@pulumi/juniper-mist 0.1.4 → 0.1.5

package/types/input.d.ts

@@ -518,8 +518,7 @@ export declare namespace device {
          */
         exportPolicy?: pulumi.Input<string>;
         /**
-         * by default, either inet/net6 unicast depending on neighbor IP family (v4 or v6)
-         * for v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
+         * by default, either inet/net6 unicast depending on neighbor IP family (v4 or v6). For v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
          */
         extendedV4Nexthop?: pulumi.Input<boolean>;
         /**
@@ -765,6 +764,9 @@ export declare namespace device {
         routedForNetworks?: pulumi.Input<pulumi.Input<string>[]>;
         subnet: pulumi.Input<string>;
         subnet6?: pulumi.Input<string>;
+        /**
+         * Property key must be the user/tenant name (i.e. "printer-1") or a Variable (i.e. "{{myvar}}")
+         */
         tenants?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.device.GatewayNetworkTenants>;
         }>;
@@ -782,7 +784,7 @@ export declare namespace device {
     interface GatewayNetworkInternetAccess {
         createSimpleServicePolicy?: pulumi.Input<boolean>;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
         destinationNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.device.GatewayNetworkInternetAccessDestinationNat>;
@@ -793,22 +795,35 @@ export declare namespace device {
          */
         restricted?: pulumi.Input<boolean>;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.device.GatewayNetworkInternetAccessStaticNat>;
         }>;
     }
     interface GatewayNetworkInternetAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: pulumi.Input<string>;
         name?: pulumi.Input<string>;
-        port?: pulumi.Input<number>;
+        /**
+         * The Destination NAT destination IP Address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}")
+         */
+        port?: pulumi.Input<string>;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity
+         */
+        wanName?: pulumi.Input<string>;
     }
     interface GatewayNetworkInternetAccessStaticNat {
-        internalIp?: pulumi.Input<string>;
-        name?: pulumi.Input<string>;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
+         */
+        internalIp: pulumi.Input<string>;
+        name: pulumi.Input<string>;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}")
          */
         wanName?: pulumi.Input<string>;
     }
@@ -844,7 +859,7 @@ export declare namespace device {
          */
         allowPing?: pulumi.Input<boolean>;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
         destinationNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.device.GatewayNetworkVpnAccessDestinationNat>;
@@ -862,13 +877,11 @@ export declare namespace device {
          */
         noReadvertiseToLanOspf?: pulumi.Input<boolean>;
         /**
-         * toward overlay
-         * how HUB should deal with routes it received from Spokes
+         * toward overlay, how HUB should deal with routes it received from Spokes
          */
         noReadvertiseToOverlay?: pulumi.Input<boolean>;
         /**
-         * by default, the routes are only readvertised toward the same vrf on spoke
-         * to allow it to be leaked to other vrfs
+         * by default, the routes are only readvertised toward the same vrf on spoke. To allow it to be leaked to other vrfs
          */
         otherVrfs?: pulumi.Input<pulumi.Input<string>[]>;
         /**
@@ -880,14 +893,13 @@ export declare namespace device {
          */
         sourceNat?: pulumi.Input<inputs.device.GatewayNetworkVpnAccessSourceNat>;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.device.GatewayNetworkVpnAccessStaticNat>;
         }>;
         /**
-         * toward overlay
-         * how HUB should deal with routes it received from Spokes
+         * toward overlay, how HUB should deal with routes it received from Spokes
          */
         summarizedSubnet?: pulumi.Input<string>;
         /**
@@ -900,20 +912,22 @@ export declare namespace device {
         summarizedSubnetToLanOspf?: pulumi.Input<string>;
     }
     interface GatewayNetworkVpnAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: pulumi.Input<string>;
         name?: pulumi.Input<string>;
-        port?: pulumi.Input<number>;
+        port?: pulumi.Input<string>;
     }
     interface GatewayNetworkVpnAccessSourceNat {
         externalIp?: pulumi.Input<string>;
     }
     interface GatewayNetworkVpnAccessStaticNat {
-        internalIp?: pulumi.Input<string>;
-        name?: pulumi.Input<string>;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
          */
-        wanName?: pulumi.Input<string>;
+        internalIp: pulumi.Input<string>;
+        name: pulumi.Input<string>;
     }
     interface GatewayOobIpConfig {
         /**
@@ -1024,9 +1038,7 @@ export declare namespace device {
          */
         aeIdx?: pulumi.Input<string>;
         /**
-         * For SRX Only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability.\n
-         * Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end\n
-         * Note: Turning this on will enable force-up on one of the interfaces in the bundle only
+         * For SRX Only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
          */
         aeLacpForceUp?: pulumi.Input<boolean>;
         aggregated?: pulumi.Input<boolean>;
@@ -1034,6 +1046,9 @@ export declare namespace device {
          * if want to generate port up/down alarm, set it to true
          */
         critical?: pulumi.Input<boolean>;
+        /**
+         * Interface Description. Can be a variable (i.e. "{{myvar}}")
+         */
         description?: pulumi.Input<string>;
         disableAutoneg?: pulumi.Input<boolean>;
         /**
@@ -1045,13 +1060,11 @@ export declare namespace device {
          */
         dslType?: pulumi.Input<string>;
         /**
-         * if `wanType`==`dsl`
-         * 16 bit int
+         * if `wanType`==`dsl`, 16 bit int
          */
         dslVci?: pulumi.Input<number>;
         /**
-         * if `wanType`==`dsl`
-         * 8 bit int
+         * if `wanType`==`dsl`, 8 bit int
          */
         dslVpi?: pulumi.Input<number>;
         /**
@@ -1085,7 +1098,7 @@ export declare namespace device {
          */
         name?: pulumi.Input<string>;
         /**
-         * if `usage`==`lan`
+         * if `usage`==`lan`, name of the `junipermist.org.Network` resource
          */
         networks?: pulumi.Input<pulumi.Input<string>[]>;
         /**
@@ -1094,7 +1107,7 @@ export declare namespace device {
         outerVlanId?: pulumi.Input<number>;
         poeDisabled?: pulumi.Input<boolean>;
         /**
-         * if `usage`==`lan`
+         * Only for SRX and if `usage`==`lan`, the Untagged VLAN Network
          */
         portNetwork?: pulumi.Input<string>;
         /**
@@ -1131,10 +1144,7 @@ export declare namespace device {
          * port usage name. enum: `haControl`, `haData`, `lan`, `wan`
          */
         usage: pulumi.Input<string>;
-        /**
-         * if WAN interface is on a VLAN
-         */
-        vlanId?: pulumi.Input<number>;
+        vlanId?: pulumi.Input<string>;
         /**
          * Property key is the VPN name
          */
@@ -1142,29 +1152,33 @@ export declare namespace device {
             [key: string]: pulumi.Input<inputs.device.GatewayPortConfigVpnPaths>;
         }>;
         /**
-         * when `wanType`==`broadband`. enum: `default`, `max`, `recommended`
+         * Only when `wanType`==`broadband`. enum: `default`, `max`, `recommended`
          */
         wanArpPolicer?: pulumi.Input<string>;
         /**
-         * optional, if spoke should reach this port by a different IP
+         * Only if `usage`==`wan`, optional. If spoke should reach this port by a different IP
          */
         wanExtIp?: pulumi.Input<string>;
         /**
-         * Property Key is the destianation CIDR (e.g "100.100.100.0/24")
+         * Only if `usage`==`wan`. Property Key is the destianation CIDR (e.g "100.100.100.0/24")
          */
         wanExtraRoutes?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.device.GatewayPortConfigWanExtraRoutes>;
         }>;
         /**
-         * if `usage`==`wan`
+         * Only if `usage`==`wan`. If some networks are connected to this WAN port, it can be added here so policies can be defined
+         */
+        wanNetworks?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Only if `usage`==`wan`
          */
         wanProbeOverride?: pulumi.Input<inputs.device.GatewayPortConfigWanProbeOverride>;
         /**
-         * optional, by default, source-NAT is performed on all WAN Ports using the interface-ip
+         * Only if `usage`==`wan`, optional. By default, source-NAT is performed on all WAN Ports using the interface-ip
          */
         wanSourceNat?: pulumi.Input<inputs.device.GatewayPortConfigWanSourceNat>;
         /**
-         * if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`
+         * Only if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`
          */
         wanType?: pulumi.Input<string>;
     }
@@ -1178,12 +1192,15 @@ export declare namespace device {
          */
         dnsSuffixes?: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * except for out-of_band interface (vme/em0/fxp0)
+         * except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP Address (i.e. "192.168.1.1") or a Variable (i.e. "{{myvar}}")
          */
         gateway?: pulumi.Input<string>;
+        /**
+         * Interface IP Address (i.e. "192.168.1.8") or a Variable (i.e. "{{myvar}}")
+         */
         ip?: pulumi.Input<string>;
         /**
-         * used only if `subnet` is not specified in `networks`
+         * used only if `subnet` is not specified in `networks`. Interface Netmask (i.e. "/24") or a Variable (i.e. "{{myvar}}")
          */
         netmask?: pulumi.Input<string>;
         /**
@@ -1209,11 +1226,14 @@ export declare namespace device {
     }
     interface GatewayPortConfigTrafficShaping {
         /**
-         * percentages for differet class of traffic: high / medium / low / best-effort
-         * sum must be equal to 100
+         * percentages for differet class of traffic: high / medium / low / best-effort. Sum must be equal to 100
          */
         classPercentages?: pulumi.Input<pulumi.Input<number>[]>;
         enabled?: pulumi.Input<boolean>;
+        /**
+         * Interface Transmit Cap in kbps
+         */
+        maxTxKbps?: pulumi.Input<number>;
     }
     interface GatewayPortConfigVpnPaths {
         /**
@@ -1240,11 +1260,14 @@ export declare namespace device {
     }
     interface GatewayPortConfigVpnPathsTrafficShaping {
         /**
-         * percentages for differet class of traffic: high / medium / low / best-effort
-         * sum must be equal to 100
+         * percentages for differet class of traffic: high / medium / low / best-effort. Sum must be equal to 100
          */
         classPercentages?: pulumi.Input<pulumi.Input<number>[]>;
         enabled?: pulumi.Input<boolean>;
+        /**
+         * Interface Transmit Cap in kbps
+         */
+        maxTxKbps?: pulumi.Input<number>;
     }
     interface GatewayPortConfigWanExtraRoutes {
         via?: pulumi.Input<string>;
@@ -1299,6 +1322,10 @@ export declare namespace device {
          * for SSR, hub decides how VRF routes are leaked on spoke
          */
         addTargetVrfs?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * route aggregation
+         */
+        aggregates?: pulumi.Input<pulumi.Input<string>[]>;
         /**
          * when used as export policy, optional
          */
@@ -1343,16 +1370,14 @@ export declare namespace device {
         vpnNeighborMacs?: pulumi.Input<pulumi.Input<string>[]>;
         vpnPathSla?: pulumi.Input<inputs.device.GatewayRoutingPoliciesTermMatchingVpnPathSla>;
         /**
-         * overlay-facing criteria (used for bgpConfig where via=vpn)
-         * ordered-
+         * overlay-facing criteria (used for bgpConfig where via=vpn). ordered-
          */
         vpnPaths?: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface GatewayRoutingPoliciesTermMatchingRouteExists {
         route?: pulumi.Input<string>;
         /**
-         * name of the vrf instance
-         * it can also be the name of the VPN or wan if they
+         * name of the vrf instance, it can also be the name of the VPN or wan if they
          */
         vrfName?: pulumi.Input<string>;
     }
@@ -1381,8 +1406,7 @@ export declare namespace device {
          */
         name?: pulumi.Input<string>;
         /**
-         * by default, we derive all paths available and use them
-         * optionally, you can customize by using `pathPreference`
+         * by default, we derive all paths available and use them. Optionally, you can customize by using `pathPreference`
          */
         pathPreference?: pulumi.Input<string>;
         /**
@@ -1425,70 +1449,81 @@ export declare namespace device {
     interface GatewayTunnelConfigs {
         autoProvision?: pulumi.Input<inputs.device.GatewayTunnelConfigsAutoProvision>;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
          */
         ikeLifetime?: pulumi.Input<number>;
         /**
-         * Only if `provider`== `custom-ipsec`. enum: `aggressive`, `main`
+         * Only if `provider`==`custom-ipsec`. enum: `aggressive`, `main`
          */
         ikeMode?: pulumi.Input<string>;
         /**
-         * if `provider`== `custom-ipsec`
+         * if `provider`==`custom-ipsec`
          */
         ikeProposals?: pulumi.Input<pulumi.Input<inputs.device.GatewayTunnelConfigsIkeProposal>[]>;
         /**
-         * if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
          */
         ipsecLifetime?: pulumi.Input<number>;
         /**
-         * Only if  `provider`== `custom-ipsec`
+         * Only if  `provider`==`custom-ipsec`
          */
         ipsecProposals?: pulumi.Input<pulumi.Input<inputs.device.GatewayTunnelConfigsIpsecProposal>[]>;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-ipsec`
-         *   * `provider`==`jse-ipsec`
-         *   * `provider`== `custom-ipsec`
+         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         localId?: pulumi.Input<string>;
         /**
-         * enum: `active-active`, `active-standby`
+         * Required if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`. enum: `active-active`, `active-standby`
          */
         mode?: pulumi.Input<string>;
         /**
-         * networks reachable via this tunnel
+         * if `provider`==`custom-ipsec`, networks reachable via this tunnel
          */
         networks?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         */
         primary?: pulumi.Input<inputs.device.GatewayTunnelConfigsPrimary>;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`
          */
         probe?: pulumi.Input<inputs.device.GatewayTunnelConfigsProbe>;
         /**
-         * Only if `provider`== `custom-ipsec`. enum: `gre`, `ipsec`
+         * Only if `provider`==`custom-ipsec`. enum: `gre`, `ipsec`
          */
         protocol?: pulumi.Input<string>;
         /**
-         * enum: `custom-ipsec`, `customer-gre`, `jse-ipsec`, `zscaler-gre`, `zscaler-ipsec`
+         * Only if `auto_provision.enabled`==`false`. enum: `custom-ipsec`, `customer-gre`, `jse-ipsec`, `zscaler-gre`, `zscaler-ipsec`
          */
         provider?: pulumi.Input<string>;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-ipsec`
-         *   * `provider`==`jse-ipsec`
-         *   * `provider`== `custom-ipsec`
+         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         psk?: pulumi.Input<string>;
+        /**
+         * Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         */
         secondary?: pulumi.Input<inputs.device.GatewayTunnelConfigsSecondary>;
         /**
-         * Only if `provider`== `custom-gre` or `provider`== `custom-ipsec`. enum: `1`, `2`
+         * Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. enum: `1`, `2`
          */
         version?: pulumi.Input<string>;
     }
     interface GatewayTunnelConfigsAutoProvision {
         enable?: pulumi.Input<boolean>;
+        /**
+         * API override for POP selection
+         */
         latlng?: pulumi.Input<inputs.device.GatewayTunnelConfigsAutoProvisionLatlng>;
         primary?: pulumi.Input<inputs.device.GatewayTunnelConfigsAutoProvisionPrimary>;
+        /**
+         * enum: `jse-ipsec`, `zscaler-ipsec`
+         */
+        provider: pulumi.Input<string>;
+        /**
+         * API override for POP selection
+         */
+        region?: pulumi.Input<string>;
         secondary?: pulumi.Input<inputs.device.GatewayTunnelConfigsAutoProvisionSecondary>;
     }
     interface GatewayTunnelConfigsAutoProvisionLatlng {
@@ -1496,14 +1531,14 @@ export declare namespace device {
         lng: pulumi.Input<number>;
     }
     interface GatewayTunnelConfigsAutoProvisionPrimary {
-        numHosts?: pulumi.Input<string>;
+        probeIps?: pulumi.Input<pulumi.Input<string>[]>;
         /**
          * optional, only needed if `varsOnly`==`false`
          */
         wanNames?: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface GatewayTunnelConfigsAutoProvisionSecondary {
-        numHosts?: pulumi.Input<string>;
+        probeIps?: pulumi.Input<pulumi.Input<string>[]>;
         /**
          * optional, only needed if `varsOnly`==`false`
          */
@@ -1539,7 +1574,7 @@ export declare namespace device {
          */
         authAlgo?: pulumi.Input<string>;
         /**
-         * Only if `provider`== `custom-ipsec`. enum:
+         * Only if `provider`==`custom-ipsec`. enum:
          *   * 1
          *   * 2 (1024-bit)
          *   * 5
@@ -1558,19 +1593,17 @@ export declare namespace device {
         encAlgo?: pulumi.Input<string>;
     }
     interface GatewayTunnelConfigsPrimary {
-        hosts?: pulumi.Input<pulumi.Input<string>[]>;
+        hosts: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-gre`
-         *   * `provider`== `custom-gre`
+         * Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`
          */
         internalIps?: pulumi.Input<pulumi.Input<string>[]>;
         probeIps?: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: pulumi.Input<pulumi.Input<string>[]>;
-        wanNames?: pulumi.Input<pulumi.Input<string>[]>;
+        wanNames: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface GatewayTunnelConfigsProbe {
         /**
@@ -1591,19 +1624,17 @@ export declare namespace device {
         type?: pulumi.Input<string>;
     }
     interface GatewayTunnelConfigsSecondary {
-        hosts?: pulumi.Input<pulumi.Input<string>[]>;
+        hosts: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-gre`
-         *   * `provider`== `custom-gre`
+         * Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`
          */
         internalIps?: pulumi.Input<pulumi.Input<string>[]>;
         probeIps?: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: pulumi.Input<pulumi.Input<string>[]>;
-        wanNames?: pulumi.Input<pulumi.Input<string>[]>;
+        wanNames: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface GatewayTunnelProviderOptions {
         /**
@@ -1616,74 +1647,125 @@ export declare namespace device {
         zscaler?: pulumi.Input<inputs.device.GatewayTunnelProviderOptionsZscaler>;
     }
     interface GatewayTunnelProviderOptionsJse {
-        name?: pulumi.Input<string>;
         numUsers?: pulumi.Input<number>;
+        /**
+         * JSE Organization name
+         */
+        orgName?: pulumi.Input<string>;
     }
     interface GatewayTunnelProviderOptionsZscaler {
-        aupAcceptanceRequired?: pulumi.Input<boolean>;
+        aupBlockInternetUntilAccepted?: pulumi.Input<boolean>;
         /**
-         * days before AUP is requested again
+         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
          */
-        aupExpire?: pulumi.Input<number>;
+        aupEnabled?: pulumi.Input<boolean>;
         /**
          * proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
          */
-        aupSslProxy?: pulumi.Input<boolean>;
+        aupForceSslInspection?: pulumi.Input<boolean>;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Required if `aupEnabled`==`true`. Days before AUP is requested again
          */
-        downloadMbps?: pulumi.Input<number>;
+        aupTimeoutInDays?: pulumi.Input<number>;
         /**
-         * if `useXff`==`true`, display Acceptable Use Policy (AUP)
+         * Enable this option to enforce user authentication
          */
-        enableAup?: pulumi.Input<boolean>;
+        authRequired?: pulumi.Input<boolean>;
         /**
-         * when `enforceAuthentication`==`false`, display caution notification for non-authenticated users
+         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
          */
-        enableCaution?: pulumi.Input<boolean>;
-        enforceAuthentication?: pulumi.Input<boolean>;
-        name?: pulumi.Input<string>;
+        cautionEnabled?: pulumi.Input<boolean>;
         /**
-         * if `useXff`==`true`
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        dnBandwidth?: pulumi.Input<number>;
+        /**
+         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
+         */
+        idleTimeInMinutes?: pulumi.Input<number>;
+        /**
+         * if `true`, enable the firewall control option
+         */
+        ofwEnabled?: pulumi.Input<boolean>;
+        /**
+         * `sub-locations` can be used for specific uses cases to define different configuration based on the user network
          */
         subLocations?: pulumi.Input<pulumi.Input<inputs.device.GatewayTunnelProviderOptionsZscalerSubLocation>[]>;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
+         */
+        surrogateIp?: pulumi.Input<boolean>;
+        /**
+         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
          */
-        uploadMbps?: pulumi.Input<number>;
+        surrogateIpEnforcedForKnownBrowsers?: pulumi.Input<boolean>;
+        /**
+         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
+         */
+        surrogateRefreshTimeInMinutes?: pulumi.Input<number>;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        upBandwidth?: pulumi.Input<number>;
         /**
          * location uses proxy chaining to forward traffic
          */
-        useXff?: pulumi.Input<boolean>;
+        xffForwardEnabled?: pulumi.Input<boolean>;
     }
     interface GatewayTunnelProviderOptionsZscalerSubLocation {
-        aupAcceptanceRequired?: pulumi.Input<boolean>;
+        aupBlockInternetUntilAccepted?: pulumi.Input<boolean>;
         /**
-         * days before AUP is requested again
+         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
          */
-        aupExpire?: pulumi.Input<number>;
+        aupEnabled?: pulumi.Input<boolean>;
         /**
          * proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
          */
-        aupSslProxy?: pulumi.Input<boolean>;
+        aupForceSslInspection?: pulumi.Input<boolean>;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Required if `aupEnabled`==`true`. Days before AUP is requested again
          */
-        downloadMbps?: pulumi.Input<number>;
+        aupTimeoutInDays?: pulumi.Input<number>;
         /**
-         * if `useXff`==`true`, display Acceptable Use Policy (AUP)
+         * Enable this option to authenticate users
          */
-        enableAup?: pulumi.Input<boolean>;
+        authRequired?: pulumi.Input<boolean>;
         /**
-         * when `enforceAuthentication`==`false`, display caution notification for non-authenticated users
+         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
          */
-        enableCaution?: pulumi.Input<boolean>;
-        enforceAuthentication?: pulumi.Input<boolean>;
-        subnets?: pulumi.Input<pulumi.Input<string>[]>;
+        cautionEnabled?: pulumi.Input<boolean>;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        dnBandwidth?: pulumi.Input<number>;
+        /**
+         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
+         */
+        idleTimeInMinutes?: pulumi.Input<number>;
+        /**
+         * Network name
+         */
+        name?: pulumi.Input<string>;
+        /**
+         * if `true`, enable the firewall control option
+         */
+        ofwEnabled?: pulumi.Input<boolean>;
+        /**
+         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
+         */
+        surrogateIp?: pulumi.Input<boolean>;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
          */
-        uploadMbps?: pulumi.Input<number>;
+        surrogateIpEnforcedForKnownBrowsers?: pulumi.Input<boolean>;
+        /**
+         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
+         */
+        surrogateRefreshTimeInMinutes?: pulumi.Input<number>;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        upBandwidth?: pulumi.Input<number>;
     }
     interface GatewayVrfConfig {
         /**
@@ -1696,14 +1778,16 @@ export declare namespace device {
     }
     interface SwitchAclPolicy {
         /**
-         * - for GBP-based policy, all srcTags and dstTags have to be gbp-based
-         * - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
+         * ACL Policy Actions:
+         *   - for GBP-based policy, all srcTags and dstTags have to be gbp-based
+         *   - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
          */
         actions?: pulumi.Input<pulumi.Input<inputs.device.SwitchAclPolicyAction>[]>;
         name?: pulumi.Input<string>;
         /**
-         * - for GBP-based policy, all srcTags and dstTags have to be gbp-based
-         * - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
+         * ACL Policy Source Tags:
+         *   - for GBP-based policy, all srcTags and dstTags have to be gbp-based
+         *   - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
          */
         srcTags?: pulumi.Input<pulumi.Input<string>[]>;
     }
@@ -1717,9 +1801,9 @@ export declare namespace device {
     interface SwitchAclTags {
         /**
          * required if
-         * - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
-         * - `type`==`gbpResource`
-         * - `type`==`staticGbp` (applying gbp tag against matching conditions)
+         *   - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
+         *   - `type`==`gbpResource`
+         *   - `type`==`staticGbp` (applying gbp tag against matching conditions)
          */
         gbpTag?: pulumi.Input<number>;
         /**
@@ -1745,8 +1829,7 @@ export declare namespace device {
          */
         radiusGroup?: pulumi.Input<string>;
         /**
-         * if `type`==`resource` or `type`==`gbpResource`
-         * empty means unrestricted, i.e. any
+         * if `type`==`resource` or `type`==`gbpResource`. Empty means unrestricted, i.e. any
          */
         specs?: pulumi.Input<pulumi.Input<inputs.device.SwitchAclTagsSpec>[]>;
         /**
@@ -1776,7 +1859,7 @@ export declare namespace device {
          */
         portRange?: pulumi.Input<string>;
         /**
-         * `tcp` / `udp` / `icmp` / `gre` / `any` / `:protocol_number`. `protocolNumber` is between 1-254
+         * `tcp` / `udp` / `icmp` / `icmp6` / `gre` / `any` / `:protocol_number`, `protocolNumber` is between 1-254, default is `any` `protocolNumber` is between 1-254
          */
         protocol?: pulumi.Input<string>;
     }
@@ -1901,13 +1984,6 @@ export declare namespace device {
         type?: pulumi.Input<string>;
         value?: pulumi.Input<string>;
     }
-    interface SwitchEvpnConfig {
-        enabled?: pulumi.Input<boolean>;
-        /**
-         * enum: `access`, `collapsed-core`, `core`, `distribution`, `esilag-access`, `none`
-         */
-        role?: pulumi.Input<string>;
-    }
     interface SwitchExtraRoutes {
         /**
          * this takes precedence
@@ -1975,9 +2051,7 @@ export declare namespace device {
          */
         allNetworks?: pulumi.Input<boolean>;
         /**
-         * If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with.
-         * All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state.
-         * When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
+         * If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with. All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state. When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
          */
         allowDhcpd?: pulumi.Input<boolean>;
         allowMultipleSupplicants?: pulumi.Input<boolean>;
@@ -2016,8 +2090,7 @@ export declare namespace device {
          */
         guestNetwork?: pulumi.Input<string>;
         /**
-         * inter_switch_link is used together with "isolation" under networks
-         * NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
+         * inter_switch_link is used together with "isolation" under networks. NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
          */
         interSwitchLink?: pulumi.Input<boolean>;
         /**
@@ -2048,6 +2121,10 @@ export declare namespace device {
          * Only if `mode`==`trunk`, the list of network/vlans
          */
         networks?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Additional note for the port config override
+         */
+        note?: pulumi.Input<string>;
         /**
          * Only if `mode`==`access` and `portAuth`!=`dot1x` whether the port should retain dynamically learned MAC addresses
          */
@@ -2139,8 +2216,7 @@ export declare namespace device {
          */
         gateway6?: pulumi.Input<string>;
         /**
-         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required)
-         * NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set
+         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required). NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set
          */
         isolation?: pulumi.Input<boolean>;
         isolationVlanId?: pulumi.Input<string>;
@@ -2330,9 +2406,7 @@ export declare namespace device {
          */
         allNetworks?: pulumi.Input<boolean>;
         /**
-         * Only if `mode`!=`dynamic`. If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with.
-         * All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state.
-         * When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
+         * Only if `mode`!=`dynamic`. If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with. All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state. When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
          */
         allowDhcpd?: pulumi.Input<boolean>;
         /**
@@ -2380,8 +2454,7 @@ export declare namespace device {
          */
         guestNetwork?: pulumi.Input<string>;
         /**
-         * Only if `mode`!=`dynamic` interSwitchLink is used together with "isolation" under networks
-         * NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
+         * Only if `mode`!=`dynamic` interSwitchLink is used together with "isolation" under networks. NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
          */
         interSwitchLink?: pulumi.Input<boolean>;
         /**
@@ -2453,8 +2526,7 @@ export declare namespace device {
          */
         speed?: pulumi.Input<string>;
         /**
-         * Switch storm control
-         * Only if `mode`!=`dynamic`
+         * Switch storm control. Only if `mode`!=`dynamic`
          */
         stormControl?: pulumi.Input<inputs.device.SwitchPortUsagesStormControl>;
         /**
@@ -2531,8 +2603,7 @@ export declare namespace device {
          */
         authServersTimeout?: pulumi.Input<number>;
         /**
-         * use `network`or `sourceIp`
-         * which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
+         * use `network`or `sourceIp`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
          */
         network?: pulumi.Input<string>;
         /**
@@ -2812,8 +2883,7 @@ export declare namespace device {
     }
     interface SwitchSnmpConfigV3ConfigUsmUser {
         /**
-         * Not required if `authenticationType`==`authenticationNone`
-         * include alphabetic, numeric, and special characters, but it cannot include control characters.
+         * Not required if `authenticationType`==`authenticationNone`. Include alphabetic, numeric, and special characters, but it cannot include control characters.
          */
         authenticationPassword?: pulumi.Input<string>;
         /**
@@ -2821,8 +2891,7 @@ export declare namespace device {
          */
         authenticationType?: pulumi.Input<string>;
         /**
-         * Not required if `encryptionType`==`privacy-none`
-         * include alphabetic, numeric, and special characters, but it cannot include control characters
+         * Not required if `encryptionType`==`privacy-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters
          */
         encryptionPassword?: pulumi.Input<string>;
         /**
@@ -3610,8 +3679,7 @@ export declare namespace org {
          */
         exportPolicy?: pulumi.Input<string>;
         /**
-         * by default, either inet/net6 unicast depending on neighbor IP family (v4 or v6)
-         * for v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
+         * by default, either inet/net6 unicast depending on neighbor IP family (v4 or v6). For v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
          */
         extendedV4Nexthop?: pulumi.Input<boolean>;
         /**
@@ -3847,6 +3915,9 @@ export declare namespace org {
         routedForNetworks?: pulumi.Input<pulumi.Input<string>[]>;
         subnet: pulumi.Input<string>;
         subnet6?: pulumi.Input<string>;
+        /**
+         * Property key must be the user/tenant name (i.e. "printer-1") or a Variable (i.e. "{{myvar}}")
+         */
         tenants?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkTenants>;
         }>;
@@ -3864,7 +3935,7 @@ export declare namespace org {
     interface DeviceprofileGatewayNetworkInternetAccess {
         createSimpleServicePolicy?: pulumi.Input<boolean>;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
         destinationNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkInternetAccessDestinationNat>;
@@ -3875,22 +3946,35 @@ export declare namespace org {
          */
         restricted?: pulumi.Input<boolean>;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkInternetAccessStaticNat>;
         }>;
     }
     interface DeviceprofileGatewayNetworkInternetAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: pulumi.Input<string>;
         name?: pulumi.Input<string>;
-        port?: pulumi.Input<number>;
+        /**
+         * The Destination NAT destination IP Address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}")
+         */
+        port?: pulumi.Input<string>;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity
+         */
+        wanName?: pulumi.Input<string>;
     }
     interface DeviceprofileGatewayNetworkInternetAccessStaticNat {
-        internalIp?: pulumi.Input<string>;
-        name?: pulumi.Input<string>;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
+         */
+        internalIp: pulumi.Input<string>;
+        name: pulumi.Input<string>;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}")
          */
         wanName?: pulumi.Input<string>;
     }
@@ -3926,7 +4010,7 @@ export declare namespace org {
          */
         allowPing?: pulumi.Input<boolean>;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
         destinationNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkVpnAccessDestinationNat>;
@@ -3944,13 +4028,11 @@ export declare namespace org {
          */
         noReadvertiseToLanOspf?: pulumi.Input<boolean>;
         /**
-         * toward overlay
-         * how HUB should deal with routes it received from Spokes
+         * toward overlay, how HUB should deal with routes it received from Spokes
          */
         noReadvertiseToOverlay?: pulumi.Input<boolean>;
         /**
-         * by default, the routes are only readvertised toward the same vrf on spoke
-         * to allow it to be leaked to other vrfs
+         * by default, the routes are only readvertised toward the same vrf on spoke. To allow it to be leaked to other vrfs
          */
         otherVrfs?: pulumi.Input<pulumi.Input<string>[]>;
         /**
@@ -3962,14 +4044,13 @@ export declare namespace org {
          */
         sourceNat?: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkVpnAccessSourceNat>;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkVpnAccessStaticNat>;
         }>;
         /**
-         * toward overlay
-         * how HUB should deal with routes it received from Spokes
+         * toward overlay, how HUB should deal with routes it received from Spokes
          */
         summarizedSubnet?: pulumi.Input<string>;
         /**
@@ -3982,20 +4063,22 @@ export declare namespace org {
         summarizedSubnetToLanOspf?: pulumi.Input<string>;
     }
     interface DeviceprofileGatewayNetworkVpnAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: pulumi.Input<string>;
         name?: pulumi.Input<string>;
-        port?: pulumi.Input<number>;
+        port?: pulumi.Input<string>;
     }
     interface DeviceprofileGatewayNetworkVpnAccessSourceNat {
         externalIp?: pulumi.Input<string>;
     }
     interface DeviceprofileGatewayNetworkVpnAccessStaticNat {
-        internalIp?: pulumi.Input<string>;
-        name?: pulumi.Input<string>;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
          */
-        wanName?: pulumi.Input<string>;
+        internalIp: pulumi.Input<string>;
+        name: pulumi.Input<string>;
     }
     interface DeviceprofileGatewayOobIpConfig {
         /**
@@ -4106,9 +4189,7 @@ export declare namespace org {
          */
         aeIdx?: pulumi.Input<string>;
         /**
-         * For SRX Only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability.\n
-         * Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end\n
-         * Note: Turning this on will enable force-up on one of the interfaces in the bundle only
+         * For SRX Only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
          */
         aeLacpForceUp?: pulumi.Input<boolean>;
         aggregated?: pulumi.Input<boolean>;
@@ -4116,6 +4197,9 @@ export declare namespace org {
          * if want to generate port up/down alarm, set it to true
          */
         critical?: pulumi.Input<boolean>;
+        /**
+         * Interface Description. Can be a variable (i.e. "{{myvar}}")
+         */
         description?: pulumi.Input<string>;
         disableAutoneg?: pulumi.Input<boolean>;
         /**
@@ -4127,13 +4211,11 @@ export declare namespace org {
          */
         dslType?: pulumi.Input<string>;
         /**
-         * if `wanType`==`dsl`
-         * 16 bit int
+         * if `wanType`==`dsl`, 16 bit int
          */
         dslVci?: pulumi.Input<number>;
         /**
-         * if `wanType`==`dsl`
-         * 8 bit int
+         * if `wanType`==`dsl`, 8 bit int
          */
         dslVpi?: pulumi.Input<number>;
         /**
@@ -4167,7 +4249,7 @@ export declare namespace org {
          */
         name?: pulumi.Input<string>;
         /**
-         * if `usage`==`lan`
+         * if `usage`==`lan`, name of the `junipermist.org.Network` resource
          */
         networks?: pulumi.Input<pulumi.Input<string>[]>;
         /**
@@ -4176,7 +4258,7 @@ export declare namespace org {
         outerVlanId?: pulumi.Input<number>;
         poeDisabled?: pulumi.Input<boolean>;
         /**
-         * if `usage`==`lan`
+         * Only for SRX and if `usage`==`lan`, the Untagged VLAN Network
          */
         portNetwork?: pulumi.Input<string>;
         /**
@@ -4213,10 +4295,7 @@ export declare namespace org {
          * port usage name. enum: `haControl`, `haData`, `lan`, `wan`
          */
         usage: pulumi.Input<string>;
-        /**
-         * if WAN interface is on a VLAN
-         */
-        vlanId?: pulumi.Input<number>;
+        vlanId?: pulumi.Input<string>;
         /**
          * Property key is the VPN name
          */
@@ -4224,29 +4303,33 @@ export declare namespace org {
             [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayPortConfigVpnPaths>;
         }>;
         /**
-         * when `wanType`==`broadband`. enum: `default`, `max`, `recommended`
+         * Only when `wanType`==`broadband`. enum: `default`, `max`, `recommended`
          */
         wanArpPolicer?: pulumi.Input<string>;
         /**
-         * optional, if spoke should reach this port by a different IP
+         * Only if `usage`==`wan`, optional. If spoke should reach this port by a different IP
          */
         wanExtIp?: pulumi.Input<string>;
         /**
-         * Property Key is the destianation CIDR (e.g "100.100.100.0/24")
+         * Only if `usage`==`wan`. Property Key is the destianation CIDR (e.g "100.100.100.0/24")
          */
         wanExtraRoutes?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayPortConfigWanExtraRoutes>;
         }>;
         /**
-         * if `usage`==`wan`
+         * Only if `usage`==`wan`. If some networks are connected to this WAN port, it can be added here so policies can be defined
+         */
+        wanNetworks?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Only if `usage`==`wan`
          */
         wanProbeOverride?: pulumi.Input<inputs.org.DeviceprofileGatewayPortConfigWanProbeOverride>;
         /**
-         * optional, by default, source-NAT is performed on all WAN Ports using the interface-ip
+         * Only if `usage`==`wan`, optional. By default, source-NAT is performed on all WAN Ports using the interface-ip
          */
         wanSourceNat?: pulumi.Input<inputs.org.DeviceprofileGatewayPortConfigWanSourceNat>;
         /**
-         * if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`
+         * Only if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`
          */
         wanType?: pulumi.Input<string>;
     }
@@ -4260,12 +4343,15 @@ export declare namespace org {
          */
         dnsSuffixes?: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * except for out-of_band interface (vme/em0/fxp0)
+         * except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP Address (i.e. "192.168.1.1") or a Variable (i.e. "{{myvar}}")
          */
         gateway?: pulumi.Input<string>;
+        /**
+         * Interface IP Address (i.e. "192.168.1.8") or a Variable (i.e. "{{myvar}}")
+         */
         ip?: pulumi.Input<string>;
         /**
-         * used only if `subnet` is not specified in `networks`
+         * used only if `subnet` is not specified in `networks`. Interface Netmask (i.e. "/24") or a Variable (i.e. "{{myvar}}")
          */
         netmask?: pulumi.Input<string>;
         /**
@@ -4291,11 +4377,14 @@ export declare namespace org {
     }
     interface DeviceprofileGatewayPortConfigTrafficShaping {
         /**
-         * percentages for differet class of traffic: high / medium / low / best-effort
-         * sum must be equal to 100
+         * percentages for differet class of traffic: high / medium / low / best-effort. Sum must be equal to 100
          */
         classPercentages?: pulumi.Input<pulumi.Input<number>[]>;
         enabled?: pulumi.Input<boolean>;
+        /**
+         * Interface Transmit Cap in kbps
+         */
+        maxTxKbps?: pulumi.Input<number>;
     }
     interface DeviceprofileGatewayPortConfigVpnPaths {
         /**
@@ -4322,11 +4411,14 @@ export declare namespace org {
     }
     interface DeviceprofileGatewayPortConfigVpnPathsTrafficShaping {
         /**
-         * percentages for differet class of traffic: high / medium / low / best-effort
-         * sum must be equal to 100
+         * percentages for differet class of traffic: high / medium / low / best-effort. Sum must be equal to 100
          */
         classPercentages?: pulumi.Input<pulumi.Input<number>[]>;
         enabled?: pulumi.Input<boolean>;
+        /**
+         * Interface Transmit Cap in kbps
+         */
+        maxTxKbps?: pulumi.Input<number>;
     }
     interface DeviceprofileGatewayPortConfigWanExtraRoutes {
         via?: pulumi.Input<string>;
@@ -4371,6 +4463,10 @@ export declare namespace org {
          * for SSR, hub decides how VRF routes are leaked on spoke
          */
         addTargetVrfs?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * route aggregation
+         */
+        aggregates?: pulumi.Input<pulumi.Input<string>[]>;
         /**
          * when used as export policy, optional
          */
@@ -4415,16 +4511,14 @@ export declare namespace org {
         vpnNeighborMacs?: pulumi.Input<pulumi.Input<string>[]>;
         vpnPathSla?: pulumi.Input<inputs.org.DeviceprofileGatewayRoutingPoliciesTermMatchingVpnPathSla>;
         /**
-         * overlay-facing criteria (used for bgpConfig where via=vpn)
-         * ordered-
+         * overlay-facing criteria (used for bgpConfig where via=vpn). ordered-
          */
         vpnPaths?: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface DeviceprofileGatewayRoutingPoliciesTermMatchingRouteExists {
         route?: pulumi.Input<string>;
         /**
-         * name of the vrf instance
-         * it can also be the name of the VPN or wan if they
+         * name of the vrf instance, it can also be the name of the VPN or wan if they
          */
         vrfName?: pulumi.Input<string>;
     }
@@ -4453,8 +4547,7 @@ export declare namespace org {
          */
         name?: pulumi.Input<string>;
         /**
-         * by default, we derive all paths available and use them
-         * optionally, you can customize by using `pathPreference`
+         * by default, we derive all paths available and use them. Optionally, you can customize by using `pathPreference`
          */
         pathPreference?: pulumi.Input<string>;
         /**
@@ -4497,70 +4590,81 @@ export declare namespace org {
     interface DeviceprofileGatewayTunnelConfigs {
         autoProvision?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsAutoProvision>;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
          */
         ikeLifetime?: pulumi.Input<number>;
         /**
-         * Only if `provider`== `custom-ipsec`. enum: `aggressive`, `main`
+         * Only if `provider`==`custom-ipsec`. enum: `aggressive`, `main`
          */
         ikeMode?: pulumi.Input<string>;
         /**
-         * if `provider`== `custom-ipsec`
+         * if `provider`==`custom-ipsec`
          */
         ikeProposals?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsIkeProposal>[]>;
         /**
-         * if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
          */
         ipsecLifetime?: pulumi.Input<number>;
         /**
-         * Only if  `provider`== `custom-ipsec`
+         * Only if  `provider`==`custom-ipsec`
          */
         ipsecProposals?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsIpsecProposal>[]>;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-ipsec`
-         *   * `provider`==`jse-ipsec`
-         *   * `provider`== `custom-ipsec`
+         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         localId?: pulumi.Input<string>;
         /**
-         * enum: `active-active`, `active-standby`
+         * Required if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`. enum: `active-active`, `active-standby`
          */
         mode?: pulumi.Input<string>;
         /**
-         * networks reachable via this tunnel
+         * if `provider`==`custom-ipsec`, networks reachable via this tunnel
          */
         networks?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         */
         primary?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsPrimary>;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`
          */
         probe?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsProbe>;
         /**
-         * Only if `provider`== `custom-ipsec`. enum: `gre`, `ipsec`
+         * Only if `provider`==`custom-ipsec`. enum: `gre`, `ipsec`
          */
         protocol?: pulumi.Input<string>;
         /**
-         * enum: `custom-ipsec`, `customer-gre`, `jse-ipsec`, `zscaler-gre`, `zscaler-ipsec`
+         * Only if `auto_provision.enabled`==`false`. enum: `custom-ipsec`, `customer-gre`, `jse-ipsec`, `zscaler-gre`, `zscaler-ipsec`
          */
         provider?: pulumi.Input<string>;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-ipsec`
-         *   * `provider`==`jse-ipsec`
-         *   * `provider`== `custom-ipsec`
+         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         psk?: pulumi.Input<string>;
+        /**
+         * Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         */
         secondary?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsSecondary>;
         /**
-         * Only if `provider`== `custom-gre` or `provider`== `custom-ipsec`. enum: `1`, `2`
+         * Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. enum: `1`, `2`
          */
         version?: pulumi.Input<string>;
     }
     interface DeviceprofileGatewayTunnelConfigsAutoProvision {
         enable?: pulumi.Input<boolean>;
+        /**
+         * API override for POP selection
+         */
         latlng?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsAutoProvisionLatlng>;
         primary?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsAutoProvisionPrimary>;
+        /**
+         * enum: `jse-ipsec`, `zscaler-ipsec`
+         */
+        provider: pulumi.Input<string>;
+        /**
+         * API override for POP selection
+         */
+        region?: pulumi.Input<string>;
         secondary?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsAutoProvisionSecondary>;
     }
     interface DeviceprofileGatewayTunnelConfigsAutoProvisionLatlng {
@@ -4568,14 +4672,14 @@ export declare namespace org {
         lng: pulumi.Input<number>;
     }
     interface DeviceprofileGatewayTunnelConfigsAutoProvisionPrimary {
-        numHosts?: pulumi.Input<string>;
+        probeIps?: pulumi.Input<pulumi.Input<string>[]>;
         /**
          * optional, only needed if `varsOnly`==`false`
          */
         wanNames?: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface DeviceprofileGatewayTunnelConfigsAutoProvisionSecondary {
-        numHosts?: pulumi.Input<string>;
+        probeIps?: pulumi.Input<pulumi.Input<string>[]>;
         /**
          * optional, only needed if `varsOnly`==`false`
          */
@@ -4611,7 +4715,7 @@ export declare namespace org {
          */
         authAlgo?: pulumi.Input<string>;
         /**
-         * Only if `provider`== `custom-ipsec`. enum:
+         * Only if `provider`==`custom-ipsec`. enum:
          *   * 1
          *   * 2 (1024-bit)
          *   * 5
@@ -4630,19 +4734,17 @@ export declare namespace org {
         encAlgo?: pulumi.Input<string>;
     }
     interface DeviceprofileGatewayTunnelConfigsPrimary {
-        hosts?: pulumi.Input<pulumi.Input<string>[]>;
+        hosts: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-gre`
-         *   * `provider`== `custom-gre`
+         * Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`
          */
         internalIps?: pulumi.Input<pulumi.Input<string>[]>;
         probeIps?: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: pulumi.Input<pulumi.Input<string>[]>;
-        wanNames?: pulumi.Input<pulumi.Input<string>[]>;
+        wanNames: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface DeviceprofileGatewayTunnelConfigsProbe {
         /**
@@ -4663,19 +4765,17 @@ export declare namespace org {
         type?: pulumi.Input<string>;
     }
     interface DeviceprofileGatewayTunnelConfigsSecondary {
-        hosts?: pulumi.Input<pulumi.Input<string>[]>;
+        hosts: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-gre`
-         *   * `provider`== `custom-gre`
+         * Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`
          */
         internalIps?: pulumi.Input<pulumi.Input<string>[]>;
         probeIps?: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: pulumi.Input<pulumi.Input<string>[]>;
-        wanNames?: pulumi.Input<pulumi.Input<string>[]>;
+        wanNames: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface DeviceprofileGatewayTunnelProviderOptions {
         /**
@@ -4688,74 +4788,125 @@ export declare namespace org {
         zscaler?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelProviderOptionsZscaler>;
     }
     interface DeviceprofileGatewayTunnelProviderOptionsJse {
-        name?: pulumi.Input<string>;
         numUsers?: pulumi.Input<number>;
+        /**
+         * JSE Organization name
+         */
+        orgName?: pulumi.Input<string>;
     }
     interface DeviceprofileGatewayTunnelProviderOptionsZscaler {
-        aupAcceptanceRequired?: pulumi.Input<boolean>;
+        aupBlockInternetUntilAccepted?: pulumi.Input<boolean>;
         /**
-         * days before AUP is requested again
+         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
          */
-        aupExpire?: pulumi.Input<number>;
+        aupEnabled?: pulumi.Input<boolean>;
         /**
          * proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
          */
-        aupSslProxy?: pulumi.Input<boolean>;
+        aupForceSslInspection?: pulumi.Input<boolean>;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Required if `aupEnabled`==`true`. Days before AUP is requested again
          */
-        downloadMbps?: pulumi.Input<number>;
+        aupTimeoutInDays?: pulumi.Input<number>;
         /**
-         * if `useXff`==`true`, display Acceptable Use Policy (AUP)
+         * Enable this option to enforce user authentication
          */
-        enableAup?: pulumi.Input<boolean>;
+        authRequired?: pulumi.Input<boolean>;
         /**
-         * when `enforceAuthentication`==`false`, display caution notification for non-authenticated users
+         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
          */
-        enableCaution?: pulumi.Input<boolean>;
-        enforceAuthentication?: pulumi.Input<boolean>;
-        name?: pulumi.Input<string>;
+        cautionEnabled?: pulumi.Input<boolean>;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        dnBandwidth?: pulumi.Input<number>;
+        /**
+         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
+         */
+        idleTimeInMinutes?: pulumi.Input<number>;
         /**
-         * if `useXff`==`true`
+         * if `true`, enable the firewall control option
+         */
+        ofwEnabled?: pulumi.Input<boolean>;
+        /**
+         * `sub-locations` can be used for specific uses cases to define different configuration based on the user network
          */
         subLocations?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileGatewayTunnelProviderOptionsZscalerSubLocation>[]>;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
+         */
+        surrogateIp?: pulumi.Input<boolean>;
+        /**
+         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
+         */
+        surrogateIpEnforcedForKnownBrowsers?: pulumi.Input<boolean>;
+        /**
+         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
+         */
+        surrogateRefreshTimeInMinutes?: pulumi.Input<number>;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
          */
-        uploadMbps?: pulumi.Input<number>;
+        upBandwidth?: pulumi.Input<number>;
         /**
          * location uses proxy chaining to forward traffic
          */
-        useXff?: pulumi.Input<boolean>;
+        xffForwardEnabled?: pulumi.Input<boolean>;
     }
     interface DeviceprofileGatewayTunnelProviderOptionsZscalerSubLocation {
-        aupAcceptanceRequired?: pulumi.Input<boolean>;
+        aupBlockInternetUntilAccepted?: pulumi.Input<boolean>;
         /**
-         * days before AUP is requested again
+         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
          */
-        aupExpire?: pulumi.Input<number>;
+        aupEnabled?: pulumi.Input<boolean>;
         /**
          * proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
          */
-        aupSslProxy?: pulumi.Input<boolean>;
+        aupForceSslInspection?: pulumi.Input<boolean>;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Required if `aupEnabled`==`true`. Days before AUP is requested again
          */
-        downloadMbps?: pulumi.Input<number>;
+        aupTimeoutInDays?: pulumi.Input<number>;
         /**
-         * if `useXff`==`true`, display Acceptable Use Policy (AUP)
+         * Enable this option to authenticate users
          */
-        enableAup?: pulumi.Input<boolean>;
+        authRequired?: pulumi.Input<boolean>;
         /**
-         * when `enforceAuthentication`==`false`, display caution notification for non-authenticated users
+         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
          */
-        enableCaution?: pulumi.Input<boolean>;
-        enforceAuthentication?: pulumi.Input<boolean>;
-        subnets?: pulumi.Input<pulumi.Input<string>[]>;
+        cautionEnabled?: pulumi.Input<boolean>;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        dnBandwidth?: pulumi.Input<number>;
+        /**
+         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
+         */
+        idleTimeInMinutes?: pulumi.Input<number>;
+        /**
+         * Network name
+         */
+        name?: pulumi.Input<string>;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * if `true`, enable the firewall control option
          */
-        uploadMbps?: pulumi.Input<number>;
+        ofwEnabled?: pulumi.Input<boolean>;
+        /**
+         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
+         */
+        surrogateIp?: pulumi.Input<boolean>;
+        /**
+         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
+         */
+        surrogateIpEnforcedForKnownBrowsers?: pulumi.Input<boolean>;
+        /**
+         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
+         */
+        surrogateRefreshTimeInMinutes?: pulumi.Input<number>;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        upBandwidth?: pulumi.Input<number>;
     }
     interface DeviceprofileGatewayVrfConfig {
         /**
@@ -4875,8 +5026,7 @@ export declare namespace org {
          */
         exportPolicy?: pulumi.Input<string>;
         /**
-         * by default, either inet/net6 unicast depending on neighbor IP family (v4 or v6)
-         * for v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
+         * by default, either inet/net6 unicast depending on neighbor IP family (v4 or v6). For v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
          */
         extendedV4Nexthop?: pulumi.Input<boolean>;
         /**
@@ -5112,6 +5262,9 @@ export declare namespace org {
         routedForNetworks?: pulumi.Input<pulumi.Input<string>[]>;
         subnet: pulumi.Input<string>;
         subnet6?: pulumi.Input<string>;
+        /**
+         * Property key must be the user/tenant name (i.e. "printer-1") or a Variable (i.e. "{{myvar}}")
+         */
         tenants?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.GatewaytemplateNetworkTenants>;
         }>;
@@ -5129,7 +5282,7 @@ export declare namespace org {
     interface GatewaytemplateNetworkInternetAccess {
         createSimpleServicePolicy?: pulumi.Input<boolean>;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
         destinationNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.GatewaytemplateNetworkInternetAccessDestinationNat>;
@@ -5140,22 +5293,35 @@ export declare namespace org {
          */
         restricted?: pulumi.Input<boolean>;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.GatewaytemplateNetworkInternetAccessStaticNat>;
         }>;
     }
     interface GatewaytemplateNetworkInternetAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: pulumi.Input<string>;
         name?: pulumi.Input<string>;
-        port?: pulumi.Input<number>;
+        /**
+         * The Destination NAT destination IP Address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}")
+         */
+        port?: pulumi.Input<string>;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity
+         */
+        wanName?: pulumi.Input<string>;
     }
     interface GatewaytemplateNetworkInternetAccessStaticNat {
-        internalIp?: pulumi.Input<string>;
-        name?: pulumi.Input<string>;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
+         */
+        internalIp: pulumi.Input<string>;
+        name: pulumi.Input<string>;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}")
          */
         wanName?: pulumi.Input<string>;
     }
@@ -5191,7 +5357,7 @@ export declare namespace org {
          */
         allowPing?: pulumi.Input<boolean>;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
         destinationNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.GatewaytemplateNetworkVpnAccessDestinationNat>;
@@ -5209,13 +5375,11 @@ export declare namespace org {
          */
         noReadvertiseToLanOspf?: pulumi.Input<boolean>;
         /**
-         * toward overlay
-         * how HUB should deal with routes it received from Spokes
+         * toward overlay, how HUB should deal with routes it received from Spokes
          */
         noReadvertiseToOverlay?: pulumi.Input<boolean>;
         /**
-         * by default, the routes are only readvertised toward the same vrf on spoke
-         * to allow it to be leaked to other vrfs
+         * by default, the routes are only readvertised toward the same vrf on spoke. To allow it to be leaked to other vrfs
          */
         otherVrfs?: pulumi.Input<pulumi.Input<string>[]>;
         /**
@@ -5227,14 +5391,13 @@ export declare namespace org {
          */
         sourceNat?: pulumi.Input<inputs.org.GatewaytemplateNetworkVpnAccessSourceNat>;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.GatewaytemplateNetworkVpnAccessStaticNat>;
         }>;
         /**
-         * toward overlay
-         * how HUB should deal with routes it received from Spokes
+         * toward overlay, how HUB should deal with routes it received from Spokes
          */
         summarizedSubnet?: pulumi.Input<string>;
         /**
@@ -5247,20 +5410,22 @@ export declare namespace org {
         summarizedSubnetToLanOspf?: pulumi.Input<string>;
     }
     interface GatewaytemplateNetworkVpnAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: pulumi.Input<string>;
         name?: pulumi.Input<string>;
-        port?: pulumi.Input<number>;
+        port?: pulumi.Input<string>;
     }
     interface GatewaytemplateNetworkVpnAccessSourceNat {
         externalIp?: pulumi.Input<string>;
     }
     interface GatewaytemplateNetworkVpnAccessStaticNat {
-        internalIp?: pulumi.Input<string>;
-        name?: pulumi.Input<string>;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
          */
-        wanName?: pulumi.Input<string>;
+        internalIp: pulumi.Input<string>;
+        name: pulumi.Input<string>;
     }
     interface GatewaytemplateOobIpConfig {
         /**
@@ -5371,9 +5536,7 @@ export declare namespace org {
          */
         aeIdx?: pulumi.Input<string>;
         /**
-         * For SRX Only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability.\n
-         * Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end\n
-         * Note: Turning this on will enable force-up on one of the interfaces in the bundle only
+         * For SRX Only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
          */
         aeLacpForceUp?: pulumi.Input<boolean>;
         aggregated?: pulumi.Input<boolean>;
@@ -5381,6 +5544,9 @@ export declare namespace org {
          * if want to generate port up/down alarm, set it to true
          */
         critical?: pulumi.Input<boolean>;
+        /**
+         * Interface Description. Can be a variable (i.e. "{{myvar}}")
+         */
         description?: pulumi.Input<string>;
         disableAutoneg?: pulumi.Input<boolean>;
         /**
@@ -5392,13 +5558,11 @@ export declare namespace org {
          */
         dslType?: pulumi.Input<string>;
         /**
-         * if `wanType`==`dsl`
-         * 16 bit int
+         * if `wanType`==`dsl`, 16 bit int
          */
         dslVci?: pulumi.Input<number>;
         /**
-         * if `wanType`==`dsl`
-         * 8 bit int
+         * if `wanType`==`dsl`, 8 bit int
          */
         dslVpi?: pulumi.Input<number>;
         /**
@@ -5432,7 +5596,7 @@ export declare namespace org {
          */
         name?: pulumi.Input<string>;
         /**
-         * if `usage`==`lan`
+         * if `usage`==`lan`, name of the `junipermist.org.Network` resource
          */
         networks?: pulumi.Input<pulumi.Input<string>[]>;
         /**
@@ -5441,7 +5605,7 @@ export declare namespace org {
         outerVlanId?: pulumi.Input<number>;
         poeDisabled?: pulumi.Input<boolean>;
         /**
-         * if `usage`==`lan`
+         * Only for SRX and if `usage`==`lan`, the Untagged VLAN Network
          */
         portNetwork?: pulumi.Input<string>;
         /**
@@ -5478,10 +5642,7 @@ export declare namespace org {
          * port usage name. enum: `haControl`, `haData`, `lan`, `wan`
          */
         usage: pulumi.Input<string>;
-        /**
-         * if WAN interface is on a VLAN
-         */
-        vlanId?: pulumi.Input<number>;
+        vlanId?: pulumi.Input<string>;
         /**
          * Property key is the VPN name
          */
@@ -5489,29 +5650,33 @@ export declare namespace org {
             [key: string]: pulumi.Input<inputs.org.GatewaytemplatePortConfigVpnPaths>;
         }>;
         /**
-         * when `wanType`==`broadband`. enum: `default`, `max`, `recommended`
+         * Only when `wanType`==`broadband`. enum: `default`, `max`, `recommended`
          */
         wanArpPolicer?: pulumi.Input<string>;
         /**
-         * optional, if spoke should reach this port by a different IP
+         * Only if `usage`==`wan`, optional. If spoke should reach this port by a different IP
          */
         wanExtIp?: pulumi.Input<string>;
         /**
-         * Property Key is the destianation CIDR (e.g "100.100.100.0/24")
+         * Only if `usage`==`wan`. Property Key is the destianation CIDR (e.g "100.100.100.0/24")
          */
         wanExtraRoutes?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.GatewaytemplatePortConfigWanExtraRoutes>;
         }>;
         /**
-         * if `usage`==`wan`
+         * Only if `usage`==`wan`. If some networks are connected to this WAN port, it can be added here so policies can be defined
+         */
+        wanNetworks?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Only if `usage`==`wan`
          */
         wanProbeOverride?: pulumi.Input<inputs.org.GatewaytemplatePortConfigWanProbeOverride>;
         /**
-         * optional, by default, source-NAT is performed on all WAN Ports using the interface-ip
+         * Only if `usage`==`wan`, optional. By default, source-NAT is performed on all WAN Ports using the interface-ip
          */
         wanSourceNat?: pulumi.Input<inputs.org.GatewaytemplatePortConfigWanSourceNat>;
         /**
-         * if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`
+         * Only if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`
          */
         wanType?: pulumi.Input<string>;
     }
@@ -5525,12 +5690,15 @@ export declare namespace org {
          */
         dnsSuffixes?: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * except for out-of_band interface (vme/em0/fxp0)
+         * except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP Address (i.e. "192.168.1.1") or a Variable (i.e. "{{myvar}}")
          */
         gateway?: pulumi.Input<string>;
+        /**
+         * Interface IP Address (i.e. "192.168.1.8") or a Variable (i.e. "{{myvar}}")
+         */
         ip?: pulumi.Input<string>;
         /**
-         * used only if `subnet` is not specified in `networks`
+         * used only if `subnet` is not specified in `networks`. Interface Netmask (i.e. "/24") or a Variable (i.e. "{{myvar}}")
          */
         netmask?: pulumi.Input<string>;
         /**
@@ -5556,11 +5724,14 @@ export declare namespace org {
     }
     interface GatewaytemplatePortConfigTrafficShaping {
         /**
-         * percentages for differet class of traffic: high / medium / low / best-effort
-         * sum must be equal to 100
+         * percentages for differet class of traffic: high / medium / low / best-effort. Sum must be equal to 100
          */
         classPercentages?: pulumi.Input<pulumi.Input<number>[]>;
         enabled?: pulumi.Input<boolean>;
+        /**
+         * Interface Transmit Cap in kbps
+         */
+        maxTxKbps?: pulumi.Input<number>;
     }
     interface GatewaytemplatePortConfigVpnPaths {
         /**
@@ -5587,11 +5758,14 @@ export declare namespace org {
     }
     interface GatewaytemplatePortConfigVpnPathsTrafficShaping {
         /**
-         * percentages for differet class of traffic: high / medium / low / best-effort
-         * sum must be equal to 100
+         * percentages for differet class of traffic: high / medium / low / best-effort. Sum must be equal to 100
          */
         classPercentages?: pulumi.Input<pulumi.Input<number>[]>;
         enabled?: pulumi.Input<boolean>;
+        /**
+         * Interface Transmit Cap in kbps
+         */
+        maxTxKbps?: pulumi.Input<number>;
     }
     interface GatewaytemplatePortConfigWanExtraRoutes {
         via?: pulumi.Input<string>;
@@ -5636,6 +5810,10 @@ export declare namespace org {
          * for SSR, hub decides how VRF routes are leaked on spoke
          */
         addTargetVrfs?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * route aggregation
+         */
+        aggregates?: pulumi.Input<pulumi.Input<string>[]>;
         /**
          * when used as export policy, optional
          */
@@ -5680,16 +5858,14 @@ export declare namespace org {
         vpnNeighborMacs?: pulumi.Input<pulumi.Input<string>[]>;
         vpnPathSla?: pulumi.Input<inputs.org.GatewaytemplateRoutingPoliciesTermMatchingVpnPathSla>;
         /**
-         * overlay-facing criteria (used for bgpConfig where via=vpn)
-         * ordered-
+         * overlay-facing criteria (used for bgpConfig where via=vpn). ordered-
          */
         vpnPaths?: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface GatewaytemplateRoutingPoliciesTermMatchingRouteExists {
         route?: pulumi.Input<string>;
         /**
-         * name of the vrf instance
-         * it can also be the name of the VPN or wan if they
+         * name of the vrf instance, it can also be the name of the VPN or wan if they
          */
         vrfName?: pulumi.Input<string>;
     }
@@ -5718,8 +5894,7 @@ export declare namespace org {
          */
         name?: pulumi.Input<string>;
         /**
-         * by default, we derive all paths available and use them
-         * optionally, you can customize by using `pathPreference`
+         * by default, we derive all paths available and use them. Optionally, you can customize by using `pathPreference`
          */
         pathPreference?: pulumi.Input<string>;
         /**
@@ -5762,70 +5937,81 @@ export declare namespace org {
     interface GatewaytemplateTunnelConfigs {
         autoProvision?: pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsAutoProvision>;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
          */
         ikeLifetime?: pulumi.Input<number>;
         /**
-         * Only if `provider`== `custom-ipsec`. enum: `aggressive`, `main`
+         * Only if `provider`==`custom-ipsec`. enum: `aggressive`, `main`
          */
         ikeMode?: pulumi.Input<string>;
         /**
-         * if `provider`== `custom-ipsec`
+         * if `provider`==`custom-ipsec`
          */
         ikeProposals?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsIkeProposal>[]>;
         /**
-         * if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
          */
         ipsecLifetime?: pulumi.Input<number>;
         /**
-         * Only if  `provider`== `custom-ipsec`
+         * Only if  `provider`==`custom-ipsec`
          */
         ipsecProposals?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsIpsecProposal>[]>;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-ipsec`
-         *   * `provider`==`jse-ipsec`
-         *   * `provider`== `custom-ipsec`
+         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         localId?: pulumi.Input<string>;
         /**
-         * enum: `active-active`, `active-standby`
+         * Required if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`. enum: `active-active`, `active-standby`
          */
         mode?: pulumi.Input<string>;
         /**
-         * networks reachable via this tunnel
+         * if `provider`==`custom-ipsec`, networks reachable via this tunnel
          */
         networks?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         */
         primary?: pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsPrimary>;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`
          */
         probe?: pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsProbe>;
         /**
-         * Only if `provider`== `custom-ipsec`. enum: `gre`, `ipsec`
+         * Only if `provider`==`custom-ipsec`. enum: `gre`, `ipsec`
          */
         protocol?: pulumi.Input<string>;
         /**
-         * enum: `custom-ipsec`, `customer-gre`, `jse-ipsec`, `zscaler-gre`, `zscaler-ipsec`
+         * Only if `auto_provision.enabled`==`false`. enum: `custom-ipsec`, `customer-gre`, `jse-ipsec`, `zscaler-gre`, `zscaler-ipsec`
          */
         provider?: pulumi.Input<string>;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-ipsec`
-         *   * `provider`==`jse-ipsec`
-         *   * `provider`== `custom-ipsec`
+         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         psk?: pulumi.Input<string>;
+        /**
+         * Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         */
         secondary?: pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsSecondary>;
         /**
-         * Only if `provider`== `custom-gre` or `provider`== `custom-ipsec`. enum: `1`, `2`
+         * Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. enum: `1`, `2`
          */
         version?: pulumi.Input<string>;
     }
     interface GatewaytemplateTunnelConfigsAutoProvision {
         enable?: pulumi.Input<boolean>;
+        /**
+         * API override for POP selection
+         */
         latlng?: pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsAutoProvisionLatlng>;
         primary?: pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsAutoProvisionPrimary>;
+        /**
+         * enum: `jse-ipsec`, `zscaler-ipsec`
+         */
+        provider: pulumi.Input<string>;
+        /**
+         * API override for POP selection
+         */
+        region?: pulumi.Input<string>;
         secondary?: pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsAutoProvisionSecondary>;
     }
     interface GatewaytemplateTunnelConfigsAutoProvisionLatlng {
@@ -5833,14 +6019,14 @@ export declare namespace org {
         lng: pulumi.Input<number>;
     }
     interface GatewaytemplateTunnelConfigsAutoProvisionPrimary {
-        numHosts?: pulumi.Input<string>;
+        probeIps?: pulumi.Input<pulumi.Input<string>[]>;
         /**
          * optional, only needed if `varsOnly`==`false`
          */
         wanNames?: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface GatewaytemplateTunnelConfigsAutoProvisionSecondary {
-        numHosts?: pulumi.Input<string>;
+        probeIps?: pulumi.Input<pulumi.Input<string>[]>;
         /**
          * optional, only needed if `varsOnly`==`false`
          */
@@ -5876,7 +6062,7 @@ export declare namespace org {
          */
         authAlgo?: pulumi.Input<string>;
         /**
-         * Only if `provider`== `custom-ipsec`. enum:
+         * Only if `provider`==`custom-ipsec`. enum:
          *   * 1
          *   * 2 (1024-bit)
          *   * 5
@@ -5895,19 +6081,17 @@ export declare namespace org {
         encAlgo?: pulumi.Input<string>;
     }
     interface GatewaytemplateTunnelConfigsPrimary {
-        hosts?: pulumi.Input<pulumi.Input<string>[]>;
+        hosts: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-gre`
-         *   * `provider`== `custom-gre`
+         * Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`
          */
         internalIps?: pulumi.Input<pulumi.Input<string>[]>;
         probeIps?: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: pulumi.Input<pulumi.Input<string>[]>;
-        wanNames?: pulumi.Input<pulumi.Input<string>[]>;
+        wanNames: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface GatewaytemplateTunnelConfigsProbe {
         /**
@@ -5928,19 +6112,17 @@ export declare namespace org {
         type?: pulumi.Input<string>;
     }
     interface GatewaytemplateTunnelConfigsSecondary {
-        hosts?: pulumi.Input<pulumi.Input<string>[]>;
+        hosts: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-gre`
-         *   * `provider`== `custom-gre`
+         * Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`
          */
         internalIps?: pulumi.Input<pulumi.Input<string>[]>;
         probeIps?: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: pulumi.Input<pulumi.Input<string>[]>;
-        wanNames?: pulumi.Input<pulumi.Input<string>[]>;
+        wanNames: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface GatewaytemplateTunnelProviderOptions {
         /**
@@ -5953,74 +6135,125 @@ export declare namespace org {
         zscaler?: pulumi.Input<inputs.org.GatewaytemplateTunnelProviderOptionsZscaler>;
     }
     interface GatewaytemplateTunnelProviderOptionsJse {
-        name?: pulumi.Input<string>;
         numUsers?: pulumi.Input<number>;
+        /**
+         * JSE Organization name
+         */
+        orgName?: pulumi.Input<string>;
     }
     interface GatewaytemplateTunnelProviderOptionsZscaler {
-        aupAcceptanceRequired?: pulumi.Input<boolean>;
+        aupBlockInternetUntilAccepted?: pulumi.Input<boolean>;
         /**
-         * days before AUP is requested again
+         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
          */
-        aupExpire?: pulumi.Input<number>;
+        aupEnabled?: pulumi.Input<boolean>;
         /**
          * proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
          */
-        aupSslProxy?: pulumi.Input<boolean>;
+        aupForceSslInspection?: pulumi.Input<boolean>;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Required if `aupEnabled`==`true`. Days before AUP is requested again
          */
-        downloadMbps?: pulumi.Input<number>;
+        aupTimeoutInDays?: pulumi.Input<number>;
         /**
-         * if `useXff`==`true`, display Acceptable Use Policy (AUP)
+         * Enable this option to enforce user authentication
          */
-        enableAup?: pulumi.Input<boolean>;
+        authRequired?: pulumi.Input<boolean>;
         /**
-         * when `enforceAuthentication`==`false`, display caution notification for non-authenticated users
+         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
          */
-        enableCaution?: pulumi.Input<boolean>;
-        enforceAuthentication?: pulumi.Input<boolean>;
-        name?: pulumi.Input<string>;
+        cautionEnabled?: pulumi.Input<boolean>;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        dnBandwidth?: pulumi.Input<number>;
+        /**
+         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
+         */
+        idleTimeInMinutes?: pulumi.Input<number>;
         /**
-         * if `useXff`==`true`
+         * if `true`, enable the firewall control option
+         */
+        ofwEnabled?: pulumi.Input<boolean>;
+        /**
+         * `sub-locations` can be used for specific uses cases to define different configuration based on the user network
          */
         subLocations?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplateTunnelProviderOptionsZscalerSubLocation>[]>;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
+         */
+        surrogateIp?: pulumi.Input<boolean>;
+        /**
+         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
+         */
+        surrogateIpEnforcedForKnownBrowsers?: pulumi.Input<boolean>;
+        /**
+         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
+         */
+        surrogateRefreshTimeInMinutes?: pulumi.Input<number>;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
          */
-        uploadMbps?: pulumi.Input<number>;
+        upBandwidth?: pulumi.Input<number>;
         /**
          * location uses proxy chaining to forward traffic
          */
-        useXff?: pulumi.Input<boolean>;
+        xffForwardEnabled?: pulumi.Input<boolean>;
     }
     interface GatewaytemplateTunnelProviderOptionsZscalerSubLocation {
-        aupAcceptanceRequired?: pulumi.Input<boolean>;
+        aupBlockInternetUntilAccepted?: pulumi.Input<boolean>;
         /**
-         * days before AUP is requested again
+         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
          */
-        aupExpire?: pulumi.Input<number>;
+        aupEnabled?: pulumi.Input<boolean>;
         /**
          * proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
          */
-        aupSslProxy?: pulumi.Input<boolean>;
+        aupForceSslInspection?: pulumi.Input<boolean>;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Required if `aupEnabled`==`true`. Days before AUP is requested again
          */
-        downloadMbps?: pulumi.Input<number>;
+        aupTimeoutInDays?: pulumi.Input<number>;
         /**
-         * if `useXff`==`true`, display Acceptable Use Policy (AUP)
+         * Enable this option to authenticate users
          */
-        enableAup?: pulumi.Input<boolean>;
+        authRequired?: pulumi.Input<boolean>;
         /**
-         * when `enforceAuthentication`==`false`, display caution notification for non-authenticated users
+         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
          */
-        enableCaution?: pulumi.Input<boolean>;
-        enforceAuthentication?: pulumi.Input<boolean>;
-        subnets?: pulumi.Input<pulumi.Input<string>[]>;
+        cautionEnabled?: pulumi.Input<boolean>;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        dnBandwidth?: pulumi.Input<number>;
+        /**
+         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
+         */
+        idleTimeInMinutes?: pulumi.Input<number>;
+        /**
+         * Network name
+         */
+        name?: pulumi.Input<string>;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * if `true`, enable the firewall control option
          */
-        uploadMbps?: pulumi.Input<number>;
+        ofwEnabled?: pulumi.Input<boolean>;
+        /**
+         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
+         */
+        surrogateIp?: pulumi.Input<boolean>;
+        /**
+         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
+         */
+        surrogateIpEnforcedForKnownBrowsers?: pulumi.Input<boolean>;
+        /**
+         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
+         */
+        surrogateRefreshTimeInMinutes?: pulumi.Input<number>;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        upBandwidth?: pulumi.Input<number>;
     }
     interface GatewaytemplateVrfConfig {
         /**
@@ -6187,7 +6420,7 @@ export declare namespace org {
     interface NetworkInternetAccess {
         createSimpleServicePolicy?: pulumi.Input<boolean>;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
         destinationNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.NetworkInternetAccessDestinationNat>;
@@ -6198,25 +6431,57 @@ export declare namespace org {
          */
         restricted?: pulumi.Input<boolean>;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.NetworkInternetAccessStaticNat>;
         }>;
     }
     interface NetworkInternetAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: pulumi.Input<string>;
         name?: pulumi.Input<string>;
-        port?: pulumi.Input<number>;
+        /**
+         * The Destination NAT destination IP Address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}")
+         */
+        port?: pulumi.Input<string>;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity
+         */
+        wanName?: pulumi.Input<string>;
     }
     interface NetworkInternetAccessStaticNat {
-        internalIp?: pulumi.Input<string>;
-        name?: pulumi.Input<string>;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
+         */
+        internalIp: pulumi.Input<string>;
+        name: pulumi.Input<string>;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}")
          */
         wanName?: pulumi.Input<string>;
     }
+    interface NetworkMulticast {
+        /**
+         * if the network will only be the soruce of the multicast traffic, IGMP can be disabled
+         */
+        disableIgmp?: pulumi.Input<boolean>;
+        enabled?: pulumi.Input<boolean>;
+        /**
+         * Group address to RP (rendezvous point) mapping. Property Key is the CIDR (example "225.1.0.3/32")
+         */
+        groups?: pulumi.Input<{
+            [key: string]: pulumi.Input<inputs.org.NetworkMulticastGroups>;
+        }>;
+    }
+    interface NetworkMulticastGroups {
+        /**
+         * RP (rendezvous point) IP Address
+         */
+        rpIp?: pulumi.Input<string>;
+    }
     interface NetworkTenants {
         addresses?: pulumi.Input<pulumi.Input<string>[]>;
     }
@@ -6230,7 +6495,7 @@ export declare namespace org {
          */
         allowPing?: pulumi.Input<boolean>;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
         destinationNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.NetworkVpnAccessDestinationNat>;
@@ -6266,7 +6531,7 @@ export declare namespace org {
          */
         sourceNat?: pulumi.Input<inputs.org.NetworkVpnAccessSourceNat>;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.NetworkVpnAccessStaticNat>;
@@ -6286,31 +6551,35 @@ export declare namespace org {
         summarizedSubnetToLanOspf?: pulumi.Input<string>;
     }
     interface NetworkVpnAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: pulumi.Input<string>;
         name?: pulumi.Input<string>;
-        port?: pulumi.Input<number>;
+        port?: pulumi.Input<string>;
     }
     interface NetworkVpnAccessSourceNat {
         externalIp?: pulumi.Input<string>;
     }
     interface NetworkVpnAccessStaticNat {
-        internalIp?: pulumi.Input<string>;
-        name?: pulumi.Input<string>;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
          */
-        wanName?: pulumi.Input<string>;
+        internalIp: pulumi.Input<string>;
+        name: pulumi.Input<string>;
     }
     interface NetworktemplateAclPolicy {
         /**
-         * - for GBP-based policy, all srcTags and dstTags have to be gbp-based
-         * - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
+         * ACL Policy Actions:
+         *   - for GBP-based policy, all srcTags and dstTags have to be gbp-based
+         *   - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
          */
         actions?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateAclPolicyAction>[]>;
         name?: pulumi.Input<string>;
         /**
-         * - for GBP-based policy, all srcTags and dstTags have to be gbp-based
-         * - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
+         * ACL Policy Source Tags:
+         *   - for GBP-based policy, all srcTags and dstTags have to be gbp-based
+         *   - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
          */
         srcTags?: pulumi.Input<pulumi.Input<string>[]>;
     }
@@ -6324,9 +6593,9 @@ export declare namespace org {
     interface NetworktemplateAclTags {
         /**
          * required if
-         * - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
-         * - `type`==`gbpResource`
-         * - `type`==`staticGbp` (applying gbp tag against matching conditions)
+         *   - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
+         *   - `type`==`gbpResource`
+         *   - `type`==`staticGbp` (applying gbp tag against matching conditions)
          */
         gbpTag?: pulumi.Input<number>;
         /**
@@ -6352,8 +6621,7 @@ export declare namespace org {
          */
         radiusGroup?: pulumi.Input<string>;
         /**
-         * if `type`==`resource` or `type`==`gbpResource`
-         * empty means unrestricted, i.e. any
+         * if `type`==`resource` or `type`==`gbpResource`. Empty means unrestricted, i.e. any
          */
         specs?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateAclTagsSpec>[]>;
         /**
@@ -6383,7 +6651,7 @@ export declare namespace org {
          */
         portRange?: pulumi.Input<string>;
         /**
-         * `tcp` / `udp` / `icmp` / `gre` / `any` / `:protocol_number`. `protocolNumber` is between 1-254
+         * `tcp` / `udp` / `icmp` / `icmp6` / `gre` / `any` / `:protocol_number`, `protocolNumber` is between 1-254, default is `any` `protocolNumber` is between 1-254
          */
         protocol?: pulumi.Input<string>;
     }
@@ -6457,8 +6725,7 @@ export declare namespace org {
          */
         gateway6?: pulumi.Input<string>;
         /**
-         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required)
-         * NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set
+         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required). NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set
          */
         isolation?: pulumi.Input<boolean>;
         isolationVlanId?: pulumi.Input<string>;
@@ -6544,9 +6811,7 @@ export declare namespace org {
          */
         allNetworks?: pulumi.Input<boolean>;
         /**
-         * Only if `mode`!=`dynamic`. If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with.
-         * All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state.
-         * When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
+         * Only if `mode`!=`dynamic`. If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with. All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state. When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
          */
         allowDhcpd?: pulumi.Input<boolean>;
         /**
@@ -6594,8 +6859,7 @@ export declare namespace org {
          */
         guestNetwork?: pulumi.Input<string>;
         /**
-         * Only if `mode`!=`dynamic` interSwitchLink is used together with "isolation" under networks
-         * NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
+         * Only if `mode`!=`dynamic` interSwitchLink is used together with "isolation" under networks. NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
          */
         interSwitchLink?: pulumi.Input<boolean>;
         /**
@@ -6667,8 +6931,7 @@ export declare namespace org {
          */
         speed?: pulumi.Input<string>;
         /**
-         * Switch storm control
-         * Only if `mode`!=`dynamic`
+         * Switch storm control. Only if `mode`!=`dynamic`
          */
         stormControl?: pulumi.Input<inputs.org.NetworktemplatePortUsagesStormControl>;
         /**
@@ -6749,8 +7012,7 @@ export declare namespace org {
          */
         authServersTimeout?: pulumi.Input<number>;
         /**
-         * use `network`or `sourceIp`
-         * which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
+         * use `network`or `sourceIp`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
          */
         network?: pulumi.Input<string>;
         /**
@@ -7030,8 +7292,7 @@ export declare namespace org {
     }
     interface NetworktemplateSnmpConfigV3ConfigUsmUser {
         /**
-         * Not required if `authenticationType`==`authenticationNone`
-         * include alphabetic, numeric, and special characters, but it cannot include control characters.
+         * Not required if `authenticationType`==`authenticationNone`. Include alphabetic, numeric, and special characters, but it cannot include control characters.
          */
         authenticationPassword?: pulumi.Input<string>;
         /**
@@ -7039,8 +7300,7 @@ export declare namespace org {
          */
         authenticationType?: pulumi.Input<string>;
         /**
-         * Not required if `encryptionType`==`privacy-none`
-         * include alphabetic, numeric, and special characters, but it cannot include control characters
+         * Not required if `encryptionType`==`privacy-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters
          */
         encryptionPassword?: pulumi.Input<string>;
         /**
@@ -7165,8 +7425,7 @@ Please update your configurations.
             [key: string]: pulumi.Input<inputs.org.NetworktemplateSwitchMatchingRulePortConfig>;
         }>;
         /**
-         * Property key is the port mirroring instance name
-         * portMirroring can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 port mirrorings is allowed
+         * Property key is the port mirroring instance name. `portMirroring` can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 port mirrorings is allowed
          */
         portMirroring?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.org.NetworktemplateSwitchMatchingRulePortMirroring>;
@@ -8092,8 +8351,7 @@ Please update your configurations.
         }>;
         enabled?: pulumi.Input<boolean>;
         /**
-         * Map from wxtagId of Hostname Wxlan Tags to bandwidth in kbps
-         * Property key is the wxtag id
+         * Map from wxtagId of Hostname Wxlan Tags to bandwidth in kbps. Property key is the `wxtagId`
          */
         wxtagIds?: pulumi.Input<{
             [key: string]: pulumi.Input<number>;
@@ -8258,8 +8516,7 @@ Please update your configurations.
     interface WlanDnsServerRewrite {
         enabled?: pulumi.Input<boolean>;
         /**
-         * map between radiusGroup and the desired DNS server (IPv4 only)
-         * Property key is the RADIUS group, property value is the desired DNS Server
+         * map between radiusGroup and the desired DNS server (IPv4 only). Property key is the RADIUS group, property value is the desired DNS Server
          */
         radiusGroups?: pulumi.Input<{
             [key: string]: pulumi.Input<string>;
@@ -8273,8 +8530,7 @@ Please update your configurations.
         defaultVlanId?: pulumi.Input<string>;
         enabled?: pulumi.Input<boolean>;
         /**
-         * when 11r is enabled, we'll try to use the cached PMK, this can be disabled
-         * `false` means auto
+         * when 11r is enabled, we'll try to use the cached PMK, this can be disabled. `false` means auto
          */
         forceLookup?: pulumi.Input<boolean>;
         /**
@@ -9332,13 +9588,11 @@ Please update your configurations.
         enabled?: pulumi.Input<boolean>;
         idleTimeout?: pulumi.Input<number>;
         /**
-         * To use Org mxedges when this WLAN does not use mxtunnel, specify their mxcluster_ids.
-         * Org mxedge(s) identified by mxcluster_ids
+         * To use Org mxedges when this WLAN does not use mxtunnel, specify their mxcluster_ids. Org mxedge(s) identified by mxcluster_ids
          */
         mxclusterIds?: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * default is site.mxedge.radsec.proxy_hosts which must be a superset of all wlans[*].radsec.proxy_hosts
-         * when radsec.proxy_hosts are not used, tunnel peers (org or site mxedges) are used irrespective of use_site_mxedge
+         * default is site.mxedge.radsec.proxy_hosts which must be a superset of all `wlans[*].radsec.proxy_hosts`. When `radsec.proxy_hosts` are not used, tunnel peers (org or site mxedges) are used irrespective of `useSiteMxedge`
          */
         proxyHosts?: pulumi.Input<pulumi.Input<string>[]>;
         /**
@@ -9537,14 +9791,16 @@ export declare namespace site {
     }
     interface NetworktemplateAclPolicy {
         /**
-         * - for GBP-based policy, all srcTags and dstTags have to be gbp-based
-         * - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
+         * ACL Policy Actions:
+         *   - for GBP-based policy, all srcTags and dstTags have to be gbp-based
+         *   - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
          */
         actions?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateAclPolicyAction>[]>;
         name?: pulumi.Input<string>;
         /**
-         * - for GBP-based policy, all srcTags and dstTags have to be gbp-based
-         * - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
+         * ACL Policy Source Tags:
+         *   - for GBP-based policy, all srcTags and dstTags have to be gbp-based
+         *   - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
          */
         srcTags?: pulumi.Input<pulumi.Input<string>[]>;
     }
@@ -9558,9 +9814,9 @@ export declare namespace site {
     interface NetworktemplateAclTags {
         /**
          * required if
-         * - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
-         * - `type`==`gbpResource`
-         * - `type`==`staticGbp` (applying gbp tag against matching conditions)
+         *   - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
+         *   - `type`==`gbpResource`
+         *   - `type`==`staticGbp` (applying gbp tag against matching conditions)
          */
         gbpTag?: pulumi.Input<number>;
         /**
@@ -9586,8 +9842,7 @@ export declare namespace site {
          */
         radiusGroup?: pulumi.Input<string>;
         /**
-         * if `type`==`resource` or `type`==`gbpResource`
-         * empty means unrestricted, i.e. any
+         * if `type`==`resource` or `type`==`gbpResource`. Empty means unrestricted, i.e. any
          */
         specs?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateAclTagsSpec>[]>;
         /**
@@ -9617,7 +9872,7 @@ export declare namespace site {
          */
         portRange?: pulumi.Input<string>;
         /**
-         * `tcp` / `udp` / `icmp` / `gre` / `any` / `:protocol_number`. `protocolNumber` is between 1-254
+         * `tcp` / `udp` / `icmp` / `icmp6` / `gre` / `any` / `:protocol_number`, `protocolNumber` is between 1-254, default is `any` `protocolNumber` is between 1-254
          */
         protocol?: pulumi.Input<string>;
     }
@@ -9691,8 +9946,7 @@ export declare namespace site {
          */
         gateway6?: pulumi.Input<string>;
         /**
-         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required)
-         * NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set
+         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required). NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set
          */
         isolation?: pulumi.Input<boolean>;
         isolationVlanId?: pulumi.Input<string>;
@@ -9778,9 +10032,7 @@ export declare namespace site {
          */
         allNetworks?: pulumi.Input<boolean>;
         /**
-         * Only if `mode`!=`dynamic`. If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with.
-         * All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state.
-         * When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
+         * Only if `mode`!=`dynamic`. If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with. All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state. When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
          */
         allowDhcpd?: pulumi.Input<boolean>;
         /**
@@ -9828,8 +10080,7 @@ export declare namespace site {
          */
         guestNetwork?: pulumi.Input<string>;
         /**
-         * Only if `mode`!=`dynamic` interSwitchLink is used together with "isolation" under networks
-         * NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
+         * Only if `mode`!=`dynamic` interSwitchLink is used together with "isolation" under networks. NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
          */
         interSwitchLink?: pulumi.Input<boolean>;
         /**
@@ -9901,8 +10152,7 @@ export declare namespace site {
          */
         speed?: pulumi.Input<string>;
         /**
-         * Switch storm control
-         * Only if `mode`!=`dynamic`
+         * Switch storm control. Only if `mode`!=`dynamic`
          */
         stormControl?: pulumi.Input<inputs.site.NetworktemplatePortUsagesStormControl>;
         /**
@@ -9983,8 +10233,7 @@ export declare namespace site {
          */
         authServersTimeout?: pulumi.Input<number>;
         /**
-         * use `network`or `sourceIp`
-         * which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
+         * use `network`or `sourceIp`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
          */
         network?: pulumi.Input<string>;
         /**
@@ -10264,8 +10513,7 @@ export declare namespace site {
     }
     interface NetworktemplateSnmpConfigV3ConfigUsmUser {
         /**
-         * Not required if `authenticationType`==`authenticationNone`
-         * include alphabetic, numeric, and special characters, but it cannot include control characters.
+         * Not required if `authenticationType`==`authenticationNone`. Include alphabetic, numeric, and special characters, but it cannot include control characters.
          */
         authenticationPassword?: pulumi.Input<string>;
         /**
@@ -10273,8 +10521,7 @@ export declare namespace site {
          */
         authenticationType?: pulumi.Input<string>;
         /**
-         * Not required if `encryptionType`==`privacy-none`
-         * include alphabetic, numeric, and special characters, but it cannot include control characters
+         * Not required if `encryptionType`==`privacy-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters
          */
         encryptionPassword?: pulumi.Input<string>;
         /**
@@ -10399,8 +10646,7 @@ Please update your configurations.
             [key: string]: pulumi.Input<inputs.site.NetworktemplateSwitchMatchingRulePortConfig>;
         }>;
         /**
-         * Property key is the port mirroring instance name
-         * portMirroring can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 port mirrorings is allowed
+         * Property key is the port mirroring instance name. `portMirroring` can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 port mirrorings is allowed
          */
         portMirroring?: pulumi.Input<{
             [key: string]: pulumi.Input<inputs.site.NetworktemplateSwitchMatchingRulePortMirroring>;
@@ -11221,8 +11467,7 @@ Please update your configurations.
         }>;
         enabled?: pulumi.Input<boolean>;
         /**
-         * Map from wxtagId of Hostname Wxlan Tags to bandwidth in kbps
-         * Property key is the wxtag id
+         * Map from wxtagId of Hostname Wxlan Tags to bandwidth in kbps. Property key is the `wxtagId`
          */
         wxtagIds?: pulumi.Input<{
             [key: string]: pulumi.Input<number>;
@@ -11387,8 +11632,7 @@ Please update your configurations.
     interface WlanDnsServerRewrite {
         enabled?: pulumi.Input<boolean>;
         /**
-         * map between radiusGroup and the desired DNS server (IPv4 only)
-         * Property key is the RADIUS group, property value is the desired DNS Server
+         * map between radiusGroup and the desired DNS server (IPv4 only). Property key is the RADIUS group, property value is the desired DNS Server
          */
         radiusGroups?: pulumi.Input<{
             [key: string]: pulumi.Input<string>;
@@ -11402,8 +11646,7 @@ Please update your configurations.
         defaultVlanId?: pulumi.Input<string>;
         enabled?: pulumi.Input<boolean>;
         /**
-         * when 11r is enabled, we'll try to use the cached PMK, this can be disabled
-         * `false` means auto
+         * when 11r is enabled, we'll try to use the cached PMK, this can be disabled. `false` means auto
          */
         forceLookup?: pulumi.Input<boolean>;
         /**
@@ -12461,13 +12704,11 @@ Please update your configurations.
         enabled?: pulumi.Input<boolean>;
         idleTimeout?: pulumi.Input<number>;
         /**
-         * To use Org mxedges when this WLAN does not use mxtunnel, specify their mxcluster_ids.
-         * Org mxedge(s) identified by mxcluster_ids
+         * To use Org mxedges when this WLAN does not use mxtunnel, specify their mxcluster_ids. Org mxedge(s) identified by mxcluster_ids
          */
         mxclusterIds?: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * default is site.mxedge.radsec.proxy_hosts which must be a superset of all wlans[*].radsec.proxy_hosts
-         * when radsec.proxy_hosts are not used, tunnel peers (org or site mxedges) are used irrespective of use_site_mxedge
+         * default is site.mxedge.radsec.proxy_hosts which must be a superset of all `wlans[*].radsec.proxy_hosts`. When `radsec.proxy_hosts` are not used, tunnel peers (org or site mxedges) are used irrespective of `useSiteMxedge`
          */
         proxyHosts?: pulumi.Input<pulumi.Input<string>[]>;
         /**