ols-659 changes_after_review1

OLS-644: Global DNS configuration

capabilities/connect.capabilities.yml

@@ -300,6 +300,7 @@ properties:
       - Service-Online-Check
       - Service-CaptivePortal
       - Service-PublicIpCheck
+      - Service-Global-DNS
       # Tunneling
       - Tunneling-VxLAN
       - Tunneling-GRE

schema.json

@@ -1,5 +1,5 @@
 {
-	"major": 3,
-	"minor": 2,
-	"patch": 7
+	"major": 4,
+	"minor": 0,
+	"patch": 0 
 }

schema/ethernet.yml

@@ -368,6 +368,18 @@ properties:
         type: boolean
         description: Enables the transmission of SNMP trap notifications about LLDP changes.
         default: false
+  ip-arp-inspect-port:
+    type: object
+    description: Configuration for ARP Inspection on specific interfaces or ports in the switch.
+    properties:
+      rate-limit-pps:
+        type: integer
+        description: Sets a rate limit (packets per second) for the ARP packets received on a port. Ensures that the port does not process ARP packets beyond the configured limit.
+        minimum: 0
+        maximum: 65535
+      trusted:
+        type: boolean
+        description: Configures the port as trusted, exempting it from ARP Inspection. Trusted ports bypass ARP validation checks.
   rate-limit-port:
     type: object
     description: Configuration for ingress and egress rate limiting on a specific port (in kbps)

schema/interface.ipv4.arp-inspect.yml

@@ -0,0 +1,14 @@
+type: object
+description: Configuration for ARP Inspection on specific VLANs in the switch.
+properties:
+  vlan-enable:
+    type: boolean
+    description: Enable or disable ARP Inspection for a specified VLAN.
+  vlan-acl-rule:
+    type: string
+    description: Specifies an ARP ACL to apply to one or more VLANs.
+    maxLength: 32
+    minLength: 1
+  vlan-acl-nodhcp-bindings:
+    type: boolean
+    description: Validate ARP packets against only the specified ACL without checking address bindings in the DHCP snooping database.

schema/interface.ipv4.yml

@@ -200,6 +200,8 @@ properties:
     description: "Enables DHCP Snooping on a VLAN"
     type: boolean
     default: false
+  ip-arp-inspect-vlan:
+      $ref: "https://ucentral.io/schema/v1/interface/ipv4/arp-inspect/"
   dhcp:
     $ref: "https://ucentral.io/schema/v1/interface/ipv4/dhcp/"
   dhcp-leases:

schema/interface.vlan.yml

@@ -8,7 +8,15 @@ properties:
       The individual physical network devices contained within the interface
       need to be told explicitly if egress traffic shall be tagged.
     type: integer
-    maximum: 4050
+    maximum: 4094
+  range-start:
+    decription: Start vlan-id of the specified range
+    type: integer
+    maximum: 4094
+  range-end:
+    decription: End vlan-id of the specified range
+    type: integer
+    maximum: 4094
   proto:
     decription:
       The L2 vlan tag that shall be added (1q,1ad)

schema/switch.arp-inspect.yml

@@ -0,0 +1,19 @@
+type: object
+description: Global configuration for ARP Inspection on the switch.
+properties:
+  ip-arp-inspect:
+    type: boolean
+    description: Enable or disable ARP Inspection globally.
+    default: false
+  validate-dst-mac:
+    type: boolean
+    description: Validate that the destination MAC address in the Ethernet header matches the target MAC address in the ARP body for ARP responses.
+  validate-ip:
+    type: boolean
+    description: Validate ARP packets for unexpected or invalid IP addresses, such as 0.0.0.0, 255.255.255.255, and IP multicast addresses.
+  validate-allow-zeros:
+    type: boolean
+    description: Allow ARP packets where the sender IP address is 0.0.0.0.
+  validate-src-mac:
+    type: boolean
+    description: Validate that the source MAC address in the Ethernet header matches the sender MAC address in the ARP body for both ARP requests and responses.

schema/switch.yml

@@ -537,9 +537,16 @@ properties:
               minLength: 1
               examples:
                 - "A VoIP Phone"
+  arp-inspect:
+    $ref: "https://ucentral.io/schema/v1/switch/arp-inspect/"
   ip-source-guard:
     $ref: "https://ucentral.io/schema/v1/switch/ip-source-guard/"
   rt-events:
     $ref: "https://ucentral.io/schema/v1/switch/rtevent/"
   acl:
     $ref: "https://ucentral.io/schema/v1/switch/acl/"
+  dns:
+    description: Define a global list of dns servers.
+    type: array
+    items:
+      type: string

state/interface.yml

@@ -15,8 +15,11 @@ items:
     name:
       type: string
       description:
-        The administrative name of this logical interface. This field is
-        freetext
+        The administrative name of this logical interface. This field is freetext
+    vlan_id:
+      description: VLAN-ID of the logical interface
+      type: integer
+      maximum: 4094
     ntp_server:
       type: string
       description:

state/state.yml

@@ -60,6 +60,34 @@ properties:
     type: string
     description:
       Current interface that serves as the Uplink. Example Ethernet2.
+  arp-inspect-stats:
+    type: object
+    description: Statistics related to ARP Inspection activity in the switch.
+    properties:
+      arp-pkt-rcvd:
+        type: integer
+        description: Total number of ARP packets received.
+      arp-pkt-dropped-rate-limit:
+        type: integer
+        description: Number of ARP packets dropped due to rate limiting.
+      arp-pkt-processed:
+        type: integer
+        description: Total number of ARP packets processed by ARP Inspection.
+      arp-pkt-dropped-src-mac:
+        type: integer
+        description: Number of ARP packets dropped due to source MAC address validation failures.
+      arp-pkt-dropped-dst-mac:
+        type: integer
+        description: Number of ARP packets dropped due to destination MAC address validation failures.
+      arp-pkt-dropped-ip:
+        type: integer
+        description: Number of ARP packets dropped due to IP address validation failures."
+      arp-pkt-dropped-acl:
+        type: integer
+        description: Number of ARP packets dropped due to ARP ACL rules.
+      arp-pkt-dropped-dhcp:
+        type: integer
+        description: Number of ARP packets dropped due to DHCP snooping validation failures.
   ip-source-guard:
     type: object
     description: Represents the configuration and state of IP Source Guard.

ucentral.capabilities.pretty.json

@@ -361,6 +361,7 @@
                     "Service-Online-Check",
                     "Service-CaptivePortal",
                     "Service-PublicIpCheck",
+                    "Service-Global-DNS",
                     "Tunneling-VxLAN",
                     "Tunneling-GRE",
                     "Tunneling-GRE6",

ucentral.schema.full.json

@@ -589,6 +589,22 @@
                             }
                         }
                     },
+                    "ip-arp-inspect-port": {
+                        "type": "object",
+                        "description": "Configuration for ARP Inspection on specific interfaces or ports in the switch.",
+                        "properties": {
+                            "rate-limit-pps": {
+                                "type": "integer",
+                                "description": "Sets a rate limit (packets per second) for the ARP packets received on a port. Ensures that the port does not process ARP packets beyond the configured limit.",
+                                "minimum": 0,
+                                "maximum": 65535
+                            },
+                            "trusted": {
+                                "type": "boolean",
+                                "description": "Configures the port as trusted, exempting it from ARP Inspection. Trusted ports bypass ARP validation checks."
+                            }
+                        }
+                    },
                     "rate-limit-port": {
                         "type": "object",
                         "description": "Configuration for ingress and egress rate limiting on a specific port (in kbps)",
@@ -1363,6 +1379,33 @@
                         }
                     }
                 },
+                "arp-inspect": {
+                    "type": "object",
+                    "description": "Global configuration for ARP Inspection on the switch.",
+                    "properties": {
+                        "ip-arp-inspect": {
+                            "type": "boolean",
+                            "description": "Enable or disable ARP Inspection globally.",
+                            "default": false
+                        },
+                        "validate-dst-mac": {
+                            "type": "boolean",
+                            "description": "Validate that the destination MAC address in the Ethernet header matches the target MAC address in the ARP body for ARP responses."
+                        },
+                        "validate-ip": {
+                            "type": "boolean",
+                            "description": "Validate ARP packets for unexpected or invalid IP addresses, such as 0.0.0.0, 255.255.255.255, and IP multicast addresses."
+                        },
+                        "validate-allow-zeros": {
+                            "type": "boolean",
+                            "description": "Allow ARP packets where the sender IP address is 0.0.0.0."
+                        },
+                        "validate-src-mac": {
+                            "type": "boolean",
+                            "description": "Validate that the source MAC address in the Ethernet header matches the sender MAC address in the ARP body for both ARP requests and responses."
+                        }
+                    }
+                },
                 "ip-source-guard": {
                     "type": "object",
                     "description": "Configuration for IP Source Guard global static bindings in a Layer 2 switch.",
@@ -1760,6 +1803,13 @@
                             }
                         }
                     }
+                },
+                "dns": {
+                    "description": "Define a global list of dns servers.",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
                 }
             }
         },
@@ -1830,7 +1880,17 @@
                             "id": {
                                 "description": "This is the pvid of the vlan that shall be assigned to the interface. The individual physical network devices contained within the interface need to be told explicitly if egress traffic shall be tagged.",
                                 "type": "integer",
-                                "maximum": 4050
+                                "maximum": 4094
+                            },
+                            "range-start": {
+                                "decription": "Start vlan-id of the specified range",
+                                "type": "integer",
+                                "maximum": 4094
+                            },
+                            "range-end": {
+                                "decription": "End vlan-id of the specified range",
+                                "type": "integer",
+                                "maximum": 4094
                             },
                             "proto": {
                                 "decription": "The L2 vlan tag that shall be added (1q,1ad)",
@@ -2168,6 +2228,26 @@
                                 "type": "boolean",
                                 "default": false
                             },
+                            "ip-arp-inspect-vlan": {
+                                "type": "object",
+                                "description": "Configuration for ARP Inspection on specific VLANs in the switch.",
+                                "properties": {
+                                    "vlan-enable": {
+                                        "type": "boolean",
+                                        "description": "Enable or disable ARP Inspection for a specified VLAN."
+                                    },
+                                    "vlan-acl-rule": {
+                                        "type": "string",
+                                        "description": "Specifies an ARP ACL to apply to one or more VLANs.",
+                                        "maxLength": 32,
+                                        "minLength": 1
+                                    },
+                                    "vlan-acl-nodhcp-bindings": {
+                                        "type": "boolean",
+                                        "description": "Validate ARP packets against only the specified ACL without checking address bindings in the DHCP snooping database."
+                                    }
+                                }
+                            },
                             "dhcp": {
                                 "description": "This section describes the DHCP server configuration",
                                 "type": "object",

ucentral.schema.json

@@ -529,6 +529,19 @@
                         }
                     }
                 },
+                "ip-arp-inspect-port": {
+                    "type": "object",
+                    "properties": {
+                        "rate-limit-pps": {
+                            "type": "integer",
+                            "minimum": 0,
+                            "maximum": 65535
+                        },
+                        "trusted": {
+                            "type": "boolean"
+                        }
+                    }
+                },
                 "rate-limit-port": {
                     "type": "object",
                     "properties": {
@@ -658,6 +671,27 @@
                 }
             }
         },
+        "switch.arp-inspect": {
+            "type": "object",
+            "properties": {
+                "ip-arp-inspect": {
+                    "type": "boolean",
+                    "default": false
+                },
+                "validate-dst-mac": {
+                    "type": "boolean"
+                },
+                "validate-ip": {
+                    "type": "boolean"
+                },
+                "validate-allow-zeros": {
+                    "type": "boolean"
+                },
+                "validate-src-mac": {
+                    "type": "boolean"
+                }
+            }
+        },
         "switch.ip-source-guard": {
             "type": "object",
             "properties": {
@@ -1519,6 +1553,9 @@
                         }
                     }
                 },
+                "arp-inspect": {
+                    "$ref": "#/$defs/switch.arp-inspect"
+                },
                 "ip-source-guard": {
                     "$ref": "#/$defs/switch.ip-source-guard"
                 },
@@ -1527,6 +1564,12 @@
                 },
                 "acl": {
                     "$ref": "#/$defs/switch.acl"
+                },
+                "dns": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
                 }
             }
         },
@@ -1535,7 +1578,17 @@
             "properties": {
                 "id": {
                     "type": "integer",
-                    "maximum": 4050
+                    "maximum": 4094
+                },
+                "range-start": {
+                    "decription": "Start vlan-id of the specified range",
+                    "type": "integer",
+                    "maximum": 4094
+                },
+                "range-end": {
+                    "decription": "End vlan-id of the specified range",
+                    "type": "integer",
+                    "maximum": 4094
                 },
                 "proto": {
                     "decription": "The L2 vlan tag that shall be added (1q,1ad)",
@@ -1624,6 +1677,22 @@
                 }
             }
         },
+        "interface.ipv4.arp-inspect": {
+            "type": "object",
+            "properties": {
+                "vlan-enable": {
+                    "type": "boolean"
+                },
+                "vlan-acl-rule": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 1
+                },
+                "vlan-acl-nodhcp-bindings": {
+                    "type": "boolean"
+                }
+            }
+        },
         "interface.ipv4.dhcp": {
             "type": "object",
             "properties": {
@@ -1928,6 +1997,9 @@
                     "type": "boolean",
                     "default": false
                 },
+                "ip-arp-inspect-vlan": {
+                    "$ref": "#/$defs/interface.ipv4.arp-inspect"
+                },
                 "dhcp": {
                     "$ref": "#/$defs/interface.ipv4.dhcp"
                 },

ucentral.schema.pretty.json

@@ -623,6 +623,22 @@
                         }
                     }
                 },
+                "ip-arp-inspect-port": {
+                    "type": "object",
+                    "description": "Configuration for ARP Inspection on specific interfaces or ports in the switch.",
+                    "properties": {
+                        "rate-limit-pps": {
+                            "type": "integer",
+                            "description": "Sets a rate limit (packets per second) for the ARP packets received on a port. Ensures that the port does not process ARP packets beyond the configured limit.",
+                            "minimum": 0,
+                            "maximum": 65535
+                        },
+                        "trusted": {
+                            "type": "boolean",
+                            "description": "Configures the port as trusted, exempting it from ARP Inspection. Trusted ports bypass ARP validation checks."
+                        }
+                    }
+                },
                 "rate-limit-port": {
                     "type": "object",
                     "description": "Configuration for ingress and egress rate limiting on a specific port (in kbps)",
@@ -774,6 +790,33 @@
                 }
             }
         },
+        "switch.arp-inspect": {
+            "type": "object",
+            "description": "Global configuration for ARP Inspection on the switch.",
+            "properties": {
+                "ip-arp-inspect": {
+                    "type": "boolean",
+                    "description": "Enable or disable ARP Inspection globally.",
+                    "default": false
+                },
+                "validate-dst-mac": {
+                    "type": "boolean",
+                    "description": "Validate that the destination MAC address in the Ethernet header matches the target MAC address in the ARP body for ARP responses."
+                },
+                "validate-ip": {
+                    "type": "boolean",
+                    "description": "Validate ARP packets for unexpected or invalid IP addresses, such as 0.0.0.0, 255.255.255.255, and IP multicast addresses."
+                },
+                "validate-allow-zeros": {
+                    "type": "boolean",
+                    "description": "Allow ARP packets where the sender IP address is 0.0.0.0."
+                },
+                "validate-src-mac": {
+                    "type": "boolean",
+                    "description": "Validate that the source MAC address in the Ethernet header matches the sender MAC address in the ARP body for both ARP requests and responses."
+                }
+            }
+        },
         "switch.ip-source-guard": {
             "type": "object",
             "description": "Configuration for IP Source Guard global static bindings in a Layer 2 switch.",
@@ -1794,6 +1837,9 @@
                         }
                     }
                 },
+                "arp-inspect": {
+                    "$ref": "#/$defs/switch.arp-inspect"
+                },
                 "ip-source-guard": {
                     "$ref": "#/$defs/switch.ip-source-guard"
                 },
@@ -1802,6 +1848,13 @@
                 },
                 "acl": {
                     "$ref": "#/$defs/switch.acl"
+                },
+                "dns": {
+                    "description": "Define a global list of dns servers.",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
                 }
             }
         },
@@ -1812,7 +1865,17 @@
                 "id": {
                     "description": "This is the pvid of the vlan that shall be assigned to the interface. The individual physical network devices contained within the interface need to be told explicitly if egress traffic shall be tagged.",
                     "type": "integer",
-                    "maximum": 4050
+                    "maximum": 4094
+                },
+                "range-start": {
+                    "decription": "Start vlan-id of the specified range",
+                    "type": "integer",
+                    "maximum": 4094
+                },
+                "range-end": {
+                    "decription": "End vlan-id of the specified range",
+                    "type": "integer",
+                    "maximum": 4094
                 },
                 "proto": {
                     "decription": "The L2 vlan tag that shall be added (1q,1ad)",
@@ -1913,6 +1976,26 @@
                 }
             }
         },
+        "interface.ipv4.arp-inspect": {
+            "type": "object",
+            "description": "Configuration for ARP Inspection on specific VLANs in the switch.",
+            "properties": {
+                "vlan-enable": {
+                    "type": "boolean",
+                    "description": "Enable or disable ARP Inspection for a specified VLAN."
+                },
+                "vlan-acl-rule": {
+                    "type": "string",
+                    "description": "Specifies an ARP ACL to apply to one or more VLANs.",
+                    "maxLength": 32,
+                    "minLength": 1
+                },
+                "vlan-acl-nodhcp-bindings": {
+                    "type": "boolean",
+                    "description": "Validate ARP packets against only the specified ACL without checking address bindings in the DHCP snooping database."
+                }
+            }
+        },
         "interface.ipv4.dhcp": {
             "description": "This section describes the DHCP server configuration",
             "type": "object",
@@ -2264,6 +2347,9 @@
                     "type": "boolean",
                     "default": false
                 },
+                "ip-arp-inspect-vlan": {
+                    "$ref": "#/$defs/interface.ipv4.arp-inspect"
+                },
                 "dhcp": {
                     "$ref": "#/$defs/interface.ipv4.dhcp"
                 },

ucentral.state.pretty.json

@@ -86,6 +86,44 @@
             "type": "string",
             "description": "Current interface that serves as the Uplink. Example Ethernet2."
         },
+        "arp-inspect-stats": {
+            "type": "object",
+            "description": "Statistics related to ARP Inspection activity in the switch.",
+            "properties": {
+                "arp-pkt-rcvd": {
+                    "type": "integer",
+                    "description": "Total number of ARP packets received."
+                },
+                "arp-pkt-dropped-rate-limit": {
+                    "type": "integer",
+                    "description": "Number of ARP packets dropped due to rate limiting."
+                },
+                "arp-pkt-processed": {
+                    "type": "integer",
+                    "description": "Total number of ARP packets processed by ARP Inspection."
+                },
+                "arp-pkt-dropped-src-mac": {
+                    "type": "integer",
+                    "description": "Number of ARP packets dropped due to source MAC address validation failures."
+                },
+                "arp-pkt-dropped-dst-mac": {
+                    "type": "integer",
+                    "description": "Number of ARP packets dropped due to destination MAC address validation failures."
+                },
+                "arp-pkt-dropped-ip": {
+                    "type": "integer",
+                    "description": "Number of ARP packets dropped due to IP address validation failures.\""
+                },
+                "arp-pkt-dropped-acl": {
+                    "type": "integer",
+                    "description": "Number of ARP packets dropped due to ARP ACL rules."
+                },
+                "arp-pkt-dropped-dhcp": {
+                    "type": "integer",
+                    "description": "Number of ARP packets dropped due to DHCP snooping validation failures."
+                }
+            }
+        },
         "ip-source-guard": {
             "type": "object",
             "description": "Represents the configuration and state of IP Source Guard.",
@@ -486,6 +524,11 @@
                         "type": "string",
                         "description": "The administrative name of this logical interface. This field is freetext"
                     },
+                    "vlan_id": {
+                        "description": "VLAN-ID of the logical interface",
+                        "type": "integer",
+                        "maximum": 4094
+                    },
                     "ntp_server": {
                         "type": "string",
                         "description": "The upstream NTP server being used by this interface."