If a BfdProfile with the bfd-profile-id is not already present,
create a new BfdProfile. If it already exists, update the
BfdProfile. This operation will fully replace the object.
If a BfdProfile with the bfd-profile-id is not already present,
create a new BfdProfile. If it already exists, update the
BfdProfile. This operation will fully replace the object.
If DHCP relay config with the dhcp-relay-config-id is not already present, create a new DHCP relay config instance.
If it already exists, update the DHCP relay config instance with specified attributes.
If DHCP relay config with the dhcp-relay-config-id is not already present,
create a new DHCP relay config instance. If it already exists, replace
the DHCP relay config instance with this object.
Reset DHCP statistics counters of a DHCP server represented by the
connectivity_path and the enforecement_point_path where the
dhcp-server-config was applied to. The connectivity_path can be the Tier0
path, Tier1 path or a segment path. If the given Tier0/1 or Segment has
DHCP server applied, the resetting will succeed and the DHCP statistics
counters will be reset to 0. But if it has no DHCP server applied, the
reseting will fail with proper error message.
If DHCP server config with the dhcp-server-config-id is not already
present, create a new DHCP server config instance. If it already exists,
update the DHCP server config instance with specified attributes.
Realized entities of this API can be found using the path of Tier-0, Tier1,
or Segment where this config is applied on.
Modification of edge_cluster_path in DhcpServerConfig will lose all
existing DHCP leases.
If both the preferred_edge_paths in the DhcpServerConfig are changed
in a same PATCH API, e.g. change from [a,b] to [x,y], the current DHCP
server leases will be lost, which could cause network connectivity
issues. It is recommended to change only one member index in an update
call, e.g. from [a, b] to [a,y].
Clearing preferred_edge_paths will not reassign edge nodes from the
edge cluster. Instead, the previously-allocated edge nodes will be
retained to avoid loss of leases.
If DHCP server config with the dhcp-server-config-id is not already
present, create a new DHCP server config instance. If it already exists,
replace the DHCP server config instance with this object.
Realized entities of this API can be found using the path of Tier-0, Tier1,
or Segment where this config is applied on.
Modification of edge_cluster_path in DhcpServerConfig will lose all
existing DHCP leases.
If both the preferred_edge_paths in the DhcpServerConfig are changed
in a same PUT API, e.g. change from [a,b] to [x,y], the current DHCP
server leases will be lost, which could cause network connectivity
issues. It is recommended to change only one member index in an update
call, e.g. from [a, b] to [a,y].
Clearing preferred_edge_paths will not reassign edge nodes from the
edge cluster. Instead, the previously-allocated edge nodes will be
retained to avoid loss of leases.
Create or update the forwarding policy.
Performance Note: If you want to edit several rules in a forwarding policy
use this API. It will perform better than several individual rule APIs.
Just pass all the rules which you wish to edit as embedded rules to it.
Create or update the forwarding policy.
Performance Note: If you want to edit several rules in a forwarding policy
use this API. It will perform better than several individual rule APIs.
Just pass all the rules which you wish to edit as embedded rules to it.
Get aggregated statistics of Forwarding Policy Rule.
Stats include total number of packets and total number of bytes for the rule.
- no enforcement point path specified: Stats will be evaluated on each enforcement
point.
- {enforcement_point_path}: Stats are evaluated only on the given enforcement point
Create a rule with the rule-id is not already present,
otherwise update the rule.
Performance Note: If you want to edit several rules in a forwarding policy,
prefer below mentioned API for optimal performance.
Pass all the rules which you wish to edit as embedded rules to it.
Use this API - PATCH (or PUT)
/infra/domains/<domain-id>/forwarding-policies/<forwarding-policy-id>
Create a rule with the rule-id is not already present,
otherwise update the rule.
Performance Note: If you want to edit several rules in a forwarding policy,
prefer below mentioned API for optimal performance.
Pass all the rules which you wish to edit as embedded rules to it.
Use this API - PATCH (or PUT)
/infra/domains/<domain-id>/forwarding-policies/<forwarding-policy-id>
Get aggregated stattistics of Forwarding Policy.
Stats include total number of packets and total number of bytes for all
Forwarding rules in a given Forwarding Policy.
- no enforcement point path specified: Stats will be evaluated on each enforcement
point.
- {enforcement_point_path}: Stats are evaluated only on the given enforcement point.
Sets Forwarding Policy rule statistics counter to zero.
- no enforcement point path specified: Reset of stats will be executed for
each enforcement point.
- {enforcement_point_path}: Reset of stats will be executed only for the given
enforcement point.
If profile with the qos-profile-id is not already present,
create a new gateway QoS profile instance. If it already exists, update
the gateway QoS profile instance with specified attributes.
If profile with the qos-profile-id is not already present,
create a new gateway QoS profile instance. If it already exists, replace
the gateway QoS profile instance with this object.
This rest routine is deprecated. Use /infra/connectivity-global-config for Connectivity global config and
/infra/ops-global-config for Operations global config.
Read global configuration.
This rest routine is deprecated. Use /infra/connectivity-global-config for Connectivity global config and
/infra/ops-global-config for Operations global config.
Update the global configuration.
Creates a new IpAddressBlock with specified ID if not already present.
If IpAddressBlock of given ID is already present, then the instance is
updated with specified attributes.
Create a new IpAddressBlock with given ID if it does not exist.
If IpAddressBlock with given ID already exists, it will update existing instance.
This is a full replace.
Creates a new IpAddressPool with specified ID if not already present.
If IpAddressPool of given ID is already present, then the instance is
updated. This is a full replace.
Create a new IpAddressPool with given ID if it does not exist.
If IpAddressPool with given ID already exists, it will update existing instance.
This is a full replace.
Records intent to allocate an IP Address from an IP Pool
If allocation of the same ID is found, this is a no-op. If no allocation
of the specified ID is found, then a new allocation is created.
An allocation cannot be updated once created.
When an allocation is requested from an IpAddressPool, the IP could be
allocated from any subnet in the pool that has the available capacity.
Request to allocate an IP will fail if no subnet was previously created.
If specific IP was requested, the status of allocation is reflected in the
realized state.
If any IP is requested, the IP finally allocated is obtained by polling on
the realized state until the allocated IP is returned in the extended
attributes.
Records intent to allocate an IP Address from an IP Pool
If allocation of the same ID is found, this is a no-op. If no allocation
of the specified ID is found, then a new allocation is created.
An allocation cannot be updated once created.
When an IP allocation is requested from an IpAddressPool, the IP could be
allocated from any subnet in the pool that has the available capacity.
Request to allocate an IP will fail if no subnet was previously created.
If specific IP was requested, the status of allocation is reflected in the
realized state.
If any IP is requested, the IP finally allocated is obtained by polling on
the realized state until the allocated IP is returned in the extended
attributes.
An allocation cannot be updated once created.
Creates a new IpAddressPoolSubnet with the specified ID if it does not
already exist. If a IpAddressPoolSubnet of the given ID already exists,
IpAddressPoolSubnet will be updated. This is a full replace.
Creates a new IpAddressPoolSubnet with the specified ID if it does not
already exist. If a IpAddressPoolSubnet of the given ID already exists,
IpAddressPoolSubnet will be updated. This is a full replace.
Create or patch dead peer detection (DPD) profile. Any change in profile affects all sessions consuming this profile. System will be provisioned with system owned editable default DPD profile. Any change in profile affects all sessions consuming this profile.
Create or fully replace a custom IPSec tunnel Profile
Create or patch dead peer detection (DPD) profile. Any change in profile affects all sessions consuming this profile. System will be provisioned with system owned editable default DPD profile. Any change in profile affects all sessions consuming this profile. Revision is optional for creation and required for update.
Create or patch a custom internet key exchange (IKE) Profile
Create or patch custom internet key exchange (IKE) Profile. IKE Profile is a reusable profile that captures IKE and phase one negotiation parameters. System will be pre provisioned with system owned editable default IKE profile and suggested set of profiles that can be used for peering with popular remote peers like AWS VPN. User can create custom profiles as needed. Any change in profile affects all sessions consuming this profile.
Create or fully replace a custom internet key exchange (IKE) Profile
Create or fully replace custom internet key exchange (IKE) Profile. IKE Profile is a reusable profile that captures IKE and phase one negotiation parameters. System will be pre provisioned with system owned editable default IKE profile and suggested set of profiles that can be used for peering with popular remote peers like AWS VPN. User can create custom profiles as needed. Any change in profile affects all sessions consuming this profile. Revision is optional for creation and required for update.
Create or patch custom IPSec tunnel profile. IPSec tunnel profile is a reusable profile that captures phase two negotiation parameters and tunnel properties. System will be provisioned with system owned editable default IPSec tunnel profile. Any change in profile affects all sessions consuming this profile.
Create or fully replace a custom IPSec tunnel Profile
Create or fully replace custom IPSec tunnel profile. IPSec tunnel profile is a reusable profile that captures phase two negotiation parameters and tunnel properties. System will be provisioned with system owned editable default IPSec tunnel profile. Any change in profile affects all sessions consuming this profile. Revision is optional for creation and required for update.
If profile with the dad-profile-id is not already present,
create a new IPv6 DAD profile instance. If it already exists, update
the IPv6 DAD profile instance with specified attributes.
If profile with the dad-profile-id is not already present,
create a new IPv6 DAD profile instance. If it already exists, replace
the IPv6 DAD profile instance with this object.
If profile with the ndra-profile-id is not already present,
create a new IPv6 NDRA profile instance. If it already exists, update
the IPv6 NDRA profile instance with specified attributes.
If profile with the ndra-profile-id is not already present,
create a new IPv6 NDRA profile instance. If it already exists, replace
the IPv6 NDRA profile instance with this object.
Delete LBAppProfile and all the entities contained by this LBAppProfile
Delete the LBAppProfile along with all the entities contained
by this LBAppProfile.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
If a LBAppProfile with the lb-app-profile-id is not already present, create
a new LBAppProfile. If it already exists, update the LBAppProfile. This
is a full replace.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
If a LBAppProfile with the lb-app-profile-id is not already present, create
a new LBAppProfile. If it already exists, update the LBAppProfile. This
is a full replace.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
If a LBClientSslProfile with the lb-client-ssl-profile-id is not already
present, create a new LBClientSslProfile. If it already exists, update the
LBClientSslProfile. This is a full replace.
If a LBClientSslProfile with the lb-client-ssl-profile-id is not already
present, create a new LBClientSslProfile. If it already exists, update the
LBClientSslProfile. This is a full replace.
If a LBMonitorProfile with the lb-monitor-profile-id is not
already present, create a new LBMonitorProfile. If it already exists,
update the LBMonitorProfile. This is a full replace.
If a LBMonitorProfile with the lb-monitor-profile-id is not
already present, create a new LBMonitorProfile. If it already exists,
update the LBMonitorProfile. This is a full replace.
API is used to retrieve node usage for load balancer which contains basic
information, LB entity usages and capacities for the given node.
Currently only edge node is supported.
The parameter ?node_path=<node-path> is required. For example, ?node_path=
/infra/sites/default/enforcement-points/default/edge-clusters/
85175e0b-4d74-461d-83e1-f3b785adef9c/edge-nodes/
86e077c0-449f-11e9-87c8-02004eb37029.
The API is used to retrieve the load balancer node usage summary of all
nodes for every enforcement point.
- If the parameter ?include_usages=true exists, the property node_usages
are included in response. By default, the property node_usages is not
included in response.
- If parameter ?enforcement_point_path=<enforcement-point-path> exists,
only node usage summary from specific enforcement point is included
in response. If no enforcement point path is specified, information will
be aggregated from each enforcement point.
Paginated list of all LBPersistenceProfiles for infra.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
Delete LBPersistenceProfile and all the entities contained by this LBPersistenceProfile
Delete the LBPersistenceProfile along with all the entities
contained by this LBPersistenceProfile.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
If a LBPersistenceProfile with the lb-persistence-profile-id is not
already present, create a new LBPersistenceProfile. If it already exists,
update the LBPersistenceProfile. This is a full replace.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
If a LBPersistenceProfile with the lb-persistence-profile-id is not
already present, create a new LBPersistenceProfile. If it already exists,
update the LBPersistenceProfile. This is a full replace.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
Delete LBPool and all the entities contained by this LBPool
Delete the LBPool along with all the entities contained
by this LBPool.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
If a LBPool with the lb-pool-id is not already present,
create a new LBPool. If it already exists, update the
LBPool. This is a full replace.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
If a LBPool with the lb-pool-id is not already present,
create a new LBPool. If it already exists, update the
LBPool. This is a full replace.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
If a LBServerSslProfile with the lb-server-ssl-profile-id is not already
present, create a new LBServerSslProfile. If it already exists, update the
LBServerSslProfile. This is a full replace.
If a LBServerSslProfile with the lb-server-ssl-profile-id is not already
present, create a new LBServerSslProfile. If it already exists, update the
LBServerSslProfile. This is a full replace.
API is used to retrieve the load balancer usage summary for
all load balancer services.
If the parameter ?include_usages=true exists, the property service-usages
is included in the response. By default, service-usages is not included
in the response.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
Delete LBService and all the entities contained by this LBService
Delete the LBService along with all the entities contained by
this LBService.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
If a LBService with the lb-service-id is not already
present, create a new LBService. If it already exists, update the
LBService. This is a full replace.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
If a LBService with the lb-service-id is not already
present, create a new LBService. If it already exists, update the
LBService. This is a full replace.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
Read the debug information of the load balancer service
API to download below information which will be used for debugging and
troubleshooting.
1) Load balancer service
2) Load balancer associated virtual servers
3) Load balancer associated pools
4) Load balancer associated profiles such as persistence, SSL, application.
5) Load balancer associated monitors
Get LBService detailed status information.
- no enforcement point path specified: Information will be aggregated from
each enforcement point.
- {enforcement_point_path}: Information will be retrieved only from the
given enforcement point.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
Get LBPool detailed status information.
- no enforcement point path specified: Information will be aggregated from
each enforcement point.
- {enforcement_point_path}: Information will be retrieved only from the
given enforcement point.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
Get LBPoolStatistics information.
- no enforcement point path specified: Information will be aggregated from
each enforcement point.
- {enforcement_point_path}: Information will be retrieved only from the
given enforcement point.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
Get LBVirtualServer detailed status information.
- no enforcement point path specified: Information will be aggregated from
each enforcement point.
- {enforcement_point_path}: Information will be retrieved only from the
given enforcement point.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
Get LBVirtualServerStatistics information.
- no enforcement point path specified: Information will be aggregated from
each enforcement point.
- {enforcement_point_path}: Information will be retrieved only from the
given enforcement point.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
Get LBServiceUsage information.
- no enforcement point path specified: Information will be aggregated from
each enforcement point.
- {enforcement_point_path}: Information will be retrieved only from the
given enforcement point.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
Get LBServiceStatistics information.
- no enforcement point path specified: Information will be aggregated from
each enforcement point.
- {enforcement_point_path}: Information will be retrieved only from the
given enforcement point.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
Delete LBVirtualServer and all the entities contained by this LBVirtualServer.
Delete the LBVirtualServer along with all the entities contained by
this LBVirtualServer.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
If a LBVirtualServer with the lb-virtual-server-id is not already
present, create a new LBVirtualServer. If it already exists, update the
LBVirtualServer. This is a full replace.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
If a LBVirtualServer with the lb-virtual-server-id is not already
present, create a new LBVirtualServer. If it already exists, update the
LBVirtualServer. This is a full replace.
This API is deprecated for the NSX-T Load Balancer, but not for the NSX-T Distributed Load Balancer.
Create a new QoS profile if the QoS profile with
given id does not already exist. If the QoS profile with the
given id already exists, patch with the existing QoS profile.
If prefix list for prefix-list-id is not already present, create
a prefix list. If it already exists, patch prefix list for prefix-list-id.
Note:
Patching existing prefix-list's "prefixes" property will overwrite the existing prefixes.
GET and PATCH is the expected set of operations to update or append new entries to the existig prefixes.
Patching existing prefixes require order to be preserved to avoid traffic impact. During PATCH operation,
reordering of existing prefixes may impact routes and eventually datapath.
Order here is crucial and it all depends upon action. If action for every prefix is PERMIT then order may
not impact but if there is DENY prefix then change in ordering could lead to traffic impact.
If prefix list for prefix-list-id is not already present, create
a prefix list. If it already exists, replace the prefix list for
prefix-list-id.
Note:
Updating existing prefixes require order to be preserved to avoid traffic impact. During PATCH operation,
reordering of existing prefixes may impact routes and eventually datapath.
Order here is crucial and it all depends upon action. If action for every prefix is PERMIT then order may
not impact but if there is DENY prefix then change in ordering could lead to traffic impact.
Create or patch a route filter. This will create a mapping of projects to prefix lists. Prefix lists will be
applied to all T-1 under the specified projects.
Create a new segment security profile if the segment security profile with given id does not
exist. Otherwise, PATCH the existing segment security profile
Read infra segment
Note:
Extended Segment: Please note that old vpn path deprecated. If user specify old l2vpn path in the
"l2_extension" object in the PATCH API payload, the path returned in the GET response payload may include the new path
instead of the deprecated l2vpn path. Both old and new l2vpn path refer to same resource. there is no functional impact.
Also note that l2vpn path included in the error messages returned from validation may include the new VPN path
instead of the deprecated l2vpn path. Both new path and old vpn path refer to same resource.
Delete one or multiple DHCP lease(s) specified by IP and MAC.
If there is a DHCP server running upon the given segment, or this segment
is using a DHCP server running in its connected Tier-0 or Tier-1, the DHCP
lease(s) which match exactly the IP address and the MAC address will be
deleted. If no such lease matches, the deletion for this lease will be
ignored.
The DHCP lease to be deleted will be removed by the system from both active
and standby node. The system will report error if the DHCP lease could not
be removed from both nodes. If the DHCP lease could not be removed on either
node, please check the DHCP server status. Once the DHCP server status is
UP, please invoke the deletion API again to ensure the lease gets deleted
from both nodes.
If segment with the segment-id is not already present, create a new segment.
If it already exists, replace the segment with this object.
Note:
Extended Segment: Please note that old vpn path deprecated. If user specify old l2vpn path in the
"l2_extension" object in the PATCH API payload, the path returned in the GET response payload may include the new path
instead of the deprecated l2vpn path. Both old and new l2vpn path refer to same resource. there is no functional impact.
Also note that l2vpn path included in the Alarm, GPRR, error messages returned from validation may include the new VPN path
instead of the deprecated l2vpn path. Both new path and old vpn path refer to same resource.
If segment with the segment-id is not already present, create a new segment.
If it already exists, replace the segment with this object.
Force parameter is required when workload connectivity is indirectly impacted
with the current replacement.
Note:
Extended Segment: Please note that old vpn path deprecated. If user specify old l2vpn path in the
"l2_extension" object in the PATCH API payload, the path returned in the GET response payload may include the new path
instead of the deprecated l2vpn path. Both old and new l2vpn path refer to same resource. there is no functional impact.
Also note that l2vpn path included in the Alarm, GPRR, error messages returned from validation may include the new VPN path
instead of the deprecated l2vpn path. Both new path and old vpn path refer to same resource.
Get ARP table from segment interface (downlink) in CSV format
Returns ARP table (IPv4) or Neighbor Discovery table (IPv6) in CSV format for the
interface (downlink) attaching segment to tier-0/tier-1 gateway, on a edge
node specified in edge_path parameter.
The edge_path parameter is mandatory.
Returns ARP table (IPv4) or Neighbor Discovery table (IPv6) for the
interface (downlink) attaching segment to tier-0/tier-1 gateway, on a edge
node specified in edge_path parameter.
The edge_path parameter is mandatory.
If binding with the binding-id is not already present,
create a new DHCP static binding instance. If it already exists, replace
the existing DHCP static binding instance with specified attributes.
If binding with the binding-id is not already present,
create a new DHCP static binding instance. If it already exists, replace
the existing DHCP static binding instance with this object.
Delete an infra segment port by giving ID. Please note that this operation will not delete
the segment port from vCenter Server if the port was connected to a Virtual Machine.
Please connect Virtual Machine to another network for the segment port to be deleted
from vCenter Server.
Create an infra segment port if it does not exist based on the IDs, or update existing port
information by replacing the port object fields which presents in the request body.
Patch infra segment port security profile binding map
Create a new port security profile binding map if the given security profile
binding map does not exist. Otherwise, patch the existing port security
profile binding map.
For objects with no binding maps, default profile is applied.
Patch the infra segment connection binding map. If binding map corresponding to the the given values is
not present, the object will get created and if it is present it will be
updated. This is a full replace.
Patch the infra segment connection binding map. If binding map corresponding to the the given values is
not present, the object will get created and if it is present it will be
updated. This is a full replace.
Create a new segment security profile binding map if the given security
profile binding map does not exist. Otherwise, patch the existing segment
security profile binding map.
For objects with no binding maps, default profile is applied.
API will create or update L2 bridge profile with ID profile-id.
L2 Bridge profile is only allowed under an enforcement-point with path
/infra/sites/default/enforcement-points/default.
API will create or update L2 bridge profile with ID profile-id.
L2 Bridge profile is only allowed under an enforcement-point with path
/infra/sites/default/enforcement-points/default.
API to recover specified Tier0 gateway and linked tier1 gateway from
primary site path to new primary site path. This will update intent of
affected Tier-0 and Tier-1 gateway.
Reprocess Tier0 gateway configuration and publish updates to NSX controller
Reprocess Tier0 gateway configuration and configuration of related entities like Tier0 interfaces
and static routes, etc. Any missing Updates are published to NSX controller.
If a community list with the community-list-id is not already present,
create a new community list. If it already exists, update the community
list for specified attributes.
If a community list with the community-list-id is not already present,
create a new community list. If it already exists, replace the community
list instance with the new object.
Return the given count of recent failed DNS queries from DNS forwarder.
Since the DNS forwarder is running in Active/Standby HA mode on transport
nodes, the given count of queries will be returned from each nodes. Hence
the total queries returned could be doubled.
If no count is specified, 100 recent failed queries are returned. If the
recent failures is less than the given count, all the failures will be
returned. The maximum count is 1,000.
Resolve a given address via the dns forwarder at Tier0
Query the nameserver for an ip-address or a FQDN of the given an address optionally using
an specified DNS server. If the address is a fqdn, nslookup will resolve ip-address with it.
If the address is an ip-address, do a reverse lookup and answer fqdn(s).
If enforcement point is specified, then DNS forwarder nslookup answer will get fetched from
specified enforcement point. Otherwise from all enforcement points.
Get statistics of tier-0 DNS forwarder.
- no enforcement point path specified: Statistics will be evaluated on each enforcement
point.
- {enforcement_point_path}: Statistics are evaluated only on the given enforcement point.
Get current status of tier-0 DNS forwarder.
- no enforcement point path specified: Status will be evaluated on each enforcement
point.
- {enforcement_point_path}: Status will be evaluated only on the given enforcement
point.
Create or fully replace IPSec VPN local endpoint
for a given ipsec vpn service under Tier-0.
Revision is optional for creation and required for update.
Get IPSec VPN session detailed status under Tier-0
- no enforcement point path specified: detailed status is evaluated on each enforcement point.
- an enforcement point path is specified: detailed status is evaluated only on the given
enforcement point.
- source=realtime: detailed status is fetched realtime from the enforcement point.
- source=cached: cached detailed status from enforcement point is returned.
- no enforcement point path specified: statistics are evaluated on each enforcement point.
- an enforcement point path is specified: statistics are evaluated only on the given
enforcement point.
- source=realtime: statistics are fetched realtime from the enforcement point.
- source=cached: cached statistics are not supported for IPSec VPN session statistics.
Statistics will always be fetched realtime even if source=cached.
Delete L2VPN session under Tier-0. When L2VPN Service is in CLIENT Mode, the L2VPN Session is deleted along with its transpot tunnels and related resources.
Create or patch an L2VPN session under Tier-0 from Peer Codes
Create or patch an L2VPN session under Tier-0 from Peer Codes.
In addition to the L2VPN Session, the IPSec VPN Session, along
with the IKE, Tunnel, and DPD Profiles are created and owned by
the system. IPSec VPN Service and Local Endpoint are created only
when required, i.e., an IPSec VPN Service does not already exist,
or an IPSec VPN Local Endpoint with same local address does not
already exist.
Updating the L2VPN Session can be performed only through this API
by specifying new peer codes. Use of specific APIs to update the
L2VPN Session and the different resources associated with it is
not allowed, except for IPSec VPN Service and Local Endpoint,
resources that are not system owned.
API supported only when L2VPN Service is in Client Mode.
Create or fully replace L2VPN session under Tier-0
Create or fully replace L2VPN session under Tier-0. API supported
only when L2VPN Service is in Server Mode.
Revision is optional for creation and required for update.
- no enforcement point path specified: detailed tatus is evaluated on each enforcement point.
- an enforcement point path is specified: detailed status is evaluated only on the given
enforcement point.
- source=realtime: detailed tatus is fetched realtime from the enforcement point.
- source=cached: cached detailed status is returned.
Get Tier-0 L2VPN session configuration for the peer site
Get peer config for the Tier-0 L2VPN session to configure the remote
side of the tunnel.
- no enforcement point path specified: L2VPN Session Peer Codes
will be evaluated on each enforcement point.
- enforcement point paths specified: L2VPN Session Peer Codes
are evaluated only on the given enforcement points.
API supported only when L2VPN Service is in Server Mode.
Returns L2Vpn session remote macs for a logical switch.
Data is fetched from enforcement point.
This API is deprecated. Please use GET /infra/tier-0s/<tier-0-id>/ipsec-vpn-services/<service-id>/
sessions/<session-id>/detailed-status instead.
- no enforcement point path specified: statistics are evaluated on each enforcement point.
- an enforcement point path is specified: statistics are evaluated only on the given
enforcement point.
- source=realtime: statistics are fetched realtime from the enforcement point.
- source=cached: cached statistics from the enforcement point are returned.
If BGP neighbor config with the neighbor-id is not already present, create a new
neighbor config. If it already exists, replace the BGP neighbor config with this object.
If BGP neighbor config with the neighbor-id is not already present, create a new
neighbor config. If it already exists, replace the BGP neighbor config with this object.
Returns routes advertised by BGP neighbor from all edge transport nodes on which
this neighbor is currently enabled.
The query parameter "source=cached" is not supported.
Returns routes advertised by BGP neighbor from all edge transport nodes on which
this neighbor is currently enabled in CSV format. Routes from all enforcement points are returned.
Returns routes learned by BGP neighbor from all edge nodes on which
this neighbor is currently enabled. Routes from all enforcement points are returned.
Returns the status of all the BGP neighbors for the given Tier0.
To get BGP neighbor status for a particular enforcement point,
parameter "enforcement_point_path=<enforcement_point_path>" needs to be specified.
If an enforcement_point is unspecified, then bgp neighbor status for all enforcement points is fetched.
To get BGP neighbors status for the logical router from particular edge node,
parameter "edge_path=<edge_path>" needs to be specified.
If an edge_path is unspecified, then bgp neighbor status for all edges is fetched.
If BGP troubleshoot config is not present in BGP configuration, create a new BGP
troubleshoot config with default value. If it already exists, update the BGP
troubleshoot config with this object.
If BGP troubleshoot config is not present in BGP configuration, create a new BGP
troubleshoot config with default value. If it already exists, update the BGP
troubleshoot config with this object.
If an Interface group with the label-id is not already present, create a new
Interface group. If it already exists, update the Interface group for specified attributes.
If an interface with the interface-id is not already present, create a new
interface. If it already exists, update the interface for specified attributes.
Get Tier-0 Interface Address Resolution Protocol Proxies in CSV format
Returns ARP proxy table for a tier-0 interface in CSV format. Interfaces can be of types
- EXTERNAL and SERVICE. Interfaces of type LOOBACK and downlink are not
supported.
Get Tier-0 Interface Address Resolution Protocol Proxies
Returns ARP proxy table for a tier-0 interface. Interfaces can be of types
- EXTERNAL and SERVICE. Interfaces of type LOOBACK and downlink are not
supported.
Returns ARP table (IPv4) or Neighbor Discovery table (IPv6) in CSV format
for the tier-0 interface, on a edge node if a query parameter
"edge_path=<policy-edge-path>" is given. The edge_path
parameter is mandatory if the interface type is not EXTERNAL.
Returns ARP table (IPv4) or Neighbor Discovery table (IPv6) for the
tier-0 interface, on a edge node if a query parameter
"edge_path=<policy-edge-path>" is given. The edge_path
parameter is mandatory if the interface type is not EXTERNAL.
Get paginated list of all IPSec VPN services
for given locale service under Tier-0.
Note:
Please note that request is validated and any error messages returned from validation may include the new VPN path
instead of the deprecated path. Both new path and old path refer to same resource.
Create or fully replace IPSec VPN local endpoint
for a given locale service under Tier-0.
Revision is optional for creation and required for update.
Note:
Please note that request is validated and any error messages returned from validation may include the new VPN path
instead of the deprecated path. Both new path and old path refer to same resource.
Also VPN path returned in the Alarm, GPRR payload may include the new VPN path
Get IPSec VPN session detailed status under Tier-0
- no enforcement point path specified: detailed status is evaluated on each enforcement point.
- an enforcement point path is specified: detailed status is evaluated only on the given
enforcement point.
- source=realtime: detailed status is fetched realtime from the enforcement point.
- source=cached: cached detailed status from enforcement point is returned.
- no enforcement point path specified: statistics are evaluated on each enforcement point.
- an enforcement point path is specified: statistics are evaluated only on the given
enforcement point.
- source=realtime: statistics are fetched realtime from the enforcement point.
- source=cached: cached statistics from enforcement point are returned.
Delete L2VPN session under Tier-0. When L2VPN Service is in CLIENT Mode,
the L2VPN Session is deleted along with its transpot tunnels and related
resources.
Create or patch an L2VPN session under Tier-0 from Peer Codes
Create or patch an L2VPN session under Tier-0 from Peer Codes.
In addition to the L2VPN Session, the IPSec VPN Session, along
with the IKE, Tunnel, and DPD Profiles are created and owned by
the system. IPSec VPN Service and Local Endpoint are created only
when required, i.e., an IPSec VPN Service does not already exist,
or an IPSec VPN Local Endpoint with same local address does not
already exist.
Updating the L2VPN Session can be performed only through this API
by specifying new peer codes. Use of specific APIs to update the
L2VPN Session and the different resources associated with it is
not allowed, except for IPSec VPN Service and Local Endpoint,
resources that are not system owned.
API supported only when L2VPN Service is in Client Mode.
Note:
Please note that request is validated and any error messages returned from validation may include the new VPN path
instead of the deprecated path. Both new path and old path refer to same resource.
Also VPN path returned in the Alarm, GPRR payload may include the new VPN path.
Create or fully replace L2VPN session under Tier-0
Create or fully replace L2VPN session under Tier-0. API supported
only when L2VPN Service is in Server Mode.
Revision is optional for creation and required for update.
- no enforcement point path specified: detailed tatus is evaluated on each enforcement point.
- an enforcement point path is specified: detailed status is evaluated only on the given
enforcement point.
- source=realtime: detailed tatus is fetched realtime from the enforcement point.
- source=cached: cached detailed status is returned.
Get Tier-0 L2VPN session configuration for the peer site
Get peer config for the Tier-0 L2VPN session to configure the remote
side of the tunnel.
- no enforcement point path specified: L2VPN Session Peer Codes
will be evaluated on each enforcement point.
- enforcement point paths specified: L2VPN Session Peer Codes
are evaluated only on the given enforcement points.
API supported only when L2VPN Service is in Server Mode.
- no enforcement point path specified: statistics are evaluated on each enforcement point.
- an enforcement point path is specified: statistics are evaluated only on the given
enforcement point.
- source=realtime: statistics are fetched realtime from the enforcement point.
- source=cached: cached statistics from the enforcement point are returned.
If an interface with the interface-id is not already present, create a new
interface. If it already exists, update the interface for specified attributes.
If a Tier-0 locale-services with the locale-services-id is not already
present, create a new locale-services. If it already exists, update
Tier-0 locale-services with specified attributes.
If a Tier-0 locale-services with the locale-services-id is not already
present, create a new locale-services. If it already exists, replace the
Tier-0 locale-services instance with the new object.
Create or update a Tier-0 multicast configuration defining the multicast replication range,
the IGMP or a PIM profile. It will update the configuration if there is already one in place.
Create or update a Tier-0 multicast configuration defining the multicast replication range,
the IGMP or a PIM profile. It will update the configuration if there is already one in place.
List NAT Rules from Tier-0 denoted by Tier-0 ID, under NAT section
denoted by <nat-id>.
Under tier-0 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property in the PATCH/PUT API, the path returned in the GET response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
Delete NAT Rule from Tier-0 denoted by Tier-0 ID, under NAT section denoted by <nat-id>. Under tier-0 there will be 3 different NATs(sections). (INTERNAL, USER and DEFAULT) For more details related to NAT section please refer to PolicyNAT schema.
Get NAT Rule from Tier-0 denoted by Tier-0 ID, under NAT section
denoted by <nat-id>.
Under tier-0 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property in the PUT/PATCH API, the path returned in the GET response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
If a NAT Rule is not already present on Tier-0 denoted by Tier-0 ID,
under NAT section denoted by <nat-id>, create a new NAT Rule.
If it already exists, update the NAT Rule.
Under tier-0 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property in the PATCH API, the path returned in the GET response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
Create or update NAT Rule on Tier-0 denoted by Tier-0 ID, under NAT section
denoted by <nat-id>.
Under tier-0 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property in the PUT API, the path returned in the PUT/GET response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
Get NAT Rule Statistics from Tier-0 denoted by Tier-0 ID, under NAT section
denoted by <nat-id>.
Under tier-0 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
If prefix list for prefix-list-id is not already present, create
a prefix list. If it already exists, patch prefix list for prefix-list-id.
Note:
Patching existing prefix-list's "prefixes" property will overwrite the existing prefixes.
GET and PATCH is the expected set of operations to update or append new entries to the existig prefixes.
Patching existing prefixes require order to be preserved to avoid traffic impact. During PATCH operation,
reordering of existing prefixes may impact routes and eventually datapath.
Order here is crucial and it all depends upon action. If action for every prefix is PERMIT then order may
not impact but if there is DENY prefix then change in ordering could lead to traffic impact.
If prefix list for prefix-list-id is not already present, create
a prefix list. If it already exists, replace the prefix list for
prefix-list-id.
Note:
Updating existing prefixes require order to be preserved to avoid traffic impact. During PATCH operation,
reordering of existing prefixes may impact routes and eventually datapath.
Order here is crucial and it all depends upon action. If action for every prefix is PERMIT then order may
not impact but if there is DENY prefix then change in ordering could lead to traffic impact.
If a route map with the route-map-id is not already present, create a new
route map. If it already exists, update the route map for specified
attributes.
If a route map with the route-map-id is not already present,
create a new route map. If it already exists, replace the
route map instance with the new object.
If a StaticRouteBfdPeer with the bfd-peer-id is not already present,
create a new StaticRouteBfdPeer. If it already exists, update the
StaticRouteBfdPeer. This is a full replace.
If a StaticRouteBfdPeer with the bfd-peer-id is not already present,
create a new StaticRouteBfdPeer. If it already exists, update the
StaticRouteBfdPeer. This operation will fully replace the object.
Create or update a StaticRouteBfdTroubleshootConfig
If a StaticRouteBfdTroubleshootConfig is not already present,
create a new StaticRouteBfdTroubleshootConfig. If it already exists, update the
StaticRouteBfdTroubleshootConfig. This is a full replace.
Create or update a StaticRouteBfdTroubleshootConfig
If a StaticRouteBfdTroubleshootConfig is not already present,
create a new StaticRouteBfdTroubleshootConfig. If it already exists, update the
StaticRouteBfdTroubleshootConfig. This operation will fully replace the object.
Get ARP table from tier-0 router link interface in CSV format
Returns ARP table (IPv4) or Neighbor Discovery table (IPv6) in CSV format
for the tier-0 router link interface, on a edge node. The edge_path
parameter is mandatory if the interface type is not EXTERNAL.
Get tier-0 router link statistics summary information
Get tier-0 router link statistics summary information. In case tier 1 is A/A, and the edge cluster is not
the response will have interface_policy_path and logical_router_port_id empty because all logical router
port stats are aggregated from all edge nodes.
If Tier-1 with the tier-1-id is not already present, create a new Tier-1 instance.
If it already exists, update the tier-1 instance with specified attributes.
Reprocess Tier1 gateway configuration and publish updates to NSX controller
Reprocess Tier1 gateway configuration and configuration of related entities like Tier1 interfaces
and static routes, etc. Any missing Updates are published to NSX controller.
Return the given count of recent failed DNS queries from DNS forwarder.
Since the DNS forwarder is running in Active/Standby HA mode on transport
nodes, the given count of queries will be returned from each nodes. Hence
the total queries returned could be doubled.
If no count is specified, 100 recent failed queries are returned. If the
recent failures is less than the given count, all the failures will be
returned. The maximum count is 1,000.
Resolve a given address via the dns forwarder at Tier1
Query the nameserver for an ip-address or a FQDN of the given an address optionally using
an specified DNS server. If the address is a fqdn, nslookup will resolve ip-address with it.
If the address is an ip-address, do a reverse lookup and answer fqdn(s).
If enforcement point is specified, then DNS forwarder nslookup answer will get fetched from
specified enforcement point. Otherwise from all enforcement points.
Get statistics of tier-1 DNS forwarder.
- no enforcement point path specified: Statistics will be evaluated on each enforcement
point.
- {enforcement_point_path}: Statistics are evaluated only on the given enforcement point.
Get current status of tier-1 DNS forwarder.
- no enforcement point path specified: Status will be evaluated on each enforcement
point.
- {enforcement_point_path}: Status will be evaluated only on the given enforcement
point.
Create or fully replace IPSec VPN local endpoint
for a given ipsec vpn service under Tier-1.
Revision is optional for creation and required for update.
Get IPSec VPN session detailed status under Tier-1
- no enforcement point path specified: detailed status is evaluated on each enforcement point.
- an enforcement point path is specified: detailed status is evaluated only on the given
enforcement point.
- source=realtime: detailed status is fetched realtime from the enforcement point.
- source=cached: cached detailed status from enforcement point is returned.
- no enforcement point path specified: statistics are evaluated on each enforcement point.
- an enforcement point path is specified: statistics are evaluated only on the given
enforcement point.
- source=realtime: statistics are fetched realtime from the enforcement point.
- source=cached: cached statistics from enforcement point are returned.
Please note that cache synchronization is based on triggering this API with
source=realtime or empty source and not polling based.
Delete L2VPN session under Tier-1. When L2VPN Service is in CLIENT Mode, the L2VPN Session is deleted along with its transpot tunnels and related resources.
Create or patch an L2VPN session under Tier-1 from Peer Codes
Create or patch an L2VPN session under Tier-1 from Peer Codes.
In addition to the L2VPN Session, the IPSec VPN Session, along
with the IKE, Tunnel, and DPD Profiles are created and owned by
the system. IPSec VPN Service and Local Endpoint are created only
when required, i.e., an IPSec VPN Service does not already exist,
or an IPSec VPN Local Endpoint with same local address does not
already exist.
Updating the L2VPN Session can be performed only through this API
by specifying new peer codes. Use of specific APIs to update the
L2VPN Session and the different resources associated with it is
not allowed, except for IPSec VPN Service and Local Endpoint,
resources that are not system owned.
API supported only when L2VPN Service is in Client Mode.
Create or fully replace L2VPN session under Tier-1
Create or fully replace L2VPN session under Tier-1. API supported
only when L2VPN Service is in Server Mode.
Revision is optional for creation and required for update.
- no enforcement point path specified: detailed tatus is evaluated on each enforcement point.
- an enforcement point path is specified: detailed status is evaluated only on the given
enforcement point.
- source=realtime: detailed tatus is fetched realtime from the enforcement point.
- source=cached: cached detailed status is returned.
Get Tier-1 L2VPN session configuration for the peer site
Get peer config for the Tier-1 L2VPN session to configure the remote
side of the tunnel.
- no enforcement point path specified: L2VPN Session Peer Codes
will be evaluated on each enforcement point.
- enforcement point paths specified: L2VPN Session Peer Codes
are evaluated only on the given enforcement points.
API supported only when L2VPN Service is in Server Mode.
- no enforcement point path specified: statistics are evaluated on each enforcement point.
- an enforcement point path is specified: statistics are evaluated only on the given
enforcement point.
- source=realtime: statistics are fetched realtime from the enforcement point.
- source=cached: cached statistics from the enforcement point are returned.
If an Interface group with the label-id is not already present, create a new
Interface group. If it already exists, update the Interface group for specified attributes.
Returns ARP table (IPv4) or Neighbor Discovery table (IPv6) for the
tier-1 interface, on a edge node specified in edge_path parameter.
The edge_path parameter is mandatory.
Returns ARP table (IPv4) or Neighbor Discovery table (IPv6) in CSV format
for the tier-1 interface, on a edge node specified in edge_path parameter.
The edge_path parameter is mandatory.
Get IPSec VPN session detailed status under Tier-1
- no enforcement point path specified: detailed status is evaluated on each enforcement point.
- an enforcement point path is specified: detailed status is evaluated only on the given
enforcement point.
- source=realtime: detailed status is fetched realtime from the enforcement point.
- source=cached: cached detailed status from enforcement point is returned.
- no enforcement point path specified: statistics are evaluated on each enforcement point.
- an enforcement point path is specified: statistics are evaluated only on the given
enforcement point.
- source=realtime: statistics are fetched realtime from the enforcement point.
- source=cached: cached statistics from enforcement point are returned.
Delete L2VPN session under Tier-1. When L2VPN Service is
in CLIENT Mode, the L2VPN Session is deleted along with its transpot
tunnels and related resources.
Create or patch an L2VPN session under Tier-1 from Peer Codes
Create or patch an L2VPN session under Tier-1 from Peer Codes.
In addition to the L2VPN Session, the IPSec VPN Session, along
with the IKE, Tunnel, and DPD Profiles are created and owned by
the system. IPSec VPN Service and Local Endpoint are created only
when required, i.e., an IPSec VPN Service does not already exist,
or an IPSec VPN Local Endpoint with same local address does not
already exist.
Updating the L2VPN Session can be performed only through this API
by specifying new peer codes. Use of specific APIs to update the
L2VPN Session and the different resources associated with it is
not allowed, except for IPSec VPN Service and Local Endpoint,
resources that are not system owned.
API supported only when L2VPN Service is in Client Mode.
Create or fully replace L2VPN session under Tier-1
Create or fully replace L2VPN session under Tier-1. API supported
only when L2VPN Service is in Server Mode.
Revision is optional for creation and required for update.
- no enforcement point path specified: detailed tatus is evaluated on each enforcement point.
- an enforcement point path is specified: detailed status is evaluated only on the given
enforcement point.
- source=realtime: detailed tatus is fetched realtime from the enforcement point.
- source=cached: cached detailed status is returned.
sessions/<session-id>/detailed-status instead.
Get Tier-1 L2VPN session configuration for the peer site
Get peer config for the Tier-1 L2VPN session to configure the remote
side of the tunnel.
- no enforcement point path specified: L2VPN Session Peer Codes
will be evaluated on each enforcement point.
- enforcement point paths specified: L2VPN Session Peer Codes
are evaluated only on the given enforcement points.
API supported only when L2VPN Service is in Server Mode.
- no enforcement point path specified: statistics are evaluated on each enforcement point.
- an enforcement point path is specified: statistics are evaluated only on the given
enforcement point.
- source=realtime: statistics are fetched realtime from the enforcement point.
- source=cached: cached statistics from the enforcement point are returned.
If a Tier1 service interface with the interface-id is not already present, create a new Tier1 service
interface. Modification of Tier 1 service interface is not allowed.
If a Tier-1 locale services with the locale-services-id is not already
present, create a new locale services. If it already exists, update
Tier-1 locale services with specified attributes.
If a Tier-1 locale services with the locale-services-id is not already
present, create a new locale-services. If it already exists, replace the
Tier-1 locale services instance with the new object.
Modifying edge cluster re-allocates NSX service routers of TIER1 to a different edge
cluster. You can also place edge nodes manually and provide maximum two indices
for HA mode ACTIVE_STANDBY. To re-allocating edge cluster is a disruptive operation
and all existing statistics of Tier1 gateway will be removed.
If an interface with the interface-id is not already present, create a new
interface. If it already exists, update the interface for specified
attributes.
Create or update a Tier-1 multicast configuration defining the multicast replication range.
It will update the configuration if there is already one in place.
Create or update a Tier-1 multicast configuration defining the multicast replication range.
It will update the configuration if there is already one in place.
List NAT Rules from Tier-1 denoted by Tier-1 ID, under NAT section
denoted by <nat-id>.
Under tier-1 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property in the PATCH/PUT PoliycNatRule API, the path returned in the GET response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
Delete NAT Rule from Tier-1 denoted by Tier-1 ID, under NAT section denoted by <nat-id>. Under tier-1 there will be 3 different NATs(sections). (INTERNAL, USER and DEFAULT) For more details related to NAT section please refer to PolicyNAT schema.
Get NAT Rule from Tier-1 denoted by Tier-1 ID, under NAT section
denoted by <nat-id>.
Under tier-1 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property in the PATCH/PUT PoliycNatRule API, the path returned in the GET response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
If a NAT Rule is not already present on Tier-1 denoted by Tier-1 ID,
under NAT section denoted by <nat-id>, create a new NAT Rule.
If it already exists, update the NAT Rule.
Under tier-1 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property, the path returned in the GET response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
Create or update NAT Rule on Tier-1 denoted by Tier-1 ID, under NAT section
denoted by <nat-id>.
Under tier-1 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property in the PUT API, the path returned in the GET/PUT response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
Get NAT Rule Statistics from Tier-1 denoted by Tier-1 ID, under NAT section
denoted by <nat-id>.
Under tier-1 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Paginated list of all fixed segments (identified as /policy/api/v1/infra/tier-1s//segments/) under Tier-1 instance.
Paginated list of all fixed segments (identified as /policy/api/v1/infra/tier-1s//segments/) under Tier-1 instance.
This API call does not return flexible segments (identified as /policy/api/v1/infra/segments/) connected to the Tier-1.
To return all segments connected as a downlink to a Tier-1 one possibility is to use the search API with: https://{{nsx-mgr}}/policy/api/v1/search?query=resource_type:Segment%20AND%20connectivity_path:“/infra/tier-1s/
Extended Segment: Please note that old vpn path deprecated. If user specify old l2vpn path in the
"l2_extension" object in the PUT/PATCH API payload, the path returned in the GET response payload may include the new path
instead of the deprecated l2vpn path. Both old and new l2vpn path refer to same resource. there is no functional impact.
Also note that l2vpn path included in the error messages returned from validation may include the new VPN path
instead of the deprecated l2vpn path. Both new path and old vpn path refer to same resource.
Read segment
Note:
Extended Segment: Please note that old vpn path deprecated. If user specify old l2vpn path in the
"l2_extension" object in the PUT/PATCH API payload, the path returned in the GET response payload may include the new path
instead of the deprecated l2vpn path. Both old and new l2vpn path refer to same resource. there is no functional impact.
Also note that l2vpn path included in the error messages returned from validation may include the new VPN path
instead of the deprecated l2vpn path. Both new path and old vpn path refer to same resource.
If segment with the segment-id is not already present, create a new segment.
If it already exists, update the segment with specified attributes.
Note:
Extended Segment: Please note that old vpn path deprecated. If user specify old l2vpn path in the
"l2_extension" object in the PATCH API payload, the path returned in the GET response payload may include the new path
instead of the deprecated l2vpn path. Both old and new l2vpn path refer to same resource. there is no functional impact.
Also note that l2vpn path included in the Alarm, GPRR, error messages returned from validation may include the new VPN path
instead of the deprecated l2vpn path. Both new path and old vpn path refer to same resource.
If segment with the segment-id is not already present, create a new segment.
If it already exists, replace the segment with this object.
Note:
Extended Segment: Please note that old vpn path deprecated. If user specify old l2vpn path in the
"l2_extension" object in the PUT API payload, the path returned in the PUT/GET response payload may include the new path
instead of the deprecated l2vpn path. Both old and new l2vpn path refer to same resource. there is no functional impact.
Also note that l2vpn path included in the Alarm, GPRR, error messages returned from validation may include the new VPN path
instead of the deprecated l2vpn path. Both new path and old vpn path refer to same resource.
Get ARP table from segment interface (downlink) in CSV format
Returns ARP table (IPv4) or Neighbor Discovery table (IPv6) in CSV format for the
interface (downlink) attaching segment to tier1 gateway, on a edge
node specified in edge_path parameter.
The edge_path parameter is mandatory.
Returns ARP table (IPv4) or Neighbor Discovery table (IPv6) for the
interface (downlink) attaching segment to tier-1 gateway, on a edge
node specified in edge_path parameter.
The edge_path parameter is mandatory.
If binding with the binding-id is not already present,
create a new DHCP static binding instance. If it already exists, replace
the existing DHCP static binding instance with specified attributes.
If binding with the binding-id is not already present,
create a new DHCP static binding instance. If it already exists, replace
the existing DHCP static binding instance with this object.
Delete a Tier-1 segment port. Please note that this operation will not delete the
segment port from vCenter Server if the port was connected to a Virtual Machine.
Please connect Virtual Machine to another network for the segment port to be deleted
from vCenter Server.
Create a Tier-1 segment port if it does not exist based on the IDs, or update existing port
information by replacing the port object fields which presents in the request body.
Create a new port security profile binding map if the given security profile
binding map does not exist. Otherwise, patch the existing port security
profile binding map.
For objects with no binding maps, default profile is applied.
Patch the infra segment connection binding map. If binding map corresponding to the the given values is
not present, the object will get created and if it is present it will be
updated. This is a full replace.
Patch the infra segment connection binding map. If binding map corresponding to the the given values is
not present, the object will get created and if it is present it will be
updated. This is a full replace.
Create a new segment security profile binding map if the given security
profile binding map does not exist. Otherwise, patch the existing segment
security profile binding map.
For objects with no binding maps, default profile is applied.
Delete one or multiple DHCP lease(s) specified by IP and MAC under a Tier-1.
If there is a DHCP server running upon the given segment, or this segment
is using a DHCP server running in its connected Tier-1, the DHCP lease(s)
which match exactly the IP address and the MAC address will be deleted.
If no such lease matches, the deletion for this lease will be ignored.
The DHCP lease to be deleted will be removed by the system from both active
and standby node. The system will report error if the DHCP lease could not
be removed from both nodes. If the DHCP lease could not be removed on either
node, please check the DHCP server status. Once the DHCP server status is
UP, please invoke the deletion API again to ensure the lease gets deleted
from both nodes.
