openapi: 3.2.0 info: title: Mist Sites Device Profiles API description: '> Version: **2607.1.1** > > Date: **August 17, 2026** NOTE: Some important API changes will be introduced.' contact: name: Thomas Munzer email: tmunzer@juniper.net version: 2607.1.1 servers: - url: https://api.mist.com variables: {} - url: https://api.gc1.mist.com variables: {} - url: https://api.ac2.mist.com variables: {} - url: https://api.gc2.mist.com variables: {} - url: https://api.gc4.mist.com variables: {} - url: https://api.eu.mist.com variables: {} - url: https://api.gc3.mist.com variables: {} - url: https://api.ac6.mist.com variables: {} - url: https://api.gc6.mist.com variables: {} - url: https://api.ac5.mist.com variables: {} - url: https://api.gc5.mist.com variables: {} - url: https://api.gc7.mist.com variables: {} security: - apiToken: [] - csrfToken: [] tags: - name: Sites Device Profiles description: The API Endpoints for the Device Profiles at the site level can be used to get the site derived networks, meaning the org level configuration with the site variables resolved.. paths: /api/v1/sites/{site_id}/deviceprofiles/derived: parameters: [] get: tags: - Sites Device Profiles summary: listSiteDeviceProfilesDerived description: Get the list of derived Device Profiles for a Site operationId: listSiteDeviceProfilesDerived parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: resolve in: query description: Whether resolve the site variables style: form explode: true schema: type: boolean default: false responses: '200': description: Example response headers: {} content: application/json: schema: type: array items: $ref: '#/components/schemas/deviceprofile' description: List of device profile configurations examples: - '[{"aeroscout":{"enabled":true,"host":"string"},"created_time":0,"disable_eth1":true,"disable_module":true,"id":"b069b358-4c97-5319-1f8c-7c5ca64d6ab1","ip_config":{"dns":["string"],"dns_suffix":["string"],"gateway":"192.168.0.1","gateway6":"2001:0db8:85a3:0000:0000:8a2e:0370:7334","ip":"192.168.0.1","ip6":"2001:0db8:85a3:0000:0000:8a2e:0370:7334","mtu":1500,"netmask":"192.168.0.1","netmask6":"2001:0db8:85a3:0000:0000:8a2e:0370:7334","type":"static","type6":"static","vlan_id":1},"mesh":{"enabled":true,"group":1,"role":"base"},"modified_time":0,"name":"string","org_id":"b069b358-4c97-5319-1f8c-7c5ca64d6ab1","poe_passthrough":true,"switch_config":{"enabled":true,"eth0":{"port_vlan_id":1,"vlan_ids":[1,10]},"eth1":{"port_vlan_id":1,"vlan_ids":[10]},"eth2":{"port_vlan_id":1,"vlan_ids":[10]},"eth3":{"port_vlan_id":1,"vlan_ids":[10]},"module":{"port_vlan_id":1,"vlan_ids":[10]},"wds":{"port_vlan_id":1,"vlan_ids":[10]}},"type":"ap","usb_config":{"cacert":"string","enabled":true,"host":"string","type":"imagotag","verify_cert":true}}]' - '[{"created_time":1680762730,"dhcpd_config":{"Corp-Mgmt":{"dns_servers":["8.8.8.8"],"dns_suffix":["stag.one"],"gateway":"10.3.172.9","ip_end":"10.3.172.99","ip_start":"10.3.172.50","type":"local"},"Corp-lan":{"dns_servers":["8.8.8.8"],"dns_suffix":["stag.one"],"gateway":"10.3.171.9","ip_end":"10.3.171.99","ip_start":"10.3.171.50","type":"local"}},"dnsOverride":true,"dns_servers":["10.3.20.201","10.3.51.222","1.1.1.1"],"dns_suffix":["example.com"],"extra_routes":{"10.101.0.0/16":{"via":"10.3.100.10"}},"id":"4ea55b5d-7313-4a81-a292-7ee125fd4ebb","ip_configs":{"Corp-Core":{"ip":"10.3.100.9","netmask":"/24","type":"static"},"Corp-Mgmt":{"ip":"10.3.172.9","netmask":"/24","type":"static"},"Corp-lan":{"ip":"10.3.171.9","netmask":"/24","type":"static"}},"modified_time":1680762890,"name":"ITParis","ntpOverride":true,"ntp_servers":["10.3.51.222"],"org_id":"93986f10-773b-42be-9438-8d3e6d127f1a","path_preferences":{"core":{"paths":[{"networks":["Corp-Core"],"type":"local"}],"strategy":"ordered"},"lab":{"paths":[{"networks":["Corp-lan"],"type":"local"}],"strategy":"ordered"},"mgmt":{"paths":[{"networks":["Corp-Mgmt"],"type":"local"}],"strategy":"ordered"},"untrust":{"paths":[{"name":"wan","type":"wan"}],"strategy":"ordered"}},"port_config":{"ge-0/0/0":{"aggregated":false,"ip_config":{"gateway":"192.168.1.1","ip":"192.168.1.9","netmask":"/24","type":"static"},"name":"wan","redundant":false,"traffic_shaping":{"enabled":false},"usage":"wan","wan_type":"broadband"},"ge-0/0/6-7":{"ae_disable_lacp":false,"ae_idx":"0","ae_lacp_force_up":true,"aggregated":true,"networks":["Corp-lan","Corp-Mgmt","Corp-Core"],"usage":"lan"}},"service_policies":[{"action":"allow","idp":{"enabled":false},"name":"ITParis-Internal","path_preference":"core","services":["internal_dns","drive"],"tenants":["ITParis"]},{"action":"deny","idp":{"enabled":false},"name":"ITParis-internet","path_preference":"untrust","services":["internet_any"],"tenants":["ITParis"]}],"type":"gateway"}]' contentMediaType: application/json examples: Deviceprofile Ap: value: - aeroscout: enabled: true host: string created_time: 0 disable_eth1: true disable_module: true id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 ip_config: dns: - string dns_suffix: - string gateway: 192.168.0.1 gateway6: 2001:0db8:85a3:0000:0000:8a2e:0370:7334 ip: 192.168.0.1 ip6: 2001:0db8:85a3:0000:0000:8a2e:0370:7334 mtu: 1500 netmask: 192.168.0.1 netmask6: 2001:0db8:85a3:0000:0000:8a2e:0370:7334 type: static type6: static vlan_id: 1 mesh: enabled: true group: 1 role: base modified_time: 0 name: string org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 poe_passthrough: true switch_config: enabled: true eth0: port_vlan_id: 1 vlan_ids: - 1 - 10 eth1: port_vlan_id: 1 vlan_ids: - 10 eth2: port_vlan_id: 1 vlan_ids: - 10 eth3: port_vlan_id: 1 vlan_ids: - 10 module: port_vlan_id: 1 vlan_ids: - 10 wds: port_vlan_id: 1 vlan_ids: - 10 type: ap usb_config: cacert: string enabled: true host: string type: imagotag verify_cert: true Deviceprofile Hub: value: - created_time: 1680762730 dhcpd_config: Corp-Mgmt: dns_servers: - 8.8.8.8 dns_suffix: - stag.one gateway: 10.3.172.9 ip_end: 10.3.172.99 ip_start: 10.3.172.50 type: local Corp-lan: dns_servers: - 8.8.8.8 dns_suffix: - stag.one gateway: 10.3.171.9 ip_end: 10.3.171.99 ip_start: 10.3.171.50 type: local dnsOverride: true dns_servers: - 10.3.20.201 - 10.3.51.222 - 1.1.1.1 dns_suffix: - example.com extra_routes: 10.101.0.0/16: via: 10.3.100.10 id: 4ea55b5d-7313-4a81-a292-7ee125fd4ebb ip_configs: Corp-Core: ip: 10.3.100.9 netmask: /24 type: static Corp-Mgmt: ip: 10.3.172.9 netmask: /24 type: static Corp-lan: ip: 10.3.171.9 netmask: /24 type: static modified_time: 1680762890 name: ITParis ntpOverride: true ntp_servers: - 10.3.51.222 org_id: 93986f10-773b-42be-9438-8d3e6d127f1a path_preferences: core: paths: - networks: - Corp-Core type: local strategy: ordered lab: paths: - networks: - Corp-lan type: local strategy: ordered mgmt: paths: - networks: - Corp-Mgmt type: local strategy: ordered untrust: paths: - name: wan type: wan strategy: ordered port_config: ge-0/0/0: aggregated: false ip_config: gateway: 192.168.1.1 ip: 192.168.1.9 netmask: /24 type: static name: wan redundant: false traffic_shaping: enabled: false usage: wan wan_type: broadband ge-0/0/6-7: ae_disable_lacp: false ae_idx: '0' ae_lacp_force_up: true aggregated: true networks: - Corp-lan - Corp-Mgmt - Corp-Core usage: lan service_policies: - action: allow idp: enabled: false name: ITParis-Internal path_preference: core services: - internal_dns - drive tenants: - ITParis - action: deny idp: enabled: false name: ITParis-internet path_preference: untrust services: - internet_any tenants: - ITParis type: gateway application/vnd.api+json: schema: type: array items: $ref: '#/components/schemas/deviceprofile' description: List of device profile configurations examples: - '[{"aeroscout":{"enabled":true,"host":"string"},"created_time":0,"disable_eth1":true,"disable_module":true,"id":"b069b358-4c97-5319-1f8c-7c5ca64d6ab1","ip_config":{"dns":["string"],"dns_suffix":["string"],"gateway":"192.168.0.1","gateway6":"2001:0db8:85a3:0000:0000:8a2e:0370:7334","ip":"192.168.0.1","ip6":"2001:0db8:85a3:0000:0000:8a2e:0370:7334","mtu":1500,"netmask":"192.168.0.1","netmask6":"2001:0db8:85a3:0000:0000:8a2e:0370:7334","type":"static","type6":"static","vlan_id":1},"mesh":{"enabled":true,"group":1,"role":"base"},"modified_time":0,"name":"string","org_id":"b069b358-4c97-5319-1f8c-7c5ca64d6ab1","poe_passthrough":true,"switch_config":{"enabled":true,"eth0":{"port_vlan_id":1,"vlan_ids":[1,10]},"eth1":{"port_vlan_id":1,"vlan_ids":[10]},"eth2":{"port_vlan_id":1,"vlan_ids":[10]},"eth3":{"port_vlan_id":1,"vlan_ids":[10]},"module":{"port_vlan_id":1,"vlan_ids":[10]},"wds":{"port_vlan_id":1,"vlan_ids":[10]}},"type":"ap","usb_config":{"cacert":"string","enabled":true,"host":"string","type":"imagotag","verify_cert":true}}]' - '[{"created_time":1680762730,"dhcpd_config":{"Corp-Mgmt":{"dns_servers":["8.8.8.8"],"dns_suffix":["stag.one"],"gateway":"10.3.172.9","ip_end":"10.3.172.99","ip_start":"10.3.172.50","type":"local"},"Corp-lan":{"dns_servers":["8.8.8.8"],"dns_suffix":["stag.one"],"gateway":"10.3.171.9","ip_end":"10.3.171.99","ip_start":"10.3.171.50","type":"local"}},"dnsOverride":true,"dns_servers":["10.3.20.201","10.3.51.222","1.1.1.1"],"dns_suffix":["example.com"],"extra_routes":{"10.101.0.0/16":{"via":"10.3.100.10"}},"id":"4ea55b5d-7313-4a81-a292-7ee125fd4ebb","ip_configs":{"Corp-Core":{"ip":"10.3.100.9","netmask":"/24","type":"static"},"Corp-Mgmt":{"ip":"10.3.172.9","netmask":"/24","type":"static"},"Corp-lan":{"ip":"10.3.171.9","netmask":"/24","type":"static"}},"modified_time":1680762890,"name":"ITParis","ntpOverride":true,"ntp_servers":["10.3.51.222"],"org_id":"93986f10-773b-42be-9438-8d3e6d127f1a","path_preferences":{"core":{"paths":[{"networks":["Corp-Core"],"type":"local"}],"strategy":"ordered"},"lab":{"paths":[{"networks":["Corp-lan"],"type":"local"}],"strategy":"ordered"},"mgmt":{"paths":[{"networks":["Corp-Mgmt"],"type":"local"}],"strategy":"ordered"},"untrust":{"paths":[{"name":"wan","type":"wan"}],"strategy":"ordered"}},"port_config":{"ge-0/0/0":{"aggregated":false,"ip_config":{"gateway":"192.168.1.1","ip":"192.168.1.9","netmask":"/24","type":"static"},"name":"wan","redundant":false,"traffic_shaping":{"enabled":false},"usage":"wan","wan_type":"broadband"},"ge-0/0/6-7":{"ae_disable_lacp":false,"ae_idx":"0","ae_lacp_force_up":true,"aggregated":true,"networks":["Corp-lan","Corp-Mgmt","Corp-Core"],"usage":"lan"}},"service_policies":[{"action":"allow","idp":{"enabled":false},"name":"ITParis-Internal","path_preference":"core","services":["internal_dns","drive"],"tenants":["ITParis"]},{"action":"deny","idp":{"enabled":false},"name":"ITParis-internet","path_preference":"untrust","services":["internet_any"],"tenants":["ITParis"]}],"type":"gateway"}]' contentMediaType: application/vnd.api+json examples: Deviceprofile Ap: value: - aeroscout: enabled: true host: string created_time: 0 disable_eth1: true disable_module: true id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 ip_config: dns: - string dns_suffix: - string gateway: 192.168.0.1 gateway6: 2001:0db8:85a3:0000:0000:8a2e:0370:7334 ip: 192.168.0.1 ip6: 2001:0db8:85a3:0000:0000:8a2e:0370:7334 mtu: 1500 netmask: 192.168.0.1 netmask6: 2001:0db8:85a3:0000:0000:8a2e:0370:7334 type: static type6: static vlan_id: 1 mesh: enabled: true group: 1 role: base modified_time: 0 name: string org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 poe_passthrough: true switch_config: enabled: true eth0: port_vlan_id: 1 vlan_ids: - 1 - 10 eth1: port_vlan_id: 1 vlan_ids: - 10 eth2: port_vlan_id: 1 vlan_ids: - 10 eth3: port_vlan_id: 1 vlan_ids: - 10 module: port_vlan_id: 1 vlan_ids: - 10 wds: port_vlan_id: 1 vlan_ids: - 10 type: ap usb_config: cacert: string enabled: true host: string type: imagotag verify_cert: true Deviceprofile Hub: value: - created_time: 1680762730 dhcpd_config: Corp-Mgmt: dns_servers: - 8.8.8.8 dns_suffix: - stag.one gateway: 10.3.172.9 ip_end: 10.3.172.99 ip_start: 10.3.172.50 type: local Corp-lan: dns_servers: - 8.8.8.8 dns_suffix: - stag.one gateway: 10.3.171.9 ip_end: 10.3.171.99 ip_start: 10.3.171.50 type: local dnsOverride: true dns_servers: - 10.3.20.201 - 10.3.51.222 - 1.1.1.1 dns_suffix: - example.com extra_routes: 10.101.0.0/16: via: 10.3.100.10 id: 4ea55b5d-7313-4a81-a292-7ee125fd4ebb ip_configs: Corp-Core: ip: 10.3.100.9 netmask: /24 type: static Corp-Mgmt: ip: 10.3.172.9 netmask: /24 type: static Corp-lan: ip: 10.3.171.9 netmask: /24 type: static modified_time: 1680762890 name: ITParis ntpOverride: true ntp_servers: - 10.3.51.222 org_id: 93986f10-773b-42be-9438-8d3e6d127f1a path_preferences: core: paths: - networks: - Corp-Core type: local strategy: ordered lab: paths: - networks: - Corp-lan type: local strategy: ordered mgmt: paths: - networks: - Corp-Mgmt type: local strategy: ordered untrust: paths: - name: wan type: wan strategy: ordered port_config: ge-0/0/0: aggregated: false ip_config: gateway: 192.168.1.1 ip: 192.168.1.9 netmask: /24 type: static name: wan redundant: false traffic_shaping: enabled: false usage: wan wan_type: broadband ge-0/0/6-7: ae_disable_lacp: false ae_idx: '0' ae_lacp_force_up: true aggregated: true networks: - Corp-lan - Corp-Mgmt - Corp-Core usage: lan service_policies: - action: allow idp: enabled: false name: ITParis-Internal path_preference: core services: - internal_dns - drive tenants: - ITParis - action: deny idp: enabled: false name: ITParis-internet path_preference: untrust services: - internet_any tenants: - ITParis type: gateway '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false components: schemas: tunnel_config_ike_dh_group2: title: tunnel_config_ike_dh_group2 enum: - '1' - '14' - '15' - '16' - '19' - '2' - '20' - '21' - '24' - '5' type: string description: 'Diffie-Hellman group used by this IKE proposal. enum: `1`, `14`, `15`, `16`, `19`, `2`, `20`, `21`, `24`, `5`.' extra_route: title: extra_route type: object properties: discard: type: boolean description: Whether to install a discard route; this takes precedence over next-hop settings default: false metric: maximum: 2147483647 minimum: 0 type: - integer - 'null' description: Route metric for the IPv4 static route contentEncoding: int32 next_qualified: type: object additionalProperties: $ref: '#/components/schemas/extra_route_next_qualified_properties' description: Qualified next-hop settings keyed by IPv4 next-hop address examples: - 10.3.1.1: metric: null preference: 40 no_resolve: type: boolean description: Whether to prevent recursive next-hop resolution for the IPv4 static route default: false preference: maximum: 2147483647 minimum: 0 type: - integer - 'null' description: Route preference for the IPv4 static route contentEncoding: int32 examples: - 30 via: oneOf: - type: string - type: array items: type: string description: Next-hop IPv4 address or ECMP next-hop IPv4 addresses for the route examples: - 10.2.1.1 - "[\n \"10.2.1.1\",\n \"10.2.1.2\"\n]" description: IPv4 static route settings for a destination prefix radio_band_antenna_mode1: title: radio_band_antenna_mode1 enum: - 1x1 - 2x2 - 3x3 - 4x4 - default type: string description: 'Radio chain mode for the 5 GHz radio. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' examples: - default gateway_port_duplex2: title: gateway_port_duplex2 enum: - auto - full - half type: string description: 'Ethernet duplex mode configured on the port. enum: `auto`, `full`, `half`.' examples: - full response_http400: title: response_http400 type: object properties: detail: type: string description: Human-readable explanation of the bad request error examples: - 'JSON parse error - Expecting value: line 5 column 8 (char 56)' description: Standard HTTP 400 bad request error response gateway_port_dsl_type2: title: gateway_port_dsl_type2 enum: - adsl - vdsl type: string description: 'If `wan_type`==`dsl`. DSL technology used by the WAN port. enum: `adsl`, `vdsl`.' service_policy_skyatp_dns_tunnel_detection2: title: service_policy_skyatp_dns_tunnel_detection2 type: object properties: enabled: type: boolean description: Whether Sky ATP DNS tunneling detection is enabled profile: allOf: - $ref: '#/components/schemas/service_policy_skyatp_dns_tunnel_detection_profile2' - description: 'Sky ATP DNS tunneling detection profile to apply. enum: `default`, `standard`, `strict`.' description: Detection settings for DNS tunneling threats provided by Sky ATP gateway_path_strategy2: title: gateway_path_strategy2 enum: - ecmp - ordered - weighted type: string description: 'Selection strategy used to evaluate the candidate paths. enum: `ecmp`, `ordered`, `weighted`.' ip_type4: title: ip_type4 enum: - dhcp - static type: string description: 'IPv4 address assignment mode for this gateway network interface. enum: `dhcp`, `static`.' examples: - static switch_port_usage_dynamic_rule: title: switch_port_usage_dynamic_rule required: - src type: object properties: description: type: string description: Optional description of the rule equals: type: string description: Exact value that the selected source attribute must match equals_any: type: array items: type: string description: List of values where any match satisfies this dynamic rule expression: type: string description: '"[0:3]":"abcdef" -> "abc" "split(.)[1]": "a.b.c" -> "b" "split(-)[1][0:3]: "a1234-b5678-c90" -> "b56"' src: allOf: - $ref: '#/components/schemas/switch_port_usage_dynamic_rule_src2' - description: 'Source attribute evaluated by this dynamic rule. enum: `link_peermac`, `lldp_chassis_id`, `lldp_hardware_revision`, `lldp_manufacturer_name`, `lldp_oui`, `lldp_serial_number`, `lldp_system_description`, `lldp_system_name`, `radius_dynamicfilter`, `radius_usermac`, `radius_username`.' usage: type: string description: Port usage name to apply when this dynamic rule matches description: Dynamic port usage rule evaluated against LLDP, RADIUS, or peer MAC attributes dhcpd_config1: title: dhcpd_config1 type: object properties: enabled: type: boolean description: If set to `false`, disable the DHCP server default: true additionalProperties: allOf: - $ref: '#/components/schemas/dhcpd_config_property' - description: DHCP server or relay configuration for one network description: DHCP server defaults provided by this gateway profile gateway_port_config: title: gateway_port_config required: - usage type: object properties: ae_disable_lacp: type: boolean description: If `aggregated`==`true`. To disable LCP support for the AE interface default: false ae_idx: type: - string - 'null' description: If `aggregated`==`true`. Users could force to use the designated AE name (must be an integer between 0 and 127) ae_lacp_force_up: type: boolean description: 'For SRX only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only' default: false aggregated: type: boolean description: Whether the port participates in an aggregated Ethernet interface default: false critical: type: boolean description: To generate port up/down alarm, set it to true default: false description: type: string description: Interface Description. Can be a variable (i.e. "{{myvar}}") disable_autoneg: type: boolean description: Whether Ethernet autonegotiation is disabled on the port default: false disabled: type: boolean description: Port admin up (true) / down (false) default: false dsl_type: allOf: - $ref: '#/components/schemas/gateway_port_dsl_type2' - description: 'If `wan_type`==`dsl`. DSL technology used by the WAN port. enum: `adsl`, `vdsl`.' dsl_vci: type: integer description: If `wan_type`==`dsl`, 16 bit int contentEncoding: int32 default: 35 dsl_vpi: type: integer description: If `wan_type`==`dsl`, 8 bit int contentEncoding: int32 default: 0 duplex: allOf: - $ref: '#/components/schemas/gateway_port_duplex2' - description: 'Ethernet duplex mode configured on the port. enum: `auto`, `full`, `half`.' examples: - full ip_config: allOf: - $ref: '#/components/schemas/gateway_port_config_ip_config2' - description: Layer 3 IP configuration for the port lte_apn: type: string description: If `wan_type`==`lte`. APN used by the LTE uplink lte_auth: allOf: - $ref: '#/components/schemas/gateway_port_lte_auth2' - description: 'If `wan_type`==`lte`. Authentication method used by the LTE uplink. enum: `chap`, `none`, `pap`.' lte_backup: type: boolean description: Whether the LTE uplink is used as a backup WAN connection lte_password: type: string description: If `wan_type`==`lte`. Password used for LTE uplink authentication contentEncoding: password lte_username: type: string description: If `wan_type`==`lte`. Username used for LTE uplink authentication mtu: type: integer description: Layer 3 MTU configured on the port contentEncoding: int32 name: type: string description: Interface name used to derive device configuration networks: type: array items: type: string description: If `usage`==`lan`. Networks attached to the interface outer_vlan_id: type: integer description: For Q-in-Q. Outer VLAN ID used for QinQ encapsulation contentEncoding: int32 poe_disabled: type: boolean description: Whether PoE output is disabled on the port default: false poe_keep_state_when_reboot: type: boolean description: Whether Perpetual PoE capabilities are enabled for a port default: false port_network: type: string description: Only for SRX and if `usage`==`lan`, the name of the Network to be used as the Untagged VLAN preserve_dscp: type: boolean description: Whether to preserve dscp when sending traffic over VPN (SSR-only) default: true redundant: type: boolean description: If HA mode. Whether the port participates in the redundant Ethernet configuration redundant_group: maximum: 128 minimum: 1 type: integer description: If HA mode, SRX Only - support redundancy-group. 1-128 for physical SRX, 1-64 for virtual SRX contentEncoding: int32 reth_idx: anyOf: - type: integer contentEncoding: int32 - type: string description: If HA mode and for SRX only. Redundant Ethernet interface index assigned to the port reth_node: type: string description: If HA mode. Node associated with the redundant Ethernet interface reth_nodes: type: array items: type: string description: If HA mode and for SSR only. Per-network node assignment used for VLAN-based redundancy examples: - - node0 - node1 speed: type: string description: Link speed configured on the port default: auto examples: - 1g ssr_no_virtual_mac: type: boolean description: When SSR is running as VM, this is required on certain hosting platforms default: false svr_port_range: type: string description: For SSR only. Port range configured on the interface default: none examples: - 60000-60005 traffic_shaping: allOf: - $ref: '#/components/schemas/gateway_traffic_shaping3' - description: Traffic shaping settings applied to the port usage: allOf: - $ref: '#/components/schemas/gateway_port_usage2' - description: 'Logical usage assigned to the port. enum: `ha_control`, `ha_data`, `lan`, `wan`.' vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: VLAN ID or variable used when the WAN interface is carried on a VLAN vpn_paths: type: object additionalProperties: $ref: '#/components/schemas/gateway_port_vpn_path' description: Per-VPN path settings for traffic that uses this port wan_arp_policer: allOf: - $ref: '#/components/schemas/gateway_port_wan_arp_policer2' - description: 'Only when `wan_type`==`broadband`. ARP policer profile applied to the WAN port. enum: `default`, `max`, `recommended`.' wan_ext_ip: type: string description: Only if `usage`==`wan`, optional. If spoke should reach this port by a different IP examples: - 64.2.4.3 wan_ext_ip6: type: string description: Only if `usage`==`wan`, optional. If spoke should reach this port by a different IPv6 examples: - 2601:1700:43c0:dc0::10 wan_extra_routes: type: object additionalProperties: $ref: '#/components/schemas/wan_extra_routes' description: Only if `usage`==`wan`. Property Key is the destination CIDR (e.g. "100.100.100.0/24") wan_extra_routes6: type: object additionalProperties: $ref: '#/components/schemas/wan_extra_routes6' description: Only if `usage`==`wan`. Property Key is the destination CIDR (e.g. "2a02:1234:420a:10c9::/64") wan_networks: type: array items: type: string description: Only if `usage`==`wan`. Networks reachable through this WAN port for policy definition wan_probe_override: allOf: - $ref: '#/components/schemas/gateway_wan_probe_override2' - description: Optional WAN health probe override settings for this port wan_source_nat: allOf: - $ref: '#/components/schemas/gateway_port_wan_source_nat2' - description: Source NAT settings applied to traffic leaving this WAN port wan_speedtest_mode: allOf: - $ref: '#/components/schemas/gateway_port_config_wan_speedtest_mode2' - description: 'Controls whether Marvis or the scheduler can run speed tests on this WAN port. enum: `auto`, `enabled`, `disabled`.' examples: - auto wan_type: allOf: - $ref: '#/components/schemas/gateway_port_wan_type2' - description: 'Only if `usage`==`wan`. WAN uplink type configured on the port. enum: `broadband`, `dsl`, `lte`.' description: Gateway port configuration for LAN, WAN, tunnel, and HA interfaces service_policy_ewf_rule: title: service_policy_ewf_rule type: object properties: alert_only: type: boolean description: Whether matching enhanced web filtering traffic is logged without being blocked block_message: type: string description: Message returned when enhanced web filtering blocks a request examples: - Access to this URL Category has been blocked enabled: type: boolean description: Whether this enhanced web filtering rule is enabled default: false profile: allOf: - $ref: '#/components/schemas/service_policy_ewf_rule_profile2' - description: 'Enhanced web filtering profile applied by this rule. enum: `critical`, `standard`, `strict`.' description: Enhanced web filtering rule applied by a service policy switch_port_usage_storm_control2: title: switch_port_usage_storm_control2 type: object properties: disable_port: type: boolean description: Whether to disable the port when storm control is triggered default: false no_broadcast: type: boolean description: Whether to disable storm control on broadcast traffic default: false no_multicast: type: boolean description: Whether to disable storm control on multicast traffic default: false no_registered_multicast: type: boolean description: Whether to disable storm control on registered multicast traffic default: false no_unknown_unicast: type: boolean description: Whether to disable storm control on unknown unicast traffic default: false percentage: maximum: 100 minimum: 0 type: integer description: Bandwidth-percentage, configures the storm control level as a percentage of the available bandwidth contentEncoding: int32 default: 80 description: Only if `mode`!=`dynamic`. Storm-control settings for this port usage switch_network_multicast2: title: switch_network_multicast2 type: object properties: enabled: type: boolean description: Whether to enable IGMP snooping on this VLAN default: false igmp_version: allOf: - $ref: '#/components/schemas/switch_network_multicast_igmp_version' - description: IGMP version. '2' (default, ASM/IGMPv2) / '3' (SSM/IGMPv3) description: Multicast (IGMP snooping) settings for this VLAN snmp_vacm_security_to_group_content_item: title: snmp_vacm_security_to_group_content_item type: object properties: group: type: string description: VACM group name referenced by this mapping security_name: type: string description: Name of the SNMP security principal mapped to a VACM group description: VACM security-name to group mapping entry ap_zigbee_allow_join2: title: ap_zigbee_allow_join2 enum: - always - manual type: string description: 'Join policy for new Zigbee devices on this AP. enum: `always`, `manual`.' examples: - manual network_vpn_access_static_nat_property: title: network_vpn_access_static_nat_property type: object properties: internal_ip: type: string description: The Static NAT destination IP address. Must be an IP address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}") examples: - 192.168.70.3 name: type: string description: Label for this VPN static NAT rule examples: - pos_station-1 description: VPN access static NAT rule target settings ip_type62: title: ip_type62 enum: - autoconf - dhcp - disabled - static type: string description: 'IPv6 address assignment mode for this gateway network interface. enum: `autoconf`, `dhcp`, `disabled`, `static`.' examples: - static sw_routing_policy: title: sw_routing_policy type: object properties: terms: minItems: 1 uniqueItems: true type: array items: $ref: '#/components/schemas/sw_routing_policy_term' description: Ordered terms evaluated by this switch routing policy description: Switch routing policy made of ordered match-action terms service_policy_skyatp_dns_dga_detection_profile2: title: service_policy_skyatp_dns_dga_detection_profile2 enum: - default - standard - strict type: string description: 'Sky ATP DNS DGA detection profile to apply. enum: `default`, `standard`, `strict`.' acl_tag_spec: title: acl_tag_spec type: object properties: port_range: type: string description: Matched dst port, "0" means any default: '0' protocol: type: string description: '`tcp` / `udp` / `icmp` / `icmp6` / `gre` / `any` / `:protocol_number`, `protocol_number` is between 1-254, default is `any` `protocol_number` is between 1-254' default: any description: Layer 4 protocol and destination-port match constraint for an ACL tag antenna_select1: title: antenna_select1 enum: - external - internal type: string description: 'Internal or external antenna selection for AP models with selectable antennas. enum: ``, `external`, `internal`.' examples: - external bgp_config_via2: title: bgp_config_via2 enum: - lan - tunnel - vpn - wan type: string description: Transport used for this BGP session, such as LAN, tunnel, VPN, or WAN switch_dhcpd_config1: title: switch_dhcpd_config1 type: object properties: enabled: type: boolean description: Whether switch DHCP server or relay configuration is enabled default: false additionalProperties: allOf: - $ref: '#/components/schemas/switch_dhcpd_config_property' - description: DHCP server or relay configuration for one switch network. The property key is the network name. In case of DHCP relay, it's common for many networks to use the same dhcp relay, comma-separated network names can be used here (e.g. "net1,net2") description: DHCP server defaults provided by this switch profile deviceprofile: oneOf: - $ref: '#/components/schemas/deviceprofile_ap' - $ref: '#/components/schemas/deviceprofile_gateway' - $ref: '#/components/schemas/deviceprofile_switch' description: Device profile configuration for an AP, switch, or gateway discriminator: propertyName: type mapping: ap: deviceprofile_ap gateway: deviceprofile_gateway switch: deviceprofile_switch extra_route_next_qualified_properties: title: extra_route_next_qualified_properties type: object properties: metric: type: - integer - 'null' description: Route metric for this qualified IPv4 next hop contentEncoding: int32 preference: type: - integer - 'null' description: Route preference for this qualified IPv4 next hop contentEncoding: int32 description: Qualified next-hop attributes for an IPv4 static route ap_iot_input1: title: ap_iot_input1 type: object properties: enabled: type: boolean description: Whether to enable a pin default: false name: type: string description: Optional; descriptive pin name examples: - motion pullup: allOf: - $ref: '#/components/schemas/ap_iot_pullup1' - description: 'Selects the pull-up resistor mode applied to the input pin. enum: `external`, `internal`, `none`.' description: Digital input pin DI2 settings ap_mqtt_broker_proto2: title: ap_mqtt_broker_proto2 enum: - ssl - tcp type: string description: 'MQTT broker transport protocol. enum: `ssl`, `tcp`.' network_vpn_access_config: title: network_vpn_access_config type: object properties: advertised_subnet: type: string description: If `routed`==`true`, whether to advertise an aggregated subnet toward HUB this is useful when there are multiple networks on SPOKE's side examples: - 172.16.0.0/24 allow_ping: type: boolean description: Whether to allow ping from vpn into this routed network destination_nat: type: object additionalProperties: $ref: '#/components/schemas/network_vpn_access_destination_nat_property' description: Destination NAT rules applied for VPN access to this network nat_pool: type: string description: If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub, a subnet is required to create and advertise the route to Hub examples: - 172.16.0.0/26 no_readvertise_to_lan_bgp: type: boolean description: toward LAN-side BGP peers default: false no_readvertise_to_lan_ospf: type: boolean description: toward LAN-side OSPF peers default: false no_readvertise_to_overlay: type: boolean description: toward overlay, how HUB should deal with routes it received from Spokes other_vrfs: type: array items: type: string description: Other VRFs that can receive leaked routes from this spoke network routed: type: boolean description: Whether this network is routable source_nat: allOf: - $ref: '#/components/schemas/network_source_nat2' - description: Source NAT settings used when non-routed spoke hosts must be reachable from the hub static_nat: type: object additionalProperties: $ref: '#/components/schemas/network_vpn_access_static_nat_property' description: Static NAT rules applied for VPN access to this network summarized_subnet: type: string description: toward overlay, how HUB should deal with routes it received from Spokes examples: - 172.16.0.0/16 summarized_subnet_to_lan_bgp: type: string description: toward LAN-side BGP peers examples: - 172.16.0.0/16 summarized_subnet_to_lan_ospf: type: string description: toward LAN-side OSPF peers examples: - 172.16.0.0/16 description: VPN access settings for a network and VPN pair switch_port_usage_mode2: title: switch_port_usage_mode2 enum: - access - dynamic - inet - trunk type: string description: 'Switching mode for this port usage. enum: `access`, `dynamic`, `inet`, `trunk`.' tunnel_config_provider2: title: tunnel_config_provider2 enum: - custom-ipsec - custom-gre - jse-ipsec - prisma-ipsec - zscaler-gre - zscaler-ipsec type: string description: 'Tunnel provider used when auto provisioning is disabled. enum: `custom-ipsec`, `custom-gre`, `jse-ipsec`, `prisma-ipsec`, `zscaler-gre`, `zscaler-ipsec`.' acl_tag: title: acl_tag required: - type type: object properties: ether_types: type: array items: type: string description: Layer 2 EtherTypes matched by this ACL tag; defaults to `any` default: - any gbp_tag: type: integer description: "Required if\n - `type`==`dynamic_gbp` (gbp_tag received from RADIUS)\n - `type`==`gbp_resource`\n - `type`==`static_gbp` (applying gbp tag against matching conditions)" contentEncoding: int32 macs: type: array items: type: string description: Client or resource MAC addresses matched by this ACL tag network: type: string description: "If:\n * `type`==`mac` (optional. default is `any`)\n * `type`==`subnet` (optional. default is `any`)\n * `type`==`network`\n * `type`==`resource` (optional. default is `any`)\n * `type`==`static_gbp` if from matching network (vlan)" port_usage: type: string description: Required if `type`==`port_usage`. Switch port usage name matched by this ACL tag radius_group: type: string description: "Required if:\n * `type`==`radius_group`\n * `type`==`aruba_user_role`\n * `type`==`static_gbp`\nif from matching radius_group" specs: type: array items: $ref: '#/components/schemas/acl_tag_spec' description: Layer 4 protocol and destination-port constraints for this ACL tag subnets: type: array items: type: string description: IP subnets matched by this ACL tag type: allOf: - $ref: '#/components/schemas/acl_tag_type2' - description: 'Classifier type that determines which ACL tag fields are evaluated. enum: `any`, `aruba_user_role`, `dynamic_gbp`, `gbp_resource`, `mac`, `network`, `port_usage`, `radius_group`, `resource`, `static_gbp`, `subnet`.' description: Resource tags (`type`==`resource` or `type`==`gbp_resource`) can only be used in `dst_tags` tunnel_config_auth_algo3: title: tunnel_config_auth_algo3 enum: - md5 - sha1 - sha2 type: string description: 'Integrity algorithm used by this IKE proposal. enum: `md5`, `sha1`, `sha2`.' tunnel_config_probe: title: tunnel_config_probe type: object properties: interval: type: integer description: How often to trigger the probe contentEncoding: int32 threshold: type: integer description: Number of consecutive misses before declaring the tunnel down contentEncoding: int32 timeout: type: integer description: Time within which to complete the connectivity check contentEncoding: int32 type: allOf: - $ref: '#/components/schemas/tunnel_config_probe_type2' - description: 'Protocol used by the custom IPsec tunnel health probe. enum: `http`, `icmp`.' description: Tunnel health probe settings remote_syslog_severity1: title: remote_syslog_severity1 enum: - alert - any - critical - emergency - error - info - notice - warning type: string description: 'Default syslog severity for messages sent to this server. enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`.' ap_iot_output3: title: ap_iot_output3 type: object properties: enabled: type: boolean description: Whether to enable a pin default: false name: type: string description: Optional; descriptive pin name examples: - motion output: type: boolean description: Whether the pin is configured as an output. DO and A1-A4 can be repurposed by changing examples: - true pullup: allOf: - $ref: '#/components/schemas/ap_iot_pullup3' - description: 'Selects the pull-up resistor mode applied to the output pin. enum: `external`, `internal`, `none`.' value: type: integer description: Output pin signal level, default 0 contentEncoding: int32 examples: - 0 description: Analog-capable IoT pin A4 output settings gw_routing_policy_term_matching_vpn_path_sla2: title: gw_routing_policy_term_matching_vpn_path_sla2 type: object properties: max_jitter: type: - integer - 'null' description: Maximum jitter threshold allowed for the VPN path contentEncoding: int32 max_latency: type: - integer - 'null' description: Maximum latency threshold allowed for the VPN path contentEncoding: int32 examples: - 1500 max_loss: type: - integer - 'null' description: Maximum packet-loss threshold allowed for the VPN path contentEncoding: int32 examples: - 30 description: SLA thresholds used when matching a VPN path junos_port_config_duplex2: title: junos_port_config_duplex2 enum: - auto - full - half type: string description: 'Link duplex mode for this Junos port. enum: `auto`, `full`, `half`.' ap_pwr_config2: title: ap_pwr_config2 type: object properties: base: type: integer description: Additional power to request during negotiating with PSE over PoE, in mW contentEncoding: int32 default: 0 examples: - 2000 prefer_usb_over_wifi: type: boolean description: Whether to enable power out to peripheral, meanwhile will reduce power to Wi-Fi (only for AP45 at power mode) default: false description: Power negotiation and peripheral power defaults in this AP profile poe_priority3: title: poe_priority3 enum: - low - high type: string description: 'Only if `mode`!=`dynamic`. PoE priority for ports using this port usage. enum: `low`, `high`.' switch_network_multicast_igmp_version: title: switch_network_multicast_igmp_version enum: - '2' - '3' type: string description: IGMP version. '2' (default, ASM/IGMPv2) / '3' (SSM/IGMPv3) remote_syslog_server_protocol2: title: remote_syslog_server_protocol2 enum: - tcp - udp type: string description: 'Transport protocol used for this remote syslog server. enum: `tcp`, `udp`.' switch_vrf_instance: title: switch_vrf_instance type: object properties: aggregate_routes: type: object additionalProperties: $ref: '#/components/schemas/aggregate_route' description: IPv4 aggregate routes configured for this VRF instance examples: - 172.16.3.0/24: discard: false metric: null preference: 30 aggregate_routes6: type: object additionalProperties: $ref: '#/components/schemas/aggregate_route' description: IPv6 aggregate routes configured for this VRF instance examples: - 2a02:1234:420a:10c9::/64: discard: false metric: null preference: 30 evpn_auto_loopback_subnet: type: string description: IPv4 subnet used for automatic EVPN loopback addresses in this VRF instance examples: - 100.101.0.0/24 evpn_auto_loopback_subnet6: type: string description: IPv6 subnet used for automatic EVPN loopback addresses in this VRF instance extra_routes: type: object additionalProperties: $ref: '#/components/schemas/vrf_extra_route' description: Additional IPv4 static routes configured for this VRF instance examples: - 0.0.0.0/0: via: 192.168.1.10 extra_routes6: type: object additionalProperties: $ref: '#/components/schemas/vrf_extra_route6' description: Additional IPv6 static routes configured for this VRF instance examples: - 2a02:1234:420a:10c9::/64: via: 2a02:1234:200a::100 multicast_config: allOf: - $ref: '#/components/schemas/switch_multicast_config3' - description: Multicast configuration for this VRF instance. PIM is automatically enabled when any network in this VRF has `multicast.enabled`==`true` networks: uniqueItems: true type: array items: type: string description: Names of switch networks included in this VRF instance description: Switch VRF instance routing and network membership settings examples: - extra_routes: 0.0.0.0/0: via: 192.168.31.1 networks: - guest gateway_port_usage2: title: gateway_port_usage2 enum: - ha_control - ha_data - lan - wan type: string description: 'Logical usage assigned to the port. enum: `ha_control`, `ha_data`, `lan`, `wan`.' switch_oob_ip_config1: title: switch_oob_ip_config1 type: object properties: gateway: type: string description: Default gateway for the out-of-band management interface when `type`==`static` ip: type: string description: Static IPv4 address for the out-of-band management interface when `type`==`static` netmask: type: string description: Used only if `subnet` is not specified in `networks` network: type: string description: Optional, the network to be used for mgmt type: allOf: - $ref: '#/components/schemas/ip_type2' - description: 'IP assignment mode for the out-of-band management interface. enum: `dhcp`, `static`.' examples: - static use_mgmt_vrf: type: boolean description: If supported on the platform. If enabled, DNS will be using this routing-instance, too default: false use_mgmt_vrf_for_host_out: type: boolean description: For host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired default: false description: Out-of-band management IP defaults in this switch profile radio_band_antenna_beam_pattern3: title: radio_band_antenna_beam_pattern3 enum: - narrow - medium - wide type: string description: 'Beam pattern used by the 5 GHz radio antenna. enum: `narrow`, `medium`, `wide`.' ospf_area_type2: title: ospf_area_type2 enum: - default - nssa - stub type: string description: 'Area type for this OSPF area. enum: `default`, `nssa`, `stub`.' examples: - default ap_iot_pullup1: title: ap_iot_pullup1 enum: - external - internal - none type: string description: 'Selects the pull-up resistor mode applied to the input pin. enum: `external`, `internal`, `none`.' gateway_path_type2: title: gateway_path_type2 enum: - local - tunnel - vpn - wan type: string description: Gateway path source type, such as local network, WAN interface, VPN path, or tunnel radio_band_antenna_beam_pattern1: title: radio_band_antenna_beam_pattern1 enum: - narrow - medium - wide type: string description: 'Beam pattern used by the 6 GHz radio antenna. enum: `narrow`, `medium`, `wide`.' radio_band_24_usage4: title: radio_band_24_usage4 enum: - '24' - '5' - '6' - auto type: string description: 'Radio usage mode for the 2.4 GHz-capable radio. enum: `24`, `5`, `6`, `auto`.' junos_other_ip_config: title: junos_other_ip_config type: object properties: evpn_anycast: type: boolean description: For EVPN, whether anycast is desired default: false ip: type: string description: Required if `type`==`static`; IPv4 address for the additional Junos L3 presence examples: - 10.3.3.1 ip6: type: string description: Required if `type6`==`static`; IPv6 address for the additional Junos L3 presence examples: - fdad:b0bc:f29e::3d16 netmask: type: string description: Optional IPv4 netmask; `subnet` from `network` definition will be used if defined examples: - 255.255.255.0 netmask6: type: string description: Optional IPv6 prefix length; `subnet` from `network` definition will be used if defined examples: - /64 type: allOf: - $ref: '#/components/schemas/ip_type3' - description: 'IPv4 assignment mode for the additional Junos L3 presence. enum: `dhcp`, `static`.' examples: - static type6: allOf: - $ref: '#/components/schemas/ip_type61' - description: 'IPv6 assignment mode for the additional Junos L3 presence. enum: `autoconf`, `dhcp`, `disabled`, `static`.' examples: - static description: Optional switch L3 presence on an additional network or VLAN gateway_oob_ip_config_node12: title: gateway_oob_ip_config_node12 type: object properties: gateway: type: string description: Default gateway for the node1 out-of-band management interface when `type`==`static` ip: type: string description: Static IPv4 address for the node1 out-of-band management interface when `type`==`static` netmask: type: string description: IPv4 netmask or prefix length for the node1 out-of-band management interface when `type`==`static`; used only if `subnet` is not specified in `networks` type: allOf: - $ref: '#/components/schemas/ip_type5' - description: 'IP assignment mode for the node1 out-of-band management interface. enum: `dhcp`, `static`.' examples: - static use_mgmt_vrf: type: boolean description: If supported on the platform. If enabled, DNS will be using this routing-instance, too default: false use_mgmt_vrf_for_host_out: type: boolean description: Whether to use `mgmt_junos` for host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired default: false vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: VLAN ID used for node1 out-of-band management traffic description: Out-of-band management IP configuration override for node1 in an HA cluster ap_port_config_forwarding2: title: ap_port_config_forwarding2 enum: - all - limited - mxtunnel - site_mxedge - wxtunnel type: string description: 'Traffic forwarding mode for this AP Ethernet port. enum: `all`, `limited`, `mxtunnel`, `site_mxedge`, `wxtunnel`.' examples: - all network_internet_access2: title: network_internet_access2 type: object properties: create_simple_service_policy: type: boolean description: Whether Mist should create simple service policies for restricted internet access default: false destination_nat: type: object additionalProperties: $ref: '#/components/schemas/network_internet_access_destination_nat_property' description: Destination NAT rules for direct internet access enabled: type: boolean description: Whether direct internet access is enabled for this network restricted: type: boolean description: By default, all access is allowed, to only allow certain traffic, make `restricted`=`true` and define service_policies default: false static_nat: type: object additionalProperties: $ref: '#/components/schemas/network_internet_access_static_nat_property' description: Static NAT rules for direct internet access description: Direct internet access and NAT settings for this network dhcpd_config_option_type2: title: dhcpd_config_option_type2 enum: - boolean - hex - int16 - int32 - ip - string - uint16 - uint32 type: string description: 'Data type used to encode this DHCP option value. enum: `boolean`, `hex`, `int16`, `int32`, `ip`, `string`, `uint16`, `uint32`.' remote_syslog_archive1: title: remote_syslog_archive1 type: object properties: files: anyOf: - type: string - type: integer contentEncoding: int32 description: Number of archived syslog files to retain examples: - '20' size: type: string description: Maximum size of each archived syslog file, such as 5m examples: - 5m description: Retention settings for this generated syslog file idp_profile_matching2: title: idp_profile_matching2 type: object properties: attack_name: type: array items: type: string description: Signature names matched by the IDP profile overwrite dst_subnet: type: array items: type: string description: Destination subnets matched by the IDP profile overwrite severity: type: array items: $ref: '#/components/schemas/idp_profile_matching_severity_value' description: Threat levels matched by the IDP profile overwrite description: Criteria that select signatures for this overwrite rule dot11_bandwidth242: title: dot11_bandwidth242 enum: - 0 - 20 - 40 type: integer description: 'Channel width configured for the 2.4 GHz radio. enum: `0`, `20`, `40`.' examples: - 20 ap_usb_type2: title: ap_usb_type2 enum: - hanshow - imagotag - solum type: string description: 'USB integration type for this legacy AP USB configuration. enum: `hanshow`, `imagotag`, `solum`.' examples: - imagotag ap_port_config_dynamic_vlan2: title: ap_port_config_dynamic_vlan2 type: object properties: default_vlan_id: maximum: 4094 minimum: 1 type: integer description: Fallback VLAN ID used when RADIUS does not return a dynamic VLAN match contentEncoding: int32 examples: - 999 enabled: type: boolean description: Whether dynamic VLAN assignment is enabled for this AP port type: allOf: - $ref: '#/components/schemas/ap_port_config_dynamic_vlan_type2' - description: 'Mapping mode for interpreting dynamic VLAN attributes returned by RADIUS. enum: `airespace-interface-name`, `standard`.' vlans: type: object additionalProperties: type: string nullable: true description: Mapping entries for RADIUS-assigned VLAN values on this AP port. For `type`==`airespace-interface-name`, the property key is the Airespace interface name returned by RADIUS (e.g. "guest"), and the value is the corresponding VLAN ID (e.g. 100). For `type`==`standard`, the property key is the VLAN ID number returned by RADIUS, and the value is ignored. examples: - 1-10: null user: 10 description: RADIUS-assigned VLAN settings for AP port authentication gateway_port_lte_auth2: title: gateway_port_lte_auth2 enum: - chap - none - pap type: string description: 'If `wan_type`==`lte`. Authentication method used by the LTE uplink. enum: `chap`, `none`, `pap`.' remote_syslog_time_format2: title: remote_syslog_time_format2 enum: - millisecond - year - year millisecond type: string description: 'Timestamp format used in forwarded syslog messages. enum: `millisecond`, `year`, `year millisecond`.' examples: - millisecond tunnel_config_probe_type2: title: tunnel_config_probe_type2 enum: - http - icmp type: string description: 'Protocol used by the custom IPsec tunnel health probe. enum: `http`, `icmp`.' radius_config2: title: radius_config2 type: object properties: acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled contentEncoding: int32 default: 0 acct_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_acct_server' description: RADIUS accounting servers used by this Junos configuration auth_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_auth_server' description: RADIUS authentication servers used by this Junos configuration auth_servers_retries: type: integer description: Number of RADIUS authentication request retries before failover contentEncoding: int32 default: 3 auth_servers_timeout: type: integer description: RADIUS authentication server timeout, in seconds contentEncoding: int32 default: 5 coa_enabled: type: boolean description: Whether RADIUS Change of Authorization (CoA) is enabled default: false coa_port: maximum: 65535 minimum: 1 type: integer description: UDP port used for RADIUS Change of Authorization (CoA) contentEncoding: int32 default: 3799 network: type: string description: Use `network` or `source_ip`. Network where the RADIUS server resides; if the network has a static IP, Mist uses it as the source IP source_ip: type: string description: Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic description: RADIUS authentication and accounting settings for this AP port tunnel_provider_options_zscaler_sub_location: title: tunnel_provider_options_zscaler_sub_location type: object properties: aup_block_internet_until_accepted: type: boolean description: Whether this sub-location blocks internet access until the Acceptable Use Policy is accepted default: false aup_enabled: type: boolean description: Can only be `true` when `auth_required`==`false`, display Acceptable Use Policy (AUP) default: false aup_force_ssl_inspection: type: boolean description: Proxy HTTPs traffic, requiring Zscaler cert to be installed in browser default: false aup_timeout_in_days: maximum: 180 minimum: 1 type: integer description: Required if `aup_enabled`==`true`. Days before AUP is requested again contentEncoding: int32 auth_required: type: boolean description: Enable this option to authenticate users default: false caution_enabled: type: boolean description: Can only be `true` when `auth_required`==`false`, display caution notification for non-authenticated users default: false dn_bandwidth: maximum: 99999 minimum: 0.1 type: - number - 'null' description: Download bandwidth cap of the link, in Mbps. Disabled if not set examples: - 200 idle_time_in_minutes: maximum: 43200 minimum: 0 type: integer description: Required if `surrogate_IP`==`true`, idle Time to Disassociation contentEncoding: int32 name: type: string description: '[network]($h/Orgs%20Networks/_overview) name' ofw_enabled: type: boolean description: If `true`, enable the firewall control option default: false surrogate_IP: type: boolean description: Can only be `true` when `auth_required`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies default: false surrogate_IP_enforced_for_known_browsers: type: boolean description: Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers surrogate_refresh_time_in_minutes: maximum: 43200 minimum: 1 type: integer description: Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idle_time_in_minutes`, refresh Time for re-validation of Surrogacy contentEncoding: int32 up_bandwidth: maximum: 99999 minimum: 0.1 type: - number - 'null' description: Download bandwidth cap of the link, in Mbps. Disabled if not set examples: - 200 description: Zscaler sub-location settings for a specific network dhcpd_config_option: title: dhcpd_config_option type: object properties: type: allOf: - $ref: '#/components/schemas/dhcpd_config_option_type2' - description: 'Data type used to encode this DHCP option value. enum: `boolean`, `hex`, `int16`, `int32`, `ip`, `string`, `uint16`, `uint32`.' value: type: string description: Option value to send for this DHCP option description: Custom DHCP option value snmp_config_trap_group: title: snmp_config_trap_group type: object properties: categories: type: array items: type: string description: Trap categories included in this SNMP trap group group_name: type: string description: Trap group name for this SNMP trap group examples: - profiler targets: type: array items: type: string description: Trap target addresses for this SNMP trap group version: allOf: - $ref: '#/components/schemas/snmp_config_trap_version2' - description: 'SNMP trap protocol version used by this group. enum: `all`, `v1`, `v2`.' description: SNMP trap group definition acl_policy_action: title: acl_policy_action required: - dst_tag type: object properties: action: allOf: - $ref: '#/components/schemas/allow_deny4' - description: Allow or deny decision applied to traffic matching the destination tag dst_tag: type: string description: Destination ACL tag matched by this policy action examples: - corp description: Action applied to traffic that matches a destination ACL tag tunnel_config_tunnel_mode2: title: tunnel_config_tunnel_mode2 enum: - active-active - active-standby type: string description: 'Tunnel failover mode used for primary and secondary endpoints. enum: `active-active`, `active-standby`.' radio_band_preamble4: title: radio_band_preamble4 enum: - auto - long - short type: string description: '802.11 preamble mode used by the 2.4 GHz radio. enum: `auto`, `long`, `short`.' sw_routing_policy_term_action2: title: sw_routing_policy_term_action2 type: object properties: accept: type: boolean description: Whether to accept routes that match this term community: type: array items: type: string description: BGP communities to set when this term is used as an export policy local_preference: anyOf: - type: string - maximum: 4294967295 minimum: 1 type: integer contentEncoding: int32 description: Preference value to set when this term is used as an import policy prepend_as_path: type: array items: type: string description: AS path values to prepend when this term is used as an export policy description: Policy actions applied when this routing policy term matches extra_route6_next_qualified_properties: title: extra_route6_next_qualified_properties type: object properties: metric: type: - integer - 'null' description: Route metric for this qualified IPv6 next hop contentEncoding: int32 preference: type: - integer - 'null' description: Route preference for this qualified IPv6 next hop contentEncoding: int32 description: Qualified next-hop attributes for an IPv6 static route response_http404: title: response_http404 type: object properties: id: type: string description: Missing resource identifier, when the API includes one description: Standard HTTP 404 not found error response tunnel_config_ipsec_proposal: title: tunnel_config_ipsec_proposal type: object properties: auth_algo: allOf: - $ref: '#/components/schemas/tunnel_config_auth_algo1' - description: 'Integrity algorithm used by this IPsec proposal. enum: `md5`, `sha1`, `sha2`.' dh_group: allOf: - $ref: '#/components/schemas/tunnel_config_dh_group2' - description: 'Diffie-Hellman group used by this IPsec proposal. enum: `1`, `14`, `15`, `16`, `19`, `2`, `20`, `21`, `24`, `5`.' enc_algo: allOf: - oneOf: - {} - $ref: '#/components/schemas/tunnel_config_enc_algo1' - description: 'Cipher algorithm used by this IPsec proposal. enum: `3des`, `aes128`, `aes256`, `aes_gcm128`, `aes_gcm256`.' description: IPsec proposal settings for custom IPsec tunnels ap_esl_type2: title: ap_esl_type2 enum: - hanshow - imagotag - native - solum type: string description: 'ESL integration type to enable on the AP. enum: `hanshow`, `imagotag`, `native`, `solum`.' examples: - imagotag switch_dhcpd_config_type62: title: switch_dhcpd_config_type62 enum: - none - relay - server type: string description: 'IPv6 DHCP mode for this switch network. enum: `none`, `relay`, `server`.' gateway_traffic_shaping3: title: gateway_traffic_shaping3 type: object properties: class_percentages: type: array items: type: integer contentEncoding: int32 description: Traffic class bandwidth percentages for high, medium, low, and best-effort queues enabled: type: boolean description: Whether traffic shaping is enabled default: false max_tx_kbps: type: integer description: Maximum transmit bandwidth for the interface, in Kbps contentEncoding: int32 description: Traffic shaping settings applied to the port ap_iot2: title: ap_iot2 type: object properties: A1: allOf: - $ref: '#/components/schemas/ap_iot_output6' - description: Analog-capable IoT pin A1 output settings A2: allOf: - $ref: '#/components/schemas/ap_iot_output1' - description: Analog-capable IoT pin A2 output settings A3: allOf: - $ref: '#/components/schemas/ap_iot_output2' - description: Analog-capable IoT pin A3 output settings A4: allOf: - $ref: '#/components/schemas/ap_iot_output3' - description: Analog-capable IoT pin A4 output settings DI1: allOf: - $ref: '#/components/schemas/ap_iot_input3' - description: Digital input pin DI1 settings DI2: allOf: - $ref: '#/components/schemas/ap_iot_input1' - description: Digital input pin DI2 settings DO: allOf: - $ref: '#/components/schemas/ap_iot_output4' - description: Digital output pin DO settings description: Digital and analog IoT pin defaults in this AP profile dot11_band: title: dot11_band enum: - '24' - '5' - 5-dedicated - 5-selectable - '6' - 6-dedicated - 6-selectable type: string description: 'enum: `24`, `5`, `5-dedicated`, `5-selectable`, `6`, `6-dedicated`, `6-selectable`' ap_esl_config2: title: ap_esl_config2 type: object properties: cacert: type: string description: Only if `type`==`imagotag` or `type`==`native` examples: - '--BEGIN CERTIFICATE-- MIIDXTCCAkWgAwIBAgIJAL5b1z4f3k2TMA0GCSqGSIb3DQEBCwUAMIGVMQsw ' channel: type: integer description: Only if `type`==`imagotag` or `type`==`native` contentEncoding: int32 examples: - 3 enabled: type: boolean description: usb_config is ignored if esl_config enabled default: false host: type: string description: Only if `type`==`imagotag` or `type`==`native` examples: - 1.1.1.1 port: type: integer description: Only if `type`==`imagotag` or `type`==`native` contentEncoding: int32 examples: - 0 type: allOf: - $ref: '#/components/schemas/ap_esl_type2' - description: 'ESL integration type to enable on the AP. enum: `hanshow`, `imagotag`, `native`, `solum`.' examples: - imagotag verify_cert: type: boolean description: Only if `type`==`imagotag` or `type`==`native` examples: - true vlan_id: type: integer description: Only if `type`==`solum` or `type`==`hanshow` contentEncoding: int32 default: 1 description: Electronic shelf label integration defaults in this AP profile tacacs2: title: tacacs2 type: object properties: acct_servers: type: array items: $ref: '#/components/schemas/tacacs_acct_server' description: TACACS+ accounting servers used for switch management sessions default_role: allOf: - $ref: '#/components/schemas/tacacs_default_role2' - description: 'Default switch-management role to use for TACACS+ logins. enum: `admin`, `helpdesk`, `none`, `read`.' enabled: type: boolean description: Whether TACACS+ is enabled for switch management authentication network: type: string description: Source network used for connectivity to the TACACS+ servers tacplus_servers: type: array items: $ref: '#/components/schemas/tacacs_auth_server' description: TACACS+ authentication servers used for switch management logins description: Management authentication settings using TACACS+ snmp_config_engine_id_type2: title: snmp_config_engine_id_type2 enum: - local - use_mac_address type: string description: 'Method used to derive the SNMP engine ID. enum: `local`, `use_mac_address`.' tunnel_config_auto_provision_provider2: title: tunnel_config_auto_provision_provider2 enum: - jse-ipsec - zscaler-ipsec type: string description: 'Tunnel provider used for automatic endpoint provisioning. enum: `jse-ipsec`, `zscaler-ipsec`.' tunnel_config_auto_provision_node3: title: tunnel_config_auto_provision_node3 type: object properties: probe_ips: uniqueItems: true type: array items: type: string description: Probe IP addresses used to monitor auto-provisioned tunnel reachability wan_names: type: array items: type: string description: WAN interface names used by the auto-provisioned tunnel endpoint description: Main auto-provisioned tunnel endpoint settings switch_radius_config_auth_server_selection2: title: switch_radius_config_auth_server_selection2 enum: - ordered - unordered type: string description: 'Selection strategy for RADIUS authentication servers. enum: `ordered`, `unordered`.' tunnel_config_enc_algo1: title: tunnel_config_enc_algo1 enum: - 3des - aes128 - aes256 - aes_gcm128 - aes_gcm256 type: string description: 'Cipher algorithm used by this IPsec proposal. enum: `3des`, `aes128`, `aes256`, `aes_gcm128`, `aes_gcm256`.' sw_routing_policy_term_matching_protocol_enum: title: sw_routing_policy_term_matching_protocol_enum enum: - bgp - direct - evpn - ospf - static type: string description: 'enum: `bgp`, `direct`, `evpn`, `ospf`, `static`' switch_mgmt1: title: switch_mgmt1 type: object properties: ap_affinity_threshold: type: integer description: AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used. contentEncoding: int32 default: 10 cli_banner: type: string description: Set Banners for switches. Allows markup formatting examples: - \t\tWELCOME! cli_idle_timeout: maximum: 60 minimum: 1 type: integer description: Sets timeout for switches contentEncoding: int32 config_revert_timer: maximum: 30 minimum: 1 type: integer description: Rollback timer for commit confirmed contentEncoding: int32 default: 10 dhcp_option_fqdn: type: boolean description: Enable to provide the FQDN with DHCP option 81 default: false disable_oob_down_alarm: type: boolean description: Whether to suppress alarms when the switch out-of-band management interface is down fips_enabled: type: boolean description: Whether FIPS mode is enabled on the switch default: false local_accounts: type: object additionalProperties: $ref: '#/components/schemas/config_switch_local_accounts_user' description: Local switch user accounts keyed by username mxedge_proxy_host: type: string description: IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud mxedge_proxy_port: anyOf: - maximum: 65535 minimum: 1 type: integer contentEncoding: int32 default: 2222 - type: string description: Mist Edge proxy port used for switch management traffic protect_re: allOf: - $ref: '#/components/schemas/protect_re3' - description: Control-plane protection settings for the switch radius: allOf: - $ref: '#/components/schemas/switch_radius2' - description: Management authentication settings using RADIUS remove_existing_configs: type: boolean description: By default, only the configuration generated by Mist is cleaned up during the configuration process. If `true`, all the existing configuration will be removed. default: false root_password: type: string description: Root password for local switch access contentEncoding: password tacacs: allOf: - $ref: '#/components/schemas/tacacs2' - description: Management authentication settings using TACACS+ use_mxedge_proxy: type: boolean description: Whether to use Mist Edge as a proxy for switch management traffic description: Management-plane defaults provided by this switch profile gateway_matching3: title: gateway_matching3 type: object properties: enable: type: boolean description: Whether gateway matching is enabled rules: uniqueItems: true type: array items: $ref: '#/components/schemas/gateway_matching_rule' description: Gateway matching rules evaluated for this configuration description: Matching rules that select gateways for this profile config_switch_local_accounts_user: title: config_switch_local_accounts_user type: object properties: password: type: string description: Local password for the switch user account contentEncoding: password examples: - Juniper123 role: allOf: - $ref: '#/components/schemas/config_switch_local_accounts_user_role2' - description: 'Access role granted to the local switch user account. enum: `admin`, `helpdesk`, `none`, `read`.' description: Local switch user account credentials and access role gw_routing_policy_term_matching2: title: gw_routing_policy_term_matching2 type: object properties: as_path: type: array items: $ref: '#/components/schemas/bgp_as' description: AS path values that routes must match community: type: array items: type: string description: BGP communities that routes must match network: uniqueItems: true type: array items: type: string description: Configured network names that routes must match prefix: type: array items: type: string description: Route prefixes that routes must match protocol: type: array items: $ref: '#/components/schemas/gw_routing_policy_term_matching_protocol_enum' description: Routing protocols that routes must match route_exists: allOf: - $ref: '#/components/schemas/gw_routing_policy_term_matching_route_exists2' - description: Existing route condition that must be satisfied before this term matches vpn_neighbor_mac: type: array items: type: string description: Overlay neighbor MAC addresses used as match criteria for BGP sessions with `via`==`vpn` vpn_path: type: array items: type: string description: Overlay path names used as match criteria for BGP sessions with `via`==`vpn` vpn_path_sla: allOf: - $ref: '#/components/schemas/gw_routing_policy_term_matching_vpn_path_sla2' - description: SLA thresholds used when matching a VPN path description: Route match criteria that must be satisfied before actions are applied network_internet_access_destination_nat_property: title: network_internet_access_destination_nat_property type: object properties: internal_ip: type: string description: The Destination NAT destination IP address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}") examples: - 192.168.70.30 name: type: string description: Label for this direct internet destination NAT rule examples: - web server port: type: string description: The Destination NAT destination IP address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}") examples: - '443' wan_name: type: string description: SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity examples: - wan0 description: Direct-internet destination NAT rule target settings gateway_port_vpn_path_role2: title: gateway_port_vpn_path_role2 enum: - hub - mesh - spoke type: string description: 'Gateway role for this VPN path; valid values depend on the VPN `type`. enum: `hub`, `mesh`, `spoke`.' radio_band_preamble2: title: radio_band_preamble2 enum: - auto - long - short type: string description: '802.11 preamble mode used by the 6 GHz radio. enum: `auto`, `long`, `short`.' gateway_ip_config_property: title: gateway_ip_config_property type: object properties: ip: type: string description: Static IPv4 address for the gateway network interface when `type`==`static` contentEncoding: ipv4 ip6: type: string description: Static IPv6 address for the gateway network interface when `type6`==`static` contentEncoding: ipv6 netmask: type: string description: IPv4 netmask or prefix length for the gateway network interface when `type`==`static` examples: - /24 netmask6: type: string description: IPv6 netmask or prefix length for the gateway network interface when `type6`==`static` examples: - 2001:db8:abcd:12::1 secondary_ips: type: array items: type: string description: Additional IPv4 addresses in CIDR notation for this gateway network interface examples: - - 192.168.50.1/24 - 192.168.60.1/26 type: allOf: - $ref: '#/components/schemas/ip_type4' - description: 'IPv4 address assignment mode for this gateway network interface. enum: `dhcp`, `static`.' examples: - static type6: allOf: - $ref: '#/components/schemas/ip_type62' - description: 'IPv6 address assignment mode for this gateway network interface. enum: `autoconf`, `dhcp`, `disabled`, `static`.' examples: - static description: Gateway network interface IP configuration protect_re_allowed_service: title: protect_re_allowed_service enum: - icmp - ssh type: string description: 'Services allowed through protect-RE filters. enum: `icmp`, `ssh`' ap_uwb_config2: title: ap_uwb_config2 type: object properties: enabled: type: boolean description: Whether UWB RTLS integration is enabled default: false host: type: string description: RTLS server hostname or IP address examples: - coriva.example.com port: maximum: 65535 minimum: 1 type: integer description: RTLS server port number contentEncoding: int32 examples: - 9000 slot: maximum: 15 minimum: 0 type: integer description: UWB time slot assigned to this AP, 0–15 contentEncoding: int32 default: 0 examples: - 0 type: allOf: - $ref: '#/components/schemas/ap_uwb_config_type' - description: 'UWB integration type. enum: `zigpos`' description: UWB RTLS / OMLOX asset-visibility settings; overrides the site-level `uwb_config` and is overridden by device-level `uwb_config` wan_extra_routes6: title: wan_extra_routes6 type: object properties: via: type: string description: IPv6 next-hop address for this WAN extra route contentEncoding: ipv6 description: Additional IPv6 route for a WAN interface response_http401: title: response_http401 type: object properties: detail: type: string description: Human-readable explanation of the authentication error examples: - Authentication credentials were not provided. description: Standard HTTP 401 authentication error response aggregate_route: title: aggregate_route type: object properties: discard: type: boolean description: Whether to install the aggregate route as a discard route default: false metric: maximum: 4294967295 minimum: 0 type: - integer - 'null' description: Routing metric assigned to the aggregate route contentEncoding: int32 preference: maximum: 4294967295 minimum: 0 type: - integer - 'null' description: Route preference assigned to the aggregate route contentEncoding: int32 description: Aggregate route configuration for a network or routing instance vrf_extra_route: title: vrf_extra_route type: object properties: via: type: string description: IPv4 next-hop address for this VRF extra route contentEncoding: ipv4 description: Additional IPv4 static route for a VRF instance gateway_vrf_instance: title: gateway_vrf_instance type: object properties: networks: uniqueItems: true type: array items: type: string description: Network names included in this gateway VRF instance description: Gateway VRF instance and its member networks examples: - networks: - CORP_NET - MGMT_NET network_vpn_access_destination_nat_property: title: network_vpn_access_destination_nat_property type: object properties: internal_ip: type: string description: The Destination NAT destination IP address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}") examples: - 192.168.70.30 name: type: string description: Label for this VPN destination NAT rule examples: - web server port: type: string description: Destination port or variable for this VPN destination NAT rule examples: - '443' description: VPN access destination NAT rule target settings radius_acct_server: title: radius_acct_server required: - host - secret type: object properties: host: type: string description: Address or hostname of the RADIUS accounting server examples: - 1.2.3.4 keywrap_enabled: type: boolean description: Whether RADIUS keywrap is enabled for messages sent to this accounting server keywrap_format: allOf: - $ref: '#/components/schemas/radius_keywrap_format1' - description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' keywrap_kek: type: string description: RADIUS keywrap key encryption key (KEK) examples: - '1122334455' keywrap_mack: type: string description: RADIUS keywrap message authentication code key (MACK) examples: - '1122334455' port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used by the RADIUS accounting server secret: type: string description: Shared secret used with this RADIUS accounting server contentEncoding: password examples: - testing123 description: RADIUS accounting server settings radius_auth_server: title: radius_auth_server required: - host - secret type: object properties: host: type: string description: Address or hostname of the RADIUS authentication server examples: - 1.2.3.4 keywrap_enabled: type: boolean description: Whether RADIUS keywrap is enabled for messages sent to this authentication server keywrap_format: allOf: - $ref: '#/components/schemas/radius_keywrap_format1' - description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' keywrap_kek: type: string description: RADIUS keywrap key encryption key (KEK) examples: - '1122334455' keywrap_mack: type: string description: RADIUS keywrap message authentication code key (MACK) examples: - '1122334455' port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used by the RADIUS authentication server require_message_authenticator: type: boolean description: Whether to require Message-Authenticator in requests default: false secret: type: string description: Shared secret used with this RADIUS authentication server contentEncoding: password examples: - testing123 description: RADIUS authentication server settings gateway_wan_probe_override_probe_profile2: title: gateway_wan_probe_override_probe_profile2 enum: - broadband - lte type: string description: 'WAN probe profile used for health checks on this port. enum: `broadband`, `lte`.' snmp_config_client_list: title: snmp_config_client_list type: object properties: client_list_name: type: string description: Name of the SNMP client list examples: - clist-1 clients: type: array items: type: string description: SNMP client IP addresses or CIDR ranges allowed by this list description: SNMP client allowlist definition tunnel_config_ike_proposal: title: tunnel_config_ike_proposal type: object properties: auth_algo: allOf: - $ref: '#/components/schemas/tunnel_config_auth_algo3' - description: 'Integrity algorithm used by this IKE proposal. enum: `md5`, `sha1`, `sha2`.' dh_group: allOf: - $ref: '#/components/schemas/tunnel_config_ike_dh_group2' - description: 'Diffie-Hellman group used by this IKE proposal. enum: `1`, `14`, `15`, `16`, `19`, `2`, `20`, `21`, `24`, `5`.' enc_algo: allOf: - oneOf: - {} - $ref: '#/components/schemas/tunnel_config_enc_algo3' - description: 'Cipher algorithm used by this IKE proposal. enum: `3des`, `aes128`, `aes256`, `aes_gcm128`, `aes_gcm256`.' description: IKE proposal settings for custom IPsec tunnels snmpv3_config_notify_items: title: snmpv3_config_notify_items type: object properties: name: type: string description: Identifier for this SNMPv3 notification definition tag: type: string description: Notification tag used to select target addresses type: allOf: - $ref: '#/components/schemas/snmpv3_config_notify_type2' - description: Delivery mode for this SNMPv3 notification, such as trap or inform description: SNMPv3 notification definition for traps or informs gateway_path_preferences_path: title: gateway_path_preferences_path required: - type type: object properties: cost: type: integer description: Relative cost assigned to this path for gateway path selection contentEncoding: int32 disabled: type: boolean description: For SSR Only. `true`, if this specific path is undesired gateway_ip: type: string description: Only if `type`==`local`, if a different gateway is desired internet_access: type: boolean description: Only if `type`==`vpn`, if this vpn path can be used for internet name: type: string description: "Required when \n * `type`==`vpn`: the name of the VPN Path to use \n * `type`==`wan`: the name of the WAN interface to use" networks: type: array items: type: string description: List of network names used when `type`==`local` target_ips: type: array items: type: string description: List of destination IP addresses to replace when `type`==`local` type: allOf: - $ref: '#/components/schemas/gateway_path_type2' - description: Gateway path source type, such as local network, WAN interface, VPN path, or tunnel wan_name: type: string description: Optional if `type`==`vpn`; WAN interface name associated with the VPN path examples: - wan0 description: Candidate path within a gateway path preference ap_radio_band62: title: ap_radio_band62 type: object properties: allow_rrm_disable: type: boolean description: Whether RRM may disable the 6 GHz radio when optimizing RF settings default: false ant_gain: maximum: 10 minimum: 0 type: - integer - 'null' description: External antenna gain for the 6 GHz radio contentEncoding: int32 default: 0 antenna_beam_pattern: allOf: - $ref: '#/components/schemas/radio_band_antenna_beam_pattern1' - description: 'Beam pattern used by the 6 GHz radio antenna. enum: `narrow`, `medium`, `wide`.' antenna_mode: allOf: - $ref: '#/components/schemas/radio_band_antenna_mode2' - description: 'Radio chain mode for the 6 GHz radio. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' examples: - default bandwidth: allOf: - $ref: '#/components/schemas/dot11_bandwidth62' - description: 'Channel width configured for the 6 GHz radio. enum: `0`, `20`, `40`, `80`, `160`.' examples: - 80 channel: type: - integer - 'null' description: For Device. (primary) channel for the band, 0 means using the Site Setting contentEncoding: int32 examples: - 0 channels: type: - array - 'null' items: type: integer contentEncoding: int32 description: Allowed channel list for the 6 GHz radio; null or an empty array uses automatic selection default: [] disabled: type: boolean description: Whether to disable the radio default: false power: maximum: 25 minimum: 0 type: - integer - 'null' description: Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode contentEncoding: int32 examples: - 7 power_max: maximum: 18 minimum: 5 type: - integer - 'null' description: When power=null/unset, max tx power to use, HW-specific values will be used if not set contentEncoding: int32 power_min: maximum: 18 minimum: 5 type: - integer - 'null' description: When power=null/unset, min tx power to use, HW-specific values will be used if not set contentEncoding: int32 preamble: allOf: - $ref: '#/components/schemas/radio_band_preamble2' - description: '802.11 preamble mode used by the 6 GHz radio. enum: `auto`, `long`, `short`.' standard_power: type: boolean description: For 6GHz Only, standard-power operation, AFC (Automatic Frequency Coordination) will be performed, and we'll fall back to Low Power Indoor if AFC failed default: false description: 6 GHz radio settings for this access point ap_switch_setting7: title: ap_switch_setting7 type: object properties: enable_vlan: type: boolean description: Whether VLAN tagging is enabled for this AP switch-config port port_vlan_id: anyOf: - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 - type: string description: Native VLAN ID for this AP switch-config port vlan_ids: type: array items: maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: Allowed VLAN IDs for this AP switch-config port description: VLAN settings for AP eth0 idp_profile_action2: title: idp_profile_action2 enum: - alert - close - drop type: string description: 'Enforcement action applied when this overwrite rule matches. enum: `alert`, `close`, `drop`.' examples: - alert ap_uplink_port_config2: title: ap_uplink_port_config2 type: object properties: dot1x: type: boolean description: Whether to do 802.1x against uplink switch. When enabled, AP cert will be used to do EAP-TLS and the Org's CA Cert has to be provisioned at the switch default: false keep_wlans_up_if_down: type: boolean description: By default, WLANs are disabled when uplink is down. In some scenario, like SiteSurvey, one would want the AP to keep sending beacons. default: false description: Authentication and failover defaults for AP uplink ports network_multicast_group: title: network_multicast_group type: object properties: rp_ip: type: string description: RP (rendezvous point) IP address description: Multicast group rendezvous point mapping deviceprofile_switch: title: deviceprofile_switch required: - name - type type: object properties: acl_policies: type: array items: $ref: '#/components/schemas/acl_policy' description: ACL policy defaults provided by this switch profile acl_tags: type: object additionalProperties: $ref: '#/components/schemas/acl_tag' description: ACL tags available to switch access policies in this profile additional_config_cmds: type: array items: type: string description: Additional CLI configuration commands provided by this switch profile aggregate_routes: type: object additionalProperties: $ref: '#/components/schemas/aggregate_route' description: Additional IPv4 aggregate route defaults in this switch profile examples: - 172.16.3.0/24: discard: false metric: null preference: 30 aggregate_routes6: type: object additionalProperties: $ref: '#/components/schemas/aggregate_route' description: Additional IPv6 aggregate route defaults in this switch profile examples: - 2a02:1234:420a:10c9::/64: discard: false metric: null preference: 30 created_time: type: number description: Timestamp when the switch profile was created readOnly: true dhcp_snooping: allOf: - $ref: '#/components/schemas/dhcp_snooping1' - description: DHCP snooping defaults provided by this switch profile dhcpd_config: allOf: - $ref: '#/components/schemas/switch_dhcpd_config1' - description: DHCP server defaults provided by this switch profile dns_servers: type: array items: type: string description: DNS servers provided by this switch profile dns_suffix: type: array items: type: string description: DNS search suffixes provided by this switch profile evpn_config: allOf: - $ref: '#/components/schemas/evpn_config1' - description: EVPN defaults applied by this switch profile readOnly: true extra_routes: type: object additionalProperties: $ref: '#/components/schemas/extra_route' description: Additional IPv4 route defaults in this switch profile examples: - 0.0.0.0/0: via: 192.168.1.10 extra_routes6: type: object additionalProperties: $ref: '#/components/schemas/extra_route6' description: Additional IPv6 route defaults in this switch profile examples: - 2a02:1234:420a:10c9::/64: via: 2a02:1234:200a::100 id: type: string description: Unique identifier of the switch profile contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f iot_config: type: object additionalProperties: $ref: '#/components/schemas/switch_iot_port' description: IoT port defaults provided by this switch profile ip_config: allOf: - $ref: '#/components/schemas/junos_ip_config1' - description: Management IP addressing defaults in this switch profile mist_nac: allOf: - $ref: '#/components/schemas/switch_mist_nac1' - description: Mist NAC defaults applied by this switch profile modified_time: type: number description: Timestamp when the switch profile was last modified readOnly: true name: type: string description: Display name of the switch profile networks: type: object additionalProperties: $ref: '#/components/schemas/switch_network' description: Layer 3 networks configured by this switch profile ntp_servers: type: array items: type: string description: NTP servers provided by this switch profile oob_ip_config: allOf: - $ref: '#/components/schemas/switch_oob_ip_config1' - description: Out-of-band management IP defaults in this switch profile org_id: type: string description: Organization that owns this switch profile contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 ospf_areas: type: object additionalProperties: $ref: '#/components/schemas/ospf_area' description: OSPF area defaults provided by this switch profile other_ip_configs: type: object additionalProperties: $ref: '#/components/schemas/junos_other_ip_config' description: Property key is the network name. Defines the additional IP Addresses configured on the device. port_config: type: object additionalProperties: $ref: '#/components/schemas/junos_port_config' description: Per-port wired defaults provided by this switch profile port_mirroring: type: object additionalProperties: $ref: '#/components/schemas/switch_port_mirroring_property' description: Port mirroring defaults provided by this switch profile port_usages: type: object additionalProperties: $ref: '#/components/schemas/switch_port_usage' description: Reusable switch port usage profiles provided by this switch profile radius_config: allOf: - $ref: '#/components/schemas/switch_radius_config2' - description: RADIUS authentication and accounting defaults in this switch profile remote_syslog: allOf: - $ref: '#/components/schemas/remote_syslog1' - description: Remote syslog defaults provided by this switch profile routing_policies: type: object additionalProperties: $ref: '#/components/schemas/sw_routing_policy' description: Routing policy defaults applied by this switch profile site_id: type: string description: Site where this switch profile is defined, when scoped to a site contentEncoding: uuid readOnly: true examples: - 441a1214-6928-442a-8e92-e1d34b8ec6a6 snmp_config: allOf: - $ref: '#/components/schemas/snmp_config1' - description: SNMP defaults provided by this switch profile stp_config: allOf: - $ref: '#/components/schemas/switch_stp_config1' - description: Spanning Tree Protocol defaults provided by this switch profile switch_mgmt: allOf: - $ref: '#/components/schemas/switch_mgmt1' - description: Management-plane defaults provided by this switch profile type: const: switch type: string description: Device type discriminator for switch profiles readOnly: true use_router_id_as_source_ip: type: boolean description: Whether to use it for snmp / syslog / tacplus / radius default: false vrf_config: allOf: - $ref: '#/components/schemas/vrf_config3' - description: VRF defaults applied by this switch profile vrf_instances: type: object additionalProperties: $ref: '#/components/schemas/switch_vrf_instance' description: VRF instances configured by this switch profile examples: - guest: extra_routes: 0.0.0.0/0: via: 192.168.31.1 networks: - guest vrrp_config: allOf: - $ref: '#/components/schemas/vrrp_config1' - description: VRRP defaults applied by this switch profile description: Switch Device Profiles can be applied to one or multiple switches. The settings from the Device Profile will override the settings from the Switch Template and the Site Settings. switch_port_usage_dynamic_reset_default_when2: title: switch_port_usage_dynamic_reset_default_when2 enum: - link_down - none type: string description: 'Only if `mode`==`dynamic`. Condition that resets a dynamic port to the default port usage. enum: `link_down`, `none`.' examples: - link_down snmp_config1: title: snmp_config1 type: object properties: client_list: type: array items: $ref: '#/components/schemas/snmp_config_client_list' description: SNMP client allowlists that can be referenced by communities contact: type: string description: Administrative contact string advertised through SNMP examples: - cns@juniper.net description: type: string description: Device description string advertised through SNMP examples: - Juniper QFX Series Switch - 1K_5LA enabled: type: boolean description: Whether SNMP is enabled default: true engine_id: maxLength: 27 type: string description: SNMP engine ID used for SNMPv3 engine_id_type: allOf: - $ref: '#/components/schemas/snmp_config_engine_id_type2' - description: 'Method used to derive the SNMP engine ID. enum: `local`, `use_mac_address`.' location: type: string description: Physical location string advertised through SNMP examples: - Las Vegas, NV name: type: string description: System name advertised through SNMP examples: - TGH-1K-QFX10K network: type: string description: Management network used for SNMP traffic default: default trap_groups: type: array items: $ref: '#/components/schemas/snmp_config_trap_group' description: SNMP trap group definitions v2c_config: type: array items: $ref: '#/components/schemas/snmp_config_v2c_config' description: SNMPv2c community configuration entries for this SNMP profile v3_config: allOf: - $ref: '#/components/schemas/snmpv3_config2' - description: SNMPv3 user, VACM, notify, and target configuration views: type: array items: $ref: '#/components/schemas/snmp_config_view' description: SNMP MIB view definitions description: SNMP defaults provided by this switch profile snmp_config_trap_version2: title: snmp_config_trap_version2 enum: - all - v1 - v2 type: string description: 'SNMP trap protocol version used by this group. enum: `all`, `v1`, `v2`.' idp_config2: title: idp_config2 type: object properties: alert_only: type: boolean description: Whether to alert without enforcing IDP prevention actions enabled: type: boolean description: Whether IDP inspection is enabled for the policy default: false idpprofile_id: type: string description: org_level IDP Profile can be used, this takes precedence over `profile` contentEncoding: uuid examples: - 89b9d208-84a4-fa8f-af57-78f92c639cf2 profile: type: string description: 'enum: `Custom`, `strict` (default), `standard` or keys from idp_profiles' default: strict description: Intrusion detection and prevention settings applied by this service policy switch_radius_config1: title: switch_radius_config1 type: object properties: acct_immediate_update: type: boolean description: Whether immediate RADIUS accounting updates are sent acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled contentEncoding: int32 default: 0 acct_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_acct_server' description: RADIUS accounting servers used by this switch configuration auth_server_selection: allOf: - $ref: '#/components/schemas/switch_radius_config_auth_server_selection2' - description: 'Selection strategy for RADIUS authentication servers. enum: `ordered`, `unordered`.' auth_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_auth_server' description: RADIUS authentication servers used by this switch configuration auth_servers_retries: type: integer description: RADIUS auth session retries contentEncoding: int32 default: 3 auth_servers_timeout: type: integer description: RADIUS auth session timeout contentEncoding: int32 default: 5 coa_enabled: type: boolean description: Whether RADIUS Change of Authorization (CoA) is enabled default: false coa_port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used for RADIUS Change of Authorization (CoA) fast_dot1x_timers: type: boolean description: Whether fast 802.1X timers are enabled for RADIUS authentication default: false network: type: string description: Use `network`or `source_ip`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip source_ip: type: string description: Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic description: RADIUS configuration used when alternate RADIUS settings are required tunnel_config_node1: title: tunnel_config_node1 required: - hosts - wan_names type: object properties: hosts: type: array items: type: string description: Remote gateway host addresses for this tunnel node internal_ip6s: uniqueItems: true type: array items: type: string description: IPv6 addresses configured on this tunnel node internal_ips: type: array items: type: string description: Internal IP addresses configured on this tunnel node probe_hostnames: uniqueItems: true type: array items: type: string description: Hostnames used as ICMP probe destinations for this tunnel node; applicable for both IPv4 and IPv6 probe_http: allOf: - $ref: '#/components/schemas/tunnel_config_node_probe_http2' - description: HTTP probe settings for this tunnel node; success from any ICMP or HTTP probe indicates the tunnel is up probe_ip6s: uniqueItems: true type: array items: type: string description: IPv6 ICMP probe addresses used to monitor this tunnel node probe_ips: uniqueItems: true type: array items: type: string description: Health-check IP addresses used to monitor this tunnel node remote_ids: type: array items: type: string description: IKE identities expected from this tunnel node wan_names: type: array items: type: string description: Interface names that source tunnel traffic for this node description: Backup remote tunnel endpoint settings idp_profile: title: idp_profile type: object properties: base_profile: allOf: - $ref: '#/components/schemas/idp_profile_base_profile2' - description: 'Built-in IDP baseline profile inherited before applying overwrites. enum: `critical`, `standard`, `strict`.' examples: - strict created_time: type: number description: Timestamp when the IDP profile was created readOnly: true id: type: string description: Unique identifier of the IDP profile contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f modified_time: type: number description: Timestamp when the IDP profile was last modified readOnly: true name: type: string description: Display name of the IDP profile examples: - relaxed org_id: type: string description: Owning organization for the IDP profile contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 overwrites: type: array items: $ref: '#/components/schemas/idp_profile_overwrite' description: IDP signature override rules applied on top of the base profile description: Organization IDP profile with a base profile and targeted overwrite rules vrf_config3: title: vrf_config3 type: object properties: enabled: type: boolean description: Whether to enable VRF (when supported on the device) description: VRF defaults applied by this switch profile service_policy_ewf_rule_profile2: title: service_policy_ewf_rule_profile2 enum: - critical - standard - strict type: string description: 'Enhanced web filtering profile applied by this rule. enum: `critical`, `standard`, `strict`.' service_policy_skyatp_http_inspection_profile2: title: service_policy_skyatp_http_inspection_profile2 enum: - standard - strict type: string description: 'Sky ATP HTTP inspection profile to apply. enum: `standard`, `strict`.' ap_port_config: title: ap_port_config type: object properties: disabled: type: boolean description: Whether this AP Ethernet port is disabled default: false dynamic_vlan: allOf: - $ref: '#/components/schemas/ap_port_config_dynamic_vlan2' - description: RADIUS-assigned VLAN settings for AP port authentication enable_mac_auth: type: boolean description: Whether MAC authentication is enabled on this AP port default: false forwarding: allOf: - $ref: '#/components/schemas/ap_port_config_forwarding2' - description: 'Traffic forwarding mode for this AP Ethernet port. enum: `all`, `limited`, `mxtunnel`, `site_mxedge`, `wxtunnel`.' examples: - all mac_auth_preferred: type: boolean description: When `true`, we'll do dot1x then mac_auth. enable this to prefer mac_auth default: false mac_auth_protocol: allOf: - $ref: '#/components/schemas/ap_port_config_mac_auth_protocol2' - description: 'Protocol used for MAC authentication when `enable_mac_auth` is `true`. enum: `eap-md5`, `eap-peap`, `pap`.' mist_nac: allOf: - $ref: '#/components/schemas/wlan_mist_nac3' - description: Juniper Mist NAC settings used by AP port authentication mx_tunnel_id: type: string description: If `forwarding`==`mxtunnel`, vlan_ids comes from mxtunnel contentEncoding: uuid examples: - 08cd7499-5841-51c8-e663-fb16b6f3b45e mxtunnel_name: type: string description: If `forwarding`==`site_mxedge`, vlan_ids comes from site_mxedge (`mxtunnel` under site setting) port_auth: allOf: - $ref: '#/components/schemas/ap_port_config_port_auth2' - description: 'Authentication mode for this AP Ethernet port. enum: `dot1x`, `none`.' examples: - none port_vlan_id: maximum: 4094 minimum: 1 type: integer description: If `forwarding`==`limited`. VLAN ID allowed on this AP Ethernet port contentEncoding: int32 examples: - 1 radius_config: allOf: - $ref: '#/components/schemas/radius_config2' - description: RADIUS authentication and accounting settings for this AP port radsec: allOf: - $ref: '#/components/schemas/radsec3' - description: TLS-secured RADIUS settings for this AP port vlan_id: maximum: 4094 minimum: 1 type: integer description: "Optional to specify the VLAN ID for a tunnel if forwarding is for `wxtunnel`, `mxtunnel` or `site_mxedge`.\n * if vlan_id is not specified then it will use first one in vlan_ids[] of the mxtunnel.\n * if forwarding == site_mxedge, vlan_ids comes from site_mxedge (`mxtunnel` under site setting)" contentEncoding: int32 examples: - 9 vlan_ids: type: string description: If `forwarding`==`limited`, comma separated list of additional VLAN IDs allowed on this port examples: - 10,20,30 wxtunnel_id: type: string description: If `forwarding`==`wxtunnel`, the port is bridged to the vlan of the session contentEncoding: uuid examples: - 7dae216d-7c98-a51b-e068-dd7d477b7216 wxtunnel_remote_id: type: string description: If `forwarding`==`wxtunnel`, the port is bridged to the vlan of the session examples: - wifiguest description: Ethernet port behavior settings for an access point service_policy_ssl_proxy3: title: service_policy_ssl_proxy3 type: object properties: ciphers_category: allOf: - $ref: '#/components/schemas/ssl_proxy_ciphers_category2' - description: 'Allowed cipher strength category for SSL proxy inspection. enum: `medium`, `strong`, `weak`.' enabled: type: boolean description: Whether SSL proxy inspection is enabled for the service policy default: false description: TLS inspection settings applied by this service policy gateway_oob_ip_config1: title: gateway_oob_ip_config1 type: object properties: gateway: type: string description: Default gateway for the out-of-band management interface when `type`==`static` ip: type: string description: Static IPv4 address for the out-of-band management interface when `type`==`static` netmask: type: string description: IPv4 netmask or prefix length for the out-of-band management interface when `type`==`static` node1: allOf: - $ref: '#/components/schemas/gateway_oob_ip_config_node12' - description: Out-of-band management IP configuration override for node1 in an HA cluster type: allOf: - $ref: '#/components/schemas/ip_type2' - description: 'IP assignment mode for the out-of-band management interface. enum: `dhcp`, `static`.' examples: - static use_mgmt_vrf: type: boolean description: If supported on the platform. If enabled, DNS will be using this routing-instance, too default: false use_mgmt_vrf_for_host_out: type: boolean description: For host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired default: false vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: VLAN ID used for out-of-band management traffic description: Out-of-band management IP defaults in this gateway profile gateway_traffic_shaping1: title: gateway_traffic_shaping1 type: object properties: class_percentages: type: array items: type: integer contentEncoding: int32 description: Traffic class bandwidth percentages for high, medium, low, and best-effort queues enabled: type: boolean description: Whether traffic shaping is enabled default: false max_tx_kbps: type: integer description: Maximum transmit bandwidth for the interface, in Kbps contentEncoding: int32 description: Traffic shaping settings applied to this VPN path tunnel_via2: title: tunnel_via2 enum: - primary - secondary type: string description: If `via`==`tunnel`, primary or secondary tunnel associated with this BGP neighbor switch_iot_port: title: switch_iot_port type: object properties: alarm_class: allOf: - $ref: '#/components/schemas/switch_iot_port_alarm_class2' - description: 'Alarm severity class raised for input-triggered switch IOT port events. enum: `minor`, `major`.' enabled: type: boolean description: Whether this switch IOT port is enabled default: false input_src: allOf: - $ref: '#/components/schemas/switch_iot_port_input_src2' - description: 'Only for `OUT` ports. Input port that triggers this output port. enum: `IN0`, `IN1`.' name: type: string description: Display name for the switch IOT port description: Switch IOT port configuration radsec3: title: radsec3 type: object properties: coa_enabled: type: boolean description: Whether RADIUS Change of Authorization (CoA) is enabled for RadSec traffic default: false enabled: type: boolean description: Whether RadSec is enabled idle_timeout: anyOf: - type: integer contentEncoding: int32 default: 60 - type: string description: Idle timeout, in seconds, for RadSec connections mxcluster_ids: type: array items: type: string contentEncoding: uuid description: Mist Edge cluster IDs used as RadSec proxies when the WLAN does not use mxtunnel proxy_hosts: type: array items: type: string description: RadSec proxy hostnames advertised to APs server_name: type: string description: TLS server name to verify against the CA certificates in Org Setting. Only if not Mist Edge. examples: - radsec.abc.com servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radsec_server' description: External RadSec servers. Only if not Mist Edge. use_mxedge: type: boolean description: Whether to use organization Mist Edge instances as RadSec proxies use_site_mxedge: type: boolean description: Whether to use site Mist Edge instances when this WLAN does not use mxtunnel default: false description: TLS-secured RADIUS settings for this AP port network: title: network required: - name type: object properties: created_time: type: number description: Epoch timestamp when the network was created readOnly: true disallow_mist_services: type: boolean description: Whether to disallow Mist Devices in the network default: false gateway: type: string description: IPv4 gateway address for this network contentEncoding: ipv4 examples: - 192.168.70.1 gateway6: type: string description: IPv6 gateway address for this network contentEncoding: ipv6 examples: - fdad:b0bc:f29e::1 id: type: string description: Unique identifier of the network contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f internal_access: allOf: - $ref: '#/components/schemas/network_internal_access2' - description: Internal access settings for this network internet_access: allOf: - $ref: '#/components/schemas/network_internet_access2' - description: Direct internet access and NAT settings for this network isolation: type: boolean description: Whether to allow clients in the network to talk to each other modified_time: type: number description: Epoch timestamp when the network was last modified readOnly: true multicast: allOf: - $ref: '#/components/schemas/network_multicast2' - description: Settings for multicast routing on this network name: type: string description: Display name of the organization network org_id: type: string description: Organization that owns this network contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 routed_for_networks: type: array items: type: string description: Other network names this network can route to, for example through BGP, OSPF or static routes subnet: type: string description: IPv4 subnet CIDR for this network examples: - 192.168.70.0/24 subnet6: type: string description: IPv6 subnet CIDR for this network examples: - fdad:b0bc:f29e::/32 tenants: type: object additionalProperties: $ref: '#/components/schemas/network_tenant' description: Tenant address mappings associated with this network vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: VLAN ID or variable associated with this network vpn_access: type: object additionalProperties: $ref: '#/components/schemas/network_vpn_access_config' description: VPN access settings keyed by VPN name for this network description: Organization-level Layer 3 network definition that can be merged into site settings and used for service routes. Networks are used to define the service routes in the Gateway settings or templates gw_routing_policy_term_action2: title: gw_routing_policy_term_action2 type: object properties: accept: type: boolean description: Whether to accept routes that match this term. Precedence is `accept` > `next_term` > `next_policy`; routes are rejected if all three are false add_community: type: array items: type: string description: BGP communities to add to routes that match this term add_target_vrfs: type: array items: type: string description: SSR target VRFs to add when leaking routes from hub to spoke community: type: array items: type: string description: BGP communities to set when this term is used as an export policy exclude_as_path: type: array items: type: string description: AS path values to exclude when this term is used as an export policy exclude_community: type: array items: type: string description: BGP communities to exclude from routes that match this term export_communities: type: array items: type: string description: BGP communities allowed for export when this term is used as an export policy local_preference: anyOf: - type: string - maximum: 4294967295 minimum: 1 type: integer contentEncoding: int32 description: Preference value to set when this term is used as an import policy next_policy: type: boolean description: When true, continue evaluating the next routing policy in the chain after this term matches; default is false default: false next_term: type: boolean description: When true, continue evaluating the next term in the same routing policy after this term matches; default is false default: false prepend_as_path: type: array items: type: string description: AS path values to prepend when this term is used as an export policy description: Policy actions applied when this routing policy term matches ap_iot_pullup3: title: ap_iot_pullup3 enum: - external - internal - none type: string description: 'Selects the pull-up resistor mode applied to the output pin. enum: `external`, `internal`, `none`.' tunnel_provider_options_prisma2: title: tunnel_provider_options_prisma2 type: object properties: service_account_name: type: string description: For prisma-ipsec, service account name to used for tunnel auto provisioning examples: - sa1@1823425211 description: Palo Alto Prisma Access provisioning options for tunnel endpoints ospf_area_network_auth_type2: title: ospf_area_network_auth_type2 enum: - md5 - none - password type: string description: 'Authentication method used by this OSPF network. enum: `md5`, `none`, `password`.' examples: - md5 junos_ip_config1: title: junos_ip_config1 type: object properties: dns: uniqueItems: true type: array items: type: string description: Configured DNS server addresses for Junos management traffic dns_suffix: uniqueItems: true type: array items: type: string description: DNS search suffixes configured for Junos management traffic gateway: type: string description: Default gateway IPv4 address for this Junos IP configuration ip: type: string description: Configured IPv4 address for this Junos IP configuration netmask: type: string description: Used only if `subnet` is not specified in `networks` network: type: string description: Management network for this IP configuration; used as the default source network for outbound SSH, DNS, NTP, TACACS+, RADIUS, syslog, and SNMP type: allOf: - $ref: '#/components/schemas/ip_type1' - description: 'IP assignment mode for this Junos IP configuration. enum: `dhcp`, `static`.' examples: - static description: Management IP addressing defaults in this switch profile network_multicast2: title: network_multicast2 type: object properties: disable_igmp: type: boolean description: If the network will only be the source of the multicast traffic, IGMP can be disabled default: false enabled: type: boolean description: Whether multicast support is enabled for this network default: false groups: type: object additionalProperties: $ref: '#/components/schemas/network_multicast_group' description: Multicast group-to-RP mappings for this network description: Settings for multicast routing on this network bgp_config_neighbors: title: bgp_config_neighbors required: - neighbor_as type: object properties: disabled: type: boolean description: If true, the BGP session to this neighbor will be administratively disabled/shutdown default: false export_policy: type: string description: Export policy applied only to this BGP neighbor hold_time: maximum: 65535 minimum: 0 type: integer description: BGP hold time for this neighbor, in seconds contentEncoding: int32 default: 90 import_policy: type: string description: Import policy applied only to this BGP neighbor multihop_ttl: maximum: 255 minimum: 0 type: integer description: Assuming BGP neighbor is directly connected contentEncoding: int32 neighbor_as: anyOf: - type: string - maximum: 4294967294 minimum: 1 type: integer contentEncoding: int32 description: Autonomous System (AS) number of this BGP neighbor examples: - '65000' tunnel_via: allOf: - $ref: '#/components/schemas/tunnel_via2' - description: If `via`==`tunnel`, primary or secondary tunnel associated with this BGP neighbor description: Per-neighbor BGP session settings gateway_port_config_ip_config2: title: gateway_port_config_ip_config2 type: object properties: dns: type: array items: type: string description: Resolver server IP addresses used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0 dns_suffix: type: array items: type: string description: DNS search suffixes used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0 gateway: type: string description: Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP address (i.e. "192.168.1.1") or a Variable (i.e. "{{myvar}}") examples: - 192.168.1.1 gateway6: type: string description: Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IPv6 Address (i.e. "2001:db8::1") or a Variable (i.e. "{{myvar}}") examples: - 2001:db8::1 ip: type: string description: Interface IP address (i.e. "192.168.1.8") or a Variable (i.e. "{{myvar}}") contentEncoding: ipv4 examples: - 192.168.1.8 ip6: type: string description: Interface IPv6 Address (i.e. "2001:db8::123") or a Variable (i.e. "{{myvar}}") contentEncoding: ipv6 examples: - 2001:db8::123 netmask: type: string description: Used only if `subnet` is not specified in `networks`. Interface Netmask (i.e. "/24") or a Variable (i.e. "{{myvar}}") examples: - /24 netmask6: type: string description: Used only if `subnet` is not specified in `networks`. Interface IPv6 Netmask (i.e. "/64") or a Variable (i.e. "{{myvar}}") examples: - /64 network: type: string description: Optional, the network to be used for mgmt poser_password: type: string description: Password used for PPPoE when `type`==`pppoe` contentEncoding: password pppoe_auth: allOf: - $ref: '#/components/schemas/gateway_wan_ppoe_auth2' - description: 'Authentication protocol used for PPPoE when `type`==`pppoe`. enum: `chap`, `none`, `pap`.' pppoe_username: type: string description: Username used for PPPoE when `type`==`pppoe` type: allOf: - $ref: '#/components/schemas/gateway_wan_type2' - description: 'IPv4 assignment mode for this gateway port interface. enum: `dhcp`, `pppoe`, `static`.' type6: allOf: - $ref: '#/components/schemas/gateway_wan_type62' - description: 'IPv6 assignment mode for this gateway port interface. enum: `autoconf`, `dhcp`, `static`.' description: Layer 3 IP configuration for the port tunnel_config_node3: title: tunnel_config_node3 required: - hosts - wan_names type: object properties: hosts: type: array items: type: string description: Remote gateway host addresses for this tunnel node internal_ip6s: uniqueItems: true type: array items: type: string description: IPv6 addresses configured on this tunnel node internal_ips: type: array items: type: string description: Internal IP addresses configured on this tunnel node probe_hostnames: uniqueItems: true type: array items: type: string description: Hostnames used as ICMP probe destinations for this tunnel node; applicable for both IPv4 and IPv6 probe_http: allOf: - $ref: '#/components/schemas/tunnel_config_node_probe_http2' - description: HTTP probe settings for this tunnel node; success from any ICMP or HTTP probe indicates the tunnel is up probe_ip6s: uniqueItems: true type: array items: type: string description: IPv6 ICMP probe addresses used to monitor this tunnel node probe_ips: uniqueItems: true type: array items: type: string description: Health-check IP addresses used to monitor this tunnel node remote_ids: type: array items: type: string description: IKE identities expected from this tunnel node wan_names: type: array items: type: string description: Interface names that source tunnel traffic for this node description: Main remote tunnel endpoint settings gw_routing_policy_term: title: gw_routing_policy_term type: object properties: actions: allOf: - $ref: '#/components/schemas/gw_routing_policy_term_action2' - description: Policy actions applied when this routing policy term matches matching: allOf: - $ref: '#/components/schemas/gw_routing_policy_term_matching2' - description: Route match criteria that must be satisfied before actions are applied description: Gateway routing policy term with match criteria and actions switch_port_usage_mac_auth_protocol2: title: switch_port_usage_mac_auth_protocol2 enum: - eap-md5 - eap-peap - pap type: string description: 'Only if `mode`!=`dynamic` and `enable_mac_auth`==`true`. MAC authentication protocol to use; ignored if Mist NAC is enabled. enum: `eap-md5`, `eap-peap`, `pap`.' snmpv3_config_notify_filter_item_content: title: snmpv3_config_notify_filter_item_content type: object properties: include: type: boolean description: Whether the matching OID subtree is included oid: type: string description: Matched OID subtree for this notification filter rule examples: - 1.3.6.1.4.1 description: OID filter rule for an SNMPv3 notification profile remote_syslog_user: title: remote_syslog_user type: object properties: contents: type: array items: $ref: '#/components/schemas/remote_syslog_content' description: Syslog facilities and severities logged for this user rule match: type: string description: Expression used to filter user log messages examples: - '"!alarm|ntp|errors.crc_error[chan]"' user: type: string description: Account name or wildcard matched by this syslog rule examples: - '*' description: User-specific syslog logging rule service_policy: title: service_policy type: object properties: action: allOf: - $ref: '#/components/schemas/allow_deny2' - description: Allow or deny action for traffic matched by this service policy antivirus: allOf: - $ref: '#/components/schemas/service_policy_antivirus1' - description: Malware and virus inspection settings applied by this service policy appqoe: allOf: - $ref: '#/components/schemas/service_policy_appqoe1' - description: Application QoE settings applied by this service policy ewf: type: array items: $ref: '#/components/schemas/service_policy_ewf_rule' description: Enhanced web filtering rules applied by this service policy idp: allOf: - $ref: '#/components/schemas/idp_config2' - description: Intrusion detection and prevention settings applied by this service policy local_routing: type: boolean description: Whether the policy permits access within the same VRF name: type: string description: Display name of the service policy path_preference: type: string description: By default, we derive all paths available and use them. Optionally, you can customize by using `path_preference` secintel: allOf: - $ref: '#/components/schemas/service_policy_secintel3' - description: Threat intelligence settings applied by this service policy servicepolicy_id: type: string description: Organization-level service policy identifier used to link and override selected attributes contentEncoding: uuid services: uniqueItems: true type: array items: type: string description: Application services or service groups matched by this policy skyatp: allOf: - $ref: '#/components/schemas/service_policy_skyatp2' - description: Threat inspection settings provided by Sky ATP for this service policy ssl_proxy: allOf: - $ref: '#/components/schemas/service_policy_ssl_proxy3' - description: TLS inspection settings applied by this service policy syslog: allOf: - $ref: '#/components/schemas/service_policy_syslog2' - description: Remote logging settings applied by this service policy tenants: uniqueItems: true type: array items: type: string description: User or network tenants matched by this service policy description: Site-level service policy that allows or denies traffic for tenants and services snmp_vacm_security_model2: title: snmp_vacm_security_model2 enum: - usm - v1 - v2c type: string description: 'Required security model for these VACM group mappings. enum: `usm`, `v1`, `v2c`.' tunnel_provider_options_zscaler2: title: tunnel_provider_options_zscaler2 type: object properties: aup_block_internet_until_accepted: type: boolean description: Whether Zscaler blocks internet access until the Acceptable Use Policy is accepted default: false aup_enabled: type: boolean description: Can only be `true` when `auth_required`==`false`, display Acceptable Use Policy (AUP) default: false aup_force_ssl_inspection: type: boolean description: Proxy HTTPs traffic, requiring Zscaler cert to be installed in browser default: false aup_timeout_in_days: maximum: 180 minimum: 1 type: integer description: Required if `aup_enabled`==`true`. Days before AUP is requested again contentEncoding: int32 auth_required: type: boolean description: Enable this option to enforce user authentication default: false caution_enabled: type: boolean description: Can only be `true` when `auth_required`==`false`, display caution notification for non-authenticated users default: false dn_bandwidth: maximum: 99999 minimum: 0.1 type: - number - 'null' description: Download bandwidth cap of the link, in Mbps. Disabled if not set examples: - 200 idle_time_in_minutes: maximum: 43200 minimum: 0 type: integer description: Required if `surrogate_IP`==`true`, idle Time to Disassociation contentEncoding: int32 ofw_enabled: type: boolean description: If `true`, enable the firewall control option default: false sub_locations: type: array items: $ref: '#/components/schemas/tunnel_provider_options_zscaler_sub_location' description: Per-network Zscaler sub-location settings surrogate_IP: type: boolean description: Can only be `true` when `auth_required`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies default: false surrogate_IP_enforced_for_known_browsers: type: boolean description: Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers surrogate_refresh_time_in_minutes: maximum: 43200 minimum: 1 type: integer description: Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idle_time_in_minutes`, refresh Time for re-validation of Surrogacy contentEncoding: int32 up_bandwidth: maximum: 99999 minimum: 0.1 type: - number - 'null' description: Download bandwidth cap of the link, in Mbps. Disabled if not set examples: - 200 xff_forward_enabled: type: boolean description: Location uses proxy chaining to forward traffic default: false description: Provider settings for Zscaler tunnel endpoints ap_radio_band51: title: ap_radio_band51 type: object properties: allow_rrm_disable: type: boolean description: Whether RRM may disable the 5 GHz radio when optimizing RF settings default: false ant_gain: maximum: 10 minimum: 0 type: - integer - 'null' description: External antenna gain for the 5 GHz radio contentEncoding: int32 default: 0 antenna_beam_pattern: allOf: - $ref: '#/components/schemas/radio_band_antenna_beam_pattern3' - description: 'Beam pattern used by the 5 GHz radio antenna. enum: `narrow`, `medium`, `wide`.' antenna_mode: allOf: - $ref: '#/components/schemas/radio_band_antenna_mode1' - description: 'Radio chain mode for the 5 GHz radio. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' examples: - default bandwidth: allOf: - $ref: '#/components/schemas/dot11_bandwidth52' - description: 'Channel width configured for the 5 GHz radio. enum: `0`, `20`, `40`, `80`.' examples: - 40 channel: type: - integer - 'null' description: For Device. (primary) channel for the band, 0 means using the Site Setting contentEncoding: int32 examples: - 100 channels: type: - array - 'null' items: type: integer contentEncoding: int32 description: Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection default: [] disabled: type: boolean description: Whether to disable the radio default: false power: maximum: 25 minimum: 0 type: - integer - 'null' description: Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode contentEncoding: int32 examples: - 6 power_max: maximum: 17 minimum: 5 type: - integer - 'null' description: When power=null/unset, max tx power to use, HW-specific values will be used if not set contentEncoding: int32 power_min: maximum: 17 minimum: 5 type: - integer - 'null' description: When power=null/unset, min tx power to use, HW-specific values will be used if not set contentEncoding: int32 preamble: allOf: - $ref: '#/components/schemas/radio_band_preamble1' - description: '802.11 preamble mode used by the 5 GHz radio. enum: `auto`, `long`, `short`.' description: 5 GHz settings used when the 2.4 GHz radio operates in 5 GHz mode ospf_area_network_interface_type2: title: ospf_area_network_interface_type2 enum: - broadcast - nbma - p2mp - p2p type: string description: 'OSPF interface type used for this network. enum: `broadcast`, `nbma`, `p2mp`, `p2p`.' protect_re3: title: protect_re3 type: object properties: allowed_services: type: array items: $ref: '#/components/schemas/protect_re_allowed_service' description: Built-in services explicitly allowed by the Protect RE policy examples: - - icmp - ssh custom: type: array items: $ref: '#/components/schemas/protect_re_custom' description: Additional ACL entries allowed by the Protect RE policy enabled: type: boolean description: "When enabled, all traffic that is not essential to our operation will be dropped\ne.g. ntp / dns / traffic to mist will be allowed by default\n if dhcpd is enabled, we'll make sure it works" default: false hit_count: type: boolean description: Whether to enable hit count for Protect_RE policy default: false trusted_hosts: type: array items: type: string description: Trusted host or subnet entries allowed by the Protect RE policy description: Control-plane protection settings for the switch config_switch_local_accounts_user_role2: title: config_switch_local_accounts_user_role2 enum: - admin - helpdesk - none - read type: string description: 'Access role granted to the local switch user account. enum: `admin`, `helpdesk`, `none`, `read`.' switch_port_usage_duplex2: title: switch_port_usage_duplex2 enum: - auto - full - half type: string description: 'Only if `mode`!=`dynamic`. Link duplex mode for this port usage. enum: `auto`, `full`, `half`.' junos_port_config: title: junos_port_config required: - usage type: object properties: ae_disable_lacp: type: boolean description: To disable LACP support for the AE interface ae_idx: type: integer description: Users could force to use the designated AE name contentEncoding: int32 ae_lacp_force_up: type: boolean description: 'If `aggregated`==`true`, sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only' default: false ae_lacp_passive: type: boolean description: If `aggregated`==`true`, sets LACP to passive mode on this AE interface; by default, active (fast) mode is used default: false ae_lacp_slow: type: boolean description: To use slow timeout aggregated: type: boolean description: Whether this port is configured as an aggregated Ethernet member default: false critical: type: boolean description: To generate port up/down alarm default: false description: type: string description: Human-readable description for this Junos port disable_autoneg: type: boolean description: If `speed` and `duplex` are specified, whether to disable autonegotiation default: false duplex: allOf: - $ref: '#/components/schemas/junos_port_config_duplex2' - description: 'Link duplex mode for this Junos port. enum: `auto`, `full`, `half`.' dynamic_usage: type: - string - 'null' description: Enable dynamic usage for this port. Set to `dynamic` to enable. esilag: type: boolean description: Whether this Junos port participates in an ESI-LAG mtu: type: integer description: Media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation contentEncoding: int32 default: 1514 networks: type: array items: type: string description: List of network names. Required if `usage`==`inet` no_local_overwrite: type: boolean description: Prevent helpdesk to override the port config default: true poe_disabled: type: boolean description: Whether PoE capabilities are disabled for this Junos port default: false port_network: type: string description: Required if `usage`==`vlan_tunnel`. Q-in-Q tunneling using All-in-one bundling. This also enables standard L2PT for interfaces that are not encapsulation tunnel interfaces and uses MAC rewrite operation. [View more information](https://www.juniper.net/documentation/us/en/software/junos/multicast-l2/topics/topic-map/q-in-q.html#id-understanding-qinq-tunneling-and-vlan-translation) speed: allOf: - $ref: '#/components/schemas/junos_port_config_speed1' - description: 'Link speed for this Junos port. enum: `10m`, `100m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`, `auto`.' usage: type: string description: Port usage name. For Q-in-Q, use `vlan_tunnel`. If EVPN is used, use `evpn_uplink`or `evpn_downlink` description: Junos switch port configuration snmpv3_config_target_address_item: title: snmpv3_config_target_address_item type: object properties: address: type: string description: IP address or hostname of the SNMP target examples: - 10.11.0.2 address_mask: type: string description: Mask applied to the SNMP target address examples: - 255.255.255.0 port: type: - string - 'null' description: UDP port used by the SNMP target default: '161' tag_list: type: string description: Set of notification tags for this target address; use spaces between multiple tags target_address_name: type: string description: Name of the SNMP target address entry examples: - target_address_name target_parameters: type: string description: Target parameter profile referenced by this target address description: SNMPv3 notification target address entry ap_switch_setting2: title: ap_switch_setting2 type: object properties: enable_vlan: type: boolean description: Whether VLAN tagging is enabled for this AP switch-config port port_vlan_id: anyOf: - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 - type: string description: Native VLAN ID for this AP switch-config port vlan_ids: type: array items: maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: Allowed VLAN IDs for this AP switch-config port description: VLAN settings for AP eth2 ap_iot_output2: title: ap_iot_output2 type: object properties: enabled: type: boolean description: Whether to enable a pin default: false name: type: string description: Optional; descriptive pin name examples: - motion output: type: boolean description: Whether the pin is configured as an output. DO and A1-A4 can be repurposed by changing examples: - true pullup: allOf: - $ref: '#/components/schemas/ap_iot_pullup3' - description: 'Selects the pull-up resistor mode applied to the output pin. enum: `external`, `internal`, `none`.' value: type: integer description: Output pin signal level, default 0 contentEncoding: int32 examples: - 0 description: Analog-capable IoT pin A3 output settings response_http429: title: response_http429 type: object properties: detail: type: string description: Human-readable explanation of the rate limit error examples: - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold description: Standard HTTP 429 rate limit error response tunnel_config_enc_algo3: title: tunnel_config_enc_algo3 enum: - 3des - aes128 - aes256 - aes_gcm128 - aes_gcm256 type: string description: 'Cipher algorithm used by this IKE proposal. enum: `3des`, `aes128`, `aes256`, `aes_gcm128`, `aes_gcm256`.' ap_iot_output6: title: ap_iot_output6 type: object properties: enabled: type: boolean description: Whether to enable a pin default: false name: type: string description: Optional; descriptive pin name examples: - motion output: type: boolean description: Whether the pin is configured as an output. DO and A1-A4 can be repurposed by changing examples: - true pullup: allOf: - $ref: '#/components/schemas/ap_iot_pullup3' - description: 'Selects the pull-up resistor mode applied to the output pin. enum: `external`, `internal`, `none`.' value: type: integer description: Output pin signal level, default 0 contentEncoding: int32 examples: - 0 description: Analog-capable IoT pin A1 output settings service_policy_secintel_profile2: title: service_policy_secintel_profile2 enum: - default - standard - strict type: string description: 'Protection level applied by SecIntel inspection. enum: `default`, `standard`, `strict`.' switch_iot_port_alarm_class2: title: switch_iot_port_alarm_class2 enum: - minor - major type: string description: 'Alarm severity class raised for input-triggered switch IOT port events. enum: `minor`, `major`.' service_policy_skyatp2: title: service_policy_skyatp2 type: object properties: dns_dga_detection: allOf: - $ref: '#/components/schemas/service_policy_skyatp_dns_dga_detection2' - description: Detection settings for DNS DGA threats provided by Sky ATP dns_tunnel_detection: allOf: - $ref: '#/components/schemas/service_policy_skyatp_dns_tunnel_detection2' - description: Detection settings for DNS tunneling threats provided by Sky ATP http_inspection: allOf: - $ref: '#/components/schemas/service_policy_skyatp_http_inspection2' - description: Web traffic inspection settings provided by Sky ATP iot_device_policy: allOf: - $ref: '#/components/schemas/service_policy_skyatp_iot_device_policy2' - description: Device threat policy settings provided by Sky ATP for IoT clients description: Threat inspection settings provided by Sky ATP for this service policy gateway_wan_type62: title: gateway_wan_type62 enum: - autoconf - dhcp - static type: string description: 'IPv6 assignment mode for this gateway port interface. enum: `autoconf`, `dhcp`, `static`.' ip_type64: title: ip_type64 enum: - autoconf - dhcp - disabled - static type: string description: 'IPv6 address assignment mode for AP management traffic. enum: `autoconf`, `dhcp`, `disabled`, `static`.' examples: - static service_policy_skyatp_dns_dga_detection2: title: service_policy_skyatp_dns_dga_detection2 type: object properties: enabled: type: boolean description: Whether Sky ATP DNS DGA detection is enabled profile: allOf: - $ref: '#/components/schemas/service_policy_skyatp_dns_dga_detection_profile2' - description: 'Sky ATP DNS DGA detection profile to apply. enum: `default`, `standard`, `strict`.' description: Detection settings for DNS DGA threats provided by Sky ATP sw_routing_policy_term: title: sw_routing_policy_term required: - name type: object properties: actions: allOf: - $ref: '#/components/schemas/sw_routing_policy_term_action2' - description: Policy actions applied when this routing policy term matches matching: allOf: - $ref: '#/components/schemas/sw_routing_policy_term_matching2' - description: Route match criteria that must be satisfied before actions are applied name: type: string description: Display name of the switch routing policy term description: Switch routing policy term with match criteria and actions switch_radius_config2: title: switch_radius_config2 type: object properties: acct_immediate_update: type: boolean description: Whether immediate RADIUS accounting updates are sent acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled contentEncoding: int32 default: 0 acct_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_acct_server' description: RADIUS accounting servers used by this switch configuration auth_server_selection: allOf: - $ref: '#/components/schemas/switch_radius_config_auth_server_selection2' - description: 'Selection strategy for RADIUS authentication servers. enum: `ordered`, `unordered`.' auth_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_auth_server' description: RADIUS authentication servers used by this switch configuration auth_servers_retries: type: integer description: RADIUS auth session retries contentEncoding: int32 default: 3 auth_servers_timeout: type: integer description: RADIUS auth session timeout contentEncoding: int32 default: 5 coa_enabled: type: boolean description: Whether RADIUS Change of Authorization (CoA) is enabled default: false coa_port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used for RADIUS Change of Authorization (CoA) fast_dot1x_timers: type: boolean description: Whether fast 802.1X timers are enabled for RADIUS authentication default: false network: type: string description: Use `network`or `source_ip`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip source_ip: type: string description: Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic description: RADIUS authentication and accounting defaults in this switch profile dhcpd_config_type2: title: dhcpd_config_type2 enum: - local - none - relay type: string description: 'IPv4 DHCP mode for this network. enum: `local`, `none`, `relay`.' ap_uwb_config_type: title: ap_uwb_config_type const: zigpos type: string description: 'UWB integration type. enum: `zigpos`' snmpv3_config_target_param_security_model2: title: snmpv3_config_target_param_security_model2 enum: - usm - v1 - v2c type: string description: 'Required security model for this target parameter profile. enum: `usm`, `v1`, `v2c`.' deviceprofile_ap: title: deviceprofile_ap required: - type type: object properties: aeroscout: allOf: - $ref: '#/components/schemas/ap_aeroscout2' - description: Location integration defaults for AeroScout in this AP profile airista: allOf: - $ref: '#/components/schemas/ap_airista2' - description: Location integration defaults for Airista in this AP profile ble_config: allOf: - $ref: '#/components/schemas/ble_config2' - description: Bluetooth Low Energy beacon and asset defaults in this AP profile created_time: type: number description: Timestamp when the AP device profile was created readOnly: true disable_eth1: type: boolean description: Whether to disable eth1 port default: false disable_eth2: type: boolean description: Whether to disable eth2 port default: false disable_eth3: type: boolean description: Whether to disable eth3 port default: false disable_module: type: boolean description: Whether to disable module port default: false esl_config: allOf: - $ref: '#/components/schemas/ap_esl_config2' - description: Electronic shelf label integration defaults in this AP profile for_site: type: boolean description: Whether this AP profile is scoped directly to a site readOnly: true id: type: string description: Unique identifier of the AP device profile contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f iot_config: allOf: - $ref: '#/components/schemas/ap_iot2' - description: Digital and analog IoT pin defaults in this AP profile ip_config: allOf: - $ref: '#/components/schemas/ap_ip_config2' - description: Management IP addressing defaults in this AP profile lacp_config: allOf: - $ref: '#/components/schemas/device_ap_lacp_config2' - description: Link aggregation defaults for supported AP Ethernet uplinks led: allOf: - $ref: '#/components/schemas/ap_led2' - description: Indicator light behavior defaults in this AP profile mesh: allOf: - $ref: '#/components/schemas/ap_mesh2' - description: Wireless mesh role and band defaults in this AP profile modified_time: type: number description: Timestamp when the AP device profile was last modified readOnly: true mqtt_config: allOf: - $ref: '#/components/schemas/ap_mqtt2' - description: MQTT broker publishing settings for this AP profile name: type: - string - 'null' description: Display name of the AP device profile ntp_servers: uniqueItems: true type: array items: type: string description: NTP servers configured by this AP profile org_id: type: string description: Organization that owns this AP device profile contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 poe_passthrough: type: boolean description: Whether to enable power out through module port (for APH) or eth1 (for APL/BT11) default: false port_config: type: object additionalProperties: $ref: '#/components/schemas/ap_port_config' description: eth0 is not allowed here. Property key is the interface(s) name (e.g. `eth1` or `eth1,eth2`). If specified, this takes precedence over switch_config (deprecated) pwr_config: allOf: - $ref: '#/components/schemas/ap_pwr_config2' - description: Power negotiation and peripheral power defaults in this AP profile radio_config: allOf: - $ref: '#/components/schemas/ap_radio2' - description: Radio configuration defaults in this AP profile site_id: type: string description: Site where this AP device profile is defined, when scoped to a site contentEncoding: uuid readOnly: true examples: - 441a1214-6928-442a-8e92-e1d34b8ec6a6 switch_config: allOf: - $ref: '#/components/schemas/ap_switch1' - description: Deprecated AP switch configuration defaults in this profile deprecated: true type: const: ap type: string description: Device type discriminator for AP device profiles uplink_port_config: allOf: - $ref: '#/components/schemas/ap_uplink_port_config2' - description: Authentication and failover defaults for AP uplink ports usb_config: allOf: - $ref: '#/components/schemas/ap_usb2' - description: Legacy USB integration defaults in this AP profile uwb_config: allOf: - $ref: '#/components/schemas/ap_uwb_config2' - description: UWB RTLS / OMLOX asset-visibility settings; overrides the site-level `uwb_config` and is overridden by device-level `uwb_config` vars: type: object additionalProperties: type: string description: Variable values provided by this AP device profile examples: - RADIUS_IP1: 172.31.2.5 RADIUS_SECRET: 11s64632d zigbee_config: allOf: - $ref: '#/components/schemas/ap_zigbee2' - description: Zigbee radio and network defaults in this AP profile description: AP device profile configuration applied to APs at a site or organization switch_stp_config1: title: switch_stp_config1 type: object properties: bridge_priority: type: string description: Switch STP priority. Range [0, 4k, 8k.. 60k] in steps of 4k. Bridge priority applies to both VSTP and RSTP. default: 32k examples: - 40k description: Spanning Tree Protocol defaults provided by this switch profile snmpv3_config_notify_filter_item: title: snmpv3_config_notify_filter_item type: object properties: categories: type: array items: type: string description: CX only. List of SNMP trap group categories included in this filter profile. See https://www.juniper.net/documentation/software/topics/task/configuration/snmp-trap-groups-configuring-junos-nm.html for valid category names. examples: - - link - authentication contents: type: array items: $ref: '#/components/schemas/snmpv3_config_notify_filter_item_content' description: OID filter rules in this notification filter profile profile_name: type: string description: Notification filter profile name description: SNMPv3 notification filter profile protect_re_custom_protocol2: title: protect_re_custom_protocol2 enum: - any - icmp - tcp - udp type: string description: 'Transport protocol matched by this custom Protect RE ACL. enum: `any`, `icmp`, `tcp`, `udp`.' ap_port_config_dynamic_vlan_type2: title: ap_port_config_dynamic_vlan_type2 enum: - airespace-interface-name - standard type: string description: 'Mapping mode for interpreting dynamic VLAN attributes returned by RADIUS. enum: `airespace-interface-name`, `standard`.' snmp_vacm_access_item_type2: title: snmp_vacm_access_item_type2 enum: - context_prefix - default_context_prefix type: string description: 'VACM context matching type for this access rule. enum: `context_prefix`, `default_context_prefix`.' sw_routing_policy_term_matching2: title: sw_routing_policy_term_matching2 type: object properties: as_path: type: array items: $ref: '#/components/schemas/bgp_as' description: AS path values that routes must match community: type: array items: type: string description: BGP communities that routes must match prefix: type: array items: type: string description: Route prefixes that routes must match protocol: type: array items: $ref: '#/components/schemas/sw_routing_policy_term_matching_protocol_enum' description: Routing protocols that routes must match description: Route match criteria that must be satisfied before actions are applied remote_syslog_facility3: title: remote_syslog_facility3 enum: - any - authorization - change-log - config - conflict-log - daemon - dfc - external - firewall - ftp - interactive-commands - kernel - ntp - pfe - security - user type: string description: 'Syslog facility to match for this selector. enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`.' examples: - config snmp_vacm_access_item_prefix_list_item: title: snmp_vacm_access_item_prefix_list_item type: object properties: context_prefix: type: string description: Context prefix for this VACM access rule. Required only if `type`==`context_prefix` examples: - iil notify_view: type: string description: Notify view name referenced by this VACM access rule examples: - all read_view: type: string description: Read view name referenced by this VACM access rule examples: - all security_level: allOf: - $ref: '#/components/schemas/snmp_vacm_access_item_prefix_list_item_level2' - description: 'Required security level for this VACM access rule. enum: `authentication`, `none`, `privacy`.' security_model: allOf: - $ref: '#/components/schemas/snmp_vacm_access_item_prefix_list_item_model2' - description: 'Required security model for this VACM access rule. enum: `any`, `usm`, `v1`, `v2c`.' type: allOf: - $ref: '#/components/schemas/snmp_vacm_access_item_type2' - description: 'VACM context matching type for this access rule. enum: `context_prefix`, `default_context_prefix`.' write_view: type: string description: Write view name referenced by this VACM access rule examples: - all description: Context prefix rule for a VACM access entry radio_band_antenna_mode2: title: radio_band_antenna_mode2 enum: - 1x1 - 2x2 - 3x3 - 4x4 - default type: string description: 'Radio chain mode for the 6 GHz radio. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' examples: - default gateway_port_config_wan_speedtest_mode2: title: gateway_port_config_wan_speedtest_mode2 enum: - auto - enabled - disabled type: string description: 'Controls whether Marvis or the scheduler can run speed tests on this WAN port. enum: `auto`, `enabled`, `disabled`.' examples: - auto ip_type13: title: ip_type13 enum: - dhcp - static type: string description: 'IPv4 address assignment mode for AP management traffic. enum: `dhcp`, `static`.' examples: - static bgp_as: anyOf: - type: string - maximum: 4294967294 minimum: 1 type: integer contentEncoding: int32 description: BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}` ) examples: - '65000' radio_band_antenna_mode4: title: radio_band_antenna_mode4 enum: - 1x1 - 2x2 - 3x3 - 4x4 - default type: string description: 'Radio chain mode for the 2.4 GHz radio. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' examples: - default dot11_bandwidth62: title: dot11_bandwidth62 enum: - 0 - 20 - 40 - 80 - 160 type: integer description: 'Channel width configured for the 6 GHz radio. enum: `0`, `20`, `40`, `80`, `160`.' examples: - 80 junos_port_config_speed1: title: junos_port_config_speed1 enum: - 10m - 100m - 1g - 2.5g - 5g - 10g - 25g - 40g - 100g - auto type: string description: 'Link speed for this Junos port. enum: `10m`, `100m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`, `auto`.' switch_multicast_config3: title: switch_multicast_config3 type: object properties: anycast_rp: type: boolean description: When `true`, auto-generates a shared RP on `is_l3_border` devices (ERB/IPClos topologies only) default: false rp_ip: type: string description: RP address used when `anycast_rp`==`false`. If the address matches a device SVI, it is configured as a local RP; otherwise a static RP is configured examples: - 10.2.1.10 sbd_subnet: type: string description: SBD IRB subnet; Mist auto-assigns per-device IPs from this range (EVPN eOISM only) examples: - 10.99.0.0/24 sbd_vlan_id: type: integer description: Supplemental Bridge Domain VLAN ID (EVPN topology / eOISM only) contentEncoding: int32 examples: - 3900 description: Multicast configuration for this VRF instance. PIM is automatically enabled when any network in this VRF has `multicast.enabled`==`true` gateway_wan_type2: title: gateway_wan_type2 enum: - dhcp - pppoe - static type: string description: 'IPv4 assignment mode for this gateway port interface. enum: `dhcp`, `pppoe`, `static`.' ap_zigbee2: title: ap_zigbee2 type: object properties: allow_join: allOf: - $ref: '#/components/schemas/ap_zigbee_allow_join2' - description: 'Join policy for new Zigbee devices on this AP. enum: `always`, `manual`.' examples: - manual channel: maximum: 26 minimum: 0 type: integer description: Zigbee channel (2.4 GHz). `0` means auto; valid fixed values are 11–26 contentEncoding: int32 default: 0 examples: - 0 enabled: type: boolean description: Whether to enable Zigbee on this AP default: false extended_pan_id: type: - string - 'null' description: Extended PAN ID in hex string format; only applicable when `pan_id` is also specified examples: - '1311768467294899695' pan_id: type: - string - 'null' description: PAN ID in hex string format; if not specified, assigned automatically examples: - 4660 description: Zigbee radio and network defaults in this AP profile service_policy_secintel3: title: service_policy_secintel3 type: object properties: enabled: type: boolean description: Whether SecIntel inspection is enabled for the service policy default: false profile: allOf: - $ref: '#/components/schemas/service_policy_secintel_profile2' - description: 'Protection level applied by SecIntel inspection. enum: `default`, `standard`, `strict`.' secintelprofile_id: type: string description: Organization-level SecIntel profile ID; takes precedence over inline `profile` settings description: Threat intelligence settings applied by this service policy snmp_vacm_access_item_prefix_list_item_level2: title: snmp_vacm_access_item_prefix_list_item_level2 enum: - authentication - none - privacy type: string description: 'Required security level for this VACM access rule. enum: `authentication`, `none`, `privacy`.' idp_profile_matching_severity_value: title: idp_profile_matching_severity_value enum: - critical - info - major - minor type: string description: 'enum: `critical`, `info`, `major`, `minor`' examples: - major network_tenant: title: network_tenant type: object properties: addresses: type: array items: type: string description: IP addresses or subnets assigned to this tenant in the network description: Tenant address entry for a network tacacs_auth_server: title: tacacs_auth_server type: object properties: host: type: string description: Address or hostname of the TACACS+ authentication server port: type: string description: TCP port used by the TACACS+ authentication server secret: type: string description: Shared secret used with this TACACS+ authentication server contentEncoding: password timeout: type: integer description: TACACS+ authentication server timeout, in seconds contentEncoding: int32 default: 10 description: TACACS+ authentication server settings ap_mesh_role2: title: ap_mesh_role2 enum: - base - remote type: string description: Mesh role for this AP, either base or remote examples: - base protect_re_custom: title: protect_re_custom type: object properties: port_range: type: string description: Matched dst port, "0" means any default: '0' examples: - 80,1035-1040 protocol: allOf: - $ref: '#/components/schemas/protect_re_custom_protocol2' - description: 'Transport protocol matched by this custom Protect RE ACL. enum: `any`, `icmp`, `tcp`, `udp`.' subnets: type: array items: type: string description: Source subnets matched by this custom Protect RE ACL description: Custom Protect RE ACL entry switch_network: title: switch_network required: - vlan_id type: object properties: gateway: type: string description: Only required for EVPN-VXLAN networks, IPv4 Virtual Gateway gateway6: type: string description: Only required for EVPN-VXLAN networks, IPv6 Virtual Gateway isolation: type: boolean description: 'whether to stop clients to talk to each other, default is false (when enabled, a unique isolation_vlan_id is required). NOTE: this features requires uplink device to also a be Juniper device and `inter_switch_link` to be set. See also `inter_isolation_network_link` and `community_vlan_id` in port_usage' default: false isolation_vlan_id: type: string description: Required when `isolation`==`true`. Unique VLAN ID used for client isolation examples: - '3070' multicast: allOf: - $ref: '#/components/schemas/switch_network_multicast2' - description: Multicast (IGMP snooping) settings for this VLAN subnet: type: string description: Optional for pure switching, required when L3 / routing features are used subnet6: type: string description: Optional for pure switching, required when L3 / routing features are used vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: VLAN identifier for this switch network description: A network represents a network segment. It can either represent a VLAN (then usually ties to a L3 subnet), optionally associate it with a subnet which can later be used to create addition routes. Used for ports doing `family ethernet-switching`. It can also be a pure L3-subnet that can then be used against a port that with `family inet`. tunnel_config: title: tunnel_config type: object properties: auto_provision: allOf: - $ref: '#/components/schemas/tunnel_config_auto_provision2' - description: Provider auto-provisioning settings for tunnel endpoints ike_lifetime: type: integer description: Only if `provider`==`custom-ipsec`. IKE lifetime configured for the custom IPsec tunnel contentEncoding: int32 ike_mode: allOf: - $ref: '#/components/schemas/tunnel_config_ike_mode2' - description: 'Only if `provider`==`custom-ipsec`. IKE negotiation mode for the tunnel. enum: `aggressive`, `main`.' ike_proposals: type: array items: $ref: '#/components/schemas/tunnel_config_ike_proposal' description: If `provider`==`custom-ipsec`, IKE proposals used for custom IPsec negotiation ipsec_lifetime: type: integer description: If `provider`==`custom-ipsec`, IPsec lifetime configured for the custom tunnel contentEncoding: int32 ipsec_proposals: type: array items: $ref: '#/components/schemas/tunnel_config_ipsec_proposal' description: Only if `provider`==`custom-ipsec`. IPsec proposals used for custom IPsec negotiation local_id: type: string description: Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec` local_subnets: type: array items: type: string description: Local protected subnets advertised by this tunnel mode: allOf: - $ref: '#/components/schemas/tunnel_config_tunnel_mode2' - description: 'Tunnel failover mode used for primary and secondary endpoints. enum: `active-active`, `active-standby`.' networks: type: array items: type: string description: Destination networks reachable through this tunnel primary: allOf: - $ref: '#/components/schemas/tunnel_config_node3' - description: Main remote tunnel endpoint settings probe: allOf: - $ref: '#/components/schemas/tunnel_config_probe' - description: Tunnel health probe settings protocol: allOf: - $ref: '#/components/schemas/tunnel_config_protocol2' - description: 'Only if `provider`==`custom-ipsec`. Tunnel protocol for custom tunnel negotiation. enum: `gre`, `ipsec`.' provider: allOf: - $ref: '#/components/schemas/tunnel_config_provider2' - description: 'Tunnel provider used when auto provisioning is disabled. enum: `custom-ipsec`, `custom-gre`, `jse-ipsec`, `prisma-ipsec`, `zscaler-gre`, `zscaler-ipsec`.' psk: type: string description: Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec` remote_subnets: type: array items: type: string description: Remote protected subnets reached through policy-based IPsec secondary: allOf: - $ref: '#/components/schemas/tunnel_config_node1' - description: Backup remote tunnel endpoint settings version: allOf: - $ref: '#/components/schemas/tunnel_config_version2' - description: 'Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. Tunnel version value for custom tunnel configuration. enum: `1`, `2`.' description: Gateway tunnel configuration for provider-managed or custom tunnels snmpv3_config2: title: snmpv3_config2 type: object properties: notify: type: array items: $ref: '#/components/schemas/snmpv3_config_notify_items' description: SNMPv3 notification definitions used for traps and informs notify_filter: type: array items: $ref: '#/components/schemas/snmpv3_config_notify_filter_item' description: SNMPv3 notification filter profiles target_address: type: array items: $ref: '#/components/schemas/snmpv3_config_target_address_item' description: SNMPv3 notification target addresses target_parameters: type: array items: $ref: '#/components/schemas/snmpv3_config_target_param' description: SNMPv3 target parameter profiles usm: type: array items: $ref: '#/components/schemas/snmp_usm' description: SNMPv3 USM engine configurations vacm: allOf: - $ref: '#/components/schemas/snmp_vacm2' - description: SNMPv3 VACM access control configuration description: SNMPv3 user, VACM, notify, and target configuration ble_config2: title: ble_config2 type: object properties: beacon_enabled: type: boolean description: Whether Mist beacons is enabled default: true beacon_rate: type: integer description: Required if `beacon_rate_mode`==`custom`, 1-10, in number-beacons-per-second contentEncoding: int32 examples: - 3 beacon_rate_mode: allOf: - $ref: '#/components/schemas/ble_config_beacon_rate_mode2' - description: 'Beacon rate mode for Mist BLE beacons; use custom to set beacon_rate. enum: `custom`, `default`.' examples: - custom beam_disabled: type: array items: type: integer contentEncoding: int32 description: AP BLE beam numbers disabled for location advertisements examples: - - 1 - 3 - 6 custom_ble_packet_enabled: type: boolean description: Can be enabled if `beacon_enabled`==`true`, whether to send custom packet default: false custom_ble_packet_frame: type: string description: The custom frame to be sent out in this beacon. The frame must be a hexstring examples: - 0x........ custom_ble_packet_freq_msec: minimum: 0 type: integer description: Frequency (msec) of data emitted by custom ble beacon contentEncoding: int32 default: 0 examples: - 300 eddystone_uid_adv_power: maximum: 20 minimum: -100 type: integer description: Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default contentEncoding: int32 default: 0 examples: - -65 eddystone_uid_beams: type: string description: BLE beams used to transmit Eddystone-UID advertisements, expressed as ranges such as `2-4,7` examples: - 2-4,7 eddystone_uid_enabled: type: boolean description: Only if `beacon_enabled`==`false`, Whether Eddystone-UID beacon is enabled default: false eddystone_uid_freq_msec: type: integer description: Frequency (msec) of data emit by Eddystone-UID beacon contentEncoding: int32 default: 0 examples: - 200 eddystone_uid_instance: type: string description: Eddystone-UID instance for the device examples: - 5c5b35000001 eddystone_uid_namespace: type: string description: Eddystone-UID namespace broadcast by the AP, as a 10-byte hex string examples: - 2818e3868dec25629ede eddystone_url_adv_power: maximum: 20 minimum: -100 type: integer description: Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default contentEncoding: int32 default: 0 examples: - -65 eddystone_url_beams: type: string description: BLE beams used to transmit Eddystone-URL advertisements, expressed as ranges such as `2-4,7` examples: - 2-4,7 eddystone_url_enabled: type: boolean description: Only if `beacon_enabled`==`false`, Whether Eddystone-URL beacon is enabled default: false eddystone_url_freq_msec: type: integer description: Frequency (msec) of data emitted by Eddystone-URL beacon contentEncoding: int32 default: 0 examples: - 1000 eddystone_url_url: type: string description: URL pointed by Eddystone-URL beacon examples: - https://www.abc.com ibeacon_adv_power: maximum: 20 minimum: -100 type: integer description: Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default contentEncoding: int32 default: 0 examples: - -65 ibeacon_beams: type: string description: BLE beams used to transmit iBeacon advertisements, expressed as ranges such as `2-4,7` examples: - 2-4,7 ibeacon_enabled: type: boolean description: Can be enabled if `beacon_enabled`==`true`, whether to send iBeacon default: false ibeacon_freq_msec: type: integer description: Frequency (msec) of data emit for iBeacon contentEncoding: int32 default: 0 ibeacon_major: maximum: 65535 minimum: 1 type: - integer - 'null' description: iBeacon major value broadcast by the AP contentEncoding: int32 examples: - 1234 ibeacon_minor: maximum: 65535 minimum: 1 type: - integer - 'null' description: iBeacon minor value broadcast by the AP contentEncoding: int32 examples: - 1234 ibeacon_uuid: type: string description: Optional, if not specified, the same UUID as the beacon will be used contentEncoding: uuid examples: - f3f17139-704a-f03a-2786-0400279e37c3 power: maximum: 10 minimum: 1 type: integer description: Required if `power_mode`==`custom`; else use `power_mode` as default contentEncoding: int32 default: 9 examples: - 6 power_mode: allOf: - $ref: '#/components/schemas/ble_config_power_mode3' - description: 'Transmit power mode for BLE beacons; use custom to set `power`. enum: `custom`, `default`.' examples: - custom description: Bluetooth Low Energy beacon and asset defaults in this AP profile tunnel_config_dh_group2: title: tunnel_config_dh_group2 enum: - '1' - '14' - '15' - '16' - '19' - '2' - '20' - '21' - '24' - '5' type: string description: 'Diffie-Hellman group used by this IPsec proposal. enum: `1`, `14`, `15`, `16`, `19`, `2`, `20`, `21`, `24`, `5`.' dhcpd_config_type62: title: dhcpd_config_type62 enum: - local - none - relay type: string description: 'IPv6 DHCP mode for this network. enum: `local`, `none`, `relay`.' snmpv3_config_target_param_mess_process_model2: title: snmpv3_config_target_param_mess_process_model2 enum: - v1 - v2c - v3 type: string description: 'SNMP message processing model used by this target parameter profile. enum: `v1`, `v2c`, `v3`.' radius_keywrap_format1: title: radius_keywrap_format1 enum: - ascii - hex type: string description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' ble_config_power_mode3: title: ble_config_power_mode3 enum: - custom - default type: string description: 'Transmit power mode for BLE beacons; use custom to set `power`. enum: `custom`, `default`.' examples: - custom snmp_config_v2c_config: title: snmp_config_v2c_config type: object properties: authorization: type: string description: Access level for the SNMPv2c community examples: - read-only client_list_name: type: string description: SNMP client list name referenced by this community examples: - clist-1 community_name: type: string description: SNMPv2c community string name examples: - abc123 view: type: string description: SNMP view name that must be defined in the views list examples: - all description: SNMPv2c community configuration entry snmp_usm_user_encryption_type2: title: snmp_usm_user_encryption_type2 enum: - privacy-3des - privacy-aes128 - privacy-des - privacy-none type: string description: 'Privacy protocol used by this SNMPv3 USM user. enum: `privacy-3des`, `privacy-aes128`, `privacy-des`, `privacy-none`.' bgp_config_type2: title: bgp_config_type2 enum: - external - internal type: string description: Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; BGP session type, internal or external snmpv3_config_target_param_security_level2: title: snmpv3_config_target_param_security_level2 enum: - authentication - none - privacy type: string description: 'Required security level for this target parameter profile. enum: `authentication`, `none`, `privacy`.' remote_syslog_content: title: remote_syslog_content type: object properties: facility: allOf: - $ref: '#/components/schemas/remote_syslog_facility3' - description: 'Syslog facility to match for this selector. enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`.' examples: - config severity: allOf: - $ref: '#/components/schemas/remote_syslog_severity3' - description: 'Syslog severity to match for this selector. enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`.' description: Syslog message content selector for remote logging deviceprofile_gateway: title: deviceprofile_gateway required: - name - type type: object properties: additional_config_cmds: type: array items: type: string description: Additional CLI configuration commands provided by this gateway profile bgp_config: type: object additionalProperties: $ref: '#/components/schemas/bgp_config' description: BGP routing defaults for this gateway profile. Property key is the BGP session name created_time: type: number description: Timestamp when the gateway profile was created readOnly: true dhcpd_config: allOf: - $ref: '#/components/schemas/dhcpd_config1' - description: DHCP server defaults provided by this gateway profile dnsOverride: type: boolean description: Whether DNS server and suffix settings in this profile override inherited values default: false dns_servers: type: array items: type: string description: DNS servers provided by this gateway profile dns_suffix: type: array items: type: string description: DNS search suffixes provided by this gateway profile extra_routes: type: object additionalProperties: $ref: '#/components/schemas/gateway_extra_route' description: Additional IPv4 route defaults in this gateway profile extra_routes6: type: object additionalProperties: $ref: '#/components/schemas/gateway_extra_route6' description: Additional IPv6 route defaults in this gateway profile examples: - 2a02:1234:420a:10c9::/64: via: 2a02:1234:200a::100 gateway_matching: allOf: - $ref: '#/components/schemas/gateway_matching3' - description: Matching rules that select gateways for this profile id: type: string description: Unique identifier of the gateway profile contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f idp_profiles: type: object additionalProperties: $ref: '#/components/schemas/idp_profile' description: Intrusion detection and prevention profile defaults in this gateway profile ip_configs: type: object additionalProperties: $ref: '#/components/schemas/gateway_ip_config_property' description: Gateway interface IP configuration defaults by network name modified_time: type: number description: Timestamp when the gateway profile was last modified readOnly: true name: type: string description: Display name of the gateway profile examples: - gw_template networks: type: array items: $ref: '#/components/schemas/network' description: Layer 3 networks configured by this gateway profile ntpOverride: type: boolean description: Whether NTP servers in this profile override inherited values default: false ntp_servers: type: array items: type: string description: NTP servers provided by this gateway profile oob_ip_config: allOf: - $ref: '#/components/schemas/gateway_oob_ip_config1' - description: Out-of-band management IP defaults in this gateway profile org_id: type: string description: Organization that owns this gateway profile contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 path_preferences: type: object additionalProperties: $ref: '#/components/schemas/gateway_path_preferences' description: Property key is the path name port_config: type: object additionalProperties: $ref: '#/components/schemas/gateway_port_config' description: Property key is the port(s) name or range (e.g. "ge-0/0/0-10") router_id: type: string description: Auto assigned if not set examples: - 10.2.1.10 routing_policies: type: object additionalProperties: $ref: '#/components/schemas/gw_routing_policy' description: Routing policy defaults applied by this gateway profile service_policies: type: array items: $ref: '#/components/schemas/service_policy' description: Traffic service policy defaults enforced by this gateway profile tunnel_configs: type: object additionalProperties: $ref: '#/components/schemas/tunnel_config' description: Property key is the tunnel name tunnel_provider_options: allOf: - $ref: '#/components/schemas/tunnel_provider_options1' - description: Provider-specific tunnel options defined by this gateway profile type: const: gateway type: string description: Device type discriminator for gateway profiles url_filtering_deny_msg: type: string description: When a service policy denies a app_category, what message to show in user's browser default: Access to this URL Category has been blocked examples: - Access to this URL Category has been blocked vrf_config: allOf: - $ref: '#/components/schemas/vrf_config2' - description: VRF defaults applied by this gateway profile vrf_instances: type: object additionalProperties: $ref: '#/components/schemas/gateway_vrf_instance' description: VRF instances configured by this gateway profile examples: - CORP_VRF: networks: - CORP_NET - MGMT_NET description: Gateway Template is applied to a site for gateway(s) in a site. switch_dhcpd_config_property: title: switch_dhcpd_config_property type: object properties: dns_servers: type: array items: type: string description: If `type`==`server` or `type6`==`server`, DNS servers advertised to DHCP clients examples: - - 8.8.8.8 - 4.4.4.4 - 2001:4860:4860::8888 dns_suffix: type: array items: type: string description: If `type`==`server` or `type6`==`server`, DNS search suffixes advertised to DHCP clients examples: - - .mist.local - .mist.com fixed_bindings: type: object additionalProperties: $ref: '#/components/schemas/dhcpd_config_fixed_binding' description: If `type`==`server` or `type6`==`server`, fixed client bindings for DHCP service examples: - 5684dae9ac8b: ip: 192.168.70.35 name: John gateway: type: string description: If `type`==`server` - optional, `ip` will be used if not provided examples: - 192.168.70.1 ip_end: type: string description: If `type`==`server`, ending IPv4 address for the DHCP lease pool examples: - 192.168.70.200 ip_end6: type: string description: If `type6`==`server`, ending IPv6 address for the DHCP lease pool examples: - 2607:f8b0:4005:808::ff ip_start: type: string description: If `type`==`server`, starting IPv4 address for the DHCP lease pool examples: - 192.168.70.100 ip_start6: type: string description: If `type6`==`server`, starting IPv6 address for the DHCP lease pool examples: - 2607:f8b0:4005:808::2 lease_time: maximum: 604800 minimum: 3600 type: integer description: In seconds, lease time has to be between 3600 [1hr] - 604800 [1 week], default is 86400 [1 day] contentEncoding: int32 default: 86400 options: type: object additionalProperties: $ref: '#/components/schemas/dhcpd_config_option' description: If `type`==`server` or `type6`==`server`, custom DHCP options advertised to clients server_id_override: type: boolean description: "`server_id_override`==`true` means the device, when acts as DHCP relay and forwards DHCP responses from DHCP server to clients, \nshould overwrite the Sever Identifier option (i.e. DHCP option 54) in DHCP responses with its own IP address." default: false servers: type: array items: type: string description: If `type`==`relay`, upstream IPv4 DHCP servers examples: - - 11.2.3.4 servers6: type: array items: type: string description: If `type6`==`relay`, upstream IPv6 DHCP servers examples: - - 2607:f8b0:4005:808::64 type: allOf: - $ref: '#/components/schemas/switch_dhcpd_config_type2' - description: 'IPv4 DHCP mode for this switch network. enum: `none`, `relay`, `server`.' type6: allOf: - $ref: '#/components/schemas/switch_dhcpd_config_type62' - description: 'IPv6 DHCP mode for this switch network. enum: `none`, `relay`, `server`.' vendor_encapsulated: type: object additionalProperties: $ref: '#/components/schemas/dhcpd_config_vendor_option' description: If `type`==`server` or `type6`==`server`, vendor-encapsulated DHCP options advertised to clients description: DHCP server or relay configuration for one switch network. The property key is the network name. In case of DHCP relay, it's common for many networks to use the same dhcp relay, comma-separated network names can be used here (e.g. "net1,net2") gw_routing_policy_term_matching_protocol_enum: title: gw_routing_policy_term_matching_protocol_enum enum: - aggregate - bgp - direct - ospf - static type: string description: 'enum: `aggregate`, `bgp`, `direct`, `ospf`, `static` (SRX Only)' network_internal_access2: title: network_internal_access2 type: object properties: enabled: type: boolean description: Whether internal access is enabled for this network description: Internal access settings for this network bgp_config: title: bgp_config required: - via type: object properties: auth_key: type: string description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan` bfd_minimum_interval: maximum: 255000 minimum: 1 type: - integer - 'null' description: "Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`, when bfd_multiplier is configured alone. Default:\n * 1000 if `type`==`external`\n * 350 `type`==`internal`" contentEncoding: int32 default: 350 bfd_multiplier: maximum: 255 minimum: 1 type: - integer - 'null' description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`, when bfd_minimum_interval_is_configured alone contentEncoding: int32 default: 3 disable_bfd: type: boolean description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. BFD provides faster path failure detection and is enabled by default default: false export: type: string description: Routing policy applied to routes exported by this BGP session export_policy: type: string description: Default export policies if no per-neighbor policies defined extended_v4_nexthop: type: boolean description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. By default, either inet/net6 unicast depending on neighbor IP family (v4 or v6). For v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this graceful_restart_time: maximum: 4095 minimum: 0 type: integer description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. `0` means disable contentEncoding: int32 default: 0 hold_time: maximum: 65535 minimum: 0 type: integer description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. Default is 90. contentEncoding: int32 default: 90 import: type: string description: Routing policy applied to routes imported by this BGP session import_policy: type: string description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. Default import policies if no per-neighbor policies defined local_as: anyOf: - type: string - maximum: 4294967295 minimum: 1 type: integer contentEncoding: int32 description: Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; local BGP Autonomous System (AS) number examples: - '65000' neighbor_as: anyOf: - type: string - maximum: 4294967294 minimum: 1 type: integer contentEncoding: int32 description: Default BGP neighbor Autonomous System (AS) number for this session examples: - '65000' neighbors: type: object additionalProperties: $ref: '#/components/schemas/bgp_config_neighbors' description: Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. If per-neighbor as is desired. Property key is the neighbor address networks: type: array items: type: string description: Optional if `via`==`lan`; networks where BGP neighbors can connect to or from no_private_as: type: boolean description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. If true, we will not advertise private ASNs (AS 64512-65534) to this neighbor default: false no_readvertise_to_overlay: type: boolean description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. By default, we'll re-advertise all learned BGP routers toward overlay default: false tunnel_name: type: string description: Optional if `via`==`tunnel`; tunnel name used for this BGP session type: allOf: - $ref: '#/components/schemas/bgp_config_type2' - minLength: 1 description: Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; BGP session type, internal or external via: allOf: - $ref: '#/components/schemas/bgp_config_via2' - description: Transport used for this BGP session, such as LAN, tunnel, VPN, or WAN vpn_name: type: string description: Optional if `via`==`vpn`; VPN name used for this BGP session wan_name: type: string description: Optional if `via`==`wan`; WAN interface name used for this BGP session description: BGP session configuration. BFD is enabled when either bfd_minimum_interval or bfd_multiplier is configured service_policy_antivirus1: title: service_policy_antivirus1 type: object properties: avprofile_id: type: string description: Organization-level antivirus profile ID; takes precedence over inline `profile` settings contentEncoding: uuid enabled: type: boolean description: Whether antivirus inspection is enabled for the service policy default: false profile: type: string description: Antivirus profile name to apply, such as `default`, `noftp`, `httponly`, or an AV profile key description: Malware and virus inspection settings applied by this service policy gateway_port_wan_arp_policer2: title: gateway_port_wan_arp_policer2 enum: - default - max - recommended type: string description: 'Only when `wan_type`==`broadband`. ARP policer profile applied to the WAN port. enum: `default`, `max`, `recommended`.' gw_routing_policy_term_matching_route_exists2: title: gw_routing_policy_term_matching_route_exists2 type: object properties: route: type: string description: Prefix that must exist for this condition to match examples: - 192.168.0.0/24 vrf_name: type: string description: Name of the VRF instance where the route is checked; can also be a VPN or WAN name when applicable default: default description: Existing route condition that must be satisfied before this term matches ble_config_beacon_rate_mode2: title: ble_config_beacon_rate_mode2 enum: - custom - default type: string description: 'Beacon rate mode for Mist BLE beacons; use custom to set beacon_rate. enum: `custom`, `default`.' examples: - custom gateway_port_vpn_path: title: gateway_port_vpn_path type: object properties: bfd_profile: allOf: - $ref: '#/components/schemas/gateway_port_vpn_path_bfd_profile2' - description: 'BFD profile used for this VPN path when the VPN `type`==`hub_spoke`. enum: `broadband`, `lte`.' bfd_use_tunnel_mode: type: boolean description: Only if the VPN `type`==`hub_spoke`. Whether to use tunnel mode. SSR only default: false preference: type: integer description: Only if the VPN `type`==`hub_spoke`. For a given VPN, when `path_selection.strategy`==`simple`, the preference for a path (lower is preferred) contentEncoding: int32 role: allOf: - $ref: '#/components/schemas/gateway_port_vpn_path_role2' - description: 'Gateway role for this VPN path; valid values depend on the VPN `type`. enum: `hub`, `mesh`, `spoke`.' traffic_shaping: allOf: - $ref: '#/components/schemas/gateway_traffic_shaping1' - description: Traffic shaping settings applied to this VPN path description: VPN path settings for traffic that uses a gateway port remote_syslog_facility1: title: remote_syslog_facility1 enum: - any - authorization - change-log - config - conflict-log - daemon - dfc - external - firewall - ftp - interactive-commands - kernel - ntp - pfe - security - user type: string description: 'Default syslog facility for messages sent to this server. enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`.' examples: - config snmp_vacm_access_item: title: snmp_vacm_access_item type: object properties: group_name: type: string description: SNMP VACM group name prefix_list: type: array items: $ref: '#/components/schemas/snmp_vacm_access_item_prefix_list_item' description: Context prefix rules for this VACM group description: VACM access rule for an SNMP group ap_switch1: title: ap_switch1 type: object properties: enabled: type: boolean description: Whether deprecated AP switch VLAN control is enabled default: false eth0: allOf: - $ref: '#/components/schemas/ap_switch_setting7' - description: VLAN settings for AP eth0 eth1: allOf: - $ref: '#/components/schemas/ap_switch_setting1' - description: VLAN settings for AP eth1 eth2: allOf: - $ref: '#/components/schemas/ap_switch_setting2' - description: VLAN settings for AP eth2 eth3: allOf: - $ref: '#/components/schemas/ap_switch_setting3' - description: VLAN settings for AP eth3 module: allOf: - $ref: '#/components/schemas/ap_switch_setting4' - description: VLAN settings for the AP module port wds: allOf: - $ref: '#/components/schemas/ap_switch_setting5' - description: VLAN settings for WDS traffic on the AP description: Deprecated AP switch configuration defaults in this profile deprecated: true allow_deny4: title: allow_deny4 enum: - allow - deny type: string description: Allow or deny decision applied to traffic matching the destination tag remote_syslog_file_config: title: remote_syslog_file_config type: object properties: archive: allOf: - $ref: '#/components/schemas/remote_syslog_archive1' - description: Retention settings for this generated syslog file contents: type: array items: $ref: '#/components/schemas/remote_syslog_content' description: Syslog facilities and severities written to this file enable_tls: type: boolean description: Only if `protocol`==`tcp`, enable TLS for this syslog file destination explicit_priority: type: boolean description: Whether to include explicit syslog priority values in file output file: type: string description: Generated syslog file name examples: - file-name match: type: string description: Expression used to filter log messages written to this file examples: - '!alarm|ntp|errors.crc_error[chan]' structured_data: type: boolean description: Whether to include structured syslog data in file output description: Generated syslog file output settings gateway_port_vpn_path_bfd_profile2: title: gateway_port_vpn_path_bfd_profile2 enum: - broadband - lte type: string description: 'BFD profile used for this VPN path when the VPN `type`==`hub_spoke`. enum: `broadband`, `lte`.' acl_policy: title: acl_policy type: object properties: actions: type: array items: $ref: '#/components/schemas/acl_policy_action' description: Destination tag actions evaluated for sources matching this ACL policy disabled: type: boolean description: Whether this ACL policy is disabled default: false name: type: string description: Display name of the ACL policy examples: - guest access src_tags: type: array items: type: string description: Source ACL tags that select traffic for this ACL policy description: "ACL Policy:\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to" remote_syslog_server: title: remote_syslog_server type: object properties: contents: type: array items: $ref: '#/components/schemas/remote_syslog_content' description: Syslog facilities and severities sent to this server explicit_priority: type: boolean description: Whether to include explicit syslog priority values in messages sent to this server facility: allOf: - $ref: '#/components/schemas/remote_syslog_facility1' - description: 'Default syslog facility for messages sent to this server. enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`.' examples: - config host: type: string description: Address or hostname of the remote syslog server examples: - syslogd.internal match: type: string description: Expression used to filter log messages sent to this server examples: - '!alarm|ntp|errors.crc_error[chan]' port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 default: 514 - type: string description: Network port used by the remote syslog server protocol: allOf: - $ref: '#/components/schemas/remote_syslog_server_protocol2' - description: 'Transport protocol used for this remote syslog server. enum: `tcp`, `udp`.' routing_instance: type: string description: Routing instance used to reach this remote syslog server examples: - routing-instance-name server_name: type: string description: TLS server name used when verifying the remote syslog server certificate examples: - syslogd.internal severity: allOf: - $ref: '#/components/schemas/remote_syslog_severity1' - description: 'Default syslog severity for messages sent to this server. enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`.' source_address: type: string description: Source address for syslog traffic. If configured, Mist uses the VLAN first; otherwise it uses `source_ip` structured_data: type: boolean description: Whether to include structured syslog data in messages sent to this server tag: type: string description: Syslog tag value added to messages sent to this server description: Remote syslog server destination settings ap_mqtt_format2: title: ap_mqtt_format2 enum: - json - raw type: string description: 'Payload format for published messages. enum: `json`, `raw`.' tunnel_config_auto_provision_lat_lng2: title: tunnel_config_auto_provision_lat_lng2 required: - lat - lng type: object properties: lat: type: number description: Geographic latitude used for POP selection override examples: - 37.295833 lng: type: number description: Geographic longitude used for POP selection override examples: - -122.032946 description: Geographic coordinate override used for tunnel POP selection remote_syslog_archive3: title: remote_syslog_archive3 type: object properties: files: anyOf: - type: string - type: integer contentEncoding: int32 description: Number of archived syslog files to retain examples: - '20' size: type: string description: Maximum size of each archived syslog file, such as 5m examples: - 5m description: Retention settings for generated syslog archive files network_source_nat2: title: network_source_nat2 type: object properties: external_ip: type: string description: External source NAT IP or subnet used when spoke hosts must be reachable from the hub examples: - 172.16.0.8/30 description: Source NAT settings used when non-routed spoke hosts must be reachable from the hub tacacs_acct_server: title: tacacs_acct_server type: object properties: host: type: string description: Address or hostname of the TACACS+ accounting server port: type: string description: TCP port used by the TACACS+ accounting server secret: type: string description: Shared secret used with this TACACS+ accounting server contentEncoding: password timeout: type: integer description: TACACS+ accounting server timeout, in seconds contentEncoding: int32 default: 10 description: TACACS+ accounting server settings ap_iot_output4: title: ap_iot_output4 type: object properties: enabled: type: boolean description: Whether to enable a pin default: false name: type: string description: Optional; descriptive pin name examples: - motion output: type: boolean description: Whether the pin is configured as an output. DO and A1-A4 can be repurposed by changing examples: - true pullup: allOf: - $ref: '#/components/schemas/ap_iot_pullup3' - description: 'Selects the pull-up resistor mode applied to the output pin. enum: `external`, `internal`, `none`.' value: type: integer description: Output pin signal level, default 0 contentEncoding: int32 examples: - 0 description: Digital output pin DO settings ospf_areas_network: title: ospf_areas_network type: object properties: auth_keys: type: object additionalProperties: type: string description: Required if `auth_type`==`md5`. Property key is the key number examples: - '1': auth-key-1 auth_password: type: string description: Required if `auth_type`==`password`, the password, max length is 8 examples: - simple auth_type: allOf: - $ref: '#/components/schemas/ospf_area_network_auth_type2' - description: 'Authentication method used by this OSPF network. enum: `md5`, `none`, `password`.' examples: - md5 bfd_minimum_interval: maximum: 255000 minimum: 1 type: integer description: Minimum BFD interval for this OSPF network, in milliseconds contentEncoding: int32 examples: - 500 dead_interval: maximum: 65535 minimum: 1 type: integer description: OSPF dead interval for this network, in seconds contentEncoding: int32 examples: - 40 export_policy: type: string description: Routing policy used to export routes from this OSPF network examples: - export_policy hello_interval: maximum: 255 minimum: 1 type: integer description: OSPF hello interval for this network, in seconds contentEncoding: int32 import_policy: type: string description: Routing policy used to import routes for this OSPF network examples: - import_policy interface_type: allOf: - $ref: '#/components/schemas/ospf_area_network_interface_type2' - description: 'OSPF interface type used for this network. enum: `broadcast`, `nbma`, `p2mp`, `p2p`.' metric: maximum: 65535 minimum: 1 type: - integer - 'null' description: OSPF metric assigned to this network contentEncoding: int32 examples: - 10000 no_readvertise_to_overlay: type: boolean description: By default, we'll re-advertise all learned OSPF routes toward overlay default: false passive: type: boolean description: Whether to send OSPF-Hello default: false description: Property key is the network name. Networks to participate in an OSPF area ap_port_config_mac_auth_protocol2: title: ap_port_config_mac_auth_protocol2 enum: - eap-md5 - eap-peap - pap type: string description: 'Protocol used for MAC authentication when `enable_mac_auth` is `true`. enum: `eap-md5`, `eap-peap`, `pap`.' snmp_vacm_security_to_group2: title: snmp_vacm_security_to_group2 type: object properties: content: type: array items: $ref: '#/components/schemas/snmp_vacm_security_to_group_content_item' description: VACM security-name to group mapping entries security_model: allOf: - $ref: '#/components/schemas/snmp_vacm_security_model2' - description: 'Required security model for these VACM group mappings. enum: `usm`, `v1`, `v2c`.' description: VACM security-name to group mappings ap_switch_setting5: title: ap_switch_setting5 type: object properties: enable_vlan: type: boolean description: Whether VLAN tagging is enabled for this AP switch-config port port_vlan_id: anyOf: - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 - type: string description: Native VLAN ID for this AP switch-config port vlan_ids: type: array items: maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: Allowed VLAN IDs for this AP switch-config port description: VLAN settings for WDS traffic on the AP ap_switch_setting4: title: ap_switch_setting4 type: object properties: enable_vlan: type: boolean description: Whether VLAN tagging is enabled for this AP switch-config port port_vlan_id: anyOf: - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 - type: string description: Native VLAN ID for this AP switch-config port vlan_ids: type: array items: maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: Allowed VLAN IDs for this AP switch-config port description: VLAN settings for the AP module port ap_radio2: title: ap_radio2 type: object properties: allow_rrm_disable: type: boolean description: Whether RRM can be disabled for individual radio-band settings default: false ant_gain_24: minimum: 0 type: integer description: Antenna gain for 2.4G - for models with external antenna only contentEncoding: int32 examples: - 4 ant_gain_5: minimum: 0 type: integer description: Antenna gain for 5G - for models with external antenna only contentEncoding: int32 examples: - 5 ant_gain_6: minimum: 0 type: integer description: Antenna gain for 6G - for models with external antenna only contentEncoding: int32 examples: - 5 antenna_mode: allOf: - $ref: '#/components/schemas/ap_radio_antenna_mode2' - description: 'Selected radio chain mode for AP models that support antenna mode control. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' antenna_select: allOf: - $ref: '#/components/schemas/antenna_select1' - description: 'Internal or external antenna selection for AP models with selectable antennas. enum: ``, `external`, `internal`.' examples: - external band_24: allOf: - $ref: '#/components/schemas/ap_radio_band242' - description: 2.4 GHz radio settings for this access point band_24_usage: allOf: - $ref: '#/components/schemas/radio_band_24_usage4' - description: 'Radio usage mode for the 2.4 GHz-capable radio. enum: `24`, `5`, `6`, `auto`.' band_5: allOf: - $ref: '#/components/schemas/ap_radio_band53' - description: 5 GHz radio settings for this access point band_5_on_24_radio: allOf: - $ref: '#/components/schemas/ap_radio_band51' - description: 5 GHz settings used when the 2.4 GHz radio operates in 5 GHz mode band_6: allOf: - $ref: '#/components/schemas/ap_radio_band62' - description: 6 GHz radio settings for this access point full_automatic_rrm: type: boolean description: Let RRM control everything, only the `channels` and `ant_gain` will be honored (i.e. disabled/bandwidth/power/band_24_usage are all controlled by RRM) default: false indoor_use: type: boolean description: To make an outdoor operate indoor. For an outdoor-ap, some channels are disallowed by default, this allows the user to use it as an indoor-ap default: false rrm_managed: type: boolean description: Enable RRM to manage all radio settings (ignores all band_xxx configs) scanning_enabled: type: boolean description: Whether scanning radio is enabled examples: - true description: Radio configuration defaults in this AP profile ap_mesh2: title: ap_mesh2 type: object properties: bands: type: array items: $ref: '#/components/schemas/dot11_band' description: Radio bands allowed for AP mesh links enabled: type: boolean description: Whether mesh is enabled on this AP default: false group: maximum: 9 minimum: 1 type: - integer - 'null' description: Mesh group, base AP(s) will only allow remote AP(s) in the same mesh group to join, 1-9, optional contentEncoding: int32 examples: - 1 role: allOf: - $ref: '#/components/schemas/ap_mesh_role2' - description: Mesh role for this AP, either base or remote examples: - base use_wpa3_on_5: type: boolean description: Whether to use WPA3 on the 5 GHz band for mesh links default: false description: Wireless mesh role and band defaults in this AP profile switch_port_usage_dynamic_rule_src2: title: switch_port_usage_dynamic_rule_src2 enum: - link_peermac - lldp_chassis_id - lldp_hardware_revision - lldp_manufacturer_name - lldp_oui - lldp_serial_number - lldp_system_description - lldp_system_name - radius_dynamicfilter - radius_usermac - radius_username type: string description: 'Source attribute evaluated by this dynamic rule. enum: `link_peermac`, `lldp_chassis_id`, `lldp_hardware_revision`, `lldp_manufacturer_name`, `lldp_oui`, `lldp_serial_number`, `lldp_system_description`, `lldp_system_name`, `radius_dynamicfilter`, `radius_usermac`, `radius_username`.' ap_switch_setting3: title: ap_switch_setting3 type: object properties: enable_vlan: type: boolean description: Whether VLAN tagging is enabled for this AP switch-config port port_vlan_id: anyOf: - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 - type: string description: Native VLAN ID for this AP switch-config port vlan_ids: type: array items: maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: Allowed VLAN IDs for this AP switch-config port description: VLAN settings for AP eth3 evpn_config_role2: title: evpn_config_role2 enum: - access - border - collapsed-core - core - distribution - esilag-access - none type: string description: 'EVPN topology role for the switch. enum: `access`, `border`, `collapsed-core`, `core`, `distribution`, `esilag-access`, `none`.' vrrp_config1: title: vrrp_config1 type: object properties: enabled: type: boolean description: Whether VRRP configuration is enabled groups: type: object additionalProperties: $ref: '#/components/schemas/vrrp_config_group' description: VRRP groups keyed by group name description: VRRP defaults applied by this switch profile gateway_port_wan_source_nat2: title: gateway_port_wan_source_nat2 type: object properties: disabled: type: boolean description: Or to disable the source-nat default: false nat6_pool: type: string description: If alternative nat_pool is desired examples: - 2601:1700:43c0:dc0:20c:29ff:fea7:93bc/126 nat_pool: type: string description: If alternative nat_pool is desired examples: - 64.2.4.0/30 description: Source NAT settings applied to traffic leaving this WAN port vrrp_config_group: title: vrrp_config_group type: object properties: preempt: type: boolean description: If `true`, allow preemption (a backup router can preempt a primary router) default: false priority: type: integer description: VRRP priority for this router in the group contentEncoding: int32 description: VRRP group behavior settings wlan_mist_nac3: title: wlan_mist_nac3 type: object properties: acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled. contentEncoding: int32 default: 0 examples: - 60 auth_servers_retries: maximum: 10 minimum: 1 type: integer description: RADIUS auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. "retries" are set to value of `auth_servers_timeout`. "max-requests" is also set when setting `auth_servers_retries` is set to default value to 3. contentEncoding: int32 default: 2 examples: - 3 auth_servers_timeout: maximum: 30 minimum: 1 type: integer description: RADIUS auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. "quite-period" and "transmit-period" are set to half the value of `auth_servers_timeout`. "supplicant-timeout" is also set when setting `auth_servers_timeout` is set to default value of 10. contentEncoding: int32 default: 5 examples: - 5 coa_enabled: type: boolean description: Allows a RADIUS server to dynamically modify the authorization status of a user session. default: false coa_port: maximum: 65535 minimum: 1 type: integer description: the communication port used for “Change of Authorization” (CoA) messages contentEncoding: int32 examples: - 3799 enabled: type: boolean description: "When enabled:\n * `auth_servers` is ignored\n * `acct_servers` is ignored\n * `auth_servers_*` are ignored\n * `coa_servers` is ignored\n * `radsec` is ignored\n * `coa_enabled` is assumed" default: false fast_dot1x_timers: type: boolean description: If set to true, sets default fast-timers with values calculated from `auth_servers_timeout` and `auth_server_retries`. default: false network: type: - string - 'null' description: Which network the mist nac server resides in examples: - default source_ip: type: - string - 'null' description: In case there is a static IP for this network, we can specify it using source ip examples: - 1.2.3.4 description: Juniper Mist NAC settings used by AP port authentication gw_routing_policy: title: gw_routing_policy type: object properties: terms: uniqueItems: true type: array items: $ref: '#/components/schemas/gw_routing_policy_term' description: Ordered terms evaluated by this gateway routing policy description: Gateway routing policy made of ordered match-action terms gateway_wan_probe_override_http2: title: gateway_wan_probe_override_http2 type: object properties: accepted_status_codes: type: array items: type: integer contentEncoding: int32 description: HTTP response status codes that indicate a successful probe. Defaults to 200 if not specified. examples: - - 204 urls: type: array items: type: string description: HTTP or HTTPS URLs to probe examples: - - http://www.google.com/generate_204 - https://www.google.com/generate_204 description: HTTP probe settings; success from any ICMP or HTTP probe indicates the WAN is up switch_dhcpd_config_type2: title: switch_dhcpd_config_type2 enum: - none - relay - server type: string description: 'IPv4 DHCP mode for this switch network. enum: `none`, `relay`, `server`.' switch_port_usage_dot1x2: title: switch_port_usage_dot1x2 const: dot1x type: string description: 'Only if `mode`!=`dynamic`. 802.1X authentication mode for this port usage. enum: `dot1x`.' radio_band_preamble1: title: radio_band_preamble1 enum: - auto - long - short type: string description: '802.11 preamble mode used by the 5 GHz radio. enum: `auto`, `long`, `short`.' gateway_port_wan_type2: title: gateway_port_wan_type2 enum: - broadband - dsl - lte type: string description: 'Only if `usage`==`wan`. WAN uplink type configured on the port. enum: `broadband`, `dsl`, `lte`.' remote_syslog1: title: remote_syslog1 type: object properties: archive: allOf: - $ref: '#/components/schemas/remote_syslog_archive3' - description: Retention settings for generated syslog archive files cacerts: type: array items: type: string description: CA certificates used to verify TLS syslog servers examples: - - '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----' - '-----BEGIN CERTIFICATE-----\nBhMCRVMxFDASBgNVBAoMC1N0YXJ0Q29tIENBMSwwKgYDVn-----END CERTIFICATE-----' console: allOf: - $ref: '#/components/schemas/remote_syslog_console2' - description: Log forwarding filters for console messages sent to remote syslog enabled: type: boolean description: Whether remote syslog forwarding is enabled default: false files: type: array items: $ref: '#/components/schemas/remote_syslog_file_config' description: Local syslog file definitions to generate and forward network: type: string description: Source network used for syslog traffic. If `source_address` is configured, Mist uses the VLAN first; otherwise it uses `source_ip` examples: - default send_to_all_servers: type: boolean description: Whether each log entry is sent to all configured remote syslog servers default: false servers: type: array items: $ref: '#/components/schemas/remote_syslog_server' description: Remote syslog server destinations examples: - - facility: config host: syslogd.internal port: 514 protocol: udp severity: info tag: '' time_format: allOf: - $ref: '#/components/schemas/remote_syslog_time_format2' - description: 'Timestamp format used in forwarded syslog messages. enum: `millisecond`, `year`, `year millisecond`.' examples: - millisecond users: type: array items: $ref: '#/components/schemas/remote_syslog_user' description: User-specific syslog logging rules description: Remote syslog defaults provided by this switch profile gateway_wan_probe_override2: title: gateway_wan_probe_override2 type: object properties: hostnames: uniqueItems: true type: array items: type: string description: List of hostnames used as probe destinations; applicable for both IPv4 and IPv6 http: allOf: - $ref: '#/components/schemas/gateway_wan_probe_override_http2' - description: HTTP probe settings; success from any ICMP or HTTP probe indicates the WAN is up ip6s: uniqueItems: true type: array items: type: string description: List of IPv6 probe host addresses used by this WAN override ips: uniqueItems: true type: array items: type: string description: List of IPv4 probe host addresses used by this WAN override probe_profile: allOf: - $ref: '#/components/schemas/gateway_wan_probe_override_probe_profile2' - description: 'WAN probe profile used for health checks on this port. enum: `broadband`, `lte`.' description: Optional WAN health probe override settings for this port switch_radius2: title: switch_radius2 type: object properties: enabled: type: boolean description: Whether RADIUS is enabled for switch management authentication radius_config: allOf: - $ref: '#/components/schemas/switch_radius_config1' - description: RADIUS configuration used when alternate RADIUS settings are required use_different_radius: type: string description: Selector for alternate RADIUS settings instead of the default switch `radius_config` description: Management authentication settings using RADIUS ap_port_config_port_auth2: title: ap_port_config_port_auth2 enum: - dot1x - none type: string description: 'Authentication mode for this AP Ethernet port. enum: `dot1x`, `none`.' examples: - none ap_radio_antenna_mode2: title: ap_radio_antenna_mode2 enum: - 1x1 - 2x2 - 3x3 - 4x4 - default type: string description: 'Selected radio chain mode for AP models that support antenna mode control. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' dhcpd_config_property: title: dhcpd_config_property type: object properties: dns_servers: type: array items: type: string description: If `type`==`local` or `type6`==`local`, DNS servers advertised to DHCP clients examples: - - 8.8.8.8 - 4.4.4.4 - 2001:4860:4860::8888 dns_suffix: type: array items: type: string description: If `type`==`local` or `type6`==`local`, DNS search suffixes advertised to DHCP clients examples: - - .mist.local - .mist.com fixed_bindings: type: object additionalProperties: $ref: '#/components/schemas/dhcpd_config_fixed_binding' description: If `type`==`local` or `type6`==`local`, fixed client bindings for local DHCP service examples: - 5684dae9ac8b: ip: 192.168.70.35 name: John gateway: type: string description: If `type`==`local` - optional, `ip` will be used if not provided examples: - 192.168.70.1 ip6_end: type: string description: If `type6`==`local`, ending IPv6 address for the DHCP lease pool examples: - 2607:f8b0:4005:808::ff ip6_start: type: string description: If `type6`==`local`, starting IPv6 address for the DHCP lease pool examples: - 2607:f8b0:4005:808::2 ip_end: type: string description: If `type`==`local`, ending IPv4 address for the DHCP lease pool examples: - 192.168.70.200 ip_start: type: string description: If `type`==`local`, starting IPv4 address for the DHCP lease pool examples: - 192.168.70.100 lease_time: maximum: 604800 minimum: 3600 type: integer description: In seconds, lease time has to be between 3600 [1hr] - 604800 [1 week], default is 86400 [1 day] contentEncoding: int32 default: 86400 options: type: object additionalProperties: $ref: '#/components/schemas/dhcpd_config_option' description: If `type`==`local` or `type6`==`local`, custom DHCP options advertised to clients server_id_override: type: boolean description: "`server_id_override`==`true` means the device, when acts as DHCP relay and forwards DHCP responses from DHCP server to clients, \nshould overwrite the Sever Identifier option (i.e. DHCP option 54) in DHCP responses with its own IP address." default: false servers: type: array items: type: string description: If `type`==`relay`, upstream IPv4 DHCP servers examples: - - 11.2.3.4 serversv6: type: array items: type: string description: If `type6`==`relay`, upstream IPv6 DHCP servers examples: - - 2607:f8b0:4005:808::64 type: allOf: - $ref: '#/components/schemas/dhcpd_config_type2' - description: 'IPv4 DHCP mode for this network. enum: `local`, `none`, `relay`.' type6: allOf: - $ref: '#/components/schemas/dhcpd_config_type62' - description: 'IPv6 DHCP mode for this network. enum: `local`, `none`, `relay`.' vendor_encapsulated: type: object additionalProperties: $ref: '#/components/schemas/dhcpd_config_vendor_option' description: If `type`==`local` or `type6`==`local`, vendor-encapsulated DHCP options advertised to clients description: DHCP server or relay configuration for one network snmp_vacm2: title: snmp_vacm2 type: object properties: access: type: array items: $ref: '#/components/schemas/snmp_vacm_access_item' description: VACM access rules for SNMPv3 security_to_group: allOf: - $ref: '#/components/schemas/snmp_vacm_security_to_group2' - description: VACM security-name to group mappings description: SNMPv3 VACM access control configuration snmpv3_config_notify_type2: title: snmpv3_config_notify_type2 enum: - inform - trap type: string description: Delivery mode for this SNMPv3 notification, such as trap or inform ip_type61: title: ip_type61 enum: - autoconf - dhcp - disabled - static type: string description: 'IPv6 assignment mode for the additional Junos L3 presence. enum: `autoconf`, `dhcp`, `disabled`, `static`.' examples: - static switch_port_mirroring_property: title: switch_port_mirroring_property type: object properties: input_networks_ingress: type: array items: type: string description: At least one mirror input source should be specified. Networks whose ingress traffic is mirrored input_port_ids_egress: type: array items: type: string description: At least one mirror input source should be specified. Switch ports whose egress traffic is mirrored input_port_ids_ingress: type: array items: type: string description: At least one mirror input source should be specified. Switch ports whose ingress traffic is mirrored output_ip_address: type: string description: Exactly one of the `output_ip_address`, `output_port_id` or `output_network` should be provided examples: - 1.2.3.4 output_network: type: string description: Exactly one of the `output_ip_address`, `output_port_id` or `output_network` should be provided examples: - analyze output_port_id: type: string description: Exactly one of the `output_ip_address`, `output_port_id` or `output_network` should be provided examples: - ge-0/0/5 description: Input and output settings for one switch port mirroring session idp_profile_base_profile2: title: idp_profile_base_profile2 enum: - critical - standard - strict type: string description: 'Built-in IDP baseline profile inherited before applying overwrites. enum: `critical`, `standard`, `strict`.' examples: - strict snmp_usm_user_authentication_type2: title: snmp_usm_user_authentication_type2 enum: - authentication-md5 - authentication-none - authentication-sha - authentication-sha224 - authentication-sha256 - authentication-sha384 - authentication-sha512 type: string description: 'Authentication protocol used by this SNMPv3 USM user. enum: `authentication-md5`, `authentication-none`, `authentication-sha`, `authentication-sha224`, `authentication-sha256`, `authentication-sha384`, `authentication-sha512`.' tunnel_config_auto_provision2: title: tunnel_config_auto_provision2 required: - provider type: object properties: enabled: type: boolean description: Enable auto provisioning for the tunnel. If enabled, the `primary` and `secondary` nodes will be ignored. latlng: allOf: - $ref: '#/components/schemas/tunnel_config_auto_provision_lat_lng2' - description: Geographic coordinate override used for tunnel POP selection primary: allOf: - $ref: '#/components/schemas/tunnel_config_auto_provision_node3' - description: Main auto-provisioned tunnel endpoint settings provider: allOf: - $ref: '#/components/schemas/tunnel_config_auto_provision_provider2' - description: 'Tunnel provider used for automatic endpoint provisioning. enum: `jse-ipsec`, `zscaler-ipsec`.' region: type: string description: API override for POP selection in the case user wants to override the auto discovery of remote network location and force the tunnel to use the specified peer location. secondary: allOf: - $ref: '#/components/schemas/tunnel_config_auto_provision_node1' - description: Backup auto-provisioned tunnel endpoint settings service_connection: type: string description: if `provider`==`prisma-ipsec`. By default, we'll use the location of the site to determine the optimal Remote Network location, optionally, service_connection can be considered, then we'll also consider this along with the site location. Define service_connection if the traffic is to be routed to a specific service connection. This field takes a service connection name that is configured in the Prisma cloud, Prisma Access Setup -> Service Connections. examples: - Juniper-Lab-SC-1 description: Provider auto-provisioning settings for tunnel endpoints service_policy_skyatp_http_inspection2: title: service_policy_skyatp_http_inspection2 type: object properties: enabled: type: boolean description: Whether Sky ATP HTTP inspection is enabled profile: allOf: - $ref: '#/components/schemas/service_policy_skyatp_http_inspection_profile2' - description: 'Sky ATP HTTP inspection profile to apply. enum: `standard`, `strict`.' description: Web traffic inspection settings provided by Sky ATP snmp_usm_engine_type2: title: snmp_usm_engine_type2 enum: - local_engine - remote_engine type: string description: 'SNMP engine type used for this USM configuration. enum: `local_engine`, `remote_engine`.' snmpv3_config_target_param: title: snmpv3_config_target_param type: object properties: message_processing_model: allOf: - $ref: '#/components/schemas/snmpv3_config_target_param_mess_process_model2' - description: 'SNMP message processing model used by this target parameter profile. enum: `v1`, `v2c`, `v3`.' name: type: string description: Target parameter profile name notify_filter: type: string description: Notification filter profile referenced by this target parameter profile security_level: allOf: - $ref: '#/components/schemas/snmpv3_config_target_param_security_level2' - description: 'Required security level for this target parameter profile. enum: `authentication`, `none`, `privacy`.' security_model: allOf: - $ref: '#/components/schemas/snmpv3_config_target_param_security_model2' - description: 'Required security model for this target parameter profile. enum: `usm`, `v1`, `v2c`.' security_name: type: string description: USM security name referenced by this target parameter profile examples: - m01620 description: SNMPv3 target parameter profile ap_iot_input3: title: ap_iot_input3 type: object properties: enabled: type: boolean description: Whether to enable a pin default: false name: type: string description: Optional; descriptive pin name examples: - motion pullup: allOf: - $ref: '#/components/schemas/ap_iot_pullup1' - description: 'Selects the pull-up resistor mode applied to the input pin. enum: `external`, `internal`, `none`.' description: Digital input pin DI1 settings service_policy_appqoe1: title: service_policy_appqoe1 type: object properties: enabled: type: boolean description: Whether application QoE is enabled for the service policy default: false description: Application QoE settings applied by this service policy ospf_area: title: ospf_area type: object properties: include_loopback: type: boolean description: Whether loopback interfaces are included in this OSPF area default: false networks: type: object additionalProperties: $ref: '#/components/schemas/ospf_areas_network' description: OSPF network settings keyed by network name examples: - corp: auth_keys: '1': auth-key-1 auth_type: md5 bfd_minimum_interval: 500 dead_interval: 40 hello_interval: 10 interface_type: nbma metric: 10000 guest: passive: true type: allOf: - $ref: '#/components/schemas/ospf_area_type2' - description: 'Area type for this OSPF area. enum: `default`, `nssa`, `stub`.' examples: - default description: Property key is the OSPF Area (Area should be a number (0-255) / IP address) extra_route6: title: extra_route6 type: object properties: discard: type: boolean description: Whether to install a discard route; this takes precedence over next-hop settings default: false metric: maximum: 2147483647 minimum: 0 type: - integer - 'null' description: Route metric for the IPv6 static route contentEncoding: int32 next_qualified: type: object additionalProperties: $ref: '#/components/schemas/extra_route6_next_qualified_properties' description: Qualified next-hop settings keyed by IPv6 next-hop address examples: - 2a02:1234:200a::100: metric: null preference: 40 no_resolve: type: boolean description: Whether to prevent recursive next-hop resolution for the IPv6 static route default: false preference: maximum: 2147483647 minimum: 0 type: - integer - 'null' description: Route preference for the IPv6 static route contentEncoding: int32 examples: - 30 via: oneOf: - type: string - type: array items: type: string description: Next-hop IPv6 address or ECMP next-hop IPv6 addresses for the route examples: - 10.2.1.1 - "[\n \"10.2.1.1\",\n \"10.2.1.2\"\n]" description: IPv6 static route settings for a destination prefix gateway_extra_route6: title: gateway_extra_route6 type: object properties: via: type: string description: Next-hop IPv6 address for the gateway extra route contentEncoding: ipv6 description: Gateway IPv6 extra route next-hop settings ssl_proxy_ciphers_category2: title: ssl_proxy_ciphers_category2 enum: - medium - strong - weak type: string description: 'Allowed cipher strength category for SSL proxy inspection. enum: `medium`, `strong`, `weak`.' tunnel_config_ike_mode2: title: tunnel_config_ike_mode2 enum: - aggressive - main type: string description: 'Only if `provider`==`custom-ipsec`. IKE negotiation mode for the tunnel. enum: `aggressive`, `main`.' ap_usb2: title: ap_usb2 type: object properties: cacert: type: - string - 'null' description: Only if `type`==`imagotag`. CA certificate used to validate the Imagotag service certificate channel: type: integer description: Only if `type`==`imagotag`, channel selection, not needed by default, required for manual channel override only contentEncoding: int32 examples: - 3 enabled: type: boolean description: Whether to enable any usb config host: type: string description: Only if `type`==`imagotag`. Imagotag service host or IP address contacted by the AP examples: - 1.1.1.1 port: type: integer description: Only if `type`==`imagotag`. TCP port used to reach the Imagotag service contentEncoding: int32 default: 0 examples: - 0 type: allOf: - $ref: '#/components/schemas/ap_usb_type2' - description: 'USB integration type for this legacy AP USB configuration. enum: `hanshow`, `imagotag`, `solum`.' examples: - imagotag verify_cert: type: boolean description: Only if `type`==`imagotag`, whether to turn on SSL verification vlan_id: type: integer description: Only if `type`==`solum` or `type`==`hanshow` contentEncoding: int32 default: 1 description: Legacy USB integration defaults in this AP profile tacacs_default_role2: title: tacacs_default_role2 enum: - admin - helpdesk - none - read type: string description: 'Default switch-management role to use for TACACS+ logins. enum: `admin`, `helpdesk`, `none`, `read`.' ap_switch_setting1: title: ap_switch_setting1 type: object properties: enable_vlan: type: boolean description: Whether VLAN tagging is enabled for this AP switch-config port port_vlan_id: anyOf: - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 - type: string description: Native VLAN ID for this AP switch-config port vlan_ids: type: array items: maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: Allowed VLAN IDs for this AP switch-config port description: VLAN settings for AP eth1 ap_iot_output1: title: ap_iot_output1 type: object properties: enabled: type: boolean description: Whether to enable a pin default: false name: type: string description: Optional; descriptive pin name examples: - motion output: type: boolean description: Whether the pin is configured as an output. DO and A1-A4 can be repurposed by changing examples: - true pullup: allOf: - $ref: '#/components/schemas/ap_iot_pullup3' - description: 'Selects the pull-up resistor mode applied to the output pin. enum: `external`, `internal`, `none`.' value: type: integer description: Output pin signal level, default 0 contentEncoding: int32 examples: - 0 description: Analog-capable IoT pin A2 output settings ip_type3: title: ip_type3 enum: - dhcp - static type: string description: 'IPv4 assignment mode for the additional Junos L3 presence. enum: `dhcp`, `static`.' examples: - static gateway_wan_ppoe_auth2: title: gateway_wan_ppoe_auth2 enum: - chap - none - pap type: string description: 'Authentication protocol used for PPPoE when `type`==`pppoe`. enum: `chap`, `none`, `pap`.' switch_iot_port_input_src2: title: switch_iot_port_input_src2 enum: - IN0 - IN1 type: string description: 'Only for `OUT` ports. Input port that triggers this output port. enum: `IN0`, `IN1`.' ap_radio_band53: title: ap_radio_band53 type: object properties: allow_rrm_disable: type: boolean description: Whether RRM may disable the 5 GHz radio when optimizing RF settings default: false ant_gain: maximum: 10 minimum: 0 type: - integer - 'null' description: External antenna gain for the 5 GHz radio contentEncoding: int32 default: 0 antenna_beam_pattern: allOf: - $ref: '#/components/schemas/radio_band_antenna_beam_pattern3' - description: 'Beam pattern used by the 5 GHz radio antenna. enum: `narrow`, `medium`, `wide`.' antenna_mode: allOf: - $ref: '#/components/schemas/radio_band_antenna_mode1' - description: 'Radio chain mode for the 5 GHz radio. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' examples: - default bandwidth: allOf: - $ref: '#/components/schemas/dot11_bandwidth52' - description: 'Channel width configured for the 5 GHz radio. enum: `0`, `20`, `40`, `80`.' examples: - 40 channel: type: - integer - 'null' description: For Device. (primary) channel for the band, 0 means using the Site Setting contentEncoding: int32 examples: - 100 channels: type: - array - 'null' items: type: integer contentEncoding: int32 description: Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection default: [] disabled: type: boolean description: Whether to disable the radio default: false power: maximum: 25 minimum: 0 type: - integer - 'null' description: Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode contentEncoding: int32 examples: - 6 power_max: maximum: 17 minimum: 5 type: - integer - 'null' description: When power=null/unset, max tx power to use, HW-specific values will be used if not set contentEncoding: int32 power_min: maximum: 17 minimum: 5 type: - integer - 'null' description: When power=null/unset, min tx power to use, HW-specific values will be used if not set contentEncoding: int32 preamble: allOf: - $ref: '#/components/schemas/radio_band_preamble1' - description: '802.11 preamble mode used by the 5 GHz radio. enum: `auto`, `long`, `short`.' description: 5 GHz radio settings for this access point ap_aeroscout2: title: ap_aeroscout2 type: object properties: enabled: type: boolean description: Whether to enable aeroscout config default: false host: type: - string - 'null' description: Required if enabled, aeroscout server host examples: - aero.pvt.net locate_connected: type: boolean description: Whether to enable the feature to allow wireless clients data received and sent to AES server for location calculation default: false port: type: - integer - 'null' description: Optional if enabled, Aeroscout server port. Defaults to 1144 contentEncoding: int32 default: 1144 description: Location integration defaults for AeroScout in this AP profile allow_deny2: title: allow_deny2 enum: - allow - deny type: string description: Allow or deny action for traffic matched by this service policy dot11_bandwidth52: title: dot11_bandwidth52 enum: - 0 - 20 - 40 - 80 type: integer description: 'Channel width configured for the 5 GHz radio. enum: `0`, `20`, `40`, `80`.' examples: - 40 response_http403: title: response_http403 type: object properties: detail: type: string description: Human-readable explanation of the permission error examples: - You do not have permission to perform this action. description: Standard HTTP 403 permission error response wan_extra_routes: title: wan_extra_routes type: object properties: via: type: string description: IPv4 next-hop address for this WAN extra route contentEncoding: ipv4 description: Additional IPv4 route for a WAN interface snmp_vacm_access_item_prefix_list_item_model2: title: snmp_vacm_access_item_prefix_list_item_model2 enum: - any - usm - v1 - v2c type: string description: 'Required security model for this VACM access rule. enum: `any`, `usm`, `v1`, `v2c`.' ap_mqtt2: title: ap_mqtt2 type: object properties: broker_host: type: string description: MQTT broker hostname or IP address; required when `enabled` is `true` broker_port: type: integer description: MQTT broker port; defaults to `1883` for `tcp` and `8883` for `ssl` contentEncoding: int32 broker_proto: allOf: - $ref: '#/components/schemas/ap_mqtt_broker_proto2' - description: 'MQTT broker transport protocol. enum: `ssl`, `tcp`.' default_topic: type: string description: Optional catch-all MQTT topic; BLE advertisements matching no AssetFilter are published here examples: - mist/asset/raw enabled: type: boolean description: Whether to enable MQTT publishing default: false format: allOf: - $ref: '#/components/schemas/ap_mqtt_format2' - description: 'Payload format for published messages. enum: `json`, `raw`.' password: type: string description: Optional MQTT password; masked in GET responses contentEncoding: password username: type: string description: Optional MQTT username description: MQTT broker publishing settings for this AP profile tunnel_config_auth_algo1: title: tunnel_config_auth_algo1 enum: - md5 - sha1 - sha2 type: string description: 'Integrity algorithm used by this IPsec proposal. enum: `md5`, `sha1`, `sha2`.' tunnel_config_version2: title: tunnel_config_version2 enum: - '1' - '2' type: string description: 'Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. Tunnel version value for custom tunnel configuration. enum: `1`, `2`.' gateway_matching_rule: title: gateway_matching_rule type: object properties: additional_config_cmds: type: array items: type: string description: For SRX only, additional Junos CLI commands appended when this gateway matching rule applies name: type: string description: Display name for the gateway matching rule port_config: type: object additionalProperties: $ref: '#/components/schemas/gateway_port_config' description: Property key is the port(s) name or range (e.g. "ge-0/0/0-10"). additionalProperties: type: string description: 'Property key defines the type of matching. e.g: `match_name[0:3]`, `match_model[0-6]` or `match_role`' description: Gateway matching rule that applies settings when its match keys select a gateway switch_port_usage: title: switch_port_usage type: object properties: all_networks: type: boolean description: Only if `mode`==`trunk`. Whether to trunk all network/vlans default: false allow_dhcpd: type: boolean description: 'Only applies when `mode`!=`dynamic`. Controls whether DHCP server traffic is allowed on ports using this configuration if DHCP snooping is enabled. This is a tri-state setting; `true`: ports become trusted ports allowing DHCP server traffic, `false`: ports become untrusted blocking DHCP server traffic, undefined: use system defaults (access ports default to untrusted, trunk ports default to trusted).' allow_multiple_supplicants: type: boolean description: Only if `mode`!=`dynamic` default: false bypass_auth_when_server_down: type: boolean description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Bypass auth for known clients if set to true when RADIUS server is down default: false bypass_auth_when_server_down_for_unknown_client: type: boolean description: Only if `mode`!=`dynamic` and `port_auth`=`dot1x`. Bypass auth for all (including unknown clients) if set to true when RADIUS server is down default: false bypass_auth_when_server_down_for_voip: type: boolean description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Bypass auth for VOIP if set to true when RADIUS server is down default: false community_vlan_id: type: integer description: Only if `mode`!=`dynamic`. To be used together with `isolation` under networks. Signaling that this port connects to the networks isolated but wired clients belong to the same community can talk to each other contentEncoding: int32 description: type: string description: Only if `mode`!=`dynamic` disable_autoneg: type: boolean description: Only if `mode`!=`dynamic`. If speed and duplex are specified, whether to disable autonegotiation default: false disabled: type: boolean description: Only if `mode`!=`dynamic`. Whether the port is disabled default: false duplex: allOf: - $ref: '#/components/schemas/switch_port_usage_duplex2' - description: 'Only if `mode`!=`dynamic`. Link duplex mode for this port usage. enum: `auto`, `full`, `half`.' dynamic_vlan_networks: type: array items: type: string description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Networks or VLANs that RADIUS can return for dynamic VLAN assignment examples: - - corp - user enable_mac_auth: type: boolean description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Whether to enable MAC Auth default: false enable_qos: type: boolean description: Only if `mode`!=`dynamic` default: false guest_network: type: - string - 'null' description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Which network to put the device into if the device cannot do dot1x. default is null (i.e. not allowed) inter_isolation_network_link: type: boolean description: Only if `mode`!=`dynamic`. `inter_isolation_network_link` is used together with `isolation` under networks, signaling that this port connects to isolated networks default: false inter_switch_link: type: boolean description: 'Only if `mode`!=`dynamic`. `inter_switch_link` is used together with `isolation` under networks. NOTE: `inter_switch_link` works only between Juniper devices. This has to be applied to both ports connected together' default: false mac_auth_only: type: boolean description: Only if `mode`!=`dynamic` and `enable_mac_auth`==`true` mac_auth_preferred: type: boolean description: Only if `mode`!=`dynamic` + `enable_mac_auth`==`true` + `mac_auth_only`==`false`, dot1x will be given priority then mac_auth. Enable this to prefer mac_auth over dot1x. mac_auth_protocol: allOf: - $ref: '#/components/schemas/switch_port_usage_mac_auth_protocol2' - description: 'Only if `mode`!=`dynamic` and `enable_mac_auth`==`true`. MAC authentication protocol to use; ignored if Mist NAC is enabled. enum: `eap-md5`, `eap-peap`, `pap`.' mac_limit: anyOf: - maximum: 16383 minimum: 0 type: integer contentEncoding: int32 default: 0 - type: string description: Only if `mode`!=`dynamic`. Maximum number of MAC addresses allowed on the port; 0 means unlimited mode: allOf: - $ref: '#/components/schemas/switch_port_usage_mode2' - description: 'Switching mode for this port usage. enum: `access`, `dynamic`, `inet`, `trunk`.' mtu: anyOf: - maximum: 9216 minimum: 256 type: integer contentEncoding: int32 - type: string description: Only if `mode`!=`dynamic`. MTU for ports using this port usage networks: type: array items: type: string description: Only if `mode`==`trunk`. Network or VLAN names to trunk persist_mac: type: boolean description: Only if `mode`==`access` and `port_auth`!=`dot1x`. Whether the port should retain dynamically learned MAC addresses default: false poe_disabled: type: boolean description: Only if `mode`!=`dynamic`. Whether PoE capabilities are disabled for a port default: false poe_keep_state_when_reboot: type: boolean description: Only if `mode`!=`dynamic`. Whether Perpetual PoE is enabled; keeps PoE state across reboots default: false poe_priority: allOf: - $ref: '#/components/schemas/poe_priority3' - description: 'Only if `mode`!=`dynamic`. PoE priority for ports using this port usage. enum: `low`, `high`.' port_auth: allOf: - oneOf: - {} - $ref: '#/components/schemas/switch_port_usage_dot1x2' - description: 'Only if `mode`!=`dynamic`. 802.1X authentication mode for this port usage. enum: `dot1x`.' port_network: type: string description: Only if `mode`!=`dynamic`. Native network/vlan for untagged traffic reauth_interval: anyOf: - maximum: 65535 minimum: 10 type: integer contentEncoding: int32 default: 3600 - type: string description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. RADIUS reauthentication interval for clients on the port reset_default_when: allOf: - $ref: '#/components/schemas/switch_port_usage_dynamic_reset_default_when2' - description: 'Only if `mode`==`dynamic`. Condition that resets a dynamic port to the default port usage. enum: `link_down`, `none`.' examples: - link_down rules: type: array items: $ref: '#/components/schemas/switch_port_usage_dynamic_rule' description: Only if `mode`==`dynamic`. Dynamic matching rules that select the port usage to apply server_fail_network: type: - string - 'null' description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Sets server fail fallback vlan server_fail_retry_interval: maximum: 65535 minimum: 120 type: integer description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Interval, in seconds. Sets the wait time before retrying authentication after RADIUS failure to reduce client flapping. Range 120-65535 contentEncoding: int32 default: 120 server_reject_network: type: - string - 'null' description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. When RADIUS server reject / fails speed: allOf: - $ref: '#/components/schemas/switch_port_usage_speed2' - description: 'Only if `mode`!=`dynamic`. Link speed for this port usage. enum: `10m`, `100m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`, `auto`.' storm_control: allOf: - $ref: '#/components/schemas/switch_port_usage_storm_control2' - description: Only if `mode`!=`dynamic`. Storm-control settings for this port usage stp_disable: type: boolean description: Only if `mode`!=`dynamic` and `stp_required`==`false`. Drop bridge protocol data units (BPDUs ) that enter any interface or a specified interface default: false stp_edge: type: boolean description: Only if `mode`!=`dynamic`. When enabled, the port is not expected to receive BPDU frames default: false stp_no_root_port: type: boolean description: Only if `mode`!=`dynamic` default: false stp_p2p: type: boolean description: Only if `mode`!=`dynamic` default: false stp_required: type: boolean description: Only if `mode`!=`dynamic`. Whether to remain in block state if no BPDU is received default: false ui_evpntopo_id: type: string description: Optional for Campus Fabric Core-Distribution ESI-LAG profile. Helper used by the UI to select this port profile as the ESI-Lag between Distribution and Access switches contentEncoding: uuid use_vstp: type: boolean description: If this is connected to a vstp network default: false voip_network: type: - string - 'null' description: Only if `mode`!=`dynamic`. Network/vlan for voip traffic, must also set port_network. to authenticate device, set port_auth description: Junos switch port usage template and authentication settings ip_type2: title: ip_type2 enum: - dhcp - static type: string description: 'IP assignment mode for the out-of-band management interface. enum: `dhcp`, `static`.' examples: - static tunnel_config_node_probe_http2: title: tunnel_config_node_probe_http2 type: object properties: accepted_status_codes: type: array items: type: integer contentEncoding: int32 description: HTTP response status codes that indicate a successful probe. Defaults to 200 if not specified. examples: - - 204 urls: type: array items: type: string description: HTTP or HTTPS URLs to probe examples: - - http://www.google.com/generate_204 - https://www.google.com/generate_204 description: HTTP probe settings for this tunnel node; success from any ICMP or HTTP probe indicates the tunnel is up snmp_usm_user: title: snmp_usm_user type: object properties: authentication_password: minLength: 7 type: string description: Not required if `authentication_type`==`authentication-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters. authentication_type: allOf: - $ref: '#/components/schemas/snmp_usm_user_authentication_type2' - description: 'Authentication protocol used by this SNMPv3 USM user. enum: `authentication-md5`, `authentication-none`, `authentication-sha`, `authentication-sha224`, `authentication-sha256`, `authentication-sha384`, `authentication-sha512`.' encryption_password: minLength: 8 type: string description: Not required if `encryption_type`==`privacy-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters encryption_type: allOf: - $ref: '#/components/schemas/snmp_usm_user_encryption_type2' - description: 'Privacy protocol used by this SNMPv3 USM user. enum: `privacy-3des`, `privacy-aes128`, `privacy-des`, `privacy-none`.' name: type: string description: Username for the SNMPv3 USM user description: SNMPv3 USM user definition ap_ip_config2: title: ap_ip_config2 type: object properties: dns: type: array items: type: string description: If `type`==`static`. DNS server IP addresses for AP management traffic examples: - - 8.8.8.8 - 4.4.4.4 dns_suffix: type: array items: type: string description: If `type`==`static`. DNS search suffixes applied to AP management lookups examples: - - .mist.local - .mist.com gateway: type: string description: Required if `type`==`static`. IPv4 default gateway for AP management traffic contentEncoding: ipv4 examples: - 10.2.1.254 gateway6: type: string description: Required if `type6`==`static`. IPv6 default gateway for AP management traffic when static IPv6 addressing is used contentEncoding: ipv6 examples: - 2607:f8b0:4005:808::1 ip: type: string description: Required if `type`==`static`. Static IPv4 address for the AP management interface contentEncoding: ipv4 examples: - 10.2.1.1 ip6: type: string description: Required if `type6`==`static`. Static IPv6 address for the AP management interface contentEncoding: ipv6 examples: - 2607:f8b0:4005:808::2004 mtu: type: integer description: Maximum transmission unit for AP management traffic contentEncoding: int32 examples: - 0 netmask: type: string description: Required if `type`==`static`. IPv4 netmask for the AP management interface examples: - 255.255.255.0 netmask6: type: string description: Required if `type6`==`static`. IPv6 prefix length for the AP management interface examples: - /32 type: allOf: - $ref: '#/components/schemas/ip_type13' - description: 'IPv4 address assignment mode for AP management traffic. enum: `dhcp`, `static`.' examples: - static type6: allOf: - $ref: '#/components/schemas/ip_type64' - description: 'IPv6 address assignment mode for AP management traffic. enum: `autoconf`, `dhcp`, `disabled`, `static`.' examples: - static vlan_id: type: integer description: Management VLAN ID, default is 1 (untagged) contentEncoding: int32 default: 1 examples: - 1 description: Management IP addressing defaults in this AP profile tunnel_config_auto_provision_node1: title: tunnel_config_auto_provision_node1 type: object properties: probe_ips: uniqueItems: true type: array items: type: string description: Probe IP addresses used to monitor auto-provisioned tunnel reachability wan_names: type: array items: type: string description: WAN interface names used by the auto-provisioned tunnel endpoint description: Backup auto-provisioned tunnel endpoint settings switch_mist_nac1: title: switch_mist_nac1 type: object properties: enabled: type: boolean description: Whether Mist NAC RadSec is enabled for the switch network: type: string description: Switch network used for Mist NAC RadSec connectivity description: Mist NAC defaults applied by this switch profile vrf_config2: title: vrf_config2 type: object properties: enabled: type: boolean description: Whether to enable VRF (when supported on the device) description: VRF defaults applied by this gateway profile gateway_path_preferences: title: gateway_path_preferences type: object properties: paths: type: array items: $ref: '#/components/schemas/gateway_path_preferences_path' description: Candidate paths evaluated for this gateway path preference strategy: allOf: - $ref: '#/components/schemas/gateway_path_strategy2' - description: 'Selection strategy used to evaluate the candidate paths. enum: `ecmp`, `ordered`, `weighted`.' description: Gateway path preference that selects among one or more local, WAN, VPN, or tunnel paths dhcpd_config_vendor_option_type2: title: dhcpd_config_vendor_option_type2 enum: - boolean - hex - int16 - int32 - ip - string - uint16 - uint32 type: string description: 'Data type used to encode this vendor option value. enum: `boolean`, `hex`, `int16`, `int32`, `ip`, `string`, `uint16`, `uint32`.' remote_syslog_severity3: title: remote_syslog_severity3 enum: - alert - any - critical - emergency - error - info - notice - warning type: string description: 'Syslog severity to match for this selector. enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`.' tunnel_config_protocol2: title: tunnel_config_protocol2 enum: - gre - ipsec type: string description: 'Only if `provider`==`custom-ipsec`. Tunnel protocol for custom tunnel negotiation. enum: `gre`, `ipsec`.' gateway_extra_route: title: gateway_extra_route type: object properties: via: type: string description: Next-hop IPv4 address for the gateway extra route contentEncoding: ipv4 description: Gateway IPv4 extra route next-hop settings switch_port_usage_speed2: title: switch_port_usage_speed2 enum: - 10m - 100m - 1g - 2.5g - 5g - 10g - 25g - 40g - 100g - auto type: string description: 'Only if `mode`!=`dynamic`. Link speed for this port usage. enum: `10m`, `100m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`, `auto`.' device_ap_lacp_config2: title: device_ap_lacp_config2 type: object properties: enabled: type: boolean description: Whether to enable LACP on supported AP Ethernet uplinks default: false description: Link aggregation defaults for supported AP Ethernet uplinks service_policy_syslog2: title: service_policy_syslog2 type: object properties: enabled: type: boolean description: Whether syslog logging is enabled for the service policy default: false server_names: type: array items: type: string description: Names of syslog servers that receive logs for this service policy examples: - - dc_syslog_server description: Remote logging settings applied by this service policy dhcp_snooping1: title: dhcp_snooping1 type: object properties: all_networks: type: boolean description: Whether DHCP snooping applies to all configured networks enable_arp_spoof_check: type: boolean description: Enable for dynamic ARP inspection check enable_ip_source_guard: type: boolean description: Enable for check for forging source IP address enabled: type: boolean description: Whether DHCP snooping is enabled networks: type: array items: type: string description: Network names with DHCP snooping enabled when `all_networks`==`false` description: DHCP snooping defaults provided by this switch profile service_policy_skyatp_iot_device_policy2: title: service_policy_skyatp_iot_device_policy2 type: object properties: enabled: type: boolean description: Whether Sky ATP IoT device policy inspection is enabled description: Device threat policy settings provided by Sky ATP for IoT clients ip_type5: title: ip_type5 enum: - dhcp - static type: string description: 'IP assignment mode for the node1 out-of-band management interface. enum: `dhcp`, `static`.' examples: - static vrf_extra_route6: title: vrf_extra_route6 type: object properties: via: type: string description: IPv6 next-hop address for this VRF extra route contentEncoding: ipv6 description: Additional IPv6 static route for a VRF instance ap_airista2: title: ap_airista2 type: object properties: enabled: type: boolean description: Whether to enable Airista config default: false host: type: - string - 'null' description: Required if enabled, Airista server host examples: - airista.pvt.net port: type: - integer - 'null' description: Optional if enabled, Airista server port. Defaults to 1144 contentEncoding: int32 default: 1144 description: Location integration defaults for Airista in this AP profile evpn_config1: title: evpn_config1 type: object properties: enabled: type: boolean description: Whether EVPN configuration is enabled on the switch readOnly: true role: allOf: - $ref: '#/components/schemas/evpn_config_role2' - description: 'EVPN topology role for the switch. enum: `access`, `border`, `collapsed-core`, `core`, `distribution`, `esilag-access`, `none`.' readOnly: true description: EVPN defaults applied by this switch profile tunnel_provider_options1: title: tunnel_provider_options1 type: object properties: jse: allOf: - $ref: '#/components/schemas/tunnel_provider_options_jse2' - description: Juniper Secure Edge provisioning options for tunnel endpoints prisma: allOf: - $ref: '#/components/schemas/tunnel_provider_options_prisma2' - description: Palo Alto Prisma Access provisioning options for tunnel endpoints zscaler: allOf: - $ref: '#/components/schemas/tunnel_provider_options_zscaler2' - description: Provider settings for Zscaler tunnel endpoints description: Provider-specific tunnel options defined by this gateway profile dhcpd_config_vendor_option: title: dhcpd_config_vendor_option type: object properties: type: allOf: - $ref: '#/components/schemas/dhcpd_config_vendor_option_type2' - description: 'Data type used to encode this vendor option value. enum: `boolean`, `hex`, `int16`, `int32`, `ip`, `string`, `uint16`, `uint32`.' value: type: string description: Option value to send for this vendor option description: Vendor-encapsulated DHCP option value tunnel_provider_options_jse2: title: tunnel_provider_options_jse2 type: object properties: num_users: type: integer description: User capacity to provision on Juniper Secure Edge contentEncoding: int32 examples: - 5 org_name: type: string description: JSE Organization name. The list of available organizations can be retrieved with the [Get Org JSE Info]($e/Orgs%20Integration%20JSE/getOrgJseInfo) API Call examples: - JSE_ORG1 description: Juniper Secure Edge provisioning options for tunnel endpoints dhcpd_config_fixed_binding: title: dhcpd_config_fixed_binding type: object properties: ip: type: string description: Reserved IPv4 address for this fixed DHCP binding examples: - 192.168.70.35 ip6: type: string description: Reserved IPv6 address for this fixed DHCP binding examples: - 2607:f8b0:4005:808::2 name: type: string description: Friendly name for this fixed DHCP binding description: Static DHCP binding for a client MAC address network_internet_access_static_nat_property: title: network_internet_access_static_nat_property type: object properties: internal_ip: type: string description: The Static NAT destination IP address. Must be an IP address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}") examples: - 192.168.70.3 name: type: string description: Label for this direct internet static NAT rule examples: - pos_station-1 wan_name: type: string description: SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}") examples: - wan0 description: Direct-internet static NAT rule target settings ap_led2: title: ap_led2 type: object properties: brightness: maximum: 255 minimum: 0 type: integer description: Indicator LED brightness level from 0 to 255 contentEncoding: int32 default: 255 examples: - 255 enabled: type: boolean description: Whether the AP indicator LED is enabled default: true description: Indicator light behavior defaults in this AP profile acl_tag_type2: title: acl_tag_type2 enum: - any - aruba_user_role - dynamic_gbp - gbp_resource - mac - network - port_usage - radius_group - resource - static_gbp - subnet type: string description: 'Classifier type that determines which ACL tag fields are evaluated. enum: `any`, `aruba_user_role`, `dynamic_gbp`, `gbp_resource`, `mac`, `network`, `port_usage`, `radius_group`, `resource`, `static_gbp`, `subnet`.' ip_type1: title: ip_type1 enum: - dhcp - static type: string description: 'IP assignment mode for this Junos IP configuration. enum: `dhcp`, `static`.' examples: - static idp_profile_overwrite: title: idp_profile_overwrite type: object properties: action: allOf: - $ref: '#/components/schemas/idp_profile_action2' - description: 'Enforcement action applied when this overwrite rule matches. enum: `alert`, `close`, `drop`.' examples: - alert matching: allOf: - $ref: '#/components/schemas/idp_profile_matching2' - description: Criteria that select signatures for this overwrite rule name: type: string description: Display name for this IDP profile overwrite rule description: Override rule that changes the IDP action for matching signatures remote_syslog_console2: title: remote_syslog_console2 type: object properties: contents: type: array items: $ref: '#/components/schemas/remote_syslog_content' description: Syslog facilities and severities forwarded from console logs description: Log forwarding filters for console messages sent to remote syslog snmp_usm: title: snmp_usm type: object properties: engine_type: allOf: - $ref: '#/components/schemas/snmp_usm_engine_type2' - description: 'SNMP engine type used for this USM configuration. enum: `local_engine`, `remote_engine`.' remote_engine_id: type: string description: Required only if `engine_type`==`remote_engine` examples: - 00:00:00:0b:00:00:70:10:6f:08:b6:3f users: type: array items: $ref: '#/components/schemas/snmp_usm_user' description: SNMPv3 USM users for this engine description: SNMPv3 User-based Security Model configuration snmp_config_view: title: snmp_config_view type: object properties: include: type: boolean description: Whether the root OID is included in this SNMP view oid: type: string description: Root OID for this SNMP view examples: - 1.3.6.1 view_name: type: string description: Name of the SNMP MIB view definition examples: - all description: SNMP MIB view definition ap_radio_band242: title: ap_radio_band242 type: object properties: allow_rrm_disable: type: boolean description: Whether RRM may disable the 2.4 GHz radio when optimizing RF settings default: false ant_gain: maximum: 10 minimum: 0 type: - integer - 'null' description: External antenna gain for the 2.4 GHz radio contentEncoding: int32 default: 0 antenna_mode: allOf: - $ref: '#/components/schemas/radio_band_antenna_mode4' - description: 'Radio chain mode for the 2.4 GHz radio. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' examples: - default bandwidth: allOf: - $ref: '#/components/schemas/dot11_bandwidth242' - description: 'Channel width configured for the 2.4 GHz radio. enum: `0`, `20`, `40`.' examples: - 20 channel: maximum: 13 minimum: 1 type: - integer - 'null' description: For Device. (primary) channel for the band, 0 means using the Site Setting contentEncoding: int32 examples: - 6 channels: type: - array - 'null' items: type: integer contentEncoding: int32 description: Allowed channel list for the 2.4 GHz radio; null or an empty array uses automatic selection default: [] disabled: type: boolean description: Whether to disable the radio default: false power: maximum: 25 minimum: 0 type: - integer - 'null' description: Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode contentEncoding: int32 examples: - 3 power_max: maximum: 18 minimum: 3 type: - integer - 'null' description: When power=null/unset, max tx power to use, HW-specific values will be used if not set contentEncoding: int32 power_min: maximum: 18 minimum: 3 type: - integer - 'null' description: When power=null/unset, min tx power to use, HW-specific values will be used if not set contentEncoding: int32 preamble: allOf: - $ref: '#/components/schemas/radio_band_preamble4' - description: '802.11 preamble mode used by the 2.4 GHz radio. enum: `auto`, `long`, `short`.' description: 2.4 GHz radio settings for this access point service_policy_skyatp_dns_tunnel_detection_profile2: title: service_policy_skyatp_dns_tunnel_detection_profile2 enum: - default - standard - strict type: string description: 'Sky ATP DNS tunneling detection profile to apply. enum: `default`, `standard`, `strict`.' radsec_server: title: radsec_server type: object properties: host: type: string description: Address or hostname of the RadSec server examples: - 1.1.1.1 port: maximum: 65535 minimum: 1 type: integer description: TCP port used by the RadSec server contentEncoding: int32 examples: - 1812 description: External RadSec server settings securitySchemes: apiToken: type: apiKey description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed." name: Authorization in: header csrfToken: type: apiKey description: 'Session-based authentication for browser or login/password flows. After a successful [Login]($e/Admins%20Login/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session. **Format**: ``` X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx ``` For automation, API Token authentication is preferred.' name: X-CSRFToken in: header