scottk/ols-ucentral-schema
1
0
Fork 0
mirror of https://github.com/Telecominfraproject/ols-ucentral-schema.git synced 2025-10-29 01:02:20 +00:00
Code Issues Packages Projects Releases 3 Wiki Activity
Files
52e38ce792179f69f1b33c833820c7df5514175c
ols-ucentral-schema/ucentral.schema.pretty.json
Binny 52e38ce792 Merge branch 'main' into ols-688-bpdu-guard
2025-09-03 23:05:31 +05:30

3902 lines
193 KiB
JSON
Raw Blame History

{
"$id": "https://openwrt.org/ucentral.schema.json",
"$schema": "http://json-schema.org/draft-07/schema#",
"description": "OpenWrt uCentral schema",
"type": "object",
"properties": {
"strict": {
"description": "The device will reject any configuration that causes warnings if strict mode is enabled.",
"type": "boolean",
"default": false
},
"uuid": {
"description": "The unique ID of the configuration. This is the unix timestamp of when the config was created.",
"type": "integer"
},
"public_ip_lookup": {
"description": "The fqdn to retrieve public ip of internet connection.",
"type": "string",
"format": "uc-fqdn"
},
"unit": {
"$ref": "#/$defs/unit"
},
"globals": {
"$ref": "#/$defs/globals"
},
"ethernet": {
"type": "array",
"items": {
"$ref": "#/$defs/ethernet"
}
},
"switch": {
"$ref": "#/$defs/switch"
},
"interfaces": {
"type": "array",
"items": {
"$ref": "#/$defs/interface"
}
},
"services": {
"$ref": "#/$defs/service"
},
"metrics": {
"$ref": "#/$defs/metrics"
},
"config-raw": {
"$ref": "#/$defs/config-raw"
},
"third-party": {
"type": "object",
"additionalProperties": true
}
},
"$defs": {
"unit": {
"description": "A device has certain properties that describe its identity and location. These properties are described inside this object.",
"type": "object",
"properties": {
"name": {
"description": "This is a free text field, stating the administrative name of the device. It may contain spaces and special characters.",
"type": "string"
},
"hostname": {
"description": "The hostname that shall be set on the device. If this field is not set, then the devices serial number is used.",
"type": "string",
"format": "hostname"
},
"location": {
"description": "This is a free text field, stating the location of the device. It may contain spaces and special characters.",
"type": "string"
},
"timezone": {
"description": "This allows you to change the TZ of the device.",
"type": "string",
"examples": [
"UTC",
"EST5",
"CET-1CEST,M3.5.0,M10.5.0/3"
]
},
"leds-active": {
"description": "This allows forcing all LEDs off.",
"type": "boolean",
"default": true
},
"random-password": {
"description": "The device shall create a random root password and tell the gateway about it.",
"type": "boolean",
"default": false
},
"system-password": {
"description": "System-config string that holds the password for main (root / admin) user to apply.",
"type": "string"
},
"beacon-advertisement": {
"description": "The TIP vendor IEs that shall be added to beacons",
"type": "object",
"properties": {
"device-name": {
"description": "Add an IE containing the device's name to beacons.",
"type": "boolean"
},
"device-serial": {
"description": "Add an IE containing the device's serial to beacons.",
"type": "boolean"
},
"network-id": {
"description": "A provider specific ID for the network/venue that the device is part of.",
"type": "integer"
}
}
},
"poe": {
"description": "This section describes the system-wide (unit) PoE controller configuration object.",
"type": "object",
"properties": {
"power-management": {
"description": "This configuration mode controls the power management algorithm used by the Power sourcing equipment to deliver power to the requesting PDs. \"class\" option - Class-based power management. \"dynamic\" option - Power management is done by the POE controller and the maximum power for a port is not reserved for each port. \"static\" option - The power deducted from the total power pool is the maximum power for that port. This mode ensures that the maximum power specified by you for the interface is always reserved and cannot be shared by other PDs.",
"type": "string",
"examples": [
"class",
"dynamic",
"dynamic-priority",
"static",
"static-priority"
]
},
"usage-threshold": {
"description": "Configure a power alarm threshold for the Power sourcing equipment (in percentages %).",
"type": "number",
"default": 90
}
}
},
"multicast": {
"description": "This sections describes the system-wide (unit) multicast configuration object.",
"type": "object",
"properties": {
"igmp-snooping-enable": {
"description": "Global config for controlling whether IGMP snooping is enabled. If this global setting is disabled, all VLANs are treated as disabled, whether they are enabled or not.",
"type": "boolean",
"default": true
},
"mld-snooping-enable": {
"description": "Global config for controlling whether MLD snooping is enabled. If this global setting is disabled, all VLANs are treated as disabled, whether they are enabled or not.",
"type": "boolean",
"default": true
},
"unknown-multicast-flood-control": {
"description": "Global config for the unknown multicast flood control feature. This enables the system to forward unknown multicast packets only to a multicast router (mrouter).",
"type": "boolean",
"default": false
},
"querier-enable": {
"description": "Global IGMP querier config. This enables all Vlan interfaces to act as a querier.",
"type": "boolean",
"default": false
}
}
}
}
},
"globals": {
"description": "A device has certain global properties that are used to derive parts of the final configuration that gets applied.",
"type": "object",
"properties": {
"ipv4-network": {
"description": "Define the IPv4 range that is delegatable to the downstream interfaces This is described as a CIDR block. (192.168.0.0/16, 172.16.128/17)",
"type": "string",
"format": "uc-cidr4",
"examples": [
"192.168.0.0/16"
]
},
"ipv6-network": {
"description": "Define the IPv6 range that is delegatable to the downstream interfaces This is described as a CIDR block. (fdca:1234:4567::/48)",
"type": "string",
"format": "uc-cidr6",
"examples": [
"fdca:1234:4567::/48"
]
},
"ipv4-blackhole": {
"description": "Define a list of non-interface specific BLACKHOLE (to-nowhere) routes.",
"type": "array",
"items": {
"type": "object",
"properties": {
"prefix": {
"description": "Defines a BLACKHOLE route's prefix.",
"type": "string",
"format": "uc-cidr4",
"examples": [
"192.168.1.0/24"
]
},
"vrf": {
"description": "VRF id.",
"type": "integer"
}
}
}
},
"ipv4-unreachable": {
"description": "Define a list of non-interface specific UNREACHABLE routes.",
"type": "array",
"items": {
"type": "object",
"properties": {
"prefix": {
"description": "Defines a UNREACHABLE route's prefix.",
"type": "string",
"format": "uc-cidr4",
"examples": [
"192.168.1.0/24"
]
},
"vrf": {
"description": "VRF id.",
"type": "integer"
}
}
}
}
}
},
"ethernet": {
"description": "This section defines the linkk speed and duplex mode of the physical copper/fiber ports of the device.",
"type": "object",
"properties": {
"select-ports": {
"description": "The list of physical network devices that shall be configured. The names are logical ones and wildcardable.",
"type": "array",
"items": {
"type": "string",
"examples": [
"LAN1",
"LAN2",
"LAN3",
"LAN4",
"LAN*",
"WAN*",
"*"
]
}
},
"name": {
"description": "This is a free text field, stating the administrative name of the port. It may contain spaces and special characters, not exceeding 64 characters.",
"type": "string",
"examples": [
"cloud_uplink_port"
]
},
"speed": {
"description": "The link speed that shall be forced.",
"type": "integer",
"enum": [
10,
100,
1000,
2500,
5000,
10000,
25000,
40000,
50000,
100000,
200000
],
"default": 1000
},
"duplex": {
"description": "The duplex mode that shall be forced.",
"type": "string",
"enum": [
"half",
"full"
],
"default": "full"
},
"enabled": {
"description": "This allows forcing the port to down state by default.",
"type": "boolean",
"default": true
},
"services": {
"description": "The services that shall be offered on this L2 interface.",
"type": "array",
"items": {
"type": "string",
"examples": [
"quality-of-service"
]
}
},
"poe": {
"description": "This section describes the ethernet poe-port configuration object.",
"type": "object",
"properties": {
"admin-mode": {
"description": "Option to force admin state over selected port. Setting to <false> immediately shuts down power. Setting to <true> starts PoE hanshake (Power sourcing equipment < - > Powered Device) sequence and in case of success, power is being delivered to Powered Device.",
"type": "boolean",
"default": false
},
"do-reset": {
"description": "Option to force device's PSE (Power sourcing equipment) to invoke a PoE port reset sequence. This option can be used to reset PoE port without flickering it via <admin-mode> down/up sequence.",
"type": "boolean"
},
"detection": {
"description": "The detection mode is used to set the type of devices that are allowed for powering up. The PoE controller can be configured to detect only IEEE standard devices or pre-IEEE legacy devices (which were pre-standard - non-IEEE 802.3af compliant). For example, if \"dot3af\" is used (PoE, max up to 15.4 W), and Powered Device drains >15.4W, Power sourcing equipment won't allow this port to drain power.",
"type": "string",
"examples": [
"2pt-dot3af",
"2pt-dot3af+legacy",
"4pt-dot3af",
"4pt-dot3af+legacy",
"dot3bt",
"dot3bt+legacy",
"legacy"
],
"default": "dot3bt"
},
"power-limit": {
"description": "Option to configure user defined absolute power limit PoE port can dain (in milliwatts, mW).",
"type": "integer",
"default": 99900
},
"priority": {
"description": "Option to set priority to each PoE port. When the PoE switch has less power available and more ports are required to supply power, higher priority ports are receive power in preference to lower priority ports.",
"type": "string",
"default": "low",
"examples": [
"critical",
"high",
"medium",
"low"
]
}
}
},
"ieee8021x": {
"description": "This section describes the per-port specific 802.1X (port access control) configuration.",
"type": "object",
"properties": {
"is-authenticator": {
"description": "Configure PAE processing on port, as well as select this port as an Authenticator (configure PAC role to authenticator). False configures the switch to not process PAC",
"type": "boolean",
"default": false
},
"authentication-mode": {
"description": "Configure PAE processing on port, as well as select this port as an Authenticator (configure PAC role to authenticator). force-authorized - Disables IEEE 802.1X authentication and causes the port to change to the authorized state without any authentication exchange required. The port sends and receives normal traffic without IEEE 802.1X-based authentication of the client. force-unauthorized - Causes the port to remain in the unauthorized state, ignoring all attempts by the supplicant to authenticate. The Device cannot provide authentication services to the supplicant through the port. auto - Enables IEEE 802.1X authentication and causes the port to begin in the unauthorized state, allowing only EAPOL frames to be sent and received through the port. The authentication process begins when the link state of the port changes from down to up or when an EAPOL-start frame is received. The Device requests the identity of the supplicant and begins relaying authentication messages between the supplicant and the authentication server. Each supplicant attempting to access the network is uniquely identified by the Device by using the supplicant MAC address.",
"type": "string",
"enum": [
"force-authorized",
"force-unauthorized",
"auto"
],
"default": "force-authorized"
},
"host-mode": {
"description": "Multi-auth - While in this mode, multiple devices are allowed to independently authenticate through the same port.\nMulti-domain - While in this mode, the authenticator will allow one host from the data domain and one from the voice domain.\nMulti-host - While in this mode, the first device to authenticate will open to the switchport so that all other devices can use the port. These other devices are not required to be authenticated independently.\nSingle-host - While in this mode, the switchport will only allow a single host to be authenticated and to pass traffic at a time.\n",
"type": "string",
"enum": [
"multi-auth",
"multi-domain",
"multi-host",
"single-host"
],
"default": "multi-auth"
},
"guest-vlan": {
"description": "Configure a VLAN as a guest VLAN on an interface if the switch receives no response in an authentication event.",
"type": "integer",
"minimum": 1,
"maximum": 4094
},
"unauthenticated-vlan": {
"description": "Configure the unauthenticated VLAN to use when the AAA server fails to recognize the client credentials",
"type": "integer",
"minimum": 1,
"maximum": 4094
},
"mac-address-bypass": {
"description": "Enables bypass when a device does not support 802.1X authentication (e.g., printers, IP phones)",
"type": "boolean"
},
"mac-address-bypass-timeout-minutes": {
"description": "Defines the time period (in minutes) for which a MAC address is allowed access to the network without requiring reauthentication, after being authenticated or allowed via MAC Authentication Bypass (MAB).",
"type": "integer"
}
}
},
"trunk-group": {
"description": "Associates this port to a trunk or a port-channel.",
"type": "integer",
"minimum": 1,
"maximum": 64
},
"lacp-config": {
"description": "This section describes the 802.3ad Link Aggregation Control Protocol (LACP) configuration for the current interface.",
"type": "object",
"properties": {
"lacp-enable": {
"description": "Enables 802.3ad Link Aggregation Control Protocol (LACP) for the current interface.",
"type": "boolean",
"default": false
},
"lacp-role": {
"description": "Configures the port LACP role as actor or partner.",
"type": "string",
"enum": [
"actor",
"partner"
],
"default": "actor"
},
"lacp-mode": {
"description": "Configures the LACP negotiation activity mode as active or passive.",
"type": "string",
"enum": [
"active",
"passive"
],
"default": "passive"
},
"lacp-port-admin-key": {
"description": "Configures the port's LACP administration key.",
"type": "integer",
"minimum": 1,
"maximum": 65535,
"default": 1
},
"lacp-port-priority": {
"description": "Configures the LACP port priority.",
"type": "integer",
"minimum": 1,
"maximum": 65535,
"default": 32768
},
"lacp-system-priority": {
"description": "Configures the LACP System priority.",
"type": "integer",
"minimum": 1,
"maximum": 65535,
"default": 32768
},
"lacp-pchan-admin-key": {
"description": "Configures the port channel's LACP administration key (optional).",
"type": "integer",
"minimum": 1,
"maximum": 65535
},
"lacp-timeout": {
"description": "Configures the timeout to wait for the next LACP data unit.",
"type": "string",
"enum": [
"short",
"long"
],
"default": "long"
}
}
},
"lldp-interface-config": {
"type": "object",
"description": "Configurations of LLDP on a specified interface.",
"properties": {
"lldp-admin-status": {
"type": "string",
"description": "Enables LLDP transmit, receive, or transmit and receive mode on the specified port.",
"enum": [
"rx",
"tx",
"rx-tx"
]
},
"lldp-basic-tlv-mgmt-ip-v4": {
"type": "boolean",
"description": "Configures an LLDP-enabled port to advertise the management address for this device.",
"default": true
},
"lldp-basic-tlv-mgmt-ip-v6": {
"type": "boolean",
"description": "Configures an LLDP-enabled port to advertise the management IPv6 address for this device, if available.",
"default": false
},
"lldp-basic-tlv-port-descr": {
"type": "boolean",
"description": "Configures an LLDP-enabled port to advertise its port description.",
"default": true
},
"lldp-basic-tlv-sys-capab": {
"type": "boolean",
"description": "Configures an LLDP-enabled port to advertise its system capabilities.",
"default": true
},
"lldp-basic-tlv-sys-descr": {
"type": "boolean",
"description": "Configures an LLDP-enabled port to advertise the system description.",
"default": true
},
"lldp-basic-tlv-sys-name": {
"type": "boolean",
"description": "Configures an LLDP-enabled port to advertise its system name.",
"default": true
},
"lldp-dot1-tlv-proto-ident": {
"type": "boolean",
"description": "Configures an LLDP-enabled port to advertise the supported protocols.",
"default": true
},
"lldp-dot1-tlv-proto-vid": {
"type": "boolean",
"description": "Configures an LLDP-enabled port to advertise port-based protocol-related VLAN information.",
"default": true
},
"lldp-dot1-tlv-pvid": {
"type": "boolean",
"description": "Configures an LLDP-enabled port to advertise its default Native VLAN ID (PVID).",
"default": true
},
"lldp-dot1-tlv-vlan-name": {
"type": "boolean",
"description": "Configures an LLDP-enabled port to advertise its VLAN name.",
"default": true
},
"lldp-dot3-tlv-link-agg": {
"type": "boolean",
"description": "Configures an LLDP-enabled port to advertise its link aggregation capabilities.",
"default": true
},
"lldp-dot3-tlv-mac-phy": {
"type": "boolean",
"description": "Configures an LLDP-enabled port to advertise its MAC and physical layer specifications.",
"default": true
},
"lldp-dot3-tlv-max-frame": {
"type": "boolean",
"description": "Configures an LLDP-enabled port to advertise its maximum frame size.",
"default": true
},
"lldp-dot3-tlv-poe": {
"type": "boolean",
"description": "Configures an LLDP-enabled port to advertise its Power-over-Ethernet capabilities.",
"default": true
},
"lldp-med-location-civic-addr": {
"type": "object",
"description": "Configures an LLDP-MED-enabled port to advertise its location identification details.",
"properties": {
"lldp-med-location-civic-addr-admin-status": {
"type": "boolean",
"description": "Enables or disables the advertisement of this TLV.",
"default": false
},
"lldp-med-location-civic-country-code": {
"type": "string",
"description": "Configure the two-letter ISO 3166 country code in capital ASCII letters."
},
"lldp-med-location-civic-device-type": {
"type": "integer",
"description": "The type of device to which the location applies."
},
"lldp-med-location-civic-ca": {
"description": "The list of LLDP MED Location CA Types to advertise the physical location of the device, that is the city, street number, building and room information.",
"type": "array",
"items": {
"type": "object",
"properties": {
"lldp-med-location-civic-ca-type": {
"type": "integer",
"description": "A one-octet descriptor of the data civic address value.",
"maximum": 255,
"minimum": 0
},
"lldp-med-location-civic-ca-value": {
"type": "string",
"description": "Description of a location.",
"maxLength": 32,
"minLength": 1
}
}
}
}
}
},
"lldp-med-notification": {
"type": "boolean",
"description": "Enables the transmission of SNMP trap notifications about LLDP-MED changes.",
"default": false
},
"lldp-med-tlv-ext-poe": {
"type": "boolean",
"description": "Configures an LLDP-MED-enabled port to advertise its extended Power over Ethernet configuration and usage information.",
"default": true
},
"lldp-med-tlv-inventory": {
"type": "boolean",
"description": "Configures an LLDP-MED-enabled port to advertise its inventory identification details.",
"default": true
},
"lldp-med-tlv-location": {
"type": "boolean",
"description": "Configures an LLDP-MED-enabled port to advertise its location identification details.",
"default": true
},
"lldp-med-tlv-med-cap": {
"type": "boolean",
"description": "Configures an LLDP-MED-enabled port to advertise its Media Endpoint Device capabilities.",
"default": true
},
"lldp-med-tlv-network-policy": {
"type": "boolean",
"description": "Configures an LLDP-MED-enabled port to advertise its network policy configuration.",
"default": true
},
"lldp-notification": {
"type": "boolean",
"description": "Enables the transmission of SNMP trap notifications about LLDP changes.",
"default": false
}
}
},
"ip-arp-inspect-port": {
"type": "object",
"description": "Configuration for ARP Inspection on specific interfaces or ports in the switch.",
"properties": {
"rate-limit-pps": {
"type": "integer",
"description": "Sets a rate limit (packets per second) for the ARP packets received on a port. Ensures that the port does not process ARP packets beyond the configured limit.",
"minimum": 0,
"maximum": 65535
},
"trusted": {
"type": "boolean",
"description": "Configures the port as trusted, exempting it from ARP Inspection. Trusted ports bypass ARP validation checks."
}
}
},
"rate-limit-port": {
"type": "object",
"description": "Configuration for ingress and egress rate limiting on a specific port (in kbps)",
"properties": {
"ingress-kbps": {
"type": "integer",
"description": "Sets the maximum allowed ingress (input) traffic rate for the port, in kilobits per second (kbps).",
"minimum": 64,
"maximum": 1000000000
},
"egress-kbps": {
"type": "integer",
"description": "Sets the maximum allowed egress (output) traffic rate for the port, in kilobits per second (kbps).",
"minimum": 64,
"maximum": 1000000000
}
}
},
"ip-source-guard-port": {
"type": "object",
"description": "Configuration of IP Source Guard (IPSG) on a physical interface in a Layer 2 switch.",
"properties": {
"rule": {
"type": "string",
"description": "Configures the switch to filter inbound traffic based on source IP address only, or source IP address and corresponding MAC address combined.",
"enum": [
"sip",
"sip-mac"
]
},
"mode": {
"type": "string",
"description": "Specifies the learning mode to use for validation, either MAC address table or ACL table. The system searches for source addresses in the specified table.",
"enum": [
"mac",
"acl"
]
},
"max-binding": {
"type": "integer",
"description": "Sets the maximum number of address entries that can be mapped to an interface in the binding table. Includes both static entries and dynamically learned entries via DHCP Snooping.",
"minimum": 1,
"maximum": 65535
}
}
},
"acl": {
"description": "A collection of access control entries that define the rules for filtering traffic through a network port.",
"type": "array",
"items": {
"type": "object",
"properties": {
"acl-inf-policy-preference": {
"description": "Determines the priority of multiple ACL policies when more than one is applied to an interface, if any.",
"type": "integer",
"minimum": 1,
"maximum": 64,
"default": 1
},
"acl-inf-policy-ingress": {
"description": "Specifies the ACL policy that is applied to incoming traffic on an interface.",
"type": "string",
"maxLength": 32,
"minLength": 1,
"examples": [
"blacklisted-macs"
]
},
"acl-inf-counters-ingress": {
"description": "Tracks the number and type of packets that match the ingress ACL rules on an interface.",
"type": "boolean",
"default": false
},
"acl-inf-policy-egress": {
"description": "Specifies the ACL policy that is applied to outgoing traffic from an interface.",
"type": "string",
"maxLength": 32,
"minLength": 1,
"examples": [
"blacklisted-macs"
]
},
"acl-inf-counters-egress": {
"description": "Tracks the number and type of packets that match the egress ACL rules on an interface.",
"type": "boolean",
"default": false
}
}
}
},
"voice-vlan-intf-config": {
"description": "Configure the Voice VLAN feature at the interface level, allowing for VoIP traffic to be prioritized on this specific port.",
"type": "object",
"properties": {
"voice-vlan-intf-mode": {
"description": "Specify the mode of placing this port on the voice VLAN.",
"type": "string",
"default": "auto",
"enum": [
"none",
"manual",
"auto"
]
},
"voice-vlan-intf-priority": {
"description": "Define the Class of Service (CoS) priority for VoIP traffic passing through this port, ensuring higher priority over other traffic types.",
"type": "integer",
"default": 6,
"minimum": 0,
"maximum": 6
},
"voice-vlan-intf-detect-voice": {
"description": "Select the detection method for identifying VoIP traffic on this port, such as OUI-based detection or traffic pattern recognition.",
"type": "string",
"default": "oui",
"enum": [
"oui",
"lldp"
]
},
"voice-vlan-intf-security": {
"description": "Enable or configure security filtering for VoIP traffic on the interface to protect against unauthorized devices.",
"type": "boolean",
"default": false
}
}
},
"dhcp-snoop-port": {
"description": "Configuration for DHCP Snooping on a port level on a switch",
"type": "object",
"properties": {
"dhcp-snoop-port-trust": {
"description": "This parameter designates a switch port as \u2018trusted\u2019 for DHCP messages, meaning it can forward DHCP offers and acknowledgments, which is essential for connecting to legitimate DHCP servers",
"type": "boolean",
"default": false
},
"dhcp-snoop-port-client-limit": {
"description": "It sets a limit on the number of DHCP clients that can be associated with a single port, helping to prevent a single port from exhausting the network\u2019s IP address pool",
"type": "integer",
"minimum": 1
},
"dhcp-snoop-port-circuit-id": {
"description": "Specifies DHCP Option 82 circuit ID suboption information. Often including information like the interface number and VLAN ID, this can be useful for network management and troubleshooting",
"type": "string",
"minLength": 1,
"maxLength": 32
}
}
},
"bpdu-guard": {
"description": "BPDU Guard configuration block. Enables protection against unexpected BPDUs on edge ports to prevent loops and rogue switch connections.",
"type": "object",
"properties": {
"enabled": {
"description": "When true, the port will be placed into an error-disabled state if any BPDU is received.",
"type": "boolean"
},
"auto-recovery-secs": {
"description": "Time in 'seconds' after which a port that was err-disabled due to BPDU Guard violation will be automatically re-enabled.",
"type": "integer",
"default": 300
}
}
},
"edge-port": {
"description": "When true, the port behaves as an STP Edge Port. When false, the port participates fully in STP and is treated as a normal switch port.",
"type": "boolean",
"default": false
"storm-control": {
"description": "Storm Control configuration per storm type. Allows enabling or disabling traffic storm control for broadcast, multicast, and unknown unicast packets, with independent packet-per-second (pps) thresholds. A limit-pps value of 0 implies the control is disabled for that traffic type.",
"type": "object",
"properties": null,
"broadcast-pps": {
"type": "integer",
"minimum": 0,
"default": 0,
"description": "Maximum allowed broadcast packets per second. 0 disables broadcast storm control."
},
"multicast-pps": {
"type": "integer",
"minimum": 0,
"default": 0,
"description": "Maximum allowed multicast packets per second. 0 disables multicast storm control."
},
"unknown-unicast-pps": {
"type": "integer",
"minimum": 0,
"default": 0,
"description": "Maximum allowed unknown unicast packets per second. 0 disables unknown unicast storm control."
}
}
}
},
"switch.arp-inspect": {
"type": "object",
"description": "Global configuration for ARP Inspection on the switch.",
"properties": {
"ip-arp-inspect": {
"type": "boolean",
"description": "Enable or disable ARP Inspection globally.",
"default": false
},
"validate-dst-mac": {
"type": "boolean",
"description": "Validate that the destination MAC address in the Ethernet header matches the target MAC address in the ARP body for ARP responses."
},
"validate-ip": {
"type": "boolean",
"description": "Validate ARP packets for unexpected or invalid IP addresses, such as 0.0.0.0, 255.255.255.255, and IP multicast addresses."
},
"validate-allow-zeros": {
"type": "boolean",
"description": "Allow ARP packets where the sender IP address is 0.0.0.0."
},
"validate-src-mac": {
"type": "boolean",
"description": "Validate that the source MAC address in the Ethernet header matches the sender MAC address in the ARP body for both ARP requests and responses."
}
}
},
"switch.ip-source-guard": {
"type": "object",
"description": "Configuration for IP Source Guard global static bindings in a Layer 2 switch.",
"properties": {
"bindings": {
"type": "array",
"description": "List of static bindings for IP Source Guard.",
"items": {
"type": "object",
"properties": {
"binding-mode": {
"type": "string",
"description": "Specifies the mode for adding a static address to the Source Guard ACL or MAC address binding table. It determines whether the binding is based on MAC addresses or ACLs.",
"enum": [
"mac",
"acl"
]
},
"binding-mac": {
"type": "string",
"format": "uc-mac",
"description": "A valid unicast MAC address for binding to the Source Guard filtering table."
},
"binding-vlans": {
"type": "integer",
"description": "The VLAN ID associated with the static binding for Source Guard filtering. Must be a valid, configured VLAN on the switch."
},
"binding-ip": {
"type": "string",
"format": "ipv4",
"description": "A valid unicast IPv4 address to associate with the Source Guard filtering table."
},
"binding-port": {
"type": "string",
"description": "The physical interface (e.g., ethernet0, ethernet1) where the Source Guard binding applies."
}
}
}
}
}
},
"switch.rtevent": {
"description": "Configuration for enabling or disabling specific event categories and their sub-events.",
"type": "object",
"properties": {
"port-status": {
"description": "Enable/Disable Port Status events.",
"type": "object",
"properties": {
"enabled": {
"description": "Enable/Disable Port Status category.",
"type": "boolean",
"default": false
},
"sub-events": {
"type": "object",
"properties": {
"wired.carrier-down": {
"type": "boolean",
"description": "Enable/Disable carrier down event.",
"default": false
},
"wired.carrier-up": {
"type": "boolean",
"description": "Enable/Disable carrier up event.",
"default": false
}
}
}
}
},
"module": {
"description": "Enable/Disable Module events.",
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable/Disable Module category.",
"default": false
},
"sub-events": {
"type": "object",
"properties": {
"module.plugout": {
"type": "boolean",
"description": "Enable/Disable module plugout event.",
"default": false
},
"module.plugin": {
"type": "boolean",
"description": "Enable/Disable module plugin event.",
"default": false
}
}
}
}
},
"stp": {
"description": "Enable/Disable STP events.",
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable/Disable STP category.",
"default": false
},
"sub-events": {
"type": "object",
"properties": {
"stp.loop-detected": {
"type": "boolean",
"description": "Enable/Disable loop detected event.",
"default": false
},
"stp.loop-cleared": {
"type": "boolean",
"description": "Enable/Disable loop cleared event.",
"default": false
},
"stp.state-change": {
"type": "boolean",
"description": "Enable/Disable state change event.",
"default": false
}
}
}
}
},
"rstp": {
"description": "Enable/Disable RSTP events.",
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable/Disable RSTP category.",
"default": false
},
"sub-events": {
"type": "object",
"properties": {
"rstp.loop-detected": {
"type": "boolean",
"description": "Enable/Disable loop detected event.",
"default": false
},
"rstp.loop-cleared": {
"type": "boolean",
"description": "Enable/Disable loop cleared event.",
"default": false
},
"rstp.state-change": {
"type": "boolean",
"description": "Enable/Disable state change event.",
"default": false
}
}
}
}
},
"fw-upgrade": {
"description": "Enable/Disable Firmware Upgrade events.",
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable/Disable Firmware Upgrade category.",
"default": false
},
"sub-events": {
"type": "object",
"properties": {
"upg.download-start": {
"type": "boolean",
"description": "Enable/Disable download start event.",
"default": false
},
"upg.download-in-progress": {
"type": "boolean",
"description": "Enable/Disable download in progress event.",
"default": false
},
"upg.download-failed": {
"type": "boolean",
"description": "Enable/Disable download failed event.",
"default": false
},
"upg.validation-start": {
"type": "boolean",
"description": "Enable/Disable validation start event.",
"default": false
},
"upg.validation-success": {
"type": "boolean",
"description": "Enable/Disable validation success event.",
"default": false
},
"upg.validation-failed": {
"type": "boolean",
"description": "Enable/Disable validation failed event.",
"default": false
},
"upg.backup-current-firmware": {
"type": "boolean",
"description": "Enable/Disable firmware backup event.",
"default": false
},
"upg.install-start": {
"type": "boolean",
"description": "Enable/Disable install start event.",
"default": false
},
"upg.install-failed": {
"type": "boolean",
"description": "Enable/Disable install failed event.",
"default": false
},
"upg.reboot-start": {
"type": "boolean",
"description": "Enable/Disable reboot start event.",
"default": false
},
"upg.success": {
"type": "boolean",
"description": "Enable/Disable upgrade success event.",
"default": false
}
}
}
}
},
"dhcp-snooping": {
"description": "Enable/Disable DHCP Snooping events.",
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable/Disable DHCP Snooping category.",
"default": false
},
"sub-events": {
"type": "object",
"properties": {
"dhcp-snooping.violation-detected": {
"type": "boolean",
"description": "Enable/Disable DHCP Snooping violation detected event.",
"default": false
},
"dhcp-snooping.violation-cleared": {
"type": "boolean",
"description": "Enable/Disable DHCP Snooping violation cleared event.",
"default": false
}
}
}
}
}
}
},
"switch.acl": {
"description": "Contains all the access control rule definitions",
"type": "array",
"uniqueItems": true,
"items": {
"type": "object",
"properties": {
"acl-name": {
"description": "The identifier or name for the Access Control List",
"type": "string",
"maxLength": 32,
"minLength": 1
},
"acl-type": {
"description": "Type of the access control list",
"type": "string",
"enum": [
"ipv4",
"ipv6",
"ipv4Ext",
"ipv6Ext",
"mac",
"arp"
]
},
"acl-rules": {
"description": "access control rules under this ACL",
"type": "object",
"additionalProperties": {
"type": "array",
"uniqueItems": true,
"items": {
"type": "object",
"properties": {
"acl-rule-action": {
"description": "Defines whether to permit or deny traffic matching the rule",
"type": "string",
"enum": [
"permit",
"deny"
]
},
"acl-source-macaddress": {
"description": "Specifies the source MAC address to filter on",
"type": "string",
"format": "uc-mac"
},
"acl-source-macbitmask": {
"description": "The mask applied to the source MAC address",
"type": "string",
"format": "uc-mac"
},
"acl-dest-macaddress": {
"description": "Specifies the destination MAC address for the filter",
"type": "string",
"format": "uc-mac"
},
"acl-dest-macbitmask": {
"description": "The mask applied to the destination MAC address",
"type": "string",
"format": "uc-mac"
},
"acl-packet-format": {
"description": "Identifies the protocol encapsulated in the Ethernet frame by its EtherType",
"type": "string",
"enum": [
"any",
"untagged-eth2",
"untagged-802.3",
"tagged-eth2",
"tagged-802.3"
]
},
"acl-vlanid": {
"description": "Specifies a VLAN ID to filter traffic from a specific VLAN",
"type": "integer",
"minimum": 1,
"maximum": 4094
},
"acl-vid-bitmask": {
"description": "The mask applied to the VLAN ID",
"type": "integer",
"minimum": 1,
"maximum": 4095
},
"acl-ethertype": {
"description": "Filters packets based on the custom EtherType field (HEX) in the Ethernet frame",
"type": "string",
"default": "800"
},
"acl-ethertype-bitmask": {
"description": "The mask applied to the EtherType field",
"type": "string",
"default": "FFFF"
},
"acl-cos": {
"description": "Filters based on the Class of Service (CoS) field in the frame",
"type": "integer",
"minimum": 0,
"maximum": 7
},
"acl-cos-bitmask": {
"description": "The mask applied to the CoS field",
"type": "integer",
"minimum": 0,
"maximum": 7
},
"acl-ipv4-source-address": {
"description": "The IPv4 address of the source to filter on",
"type": "string",
"format": "ipv4"
},
"acl-ipv4-source-subnetmask": {
"description": "The subnet mask applied to the source IPv4 address",
"type": "string",
"format": "ipv4"
},
"acl-ipv4-dest-address": {
"description": "The IPv4 address of the destination to filter on",
"type": "string",
"format": "ipv4"
},
"acl-ipv4-dest-subnetmask": {
"description": "The subnet mask applied to the destination IPv4 address",
"type": "string",
"format": "ipv4"
},
"acl-ip-proto": {
"description": "Filters based on the IP protocol number",
"type": "integer",
"minimum": 0,
"maximum": 255
}
}
}
}
}
}
}
},
"switch": {
"description": "This section defines the switch fabric specific features of a physical switch.",
"type": "object",
"properties": {
"port-mirror": {
"description": "Enable mirror of traffic from multiple minotor ports to a single analysis port.",
"type": "array",
"items": {
"type": "object",
"properties": {
"monitor-ports": {
"description": "The list of ports that we want to mirror.",
"type": "array",
"items": {
"type": "string"
}
},
"analysis-port": {
"description": "The port that mirror'ed packets should be sent to.",
"type": "string"
}
}
}
},
"loop-detection": {
"description": "Enable loop detection on the L2 switches/bridge.",
"type": "object",
"properties": {
"protocol": {
"description": "Define which protocol shall be used for loop detection.",
"type": "string",
"enum": [
"none",
"stp",
"rstp",
"mstp",
"pvstp",
"rpvstp"
],
"default": "rstp"
},
"roles": {
"description": "Define on which logical switches/bridges we want to provide loop-detection.",
"type": "array",
"items": {
"type": "string",
"enum": [
"upstream",
"downstream"
]
}
},
"instances": {
"description": "Define a list of configuration for each STP instance. Meaning of this field depends on current STP protocol (switch.loop-detection.protocol)",
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"description": "Indicates instance to configure. Depends on current STP protocol If RPVSTP/PVSTP - vlan id If MSTP - instance id",
"type": "integer"
},
"enabled": {
"description": "Enable STP on this instance.",
"type": "boolean",
"default": true
},
"priority": {
"description": "Bridge priority.",
"type": "integer",
"default": 32768
},
"forward_delay": {
"description": "Defines the amount of time a switch port stays in the Listening and Learning states before transitioning to the Forwarding state.",
"type": "integer",
"default": 15
},
"hello_time": {
"description": "Determines how often switches send BPDU.",
"type": "integer",
"default": 2
},
"max_age": {
"description": "Specifies the maximum time that a switch port should wait to receive a BPDU from its neighbor before considering the link as failed or disconnected.",
"type": "integer",
"default": 20
}
}
}
}
}
},
"ieee8021x": {
"description": "This section describes the global 802.1X (port access control) configuration.",
"type": "object",
"properties": {
"auth-control-enable": {
"description": "Enabled processing of PAE frames on ports that have .1X configured.",
"type": "boolean",
"default": false
},
"radius": {
"description": "Define a list of RADIUS server to forward auth requests to.",
"type": "array",
"items": {
"type": "object",
"properties": {
"server-host": {
"description": "Remote radius server address (IP or hostname).",
"type": "string",
"examples": [
"192.168.1.1",
"somehost.com"
]
},
"server-authentication-port": {
"description": "The port that the RADIUS authentication agent is running on.",
"type": "integer",
"maximum": 65535,
"minimum": 1
},
"server-key": {
"description": "Secret key text that is shared between a RADIUS server and the switch.",
"type": "string",
"examples": [
"somepassword"
]
},
"server-priority": {
"description": "The server's priority (used when multiple servers are present. Bigger prio value = higher priority).",
"type": "integer",
"maximum": 64,
"minimum": 1
}
}
}
},
"dynamic-authorization": {
"description": "Additional dynamic authorization (RFC 5176 compliant) - configure option for DAS that enable RM and CoA processing.",
"type": "object",
"properties": {
"auth-type": {
"description": "Sets the accepted authorization types for dynamic RADIUS clients. all - Selects all COA client authentication types. All authentication attributes must match for the authentication to succeed. any - Selects any COA client authentication type. Any authentication attribute may match for the authentication to succeed. session-key - Indicates that the session-key must match for authentication to succeed.",
"type": "string",
"enum": [
"all",
"any",
"session-key"
]
},
"bounce-port-ignore": {
"description": "Sets the switch to ignore bounce-port requests from dynamic authorization clients.",
"type": "boolean",
"default": false
},
"disable-port-ignore": {
"description": "Sets the switch to ignore requests from dynamic authorization clients.",
"type": "boolean",
"default": false
},
"ignore-server-key": {
"description": "Do not attmept to authenticate with the server key.",
"type": "boolean",
"default": false
},
"ignore-session-key": {
"description": "Do not attmept to authenticate with the session key.",
"type": "boolean",
"default": false
},
"server-key": {
"description": "Sets the shared secret to verify client COA requests for this server.",
"type": "string"
},
"client": {
"description": "Configure DAC.",
"type": "array",
"items": {
"type": "object",
"properties": {
"address": {
"description": "A valid IP address or hostname of a DAC.",
"type": "string"
},
"server-key": {
"description": "Sets the shared secret to verify client COA requests for this server.",
"type": "string"
}
}
}
}
}
}
}
},
"port-isolation": {
"description": "This section describes the per-port specific port-isolation matrix (to which ports selected port can forward traffic to) configuration. Omitting this configuration completely fully disables any port-isolation configuration on this given port.",
"type": "object",
"properties": {
"sessions": {
"description": "Allow selected port to forward traffic in the provided session-based format.",
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"description": "Session id to configure.",
"type": "integer"
},
"uplink": {
"description": "Configuration object for uplink interface(s)",
"type": "object",
"properties": {
"interface-list": {
"description": "List of interfaces (either physical or trunk ports)",
"type": "array",
"items": {
"type": "string"
}
}
}
},
"downlink": {
"description": "Configuration object for downlink interface(s)",
"type": "object",
"properties": {
"interface-list": {
"description": "List of interfaces (either physical or trunk ports)",
"type": "array",
"items": {
"type": "string"
}
}
}
}
}
}
}
}
},
"trunk-balance-method": {
"description": "Sets the load-distribution method among ports in aggregated links for both static and LACP based trunks.",
"type": "string",
"enum": [
"dst-ip",
"dst-mac",
"src-dst-ip",
"src-dst-mac",
"src-ip",
"src-mac"
],
"default": "src-dst-mac"
},
"jumbo-frames": {
"description": "Enables Jumbo frames",
"type": "boolean",
"default": false
},
"dhcp-snooping": {
"description": "DHCP Snooping configuration parameters",
"type": "object",
"properties": {
"dhcp-snoop-enable": {
"description": "Enables DHCP Snooping on the network switch, which is a security feature that prevents unauthorized DHCP servers from offering IP addresses",
"type": "boolean",
"default": false
},
"dhcp-snoop-rate-limit": {
"description": "Sets a limit on the number of DHCP packets per second that can be received on an untrusted interface to prevent DHCP flooding attacks",
"type": "integer",
"minimum": 1,
"maximum": 2048
},
"dhcp-snoop-mac-verify": {
"description": "This option ensures that the MAC address in a DHCP request matches the source MAC address of the packet, providing an additional layer of security",
"type": "boolean",
"default": false
},
"dhcp-snoop-inf-opt-82": {
"description": "This refers to the insertion of information option 82 in DHCP packets, which adds more details about the client\u2019s location and network information for tracking and control purposes",
"type": "boolean",
"default": false
},
"dhcp-snoop-inf-opt-encode-subopt": {
"description": "This parameter allows for the encoding of sub-options within option 82 to further specify client information",
"type": "boolean",
"default": false
},
"dhcp-snoop-inf-opt-remoteid": {
"description": "It specifies the remote ID sub-option in option 82, which typically includes information like the circuit ID or remote host identifier",
"type": "string",
"maxLength": 32,
"minLength": 1
},
"dhcp-snoop-inf-opt-policy": {
"description": "This defines the policy for handling packets with option 82, determining whether they should be forwarded or dropped based on the configuration",
"type": "string",
"enum": [
"drop",
"keep",
"replace"
]
}
}
},
"mvr-config": {
"description": "This section defines the Multicast VLAN Registration (MVR) general configuration.",
"type": "object",
"properties": {
"mvr-enable": {
"description": "Enable/Disable MVR globally on the switch.",
"type": "boolean",
"default": false
},
"mvr-proxy-query-intvl": {
"description": "This command configures the interval (in seconds) at which the receiver port sends out general queries. The maximum value is determined based on 12 hours as maximum interval, and minimum as 1 second as allowed value.",
"type": "integer",
"default": 125,
"maximum": 43200,
"minimum": 1
},
"mvr-proxy-switching": {
"description": "Enable the MVR proxy switching mode, where the source port acts as a host, and the receiver port acts as an MVR router with querier service enabled.",
"type": "boolean",
"default": false
},
"mvr-robustness-val": {
"description": "Configure the expected packet loss, and thereby the number of times to generate report and group-specific queries when changes are learned about downstream groups, and the number of times group-specific queries are sent to downstream receiver ports. Right configuration ensures that multicast group memberships are correctly maintained even if some control messages are lost due to network issues.",
"type": "integer",
"default": 2,
"maximum": 255,
"minimum": 1
},
"mvr-source-port-mode": {
"description": "Configure the switch to forward only multicast streams that a source port has dynamically joined or to forward all multicast groups.",
"type": "string",
"default": "forward",
"enum": [
"dynamic",
"forward"
]
}
}
},
"mvr-domain-config": {
"description": "Configure the Multicast VLAN Registration (MVR) domains.",
"type": "array",
"items": {
"type": "object",
"properties": {
"mvr-domain-id": {
"description": "Unique identifier for a Multicast Domain defined under the MVR.",
"type": "integer",
"minimum": 1,
"maximum": 10,
"default": 1
},
"mvr-domain-enable": {
"description": "Enable/disable Multicast VLAN Registration (MVR) for a specific domain.",
"type": "boolean",
"default": false
},
"mvr-domain-vlan-id": {
"description": "Per domain Level Multicast VLAN ID. Specifies the VLAN through which MVR multicast data is received. This is the VLAN to which all source ports must be assigned.",
"type": "integer",
"minimum": 1,
"maximum": 4094,
"default": 1
},
"mvr-domain-upstream-sip": {
"description": "Configures the source IP address assigned to all MVR control packets sent upstream on all domains or on a specified domain.",
"type": "string",
"format": "ipv4",
"examples": [
"192.168.0.5"
]
}
}
}
},
"mvr-group-config": {
"type": "array",
"description": "List of MVR groups (or profiles) configuration.",
"items": {
"type": "object",
"properties": {
"mvr-group-name": {
"type": "string",
"description": "The name of a MVR group that consists of one or more MVR group addresses",
"maxLength": 16,
"minLength": 1
},
"mvr-group-range-start": {
"type": "string",
"format": "ipv4",
"description": "Start IP address on the range of MVR group addresses that maps to a profile/MVR group"
},
"mvr-group-range-end": {
"type": "string",
"format": "ipv4",
"description": "Statically configure all multicast group addresses that will join an MVR VLAN. Map a range of MVR group addresses to a profile"
},
"mvr-group-assoc-domain": {
"descpription": "Map the MVR Group to a secific domain. There can be many profiles under a single domain",
"type": "array",
"items": {
"type": "integer",
"maximum": 10,
"minimum": 1
}
}
},
"required": [
"mvr-group-name",
"mvr-group-range-start",
"mvr-group-range-end",
"mvr-group-assoc-domain"
]
}
},
"lldp-global-config": {
"type": "object",
"description": "Configuration options for LLDP on a global level in a OLS switch.",
"properties": {
"lldp-enable": {
"type": "boolean",
"default": true,
"description": "Enables or disables LLDP globally at a switch level."
},
"lldp-holdtime-multiplier": {
"type": "integer",
"description": "Configures the time-to-live (TTL) value sent in LLDP advertisements. The TTL tells the receiving LLDP agent how long to retain all information from the sending LLDP agent if it does not transmit updates in a timely manner.",
"default": 4
},
"lldp-med-fast-start-count": {
"type": "integer",
"description": "Configures how many medFastStart packets are transmitted during the activation process of the LLDP-MED Fast Start mechanism.",
"default": 4
},
"lldp-refresh-interval": {
"type": "integer",
"description": "Configures the periodic transmit interval for LLDP advertisements (in seconds).",
"default": 30
},
"lldp-reinit-delay": {
"type": "integer",
"description": "Configures the delay (in seconds) before reinitializing after LLDP ports are disabled or the link goes down.",
"default": 2
},
"lldp-tx-delay": {
"type": "integer",
"description": "Configures a delay (in seconds) between successive transmissions of advertisements initiated by a change in local LLDP state.",
"maximum": 8192,
"minimum": 1
},
"lldp-notification-interval": {
"type": "integer",
"description": "Configures the interval (in seconds) for sending SNMP notifications about LLDP changes.",
"default": 5
}
}
},
"mc-lag": {
"type": "boolean",
"description": "Enables MC-LAG or disables it.",
"default": false
},
"mclag-config": {
"description": "This section defines the MC-LAG configuration parameters for the switch.",
"type": "object",
"properties": {
"mclag-domains": {
"description": "List of MC-LAG domain configurations for the switch.",
"type": "array",
"items": {
"type": "object",
"properties": {
"mclag-domain": {
"description": "Specifies the MC-LAG domain ID to identify the grouping of peer switches.",
"type": "integer",
"minimum": 1,
"maximum": 1024,
"default": 1
},
"peer-link": {
"description": "Configures the peer-link, which could be a physical port or a trunk group that connects the two MC-LAG peer switches.",
"type": "object",
"properties": {
"type": {
"description": "Defines the type of peer-link, either 'port' or 'trunk-group'",
"type": "string",
"enum": [
"port",
"trunk-group"
],
"default": "trunk-group"
},
"value": {
"description": "Specifies the port or trunk-group ID for the peer-link.",
"type": "integer",
"minimum": 1,
"maximum": 64
}
}
},
"mclag-group": {
"description": "Configures the MC-LAG group, which binds the interfaces into a multi-chassis LAG.",
"type": "object",
"properties": {
"group-id": {
"description": "Defines the unique MC-LAG group identifier.",
"type": "integer",
"minimum": 1,
"maximum": 128
},
"members": {
"description": "List of interfaces that participate in the MC-LAG group.",
"type": "array",
"items": {
"type": "string",
"description": "Interface names that are part of the MC-LAG group.",
"examples": [
"eth0",
"eth1"
]
}
},
"lacp-config": {
"description": "LACP configuration settings for the MC-LAG group.",
"type": "object",
"properties": {
"lacp-enable": {
"description": "Enables or disables LACP for the MC-LAG group.",
"type": "boolean",
"default": true
},
"lacp-role": {
"description": "Configures the LACP role as 'actor' or 'partner'",
"type": "string",
"enum": [
"actor",
"partner"
],
"default": "actor"
},
"lacp-timeout": {
"description": "Sets the LACP timeout as either 'short' or 'long'.",
"type": "string",
"enum": [
"short",
"long"
],
"default": "long"
}
}
}
}
},
"system-priority": {
"description": "Specifies the system priority used by the switch for LACP negotiations.",
"type": "integer",
"minimum": 1,
"maximum": 65535,
"default": 32768
},
"dual-active-detection": {
"description": "Enables dual-active detection to prevent split-brain scenarios in MC-LAG.",
"type": "boolean",
"default": true
}
}
}
}
}
},
"voice-vlan-config": {
"description": "This parameter enables or disables the overall configuration of the Voice VLAN feature on the switch. When enabled, it allows the system to classify and prioritize voice traffic.",
"type": "object",
"properties": {
"voice-vlan-id": {
"description": "Specifies the VLAN ID assigned to the Voice VLAN. This is the unique identifier for the VLAN that will be used for prioritizing voice traffic.",
"type": "integer",
"minimum": 1,
"maximum": 4094
},
"voice-vlan-ageing-time": {
"description": "Defines the time, in minutes, that a dynamic Voice VLAN entry remains in the VLAN after voice traffic is no longer detected. It helps manage resources by removing inactive voice devices from the VLAN after this time elapses.",
"type": "integer",
"minimum": 5,
"maximum": 43200,
"default": 1440
},
"voice-vlan-oui-config": {
"description": "Configures the Organizationally Unique Identifier (OUI) for identifying the voice devices (like IP phones).",
"type": "array",
"items": {
"type": "object",
"properties": {
"voice-vlan-oui-mac": {
"description": "The specific MAC address pattern that corresponds to voice devices, as determined by the OUI. It is used for identifying and classifying voice traffic.",
"type": "string",
"format": "uc-mac"
},
"voice-vlan-oui-mask": {
"description": "A mask applied to the MAC address to help match the OUI more precisely. It ensures that the correct portion of the MAC address is evaluated to identify a device as a voice device.",
"type": "string",
"format": "uc-mac"
},
"voice-vlan-oui-description": {
"description": "A descriptive label or comment for the OUI configuration. This can help administrators keep track of which OUI belongs to which type of voice device or vendor.",
"type": "string",
"maxLength": 32,
"minLength": 1,
"examples": [
"A VoIP Phone"
]
}
}
}
}
}
},
"arp-inspect": {
"$ref": "#/$defs/switch.arp-inspect"
},
"ip-source-guard": {
"$ref": "#/$defs/switch.ip-source-guard"
},
"rt-events": {
"$ref": "#/$defs/switch.rtevent"
},
"acl": {
"$ref": "#/$defs/switch.acl"
},
"dns": {
"description": "Define a global list of dns servers.",
"type": "array",
"items": {
"type": "string"
}
}
}
},
"interface.vlan": {
"description": "This section describes the vlan behaviour of a logical network interface.",
"type": "object",
"properties": {
"id": {
"description": "This is the pvid of the vlan that shall be assigned to the interface. The individual physical network devices contained within the interface need to be told explicitly if egress traffic shall be tagged.",
"type": "integer",
"maximum": 4094
},
"range-start": {
"decription": "Start vlan-id of the specified range",
"type": "integer",
"maximum": 4094
},
"range-end": {
"decription": "End vlan-id of the specified range",
"type": "integer",
"maximum": 4094
},
"proto": {
"decription": "The L2 vlan tag that shall be added (1q,1ad)",
"type": "string",
"enum": [
"802.1ad",
"802.1q"
],
"default": "802.1q"
},
"stp-instance": {
"decription": "MSTP instance identifier of the vlan. This field does nothing if MSTP is not enabled.",
"type": "integer"
}
}
},
"interface.bridge": {
"description": "This section describes the bridge behaviour of a logical network interface.",
"type": "object",
"properties": {
"mtu": {
"description": "The MTU that shall be used by the network interface.",
"type": "integer",
"maximum": 65535,
"minimum": 256,
"examples": [
1500
]
},
"tx-queue-len": {
"description": "The Transmit Queue Length is a TCP/IP stack network interface value that sets the number of packets allowed per kernel transmit queue of a network interface device.",
"type": "integer",
"examples": [
5000
]
},
"isolate-ports": {
"description": "Isolates the bridge ports from each other.",
"type": "boolean",
"default": false
}
}
},
"interface.ethernet": {
"description": "This section defines the physical copper/fiber ports that are members of the interface. Network devices are referenced by their logical names.",
"type": "object",
"properties": {
"select-ports": {
"description": "The list of physical network devices that shall be added to the interface. The names are logical ones and wildcardable. \"WAN\" will use whatever the hardwares default upstream facing port is. \"LANx\" will use the \"x'th\" downstream facing ethernet port. LAN* will use all downstream ports.",
"type": "array",
"items": {
"type": "string",
"examples": [
"LAN1",
"LAN2",
"LAN3",
"LAN4",
"LAN*",
"WAN*",
"*"
]
}
},
"multicast": {
"description": "Enable multicast support.",
"type": "boolean",
"default": true
},
"learning": {
"description": "Controls whether a given port will learn MAC addresses from received traffic or not. If learning if off, the bridge will end up flooding any traffic for which it has no FDB entry. By default this flag is on.",
"type": "boolean",
"default": true
},
"isolate": {
"description": "Only allow communication with non-isolated bridge ports when enabled.",
"type": "boolean",
"default": false
},
"macaddr": {
"description": "Enforce a specific MAC to these ports.",
"type": "string",
"format": "uc-mac"
},
"reverse-path-filter": {
"description": "Reverse Path filtering is a method used by the Linux Kernel to help prevent attacks used by Spoofing IP Addresses.",
"type": "boolean",
"default": false
},
"vlan-tag": {
"description": "Shall the port have a vlan tag.",
"type": "string",
"enum": [
"tagged",
"un-tagged",
"auto"
],
"default": "auto"
}
}
},
"interface.ipv4.arp-inspect": {
"type": "object",
"description": "Configuration for ARP Inspection on specific VLANs in the switch.",
"properties": {
"vlan-enable": {
"type": "boolean",
"description": "Enable or disable ARP Inspection for a specified VLAN."
},
"vlan-acl-rule": {
"type": "string",
"description": "Specifies an ARP ACL to apply to one or more VLANs.",
"maxLength": 32,
"minLength": 1
},
"vlan-acl-nodhcp-bindings": {
"type": "boolean",
"description": "Validate ARP packets against only the specified ACL without checking address bindings in the DHCP snooping database."
}
}
},
"interface.ipv4.dhcp": {
"description": "This section describes the DHCP server configuration",
"type": "object",
"properties": {
"lease-first": {
"description": "The last octet of the first IPv4 address in this DHCP pool.",
"type": "integer",
"examples": [
10
]
},
"lease-count": {
"description": "The number of IPv4 addresses inside the DHCP pool.",
"type": "integer",
"examples": [
100
]
},
"lease-time": {
"description": "How long the lease is valid before a RENEW must be issued.",
"type": "string",
"format": "uc-timeout",
"default": "6h"
},
"relay-server": {
"description": "Use host at this IPv4 address to forward packets between clients and servers on different subnets.",
"type": "string",
"format": "ipv4",
"example": "192.168.2.1"
},
"circuit-id-format": {
"description": "This option selects what info shall be contained within a relayed frame's circuit ID. The string passed in has placeholders that are placed inside a bracket pair \"{}\". Any text not contained within brackets will be included as freetext. Valid placeholders are \"Interface, VLAN-ID\"",
"type": "string",
"example": [
"\\{Interface\\}:\\{VLAN-ID\\}}"
]
}
}
},
"interface.ipv4.dhcp-lease": {
"description": "This section describes the static DHCP leases of this logical interface.",
"type": "object",
"properties": {
"macaddr": {
"description": "The MAC address of the host that this lease shall be used for.",
"type": "string",
"format": "uc-mac",
"examples": [
"00:11:22:33:44:55"
]
},
"static-lease-offset": {
"description": "The offset of the IP that shall be used in relation to the first IP in the available range.",
"type": "integer",
"examples": [
10
]
},
"lease-time": {
"description": "How long the lease is valid before a RENEW muss ne issued.",
"type": "string",
"format": "uc-timeout",
"default": "6h"
},
"publish-hostname": {
"description": "Shall the hosts hostname be made available locally via DNS.",
"type": "boolean",
"default": true
}
}
},
"interface.ipv4.port-forward": {
"description": "This section describes an IPv4 port forwarding.",
"type": "object",
"properties": {
"protocol": {
"description": "The layer 3 protocol to match.",
"type": "string",
"enum": [
"tcp",
"udp",
"any"
],
"default": "any"
},
"external-port": {
"description": "The external port(s) to forward.",
"type": [
"integer",
"string"
],
"minimum": 0,
"maximum": 65535,
"format": "uc-portrange"
},
"internal-address": {
"description": "The internal IP to forward to. The address will be masked and concatenated with the effective interface subnet.",
"type": "string",
"format": "ipv4",
"example": "0.0.0.120"
},
"internal-port": {
"description": "The internal port to forward to. Defaults to the external port if omitted.",
"type": [
"integer",
"string"
],
"minimum": 0,
"maximum": 65535,
"format": "uc-portrange"
}
},
"required": [
"external-port",
"internal-address"
]
},
"interface.ipv4": {
"description": "This section describes the IPv4 properties of a logical interface.",
"type": "object",
"properties": {
"addressing": {
"description": "This option defines the method by which the IPv4 address of the interface is chosen.",
"type": "string",
"enum": [
"dynamic",
"static",
"none"
],
"examples": [
"static"
]
},
"subnet": {
"description": "This option defines a list of CONNECTED routes (with VRF id) in CIDR notation.",
"type": "array",
"items": {
"type": "object",
"properties": {
"prefix": {
"description": "Defines a CONNECTED route's prefix (network).",
"type": "string",
"format": "uc-cidr4",
"examples": [
"192.168.1.0/24"
]
},
"vrf": {
"description": "VRF id.",
"type": "integer"
}
}
}
},
"gateway": {
"description": "This option defines the static IPv4 gateway of the logical interface.",
"type": "array",
"items": {
"type": "object",
"properties": {
"prefix": {
"description": "Defines a NEXTHOP route's prefix (network).",
"type": "string",
"format": "uc-cidr4",
"examples": [
"192.168.1.0/24"
]
},
"nexthop": {
"description": "Gateway (nexthop) address.",
"type": "string",
"format": "ipv4",
"examples": [
"192.168.1.1"
]
},
"vrf": {
"description": "VRF id.",
"type": "integer"
},
"metric": {
"description": "Optional metric value (define a NH route's weight / metric).",
"type": "number"
}
}
}
},
"broadcast": {
"description": "This option defines a list of BROADCAST routes (with VRF id) in CIDR notation.",
"type": "array",
"items": {
"type": "object",
"properties": {
"prefix": {
"description": "Defines a BROADCAST route's prefix (network).",
"type": "string",
"format": "uc-cidr4",
"examples": [
"192.168.1.0/24"
]
},
"vrf": {
"description": "VRF id.",
"type": "integer"
}
}
}
},
"multicast": {
"type": "object",
"properties": {
"unknown-multicast-flood-control": {
"description": "The unknown multicast flood control feature enables the system to forward unknown multicast packets only to a multicast router (mrouter).",
"type": "boolean",
"default": true
},
"igmp": {
"type": "object",
"properties": {
"snooping-enable": {
"description": "Enable or disable IGMP snooping on per-VLAN basis.",
"type": "boolean",
"default": true
},
"version": {
"description": "Configures the IGMP version. Configurable versions are IGMPv1, IGMPv2, and IGMPv3",
"type": "integer",
"enum": [
1,
2,
3
],
"examples": [
3
],
"default": 3
},
"querier-enable": {
"description": "Configure this interface to act as a querier (multicast router)",
"type": "boolean",
"default": false
},
"fast-leave-enable": {
"description": "Removes the group state when it receives an IGMP Leave report without sending an IGMP query message",
"type": "boolean",
"default": false
},
"query-interval": {
"description": "Defines the interval between sending IGMP general queries",
"type": "integer",
"default": 1000
},
"last-member-query-interval": {
"description": "Defines the maximum response time (milliseconds) advertised in IGMP group-specific queries",
"type": "integer",
"default": 1000
},
"max-response-time": {
"description": "Configures a query maximum response time (in seconds) that is advertised on IGMP queries.",
"type": "integer",
"default": 10
},
"static-mcast-groups": {
"description": "Configures a Layer 2 port of a VLAN as a static member of an IGMP multicast group(s).",
"type": "array",
"items": {
"type": "object",
"properties": {
"egress-ports": {
"description": "Specify egress port(s) to forward mcast traffc of static group to.",
"type": "array",
"items": {
"type": "string"
}
},
"address": {
"description": "Specify IPV4 address (group) this interface is statically configured to be member of.",
"type": "string",
"format": "ipv4",
"examples": [
"225.0.0.1"
]
}
}
}
}
}
},
"mvr": {
"type": "object",
"description": "MVR attributes on a given interface",
"properties": {
"mvr-intf-mvr-role": {
"type": "string",
"description": "Configure an interface as an MVR receiver or source port. A port which is not configured as an MVR receiver or source port can use IGMP snooping to join or leave multicast groups using the standard rules for multicast filtering.",
"enum": [
"none",
"source",
"receiver"
]
},
"mvr-intf-immed-leave": {
"type": "string",
"description": "Switch to immediately remove an interface from a multicast stream as soon as it receives a leave message for that group. Applies to only receiver role ports.",
"enum": [
"none",
"by-host-ip",
"by-group"
],
"default": "by-group"
},
"mvr-intf-assoc-domain": {
"type": "integer",
"description": "Map the port to a specific domain.",
"maximum": 10,
"minimum": 1
}
},
"required": [
"mvr-intf-mvr-role",
"mvr-intf-immed-leave",
"mvr-intf-assoc-domain"
]
}
}
},
"send-hostname": {
"description": "include the devices hostname inside DHCP requests",
"type": "boolean",
"default": true,
"examples": [
true
]
},
"use-dns": {
"description": "Define which DNS servers shall be used. This can either be a list of static IPv4 addresse or dhcp (use the server provided by the DHCP lease)",
"type": "array",
"items": {
"type": "string",
"format": "ipv4",
"examples": [
"8.8.8.8",
"4.4.4.4"
]
}
},
"dhcp-snoop-vlan-enable": {
"description": "Enables DHCP Snooping on a VLAN",
"type": "boolean",
"default": false
},
"ip-arp-inspect-vlan": {
"$ref": "#/$defs/interface.ipv4.arp-inspect"
},
"dhcp": {
"$ref": "#/$defs/interface.ipv4.dhcp"
},
"dhcp-leases": {
"type": "array",
"items": {
"$ref": "#/$defs/interface.ipv4.dhcp-lease"
}
},
"port-forward": {
"type": "array",
"items": {
"$ref": "#/$defs/interface.ipv4.port-forward"
}
}
}
},
"interface.ipv6.dhcpv6": {
"description": "This section describes the DHCPv6 server configuration",
"type": "object",
"properties": {
"mode": {
"description": "Specifies the DHCPv6 server operation mode. When set to \"stateless\", the system will announce router advertisements only, without offering stateful DHCPv6 service. When set to \"stateful\", emitted router advertisements will instruct clients to obtain a DHCPv6 lease. When set to \"hybrid\", clients can freely chose whether to self-assign a random address through SLAAC, whether to request an address via DHCPv6, or both. For maximum compatibility with different clients, it is recommended to use the hybrid mode. The special mode \"relay\" will instruct the unit to act as DHCPv6 relay between this interface and any of the IPv6 interfaces in \"upstream\" mode.",
"type": "string",
"enum": [
"hybrid",
"stateless",
"stateful",
"relay"
]
},
"announce-dns": {
"description": "Overrides the DNS server to announce in DHCPv6 and RA messages. By default, the device will announce its own local interface address as DNS server, essentially acting as proxy for downstream clients. By specifying a non-empty list of IPv6 addresses here, this default behaviour can be overridden.",
"type": "array",
"items": {
"type": "string",
"format": "ipv6"
}
},
"filter-prefix": {
"description": "Selects a specific downstream prefix or a number of downstream prefix ranges to announce in DHCPv6 and RA messages. By default, all prefixes configured on a given downstream interface are advertised. By specifying an IPv6 prefix in CIDR notation here, only prefixes covered by this CIDR are selected.",
"type": "string",
"format": "uc-cidr6",
"default": "::/0"
}
}
},
"interface.ipv6.port-forward": {
"description": "This section describes an IPv6 port forwarding.",
"type": "object",
"properties": {
"protocol": {
"description": "The layer 3 protocol to match.",
"type": "string",
"enum": [
"tcp",
"udp",
"any"
],
"default": "any"
},
"external-port": {
"description": "The external port(s) to forward.",
"type": [
"integer",
"string"
],
"minimum": 0,
"maximum": 65535,
"format": "uc-portrange"
},
"internal-address": {
"description": "The internal IP to forward to. The address will be masked and concatenated with the effective interface subnet.",
"type": "string",
"format": "ipv6",
"example": "::1234:abcd"
},
"internal-port": {
"description": "The internal port to forward to. Defaults to the external port if omitted.",
"type": [
"integer",
"string"
],
"minimum": 0,
"maximum": 65535,
"format": "uc-portrange"
}
},
"required": [
"external-port",
"internal-address"
]
},
"interface.ipv6.traffic-allow": {
"description": "This section describes an IPv6 traffic accept rule.",
"type": "object",
"properties": {
"protocol": {
"description": "The layer 3 protocol to match.",
"type": "string",
"default": "any"
},
"source-address": {
"description": "The source IP to allow traffic from.",
"type": "string",
"format": "uc-cidr6",
"example": "2001:db8:1234:abcd::/64",
"default": "::/0"
},
"source-ports": {
"description": "The source port(s) to accept.",
"type": "array",
"minItems": 1,
"items": {
"type": [
"integer",
"string"
],
"minimum": 0,
"maximum": 65535,
"format": "uc-portrange"
}
},
"destination-address": {
"description": "The destination IP to allow traffic to. The address will be masked and concatenated with the effective interface subnet.",
"type": "string",
"format": "ipv6",
"example": "::1000"
},
"destination-ports": {
"description": "The destination ports to accept.",
"type": "array",
"minItems": 1,
"items": {
"type": [
"integer",
"string"
],
"minimum": 0,
"maximum": 65535,
"format": "uc-portrange"
}
}
},
"required": [
"destination-address"
]
},
"interface.ipv6": {
"description": "This section describes the IPv6 properties of a logical interface.",
"type": "object",
"properties": {
"addressing": {
"description": "This option defines the method by which the IPv6 subnet of the interface is acquired. In static addressing mode, the specified subnet and gateway, if any, are configured on the interface in a fixed manner. Also - if a prefix size hint is specified - a prefix of the given size is allocated from each upstream received prefix delegation pool and assigned to the interface. In dynamic addressing mode, a DHCPv6 client will be launched to obtain IPv6 prefixes for the interface itself and for downstream delegation. Note that dynamic addressing usually only ever makes sense on upstream interfaces.",
"type": "string",
"enum": [
"dynamic",
"static"
]
},
"subnet": {
"description": "This option defines a static IPv6 prefix in CIDR notation to set on the logical interface. A special notation \"auto/64\" can be used, causing the configuration agent to automatically allocate a suitable prefix from the IPv6 address pool specified in globals.ipv6-network. This property only applies to static addressing mode. Note that this is usually not needed due to DHCPv6-PD assisted prefix assignment.",
"type": "string",
"format": "uc-cidr6",
"examples": [
"auto/64"
]
},
"gateway": {
"description": "This option defines the static IPv6 gateway of the logical interface. It only applies to static addressing mode. Note that this is usually not needed due to DHCPv6-PD assisted prefix assignment.",
"type": "string",
"format": "ipv6",
"examples": [
"2001:db8:123:456::1"
]
},
"prefix-size": {
"description": "For dynamic addressing interfaces, this property specifies the prefix size to request from an upstream DHCPv6 server through prefix delegation. For static addressing interfaces, it specifies the size of the sub-prefix to allocate from the upstream-received delegation prefixes for assignment to the logical interface.",
"type": "integer",
"maximum": 64,
"minimum": 0
},
"dhcpv6": {
"$ref": "#/$defs/interface.ipv6.dhcpv6"
},
"port-forward": {
"type": "array",
"items": {
"$ref": "#/$defs/interface.ipv6.port-forward"
}
},
"traffic-allow": {
"type": "array",
"items": {
"$ref": "#/$defs/interface.ipv6.traffic-allow"
}
}
}
},
"interface.broad-band.wwan": {
"description": "This Object defines the properties of a broad-band uplink.",
"type": "object",
"properties": {
"protocol": {
"description": "This uplink uses WWAN/LTE",
"type": "string",
"const": "wwan"
},
"modem-type": {
"description": "The local protocol that the modem supports.",
"type": "string",
"enum": [
"qmi",
"mbim",
"wwan"
]
},
"access-point-name": {
"description": "Commonly known as APN. The name of a gateway between a mobile network and the internet.",
"type": "string"
},
"authentication-type": {
"description": "The authentication mode that shall be used.",
"type": "string",
"enum": [
"none",
"pap",
"chap",
"pap-chap"
],
"default": "none"
},
"pin-code": {
"description": "The PIN that shall be used to unlock the SIM card.",
"type": "string"
},
"user-name": {
"description": "This option is only required if an authentication-type is defined.",
"type": "string"
},
"password": {
"description": "This option is only required if an authentication-type is defined.",
"type": "string"
},
"packet-data-protocol": {
"description": "Define what kind of IP stack shall be used.",
"type": "string",
"enum": [
"ipv4",
"ipv6",
"dual-stack"
],
"default": "dual-stack"
}
}
},
"interface.broad-band.pppoe": {
"description": "This Object defines the properties of a PPPoE uplink.",
"type": "object",
"properties": {
"protocol": {
"description": "This uplink uses PPPoE",
"type": "string",
"const": "pppoe"
},
"user-name": {
"description": "The username used to authenticate.",
"type": "string"
},
"password": {
"description": "The password used to authenticate.",
"type": "string"
}
}
},
"interface.broad-band": {
"oneOf": [
{
"$ref": "#/$defs/interface.broad-band.wwan"
},
{
"$ref": "#/$defs/interface.broad-band.pppoe"
}
]
},
"interface.tunnel.mesh": {
"description": "This Object defines the properties of a mesh interface overlay.",
"type": "object",
"properties": {
"proto": {
"description": "This field must be set to mesh.",
"type": "string",
"const": "mesh"
}
}
},
"interface.tunnel.vxlan": {
"description": "This Object defines the properties of a vxlan tunnel.",
"type": "object",
"properties": {
"proto": {
"description": "This field must be set to vxlan.",
"type": "string",
"const": "vxlan"
},
"peer-address": {
"description": "This is the IP address of the remote host, that the VXLAN tunnel shall be established with.",
"type": "string",
"format": "ipv4",
"example": "192.168.100.1"
},
"peer-port": {
"description": "The network port that shall be used to establish the VXLAN tunnel.",
"type": "integer",
"maximum": 65535,
"minimum": 1,
"examples": [
4789
]
}
}
},
"interface.tunnel.l2tp": {
"description": "This Object defines the properties of a l2tp tunnel.",
"type": "object",
"properties": {
"proto": {
"description": "This field must be set to vxlan.",
"type": "string",
"const": "l2tp"
},
"server": {
"description": "This is the IP address of the remote host, that the L2TP tunnel shall be established with.",
"type": "string",
"format": "ipv4",
"example": "192.168.100.1"
},
"user-name": {
"description": "The username used to authenticate.",
"type": "string"
},
"password": {
"description": "The password used to authenticate.",
"type": "string"
}
}
},
"interface.tunnel.gre": {
"description": "This Object defines the properties of a GRE tunnel.",
"type": "object",
"properties": {
"proto": {
"description": "This field must be set to gre.",
"type": "string",
"const": "gre"
},
"peer-address": {
"description": "This is the IP address of the remote host, that the GRE tunnel shall be established with.",
"type": "string",
"format": "ipv4",
"example": "192.168.100.1"
},
"dhcp-healthcheck": {
"description": "Healthcheck will probe if the remote peer replies to DHCP discovery without sending an ACK.",
"type": "boolean",
"default": false
},
"dont-fragment": {
"description": "Set \u201cDon't Fragment\u201d flag on encapsulated packets.",
"type": "boolean",
"default": false
}
}
},
"interface.tunnel.gre6": {
"description": "This Object defines the properties of a GREv6 tunnel.",
"type": "object",
"properties": {
"proto": {
"description": "This field must be set to gre6.",
"type": "string",
"const": "gre6"
},
"peer-address": {
"description": "This is the IPv6 address of the remote host, that the GRE tunnel shall be established with.",
"type": "string",
"format": "ipv6",
"example": "2405:200:802:600:61::1"
},
"dhcp-healthcheck": {
"description": "Healthcheck will probe if the remote peer replies to DHCP discovery without sending an ACK.",
"type": "boolean",
"default": false
}
}
},
"interface.tunnel": {
"oneOf": [
{
"$ref": "#/$defs/interface.tunnel.mesh"
},
{
"$ref": "#/$defs/interface.tunnel.vxlan"
},
{
"$ref": "#/$defs/interface.tunnel.l2tp"
},
{
"$ref": "#/$defs/interface.tunnel.gre"
},
{
"$ref": "#/$defs/interface.tunnel.gre6"
}
]
},
"interface": {
"description": "This section describes the logical network interfaces of the device. Interfaces as their primary have a role that is upstream, downstream, guest, ....",
"type": "object",
"properties": {
"name": {
"description": "This is a free text field, stating the administrative name of the interface. It may contain spaces and special characters.",
"type": "string",
"examples": [
"LAN"
]
},
"role": {
"description": "The role defines if the interface is upstream or downstream facing.",
"type": "string",
"enum": [
"upstream",
"downstream"
]
},
"isolate-hosts": {
"description": "This option makes sure that any traffic leaving this interface is isolated and all local IP ranges are blocked. It essentially enforces \"guest network\" firewall settings.",
"type": "boolean"
},
"metric": {
"description": "The routing metric of this logical interface. Lower values have higher priority.",
"type": "integer",
"maximum": 4294967295,
"minimum": 0
},
"mtu": {
"description": "The MTU of this logical interface.",
"type": "integer",
"maximum": 1500,
"minimum": 1280
},
"services": {
"description": "The services that shall be offered on this logical interface. These are just strings such as \"ssh\", \"lldp\", \"mdns\"",
"type": "array",
"items": {
"type": "string",
"examples": [
"ssh",
"lldp"
]
}
},
"vlan-awareness": {
"description": "Setup additional VLANs inside the bridge",
"type": "object",
"properties": {
"first": {
"type": "integer"
},
"last": {
"type": "integer"
}
}
},
"vlan": {
"$ref": "#/$defs/interface.vlan"
},
"bridge": {
"$ref": "#/$defs/interface.bridge"
},
"ethernet": {
"type": "array",
"items": {
"$ref": "#/$defs/interface.ethernet"
}
},
"ipv4": {
"$ref": "#/$defs/interface.ipv4"
},
"ipv6": {
"$ref": "#/$defs/interface.ipv6"
},
"broad-band": {
"$ref": "#/$defs/interface.broad-band"
},
"tunnel": {
"$ref": "#/$defs/interface.tunnel"
}
}
},
"service.lldp": {
"type": "object",
"properties": {
"describe": {
"description": "The LLDP description field. If set to \"auto\" it will be derived from unit.name.",
"type": "string",
"default": "uCentral Access Point"
},
"location": {
"description": "The LLDP location field. If set to \"auto\" it will be derived from unit.location.",
"type": "string",
"default": "uCentral Network"
}
}
},
"service.ssh": {
"description": "This section can be used to setup a SSH server on the AP.",
"type": "object",
"properties": {
"port": {
"description": "This option defines which port the SSH server shall be available on.",
"type": "integer",
"maximum": 65535,
"default": 22
},
"authorized-keys": {
"description": "This allows the upload of public ssh keys. Keys need to be seperated by a newline.",
"type": "array",
"items": {
"type": "string",
"examples": [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC0ghdSd2D2y08TFowZLMZn3x1/Djw3BkNsIeHt/Z+RaXwvfV1NQAnNdaOngMT/3uf5jZtYxhpl+dbZtRhoUPRvKflKBeFHYBqjZVzD3r4ns2Ofm2UpHlbdOpMuy9oeTSCeF0IKZZ6szpkvSirQogeP2fe9KRkzQpiza6YxxaJlWw== user@example",
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ4FDjyCsg+1Mh2C5G7ibR3z0Kw1dU57kfXebLRwS6CL bob@work",
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBP/JpJ/KHtKKImzISBDwLO0/EwytIr4pGZQXcP6GCSHchLMyfjf147KNlF9gC+3FibzqKH02EiQspVhRgfuK6y0= alice@home"
]
}
},
"password-authentication": {
"description": "This option defines if password authentication shall be enabled. If set to false, only ssh key based authentication is possible.",
"type": "boolean",
"default": true
},
"enable": {
"description": "This option whether SSH server should be enabled or disabled.",
"type": "boolean"
}
}
},
"service.ntp": {
"type": "object",
"description": "This section can be used to setup the upstream NTP servers.",
"properties": {
"servers": {
"description": "This is an array of URL/IP of the upstream NTP servers that the unit shall use to acquire its current time.",
"type": "array",
"items": {
"type": "string",
"format": "uc-host"
},
"examples": [
"0.openwrt.pool.ntp.org"
]
},
"local-server": {
"description": "Start a NTP server that provides the time to local clients.",
"type": "boolean",
"examples": [
true
]
}
}
},
"service.mdns": {
"description": "This section can be used to configure the MDNS server.",
"type": "object",
"properties": {
"enable": {
"description": "Enable this option if you would like to enable the MDNS server on the unit.",
"type": "boolean",
"default": false
}
}
},
"service.rtty": {
"description": "This section can be used to setup a persistent connection to a rTTY server.",
"type": "object",
"properties": {
"host": {
"description": "The server that the device shall connect to.",
"type": "string",
"format": "uc-host",
"examples": [
"192.168.1.10"
]
},
"port": {
"description": "This option defines the port that device shall connect to.",
"type": "integer",
"maximum": 65535,
"default": 5912
},
"token": {
"description": "The security token that shall be used to authenticate with the server.",
"type": "string",
"maxLength": 32,
"minLength": 32,
"examples": [
"01234567890123456789012345678901"
]
},
"mutual-tls": {
"description": "Shall the connection enforce mTLS",
"type": "boolean",
"default": true
}
}
},
"service.log": {
"description": "This section can be used to configure remote syslog support.",
"type": "object",
"properties": {
"host": {
"description": "IP address of a syslog server to which the log messages should be sent in addition to the local destination.",
"type": "string",
"format": "uc-host",
"examples": [
"192.168.1.10"
]
},
"port": {
"description": "Port number of the remote syslog server specified with log_ip.",
"type": "integer",
"maximum": 65535,
"minimum": 100,
"examples": [
2000
]
},
"proto": {
"description": "Sets the protocol to use for the connection, either tcp or udp.",
"type": "string",
"enum": [
"tcp",
"udp"
],
"default": "udp"
},
"size": {
"description": "Size of the file based log buffer in KiB. This value is used as the fallback value for log_buffer_size if the latter is not specified.",
"type": "integer",
"minimum": 32,
"default": 1000
},
"priority": {
"description": "Filter messages by their log priority. the value maps directly to the 0-7 range used by syslog.",
"type": "integer",
"minimum": 0,
"default": 7
}
}
},
"service.http": {
"description": "Enable the webserver with the on-boarding webui",
"type": "object",
"properties": {
"http-port": {
"description": "The port that the HTTP server should run on.",
"type": "integer",
"maximum": 65535,
"minimum": 1,
"default": 80
},
"enable": {
"description": "This option whether http server should be enabled or disabled.",
"type": "boolean"
}
}
},
"service.igmp": {
"description": "This section allows enabling the IGMP/Multicast proxy",
"type": "object",
"properties": {
"enable": {
"description": "This option defines if the IGMP/Multicast proxy shall be enabled on the device.",
"type": "boolean",
"default": false
}
}
},
"service.radius-proxy": {
"description": "This section can be used to setup a radius security proxy instance (radsecproxy).",
"type": "object",
"properties": {
"proxy-secret": {
"description": "The radius secret used to communicate with the proxy.",
"type": "string",
"default": "secret"
},
"realms": {
"description": "The various realms that we can proxy to.",
"type": "array",
"items": {
"anyOf": [
{
"type": "object",
"properties": {
"protocol": {
"description": "Defines whether the real should use radsec or normal radius.",
"type": "string",
"enum": [
"radsec"
],
"default": "radsec"
},
"realm": {
"description": "The realm that that this server shall be used for.",
"type": "array",
"items": {
"type": "string",
"default": "*"
}
},
"auto-discover": {
"description": "Auto discover radsec server address via realm DNS NAPTR record.",
"type": "boolean",
"default": false
},
"host": {
"description": "The remote proxy server that the device shall connect to.",
"type": "string",
"format": "uc-host",
"examples": [
"192.168.1.10"
]
},
"port": {
"description": "The remote proxy port that the device shall connect to.",
"type": "integer",
"maximum": 65535,
"default": 2083
},
"secret": {
"description": "The radius secret that will be used for the connection.",
"type": "string"
},
"use-local-certificates": {
"description": "The device will use its local certificate bundle for the TLS setup and ignores all other certificate options in this section.",
"type": "boolean",
"default": false
},
"ca-certificate": {
"description": "The local servers CA bundle.",
"type": "string"
},
"certificate": {
"description": "The local servers certificate.",
"type": "string"
},
"private-key": {
"description": "The local servers private key/",
"type": "string"
},
"private-key-password": {
"description": "The password required to read the private key.",
"type": "string"
}
}
},
{
"type": "object",
"properties": {
"protocol": {
"description": "Defines whether the real should use radsec or normal radius.",
"type": "string",
"enum": [
"radius"
]
},
"realm": {
"description": "The realm that that this server shall be used for.",
"type": "array",
"items": {
"type": "string",
"default": "*"
}
},
"auth-server": {
"description": "The URI of our Radius server.",
"type": "string",
"format": "uc-host",
"examples": [
"192.168.1.10"
]
},
"auth-port": {
"description": "The network port of our Radius server.",
"type": "integer",
"maximum": 65535,
"minimum": 1024,
"examples": [
1812
]
},
"auth-secret": {
"description": "The shared Radius authentication secret.",
"type": "string",
"examples": [
"secret"
]
},
"acct-server": {
"description": "The URI of our Radius server.",
"type": "string",
"format": "uc-host",
"examples": [
"192.168.1.10"
]
},
"acct-port": {
"description": "The network port of our Radius server.",
"type": "integer",
"maximum": 65535,
"minimum": 1024,
"examples": [
1812
]
},
"acct-secret": {
"description": "The shared Radius authentication secret.",
"type": "string",
"examples": [
"secret"
]
}
}
},
{
"type": "object",
"properties": {
"protocol": {
"description": "Defines whether the real should use radsec or normal radius.",
"type": "string",
"enum": [
"block"
]
},
"realm": {
"description": "The realm that that this server shall be used for.",
"type": "array",
"items": {
"type": "string",
"default": "*"
}
},
"message": {
"description": "The message that is sent when a realm is blocked.",
"type": "string",
"items": {
"type": "string",
"default": "blocked"
}
}
}
}
]
}
}
}
},
"service.online-check": {
"description": "This section can be used to configure the online check service.",
"type": "object",
"properties": {
"ping-hosts": {
"description": "Hosts that shall be pinged to find out if we are online.",
"type": "array",
"items": {
"type": "string",
"format": "uc-host",
"examples": [
"192.168.1.10"
]
}
},
"download-hosts": {
"description": "URLs to which a http/s connection shall be established to find out if we are online. The service will try to download http://$string/online.txt and expects the content of that file to be \"Ok\". HTTP 30x is support allowing https redirects.",
"type": "array",
"items": {
"type": "string",
"examples": [
"www.example.org"
]
}
},
"check-interval": {
"description": "The interval in seconds in between each online-check.",
"type": "number",
"default": 60
},
"check-threshold": {
"description": "How often does the online check need to fail until the system assumes that it has lost online connectivity.",
"type": "number",
"default": 1
},
"action": {
"description": "The action that the device shall execute when it has detected that it is not online.",
"type": "array",
"items": {
"type": "string",
"enum": [
"leds"
]
}
}
}
},
"service.data-plane": {
"description": "This section can be used to define eBPF and cBPF blobs that shall be loaded for virtual data-planes and SDN.",
"type": "object",
"properties": {
"ingress-filters": {
"description": "A list of programs that can be loaded as ingress filters on interfaces.",
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"description": "The name of the ingress filter.",
"type": "string"
},
"program": {
"description": "The base64 encoded xBPF.",
"type": "string",
"format": "uc-base64"
}
}
}
}
}
},
"service.quality-of-service.class-selector": {
"type": "string",
"enum": [
"CS0",
"CS1",
"CS2",
"CS3",
"CS4",
"CS5",
"CS6",
"CS7",
"AF11",
"AF12",
"AF13",
"AF21",
"AF22",
"AF23",
"AF31",
"AF32",
"AF33",
"AF41",
"AF42",
"AF43",
"DF",
"EF",
"VA",
"LE"
]
},
"service.quality-of-service": {
"description": "This section describes the QoS behaviour of the unit.",
"type": "object",
"properties": {
"select-ports": {
"description": "The physical network devices that shall be considered the primary uplink interface. All classification and shaping will happen on this device.",
"type": "array",
"items": {
"type": "string",
"default": "WAN"
}
},
"bandwidth-up": {
"description": "Defines the upload bandwidth of this device. If it is not known or the device is attached to a shared medium, this value needs to be 0.",
"type": "integer",
"default": 0
},
"bandwidth-down": {
"description": "Defines the download bandwidth of this device. If it is not known or the device is attached to a shared medium, this value needs to be 0.",
"type": "integer",
"default": 0
},
"bulk-detection": {
"description": "The QoS feature can automatically detect and classify bulk flows. This is based on average packet size and PPS.",
"type": "object",
"properties": {
"dscp": {
"description": "The differentiated services code point that shall be assigned to packets that belong to a bulk flow.",
"$ref": "#/$defs/service.quality-of-service.class-selector",
"default": "CS0"
},
"packets-per-second": {
"description": "The required PPS rate that will cause a flow to be classified as bulk.",
"type": "number",
"default": 0
}
}
},
"services": {
"description": "A list of predefined named services that shall be classified according to the communities DB.",
"type": "array",
"items": {
"type": "string"
}
},
"classifier": {
"description": "A list of classifiers. Each classifier will map certain traffic to specific ToS/DSCP values based upon the defined constraints.",
"type": "array",
"items": {
"type": "object",
"properties": {
"dscp": {
"description": "The differentiated services code point that shall be assigned to packet that match the rules of this entry.",
"$ref": "#/$defs/service.quality-of-service.class-selector",
"default": "CS1"
},
"ports": {
"description": "Each entry defines a layer3 protocol and a port(range) that will be used to match packets.",
"type": "array",
"items": {
"type": "object",
"properties": {
"protocol": {
"description": "The port match can apply for TCP, UDP or any IP protocol.",
"type": "string",
"enum": [
"any",
"tcp",
"udp"
],
"default": "any"
},
"port": {
"description": "The port of this match rule.",
"type": "integer"
},
"range-end": {
"description": "The last port of this match rule if it is a port range.",
"type": "integer"
},
"reclassify": {
"description": "Ignore the ToS/DSCP of packets and reclassify them.",
"type": "boolean",
"default": true
}
}
}
},
"dns": {
"description": "Each entry defines a wildcard FQDN. The IP that this resolves to will be used to match packets.",
"type": "array",
"items": {
"type": "object",
"properties": {
"fqdn": {
"type": "string",
"format": "uc-fqdn"
},
"suffix-matching": {
"description": "Match for all suffixes of the FQDN.",
"type": "boolean",
"default": true
},
"reclassify": {
"description": "Ignore the ToS/DSCP of packets and reclassify them.",
"type": "boolean",
"default": true
}
}
}
}
}
}
}
}
},
"service.wireguard-overlay": {
"description": "This Object defines the properties of a wireguard-overlay.",
"type": "object",
"properties": {
"proto": {
"description": "This field must be set to wireguard-overlay.",
"type": "string",
"const": "wireguard-overlay"
},
"private-key": {
"description": "The private key of the device. This key is used to lookup the host entry inside the config.",
"type": "string"
},
"peer-port": {
"description": "The network port that shall be used to establish the wireguard tunnel.",
"type": "integer",
"maximum": 65535,
"minimum": 1,
"default": 3456
},
"peer-exchange-port": {
"description": "The network port that shall be used to exchange peer data inside the tunnel.",
"type": "integer",
"maximum": 65535,
"minimum": 1,
"default": 3458
},
"root-node": {
"description": "The descritption of the root node of the overlay.",
"type": "object",
"properties": {
"key": {
"description": "The public key of the host.",
"type": "string"
},
"endpoint": {
"description": "The public IP of the host (optional).",
"type": "string",
"format": "uc-ip"
},
"ipaddr": {
"description": "The list of private IPs that a host is reachable on inside the overlay.",
"type": "array",
"items": {
"type": "string",
"format": "uc-ip"
}
}
}
},
"hosts": {
"description": "The list of all known hosts inside the overlay.",
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"description": "The unique name of the host.",
"type": "string"
},
"key": {
"description": "The public key of the host.",
"type": "string"
},
"endpoint": {
"description": "The public IP of the host (optional).",
"type": "string",
"format": "uc-ip"
},
"subnet": {
"description": "The list of subnets that shall be routed to this host.",
"type": "array",
"items": {
"type": "string",
"format": "uc-cidr"
}
},
"ipaddr": {
"description": "The list of private IPs that a host is reachable on inside the overlay.",
"type": "array",
"items": {
"type": "string",
"format": "uc-ip"
}
}
}
}
},
"vxlan": {
"description": "The descritption of the root node of the overlay.",
"type": "object",
"properties": {
"port": {
"description": "The network port that shall be used to establish the vxlan overlay.",
"type": "integer",
"maximum": 65535,
"minimum": 1,
"default": 4789
},
"mtu": {
"description": "The MTU that shall be used by the vxlan tunnel.",
"type": "integer",
"maximum": 65535,
"minimum": 256,
"default": 1420
},
"isolate": {
"description": "If set to true hosts will only be able to talk with the root node and not forward L@ traffic between each other.",
"type": "boolean",
"default": true
}
}
}
}
},
"service.gps": {
"description": "This section can be used to configure a GPS dongle",
"type": "object",
"properties": {
"adjust-time": {
"description": "Adjust the systems clock upon a successful GPS lock.",
"type": "boolean",
"default": false
},
"baud-rate": {
"description": "The baudrate used by the attached GPS dongle",
"type": "integer",
"enum": [
2400,
4800,
9600,
19200
]
}
}
},
"service.telnet": {
"description": "This section can be used to setup a Telnet server on the device.",
"type": "object",
"properties": {
"enable": {
"description": "This option whether telnet server should be enabled or disabled.",
"type": "boolean"
}
}
},
"service.https": {
"description": "Enable the webserver with the on-boarding webui",
"type": "object",
"properties": {
"https-port": {
"description": "The port that the secure HTTP server should run on.",
"type": "integer",
"maximum": 65535,
"minimum": 1,
"default": 443
},
"enable": {
"description": "This option whether secure http server should be enabled or disabled.",
"type": "boolean"
}
}
},
"service": {
"description": "This section describes all of the services that may be present on the AP. Each service is then referenced via its name inside an interface, ...",
"type": "object",
"properties": {
"lldp": {
"$ref": "#/$defs/service.lldp"
},
"ssh": {
"$ref": "#/$defs/service.ssh"
},
"ntp": {
"$ref": "#/$defs/service.ntp"
},
"mdns": {
"$ref": "#/$defs/service.mdns"
},
"rtty": {
"$ref": "#/$defs/service.rtty"
},
"log": {
"$ref": "#/$defs/service.log"
},
"http": {
"$ref": "#/$defs/service.http"
},
"igmp": {
"$ref": "#/$defs/service.igmp"
},
"radius-proxy": {
"$ref": "#/$defs/service.radius-proxy"
},
"online-check": {
"$ref": "#/$defs/service.online-check"
},
"data-plane": {
"$ref": "#/$defs/service.data-plane"
},
"quality-of-service": {
"$ref": "#/$defs/service.quality-of-service"
},
"wireguard-overlay": {
"$ref": "#/$defs/service.wireguard-overlay"
},
"gps": {
"$ref": "#/$defs/service.gps"
},
"telnet": {
"$ref": "#/$defs/service.telnet"
},
"https": {
"$ref": "#/$defs/service.https"
}
}
},
"metrics.statistics": {
"description": "Statistics are traffic counters, neighbor tables, ...",
"type": "object",
"properties": {
"interval": {
"description": "The reporting interval defined in seconds.",
"type": "integer",
"minimum": 60
},
"types": {
"description": "A list of names of subsystems that shall be reported periodically.",
"type": "array",
"items": {
"type": "string",
"enum": [
"lldp",
"clients"
]
}
},
"wired-clients-max-num": {
"description": "Configure maximum number of FDB entries device's allowed to report. If omitted, device-default number should be used (2000). Setting to zero means no entries should be reported, flag should be raised. If device's current FDB size exceeds configured value, flag should be raised as well.",
"type": "integer"
}
}
},
"metrics.health": {
"description": "Health check gets executed periodically and will report a health value between 0-100 indicating how healthy the device thinks it is",
"type": "object",
"properties": {
"interval": {
"description": "The reporting interval defined in seconds.",
"type": "integer",
"minimum": 60
},
"dhcp-local": {
"description": "This is makes the AP probe local downstream DHCP servers.",
"type": "boolean",
"default": true
},
"dhcp-remote": {
"description": "This is makes the AP probe remote upstream DHCP servers.",
"type": "boolean",
"default": false
},
"dns-local": {
"description": "This is makes the AP probe DNS servers.",
"type": "boolean",
"default": true
},
"dns-remote": {
"description": "This is makes the AP probe DNS servers.",
"type": "boolean",
"default": true
}
}
},
"metrics.dhcp-snooping": {
"description": "DHCP snooping allows us to intercept DHCP packages on interface that are bridged, where DHCP is not offered as a service by the AP.",
"type": "object",
"properties": {
"filters": {
"description": "A list of the message types that shall be sent to the backend.",
"type": "array",
"items": {
"type": "string",
"enum": [
"ack",
"discover",
"offer",
"request",
"solicit",
"reply",
"renew"
]
}
}
}
},
"metrics.telemetry": {
"description": "Configure the unsolicited telemetry stream.",
"type": "object",
"properties": {
"interval": {
"description": "The reporting interval defined in seconds.",
"type": "integer"
},
"types": {
"description": "The event types that get added to telemetry.",
"type": "array",
"items": {
"type": "string",
"enum": [
"ssh",
"health",
"health.dns",
"health.dhcp",
"health.radius",
"health.memory",
"client",
"client.join",
"client.leave",
"client.key-mismatch",
"wired",
"wired.carrier-up",
"wired.carrier-down",
"unit",
"unit.boot-up"
]
}
}
}
},
"metrics.realtime": {
"description": "Configure the realtime events that get sent to the cloud.",
"type": "object",
"properties": {
"types": {
"description": "The event types that get added to telemetry.",
"type": "array",
"items": {
"type": "string",
"enum": [
"ssh",
"health",
"health.dns",
"health.dhcp",
"health.radius",
"health.memory",
"client",
"client.join",
"client.leave",
"client.key-mismatch",
"wired",
"wired.carrier-up",
"wired.carrier-down",
"unit",
"unit.boot-up"
]
}
}
}
},
"metrics": {
"description": "There are several types of mertics that shall be reported in certain intervals. This section provides a granual configuration.",
"type": "object",
"properties": {
"statistics": {
"$ref": "#/$defs/metrics.statistics"
},
"health": {
"$ref": "#/$defs/metrics.health"
},
"dhcp-snooping": {
"$ref": "#/$defs/metrics.dhcp-snooping"
},
"telemetry": {
"$ref": "#/$defs/metrics.telemetry"
},
"realtime": {
"$ref": "#/$defs/metrics.realtime"
}
}
},
"config-raw": {
"description": "This object allows passing raw uci commands, that get applied after all the other configuration was ben generated.",
"type": "array",
"items": {
"type": "array",
"minItems": 2,
"items": {
"type": "string"
},
"examples": [
[
"set",
"system.@system[0].timezone",
"GMT0"
],
[
"delete",
"firewall.@zone[0]"
],
[
"delete",
"dhcp.wan"
],
[
"add",
"dhcp",
"dhcp"
],
[
"add-list",
"system.ntp.server",
"0.pool.example.org"
],
[
"del-list",
"system.ntp.server",
"1.openwrt.pool.ntp.org"
]
]
}
}
}
}
Reference in New Issue View Git Blame Copy Permalink