Developer Documentation

ForwardingRule

Forwarding rule that determine how to forward traffic from a VM. Traffic from VM can either be routed via Overlay or Underlay when VM is on hybrid port. Additionally NAT can be performed for VM or container on overlay to route traffic to/from underlay ROUTE_TO_UNDERLAY - Access a service on underlay space from a VM connected to hybrid port. Eg access to AWS S3 on AWS underlay ROUTE_TO_OVERLAY - Access a service on overlay space from a VM connected to hybrid port. ROUTE_FROM_UNDERLAY - Access a service hosted on a VM (that is connected to hybrid port) from underlay space. Eg access from AWS ELB to VM ROUTE_FROM_OVERLAY - Access a service hosted on a VM (that is connected to hybrid port) from overlay space NAT_FROM_UNDERLAY - Access a service on overlay VM/container from underlay space using DNAT from underlay IP to overlay IP NAT_TO_UNDERLAY - Access an underlay service from a VM/container on overlay space using SNAT from overlay IP to underlay IP


Properties

Required Property Name Type Description
optional _create_time integer

Timestamp of resource creation

optional _create_user string

ID of the user who created this resource

optional _last_modified_time integer

Timestamp of last modification

optional _last_modified_user string

ID of the user who last modified this resource

optional _links array of ResourceLink

The server will populate this field when returing the resource. Ignored on PUT and POST.

optional _protection string

Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.

optional _revision integer

The _revision property describes the current revision of the resource. To prevent clients from overwriting each other’s changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.

optional _schema string

Schema for this resource

optional _self SelfResourceLink

Link to this resource

optional _system_owned boolean

Indicates system owned resource

optional action string

The action to be applied to all the services

optional children array of ChildPolicyConfigResource

subtree for this type within policy tree containing nested elements.

optional description string

Description of this resource

optional destination_groups array of string

We need paths as duplicate names may exist for groups under different domains.In order to specify all groups, use the constant “ANY”. This is case insensitive. If “ANY” is used, it should be the ONLY element in the group array. Error will be thrown if ANY is used in conjunction with other values.

optional destinations_excluded boolean

If set to true, the rule gets applied on all the groups that are NOT part of the destination groups. If false, the rule applies to the destination groups

optional direction string

Define direction of traffic.

optional disabled boolean

Flag to disable the rule. Default is enabled.

optional display_name string

Defaults to ID if not set

optional id string

Unique identifier of this resource

optional ip_protocol string

Type of IP packet that should be matched while enforcing the rule. The value is set to IPV4_IPV6 for Layer3 rule if not specified. For Layer2/Ether rule the value must be null.

optional logged boolean

Flag to enable packet logging. Default is disabled.

optional marked_for_delete boolean

Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.

optional notes string

Text for additional notes on changes.

optional parent_path string

Path of its parent

optional path string

Absolute path of this object

optional profiles array of string

Holds the list of layer 7 service profile paths. These profiles accept attributes and sub-attributes of various network services (e.g. L4 AppId, encryption algorithm, domain name, etc) as key value pairs.

optional relative_path string

Path relative from its parent

optional resource_type string

The type of this resource.

optional scope array of string

The list of policy paths where the rule is applied LR/Edge/T0/T1/LRP etc. Note that a given rule can be applied on multiple LRs/LRPs.

optional sequence_number integer

This field is used to resolve conflicts between multiple Rules under Security or Gateway Policy for a Domain If no sequence number is specified in the payload, a value of 0 is assigned by default. If there are multiple rules with the same sequence number then their order is not deterministic. If a specific order of rules is desired, then one has to specify unique sequence numbers or use the POST request on the rule entity with a query parameter action=revise to let the framework assign a sequence number

optional services array of string

In order to specify all services, use the constant “ANY”. This is case insensitive. If “ANY” is used, it should be the ONLY element in the services array. Error will be thrown if ANY is used in conjunction with other values.

optional source_groups array of string

We need paths as duplicate names may exist for groups under different domains. In order to specify all groups, use the constant “ANY”. This is case insensitive. If “ANY” is used, it should be the ONLY element in the group array. Error will be thrown if ANY is used in conjunction with other values.

optional sources_excluded boolean

If set to true, the rule gets applied on all the groups that are NOT part of the source groups. If false, the rule applies to the source groups

optional tag string

User level field which will be printed in CLI and packet logs.

optional tags array of Tag

Opaque identifiers meaningful to the API user

Feedback

Was this page helpful?