openapi: 3.2.0 info: version: 2.0.0 title: Network Services Zone Protection Profiles API description: These APIs are used for defining and managing network services configuration within Strata Cloud Manager. termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf contact: email: support@paloaltonetworks.com name: Palo Alto Networks Technical Support url: https://support.paloaltonetworks.com license: name: MIT url: https://opensource.org/license/mit servers: - url: https://api.strata.paloaltonetworks.com/config/network/v1 description: Current - url: https://api.sase.paloaltonetworks.com/sse/config/v1 description: Legacy security: - scmToken: [] tags: - name: Zone Protection Profiles description: Zone Protection Profiles paths: /zone-protection-profiles: get: tags: - Zone Protection Profiles summary: List zone protection profiles description: 'Retrieve a list of zone protection profiles. ' operationId: ListZoneProtectionProfiles parameters: - $ref: '#/components/parameters/limit' - $ref: '#/components/parameters/offset' - $ref: '#/components/parameters/name' - $ref: '#/components/parameters/folder' - $ref: '#/components/parameters/snippet' - $ref: '#/components/parameters/device' responses: '200': description: OK content: application/json: schema: type: object properties: data: allOf: - type: array items: $ref: '#/components/schemas/zone-protection-profiles' limit: type: integer default: 200 offset: type: integer default: 0 total: type: integer '400': $ref: '#/components/responses/bad_request_errors_basic' '401': $ref: '#/components/responses/auth_errors' '403': $ref: '#/components/responses/access_errors' '404': $ref: '#/components/responses/not_found' default: $ref: '#/components/responses/default_errors' post: tags: - Zone Protection Profiles summary: Create a zone protection profile description: 'Create a new zone protection profile. ' operationId: CreateZoneProtectionProfiles requestBody: description: Created content: application/json: schema: $ref: '#/components/schemas/zone-protection-profiles' responses: '201': description: OK content: application/json: schema: $ref: '#/components/schemas/zone-protection-profiles' '400': $ref: '#/components/responses/bad_request_errors_basic_with_body' '401': $ref: '#/components/responses/auth_errors' '403': $ref: '#/components/responses/access_errors' '409': $ref: '#/components/responses/conflict_errors' default: $ref: '#/components/responses/default_errors' /zone-protection-profiles/{id}: get: tags: - Zone Protection Profiles summary: Get a zone protection profile description: 'Get an existing zone protection profile. ' operationId: GetZoneProtectionProfilesByID parameters: - $ref: '#/components/parameters/uuid' responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/zone-protection-profiles' '400': $ref: '#/components/responses/bad_request_errors_basic' '401': $ref: '#/components/responses/auth_errors' '403': $ref: '#/components/responses/access_errors' '404': $ref: '#/components/responses/not_found' default: $ref: '#/components/responses/default_errors' put: tags: - Zone Protection Profiles summary: Update a zone protection profile description: 'Update an existing zone protection profile. ' operationId: UpdateZoneProtectionProfilesByID parameters: - $ref: '#/components/parameters/uuid' requestBody: description: OK content: application/json: schema: $ref: '#/components/schemas/zone-protection-profiles' responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/zone-protection-profiles' '400': $ref: '#/components/responses/bad_request_errors_basic_with_body' '401': $ref: '#/components/responses/auth_errors' '403': $ref: '#/components/responses/access_errors' '404': $ref: '#/components/responses/not_found' '409': $ref: '#/components/responses/conflict_errors' default: $ref: '#/components/responses/default_errors' delete: tags: - Zone Protection Profiles summary: Delete a zone protection profile description: 'Delete a zone protection profile. ' operationId: DeleteZoneProtectionProfilesByID parameters: - $ref: '#/components/parameters/uuid' responses: '200': $ref: '#/components/responses/http_ok' '400': $ref: '#/components/responses/bad_request_errors_basic' '401': $ref: '#/components/responses/auth_errors' '403': $ref: '#/components/responses/access_errors' '404': $ref: '#/components/responses/not_found' '409': $ref: '#/components/responses/conflict_errors' default: $ref: '#/components/responses/default_errors' components: examples: json_401_panui_auth_key_expired: summary: Key Expired value: _errors: - code: E016 message: Key Expired details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_501_panui_restapi_method_not_supported: summary: Method Not Supported value: _errors: - code: E012 message: Method Not Supported details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_400_panui_restapi_input_format_mismatch: summary: Input Format Mismatch value: _errors: - code: E003 message: 'Input Format Mismatch: input-format=json' details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_501_panui_restapi_version_not_supported: summary: Version Not Supported value: _errors: - code: E012 message: Version Not Supported details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_409_panui_mgmt_name_not_unique: summary: Name Not Unique value: _errors: - code: E006 message: Name Not Unique details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_409_panui_mgmt_object_not_unique: summary: Object Not Unique value: _errors: - code: E016 message: Object Not Unique details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_404_panui_mgmt_object_not_present: summary: Object Not Present value: _errors: - code: E005 message: Object Not Present details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_400_panui_restapi_missing_body: summary: Missing Body value: _errors: - code: E003 message: Missing Body details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_409_panui_mgmt_reference_not_zero: summary: Reference Not Zero value: _errors: - code: E009 message: Reference Not Zero details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_400_panui_mgmt_invalid_command: summary: Invalid Command value: _errors: - code: E003 message: Invalid Command details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_400_panui_restapi_output_format_mismatch: summary: Output Format Mismatch value: _errors: - code: E003 message: 'Output Format Mismatch: output-format=json Accept=xml' details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_401_panui_auth_not_authenticated: summary: Not Authenticated value: _errors: - code: E016 message: Not Authenticated details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_401_panui_auth_invalid_credential: summary: Invalid Credential value: _errors: - code: E016 message: Invalid Credential details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_403_panui_auth_unauthorized: summary: Unauthorized value: _errors: - code: E007 message: Unauthorized details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_400_panui_restapi_missing_query_parameter: summary: Missing Query Parameter value: _errors: - code: E003 message: 'Missing Query Parameter: name' details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_405_panui_restapi_action_not_supported: summary: Action Not Supported value: _errors: - code: E012 message: 'Action Not Supported: move' details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_400_panui_restapi_invalid_query_parameter: summary: Invalid Query Parameter value: _errors: - code: E003 message: 'Invalid Query Parameter: location=invalid' details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_401_panui_auth_key_too_long: summary: Key Too Long value: _errors: - code: E016 message: Key Too Long details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_400_panui_mgmt_invalid_object: summary: Invalid Object value: _errors: - code: E003 message: Invalid Object details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_400_panui_mgmt_malformed_command: summary: Malformed Command value: _errors: - code: E003 message: Malformed Command details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_504_panui_mgmt_session_timeout: summary: Session Timeout value: _errors: - code: '4' message: Session Timeout details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_401_panui_auth_need_password_change: summary: Need Password Change value: _errors: - code: E016 message: The password needs to be changed. details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 json_400_panui_mgmt_bad_xpath: summary: Bad XPath value: _errors: - code: E013 message: Bad XPath details: {} _request_id: 123e4567-e89b-12d3-a456-426655440000 parameters: uuid: name: id in: path description: The UUID of the configuration resource required: true schema: type: string format: uuid example: 123e4567-e89b-12d3-a456-426655440000 name: name: name in: query description: The name of the configuration resource required: false schema: type: string limit: name: limit in: query description: The maximum number of results per page required: false schema: type: integer default: 200 folder: name: folder in: query description: 'The folder in which the resource is defined ' required: false schema: type: string snippet: name: snippet in: query description: 'The snippet in which the resource is defined ' required: false schema: type: string offset: name: offset in: query description: The offset into the list of results returned required: false schema: type: integer default: 0 device: name: device in: query description: 'The device in which the resource is defined ' required: false schema: type: string responses: http_ok: description: OK not_found: description: Not Found content: application/json: schema: $ref: '#/components/schemas/generic_error' examples: object_not_present: $ref: '#/components/examples/json_404_panui_mgmt_object_not_present' default_errors: description: General Errors content: application/json: schema: $ref: '#/components/schemas/generic_error' examples: version_not_supported: $ref: '#/components/examples/json_501_panui_restapi_version_not_supported' method_not_allowed: $ref: '#/components/examples/json_501_panui_restapi_method_not_supported' action_not_supported: $ref: '#/components/examples/json_405_panui_restapi_action_not_supported' bad_xpath: $ref: '#/components/examples/json_400_panui_mgmt_bad_xpath' invalid_command: $ref: '#/components/examples/json_400_panui_mgmt_invalid_command' malformed_command: $ref: '#/components/examples/json_400_panui_mgmt_malformed_command' session_timeout: $ref: '#/components/examples/json_504_panui_mgmt_session_timeout' bad_request_errors_basic_with_body: description: Bad Request content: application/json: schema: $ref: '#/components/schemas/generic_error' examples: input_format_mismatch: $ref: '#/components/examples/json_400_panui_restapi_input_format_mismatch' output_format_mismatch: $ref: '#/components/examples/json_400_panui_restapi_output_format_mismatch' missing_query_parameter: $ref: '#/components/examples/json_400_panui_restapi_missing_query_parameter' invalid_query_parameter: $ref: '#/components/examples/json_400_panui_restapi_invalid_query_parameter' missing_body: $ref: '#/components/examples/json_400_panui_restapi_missing_body' invalid_object: $ref: '#/components/examples/json_400_panui_mgmt_invalid_object' bad_request_errors_basic: description: Bad Request content: application/json: schema: $ref: '#/components/schemas/generic_error' examples: input_format_mismatch: $ref: '#/components/examples/json_400_panui_restapi_input_format_mismatch' output_format_mismatch: $ref: '#/components/examples/json_400_panui_restapi_output_format_mismatch' missing_query_parameter: $ref: '#/components/examples/json_400_panui_restapi_missing_query_parameter' invalid_query_parameter: $ref: '#/components/examples/json_400_panui_restapi_invalid_query_parameter' auth_errors: description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/generic_error' examples: auth_not_authenticated: $ref: '#/components/examples/json_401_panui_auth_not_authenticated' invalid_credential: $ref: '#/components/examples/json_401_panui_auth_invalid_credential' key_too_long: $ref: '#/components/examples/json_401_panui_auth_key_too_long' key_expired: $ref: '#/components/examples/json_401_panui_auth_key_expired' need_password_change: $ref: '#/components/examples/json_401_panui_auth_need_password_change' conflict_errors: description: Conflict content: application/json: schema: $ref: '#/components/schemas/generic_error' examples: object_not_unique: $ref: '#/components/examples/json_409_panui_mgmt_object_not_unique' name_not_unique: $ref: '#/components/examples/json_409_panui_mgmt_name_not_unique' reference_not_zero: $ref: '#/components/examples/json_409_panui_mgmt_reference_not_zero' access_errors: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/generic_error' examples: auth_unauthorized: $ref: '#/components/examples/json_403_panui_auth_unauthorized' schemas: generic_error: type: object properties: _errors: $ref: '#/components/schemas/error_detail_cause_infos' _request_id: type: string x-examples: {} error_detail_cause_info: type: object title: Cause Info properties: code: type: string message: type: string details: oneOf: - type: string - type: object help: type: string error_detail_cause_infos: type: array items: $ref: '#/components/schemas/error_detail_cause_info' x-examples: {} zone-protection-profiles: type: object properties: id: type: string description: UUID of the resource readOnly: true example: 123e4567-e89b-12d3-a456-426655440000 name: description: The profile name type: string maxLength: 31 description: description: The description of the profile type: string maxLength: 255 flood: type: object properties: tcp_syn: type: object properties: enable: description: Enable protection against SYN floods? type: boolean oneOf: - title: red type: object properties: alarm_rate: description: When the flow exceeds the `alert_rate`` threshold, an alarm is generated. type: integer format: int32 minimum: 0 maximum: 2000000 example: 10000 activate_rate: description: When the flow exceeds the `activate_rate`` threshold, the firewall drops individual SYN packets randomly to restrict the flow. type: integer format: int32 minimum: 0 maximum: 2000000 example: 10000 maximal_rate: description: When the flow exceeds the `maximal_rate` threshold, 100% of incoming SYN packets are dropped. type: integer format: int32 minimum: 0 maximum: 2000000 example: 40000 required: - alarm_rate - activate_rate - maximal_rate - title: syn_cookies type: object properties: alarm_rate: description: When the flow exceeds the `alert_rate`` threshold, an alarm is generated. type: integer format: int32 minimum: 0 maximum: 2000000 example: 10000 activate_rate: description: When the flow exceeds the `activate_rate`` threshold, the firewall drops individual SYN packets randomly to restrict the flow. type: integer format: int32 minimum: 0 maximum: 2000000 example: 0 maximal_rate: description: When the flow exceeds the `maximal_rate` threshold, 100% of incoming SYN packets are dropped. type: integer format: int32 minimum: 0 maximum: 2000000 example: 1000000 required: - alarm_rate - activate_rate - maximal_rate udp: type: object properties: enable: description: Enable protection against UDP floods? type: boolean red: type: object properties: alarm_rate: description: The number of UDP packets (not matching an existing session) that the zone receives per second that triggers an attack alarm. type: integer format: int32 minimum: 0 maximum: 2000000 example: 10000 activate_rate: description: The number of UDP packets (not matching an existing session) that the zone receives per second that triggers random dropping of UDP packets. type: integer format: int32 minimum: 0 maximum: 2000000 example: 10000 maximal_rate: description: The maximum number of UDP packets (not matching an existing session) the zone receives per second before packets exceeding the maximum are dropped. type: integer format: int32 minimum: 0 maximum: 2000000 example: 40000 required: - alarm_rate - activate_rate - maximal_rate sctp_init: type: object properties: enable: description: Enable protection against floods of Stream Control Transmission Protocol (SCTP) packets that contain an Initiation (INIT) chunk? type: boolean red: type: object properties: alarm_rate: description: The number of SCTP INIT packets (not matching an existing session) that the zone receives per second that triggers an attack alarm. type: integer format: int32 minimum: 0 maximum: 2000000 example: 10000 activate_rate: description: The number of SCTP INIT packets (not matching an existing session) that the zone receives per second before subsequent SCTP INIT packets are dropped. type: integer format: int32 minimum: 0 maximum: 2000000 example: 10000 maximal_rate: description: The maximum number of SCTP INIT packets (not matching an existing session) that the zone receives per second before packets exceeding the maximum are dropped. type: integer format: int32 minimum: 0 maximum: 2000000 example: 10000 required: - alarm_rate - activate_rate - maximal_rate icmp: type: object properties: enable: description: Enable protection against ICMP floods? type: boolean red: type: object properties: alarm_rate: description: The number of ICMP echo requests (pings not matching an existing session) that the zone receives per second that triggers an attack alarm. type: integer format: int32 minimum: 0 maximum: 2000000 example: 10000 activate_rate: description: The number of ICMP packets (not matching an existing session) that the zone receives per second before subsequent ICMP packets are dropped. type: integer format: int32 minimum: 0 maximum: 2000000 example: 10000 maximal_rate: description: The maximum number of ICMP packets (not matching an existing session) that the zone receives per second before packets exceeding the maximum are dropped. type: integer format: int32 minimum: 0 maximum: 2000000 example: 40000 required: - alarm_rate - activate_rate - maximal_rate icmpv6: type: object properties: enable: description: Enable protection against ICMPv6 floods? type: boolean red: type: object properties: alarm_rate: description: The number of ICMPv6 echo requests (pings not matching an existing session) that the zone receives per second that triggers an attack alarm. type: integer format: int32 minimum: 0 maximum: 2000000 example: 10000 activate_rate: description: The number of ICMPv6 packets (not matching an existing session) that the zone receives per second before subsequent ICMPv6 packets are dropped. type: integer format: int32 minimum: 0 maximum: 2000000 example: 10000 maximal_rate: description: The maximum number of ICMPv6 packets (not matching an existing session) that the zone receives per second before packets exceeding the maximum are dropped. type: integer format: int32 minimum: 0 maximum: 2000000 example: 40000 required: - alarm_rate - activate_rate - maximal_rate other_ip: type: object properties: enable: description: Enable protection against other IP (non-TCP, non-ICMP, non-ICMPv6, non-SCTP, and non-UDP) floods? type: boolean red: type: object properties: alarm_rate: type: integer format: int32 minimum: 0 maximum: 2000000 example: 10000 activate_rate: type: integer format: int32 minimum: 0 maximum: 2000000 example: 10000 maximal_rate: type: integer format: int32 minimum: 0 maximum: 2000000 example: 40000 required: - alarm_rate - activate_rate - maximal_rate scan: type: array items: type: object properties: name: description: 'The threat ID number. These can be found in [Palo Alto Networks ThreatVault](https://threatvault.paloaltonetworks.com). * "8001" - TCP Port Scan * "8002" - Host Sweep * "8003" - UDP Port Scan * "8006" - Port Scan ' type: string enum: - '8001' - '8002' - '8003' - '8006' action: type: object oneOf: - title: allow type: object - title: alert type: object - title: block type: object - title: block_ip type: object properties: track_by: type: string enum: - source-and-destination - source duration: type: integer format: int32 minimum: 1 maximum: 3600 required: - track_by - duration interval: type: integer format: int32 minimum: 2 maximum: 65535 example: 2 threshold: type: integer format: int32 minimum: 2 maximum: 65535 example: 100 required: - name scan_white_list: type: array items: type: object properties: name: description: A descriptive name for the address to exclude. type: string oneOf: - title: ipv4 type: string format: ipv4 - title: ipv6 type: string format: ipv6 required: - name spoofed_ip_discard: description: 'Check that the source IP address of the ingress packet is routable and the routing interface is in the same zone as the ingress interface. If either condition is not true, discard the packet. ' type: boolean strict_ip_check: description: 'Check that both conditions are true: * The source IP address is not the subnet broadcast IP address of the ingress interface. * The source IP address is routable over the exact ingress interface. If either condition is not true, discard the packet. ' type: boolean fragmented_traffic_discard: description: 'Discard fragmented IP packets. ' type: boolean strict_source_routing_discard: description: 'Discard packets with the Strict Source Routing IP option set. Strict Source Routing is an option whereby a source of a datagram provides routing information through which a gateway or host must send the datagram. ' type: boolean loose_source_routing_discard: description: 'Discard packets with the Loose Source Routing IP option set. Loose Source Routing is an option whereby a source of a datagram provides routing information and a gateway or host is allowed to choose any route of a number of intermediate gateways to get the datagram to the next address in the route. ' type: boolean timestamp_discard: description: 'Discard packets with the Timestamp IP option set. ' type: boolean record_route_discard: description: 'Discard packets with the Record Route IP option set. When a datagram has this option, each router that routes the datagram adds its own IP address to the header, thus providing the path to the recipient. ' type: boolean security_discard: description: 'Discard packets if the security option is defined. ' type: boolean stream_id_discard: description: 'Discard packets if the Stream ID option is defined. ' type: boolean unknown_option_discard: description: 'Discard packets if the class and number are unknown. ' type: boolean malformed_option_discard: description: 'Discard packets if they have incorrect combinations of class, number, and length based on RFCs 791, 1108, 1393, and 2113. ' type: boolean mismatched_overlapping_tcp_segment_discard: description: 'Drop packets with mismatched overlapping TCP segments. ' type: boolean tcp_handshake_discard: description: 'Drop packets with split handshakes. ' type: boolean tcp_syn_with_data_discard: description: 'Prevent a TCP session from being established if the TCP SYN packet contains data during a three-way handshake. ' type: boolean default: true tcp_synack_with_data_discard: description: 'Prevent a TCP session from being established if the TCP SYN-ACK packet contains data during a three-way handshake. ' type: boolean default: true reject_non_syn_tcp: description: 'Determine whether to reject the packet if the first packet for the TCP session setup is not a SYN packet: * `global` — Use system-wide setting that is assigned through the CLI. * `yes` — Reject non-SYN TCP. * `no` — Accept non-SYN TCP. ' type: string enum: - global - true - false asymmetric_path: description: 'Determine whether to drop or bypass packets that contain out-of-sync ACKs or out-of-window sequence numbers: * `global` — Use system-wide setting that is assigned through TCP Settings or the CLI. * `drop` — Drop packets that contain an asymmetric path. * `bypass` — Bypass scanning on packets that contain an asymmetric path. ' type: string enum: - global - drop - bypass tcp_timestamp_strip: description: 'Determine whether the packet has a TCP timestamp in the header and, if it does, strip the timestamp from the header. ' type: boolean tcp_fast_open_and_data_strip: description: 'Strip the TCP Fast Open option (and data payload, if any) from the TCP SYN or SYN-ACK packet during a TCP three-way handshake. ' type: boolean mptcp_option_strip: description: 'MPTCP is an extension of TCP that allows a client to maintain a connection by simultaneously using multiple paths to connect to the destination host. By default, MPTCP support is disabled, based on the global MPTCP setting. Review or adjust the MPTCP settings for the security zones associated with this profile: * `no` — Enable MPTCP support (do not strip the MPTCP option). * `yes` — Disable MPTCP support (strip the MPTCP option). With this configured, MPTCP connections are converted to standard TCP connections, as MPTCP is backwards compatible with TCP. * `global` — Support MPTCP based on the global MPTCP setting. By default, the global MPTCP setting is set to yes so that MPTCP is disabled (the MPTCP option is stripped from the packet). ' type: string enum: - false - true - global default: global icmp_ping_zero_id_discard: description: 'Discard packets if the ICMP ping packet has an identifier value of 0. ' type: boolean icmp_frag_discard: description: Discard packets that consist of ICMP fragments. type: boolean icmp_large_packet_discard: description: Discard ICMP packets that are larger than 1024 bytes. type: boolean discard_icmp_embedded_error: description: Discard ICMP packets that are embedded with an error message. type: boolean suppress_icmp_timeexceeded: description: Stop sending ICMP TTL expired messages. type: boolean suppress_icmp_needfrag: description: 'Stop sending ICMP fragmentation needed messages in response to packets that exceed the interface MTU and have the do not fragment (DF) bit set. This setting will interfere with the PMTUD process performed by hosts behind the firewall. ' type: boolean ipv6: type: object properties: routing_header_0: description: Drop packets with type 0 routing header. type: boolean routing_header_1: description: Drop packets with type 1 routing header. type: boolean routing_header_3: description: Drop packets with type 3 routing header. type: boolean routing_header_4_252: description: Drop packets with type 4 to type 252 routing header. type: boolean routing_header_253: description: Drop packets with type 253 routing header. type: boolean routing_header_254: description: Drop packets with type 254 routing header. type: boolean routing_header_255: description: Drop packets with type 255 routing header. type: boolean ipv4_compatible_address: description: Discard IPv6 packets that are defined as an RFC 4291 IPv4-Compatible IPv6 address. type: boolean filter_ext_hdr: type: object properties: hop_by_hop_hdr: description: Discard IPv6 packets that contain the Hop-by-Hop Options extension header. type: boolean routing_hdr: description: Discard IPv6 packets that contain the Routing extension header, which directs packets to one or more intermediate nodes on its way to its destination. type: boolean dest_option_hdr: description: Discard IPv6 packets that contain the Destination Options extension, which contains options intended only for the destination of the packet. type: boolean options_invalid_ipv6_discard: description: Discard IPv6 packets that contain invalid IPv6 options in an extension header. type: boolean reserved_field_set_discard: description: Discard IPv6 packets that have a header with a reserved field not set to zero. type: boolean anycast_source: description: Discard IPv6 packets that contain an anycast source address. type: boolean needless_fragment_hdr: description: Discard IPv6 packets with the last fragment flag (M=0) and offset of zero. type: boolean icmpv6_too_big_small_mtu_discard: description: Discard IPv6 packets that contain a Packet Too Big ICMPv6 message when the maximum transmission unit (MTU) is less than 1,280 bytes. type: boolean ignore_inv_pkt: type: object properties: dest_unreach: description: Require an explicit Security policy match for Destination Unreachable ICMPv6 messages, even when the message is associated with an existing session. type: boolean pkt_too_big: description: Require an explicit Security policy match for Packet Too Big ICMPv6 messages, even when the message is associated with an existing session. type: boolean time_exceeded: description: Require an explicit Security policy match for Time Exceeded ICMPv6 messages, even when the message is associated with an existing session. type: boolean param_problem: description: Require an explicit Security policy match for Parameter Problem ICMPv6 messages, even when the message is associated with an existing session. type: boolean redirect: description: Require an explicit Security policy match for Redirect Message ICMPv6 messages, even when the message is associated with an existing session. type: boolean non_ip_protocol: type: object properties: list_type: description: 'Specify the type of list you are creating for protocol protection: * Include List—Only the protocols on the list are allowed—in addition to IPv4 (0x0800), IPv6 (0x86DD), ARP (0x0806), and VLAN tagged frames (0x8100). All other protocols are implicitly denied (blocked). * Exclude List—Only the protocols on the list are denied; all other protocols are implicitly allowed. You cannot exclude IPv4 (0x0800), IPv6 (0x86DD), ARP (0x0806), or VLAN tagged frames (0x8100). ' type: string enum: - exclude - include protocol: type: array items: type: object properties: name: description: 'Enter the protocol name that corresponds to the Ethertype code you are adding to the list. The firewall does not verify that the protocol name matches the Ethertype code but the Ethertype code does determine the protocol filter. ' type: string ether_type: description: 'Enter an Ethertype code (protocol) preceded by 0x to indicate hexadecimal (range is 0x0000 to 0xFFFF). A list can have a maximum of 64 Ethertypes. Some sources of Ethertype codes are: * [IEEE hexadecimal Ethertype](https://www.iana.org/assignments/ieee-802-numbers/ieee-802-numbers.xhtml) * [standards.ieee.org/develop/regauth/ethertype/eth.txt](https://standards-oui.ieee.org/ethertype/eth.txt) * [www.cavebear.com/archive/cavebear/Ethernet/type.html](https://www.cavebear.com/archive/cavebear/Ethernet/type.html) ' type: string enable: description: Enable the Ethertype code on the list. type: boolean required: - name - ether_type l2_sec_group_tag_protection: type: object properties: tags: type: array items: type: object properties: name: description: Name for the list of Security Group Tags (SGTs). type: string tag: description: The Layer 2 SGTs in headers of packets that you want to exclude (drop) when the SGT matches this list in the Zone Protection profile applied to a zone (range is 0 to 65,535). type: string enable: description: Enable this exclude list for Ethernet SGT protection. type: boolean required: - name - tag required: - name oneOf: - type: object title: folder properties: folder: type: string pattern: ^[a-zA-Z\d\-_\. ]+$ maxLength: 64 description: The folder in which the resource is defined example: My Folder required: - folder - type: object title: snippet properties: snippet: type: string pattern: ^[a-zA-Z\d\-_\. ]+$ maxLength: 64 description: The snippet in which the resource is defined example: My Snippet required: - snippet - type: object title: device properties: device: type: string pattern: ^[a-zA-Z\d\-_\. ]+$ maxLength: 64 description: The device in which the resource is defined example: My Device required: - device securitySchemes: scmOAuth: type: oauth2 description: "Strata Cloud Manager APIs authenticate client requests using the \nOAuth 2.0 Client Credentials flow. Please use the `client_id`, \n`client_secret` values associated with an IAM service account along \nwith a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the \nTenant Service Group (TSG) ID. The resulting JWT access token should \nbe attached to all API calls as a `Bearer` token in the `Authorization` \nheader (ex. `Authorization: Bearer tokenstring`).\n" flows: clientCredentials: tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token scopes: tsg_id: Your tenant service group in the form `tsg_id:XXXXXXXXXX` scmToken: type: http description: "Strata Cloud Manager APIs authenticate client requests using the \nOAuth 2.0 Client Credentials flow. Please use the `client_id`, \n`client_secret` values associated with an IAM service account along \nwith a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the \nTenant Service Group (TSG) ID. The resulting JWT access token should \nbe attached to all API calls as a `Bearer` token in the `Authorization` \nheader (ex. `Authorization: Bearer tokenstring`).\n" scheme: bearer bearerFormat: JWT x-internal: false