ForwardingRule

Forwarding rule that determine how to forward traffic from a VM. Traffic from VM can either be routed via Overlay or Underlay when VM is on hybrid port. Additionally NAT can be performed for VM or container on overlay to route traffic to/from underlay ROUTE_TO_UNDERLAY - Access a service on underlay space from a VM connected to hybrid port. Eg access to AWS S3 on AWS underlay ROUTE_TO_OVERLAY - Access a service on overlay space from a VM connected to hybrid port. ROUTE_FROM_UNDERLAY - Access a service hosted on a VM (that is connected to hybrid port) from underlay space. Eg access from AWS ELB to VM ROUTE_FROM_OVERLAY - Access a service hosted on a VM (that is connected to hybrid port) from overlay space NAT_FROM_UNDERLAY - Access a service on overlay VM/container from underlay space using DNAT from underlay IP to overlay IP NAT_TO_UNDERLAY - Access an underlay service from a VM/container on overlay space using SNAT from overlay IP to underlay IP


Properties

integer
_create_time Optional

Timestamp of resource creation


string
_create_user Optional

ID of the user who created this resource


integer
_last_modified_time Optional

Timestamp of last modification


string
_last_modified_user Optional

ID of the user who last modified this resource


array of ResourceLink
_links Optional

The server will populate this field when returing the resource. Ignored on PUT and POST.


string
_protection Optional

Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.


integer
_revision Optional

The _revision property describes the current revision of the resource. To prevent clients from overwriting each other’s changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.


string
_schema Optional

Schema for this resource


_self Optional

Link to this resource


boolean
_system_owned Optional

Indicates system owned resource


string
action Optional

The action to be applied to all the services

Possible values are: ROUTE_TO_UNDERLAYROUTE_TO_OVERLAYROUTE_FROM_UNDERLAYROUTE_FROM_OVERLAYNAT_FROM_UNDERLAYNAT_TO_UNDERLAY


children Optional

subtree for this type within policy tree containing nested elements.


string
description Optional

Description of this resource


array of string
destination_groups Optional

We need paths as duplicate names may exist for groups under different domains.In order to specify all groups, use the constant “ANY”. This is case insensitive. If “ANY” is used, it should be the ONLY element in the group array. Error will be thrown if ANY is used in conjunction with other values.


boolean
destinations_excluded Optional

If set to true, the rule gets applied on all the groups that are NOT part of the destination groups. If false, the rule applies to the destination groups


string
direction Optional

Define direction of traffic.

Possible values are: INOUTIN_OUT


boolean
disabled Optional

Flag to disable the rule. Default is enabled.


string
display_name Optional

Defaults to ID if not set


string
id Optional

Unique identifier of this resource


string
ip_protocol Optional

Type of IP packet that should be matched while enforcing the rule. The value is set to IPV4_IPV6 for Layer3 rule if not specified. For Layer2/Ether rule the value must be null.

Possible values are: IPV4IPV6IPV4_IPV6


boolean
logged Optional

Flag to enable packet logging. Default is disabled.


boolean
marked_for_delete Optional

Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.


string
notes Optional

Text for additional notes on changes.


string
parent_path Optional

Path of its parent


string
path Optional

Absolute path of this object


array of string
profiles Optional

Holds the list of layer 7 service profile paths. These profiles accept attributes and sub-attributes of various network services (e.g. L4 AppId, encryption algorithm, domain name, etc) as key value pairs.


string
relative_path Optional

Path relative from its parent


string
resource_type Optional

The type of this resource.


array of string
scope Optional

The list of policy paths where the rule is applied LR/Edge/T0/T1/LRP etc. Note that a given rule can be applied on multiple LRs/LRPs.


integer
sequence_number Optional

This field is used to resolve conflicts between multiple Rules under Security or Gateway Policy for a Domain If no sequence number is specified in the payload, a value of 0 is assigned by default. If there are multiple rules with the same sequence number then their order is not deterministic. If a specific order of rules is desired, then one has to specify unique sequence numbers or use the POST request on the rule entity with a query parameter action=revise to let the framework assign a sequence number


array of string
services Optional

In order to specify all services, use the constant “ANY”. This is case insensitive. If “ANY” is used, it should be the ONLY element in the services array. Error will be thrown if ANY is used in conjunction with other values.


array of string
source_groups Optional

We need paths as duplicate names may exist for groups under different domains. In order to specify all groups, use the constant “ANY”. This is case insensitive. If “ANY” is used, it should be the ONLY element in the group array. Error will be thrown if ANY is used in conjunction with other values.


boolean
sources_excluded Optional

If set to true, the rule gets applied on all the groups that are NOT part of the source groups. If false, the rule applies to the source groups


string
tag Optional

User level field which will be printed in CLI and packet logs.


array of Tag
tags Optional

Opaque identifiers meaningful to the API user

JSON Example

{
    "_create_time": 0,
    "_create_user": "string",
    "_last_modified_time": 0,
    "_last_modified_user": "string",
    "_links": [
        {
            "action": "string",
            "href": "string",
            "rel": "string"
        }
    ],
    "_protection": "string",
    "_revision": 0,
    "_schema": "string",
    "_self": {
        "action": "string",
        "href": "string",
        "rel": "string"
    },
    "_system_owned": false,
    "action": "string",
    "children": [
        {
            "_create_time": 0,
            "_create_user": "string",
            "_last_modified_time": 0,
            "_last_modified_user": "string",
            "_links": [
                {
                    "action": "string",
                    "href": "string",
                    "rel": "string"
                }
            ],
            "_protection": "string",
            "_revision": 0,
            "_schema": "string",
            "_self": {
                "action": "string",
                "href": "string",
                "rel": "string"
            },
            "_system_owned": false,
            "description": "string",
            "display_name": "string",
            "id": "string",
            "marked_for_delete": false,
            "resource_type": "string",
            "tags": [
                {
                    "scope": "string",
                    "tag": "string"
                }
            ]
        }
    ],
    "description": "string",
    "destination_groups": [
        "string"
    ],
    "destinations_excluded": false,
    "direction": "string",
    "disabled": false,
    "display_name": "string",
    "id": "string",
    "ip_protocol": "string",
    "logged": false,
    "marked_for_delete": false,
    "notes": "string",
    "parent_path": "string",
    "path": "string",
    "profiles": [
        "string"
    ],
    "relative_path": "string",
    "resource_type": "string",
    "scope": [
        "string"
    ],
    "sequence_number": 0,
    "services": [
        "string"
    ],
    "source_groups": [
        "string"
    ],
    "sources_excluded": false,
    "tag": "string",
    "tags": [
        {
            "scope": "string",
            "tag": "string"
        }
    ]
}
Feedback

Was this page helpful?