE uplink", "type": "string" }, "lte_auth": { "default": "none", - "description": "if `wan_type`==`lte`. enum: `chap`, `none`, `pap`", + "description": "If `wan_type`==`lte`. Authentication method used by the LTE uplink", "enum": [ "chap", "none", @@ -28353,36 +29743,40 @@ "type": "string" }, "lte_backup": { + "description": "Whether the LTE uplink is used as a backup WAN connection", "type": "boolean" }, "lte_password": { - "description": "If `wan_type`==`lte`", + "description": "If `wan_type`==`lte`. Password used for LTE uplink authentication", + "format": "password", "type": "string" }, "lte_username": { - "description": "If `wan_type`==`lte`", + "description": "If `wan_type`==`lte`. Username used for LTE uplink authentication", "type": "string" }, "mtu": { + "description": "Layer 3 MTU configured on the port", "type": "integer" }, "name": { - "description": "Name that we'll use to derive config", + "description": "Interface name used to derive device configuration", "type": "string" }, "networks": { - "description": "If `usage`==`lan`, name of the [networks]($h/Orgs%20Networks/_overview) to attach to the interface", + "description": "If `usage`==`lan`. Networks attached to the interface", "items": { "type": "string" }, "type": "array" }, "outer_vlan_id": { - "description": "For Q-in-Q", + "description": "For Q-in-Q. Outer VLAN ID used for QinQ encapsulation", "type": "integer" }, "poe_disabled": { "default": false, + "description": "Whether PoE output is disabled on the port", "type": "boolean" }, "poe_keep_state_when_reboot": { @@ -28400,7 +29794,7 @@ "type": "boolean" }, "redundant": { - "description": "If HA mode", + "description": "If HA mode. Whether the port participates in the redundant Ethernet configuration", "type": "boolean" }, "redundant_group": { @@ -28418,14 +29812,14 @@ "type": "string" } ], - "description": "For SRX only and if HA Mode. `-1` means it will be managed by the device. Use `>= 0` values to manage it manually. Ensure no conflicting values are assigned across all ports." + "description": "If HA mode and for SRX only. Redundant Ethernet interface index assigned to the port" }, "reth_node": { - "description": "If HA mode", + "description": "If HA mode. Node associated with the redundant Ethernet interface", "type": "string" }, "reth_nodes": { - "description": "SSR only - supporting vlan-based redundancy (matching the size of `networks`)", + "description": "If HA mode and for SSR only. Per-network node assignment used for VLAN-based redundancy", "examples": [ [ "node0", @@ -28439,6 +29833,7 @@ }, "speed": { "default": "auto", + "description": "Link speed configured on the port", "examples": [ "1g" ], @@ -28451,7 +29846,7 @@ }, "svr_port_range": { "default": "none", - "description": "For SSR only", + "description": "For SSR only. Port range configured on the interface", "examples": [ "60000-60005" ], @@ -28459,9 +29854,10 @@ }, "traffic_shaping": { "additionalProperties": false, + "description": "Traffic shaping settings applied to the port", "properties": { "class_percentages": { - "description": "percentages for different class of traffic: high / medium / low / best-effort. Sum must be equal to 100", + "description": "Traffic class bandwidth percentages for high, medium, low, and best-effort queues", "items": { "type": "integer" }, @@ -28469,17 +29865,18 @@ }, "enabled": { "default": false, + "description": "Whether traffic shaping is enabled", "type": "boolean" }, "max_tx_kbps": { - "description": "Interface Transmit Cap in kbps", + "description": "Maximum transmit bandwidth for the interface, in Kbps", "type": "integer" } }, "type": "object" }, "usage": { - "description": "port usage name. enum: `ha_control`, `ha_data`, `lan`, `wan`", + "description": "Logical usage assigned to the port", "enum": [ "ha_control", "ha_data", @@ -28489,7 +29886,7 @@ "type": "string" }, "vlan_id": { - "description": "If WAN interface is on a VLAN. Can be the VLAN ID (i.e. \\"10\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "VLAN ID or variable used when the WAN interface is carried on a VLAN", "oneOf": [ { "type": "string" @@ -28504,10 +29901,11 @@ "vpn_paths": { "additionalProperties": { "additionalProperties": false, + "description": "VPN path settings for traffic that uses a gateway port", "properties": { "bfd_profile": { "default": "broadband", - "description": "Only if the VPN `type`==`hub_spoke`. enum: `broadband`, `lte`", + "description": "BFD profile used for this VPN path when the VPN `type`==`hub_spoke`", "enum": [ "broadband", "lte" @@ -28525,7 +29923,7 @@ }, "role": { "default": "spoke", - "description": "If the VPN `type`==`hub_spoke`, enum: `hub`, `spoke`. If the VPN `type`==`mesh`, enum: `mesh`", + "description": "Gateway role for this VPN path; valid values depend on the VPN `type`", "enum": [ "hub", "mesh", @@ -28535,6 +29933,7 @@ }, "traffic_shaping": { "additionalProperties": false, + "description": "Traffic shaping settings applied to this VPN path", "properties": { "class_percentages": { "$comment": "max depth reached" @@ -28551,12 +29950,12 @@ }, "type": "object" }, - "description": "Property key is the VPN name", + "description": "Per-VPN path settings for traffic that uses this port", "type": "object" }, "wan_arp_policer": { "default": "default", - "description": "Only when `wan_type`==`broadband`. enum: `default`, `max`, `recommended`", + "description": "Only when `wan_type`==`broadband`. ARP policer profile applied to the WAN port", "enum": [ "default", "max", @@ -28581,8 +29980,10 @@ "wan_extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv4 route for a WAN interface", "properties": { "via": { + "description": "IPv4 next-hop address for this WAN extra route", "format": "ipv4", "type": "string" } @@ -28595,8 +29996,10 @@ "wan_extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv6 route for a WAN interface", "properties": { "via": { + "description": "IPv6 next-hop address for this WAN extra route", "format": "ipv6", "type": "string" } @@ -28607,7 +30010,7 @@ "type": "object" }, "wan_networks": { - "description": "Only if `usage`==`wan`. If some networks are connected to this WAN port, it can be added here so policies can be defined", + "description": "Only if `usage`==`wan`. Networks reachable through this WAN port for policy definition", "items": { "type": "string" }, @@ -28615,9 +30018,10 @@ }, "wan_probe_override": { "additionalProperties": false, - "description": "Only if `usage`==`wan`", + "description": "Optional WAN health probe override settings for this port", "properties": { "ip6s": { + "description": "List of IPv6 probe host addresses used by this WAN override", "items": { "type": "string" }, @@ -28625,6 +30029,7 @@ "uniqueItems": true }, "ips": { + "description": "List of IPv4 probe host addresses used by this WAN override", "items": { "type": "string" }, @@ -28633,7 +30038,7 @@ }, "probe_profile": { "default": "broadband", - "description": "enum: `broadband`, `lte`", + "description": "WAN probe profile used for health checks on this port", "enum": [ "broadband", "lte" @@ -28645,7 +30050,7 @@ }, "wan_source_nat": { "additionalProperties": false, - "description": "Only if `usage`==`wan`, optional. By default, source-NAT is performed on all WAN Ports using the interface-ip", + "description": "Source NAT settings applied to traffic leaving this WAN port", "properties": { "disabled": { "default": false, @@ -28671,7 +30076,7 @@ }, "wan_speedtest_mode": { "default": "auto", - "description": "Controls whether Marvis/scheduler can run speedtest on this port. enum: `auto`, `enabled`, `disabled`", + "description": "Controls whether Marvis or the scheduler can run speed tests on this WAN port", "enum": [ "auto", "enabled", @@ -28684,7 +30089,7 @@ }, "wan_type": { "default": "broadband", - "description": "Only if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`", + "description": "Only if `usage`==`wan`. WAN uplink type configured on the port", "enum": [ "broadband", "dsl", @@ -28711,17 +30116,21 @@ "routing_policies": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway routing policy made of ordered match-action terms", "properties": { "terms": { - "description": "zero or more criteria/filter can be specified to match the term, all criteria have to be met", + "description": "Ordered terms evaluated by this gateway routing policy", "items": { "additionalProperties": false, + "description": "Gateway routing policy term with match criteria and actions", "properties": { "actions": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Policy actions applied when this routing policy term matches" }, "matching": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Route match criteria that must be satisfied before actions are applied" } }, "type": "object" @@ -28732,15 +30141,17 @@ }, "type": "object" }, - "description": "Property key is the routing policy name", + "description": "Routing policy defaults applied by this gateway profile", "type": "object" }, "service_policies": { + "description": "Traffic service policy defaults enforced by this gateway profile", "items": { "additionalProperties": false, + "description": "Site-level service policy that allows or denies traffic for tenants and services", "properties": { "action": { - "description": "enum: `allow`, `deny`", + "description": "Allow or deny action for traffic matched by this service policy", "enum": [ "allow", "deny" @@ -28749,19 +30160,20 @@ }, "antivirus": { "additionalProperties": false, - "description": "For SRX-only", + "description": "Malware and virus inspection settings applied by this service policy", "properties": { "avprofile_id": { - "description": "org-level AV Profile can be used, this takes precedence over 'profile'", + "description": "Organization-level antivirus profile ID; takes precedence over inline `profile` settings", "format": "uuid", "type": "string" }, "enabled": { "default": false, + "description": "Whether antivirus inspection is enabled for the service policy", "type": "boolean" }, "profile": { - "description": "Default / noftp / httponly / or keys from av_profiles", + "description": "Antivirus profile name to apply, such as `default`, `noftp`, `httponly`, or an AV profile key", "type": "string" } }, @@ -28769,23 +30181,28 @@ }, "appqoe": { "additionalProperties": false, - "description": "SRX only", + "description": "Application QoE settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether application QoE is enabled for the service policy", "type": "boolean" } }, "type": "object" }, "ewf": { + "description": "Enhanced web filtering rules applied by this service policy", "items": { "additionalProperties": false, + "description": "Enhanced web filtering rule applied by a service policy", "properties": { "alert_only": { + "description": "Whether matching enhanced web filtering traffic is logged without being blocked", "type": "boolean" }, "block_message": { + "description": "Message returned when enhanced web filtering blocks a request", "examples": [ "Access to this URL Category has been blocked" ], @@ -28793,10 +30210,12 @@ }, "enabled": { "default": false, + "description": "Whether this enhanced web filtering rule is enabled", "type": "boolean" }, "profile": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Enhanced web filtering profile applied by this rule" } }, "type": "object" @@ -28805,12 +30224,15 @@ }, "idp": { "additionalProperties": false, + "description": "Intrusion detection and prevention settings applied by this service policy", "properties": { "alert_only": { + "description": "Whether to alert without enforcing IDP prevention actions", "type": "boolean" }, "enabled": { "default": false, + "description": "Whether IDP inspection is enabled for the policy", "type": "boolean" }, "idpprofile_id": { @@ -28830,10 +30252,11 @@ "type": "object" }, "local_routing": { - "description": "access within the same VRF", + "description": "Whether the policy permits access within the same VRF", "type": "boolean" }, "name": { + "description": "Display name of the service policy", "type": "string" }, "path_preference": { @@ -28842,15 +30265,16 @@ }, "secintel": { "additionalProperties": false, - "description": "SRX only", + "description": "Threat intelligence settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether SecIntel inspection is enabled for the service policy", "type": "boolean" }, "profile": { "default": "default", - "description": "enum: `default`, `standard`, `strict`", + "description": "Protection level applied by SecIntel inspection", "enum": [ "default", "standard", @@ -28859,18 +30283,19 @@ "type": "string" }, "secintelprofile_id": { - "description": "org-level secintel Profile can be used, this takes precedence over 'profile'", + "description": "Organization-level SecIntel profile ID; takes precedence over inline `profile` settings", "type": "string" } }, "type": "object" }, "servicepolicy_id": { - "description": "Used to link servicepolicy defined at org level and overwrite some attributes", + "description": "Organization-level service policy identifier used to link and override selected attributes", "format": "uuid", "type": "string" }, "services": { + "description": "Application services or service groups matched by this policy", "items": { "type": "string" }, @@ -28879,48 +30304,59 @@ }, "skyatp": { "additionalProperties": false, - "description": "SRX only", + "description": "Threat inspection settings provided by Sky ATP for this service policy", "properties": { "dns_dga_detection": { "additionalProperties": false, + "description": "Detection settings for DNS DGA threats provided by Sky ATP", "properties": { "enabled": { + "description": "Whether Sky ATP DNS DGA detection is enabled", "type": "boolean" }, "profile": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Sky ATP DNS DGA detection profile to apply" } }, "type": "object" }, "dns_tunnel_detection": { "additionalProperties": false, + "description": "Detection settings for DNS tunneling threats provided by Sky ATP", "properties": { "enabled": { + "description": "Whether Sky ATP DNS tunneling detection is enabled", "type": "boolean" }, "profile": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Sky ATP DNS tunneling detection profile to apply" } }, "type": "object" }, "http_inspection": { "additionalProperties": false, + "description": "Web traffic inspection settings provided by Sky ATP", "properties": { "enabled": { + "description": "Whether Sky ATP HTTP inspection is enabled", "type": "boolean" }, "profile": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Sky ATP HTTP inspection profile to apply" } }, "type": "object" }, "iot_device_policy": { "additionalProperties": false, + "description": "Device threat policy settings provided by Sky ATP for IoT clients", "properties": { "enabled": { + "description": "Whether Sky ATP IoT device policy inspection is enabled", "type": "boolean" } }, @@ -28931,11 +30367,11 @@ }, "ssl_proxy": { "additionalProperties": false, - "description": "For SRX-only", + "description": "TLS inspection settings applied by this service policy", "properties": { "ciphers_category": { "default": "strong", - "description": "enum: `medium`, `strong`, `weak`", + "description": "Allowed cipher strength category for SSL proxy inspection", "enum": [ "medium", "strong", @@ -28945,6 +30381,7 @@ }, "enabled": { "default": false, + "description": "Whether SSL proxy inspection is enabled for the service policy", "type": "boolean" } }, @@ -28952,13 +30389,15 @@ }, "syslog": { "additionalProperties": false, - "description": "Required for syslog logging", + "description": "Remote logging settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether syslog logging is enabled for the service policy", "type": "boolean" }, "server_names": { + "description": "Names of syslog servers that receive logs for this service policy", "examples": [ [ "dc_syslog_server" @@ -28973,6 +30412,7 @@ "type": "object" }, "tenants": { + "description": "User or network tenants matched by this service policy", "items": { "type": "string" }, @@ -28987,10 +30427,11 @@ "tunnel_configs": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway tunnel configuration for provider-managed or custom tunnels", "properties": { "auto_provision": { "additionalProperties": false, - "description": "Auto Provisioning configuration for the tunne. This takes precedence over the `primary` and `secondary` nodes.", + "description": "Provider auto-provisioning settings for tunnel endpoints", "properties": { "enabled": { "description": "Enable auto provisioning for the tunnel. If enabled, the `primary` and `secondary` nodes will be ignored.", @@ -28998,9 +30439,10 @@ }, "latlng": { "additionalProperties": false, - "description": "API override for POP selection", + "description": "Geographic coordinate override used for tunnel POP selection", "properties": { "lat": { + "description": "Geographic latitude used for POP selection override", "examples": [ 37.295833 ], @@ -29008,6 +30450,7 @@ "type": "number" }, "lng": { + "description": "Geographic longitude used for POP selection override", "examples": [ -122.032946 ], @@ -29022,8 +30465,10 @@ "type": "object" }, "primary": { + "description": "Main auto-provisioned tunnel endpoint settings", "properties": { "probe_ips": { + "description": "Probe IP addresses used to monitor auto-provisioned tunnel reachability", "items": { "$comment": "max depth reached" }, @@ -29031,7 +30476,7 @@ "uniqueItems": true }, "wan_names": { - "description": "Optional, only needed if `vars_only`==`false`", + "description": "WAN interface names used by the auto-provisioned tunnel endpoint", "items": { "$comment": "max depth reached" }, @@ -29040,7 +30485,7 @@ } }, "provider": { - "description": "enum: `jse-ipsec`, `zscaler-ipsec`", + "description": "Tunnel provider used for automatic endpoint provisioning", "enum": [ "jse-ipsec", "zscaler-ipsec" @@ -29052,8 +30497,10 @@ "type": "string" }, "secondary": { + "description": "Backup auto-provisioned tunnel endpoint settings", "properties": { "probe_ips": { + "description": "Probe IP addresses used to monitor auto-provisioned tunnel reachability", "items": { "$comment": "max depth reached" }, @@ -29061,7 +30508,7 @@ "uniqueItems": true }, "wan_names": { - "description": "Optional, only needed if `vars_only`==`false`", + "description": "WAN interface names used by the auto-provisioned tunnel endpoint", "items": { "$comment": "max depth reached" }, @@ -29083,12 +30530,12 @@ "type": "object" }, "ike_lifetime": { - "description": "Only if `provider`==`custom-ipsec`", + "description": "Only if `provider`==`custom-ipsec`. IKE lifetime configured for the custom IPsec tunnel", "type": "integer" }, "ike_mode": { "default": "main", - "description": "Only if `provider`==`custom-ipsec`. enum: `aggressive`, `main`", + "description": "Only if `provider`==`custom-ipsec`. IKE negotiation mode for the tunnel", "enum": [ "aggressive", "main" @@ -29096,12 +30543,13 @@ "type": "string" }, "ike_proposals": { - "description": "If `provider`==`custom-ipsec`", + "description": "If `provider`==`custom-ipsec`, IKE proposals used for custom IPsec negotiation", "items": { "additionalProperties": false, + "description": "IKE proposal settings for custom IPsec tunnels", "properties": { "auth_algo": { - "description": "enum: `md5`, `sha1`, `sha2`", + "description": "Integrity algorithm used by this IKE proposal", "enum": [ "md5", "sha1", @@ -29111,7 +30559,7 @@ }, "dh_group": { "default": "14", - "description": "enum:\\n * 1\\n * 2 (1024-bit)\\n * 5\\n * 14 (default, 2048-bit)\\n * 15 (3072-bit)\\n * 16 (4096-bit)\\n * 19 (256-bit ECP)\\n * 20 (384-bit ECP)\\n * 21 (521-bit ECP)\\n * 24 (2048-bit ECP)", + "description": "Diffie-Hellman group used by this IKE proposal", "enum": [ "1", "14", @@ -29128,7 +30576,7 @@ }, "enc_algo": { "default": "aes256", - "description": "enum: `3des`, `aes128`, `aes256`, `aes_gcm128`, `aes_gcm256`", + "description": "Cipher algorithm used by this IKE proposal", "enum": [ "3des", "aes128", @@ -29147,16 +30595,17 @@ "type": "array" }, "ipsec_lifetime": { - "description": "If `provider`==`custom-ipsec`", + "description": "If `provider`==`custom-ipsec`, IPsec lifetime configured for the custom tunnel", "type": "integer" }, "ipsec_proposals": { - "description": "Only if `provider`==`custom-ipsec`", + "description": "Only if `provider`==`custom-ipsec`. IPsec proposals used for custom IPsec negotiation", "items": { "additionalProperties": false, + "description": "IPsec proposal settings for custom IPsec tunnels", "properties": { "auth_algo": { - "description": "enum: `md5`, `sha1`, `sha2`", + "description": "Integrity algorithm used by this IPsec proposal", "enum": [ "md5", "sha1", @@ -29166,7 +30615,7 @@ }, "dh_group": { "default": "14", - "description": "Only if `provider`==`custom-ipsec`. enum:\\n * 1\\n * 2 (1024-bit)\\n * 5\\n * 14 (default, 2048-bit)\\n * 15 (3072-bit)\\n * 16 (4096-bit)\\n * 19 (256-bit ECP)\\n * 20 (384-bit ECP)\\n * 21 (521-bit ECP)\\n * 24 (2048-bit ECP)", + "description": "Diffie-Hellman group used by this IPsec proposal", "enum": [ "1", "14", @@ -29183,7 +30632,7 @@ }, "enc_algo": { "default": "aes256", - "description": "enum: `3des`, `aes128`, `aes256`, `aes_gcm128`, `aes_gcm256`", + "description": "Cipher algorithm used by this IPsec proposal", "enum": [ "3des", "aes128", @@ -29206,7 +30655,7 @@ "type": "string" }, "local_subnets": { - "description": "List of Local protected subnet for policy-based IPSec negotiation", + "description": "Local protected subnets advertised by this tunnel", "items": { "type": "string" }, @@ -29214,7 +30663,7 @@ }, "mode": { "default": "active-standby", - "description": "Required if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`. enum: `active-active`, `active-standby`", + "description": "Tunnel failover mode used for primary and secondary endpoints", "enum": [ "active-active", "active-standby" @@ -29222,7 +30671,7 @@ "type": "string" }, "networks": { - "description": "If `provider`==`custom-ipsec` or `provider`==`prisma-ipsec`, networks reachable via this tunnel", + "description": "Destination networks reachable through this tunnel", "items": { "type": "string" }, @@ -29230,23 +30679,25 @@ }, "primary": { "additionalProperties": false, - "description": "Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "Main remote tunnel endpoint settings", "properties": { "hosts": { + "description": "Remote gateway host addresses for this tunnel node", "items": { - "description": "IP Address of the remote host", + "description": "IP address of the remote host", "type": "string" }, "type": "array" }, "internal_ips": { - "description": "Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`", + "description": "Internal IP addresses configured on this tunnel node", "items": { "type": "string" }, "type": "array" }, "probe_ips": { + "description": "Health-check IP addresses used to monitor this tunnel node", "items": { "type": "string" }, @@ -29254,13 +30705,14 @@ "uniqueItems": true }, "remote_ids": { - "description": "Only if `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "IKE identities expected from this tunnel node", "items": { "type": "string" }, "type": "array" }, "wan_names": { + "description": "Interface names that source tunnel traffic for this node", "items": { "type": "string" }, @@ -29275,7 +30727,7 @@ }, "probe": { "additionalProperties": false, - "description": "Only if `provider`==`custom-ipsec`", + "description": "Tunnel health probe settings", "properties": { "interval": { "description": "How often to trigger the probe", @@ -29291,7 +30743,7 @@ }, "type": { "default": "icmp", - "description": "enum: `http`, `icmp`", + "description": "Protocol used by the custom IPsec tunnel health probe", "enum": [ "http", "icmp" @@ -29302,7 +30754,7 @@ "type": "object" }, "protocol": { - "description": "Only if `provider`==`custom-ipsec`. enum: `gre`, `ipsec`", + "description": "Only if `provider`==`custom-ipsec`. Tunnel protocol for custom tunnel negotiation", "enum": [ "gre", "ipsec" @@ -29310,7 +30762,7 @@ "type": "string" }, "provider": { - "description": "Only if `auto_provision.enabled`==`false`. enum: `custom-ipsec`, `custom-gre`, `jse-ipsec`, `prisma-ipsec`, `zscaler-gre`, `zscaler-ipsec`", + "description": "Tunnel provider used when auto provisioning is disabled", "enum": [ "custom-ipsec", "custom-gre", @@ -29326,7 +30778,7 @@ "type": "string" }, "remote_subnets": { - "description": "List of Remote protected subnet for policy-based IPSec negotiation", + "description": "Remote protected subnets reached through policy-based IPsec", "items": { "type": "string" }, @@ -29334,23 +30786,25 @@ }, "secondary": { "additionalProperties": false, - "description": "Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "Backup remote tunnel endpoint settings", "properties": { "hosts": { + "description": "Remote gateway host addresses for this tunnel node", "items": { - "description": "IP Address of the remote host", + "description": "IP address of the remote host", "type": "string" }, "type": "array" }, "internal_ips": { - "description": "Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`", + "description": "Internal IP addresses configured on this tunnel node", "items": { "type": "string" }, "type": "array" }, "probe_ips": { + "description": "Health-check IP addresses used to monitor this tunnel node", "items": { "type": "string" }, @@ -29358,13 +30812,14 @@ "uniqueItems": true }, "remote_ids": { - "description": "Only if `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "IKE identities expected from this tunnel node", "items": { "type": "string" }, "type": "array" }, "wan_names": { + "description": "Interface names that source tunnel traffic for this node", "items": { "type": "string" }, @@ -29379,7 +30834,7 @@ }, "version": { "default": "2", - "description": "Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. enum: `1`, `2`", + "description": "Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. Tunnel version value for custom tunnel configuration", "enum": [ "1", "2" @@ -29394,12 +30849,14 @@ }, "tunnel_provider_options": { "additionalProperties": false, + "description": "Provider-specific tunnel options defined by this gateway profile", "properties": { "jse": { "additionalProperties": false, - "description": "For jse-ipsec, this allows provisioning of adequate resource on JSE. Make sure adequate licenses are added", + "description": "Juniper Secure Edge provisioning options for tunnel endpoints", "properties": { "num_users": { + "description": "User capacity to provision on Juniper Secure Edge", "examples": [ 5 ], @@ -29417,6 +30874,7 @@ }, "prisma": { "additionalProperties": false, + "description": "Palo Alto Prisma Access provisioning options for tunnel endpoints", "properties": { "service_account_name": { "description": "For prisma-ipsec, service account name to used for tunnel auto provisioning", @@ -29430,10 +30888,11 @@ }, "zscaler": { "additionalProperties": false, - "description": "For zscaler-ipsec and zscaler-gre", + "description": "Provider settings for Zscaler tunnel endpoints", "properties": { "aup_block_internet_until_accepted": { "default": false, + "description": "Whether Zscaler blocks internet access until the Acceptable Use Policy is accepted", "type": "boolean" }, "aup_enabled": { @@ -29487,12 +30946,14 @@ "type": "boolean" }, "sub_locations": { - "description": "`sub-locations` can be used for specific uses cases to define different configuration based on the user network", + "description": "Per-network Zscaler sub-location settings", "items": { "additionalProperties": false, + "description": "Zscaler sub-location settings for a specific network", "properties": { "aup_block_internet_until_accepted": { "default": false, + "description": "Whether this sub-location blocks internet access until the Acceptable Use Policy is accepted", "type": "boolean" }, "aup_enabled": { @@ -29622,7 +31083,7 @@ "type": "object" }, "type": { - "description": "Device Type. enum: `gateway`", + "description": "Device type discriminator for gateway profiles", "enum": [ "gateway" ], @@ -29638,6 +31099,7 @@ }, "vrf_config": { "additionalProperties": false, + "description": "VRF defaults applied by this gateway profile", "properties": { "enabled": { "description": "Whether to enable VRF (when supported on the device)", @@ -29649,6 +31111,7 @@ "vrf_instances": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway VRF instance and its member networks", "examples": [ { "networks": [ @@ -29659,6 +31122,7 @@ ], "properties": { "networks": { + "description": "Network names included in this gateway VRF instance", "items": { "type": "string" }, @@ -29668,7 +31132,7 @@ }, "type": "object" }, - "description": "Property key is the network name", + "description": "VRF instances configured by this gateway profile", "examples": [ { "CORP_VRF": { @@ -29692,10 +31156,10 @@ }, "org_network": { "schema": { - "description": "Networks are usually subnets that have cross-site significance. `networks`in Org Settings will got merged into `networks`in Site Setting. For gateways, they can be used to define Service Routes.", + "description": "Organization-level Layer 3 network definition that can be merged into site settings and used for service routes. Networks are used to define the service routes in the Gateway settings or templates", "properties": { "created_time": { - "description": "When the object has been created, in epoch", + "description": "Epoch timestamp when the network was created", "format": "double", "readOnly": true, "type": "number" @@ -29706,6 +31170,7 @@ "type": "boolean" }, "gateway": { + "description": "IPv4 gateway address for this network", "examples": [ "192.168.70.1" ], @@ -29713,6 +31178,7 @@ "type": "string" }, "gateway6": { + "description": "IPv6 gateway address for this network", "examples": [ "fdad:b0bc:f29e::1" ], @@ -29720,7 +31186,7 @@ "type": "string" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the network", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -29730,8 +31196,10 @@ }, "internal_access": { "additionalProperties": false, + "description": "Internal access settings for this network", "properties": { "enabled": { + "description": "Whether internal access is enabled for this network", "type": "boolean" } }, @@ -29739,31 +31207,34 @@ }, "internet_access": { "additionalProperties": false, - "description": "Whether this network has direct internet access", + "description": "Direct internet access and NAT settings for this network", "properties": { "create_simple_service_policy": { "default": false, + "description": "Whether Mist should create simple service policies for restricted internet access", "type": "boolean" }, "destination_nat": { "additionalProperties": { "additionalProperties": false, + "description": "Direct-internet destination NAT rule target settings", "properties": { "internal_ip": { - "description": "The Destination NAT destination IP Address. Must be an IP (i.e. \\"192.168.70.30\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "The Destination NAT destination IP address. Must be an IP (i.e. \\"192.168.70.30\\") or a Variable (i.e. \\"{{myvar}}\\")", "examples": [ "192.168.70.30" ], "type": "string" }, "name": { + "description": "Label for this direct internet destination NAT rule", "examples": [ "web server" ], "type": "string" }, "port": { - "description": "The Destination NAT destination IP Address. Must be a Port (i.e. \\"443\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "The Destination NAT destination IP address. Must be a Port (i.e. \\"443\\") or a Variable (i.e. \\"{{myvar}}\\")", "examples": [ "443" ], @@ -29779,10 +31250,11 @@ }, "type": "object" }, - "description": "Property key can be an External IP (i.e. \\"63.16.0.3\\"), an External IP:Port (i.e. \\"63.16.0.3:443\\"), an External Port (i.e. \\":443\\"), an External CIDR (i.e. \\"63.16.0.0/30\\"), an External CIDR:Port (i.e. \\"63.16.0.0/30:443\\") or a Variable (i.e. \\"{{myvar}}\\"). At least one of the `internal_ip` or `port` must be defined", + "description": "Destination NAT rules for direct internet access", "type": "object" }, "enabled": { + "description": "Whether direct internet access is enabled for this network", "type": "boolean" }, "restricted": { @@ -29793,15 +31265,17 @@ "static_nat": { "additionalProperties": { "additionalProperties": false, + "description": "Direct-internet static NAT rule target settings", "properties": { "internal_ip": { - "description": "The Static NAT destination IP Address. Must be an IP Address (i.e. \\"192.168.70.3\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "The Static NAT destination IP address. Must be an IP address (i.e. \\"192.168.70.3\\") or a Variable (i.e. \\"{{myvar}}\\")", "examples": [ "192.168.70.3" ], "type": "string" }, "name": { + "description": "Label for this direct internet static NAT rule", "examples": [ "pos_station-1" ], @@ -29817,7 +31291,7 @@ }, "type": "object" }, - "description": "Property key may be an External IP Address (i.e. \\"63.16.0.3\\"), a CIDR (i.e. \\"63.16.0.12/20\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Static NAT rules for direct internet access", "type": "object" } }, @@ -29828,14 +31302,14 @@ "type": "boolean" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Epoch timestamp when the network was last modified", "format": "double", "readOnly": true, "type": "number" }, "multicast": { "additionalProperties": false, - "description": "Whether to enable multicast support (only PIM-sparse mode is supported)", + "description": "Settings for multicast routing on this network", "properties": { "disable_igmp": { "default": false, @@ -29844,29 +31318,33 @@ }, "enabled": { "default": false, + "description": "Whether multicast support is enabled for this network", "type": "boolean" }, "groups": { "additionalProperties": { "additionalProperties": false, + "description": "Multicast group rendezvous point mapping", "properties": { "rp_ip": { - "description": "RP (rendezvous point) IP Address", + "description": "RP (rendezvous point) IP address", "type": "string" } }, "type": "object" }, - "description": "Group address to RP (rendezvous point) mapping. Property Key is the CIDR (example \\"225.1.0.3/32\\")", + "description": "Multicast group-to-RP mappings for this network", "type": "object" } }, "type": "object" }, "name": { + "description": "Display name of the organization network", "type": "string" }, "org_id": { + "description": "Organization that owns this network", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -29875,7 +31353,7 @@ "type": "string" }, "routed_for_networks": { - "description": "For a Network (usually LAN), it can be routable to other networks (e.g. OSPF)", + "description": "Other network names this network can route to, for example through BGP, OSPF or static routes", "items": { "examples": [ "pos" @@ -29885,12 +31363,14 @@ "type": "array" }, "subnet": { + "description": "IPv4 subnet CIDR for this network", "examples": [ "192.168.70.0/24" ], "type": "string" }, "subnet6": { + "description": "IPv6 subnet CIDR for this network", "examples": [ "fdad:b0bc:f29e::/32" ], @@ -29899,10 +31379,12 @@ "tenants": { "additionalProperties": { "additionalProperties": false, + "description": "Tenant address entry for a network", "properties": { "addresses": { + "description": "IP addresses or subnets assigned to this tenant in the network", "items": { - "description": "The user/tenant IP Address (i.e. \\"192.168.70.30\\"), an Subnet (i.e. \\"192.168.70.0/24\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "The user/tenant IP address (i.e. \\"192.168.70.30\\"), an Subnet (i.e. \\"192.168.70.0/24\\") or a Variable (i.e. \\"{{myvar}}\\")", "examples": [ "192.168.70.30" ], @@ -29913,10 +31395,11 @@ }, "type": "object" }, - "description": "Property key must be the user/tenant name (i.e. \\"printer-1\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Tenant address mappings associated with this network", "type": "object" }, "vlan_id": { + "description": "VLAN ID or variable associated with this network", "oneOf": [ { "type": "string" @@ -29931,6 +31414,7 @@ "vpn_access": { "additionalProperties": { "additionalProperties": false, + "description": "VPN access settings for a network and VPN pair", "properties": { "advertised_subnet": { "description": "If `routed`==`true`, whether to advertise an aggregated subnet toward HUB this is useful when there are multiple networks on SPOKE's side", @@ -29946,21 +31430,24 @@ "destination_nat": { "additionalProperties": { "additionalProperties": false, + "description": "VPN access destination NAT rule target settings", "properties": { "internal_ip": { - "description": "The Destination NAT destination IP Address. Must be an IP (i.e. \\"192.168.70.30\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "The Destination NAT destination IP address. Must be an IP (i.e. \\"192.168.70.30\\") or a Variable (i.e. \\"{{myvar}}\\")", "examples": [ "192.168.70.30" ], "type": "string" }, "name": { + "description": "Label for this VPN destination NAT rule", "examples": [ "web server" ], "type": "string" }, "port": { + "description": "Destination port or variable for this VPN destination NAT rule", "examples": [ "443" ], @@ -29969,7 +31456,7 @@ }, "type": "object" }, - "description": "Property key can be an External IP (i.e. \\"63.16.0.3\\"), an External IP:Port (i.e. \\"63.16.0.3:443\\"), an External Port (i.e. \\":443\\"), an External CIDR (i.e. \\"63.16.0.0/30\\"), an External CIDR:Port (i.e. \\"63.16.0.0/30:443\\") or a Variable (i.e. \\"{{myvar}}\\"). At least one of the `internal_ip` or `port` must be defined", + "description": "Destination NAT rules applied for VPN access to this network", "type": "object" }, "nat_pool": { @@ -29994,7 +31481,7 @@ "type": "boolean" }, "other_vrfs": { - "description": "By default, the routes are only readvertised toward the same vrf on spoke. To allow it to be leaked to other vrfs", + "description": "Other VRFs that can receive leaked routes from this spoke network", "items": { "examples": [ "iot" @@ -30009,9 +31496,10 @@ }, "source_nat": { "additionalProperties": false, - "description": "If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub", + "description": "Source NAT settings used when non-routed spoke hosts must be reachable from the hub", "properties": { "external_ip": { + "description": "External source NAT IP or subnet used when spoke hosts must be reachable from the hub", "examples": [ "172.16.0.8/30" ], @@ -30023,15 +31511,17 @@ "static_nat": { "additionalProperties": { "additionalProperties": false, + "description": "VPN access static NAT rule target settings", "properties": { "internal_ip": { - "description": "The Static NAT destination IP Address. Must be an IP Address (i.e. \\"192.168.70.3\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "The Static NAT destination IP address. Must be an IP address (i.e. \\"192.168.70.3\\") or a Variable (i.e. \\"{{myvar}}\\")", "examples": [ "192.168.70.3" ], "type": "string" }, "name": { + "description": "Label for this VPN static NAT rule", "examples": [ "pos_station-1" ], @@ -30040,7 +31530,7 @@ }, "type": "object" }, - "description": "Property key may be an External IP Address (i.e. \\"63.16.0.3\\"), a CIDR (i.e. \\"63.16.0.12/20\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Static NAT rules applied for VPN access to this network", "type": "object" }, "summarized_subnet": { @@ -30067,7 +31557,7 @@ }, "type": "object" }, - "description": "Property key is the VPN name. Whether this network can be accessed from vpn", + "description": "VPN access settings keyed by VPN name for this network", "type": "object" } }, @@ -30081,9 +31571,10 @@ "org_servicepolicy": { "schema": { "additionalProperties": false, + "description": "Site-level service policy that allows or denies traffic for tenants and services", "properties": { "action": { - "description": "enum: `allow`, `deny`", + "description": "Allow or deny action for traffic matched by this service policy", "enum": [ "allow", "deny" @@ -30092,19 +31583,20 @@ }, "antivirus": { "additionalProperties": false, - "description": "For SRX-only", + "description": "Malware and virus inspection settings applied by this service policy", "properties": { "avprofile_id": { - "description": "org-level AV Profile can be used, this takes precedence over 'profile'", + "description": "Organization-level antivirus profile ID; takes precedence over inline `profile` settings", "format": "uuid", "type": "string" }, "enabled": { "default": false, + "description": "Whether antivirus inspection is enabled for the service policy", "type": "boolean" }, "profile": { - "description": "Default / noftp / httponly / or keys from av_profiles", + "description": "Antivirus profile name to apply, such as `default`, `noftp`, `httponly`, or an AV profile key", "type": "string" } }, @@ -30112,23 +31604,28 @@ }, "appqoe": { "additionalProperties": false, - "description": "SRX only", + "description": "Application QoE settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether application QoE is enabled for the service policy", "type": "boolean" } }, "type": "object" }, "ewf": { + "description": "Enhanced web filtering rules applied by this service policy", "items": { "additionalProperties": false, + "description": "Enhanced web filtering rule applied by a service policy", "properties": { "alert_only": { + "description": "Whether matching enhanced web filtering traffic is logged without being blocked", "type": "boolean" }, "block_message": { + "description": "Message returned when enhanced web filtering blocks a request", "examples": [ "Access to this URL Category has been blocked" ], @@ -30136,11 +31633,12 @@ }, "enabled": { "default": false, + "description": "Whether this enhanced web filtering rule is enabled", "type": "boolean" }, "profile": { "default": "strict", - "description": "enum: `critical`, `standard`, `strict`", + "description": "Enhanced web filtering profile applied by this rule", "enum": [ "critical", "standard", @@ -30155,12 +31653,15 @@ }, "idp": { "additionalProperties": false, + "description": "Intrusion detection and prevention settings applied by this service policy", "properties": { "alert_only": { + "description": "Whether to alert without enforcing IDP prevention actions", "type": "boolean" }, "enabled": { "default": false, + "description": "Whether IDP inspection is enabled for the policy", "type": "boolean" }, "idpprofile_id": { @@ -30180,10 +31681,11 @@ "type": "object" }, "local_routing": { - "description": "access within the same VRF", + "description": "Whether the policy permits access within the same VRF", "type": "boolean" }, "name": { + "description": "Display name of the service policy", "type": "string" }, "path_preference": { @@ -30192,15 +31694,16 @@ }, "secintel": { "additionalProperties": false, - "description": "SRX only", + "description": "Threat intelligence settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether SecIntel inspection is enabled for the service policy", "type": "boolean" }, "profile": { "default": "default", - "description": "enum: `default`, `standard`, `strict`", + "description": "Protection level applied by SecIntel inspection", "enum": [ "default", "standard", @@ -30209,18 +31712,19 @@ "type": "string" }, "secintelprofile_id": { - "description": "org-level secintel Profile can be used, this takes precedence over 'profile'", + "description": "Organization-level SecIntel profile ID; takes precedence over inline `profile` settings", "type": "string" } }, "type": "object" }, "servicepolicy_id": { - "description": "Used to link servicepolicy defined at org level and overwrite some attributes", + "description": "Organization-level service policy identifier used to link and override selected attributes", "format": "uuid", "type": "string" }, "services": { + "description": "Application services or service groups matched by this policy", "items": { "type": "string" }, @@ -30229,16 +31733,18 @@ }, "skyatp": { "additionalProperties": false, - "description": "SRX only", + "description": "Threat inspection settings provided by Sky ATP for this service policy", "properties": { "dns_dga_detection": { "additionalProperties": false, + "description": "Detection settings for DNS DGA threats provided by Sky ATP", "properties": { "enabled": { + "description": "Whether Sky ATP DNS DGA detection is enabled", "type": "boolean" }, "profile": { - "description": "enum: `default`, `standard`, `strict`", + "description": "Sky ATP DNS DGA detection profile to apply", "enum": [ "default", "standard", @@ -30251,12 +31757,14 @@ }, "dns_tunnel_detection": { "additionalProperties": false, + "description": "Detection settings for DNS tunneling threats provided by Sky ATP", "properties": { "enabled": { + "description": "Whether Sky ATP DNS tunneling detection is enabled", "type": "boolean" }, "profile": { - "description": "enum: `default`, `standard`, `strict`", + "description": "Sky ATP DNS tunneling detection profile to apply", "enum": [ "default", "standard", @@ -30269,12 +31777,14 @@ }, "http_inspection": { "additionalProperties": false, + "description": "Web traffic inspection settings provided by Sky ATP", "properties": { "enabled": { + "description": "Whether Sky ATP HTTP inspection is enabled", "type": "boolean" }, "profile": { - "description": "enum: `standard`, `strict`", + "description": "Sky ATP HTTP inspection profile to apply", "enum": [ "standard", "strict" @@ -30286,8 +31796,10 @@ }, "iot_device_policy": { "additionalProperties": false, + "description": "Device threat policy settings provided by Sky ATP for IoT clients", "properties": { "enabled": { + "description": "Whether Sky ATP IoT device policy inspection is enabled", "type": "boolean" } }, @@ -30298,11 +31810,11 @@ }, "ssl_proxy": { "additionalProperties": false, - "description": "For SRX-only", + "description": "TLS inspection settings applied by this service policy", "properties": { "ciphers_category": { "default": "strong", - "description": "enum: `medium`, `strong`, `weak`", + "description": "Allowed cipher strength category for SSL proxy inspection", "enum": [ "medium", "strong", @@ -30312,6 +31824,7 @@ }, "enabled": { "default": false, + "description": "Whether SSL proxy inspection is enabled for the service policy", "type": "boolean" } }, @@ -30319,13 +31832,15 @@ }, "syslog": { "additionalProperties": false, - "description": "Required for syslog logging", + "description": "Remote logging settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether syslog logging is enabled for the service policy", "type": "boolean" }, "server_names": { + "description": "Names of syslog servers that receive logs for this service policy", "examples": [ [ "dc_syslog_server" @@ -30340,6 +31855,7 @@ "type": "object" }, "tenants": { + "description": "User or network tenants matched by this service policy", "items": { "type": "string" }, @@ -30353,15 +31869,16 @@ }, "org_vpn": { "schema": { + "description": "Organization VPN overlay configuration", "properties": { "created_time": { - "description": "When the object has been created, in epoch", + "description": "Epoch timestamp when the VPN configuration was created", "format": "double", "readOnly": true, "type": "number" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the VPN configuration", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -30370,16 +31887,18 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Epoch timestamp when the VPN configuration was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the VPN configuration", "minLength": 1, "type": "string" }, "org_id": { + "description": "Organization that owns the VPN configuration", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -30389,11 +31908,11 @@ }, "path_selection": { "additionalProperties": false, - "description": "Only if `type`==`hub_spoke`", + "description": "Path selection settings used when `type`==`hub_spoke`", "properties": { "strategy": { "default": "disabled", - "description": "enum: `disabled`, `simple`, `manual`", + "description": "Path selection strategy for a hub-and-spoke VPN", "enum": [ "disabled", "simple", @@ -30407,10 +31926,11 @@ "paths": { "additionalProperties": { "additionalProperties": false, + "description": "VPN path settings used by an organization VPN", "properties": { "bfd_profile": { "default": "broadband", - "description": "enum: `broadband`, `lte`", + "description": "BFD profile used for this VPN path", "enum": [ "broadband", "lte" @@ -30423,25 +31943,27 @@ "type": "boolean" }, "ip": { - "description": "If different from the wan port", + "description": "Source IP address for this VPN path, if different from the WAN port IP", "type": "string" }, "peer_paths": { "additionalProperties": { "additionalProperties": false, - "description": "Preference indicates which outgoing wan should be preferred", + "description": "Peer path preference settings for mesh VPN routing", "properties": { "preference": { + "description": "Lower numeric value makes this outgoing WAN path more preferred", "type": "integer" } }, "type": "object" }, - "description": "If `type`==`mesh`, Property key is the Peer Interface name", + "description": "Peer path preferences used when `type`==`mesh`", "type": "object" }, "pod": { "default": 1, + "description": "Grouping index used to place this VPN path into a pod", "examples": [ 2 ], @@ -30451,6 +31973,7 @@ }, "traffic_shaping": { "additionalProperties": false, + "description": "Traffic shaping settings applied to this VPN path", "properties": { "class_percentage": { "default": [ @@ -30459,7 +31982,7 @@ 9, 1 ], - "description": "percentages for different class of traffic: high / medium / low / best-effort adding up to 100", + "description": "Bandwidth percentages for high, medium, low, and best-effort traffic classes", "items": { "type": "integer" }, @@ -30468,9 +31991,11 @@ "type": "array" }, "enabled": { + "description": "Whether traffic shaping is enabled for this VPN path", "type": "boolean" }, "max_tx_kbps": { + "description": "Maximum transmit rate for this VPN path, in Kbps; `null` means no explicit limit", "type": [ "integer", "null" @@ -30482,12 +32007,12 @@ }, "type": "object" }, - "description": "For `type`==`hub_spoke`, Property key is the VPN name. For `type`==`mesh`, Property key is the Interface name", + "description": "VPN path definitions keyed by VPN name for `hub_spoke` mode or interface name for `mesh` mode", "type": "object" }, "type": { "default": "hub_spoke", - "description": "enum: `hub_spoke`, `mesh`", + "description": "VPN topology mode for this configuration", "enum": [ "hub_spoke", "mesh" @@ -30505,20 +32030,21 @@ }, "org_mxedge": { "schema": { - "description": "MxEdge", + "description": "Mist Edge appliance configuration and registration state", "properties": { "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the Mist Edge record was created", "format": "double", "readOnly": true, "type": "number" }, "for_site": { + "description": "Whether this Mist Edge is scoped to a site", "readOnly": true, "type": "boolean" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the Mist Edge", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -30527,6 +32053,7 @@ "type": "string" }, "mac": { + "description": "Mist Edge MAC address", "examples": [ "0200009fbe65" ], @@ -30534,6 +32061,7 @@ "type": "string" }, "magic": { + "description": "Registration claim code for the Mist Edge", "examples": [ "L-NpT5gi-ADR8WTFd4EiQPY3cP5WdSoD" ], @@ -30541,23 +32069,25 @@ "type": "string" }, "model": { + "description": "Mist Edge hardware or virtual appliance model", "examples": [ "ME-100" ], "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the Mist Edge record was last modified", "format": "double", "readOnly": true, "type": "number" }, "mxagent_registered": { + "description": "Whether the Mist Edge agent has registered with Mist cloud", "readOnly": true, "type": "boolean" }, "mxcluster_id": { - "description": "MxCluster this MxEdge belongs to", + "description": "Mist Edge cluster identifier that this appliance belongs to", "examples": [ "572586b7-f97b-a22b-526c-8b97a3f609c4" ], @@ -30566,16 +32096,20 @@ }, "mxedge_mgmt": { "additionalProperties": false, + "description": "Management credentials and settings for the Mist Edge", "properties": { "config_auto_revert": { "default": false, + "description": "Whether the Mist Edge automatically reverts configuration changes if connectivity is lost", "type": "boolean" }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the Mist Edge", "type": "boolean" }, "mist_password": { + "description": "Password for the Mist service account on the Mist Edge", "examples": [ "MIST_PASSWORD" ], @@ -30583,7 +32117,7 @@ }, "oob_ip_type": { "default": "dhcp", - "description": "enum: `dhcp`, `disabled`, `static`", + "description": "IPv4 address assignment mode for out-of-band management", "enum": [ "dhcp", "disabled", @@ -30593,7 +32127,7 @@ }, "oob_ip_type6": { "default": "autoconf", - "description": "enum: `autoconf`, `dhcp`, `disabled`, `static`", + "description": "IPv6 address assignment mode for out-of-band management", "enum": [ "autoconf", "dhcp", @@ -30603,6 +32137,7 @@ "type": "string" }, "root_password": { + "description": "Root account password for the Mist Edge", "examples": [ "ROOT_PASSWORD" ], @@ -30613,18 +32148,21 @@ "type": "object" }, "name": { + "description": "Display name of the Mist Edge", "examples": [ "Guest" ], "type": "string" }, "notes": { + "description": "Free-form notes for the Mist Edge", "examples": [ "note for mxedge" ], "type": "string" }, "ntp_servers": { + "description": "Time synchronization servers used by the Mist Edge", "items": { "type": "string" }, @@ -30633,14 +32171,16 @@ }, "oob_ip_config": { "additionalProperties": false, - "description": "IPconfiguration of the Mist Edge out-of_band management interface", + "description": "Out-of-band management IP configuration for the Mist Edge", "properties": { "autoconf6": { "default": true, + "description": "Whether IPv6 autoconfiguration is enabled on the out-of-band management interface", "type": "boolean" }, "dhcp6": { "default": true, + "description": "Whether DHCPv6 is enabled on the out-of-band management interface", "type": "boolean" }, "dns": { @@ -30650,7 +32190,7 @@ "2001:4860:4860::8888", "2001:4860:4860::8844" ], - "description": "IPv4 ignored if `type`!=`static`, IPv6 ignored if `type6`!=`static`", + "description": "Name server addresses for out-of-band management", "examples": [ [ "8.8.8.8", @@ -30665,39 +32205,42 @@ "type": "array" }, "gateway": { - "description": "If `type`=`static`", + "description": "If `type`=`static`, IPv4 default gateway for the out-of-band management interface", "examples": [ "10.2.1.254" ], "type": "string" }, "gateway6": { + "description": "If `type6`=`static`, IPv6 default gateway for the out-of-band management interface", "examples": [ "2601:1700:43c0:dc0::1" ], "type": "string" }, "ip": { - "description": "If `type`=`static`", + "description": "If `type`=`static`, IPv4 address for the out-of-band management interface", "examples": [ "10.2.1.2" ], "type": "string" }, "ip6": { + "description": "If `type6`=`static`, IPv6 address for the out-of-band management interface", "examples": [ "2601:1700:43c0:dc0:20c:29ff:fea7:93bc" ], "type": "string" }, "netmask": { - "description": "If `type`=`static`", + "description": "If `type`=`static`, IPv4 netmask for the out-of-band management interface", "examples": [ "255.255.255.0" ], "type": "string" }, "netmask6": { + "description": "If `type6`=`static`, IPv6 prefix length for the out-of-band management interface", "examples": [ "/64" ], @@ -30705,7 +32248,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IPv4 address assignment mode for out-of-band management", "enum": [ "dhcp", "static" @@ -30717,7 +32260,7 @@ }, "type6": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IPv6 address assignment mode for out-of-band management", "enum": [ "dhcp", "static" @@ -30731,6 +32274,7 @@ "type": "object" }, "org_id": { + "description": "Identifier of the org that owns the Mist Edge", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -30740,16 +32284,18 @@ }, "proxy": { "additionalProperties": false, - "description": "Proxy Configuration to talk to Mist", + "description": "Network proxy settings used by the Mist Edge", "properties": { "disabled": { "default": false, + "description": "Whether this proxy configuration is disabled", "examples": [ true ], "type": "boolean" }, "url": { + "description": "Proxy URL used to reach Mist", "examples": [ "https://proxy.corp.com:8080/" ], @@ -30759,7 +32305,7 @@ "type": "object" }, "services": { - "description": "List of services to run, tunterm only for now", + "description": "List of services enabled to run on the Mist Edge", "items": { "default": "tunterm", "type": "string" @@ -30767,6 +32313,7 @@ "type": "array" }, "site_id": { + "description": "Identifier of the site when the Mist Edge is site-scoped", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -30777,13 +32324,15 @@ "tunterm_dhcpd_config": { "additionalProperties": { "additionalProperties": false, + "description": "Per-VLAN DHCP relay settings for a Mist Tunneled VLAN", "properties": { "enabled": { "default": false, + "description": "Whether DHCP relay is enabled for this tunneled VLAN", "type": "boolean" }, "servers": { - "description": "List of DHCP servers; required if `type`==`relay`", + "description": "DHCP relay server addresses used by this tunneled VLAN", "items": { "type": "string" }, @@ -30791,7 +32340,7 @@ }, "type": { "default": "relay", - "description": "enum: `relay`", + "description": "DHCP handling mode for this tunneled VLAN", "enum": [ "relay" ], @@ -30800,14 +32349,15 @@ }, "type": "object" }, - "description": "Global and per-VLAN. Property key is the VLAN ID", + "description": "DHCP relay or server settings for Mist Tunneled VLANs", "properties": { "enabled": { "default": false, + "description": "Whether DHCP relay is enabled for Mist Tunneled VLANs", "type": "boolean" }, "servers": { - "description": "List of DHCP servers; required if `type`==`relay`", + "description": "DHCP relay server addresses used when `type`==`relay`", "items": { "type": "string" }, @@ -30815,7 +32365,7 @@ }, "type": { "default": "relay", - "description": "enum: `relay`", + "description": "DHCP handling mode for the global tunnel termination config", "enum": [ "relay" ], @@ -30827,18 +32377,21 @@ "tunterm_extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Extra route for Mist Tunnel traffic on a Mist Edge", "properties": { "via": { + "description": "Next-hop IP address for this Mist Tunnel extra route", "type": "string" } }, "type": "object" }, - "description": "Property key is a CIDR", + "description": "Extra routes for Mist Tunneled VLAN traffic; property key is a CIDR", "type": "object" }, "tunterm_igmp_snooping_config": { "additionalProperties": false, + "description": "IGMP snooping settings for Mist Tunneled VLANs", "properties": { "enabled": { "anyOf": [ @@ -30849,10 +32402,12 @@ "type": "string" } ], - "default": false + "default": false, + "description": "Whether IGMP snooping is enabled for the configured VLANs" }, "querier": { "additionalProperties": false, + "description": "IGMP querier settings used with tunnel termination snooping", "properties": { "max_response_time": { "description": "Querier's query response interval, in tenths-of-seconds", @@ -30876,7 +32431,7 @@ "type": "integer" }, "robustness": { - "description": "Querier's robustness", + "description": "IGMP querier robustness variable", "maximum": 7, "minimum": 1, "type": "integer" @@ -30908,47 +32463,52 @@ "type": "string" } ], - "description": "List of vlans on which tunterm performs IGMP snooping" + "description": "List of VLAN IDs where tunnel termination performs IGMP snooping" } }, "type": "object" }, "tunterm_ip_config": { "additionalProperties": false, - "description": "IPconfiguration of the Mist Tunnel interface", + "description": "Tunnel termination IP configuration for the Mist Edge", "properties": { "gateway": { + "description": "IPv4 gateway for the Mist Tunnel interface", "examples": [ "10.2.1.254" ], "type": "string" }, "gateway6": { + "description": "IPv6 gateway for the Mist Tunnel interface", "examples": [ "2001:1010:1010:1010::1" ], "type": "string" }, "ip": { - "description": "Untagged VLAN", + "description": "Address on the untagged Mist Tunnel interface, in IPv4 format", "examples": [ "10.2.1.1" ], "type": "string" }, "ip6": { + "description": "Address on the Mist Tunnel interface, in IPv6 format", "examples": [ "2001:1010:1010:1010::2" ], "type": "string" }, "netmask": { + "description": "Subnet mask for the Mist Tunnel IPv4 address", "examples": [ "255.255.255.0" ], "type": "string" }, "netmask6": { + "description": "Prefix length for the Mist Tunnel IPv6 address", "examples": [ "/64" ], @@ -30963,9 +32523,12 @@ "type": "object" }, "tunterm_monitoring": { + "description": "Monitoring checks for tunnel termination reachability", "items": { + "description": "Tunnel termination monitoring checks", "items": { "additionalProperties": false, + "description": "Monitoring check for tunnel termination reachability", "properties": { "host": { "description": "Can be ip, ipv6, hostname", @@ -30976,14 +32539,14 @@ "type": "string" }, "port": { - "description": "When `protocol`==`tcp`", + "description": "When `protocol`==`tcp`, TCP port checked by the monitoring probe", "examples": [ 80 ], "type": "integer" }, "protocol": { - "description": "enum: `arp`, `ping`, `tcp`", + "description": "Monitoring method used for this tunnel termination check", "enum": [ "arp", "ping", @@ -31004,6 +32567,7 @@ }, "timeout": { "default": 300, + "description": "Maximum time for this monitoring check, in seconds", "examples": [ 300 ], @@ -31018,14 +32582,18 @@ }, "tunterm_multicast_config": { "additionalProperties": false, + "description": "Multicast forwarding settings for tunnel termination", "properties": { "mdns": { "additionalProperties": false, + "description": "Settings for mDNS forwarding on tunnel termination VLANs", "properties": { "enabled": { + "description": "Whether mDNS forwarding is enabled for the configured VLANs", "type": "boolean" }, "vlan_ids": { + "description": "List of VLAN IDs where mDNS forwarding is enabled", "items": { "type": "string" }, @@ -31037,11 +32605,14 @@ }, "ssdp": { "additionalProperties": false, + "description": "Settings for SSDP forwarding on tunnel termination VLANs", "properties": { "enabled": { + "description": "Whether SSDP forwarding is enabled for the configured VLANs", "type": "boolean" }, "vlan_ids": { + "description": "List of VLAN IDs where SSDP forwarding is enabled", "items": { "type": "string" }, @@ -31057,11 +32628,14 @@ "tunterm_other_ip_configs": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IP configuration for a Mist Tunnel VLAN interface", "properties": { "ip": { + "description": "Address for the additional Mist Tunnel interface, in IPv4 format", "type": "string" }, "netmask": { + "description": "Subnet mask for the additional Mist Tunnel IPv4 address", "type": "string" } }, @@ -31076,10 +32650,10 @@ }, "tunterm_port_config": { "additionalProperties": false, - "description": "Ethernet port configurations", + "description": "Port configuration for tunnel termination traffic", "properties": { "downstream_ports": { - "description": "List of ports to be used for downstream (to AP) purpose", + "description": "Ports connected downstream toward APs for tunnel termination", "examples": [ [ "2", @@ -31097,7 +32671,7 @@ "type": "boolean" }, "upstream_port_vlan_id": { - "description": "Native VLAN id for upstream ports", + "description": "Native VLAN ID applied to upstream tunnel termination ports", "oneOf": [ { "type": "string" @@ -31110,7 +32684,7 @@ ] }, "upstream_ports": { - "description": "List of ports to be used for upstream purpose (to LAN)", + "description": "Ports connected upstream toward the LAN for tunnel termination", "examples": [ [ "0", @@ -31126,18 +32700,23 @@ "type": "object" }, "tunterm_registered": { + "description": "Whether the tunnel termination service has registered with Mist cloud", "readOnly": true, "type": "boolean" }, "tunterm_switch_config": { "additionalProperties": { "additionalProperties": false, + "description": "Switch VLAN settings for one tunnel termination port", "properties": { "port_vlan_id": { + "description": "Untagged VLAN ID for this tunnel termination switch port", "type": "integer" }, "vlan_ids": { + "description": "List of tagged VLAN IDs allowed on this tunnel termination switch port", "items": { + "description": "VLAN ID, either numeric or expressed as a template variable string", "oneOf": [ { "type": "string" @@ -31154,9 +32733,10 @@ }, "type": "object" }, - "description": "If custom vlan settings are desired", + "description": "Switch VLAN settings for tunnel termination", "properties": { "enabled": { + "description": "Whether custom tunnel termination switch VLAN settings are enabled", "type": "boolean" } }, @@ -31164,12 +32744,15 @@ }, "versions": { "additionalProperties": false, + "description": "Service version information reported by the Mist Edge", "properties": { "mxagent": { + "description": "Reported version of the mxagent service", "readOnly": true, "type": "string" }, "tunterm": { + "description": "Reported version of the tunnel termination service", "readOnly": true, "type": "string" } @@ -31188,20 +32771,21 @@ }, "site_mxedge": { "schema": { - "description": "MxEdge", + "description": "Mist Edge appliance configuration and registration state", "properties": { "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the Mist Edge record was created", "format": "double", "readOnly": true, "type": "number" }, "for_site": { + "description": "Whether this Mist Edge is scoped to a site", "readOnly": true, "type": "boolean" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the Mist Edge", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -31210,6 +32794,7 @@ "type": "string" }, "mac": { + "description": "Mist Edge MAC address", "examples": [ "0200009fbe65" ], @@ -31217,6 +32802,7 @@ "type": "string" }, "magic": { + "description": "Registration claim code for the Mist Edge", "examples": [ "L-NpT5gi-ADR8WTFd4EiQPY3cP5WdSoD" ], @@ -31224,23 +32810,25 @@ "type": "string" }, "model": { + "description": "Mist Edge hardware or virtual appliance model", "examples": [ "ME-100" ], "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the Mist Edge record was last modified", "format": "double", "readOnly": true, "type": "number" }, "mxagent_registered": { + "description": "Whether the Mist Edge agent has registered with Mist cloud", "readOnly": true, "type": "boolean" }, "mxcluster_id": { - "description": "MxCluster this MxEdge belongs to", + "description": "Mist Edge cluster identifier that this appliance belongs to", "examples": [ "572586b7-f97b-a22b-526c-8b97a3f609c4" ], @@ -31249,16 +32837,20 @@ }, "mxedge_mgmt": { "additionalProperties": false, + "description": "Management credentials and settings for the Mist Edge", "properties": { "config_auto_revert": { "default": false, + "description": "Whether the Mist Edge automatically reverts configuration changes if connectivity is lost", "type": "boolean" }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the Mist Edge", "type": "boolean" }, "mist_password": { + "description": "Password for the Mist service account on the Mist Edge", "examples": [ "MIST_PASSWORD" ], @@ -31266,7 +32858,7 @@ }, "oob_ip_type": { "default": "dhcp", - "description": "enum: `dhcp`, `disabled`, `static`", + "description": "IPv4 address assignment mode for out-of-band management", "enum": [ "dhcp", "disabled", @@ -31276,7 +32868,7 @@ }, "oob_ip_type6": { "default": "autoconf", - "description": "enum: `autoconf`, `dhcp`, `disabled`, `static`", + "description": "IPv6 address assignment mode for out-of-band management", "enum": [ "autoconf", "dhcp", @@ -31286,6 +32878,7 @@ "type": "string" }, "root_password": { + "description": "Root account password for the Mist Edge", "examples": [ "ROOT_PASSWORD" ], @@ -31296,18 +32889,21 @@ "type": "object" }, "name": { + "description": "Display name of the Mist Edge", "examples": [ "Guest" ], "type": "string" }, "notes": { + "description": "Free-form notes for the Mist Edge", "examples": [ "note for mxedge" ], "type": "string" }, "ntp_servers": { + "description": "Time synchronization servers used by the Mist Edge", "items": { "type": "string" }, @@ -31316,14 +32912,16 @@ }, "oob_ip_config": { "additionalProperties": false, - "description": "IPconfiguration of the Mist Edge out-of_band management interface", + "description": "Out-of-band management IP configuration for the Mist Edge", "properties": { "autoconf6": { "default": true, + "description": "Whether IPv6 autoconfiguration is enabled on the out-of-band management interface", "type": "boolean" }, "dhcp6": { "default": true, + "description": "Whether DHCPv6 is enabled on the out-of-band management interface", "type": "boolean" }, "dns": { @@ -31333,7 +32931,7 @@ "2001:4860:4860::8888", "2001:4860:4860::8844" ], - "description": "IPv4 ignored if `type`!=`static`, IPv6 ignored if `type6`!=`static`", + "description": "Name server addresses for out-of-band management", "examples": [ [ "8.8.8.8", @@ -31348,39 +32946,42 @@ "type": "array" }, "gateway": { - "description": "If `type`=`static`", + "description": "If `type`=`static`, IPv4 default gateway for the out-of-band management interface", "examples": [ "10.2.1.254" ], "type": "string" }, "gateway6": { + "description": "If `type6`=`static`, IPv6 default gateway for the out-of-band management interface", "examples": [ "2601:1700:43c0:dc0::1" ], "type": "string" }, "ip": { - "description": "If `type`=`static`", + "description": "If `type`=`static`, IPv4 address for the out-of-band management interface", "examples": [ "10.2.1.2" ], "type": "string" }, "ip6": { + "description": "If `type6`=`static`, IPv6 address for the out-of-band management interface", "examples": [ "2601:1700:43c0:dc0:20c:29ff:fea7:93bc" ], "type": "string" }, "netmask": { - "description": "If `type`=`static`", + "description": "If `type`=`static`, IPv4 netmask for the out-of-band management interface", "examples": [ "255.255.255.0" ], "type": "string" }, "netmask6": { + "description": "If `type6`=`static`, IPv6 prefix length for the out-of-band management interface", "examples": [ "/64" ], @@ -31388,7 +32989,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IPv4 address assignment mode for out-of-band management", "enum": [ "dhcp", "static" @@ -31400,7 +33001,7 @@ }, "type6": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IPv6 address assignment mode for out-of-band management", "enum": [ "dhcp", "static" @@ -31414,6 +33015,7 @@ "type": "object" }, "org_id": { + "description": "Identifier of the org that owns the Mist Edge", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -31423,16 +33025,18 @@ }, "proxy": { "additionalProperties": false, - "description": "Proxy Configuration to talk to Mist", + "description": "Network proxy settings used by the Mist Edge", "properties": { "disabled": { "default": false, + "description": "Whether this proxy configuration is disabled", "examples": [ true ], "type": "boolean" }, "url": { + "description": "Proxy URL used to reach Mist", "examples": [ "https://proxy.corp.com:8080/" ], @@ -31442,7 +33046,7 @@ "type": "object" }, "services": { - "description": "List of services to run, tunterm only for now", + "description": "List of services enabled to run on the Mist Edge", "items": { "default": "tunterm", "type": "string" @@ -31450,6 +33054,7 @@ "type": "array" }, "site_id": { + "description": "Identifier of the site when the Mist Edge is site-scoped", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -31460,13 +33065,15 @@ "tunterm_dhcpd_config": { "additionalProperties": { "additionalProperties": false, + "description": "Per-VLAN DHCP relay settings for a Mist Tunneled VLAN", "properties": { "enabled": { "default": false, + "description": "Whether DHCP relay is enabled for this tunneled VLAN", "type": "boolean" }, "servers": { - "description": "List of DHCP servers; required if `type`==`relay`", + "description": "DHCP relay server addresses used by this tunneled VLAN", "items": { "type": "string" }, @@ -31474,7 +33081,7 @@ }, "type": { "default": "relay", - "description": "enum: `relay`", + "description": "DHCP handling mode for this tunneled VLAN", "enum": [ "relay" ], @@ -31483,14 +33090,15 @@ }, "type": "object" }, - "description": "Global and per-VLAN. Property key is the VLAN ID", + "description": "DHCP relay or server settings for Mist Tunneled VLANs", "properties": { "enabled": { "default": false, + "description": "Whether DHCP relay is enabled for Mist Tunneled VLANs", "type": "boolean" }, "servers": { - "description": "List of DHCP servers; required if `type`==`relay`", + "description": "DHCP relay server addresses used when `type`==`relay`", "items": { "type": "string" }, @@ -31498,7 +33106,7 @@ }, "type": { "default": "relay", - "description": "enum: `relay`", + "description": "DHCP handling mode for the global tunnel termination config", "enum": [ "relay" ], @@ -31510,18 +33118,21 @@ "tunterm_extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Extra route for Mist Tunnel traffic on a Mist Edge", "properties": { "via": { + "description": "Next-hop IP address for this Mist Tunnel extra route", "type": "string" } }, "type": "object" }, - "description": "Property key is a CIDR", + "description": "Extra routes for Mist Tunneled VLAN traffic; property key is a CIDR", "type": "object" }, "tunterm_igmp_snooping_config": { "additionalProperties": false, + "description": "IGMP snooping settings for Mist Tunneled VLANs", "properties": { "enabled": { "anyOf": [ @@ -31532,10 +33143,12 @@ "type": "string" } ], - "default": false + "default": false, + "description": "Whether IGMP snooping is enabled for the configured VLANs" }, "querier": { "additionalProperties": false, + "description": "IGMP querier settings used with tunnel termination snooping", "properties": { "max_response_time": { "description": "Querier's query response interval, in tenths-of-seconds", @@ -31559,7 +33172,7 @@ "type": "integer" }, "robustness": { - "description": "Querier's robustness", + "description": "IGMP querier robustness variable", "maximum": 7, "minimum": 1, "type": "integer" @@ -31591,47 +33204,52 @@ "type": "string" } ], - "description": "List of vlans on which tunterm performs IGMP snooping" + "description": "List of VLAN IDs where tunnel termination performs IGMP snooping" } }, "type": "object" }, "tunterm_ip_config": { "additionalProperties": false, - "description": "IPconfiguration of the Mist Tunnel interface", + "description": "Tunnel termination IP configuration for the Mist Edge", "properties": { "gateway": { + "description": "IPv4 gateway for the Mist Tunnel interface", "examples": [ "10.2.1.254" ], "type": "string" }, "gateway6": { + "description": "IPv6 gateway for the Mist Tunnel interface", "examples": [ "2001:1010:1010:1010::1" ], "type": "string" }, "ip": { - "description": "Untagged VLAN", + "description": "Address on the untagged Mist Tunnel interface, in IPv4 format", "examples": [ "10.2.1.1" ], "type": "string" }, "ip6": { + "description": "Address on the Mist Tunnel interface, in IPv6 format", "examples": [ "2001:1010:1010:1010::2" ], "type": "string" }, "netmask": { + "description": "Subnet mask for the Mist Tunnel IPv4 address", "examples": [ "255.255.255.0" ], "type": "string" }, "netmask6": { + "description": "Prefix length for the Mist Tunnel IPv6 address", "examples": [ "/64" ], @@ -31646,9 +33264,12 @@ "type": "object" }, "tunterm_monitoring": { + "description": "Monitoring checks for tunnel termination reachability", "items": { + "description": "Tunnel termination monitoring checks", "items": { "additionalProperties": false, + "description": "Monitoring check for tunnel termination reachability", "properties": { "host": { "description": "Can be ip, ipv6, hostname", @@ -31659,14 +33280,14 @@ "type": "string" }, "port": { - "description": "When `protocol`==`tcp`", + "description": "When `protocol`==`tcp`, TCP port checked by the monitoring probe", "examples": [ 80 ], "type": "integer" }, "protocol": { - "description": "enum: `arp`, `ping`, `tcp`", + "description": "Monitoring method used for this tunnel termination check", "enum": [ "arp", "ping", @@ -31687,6 +33308,7 @@ }, "timeout": { "default": 300, + "description": "Maximum time for this monitoring check, in seconds", "examples": [ 300 ], @@ -31701,14 +33323,18 @@ }, "tunterm_multicast_config": { "additionalProperties": false, + "description": "Multicast forwarding settings for tunnel termination", "properties": { "mdns": { "additionalProperties": false, + "description": "Settings for mDNS forwarding on tunnel termination VLANs", "properties": { "enabled": { + "description": "Whether mDNS forwarding is enabled for the configured VLANs", "type": "boolean" }, "vlan_ids": { + "description": "List of VLAN IDs where mDNS forwarding is enabled", "items": { "type": "string" }, @@ -31720,11 +33346,14 @@ }, "ssdp": { "additionalProperties": false, + "description": "Settings for SSDP forwarding on tunnel termination VLANs", "properties": { "enabled": { + "description": "Whether SSDP forwarding is enabled for the configured VLANs", "type": "boolean" }, "vlan_ids": { + "description": "List of VLAN IDs where SSDP forwarding is enabled", "items": { "type": "string" }, @@ -31740,11 +33369,14 @@ "tunterm_other_ip_configs": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IP configuration for a Mist Tunnel VLAN interface", "properties": { "ip": { + "description": "Address for the additional Mist Tunnel interface, in IPv4 format", "type": "string" }, "netmask": { + "description": "Subnet mask for the additional Mist Tunnel IPv4 address", "type": "string" } }, @@ -31759,10 +33391,10 @@ }, "tunterm_port_config": { "additionalProperties": false, - "description": "Ethernet port configurations", + "description": "Port configuration for tunnel termination traffic", "properties": { "downstream_ports": { - "description": "List of ports to be used for downstream (to AP) purpose", + "description": "Ports connected downstream toward APs for tunnel termination", "examples": [ [ "2", @@ -31780,7 +33412,7 @@ "type": "boolean" }, "upstream_port_vlan_id": { - "description": "Native VLAN id for upstream ports", + "description": "Native VLAN ID applied to upstream tunnel termination ports", "oneOf": [ { "type": "string" @@ -31793,7 +33425,7 @@ ] }, "upstream_ports": { - "description": "List of ports to be used for upstream purpose (to LAN)", + "description": "Ports connected upstream toward the LAN for tunnel termination", "examples": [ [ "0", @@ -31809,18 +33441,23 @@ "type": "object" }, "tunterm_registered": { + "description": "Whether the tunnel termination service has registered with Mist cloud", "readOnly": true, "type": "boolean" }, "tunterm_switch_config": { "additionalProperties": { "additionalProperties": false, + "description": "Switch VLAN settings for one tunnel termination port", "properties": { "port_vlan_id": { + "description": "Untagged VLAN ID for this tunnel termination switch port", "type": "integer" }, "vlan_ids": { + "description": "List of tagged VLAN IDs allowed on this tunnel termination switch port", "items": { + "description": "VLAN ID, either numeric or expressed as a template variable string", "oneOf": [ { "type": "string" @@ -31837,9 +33474,10 @@ }, "type": "object" }, - "description": "If custom vlan settings are desired", + "description": "Switch VLAN settings for tunnel termination", "properties": { "enabled": { + "description": "Whether custom tunnel termination switch VLAN settings are enabled", "type": "boolean" } }, @@ -31847,12 +33485,15 @@ }, "versions": { "additionalProperties": false, + "description": "Service version information reported by the Mist Edge", "properties": { "mxagent": { + "description": "Reported version of the mxagent service", "readOnly": true, "type": "string" }, "tunterm": { + "description": "Reported version of the tunnel termination service", "readOnly": true, "type": "string" } @@ -31871,9 +33512,10 @@ }, "org_idpprofile": { "schema": { + "description": "Organization IDP profile with a base profile and targeted overwrite rules", "properties": { "base_profile": { - "description": "enum: `critical`, `standard`, `strict`", + "description": "Built-in IDP baseline profile inherited before applying overwrites", "enum": [ "critical", "standard", @@ -31885,13 +33527,13 @@ "type": "string" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the IDP profile was created", "format": "double", "readOnly": true, "type": "number" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the IDP profile", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -31900,18 +33542,20 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the IDP profile was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the IDP profile", "examples": [ "relaxed" ], "type": "string" }, "org_id": { + "description": "Owning organization for the IDP profile", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -31920,12 +33564,14 @@ "type": "string" }, "overwrites": { + "description": "IDP signature override rules applied on top of the base profile", "items": { "additionalProperties": false, + "description": "Override rule that changes the IDP action for matching signatures", "properties": { "action": { "default": "alert", - "description": "enum:\\n * alert (default)\\n * drop: silently dropping packets\\n * close: notify client/server to close connection", + "description": "Enforcement action applied when this overwrite rule matches", "enum": [ "alert", "close", @@ -31938,8 +33584,10 @@ }, "matching": { "additionalProperties": false, + "description": "Criteria that select signatures for this overwrite rule", "properties": { "attack_name": { + "description": "Signature names matched by the IDP profile overwrite", "items": { "examples": [ "HTTP:INVALID:HDR-FIELD" @@ -31949,6 +33597,7 @@ "type": "array" }, "dst_subnet": { + "description": "Destination subnets matched by the IDP profile overwrite", "items": { "examples": [ "63.1.2.0/24" @@ -31958,6 +33607,7 @@ "type": "array" }, "severity": { + "description": "Threat levels matched by the IDP profile overwrite", "items": { "$comment": "max depth reached" }, @@ -31967,6 +33617,7 @@ "type": "object" }, "name": { + "description": "Display name for this IDP profile overwrite rule", "type": "string" } }, @@ -31981,15 +33632,16 @@ }, "org_avprofile": { "schema": { + "description": "Antivirus scanning profile with protocols, limits, and whitelist settings", "properties": { "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when this antivirus profile was created", "format": "double", "readOnly": true, "type": "number" }, "fallback_action": { - "description": "enum: `block`, `log-and-permit`, `permit`", + "description": "Action to take when antivirus scanning cannot complete", "enum": [ "block", "log-and-permit", @@ -31998,7 +33650,7 @@ "type": "string" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the antivirus profile", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -32008,12 +33660,13 @@ }, "max_filesize": { "default": 10000, - "description": "In KB", + "description": "Maximum file size scanned by this antivirus profile, in KB", "maximum": 40000, "minimum": 20, "type": "integer" }, "mime_whitelist": { + "description": "Content MIME types exempted from antivirus scanning", "items": { "type": "string" }, @@ -32021,15 +33674,17 @@ "uniqueItems": true }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when this antivirus profile was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the antivirus profile", "type": "string" }, "org_id": { + "description": "Owning organization identifier for this antivirus profile", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -32038,8 +33693,9 @@ "type": "string" }, "protocols": { - "description": "List of protocols to monitor. enum: `ftp`, `http`, `imap`, `pop3`, `smtp`", + "description": "Network protocols inspected by this antivirus profile", "items": { + "description": "Protocol that can be inspected by an antivirus profile. enum: `ftp`, `http`, `imap`, `pop3`, `smtp`", "enum": [ "ftp", "http", @@ -32053,6 +33709,7 @@ "type": "array" }, "site_id": { + "description": "Associated site identifier for this antivirus profile, when site-scoped", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -32061,6 +33718,7 @@ "type": "string" }, "url_whitelist": { + "description": "Allowed URL entries exempted from antivirus scanning", "items": { "type": "string" }, @@ -32077,13 +33735,16 @@ }, "org_aamwprofile": { "schema": { + "description": "Advanced Anti Malware profile that controls Sky ATP file verdict handling", "properties": { "categories": { + "description": "File categories evaluated by this Advanced Anti Malware profile", "items": { "additionalProperties": false, + "description": "File category rule for Advanced Anti Malware inspection", "properties": { "category": { - "description": "enum: `archive`, `document`, `pdf`, `executable`, `rich_application`, `library`, `os_package`, `mobile`, `java`, `configuration`, `script`", + "description": "File category covered by this Advanced Anti Malware profile", "enum": [ "archive", "document", @@ -32101,6 +33762,7 @@ }, "hash_lookup_only": { "default": false, + "description": "Whether files in this category use hash lookup without full file analysis", "type": "boolean" } }, @@ -32109,14 +33771,14 @@ "type": "array" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the Advanced Anti Malware profile was created", "format": "double", "readOnly": true, "type": "number" }, "fallback_action": { "default": "block", - "description": "enum: `block`, `permit`", + "description": "Action to take when Sky ATP cannot obtain a malware verdict", "enum": [ "block", "permit" @@ -32125,7 +33787,7 @@ }, "file_action": { "default": "block", - "description": "enum: `block`, `permit`", + "description": "Action to take for files that meet or exceed the malware verdict threshold", "enum": [ "block", "permit" @@ -32133,7 +33795,7 @@ "type": "string" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the Advanced Anti Malware profile", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -32142,18 +33804,20 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the Advanced Anti Malware profile was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the Advanced Anti Malware profile", "examples": [ "aamw-custom" ], "type": "string" }, "org_id": { + "description": "Organization that owns this Advanced Anti Malware profile", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -32162,6 +33826,7 @@ "type": "string" }, "site_id": { + "description": "Site associated with this derived Advanced Anti Malware profile", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -32171,6 +33836,7 @@ }, "verdict_threshold": { "default": 8, + "description": "Minimum Sky ATP verdict score that triggers the configured file action", "maximum": 10, "minimum": 1, "type": "integer" @@ -32182,20 +33848,21 @@ }, "org_nactag": { "schema": { + "description": "NAC tag used as a rule-matching classifier or as a result attribute for allowed users", "properties": { "allow_usermac_override": { "default": false, - "description": "Can be set to true to allow the override by usermac result", + "description": "Whether usermac result values can override this NAC tag when the result type is also supported by usermac", "type": "boolean" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Epoch timestamp when the NAC tag was created", "format": "double", "readOnly": true, "type": "number" }, "egress_vlan_names": { - "description": "If `type`==`egress_vlan_names`, list of egress vlans to return", + "description": "If `type`==`egress_vlan_names`, list of egress VLAN names returned by the NAC rule", "examples": [ [ "1vlan-30", @@ -32219,10 +33886,10 @@ "type": "string" } ], - "description": "If `type`==`gbp_tag`" + "description": "If `type`==`gbp_tag`, GBP tag value returned by the NAC rule" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the NAC tag", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -32231,7 +33898,7 @@ "type": "string" }, "match": { - "description": "if `type`==`match`. enum: `cert_cn`, `cert_eku`, `cert_issuer`, `cert_san`, `cert_serial`, `cert_sub`, `cert_template`, `client_mac`, `edr_status`, `gbp_tag`, `hostname`, `idp_role`, `ingress_vlan`, `mdm_status`, `nas_ip`, `radius_group`, `realm`, `ssid`, `user_name`, `usermac_label`", + "description": "If `type`==`match`, client or authentication attribute used for rule matching", "enum": [ "cert_cn", "cert_eku", @@ -32263,13 +33930,13 @@ "type": "boolean" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Epoch timestamp when the NAC tag was last modified", "format": "double", "readOnly": true, "type": "number" }, "nacportal_id": { - "description": "If `type`==`redirect_nacportal_id`, the ID of the NAC portal to redirect to", + "description": "If `type`==`redirect_nacportal_id`, NAC portal ID used for client redirection", "examples": [ "1e970fec-0a7a-4d73-a472-3ef3b6a456aa" ], @@ -32277,10 +33944,12 @@ "type": "string" }, "name": { + "description": "Human-readable name of the NAC tag", "minLength": 1, "type": "string" }, "org_id": { + "description": "Org identifier that owns the NAC tag", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -32289,7 +33958,7 @@ "type": "string" }, "radius_attrs": { - "description": "If `type`==`radius_attrs`, user can specify a list of one or more standard attributes in the field \\"radius_attrs\\". \\nIt is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected.\\nNote that it is allowed to have more than one radius_attrs in the result of a given rule.", + "description": "If `type`==`radius_attrs`, standard RADIUS attributes returned by the NAC rule", "examples": [ [ "Idle-Timeout=600", @@ -32302,11 +33971,11 @@ "type": "array" }, "radius_group": { - "description": "If `type`==`radius_group`", + "description": "If `type`==`radius_group`, RADIUS group value returned by the NAC rule", "type": "string" }, "radius_vendor_attrs": { - "description": "If `type`==`radius_vendor_attrs`, user can specify a list of one or more vendor-specific attributes in the field \\"radius_vendor_attrs\\". \\nIt is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected.\\nNote that it is allowed to have more than one radius_vendor_attrs in the result of a given rule.", + "description": "If `type`==`radius_vendor_attrs`, vendor-specific RADIUS attributes returned by the NAC rule", "examples": [ [ "PaloAlto-Admin-Role=superuser", @@ -32319,14 +33988,14 @@ "type": "array" }, "session_timeout": { - "description": "If `type`==`session_timeout, in seconds", + "description": "If `type`==`session_timeout`, session timeout returned by the NAC rule, in seconds", "examples": [ 86000 ], "type": "integer" }, "type": { - "description": "enum: `egress_vlan_names`, `gbp_tag`, `match`, `radius_attrs`, `radius_group`, `radius_vendor_attrs`, `redirect_nacportal_id`, `session_timeout`, `username_attr`, `vlan`", + "description": "NAC tag type that determines whether the tag is a matcher or a result attribute", "enum": [ "egress_vlan_names", "gbp_tag", @@ -32343,7 +34012,7 @@ "type": "string" }, "username_attr": { - "description": "enum: `automatic`, `cn`, `dns`, `email`, `upn`", + "description": "If `type`==`username_attr`, attribute used to derive the username returned by the NAC rule", "enum": [ "automatic", "cn", @@ -32354,14 +34023,14 @@ "type": "string" }, "values": { - "description": "If `type`==`match`", + "description": "If `type`==`match`, attribute values used by the NAC tag matcher", "items": { "type": "string" }, "type": "array" }, "vlan": { - "description": "If `type`==`vlan`", + "description": "If `type`==`vlan`, VLAN name or ID returned by the NAC rule", "type": "string" } }, @@ -32375,9 +34044,10 @@ }, "org_nacrule": { "schema": { + "description": "NAC authentication policy rule that matches request criteria and applies an allow or block action", "properties": { "action": { - "description": "enum: `allow`, `block`", + "description": "Allow or block decision applied when the NAC rule matches", "enum": [ "allow", "block" @@ -32388,7 +34058,7 @@ "type": "string" }, "apply_tags": { - "description": "All optional, this goes into Access-Accept", + "description": "NAC tag IDs to include in the Access-Accept when the rule allows access", "examples": [ [ "c049dfcd-0c73-5014-1c64-062e9903f1e5" @@ -32400,18 +34070,22 @@ "type": "array" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Epoch timestamp when the NAC rule was created", "format": "double", "readOnly": true, "type": "number" }, + "dry_run": { + "description": "Whether the NAC rule is in dry-run mode, where matches are logged but the action is not enforced", + "type": "boolean" + }, "enabled": { "default": true, - "description": "Enabled or not", + "description": "Whether the NAC rule is evaluated during policy matching", "type": "boolean" }, "guest_auth_state": { - "description": "Guest portal authorization state. enum: `authorized`, `unknown`", + "description": "Guest portal authorization state condition for the rule", "enum": [ "authorized", "unknown" @@ -32422,7 +34096,7 @@ "type": "string" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the NAC rule", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -32432,9 +34106,10 @@ }, "matching": { "additionalProperties": false, + "description": "Criteria that must match for the NAC rule to apply", "properties": { "auth_type": { - "description": "enum: `cert`, `device-auth`, `eap-teap`, `eap-tls`, `eap-ttls`, `idp`, `mab`, `eap-peap`", + "description": "NAC authentication method that must match the request", "enum": [ "cert", "device-auth", @@ -32451,27 +34126,28 @@ "type": "string" }, "family": { - "description": "List of client device families to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed family values", + "description": "Client device family values that must match the request", "items": { "type": "string" }, "type": "array" }, "mfg": { - "description": "List of client device models to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed model values", + "description": "Client device manufacturer values that must match the request", "items": { "type": "string" }, "type": "array" }, "model": { - "description": "List of client device manufacturers to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed mfg values", + "description": "Client device model values that must match the request", "items": { "type": "string" }, "type": "array" }, "nactags": { + "description": "NAC tag IDs whose match criteria must be satisfied by the request", "examples": [ [ "041d5d36-716c-4cfb-4988-3857c6aa14a2", @@ -32484,20 +34160,21 @@ "type": "array" }, "os_type": { - "description": "List of client device os types to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed os_type values", + "description": "Client OS type values that must match the request", "items": { "type": "string" }, "type": "array" }, "port_types": { + "description": "Wired or wireless access types that must match the request", "examples": [ [ "wired" ] ], "items": { - "description": "enum: `wired`, `wireless`", + "description": "Port attachment type matched by a NAC rule. enum: `wired`, `wireless`", "enum": [ "wired", "wireless" @@ -32507,7 +34184,7 @@ "type": "array" }, "site_ids": { - "description": "List of site ids to match", + "description": "Site IDs where the rule criteria apply", "examples": [ [ "bb19fc3e-4124-4b57-80d9-c3f6edce47c4", @@ -32521,7 +34198,7 @@ "type": "array" }, "sitegroup_ids": { - "description": "List of sitegroup ids to match", + "description": "Site group IDs where the rule criteria apply", "examples": [ [ "bb19fc3e-4124-4b57-80d9-c3f6edce47c4", @@ -32535,7 +34212,7 @@ "type": "array" }, "vendor": { - "description": "List of vendors to match", + "description": "Client device vendor values that must match the request", "items": { "examples": [ "cisc" @@ -32548,19 +34225,21 @@ "type": "object" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Epoch timestamp when the NAC rule was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Human-readable name of the NAC rule", "type": "string" }, "not_matching": { "additionalProperties": false, + "description": "Criteria that must not match for the NAC rule to apply", "properties": { "auth_type": { - "description": "enum: `cert`, `device-auth`, `eap-teap`, `eap-tls`, `eap-ttls`, `idp`, `mab`, `eap-peap`", + "description": "NAC authentication method that must match the request", "enum": [ "cert", "device-auth", @@ -32577,27 +34256,28 @@ "type": "string" }, "family": { - "description": "List of client device families to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed family values", + "description": "Client device family values that must match the request", "items": { "type": "string" }, "type": "array" }, "mfg": { - "description": "List of client device models to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed model values", + "description": "Client device manufacturer values that must match the request", "items": { "type": "string" }, "type": "array" }, "model": { - "description": "List of client device manufacturers to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed mfg values", + "description": "Client device model values that must match the request", "items": { "type": "string" }, "type": "array" }, "nactags": { + "description": "NAC tag IDs whose match criteria must be satisfied by the request", "examples": [ [ "041d5d36-716c-4cfb-4988-3857c6aa14a2", @@ -32610,20 +34290,21 @@ "type": "array" }, "os_type": { - "description": "List of client device os types to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed os_type values", + "description": "Client OS type values that must match the request", "items": { "type": "string" }, "type": "array" }, "port_types": { + "description": "Wired or wireless access types that must match the request", "examples": [ [ "wired" ] ], "items": { - "description": "enum: `wired`, `wireless`", + "description": "Port attachment type matched by a NAC rule. enum: `wired`, `wireless`", "enum": [ "wired", "wireless" @@ -32633,7 +34314,7 @@ "type": "array" }, "site_ids": { - "description": "List of site ids to match", + "description": "Site IDs where the rule criteria apply", "examples": [ [ "bb19fc3e-4124-4b57-80d9-c3f6edce47c4", @@ -32647,7 +34328,7 @@ "type": "array" }, "sitegroup_ids": { - "description": "List of sitegroup ids to match", + "description": "Site group IDs where the rule criteria apply", "examples": [ [ "bb19fc3e-4124-4b57-80d9-c3f6edce47c4", @@ -32661,7 +34342,7 @@ "type": "array" }, "vendor": { - "description": "List of vendors to match", + "description": "Client device vendor values that must match the request", "items": { "examples": [ "cisc" @@ -32674,7 +34355,7 @@ "type": "object" }, "order": { - "description": "Order of the rule, lower value implies higher priority", + "description": "Rule priority; lower values are evaluated with higher priority", "examples": [ 1 ], @@ -32682,6 +34363,7 @@ "type": "integer" }, "org_id": { + "description": "Org identifier that owns the NAC rule", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -32700,7 +34382,7 @@ }, "org_psk": { "schema": { - "description": "PSK", + "description": "Personal pre-shared key configuration for WLAN access", "properties": { "admin_sso_id": { "description": "sso id for psk created from psk portal", @@ -32708,13 +34390,13 @@ "type": "string" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Epoch timestamp when the PSK was created", "format": "double", "readOnly": true, "type": "number" }, "email": { - "description": "email to send psk expiring notifications to", + "description": "Notification recipient email address for PSK creation notification and expiration reminders", "type": "string" }, "expire_time": { @@ -32733,7 +34415,7 @@ "type": "integer" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the PSK", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -32742,11 +34424,11 @@ "type": "string" }, "mac": { - "description": "If `usage`==`single`, the mac that this PSK ties to, empty if `auto-binding`", + "description": "If `usage`==`single`, client MAC address this PSK is bound to; empty when auto-binding is used", "type": "string" }, "macs": { - "description": "If `usage`==`macs`, this list contains N number of client mac addresses or mac patterns(1122*) or both. This list is capped at 5000", + "description": "Client MAC addresses or MAC patterns allowed when `usage`==`macs`", "examples": [ [ "112233abcedf", @@ -32764,15 +34446,17 @@ "type": "integer" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Epoch timestamp when the PSK was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the PSK", "type": "string" }, "note": { + "description": "Admin note or description stored with the PSK", "type": "string" }, "notify_expiry": { @@ -32789,6 +34473,7 @@ "type": "string" }, "org_id": { + "description": "Organization that owns the org-level PSK", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -32797,17 +34482,20 @@ "type": "string" }, "passphrase": { - "description": "passphrase of the PSK (8-63 character or 64 in hex)", + "description": "PSK passphrase, 8-63 characters or 64 hexadecimal characters", + "format": "password", "maxLength": 64, "minLength": 8, "type": "string" }, "role": { + "description": "Client role applied to users authenticated with this PSK", "maxLength": 32, "minLength": 0, "type": "string" }, "site_id": { + "description": "Site associated with the site-level PSK", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -32816,12 +34504,12 @@ "type": "string" }, "ssid": { - "description": "SSID this PSK should be applicable to", + "description": "WLAN SSID where this PSK can be used", "type": "string" }, "usage": { "default": "multi", - "description": "enum: `macs`, `multi`, `single`", + "description": "Binding mode for this PSK, enum: `macs`, `multi`, `single`", "enum": [ "macs", "multi", @@ -32830,7 +34518,7 @@ "type": "string" }, "vlan_id": { - "description": "VLAN for this PSK key", + "description": "VLAN ID returned for clients using this PSK", "oneOf": [ { "type": "string" @@ -32858,7 +34546,7 @@ }, "site_psk": { "schema": { - "description": "PSK", + "description": "Personal pre-shared key configuration for WLAN access", "properties": { "admin_sso_id": { "description": "sso id for psk created from psk portal", @@ -32866,13 +34554,13 @@ "type": "string" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Epoch timestamp when the PSK was created", "format": "double", "readOnly": true, "type": "number" }, "email": { - "description": "email to send psk expiring notifications to", + "description": "Notification recipient email address for PSK creation notification and expiration reminders", "type": "string" }, "expire_time": { @@ -32891,7 +34579,7 @@ "type": "integer" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the PSK", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -32900,11 +34588,11 @@ "type": "string" }, "mac": { - "description": "If `usage`==`single`, the mac that this PSK ties to, empty if `auto-binding`", + "description": "If `usage`==`single`, client MAC address this PSK is bound to; empty when auto-binding is used", "type": "string" }, "macs": { - "description": "If `usage`==`macs`, this list contains N number of client mac addresses or mac patterns(1122*) or both. This list is capped at 5000", + "description": "Client MAC addresses or MAC patterns allowed when `usage`==`macs`", "examples": [ [ "112233abcedf", @@ -32922,15 +34610,17 @@ "type": "integer" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Epoch timestamp when the PSK was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the PSK", "type": "string" }, "note": { + "description": "Admin note or description stored with the PSK", "type": "string" }, "notify_expiry": { @@ -32947,6 +34637,7 @@ "type": "string" }, "org_id": { + "description": "Organization that owns the org-level PSK", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -32955,17 +34646,20 @@ "type": "string" }, "passphrase": { - "description": "passphrase of the PSK (8-63 character or 64 in hex)", + "description": "PSK passphrase, 8-63 characters or 64 hexadecimal characters", + "format": "password", "maxLength": 64, "minLength": 8, "type": "string" }, "role": { + "description": "Client role applied to users authenticated with this PSK", "maxLength": 32, "minLength": 0, "type": "string" }, "site_id": { + "description": "Site associated with the site-level PSK", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -32974,12 +34668,12 @@ "type": "string" }, "ssid": { - "description": "SSID this PSK should be applicable to", + "description": "WLAN SSID where this PSK can be used", "type": "string" }, "usage": { "default": "multi", - "description": "enum: `macs`, `multi`, `single`", + "description": "Binding mode for this PSK, enum: `macs`, `multi`, `single`", "enum": [ "macs", "multi", @@ -32988,7 +34682,7 @@ "type": "string" }, "vlan_id": { - "description": "VLAN for this PSK key", + "description": "VLAN ID returned for clients using this PSK", "oneOf": [ { "type": "string" @@ -33016,10 +34710,10 @@ }, "org_service": { "schema": { - "description": "Applications used for the Gateway configurations", + "description": "Traffic service definition for applications or destinations used by gateway and SSR policies", "properties": { "addresses": { - "description": "If `type`==`custom`, IPv4 and/or IPv6 subnets (e.g. 10.0.0.0/8, fd28::/128)", + "description": "Custom IPv4 or IPv6 subnets matched by this service when `type`==`custom`", "examples": [ [ "10.0.0.0/8", @@ -33034,7 +34728,7 @@ "type": "array" }, "app_categories": { - "description": "When `type`==`app_categories`, list of application categories are available through [List App Category Definitions](/#operations/listAppCategoryDefinitions)", + "description": "Categories of applications matched by this service when `type`==`app_categories`", "examples": [ [ "Sports" @@ -33046,7 +34740,7 @@ "type": "array" }, "app_subcategories": { - "description": "When `type`==`app_categories`, list of application categories are available through [List App Sub Category Definitions](/#operations/listAppSubCategoryDefinitions)", + "description": "Application subcategories matched by this service when `type`==`app_categories`", "examples": [ [ "Shopping" @@ -33058,7 +34752,7 @@ "type": "array" }, "apps": { - "description": "When `type`==`apps`, list of applications are available through:\\n * [List Applications](/#operations/listApplications)\\n * [List Gateway Applications](/#operations/listGatewayApplications)\\n * /insight/top_app_by-bytes?wired=true", + "description": "Application identifiers matched by this service when `type`==`apps`", "examples": [ [ "office365", @@ -33091,16 +34785,17 @@ "type": "integer" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the service definition was created, in epoch seconds", "format": "double", "readOnly": true, "type": "number" }, "description": { + "description": "Free-form description of the service definition", "type": "string" }, "dscp": { - "description": "For SSR only, when `traffic_type`==`custom`. 0-63 or variable", + "description": "QoS DSCP value used for custom SSR traffic classification", "oneOf": [ { "type": "string" @@ -33114,7 +34809,7 @@ }, "failover_policy": { "default": "revertible", - "description": "enum: `non_revertible`, `none`, `revertible`", + "description": "Failover behavior for traffic matched by this service", "enum": [ "non_revertible", "none", @@ -33123,7 +34818,7 @@ "type": "string" }, "hostnames": { - "description": "If `type`==`custom`, web filtering", + "description": "Domain hostnames matched by this custom service for web filtering", "items": { "examples": [ "example.com" @@ -33133,7 +34828,7 @@ "type": "array" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique value identifying the service definition", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -33142,7 +34837,7 @@ "type": "string" }, "max_jitter": { - "description": "For SSR only, when `traffic_type`==`custom`, for uplink selection. 0-2147483647 or variable", + "description": "Maximum jitter threshold used for SSR uplink selection when `traffic_type`==`custom`", "oneOf": [ { "type": "string" @@ -33155,7 +34850,7 @@ ] }, "max_latency": { - "description": "For SSR only, when `traffic_type`==`custom`, for uplink selection. 0-2147483647 or variable", + "description": "Maximum latency threshold used for SSR uplink selection when `traffic_type`==`custom`", "oneOf": [ { "type": "string" @@ -33168,7 +34863,7 @@ ] }, "max_loss": { - "description": "For SSR only, when `traffic_type`==`custom`, for uplink selection. 0-100 or variable", + "description": "Maximum packet loss threshold used for SSR uplink selection when `traffic_type`==`custom`", "oneOf": [ { "type": "string" @@ -33181,15 +34876,17 @@ ] }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the service definition was last modified, in epoch seconds", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the service definition", "type": "string" }, "org_id": { + "description": "Organization identifier associated with the service definition", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -33223,9 +34920,10 @@ "type": "boolean" }, "specs": { - "description": "When `type`==`custom`, optional, if it doesn't exist, http and https is assumed", + "description": "Protocol and port match rules used when `type`==`custom`", "items": { "additionalProperties": false, + "description": "Protocol and port match rule for a custom service", "properties": { "port_range": { "description": "Port number, port range, or variable", @@ -33249,11 +34947,12 @@ }, "ssr_relaxed_tcp_state_enforcement": { "default": false, + "description": "Whether SSR relaxes TCP state enforcement for this service", "type": "boolean" }, "traffic_class": { "default": "best_effort", - "description": "when `traffic_type`==`custom`. enum: `best_effort`, `high`, `low`, `medium`", + "description": "Traffic class applied when `traffic_type`==`custom`", "enum": [ "best_effort", "high", @@ -33269,7 +34968,7 @@ }, "type": { "default": "custom", - "description": "enum: `app_categories`, `apps`, `custom`, `urls`", + "description": "Matching mode that determines which app, URL, or custom fields are used", "enum": [ "app_categories", "apps", @@ -33279,7 +34978,7 @@ "type": "string" }, "urls": { - "description": "When `type`==`urls`, no need for spec as URL can encode the ports being used", + "description": "URL patterns matched by this service when `type`==`urls`", "items": { "type": "string" }, @@ -33292,7 +34991,7 @@ }, "org_site": { "schema": { - "description": "Site", + "description": "Site configuration and metadata within an organization", "properties": { "address": { "description": "full address of the site", @@ -33334,7 +35033,7 @@ "type": "string" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the site was created, in epoch seconds", "format": "double", "readOnly": true, "type": "number" @@ -33351,7 +35050,7 @@ ] }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique value identifying the site", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -33361,8 +35060,10 @@ }, "latlng": { "additionalProperties": false, + "description": "Latitude and longitude for the site location", "properties": { "lat": { + "description": "Geographic latitude in decimal degrees", "examples": [ 37.295833 ], @@ -33370,6 +35071,7 @@ "type": "number" }, "lng": { + "description": "Geographic longitude in decimal degrees", "examples": [ -122.032946 ], @@ -33384,12 +35086,13 @@ "type": "object" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the site was last modified, in epoch seconds", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the site", "examples": [ "Mist Office" ], @@ -33414,6 +35117,7 @@ ] }, "org_id": { + "description": "Organization identifier associated with the site", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -33444,7 +35148,7 @@ ] }, "secpolicy_id": { - "description": "SecPolicy ID", + "description": "Security policy identifier applied to this site", "examples": [ "3bcd0beb-5d0a-4cbd-92c1-14aea91e98ef" ], @@ -33455,7 +35159,7 @@ ] }, "sitegroup_ids": { - "description": "Sitegroups this site belongs to", + "description": "Site group identifiers for groups that include this site", "items": { "format": "uuid", "type": "string" @@ -33463,7 +35167,7 @@ "type": "array" }, "sitetemplate_id": { - "description": "Site Template ID", + "description": "Site template identifier applied to this site", "format": "uuid", "type": [ "string", @@ -33472,7 +35176,7 @@ }, "timezone": { "default": "UTC", - "description": "Timezone the site is at", + "description": "IANA time zone name for the site", "examples": [ "America/Los_Angeles" ], @@ -33480,6 +35184,7 @@ }, "tzoffset": { "default": 0, + "description": "Time zone offset value derived from the site's timezone", "type": "integer" } }, @@ -33492,12 +35197,14 @@ }, "org_sitetemplate": { "schema": { + "description": "Site template containing auto-upgrade settings and template variables", "properties": { "auto_upgrade": { "additionalProperties": false, + "description": "Automatic upgrade settings applied by this site template", "properties": { "day_of_week": { - "description": "enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`", + "description": "Day of week when the automatic upgrade window runs", "enum": [ "any", "fri", @@ -33511,25 +35218,29 @@ "type": "string" }, "enabled": { + "description": "Whether automatic upgrades are enabled for sites using this site template", "type": "boolean" }, "time_of_day": { + "description": "Local time of day when the automatic upgrade window starts", "type": "string" }, "version": { + "description": "Target firmware version installed during automatic upgrades", "type": "string" } }, "type": "object" }, "name": { + "description": "Display name of the site template", "type": "string" }, "vars": { "additionalProperties": { "type": "string" }, - "description": "Dictionary of name->value, the vars can then be used in Wlans. This can overwrite those from Site Vars", + "description": "Template variables available to WLAN configuration in this site template", "examples": [ { "RADIUS_IP1": "172.31.2.5", @@ -33545,16 +35256,16 @@ }, "org_sitegroup": { "schema": { - "description": "Sites Group", + "description": "Group of sites within an organization", "properties": { "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the site group was created", "format": "double", "readOnly": true, "type": "number" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique value identifying the site group", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -33563,15 +35274,17 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the site group was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the site group", "type": "string" }, "org_id": { + "description": "Identifier of the org that owns the site group", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -33580,6 +35293,7 @@ "type": "string" }, "site_ids": { + "description": "Site identifiers included in the site group", "items": { "format": "uuid", "type": "string" @@ -33596,9 +35310,10 @@ }, "org_webhook": { "schema": { + "description": "Webhook configuration for delivering selected Mist events to an external destination", "properties": { "assetfilter_ids": { - "description": "Only if `type`==`asset-raw-rssi`. List of ids to associated asset filters. These filters will be applied to messages routed to a filtered-asset-rssi webhook", + "description": "Asset filter identifiers used to restrict `asset-raw-rssi` webhook events", "items": { "format": "uuid", "type": "string" @@ -33606,7 +35321,7 @@ "type": "array" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Epoch timestamp when the webhook was created", "format": "double", "readOnly": true, "type": "number" @@ -33617,6 +35332,7 @@ "type": "boolean" }, "for_site": { + "description": "Whether this webhook is scoped to a site rather than the organization", "readOnly": true, "type": "boolean" }, @@ -33637,7 +35353,7 @@ ] }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the webhook", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -33646,29 +35362,29 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Epoch timestamp when the webhook was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { - "description": "Name of the webhook", + "description": "Display name of the webhook", "type": [ "string", "null" ] }, "oauth2_client_id": { - "description": "Required when `oauth2_grant_type`==`client_credentials`", + "description": "Required when `oauth2_grant_type`==`client_credentials`; OAuth2 client identifier used to request an access token", "type": "string" }, "oauth2_client_secret": { - "description": "Required when `oauth2_grant_type`==`client_credentials`", + "description": "Required when `oauth2_grant_type`==`client_credentials`; OAuth2 client secret used to request an access token", "format": "password", "type": "string" }, "oauth2_grant_type": { - "description": "required when `type`==`oauth2`. enum: `client_credentials`, `password`", + "description": "OAuth2 grant type used when `type`==`oauth2`", "enum": [ "client_credentials", "password" @@ -33676,26 +35392,27 @@ "type": "string" }, "oauth2_password": { - "description": "Required when `oauth2_grant_type`==`password`", + "description": "Required when `oauth2_grant_type`==`password`; password used for the OAuth2 token request", "format": "password", "type": "string" }, "oauth2_scopes": { - "description": "Required when `type`==`oauth2`, if provided, will be used in the token request", + "description": "OAuth2 scopes included in the token request when `type`==`oauth2`", "items": { "type": "string" }, "type": "array" }, "oauth2_token_url": { - "description": "Required when `type`==`oauth2`", + "description": "Required when `type`==`oauth2`; token endpoint URL used to obtain the OAuth2 access token", "type": "string" }, "oauth2_username": { - "description": "Required when `oauth2_grant_type`==`password`", + "description": "Required when `oauth2_grant_type`==`password`; username used for the OAuth2 token request", "type": "string" }, "org_id": { + "description": "Organization that owns the webhook", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -33716,6 +35433,7 @@ "type": "boolean" }, "site_id": { + "description": "Site associated with this webhook when it is site-scoped", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -33731,7 +35449,7 @@ ] }, "topics": { - "description": "List of supported webhook topics available with the API Call [List Webhook Topics](/#operations/listWebhookTopics)", + "description": "Event topics delivered by this webhook", "items": { "type": "string" }, @@ -33739,7 +35457,7 @@ }, "type": { "default": "http-post", - "description": "enum: `aws-sns`, `google-pubsub`, `http-post`, `oauth2`, `splunk`", + "description": "Delivery mechanism used by this webhook", "enum": [ "aws-sns", "google-pubsub", @@ -33750,6 +35468,7 @@ "type": "string" }, "url": { + "description": "Destination URL that receives webhook deliveries", "type": "string" }, "verify_cert": { @@ -33764,9 +35483,10 @@ }, "site_webhook": { "schema": { + "description": "Webhook configuration for delivering selected Mist events to an external destination", "properties": { "assetfilter_ids": { - "description": "Only if `type`==`asset-raw-rssi`. List of ids to associated asset filters. These filters will be applied to messages routed to a filtered-asset-rssi webhook", + "description": "Asset filter identifiers used to restrict `asset-raw-rssi` webhook events", "items": { "format": "uuid", "type": "string" @@ -33774,7 +35494,7 @@ "type": "array" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Epoch timestamp when the webhook was created", "format": "double", "readOnly": true, "type": "number" @@ -33785,6 +35505,7 @@ "type": "boolean" }, "for_site": { + "description": "Whether this webhook is scoped to a site rather than the organization", "readOnly": true, "type": "boolean" }, @@ -33805,7 +35526,7 @@ ] }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the webhook", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -33814,29 +35535,29 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Epoch timestamp when the webhook was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { - "description": "Name of the webhook", + "description": "Display name of the webhook", "type": [ "string", "null" ] }, "oauth2_client_id": { - "description": "Required when `oauth2_grant_type`==`client_credentials`", + "description": "Required when `oauth2_grant_type`==`client_credentials`; OAuth2 client identifier used to request an access token", "type": "string" }, "oauth2_client_secret": { - "description": "Required when `oauth2_grant_type`==`client_credentials`", + "description": "Required when `oauth2_grant_type`==`client_credentials`; OAuth2 client secret used to request an access token", "format": "password", "type": "string" }, "oauth2_grant_type": { - "description": "required when `type`==`oauth2`. enum: `client_credentials`, `password`", + "description": "OAuth2 grant type used when `type`==`oauth2`", "enum": [ "client_credentials", "password" @@ -33844,26 +35565,27 @@ "type": "string" }, "oauth2_password": { - "description": "Required when `oauth2_grant_type`==`password`", + "description": "Required when `oauth2_grant_type`==`password`; password used for the OAuth2 token request", "format": "password", "type": "string" }, "oauth2_scopes": { - "description": "Required when `type`==`oauth2`, if provided, will be used in the token request", + "description": "OAuth2 scopes included in the token request when `type`==`oauth2`", "items": { "type": "string" }, "type": "array" }, "oauth2_token_url": { - "description": "Required when `type`==`oauth2`", + "description": "Required when `type`==`oauth2`; token endpoint URL used to obtain the OAuth2 access token", "type": "string" }, "oauth2_username": { - "description": "Required when `oauth2_grant_type`==`password`", + "description": "Required when `oauth2_grant_type`==`password`; username used for the OAuth2 token request", "type": "string" }, "org_id": { + "description": "Organization that owns the webhook", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -33884,6 +35606,7 @@ "type": "boolean" }, "site_id": { + "description": "Site associated with this webhook when it is site-scoped", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -33899,7 +35622,7 @@ ] }, "topics": { - "description": "List of supported webhook topics available with the API Call [List Webhook Topics](/#operations/listWebhookTopics)", + "description": "Event topics delivered by this webhook", "items": { "type": "string" }, @@ -33907,7 +35630,7 @@ }, "type": { "default": "http-post", - "description": "enum: `aws-sns`, `google-pubsub`, `http-post`, `oauth2`, `splunk`", + "description": "Delivery mechanism used by this webhook", "enum": [ "aws-sns", "google-pubsub", @@ -33918,6 +35641,7 @@ "type": "string" }, "url": { + "description": "Destination URL that receives webhook deliveries", "type": "string" }, "verify_cert": { @@ -33932,10 +35656,10 @@ }, "org_wxlanrule": { "schema": { - "description": "WXlan", + "description": "WxLAN policy rule controlling traffic between WxLAN tags", "properties": { "action": { - "description": "type of action, allow / block. enum: `allow`, `block`", + "description": "Allow or block behavior applied by this WxLAN rule", "enum": [ "allow", "block" @@ -33946,6 +35670,7 @@ "type": "string" }, "apply_tags": { + "description": "WxLAN tag identifiers applied when this rule matches", "items": { "examples": [ "c049dfcd-0c73-5014-1c64-062e9903f1e5" @@ -33955,7 +35680,7 @@ "type": "array" }, "blocked_apps": { - "description": "Blocked apps (always blocking, ignoring action), the key of Get Application List", + "description": "Application keys always blocked by this rule, regardless of the rule action", "examples": [ [ "mist", @@ -33968,13 +35693,13 @@ "type": "array" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Time when this WxLAN rule was created, in epoch seconds", "format": "double", "readOnly": true, "type": "number" }, "dst_allow_wxtags": { - "description": "List of WxTag UUID to indicate these tags are allowed access", + "description": "Destination WxLAN tag identifiers explicitly allowed by this rule", "examples": [ [ "fff34466-eec0-3756-6765-381c728a6037", @@ -33987,7 +35712,7 @@ "type": "array" }, "dst_deny_wxtags": { - "description": "List of WxTag UUID to indicate these tags are blocked access", + "description": "Destination WxLAN tag identifiers explicitly denied by this rule", "examples": [ [ "aaa34466-eec0-3756-6765-381c728a6037", @@ -34000,7 +35725,7 @@ "type": "array" }, "dst_wxtags": { - "description": "List of WxTag UUID", + "description": "Destination WxLAN tag identifiers matched by this rule", "examples": [ [ "aaa34466-eec0-3756-6765-381c728a6037", @@ -34014,14 +35739,16 @@ }, "enabled": { "default": true, + "description": "Whether this WxLAN rule is enabled", "type": "boolean" }, "for_site": { + "description": "Whether this WxLAN rule is scoped to a site", "readOnly": true, "type": "boolean" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier for this WxLAN rule", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -34030,13 +35757,13 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Time when this WxLAN rule was last modified, in epoch seconds", "format": "double", "readOnly": true, "type": "number" }, "order": { - "description": "Order how rules would be looked up, > 0 and bigger order got matched first, -1 means LAST, uniqueness not checked", + "description": "Lookup priority for WxLAN rules; larger positive values match first, and -1 means LAST. Uniqueness is not checked", "examples": [ 1 ], @@ -34044,6 +35771,7 @@ "type": "integer" }, "org_id": { + "description": "Owning organization associated with this WxLAN rule", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -34052,6 +35780,7 @@ "type": "string" }, "site_id": { + "description": "Mist site associated with this WxLAN rule, when site-scoped", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -34060,7 +35789,7 @@ "type": "string" }, "src_wxtags": { - "description": "List of WxTag UUID to determine if this rule would match", + "description": "Source WxLAN tag identifiers that must match for this rule to apply", "examples": [ [ "8bfc2490-d726-3587-038d-cb2e71bd2330", @@ -34091,10 +35820,10 @@ }, "site_wxlanrule": { "schema": { - "description": "WXlan", + "description": "WxLAN policy rule controlling traffic between WxLAN tags", "properties": { "action": { - "description": "type of action, allow / block. enum: `allow`, `block`", + "description": "Allow or block behavior applied by this WxLAN rule", "enum": [ "allow", "block" @@ -34105,6 +35834,7 @@ "type": "string" }, "apply_tags": { + "description": "WxLAN tag identifiers applied when this rule matches", "items": { "examples": [ "c049dfcd-0c73-5014-1c64-062e9903f1e5" @@ -34114,7 +35844,7 @@ "type": "array" }, "blocked_apps": { - "description": "Blocked apps (always blocking, ignoring action), the key of Get Application List", + "description": "Application keys always blocked by this rule, regardless of the rule action", "examples": [ [ "mist", @@ -34127,13 +35857,13 @@ "type": "array" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Time when this WxLAN rule was created, in epoch seconds", "format": "double", "readOnly": true, "type": "number" }, "dst_allow_wxtags": { - "description": "List of WxTag UUID to indicate these tags are allowed access", + "description": "Destination WxLAN tag identifiers explicitly allowed by this rule", "examples": [ [ "fff34466-eec0-3756-6765-381c728a6037", @@ -34146,7 +35876,7 @@ "type": "array" }, "dst_deny_wxtags": { - "description": "List of WxTag UUID to indicate these tags are blocked access", + "description": "Destination WxLAN tag identifiers explicitly denied by this rule", "examples": [ [ "aaa34466-eec0-3756-6765-381c728a6037", @@ -34159,7 +35889,7 @@ "type": "array" }, "dst_wxtags": { - "description": "List of WxTag UUID", + "description": "Destination WxLAN tag identifiers matched by this rule", "examples": [ [ "aaa34466-eec0-3756-6765-381c728a6037", @@ -34173,14 +35903,16 @@ }, "enabled": { "default": true, + "description": "Whether this WxLAN rule is enabled", "type": "boolean" }, "for_site": { + "description": "Whether this WxLAN rule is scoped to a site", "readOnly": true, "type": "boolean" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier for this WxLAN rule", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -34189,13 +35921,13 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Time when this WxLAN rule was last modified, in epoch seconds", "format": "double", "readOnly": true, "type": "number" }, "order": { - "description": "Order how rules would be looked up, > 0 and bigger order got matched first, -1 means LAST, uniqueness not checked", + "description": "Lookup priority for WxLAN rules; larger positive values match first, and -1 means LAST. Uniqueness is not checked", "examples": [ 1 ], @@ -34203,6 +35935,7 @@ "type": "integer" }, "org_id": { + "description": "Owning organization associated with this WxLAN rule", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -34211,6 +35944,7 @@ "type": "string" }, "site_id": { + "description": "Mist site associated with this WxLAN rule, when site-scoped", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -34219,7 +35953,7 @@ "type": "string" }, "src_wxtags": { - "description": "List of WxTag UUID to determine if this rule would match", + "description": "Source WxLAN tag identifiers that must match for this rule to apply", "examples": [ [ "8bfc2490-d726-3587-038d-cb2e71bd2330", @@ -34253,17 +35987,18 @@ "description": "WxLAN Tag\\n * type:\\n * client: created manually (e.g. on wireless client table, when they spot a device of interest, they can create a wxlan tag for it\\n * resource: created automatically when we discover a network resource\\n * subnet: create automatically when a subnet is discovered\\n * match:\\n * wlan_id, ap_id: values are a list of Wlan / Device ids\\n * client_mac: values are a list of MAC addresses\\n * radius_group: this is a smart tag that matches RADIUS-Filter-ID, Airespace-ACL-Name (VendorID=14179, VendorType=6) / Aruba-User-Role (VendorID=14823, VendorType=1)\\n * radius_username: this matches the ATTR-User-Name(1)\\n * radius_class: the matches the ATTR-Class(25)\\n * radius_attr: the values are [ \\"6=1\\" , \\"26=10.2.3.4\\" ], this support other RADIUS attributes where we know the type\\n * radius_vendor: the values are [ \\"14179.10=1\\" , \\"14178.16=1.2.3.4\\" ], this matches vendor attributes and will be dynamically evaluated", "properties": { "created_time": { - "description": "When the object has been created, in epoch", + "description": "Time when this WxLAN tag was created, in epoch seconds", "format": "double", "readOnly": true, "type": "number" }, "for_site": { + "description": "Whether this WxLAN tag is scoped to a site", "readOnly": true, "type": "boolean" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier for this WxLAN tag", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -34272,6 +36007,7 @@ "type": "string" }, "last_ips": { + "description": "Most recent IP addresses observed for this WxLAN tag", "items": { "type": "string" }, @@ -34279,14 +36015,14 @@ "type": "array" }, "mac": { - "description": "If `type`==`client`, Client MAC Address", + "description": "If `type`==`client`, Client MAC address", "type": [ "string", "null" ] }, "match": { - "description": "required if `type`==`match`. enum: `ap_id`, `app`, `asset_mac`, `client_mac`, `hostname`, `ip_range_subnet`, `port`, `psk_name`, `psk_role`, `radius_attr`, `radius_class`, `radius_group`, `radius_username`, `sdkclient_uuid`, `wlan_id`", + "description": "Required if `type`==`match`; attribute compared against `values`", "enum": [ "ap_id", "app", @@ -34307,18 +36043,18 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Time when this WxLAN tag was last modified, in epoch seconds", "format": "double", "readOnly": true, "type": "number" }, "name": { - "description": "The name", + "description": "Display name of the WxLAN tag", "type": "string" }, "op": { "default": "in", - "description": "required if `type`==`match`, type of tag (inclusive/exclusive). enum: `in`, `not_in`", + "description": "Required if `type`==`match`; whether `values` are inclusive or exclusive matches", "enum": [ "in", "not_in" @@ -34326,6 +36062,7 @@ "type": "string" }, "org_id": { + "description": "Owning organization associated with this WxLAN tag", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -34334,12 +36071,14 @@ "type": "string" }, "resource_mac": { + "description": "MAC address of the discovered resource associated with this tag, when applicable", "type": [ "string", "null" ] }, "services": { + "description": "Names of services associated with this WxLAN tag", "items": { "type": "string" }, @@ -34347,6 +36086,7 @@ "uniqueItems": true }, "site_id": { + "description": "Mist site associated with this WxLAN tag, when site-scoped", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -34355,9 +36095,10 @@ "type": "string" }, "specs": { - "description": "If `type`==`spec`", + "description": "Traffic match specifications used when `type`==`spec`", "items": { "additionalProperties": false, + "description": "Traffic match specification used by a WxLAN tag", "properties": { "port_range": { "default": "0", @@ -34371,7 +36112,7 @@ }, "subnets": { "default": [], - "description": "Matched destination subnets and/or IP Addresses", + "description": "Destination subnets or IP addresses matched by this WxLAN tag spec", "examples": [ [ "0.0.0.0/0" @@ -34388,10 +36129,11 @@ "type": "array" }, "subnet": { + "description": "CIDR subnet associated with this WxLAN tag when `type`==`subnet`", "type": "string" }, "type": { - "description": "enum: `client`, `match`, `resource`, `spec`, `subnet`, `vlan`", + "description": "Kind of WxLAN tag and how it is populated", "enum": [ "client", "match", @@ -34403,14 +36145,14 @@ "type": "string" }, "values": { - "description": "Required if `type`==`match` and\\n * `match`==`ap_id`: list of AP IDs\\n * `match`==`app`: list of Application Names\\n * `match`==`asset_mac`: list of Asset MAC Addresses\\n * `match`==`client_mac`: list of Client MAC Addresses\\n * `match`==`hostname`: list of Resources Hostnames\\n * `match`==`ip_range_subnet`: list of IP Addresses and/or CIDRs\\n * `match`==`psk_name`: list of PSK Names\\n * `match`==`psk_role`: list of PSK Roles\\n * `match`==`port`: list of Ports or Port Ranges\\n * `match`==`radius_attr`: list of RADIUS Attributes. The values are [ \\"6=1\\", \\"26=10.2.3.4\\" ], this support other RADIUS attributes where we know the type\\n * `match`==`radius_class`: list of RADIUS Classes. This matches the ATTR-Class(25)\\n * `match`==`radius_group`: list of RADIUS Groups. This is a smart tag that matches RADIUS-Filter-ID, Airespace-ACL-Name (VendorID=14179, VendorType=6) / Aruba-User-Role (VendorID=14823, VendorType=1)\\n * `match`==`radius_username`: list of RADIUS Usernames. This matches the ATTR-User-Name(1)\\n * `match`==`sdkclient_uuid`: list of SDK UUIDs\\n * `match`==`wlan_id`: list of WLAN IDs\\n\\n**Notes**:\\nVariables are not allowed", + "description": "Comparison values for the selected `match` attribute when `type`==`match`", "items": { "type": "string" }, "type": "array" }, "vlan_id": { - "description": "If `type`==`vlan_id`, VLAN ID or variable", + "description": "Identifier of the VLAN associated with this WxLAN tag when `type`==`vlan`", "examples": [ "1055" ], @@ -34439,17 +36181,18 @@ "description": "WxLAN Tag\\n * type:\\n * client: created manually (e.g. on wireless client table, when they spot a device of interest, they can create a wxlan tag for it\\n * resource: created automatically when we discover a network resource\\n * subnet: create automatically when a subnet is discovered\\n * match:\\n * wlan_id, ap_id: values are a list of Wlan / Device ids\\n * client_mac: values are a list of MAC addresses\\n * radius_group: this is a smart tag that matches RADIUS-Filter-ID, Airespace-ACL-Name (VendorID=14179, VendorType=6) / Aruba-User-Role (VendorID=14823, VendorType=1)\\n * radius_username: this matches the ATTR-User-Name(1)\\n * radius_class: the matches the ATTR-Class(25)\\n * radius_attr: the values are [ \\"6=1\\" , \\"26=10.2.3.4\\" ], this support other RADIUS attributes where we know the type\\n * radius_vendor: the values are [ \\"14179.10=1\\" , \\"14178.16=1.2.3.4\\" ], this matches vendor attributes and will be dynamically evaluated", "properties": { "created_time": { - "description": "When the object has been created, in epoch", + "description": "Time when this WxLAN tag was created, in epoch seconds", "format": "double", "readOnly": true, "type": "number" }, "for_site": { + "description": "Whether this WxLAN tag is scoped to a site", "readOnly": true, "type": "boolean" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier for this WxLAN tag", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -34458,6 +36201,7 @@ "type": "string" }, "last_ips": { + "description": "Most recent IP addresses observed for this WxLAN tag", "items": { "type": "string" }, @@ -34465,14 +36209,14 @@ "type": "array" }, "mac": { - "description": "If `type`==`client`, Client MAC Address", + "description": "If `type`==`client`, Client MAC address", "type": [ "string", "null" ] }, "match": { - "description": "required if `type`==`match`. enum: `ap_id`, `app`, `asset_mac`, `client_mac`, `hostname`, `ip_range_subnet`, `port`, `psk_name`, `psk_role`, `radius_attr`, `radius_class`, `radius_group`, `radius_username`, `sdkclient_uuid`, `wlan_id`", + "description": "Required if `type`==`match`; attribute compared against `values`", "enum": [ "ap_id", "app", @@ -34493,18 +36237,18 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Time when this WxLAN tag was last modified, in epoch seconds", "format": "double", "readOnly": true, "type": "number" }, "name": { - "description": "The name", + "description": "Display name of the WxLAN tag", "type": "string" }, "op": { "default": "in", - "description": "required if `type`==`match`, type of tag (inclusive/exclusive). enum: `in`, `not_in`", + "description": "Required if `type`==`match`; whether `values` are inclusive or exclusive matches", "enum": [ "in", "not_in" @@ -34512,6 +36256,7 @@ "type": "string" }, "org_id": { + "description": "Owning organization associated with this WxLAN tag", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -34520,12 +36265,14 @@ "type": "string" }, "resource_mac": { + "description": "MAC address of the discovered resource associated with this tag, when applicable", "type": [ "string", "null" ] }, "services": { + "description": "Names of services associated with this WxLAN tag", "items": { "type": "string" }, @@ -34533,6 +36280,7 @@ "uniqueItems": true }, "site_id": { + "description": "Mist site associated with this WxLAN tag, when site-scoped", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -34541,9 +36289,10 @@ "type": "string" }, "specs": { - "description": "If `type`==`spec`", + "description": "Traffic match specifications used when `type`==`spec`", "items": { "additionalProperties": false, + "description": "Traffic match specification used by a WxLAN tag", "properties": { "port_range": { "default": "0", @@ -34557,7 +36306,7 @@ }, "subnets": { "default": [], - "description": "Matched destination subnets and/or IP Addresses", + "description": "Destination subnets or IP addresses matched by this WxLAN tag spec", "examples": [ [ "0.0.0.0/0" @@ -34574,10 +36323,11 @@ "type": "array" }, "subnet": { + "description": "CIDR subnet associated with this WxLAN tag when `type`==`subnet`", "type": "string" }, "type": { - "description": "enum: `client`, `match`, `resource`, `spec`, `subnet`, `vlan`", + "description": "Kind of WxLAN tag and how it is populated", "enum": [ "client", "match", @@ -34589,14 +36339,14 @@ "type": "string" }, "values": { - "description": "Required if `type`==`match` and\\n * `match`==`ap_id`: list of AP IDs\\n * `match`==`app`: list of Application Names\\n * `match`==`asset_mac`: list of Asset MAC Addresses\\n * `match`==`client_mac`: list of Client MAC Addresses\\n * `match`==`hostname`: list of Resources Hostnames\\n * `match`==`ip_range_subnet`: list of IP Addresses and/or CIDRs\\n * `match`==`psk_name`: list of PSK Names\\n * `match`==`psk_role`: list of PSK Roles\\n * `match`==`port`: list of Ports or Port Ranges\\n * `match`==`radius_attr`: list of RADIUS Attributes. The values are [ \\"6=1\\", \\"26=10.2.3.4\\" ], this support other RADIUS attributes where we know the type\\n * `match`==`radius_class`: list of RADIUS Classes. This matches the ATTR-Class(25)\\n * `match`==`radius_group`: list of RADIUS Groups. This is a smart tag that matches RADIUS-Filter-ID, Airespace-ACL-Name (VendorID=14179, VendorType=6) / Aruba-User-Role (VendorID=14823, VendorType=1)\\n * `match`==`radius_username`: list of RADIUS Usernames. This matches the ATTR-User-Name(1)\\n * `match`==`sdkclient_uuid`: list of SDK UUIDs\\n * `match`==`wlan_id`: list of WLAN IDs\\n\\n**Notes**:\\nVariables are not allowed", + "description": "Comparison values for the selected `match` attribute when `type`==`match`", "items": { "type": "string" }, "type": "array" }, "vlan_id": { - "description": "If `type`==`vlan_id`, VLAN ID or variable", + "description": "Identifier of the VLAN associated with this WxLAN tag when `type`==`vlan`", "examples": [ "1055" ], @@ -34622,7 +36372,7 @@ }, "org_setting": { "schema": { - "description": "Org Settings", + "description": "Organization-wide feature, integration, management, and security settings", "properties": { "allow_mist": { "default": false, @@ -34644,6 +36394,7 @@ }, "api_policy": { "additionalProperties": false, + "description": "Policy for hiding API secrets and passwords in responses", "properties": { "no_reveal": { "default": false, @@ -34655,13 +36406,17 @@ }, "auto_device_naming": { "additionalProperties": false, + "description": "Automatic device naming rules for claimed devices", "properties": { "enable": { + "description": "Whether automatic device naming is enabled", "type": "boolean" }, "rules": { + "description": "List of rules used to derive device names automatically", "items": { "additionalProperties": false, + "description": "Automatic device naming rule", "properties": { "expression": { "description": "\\"[0:3]\\" // \\"abcdef\\" -> \\"abc\\" \\n \\"split(.)[1]\\" // \\"a.b.c\\" -> \\"b\\" \\n \\"split(-)[1][0:3]\\" // \\"a1234-b5678-c90\\" -> \\"b56\\"'", @@ -34672,7 +36427,7 @@ }, "match_device": { "default": "ap", - "description": "enum: `ap`, `gateway`, `switch`", + "description": "Device type filter for this naming rule", "enum": [ "ap", "gateway", @@ -34681,11 +36436,11 @@ "type": "string" }, "prefix": { - "description": "Prefix to append to the device name", + "description": "Text prepended to the generated device name", "type": "string" }, "src": { - "description": "enum: `lldp_port_desc`, `mac`", + "description": "Device attribute used to generate the name", "enum": [ "lldp_port_desc", "mac" @@ -34693,7 +36448,7 @@ "type": "string" }, "suffix": { - "description": "Suffix to append to the device name", + "description": "Text appended to the generated device name", "type": "string" } }, @@ -34709,14 +36464,17 @@ }, "auto_deviceprofile_assignment": { "additionalProperties": false, + "description": "Automatic device profile assignment rules for claimed devices", "properties": { "enable": { + "description": "Whether automatic device profile assignment is enabled", "type": "boolean" }, "rules": { + "description": "Assignment rules evaluated for automatic device profile selection", "items": { "additionalProperties": false, - "description": "Auto_rules in org settings", + "description": "Automatic assignment rule used by org settings", "properties": { "create_new_site_if_needed": { "default": false, @@ -34738,12 +36496,12 @@ "type": "string" }, "match_country": { - "description": "If `src`==`geoip`", + "description": "If `src`==`geoip`, country or region value that must match the device location", "type": "string" }, "match_device_type": { "default": "ap", - "description": "enum: `ap`, `gateway`, `switch`", + "description": "Device type filter that limits which claimed devices this rule applies to", "enum": [ "ap", "gateway", @@ -34752,15 +36510,15 @@ "type": "string" }, "match_model": { - "description": "Optional/additional filter", + "description": "Optional additional device model filter for this assignment rule", "type": "string" }, "model": { - "description": "If `src`==`model`", + "description": "If `src`==`model`, device model value to match", "type": "string" }, "prefix": { - "description": "If `src`==`name`", + "description": "If `src`==`name`, prefix that must be present in the device name", "examples": [ "XX-" ], @@ -34770,7 +36528,7 @@ ] }, "src": { - "description": "enum: `ext_ip`, `dns_suffix`, `geoip`, `lldp_port_desc`, `lldp_system_name`, `model`, `name`, `subnet`", + "description": "Source attribute used to evaluate the automatic assignment rule", "enum": [ "ext_ip", "dns_suffix", @@ -34788,7 +36546,7 @@ "type": "string" }, "suffix": { - "description": "If `src`==`name`", + "description": "If `src`==`name`, suffix that must be present in the device name", "examples": [ "-YY" ], @@ -34817,14 +36575,17 @@ }, "auto_site_assignment": { "additionalProperties": false, + "description": "Automatic site assignment rules for claimed devices", "properties": { "enable": { + "description": "Whether automatic site assignment is enabled", "type": "boolean" }, "rules": { + "description": "Assignment rules evaluated for automatic site selection", "items": { "additionalProperties": false, - "description": "Auto_rules in org settings", + "description": "Automatic assignment rule used by org settings", "properties": { "create_new_site_if_needed": { "default": false, @@ -34846,12 +36607,12 @@ "type": "string" }, "match_country": { - "description": "If `src`==`geoip`", + "description": "If `src`==`geoip`, country or region value that must match the device location", "type": "string" }, "match_device_type": { "default": "ap", - "description": "enum: `ap`, `gateway`, `switch`", + "description": "Device type filter that limits which claimed devices this rule applies to", "enum": [ "ap", "gateway", @@ -34860,15 +36621,15 @@ "type": "string" }, "match_model": { - "description": "Optional/additional filter", + "description": "Optional additional device model filter for this assignment rule", "type": "string" }, "model": { - "description": "If `src`==`model`", + "description": "If `src`==`model`, device model value to match", "type": "string" }, "prefix": { - "description": "If `src`==`name`", + "description": "If `src`==`name`, prefix that must be present in the device name", "examples": [ "XX-" ], @@ -34878,7 +36639,7 @@ ] }, "src": { - "description": "enum: `ext_ip`, `dns_suffix`, `geoip`, `lldp_port_desc`, `lldp_system_name`, `model`, `name`, `subnet`", + "description": "Source attribute used to evaluate the automatic assignment rule", "enum": [ "ext_ip", "dns_suffix", @@ -34896,7 +36657,7 @@ "type": "string" }, "suffix": { - "description": "If `src`==`name`", + "description": "If `src`==`name`, suffix that must be present in the device name", "examples": [ "-YY" ], @@ -34924,6 +36685,7 @@ "type": "object" }, "blacklist_url": { + "description": "Read-only URL for the organization blacklist file", "examples": [ "https://papi.s3.amazonaws.com/blacklist/xxx..." ], @@ -34931,7 +36693,7 @@ "type": "string" }, "cacerts": { - "description": "RADSec certificates for AP", + "description": "CA certificates used by organization-level RADIUS and RADSec settings", "items": { "examples": [ "-----BEGIN CERTIFICATE-----\\\\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\\\\n-----END CERTIFICATE-----" @@ -34942,14 +36704,17 @@ }, "celona": { "additionalProperties": false, + "description": "Integration settings for Celona", "properties": { "api_key": { + "description": "Credential used by Mist for the Celona integration", "examples": [ "$2a$04$OkaLCoJn6rDjR8ha.oduQVDST3.kJNIrte" ], "type": "string" }, "api_prefix": { + "description": "Celona API prefix configured for the integration", "examples": [ "cc3273fcb016470e" ], @@ -34960,15 +36725,17 @@ }, "cloudshark": { "additionalProperties": false, + "description": "Packet capture integration settings for CloudShark", "properties": { "apitoken": { + "description": "Token used by Mist to access the CloudShark integration", "examples": [ "accbd6f10c6d05c3" ], "type": "string" }, "url": { - "description": "If using CS Enterprise", + "description": "CloudShark Enterprise URL, if using a self-hosted CS Enterprise instance", "examples": [ "https://cloudshark.hosted.domain" ], @@ -34979,8 +36746,10 @@ }, "cradlepoint": { "additionalProperties": false, + "description": "Integration settings for Cradlepoint devices", "properties": { "cp_api_id": { + "description": "Cradlepoint API ID used by Mist for the integration", "examples": [ "84446d61-2206-4ea5-855a-0043f980be54" ], @@ -34988,13 +36757,16 @@ "type": "string" }, "cp_api_key": { + "description": "Cradlepoint API key paired with the Cradlepoint API ID", "examples": [ "79c329da9893e34099c7d8ad5cb9c941" ], + "format": "password", "readOnly": true, "type": "string" }, "ecm_api_id": { + "description": "Cradlepoint ECM API ID used by Mist for the integration", "examples": [ "73446d61-2206-4ea5-855a-0043f980be62" ], @@ -35002,13 +36774,16 @@ "type": "string" }, "ecm_api_key": { + "description": "Cradlepoint ECM API key paired with the ECM API ID", "examples": [ "68b329da9893e34099c7d8ad5cb9c940" ], + "format": "password", "readOnly": true, "type": "string" }, "enable_lldp": { + "description": "Whether Mist uses Cradlepoint LLDP data to link routers to Mist sites and devices", "readOnly": true, "type": "boolean" } @@ -35017,22 +36792,24 @@ "type": "object" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Epoch timestamp when the organization settings were created", "format": "double", "readOnly": true, "type": "number" }, "device_cert": { "additionalProperties": false, - "description": "common device cert, optional", + "description": "Common device certificate used by organization settings", "properties": { "cert": { + "description": "PEM-encoded common device certificate used by organization settings", "examples": [ "-----BEGIN CERTIFICATE-----\\\\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\\\\n-----END CERTIFICATE-----" ], "type": "string" }, "key": { + "description": "Private key paired with the common device certificate", "examples": [ "-----BEGIN PRI..." ], @@ -35062,17 +36839,20 @@ "type": "boolean" }, "for_site": { + "description": "Read-only indicator that the settings object is scoped to a site", "readOnly": true, "type": "boolean" }, "gateway_mgmt": { "additionalProperties": false, + "description": "Gateway management defaults for the organization", "properties": { "app_probing": { "additionalProperties": false, + "description": "Application probing configuration applied to managed gateways", "properties": { "apps": { - "description": "APp-keys from [List Applications](/#operations/listApplications)", + "description": "Predefined application keys to probe from managed gateways", "examples": [ [ "facebook" @@ -35087,20 +36867,24 @@ "type": "object" }, "app_usage": { - "description": "consumes uplink bandwidth, requires WA license", + "description": "For SRX only, whether gateway application usage collection is enabled; requires App Track license", "type": "boolean" }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled for managed gateways", "type": "boolean" }, "host_in_policies": { "additionalProperties": false, + "description": "Host-in access policies for gateway management services such as ICMP and SNMP", "properties": { "icmp": { "additionalProperties": false, + "description": "Host-in access policy for ICMP traffic to managed gateways", "properties": { "tenants": { + "description": "Tenant names this host-in policy applies to", "items": { "type": "string" }, @@ -35112,8 +36896,10 @@ }, "snmp": { "additionalProperties": false, + "description": "Host-in access policy for SNMP traffic to managed gateways", "properties": { "tenants": { + "description": "Tenant names this host-in policy applies to", "items": { "type": "string" }, @@ -35128,12 +36914,14 @@ }, "host_out_policies": { "additionalProperties": false, - "description": "optional, for some of the host-out traffic, the path preference can be specified by default, ECMP will be used from all available route/path available services: dns/mist/ntp/pim", + "description": "Path preference policies for gateway-originated management traffic", "properties": { "dns": { "additionalProperties": false, + "description": "Path preference policy for gateway-originated DNS traffic", "properties": { "path_preference": { + "description": "Preferred path name for this gateway-originated service traffic", "type": "string" } }, @@ -35141,8 +36929,10 @@ }, "ntp": { "additionalProperties": false, + "description": "Path preference policy for gateway-originated NTP traffic", "properties": { "path_preference": { + "description": "Preferred path name for this gateway-originated service traffic", "type": "string" } }, @@ -35150,14 +36940,17 @@ }, "syslog": { "additionalProperties": false, + "description": "Path preference policy for gateway-originated syslog traffic", "properties": { "path_preference": { + "description": "Preferred path name used by default for gateway syslog traffic", "examples": [ "broadband_wans" ], "type": "string" }, "servers": { + "description": "Per-server host-out path policies for gateway syslog traffic", "items": { "$comment": "max depth reached" }, @@ -35171,6 +36964,7 @@ }, "overlay_ip": { "additionalProperties": false, + "description": "Overlay IP addresses used when gateway management traffic uses the overlay", "properties": { "ip": { "description": "When it's going overlay, a routable IP to overlay will be required", @@ -35211,7 +37005,7 @@ ] }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the organization settings object", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -35221,14 +37015,18 @@ }, "installer": { "additionalProperties": false, + "description": "Access settings for organization installer workflows", "properties": { "allow_all_devices": { + "description": "Whether installers may work with all eligible devices", "type": "boolean" }, "allow_all_sites": { + "description": "Whether installers may work with all sites", "type": "boolean" }, "extra_site_ids": { + "description": "Additional site IDs that installers may access", "items": { "examples": [ "4ac1dcf4-9d8b-7211-65c4-057819f0862b" @@ -35239,6 +37037,7 @@ "type": "array" }, "grace_period": { + "description": "Grace period, in days, during which installers can modify recent sites or devices", "type": "integer" } }, @@ -35246,17 +37045,18 @@ }, "jcloud": { "additionalProperties": false, + "description": "Integration settings for JCloud", "properties": { "org_apitoken": { - "description": "JCloud Org Token", + "description": "JCloud organization API token used by this Mist organization", "type": "string" }, "org_apitoken_name": { - "description": "JCloud Org Token Name", + "description": "Display name for the JCloud organization API token", "type": "string" }, "org_id": { - "description": "JCloud Org ID", + "description": "JCloud organization identifier linked to this Mist organization", "type": "string" } }, @@ -35264,7 +37064,7 @@ }, "jcloud_ra": { "additionalProperties": false, - "description": "JCloud Routing Assurance connexion", + "description": "Routing Assurance integration settings for JCloud", "properties": { "org_apitoken": { "description": "JCloud Routing Assurance Org Token", @@ -35282,12 +37082,16 @@ "type": "object" }, "juniper": { + "description": "Linked Juniper account information for this organization", "properties": { "accounts": { + "description": "List of linked Juniper account records", "items": { "additionalProperties": false, + "description": "Linked Juniper account available to the organization", "properties": { "linked_by": { + "description": "User who linked this Juniper account", "examples": [ "John Smith (john@abccorp.com)" ], @@ -35295,6 +37099,7 @@ "type": "string" }, "name": { + "description": "Display name of the linked Juniper account", "examples": [ "ABC Corp" ], @@ -35311,10 +37116,11 @@ }, "juniper_srx": { "additionalProperties": false, + "description": "SRX integration settings for Juniper devices", "properties": { "auto_upgrade": { "additionalProperties": false, - "description": "auto_upgrade device first time it is onboarded", + "description": "SRX auto-upgrade settings applied when Juniper SRX devices are first onboarded", "properties": { "custom_versions": { "additionalProperties": { @@ -35324,15 +37130,17 @@ ], "type": "string" }, - "description": "Property key is the SRX Hardware model (e.g. \\"SRX4600\\")", + "description": "Per-SRX-model firmware versions to deploy instead of the default version", "type": "object" }, "enabled": { "default": false, + "description": "Whether SRX auto-upgrade is enabled for newly onboarded devices", "type": "boolean" }, "snapshot": { "default": false, + "description": "Whether to take a snapshot during the SRX upgrade process", "type": "boolean" }, "version": { @@ -35350,11 +37158,11 @@ }, "junos_shell_access": { "additionalProperties": false, - "description": "junos_shell_access: Manages role-based web-shell access. \\nWhen junos_shell access is not defined (Default) - No additional users are configured and web-shell uses default `mist` user to login. \\nWhen junos_shell_access is defined - Additional users mist-web-admin (admin permission), mist-web-viewer(viewer permission) are configured on the device and web-shell logs in with the mist-web-admin/mist-web-viewer user depending upon the shell access level. Setting the shell access level to \\"none\\", disables web-shell access for that specific role.\\n", + "description": "Role-based Junos web-shell access settings", "properties": { "admin": { "default": "admin", - "description": "enum: `admin`, `viewer`, `none`", + "description": "Shell access level used for administrator web-shell sessions", "enum": [ "admin", "none", @@ -35364,7 +37172,7 @@ }, "helpdesk": { "default": "none", - "description": "enum: `admin`, `viewer`, `none`", + "description": "Shell access level used for helpdesk web-shell sessions", "enum": [ "admin", "none", @@ -35374,7 +37182,7 @@ }, "read": { "default": "none", - "description": "enum: `admin`, `viewer`, `none`", + "description": "Shell access level used for read-only web-shell sessions", "enum": [ "admin", "none", @@ -35384,7 +37192,7 @@ }, "write": { "default": "admin", - "description": "enum: `admin`, `viewer`, `none`", + "description": "Shell access level used for write-role web-shell sessions", "enum": [ "admin", "none", @@ -35397,16 +37205,19 @@ }, "marvis": { "additionalProperties": false, + "description": "AI assistant and self-driving feature settings for Marvis", "properties": { "self_driving": { "additionalProperties": false, - "description": "Self-driving network automation settings per domain", + "description": "Self-driving network automation settings by domain", "properties": { "wan": { "additionalProperties": false, + "description": "Self-driving automation settings for the WAN domain", "properties": { "enabled": { "default": false, + "description": "Whether self-driving automation is enabled for this domain", "type": "boolean" } }, @@ -35414,9 +37225,11 @@ }, "wired": { "additionalProperties": false, + "description": "Self-driving automation settings for the wired domain", "properties": { "enabled": { "default": false, + "description": "Whether self-driving automation is enabled for this domain", "type": "boolean" } }, @@ -35424,9 +37237,11 @@ }, "wireless": { "additionalProperties": false, + "description": "Self-driving automation settings for the wireless domain", "properties": { "enabled": { "default": false, + "description": "Whether self-driving automation is enabled for this domain", "type": "boolean" } }, @@ -35440,10 +37255,10 @@ }, "mgmt": { "additionalProperties": false, - "description": "management-related properties", + "description": "Tunnel settings for organization management connectivity", "properties": { "mxtunnel_ids": { - "description": "List of Mist Tunnels", + "description": "Mist Tunnel IDs selected for management connectivity", "items": { "examples": [ "08cd7499-5841-51c8-e663-fb16b6f3b45e" @@ -35468,6 +37283,7 @@ }, "mist_nac": { "additionalProperties": false, + "description": "NAC settings for Mist Access Assurance", "properties": { "allow_teap_machine_auth_only": { "default": false, @@ -35475,7 +37291,7 @@ "type": "boolean" }, "cacerts": { - "description": "List of PEM-encoded ca certs", + "description": "CA certificates trusted by Mist NAC for certificate-based authentication", "items": { "examples": [ "-----BEGIN CERTIFICATE-----\\\\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\\\\n-----END CERTIFICATE-----" @@ -35502,12 +37318,12 @@ }, "eu_only": { "default": false, - "description": "By default, NAC POD failover considers all NAC pods available around the globe, i.e. EU, US, or APAC based, failover happens based on geo IP of the originating site. For strict GDPR compliance NAC POD failover would only happen between the PODs located within the EU environment, and no authentication would take place outside of EU. This is an org setting that is applicable to WLANs, switch templates, mxedge clusters that have mist_nac enabled", + "description": "By default, NAC POD failover considers all NAC pods available around the globe, i.e. EU, US, or APAC based, failover happens based on geo IP of the originating site. For strict GDPR compliance NAC POD failover would only happen between the PODs located within the EU environment, and no authentication would take place outside of EU. This is an org setting that is applicable to WLANs, switch templates, Mist Edge clusters that have mist_nac enabled", "type": "boolean" }, "fingerprinting": { "additionalProperties": false, - "description": "Allows customer to enable client fingerprinting for policy enforcement", + "description": "Client fingerprinting settings used by Mist NAC", "properties": { "enabled": { "default": false, @@ -35525,7 +37341,7 @@ "type": "boolean" }, "wireless_coa_type": { - "description": "enum: `reauth`, `disconnect`", + "description": "Change of Authorization action sent to wireless clients when fingerprints change", "enum": [ "reauth", "disconnect" @@ -35537,7 +37353,7 @@ }, "idp_machine_cert_lookup_field": { "default": "automatic", - "description": "allow customer to choose the EAP-TLS client certificate's field to use for IDP Machine Groups lookup. enum: `automatic`, `cn`, `dns`", + "description": "Client certificate field used to look up machine groups in identity providers", "enum": [ "automatic", "cn", @@ -35547,7 +37363,7 @@ }, "idp_user_cert_lookup_field": { "default": "automatic", - "description": "allow customer to choose the EAP-TLS client certificate's field. To use for IDP User Groups lookup. enum: `automatic`, `cn`, `email`, `upn`", + "description": "Client certificate field used to look up user groups in identity providers", "enum": [ "automatic", "cn", @@ -35557,18 +37373,20 @@ "type": "string" }, "idps": { + "description": "Identity provider mappings used by Mist NAC realm matching", "items": { "additionalProperties": false, + "description": "Mist NAC identity provider realm mapping", "properties": { "exclude_realms": { - "description": "When the IDP of mxedge_proxy type, exclude the following realms from proxying in addition to other valid home realms in this org", + "description": "When the IDP is `mxedge_proxy` type, realms excluded from proxying in addition to other valid home realms in this org", "items": { "type": "string" }, "type": "array" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the identity provider referenced by this Mist NAC mapping", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -35577,7 +37395,7 @@ "type": "string" }, "user_realms": { - "description": "Which realm should trigger this IDP. User Realm is extracted from:\\n * Username-AVP (`mist.com` from john@mist.com)\\n * Cert CN", + "description": "User realms that select this identity provider", "items": { "examples": [ "abc" @@ -35593,11 +37411,11 @@ }, "mdm": { "additionalProperties": false, - "description": "MDM (Mobile Device Management) CoA configuration", + "description": "Mobile Device Management CoA settings for Mist NAC", "properties": { "coa_type": { "default": "reauth", - "description": "CoA type to send. enum: `reauth`, `disconnect`", + "description": "Change of Authorization action sent for MDM posture changes", "enum": [ "reauth", "disconnect" @@ -35609,22 +37427,26 @@ }, "server_cert": { "additionalProperties": false, - "description": "radius server cert to be presented in EAP TLS", + "description": "RADIUS server certificate presented by Mist NAC during EAP-TLS", "properties": { "cert": { + "description": "PEM-encoded RADIUS server certificate presented during EAP-TLS", "examples": [ "-----BEGIN CERTIFICATE-----\\\\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\\\\n-----END CERTIFICATE-----" ], "type": "string" }, "key": { + "description": "Private key paired with the Mist NAC RADIUS server certificate", "examples": [ "-----BEGIN PRI..." ], + "format": "password", "type": "string" }, "password": { - "description": "private key password (optional)", + "description": "Optional password for the private key", + "format": "password", "type": "string" } }, @@ -35632,7 +37454,7 @@ }, "use_ip_version": { "default": "v4", - "description": "by default, NAS devices(switches/aps) and proxies(mxedge) are configured to reach mist-nac via IPv4. enum: `v4`, `v6`", + "description": "IP version used by NAS devices and Mist Edge proxies to reach Mist NAC", "enum": [ "v4", "v6" @@ -35658,12 +37480,13 @@ "type": "object" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Epoch timestamp when the organization settings were last modified", "format": "double", "readOnly": true, "type": "number" }, "msp_id": { + "description": "Managed service provider account associated with these settings", "examples": [ "b9d42c2e-88ee-41f8-b798-f009ce7fe909" ], @@ -35673,16 +37496,20 @@ }, "mxedge_mgmt": { "additionalProperties": false, + "description": "Management settings for Mist Edge devices", "properties": { "config_auto_revert": { "default": false, + "description": "Whether the Mist Edge automatically reverts configuration changes if connectivity is lost", "type": "boolean" }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the Mist Edge", "type": "boolean" }, "mist_password": { + "description": "Password for the Mist service account on the Mist Edge", "examples": [ "MIST_PASSWORD" ], @@ -35690,7 +37517,7 @@ }, "oob_ip_type": { "default": "dhcp", - "description": "enum: `dhcp`, `disabled`, `static`", + "description": "IPv4 address assignment mode for out-of-band management", "enum": [ "dhcp", "disabled", @@ -35700,7 +37527,7 @@ }, "oob_ip_type6": { "default": "autoconf", - "description": "enum: `autoconf`, `dhcp`, `disabled`, `static`", + "description": "IPv6 address assignment mode for out-of-band management", "enum": [ "autoconf", "dhcp", @@ -35710,6 +37537,7 @@ "type": "string" }, "root_password": { + "description": "Root account password for the Mist Edge", "examples": [ "ROOT_PASSWORD" ], @@ -35722,10 +37550,11 @@ "optic_port_config": { "additionalProperties": { "additionalProperties": false, + "description": "Per-interface optic port override settings", "properties": { "channelized": { "default": false, - "description": "Enable channelization", + "description": "Whether channelization is enabled on this optic port", "type": "boolean" }, "speed": { @@ -35738,10 +37567,11 @@ }, "type": "object" }, - "description": "Property key is the interface name or range (e.g. `et-0/0/47`, `et-0/0/48-49`)", + "description": "Configuration defaults for optic ports", "type": "object" }, "org_id": { + "description": "Organization that owns these settings", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -35751,7 +37581,7 @@ }, "password_policy": { "additionalProperties": false, - "description": "password policy", + "description": "Admin credential policy settings for the organization", "properties": { "enabled": { "default": false, @@ -35769,7 +37599,7 @@ }, "min_length": { "default": 8, - "description": "Required password length", + "description": "Minimum number of characters required for passwords", "type": "integer" }, "requires_special_char": { @@ -35787,8 +37617,10 @@ }, "pcap": { "additionalProperties": false, + "description": "Packet capture settings for the organization", "properties": { "bucket": { + "description": "Storage bucket name used for organization packet capture files", "examples": [ "myorg_pcap" ], @@ -35796,7 +37628,7 @@ }, "max_pkt_len": { "default": 128, - "description": "Max_len of non-management packets to capture", + "description": "Maximum length of non-management packets to capture, in bytes", "examples": [ 128 ], @@ -35807,11 +37639,13 @@ "type": "object" }, "pcap_bucket_verified": { + "description": "Whether the configured packet capture bucket has been verified", "readOnly": true, "type": "boolean" }, "security": { "additionalProperties": false, + "description": "Organization security controls such as local SSH restrictions", "properties": { "disable_local_ssh": { "description": "Whether to disable local SSH (by default, local SSH is enabled with allow_mist in Org is enabled", @@ -35834,24 +37668,27 @@ }, "simple_alert": { "additionalProperties": false, - "description": "Set of heuristic rules will be enabled when marvis subscription is not available. It triggers when, in a Z minute window, there are more than Y distinct client encountering over X failures", + "description": "Basic alert delivery settings for the organization", "properties": { "arp_failure": { "additionalProperties": false, + "description": "Thresholds for ARP failure heuristic alerts", "properties": { "client_count": { "default": 10, + "description": "Number of distinct clients that must encounter ARP failures before alerting", "type": "integer" }, "duration": { "default": 20, - "description": "failing within minutes", + "description": "Time window in minutes for evaluating ARP failures", "maximum": 60, "minimum": 5, "type": "integer" }, "incident_count": { "default": 10, + "description": "Number of ARP failure incidents required within the duration window", "type": "integer" } }, @@ -35859,20 +37696,23 @@ }, "dhcp_failure": { "additionalProperties": false, + "description": "Thresholds for DHCP failure heuristic alerts", "properties": { "client_count": { "default": 10, + "description": "Number of distinct clients that must encounter DHCP failures before alerting", "type": "integer" }, "duration": { "default": 10, - "description": "failing within minutes", + "description": "Time window in minutes for evaluating DHCP failures", "maximum": 60, "minimum": 5, "type": "integer" }, "incident_count": { "default": 20, + "description": "Number of DHCP failure incidents required within the duration window", "type": "integer" } }, @@ -35880,20 +37720,23 @@ }, "dns_failure": { "additionalProperties": false, + "description": "Thresholds for DNS failure heuristic alerts", "properties": { "client_count": { "default": 20, + "description": "Number of distinct clients that must encounter DNS failures before alerting", "type": "integer" }, "duration": { "default": 10, - "description": "failing within minutes", + "description": "Time window in minutes for evaluating DNS failures", "maximum": 60, "minimum": 5, "type": "integer" }, "incident_count": { "default": 30, + "description": "Number of DNS failure incidents required within the duration window", "type": "integer" } }, @@ -35904,14 +37747,15 @@ }, "ssr": { "additionalProperties": false, + "description": "Session Smart Router settings for the organization", "properties": { "auto_upgrade": { "additionalProperties": false, - "description": "auto_upgrade device first time it is onboarded", + "description": "Automatic SSR firmware upgrade settings for newly onboarded devices", "properties": { "channel": { "default": "stable", - "description": "upgrade channel to follow. enum: `alpha`, `beta`, `stable`", + "description": "Firmware release channel used for SSR auto-upgrade", "enum": [ "alpha", "beta", @@ -35927,11 +37771,12 @@ ], "type": "string" }, - "description": "Property key is the SSR model (e.g. \\"SSR130\\").", + "description": "Per-model SSR firmware versions used for auto-upgrade", "type": "object" }, "enabled": { "default": false, + "description": "Whether SSR auto-upgrade is enabled for newly onboarded devices", "type": "boolean" }, "version": { @@ -35945,32 +37790,34 @@ "type": "object" }, "conductor_hosts": { - "description": "List of Conductor IP Addresses or Hosts to be used by the SSR Devices", + "description": "IP addresses or hostnames of conductors used by SSR devices", "items": { "type": "string" }, "type": "array" }, "conductor_token": { - "description": "Token to be used by the SSR Devices to connect to the Conductor", + "description": "Registration token used by SSR devices to connect to the conductor", "type": "string" }, "disable_stats": { - "description": "Disable stats collection on SSR devices", + "description": "Whether stats collection is disabled on SSR devices", "type": "boolean" }, "proxy": { "additionalProperties": false, - "description": "SSR proxy configuration to talk to Mist", + "description": "Network proxy settings used by SSR devices to reach Mist", "properties": { "disabled": { "default": false, + "description": "Whether the SSR proxy configuration is disabled", "examples": [ true ], "type": "boolean" }, "url": { + "description": "Proxy URL that SSR devices use to reach Mist", "examples": [ "https://proxy.corp.com:8080/" ], @@ -35984,15 +37831,17 @@ }, "switch": { "additionalProperties": false, + "description": "Configuration defaults for switches in this organization", "properties": { "auto_upgrade": { "additionalProperties": false, + "description": "Auto-upgrade defaults for switches in this organization", "properties": { "custom_versions": { "additionalProperties": { "type": "string" }, - "description": "Custom version to be used. The Property Key is the switch hardware and the property value is the firmware version", + "description": "Per-model switch firmware versions to use for auto-upgrade", "examples": [ { "QFX5120-32C": "23.4R2-S2.1", @@ -36002,12 +37851,12 @@ "type": "object" }, "enabled": { - "description": "Enable auto upgrade for the switch", + "description": "Whether switch auto-upgrade is enabled", "type": "boolean" }, "snapshot": { "default": false, - "description": "Enable snapshot during the upgrade process", + "description": "Whether to create a recovery snapshot during the upgrade process", "type": "boolean" } }, @@ -36018,6 +37867,7 @@ }, "switch_mgmt": { "additionalProperties": false, + "description": "Management settings for switches in this organization", "properties": { "ap_affinity_threshold": { "default": 12, @@ -36043,10 +37893,11 @@ }, "synthetic_test": { "additionalProperties": false, + "description": "Configuration for organization synthetic tests", "properties": { "aggressiveness": { "default": "auto", - "description": "enum: `auto`, `high`, `low`", + "description": "Overall aggressiveness level for synthetic test probes", "enum": [ "auto", "high", @@ -36058,10 +37909,11 @@ "custom_probes": { "additionalProperties": { "additionalProperties": false, + "description": "Custom probe definition for synthetic tests", "properties": { "aggressiveness": { "default": "auto", - "description": "enum: `auto`, `high`, `low`", + "description": "Probe aggressiveness level for this custom synthetic probe", "enum": [ "auto", "high", @@ -36078,7 +37930,7 @@ "type": "string" }, "threshold": { - "description": "In milliseconds", + "description": "Response-time threshold for this custom probe, in milliseconds", "examples": [ 100 ], @@ -36086,7 +37938,7 @@ }, "type": { "default": "icmp", - "description": "enum: `application`, `curl`, `icmp`, `reachability`, `tcp`", + "description": "Probe type used by this custom synthetic probe", "enum": [ "application", "curl", @@ -36099,21 +37951,22 @@ }, "type": "object" }, - "description": "Custom probes to be used for synthetic tests", + "description": "Custom synthetic probe definitions keyed by probe name", "type": "object" }, "disabled": { "default": false, + "description": "Whether synthetic tests are disabled", "type": "boolean" }, "lan_networks": { - "description": "List of networks to be used for synthetic tests", + "description": "LAN network probe groups used by synthetic tests", "items": { "additionalProperties": false, "description": "configure minis probes to be tested on lan networks of gateways", "properties": { "networks": { - "description": "List of networks to be used for synthetic tests", + "description": "LAN network names where synthetic probes are run", "examples": [ [ "pos-stations", @@ -36126,7 +37979,7 @@ "type": "array" }, "probes": { - "description": "app name comes from `custom_probes` above or /const/synthetic_test_probes", + "description": "Synthetic probe names to run on the listed LAN networks", "items": { "type": "string" }, @@ -36139,11 +37992,14 @@ }, "vlans": { "deprecated": true, + "description": "Deprecated VLAN-based synthetic test settings", "items": { "additionalProperties": false, + "description": "Deprecated VLAN-based synthetic test settings", "properties": { "custom_test_urls": { "deprecated": true, + "description": "Deprecated custom URLs tested by VLAN-based synthetic probes", "examples": [ [ "https://www.abc.com/", @@ -36161,13 +38017,14 @@ "type": "boolean" }, "probes": { - "description": "app name comes from `custom_probes` above or /const/synthetic_test_probes", + "description": "Synthetic probe names to run for the listed VLANs", "items": { "type": "string" }, "type": "array" }, "vlan_ids": { + "description": "VLAN identifiers where synthetic probes are run", "examples": [ [ 10, @@ -36187,13 +38044,15 @@ }, "wan_speedtest": { "additionalProperties": false, + "description": "WAN speedtest settings for synthetic tests", "properties": { "enabled": { + "description": "Whether scheduled WAN speedtests are enabled", "type": "boolean" }, "time_of_day": { "default": "any", - "description": "`any` / HH:MM (24-hour format)", + "description": "Scheduled time of day for WAN speedtests", "examples": [ "12:00" ], @@ -36206,7 +38065,7 @@ "type": "object" }, "tags": { - "description": "List of tags", + "description": "Labels associated with these organization settings", "items": { "type": "string" }, @@ -36224,18 +38083,22 @@ }, "ui_no_tracking": { "default": false, + "description": "Whether UI usage tracking is disabled for the organization", "type": "boolean" }, "vpn_options": { "additionalProperties": false, + "description": "Options for organization VPN behavior", "properties": { "as_base": { + "description": "Base BGP autonomous system number used for generated VPN configurations", "maximum": 2147483647, "minimum": 1, "type": "integer" }, "enable_ipv6": { "default": false, + "description": "Whether IPv6 is enabled for organization VPN configuration", "type": "boolean" }, "st_subnet": { @@ -36248,9 +38111,11 @@ }, "wan_pma": { "additionalProperties": false, + "description": "PMA feature settings for WAN Assurance", "properties": { "enabled": { "default": false, + "description": "Whether PMA is enabled for WAN Assurance", "type": "boolean" } }, @@ -36258,9 +38123,11 @@ }, "wired_pma": { "additionalProperties": false, + "description": "PMA feature settings for Wired Assurance", "properties": { "enabled": { "default": false, + "description": "Whether PMA is enabled for Wired Assurance", "type": "boolean" } }, @@ -36268,9 +38135,11 @@ }, "wireless_pma": { "additionalProperties": false, + "description": "PMA feature settings for Wireless Assurance", "properties": { "enabled": { "default": true, + "description": "Whether PMA is enabled for Wireless Assurance", "type": "boolean" } }, @@ -36283,22 +38152,26 @@ }, "site_setting": { "schema": { - "description": "Site Settings", + "description": "Configuration settings applied at the site level", "properties": { "acl_policies": { + "description": "Access control policies configured for the site", "items": { "additionalProperties": false, "description": "ACL Policy:\\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to", "properties": { "actions": { - "description": "ACL Policy Actions:\\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to", + "description": "Destination tag actions evaluated for sources matching this ACL policy", "items": { "additionalProperties": false, + "description": "Action applied to traffic that matches a destination ACL tag", "properties": { "action": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Allow or deny decision applied to traffic matching the destination tag" }, "dst_tag": { + "description": "Destination ACL tag matched by this policy action", "examples": [ "corp" ], @@ -36313,13 +38186,14 @@ "type": "array" }, "name": { + "description": "Display name of the ACL policy", "examples": [ "guest access" ], "type": "string" }, "src_tags": { - "description": "ACL Policy Source Tags:\\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to", + "description": "Source ACL tags that select traffic for this ACL policy", "items": { "examples": [ "macs" @@ -36342,7 +38216,7 @@ "default": [ "any" ], - "description": "ARP / IPv6. Default is `any`", + "description": "Layer 2 EtherTypes matched by this ACL tag; defaults to `any`", "items": { "type": "string" }, @@ -36353,7 +38227,7 @@ "type": "integer" }, "macs": { - "description": "Required if \\n- `type`==`mac`\\n- `type`==`static_gbp` if from matching mac", + "description": "Client or resource MAC addresses matched by this ACL tag", "items": { "type": "string" }, @@ -36364,7 +38238,7 @@ "type": "string" }, "port_usage": { - "description": "Required if `type`==`port_usage`", + "description": "Required if `type`==`port_usage`. Switch port usage name matched by this ACL tag", "type": "string" }, "radius_group": { @@ -36372,9 +38246,10 @@ "type": "string" }, "specs": { - "description": "If `type`==`resource`, `type`==`radius_group`, `type`==`port_usage` or `type`==`gbp_resource`. Empty means unrestricted, i.e. any", + "description": "Layer 4 protocol and destination-port constraints for this ACL tag", "items": { "additionalProperties": false, + "description": "Layer 4 protocol and destination-port match constraint for an ACL tag", "properties": { "port_range": { "default": "0", @@ -36392,14 +38267,14 @@ "type": "array" }, "subnets": { - "description": "If \\n- `type`==`subnet` \\n- `type`==`resource` (optional. default is `any`)\\n- `type`==`static_gbp` if from matching subnet", + "description": "IP subnets matched by this ACL tag", "items": { "type": "string" }, "type": "array" }, "type": { - "description": "enum: \\n * `any`: matching anything not identified\\n * `dynamic_gbp`: from the gbp_tag received from RADIUS\\n * `gbp_resource`: can only be used in `dst_tags`\\n * `mac`\\n * `network`\\n * `port_usage`\\n * `radius_group`\\n * `resource`: can only be used in `dst_tags`\\n * `static_gbp`: applying gbp tag against matching conditions\\n * `subnet`'", + "description": "Classifier type that determines which ACL tag fields are evaluated", "enum": [ "any", "dynamic_gbp", @@ -36420,11 +38295,11 @@ ], "type": "object" }, - "description": "ACL Tags to identify traffic source or destination. Key name is the tag name", + "description": "Access control tag definitions available to site policies", "type": "object" }, "additional_config_cmds": { - "description": "additional CLI commands to append to the generated Junos config. **Note**: no check is done", + "description": "Additional CLI configuration commands applied through the site setting", "items": { "description": "JUNOS \\"set\\" command to add to the generated configuration", "examples": [ @@ -36441,6 +38316,7 @@ }, "analytic": { "additionalProperties": false, + "description": "Advanced analytics configuration for the site", "properties": { "enabled": { "default": false, @@ -36452,11 +38328,14 @@ }, "ap_matching": { "additionalProperties": false, + "description": "Rules that apply model-specific AP port configuration", "properties": { "enabled": { + "description": "Whether AP matching rules are enabled", "type": "boolean" }, "rules": { + "description": "Ordered AP matching rules for applying port configuration", "examples": [ [ { @@ -36483,14 +38362,17 @@ ], "items": { "additionalProperties": false, + "description": "AP matching rule for selecting APs and applying port configuration", "properties": { "match_model": { + "description": "AP model matched by this rule", "examples": [ "AP12" ], "type": "string" }, "name": { + "description": "Display name of the AP matching rule", "examples": [ "AP12" ], @@ -36499,6 +38381,7 @@ "port_config": { "additionalProperties": { "additionalProperties": false, + "description": "Ethernet port behavior settings for an access point", "properties": { "disabled": { "$comment": "max depth reached" @@ -36567,21 +38450,25 @@ }, "ap_port_config": { "additionalProperties": false, + "description": "Ethernet port configuration overrides for APs at the site", "properties": { "model_specific": { "additionalProperties": { "additionalProperties": { "additionalProperties": false, + "description": "Ethernet port behavior settings for an access point", "properties": { "disabled": { "default": false, + "description": "Whether this AP Ethernet port is disabled", "type": "boolean" }, "dynamic_vlan": { "additionalProperties": false, - "description": "Optional dynamic vlan", + "description": "RADIUS-assigned VLAN settings for AP port authentication", "properties": { "default_vlan_id": { + "description": "Fallback VLAN ID used when RADIUS does not return a dynamic VLAN match", "examples": [ 999 ], @@ -36590,19 +38477,22 @@ "type": "integer" }, "enabled": { + "description": "Whether dynamic VLAN assignment is enabled for this AP port", "type": "boolean" }, "type": { - "type": "string" + "$comment": "max depth reached", + "description": "Mapping mode for interpreting dynamic VLAN attributes returned by RADIUS" }, "vlans": { "additionalProperties": { "$comment": "max depth reached" }, + "description": "Mapping entries for RADIUS-assigned VLAN values on this AP port. For `type`==`airespace-interface-name`, the property key is the Airespace interface name returned by RADIUS (e.g. \\"guest\\"), and the value is the corresponding VLAN ID (e.g. 100). For `type`==`standard`, the property key is the VLAN ID number returned by RADIUS, and the value is ignored.", "examples": [ { "1-10": null, - "user": null + "user": 10 } ], "type": "object" @@ -36612,11 +38502,12 @@ }, "enable_mac_auth": { "default": false, + "description": "Whether MAC authentication is enabled on this AP port", "type": "boolean" }, "forwarding": { "default": "all", - "description": "enum: \\n * `all`: local breakout, All VLANs\\n * `limited`: local breakout, only the VLANs configured in `port_vlan_id` and `vlan_ids`\\n * `mxtunnel`: central breakout to an Org Mist Edge (requires `mxtunnel_id`)\\n * `site_mxedge`: central breakout to a Site Mist Edge (requires `mxtunnel_name`)\\n * `wxtunnel`': central breakout to an Org WxTunnel (requires `wxtunnel_id`)", + "description": "Traffic forwarding mode for this AP Ethernet port", "enum": [ "all", "limited", @@ -36636,7 +38527,7 @@ }, "mac_auth_protocol": { "default": "pap", - "description": "if `enable_mac_auth`==`true`, allows user to select an authentication protocol. enum: `eap-md5`, `eap-peap`, `pap`", + "description": "Protocol used for MAC authentication when `enable_mac_auth` is `true`", "enum": [ "eap-md5", "eap-peap", @@ -36646,10 +38537,11 @@ }, "mist_nac": { "additionalProperties": false, + "description": "Juniper Mist NAC settings used by AP port authentication", "properties": { "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled.", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled.", "examples": [ 60 ], @@ -36659,7 +38551,7 @@ }, "auth_servers_retries": { "default": 2, - "description": "Radius auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"retries\\" are set to value of `auth_servers_timeout`. \\"max-requests\\" is also set when setting `auth_servers_retries` is set to default value to 3.", + "description": "RADIUS auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"retries\\" are set to value of `auth_servers_timeout`. \\"max-requests\\" is also set when setting `auth_servers_retries` is set to default value to 3.", "examples": [ 3 ], @@ -36669,7 +38561,7 @@ }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"quite-period\\" and \\"transmit-period\\" are set to half the value of `auth_servers_timeout`. \\"supplicant-timeout\\" is also set when setting `auth_servers_timeout` is set to default value of 10.", + "description": "RADIUS auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. \\"quite-period\\" and \\"transmit-period\\" are set to half the value of `auth_servers_timeout`. \\"supplicant-timeout\\" is also set when setting `auth_servers_timeout` is set to default value of 10.", "examples": [ 5 ], @@ -36740,7 +38632,7 @@ }, "port_auth": { "default": "none", - "description": "When doing port auth. enum: `dot1x`, `none`", + "description": "Authentication mode for this AP Ethernet port", "enum": [ "dot1x", "none" @@ -36751,7 +38643,7 @@ "type": "string" }, "port_vlan_id": { - "description": "If `forwarding`==`limited`", + "description": "If `forwarding`==`limited`. VLAN ID allowed on this AP Ethernet port", "examples": [ 1 ], @@ -36761,47 +38653,51 @@ }, "radius_config": { "additionalProperties": false, - "description": "Junos Radius config", + "description": "RADIUS authentication and accounting settings for this AP port", "properties": { "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled", "maximum": 65535, "minimum": 0, "type": "integer" }, "acct_servers": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "RADIUS accounting servers used by this Junos configuration" }, "auth_servers": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "RADIUS authentication servers used by this Junos configuration" }, "auth_servers_retries": { "default": 3, - "description": "radius auth session retries", + "description": "Number of RADIUS authentication request retries before failover", "type": "integer" }, "auth_servers_timeout": { "default": 5, - "description": "radius auth session timeout", + "description": "RADIUS authentication server timeout, in seconds", "type": "integer" }, "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled", "type": "boolean" }, "coa_port": { "default": 3799, + "description": "UDP port used for RADIUS Change of Authorization (CoA)", "maximum": 65535, "minimum": 1, "type": "integer" }, "network": { - "description": "use `network`or `source_ip`, which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip", + "description": "Use `network` or `source_ip`. Network where the RADIUS server resides; if the network has a static IP, Mist uses it as the source IP", "type": "string" }, "source_ip": { - "description": "use `network`or `source_ip`", + "description": "Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic", "type": "string" } }, @@ -36809,48 +38705,54 @@ }, "radsec": { "additionalProperties": false, - "description": "RadSec settings", + "description": "TLS-secured RADIUS settings for this AP port", "properties": { "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled for RadSec traffic", "type": "boolean" }, "enabled": { + "description": "Whether RadSec is enabled", "type": "boolean" }, "idle_timeout": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Idle timeout, in seconds, for RadSec connections" }, "mxcluster_ids": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Mist Edge cluster IDs used as RadSec proxies when the WLAN does not use mxtunnel" }, "proxy_hosts": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "RadSec proxy hostnames advertised to APs" }, "server_name": { - "description": "Name of the server to verify (against the cacerts in Org Setting). Only if not Mist Edge.", + "description": "TLS server name to verify against the CA certificates in Org Setting. Only if not Mist Edge.", "examples": [ "radsec.abc.com" ], "type": "string" }, "servers": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "External RadSec servers. Only if not Mist Edge." }, "use_mxedge": { - "description": "use mxedge(s) as RadSec Proxy", + "description": "Whether to use organization Mist Edge instances as RadSec proxies", "type": "boolean" }, "use_site_mxedge": { "default": false, - "description": "To use Site mxedges when this WLAN does not use mxtunnel", + "description": "Whether to use site Mist Edge instances when this WLAN does not use mxtunnel", "type": "boolean" } }, "type": "object" }, "vlan_id": { - "description": "Optional to specify the vlan id for a tunnel if forwarding is for `wxtunnel`, `mxtunnel` or `site_mxedge`.\\n * if vlan_id is not specified then it will use first one in vlan_ids[] of the mxtunnel.\\n * if forwarding == site_mxedge, vlan_ids comes from site_mxedge (`mxtunnels` under site setting)", + "description": "Optional to specify the VLAN ID for a tunnel if forwarding is for `wxtunnel`, `mxtunnel` or `site_mxedge`.\\n * if vlan_id is not specified then it will use first one in vlan_ids[] of the mxtunnel.\\n * if forwarding == site_mxedge, vlan_ids comes from site_mxedge (`mxtunnels` under site setting)", "examples": [ 9 ], @@ -36859,7 +38761,7 @@ "type": "integer" }, "vlan_ids": { - "description": "If `forwarding`==`limited`, comma separated list of additional vlan ids allowed on this port", + "description": "If `forwarding`==`limited`, comma separated list of additional VLAN IDs allowed on this port", "examples": [ "10,20,30" ], @@ -36910,7 +38812,7 @@ }, "ap_synthetic_test": { "additionalProperties": false, - "description": "AP Synthetic Test configuration", + "description": "Synthetic test configuration for APs at the site", "properties": { "additional_vlan_ids": { "anyOf": [ @@ -36918,7 +38820,9 @@ "type": "string" }, { + "description": "Additional VLAN IDs represented as an array", "items": { + "description": "VLAN ID, either numeric or expressed as a template variable string", "oneOf": [ { "type": "string" @@ -36933,7 +38837,7 @@ "type": "array" } ], - "description": "List or Comma separated list of additional VLAN IDs (on the LAN side or from other WLANs) should we be forwarding bonjour queries/responses" + "description": "VLAN IDs included in addition to the default VLAN set for AP synthetic tests" } }, "type": "object" @@ -36953,15 +38857,17 @@ }, "auto_placement": { "additionalProperties": false, - "description": "If we're able to determine its x/y/orientation, this will be populated", + "description": "Automatic AP placement settings for the site", "properties": { "orientation": { + "description": "AP orientation angle in degrees on the map", "examples": [ 45 ], "type": "integer" }, "x": { + "description": "Map x-coordinate determined by auto placement", "examples": [ 30 ], @@ -36969,6 +38875,7 @@ "type": "number" }, "y": { + "description": "Map y-coordinate determined by auto placement", "examples": [ 60 ], @@ -36980,7 +38887,7 @@ }, "auto_upgrade": { "additionalProperties": false, - "description": "Auto Upgrade Settings", + "description": "Automatic AP firmware upgrade settings for the site", "properties": { "custom_versions": { "additionalProperties": { @@ -36997,7 +38904,7 @@ "type": "object" }, "day_of_week": { - "description": "enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`", + "description": "Weekly AP auto-upgrade day for the maintenance window", "enum": [ "any", "fri", @@ -37024,7 +38931,7 @@ }, "version": { "default": "stable", - "description": "desired version. enum: `beta`, `custom`, `stable`", + "description": "Firmware release channel or custom version used for AP auto-upgrade", "enum": [ "beta", "custom", @@ -37040,7 +38947,7 @@ }, "auto_upgrade_esl": { "additionalProperties": false, - "description": "auto upgrade AP ESL. When both firmware and ESL auto-upgrade are enabled, ESL upgrade will be done only after firmware upgrade", + "description": "Automatic ESL firmware upgrade settings for the site", "properties": { "allow_downgrade": { "default": false, @@ -37061,7 +38968,7 @@ "type": "object" }, "day_of_week": { - "description": "enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`", + "description": "Weekly ESL auto-upgrade day for the maintenance window", "enum": [ "any", "fri", @@ -37087,6 +38994,7 @@ "type": "string" }, "version": { + "description": "ESL firmware version used for auto-upgrade", "examples": [ "2.5.0" ], @@ -37097,6 +39005,7 @@ }, "auto_upgrade_linecard": { "default": true, + "description": "Whether line cards are included in automatic switch upgrades", "type": "boolean" }, "bgp_neighbor_updown_threshold": { @@ -37111,6 +39020,7 @@ ] }, "blacklist_url": { + "description": "Read-only URL for the site blacklist file", "examples": [ "https://papi.s3.amazonaws.com/blacklist/xxx..." ], @@ -37119,7 +39029,7 @@ }, "ble_config": { "additionalProperties": false, - "description": "BLE AP settings", + "description": "Bluetooth Low Energy configuration applied to APs at the site", "properties": { "beacon_enabled": { "default": true, @@ -37135,7 +39045,7 @@ }, "beacon_rate_mode": { "default": "default", - "description": "enum: `custom`, `default`", + "description": "Beacon rate mode for Mist BLE beacons; use custom to set beacon_rate", "enum": [ "custom", "default" @@ -37146,7 +39056,7 @@ "type": "string" }, "beam_disabled": { - "description": "List of AP BLE location beam numbers (1-8) which should be disabled at the AP and not transmit location information (where beam 1 is oriented at the top the AP, growing counter-clock-wise, with 9 being the omni BLE beam)", + "description": "AP BLE beam numbers disabled for location advertisements", "examples": [ [ 1, @@ -37193,6 +39103,7 @@ }, "eddystone_uid_beams": { "default": "", + "description": "BLE beams used to transmit Eddystone-UID advertisements, expressed as ranges such as `2-4,7`", "examples": [ "2-4,7" ], @@ -37221,7 +39132,7 @@ }, "eddystone_uid_namespace": { "default": "", - "description": "Eddystone-UID namespace", + "description": "Eddystone-UID namespace broadcast by the AP, as a 10-byte hex string", "examples": [ "2818e3868dec25629ede" ], @@ -37239,6 +39150,7 @@ }, "eddystone_url_beams": { "default": "", + "description": "BLE beams used to transmit Eddystone-URL advertisements, expressed as ranges such as `2-4,7`", "examples": [ "2-4,7" ], @@ -37251,7 +39163,7 @@ }, "eddystone_url_freq_msec": { "default": 0, - "description": "Frequency (msec) of data emit by Eddystone-UID beacon", + "description": "Frequency (msec) of data emitted by Eddystone-URL beacon", "examples": [ 1000 ], @@ -37277,6 +39189,7 @@ }, "ibeacon_beams": { "default": "", + "description": "BLE beams used to transmit iBeacon advertisements, expressed as ranges such as `2-4,7`", "examples": [ "2-4,7" ], @@ -37293,7 +39206,7 @@ "type": "integer" }, "ibeacon_major": { - "description": "Major number for iBeacon", + "description": "iBeacon major value broadcast by the AP", "examples": [ 1234 ], @@ -37305,7 +39218,7 @@ ] }, "ibeacon_minor": { - "description": "Minor number for iBeacon", + "description": "iBeacon minor value broadcast by the AP", "examples": [ 1234 ], @@ -37337,7 +39250,7 @@ }, "power_mode": { "default": "default", - "description": "enum: `custom`, `default`", + "description": "Transmit power mode for BLE beacons; use custom to set `power`", "enum": [ "custom", "default" @@ -37357,7 +39270,7 @@ }, "config_push_policy": { "additionalProperties": false, - "description": "Mist also uses some heuristic rules to prevent destructive configs from being pushed", + "description": "Policy controlling how site configuration pushes are applied", "properties": { "no_push": { "default": false, @@ -37366,19 +39279,20 @@ }, "push_window": { "additionalProperties": false, - "description": "If enabled, new config will only be pushed to device within the specified time window", + "description": "Allowed time window during which configuration pushes may run", "properties": { "enabled": { "default": false, + "description": "Whether configuration pushes are limited to the configured push window", "type": "boolean" }, "hours": { "additionalProperties": false, - "description": "Days/Hours of operation filter, the available days (mon, tue, wed, thu, fri, sat, sun)", + "description": "Day-of-week hour ranges when configuration pushes are allowed", "properties": { "fri": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Friday", "examples": [ "09:00-17:00" ], @@ -37386,7 +39300,7 @@ }, "mon": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Monday", "examples": [ "09:00-17:00" ], @@ -37394,7 +39308,7 @@ }, "sat": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Saturday", "examples": [ "09:00-17:00" ], @@ -37402,7 +39316,7 @@ }, "sun": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Sunday", "examples": [ "09:00-17:00" ], @@ -37410,7 +39324,7 @@ }, "thu": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Thursday", "examples": [ "09:00-17:00" ], @@ -37418,7 +39332,7 @@ }, "tue": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Tuesday", "examples": [ "09:00-17:00" ], @@ -37426,7 +39340,7 @@ }, "wed": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Wednesday", "examples": [ "09:00-17:00" ], @@ -37442,30 +39356,35 @@ "type": "object" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the site settings were created", "format": "double", "readOnly": true, "type": "number" }, "critical_url_monitoring": { "additionalProperties": false, - "description": "You can define some URLs that's critical to site operations the latency will be captured and considered for site health", + "description": "Monitoring configuration for critical URLs at the site", "properties": { "enabled": { "default": true, + "description": "Whether critical URL monitoring is enabled", "type": "boolean" }, "monitors": { + "description": "Critical URLs monitored for site health latency", "items": { "additionalProperties": false, + "description": "Critical URL monitor definition for site health", "properties": { "url": { + "description": "Monitored HTTP or HTTPS URL used for site health latency", "examples": [ "http://50.1.3.5:8080" ], "type": "string" }, "vlan_id": { + "description": "Source VLAN ID used to run the critical URL monitor", "oneOf": [ { "type": "string" @@ -37500,8 +39419,10 @@ }, "dhcp_snooping": { "additionalProperties": false, + "description": "Layer 2 DHCP snooping settings for the site", "properties": { "all_networks": { + "description": "Whether DHCP snooping applies to all configured networks", "type": "boolean" }, "enable_arp_spoof_check": { @@ -37513,10 +39434,11 @@ "type": "boolean" }, "enabled": { + "description": "Whether DHCP snooping is enabled", "type": "boolean" }, "networks": { - "description": "If `all_networks`==`false`, list of network with DHCP snooping enabled", + "description": "Network names with DHCP snooping enabled when `all_networks`==`false`", "items": { "type": "string" }, @@ -37526,7 +39448,7 @@ "type": "object" }, "disabled_system_defined_port_usages": { - "description": "If some system-default port usages are not desired - namely, ap / iot / uplink", + "description": "System-defined switch port usages disabled for the site", "items": { "description": "system-default port usages. enum: `ap`, `iot`, `uplink``", "enum": [ @@ -37539,14 +39461,14 @@ "type": "array" }, "dns_servers": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "Name server addresses configured for the site", "items": { "type": "string" }, "type": "array" }, "dns_suffix": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "Search suffixes used for DNS lookups at the site", "items": { "type": "string" }, @@ -37554,18 +39476,20 @@ }, "enable_unii_4": { "default": false, + "description": "Whether UNII-4 channels are enabled for the site", "type": "boolean" }, "engagement": { "additionalProperties": false, - "description": "**Note**: if hours does not exist, it's treated as everyday of the week, 00:00-23:59. Currently, we don't allow multiple ranges for the same day", + "description": "Dwell-time analytics rules for the site", "properties": { "dwell_tag_names": { "additionalProperties": false, - "description": "Name associated to each tag", + "description": "Display labels for dwell-time visit categories", "properties": { "bounce": { "default": "Visitor", + "description": "Display label for bounce visits", "examples": [ "Bounce" ], @@ -37573,6 +39497,7 @@ }, "engaged": { "default": "Associates", + "description": "Display label for engaged visits", "examples": [ "Engaged" ], @@ -37580,6 +39505,7 @@ }, "passerby": { "default": "Passerby", + "description": "Display label for passerby visits", "examples": [ "Passer By" ], @@ -37587,6 +39513,7 @@ }, "stationed": { "default": "Assets", + "description": "Display label for stationed visits", "examples": [ "Stationed" ], @@ -37597,10 +39524,11 @@ }, "dwell_tags": { "additionalProperties": false, - "description": "add tags to visits within the duration (in seconds)", + "description": "Visit duration ranges used to assign engagement categories", "properties": { "bounce": { "default": "301-14400", + "description": "Visit duration range for bounce visits, in seconds", "type": [ "string", "null" @@ -37608,6 +39536,7 @@ }, "engaged": { "default": "14401-28800", + "description": "Visit duration range for engaged visits, in seconds", "type": [ "string", "null" @@ -37615,6 +39544,7 @@ }, "passerby": { "default": "1-300", + "description": "Visit duration range for passerby visits, in seconds", "type": [ "string", "null" @@ -37622,6 +39552,7 @@ }, "stationed": { "default": "28801-42000", + "description": "Visit duration range for stationed visits, in seconds", "type": [ "string", "null" @@ -37632,11 +39563,11 @@ }, "hours": { "additionalProperties": false, - "description": "Days/Hours of operation filter, the available days (mon, tue, wed, thu, fri, sat, sun)", + "description": "Schedule during which engagement analytics rules apply", "properties": { "fri": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Friday", "examples": [ "09:00-17:00" ], @@ -37644,7 +39575,7 @@ }, "mon": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Monday", "examples": [ "09:00-17:00" ], @@ -37652,7 +39583,7 @@ }, "sat": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Saturday", "examples": [ "09:00-17:00" ], @@ -37660,7 +39591,7 @@ }, "sun": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Sunday", "examples": [ "09:00-17:00" ], @@ -37668,7 +39599,7 @@ }, "thu": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Thursday", "examples": [ "09:00-17:00" ], @@ -37676,7 +39607,7 @@ }, "tue": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Tuesday", "examples": [ "09:00-17:00" ], @@ -37684,7 +39615,7 @@ }, "wed": { "default": "", - "description": "Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.", + "description": "Operating hour range for Wednesday", "examples": [ "09:00-17:00" ], @@ -37695,7 +39626,7 @@ }, "max_dwell": { "default": 43200, - "description": "Max time, default is 43200(12h), max is 68400 (18h)", + "description": "Maximum dwell time in seconds considered by engagement analytics", "examples": [ 43200 ], @@ -37704,7 +39635,7 @@ "type": "integer" }, "min_dwell": { - "description": "min time", + "description": "Minimum dwell time in seconds for engagement analytics", "minimum": 0, "type": "integer" } @@ -37713,7 +39644,7 @@ }, "evpn_options": { "additionalProperties": false, - "description": "EVPN Options", + "description": "Fabric EVPN options for the site", "properties": { "auto_loopback_subnet": { "default": "172.16.192.0/24", @@ -37754,6 +39685,7 @@ }, "overlay": { "additionalProperties": false, + "description": "EVPN overlay BGP settings for the topology", "properties": { "as": { "default": 65000, @@ -37780,7 +39712,7 @@ }, "routed_at": { "default": "edge", - "description": "optional, where virtual-gateway should reside. enum: `core`, `distribution`, `edge`", + "description": "Topology tier where EVPN virtual gateway routing is placed", "enum": [ "core", "distribution", @@ -37790,6 +39722,7 @@ }, "underlay": { "additionalProperties": false, + "description": "EVPN underlay BGP and subnet settings for the topology", "properties": { "as_base": { "default": 65001, @@ -37802,6 +39735,7 @@ "type": "integer" }, "routed_id_prefix": { + "description": "Prefix length used for automatically derived underlay router identifiers", "examples": [ "/24" ], @@ -37825,8 +39759,10 @@ "vs_instances": { "additionalProperties": { "additionalProperties": false, + "description": "EVPN virtual-switch instance network mapping", "properties": { "networks": { + "description": "List of network names included in this virtual-switch instance", "items": { "type": "string" }, @@ -37836,7 +39772,7 @@ }, "type": "object" }, - "description": "Optional, for EX9200 only to segregate virtual-switches", + "description": "Virtual-switch instance mappings used to segregate EVPN networks", "examples": [ { "guest": { @@ -37860,13 +39796,15 @@ "extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "IPv4 static route settings for a destination prefix", "properties": { "discard": { "default": false, - "description": "This takes precedence", + "description": "Whether to install a discard route; this takes precedence over next-hop settings", "type": "boolean" }, "metric": { + "description": "Route metric for the IPv4 static route", "examples": [ null ], @@ -37880,14 +39818,17 @@ "next_qualified": { "additionalProperties": { "additionalProperties": false, + "description": "Qualified next-hop attributes for an IPv4 static route", "properties": { "metric": { + "description": "Route metric for this qualified IPv4 next hop", "type": [ "integer", "null" ] }, "preference": { + "description": "Route preference for this qualified IPv4 next hop", "type": [ "integer", "null" @@ -37896,6 +39837,7 @@ }, "type": "object" }, + "description": "Qualified next-hop settings keyed by IPv4 next-hop address", "examples": [ { "10.3.1.1": { @@ -37908,9 +39850,11 @@ }, "no_resolve": { "default": false, + "description": "Whether to prevent recursive next-hop resolution for the IPv4 static route", "type": "boolean" }, "preference": { + "description": "Route preference for the IPv4 static route", "examples": [ 30 ], @@ -37922,7 +39866,7 @@ ] }, "via": { - "description": "Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.", + "description": "Next-hop IPv4 address or ECMP next-hop IPv4 addresses for the route", "examples": [ "10.2.1.1", [ @@ -37945,7 +39889,7 @@ }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"10.0.0.0/8\\")", + "description": "Additional IPv4 routes configured for the site", "examples": [ { "0.0.0.0/0": { @@ -37958,13 +39902,15 @@ "extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "IPv6 static route settings for a destination prefix", "properties": { "discard": { "default": false, - "description": "This takes precedence", + "description": "Whether to install a discard route; this takes precedence over next-hop settings", "type": "boolean" }, "metric": { + "description": "Route metric for the IPv6 static route", "examples": [ null ], @@ -37978,14 +39924,17 @@ "next_qualified": { "additionalProperties": { "additionalProperties": false, + "description": "Qualified next-hop attributes for an IPv6 static route", "properties": { "metric": { + "description": "Route metric for this qualified IPv6 next hop", "type": [ "integer", "null" ] }, "preference": { + "description": "Route preference for this qualified IPv6 next hop", "type": [ "integer", "null" @@ -37994,6 +39943,7 @@ }, "type": "object" }, + "description": "Qualified next-hop settings keyed by IPv6 next-hop address", "examples": [ { "2a02:1234:200a::100": { @@ -38006,9 +39956,11 @@ }, "no_resolve": { "default": false, + "description": "Whether to prevent recursive next-hop resolution for the IPv6 static route", "type": "boolean" }, "preference": { + "description": "Route preference for the IPv6 static route", "examples": [ 30 ], @@ -38020,7 +39972,7 @@ ] }, "via": { - "description": "Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.", + "description": "Next-hop IPv6 address or ECMP next-hop IPv6 addresses for the route", "examples": [ "10.2.1.1", [ @@ -38043,7 +39995,7 @@ }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "Additional IPv6 routes configured for the site", "examples": [ { "2a02:1234:420a:10c9::/64": { @@ -38057,18 +40009,19 @@ "additionalProperties": { "type": "string" }, - "description": "Name/val pair objects for location engine to use", + "description": "Feature flags enabled for the site", "type": "object" }, "for_site": { + "description": "Whether this settings object is scoped to a site", "readOnly": true, "type": "boolean" }, "gateway": { - "description": "Gateway Template is applied to a site for gateway(s) in a site.", + "description": "Template settings applied to site gateways", "properties": { "additional_config_cmds": { - "description": "additional CLI commands to append to the generated Junos config. **Note**: no check is done", + "description": "Additional CLI configuration commands provided by this gateway template", "items": { "description": "JUNOS \\"set\\" command to add to the generated configuration", "examples": [ @@ -38081,7 +40034,7 @@ "bgp_config": { "additionalProperties": { "additionalProperties": false, - "description": "BFD is enabled when either bfd_minimum_interval or bfd_multiplier is configured", + "description": "BGP session configuration. BFD is enabled when either bfd_minimum_interval or bfd_multiplier is configured", "properties": { "auth_key": { "description": "Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`", @@ -38113,6 +40066,7 @@ "type": "boolean" }, "export": { + "description": "Routing policy applied to routes exported by this BGP session", "type": "string" }, "export_policy": { @@ -38138,6 +40092,7 @@ "type": "integer" }, "import": { + "description": "Routing policy applied to routes imported by this BGP session", "type": "string" }, "import_policy": { @@ -38155,7 +40110,7 @@ "type": "integer" } ], - "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. BGP AS, value in range 1-4294967295", + "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; local BGP Autonomous System (AS) number", "examples": [ 65000 ] @@ -38171,7 +40126,7 @@ "type": "integer" } ], - "description": "BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}` )", + "description": "Default BGP neighbor Autonomous System (AS) number for this session", "examples": [ 65000 ] @@ -38179,6 +40134,7 @@ "neighbors": { "additionalProperties": { "additionalProperties": false, + "description": "Per-neighbor BGP session settings", "properties": { "disabled": { "default": false, @@ -38186,15 +40142,18 @@ "type": "boolean" }, "export_policy": { + "description": "Export policy applied only to this BGP neighbor", "type": "string" }, "hold_time": { "default": 90, + "description": "BGP hold time for this neighbor, in seconds", "maximum": 65535, "minimum": 0, "type": "integer" }, "import_policy": { + "description": "Import policy applied only to this BGP neighbor", "type": "string" }, "multihop_ttl": { @@ -38204,10 +40163,12 @@ "type": "integer" }, "neighbor_as": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Autonomous System (AS) number of this BGP neighbor" }, "tunnel_via": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "If `via`==`tunnel`, primary or secondary tunnel associated with this BGP neighbor" } }, "required": [ @@ -38219,7 +40180,7 @@ "type": "object" }, "networks": { - "description": "Optional if `via`==`lan`. List of networks where we expect BGP neighbor to connect to/from", + "description": "Optional if `via`==`lan`; networks where BGP neighbors can connect to or from", "items": { "type": "string" }, @@ -38236,11 +40197,11 @@ "type": "boolean" }, "tunnel_name": { - "description": "Optional if `via`==`tunnel`", + "description": "Optional if `via`==`tunnel`; tunnel name used for this BGP session", "type": "string" }, "type": { - "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. enum: `external`, `internal`", + "description": "Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; BGP session type, internal or external", "enum": [ "external", "internal" @@ -38250,7 +40211,7 @@ }, "via": { "default": "lan", - "description": "enum: `lan`, `tunnel`, `vpn`, `wan`", + "description": "Transport used for this BGP session, such as LAN, tunnel, VPN, or WAN", "enum": [ "lan", "tunnel", @@ -38260,11 +40221,11 @@ "type": "string" }, "vpn_name": { - "description": "Optional if `via`==`vpn`", + "description": "Optional if `via`==`vpn`; VPN name used for this BGP session", "type": "string" }, "wan_name": { - "description": "Optional if `via`==`wan`", + "description": "Optional if `via`==`wan`; WAN interface name used for this BGP session", "type": "string" } }, @@ -38273,10 +40234,11 @@ ], "type": "object" }, + "description": "BGP routing defaults for this gateway template. Property key is the BGP session name", "type": "object" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the gateway template was created", "format": "double", "readOnly": true, "type": "number" @@ -38284,9 +40246,10 @@ "dhcpd_config": { "additionalProperties": { "additionalProperties": false, + "description": "DHCP server or relay configuration for one network", "properties": { "dns_servers": { - "description": "If `type`==`local` or `type6`==`local` - optional, if not defined, system one will be used", + "description": "If `type`==`local` or `type6`==`local`, DNS servers advertised to DHCP clients", "examples": [ [ "8.8.8.8", @@ -38300,7 +40263,7 @@ "type": "array" }, "dns_suffix": { - "description": "If `type`==`local` or `type6`==`local` - optional, if not defined, system one will be used", + "description": "If `type`==`local` or `type6`==`local`, DNS search suffixes advertised to DHCP clients", "examples": [ [ ".mist.local", @@ -38316,7 +40279,7 @@ "additionalProperties": { "$comment": "max depth reached" }, - "description": "If `type`==`local` or `type6`==`local`. Property key is the MAC Address. Format is `[0-9a-f]{12}` (e.g. \\"5684dae9ac8b\\")", + "description": "If `type`==`local` or `type6`==`local`, fixed client bindings for local DHCP service", "examples": [ { "5684dae9ac8b": { @@ -38335,28 +40298,28 @@ "type": "string" }, "ip6_end": { - "description": "If `type6`==`local`", + "description": "If `type6`==`local`, ending IPv6 address for the DHCP lease pool", "examples": [ "2607:f8b0:4005:808::ff" ], "type": "string" }, "ip6_start": { - "description": "If `type6`==`local`", + "description": "If `type6`==`local`, starting IPv6 address for the DHCP lease pool", "examples": [ "2607:f8b0:4005:808::2" ], "type": "string" }, "ip_end": { - "description": "If `type`==`local`", + "description": "If `type`==`local`, ending IPv4 address for the DHCP lease pool", "examples": [ "192.168.70.200" ], "type": "string" }, "ip_start": { - "description": "If `type`==`local`", + "description": "If `type`==`local`, starting IPv4 address for the DHCP lease pool", "examples": [ "192.168.70.100" ], @@ -38373,7 +40336,7 @@ "additionalProperties": { "$comment": "max depth reached" }, - "description": "If `type`==`local` or `type6`==`local`. Property key is the DHCP option number", + "description": "If `type`==`local` or `type6`==`local`, custom DHCP options advertised to clients", "type": "object" }, "server_id_override": { @@ -38382,7 +40345,7 @@ "type": "boolean" }, "servers": { - "description": "If `type`==`relay`", + "description": "If `type`==`relay`, upstream IPv4 DHCP servers", "examples": [ [ "11.2.3.4" @@ -38394,7 +40357,7 @@ "type": "array" }, "serversv6": { - "description": "If `type6`==`relay`", + "description": "If `type6`==`relay`, upstream IPv6 DHCP servers", "examples": [ [ "2607:f8b0:4005:808::64" @@ -38407,7 +40370,7 @@ }, "type": { "default": "local", - "description": "enum: `local` (DHCP Server), `none`, `relay` (DHCP Relay)", + "description": "IPv4 DHCP mode for this network", "enum": [ "local", "none", @@ -38417,7 +40380,7 @@ }, "type6": { "default": "none", - "description": "enum: `local` (DHCP Server), `none`, `relay` (DHCP Relay)", + "description": "IPv6 DHCP mode for this network", "enum": [ "local", "none", @@ -38429,12 +40392,13 @@ "additionalProperties": { "$comment": "max depth reached" }, - "description": "If `type`==`local` or `type6`==`local`. Property key is :, with\\n * enterprise number: 1-65535 (https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers)\\n * sub option code: 1-255, sub-option code", + "description": "If `type`==`local` or `type6`==`local`, vendor-encapsulated DHCP options advertised to clients", "type": "object" } }, "type": "object" }, + "description": "DHCP server defaults provided by this gateway template", "properties": { "enabled": { "default": true, @@ -38446,17 +40410,18 @@ }, "dnsOverride": { "default": false, + "description": "Whether DNS server and suffix settings in this template override inherited values", "type": "boolean" }, "dns_servers": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS servers provided by this gateway template", "items": { "type": "string" }, "type": "array" }, "dns_suffix": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS search suffixes provided by this gateway template", "items": { "type": "string" }, @@ -38465,29 +40430,33 @@ "extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway IPv4 extra route next-hop settings", "properties": { "via": { + "description": "Next-hop IPv4 address for the gateway extra route", "format": "ipv4", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"10.0.0.0/8\\"), the destination Network name or a variable (e.g. \\"{{myvar}}\\")", + "description": "Additional IPv4 route defaults in this gateway template", "type": "object" }, "extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway IPv6 extra route next-hop settings", "properties": { "via": { + "description": "Next-hop IPv6 address for the gateway extra route", "format": "ipv6", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"2a02:1234:420a:10c9::/64\\"), the destination Network name or a variable (e.g. \\"{{myvar}}\\")", + "description": "Additional IPv6 route defaults in this gateway template", "examples": [ { "2a02:1234:420a:10c9::/64": { @@ -38499,22 +40468,27 @@ }, "gateway_matching": { "additionalProperties": false, - "description": "Gateway matching", + "description": "Matching rules that select gateways for this template", "properties": { "enable": { + "description": "Whether gateway matching is enabled", "type": "boolean" }, "rules": { + "description": "Gateway matching rules evaluated for this configuration", "items": { "additionalProperties": { "description": "Property key defines the type of matching. e.g: `match_name[0:3]`, `match_model[0-6]` or `match_role`", "type": "string" }, + "description": "Gateway matching rule that applies settings when its match keys select a gateway", "properties": { "additional_config_cmds": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "For SRX only, additional Junos CLI commands appended when this gateway matching rule applies" }, "name": { + "description": "Display name for the gateway matching rule", "type": "string" }, "port_config": { @@ -38535,10 +40509,10 @@ }, "gateway_mgmt": { "additionalProperties": false, - "description": "Gateway Management settings", + "description": "Management-plane defaults provided by this gateway template", "properties": { "admin_sshkeys": { - "description": "For SSR only, as direct root access is not allowed", + "description": "SSR-only SSH public keys for administrative access", "examples": [ [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA...Wxa6p6UW0ZbcP john@host" @@ -38551,9 +40525,10 @@ }, "app_probing": { "additionalProperties": false, + "description": "Application probing configuration for gateway monitoring", "properties": { "apps": { - "description": "APp-keys from [List Applications](/#operations/listApplications)", + "description": "Predefined application keys to probe", "examples": [ [ "facebook" @@ -38565,12 +40540,14 @@ "type": "array" }, "custom_apps": { + "description": "User-defined application probe definitions", "items": { "$comment": "max depth reached" }, "type": "array" }, "enabled": { + "description": "Whether gateway application probing is enabled", "type": "boolean" } }, @@ -38582,9 +40559,10 @@ }, "auto_signature_update": { "additionalProperties": false, + "description": "Schedule for automatic security signature updates", "properties": { "day_of_week": { - "description": "enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`", + "description": "Scheduled weekday for automatic signature updates", "enum": [ "any", "fri", @@ -38599,6 +40577,7 @@ }, "enable": { "default": true, + "description": "Whether automatic security signature updates are enabled", "type": "boolean" }, "time_of_day": { @@ -38632,9 +40611,11 @@ }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the gateway", "type": "boolean" }, "probe_hosts": { + "description": "IPv4 probe targets used for gateway connectivity checks", "examples": [ [ "8.8.8.8" @@ -38647,6 +40628,7 @@ "type": "array" }, "probe_hostsv6": { + "description": "IPv6 probe targets used for gateway connectivity checks", "examples": [ [ "2001:4860:4860::8888" @@ -38660,10 +40642,10 @@ }, "protect_re": { "additionalProperties": false, - "description": "Restrict inbound-traffic to host\\nwhen enabled, all traffic that is not essential to our operation will be dropped \\ne.g. ntp / dns / traffic to mist will be allowed by default, if dhcpd is enabled, we'll make sure it works", + "description": "Control-plane protection settings for the gateway", "properties": { "allowed_services": { - "description": "Optionally, services we'll allow", + "description": "Built-in services explicitly allowed by the Protect RE policy", "examples": [ [ "icmp", @@ -38676,6 +40658,7 @@ "type": "array" }, "custom": { + "description": "Additional ACL entries allowed by the Protect RE policy", "items": { "$comment": "max depth reached" }, @@ -38692,7 +40675,7 @@ "type": "boolean" }, "trusted_hosts": { - "description": "host/subnets we'll allow traffic to/from", + "description": "Trusted host or subnet entries allowed by the Protect RE policy", "items": { "examples": [ "10.242.3.0/24" @@ -38705,11 +40688,12 @@ "type": "object" }, "root_password": { - "description": "SRX only", + "description": "SRX only. Root password for local gateway access", "format": "password", "type": "string" }, "security_log_source_address": { + "description": "IPv4 source address used for gateway security log traffic", "examples": [ "192.168.1.1" ], @@ -38717,6 +40701,7 @@ "type": "string" }, "security_log_source_interface": { + "description": "Source interface used for gateway security log traffic", "examples": [ "ge-0/0/1.0" ], @@ -38726,7 +40711,7 @@ "type": "object" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the gateway template", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -38736,9 +40721,10 @@ }, "idp_profiles": { "additionalProperties": { + "description": "Organization IDP profile with a base profile and targeted overwrite rules", "properties": { "base_profile": { - "description": "enum: `critical`, `standard`, `strict`", + "description": "Built-in IDP baseline profile inherited before applying overwrites", "enum": [ "critical", "standard", @@ -38750,13 +40736,13 @@ "type": "string" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the IDP profile was created", "format": "double", "readOnly": true, "type": "number" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the IDP profile", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -38765,18 +40751,20 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the IDP profile was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the IDP profile", "examples": [ "relaxed" ], "type": "string" }, "org_id": { + "description": "Owning organization for the IDP profile", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -38785,6 +40773,7 @@ "type": "string" }, "overwrites": { + "description": "IDP signature override rules applied on top of the base profile", "items": { "$comment": "max depth reached" }, @@ -38793,35 +40782,40 @@ }, "type": "object" }, - "description": "Property key is the profile name", + "description": "Intrusion detection and prevention profile defaults in this gateway template", "type": "object" }, "ip_configs": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway network interface IP configuration", "properties": { "ip": { + "description": "Static IPv4 address for the gateway network interface when `type`==`static`", "format": "ipv4", "type": "string" }, "ip6": { + "description": "Static IPv6 address for the gateway network interface when `type6`==`static`", "format": "ipv6", "type": "string" }, "netmask": { + "description": "IPv4 netmask or prefix length for the gateway network interface when `type`==`static`", "examples": [ "/24" ], "type": "string" }, "netmask6": { + "description": "IPv6 netmask or prefix length for the gateway network interface when `type6`==`static`", "examples": [ "2001:db8:abcd:12::1" ], "type": "string" }, "secondary_ips": { - "description": "Optional list of secondary IPs in CIDR format", + "description": "Additional IPv4 addresses in CIDR notation for this gateway network interface", "examples": [ [ "192.168.50.1/24", @@ -38835,7 +40829,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IPv4 address assignment mode for this gateway network interface", "enum": [ "dhcp", "static" @@ -38847,7 +40841,7 @@ }, "type6": { "default": "disabled", - "description": "enum: `autoconf`, `dhcp`, `disabled`, `static`", + "description": "IPv6 address assignment mode for this gateway network interface", "enum": [ "autoconf", "dhcp", @@ -38862,27 +40856,29 @@ }, "type": "object" }, - "description": "Property key is the network name", + "description": "Gateway interface IP configuration defaults by network name", "type": "object" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the gateway template was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the gateway template", "examples": [ "gw_template" ], "type": "string" }, "networks": { + "description": "Layer 3 networks configured by this gateway template", "items": { - "description": "Networks are usually subnets that have cross-site significance. `networks`in Org Settings will got merged into `networks`in Site Setting. For gateways, they can be used to define Service Routes.", + "description": "Organization-level Layer 3 network definition that can be merged into site settings and used for service routes. Networks are used to define the service routes in the Gateway settings or templates", "properties": { "created_time": { - "description": "When the object has been created, in epoch", + "description": "Epoch timestamp when the network was created", "format": "double", "readOnly": true, "type": "number" @@ -38893,6 +40889,7 @@ "type": "boolean" }, "gateway": { + "description": "IPv4 gateway address for this network", "examples": [ "192.168.70.1" ], @@ -38900,6 +40897,7 @@ "type": "string" }, "gateway6": { + "description": "IPv6 gateway address for this network", "examples": [ "fdad:b0bc:f29e::1" ], @@ -38907,7 +40905,7 @@ "type": "string" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the network", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -38917,8 +40915,10 @@ }, "internal_access": { "additionalProperties": false, + "description": "Internal access settings for this network", "properties": { "enabled": { + "description": "Whether internal access is enabled for this network", "type": "boolean" } }, @@ -38926,16 +40926,19 @@ }, "internet_access": { "additionalProperties": false, - "description": "Whether this network has direct internet access", + "description": "Direct internet access and NAT settings for this network", "properties": { "create_simple_service_policy": { "default": false, + "description": "Whether Mist should create simple service policies for restricted internet access", "type": "boolean" }, "destination_nat": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Destination NAT rules for direct internet access" }, "enabled": { + "description": "Whether direct internet access is enabled for this network", "type": "boolean" }, "restricted": { @@ -38944,7 +40947,8 @@ "type": "boolean" }, "static_nat": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Static NAT rules for direct internet access" } }, "type": "object" @@ -38954,14 +40958,14 @@ "type": "boolean" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Epoch timestamp when the network was last modified", "format": "double", "readOnly": true, "type": "number" }, "multicast": { "additionalProperties": false, - "description": "Whether to enable multicast support (only PIM-sparse mode is supported)", + "description": "Settings for multicast routing on this network", "properties": { "disable_igmp": { "default": false, @@ -38970,18 +40974,22 @@ }, "enabled": { "default": false, + "description": "Whether multicast support is enabled for this network", "type": "boolean" }, "groups": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Multicast group-to-RP mappings for this network" } }, "type": "object" }, "name": { + "description": "Display name of the organization network", "type": "string" }, "org_id": { + "description": "Organization that owns this network", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -38990,7 +40998,7 @@ "type": "string" }, "routed_for_networks": { - "description": "For a Network (usually LAN), it can be routable to other networks (e.g. OSPF)", + "description": "Other network names this network can route to, for example through BGP, OSPF or static routes", "items": { "examples": [ "pos" @@ -39000,12 +41008,14 @@ "type": "array" }, "subnet": { + "description": "IPv4 subnet CIDR for this network", "examples": [ "192.168.70.0/24" ], "type": "string" }, "subnet6": { + "description": "IPv6 subnet CIDR for this network", "examples": [ "fdad:b0bc:f29e::/32" ], @@ -39015,10 +41025,11 @@ "additionalProperties": { "$comment": "max depth reached" }, - "description": "Property key must be the user/tenant name (i.e. \\"printer-1\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Tenant address mappings associated with this network", "type": "object" }, "vlan_id": { + "description": "VLAN ID or variable associated with this network", "oneOf": [ { "type": "string" @@ -39034,7 +41045,7 @@ "additionalProperties": { "$comment": "max depth reached" }, - "description": "Property key is the VPN name. Whether this network can be accessed from vpn", + "description": "VPN access settings keyed by VPN name for this network", "type": "object" } }, @@ -39047,10 +41058,11 @@ }, "ntpOverride": { "default": false, + "description": "Whether NTP servers in this template override inherited values", "type": "boolean" }, "ntp_servers": { - "description": "List of NTP servers specific to this device. By default, those in Site Settings will be used", + "description": "NTP servers provided by this gateway template", "items": { "type": "string" }, @@ -39058,38 +41070,39 @@ }, "oob_ip_config": { "additionalProperties": false, - "description": "Out-of-band (vme/em0/fxp0) IP config", + "description": "Out-of-band management IP defaults in this gateway template", "properties": { "gateway": { - "description": "If `type`==`static`", + "description": "Default gateway for the out-of-band management interface when `type`==`static`", "type": "string" }, "ip": { - "description": "If `type`==`static`", + "description": "Static IPv4 address for the out-of-band management interface when `type`==`static`", "type": "string" }, "netmask": { - "description": "If `type`==`static`", + "description": "IPv4 netmask or prefix length for the out-of-band management interface when `type`==`static`", "type": "string" }, "node1": { "additionalProperties": false, - "description": "For HA Cluster, node1 can have different IP Config", + "description": "Out-of-band management IP configuration override for node1 in an HA cluster", "properties": { "gateway": { - "description": "If `type`==`static`", + "description": "Default gateway for the node1 out-of-band management interface when `type`==`static`", "type": "string" }, "ip": { + "description": "Static IPv4 address for the node1 out-of-band management interface when `type`==`static`", "type": "string" }, "netmask": { - "description": "Used only if `subnet` is not specified in `networks`", + "description": "IPv4 netmask or prefix length for the node1 out-of-band management interface when `type`==`static`; used only if `subnet` is not specified in `networks`", "type": "string" }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IP assignment mode for the node1 out-of-band management interface", "enum": [ "dhcp", "static" @@ -39110,7 +41123,7 @@ "type": "boolean" }, "vlan_id": { - "description": "If WAN interface is on a VLAN. Can be the VLAN ID (i.e. \\"10\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "VLAN ID used for node1 out-of-band management traffic", "oneOf": [ { "type": "string" @@ -39127,7 +41140,7 @@ }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `static`", + "description": "IP assignment mode for the out-of-band management interface", "enum": [ "dhcp", "static" @@ -39148,7 +41161,7 @@ "type": "boolean" }, "vlan_id": { - "description": "If WAN interface is on a VLAN. Can be the VLAN ID (i.e. \\"10\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "VLAN ID used for out-of-band management traffic", "oneOf": [ { "type": "string" @@ -39164,6 +41177,7 @@ "type": "object" }, "org_id": { + "description": "Organization that owns this gateway template", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -39174,10 +41188,13 @@ "path_preferences": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway path preference that selects among one or more local, WAN, VPN, or tunnel paths", "properties": { "paths": { + "description": "Candidate paths evaluated for this gateway path preference", "items": { "additionalProperties": false, + "description": "Candidate path within a gateway path preference", "properties": { "cost": { "$comment": "max depth reached" @@ -39216,7 +41233,7 @@ }, "strategy": { "default": "ordered", - "description": "enum: `ecmp`, `ordered`, `weighted`", + "description": "Selection strategy used to evaluate the candidate paths", "enum": [ "ecmp", "ordered", @@ -39233,7 +41250,7 @@ "port_config": { "additionalProperties": { "additionalProperties": false, - "description": "Gateway port config", + "description": "Gateway port configuration for LAN, WAN, tunnel, and HA interfaces", "properties": { "ae_disable_lacp": { "default": false, @@ -39254,6 +41271,7 @@ }, "aggregated": { "default": false, + "description": "Whether the port participates in an aggregated Ethernet interface", "type": "boolean" }, "critical": { @@ -39267,6 +41285,7 @@ }, "disable_autoneg": { "default": false, + "description": "Whether Ethernet autonegotiation is disabled on the port", "type": "boolean" }, "disabled": { @@ -39276,7 +41295,7 @@ }, "dsl_type": { "default": "vdsl", - "description": "if `wan_type`==`dsl`. enum: `adsl`, `vdsl`", + "description": "If `wan_type`==`dsl`. DSL technology used by the WAN port", "enum": [ "adsl", "vdsl" @@ -39295,7 +41314,7 @@ }, "duplex": { "default": "auto", - "description": "enum: `auto`, `full`, `half`", + "description": "Ethernet duplex mode configured on the port", "enum": [ "auto", "full", @@ -39308,24 +41327,24 @@ }, "ip_config": { "additionalProperties": false, - "description": "Junos IP Config", + "description": "Layer 3 IP configuration for the port", "properties": { "dns": { - "description": "Except for out-of_band interface (vme/em0/fxp0)", + "description": "Resolver server IP addresses used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0", "items": { "$comment": "max depth reached" }, "type": "array" }, "dns_suffix": { - "description": "Except for out-of_band interface (vme/em0/fxp0)", + "description": "DNS search suffixes used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0", "items": { "$comment": "max depth reached" }, "type": "array" }, "gateway": { - "description": "Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP Address (i.e. \\"192.168.1.1\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP address (i.e. \\"192.168.1.1\\") or a Variable (i.e. \\"{{myvar}}\\")", "examples": [ "192.168.1.1" ], @@ -39339,7 +41358,7 @@ "type": "string" }, "ip": { - "description": "Interface IP Address (i.e. \\"192.168.1.8\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "Interface IP address (i.e. \\"192.168.1.8\\") or a Variable (i.e. \\"{{myvar}}\\")", "examples": [ "192.168.1.8" ], @@ -39373,12 +41392,13 @@ "type": "string" }, "poser_password": { - "description": "If `type`==`pppoe`", + "description": "Password used for PPPoE when `type`==`pppoe`", + "format": "password", "type": "string" }, "pppoe_auth": { "default": "none", - "description": "if `type`==`pppoe`. enum: `chap`, `none`, `pap`", + "description": "Authentication protocol used for PPPoE when `type`==`pppoe`", "enum": [ "chap", "none", @@ -39387,12 +41407,12 @@ "type": "string" }, "pppoe_username": { - "description": "If `type`==`pppoe`", + "description": "Username used for PPPoE when `type`==`pppoe`", "type": "string" }, "type": { "default": "dhcp", - "description": "enum: `dhcp`, `pppoe`, `static`", + "description": "IPv4 assignment mode for this gateway port interface", "enum": [ "dhcp", "pppoe", @@ -39402,7 +41422,7 @@ }, "type6": { "default": "autoconf", - "description": "enum: `autoconf`, `dhcp`, `static`", + "description": "IPv6 assignment mode for this gateway port interface", "enum": [ "autoconf", "dhcp", @@ -39414,12 +41434,12 @@ "type": "object" }, "lte_apn": { - "description": "If `wan_type`==`lte`", + "description": "If `wan_type`==`lte`. APN used by the LTE uplink", "type": "string" }, "lte_auth": { "default": "none", - "description": "if `wan_type`==`lte`. enum: `chap`, `none`, `pap`", + "description": "If `wan_type`==`lte`. Authentication method used by the LTE uplink", "enum": [ "chap", "none", @@ -39428,36 +41448,40 @@ "type": "string" }, "lte_backup": { + "description": "Whether the LTE uplink is used as a backup WAN connection", "type": "boolean" }, "lte_password": { - "description": "If `wan_type`==`lte`", + "description": "If `wan_type`==`lte`. Password used for LTE uplink authentication", + "format": "password", "type": "string" }, "lte_username": { - "description": "If `wan_type`==`lte`", + "description": "If `wan_type`==`lte`. Username used for LTE uplink authentication", "type": "string" }, "mtu": { + "description": "Layer 3 MTU configured on the port", "type": "integer" }, "name": { - "description": "Name that we'll use to derive config", + "description": "Interface name used to derive device configuration", "type": "string" }, "networks": { - "description": "If `usage`==`lan`, name of the [networks]($h/Orgs%20Networks/_overview) to attach to the interface", + "description": "If `usage`==`lan`. Networks attached to the interface", "items": { "type": "string" }, "type": "array" }, "outer_vlan_id": { - "description": "For Q-in-Q", + "description": "For Q-in-Q. Outer VLAN ID used for QinQ encapsulation", "type": "integer" }, "poe_disabled": { "default": false, + "description": "Whether PoE output is disabled on the port", "type": "boolean" }, "poe_keep_state_when_reboot": { @@ -39475,7 +41499,7 @@ "type": "boolean" }, "redundant": { - "description": "If HA mode", + "description": "If HA mode. Whether the port participates in the redundant Ethernet configuration", "type": "boolean" }, "redundant_group": { @@ -39493,14 +41517,14 @@ "type": "string" } ], - "description": "For SRX only and if HA Mode. `-1` means it will be managed by the device. Use `>= 0` values to manage it manually. Ensure no conflicting values are assigned across all ports." + "description": "If HA mode and for SRX only. Redundant Ethernet interface index assigned to the port" }, "reth_node": { - "description": "If HA mode", + "description": "If HA mode. Node associated with the redundant Ethernet interface", "type": "string" }, "reth_nodes": { - "description": "SSR only - supporting vlan-based redundancy (matching the size of `networks`)", + "description": "If HA mode and for SSR only. Per-network node assignment used for VLAN-based redundancy", "examples": [ [ "node0", @@ -39514,6 +41538,7 @@ }, "speed": { "default": "auto", + "description": "Link speed configured on the port", "examples": [ "1g" ], @@ -39526,7 +41551,7 @@ }, "svr_port_range": { "default": "none", - "description": "For SSR only", + "description": "For SSR only. Port range configured on the interface", "examples": [ "60000-60005" ], @@ -39534,9 +41559,10 @@ }, "traffic_shaping": { "additionalProperties": false, + "description": "Traffic shaping settings applied to the port", "properties": { "class_percentages": { - "description": "percentages for different class of traffic: high / medium / low / best-effort. Sum must be equal to 100", + "description": "Traffic class bandwidth percentages for high, medium, low, and best-effort queues", "items": { "$comment": "max depth reached" }, @@ -39544,17 +41570,18 @@ }, "enabled": { "default": false, + "description": "Whether traffic shaping is enabled", "type": "boolean" }, "max_tx_kbps": { - "description": "Interface Transmit Cap in kbps", + "description": "Maximum transmit bandwidth for the interface, in Kbps", "type": "integer" } }, "type": "object" }, "usage": { - "description": "port usage name. enum: `ha_control`, `ha_data`, `lan`, `wan`", + "description": "Logical usage assigned to the port", "enum": [ "ha_control", "ha_data", @@ -39564,7 +41591,7 @@ "type": "string" }, "vlan_id": { - "description": "If WAN interface is on a VLAN. Can be the VLAN ID (i.e. \\"10\\") or a Variable (i.e. \\"{{myvar}}\\")", + "description": "VLAN ID or variable used when the WAN interface is carried on a VLAN", "oneOf": [ { "type": "string" @@ -39579,6 +41606,7 @@ "vpn_paths": { "additionalProperties": { "additionalProperties": false, + "description": "VPN path settings for traffic that uses a gateway port", "properties": { "bfd_profile": { "$comment": "max depth reached" @@ -39598,12 +41626,12 @@ }, "type": "object" }, - "description": "Property key is the VPN name", + "description": "Per-VPN path settings for traffic that uses this port", "type": "object" }, "wan_arp_policer": { "default": "default", - "description": "Only when `wan_type`==`broadband`. enum: `default`, `max`, `recommended`", + "description": "Only when `wan_type`==`broadband`. ARP policer profile applied to the WAN port", "enum": [ "default", "max", @@ -39628,8 +41656,10 @@ "wan_extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv4 route for a WAN interface", "properties": { "via": { + "description": "IPv4 next-hop address for this WAN extra route", "format": "ipv4", "type": "string" } @@ -39642,8 +41672,10 @@ "wan_extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv6 route for a WAN interface", "properties": { "via": { + "description": "IPv6 next-hop address for this WAN extra route", "format": "ipv6", "type": "string" } @@ -39654,7 +41686,7 @@ "type": "object" }, "wan_networks": { - "description": "Only if `usage`==`wan`. If some networks are connected to this WAN port, it can be added here so policies can be defined", + "description": "Only if `usage`==`wan`. Networks reachable through this WAN port for policy definition", "items": { "type": "string" }, @@ -39662,9 +41694,10 @@ }, "wan_probe_override": { "additionalProperties": false, - "description": "Only if `usage`==`wan`", + "description": "Optional WAN health probe override settings for this port", "properties": { "ip6s": { + "description": "List of IPv6 probe host addresses used by this WAN override", "items": { "$comment": "max depth reached" }, @@ -39672,6 +41705,7 @@ "uniqueItems": true }, "ips": { + "description": "List of IPv4 probe host addresses used by this WAN override", "items": { "$comment": "max depth reached" }, @@ -39680,7 +41714,7 @@ }, "probe_profile": { "default": "broadband", - "description": "enum: `broadband`, `lte`", + "description": "WAN probe profile used for health checks on this port", "enum": [ "broadband", "lte" @@ -39692,7 +41726,7 @@ }, "wan_source_nat": { "additionalProperties": false, - "description": "Only if `usage`==`wan`, optional. By default, source-NAT is performed on all WAN Ports using the interface-ip", + "description": "Source NAT settings applied to traffic leaving this WAN port", "properties": { "disabled": { "default": false, @@ -39718,7 +41752,7 @@ }, "wan_speedtest_mode": { "default": "auto", - "description": "Controls whether Marvis/scheduler can run speedtest on this port. enum: `auto`, `enabled`, `disabled`", + "description": "Controls whether Marvis or the scheduler can run speed tests on this WAN port", "enum": [ "auto", "enabled", @@ -39731,7 +41765,7 @@ }, "wan_type": { "default": "broadband", - "description": "Only if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`", + "description": "Only if `usage`==`wan`. WAN uplink type configured on the port", "enum": [ "broadband", "dsl", @@ -39758,9 +41792,10 @@ "routing_policies": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway routing policy made of ordered match-action terms", "properties": { "terms": { - "description": "zero or more criteria/filter can be specified to match the term, all criteria have to be met", + "description": "Ordered terms evaluated by this gateway routing policy", "items": { "$comment": "max depth reached" }, @@ -39770,15 +41805,17 @@ }, "type": "object" }, - "description": "Property key is the routing policy name", + "description": "Routing policy defaults applied by this gateway template", "type": "object" }, "service_policies": { + "description": "Traffic service policy defaults enforced by this gateway template", "items": { "additionalProperties": false, + "description": "Site-level service policy that allows or denies traffic for tenants and services", "properties": { "action": { - "description": "enum: `allow`, `deny`", + "description": "Allow or deny action for traffic matched by this service policy", "enum": [ "allow", "deny" @@ -39787,19 +41824,20 @@ }, "antivirus": { "additionalProperties": false, - "description": "For SRX-only", + "description": "Malware and virus inspection settings applied by this service policy", "properties": { "avprofile_id": { - "description": "org-level AV Profile can be used, this takes precedence over 'profile'", + "description": "Organization-level antivirus profile ID; takes precedence over inline `profile` settings", "format": "uuid", "type": "string" }, "enabled": { "default": false, + "description": "Whether antivirus inspection is enabled for the service policy", "type": "boolean" }, "profile": { - "description": "Default / noftp / httponly / or keys from av_profiles", + "description": "Antivirus profile name to apply, such as `default`, `noftp`, `httponly`, or an AV profile key", "type": "string" } }, @@ -39807,16 +41845,18 @@ }, "appqoe": { "additionalProperties": false, - "description": "SRX only", + "description": "Application QoE settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether application QoE is enabled for the service policy", "type": "boolean" } }, "type": "object" }, "ewf": { + "description": "Enhanced web filtering rules applied by this service policy", "items": { "$comment": "max depth reached" }, @@ -39824,12 +41864,15 @@ }, "idp": { "additionalProperties": false, + "description": "Intrusion detection and prevention settings applied by this service policy", "properties": { "alert_only": { + "description": "Whether to alert without enforcing IDP prevention actions", "type": "boolean" }, "enabled": { "default": false, + "description": "Whether IDP inspection is enabled for the policy", "type": "boolean" }, "idpprofile_id": { @@ -39849,10 +41892,11 @@ "type": "object" }, "local_routing": { - "description": "access within the same VRF", + "description": "Whether the policy permits access within the same VRF", "type": "boolean" }, "name": { + "description": "Display name of the service policy", "type": "string" }, "path_preference": { @@ -39861,28 +41905,31 @@ }, "secintel": { "additionalProperties": false, - "description": "SRX only", + "description": "Threat intelligence settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether SecIntel inspection is enabled for the service policy", "type": "boolean" }, "profile": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Protection level applied by SecIntel inspection" }, "secintelprofile_id": { - "description": "org-level secintel Profile can be used, this takes precedence over 'profile'", + "description": "Organization-level SecIntel profile ID; takes precedence over inline `profile` settings", "type": "string" } }, "type": "object" }, "servicepolicy_id": { - "description": "Used to link servicepolicy defined at org level and overwrite some attributes", + "description": "Organization-level service policy identifier used to link and override selected attributes", "format": "uuid", "type": "string" }, "services": { + "description": "Application services or service groups matched by this policy", "items": { "type": "string" }, @@ -39891,32 +41938,38 @@ }, "skyatp": { "additionalProperties": false, - "description": "SRX only", + "description": "Threat inspection settings provided by Sky ATP for this service policy", "properties": { "dns_dga_detection": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Detection settings for DNS DGA threats provided by Sky ATP" }, "dns_tunnel_detection": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Detection settings for DNS tunneling threats provided by Sky ATP" }, "http_inspection": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Web traffic inspection settings provided by Sky ATP" }, "iot_device_policy": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Device threat policy settings provided by Sky ATP for IoT clients" } }, "type": "object" }, "ssl_proxy": { "additionalProperties": false, - "description": "For SRX-only", + "description": "TLS inspection settings applied by this service policy", "properties": { "ciphers_category": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Allowed cipher strength category for SSL proxy inspection" }, "enabled": { "default": false, + "description": "Whether SSL proxy inspection is enabled for the service policy", "type": "boolean" } }, @@ -39924,13 +41977,15 @@ }, "syslog": { "additionalProperties": false, - "description": "Required for syslog logging", + "description": "Remote logging settings applied by this service policy", "properties": { "enabled": { "default": false, + "description": "Whether syslog logging is enabled for the service policy", "type": "boolean" }, "server_names": { + "description": "Names of syslog servers that receive logs for this service policy", "examples": [ [ "dc_syslog_server" @@ -39945,6 +42000,7 @@ "type": "object" }, "tenants": { + "description": "User or network tenants matched by this service policy", "items": { "type": "string" }, @@ -39959,10 +42015,11 @@ "tunnel_configs": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway tunnel configuration for provider-managed or custom tunnels", "properties": { "auto_provision": { "additionalProperties": false, - "description": "Auto Provisioning configuration for the tunne. This takes precedence over the `primary` and `secondary` nodes.", + "description": "Provider auto-provisioning settings for tunnel endpoints", "properties": { "enabled": { "description": "Enable auto provisioning for the tunnel. If enabled, the `primary` and `secondary` nodes will be ignored.", @@ -39970,7 +42027,7 @@ }, "latlng": { "additionalProperties": false, - "description": "API override for POP selection", + "description": "Geographic coordinate override used for tunnel POP selection", "properties": { "lat": { "$comment": "max depth reached" @@ -39986,6 +42043,7 @@ "type": "object" }, "primary": { + "description": "Main auto-provisioned tunnel endpoint settings", "properties": { "probe_ips": { "$comment": "max depth reached" @@ -39996,7 +42054,7 @@ } }, "provider": { - "description": "enum: `jse-ipsec`, `zscaler-ipsec`", + "description": "Tunnel provider used for automatic endpoint provisioning", "enum": [ "jse-ipsec", "zscaler-ipsec" @@ -40008,6 +42066,7 @@ "type": "string" }, "secondary": { + "description": "Backup auto-provisioned tunnel endpoint settings", "properties": { "probe_ips": { "$comment": "max depth reached" @@ -40031,12 +42090,12 @@ "type": "object" }, "ike_lifetime": { - "description": "Only if `provider`==`custom-ipsec`", + "description": "Only if `provider`==`custom-ipsec`. IKE lifetime configured for the custom IPsec tunnel", "type": "integer" }, "ike_mode": { "default": "main", - "description": "Only if `provider`==`custom-ipsec`. enum: `aggressive`, `main`", + "description": "Only if `provider`==`custom-ipsec`. IKE negotiation mode for the tunnel", "enum": [ "aggressive", "main" @@ -40044,9 +42103,10 @@ "type": "string" }, "ike_proposals": { - "description": "If `provider`==`custom-ipsec`", + "description": "If `provider`==`custom-ipsec`, IKE proposals used for custom IPsec negotiation", "items": { "additionalProperties": false, + "description": "IKE proposal settings for custom IPsec tunnels", "properties": { "auth_algo": { "$comment": "max depth reached" @@ -40063,13 +42123,14 @@ "type": "array" }, "ipsec_lifetime": { - "description": "If `provider`==`custom-ipsec`", + "description": "If `provider`==`custom-ipsec`, IPsec lifetime configured for the custom tunnel", "type": "integer" }, "ipsec_proposals": { - "description": "Only if `provider`==`custom-ipsec`", + "description": "Only if `provider`==`custom-ipsec`. IPsec proposals used for custom IPsec negotiation", "items": { "additionalProperties": false, + "description": "IPsec proposal settings for custom IPsec tunnels", "properties": { "auth_algo": { "$comment": "max depth reached" @@ -40090,7 +42151,7 @@ "type": "string" }, "local_subnets": { - "description": "List of Local protected subnet for policy-based IPSec negotiation", + "description": "Local protected subnets advertised by this tunnel", "items": { "type": "string" }, @@ -40098,7 +42159,7 @@ }, "mode": { "default": "active-standby", - "description": "Required if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`. enum: `active-active`, `active-standby`", + "description": "Tunnel failover mode used for primary and secondary endpoints", "enum": [ "active-active", "active-standby" @@ -40106,7 +42167,7 @@ "type": "string" }, "networks": { - "description": "If `provider`==`custom-ipsec` or `provider`==`prisma-ipsec`, networks reachable via this tunnel", + "description": "Destination networks reachable through this tunnel", "items": { "type": "string" }, @@ -40114,22 +42175,24 @@ }, "primary": { "additionalProperties": false, - "description": "Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "Main remote tunnel endpoint settings", "properties": { "hosts": { + "description": "Remote gateway host addresses for this tunnel node", "items": { "$comment": "max depth reached" }, "type": "array" }, "internal_ips": { - "description": "Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`", + "description": "Internal IP addresses configured on this tunnel node", "items": { "$comment": "max depth reached" }, "type": "array" }, "probe_ips": { + "description": "Health-check IP addresses used to monitor this tunnel node", "items": { "$comment": "max depth reached" }, @@ -40137,13 +42200,14 @@ "uniqueItems": true }, "remote_ids": { - "description": "Only if `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "IKE identities expected from this tunnel node", "items": { "$comment": "max depth reached" }, "type": "array" }, "wan_names": { + "description": "Interface names that source tunnel traffic for this node", "items": { "$comment": "max depth reached" }, @@ -40158,7 +42222,7 @@ }, "probe": { "additionalProperties": false, - "description": "Only if `provider`==`custom-ipsec`", + "description": "Tunnel health probe settings", "properties": { "interval": { "description": "How often to trigger the probe", @@ -40174,7 +42238,7 @@ }, "type": { "default": "icmp", - "description": "enum: `http`, `icmp`", + "description": "Protocol used by the custom IPsec tunnel health probe", "enum": [ "http", "icmp" @@ -40185,7 +42249,7 @@ "type": "object" }, "protocol": { - "description": "Only if `provider`==`custom-ipsec`. enum: `gre`, `ipsec`", + "description": "Only if `provider`==`custom-ipsec`. Tunnel protocol for custom tunnel negotiation", "enum": [ "gre", "ipsec" @@ -40193,7 +42257,7 @@ "type": "string" }, "provider": { - "description": "Only if `auto_provision.enabled`==`false`. enum: `custom-ipsec`, `custom-gre`, `jse-ipsec`, `prisma-ipsec`, `zscaler-gre`, `zscaler-ipsec`", + "description": "Tunnel provider used when auto provisioning is disabled", "enum": [ "custom-ipsec", "custom-gre", @@ -40209,7 +42273,7 @@ "type": "string" }, "remote_subnets": { - "description": "List of Remote protected subnet for policy-based IPSec negotiation", + "description": "Remote protected subnets reached through policy-based IPsec", "items": { "type": "string" }, @@ -40217,22 +42281,24 @@ }, "secondary": { "additionalProperties": false, - "description": "Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "Backup remote tunnel endpoint settings", "properties": { "hosts": { + "description": "Remote gateway host addresses for this tunnel node", "items": { "$comment": "max depth reached" }, "type": "array" }, "internal_ips": { - "description": "Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`", + "description": "Internal IP addresses configured on this tunnel node", "items": { "$comment": "max depth reached" }, "type": "array" }, "probe_ips": { + "description": "Health-check IP addresses used to monitor this tunnel node", "items": { "$comment": "max depth reached" }, @@ -40240,13 +42306,14 @@ "uniqueItems": true }, "remote_ids": { - "description": "Only if `provider`==`jse-ipsec` or `provider`==`custom-ipsec`", + "description": "IKE identities expected from this tunnel node", "items": { "$comment": "max depth reached" }, "type": "array" }, "wan_names": { + "description": "Interface names that source tunnel traffic for this node", "items": { "$comment": "max depth reached" }, @@ -40261,7 +42328,7 @@ }, "version": { "default": "2", - "description": "Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. enum: `1`, `2`", + "description": "Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. Tunnel version value for custom tunnel configuration", "enum": [ "1", "2" @@ -40276,12 +42343,14 @@ }, "tunnel_provider_options": { "additionalProperties": false, + "description": "Provider-specific tunnel options defined by this gateway template", "properties": { "jse": { "additionalProperties": false, - "description": "For jse-ipsec, this allows provisioning of adequate resource on JSE. Make sure adequate licenses are added", + "description": "Juniper Secure Edge provisioning options for tunnel endpoints", "properties": { "num_users": { + "description": "User capacity to provision on Juniper Secure Edge", "examples": [ 5 ], @@ -40299,6 +42368,7 @@ }, "prisma": { "additionalProperties": false, + "description": "Palo Alto Prisma Access provisioning options for tunnel endpoints", "properties": { "service_account_name": { "description": "For prisma-ipsec, service account name to used for tunnel auto provisioning", @@ -40312,10 +42382,11 @@ }, "zscaler": { "additionalProperties": false, - "description": "For zscaler-ipsec and zscaler-gre", + "description": "Provider settings for Zscaler tunnel endpoints", "properties": { "aup_block_internet_until_accepted": { "default": false, + "description": "Whether Zscaler blocks internet access until the Acceptable Use Policy is accepted", "type": "boolean" }, "aup_enabled": { @@ -40369,7 +42440,7 @@ "type": "boolean" }, "sub_locations": { - "description": "`sub-locations` can be used for specific uses cases to define different configuration based on the user network", + "description": "Per-network Zscaler sub-location settings", "items": { "$comment": "max depth reached" }, @@ -40416,7 +42487,7 @@ }, "type": { "default": "standalone", - "description": "enum: `spoke`, `standalone`", + "description": "Gateway template deployment type", "enum": [ "spoke", "standalone" @@ -40436,6 +42507,7 @@ }, "vrf_config": { "additionalProperties": false, + "description": "VRF defaults applied by this gateway template", "properties": { "enabled": { "description": "Whether to enable VRF (when supported on the device)", @@ -40447,6 +42519,7 @@ "vrf_instances": { "additionalProperties": { "additionalProperties": false, + "description": "Gateway VRF instance and its member networks", "examples": [ { "networks": [ @@ -40457,6 +42530,7 @@ ], "properties": { "networks": { + "description": "Network names included in this gateway VRF instance", "items": { "type": "string" }, @@ -40466,7 +42540,7 @@ }, "type": "object" }, - "description": "Property key is the network name", + "description": "VRF instances configured by this gateway template", "examples": [ { "CORP_VRF": { @@ -40486,7 +42560,7 @@ "type": "object" }, "gateway_additional_config_cmds": { - "description": "additional CLI commands to append to the generated Junos config. **Note**: no check is done", + "description": "Additional CLI configuration commands applied to gateways at the site", "items": { "description": "JUNOS \\"set\\" command to add to the generated configuration", "examples": [ @@ -40498,10 +42572,10 @@ }, "gateway_mgmt": { "additionalProperties": false, - "description": "Gateway Management settings", + "description": "Management access settings for gateways at the site", "properties": { "admin_sshkeys": { - "description": "For SSR only, as direct root access is not allowed", + "description": "SSR-only SSH public keys for administrative access", "examples": [ [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA...Wxa6p6UW0ZbcP john@host" @@ -40514,9 +42588,10 @@ }, "app_probing": { "additionalProperties": false, + "description": "Application probing configuration for gateway monitoring", "properties": { "apps": { - "description": "APp-keys from [List Applications](/#operations/listApplications)", + "description": "Predefined application keys to probe", "examples": [ [ "facebook" @@ -40528,54 +42603,63 @@ "type": "array" }, "custom_apps": { + "description": "User-defined application probe definitions", "items": { "additionalProperties": false, + "description": "User-defined application probe definition", "properties": { "address": { - "description": "Required if `protocol`==`icmp`", + "description": "Required if `protocol`==`icmp`. IP address probed by the ICMP custom app", "examples": [ "192.168.1.1" ], "type": "string" }, "app_type": { + "description": "Category label used for this custom application probe", "type": "string" }, "hostnames": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "If `protocol`==`http`. Hostnames or URLs probed by this custom app" }, "key": { + "description": "Stable key used to identify this custom application probe", "type": "string" }, "name": { + "description": "Display name for this custom application probe", "examples": [ "pos_app" ], "type": "string" }, "network": { + "description": "Gateway network used as the source context for this probe", "examples": [ "lan" ], "type": "string" }, "packetSize": { - "description": "If `protocol`==`icmp`", + "description": "If `protocol`==`icmp`. ICMP packet size used by this custom app probe", "maximum": 65400, "minimum": 0, "type": "integer" }, "protocol": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Probe protocol used by this custom application definition" }, "url": { - "description": "If `protocol`==`http`", + "description": "If `protocol`==`http`. HTTP URL or hostname probed by this custom app", "examples": [ "www.abc.com" ], "type": "string" }, "vrf": { + "description": "Gateway VRF used as the source context for this probe", "examples": [ "lan" ], @@ -40587,6 +42671,7 @@ "type": "array" }, "enabled": { + "description": "Whether gateway application probing is enabled", "type": "boolean" } }, @@ -40598,9 +42683,10 @@ }, "auto_signature_update": { "additionalProperties": false, + "description": "Schedule for automatic security signature updates", "properties": { "day_of_week": { - "description": "enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`", + "description": "Scheduled weekday for automatic signature updates", "enum": [ "any", "fri", @@ -40615,6 +42701,7 @@ }, "enable": { "default": true, + "description": "Whether automatic security signature updates are enabled", "type": "boolean" }, "time_of_day": { @@ -40648,9 +42735,11 @@ }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the gateway", "type": "boolean" }, "probe_hosts": { + "description": "IPv4 probe targets used for gateway connectivity checks", "examples": [ [ "8.8.8.8" @@ -40663,6 +42752,7 @@ "type": "array" }, "probe_hostsv6": { + "description": "IPv6 probe targets used for gateway connectivity checks", "examples": [ [ "2001:4860:4860::8888" @@ -40676,10 +42766,10 @@ }, "protect_re": { "additionalProperties": false, - "description": "Restrict inbound-traffic to host\\nwhen enabled, all traffic that is not essential to our operation will be dropped \\ne.g. ntp / dns / traffic to mist will be allowed by default, if dhcpd is enabled, we'll make sure it works", + "description": "Control-plane protection settings for the gateway", "properties": { "allowed_services": { - "description": "Optionally, services we'll allow", + "description": "Built-in services explicitly allowed by the Protect RE policy", "examples": [ [ "icmp", @@ -40687,7 +42777,7 @@ ] ], "items": { - "description": "enum: `icmp`, `ssh`", + "description": "Services allowed through protect-RE filters. enum: `icmp`, `ssh`", "enum": [ "icmp", "ssh" @@ -40697,9 +42787,10 @@ "type": "array" }, "custom": { + "description": "Additional ACL entries allowed by the Protect RE policy", "items": { "additionalProperties": false, - "description": "Custom acls", + "description": "Custom Protect RE ACL entry", "properties": { "port_range": { "default": "0", @@ -40710,10 +42801,12 @@ "type": "string" }, "protocol": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Transport protocol matched by this custom Protect RE ACL" }, "subnets": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source subnets matched by this custom Protect RE ACL" } }, "type": "object" @@ -40731,7 +42824,7 @@ "type": "boolean" }, "trusted_hosts": { - "description": "host/subnets we'll allow traffic to/from", + "description": "Trusted host or subnet entries allowed by the Protect RE policy", "items": { "examples": [ "10.242.3.0/24" @@ -40744,11 +42837,12 @@ "type": "object" }, "root_password": { - "description": "SRX only", + "description": "SRX only. Root password for local gateway access", "format": "password", "type": "string" }, "security_log_source_address": { + "description": "IPv4 source address used for gateway security log traffic", "examples": [ "192.168.1.1" ], @@ -40756,6 +42850,7 @@ "type": "string" }, "security_log_source_interface": { + "description": "Source interface used for gateway security log traffic", "examples": [ "ge-0/0/1.0" ], @@ -40789,7 +42884,7 @@ ] }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique value identifying the site settings object", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -40799,15 +42894,16 @@ }, "iotproxy": { "additionalProperties": false, - "description": "IoT proxy configuration for the site", + "description": "Proxy settings for IoT traffic at the site", "properties": { "enabled": { "default": false, + "description": "Whether the site IoT proxy is enabled", "type": "boolean" }, "visionline": { "additionalProperties": false, - "description": "Visionline integration settings for IoT proxy", + "description": "Site access-control integration settings for Visionline", "properties": { "access_id": { "description": "Access ID for the Visionline service", @@ -40818,17 +42914,18 @@ }, "enabled": { "default": false, + "description": "Whether the Visionline integration is enabled", "type": "boolean" }, "host": { - "description": "Hostname or IP of the Visionline collector", + "description": "Collector hostname or IP address for Visionline", "examples": [ "visionline_collector1.local" ], "type": "string" }, "password": { - "description": "Password for the Visionline service", + "description": "Visionline service password used by the IoT proxy", "format": "password", "type": "string" }, @@ -40838,7 +42935,7 @@ "type": "integer" }, "username": { - "description": "Username for the Visionline service", + "description": "Visionline service username used by the IoT proxy", "examples": [ "card_administrator" ], @@ -40852,10 +42949,11 @@ }, "juniper_srx": { "additionalProperties": false, + "description": "SRX integration settings for the site", "properties": { "auto_upgrade": { "additionalProperties": false, - "description": "auto_upgrade device first time it is onboarded", + "description": "SRX auto-upgrade settings applied when SRX devices are onboarded", "properties": { "custom_versions": { "additionalProperties": { @@ -40865,15 +42963,17 @@ ], "type": "string" }, - "description": "Property key is the SRX Hardware model (e.g. \\"SRX4600\\")", + "description": "Per-SRX-model firmware versions to deploy instead of the default version", "type": "object" }, "enabled": { "default": false, + "description": "Whether SRX auto-upgrade is enabled for newly onboarded devices", "type": "boolean" }, "snapshot": { "default": false, + "description": "Whether to take a snapshot during the SRX upgrade process", "type": "boolean" }, "version": { @@ -40887,22 +42987,27 @@ "type": "object" }, "gateways": { + "description": "SRX gateways integrated with this site", "items": { "additionalProperties": false, + "description": "Juniper SRX gateway API connection settings", "properties": { "api_key": { + "description": "Authentication key used to access the Juniper SRX gateway API", "examples": [ "5abf7c8a-1a1c-4398-ba2d-b0c297094d1a" ], "type": "string" }, "api_password": { + "description": "Authentication password used to access the Juniper SRX gateway API", "examples": [ "abc@123" ], "type": "string" }, "api_url": { + "description": "Base URL for the Juniper SRX gateway API", "examples": [ "https://23.43.12.78:8443" ], @@ -40914,6 +43019,7 @@ "type": "array" }, "send_mist_nac_user_info": { + "description": "Whether Mist NAC user information is sent to Juniper SRX gateways", "type": "boolean" } }, @@ -40921,10 +43027,11 @@ }, "led": { "additionalProperties": false, - "description": "LED AP settings", + "description": "AP LED behavior configured for the site", "properties": { "brightness": { "default": 255, + "description": "Indicator LED brightness level from 0 to 255", "examples": [ 255 ], @@ -40934,6 +43041,7 @@ }, "enabled": { "default": true, + "description": "Whether the AP indicator LED is enabled", "type": "boolean" } }, @@ -40941,44 +43049,55 @@ }, "marvis": { "additionalProperties": false, + "description": "AI assistant settings for Marvis at the site", "properties": { "auto_operations": { "additionalProperties": false, + "description": "Automatic remediation operations controlled by Marvis", "properties": { "ap_insufficient_capacity": { "default": false, + "description": "Whether Marvis may remediate AP insufficient-capacity issues automatically", "type": "boolean" }, "ap_loop": { "default": false, + "description": "Whether Marvis may remediate AP loop issues automatically", "type": "boolean" }, "ap_non_compliant": { "default": false, + "description": "Whether Marvis may remediate AP non-compliance automatically", "type": "boolean" }, "bounce_port_for_abnormal_poe_client": { "default": false, + "description": "Whether Marvis may bounce switch ports for abnormal PoE clients", "type": "boolean" }, "disable_port_when_ddos_protocol_violation": { "default": false, + "description": "Whether Marvis may disable a port when DDOS protocol violations are detected", "type": "boolean" }, "disable_port_when_rogue_dhcp_server_detected": { "default": false, + "description": "Whether Marvis may disable a port when a rogue DHCP server is detected", "type": "boolean" }, "gateway_non_compliant": { "default": false, + "description": "Whether Marvis may remediate non-compliant gateways automatically", "type": "boolean" }, "switch_misconfigured_port": { "default": false, + "description": "Whether Marvis may remediate misconfigured switch ports automatically", "type": "boolean" }, "switch_port_stuck": { "default": false, + "description": "Whether Marvis may remediate stuck switch ports automatically", "type": "boolean" } }, @@ -40989,35 +43108,38 @@ }, "mist_nac": { "additionalProperties": false, - "description": "Enable mist_nac to use RadSec", + "description": "Network access control settings for switches at the site", "properties": { "enabled": { + "description": "Whether Mist NAC RadSec is enabled for the switch", "type": "boolean" }, "network": { + "description": "Switch network used for Mist NAC RadSec connectivity", "type": "string" } }, "type": "object" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the site settings were last modified", "format": "double", "readOnly": true, "type": "number" }, "mxedge": { "additionalProperties": false, - "description": "Site Mist Edges form a cluster of RadSec Proxy servers", + "description": "Site Mist Edge service settings", "properties": { "mist_das": { "additionalProperties": false, - "description": "Configure cloud-assisted dynamic authorization service on this cluster of mist edges", + "description": "DAS service settings for the site Mist Edge cluster", "properties": { "coa_servers": { - "description": "Dynamic authorization clients configured to send CoA|DM to mist edges on port 3799", + "description": "Dynamic authorization clients allowed to send CoA or Disconnect-Message requests", "items": { "additionalProperties": false, + "description": "CoA or Disconnect-Message client allowed to contact Mist Edge DAS", "properties": { "disable_event_timestamp_check": { "default": false, @@ -41025,15 +43147,16 @@ "type": "boolean" }, "enabled": { + "description": "Whether this DAS CoA or Disconnect-Message client is enabled", "type": "boolean" }, "host": { - "description": "This server configured to send CoA|DM to mist edges", + "description": "Server host allowed to send CoA or Disconnect-Message requests to Mist Edges", "type": "string" }, "port": { "default": 3799, - "description": "Mist edges will allow this host on this port", + "description": "UDP port where Mist Edges accept CoA or Disconnect-Message requests from this host", "type": "integer" }, "require_message_authenticator": { @@ -41042,6 +43165,7 @@ "type": "boolean" }, "secret": { + "description": "Shared secret used by this DAS CoA or Disconnect-Message client", "format": "password", "type": "string" } @@ -41052,6 +43176,7 @@ }, "enabled": { "default": false, + "description": "Whether cloud-assisted DAS is enabled for the Mist Edge cluster", "type": "boolean" } }, @@ -41059,19 +43184,23 @@ }, "mist_nac": { "additionalProperties": false, + "description": "RADIUS settings for Mist NAC on the site Mist Edge cluster", "properties": { "acct_server_port": { "default": 1813, + "description": "RADIUS accounting port used by Mist NAC on the cluster", "type": "integer" }, "auth_server_port": { "default": 1812, + "description": "RADIUS authentication port used by Mist NAC on the cluster", "type": "integer" }, "client_ips": { "additionalProperties": { "additionalProperties": { "additionalProperties": false, + "description": "Mist NAC client settings for a RADIUS client IP or subnet", "properties": { "require_message_authenticator": { "$comment": "max depth reached" @@ -41088,6 +43217,7 @@ }, "type": "object" }, + "description": "Mist NAC client settings keyed by RADIUS client IP address or subnet", "type": "object" }, "description": "Property key is the RADIUS Client IP/Subnet.", @@ -41095,9 +43225,11 @@ }, "enabled": { "default": false, + "description": "Whether Mist NAC is enabled on the cluster", "type": "boolean" }, "secret": { + "description": "Shared RADIUS secret used by Mist NAC clients", "examples": [ "testing123" ], @@ -41108,6 +43240,7 @@ }, "mist_nacedge": { "additionalProperties": false, + "description": "NAC Edge service settings for the site Mist Edge cluster", "properties": { "auth_ttl": { "default": 604800, @@ -41131,10 +43264,11 @@ "type": "string" }, "enabled": { + "description": "Whether Mist Site Survivability is enabled for the site", "type": "boolean" }, "mxedge_hosts": { - "description": "List of NAC Edges in this site", + "description": "NAC Edge hostnames used for the Site Survivability feature", "examples": [ [ "mxedge1.local" @@ -41150,12 +43284,13 @@ }, "radsec": { "additionalProperties": false, - "description": "MxEdge RadSec Configuration", + "description": "TLS-secured RADIUS proxy settings for the site Mist Edge cluster", "properties": { "acct_servers": { - "description": "List of RADIUS accounting servers, optional, order matters where the first one is treated as primary", + "description": "RADIUS accounting servers used by the RadSec proxy", "items": { "additionalProperties": false, + "description": "RadSec accounting server settings for a Mist Edge cluster", "properties": { "host": { "description": "IP / hostname of RADIUS server", @@ -41167,12 +43302,13 @@ "type": "integer" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS accounting server", "format": "password", "type": "string" }, "ssids": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "WLAN SSID filters that use this accounting server when matching is enabled" } }, "type": "object" @@ -41181,9 +43317,10 @@ "uniqueItems": true }, "auth_servers": { - "description": "List of RADIUS authentication servers, order matters where the first one is treated as primary", + "description": "RADIUS authentication servers used by the RadSec proxy", "items": { "additionalProperties": false, + "description": "RadSec authentication server settings for a Mist Edge cluster", "properties": { "host": { "description": "IP / hostname of RADIUS server", @@ -41205,7 +43342,8 @@ "type": "boolean" }, "keywrap_format": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Encoding format for Mist AP RADIUS keywrap keys" }, "keywrap_kek": { "description": "If used for Mist APs, encryption key", @@ -41222,16 +43360,17 @@ }, "retry": { "default": 2, - "description": "Authentication request retry", + "description": "Number of authentication request retries before failing over", "type": "integer" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS authentication server", "format": "password", "type": "string" }, "ssids": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "WLAN SSID filters that use this authentication server when matching is enabled" }, "timeout": { "default": 5, @@ -41254,7 +43393,7 @@ }, "nas_ip_source": { "default": "any", - "description": "SSpecify NAS-IP-ADDRESS, NAS-IPv6-ADDRESS to use with auth_servers. enum: `any`, `oob`, `oob6`, `tunnel`, `tunnel6`", + "description": "Source used to populate NAS-IP-Address and NAS-IPv6-Address attributes", "enum": [ "any", "oob", @@ -41265,7 +43404,7 @@ "type": "string" }, "proxy_hosts": { - "description": "Hostnames or IPs for Mist AP to use as the TLS Server (i.e. they are reachable from AP) in addition to `tunterm_hosts`", + "description": "AP-reachable hostnames or IP addresses advertised as RadSec TLS servers", "items": { "type": "string" }, @@ -41273,7 +43412,7 @@ }, "server_selection": { "default": "ordered", - "description": "When ordered, Mist Edge will prefer and go back to the first radius server if possible. enum: `ordered`, `unordered`", + "description": "RADIUS server selection strategy for RadSec failover", "enum": [ "ordered", "unordered" @@ -41282,7 +43421,7 @@ }, "src_ip_source": { "default": "any", - "description": "Specify IP address to connect to auth_servers and acct_servers. enum: `any`, `oob`, `oob6`, `tunnel`, `tunnel6`", + "description": "Connection source interface or address used when reaching RADIUS servers", "enum": [ "any", "oob", @@ -41300,16 +43439,20 @@ }, "mxedge_mgmt": { "additionalProperties": false, + "description": "Mist Edge management access settings for the site", "properties": { "config_auto_revert": { "default": false, + "description": "Whether the Mist Edge automatically reverts configuration changes if connectivity is lost", "type": "boolean" }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the Mist Edge", "type": "boolean" }, "mist_password": { + "description": "Password for the Mist service account on the Mist Edge", "examples": [ "MIST_PASSWORD" ], @@ -41317,7 +43460,7 @@ }, "oob_ip_type": { "default": "dhcp", - "description": "enum: `dhcp`, `disabled`, `static`", + "description": "IPv4 address assignment mode for out-of-band management", "enum": [ "dhcp", "disabled", @@ -41327,7 +43470,7 @@ }, "oob_ip_type6": { "default": "autoconf", - "description": "enum: `autoconf`, `dhcp`, `disabled`, `static`", + "description": "IPv6 address assignment mode for out-of-band management", "enum": [ "autoconf", "dhcp", @@ -41337,6 +43480,7 @@ "type": "string" }, "root_password": { + "description": "Root account password for the Mist Edge", "examples": [ "ROOT_PASSWORD" ], @@ -41348,14 +43492,15 @@ }, "mxtunnels": { "additionalProperties": false, - "description": "Site MxTunnel", + "description": "Site Mist Tunnel configuration", "properties": { "additional_mxtunnels": { "additionalProperties": { "additionalProperties": false, + "description": "Additional named Mist Tunnel configuration for a site", "properties": { "clusters": { - "description": "For AP, how to connect to tunterm or RadSec Proxy", + "description": "Tunnel peer clusters used by APs for this additional Mist Tunnel", "items": { "$comment": "max depth reached" }, @@ -41373,6 +43518,7 @@ }, "hello_retries": { "default": 7, + "description": "Number of missed hello heartbeats before an AP tries another tunnel peer", "examples": [ 3 ], @@ -41381,7 +43527,7 @@ "type": "integer" }, "protocol": { - "description": "enum: `ip`, `udp`", + "description": "Encapsulation protocol used for this additional Mist Tunnel", "enum": [ "ip", "udp" @@ -41392,6 +43538,7 @@ "type": "string" }, "vlan_ids": { + "description": "List of VLAN IDs carried by this additional Mist Tunnel", "examples": [ [ 300, @@ -41407,10 +43554,11 @@ }, "type": "object" }, + "description": "Additional named Mist Tunnel definitions configured for the site", "type": "object" }, "ap_subnets": { - "description": "List of subnets where we allow AP to establish Mist Tunnels from", + "description": "AP source subnets allowed to establish Mist Tunnels", "items": { "examples": [ "0.0.0.0/0" @@ -41421,10 +43569,10 @@ }, "auto_preemption": { "additionalProperties": false, - "description": "Schedule to preempt ap’s which are not connected to preferred peer", + "description": "Preemption behavior for restoring preferred tunnel peers after failover", "properties": { "day_of_week": { - "description": "enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`", + "description": "Scheduled weekday for auto preemption", "enum": [ "any", "fri", @@ -41439,12 +43587,12 @@ }, "enabled": { "default": false, - "description": "Whether auto preemption should happen", + "description": "Whether auto preemption is enabled", "type": "boolean" }, "time_of_day": { "default": "any", - "description": "`any` / HH:MM (24-hour format)", + "description": "Scheduled time of day for auto preemption", "examples": [ "12:00" ], @@ -41454,17 +43602,20 @@ "type": "object" }, "clusters": { - "description": "For AP, how to connect to tunterm or RadSec Proxy", + "description": "Tunnel peer clusters used by APs for this site Mist Tunnel", "items": { "additionalProperties": false, + "description": "Mist Tunnel peer cluster definition for a site", "properties": { "name": { + "description": "Peer cluster name used in the site Mist Tunnel configuration", "examples": [ "primary" ], "type": "string" }, "tunterm_hosts": { + "description": "Tunnel termination hostnames or IP addresses in this peer cluster", "examples": [ [ "mxedge1", @@ -41482,15 +43633,17 @@ "type": "array" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the site Mist Tunnel configuration was created", "format": "double", "readOnly": true, "type": "number" }, "enabled": { + "description": "Whether site Mist Tunnel tunneling is enabled", "type": "boolean" }, "for_site": { + "description": "Whether this Mist Tunnel configuration is scoped to a site", "readOnly": true, "type": "boolean" }, @@ -41506,6 +43659,7 @@ }, "hello_retries": { "default": 7, + "description": "Number of missed hello heartbeats before an AP tries another tunnel peer", "examples": [ 3 ], @@ -41514,14 +43668,14 @@ "type": "integer" }, "hosts": { - "description": "Hostnames or IPs where a Mist Tunnel will use as the Peer (i.e. they are reachable from AP)", + "description": "Tunnel peer hostnames or IP addresses reachable from APs", "items": { "type": "string" }, "type": "array" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique value identifying the site Mist Tunnel configuration", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -41530,7 +43684,7 @@ "type": "string" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the site Mist Tunnel configuration was last modified", "format": "double", "readOnly": true, "type": "number" @@ -41546,6 +43700,7 @@ "type": "integer" }, "org_id": { + "description": "Identifier of the org that owns the site Mist Tunnel configuration", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -41555,7 +43710,7 @@ }, "protocol": { "default": "udp", - "description": "enum: `ip`, `udp`", + "description": "Encapsulation protocol used for the site Mist Tunnel", "enum": [ "ip", "udp" @@ -41564,41 +43719,49 @@ }, "radsec": { "additionalProperties": false, + "description": "TLS-secured RADIUS proxy settings for the site Mist Tunnel", "properties": { "acct_servers": { + "description": "RADIUS accounting servers used by the site Mist Tunnel RadSec proxy", "items": { "additionalProperties": false, + "description": "RADIUS accounting server settings", "properties": { "host": { - "description": "IP/ hostname of RADIUS server", + "description": "Address or hostname of the RADIUS accounting server", "examples": [ "1.2.3.4" ], "type": "string" }, "keywrap_enabled": { + "description": "Whether RADIUS keywrap is enabled for messages sent to this accounting server", "type": "boolean" }, "keywrap_format": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Encoding format for RADIUS keywrap KEK and MACK values" }, "keywrap_kek": { + "description": "RADIUS keywrap key encryption key (KEK)", "examples": [ "1122334455" ], "type": "string" }, "keywrap_mack": { + "description": "RADIUS keywrap message authentication code key (MACK)", "examples": [ "1122334455" ], "type": "string" }, "port": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "UDP port used by the RADIUS accounting server" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS accounting server", "examples": [ "testing123" ], @@ -41615,37 +43778,43 @@ "type": "array" }, "auth_servers": { + "description": "RADIUS authentication servers used by the site Mist Tunnel RadSec proxy", "items": { "additionalProperties": false, - "description": "Authentication Server", + "description": "RADIUS authentication server settings", "properties": { "host": { - "description": "IP/ hostname of RADIUS server", + "description": "Address or hostname of the RADIUS authentication server", "examples": [ "1.2.3.4" ], "type": "string" }, "keywrap_enabled": { + "description": "Whether RADIUS keywrap is enabled for messages sent to this authentication server", "type": "boolean" }, "keywrap_format": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Encoding format for RADIUS keywrap KEK and MACK values" }, "keywrap_kek": { + "description": "RADIUS keywrap key encryption key (KEK)", "examples": [ "1122334455" ], "type": "string" }, "keywrap_mack": { + "description": "RADIUS keywrap message authentication code key (MACK)", "examples": [ "1122334455" ], "type": "string" }, "port": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "UDP port used by the RADIUS authentication server" }, "require_message_authenticator": { "default": false, @@ -41653,7 +43822,7 @@ "type": "boolean" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS authentication server", "examples": [ "testing123" ], @@ -41671,15 +43840,18 @@ }, "enabled": { "default": false, + "description": "Whether RadSec proxying is enabled for this site Mist Tunnel", "type": "boolean" }, "use_mxedge": { + "description": "Whether RadSec proxying uses Mist Edge", "type": "boolean" } }, "type": "object" }, "site_id": { + "description": "Identifier of the site that owns this Mist Tunnel configuration", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -41688,7 +43860,7 @@ "type": "string" }, "vlan_ids": { - "description": "List of vlan_ids that will be used", + "description": "List of VLAN IDs carried by this site Mist Tunnel", "items": { "type": "integer" }, @@ -41716,6 +43888,7 @@ "type": "boolean" }, "isolation_vlan_id": { + "description": "Required when `isolation`==`true`. Unique VLAN ID used for client isolation", "examples": [ "3070" ], @@ -41730,6 +43903,7 @@ "type": "string" }, "vlan_id": { + "description": "VLAN identifier for this switch network", "oneOf": [ { "type": "string" @@ -41747,11 +43921,11 @@ ], "type": "object" }, - "description": "Property key is network name", + "description": "Switch network definitions configured for the site", "type": "object" }, "ntp_servers": { - "description": "List of NTP servers", + "description": "Time synchronization server addresses configured for the site", "items": { "type": "string" }, @@ -41759,7 +43933,7 @@ }, "occupancy": { "additionalProperties": false, - "description": "Occupancy Analytics settings", + "description": "Analytics settings for site occupancy", "properties": { "assets_enabled": { "default": false, @@ -41773,7 +43947,7 @@ }, "min_duration": { "default": 3000, - "description": "Minimum duration", + "description": "Minimum dwell duration before a client or asset is counted in occupancy analytics", "examples": [ 3000 ], @@ -41793,6 +43967,7 @@ "type": "object" }, "org_id": { + "description": "Identifier of the org that owns the site settings", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -41807,6 +43982,7 @@ "properties": { "include_loopback": { "default": false, + "description": "Whether loopback interfaces are included in this OSPF area", "type": "boolean" }, "networks": { @@ -41835,7 +44011,7 @@ }, "auth_type": { "default": "none", - "description": "auth type. enum: `md5`, `none`, `password`", + "description": "Authentication method used by this OSPF network", "enum": [ "md5", "none", @@ -41847,6 +44023,7 @@ "type": "string" }, "bfd_minimum_interval": { + "description": "Minimum BFD interval for this OSPF network, in milliseconds", "examples": [ 500 ], @@ -41855,6 +44032,7 @@ "type": "integer" }, "dead_interval": { + "description": "OSPF dead interval for this network, in seconds", "examples": [ 40 ], @@ -41863,17 +44041,20 @@ "type": "integer" }, "export_policy": { + "description": "Routing policy used to export routes from this OSPF network", "examples": [ "export_policy" ], "type": "string" }, "hello_interval": { + "description": "OSPF hello interval for this network, in seconds", "maximum": 255, "minimum": 1, "type": "integer" }, "import_policy": { + "description": "Routing policy used to import routes for this OSPF network", "examples": [ "import_policy" ], @@ -41881,7 +44062,7 @@ }, "interface_type": { "default": "broadcast", - "description": "interface type (nbma = non-broadcast multi-access). enum: `broadcast`, `nbma`, `p2mp`, `p2p`", + "description": "OSPF interface type used for this network", "enum": [ "broadcast", "nbma", @@ -41891,6 +44072,7 @@ "type": "string" }, "metric": { + "description": "OSPF metric assigned to this network", "examples": [ 10000 ], @@ -41914,6 +44096,7 @@ }, "type": "object" }, + "description": "OSPF network settings keyed by network name", "examples": [ { "corp": { @@ -41936,7 +44119,7 @@ }, "type": { "default": "default", - "description": "OSPF type. enum: `default`, `nssa`, `stub`", + "description": "Area type for this OSPF area", "enum": [ "default", "nssa", @@ -41950,23 +44133,28 @@ }, "type": "object" }, - "description": "Junos OSPF areas. Property key is the OSPF Area (Area should be a number (0-255) / IP address)", + "description": "Routing area settings for OSPF on site switches", "type": "object" }, "paloalto_networks": { "additionalProperties": false, + "description": "Firewall integration settings for Palo Alto Networks at the site", "properties": { "gateways": { + "description": "Palo Alto Networks gateways integrated with this site", "items": { "additionalProperties": false, + "description": "Palo Alto Networks gateway API connection settings", "properties": { "api_key": { + "description": "Authentication key used to access the Palo Alto Networks gateway API", "examples": [ "5abf7c8a-1a1c-4398-ba2d-b0c297094d1a" ], "type": "string" }, "api_url": { + "description": "Base URL for the Palo Alto Networks gateway API", "examples": [ "https://23.43.12.78:8443" ], @@ -41979,6 +44167,7 @@ }, "send_mist_nac_user_info": { "default": false, + "description": "Whether Mist NAC user information is sent to Palo Alto Networks gateways", "type": "boolean" } }, @@ -41992,9 +44181,10 @@ "port_mirroring": { "additionalProperties": { "additionalProperties": false, + "description": "Input and output settings for one switch port mirroring session", "properties": { "input_networks_ingress": { - "description": "At least one of the `input_port_ids_ingress`, `input_port_ids_egress` or `input_networks_ingress ` should be specified", + "description": "At least one mirror input source should be specified. Networks whose ingress traffic is mirrored", "items": { "examples": [ "corp" @@ -42004,7 +44194,7 @@ "type": "array" }, "input_port_ids_egress": { - "description": "At least one of the `input_port_ids_ingress`, `input_port_ids_egress` or `input_networks_ingress ` should be specified", + "description": "At least one mirror input source should be specified. Switch ports whose egress traffic is mirrored", "items": { "examples": [ "ge-0/0/3" @@ -42014,7 +44204,7 @@ "type": "array" }, "input_port_ids_ingress": { - "description": "At least one of the `input_port_ids_ingress`, `input_port_ids_egress` or `input_networks_ingress ` should be specified", + "description": "At least one mirror input source should be specified. Switch ports whose ingress traffic is mirrored", "items": { "examples": [ "ge-0/0/3" @@ -42047,13 +44237,13 @@ }, "type": "object" }, - "description": "Property key is the port mirroring instance name. `port_mirroring` can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 mirroring ports is allowed", + "description": "Switch port mirroring settings for the site", "type": "object" }, "port_usages": { "additionalProperties": { "additionalProperties": false, - "description": "Junos port usages", + "description": "Junos switch port usage template and authentication settings", "properties": { "all_networks": { "default": false, @@ -42104,7 +44294,7 @@ }, "duplex": { "default": "auto", - "description": "Only if `mode`!=`dynamic`. Link connection mode. enum: `auto`, `full`, `half`", + "description": "Only if `mode`!=`dynamic`. Link duplex mode for this port usage", "enum": [ "auto", "full", @@ -42113,7 +44303,7 @@ "type": "string" }, "dynamic_vlan_networks": { - "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`, if dynamic vlan is used, specify the possible networks/vlans RADIUS can return", + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Networks or VLANs that RADIUS can return for dynamic VLAN assignment", "examples": [ [ "corp", @@ -42162,7 +44352,7 @@ }, "mac_auth_protocol": { "default": "eap-md5", - "description": "Only if `mode`!=`dynamic` and `enable_mac_auth` ==`true`. This type is ignored if mist_nac is enabled. enum: `eap-md5`, `eap-peap`, `pap`", + "description": "Only if `mode`!=`dynamic` and `enable_mac_auth`==`true`. MAC authentication protocol to use; ignored if Mist NAC is enabled", "enum": [ "eap-md5", "eap-peap", @@ -42182,10 +44372,10 @@ "type": "string" } ], - "description": "Only if `mode`!=`dynamic`, max number of mac addresses, default is 0 for unlimited, otherwise range is 1 to 16383 (upper bound constrained by platform)" + "description": "Only if `mode`!=`dynamic`. Maximum number of MAC addresses allowed on the port; 0 means unlimited" }, "mode": { - "description": "`mode`==`dynamic` must only be used if the port usage name is `dynamic`. enum: `access`, `dynamic`, `inet`, `trunk`", + "description": "Switching mode for this port usage", "enum": [ "access", "dynamic", @@ -42208,10 +44398,10 @@ "type": "null" } ], - "description": "Only if `mode`!=`dynamic` media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation. The default value is 1514." + "description": "Only if `mode`!=`dynamic`. MTU for ports using this port usage" }, "networks": { - "description": "Only if `mode`==`trunk`, the list of network/vlans", + "description": "Only if `mode`==`trunk`. Network or VLAN names to trunk", "items": { "type": "string" }, @@ -42233,7 +44423,7 @@ "type": "boolean" }, "poe_priority": { - "description": "PoE priority. enum: `low`, `high`", + "description": "Only if `mode`!=`dynamic`. PoE priority for ports using this port usage", "enum": [ "low", "high" @@ -42241,7 +44431,7 @@ "type": "string" }, "port_auth": { - "description": "Only if `mode`!=`dynamic`. If dot1x is desired, set to dot1x. enum: `dot1x`", + "description": "Only if `mode`!=`dynamic`. 802.1X authentication mode for this port usage", "enum": [ "dot1x" ], @@ -42266,11 +44456,11 @@ "type": "string" } ], - "description": "Only if `mode`!=`dynamic` and `port_auth`=`dot1x` reauthentication interval range (min: 10, max: 65535, default: 3600). Set to 0 to disable reauthentication (no-reauthentication)." + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. RADIUS reauthentication interval for clients on the port" }, "reset_default_when": { "default": "link_down", - "description": "Only if `mode`==`dynamic` Control when the DPC port should be changed to the default port usage. enum: `link_down`, `none` (let the DPC port keep at the current port usage)", + "description": "Only if `mode`==`dynamic`. Condition that resets a dynamic port to the default port usage", "enum": [ "link_down", "none" @@ -42281,29 +44471,33 @@ "type": "string" }, "rules": { - "description": "Only if `mode`==`dynamic`", + "description": "Only if `mode`==`dynamic`. Dynamic matching rules that select the port usage to apply", "items": { "additionalProperties": false, + "description": "Dynamic port usage rule evaluated against LLDP, RADIUS, or peer MAC attributes", "properties": { "description": { "description": "Optional description of the rule", "type": "string" }, "equals": { + "description": "Exact value that the selected source attribute must match", "type": "string" }, "equals_any": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "List of values where any match satisfies this dynamic rule" }, "expression": { "description": "\\"[0:3]\\":\\"abcdef\\" -> \\"abc\\"\\n\\"split(.)[1]\\": \\"a.b.c\\" -> \\"b\\"\\n\\"split(-)[1][0:3]: \\"a1234-b5678-c90\\" -> \\"b56\\"", "type": "string" }, "src": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source attribute evaluated by this dynamic rule" }, "usage": { - "description": "`port_usage` name", + "description": "Port usage name to apply when this dynamic rule matches", "type": "string" } }, @@ -42322,7 +44516,7 @@ ] }, "server_reject_network": { - "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. When radius server reject / fails", + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. When RADIUS server reject / fails", "type": [ "string", "null" @@ -42330,7 +44524,7 @@ }, "speed": { "default": "auto", - "description": "Only if `mode`!=`dynamic`, Port speed, default is auto to automatically negotiate speed enum: `100m`, `10m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`,`auto`", + "description": "Only if `mode`!=`dynamic`. Link speed for this port usage", "enum": [ "10m", "100m", @@ -42347,7 +44541,7 @@ }, "storm_control": { "additionalProperties": false, - "description": "Switch storm control. Only if `mode`!=`dynamic`", + "description": "Only if `mode`!=`dynamic`. Storm-control settings for this port usage", "properties": { "disable_port": { "default": false, @@ -42429,21 +44623,23 @@ }, "type": "object" }, - "description": "Property key is the port usage name. Defines the profiles of port configuration configured on the switch", + "description": "Switch port usage profiles available at the site", "type": "object" }, "proxy": { "additionalProperties": false, - "description": "Proxy Configuration to talk to Mist", + "description": "Network proxy settings for devices at the site", "properties": { "disabled": { "default": false, + "description": "Whether this proxy configuration is disabled", "examples": [ true ], "type": "boolean" }, "url": { + "description": "Proxy URL used to reach Mist", "examples": [ "https://proxy.corp.com:8080/" ], @@ -42454,10 +44650,11 @@ }, "radio_config": { "additionalProperties": false, - "description": "Radio AP settings", + "description": "AP radio configuration for the site", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM can be disabled for individual radio-band settings", "type": "boolean" }, "ant_gain_24": { @@ -42486,7 +44683,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Selected radio chain mode for AP models that support antenna mode control", "enum": [ "1x1", "2x2", @@ -42497,7 +44694,7 @@ "type": "string" }, "antenna_select": { - "description": "Antenna Mode for AP which supports selectable antennas. enum: `\\"\\"` (default), `external`, `internal`", + "description": "Internal or external antenna selection for AP models with selectable antennas", "enum": [ "", "external", @@ -42510,14 +44707,16 @@ }, "band_24": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "2.4 GHz radio settings for this access point", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 2.4 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 2.4 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -42527,7 +44726,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 2.4 GHz radio", "enum": [ "1x1", "2x2", @@ -42542,7 +44741,7 @@ }, "bandwidth": { "default": 20, - "description": "channel width for the 2.4GHz band. enum: `0`(disabled, response only), `20`, `40`", + "description": "Channel width configured for the 2.4 GHz radio", "enum": [ 0, 20, @@ -42568,7 +44767,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 2.4 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -42617,7 +44816,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 2.4 GHz radio", "enum": [ "auto", "long", @@ -42629,7 +44828,7 @@ "type": "object" }, "band_24_usage": { - "description": "enum: `24`, `5`, `6`, `auto`", + "description": "Radio usage mode for the 2.4 GHz-capable radio", "enum": [ "24", "5", @@ -42640,14 +44839,16 @@ }, "band_5": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "5 GHz radio settings for this access point", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 5 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 5 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -42656,7 +44857,7 @@ ] }, "antenna_beam_pattern": { - "description": "enum: `narrow`, `medium`, `wide`", + "description": "Beam pattern used by the 5 GHz radio antenna", "enum": [ "narrow", "medium", @@ -42666,7 +44867,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 5 GHz radio", "enum": [ "1x1", "2x2", @@ -42681,7 +44882,7 @@ }, "bandwidth": { "default": 40, - "description": "channel width for the 5GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`", + "description": "Channel width configured for the 5 GHz radio", "enum": [ 0, 20, @@ -42706,7 +44907,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -42755,7 +44956,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 5 GHz radio", "enum": [ "auto", "long", @@ -42768,14 +44969,16 @@ }, "band_5_on_24_radio": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "5 GHz settings used when the 2.4 GHz radio operates in 5 GHz mode", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 5 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 5 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -42784,7 +44987,7 @@ ] }, "antenna_beam_pattern": { - "description": "enum: `narrow`, `medium`, `wide`", + "description": "Beam pattern used by the 5 GHz radio antenna", "enum": [ "narrow", "medium", @@ -42794,7 +44997,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 5 GHz radio", "enum": [ "1x1", "2x2", @@ -42809,7 +45012,7 @@ }, "bandwidth": { "default": 40, - "description": "channel width for the 5GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`", + "description": "Channel width configured for the 5 GHz radio", "enum": [ 0, 20, @@ -42834,7 +45037,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -42883,7 +45086,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 5 GHz radio", "enum": [ "auto", "long", @@ -42896,14 +45099,16 @@ }, "band_6": { "additionalProperties": false, - "description": "Radio Band AP settings", + "description": "6 GHz radio settings for this access point", "properties": { "allow_rrm_disable": { "default": false, + "description": "Whether RRM may disable the 6 GHz radio when optimizing RF settings", "type": "boolean" }, "ant_gain": { "default": 0, + "description": "External antenna gain for the 6 GHz radio", "maximum": 10, "minimum": 0, "type": [ @@ -42912,7 +45117,7 @@ ] }, "antenna_beam_pattern": { - "description": "enum: `narrow`, `medium`, `wide`", + "description": "Beam pattern used by the 6 GHz radio antenna", "enum": [ "narrow", "medium", @@ -42922,7 +45127,7 @@ }, "antenna_mode": { "default": "default", - "description": "enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`", + "description": "Radio chain mode for the 6 GHz radio", "enum": [ "1x1", "2x2", @@ -42937,7 +45142,7 @@ }, "bandwidth": { "default": 80, - "description": "channel width for the 6GHz band. enum: `0`(disabled, response only), `20`, `40`, `80`, `160`", + "description": "Channel width configured for the 6 GHz radio", "enum": [ 0, 20, @@ -42963,7 +45168,7 @@ }, "channels": { "default": [], - "description": "For RFTemplates. List of channels, null or empty array means auto", + "description": "Allowed channel list for the 6 GHz radio; null or an empty array uses automatic selection", "items": { "type": "integer" }, @@ -43012,7 +45217,7 @@ }, "preamble": { "default": "short", - "description": "enum: `auto`, `long`, `short`", + "description": "802.11 preamble mode used by the 6 GHz radio", "enum": [ "auto", "long", @@ -43054,34 +45259,38 @@ }, "radius_config": { "additionalProperties": false, - "description": "Junos Radius config", + "description": "Switch RADIUS configuration for the site", "properties": { "acct_immediate_update": { + "description": "Whether immediate RADIUS accounting updates are sent", "type": "boolean" }, "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled", "maximum": 65535, "minimum": 0, "type": "integer" }, "acct_servers": { + "description": "RADIUS accounting servers used by this switch configuration", "items": { "additionalProperties": false, + "description": "RADIUS accounting server settings", "properties": { "host": { - "description": "IP/ hostname of RADIUS server", + "description": "Address or hostname of the RADIUS accounting server", "examples": [ "1.2.3.4" ], "type": "string" }, "keywrap_enabled": { + "description": "Whether RADIUS keywrap is enabled for messages sent to this accounting server", "type": "boolean" }, "keywrap_format": { - "description": "enum: `ascii`, `hex`", + "description": "Encoding format for RADIUS keywrap KEK and MACK values", "enum": [ "ascii", "hex" @@ -43089,12 +45298,14 @@ "type": "string" }, "keywrap_kek": { + "description": "RADIUS keywrap key encryption key (KEK)", "examples": [ "1122334455" ], "type": "string" }, "keywrap_mack": { + "description": "RADIUS keywrap message authentication code key (MACK)", "examples": [ "1122334455" ], @@ -43111,10 +45322,10 @@ "type": "string" } ], - "description": "Radius Auth Port, value from 1 to 65535, default is 1813" + "description": "UDP port used by the RADIUS accounting server" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS accounting server", "examples": [ "testing123" ], @@ -43133,7 +45344,7 @@ }, "auth_server_selection": { "default": "ordered", - "description": "enum: `ordered`, `unordered`", + "description": "Selection strategy for RADIUS authentication servers", "enum": [ "ordered", "unordered" @@ -43141,22 +45352,24 @@ "type": "string" }, "auth_servers": { + "description": "RADIUS authentication servers used by this switch configuration", "items": { "additionalProperties": false, - "description": "Authentication Server", + "description": "RADIUS authentication server settings", "properties": { "host": { - "description": "IP/ hostname of RADIUS server", + "description": "Address or hostname of the RADIUS authentication server", "examples": [ "1.2.3.4" ], "type": "string" }, "keywrap_enabled": { + "description": "Whether RADIUS keywrap is enabled for messages sent to this authentication server", "type": "boolean" }, "keywrap_format": { - "description": "enum: `ascii`, `hex`", + "description": "Encoding format for RADIUS keywrap KEK and MACK values", "enum": [ "ascii", "hex" @@ -43164,12 +45377,14 @@ "type": "string" }, "keywrap_kek": { + "description": "RADIUS keywrap key encryption key (KEK)", "examples": [ "1122334455" ], "type": "string" }, "keywrap_mack": { + "description": "RADIUS keywrap message authentication code key (MACK)", "examples": [ "1122334455" ], @@ -43186,7 +45401,7 @@ "type": "string" } ], - "description": "Radius Auth Port, value from 1 to 65535, default is 1812" + "description": "UDP port used by the RADIUS authentication server" }, "require_message_authenticator": { "default": false, @@ -43194,7 +45409,7 @@ "type": "boolean" }, "secret": { - "description": "Secret of RADIUS server", + "description": "Shared secret used with this RADIUS authentication server", "examples": [ "testing123" ], @@ -43213,16 +45428,17 @@ }, "auth_servers_retries": { "default": 3, - "description": "Radius auth session retries", + "description": "RADIUS auth session retries", "type": "integer" }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout", + "description": "RADIUS auth session timeout", "type": "integer" }, "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled", "type": "boolean" }, "coa_port": { @@ -43236,10 +45452,11 @@ "type": "string" } ], - "description": "Radius CoA Port, value from 1 to 65535, default is 3799" + "description": "UDP port used for RADIUS Change of Authorization (CoA)" }, "fast_dot1x_timers": { "default": false, + "description": "Whether fast 802.1X timers are enabled for RADIUS authentication", "type": "boolean" }, "network": { @@ -43247,7 +45464,7 @@ "type": "string" }, "source_ip": { - "description": "Use `network`or `source_ip`", + "description": "Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic", "type": "string" } }, @@ -43255,9 +45472,11 @@ }, "remote_syslog": { "additionalProperties": false, + "description": "Syslog forwarding settings for devices at the site", "properties": { "archive": { "additionalProperties": false, + "description": "Retention settings for generated syslog archive files", "properties": { "files": { "anyOf": [ @@ -43268,11 +45487,13 @@ "type": "integer" } ], + "description": "Number of archived syslog files to retain", "examples": [ 20 ] }, "size": { + "description": "Maximum size of each archived syslog file, such as 5m", "examples": [ "5m" ], @@ -43282,6 +45503,7 @@ "type": "object" }, "cacerts": { + "description": "CA certificates used to verify TLS syslog servers", "examples": [ [ "-----BEGIN CERTIFICATE-----\\\\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\\\\n-----END CERTIFICATE-----", @@ -43295,16 +45517,21 @@ }, "console": { "additionalProperties": false, + "description": "Log forwarding filters for console messages sent to remote syslog", "properties": { "contents": { + "description": "Syslog facilities and severities forwarded from console logs", "items": { "additionalProperties": false, + "description": "Syslog message content selector for remote logging", "properties": { "facility": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Syslog facility to match for this selector" }, "severity": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Syslog severity to match for this selector" } }, "type": "object" @@ -43316,19 +45543,25 @@ }, "enabled": { "default": false, + "description": "Whether remote syslog forwarding is enabled", "type": "boolean" }, "files": { + "description": "Local syslog file definitions to generate and forward", "items": { "additionalProperties": false, + "description": "Generated syslog file output settings", "properties": { "archive": { "additionalProperties": false, + "description": "Retention settings for this generated syslog file", "properties": { "files": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Number of archived syslog files to retain" }, "size": { + "description": "Maximum size of each archived syslog file, such as 5m", "examples": [ "5m" ], @@ -43338,31 +45571,36 @@ "type": "object" }, "contents": { + "description": "Syslog facilities and severities written to this file", "items": { "$comment": "max depth reached" }, "type": "array" }, "enable_tls": { - "description": "Only if `protocol`==`tcp`", + "description": "Only if `protocol`==`tcp`, enable TLS for this syslog file destination", "type": "boolean" }, "explicit_priority": { + "description": "Whether to include explicit syslog priority values in file output", "type": "boolean" }, "file": { + "description": "Generated syslog file name", "examples": [ "file-name" ], "type": "string" }, "match": { + "description": "Expression used to filter log messages written to this file", "examples": [ "!alarm|ntp|errors.crc_error[chan]" ], "type": "string" }, "structured_data": { + "description": "Whether to include structured syslog data in file output", "type": "boolean" } }, @@ -43371,7 +45609,7 @@ "type": "array" }, "network": { - "description": "If source_address is configured, will use the vlan firstly otherwise use source_ip", + "description": "Source network used for syslog traffic. If `source_address` is configured, Mist uses the VLAN first; otherwise it uses `source_ip`", "examples": [ "default" ], @@ -43379,9 +45617,11 @@ }, "send_to_all_servers": { "default": false, + "description": "Whether each log entry is sent to all configured remote syslog servers", "type": "boolean" }, "servers": { + "description": "Remote syslog server destinations", "examples": [ [ { @@ -43396,19 +45636,22 @@ ], "items": { "additionalProperties": false, + "description": "Remote syslog server destination settings", "properties": { "contents": { + "description": "Syslog facilities and severities sent to this server", "items": { "$comment": "max depth reached" }, "type": "array" }, "explicit_priority": { + "description": "Whether to include explicit syslog priority values in messages sent to this server", "type": "boolean" }, "facility": { "default": "any", - "description": "enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`", + "description": "Default syslog facility for messages sent to this server", "enum": [ "any", "authorization", @@ -43433,12 +45676,14 @@ "type": "string" }, "host": { + "description": "Address or hostname of the remote syslog server", "examples": [ "syslogd.internal" ], "type": "string" }, "match": { + "description": "Expression used to filter log messages sent to this server", "examples": [ "!alarm|ntp|errors.crc_error[chan]" ], @@ -43456,11 +45701,11 @@ "type": "string" } ], - "description": "Syslog Service Port, value from 1 to 65535" + "description": "Network port used by the remote syslog server" }, "protocol": { "default": "udp", - "description": "enum: `tcp`, `udp`", + "description": "Transport protocol used for this remote syslog server", "enum": [ "tcp", "udp" @@ -43468,13 +45713,14 @@ "type": "string" }, "routing_instance": { + "description": "Routing instance used to reach this remote syslog server", "examples": [ "routing-instance-name" ], "type": "string" }, "server_name": { - "description": "Name of the server", + "description": "TLS server name used when verifying the remote syslog server certificate", "examples": [ "syslogd.internal" ], @@ -43482,7 +45728,7 @@ }, "severity": { "default": "any", - "description": "enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`", + "description": "Default syslog severity for messages sent to this server", "enum": [ "alert", "any", @@ -43496,13 +45742,15 @@ "type": "string" }, "source_address": { - "description": "If source_address is configured, will use the vlan firstly otherwise use source_ip", + "description": "Source address for syslog traffic. If configured, Mist uses the VLAN first; otherwise it uses `source_ip`", "type": "string" }, "structured_data": { + "description": "Whether to include structured syslog data in messages sent to this server", "type": "boolean" }, "tag": { + "description": "Syslog tag value added to messages sent to this server", "type": "string" } }, @@ -43511,7 +45759,7 @@ "type": "array" }, "time_format": { - "description": "enum: `millisecond`, `year`, `year millisecond`", + "description": "Timestamp format used in forwarded syslog messages", "enum": [ "millisecond", "year", @@ -43523,22 +45771,27 @@ "type": "string" }, "users": { + "description": "User-specific syslog logging rules", "items": { "additionalProperties": false, + "description": "User-specific syslog logging rule", "properties": { "contents": { + "description": "Syslog facilities and severities logged for this user rule", "items": { "$comment": "max depth reached" }, "type": "array" }, "match": { + "description": "Expression used to filter user log messages", "examples": [ "\\"!alarm|ntp|errors.crc_error[chan]\\"" ], "type": "string" }, "user": { + "description": "Account name or wildcard matched by this syslog rule", "examples": [ "*" ], @@ -43564,10 +45817,10 @@ }, "rogue": { "additionalProperties": false, - "description": "Rogue site settings", + "description": "AP threat detection settings for the site", "properties": { "allowed_vlan_ids": { - "description": "list of VLAN IDs on which rogue APs are ignored", + "description": "VLAN IDs allowed by the rogue detection policy", "items": { "maximum": 4096, "minimum": 0, @@ -43622,7 +45875,7 @@ "type": "integer" }, "whitelisted_bssids": { - "description": "list of BSSIDs to whitelist. Ex: \\"cc-:8e-:6f-:d4-:bf-:16\\", \\"cc-8e-6f-d4-bf-16\\", \\"cc-73-*\\", \\"cc:82:*\\"", + "description": "BSSID values or wildcard patterns excluded from rogue detection", "examples": [ [ "NeighborSSID" @@ -43634,7 +45887,7 @@ "type": "array" }, "whitelisted_ssids": { - "description": "List of SSIDs to whitelist", + "description": "SSID names excluded from rogue detection", "examples": [ [ "cc:8e:6f:d4:bf:16", @@ -43654,19 +45907,24 @@ "routing_policies": { "additionalProperties": { "additionalProperties": false, + "description": "Switch routing policy made of ordered match-action terms", "properties": { "terms": { - "description": "at least criteria/filter must be specified to match the term, all criteria have to be met", + "description": "Ordered terms evaluated by this switch routing policy", "items": { "additionalProperties": false, + "description": "Switch routing policy term with match criteria and actions", "properties": { "actions": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Policy actions applied when this routing policy term matches" }, "matching": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Route match criteria that must be satisfied before actions are applied" }, "name": { + "description": "Display name of the switch routing policy term", "type": "string" } }, @@ -43682,30 +45940,34 @@ }, "type": "object" }, - "description": "Property key is the routing policy name", + "description": "Switch routing policy definitions for the site", "type": "object" }, "rtsa": { "additionalProperties": false, - "description": "Managed mobility", + "description": "Managed mobility and asset tracking settings for the site", "properties": { "app_waking": { "default": false, + "description": "Whether app wake-up support is enabled for managed mobility", "type": "boolean" }, "disable_dead_reckoning": { + "description": "Whether dead reckoning is disabled for managed mobility", "type": "boolean" }, "disable_pressure_sensor": { "default": false, + "description": "Whether pressure sensor use is disabled for managed mobility", "type": "boolean" }, "enabled": { + "description": "Whether managed mobility features are enabled", "type": "boolean" }, "track_asset": { "default": false, - "description": "Asset tracking related", + "description": "Whether BLE asset tracking is enabled for managed mobility", "type": "boolean" } }, @@ -43713,24 +45975,27 @@ }, "simple_alert": { "additionalProperties": false, - "description": "Set of heuristic rules will be enabled when marvis subscription is not available. It triggers when, in a Z minute window, there are more than Y distinct client encountering over X failures", + "description": "Threshold alert settings for the site", "properties": { "arp_failure": { "additionalProperties": false, + "description": "Thresholds for ARP failure heuristic alerts", "properties": { "client_count": { "default": 10, + "description": "Number of distinct clients that must encounter ARP failures before alerting", "type": "integer" }, "duration": { "default": 20, - "description": "failing within minutes", + "description": "Time window in minutes for evaluating ARP failures", "maximum": 60, "minimum": 5, "type": "integer" }, "incident_count": { "default": 10, + "description": "Number of ARP failure incidents required within the duration window", "type": "integer" } }, @@ -43738,20 +46003,23 @@ }, "dhcp_failure": { "additionalProperties": false, + "description": "Thresholds for DHCP failure heuristic alerts", "properties": { "client_count": { "default": 10, + "description": "Number of distinct clients that must encounter DHCP failures before alerting", "type": "integer" }, "duration": { "default": 10, - "description": "failing within minutes", + "description": "Time window in minutes for evaluating DHCP failures", "maximum": 60, "minimum": 5, "type": "integer" }, "incident_count": { "default": 20, + "description": "Number of DHCP failure incidents required within the duration window", "type": "integer" } }, @@ -43759,20 +46027,23 @@ }, "dns_failure": { "additionalProperties": false, + "description": "Thresholds for DNS failure heuristic alerts", "properties": { "client_count": { "default": 20, + "description": "Number of distinct clients that must encounter DNS failures before alerting", "type": "integer" }, "duration": { "default": 10, - "description": "failing within minutes", + "description": "Time window in minutes for evaluating DNS failures", "maximum": 60, "minimum": 5, "type": "integer" }, "incident_count": { "default": 30, + "description": "Number of DNS failure incidents required within the duration window", "type": "integer" } }, @@ -43782,6 +46053,7 @@ "type": "object" }, "site_id": { + "description": "Identifier of the site these settings apply to", "examples": [ "441a1214-6928-442a-8e92-e1d34b8ec6a6" ], @@ -43791,13 +46063,15 @@ }, "skyatp": { "additionalProperties": false, + "description": "Threat intelligence settings from Sky ATP for the site", "properties": { "enabled": { + "description": "Whether Sky ATP is enabled for the site", "type": "boolean" }, "send_ip_mac_mapping": { "default": false, - "description": "Whether to send IP-MAC mapping to SkyATP", + "description": "Whether IP-to-MAC mappings are sent to Sky ATP", "type": "boolean" } }, @@ -43805,24 +46079,25 @@ }, "sle_thresholds": { "additionalProperties": false, + "description": "Service level expectation threshold settings for the site", "properties": { "capacity": { "default": 20, - "description": "Capacity, in %", + "description": "Threshold percentage for capacity SLE scoring", "maximum": 50, "minimum": 5, "type": "integer" }, "coverage": { "default": -72, - "description": "Coverage, in dBm", + "description": "RSSI threshold for coverage SLE scoring, in dBm", "maximum": -60, "minimum": -90, "type": "integer" }, "throughput": { "default": 10, - "description": "Throughput, in Mbps", + "description": "Minimum throughput threshold for SLE scoring, in Mbps", "maximum": 100, "minimum": 1, "type": "integer" @@ -43839,18 +46114,23 @@ }, "snmp_config": { "additionalProperties": false, + "description": "Management polling settings for SNMP on site devices", "properties": { "client_list": { + "description": "SNMP client allowlists that can be referenced by communities", "items": { "additionalProperties": false, + "description": "SNMP client allowlist definition", "properties": { "client_list_name": { + "description": "Name of the SNMP client list", "examples": [ "clist-1" ], "type": "string" }, "clients": { + "description": "SNMP client IP addresses or CIDR ranges allowed by this list", "items": { "examples": [ "151.140.101.218/32" @@ -43865,12 +46145,14 @@ "type": "array" }, "contact": { + "description": "Administrative contact string advertised through SNMP", "examples": [ "cns@juniper.net" ], "type": "string" }, "description": { + "description": "Device description string advertised through SNMP", "examples": [ "Juniper QFX Series Switch - 1K_5LA" ], @@ -43878,15 +46160,17 @@ }, "enabled": { "default": true, + "description": "Whether SNMP is enabled", "type": "boolean" }, "engine_id": { + "description": "SNMP engine ID used for SNMPv3", "maxLength": 27, "type": "string" }, "engine_id_type": { "default": "local", - "description": "enum: `local`, `use_mac_address`", + "description": "Method used to derive the SNMP engine ID", "enum": [ "local", "use_mac_address" @@ -43894,12 +46178,14 @@ "type": "string" }, "location": { + "description": "Physical location string advertised through SNMP", "examples": [ "Las Vegas, NV" ], "type": "string" }, "name": { + "description": "System name advertised through SNMP", "examples": [ "TGH-1K-QFX10K" ], @@ -43907,13 +46193,17 @@ }, "network": { "default": "default", + "description": "Management network used for SNMP traffic", "type": "string" }, "trap_groups": { + "description": "SNMP trap group definitions", "items": { "additionalProperties": false, + "description": "SNMP trap group definition", "properties": { "categories": { + "description": "Trap categories included in this SNMP trap group", "items": { "examples": [ "authentication" @@ -43923,13 +46213,14 @@ "type": "array" }, "group_name": { - "description": "Categories list can refer to https://www.juniper.net/documentation/software/topics/task/configuration/snmp_trap-groups-configuring-junos-nm.html", + "description": "Trap group name for this SNMP trap group", "examples": [ "profiler" ], "type": "string" }, "targets": { + "description": "Trap target addresses for this SNMP trap group", "items": { "examples": [ "172.29.158.19" @@ -43940,7 +46231,7 @@ }, "version": { "default": "v2", - "description": "enum: `all`, `v1`, `v2`", + "description": "SNMP trap protocol version used by this group", "enum": [ "all", "v1", @@ -43954,30 +46245,34 @@ "type": "array" }, "v2c_config": { + "description": "SNMPv2c community configuration entries for this SNMP profile", "items": { "additionalProperties": false, + "description": "SNMPv2c community configuration entry", "properties": { "authorization": { + "description": "Access level for the SNMPv2c community", "examples": [ "read-only" ], "type": "string" }, "client_list_name": { - "description": "Client_list_name here should refer to client_list above", + "description": "SNMP client list name referenced by this community", "examples": [ "clist-1" ], "type": "string" }, "community_name": { + "description": "SNMPv2c community string name", "examples": [ "abc123" ], "type": "string" }, "view": { - "description": "View name here should be defined in views above", + "description": "SNMP view name that must be defined in the views list", "examples": [ "all" ], @@ -43990,19 +46285,25 @@ }, "v3_config": { "additionalProperties": false, + "description": "SNMPv3 user, VACM, notify, and target configuration", "properties": { "notify": { + "description": "SNMPv3 notification definitions used for traps and informs", "items": { "additionalProperties": false, + "description": "SNMPv3 notification definition for traps or informs", "properties": { "name": { + "description": "Identifier for this SNMPv3 notification definition", "type": "string" }, "tag": { + "description": "Notification tag used to select target addresses", "type": "string" }, "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Delivery mode for this SNMPv3 notification, such as trap or inform" } }, "type": "object" @@ -44010,13 +46311,17 @@ "type": "array" }, "notify_filter": { + "description": "SNMPv3 notification filter profiles", "items": { "additionalProperties": false, + "description": "SNMPv3 notification filter profile", "properties": { "contents": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "OID filter rules in this notification filter profile" }, "profile_name": { + "description": "Notification filter profile name", "type": "string" } }, @@ -44025,16 +46330,20 @@ "type": "array" }, "target_address": { + "description": "SNMPv3 notification target addresses", "items": { "additionalProperties": false, + "description": "SNMPv3 notification target address entry", "properties": { "address": { + "description": "IP address or hostname of the SNMP target", "examples": [ "10.11.0.2" ], "type": "string" }, "address_mask": { + "description": "Mask applied to the SNMP target address", "examples": [ "255.255.255.0" ], @@ -44042,23 +46351,25 @@ }, "port": { "default": "161", + "description": "UDP port used by the SNMP target", "type": [ "string", "null" ] }, "tag_list": { - "description": "Refer to notify tag, can be multiple with blank", + "description": "Set of notification tags for this target address; use spaces between multiple tags", "type": "string" }, "target_address_name": { + "description": "Name of the SNMP target address entry", "examples": [ "target_address_name" ], "type": "string" }, "target_parameters": { - "description": "Refer to notify target parameters name", + "description": "Target parameter profile referenced by this target address", "type": "string" } }, @@ -44067,27 +46378,33 @@ "type": "array" }, "target_parameters": { + "description": "SNMPv3 target parameter profiles", "items": { "additionalProperties": false, + "description": "SNMPv3 target parameter profile", "properties": { "message_processing_model": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMP message processing model used by this target parameter profile" }, "name": { + "description": "Target parameter profile name", "type": "string" }, "notify_filter": { - "description": "Refer to profile-name in notify_filter", + "description": "Notification filter profile referenced by this target parameter profile", "type": "string" }, "security_level": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Required security level for this target parameter profile" }, "security_model": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Required security model for this target parameter profile" }, "security_name": { - "description": "Refer to security_name in usm", + "description": "USM security name referenced by this target parameter profile", "examples": [ "m01620" ], @@ -44099,11 +46416,14 @@ "type": "array" }, "usm": { + "description": "SNMPv3 USM engine configurations", "items": { "additionalProperties": false, + "description": "SNMPv3 User-based Security Model configuration", "properties": { "engine_type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMP engine type used for this USM configuration" }, "remote_engine_id": { "description": "Required only if `engine_type`==`remote_engine`", @@ -44113,7 +46433,8 @@ "type": "string" }, "users": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMPv3 USM users for this engine" } }, "type": "object" @@ -44122,8 +46443,10 @@ }, "vacm": { "additionalProperties": false, + "description": "SNMPv3 VACM access control configuration", "properties": { "access": { + "description": "VACM access rules for SNMPv3", "items": { "$comment": "max depth reached" }, @@ -44131,12 +46454,15 @@ }, "security_to_group": { "additionalProperties": false, + "description": "VACM security-name to group mappings", "properties": { "content": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "VACM security-name to group mapping entries" }, "security_model": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Required security model for these VACM group mappings" } }, "type": "object" @@ -44148,20 +46474,24 @@ "type": "object" }, "views": { + "description": "SNMP MIB view definitions", "items": { "additionalProperties": false, + "description": "SNMP MIB view definition", "properties": { "include": { - "description": "If the root oid configured is included", + "description": "Whether the root OID is included in this SNMP view", "type": "boolean" }, "oid": { + "description": "Root OID for this SNMP view", "examples": [ "1.3.6.1" ], "type": "string" }, "view_name": { + "description": "Name of the SNMP MIB view definition", "examples": [ "all" ], @@ -44177,16 +46507,18 @@ }, "srx_app": { "additionalProperties": false, + "description": "Juniper SRX application visibility settings for the site", "properties": { "enabled": { "default": false, + "description": "Whether Juniper SRX application visibility is enabled", "type": "boolean" } }, "type": "object" }, "ssh_keys": { - "description": "When limit_ssh_access = true in Org Setting, list of SSH public keys provided by Mist Support to install onto APs (see Org:Setting)", + "description": "Public SSH keys configured for the site", "items": { "examples": [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA...Wxa6p6UW0ZbcP john@host" @@ -44197,14 +46529,15 @@ }, "ssr": { "additionalProperties": false, + "description": "Session Smart Router settings for the site", "properties": { "auto_upgrade": { "additionalProperties": false, - "description": "auto_upgrade device first time it is onboarded", + "description": "Automatic SSR firmware upgrade settings for newly onboarded devices", "properties": { "channel": { "default": "stable", - "description": "upgrade channel to follow. enum: `alpha`, `beta`, `stable`", + "description": "Firmware release channel used for SSR auto-upgrade", "enum": [ "alpha", "beta", @@ -44220,11 +46553,12 @@ ], "type": "string" }, - "description": "Property key is the SSR model (e.g. \\"SSR130\\").", + "description": "Per-model SSR firmware versions used for auto-upgrade", "type": "object" }, "enabled": { "default": false, + "description": "Whether SSR auto-upgrade is enabled for newly onboarded devices", "type": "boolean" }, "version": { @@ -44238,32 +46572,34 @@ "type": "object" }, "conductor_hosts": { - "description": "List of Conductor IP Addresses or Hosts to be used by the SSR Devices", + "description": "IP addresses or hostnames of conductors used by SSR devices", "items": { "type": "string" }, "type": "array" }, "conductor_token": { - "description": "Token to be used by the SSR Devices to connect to the Conductor", + "description": "Registration token used by SSR devices to connect to the conductor", "type": "string" }, "disable_stats": { - "description": "Disable stats collection on SSR devices", + "description": "Whether stats collection is disabled on SSR devices", "type": "boolean" }, "proxy": { "additionalProperties": false, - "description": "SSR proxy configuration to talk to Mist", + "description": "Network proxy settings used by SSR devices to reach Mist", "properties": { "disabled": { "default": false, + "description": "Whether the SSR proxy configuration is disabled", "examples": [ true ], "type": "boolean" }, "url": { + "description": "Proxy URL that SSR devices use to reach Mist", "examples": [ "https://proxy.corp.com:8080/" ], @@ -44277,12 +46613,15 @@ }, "status_portal": { "additionalProperties": false, + "description": "End-user status portal settings for the site", "properties": { "enabled": { "default": false, + "description": "Whether the site status portal is enabled", "type": "boolean" }, "hostnames": { + "description": "Portal hostnames served by the site status portal", "items": { "examples": [ "my.misty.com" @@ -44297,24 +46636,28 @@ "switch": { "allOf": [ { - "description": "Network Template", + "description": "Network template configuration applied to sites or site groups", "properties": { "acl_policies": { + "description": "ACL policy defaults provided by this network template", "items": { "additionalProperties": false, "description": "ACL Policy:\\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to", "properties": { "actions": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Destination tag actions evaluated for sources matching this ACL policy" }, "name": { + "description": "Display name of the ACL policy", "examples": [ "guest access" ], "type": "string" }, "src_tags": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source ACL tags that select traffic for this ACL policy" } }, "type": "object" @@ -44327,21 +46670,23 @@ "description": "Resource tags (`type`==`resource` or `type`==`gbp_resource`) can only be used in `dst_tags`", "properties": { "ether_types": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Layer 2 EtherTypes matched by this ACL tag; defaults to `any`" }, "gbp_tag": { "description": "Required if\\n - `type`==`dynamic_gbp` (gbp_tag received from RADIUS)\\n - `type`==`gbp_resource`\\n - `type`==`static_gbp` (applying gbp tag against matching conditions)", "type": "integer" }, "macs": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Client or resource MAC addresses matched by this ACL tag" }, "network": { "description": "If:\\n * `type`==`mac` (optional. default is `any`)\\n * `type`==`subnet` (optional. default is `any`)\\n * `type`==`network`\\n * `type`==`resource` (optional. default is `any`)\\n * `type`==`static_gbp` if from matching network (vlan)", "type": "string" }, "port_usage": { - "description": "Required if `type`==`port_usage`", + "description": "Required if `type`==`port_usage`. Switch port usage name matched by this ACL tag", "type": "string" }, "radius_group": { @@ -44349,13 +46694,16 @@ "type": "string" }, "specs": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Layer 4 protocol and destination-port constraints for this ACL tag" }, "subnets": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "IP subnets matched by this ACL tag" }, "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Classifier type that determines which ACL tag fields are evaluated" } }, "required": [ @@ -44363,11 +46711,11 @@ ], "type": "object" }, - "description": "ACL Tags to identify traffic source or destination. Key name is the tag name", + "description": "ACL tags available to access policies in this network template", "type": "object" }, "additional_config_cmds": { - "description": "additional CLI commands to append to the generated Junos config. **Note**: no check is done", + "description": "Additional CLI configuration commands provided by this network template", "items": { "description": "JUNOS \\"set\\" command to add to the generated configuration", "examples": [ @@ -44380,8 +46728,10 @@ "bgp_config": { "additionalProperties": { "additionalProperties": false, + "description": "Switch BGP configuration for a routing instance", "properties": { "auth_key": { + "description": "Authentication key used for BGP neighbor sessions, when configured", "type": "string" }, "bfd_minimum_interval": { @@ -44395,7 +46745,7 @@ "type": "string" }, "hold_time": { - "description": "Hold time is three times the interval at which keepalive messages are sent. It indicates to the peer the length of time that it should consider the sender valid. Must be 0 or a number in the range 3-65535.", + "description": "Default BGP hold time for switch BGP sessions", "oneOf": [ { "$comment": "max depth reached" @@ -44418,7 +46768,7 @@ "$comment": "max depth reached" } ], - "description": "BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}` )", + "description": "Local BGP Autonomous System (AS) number for the switch", "examples": [ 65000 ] @@ -44427,18 +46777,18 @@ "additionalProperties": { "$comment": "max depth reached" }, - "description": "Property key is the BGP Neighbor IP Address.", + "description": "BGP neighbor settings keyed by neighbor IP address", "type": "object" }, "networks": { - "description": "List of network names for BGP configuration. When a network is specified, a BGP group will be added to the VRF that network is part of.", + "description": "Network names used to add BGP groups to the corresponding VRFs", "items": { "$comment": "max depth reached" }, "type": "array" }, "type": { - "description": "enum: `external`, `internal`", + "description": "BGP session type for this switch BGP configuration", "enum": [ "external", "internal" @@ -44452,18 +46802,21 @@ ], "type": "object" }, + "description": "BGP routing defaults for this network template. Property key is the BGP session name", "type": "object" }, "created_time": { - "description": "When the object has been created, in epoch", + "description": "Timestamp when the network template was created", "format": "double", "readOnly": true, "type": "number" }, "dhcp_snooping": { "additionalProperties": false, + "description": "DHCP snooping defaults provided by this network template", "properties": { "all_networks": { + "description": "Whether DHCP snooping applies to all configured networks", "type": "boolean" }, "enable_arp_spoof_check": { @@ -44475,10 +46828,11 @@ "type": "boolean" }, "enabled": { + "description": "Whether DHCP snooping is enabled", "type": "boolean" }, "networks": { - "description": "If `all_networks`==`false`, list of network with DHCP snooping enabled", + "description": "Network names with DHCP snooping enabled when `all_networks`==`false`", "items": { "type": "string" }, @@ -44488,14 +46842,14 @@ "type": "object" }, "dns_servers": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS servers provided by this network template", "items": { "type": "string" }, "type": "array" }, "dns_suffix": { - "description": "Global dns settings. To keep compatibility, dns settings in `ip_config` and `oob_ip_config` will overwrite this setting", + "description": "DNS search suffixes provided by this network template", "items": { "type": "string" }, @@ -44504,13 +46858,15 @@ "extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "IPv4 static route settings for a destination prefix", "properties": { "discard": { "default": false, - "description": "This takes precedence", + "description": "Whether to install a discard route; this takes precedence over next-hop settings", "type": "boolean" }, "metric": { + "description": "Route metric for the IPv4 static route", "examples": [ null ], @@ -44525,6 +46881,7 @@ "additionalProperties": { "$comment": "max depth reached" }, + "description": "Qualified next-hop settings keyed by IPv4 next-hop address", "examples": [ { "10.3.1.1": { @@ -44537,9 +46894,11 @@ }, "no_resolve": { "default": false, + "description": "Whether to prevent recursive next-hop resolution for the IPv4 static route", "type": "boolean" }, "preference": { + "description": "Route preference for the IPv4 static route", "examples": [ 30 ], @@ -44551,12 +46910,13 @@ ] }, "via": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Next-hop IPv4 address or ECMP next-hop IPv4 addresses for the route" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"10.0.0.0/8\\")", + "description": "Additional IPv4 route defaults in this network template", "examples": [ { "0.0.0.0/0": { @@ -44569,13 +46929,15 @@ "extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "IPv6 static route settings for a destination prefix", "properties": { "discard": { "default": false, - "description": "This takes precedence", + "description": "Whether to install a discard route; this takes precedence over next-hop settings", "type": "boolean" }, "metric": { + "description": "Route metric for the IPv6 static route", "examples": [ null ], @@ -44590,6 +46952,7 @@ "additionalProperties": { "$comment": "max depth reached" }, + "description": "Qualified next-hop settings keyed by IPv6 next-hop address", "examples": [ { "2a02:1234:200a::100": { @@ -44602,9 +46965,11 @@ }, "no_resolve": { "default": false, + "description": "Whether to prevent recursive next-hop resolution for the IPv6 static route", "type": "boolean" }, "preference": { + "description": "Route preference for the IPv6 static route", "examples": [ 30 ], @@ -44616,12 +46981,13 @@ ] }, "via": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Next-hop IPv6 address or ECMP next-hop IPv6 addresses for the route" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "Additional IPv6 route defaults in this network template", "examples": [ { "2a02:1234:420a:10c9::/64": { @@ -44632,7 +46998,7 @@ "type": "object" }, "id": { - "description": "Unique ID of the object instance in the Mist Organization", + "description": "Unique identifier of the network template", "examples": [ "53f10664-3ce8-4c27-b382-0ef66432349f" ], @@ -44641,7 +47007,7 @@ "type": "string" }, "import_org_networks": { - "description": "Org Networks that we'd like to import", + "description": "Organization network names imported into this network template", "items": { "examples": [ "ap" @@ -44652,24 +47018,27 @@ }, "mist_nac": { "additionalProperties": false, - "description": "Enable mist_nac to use RadSec", + "description": "Mist NAC defaults applied by this network template", "properties": { "enabled": { + "description": "Whether Mist NAC RadSec is enabled for the switch", "type": "boolean" }, "network": { + "description": "Switch network used for Mist NAC RadSec connectivity", "type": "string" } }, "type": "object" }, "modified_time": { - "description": "When the object has been modified for the last time, in epoch", + "description": "Timestamp when the network template was last modified", "format": "double", "readOnly": true, "type": "number" }, "name": { + "description": "Display name of the network template", "type": "string" }, "networks": { @@ -44691,6 +47060,7 @@ "type": "boolean" }, "isolation_vlan_id": { + "description": "Required when `isolation`==`true`. Unique VLAN ID used for client isolation", "examples": [ "3070" ], @@ -44705,7 +47075,8 @@ "type": "string" }, "vlan_id": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "VLAN identifier for this switch network" } }, "required": [ @@ -44713,17 +47084,18 @@ ], "type": "object" }, - "description": "Property key is network name", + "description": "Layer 3 networks configured by this network template", "type": "object" }, "ntp_servers": { - "description": "List of NTP servers specific to this device. By default, those in Site Settings will be used", + "description": "NTP servers provided by this network template", "items": { "type": "string" }, "type": "array" }, "org_id": { + "description": "Organization that owns this network template", "examples": [ "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61" ], @@ -44738,12 +47110,14 @@ "properties": { "include_loopback": { "default": false, + "description": "Whether loopback interfaces are included in this OSPF area", "type": "boolean" }, "networks": { "additionalProperties": { "$comment": "max depth reached" }, + "description": "OSPF network settings keyed by network name", "examples": [ { "corp": { @@ -44765,26 +47139,31 @@ "type": "object" }, "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Area type for this OSPF area" } }, "type": "object" }, - "description": "Junos OSPF areas. Property key is the OSPF Area (Area should be a number (0-255) / IP address)", + "description": "OSPF area defaults provided by this network template", "type": "object" }, "port_mirroring": { "additionalProperties": { "additionalProperties": false, + "description": "Input and output settings for one switch port mirroring session", "properties": { "input_networks_ingress": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "At least one mirror input source should be specified. Networks whose ingress traffic is mirrored" }, "input_port_ids_egress": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "At least one mirror input source should be specified. Switch ports whose egress traffic is mirrored" }, "input_port_ids_ingress": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "At least one mirror input source should be specified. Switch ports whose ingress traffic is mirrored" }, "output_ip_address": { "description": "Exactly one of the `output_ip_address`, `output_port_id` or `output_network` should be provided", @@ -44810,13 +47189,13 @@ }, "type": "object" }, - "description": "Property key is the port mirroring instance name. `port_mirroring` can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 mirroring ports is allowed", + "description": "Port mirroring defaults provided by this network template", "type": "object" }, "port_usages": { "additionalProperties": { "additionalProperties": false, - "description": "Junos port usages", + "description": "Junos switch port usage template and authentication settings", "properties": { "all_networks": { "default": false, @@ -44866,10 +47245,12 @@ "type": "boolean" }, "duplex": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Only if `mode`!=`dynamic`. Link duplex mode for this port usage" }, "dynamic_vlan_networks": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Networks or VLANs that RADIUS can return for dynamic VLAN assignment" }, "enable_mac_auth": { "default": false, @@ -44907,19 +47288,24 @@ "type": "boolean" }, "mac_auth_protocol": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Only if `mode`!=`dynamic` and `enable_mac_auth`==`true`. MAC authentication protocol to use; ignored if Mist NAC is enabled" }, "mac_limit": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Only if `mode`!=`dynamic`. Maximum number of MAC addresses allowed on the port; 0 means unlimited" }, "mode": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Switching mode for this port usage" }, "mtu": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Only if `mode`!=`dynamic`. MTU for ports using this port usage" }, "networks": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Only if `mode`==`trunk`. Network or VLAN names to trunk" }, "persist_mac": { "default": false, @@ -44937,23 +47323,28 @@ "type": "boolean" }, "poe_priority": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Only if `mode`!=`dynamic`. PoE priority for ports using this port usage" }, "port_auth": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Only if `mode`!=`dynamic`. 802.1X authentication mode for this port usage" }, "port_network": { "description": "Only if `mode`!=`dynamic`. Native network/vlan for untagged traffic", "type": "string" }, "reauth_interval": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. RADIUS reauthentication interval for clients on the port" }, "reset_default_when": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Only if `mode`==`dynamic`. Condition that resets a dynamic port to the default port usage" }, "rules": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Only if `mode`==`dynamic`. Dynamic matching rules that select the port usage to apply" }, "server_fail_network": { "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Sets server fail fallback vlan", @@ -44963,17 +47354,19 @@ ] }, "server_reject_network": { - "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. When radius server reject / fails", + "description": "Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. When RADIUS server reject / fails", "type": [ "string", "null" ] }, "speed": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Only if `mode`!=`dynamic`. Link speed for this port usage" }, "storm_control": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Only if `mode`!=`dynamic`. Storm-control settings for this port usage" }, "stp_disable": { "default": false, @@ -45020,24 +47413,26 @@ }, "type": "object" }, - "description": "Property key is the port usage name. Defines the profiles of port configuration configured on the switch", + "description": "Reusable switch port usage profiles provided by this network template", "type": "object" }, "radius_config": { "additionalProperties": false, - "description": "Junos Radius config", + "description": "RADIUS authentication and accounting defaults in this network template", "properties": { "acct_immediate_update": { + "description": "Whether immediate RADIUS accounting updates are sent", "type": "boolean" }, "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled", "maximum": 65535, "minimum": 0, "type": "integer" }, "acct_servers": { + "description": "RADIUS accounting servers used by this switch configuration", "items": { "$comment": "max depth reached" }, @@ -45046,7 +47441,7 @@ }, "auth_server_selection": { "default": "ordered", - "description": "enum: `ordered`, `unordered`", + "description": "Selection strategy for RADIUS authentication servers", "enum": [ "ordered", "unordered" @@ -45054,6 +47449,7 @@ "type": "string" }, "auth_servers": { + "description": "RADIUS authentication servers used by this switch configuration", "items": { "$comment": "max depth reached" }, @@ -45062,16 +47458,17 @@ }, "auth_servers_retries": { "default": 3, - "description": "Radius auth session retries", + "description": "RADIUS auth session retries", "type": "integer" }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout", + "description": "RADIUS auth session timeout", "type": "integer" }, "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled", "type": "boolean" }, "coa_port": { @@ -45085,10 +47482,11 @@ "type": "string" } ], - "description": "Radius CoA Port, value from 1 to 65535, default is 3799" + "description": "UDP port used for RADIUS Change of Authorization (CoA)" }, "fast_dot1x_timers": { "default": false, + "description": "Whether fast 802.1X timers are enabled for RADIUS authentication", "type": "boolean" }, "network": { @@ -45096,7 +47494,7 @@ "type": "string" }, "source_ip": { - "description": "Use `network`or `source_ip`", + "description": "Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic", "type": "string" } }, @@ -45104,14 +47502,18 @@ }, "remote_syslog": { "additionalProperties": false, + "description": "Remote syslog defaults provided by this network template", "properties": { "archive": { "additionalProperties": false, + "description": "Retention settings for generated syslog archive files", "properties": { "files": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Number of archived syslog files to retain" }, "size": { + "description": "Maximum size of each archived syslog file, such as 5m", "examples": [ "5m" ], @@ -45121,6 +47523,7 @@ "type": "object" }, "cacerts": { + "description": "CA certificates used to verify TLS syslog servers", "examples": [ [ "-----BEGIN CERTIFICATE-----\\\\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\\\\n-----END CERTIFICATE-----", @@ -45134,25 +47537,29 @@ }, "console": { "additionalProperties": false, + "description": "Log forwarding filters for console messages sent to remote syslog", "properties": { "contents": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Syslog facilities and severities forwarded from console logs" } }, "type": "object" }, "enabled": { "default": false, + "description": "Whether remote syslog forwarding is enabled", "type": "boolean" }, "files": { + "description": "Local syslog file definitions to generate and forward", "items": { "$comment": "max depth reached" }, "type": "array" }, "network": { - "description": "If source_address is configured, will use the vlan firstly otherwise use source_ip", + "description": "Source network used for syslog traffic. If `source_address` is configured, Mist uses the VLAN first; otherwise it uses `source_ip`", "examples": [ "default" ], @@ -45160,9 +47567,11 @@ }, "send_to_all_servers": { "default": false, + "description": "Whether each log entry is sent to all configured remote syslog servers", "type": "boolean" }, "servers": { + "description": "Remote syslog server destinations", "examples": [ [ { @@ -45181,7 +47590,7 @@ "type": "array" }, "time_format": { - "description": "enum: `millisecond`, `year`, `year millisecond`", + "description": "Timestamp format used in forwarded syslog messages", "enum": [ "millisecond", "year", @@ -45193,6 +47602,7 @@ "type": "string" }, "users": { + "description": "User-specific syslog logging rules", "items": { "$comment": "max depth reached" }, @@ -45209,32 +47619,38 @@ "routing_policies": { "additionalProperties": { "additionalProperties": false, + "description": "Switch routing policy made of ordered match-action terms", "properties": { "terms": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Ordered terms evaluated by this switch routing policy" } }, "type": "object" }, - "description": "Property key is the routing policy name", + "description": "Routing policy defaults applied by this network template", "type": "object" }, "snmp_config": { "additionalProperties": false, + "description": "SNMP defaults provided by this network template", "properties": { "client_list": { + "description": "SNMP client allowlists that can be referenced by communities", "items": { "$comment": "max depth reached" }, "type": "array" }, "contact": { + "description": "Administrative contact string advertised through SNMP", "examples": [ "cns@juniper.net" ], "type": "string" }, "description": { + "description": "Device description string advertised through SNMP", "examples": [ "Juniper QFX Series Switch - 1K_5LA" ], @@ -45242,15 +47658,17 @@ }, "enabled": { "default": true, + "description": "Whether SNMP is enabled", "type": "boolean" }, "engine_id": { + "description": "SNMP engine ID used for SNMPv3", "maxLength": 27, "type": "string" }, "engine_id_type": { "default": "local", - "description": "enum: `local`, `use_mac_address`", + "description": "Method used to derive the SNMP engine ID", "enum": [ "local", "use_mac_address" @@ -45258,12 +47676,14 @@ "type": "string" }, "location": { + "description": "Physical location string advertised through SNMP", "examples": [ "Las Vegas, NV" ], "type": "string" }, "name": { + "description": "System name advertised through SNMP", "examples": [ "TGH-1K-QFX10K" ], @@ -45271,15 +47691,18 @@ }, "network": { "default": "default", + "description": "Management network used for SNMP traffic", "type": "string" }, "trap_groups": { + "description": "SNMP trap group definitions", "items": { "$comment": "max depth reached" }, "type": "array" }, "v2c_config": { + "description": "SNMPv2c community configuration entries for this SNMP profile", "items": { "$comment": "max depth reached" }, @@ -45287,29 +47710,37 @@ }, "v3_config": { "additionalProperties": false, + "description": "SNMPv3 user, VACM, notify, and target configuration", "properties": { "notify": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMPv3 notification definitions used for traps and informs" }, "notify_filter": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMPv3 notification filter profiles" }, "target_address": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMPv3 notification target addresses" }, "target_parameters": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMPv3 target parameter profiles" }, "usm": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMPv3 USM engine configurations" }, "vacm": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "SNMPv3 VACM access control configuration" } }, "type": "object" }, "views": { + "description": "SNMP MIB view definitions", "items": { "$comment": "max depth reached" }, @@ -45320,12 +47751,14 @@ }, "switch_matching": { "additionalProperties": false, - "description": "Defines custom switch configuration based on different criteria", + "description": "Matching rules that select switches for this network template", "properties": { "enable": { + "description": "Whether custom switch matching rules are enabled", "type": "boolean" }, "rules": { + "description": "Switch matching rules evaluated to apply custom configuration", "items": { "$comment": "max depth reached" }, @@ -45337,11 +47770,11 @@ }, "switch_mgmt": { "additionalProperties": false, - "description": "Switch Management settings", + "description": "Management-plane defaults provided by this network template", "properties": { "ap_affinity_threshold": { "default": 10, - "description": "AP_affinity_threshold ap_affinity_threshold can be added as a field under site/setting. By default, this value is set to 12. If the field is set in both site/setting and org/setting, the value from site/setting will be used.", + "description": "AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used.", "type": "integer" }, "cli_banner": { @@ -45370,21 +47803,23 @@ "type": "boolean" }, "disable_oob_down_alarm": { + "description": "Whether to suppress alarms when the switch out-of-band management interface is down", "type": "boolean" }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the switch", "type": "boolean" }, "local_accounts": { "additionalProperties": { "$comment": "max depth reached" }, - "description": "Property key is the user name. For Local user authentication", + "description": "Local switch user accounts keyed by username", "type": "object" }, "mxedge_proxy_host": { - "description": "IP Address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud", + "description": "IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud", "type": "string" }, "mxedge_proxy_port": { @@ -45399,17 +47834,19 @@ "type": "string" } ], - "description": "Mist Edge port used to proxy the switch management traffic to the Mist Cloud. Value in range 1-65535" + "description": "Mist Edge proxy port used for switch management traffic" }, "protect_re": { "additionalProperties": false, - "description": "Restrict inbound-traffic to host\\nwhen enabled, all traffic that is not essential to our operation will be dropped \\ne.g. ntp / dns / traffic to mist will be allowed by default, if dhcpd is enabled, we'll make sure it works", + "description": "Control-plane protection settings for the switch", "properties": { "allowed_services": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Built-in services explicitly allowed by the Protect RE policy" }, "custom": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Additional ACL entries allowed by the Protect RE policy" }, "enabled": { "default": false, @@ -45422,22 +47859,26 @@ "type": "boolean" }, "trusted_hosts": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Trusted host or subnet entries allowed by the Protect RE policy" } }, "type": "object" }, "radius": { "additionalProperties": false, - "description": "By default, `radius_config` will be used. if a different one has to be used set `use_different_radius", + "description": "Management authentication settings using RADIUS", "properties": { "enabled": { + "description": "Whether RADIUS is enabled for switch management authentication", "type": "boolean" }, "radius_config": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "RADIUS configuration used when alternate RADIUS settings are required" }, "use_different_radius": { + "description": "Selector for alternate RADIUS settings instead of the default switch `radius_config`", "type": "string" } }, @@ -45449,33 +47890,39 @@ "type": "boolean" }, "root_password": { + "description": "Root password for local switch access", "format": "password", "type": "string" }, "tacacs": { "additionalProperties": false, + "description": "Management authentication settings using TACACS+", "properties": { "acct_servers": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "TACACS+ accounting servers used for switch management sessions" }, "default_role": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Default switch-management role to use for TACACS+ logins" }, "enabled": { + "description": "Whether TACACS+ is enabled for switch management authentication", "type": "boolean" }, "network": { - "description": "Which network the TACACS server resides", + "description": "Source network used for connectivity to the TACACS+ servers", "type": "string" }, "tacplus_servers": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "TACACS+ authentication servers used for switch management logins" } }, "type": "object" }, "use_mxedge_proxy": { - "description": "To use mxedge as proxy", + "description": "Whether to use Mist Edge as a proxy for switch management traffic", "type": "boolean" } }, @@ -45483,6 +47930,7 @@ }, "vrf_config": { "additionalProperties": false, + "description": "VRF defaults applied by this network template", "properties": { "enabled": { "description": "Whether to enable VRF (when supported on the device)", @@ -45494,6 +47942,7 @@ "vrf_instances": { "additionalProperties": { "additionalProperties": false, + "description": "Switch VRF instance routing and network membership settings", "examples": [ { "extra_routes": { @@ -45508,33 +47957,40 @@ ], "properties": { "aggregate_routes": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "IPv4 aggregate routes configured for this VRF instance" }, "aggregate_routes6": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "IPv6 aggregate routes configured for this VRF instance" }, "evpn_auto_loopback_subnet": { + "description": "IPv4 subnet used for automatic EVPN loopback addresses in this VRF instance", "examples": [ "100.101.0.0/24" ], "type": "string" }, "evpn_auto_loopback_subnet6": { + "description": "IPv6 subnet used for automatic EVPN loopback addresses in this VRF instance", "type": "string" }, "extra_routes": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Additional IPv4 static routes configured for this VRF instance" }, "extra_routes6": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Additional IPv6 static routes configured for this VRF instance" }, "networks": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Names of switch networks included in this VRF instance" } }, "type": "object" }, - "description": "Property key is the network name", + "description": "VRF instances configured by this network template", "examples": [ { "guest": { @@ -45556,15 +48012,17 @@ }, { "additionalProperties": false, + "description": "Wrapper for switch firmware auto-upgrade settings", "properties": { "auto_upgrade": { "additionalProperties": false, + "description": "Switch firmware auto-upgrade configuration", "properties": { "custom_versions": { "additionalProperties": { "type": "string" }, - "description": "Custom version to be used. The Property Key is the switch hardware and the property value is the firmware version", + "description": "Per-model switch firmware versions to use for auto-upgrade", "examples": [ { "QFX5120-32C": "23.4R2-S2.1", @@ -45574,12 +48032,12 @@ "type": "object" }, "enabled": { - "description": "Enable auto upgrade for the switch", + "description": "Whether switch auto-upgrade is enabled", "type": "boolean" }, "snapshot": { "default": false, - "description": "Enable snapshot during the upgrade process", + "description": "Whether to create a recovery snapshot during the upgrade process", "type": "boolean" } }, @@ -45588,16 +48046,19 @@ }, "type": "object" } - ] + ], + "description": "Site-level switch feature configuration" }, "switch_matching": { "additionalProperties": false, - "description": "Defines custom switch configuration based on different criteria", + "description": "Rules for matching switches to model-specific settings", "properties": { "enable": { + "description": "Whether custom switch matching rules are enabled", "type": "boolean" }, "rules": { + "description": "Switch matching rules evaluated to apply custom configuration", "items": { "additionalProperties": { "type": "string" @@ -45611,7 +48072,7 @@ ], "properties": { "additional_config_cmds": { - "description": "additional CLI commands to append to the generated Junos config. **Note**: no check is done", + "description": "Additional Junos CLI commands applied when this matching rule matches", "items": { "description": "JUNOS \\"set\\" command to add to the generated configuration", "examples": [ @@ -45628,14 +48089,15 @@ }, "ip_config": { "additionalProperties": false, - "description": "In-Band Management interface configuration", + "description": "In-band management IP configuration applied when this matching rule matches", "properties": { "network": { "description": "VLAN Name for the management interface", "type": "string" }, "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "IP assignment mode for in-band switch management" } }, "type": "object" @@ -45648,10 +48110,11 @@ }, "oob_ip_config": { "additionalProperties": false, - "description": "Out-of-Band Management interface configuration", + "description": "Out-of-band management IP configuration applied when this matching rule matches", "properties": { "type": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "IP assignment mode for out-of-band switch management" }, "use_mgmt_vrf": { "default": false, @@ -45670,18 +48133,19 @@ "additionalProperties": { "$comment": "max depth reached" }, - "description": "Property key is the port name or range (e.g. \\"ge-0/0/0-10\\")", + "description": "Per-port wired configuration applied when this matching rule matches", "type": "object" }, "port_mirroring": { "additionalProperties": { "$comment": "max depth reached" }, - "description": "Property key is the port mirroring instance name. `port_mirroring` can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 mirroring ports is allowed", + "description": "Port mirroring configuration applied when this matching rule matches", "type": "object" }, "stp_config": { "additionalProperties": false, + "description": "Spanning Tree Protocol configuration applied when this matching rule matches", "properties": { "bridge_priority": { "default": "32k", @@ -45696,11 +48160,11 @@ }, "switch_mgmt": { "additionalProperties": false, - "description": "Switch Management settings", + "description": "Management-plane settings applied when this matching rule matches", "properties": { "ap_affinity_threshold": { "default": 10, - "description": "AP_affinity_threshold ap_affinity_threshold can be added as a field under site/setting. By default, this value is set to 12. If the field is set in both site/setting and org/setting, the value from site/setting will be used.", + "description": "AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used.", "type": "integer" }, "cli_banner": { @@ -45729,27 +48193,33 @@ "type": "boolean" }, "disable_oob_down_alarm": { + "description": "Whether to suppress alarms when the switch out-of-band management interface is down", "type": "boolean" }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the switch", "type": "boolean" }, "local_accounts": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Local switch user accounts keyed by username" }, "mxedge_proxy_host": { - "description": "IP Address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud", + "description": "IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud", "type": "string" }, "mxedge_proxy_port": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Mist Edge proxy port used for switch management traffic" }, "protect_re": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Control-plane protection settings for the switch" }, "radius": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Management authentication settings using RADIUS" }, "remove_existing_configs": { "default": false, @@ -45757,14 +48227,16 @@ "type": "boolean" }, "root_password": { + "description": "Root password for local switch access", "format": "password", "type": "string" }, "tacacs": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Management authentication settings using TACACS+" }, "use_mxedge_proxy": { - "description": "To use mxedge as proxy", + "description": "Whether to use Mist Edge as a proxy for switch management traffic", "type": "boolean" } }, @@ -45781,11 +48253,11 @@ }, "switch_mgmt": { "additionalProperties": false, - "description": "Switch Management settings", + "description": "Management access settings for switches at the site", "properties": { "ap_affinity_threshold": { "default": 10, - "description": "AP_affinity_threshold ap_affinity_threshold can be added as a field under site/setting. By default, this value is set to 12. If the field is set in both site/setting and org/setting, the value from site/setting will be used.", + "description": "AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used.", "type": "integer" }, "cli_banner": { @@ -45814,17 +48286,21 @@ "type": "boolean" }, "disable_oob_down_alarm": { + "description": "Whether to suppress alarms when the switch out-of-band management interface is down", "type": "boolean" }, "fips_enabled": { "default": false, + "description": "Whether FIPS mode is enabled on the switch", "type": "boolean" }, "local_accounts": { "additionalProperties": { "additionalProperties": false, + "description": "Local switch user account credentials and access role", "properties": { "password": { + "description": "Local password for the switch user account", "examples": [ "Juniper123" ], @@ -45833,7 +48309,7 @@ }, "role": { "default": "none", - "description": "enum: `admin`, `helpdesk`, `none`, `read`", + "description": "Access role granted to the local switch user account", "enum": [ "admin", "helpdesk", @@ -45845,11 +48321,11 @@ }, "type": "object" }, - "description": "Property key is the user name. For Local user authentication", + "description": "Local switch user accounts keyed by username", "type": "object" }, "mxedge_proxy_host": { - "description": "IP Address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud", + "description": "IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud", "type": "string" }, "mxedge_proxy_port": { @@ -45864,14 +48340,14 @@ "type": "string" } ], - "description": "Mist Edge port used to proxy the switch management traffic to the Mist Cloud. Value in range 1-65535" + "description": "Mist Edge proxy port used for switch management traffic" }, "protect_re": { "additionalProperties": false, - "description": "Restrict inbound-traffic to host\\nwhen enabled, all traffic that is not essential to our operation will be dropped \\ne.g. ntp / dns / traffic to mist will be allowed by default, if dhcpd is enabled, we'll make sure it works", + "description": "Control-plane protection settings for the switch", "properties": { "allowed_services": { - "description": "Optionally, services we'll allow", + "description": "Built-in services explicitly allowed by the Protect RE policy", "examples": [ [ "icmp", @@ -45879,7 +48355,7 @@ ] ], "items": { - "description": "enum: `icmp`, `ssh`", + "description": "Services allowed through protect-RE filters. enum: `icmp`, `ssh`", "enum": [ "icmp", "ssh" @@ -45889,9 +48365,10 @@ "type": "array" }, "custom": { + "description": "Additional ACL entries allowed by the Protect RE policy", "items": { "additionalProperties": false, - "description": "Custom acls", + "description": "Custom Protect RE ACL entry", "properties": { "port_range": { "default": "0", @@ -45902,10 +48379,12 @@ "type": "string" }, "protocol": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Transport protocol matched by this custom Protect RE ACL" }, "subnets": { - "$comment": "max depth reached" + "$comment": "max depth reached", + "description": "Source subnets matched by this custom Protect RE ACL" } }, "type": "object" @@ -45923,7 +48402,7 @@ "type": "boolean" }, "trusted_hosts": { - "description": "host/subnets we'll allow traffic to/from", + "description": "Trusted host or subnet entries allowed by the Protect RE policy", "items": { "examples": [ "10.242.3.0/24" @@ -45937,26 +48416,29 @@ }, "radius": { "additionalProperties": false, - "description": "By default, `radius_config` will be used. if a different one has to be used set `use_different_radius", + "description": "Management authentication settings using RADIUS", "properties": { "enabled": { + "description": "Whether RADIUS is enabled for switch management authentication", "type": "boolean" }, "radius_config": { "additionalProperties": false, - "description": "Junos Radius config", + "description": "RADIUS configuration used when alternate RADIUS settings are required", "properties": { "acct_immediate_update": { + "description": "Whether immediate RADIUS accounting updates are sent", "type": "boolean" }, "acct_interim_interval": { "default": 0, - "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled", + "description": "How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled", "maximum": 65535, "minimum": 0, "type": "integer" }, "acct_servers": { + "description": "RADIUS accounting servers used by this switch configuration", "items": { "$comment": "max depth reached" }, @@ -45965,7 +48447,7 @@ }, "auth_server_selection": { "default": "ordered", - "description": "enum: `ordered`, `unordered`", + "description": "Selection strategy for RADIUS authentication servers", "enum": [ "ordered", "unordered" @@ -45973,6 +48455,7 @@ "type": "string" }, "auth_servers": { + "description": "RADIUS authentication servers used by this switch configuration", "items": { "$comment": "max depth reached" }, @@ -45981,16 +48464,17 @@ }, "auth_servers_retries": { "default": 3, - "description": "Radius auth session retries", + "description": "RADIUS auth session retries", "type": "integer" }, "auth_servers_timeout": { "default": 5, - "description": "Radius auth session timeout", + "description": "RADIUS auth session timeout", "type": "integer" }, "coa_enabled": { "default": false, + "description": "Whether RADIUS Change of Authorization (CoA) is enabled", "type": "boolean" }, "coa_port": { @@ -46004,10 +48488,11 @@ "type": "string" } ], - "description": "Radius CoA Port, value from 1 to 65535, default is 3799" + "description": "UDP port used for RADIUS Change of Authorization (CoA)" }, "fast_dot1x_timers": { "default": false, + "description": "Whether fast 802.1X timers are enabled for RADIUS authentication", "type": "boolean" }, "network": { @@ -46015,13 +48500,14 @@ "type": "string" }, "source_ip": { - "description": "Use `network`or `source_ip`", + "description": "Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic", "type": "string" } }, "type": "object" }, "use_different_radius": { + "description": "Selector for alternate RADIUS settings instead of the default switch `radius_config`", "type": "string" } }, @@ -46033,28 +48519,36 @@ "type": "boolean" }, "root_password": { + "description": "Root password for local switch access", "format": "password", "type": "string" }, "tacacs": { "additionalProperties": false, + "description": "Management authentication settings using TACACS+", "properties": { "acct_servers": { + "description": "TACACS+ accounting servers used for switch management sessions", "items": { "additionalProperties": false, + "description": "TACACS+ accounting server settings", "properties": { "host": { + "description": "Address or hostname of the TACACS+ accounting server", "type": "string" }, "port": { + "description": "TCP port used by the TACACS+ accounting server", "type": "string" }, "secret": { + "description": "Shared secret used with this TACACS+ accounting server", "format": "password", "type": "string" }, "timeout": { "default": 10, + "description": "TACACS+ accounting server timeout, in seconds", "type": "integer" } }, @@ -46064,7 +48558,7 @@ }, "default_role": { "default": "none", - "description": "enum: `admin`, `helpdesk`, `none`, `read`", + "description": "Default switch-management role to use for TACACS+ logins", "enum": [ "admin", "helpdesk", @@ -46074,28 +48568,35 @@ "type": "string" }, "enabled": { + "description": "Whether TACACS+ is enabled for switch management authentication", "type": "boolean" }, "network": { - "description": "Which network the TACACS server resides", + "description": "Source network used for connectivity to the TACACS+ servers", "type": "string" }, "tacplus_servers": { + "description": "TACACS+ authentication servers used for switch management logins", "items": { "additionalProperties": false, + "description": "TACACS+ authentication server settings", "properties": { "host": { + "description": "Address or hostname of the TACACS+ authentication server", "type": "string" }, "port": { + "description": "TCP port used by the TACACS+ authentication server", "type": "string" }, "secret": { + "description": "Shared secret used with this TACACS+ authentication server", "format": "password", "type": "string" }, "timeout": { "default": 10, + "description": "TACACS+ authentication server timeout, in seconds", "type": "integer" } }, @@ -46107,7 +48608,7 @@ "type": "object" }, "use_mxedge_proxy": { - "description": "To use mxedge as proxy", + "description": "Whether to use Mist Edge as a proxy for switch management traffic", "type": "boolean" } }, @@ -46128,10 +48629,11 @@ }, "synthetic_test": { "additionalProperties": false, + "description": "Active monitoring test configuration for the site", "properties": { "aggressiveness": { "default": "auto", - "description": "enum: `auto`, `high`, `low`", + "description": "Overall aggressiveness level for synthetic test probes", "enum": [ "auto", "high", @@ -46143,10 +48645,11 @@ "custom_probes": { "additionalProperties": { "additionalProperties": false, + "description": "Custom probe definition for synthetic tests", "properties": { "aggressiveness": { "default": "auto", - "description": "enum: `auto`, `high`, `low`", + "description": "Probe aggressiveness level for this custom synthetic probe", "enum": [ "auto", "high", @@ -46163,7 +48666,7 @@ "type": "string" }, "threshold": { - "description": "In milliseconds", + "description": "Response-time threshold for this custom probe, in milliseconds", "examples": [ 100 ], @@ -46171,7 +48674,7 @@ }, "type": { "default": "icmp", - "description": "enum: `application`, `curl`, `icmp`, `reachability`, `tcp`", + "description": "Probe type used by this custom synthetic probe", "enum": [ "application", "curl", @@ -46184,21 +48687,22 @@ }, "type": "object" }, - "description": "Custom probes to be used for synthetic tests", + "description": "Custom synthetic probe definitions keyed by probe name", "type": "object" }, "disabled": { "default": false, + "description": "Whether synthetic tests are disabled", "type": "boolean" }, "lan_networks": { - "description": "List of networks to be used for synthetic tests", + "description": "LAN network probe groups used by synthetic tests", "items": { "additionalProperties": false, "description": "configure minis probes to be tested on lan networks of gateways", "properties": { "networks": { - "description": "List of networks to be used for synthetic tests", + "description": "LAN network names where synthetic probes are run", "examples": [ [ "pos-stations", @@ -46211,7 +48715,7 @@ "type": "array" }, "probes": { - "description": "app name comes from `custom_probes` above or /const/synthetic_test_probes", + "description": "Synthetic probe names to run on the listed LAN networks", "items": { "type": "string" }, @@ -46224,11 +48728,14 @@ }, "vlans": { "deprecated": true, + "description": "Deprecated VLAN-based synthetic test settings", "items": { "additionalProperties": false, + "description": "Deprecated VLAN-based synthetic test settings", "properties": { "custom_test_urls": { "deprecated": true, + "description": "Deprecated custom URLs tested by VLAN-based synthetic probes", "examples": [ [ "https://www.abc.com/", @@ -46246,13 +48753,14 @@ "type": "boolean" }, "probes": { - "description": "app name comes from `custom_probes` above or /const/synthetic_test_probes", + "description": "Synthetic probe names to run for the listed VLANs", "items": { "type": "string" }, "type": "array" }, "vlan_ids": { + "description": "VLAN identifiers where synthetic probes are run", "examples": [ [ 10, @@ -46272,13 +48780,15 @@ }, "wan_speedtest": { "additionalProperties": false, + "description": "WAN speedtest settings for synthetic tests", "properties": { "enabled": { + "description": "Whether scheduled WAN speedtests are enabled", "type": "boolean" }, "time_of_day": { "default": "any", - "description": "`any` / HH:MM (24-hour format)", + "description": "Scheduled time of day for WAN speedtests", "examples": [ "12:00" ], @@ -46296,8 +48806,10 @@ "type": "boolean" }, "tunterm_monitoring": { + "description": "Tunnel termination monitoring settings for the site", "items": { "additionalProperties": false, + "description": "Monitoring check for tunnel termination reachability", "properties": { "host": { "description": "Can be ip, ipv6, hostname", @@ -46308,14 +48820,14 @@ "type": "string" }, "port": { - "description": "When `protocol`==`tcp`", + "description": "When `protocol`==`tcp`, TCP port checked by the monitoring probe", "examples": [ 80 ], "type": "integer" }, "protocol": { - "description": "enum: `arp`, `ping`, `tcp`", + "description": "Monitoring method used for this tunnel termination check", "enum": [ "arp", "ping", @@ -46336,6 +48848,7 @@ }, "timeout": { "default": 300, + "description": "Maximum time for this monitoring check, in seconds", "examples": [ 300 ], @@ -46348,19 +48861,24 @@ }, "tunterm_monitoring_disabled": { "default": false, + "description": "Whether tunnel termination monitoring is disabled for the site", "type": "boolean" }, "tunterm_multicast_config": { "additionalProperties": false, + "description": "Multicast settings for tunnel termination at the site", "properties": { "mdns": { "additionalProperties": false, + "description": "Multicast DNS forwarding settings for tunneled VLANs", "properties": { "enabled": { "default": false, + "description": "Whether mDNS multicast forwarding is enabled", "type": "boolean" }, "vlan_ids": { + "description": "VLAN IDs where mDNS multicast forwarding is enabled", "examples": [ [ 2, @@ -46378,16 +48896,20 @@ }, "multicast_all": { "default": false, + "description": "Whether all multicast traffic is forwarded through tunnel termination", "type": "boolean" }, "ssdp": { "additionalProperties": false, + "description": "Simple Service Discovery Protocol forwarding settings for tunneled VLANs", "properties": { "enabled": { "default": false, + "description": "Whether SSDP multicast forwarding is enabled", "type": "boolean" }, "vlan_ids": { + "description": "VLAN IDs where SSDP multicast forwarding is enabled", "examples": [ [ 2, @@ -46408,7 +48930,7 @@ }, "uplink_port_config": { "additionalProperties": false, - "description": "AP Uplink port configuration", + "description": "AP uplink port configuration for the site", "properties": { "dot1x": { "default": false, @@ -46432,7 +48954,7 @@ "additionalProperties": { "type": "string" }, - "description": "Dictionary of name->value, the vars can then be used in Wlans. This can overwrite those from Site Vars", + "description": "Template variables defined for the site", "examples": [ { "RADIUS_IP1": "172.31.2.5", @@ -46458,7 +48980,7 @@ }, "type": "object" }, - "description": "Optional annotations for vars defined in this site. Keys match var names; values describe the var purpose and type for UI auto-complete.", + "description": "Metadata annotations for site template variables", "examples": [ { "MXTUNNEL_GUEST": { @@ -46473,6 +48995,7 @@ }, "vna": { "additionalProperties": false, + "description": "Virtual Network Assistant settings for the site", "properties": { "enabled": { "default": false, @@ -46506,6 +49029,7 @@ }, "vrf_config": { "additionalProperties": false, + "description": "Routing instance configuration for the site", "properties": { "enabled": { "description": "Whether to enable VRF (when supported on the device)", @@ -46517,6 +49041,7 @@ "vrf_instances": { "additionalProperties": { "additionalProperties": false, + "description": "Switch VRF instance routing and network membership settings", "examples": [ { "extra_routes": { @@ -46533,12 +49058,15 @@ "aggregate_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Aggregate route configuration for a network or routing instance", "properties": { "discard": { "default": false, + "description": "Whether to install the aggregate route as a discard route", "type": "boolean" }, "metric": { + "description": "Routing metric assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -46547,6 +49075,7 @@ ] }, "preference": { + "description": "Route preference assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -46557,7 +49086,7 @@ }, "type": "object" }, - "description": "Property key is the destination subnet (e.g. \\"172.16.3.0/24\\")", + "description": "IPv4 aggregate routes configured for this VRF instance", "examples": [ { "172.16.3.0/24": { @@ -46572,12 +49101,15 @@ "aggregate_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Aggregate route configuration for a network or routing instance", "properties": { "discard": { "default": false, + "description": "Whether to install the aggregate route as a discard route", "type": "boolean" }, "metric": { + "description": "Routing metric assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -46586,6 +49118,7 @@ ] }, "preference": { + "description": "Route preference assigned to the aggregate route", "maximum": 4294967295, "minimum": 0, "type": [ @@ -46596,7 +49129,7 @@ }, "type": "object" }, - "description": "Property key is the destination subnet (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "IPv6 aggregate routes configured for this VRF instance", "example": { "2a02:1234:420a:10c9::/64": { "discard": false, @@ -46607,27 +49140,30 @@ "type": "object" }, "evpn_auto_loopback_subnet": { + "description": "IPv4 subnet used for automatic EVPN loopback addresses in this VRF instance", "examples": [ "100.101.0.0/24" ], "type": "string" }, "evpn_auto_loopback_subnet6": { + "description": "IPv6 subnet used for automatic EVPN loopback addresses in this VRF instance", "type": "string" }, "extra_routes": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv4 static route for a VRF instance", "properties": { "via": { - "description": "Next-hop address", + "description": "IPv4 next-hop address for this VRF extra route", "format": "ipv4", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"10.0.0.0/8\\")", + "description": "Additional IPv4 static routes configured for this VRF instance", "examples": [ { "0.0.0.0/0": { @@ -46640,16 +49176,17 @@ "extra_routes6": { "additionalProperties": { "additionalProperties": false, + "description": "Additional IPv6 static route for a VRF instance", "properties": { "via": { - "description": "Next-hop address", + "description": "IPv6 next-hop address for this VRF extra route", "format": "ipv6", "type": "string" } }, "type": "object" }, - "description": "Property key is the destination CIDR (e.g. \\"2a02:1234:420a:10c9::/64\\")", + "description": "Additional IPv6 static routes configured for this VRF instance", "examples": [ { "2a02:1234:420a:10c9::/64": { @@ -46660,6 +49197,7 @@ "type": "object" }, "networks": { + "description": "Names of switch networks included in this VRF instance", "items": { "type": "string" }, @@ -46669,7 +49207,7 @@ }, "type": "object" }, - "description": "Property key is the network name", + "description": "Switch VRF instances configured for the site", "examples": [ { "guest": { @@ -46689,23 +49227,23 @@ "vrrp_groups": { "additionalProperties": { "additionalProperties": false, - "description": "Junos VRRP group", + "description": "Junos VRRP group authentication and network settings", "properties": { "auth_key": { - "description": "If `auth_type`==`md5`", + "description": "If `auth_type`==`md5`, authentication key used by the VRRP group", "examples": [ "auth-key-1" ], "type": "string" }, "auth_password": { - "description": "If `auth_type`==`simple`", + "description": "If `auth_type`==`simple`, password used by the VRRP group", "format": "password", "type": "string" }, "auth_type": { "default": "md5", - "description": "enum: `md5`, `simple`", + "description": "Authentication method used by the VRRP group", "enum": [ "md5", "simple" @@ -46718,14 +49256,16 @@ "networks": { "additionalProperties": { "additionalProperties": false, + "description": "Virtual IP assignment for a VRRP network", "properties": { "ip": { + "description": "Virtual IP address used by the VRRP group on this network", "type": "string" } }, "type": "object" }, - "description": "Property key is the network name", + "description": "VRRP network mappings and their virtual IP addresses", "examples": [ { "data": { @@ -46747,14 +49287,16 @@ }, "type": "object" }, - "description": "Property key is the vrrp group", + "description": "High-availability VRRP group settings for the site", "type": "object" }, "vs_instance": { "additionalProperties": { "additionalProperties": false, + "description": "EX9200 virtual-switch instance settings", "properties": { "networks": { + "description": "List of network names included in this virtual-switch instance", "items": { "examples": [ "guest" @@ -46766,20 +49308,23 @@ }, "type": "object" }, - "description": "Optional, for EX9200 only to segregate virtual-switches. Property key is the instance name", + "description": "EX9200 virtual switch instance definitions for the site", "type": "object" }, "wan_vna": { "additionalProperties": false, + "description": "Virtual Network Assistant settings for WAN experiences at the site", "properties": { "enabled": { "default": false, + "description": "Whether WAN VNA is enabled for the site", "type": "boolean" } }, "type": "object" }, "watched_station_url": { + "description": "Read-only URL for the watched station list file", "examples": [ "https://papi.s3.amazonaws.com/watched_station/xxx..." ], @@ -46787,6 +49332,7 @@ "type": "string" }, "whitelist_url": { + "description": "Read-only URL for the site whitelist file", "examples": [ "https://papi.s3.amazonaws.com/whitelist/xxx..." ], @@ -46795,10 +49341,11 @@ }, "wids": { "additionalProperties": false, - "description": "WIDS site settings", + "description": "Wireless intrusion detection settings for the site", "properties": { "repeated_auth_failures": { "additionalProperties": false, + "description": "Detection settings for repeated authentication failures", "properties": { "duration": { "description": "Window where a trigger will be detected and action to be taken (in seconds)", @@ -46819,10 +49366,11 @@ }, "wifi": { "additionalProperties": false, - "description": "Wi-Fi site settings", + "description": "Wireless LAN configuration settings for the site", "properties": { "cisco_enabled": { "default": true, + "description": "Whether Cisco compatibility features are enabled for site Wi-Fi", "type": "boolean" }, "disable_11k": { @@ -46832,6 +49380,7 @@ }, "disable_radios_when_power_constrained": { "default": false, + "description": "Whether AP radios are disabled when AP power is constrained", "type": "boolean" }, "enable_arp_spoof_check": { @@ -46841,6 +49390,7 @@ }, "enable_shared_radio_scanning": { "default": true, + "description": "Whether shared radio scanning is enabled for site Wi-Fi", "type": "boolean" }, "enabled": { @@ -46888,7 +49438,7 @@ ] }, "proxy_arp": { - "description": "enum: `default`, `disabled`, `enabled`", + "description": "ARP proxy mode for site Wi-Fi", "enum": [ "default", "disabled", @@ -46904,9 +49454,11 @@ }, "wired_vna": { "additionalProperties": false, + "description": "Virtual Network Assistant settings for wired experiences at the site", "properties": { "enabled": { "default": false, + "description": "Whether Wired VNA is enabled for the site", "type": "boolean" } }, @@ -46914,10 +49466,10 @@ }, "zone_occupancy_alert": { "additionalProperties": false, - "description": "Zone Occupancy alert site settings", + "description": "Occupancy alert settings for site zones", "properties": { "email_notifiers": { - "description": "List of email addresses to send email notifications when the alert threshold is reached", + "description": "Notification email recipients for zone occupancy alerts", "examples": [ [ "foo@juniper.net", From 7b8bb7f281ec94573d4ec23f52469cbe00815560 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 09:01:47 -0700 Subject: [PATCH 11/21] refactor: clean up and optimize SLE-related code and configurations --- mcp_generator/tools_optimization.yaml | 482 +++++++++--------- src/mistmcp/tool_helper.py | 8 +- .../tools/get_configuration_objects.py | 24 +- src/mistmcp/tools/get_sle.py | 60 +-- 4 files changed, 279 insertions(+), 295 deletions(-) diff --git a/mcp_generator/tools_optimization.yaml b/mcp_generator/tools_optimization.yaml index 931c120..e501c84 100644 --- a/mcp_generator/tools_optimization.yaml +++ b/mcp_generator/tools_optimization.yaml @@ -320,135 +320,135 @@ getConstants: operationId: listNacEventsDefinitions function: mistapi.api.v1.const.nac_events.listNacEventsDefinitions(apisession) -getSiteSle: - type: tool_consolidation - tags: [sles] - description: Provides Information about the Service Level Expectations (SLEs) for a given site. The SLEs are derived from the insight metrics and can be used to monitor the network user experience of the site against the defined SLEs - read_only_hint: true - destructive_hint: false - match_name: object_type - parameters: - - name: site_id - schema: - type: string - format: uuid - description: ID of the Mist Site - required: true - - name: scope - schema: - type: string - enum: [client, ap, gateway, mxedge, switch, site] - description: Scope of the SLEs to retrieve. Can be 'client', 'ap', 'gateway', 'mxedge', 'switch' or 'site' - required: true - - name: scope_id - schema: - type: string - description: ID of the object to retrieve SLEs for. Required if scope is 'client', 'ap', 'gateway', 'mxedge' or 'switch'. Optional if scope is 'site' - required: true - - name: metric - schema: - type: string - description: Name of the metric to retrieve SLEs for. Use the tool`mist_get_constants` with `object_type=insight_metrics` to see available metrics - required: true - - name: object_type - schema: - type: string - description: Type of object to retrieve metrics for - required: true - - name: start - schema: - type: integer - description: Start time (epoch timestamp in seconds) - required: false - - name: end - schema: - type: integer - description: End time (epoch timestamp in seconds) - required: false - - name: classifier - schema: - type: string - description: Classifier name. Required when object_type is 'classifier_summary_trend' - required: false - required_if: - test: - - classifier_summary_trend - - name: duration - schema: - type: string - description: Duration like 7d, 2w - required: false +# getSiteSle: +# type: tool_consolidation +# tags: [sles] +# description: Provides Information about the Service Level Expectations (SLEs) for a given site. The SLEs are derived from the insight metrics and can be used to monitor the network user experience of the site against the defined SLEs +# read_only_hint: true +# destructive_hint: false +# match_name: object_type +# parameters: +# - name: site_id +# schema: +# type: string +# format: uuid +# description: ID of the Mist Site +# required: true +# - name: scope +# schema: +# type: string +# enum: [client, ap, gateway, mxedge, switch, site] +# description: Scope of the SLEs to retrieve. Can be 'client', 'ap', 'gateway', 'mxedge', 'switch' or 'site' +# required: true +# - name: scope_id +# schema: +# type: string +# description: ID of the object to retrieve SLEs for. Required if scope is 'client', 'ap', 'gateway', 'mxedge' or 'switch'. Optional if scope is 'site' +# required: true +# - name: metric +# schema: +# type: string +# description: Name of the metric to retrieve SLEs for. Use the tool`mist_get_constants` with `object_type=insight_metrics` to see available metrics +# required: true +# - name: object_type +# schema: +# type: string +# description: Type of object to retrieve metrics for +# required: true +# - name: start +# schema: +# type: integer +# description: Start time (epoch timestamp in seconds) +# required: false +# - name: end +# schema: +# type: integer +# description: End time (epoch timestamp in seconds) +# required: false +# - name: classifier +# schema: +# type: string +# description: Classifier name. Required when object_type is 'classifier_summary_trend' +# required: false +# required_if: +# test: +# - classifier_summary_trend +# - name: duration +# schema: +# type: string +# description: Duration like 7d, 2w +# required: false - requests: - summary: - get: - operationId: getSiteSleSummary - function: mistapi.api.v1.sites.sle.getSiteSleSummary(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) +# requests: +# summary: +# get: +# operationId: getSiteSleSummary +# function: mistapi.api.v1.sites.sle.getSiteSleSummary(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) - impact_summary: - get: - operationId: getSiteSleImpactSummary - function: mistapi.api.v1.sites.sle.getSiteSleImpactSummary(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) +# impact_summary: +# get: +# operationId: getSiteSleImpactSummary +# function: mistapi.api.v1.sites.sle.getSiteSleImpactSummary(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) - summary_trend: - get: - operationId: getSiteSleSummaryTrend - function: mistapi.api.v1.sites.sle.getSiteSleSummaryTrend(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) +# summary_trend: +# get: +# operationId: getSiteSleSummaryTrend +# function: mistapi.api.v1.sites.sle.getSiteSleSummaryTrend(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) - impacted_applications: - get: - operationId: listSiteSleImpactedApplications - function: mistapi.api.v1.sites.sle.listSiteSleImpactedApplications(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) +# impacted_applications: +# get: +# operationId: listSiteSleImpactedApplications +# function: mistapi.api.v1.sites.sle.listSiteSleImpactedApplications(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) - impacted_aps: - get: - operationId: listSiteSleImpactedAps - function: mistapi.api.v1.sites.sle.listSiteSleImpactedAps(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) +# impacted_aps: +# get: +# operationId: listSiteSleImpactedAps +# function: mistapi.api.v1.sites.sle.listSiteSleImpactedAps(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) - impacted_gateways: - get: - operationId: listSiteSleImpactedGateways - function: mistapi.api.v1.sites.sle.listSiteSleImpactedGateways(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) +# impacted_gateways: +# get: +# operationId: listSiteSleImpactedGateways +# function: mistapi.api.v1.sites.sle.listSiteSleImpactedGateways(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) - impacted_interfaces: - get: - operationId: listSiteSleImpactedInterfaces - function: mistapi.api.v1.sites.sle.listSiteSleImpactedInterfaces(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) +# impacted_interfaces: +# get: +# operationId: listSiteSleImpactedInterfaces +# function: mistapi.api.v1.sites.sle.listSiteSleImpactedInterfaces(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) - impacted_switches: - get: - operationId: listSiteSleImpactedSwitches - function: mistapi.api.v1.sites.sle.listSiteSleImpactedSwitches(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) +# impacted_switches: +# get: +# operationId: listSiteSleImpactedSwitches +# function: mistapi.api.v1.sites.sle.listSiteSleImpactedSwitches(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) - impacted_wireless_clients: - get: - operationId: listSiteSleImpactedWirelessClients - function: mistapi.api.v1.sites.sle.listSiteSleImpactedWirelessClients(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) +# impacted_wireless_clients: +# get: +# operationId: listSiteSleImpactedWirelessClients +# function: mistapi.api.v1.sites.sle.listSiteSleImpactedWirelessClients(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) - impacted_wired_clients: - get: - operationId: listSiteSleImpactedWiredClients - function: mistapi.api.v1.sites.sle.listSiteSleImpactedWiredClients(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) +# impacted_wired_clients: +# get: +# operationId: listSiteSleImpactedWiredClients +# function: mistapi.api.v1.sites.sle.listSiteSleImpactedWiredClients(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) - impacted_chassis: - get: - operationId: listSiteSleImpactedChassis - function: mistapi.api.v1.sites.sle.listSiteSleImpactedChassis(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) +# impacted_chassis: +# get: +# operationId: listSiteSleImpactedChassis +# function: mistapi.api.v1.sites.sle.listSiteSleImpactedChassis(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) - histogram: - get: - operationId: getSiteSleHistogram - function: mistapi.api.v1.sites.sle.getSiteSleHistogram(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) +# histogram: +# get: +# operationId: getSiteSleHistogram +# function: mistapi.api.v1.sites.sle.getSiteSleHistogram(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) - classifier_summary_trend: - get: - operationId: getSiteSleClassifierSummaryTrend - function: mistapi.api.v1.sites.sle.getSiteSleClassifierSummaryTrend(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,classifier=classifier,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) +# classifier_summary_trend: +# get: +# operationId: getSiteSleClassifierSummaryTrend +# function: mistapi.api.v1.sites.sle.getSiteSleClassifierSummaryTrend(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,classifier=classifier,start=str(start) if start else None,end=str(end) if end else None,duration=duration if duration else None,) - threshold: - get: - operationId: getSiteSleThreshold - function: mistapi.api.v1.sites.sle.getSiteSleThreshold(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,) +# threshold: +# get: +# operationId: getSiteSleThreshold +# function: mistapi.api.v1.sites.sle.getSiteSleThreshold(apisession,site_id=str(site_id),scope=scope.value,scope_id=scope_id,metric=metric,) getSelf: type: tool_consolidation @@ -1347,54 +1347,54 @@ listRogueDevices: operationId: listSiteRogueClients function: mistapi.api.v1.sites.insights.listSiteRogueClients(apisession, site_id=str(site_id), limit=limit, start=str(start) if start else None, end=str(end) if end else None ) -listSiteSleInfo: - type: tool_consolidation - tags: [sles] - description: List SLE metadata for a site scope. Use metrics to list available SLE metrics for a given scope, or classifiers to list the classifiers available for a specific metric. - read_only_hint: true - destructive_hint: false - match_name: query_type - parameters: - - name: site_id - schema: - type: string - format: uuid - description: Site ID - required: true - - name: query_type - schema: - type: string - enum: [metrics, classifiers] - description: "Type of metadata to retrieve: metrics returns the list of available SLE metrics for the given scope; classifiers returns the list of classifiers for a specific metric (requires metric parameter)" - required: true - - name: scope - schema: - type: string - enum: [ap, client, gateway, site, switch] - description: "Scope of the SLE data: site, ap, client, gateway, or switch" - required: true - - name: scope_id - schema: - type: string - description: "ID of the scoped object: `site_id` if `scope=site`; `device_id` if `scope=ap`, `switch`, or `gateway`; `MAC address` if `scope=client`" - required: true - - name: metric - schema: - type: string - description: SLE metric name to retrieve classifiers for. Required when query_type is classifiers. Use query_type=metrics first to discover available metric names - required: false - required_if: - test: - - classifiers - requests: - metrics: - list: - operationId: listSiteSlesMetrics - function: mistapi.api.v1.sites.sle.listSiteSlesMetrics(apisession, site_id=str(site_id), scope=scope.value, scope_id=scope_id) - classifiers: - list: - operationId: listSiteSleMetricClassifiers - function: mistapi.api.v1.sites.sle.listSiteSleMetricClassifiers(apisession, site_id=str(site_id), scope=scope.value, scope_id=scope_id, metric=metric) +# listSiteSleInfo: +# type: tool_consolidation +# tags: [sles] +# description: List SLE metadata for a site scope. Use metrics to list available SLE metrics for a given scope, or classifiers to list the classifiers available for a specific metric. +# read_only_hint: true +# destructive_hint: false +# match_name: query_type +# parameters: +# - name: site_id +# schema: +# type: string +# format: uuid +# description: Site ID +# required: true +# - name: query_type +# schema: +# type: string +# enum: [metrics, classifiers] +# description: "Type of metadata to retrieve: metrics returns the list of available SLE metrics for the given scope; classifiers returns the list of classifiers for a specific metric (requires metric parameter)" +# required: true +# - name: scope +# schema: +# type: string +# enum: [ap, client, gateway, site, switch] +# description: "Scope of the SLE data: site, ap, client, gateway, or switch" +# required: true +# - name: scope_id +# schema: +# type: string +# description: "ID of the scoped object: `site_id` if `scope=site`; `device_id` if `scope=ap`, `switch`, or `gateway`; `MAC address` if `scope=client`" +# required: true +# - name: metric +# schema: +# type: string +# description: SLE metric name to retrieve classifiers for. Required when query_type is classifiers. Use query_type=metrics first to discover available metric names +# required: false +# required_if: +# test: +# - classifiers +# requests: +# metrics: +# list: +# operationId: listSiteSlesMetrics +# function: mistapi.api.v1.sites.sle.listSiteSlesMetrics(apisession, site_id=str(site_id), scope=scope.value, scope_id=scope_id) +# classifiers: +# list: +# operationId: listSiteSleMetricClassifiers +# function: mistapi.api.v1.sites.sle.listSiteSleMetricClassifiers(apisession, site_id=str(site_id), scope=scope.value, scope_id=scope_id, metric=metric) searchAlarms: type: tool_consolidation @@ -1605,85 +1605,85 @@ searchNacUserMacs: operationId: getOrgUserMac function: mistapi.api.v1.orgs.usermacs.getOrgUserMac(apisession, org_id=str(org_id), usermac_id=str(usermac_id) ) -getOrgSle: - type: tool_consolidation - tags: [sles] - description: Get Org SLEs (all/worst sites, Mx Edges, ...). Use the `mist_get_insight_metrics` tool to get the list of available SLE metrics - read_only_hint: true - destructive_hint: false - parameters: - - name: org_id - schema: - type: string - format: uuid - description: Organization ID - required: true - - name: metric - schema: - type: string - description: Metric to look at. Use the `mist_get_insight_metrics` tool to get the list of available SLE metrics - required: true - - name: sle - schema: - type: string - description: Type of SLE data to retrieve for the organization sites. Use the `mist_get_insight_metrics` tool to get the list of available SLE metrics - required: false - - name: start - schema: - type: integer - description: Start time (epoch timestamp in seconds) - required: false - - name: end - schema: - type: integer - description: End time (epoch timestamp in seconds) - required: false - requests: - default: - get: - operationId: getOrgSle - function: mistapi.api.v1.orgs.insights.getOrgSle(apisession, org_id=str(org_id), metric=str(metric), sle=str(sle) if sle else None, start=str(start) if start else None, end=str(end) if end else None) +# getOrgSle: +# type: tool_consolidation +# tags: [sles] +# description: Get Org SLEs (all/worst sites, Mx Edges, ...). Use the `mist_get_insight_metrics` tool to get the list of available SLE metrics +# read_only_hint: true +# destructive_hint: false +# parameters: +# - name: org_id +# schema: +# type: string +# format: uuid +# description: Organization ID +# required: true +# - name: metric +# schema: +# type: string +# description: Metric to look at. Use the `mist_get_insight_metrics` tool to get the list of available SLE metrics +# required: true +# - name: sle +# schema: +# type: string +# description: Type of SLE data to retrieve for the organization sites. Use the `mist_get_insight_metrics` tool to get the list of available SLE metrics +# required: false +# - name: start +# schema: +# type: integer +# description: Start time (epoch timestamp in seconds) +# required: false +# - name: end +# schema: +# type: integer +# description: End time (epoch timestamp in seconds) +# required: false +# requests: +# default: +# get: +# operationId: getOrgSle +# function: mistapi.api.v1.orgs.insights.getOrgSle(apisession, org_id=str(org_id), metric=str(metric), sle=str(sle) if sle else None, start=str(start) if start else None, end=str(end) if end else None) -getOrgSitesSle: - type: tool_consolidation - tags: [sles] - description: Get SLE summary for the organization sites. - read_only_hint: true - destructive_hint: false - parameters: - - name: org_id - schema: - type: string - format: uuid - description: Organization ID - required: true - - name: sle - schema: - type: string - enum: [wifi, wired, wan] - description: Type of SLE data to retrieve for the sites. Possible values are `wifi`, `wired`, and `wan` - required: true - - name: start - schema: - type: integer - description: Start time (epoch timestamp in seconds) - required: false - - name: end - schema: - type: integer - description: End time (epoch timestamp in seconds) - required: false - - name: limit - schema: - type: integer - default: 20 - description: Max number of results to return (max 1000) - required: false - requests: - default: - get: - operationId: getOrgSitesSle - function: mistapi.api.v1.orgs.insights.getOrgSitesSle(apisession, org_id=str(org_id), sle=sle.value, start=str(start) if start else None, end=str(end) if end else None, limit=limit ) +# getOrgSitesSle: +# type: tool_consolidation +# tags: [sles] +# description: Get SLE summary for the organization sites. +# read_only_hint: true +# destructive_hint: false +# parameters: +# - name: org_id +# schema: +# type: string +# format: uuid +# description: Organization ID +# required: true +# - name: sle +# schema: +# type: string +# enum: [wifi, wired, wan] +# description: Type of SLE data to retrieve for the sites. Possible values are `wifi`, `wired`, and `wan` +# required: true +# - name: start +# schema: +# type: integer +# description: Start time (epoch timestamp in seconds) +# required: false +# - name: end +# schema: +# type: integer +# description: End time (epoch timestamp in seconds) +# required: false +# - name: limit +# schema: +# type: integer +# default: 20 +# description: Max number of results to return (max 1000) +# required: false +# requests: +# default: +# get: +# operationId: getOrgSitesSle +# function: mistapi.api.v1.orgs.insights.getOrgSitesSle(apisession, org_id=str(org_id), sle=sle.value, start=str(start) if start else None, end=str(end) if end else None, limit=limit ) troubleshoot: type: tool_consolidation diff --git a/src/mistmcp/tool_helper.py b/src/mistmcp/tool_helper.py index 4752684..65579cb 100644 --- a/src/mistmcp/tool_helper.py +++ b/src/mistmcp/tool_helper.py @@ -20,10 +20,10 @@ class McpToolsCategory(Enum): WRITE_DELETE = "write_delete" WRITE = "write" UTILITIES = "utilities" + SLES = "sles" UTILITIES_UPGRADE = "utilities_upgrade" SITES_INSIGHTS = "sites_insights" CONSTANTS = "constants" - SLES = "sles" SELF_ACCOUNT = "self_account" SITES_RRM = "sites_rrm" ORGS = "orgs" @@ -62,7 +62,7 @@ class McpToolsCategory(Enum): }, "info": { "description": "Tools that provide information about the sites and organizations.", - "tools": ["mist_get_next_page", "mist_get_org_or_site_info"], + "tools": ["mist_get_next_page"], }, "marvis": { "description": "Marvis is a virtual network assistant that provides insights and analytics for the Mist network. It can be used to analyze network performance, troubleshoot issues, and optimize network configurations.\n\nIt includes features such as synthetic tests, which allow users to simulate network traffic and measure performance metrics.", @@ -94,9 +94,7 @@ class McpToolsCategory(Enum): }, "sles": { "description": "SLEs, or Service-Level Expectations, are metrics used to monitor and report on the user experience of a Wireless, Wired or Wan network.\\n\\nThey are generated through data science and machine learning algorithms and provide insights into various aspects of the network, such as coverage, capacity, connectivity, and performance.\\n\\nMist SLEs help identify when users do not have sufficient network quality, when they face issues with connecting or roaming between access points, and when there are problems on the wired network.\\n\\n SLEs API Calls at the MSP level can be used to retrieve the SLEs summary for each Organization attached to the MSP account.", - "tools": [ - "mist_get_sle", - ], + "tools": ["mist_get_sle"], }, "stats": { "description": "Tools that provide various statistics about the organizations, sites, devices, clients, ports and more.", diff --git a/src/mistmcp/tools/get_configuration_objects.py b/src/mistmcp/tools/get_configuration_objects.py index f7aeecf..ffbc4ff 100644 --- a/src/mistmcp/tools/get_configuration_objects.py +++ b/src/mistmcp/tools/get_configuration_objects.py @@ -133,8 +133,7 @@ class Object_type(Enum): async def get_configuration_objects( org_id: Annotated[UUID, Field(description="""Organization ID""")], object_type: Annotated[ - Object_type, Field( - description="""Type of configuration object to retrieve""") + Object_type, Field(description="""Type of configuration object to retrieve""") ], site_id: Annotated[ UUID, @@ -244,9 +243,7 @@ async def _org_configuration_objects_getter( ) -> _APIResponse: match object_type: case "org_info": - response = mistapi.api.v1.orgs.orgs.getOrg( - apisession, org_id=str(org_id) - ) + response = mistapi.api.v1.orgs.orgs.getOrg(apisession, org_id=str(org_id)) await process_response(response) case "org_settings": response = mistapi.api.v1.orgs.setting.getOrgSettings( @@ -1147,8 +1144,7 @@ async def _get_computed_device_configuration( elif isinstance(value, dict) and isinstance( switch_data.get(key, {}), dict ): - switch_data[key] = { - **switch_data.get(key, {}), **value} + switch_data[key] = {**switch_data.get(key, {}), **value} elif isinstance(value, list) and isinstance( switch_data.get(key, []), list ): @@ -1163,8 +1159,7 @@ async def _get_computed_device_configuration( ) await process_response(site_data) if isinstance(site_data.data, dict): - gateway_template_id = site_data.data.get( - "gatewaytemplate_id") + gateway_template_id = site_data.data.get("gatewaytemplate_id") if gateway_template_id: response = ( mistapi.api.v1.orgs.gatewaytemplates.getOrgGatewayTemplate( @@ -1189,8 +1184,7 @@ async def _get_computed_device_configuration( elif isinstance(value, list) and isinstance( gateway_data.get(key, []), list ): - gateway_data[key] = gateway_data.get( - key, []) + value + gateway_data[key] = gateway_data.get(key, []) + value else: gateway_data[key] = value device_data.data = gateway_data @@ -1255,8 +1249,7 @@ def _process_switch_rule( elif k.startswith("match_model"): match_model_enabled = True del rule_cleansed[k] - match_model_true = _process_switch_rule_match( - switch_model, k, v) + match_model_true = _process_switch_rule_match(switch_model, k, v) elif k == "match_role": match_role_enabled = True match_role_true = _process_switch_rule_match(switch_role, k, v) @@ -1283,12 +1276,11 @@ def _process_switch_rule_match( switch_value: str, match_key: str, match_value: str ) -> bool: if ":" in match_key: - match_start, match_stop = match_key.replace( - "]", "").split("[")[1].split(":") + match_start, match_stop = match_key.replace("]", "").split("[")[1].split(":") try: if ( len(switch_value) > int(match_stop) - and switch_value[int(match_start): int(match_stop)].lower() + and switch_value[int(match_start) : int(match_stop)].lower() == match_value.lower() ): return True diff --git a/src/mistmcp/tools/get_sle.py b/src/mistmcp/tools/get_sle.py index 20e3951..358fa4c 100644 --- a/src/mistmcp/tools/get_sle.py +++ b/src/mistmcp/tools/get_sle.py @@ -354,17 +354,15 @@ async def get_sle( duration=duration if duration else None, ) case ObjectType.IMPACTED_GATEWAYS: - response = ( - mistapi.api.v1.sites.sle.listSiteSleImpactedGateways( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) + response = mistapi.api.v1.sites.sle.listSiteSleImpactedGateways( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, ) case ObjectType.IMPACTED_INTERFACES: response = ( @@ -380,17 +378,15 @@ async def get_sle( ) ) case ObjectType.IMPACTED_SWITCHES: - response = ( - mistapi.api.v1.sites.sle.listSiteSleImpactedSwitches( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) + response = mistapi.api.v1.sites.sle.listSiteSleImpactedSwitches( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, ) case ObjectType.IMPACTED_WIRELESS_CLIENTS: response = ( @@ -419,17 +415,15 @@ async def get_sle( ) ) case ObjectType.IMPACTED_CHASSIS: - response = ( - mistapi.api.v1.sites.sle.listSiteSleImpactedChassis( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) + response = mistapi.api.v1.sites.sle.listSiteSleImpactedChassis( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, ) case ObjectType.HISTOGRAM: response = mistapi.api.v1.sites.sle.getSiteSleHistogram( From d7c72c9a076d633a12faf84577dd2d24f5fa3d37 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 09:31:11 -0700 Subject: [PATCH 12/21] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- mcp_generator/generate_from_openapi.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mcp_generator/generate_from_openapi.py b/mcp_generator/generate_from_openapi.py index 77068a6..b5afdf9 100644 --- a/mcp_generator/generate_from_openapi.py +++ b/mcp_generator/generate_from_openapi.py @@ -42,8 +42,8 @@ # - running as script: `python mcp_generator/generate_from_openapi.py` # - running as module: `python -m mcp_generator.generate_from_openapi` try: - from templates.tmpl_get_sle import GET_SLE_OPERATION_IDS, GET_SLE_TEMPLATE - from templates.tmpl_tool_utilities import UTILITIES_TEMPLATE + from mcp_generator.templates.tmpl_get_sle import GET_SLE_OPERATION_IDS, GET_SLE_TEMPLATE + from mcp_generator.templates.tmpl_tool_utilities import UTILITIES_TEMPLATE from mcp_generator.templates.tmpl_get_configuration_object_schema import ( GET_CONFIGURATION_OBJECT_SCHEMA_TEMPLATE, From db73cbcb2689ff04ac5250470bccdf6424c00b40 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 09:31:40 -0700 Subject: [PATCH 13/21] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../templates/tmpl_tool_change_configuration_objects.py | 1 - 1 file changed, 1 deletion(-) diff --git a/mcp_generator/templates/tmpl_tool_change_configuration_objects.py b/mcp_generator/templates/tmpl_tool_change_configuration_objects.py index 2d70527..fb974fc 100644 --- a/mcp_generator/templates/tmpl_tool_change_configuration_objects.py +++ b/mcp_generator/templates/tmpl_tool_change_configuration_objects.py @@ -68,7 +68,6 @@ "updateOrgWxTag", "createOrgWxTag", "deleteOrgWxTag", - "Site Operations:", "updateSiteInfo", "deleteSite", "updateSiteSettings", From e6156872516ab1a18afcf80d1bd7361feab69177 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 09:32:21 -0700 Subject: [PATCH 14/21] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- src/mistmcp/tools/get_sle.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/mistmcp/tools/get_sle.py b/src/mistmcp/tools/get_sle.py index 358fa4c..507b83f 100644 --- a/src/mistmcp/tools/get_sle.py +++ b/src/mistmcp/tools/get_sle.py @@ -482,6 +482,13 @@ async def get_sle( "message": "`scope` is required when `sle_scope` is `site_metrics`.", } ) + if scope == SiteSleScope.MXEDGE: + raise ToolError( + { + "status_code": 400, + "message": "`scope=mxedge` is not supported when `sle_scope` is `site_metrics`. Use `ap`, `client`, `gateway`, `switch`, or `site`.", + } + ) if not scope_id: raise ToolError( { From 23659ab36b2b1e75f1c740b396b2e87f418fa4f7 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 09:32:32 -0700 Subject: [PATCH 15/21] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- src/mistmcp/tools/get_sle.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/mistmcp/tools/get_sle.py b/src/mistmcp/tools/get_sle.py index 507b83f..accd4be 100644 --- a/src/mistmcp/tools/get_sle.py +++ b/src/mistmcp/tools/get_sle.py @@ -519,6 +519,13 @@ async def get_sle( "message": "`scope` is required when `sle_scope` is `site_classifiers`.", } ) + if scope == SiteSleScope.MXEDGE: + raise ToolError( + { + "status_code": 400, + "message": "`scope=mxedge` is not supported when `sle_scope` is `site_classifiers`. Use `ap`, `client`, `gateway`, `switch`, or `site`.", + } + ) if not scope_id: raise ToolError( { From 458f90e02d7556e73308dcfa74f619ceeece1a6b Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 09:40:26 -0700 Subject: [PATCH 16/21] docs: update object type descriptions for organization and site-level read types --- src/mistmcp/server.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/mistmcp/server.py b/src/mistmcp/server.py index bfd3a2e..b04a442 100644 --- a/src/mistmcp/server.py +++ b/src/mistmcp/server.py @@ -95,6 +95,8 @@ ## Org-Level Read Types | object_type | Description | | - | - | +| org_info | Organization information | +| org_settings | Organization settings | | org_alarmtemplates | Alarm rules templates assigned to sites | | org_wlans | Org WLAN definitions | | org_sitegroups | Groups of sites for bulk assignment | @@ -115,6 +117,7 @@ | org_rftemplates | RF templates (channels, TX power, bands) | | org_services | Application/service definitions | | org_servicepolicies | Security/firewall policies | +| org_sites | List all sites — primary way to get `site_id` | | org_sitetemplates | Site attribute/settings templates | | org_vpns | WAN Overlay VPN hub/spoke configs | | org_webhooks | Real-time event push endpoints | @@ -125,6 +128,8 @@ ## Site-Level Read Types | object_type | Description | | - | - | +| site_info | Site information | +| site_settings | Site settings | | site_evpn_topologies | Site EVPN topologies | | site_maps | Site map objects | | site_mxedges | Mist Edge appliances at a site | @@ -174,8 +179,6 @@ ## Read-Only Helper Types (mist_get_configuration_objects only) | object_type | Description | | - | - | -| org | Organization settings | -| org_sites | List all sites — primary way to get `site_id` | # PAGINATION When a response includes `next` (or legacy `_next`), pass that URL to `mist_get_next_page(url=)` for more results. From 2a21a03cf5b20911d0b673e62273e148b7019f57 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 09:40:56 -0700 Subject: [PATCH 17/21] docs: remove deprecated tool from account and navigation section in README --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 4c8c2cb..00fbe1f 100644 --- a/README.md +++ b/README.md @@ -19,7 +19,7 @@ The server exposes a focused set of tools grouped by workflow. This is the quick | Workflow | Main tools | What they are used for | | - | - | - | -| Account and navigation | `mist_get_self`, `mist_get_org_or_site_info`, `mist_get_next_page`, `mist_get_constants` | Resolve account details, discover IDs, follow pagination, and look up fixed Mist constants before making deeper queries. | +| Account and navigation | `mist_get_self`, `mist_get_next_page`, `mist_get_constants` | Resolve account details, discover IDs, follow pagination, and look up fixed Mist constants before making deeper queries. | | Device and client lookup | `mist_search_device`, `mist_search_client`, `mist_search_guest_authorization`, `mist_search_nac_user_macs` | Find devices, clients, guest authorizations, and NAC-related client entries by name, MAC, IP, serial, model, or other filters. | | Configuration read | `mist_get_configuration_objects`, `mist_get_configuration_object_schema`, `mist_search_device_config_history` | Inspect org or site configuration, discover valid schema fields, and review recent configuration history on devices. | | Configuration changes | `mist_update_configuration_objects`, `mist_change_configuration_objects` | Create, update, and delete supported configuration objects. These tools require `--enable-write-tools`. | From 6ee513a5f935651f885a85327e71392b9ae9872a Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 09:42:33 -0700 Subject: [PATCH 18/21] refactor: streamline response assignment for impacted objects and add error handling for unsupported scope --- mcp_generator/templates/tmpl_get_sle.py | 74 ++++++++++++++----------- 1 file changed, 41 insertions(+), 33 deletions(-) diff --git a/mcp_generator/templates/tmpl_get_sle.py b/mcp_generator/templates/tmpl_get_sle.py index 29de677..e8c3c83 100644 --- a/mcp_generator/templates/tmpl_get_sle.py +++ b/mcp_generator/templates/tmpl_get_sle.py @@ -375,17 +375,15 @@ async def get_sle( duration=duration if duration else None, ) case ObjectType.IMPACTED_GATEWAYS: - response = ( - mistapi.api.v1.sites.sle.listSiteSleImpactedGateways( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) + response = mistapi.api.v1.sites.sle.listSiteSleImpactedGateways( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, ) case ObjectType.IMPACTED_INTERFACES: response = ( @@ -401,17 +399,15 @@ async def get_sle( ) ) case ObjectType.IMPACTED_SWITCHES: - response = ( - mistapi.api.v1.sites.sle.listSiteSleImpactedSwitches( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) + response = mistapi.api.v1.sites.sle.listSiteSleImpactedSwitches( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, ) case ObjectType.IMPACTED_WIRELESS_CLIENTS: response = ( @@ -440,17 +436,15 @@ async def get_sle( ) ) case ObjectType.IMPACTED_CHASSIS: - response = ( - mistapi.api.v1.sites.sle.listSiteSleImpactedChassis( - apisession, - site_id=str(site_id), - scope=scope.value, - scope_id=scope_id, - metric=metric, - start=str(start) if start else None, - end=str(end) if end else None, - duration=duration if duration else None, - ) + response = mistapi.api.v1.sites.sle.listSiteSleImpactedChassis( + apisession, + site_id=str(site_id), + scope=scope.value, + scope_id=scope_id, + metric=metric, + start=str(start) if start else None, + end=str(end) if end else None, + duration=duration if duration else None, ) case ObjectType.HISTOGRAM: response = mistapi.api.v1.sites.sle.getSiteSleHistogram( @@ -509,6 +503,13 @@ async def get_sle( "message": "`scope` is required when `sle_scope` is `site_metrics`.", } ) + if scope == SiteSleScope.MXEDGE: + raise ToolError( + { + "status_code": 400, + "message": "`scope=mxedge` is not supported when `sle_scope` is `site_metrics`. Use `ap`, `client`, `gateway`, `switch`, or `site`.", + } + ) if not scope_id: raise ToolError( { @@ -539,6 +540,13 @@ async def get_sle( "message": "`scope` is required when `sle_scope` is `site_classifiers`.", } ) + if scope == SiteSleScope.MXEDGE: + raise ToolError( + { + "status_code": 400, + "message": "`scope=mxedge` is not supported when `sle_scope` is `site_classifiers`. Use `ap`, `client`, `gateway`, `switch`, or `site`.", + } + ) if not scope_id: raise ToolError( { From 0878f1d006fcc90ff94b003dac7d966f65551313 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 11:28:53 -0700 Subject: [PATCH 19/21] Refactor guest authorization and client search tools - Removed the `searchGuestAuthorization` tool and integrated its functionality into the `searchClient` tool, allowing for guest and site guest searches based on client type. - Updated the `searchClient` tool to support new client types: Org guest and Site guest. - Enhanced parameter validation in `searchClient` to ensure compatibility with client types. - Deleted the `search_guest_authorization.py` file as its functionality is now handled within `searchClient`. - Updated the `tools_optimization.yaml` to reflect the changes in the client search tool and removed the deprecated guest authorization tool. - Adjusted the `McpToolsCategory` enum to include a dedicated `CLIENTS` category. --- mcp_generator/generate_from_openapi.py | 22 +- mcp_generator/templates/tmpl_search_client.py | 344 +++++++++++++++ mcp_generator/tools_optimization.yaml | 417 ++++++++++-------- mist_openapi | 2 +- src/mistmcp/tool_helper.py | 4 +- src/mistmcp/tools/search_client.py | 136 +++++- .../tools/search_guest_authorization.py | 174 -------- 7 files changed, 709 insertions(+), 390 deletions(-) create mode 100644 mcp_generator/templates/tmpl_search_client.py delete mode 100644 src/mistmcp/tools/search_guest_authorization.py diff --git a/mcp_generator/generate_from_openapi.py b/mcp_generator/generate_from_openapi.py index b5afdf9..0dea0a9 100644 --- a/mcp_generator/generate_from_openapi.py +++ b/mcp_generator/generate_from_openapi.py @@ -42,8 +42,10 @@ # - running as script: `python mcp_generator/generate_from_openapi.py` # - running as module: `python -m mcp_generator.generate_from_openapi` try: - from mcp_generator.templates.tmpl_get_sle import GET_SLE_OPERATION_IDS, GET_SLE_TEMPLATE - from mcp_generator.templates.tmpl_tool_utilities import UTILITIES_TEMPLATE + from templates.tmpl_search_client import ( + SEARCH_CLIENT_OPERATION_IDS, + SEARCH_CLIENT_TEMPLATE, + ) from mcp_generator.templates.tmpl_get_configuration_object_schema import ( GET_CONFIGURATION_OBJECT_SCHEMA_TEMPLATE, @@ -52,6 +54,10 @@ GET_CONFIGURATION_OBJECTS_OPERATION_IDS, GET_CONFIGURATION_OBJECTS_TEMPLATE, ) + from mcp_generator.templates.tmpl_get_sle import ( + GET_SLE_OPERATION_IDS, + GET_SLE_TEMPLATE, + ) from mcp_generator.templates.tmpl_getnextpage import GET_NEXT_PAGE_TEMPLATE from mcp_generator.templates.tmpl_helper import TOOLS_HELPER from mcp_generator.templates.tmpl_init import INIT_TEMPLATE @@ -70,6 +76,7 @@ from mcp_generator.templates.tmpl_tool_update_configuration_objects import ( UPDATE_CONFIGURATION_OBJECTS_TEMPLATE, ) + from mcp_generator.templates.tmpl_tool_utilities import UTILITIES_TEMPLATE from mcp_generator.templates.tmpl_tool_write import TOOL_TEMPLATE_WRITE from mcp_generator.templates.tmpl_tool_write_delete import ( TOOL_TEMPLATE_WRITE_DELETE, @@ -87,6 +94,10 @@ from templates.tmpl_helper import TOOLS_HELPER from templates.tmpl_init import INIT_TEMPLATE from templates.tmpl_req import REQ_OPTIMIZED_TEMPLATE, REQ_TEMPLATE + from templates.tmpl_search_client import ( + SEARCH_CLIENT_OPERATION_IDS, + SEARCH_CLIENT_TEMPLATE, + ) from templates.tmpl_tool_change_configuration_objects import ( CHANGE_CONFIGURATION_OBJECTS_OPERATION_IDS, CHANGE_CONFIGURATION_OBJECTS_TEMPLATE, @@ -99,7 +110,6 @@ from templates.tmpl_tool_utilities import UTILITIES_TEMPLATE from templates.tmpl_tool_write import TOOL_TEMPLATE_WRITE from templates.tmpl_tool_write_delete import TOOL_TEMPLATE_WRITE_DELETE - # --------------------------------------------------------------------------- # CONFIGURATION CONSTANTS # --------------------------------------------------------------------------- @@ -169,6 +179,12 @@ "tag": "sles", "operation_ids": GET_SLE_OPERATION_IDS, }, + { + "name": "search_client", + "template": SEARCH_CLIENT_TEMPLATE, + "tag": "clients", + "operation_ids": SEARCH_CLIENT_OPERATION_IDS, + }, ] # Global read-only hint for tool generation READ_ONLY_HINT = True diff --git a/mcp_generator/templates/tmpl_search_client.py b/mcp_generator/templates/tmpl_search_client.py new file mode 100644 index 0000000..c0e8efa --- /dev/null +++ b/mcp_generator/templates/tmpl_search_client.py @@ -0,0 +1,344 @@ +SEARCH_CLIENT_OPERATION_IDS = [ + "searchOrgWanClients", + "searchOrgWiredClients", + "searchOrgWirelessClients", + "searchOrgNacClients", + "getOrgGuestAuthorization", + "searchOrgGuestAuthorization", + "getSiteGuestAuthorization", + "searchSiteGuestAuthorization", +] + +SEARCH_CLIENT_TEMPLATE = '''""" +-------------------------------------------------------------------------------- +-------------------------------- Mist MCP SERVER ------------------------------- + + Written by: Thomas Munzer (tmunzer@juniper.net) + Github : https://github.com/tmunzer/mistmcp + + This package is licensed under the MIT License. + +-------------------------------------------------------------------------------- +""" + +from enum import Enum +from typing import Annotated +from uuid import UUID + +import mistapi +from fastmcp.exceptions import ToolError +from pydantic import Field + +from mistmcp.logger import logger +from mistmcp.request_processor import get_apisession +from mistmcp.response_formatter import format_response +from mistmcp.response_processor import handle_network_error, process_response +from mistmcp.server import mcp + + +class Client_type(Enum): + WAN = "wan" + WIRED = "wired" + WIRELESS = "wireless" + NAC = "nac" + ORG_GUEST = "org_guest" + SITE_GUEST = "site_guest" + + +class Band(Enum): + B24 = "24" + B5 = "5" + B6 = "6" + + +@mcp.tool( + name="mist_search_client", + description="""Search for clients across an organization or specific site. +Supports searching by client type (WAN, wired, wireless, NAC), MAC address, hostname, IP address, and more. +Use wildcards (*) for partial matches on MAC address, hostname, IP, and text fields. +Different client types support different filter parameters - the tool will validate compatibility.""", + tags={"clients"}, + annotations={ + "title": "Search client", + "readOnlyHint": True, + "destructiveHint": False, + "openWorldHint": True, + "idempotentHint": True, + }, +) +async def search_client( + client_type: Annotated[ + Client_type, + Field( + description="""Type of client: WAN, wired, wireless, NAC, Org guest, or Site guest""" + ), + ], + org_id: Annotated[UUID, Field(description="""Organization ID""")], + site_id: Annotated[UUID, Field(description="""Site ID""", default=None)], + device_mac: Annotated[ + str, + Field( + description="""Partial / full MAC Address of the Access Point or the Switch. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported. Not applicable for WAN clients or Org/Site Guests""", + default=None, + ), + ], + band: Annotated[ + Band, + Field( + description="""802.11 band (24 or 5 or 6 GHz). Wireless clients only""", + default=None, + ), + ], + mac: Annotated[ + str, + Field( + description="""Partial / full Client MAC Address. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported""", + default=None, + ), + ], + hostname: Annotated[ + str, + Field( + description="""Partial / full Client hostname. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `everest*` and `*rest*` match `my-everest-client`). Suffix-only wildcards (e.g. `*everest`) are not supported. Not applicable for WAN or wired clients or Org/Site Guests""", + default=None, + ), + ], + ip: Annotated[ + str, + Field( + description="""Partial / full Client IP Address. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `10.100.10.*` and `*100.10.*` match `10.100.10.54`). Suffix-only wildcards (e.g. `*.54`) are not supported. Not applicable for NAC clients or Org/Site Guests""", + default=None, + ), + ], + wlan_id: Annotated[ + UUID, + Field( + description="""WLAN ID to filter by. Only applicable for wireless clients and Guests""", + default=None, + ), + ], + ssid: Annotated[ + str, + Field( + description="""SSID name to filter by. Only applicable for wireless clients, Guests, and NAC clients""", + default=None, + ), + ], + text: Annotated[ + str, + Field( + description="""Free text search in client details (supports * wildcard). Not applicable for WAN clients or Org/Site Guests""", + default=None, + ), + ], + start: Annotated[ + int, Field( + description="""Start of time range (epoch seconds)""", default=None) + ], + end: Annotated[ + int, Field( + description="""End of time range (epoch seconds)""", default=None) + ], + limit: Annotated[ + int, Field(description="""Max number of results per page""", default=20) + ] = 20, +) -> dict | list | str: + """Search for clients across an organization or specific site. + Supports searching by client type (WAN, wired, wireless, NAC), MAC address, hostname, IP address, and more. + Use wildcards (*) for partial matches on MAC address, hostname, IP, and text fields. + Different client types support different filter parameters - the tool will validate compatibility.""" + + logger.debug("Tool search_client called") + logger.debug( + "Input Parameters: client_type: %s, org_id: %s, site_id: %s, device_mac: %s, band: %s, mac: %s, hostname: %s, ip: %s, wlan_id: %s, ssid: %s, text: %s, start: %s, end: %s, limit: %s", + client_type, + org_id, + site_id, + device_mac, + band, + mac, + hostname, + ip, + wlan_id, + ssid, + text, + start, + end, + limit, + ) + + apisession, response_format = await get_apisession() + + try: + object_type = client_type + + if device_mac and client_type.value not in ["wireless", "wired"]: + raise ToolError( + { + "status_code": 400, + "message": '`device_mac` parameter can only be used when `client_type` is in "wireless", "wired".', + } + ) + + if band and client_type.value not in ["wireless"]: + raise ToolError( + { + "status_code": 400, + "message": '`band` parameter can only be used when `client_type` is "wireless".', + } + ) + + if hostname and client_type.value not in ["wireless", "nac"]: + raise ToolError( + { + "status_code": 400, + "message": '`hostname` parameter can only be used when `client_type` is in "wireless", "nac".', + } + ) + + if ip and client_type.value not in ["wan", "wired", "wireless"]: + raise ToolError( + { + "status_code": 400, + "message": '`ip` parameter can only be used when `client_type` is in "wan", "wired", "wireless".', + } + ) + + if wlan_id and client_type.value not in ["wireless", "org_guest", "site_guest"]: + raise ToolError( + { + "status_code": 400, + "message": '`wlan_id` parameter can only be used when `client_type` is in "wireless", "org_guest", "site_guest".', + } + ) + + if ssid and client_type.value not in [ + "wireless", + "org_guest", + "site_guest", + "nac", + ]: + raise ToolError( + { + "status_code": 400, + "message": '`ssid` parameter can only be used when `client_type` is in "wireless", "org_guest", "site_guest", "nac".', + } + ) + + if text and client_type.value not in ["wired", "wireless", "nac"]: + raise ToolError( + { + "status_code": 400, + "message": '`text` parameter can only be used when `client_type` is in "wired", "wireless", "nac".', + } + ) + + match object_type.value: + case "wan": + response = mistapi.api.v1.orgs.wan_clients.searchOrgWanClients( + apisession, + org_id=str(org_id), + site_id=str(site_id) if site_id else None, + mac=str(mac) if mac else None, + hostname=str(hostname) if hostname else None, + ip=str(ip) if ip else None, + start=str(start) if start else None, + end=str(end) if end else None, + limit=limit, + ) + await process_response(response) + case "wired": + response = mistapi.api.v1.orgs.wired_clients.searchOrgWiredClients( + apisession, + org_id=str(org_id), + site_id=str(site_id) if site_id else None, + device_mac=str(device_mac) if device_mac else None, + mac=str(mac) if mac else None, + ip=str(ip) if ip else None, + text=str(text) if text else None, + start=str(start) if start else None, + end=str(end) if end else None, + limit=limit, + ) + await process_response(response) + case "wireless": + response = mistapi.api.v1.orgs.clients.searchOrgWirelessClients( + apisession, + org_id=str(org_id), + site_id=str(site_id) if site_id else None, + ap=str(device_mac) if device_mac else None, + band=str(band) if band else None, + ssid=str(ssid) if ssid else None, + mac=str(mac) if mac else None, + hostname=str(hostname) if hostname else None, + ip=str(ip) if ip else None, + text=str(text) if text else None, + start=str(start) if start else None, + end=str(end) if end else None, + limit=limit, + ) + await process_response(response) + case "nac": + response = mistapi.api.v1.orgs.nac_clients.searchOrgNacClients( + apisession, + org_id=str(org_id), + site_id=str(site_id) if site_id else None, + ssid=str(ssid) if ssid else None, + mac=str(mac) if mac else None, + hostname=str(hostname) if hostname else None, + text=str(text) if text else None, + start=str(start) if start else None, + end=str(end) if end else None, + limit=limit, + ) + await process_response(response) + case "org_guest": + if mac: + response = mistapi.api.v1.orgs.guests.getOrgGuestAuthorization( + apisession, org_id=str(org_id), guest_mac=str(mac) + ) + await process_response(response) + else: + response = mistapi.api.v1.orgs.guests.searchOrgGuestAuthorization( + apisession, + org_id=str(org_id), + ssid=str(ssid) if ssid else None, + wlan_id=str(wlan_id) if wlan_id else None, + start=str(start) if start else None, + end=str(end) if end else None, + limit=limit, + ) + await process_response(response) + case "site_guest": + if mac: + response = mistapi.api.v1.sites.guests.getSiteGuestAuthorization( + apisession, site_id=str(site_id), guest_mac=str(mac) + ) + await process_response(response) + else: + response = mistapi.api.v1.sites.guests.searchSiteGuestAuthorization( + apisession, + site_id=str(site_id), + ssid=str(ssid) if ssid else None, + wlan_id=str(wlan_id) if wlan_id else None, + start=str(start) if start else None, + end=str(end) if end else None, + limit=limit, + ) + await process_response(response) + + case _: + raise ToolError( + { + "status_code": 400, + "message": f"Invalid object_type: {object_type.value}. Valid values are: {[e.value for e in Client_type]}", + } + ) + + except ToolError: + raise + except Exception as _exc: + await handle_network_error(_exc) + + return format_response(response, response_format) +''' diff --git a/mcp_generator/tools_optimization.yaml b/mcp_generator/tools_optimization.yaml index e501c84..72cf35f 100644 --- a/mcp_generator/tools_optimization.yaml +++ b/mcp_generator/tools_optimization.yaml @@ -996,89 +996,89 @@ searchEvents: # operationId: searchSiteDevices # function: mistapi.api.v1.sites.devices.searchSiteDevices(apisession, site_id=str(site_id), type=str(device_type) if device_type else None, hostname=str(hostname) if hostname else None, mac=str(mac) if mac else None, model=str(model) if model else None, limit=limit ) -searchGuestAuthorization: - type: tool_consolidation - tags: [clients] - description: |- - Search for guest authorization entries in an organization or site - read_only_hint: true - destructive_hint: false - parameters: - - name: scope - schema: - type: string - enum: [org, site] - description: Whether to search in the entire organization or a specific site. If `site` is selected, the `site_id` parameter is required - required: true - - name: org_id - schema: - type: string - format: uuid - description: ID of the organization to search for guest authorization entries in - required: true - - name: site_id - schema: - type: string - format: uuid - description: ID of the site to search for guest authorization entries in - required: false - required_if: - scope: - - site - - name: guest_mac - schema: - type: string - description: MAC address of the guest to search for in the authorization entries - required: false - - name: wlan_id - schema: - type: string - format: uuid - description: ID of the WLAN to filter guest authorization entries by - required: false - - name: auth_method - schema: - type: string - description: Authentication method to filter guest authorization entries by - required: false - - name: ssid - schema: - type: string - description: SSID to filter guest authorization entries by - required: false - - name: start - schema: - type: integer - description: Start time (epoch timestamp in seconds) - required: false - - name: end - schema: - type: integer - description: End time (epoch timestamp in seconds) - required: false - - name: limit - schema: - type: integer - default: 20 - description: Max number of results to return (max 1000) - required: false - match_name: scope - if_filter: guest_mac - requests: - org: - list: - operationId: searchOrgGuestAuthorization - function: mistapi.api.v1.orgs.guests.searchOrgGuestAuthorization(apisession,org_id=str(org_id),wlan_id=str(wlan_id) if wlan_id else None,auth_method=auth_method if auth_method else None,ssid=ssid if ssid else None,start=str(start) if start else None,end=str(end) if end else None, limit=limit ) - get: - operationId: getOrgGuestAuthorization - function: mistapi.api.v1.orgs.guests.getOrgGuestAuthorization(apisession, org_id=str(org_id), guest_mac=str(guest_mac) ) - site: - list: - operationId: searchSiteGuestAuthorization - function: mistapi.api.v1.sites.guests.searchSiteGuestAuthorization(apisession, site_id=str(site_id), wlan_id=str(wlan_id) if wlan_id else None, auth_method=auth_method if auth_method else None, ssid=ssid if ssid else None, start=str(start) if start else None, end=str(end) if end else None, limit=limit ) - get: - operationId: getSiteGuestAuthorization - function: mistapi.api.v1.sites.guests.getSiteGuestAuthorization(apisession, site_id=str(site_id), guest_mac=str(guest_mac) ) +# searchGuestAuthorization: +# type: tool_consolidation +# tags: [clients] +# description: |- +# Search for guest authorization entries in an organization or site +# read_only_hint: true +# destructive_hint: false +# parameters: +# - name: scope +# schema: +# type: string +# enum: [org, site] +# description: Whether to search in the entire organization or a specific site. If `site` is selected, the `site_id` parameter is required +# required: true +# - name: org_id +# schema: +# type: string +# format: uuid +# description: ID of the organization to search for guest authorization entries in +# required: true +# - name: site_id +# schema: +# type: string +# format: uuid +# description: ID of the site to search for guest authorization entries in +# required: false +# required_if: +# scope: +# - site +# - name: guest_mac +# schema: +# type: string +# description: MAC address of the guest to search for in the authorization entries +# required: false +# - name: wlan_id +# schema: +# type: string +# format: uuid +# description: ID of the WLAN to filter guest authorization entries by +# required: false +# - name: auth_method +# schema: +# type: string +# description: Authentication method to filter guest authorization entries by +# required: false +# - name: ssid +# schema: +# type: string +# description: SSID to filter guest authorization entries by +# required: false +# - name: start +# schema: +# type: integer +# description: Start time (epoch timestamp in seconds) +# required: false +# - name: end +# schema: +# type: integer +# description: End time (epoch timestamp in seconds) +# required: false +# - name: limit +# schema: +# type: integer +# default: 20 +# description: Max number of results to return (max 1000) +# required: false +# match_name: scope +# if_filter: guest_mac +# requests: +# org: +# list: +# operationId: searchOrgGuestAuthorization +# function: mistapi.api.v1.orgs.guests.searchOrgGuestAuthorization(apisession,org_id=str(org_id),wlan_id=str(wlan_id) if wlan_id else None,auth_method=auth_method if auth_method else None,ssid=ssid if ssid else None,start=str(start) if start else None,end=str(end) if end else None, limit=limit ) +# get: +# operationId: getOrgGuestAuthorization +# function: mistapi.api.v1.orgs.guests.getOrgGuestAuthorization(apisession, org_id=str(org_id), guest_mac=str(guest_mac) ) +# site: +# list: +# operationId: searchSiteGuestAuthorization +# function: mistapi.api.v1.sites.guests.searchSiteGuestAuthorization(apisession, site_id=str(site_id), wlan_id=str(wlan_id) if wlan_id else None, auth_method=auth_method if auth_method else None, ssid=ssid if ssid else None, start=str(start) if start else None, end=str(end) if end else None, limit=limit ) +# get: +# operationId: getSiteGuestAuthorization +# function: mistapi.api.v1.sites.guests.getSiteGuestAuthorization(apisession, site_id=str(site_id), guest_mac=str(guest_mac) ) # getOrgOrSiteInfo: # type: tool_consolidation @@ -1176,112 +1176,151 @@ searchAuditLogs: operationId: listOrgAuditLogs function: mistapi.api.v1.orgs.logs.listOrgAuditLogs(apisession, org_id=str(org_id), start=str(start) if start else None, end=str(end) if end else None, message=str(message) if message else None, limit=limit ) -searchClient: - type: tool_consolidation - tags: [clients] - description: |- - Search for clients across an organization or specific site. - Supports searching by client type (WAN, wired, wireless, NAC), MAC address, hostname, IP address, and more. - Use wildcards (*) for partial matches on MAC address, hostname, IP, and text fields. - Different client types support different filter parameters - the tool will validate compatibility. - read_only_hint: true - destructive_hint: false - match_name: client_type - parameters: - - name: client_type - schema: - type: string - enum: [wired, wireless, wan, nac] - description: "Type of client: WAN, wired, wireless, or NAC" - required: true - - name: org_id - schema: - type: string - format: uuid - description: ID of the organization to search for clients in - required: true - - name: site_id - schema: - type: string - format: uuid - description: Site ID for site-level search (optional) - required: false - - name: device_mac - schema: - type: string - description: Partial / full MAC Address of the Access Point or the Switch. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported - required: false - - name: band - schema: - type: string - enum: ["24", "5", "6"] - description: 802.11 band (24 or 5 or 6 GHz). Wireless clients only - required: false - only_if: - client_type: - - wireless - - name: ssid - schema: - type: string - description: SSID name. Wireless or NAC clients only - required: false - only_if: - client_type: - - wireless - - nac - - name: mac - schema: - type: string - description: Partial / full Client MAC Address. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported - required: false - - name: hostname - schema: - type: string - description: Partial / full Client hostname. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `everest*` and `*rest*` match `my-everest-client`). Suffix-only wildcards (e.g. `*everest`) are not supported. Not applicable for WAN or wired clients - required: false - - name: ip - schema: - type: string - description: Partial / full Client IP Address. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `10.100.10.*` and `*100.10.*` match `10.100.10.54`). Suffix-only wildcards (e.g. `*.54`) are not supported. Not applicable for NAC clients - required: false - - name: text - schema: - type: string - description: Free text search in client details (supports * wildcard). Not applicable for WAN clients - required: false - - name: start - schema: - type: integer - description: Start time (epoch timestamp in seconds) - required: false - - name: end - schema: - type: integer - description: End time (epoch timestamp in seconds) - required: false - - name: limit - schema: - type: integer - default: 20 - description: Max number of results to return (max 1000) - required: false - requests: - wan: - list: - operationId: searchOrgWanClients - function: mistapi.api.v1.orgs.wan_clients.searchOrgWanClients(apisession, org_id=str(org_id), site_id=str(site_id) if site_id else None, mac=str(mac) if mac else None, hostname=str(hostname) if hostname else None, ip=str(ip) if ip else None, start=str(start) if start else None, end=str(end) if end else None, limit=limit ) - wired: - list: - operationId: searchOrgWiredClients - function: mistapi.api.v1.orgs.wired_clients.searchOrgWiredClients(apisession, org_id=str(org_id), site_id=str(site_id) if site_id else None, device_mac=str(device_mac) if device_mac else None, mac=str(mac) if mac else None, ip=str(ip) if ip else None, text=str(text) if text else None, start=str(start) if start else None, end=str(end) if end else None, limit=limit ) - wireless: - list: - operationId: searchOrgWirelessClients - function: mistapi.api.v1.orgs.clients.searchOrgWirelessClients(apisession, org_id=str(org_id), site_id=str(site_id) if site_id else None, ap=str(device_mac) if device_mac else None, band=str(band) if band else None, ssid=str(ssid) if ssid else None, mac=str(mac) if mac else None, hostname=str(hostname) if hostname else None, ip=str(ip) if ip else None, text=str(text) if text else None, start=str(start) if start else None, end=str(end) if end else None, limit=limit ) - nac: - list: - operationId: searchOrgNacClients - function: mistapi.api.v1.orgs.nac_clients.searchOrgNacClients(apisession, org_id=str(org_id), site_id=str(site_id) if site_id else None, ssid=str(ssid) if ssid else None, mac=str(mac) if mac else None, hostname=str(hostname) if hostname else None, text=str(text) if text else None, start=str(start) if start else None, end=str(end) if end else None, limit=limit ) +# searchClient: +# type: tool_consolidation +# tags: [clients] +# description: |- +# Search for clients across an organization or specific site. +# Supports searching by client type (WAN, wired, wireless, NAC), MAC address, hostname, IP address, and more. +# Use wildcards (*) for partial matches on MAC address, hostname, IP, and text fields. +# Different client types support different filter parameters - the tool will validate compatibility. +# read_only_hint: true +# destructive_hint: false +# match_name: client_type +# parameters: +# - name: client_type +# schema: +# type: string +# enum: [wired, wireless, wan, nac, org_guest, site_guest] +# description: "Type of client: WAN, wired, wireless, NAC, Org guest, or Site guest" +# required: true +# - name: org_id +# schema: +# type: string +# format: uuid +# description: ID of the organization to search for clients in +# required: true +# - name: site_id +# schema: +# type: string +# format: uuid +# description: Site ID for site-level search (optional) +# required: false +# - name: device_mac +# schema: +# type: string +# description: Partial / full MAC Address of the Access Point or the Switch. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported. Not applicable for WAN clients or Org/Site Guests +# required: false +# only_if: +# client_type: +# - wireless +# - wired +# - name: band +# schema: +# type: string +# enum: ["24", "5", "6"] +# description: 802.11 band (24 or 5 or 6 GHz). Wireless clients only +# required: false +# only_if: +# client_type: +# - wireless +# - name: mac +# schema: +# type: string +# description: Partial / full Client MAC Address. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported +# required: false +# - name: hostname +# schema: +# type: string +# description: Partial / full Client hostname. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `everest*` and `*rest*` match `my-everest-client`). Suffix-only wildcards (e.g. `*everest`) are not supported. Not applicable for WAN or wired clients or Org/Site Guests +# required: false +# only_if: +# client_type: +# - wireless +# - nac +# - name: ip +# schema: +# type: string +# description: Partial / full Client IP Address. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `10.100.10.*` and `*100.10.*` match `10.100.10.54`). Suffix-only wildcards (e.g. `*.54`) are not supported. Not applicable for NAC clients or Org/Site Guests +# required: false +# only_if: +# client_type: +# - wan +# - wired +# - wireless +# - name: wlan_id +# schema: +# type: string +# format: uuid +# description: WLAN ID to filter by. Only applicable for wireless clients and Guests +# required: false +# only_if: +# client_type: +# - wireless +# - org_guest +# - site_guest +# - name: ssid +# schema: +# type: string +# description: SSID name to filter by. Only applicable for wireless clients, Guests, and NAC clients +# required: false +# only_if: +# client_type: +# - wireless +# - org_guest +# - site_guest +# - nac +# - name: text +# schema: +# type: string +# description: Free text search in client details (supports * wildcard). Not applicable for WAN clients or Org/Site Guests +# required: false +# only_if: +# client_type: +# - wired +# - wireless +# - nac +# - name: start +# schema: +# type: integer +# description: Start time (epoch timestamp in seconds) +# required: false +# - name: end +# schema: +# type: integer +# description: End time (epoch timestamp in seconds) +# required: false +# - name: limit +# schema: +# type: integer +# default: 20 +# description: Max number of results to return (max 1000) +# required: false +# requests: +# wan: +# list: +# operationId: searchOrgWanClients +# function: mistapi.api.v1.orgs.wan_clients.searchOrgWanClients(apisession, org_id=str(org_id), site_id=str(site_id) if site_id else None, mac=str(mac) if mac else None, hostname=str(hostname) if hostname else None, ip=str(ip) if ip else None, start=str(start) if start else None, end=str(end) if end else None, limit=limit ) +# wired: +# list: +# operationId: searchOrgWiredClients +# function: mistapi.api.v1.orgs.wired_clients.searchOrgWiredClients(apisession, org_id=str(org_id), site_id=str(site_id) if site_id else None, device_mac=str(device_mac) if device_mac else None, mac=str(mac) if mac else None, ip=str(ip) if ip else None, text=str(text) if text else None, start=str(start) if start else None, end=str(end) if end else None, limit=limit ) +# wireless: +# list: +# operationId: searchOrgWirelessClients +# function: mistapi.api.v1.orgs.clients.searchOrgWirelessClients(apisession, org_id=str(org_id), site_id=str(site_id) if site_id else None, ap=str(device_mac) if device_mac else None, band=str(band) if band else None, ssid=str(ssid) if ssid else None, mac=str(mac) if mac else None, hostname=str(hostname) if hostname else None, ip=str(ip) if ip else None, text=str(text) if text else None, start=str(start) if start else None, end=str(end) if end else None, limit=limit ) +# nac: +# list: +# operationId: searchOrgNacClients +# function: mistapi.api.v1.orgs.nac_clients.searchOrgNacClients(apisession, org_id=str(org_id), site_id=str(site_id) if site_id else None, ssid=str(ssid) if ssid else None, mac=str(mac) if mac else None, hostname=str(hostname) if hostname else None, text=str(text) if text else None, start=str(start) if start else None, end=str(end) if end else None, limit=limit ) +# org_guest: +# list: +# operationId: searchOrgGuestAuthorization +# function: mistapi.api.v1.orgs.guests.searchOrgGuestAuthorization(apisession, org_id=str(org_id), ssid=str(ssid) if ssid else None, guest_mac=str(mac) if mac else None, wlan_id=str(wlan_id) if wlan_id else None, start=str(start) if start else None, end=str(end) if end else None, limit=limit ) +# site_guest: +# list: +# operationId: searchSiteGuestAuthorization +# function: mistapi.api.v1.sites.guests.searchSiteGuestAuthorization(apisession, site_id=str(site_id), ssid=str(ssid) if ssid else None, guest_mac=str(mac) if mac else None, wlan_id=str(wlan_id) if wlan_id else None, start=str(start) if start else None, end=str(end) if end else None, limit=limit ) listRogueDevices: type: tool_consolidation diff --git a/mist_openapi b/mist_openapi index 3d2a814..0059506 160000 --- a/mist_openapi +++ b/mist_openapi @@ -1 +1 @@ -Subproject commit 3d2a8148e5bbc9e3343b75d1b0e3bec043b94370 +Subproject commit 0059506d17de72a3dd5d1890f1b8f19ebd5930a3 diff --git a/src/mistmcp/tool_helper.py b/src/mistmcp/tool_helper.py index 65579cb..77af2c5 100644 --- a/src/mistmcp/tool_helper.py +++ b/src/mistmcp/tool_helper.py @@ -21,6 +21,7 @@ class McpToolsCategory(Enum): WRITE = "write" UTILITIES = "utilities" SLES = "sles" + CLIENTS = "clients" UTILITIES_UPGRADE = "utilities_upgrade" SITES_INSIGHTS = "sites_insights" CONSTANTS = "constants" @@ -29,7 +30,6 @@ class McpToolsCategory(Enum): ORGS = "orgs" STATS = "stats" EVENTS = "events" - CLIENTS = "clients" SITES_ROGUES = "sites_rogues" ORGS_NAC = "orgs_nac" MARVIS = "marvis" @@ -38,7 +38,7 @@ class McpToolsCategory(Enum): TOOLS = { "clients": { "description": "Clients related objects for the sites and organizations. It provides access to clients, guests, and NAC clients. Defining the `site_id` parameter will return the clients for the specified site, while leaving it empty will return the clients for the whole organization.", - "tools": ["mist_search_guest_authorization", "mist_search_client"], + "tools": ["mist_search_client"], }, "configuration": { "description": "Configuration related objects for the sites and organizations. It provides access to various configuration objects such as site settings, device profiles, and more. These objects can be used to configure the network in a consistent manner.", diff --git a/src/mistmcp/tools/search_client.py b/src/mistmcp/tools/search_client.py index 41fab79..ccbd0ca 100644 --- a/src/mistmcp/tools/search_client.py +++ b/src/mistmcp/tools/search_client.py @@ -10,19 +10,19 @@ -------------------------------------------------------------------------------- """ +from enum import Enum +from typing import Annotated +from uuid import UUID + import mistapi -from fastmcp import Context from fastmcp.exceptions import ToolError +from pydantic import Field + +from mistmcp.logger import logger from mistmcp.request_processor import get_apisession -from mistmcp.response_processor import process_response, handle_network_error from mistmcp.response_formatter import format_response +from mistmcp.response_processor import handle_network_error, process_response from mistmcp.server import mcp -from mistmcp.logger import logger - -from pydantic import Field -from typing import Annotated -from enum import Enum -from uuid import UUID class Client_type(Enum): @@ -30,6 +30,8 @@ class Client_type(Enum): WIRED = "wired" WIRELESS = "wireless" NAC = "nac" + ORG_GUEST = "org_guest" + SITE_GUEST = "site_guest" class Band(Enum): @@ -56,14 +58,16 @@ class Band(Enum): async def search_client( client_type: Annotated[ Client_type, - Field(description="""Type of client: WAN, wired, wireless, or NAC"""), + Field( + description="""Type of client: WAN, wired, wireless, NAC, Org guest, or Site guest""" + ), ], org_id: Annotated[UUID, Field(description="""Organization ID""")], site_id: Annotated[UUID, Field(description="""Site ID""", default=None)], device_mac: Annotated[ str, Field( - description="""Partial / full MAC Address of the Access Point or the Switch. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported""", + description="""Partial / full MAC Address of the Access Point or the Switch. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported. Not applicable for WAN clients or Org/Site Guests""", default=None, ), ], @@ -74,10 +78,6 @@ async def search_client( default=None, ), ], - ssid: Annotated[ - str, - Field(description="""SSID name. Wireless or NAC clients only""", default=None), - ], mac: Annotated[ str, Field( @@ -88,21 +88,35 @@ async def search_client( hostname: Annotated[ str, Field( - description="""Partial / full Client hostname. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `everest*` and `*rest*` match `my-everest-client`). Suffix-only wildcards (e.g. `*everest`) are not supported. Not applicable for WAN or wired clients""", + description="""Partial / full Client hostname. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `everest*` and `*rest*` match `my-everest-client`). Suffix-only wildcards (e.g. `*everest`) are not supported. Not applicable for WAN or wired clients or Org/Site Guests""", default=None, ), ], ip: Annotated[ str, Field( - description="""Partial / full Client IP Address. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `10.100.10.*` and `*100.10.*` match `10.100.10.54`). Suffix-only wildcards (e.g. `*.54`) are not supported. Not applicable for NAC clients""", + description="""Partial / full Client IP Address. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `10.100.10.*` and `*100.10.*` match `10.100.10.54`). Suffix-only wildcards (e.g. `*.54`) are not supported. Not applicable for NAC clients or Org/Site Guests""", + default=None, + ), + ], + wlan_id: Annotated[ + UUID, + Field( + description="""WLAN ID to filter by. Only applicable for wireless clients and Guests""", + default=None, + ), + ], + ssid: Annotated[ + str, + Field( + description="""SSID name to filter by. Only applicable for wireless clients, Guests, and NAC clients""", default=None, ), ], text: Annotated[ str, Field( - description="""Free text search in client details (supports * wildcard). Not applicable for WAN clients""", + description="""Free text search in client details (supports * wildcard). Not applicable for WAN clients or Org/Site Guests""", default=None, ), ], @@ -123,16 +137,17 @@ async def search_client( logger.debug("Tool search_client called") logger.debug( - "Input Parameters: client_type: %s, org_id: %s, site_id: %s, device_mac: %s, band: %s, ssid: %s, mac: %s, hostname: %s, ip: %s, text: %s, start: %s, end: %s, limit: %s", + "Input Parameters: client_type: %s, org_id: %s, site_id: %s, device_mac: %s, band: %s, mac: %s, hostname: %s, ip: %s, wlan_id: %s, ssid: %s, text: %s, start: %s, end: %s, limit: %s", client_type, org_id, site_id, device_mac, band, - ssid, mac, hostname, ip, + wlan_id, + ssid, text, start, end, @@ -144,6 +159,14 @@ async def search_client( try: object_type = client_type + if device_mac and client_type.value not in ["wireless", "wired"]: + raise ToolError( + { + "status_code": 400, + "message": '`device_mac` parameter can only be used when `client_type` is in "wireless", "wired".', + } + ) + if band and client_type.value not in ["wireless"]: raise ToolError( { @@ -152,11 +175,48 @@ async def search_client( } ) - if ssid and client_type.value not in ["wireless", "nac"]: + if hostname and client_type.value not in ["wireless", "nac"]: + raise ToolError( + { + "status_code": 400, + "message": '`hostname` parameter can only be used when `client_type` is in "wireless", "nac".', + } + ) + + if ip and client_type.value not in ["wan", "wired", "wireless"]: + raise ToolError( + { + "status_code": 400, + "message": '`ip` parameter can only be used when `client_type` is in "wan", "wired", "wireless".', + } + ) + + if wlan_id and client_type.value not in ["wireless", "org_guest", "site_guest"]: + raise ToolError( + { + "status_code": 400, + "message": '`wlan_id` parameter can only be used when `client_type` is in "wireless", "org_guest", "site_guest".', + } + ) + + if ssid and client_type.value not in [ + "wireless", + "org_guest", + "site_guest", + "nac", + ]: + raise ToolError( + { + "status_code": 400, + "message": '`ssid` parameter can only be used when `client_type` is in "wireless", "org_guest", "site_guest", "nac".', + } + ) + + if text and client_type.value not in ["wired", "wireless", "nac"]: raise ToolError( { "status_code": 400, - "message": '`ssid` parameter can only be used when `client_type` is in "wireless", "nac".', + "message": '`text` parameter can only be used when `client_type` is in "wired", "wireless", "nac".', } ) @@ -219,6 +279,40 @@ async def search_client( limit=limit, ) await process_response(response) + case "org_guest": + if mac: + response = mistapi.api.v1.orgs.guests.getOrgGuestAuthorization( + apisession, org_id=str(org_id), guest_mac=str(mac) + ) + await process_response(response) + else: + response = mistapi.api.v1.orgs.guests.searchOrgGuestAuthorization( + apisession, + org_id=str(org_id), + ssid=str(ssid) if ssid else None, + wlan_id=str(wlan_id) if wlan_id else None, + start=str(start) if start else None, + end=str(end) if end else None, + limit=limit, + ) + await process_response(response) + case "site_guest": + if mac: + response = mistapi.api.v1.sites.guests.getSiteGuestAuthorization( + apisession, site_id=str(site_id), guest_mac=str(mac) + ) + await process_response(response) + else: + response = mistapi.api.v1.sites.guests.searchSiteGuestAuthorization( + apisession, + site_id=str(site_id), + ssid=str(ssid) if ssid else None, + wlan_id=str(wlan_id) if wlan_id else None, + start=str(start) if start else None, + end=str(end) if end else None, + limit=limit, + ) + await process_response(response) case _: raise ToolError( diff --git a/src/mistmcp/tools/search_guest_authorization.py b/src/mistmcp/tools/search_guest_authorization.py deleted file mode 100644 index 37c0982..0000000 --- a/src/mistmcp/tools/search_guest_authorization.py +++ /dev/null @@ -1,174 +0,0 @@ -""" --------------------------------------------------------------------------------- --------------------------------- Mist MCP SERVER ------------------------------- - - Written by: Thomas Munzer (tmunzer@juniper.net) - Github : https://github.com/tmunzer/mistmcp - - This package is licensed under the MIT License. - --------------------------------------------------------------------------------- -""" - -import mistapi -from fastmcp import Context -from fastmcp.exceptions import ToolError -from mistmcp.request_processor import get_apisession -from mistmcp.response_processor import process_response, handle_network_error -from mistmcp.response_formatter import format_response -from mistmcp.server import mcp -from mistmcp.logger import logger - -from pydantic import Field -from typing import Annotated -from enum import Enum -from uuid import UUID - - -class Scope(Enum): - ORG = "org" - SITE = "site" - - -@mcp.tool( - name="mist_search_guest_authorization", - description="""Search for guest authorization entries in an organization or site""", - tags={"clients"}, - annotations={ - "title": "Search guest authorization", - "readOnlyHint": True, - "destructiveHint": False, - "openWorldHint": True, - "idempotentHint": True, - }, -) -async def search_guest_authorization( - scope: Annotated[ - Scope, - Field( - description="""Whether to search in the entire organization or a specific site. If `site` is selected, the `site_id` parameter is required""" - ), - ], - org_id: Annotated[UUID, Field(description="""Organization ID""")], - site_id: Annotated[UUID, Field(description="""Site ID""", default=None)], - guest_mac: Annotated[ - str, - Field( - description="""MAC address of the guest to search for in the authorization entries""", - default=None, - ), - ], - wlan_id: Annotated[ - UUID, - Field( - description="""ID of the WLAN to filter guest authorization entries by""", - default=None, - ), - ], - auth_method: Annotated[ - str, - Field( - description="""Authentication method to filter guest authorization entries by""", - default=None, - ), - ], - ssid: Annotated[ - str, - Field( - description="""SSID to filter guest authorization entries by""", - default=None, - ), - ], - start: Annotated[ - int, Field(description="""Start of time range (epoch seconds)""", default=None) - ], - end: Annotated[ - int, Field(description="""End of time range (epoch seconds)""", default=None) - ], - limit: Annotated[ - int, Field(description="""Max number of results per page""", default=20) - ] = 20, -) -> dict | list | str: - """Search for guest authorization entries in an organization or site""" - - logger.debug("Tool search_guest_authorization called") - logger.debug( - "Input Parameters: scope: %s, org_id: %s, site_id: %s, guest_mac: %s, wlan_id: %s, auth_method: %s, ssid: %s, start: %s, end: %s, limit: %s", - scope, - org_id, - site_id, - guest_mac, - wlan_id, - auth_method, - ssid, - start, - end, - limit, - ) - - apisession, response_format = await get_apisession() - - try: - object_type = scope - - if object_type.value == "site": - if not site_id: - raise ToolError( - { - "status_code": 400, - "message": '`site_id` parameter is required when `scope` is "site".', - } - ) - - match object_type.value: - case "org": - if guest_mac: - response = mistapi.api.v1.orgs.guests.getOrgGuestAuthorization( - apisession, org_id=str(org_id), guest_mac=str(guest_mac) - ) - await process_response(response) - else: - response = mistapi.api.v1.orgs.guests.searchOrgGuestAuthorization( - apisession, - org_id=str(org_id), - wlan_id=str(wlan_id) if wlan_id else None, - auth_method=auth_method if auth_method else None, - ssid=ssid if ssid else None, - start=str(start) if start else None, - end=str(end) if end else None, - limit=limit, - ) - await process_response(response) - case "site": - if guest_mac: - response = mistapi.api.v1.sites.guests.getSiteGuestAuthorization( - apisession, site_id=str(site_id), guest_mac=str(guest_mac) - ) - await process_response(response) - else: - response = mistapi.api.v1.sites.guests.searchSiteGuestAuthorization( - apisession, - site_id=str(site_id), - wlan_id=str(wlan_id) if wlan_id else None, - auth_method=auth_method if auth_method else None, - ssid=ssid if ssid else None, - start=str(start) if start else None, - end=str(end) if end else None, - limit=limit, - ) - await process_response(response) - - case _: - raise ToolError( - { - "status_code": 400, - "message": f"Invalid object_type: {object_type.value}. Valid values are: {[e.value for e in Scope]}", - } - ) - - except ToolError: - raise - except Exception as _exc: - await handle_network_error(_exc) - - return format_response(response, response_format) From 036f1677ae9fbba914c1a7a92ad79d1575d0fc06 Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 12:40:38 -0700 Subject: [PATCH 20/21] docs: clarify SLE guidance --- README.md | 2 +- mcp_generator/templates/tmpl_get_sle.py | 14 +++++++------- src/mistmcp/server.py | 2 +- src/mistmcp/tools/get_sle.py | 14 +++++++------- 4 files changed, 16 insertions(+), 16 deletions(-) diff --git a/README.md b/README.md index 00fbe1f..8ebec3e 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ The server exposes a focused set of tools grouped by workflow. This is the quick | Workflow | Main tools | What they are used for | | - | - | - | | Account and navigation | `mist_get_self`, `mist_get_next_page`, `mist_get_constants` | Resolve account details, discover IDs, follow pagination, and look up fixed Mist constants before making deeper queries. | -| Device and client lookup | `mist_search_device`, `mist_search_client`, `mist_search_guest_authorization`, `mist_search_nac_user_macs` | Find devices, clients, guest authorizations, and NAC-related client entries by name, MAC, IP, serial, model, or other filters. | +| Device and client lookup | `mist_search_device`, `mist_search_client`, `mist_search_nac_user_macs` | Find devices, clients, guest authorizations, and NAC-related client entries by name, MAC, IP, serial, model, or other filters. | | Configuration read | `mist_get_configuration_objects`, `mist_get_configuration_object_schema`, `mist_search_device_config_history` | Inspect org or site configuration, discover valid schema fields, and review recent configuration history on devices. | | Configuration changes | `mist_update_configuration_objects`, `mist_change_configuration_objects` | Create, update, and delete supported configuration objects. These tools require `--enable-write-tools`. | | Monitoring and events | `mist_search_events`, `mist_search_audit_logs`, `mist_search_alarms`, `mist_get_stats` | Investigate events, audit history, alarms, and operational statistics across organizations, sites, devices, clients, and ports. | diff --git a/mcp_generator/templates/tmpl_get_sle.py b/mcp_generator/templates/tmpl_get_sle.py index e8c3c83..57e3ee1 100644 --- a/mcp_generator/templates/tmpl_get_sle.py +++ b/mcp_generator/templates/tmpl_get_sle.py @@ -88,12 +88,12 @@ class ObjectType(Enum): @mcp.tool( name="mist_get_sle", description="""Get SLE (Service Level Expectation) data at different scopes. -Use `sle_scope=org` to get org-level SLEs (all/worst sites, Mx Edges, ...). -Use `sle_scope=org_sites` to get SLE summary for all organization sites. -Use `sle_scope=site` to get detailed site-level SLE data (summary, trends, impacted devices/clients, histograms, thresholds). -Use `sle_scope=site_metrics` to discover available SLE metrics for a given site scope. -Use `sle_scope=site_classifiers` to list classifiers for a specific SLE metric (requires `metric` parameter). -Use `sle_scope=site_metrics` first to discover metric names before querying SLE data.""", +Use `sle_scope=org` with `org_id` and `metric` to get org-level SLE rollups such as all sites, worst sites, and Mx Edges. The optional `sle` parameter narrows the org query to a specific SLE name. +Use `sle_scope=org_sites` with `org_id` and `sle=wifi|wired|wan` to get per-site SLE summaries for an organization. +Use `sle_scope=site_metrics` with `site_id`, `scope`, and `scope_id` to discover metric names for one site-level object or scope. +Use `sle_scope=site_classifiers` with `site_id`, `scope`, `scope_id`, and `metric` to list classifier names for a site-level metric. +Use `sle_scope=site` with `site_id`, `scope`, `scope_id`, `metric`, and `object_type` to get detailed site-level SLE data such as summaries, trends, impacted objects, histograms, thresholds, or classifier trends. +For site-level SLE queries, call `sle_scope=site_metrics` first when you do not already know the metric name.""", tags={"sles"}, annotations={ "title": "Get SLE", @@ -127,7 +127,7 @@ async def get_sle( metric: Annotated[ str, Field( - description="""SLE metric name. Required when sle_scope is `org`, `site`, or `site_classifiers`. Use `sle_scope=site_metrics` or `mist_get_constants` with `object_type=insight_metrics` to discover available metrics""", + description="""SLE metric name. Required when sle_scope is `org`, `site`, or `site_classifiers`. For site-level queries, use `sle_scope=site_metrics` to discover metric names for the selected `scope` and `scope_id`. For org-level queries, use `mist_get_insight_metrics` or `mist_get_constants` with `object_type=insight_metrics` to discover available values""", default=None, ), ], diff --git a/src/mistmcp/server.py b/src/mistmcp/server.py index b04a442..5b38f2e 100644 --- a/src/mistmcp/server.py +++ b/src/mistmcp/server.py @@ -77,7 +77,7 @@ # KEY WORKFLOWS - Use `mist_get_constants` to discover valid event_type or insight metric names before searching. -- Use `mist_get_sle` with `sle_scope=site_metrics` to discover available SLE metrics before querying SLE data. +- For site-level SLEs, use `mist_get_sle` with `sle_scope=site_metrics` to discover metric names for a specific `site_id`, `scope`, and `scope_id` before using `sle_scope=site`. Use `sle_scope=site_classifiers` only when a site query needs classifier names. - Use `mist_get_configuration_object_schema(verbose=True)` to understand config fields before writing. - Use `mist_update_configuration_objects` for create/update and `mist_change_configuration_objects` for create/update/delete. - `mist_search_device` returns a normalized `device_id`; reuse that value directly in tools requiring a device UUID. diff --git a/src/mistmcp/tools/get_sle.py b/src/mistmcp/tools/get_sle.py index accd4be..ced05a5 100644 --- a/src/mistmcp/tools/get_sle.py +++ b/src/mistmcp/tools/get_sle.py @@ -67,12 +67,12 @@ class ObjectType(Enum): @mcp.tool( name="mist_get_sle", description="""Get SLE (Service Level Expectation) data at different scopes. -Use `sle_scope=org` to get org-level SLEs (all/worst sites, Mx Edges, ...). -Use `sle_scope=org_sites` to get SLE summary for all organization sites. -Use `sle_scope=site` to get detailed site-level SLE data (summary, trends, impacted devices/clients, histograms, thresholds). -Use `sle_scope=site_metrics` to discover available SLE metrics for a given site scope. -Use `sle_scope=site_classifiers` to list classifiers for a specific SLE metric (requires `metric` parameter). -Use `sle_scope=site_metrics` first to discover metric names before querying SLE data.""", +Use `sle_scope=org` with `org_id` and `metric` to get org-level SLE rollups such as all sites, worst sites, and Mx Edges. The optional `sle` parameter narrows the org query to a specific SLE name. +Use `sle_scope=org_sites` with `org_id` and `sle=wifi|wired|wan` to get per-site SLE summaries for an organization. +Use `sle_scope=site_metrics` with `site_id`, `scope`, and `scope_id` to discover metric names for one site-level object or scope. +Use `sle_scope=site_classifiers` with `site_id`, `scope`, `scope_id`, and `metric` to list classifier names for a site-level metric. +Use `sle_scope=site` with `site_id`, `scope`, `scope_id`, `metric`, and `object_type` to get detailed site-level SLE data such as summaries, trends, impacted objects, histograms, thresholds, or classifier trends. +For site-level SLE queries, call `sle_scope=site_metrics` first when you do not already know the metric name.""", tags={"sles"}, annotations={ "title": "Get SLE", @@ -106,7 +106,7 @@ async def get_sle( metric: Annotated[ str, Field( - description="""SLE metric name. Required when sle_scope is `org`, `site`, or `site_classifiers`. Use `sle_scope=site_metrics` or `mist_get_constants` with `object_type=insight_metrics` to discover available metrics""", + description="""SLE metric name. Required when sle_scope is `org`, `site`, or `site_classifiers`. For site-level queries, use `sle_scope=site_metrics` to discover metric names for the selected `scope` and `scope_id`. For org-level queries, use `mist_get_insight_metrics` or `mist_get_constants` with `object_type=insight_metrics` to discover available values""", default=None, ), ], From 8c86c4b0f6579a65742467e48dafda5e80ceef9f Mon Sep 17 00:00:00 2001 From: Thomas Munzer Date: Wed, 10 Jun 2026 13:10:19 -0700 Subject: [PATCH 21/21] refactor: update search_client parameters and descriptions for clarity and consistency --- src/mistmcp/tools/search_client.py | 41 ++++++++++++------------------ 1 file changed, 16 insertions(+), 25 deletions(-) diff --git a/src/mistmcp/tools/search_client.py b/src/mistmcp/tools/search_client.py index ccbd0ca..95d7c5b 100644 --- a/src/mistmcp/tools/search_client.py +++ b/src/mistmcp/tools/search_client.py @@ -63,7 +63,7 @@ async def search_client( ), ], org_id: Annotated[UUID, Field(description="""Organization ID""")], - site_id: Annotated[UUID, Field(description="""Site ID""", default=None)], + site_id: Annotated[UUID, Field(description="""Site ID. Required for site_guest, optional for other client types""", default=None)], device_mac: Annotated[ str, Field( @@ -88,7 +88,7 @@ async def search_client( hostname: Annotated[ str, Field( - description="""Partial / full Client hostname. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `everest*` and `*rest*` match `my-everest-client`). Suffix-only wildcards (e.g. `*everest`) are not supported. Not applicable for WAN or wired clients or Org/Site Guests""", + description="""Partial / full Client hostname. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `everest*` and `*rest*` match `my-everest-client`). Suffix-only wildcards (e.g. `*everest`) are not supported. Not applicable for wired clients or Org/Site Guests""", default=None, ), ], @@ -99,13 +99,6 @@ async def search_client( default=None, ), ], - wlan_id: Annotated[ - UUID, - Field( - description="""WLAN ID to filter by. Only applicable for wireless clients and Guests""", - default=None, - ), - ], ssid: Annotated[ str, Field( @@ -121,10 +114,12 @@ async def search_client( ), ], start: Annotated[ - int, Field(description="""Start of time range (epoch seconds)""", default=None) + int, Field( + description="""Start of time range (epoch seconds)""", default=None) ], end: Annotated[ - int, Field(description="""End of time range (epoch seconds)""", default=None) + int, Field( + description="""End of time range (epoch seconds)""", default=None) ], limit: Annotated[ int, Field(description="""Max number of results per page""", default=20) @@ -137,7 +132,7 @@ async def search_client( logger.debug("Tool search_client called") logger.debug( - "Input Parameters: client_type: %s, org_id: %s, site_id: %s, device_mac: %s, band: %s, mac: %s, hostname: %s, ip: %s, wlan_id: %s, ssid: %s, text: %s, start: %s, end: %s, limit: %s", + "Input Parameters: client_type: %s, org_id: %s, site_id: %s, device_mac: %s, band: %s, mac: %s, hostname: %s, ip: %s, ssid: %s, text: %s, start: %s, end: %s, limit: %s", client_type, org_id, site_id, @@ -146,7 +141,6 @@ async def search_client( mac, hostname, ip, - wlan_id, ssid, text, start, @@ -175,11 +169,11 @@ async def search_client( } ) - if hostname and client_type.value not in ["wireless", "nac"]: + if hostname and client_type.value not in ["wireless", "nac", "wan"]: raise ToolError( { "status_code": 400, - "message": '`hostname` parameter can only be used when `client_type` is in "wireless", "nac".', + "message": '`hostname` parameter can only be used when `client_type` is in "wireless", "nac", "wan".', } ) @@ -191,14 +185,6 @@ async def search_client( } ) - if wlan_id and client_type.value not in ["wireless", "org_guest", "site_guest"]: - raise ToolError( - { - "status_code": 400, - "message": '`wlan_id` parameter can only be used when `client_type` is in "wireless", "org_guest", "site_guest".', - } - ) - if ssid and client_type.value not in [ "wireless", "org_guest", @@ -290,13 +276,19 @@ async def search_client( apisession, org_id=str(org_id), ssid=str(ssid) if ssid else None, - wlan_id=str(wlan_id) if wlan_id else None, start=str(start) if start else None, end=str(end) if end else None, limit=limit, ) await process_response(response) case "site_guest": + if not site_id: + raise ToolError( + { + "status_code": 400, + "message": '`site_id` parameter is required when `client_type` is "site_guest".', + } + ) if mac: response = mistapi.api.v1.sites.guests.getSiteGuestAuthorization( apisession, site_id=str(site_id), guest_mac=str(mac) @@ -307,7 +299,6 @@ async def search_client( apisession, site_id=str(site_id), ssid=str(ssid) if ssid else None, - wlan_id=str(wlan_id) if wlan_id else None, start=str(start) if start else None, end=str(end) if end else None, limit=limit,