@pulumi/juniper-mist 0.1.4 → 0.1.5

package/types/output.d.ts

@@ -679,8 +679,7 @@ export declare namespace device {
          */
         exportPolicy?: string;
         /**
-         * by default, either inet/net6 unicast depending on neighbor IP family (v4 or v6)
-         * for v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
+         * by default, either inet/net6 unicast depending on neighbor IP family (v4 or v6). For v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
          */
         extendedV4Nexthop?: boolean;
         /**
@@ -926,6 +925,9 @@ export declare namespace device {
         routedForNetworks?: string[];
         subnet: string;
         subnet6?: string;
+        /**
+         * Property key must be the user/tenant name (i.e. "printer-1") or a Variable (i.e. "{{myvar}}")
+         */
         tenants?: {
             [key: string]: outputs.device.GatewayNetworkTenants;
         };
@@ -943,7 +945,7 @@ export declare namespace device {
     interface GatewayNetworkInternetAccess {
         createSimpleServicePolicy: boolean;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
         destinationNat?: {
             [key: string]: outputs.device.GatewayNetworkInternetAccessDestinationNat;
@@ -954,22 +956,35 @@ export declare namespace device {
          */
         restricted: boolean;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat?: {
             [key: string]: outputs.device.GatewayNetworkInternetAccessStaticNat;
         };
     }
     interface GatewayNetworkInternetAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: string;
         name?: string;
-        port?: number;
+        /**
+         * The Destination NAT destination IP Address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}")
+         */
+        port?: string;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity
+         */
+        wanName?: string;
     }
     interface GatewayNetworkInternetAccessStaticNat {
-        internalIp?: string;
-        name?: string;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
+         */
+        internalIp: string;
+        name: string;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}")
          */
         wanName?: string;
     }
@@ -1005,9 +1020,9 @@ export declare namespace device {
          */
         allowPing?: boolean;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
-        destinationNat: {
+        destinationNat?: {
             [key: string]: outputs.device.GatewayNetworkVpnAccessDestinationNat;
         };
         /**
@@ -1023,13 +1038,11 @@ export declare namespace device {
          */
         noReadvertiseToLanOspf: boolean;
         /**
-         * toward overlay
-         * how HUB should deal with routes it received from Spokes
+         * toward overlay, how HUB should deal with routes it received from Spokes
          */
         noReadvertiseToOverlay?: boolean;
         /**
-         * by default, the routes are only readvertised toward the same vrf on spoke
-         * to allow it to be leaked to other vrfs
+         * by default, the routes are only readvertised toward the same vrf on spoke. To allow it to be leaked to other vrfs
          */
         otherVrfs: string[];
         /**
@@ -1041,14 +1054,13 @@ export declare namespace device {
          */
         sourceNat: outputs.device.GatewayNetworkVpnAccessSourceNat;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat: {
             [key: string]: outputs.device.GatewayNetworkVpnAccessStaticNat;
         };
         /**
-         * toward overlay
-         * how HUB should deal with routes it received from Spokes
+         * toward overlay, how HUB should deal with routes it received from Spokes
          */
         summarizedSubnet?: string;
         /**
@@ -1061,20 +1073,22 @@ export declare namespace device {
         summarizedSubnetToLanOspf?: string;
     }
     interface GatewayNetworkVpnAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: string;
         name?: string;
-        port?: number;
+        port?: string;
     }
     interface GatewayNetworkVpnAccessSourceNat {
         externalIp?: string;
     }
     interface GatewayNetworkVpnAccessStaticNat {
-        internalIp?: string;
-        name?: string;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
          */
-        wanName?: string;
+        internalIp: string;
+        name: string;
     }
     interface GatewayOobIpConfig {
         /**
@@ -1100,7 +1114,7 @@ export declare namespace device {
         /**
          * if supported on the platform. If enabled, DNS will be using this routing-instance, too
          */
-        useMgmtVrf: boolean;
+        useMgmtVrf?: boolean;
         /**
          * for host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired
          */
@@ -1185,9 +1199,7 @@ export declare namespace device {
          */
         aeIdx?: string;
         /**
-         * For SRX Only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability.\n
-         * Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end\n
-         * Note: Turning this on will enable force-up on one of the interfaces in the bundle only
+         * For SRX Only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
          */
         aeLacpForceUp: boolean;
         aggregated: boolean;
@@ -1195,6 +1207,9 @@ export declare namespace device {
          * if want to generate port up/down alarm, set it to true
          */
         critical: boolean;
+        /**
+         * Interface Description. Can be a variable (i.e. "{{myvar}}")
+         */
         description?: string;
         disableAutoneg: boolean;
         /**
@@ -1206,13 +1221,11 @@ export declare namespace device {
          */
         dslType: string;
         /**
-         * if `wanType`==`dsl`
-         * 16 bit int
+         * if `wanType`==`dsl`, 16 bit int
          */
         dslVci: number;
         /**
-         * if `wanType`==`dsl`
-         * 8 bit int
+         * if `wanType`==`dsl`, 8 bit int
          */
         dslVpi: number;
         /**
@@ -1246,7 +1259,7 @@ export declare namespace device {
          */
         name?: string;
         /**
-         * if `usage`==`lan`
+         * if `usage`==`lan`, name of the `junipermist.org.Network` resource
          */
         networks: string[];
         /**
@@ -1255,7 +1268,7 @@ export declare namespace device {
         outerVlanId?: number;
         poeDisabled: boolean;
         /**
-         * if `usage`==`lan`
+         * Only for SRX and if `usage`==`lan`, the Untagged VLAN Network
          */
         portNetwork?: string;
         /**
@@ -1292,10 +1305,7 @@ export declare namespace device {
          * port usage name. enum: `haControl`, `haData`, `lan`, `wan`
          */
         usage: string;
-        /**
-         * if WAN interface is on a VLAN
-         */
-        vlanId?: number;
+        vlanId?: string;
         /**
          * Property key is the VPN name
          */
@@ -1303,29 +1313,33 @@ export declare namespace device {
             [key: string]: outputs.device.GatewayPortConfigVpnPaths;
         };
         /**
-         * when `wanType`==`broadband`. enum: `default`, `max`, `recommended`
+         * Only when `wanType`==`broadband`. enum: `default`, `max`, `recommended`
          */
         wanArpPolicer: string;
         /**
-         * optional, if spoke should reach this port by a different IP
+         * Only if `usage`==`wan`, optional. If spoke should reach this port by a different IP
          */
         wanExtIp?: string;
         /**
-         * Property Key is the destianation CIDR (e.g "100.100.100.0/24")
+         * Only if `usage`==`wan`. Property Key is the destianation CIDR (e.g "100.100.100.0/24")
          */
         wanExtraRoutes?: {
             [key: string]: outputs.device.GatewayPortConfigWanExtraRoutes;
         };
         /**
-         * if `usage`==`wan`
+         * Only if `usage`==`wan`. If some networks are connected to this WAN port, it can be added here so policies can be defined
+         */
+        wanNetworks: string[];
+        /**
+         * Only if `usage`==`wan`
          */
         wanProbeOverride?: outputs.device.GatewayPortConfigWanProbeOverride;
         /**
-         * optional, by default, source-NAT is performed on all WAN Ports using the interface-ip
+         * Only if `usage`==`wan`, optional. By default, source-NAT is performed on all WAN Ports using the interface-ip
          */
         wanSourceNat?: outputs.device.GatewayPortConfigWanSourceNat;
         /**
-         * if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`
+         * Only if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`
          */
         wanType: string;
     }
@@ -1339,12 +1353,15 @@ export declare namespace device {
          */
         dnsSuffixes?: string[];
         /**
-         * except for out-of_band interface (vme/em0/fxp0)
+         * except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP Address (i.e. "192.168.1.1") or a Variable (i.e. "{{myvar}}")
          */
         gateway?: string;
+        /**
+         * Interface IP Address (i.e. "192.168.1.8") or a Variable (i.e. "{{myvar}}")
+         */
         ip?: string;
         /**
-         * used only if `subnet` is not specified in `networks`
+         * used only if `subnet` is not specified in `networks`. Interface Netmask (i.e. "/24") or a Variable (i.e. "{{myvar}}")
          */
         netmask?: string;
         /**
@@ -1370,11 +1387,14 @@ export declare namespace device {
     }
     interface GatewayPortConfigTrafficShaping {
         /**
-         * percentages for differet class of traffic: high / medium / low / best-effort
-         * sum must be equal to 100
+         * percentages for differet class of traffic: high / medium / low / best-effort. Sum must be equal to 100
          */
         classPercentages?: number[];
         enabled: boolean;
+        /**
+         * Interface Transmit Cap in kbps
+         */
+        maxTxKbps?: number;
     }
     interface GatewayPortConfigVpnPaths {
         /**
@@ -1401,11 +1421,14 @@ export declare namespace device {
     }
     interface GatewayPortConfigVpnPathsTrafficShaping {
         /**
-         * percentages for differet class of traffic: high / medium / low / best-effort
-         * sum must be equal to 100
+         * percentages for differet class of traffic: high / medium / low / best-effort. Sum must be equal to 100
          */
         classPercentages?: number[];
         enabled: boolean;
+        /**
+         * Interface Transmit Cap in kbps
+         */
+        maxTxKbps?: number;
     }
     interface GatewayPortConfigWanExtraRoutes {
         via?: string;
@@ -1460,6 +1483,10 @@ export declare namespace device {
          * for SSR, hub decides how VRF routes are leaked on spoke
          */
         addTargetVrfs?: string[];
+        /**
+         * route aggregation
+         */
+        aggregates?: string[];
         /**
          * when used as export policy, optional
          */
@@ -1504,16 +1531,14 @@ export declare namespace device {
         vpnNeighborMacs?: string[];
         vpnPathSla?: outputs.device.GatewayRoutingPoliciesTermMatchingVpnPathSla;
         /**
-         * overlay-facing criteria (used for bgpConfig where via=vpn)
-         * ordered-
+         * overlay-facing criteria (used for bgpConfig where via=vpn). ordered-
          */
         vpnPaths?: string[];
     }
     interface GatewayRoutingPoliciesTermMatchingRouteExists {
         route?: string;
         /**
-         * name of the vrf instance
-         * it can also be the name of the VPN or wan if they
+         * name of the vrf instance, it can also be the name of the VPN or wan if they
          */
         vrfName: string;
     }
@@ -1542,8 +1567,7 @@ export declare namespace device {
          */
         name?: string;
         /**
-         * by default, we derive all paths available and use them
-         * optionally, you can customize by using `pathPreference`
+         * by default, we derive all paths available and use them. Optionally, you can customize by using `pathPreference`
          */
         pathPreference?: string;
         /**
@@ -1586,70 +1610,81 @@ export declare namespace device {
     interface GatewayTunnelConfigs {
         autoProvision?: outputs.device.GatewayTunnelConfigsAutoProvision;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
          */
         ikeLifetime?: number;
         /**
-         * Only if `provider`== `custom-ipsec`. enum: `aggressive`, `main`
+         * Only if `provider`==`custom-ipsec`. enum: `aggressive`, `main`
          */
         ikeMode: string;
         /**
-         * if `provider`== `custom-ipsec`
+         * if `provider`==`custom-ipsec`
          */
         ikeProposals?: outputs.device.GatewayTunnelConfigsIkeProposal[];
         /**
-         * if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
          */
         ipsecLifetime?: number;
         /**
-         * Only if  `provider`== `custom-ipsec`
+         * Only if  `provider`==`custom-ipsec`
          */
         ipsecProposals?: outputs.device.GatewayTunnelConfigsIpsecProposal[];
         /**
-         * Only if:
-         *   * `provider`== `zscaler-ipsec`
-         *   * `provider`==`jse-ipsec`
-         *   * `provider`== `custom-ipsec`
+         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         localId?: string;
         /**
-         * enum: `active-active`, `active-standby`
+         * Required if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`. enum: `active-active`, `active-standby`
          */
         mode: string;
         /**
-         * networks reachable via this tunnel
+         * if `provider`==`custom-ipsec`, networks reachable via this tunnel
          */
         networks: string[];
+        /**
+         * Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         */
         primary?: outputs.device.GatewayTunnelConfigsPrimary;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`
          */
         probe?: outputs.device.GatewayTunnelConfigsProbe;
         /**
-         * Only if `provider`== `custom-ipsec`. enum: `gre`, `ipsec`
+         * Only if `provider`==`custom-ipsec`. enum: `gre`, `ipsec`
          */
         protocol?: string;
         /**
-         * enum: `custom-ipsec`, `customer-gre`, `jse-ipsec`, `zscaler-gre`, `zscaler-ipsec`
+         * Only if `auto_provision.enabled`==`false`. enum: `custom-ipsec`, `customer-gre`, `jse-ipsec`, `zscaler-gre`, `zscaler-ipsec`
          */
         provider?: string;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-ipsec`
-         *   * `provider`==`jse-ipsec`
-         *   * `provider`== `custom-ipsec`
+         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         psk?: string;
+        /**
+         * Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         */
         secondary?: outputs.device.GatewayTunnelConfigsSecondary;
         /**
-         * Only if `provider`== `custom-gre` or `provider`== `custom-ipsec`. enum: `1`, `2`
+         * Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. enum: `1`, `2`
          */
         version: string;
     }
     interface GatewayTunnelConfigsAutoProvision {
         enable?: boolean;
+        /**
+         * API override for POP selection
+         */
         latlng?: outputs.device.GatewayTunnelConfigsAutoProvisionLatlng;
         primary?: outputs.device.GatewayTunnelConfigsAutoProvisionPrimary;
+        /**
+         * enum: `jse-ipsec`, `zscaler-ipsec`
+         */
+        provider: string;
+        /**
+         * API override for POP selection
+         */
+        region?: string;
         secondary?: outputs.device.GatewayTunnelConfigsAutoProvisionSecondary;
     }
     interface GatewayTunnelConfigsAutoProvisionLatlng {
@@ -1657,14 +1692,14 @@ export declare namespace device {
         lng: number;
     }
     interface GatewayTunnelConfigsAutoProvisionPrimary {
-        numHosts?: string;
+        probeIps?: string[];
         /**
          * optional, only needed if `varsOnly`==`false`
          */
         wanNames?: string[];
     }
     interface GatewayTunnelConfigsAutoProvisionSecondary {
-        numHosts?: string;
+        probeIps?: string[];
         /**
          * optional, only needed if `varsOnly`==`false`
          */
@@ -1700,7 +1735,7 @@ export declare namespace device {
          */
         authAlgo?: string;
         /**
-         * Only if `provider`== `custom-ipsec`. enum:
+         * Only if `provider`==`custom-ipsec`. enum:
          *   * 1
          *   * 2 (1024-bit)
          *   * 5
@@ -1719,19 +1754,17 @@ export declare namespace device {
         encAlgo: string;
     }
     interface GatewayTunnelConfigsPrimary {
-        hosts?: string[];
+        hosts: string[];
         /**
-         * Only if:
-         *   * `provider`== `zscaler-gre`
-         *   * `provider`== `custom-gre`
+         * Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`
          */
         internalIps?: string[];
         probeIps?: string[];
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: string[];
-        wanNames?: string[];
+        wanNames: string[];
     }
     interface GatewayTunnelConfigsProbe {
         /**
@@ -1752,19 +1785,17 @@ export declare namespace device {
         type: string;
     }
     interface GatewayTunnelConfigsSecondary {
-        hosts?: string[];
+        hosts: string[];
         /**
-         * Only if:
-         *   * `provider`== `zscaler-gre`
-         *   * `provider`== `custom-gre`
+         * Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`
          */
         internalIps?: string[];
         probeIps?: string[];
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: string[];
-        wanNames?: string[];
+        wanNames: string[];
     }
     interface GatewayTunnelProviderOptions {
         /**
@@ -1777,74 +1808,125 @@ export declare namespace device {
         zscaler?: outputs.device.GatewayTunnelProviderOptionsZscaler;
     }
     interface GatewayTunnelProviderOptionsJse {
-        name?: string;
         numUsers?: number;
+        /**
+         * JSE Organization name
+         */
+        orgName?: string;
     }
     interface GatewayTunnelProviderOptionsZscaler {
-        aupAcceptanceRequired: boolean;
+        aupBlockInternetUntilAccepted?: boolean;
         /**
-         * days before AUP is requested again
+         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
          */
-        aupExpire: number;
+        aupEnabled?: boolean;
         /**
          * proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
          */
-        aupSslProxy: boolean;
+        aupForceSslInspection?: boolean;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Required if `aupEnabled`==`true`. Days before AUP is requested again
          */
-        downloadMbps?: number;
+        aupTimeoutInDays?: number;
         /**
-         * if `useXff`==`true`, display Acceptable Use Policy (AUP)
+         * Enable this option to enforce user authentication
          */
-        enableAup: boolean;
+        authRequired?: boolean;
         /**
-         * when `enforceAuthentication`==`false`, display caution notification for non-authenticated users
+         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
          */
-        enableCaution: boolean;
-        enforceAuthentication: boolean;
-        name?: string;
+        cautionEnabled?: boolean;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        dnBandwidth?: number;
+        /**
+         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
+         */
+        idleTimeInMinutes?: number;
+        /**
+         * if `true`, enable the firewall control option
+         */
+        ofwEnabled?: boolean;
         /**
-         * if `useXff`==`true`
+         * `sub-locations` can be used for specific uses cases to define different configuration based on the user network
          */
         subLocations?: outputs.device.GatewayTunnelProviderOptionsZscalerSubLocation[];
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
          */
-        uploadMbps?: number;
+        surrogateIp?: boolean;
+        /**
+         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
+         */
+        surrogateIpEnforcedForKnownBrowsers?: boolean;
+        /**
+         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
+         */
+        surrogateRefreshTimeInMinutes?: number;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        upBandwidth?: number;
         /**
          * location uses proxy chaining to forward traffic
          */
-        useXff?: boolean;
+        xffForwardEnabled?: boolean;
     }
     interface GatewayTunnelProviderOptionsZscalerSubLocation {
-        aupAcceptanceRequired: boolean;
+        aupBlockInternetUntilAccepted?: boolean;
         /**
-         * days before AUP is requested again
+         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
          */
-        aupExpire: number;
+        aupEnabled?: boolean;
         /**
          * proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
          */
-        aupSslProxy: boolean;
+        aupForceSslInspection?: boolean;
+        /**
+         * Required if `aupEnabled`==`true`. Days before AUP is requested again
+         */
+        aupTimeoutInDays?: number;
+        /**
+         * Enable this option to authenticate users
+         */
+        authRequired?: boolean;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
          */
-        downloadMbps?: number;
+        cautionEnabled?: boolean;
         /**
-         * if `useXff`==`true`, display Acceptable Use Policy (AUP)
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
          */
-        enableAup?: boolean;
+        dnBandwidth?: number;
         /**
-         * when `enforceAuthentication`==`false`, display caution notification for non-authenticated users
+         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
          */
-        enableCaution: boolean;
-        enforceAuthentication: boolean;
-        subnets?: string[];
+        idleTimeInMinutes?: number;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Network name
          */
-        uploadMbps?: number;
+        name?: string;
+        /**
+         * if `true`, enable the firewall control option
+         */
+        ofwEnabled?: boolean;
+        /**
+         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
+         */
+        surrogateIp?: boolean;
+        /**
+         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
+         */
+        surrogateIpEnforcedForKnownBrowsers?: boolean;
+        /**
+         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
+         */
+        surrogateRefreshTimeInMinutes?: number;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        upBandwidth?: number;
     }
     interface GatewayVrfConfig {
         /**
@@ -3301,14 +3383,16 @@ export declare namespace device {
     }
     interface SwitchAclPolicy {
         /**
-         * - for GBP-based policy, all srcTags and dstTags have to be gbp-based
-         * - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
+         * ACL Policy Actions:
+         *   - for GBP-based policy, all srcTags and dstTags have to be gbp-based
+         *   - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
          */
         actions?: outputs.device.SwitchAclPolicyAction[];
         name?: string;
         /**
-         * - for GBP-based policy, all srcTags and dstTags have to be gbp-based
-         * - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
+         * ACL Policy Source Tags:
+         *   - for GBP-based policy, all srcTags and dstTags have to be gbp-based
+         *   - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
          */
         srcTags?: string[];
     }
@@ -3322,9 +3406,9 @@ export declare namespace device {
     interface SwitchAclTags {
         /**
          * required if
-         * - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
-         * - `type`==`gbpResource`
-         * - `type`==`staticGbp` (applying gbp tag against matching conditions)
+         *   - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
+         *   - `type`==`gbpResource`
+         *   - `type`==`staticGbp` (applying gbp tag against matching conditions)
          */
         gbpTag?: number;
         /**
@@ -3350,8 +3434,7 @@ export declare namespace device {
          */
         radiusGroup?: string;
         /**
-         * if `type`==`resource` or `type`==`gbpResource`
-         * empty means unrestricted, i.e. any
+         * if `type`==`resource` or `type`==`gbpResource`. Empty means unrestricted, i.e. any
          */
         specs?: outputs.device.SwitchAclTagsSpec[];
         /**
@@ -3381,7 +3464,7 @@ export declare namespace device {
          */
         portRange: string;
         /**
-         * `tcp` / `udp` / `icmp` / `gre` / `any` / `:protocol_number`. `protocolNumber` is between 1-254
+         * `tcp` / `udp` / `icmp` / `icmp6` / `gre` / `any` / `:protocol_number`, `protocolNumber` is between 1-254, default is `any` `protocolNumber` is between 1-254
          */
         protocol: string;
     }
@@ -3506,13 +3589,6 @@ export declare namespace device {
         type?: string;
         value?: string;
     }
-    interface SwitchEvpnConfig {
-        enabled: boolean;
-        /**
-         * enum: `access`, `collapsed-core`, `core`, `distribution`, `esilag-access`, `none`
-         */
-        role: string;
-    }
     interface SwitchExtraRoutes {
         /**
          * this takes precedence
@@ -3580,9 +3656,7 @@ export declare namespace device {
          */
         allNetworks: boolean;
         /**
-         * If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with.
-         * All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state.
-         * When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
+         * If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with. All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state. When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
          */
         allowDhcpd?: boolean;
         allowMultipleSupplicants: boolean;
@@ -3621,8 +3695,7 @@ export declare namespace device {
          */
         guestNetwork?: string;
         /**
-         * inter_switch_link is used together with "isolation" under networks
-         * NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
+         * inter_switch_link is used together with "isolation" under networks. NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
          */
         interSwitchLink: boolean;
         /**
@@ -3653,6 +3726,10 @@ export declare namespace device {
          * Only if `mode`==`trunk`, the list of network/vlans
          */
         networks?: string[];
+        /**
+         * Additional note for the port config override
+         */
+        note?: string;
         /**
          * Only if `mode`==`access` and `portAuth`!=`dot1x` whether the port should retain dynamically learned MAC addresses
          */
@@ -3744,8 +3821,7 @@ export declare namespace device {
          */
         gateway6?: string;
         /**
-         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required)
-         * NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set
+         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required). NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set
          */
         isolation: boolean;
         isolationVlanId?: string;
@@ -3935,9 +4011,7 @@ export declare namespace device {
          */
         allNetworks: boolean;
         /**
-         * Only if `mode`!=`dynamic`. If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with.
-         * All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state.
-         * When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
+         * Only if `mode`!=`dynamic`. If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with. All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state. When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
          */
         allowDhcpd?: boolean;
         /**
@@ -3985,8 +4059,7 @@ export declare namespace device {
          */
         guestNetwork?: string;
         /**
-         * Only if `mode`!=`dynamic` interSwitchLink is used together with "isolation" under networks
-         * NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
+         * Only if `mode`!=`dynamic` interSwitchLink is used together with "isolation" under networks. NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
          */
         interSwitchLink: boolean;
         /**
@@ -4058,8 +4131,7 @@ export declare namespace device {
          */
         speed: string;
         /**
-         * Switch storm control
-         * Only if `mode`!=`dynamic`
+         * Switch storm control. Only if `mode`!=`dynamic`
          */
         stormControl?: outputs.device.SwitchPortUsagesStormControl;
         /**
@@ -4136,8 +4208,7 @@ export declare namespace device {
          */
         authServersTimeout: number;
         /**
-         * use `network`or `sourceIp`
-         * which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
+         * use `network`or `sourceIp`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
          */
         network?: string;
         /**
@@ -4417,8 +4488,7 @@ export declare namespace device {
     }
     interface SwitchSnmpConfigV3ConfigUsmUser {
         /**
-         * Not required if `authenticationType`==`authenticationNone`
-         * include alphabetic, numeric, and special characters, but it cannot include control characters.
+         * Not required if `authenticationType`==`authenticationNone`. Include alphabetic, numeric, and special characters, but it cannot include control characters.
          */
         authenticationPassword?: string;
         /**
@@ -4426,8 +4496,7 @@ export declare namespace device {
          */
         authenticationType?: string;
         /**
-         * Not required if `encryptionType`==`privacy-none`
-         * include alphabetic, numeric, and special characters, but it cannot include control characters
+         * Not required if `encryptionType`==`privacy-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters
          */
         encryptionPassword?: string;
         /**
@@ -5215,8 +5284,7 @@ export declare namespace org {
          */
         exportPolicy?: string;
         /**
-         * by default, either inet/net6 unicast depending on neighbor IP family (v4 or v6)
-         * for v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
+         * by default, either inet/net6 unicast depending on neighbor IP family (v4 or v6). For v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
          */
         extendedV4Nexthop?: boolean;
         /**
@@ -5452,6 +5520,9 @@ export declare namespace org {
         routedForNetworks?: string[];
         subnet: string;
         subnet6?: string;
+        /**
+         * Property key must be the user/tenant name (i.e. "printer-1") or a Variable (i.e. "{{myvar}}")
+         */
         tenants?: {
             [key: string]: outputs.org.DeviceprofileGatewayNetworkTenants;
         };
@@ -5469,7 +5540,7 @@ export declare namespace org {
     interface DeviceprofileGatewayNetworkInternetAccess {
         createSimpleServicePolicy: boolean;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
         destinationNat?: {
             [key: string]: outputs.org.DeviceprofileGatewayNetworkInternetAccessDestinationNat;
@@ -5480,22 +5551,35 @@ export declare namespace org {
          */
         restricted: boolean;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat?: {
             [key: string]: outputs.org.DeviceprofileGatewayNetworkInternetAccessStaticNat;
         };
     }
     interface DeviceprofileGatewayNetworkInternetAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: string;
         name?: string;
-        port?: number;
+        /**
+         * The Destination NAT destination IP Address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}")
+         */
+        port?: string;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity
+         */
+        wanName?: string;
     }
     interface DeviceprofileGatewayNetworkInternetAccessStaticNat {
-        internalIp?: string;
-        name?: string;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
+         */
+        internalIp: string;
+        name: string;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}")
          */
         wanName?: string;
     }
@@ -5531,9 +5615,9 @@ export declare namespace org {
          */
         allowPing?: boolean;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
-        destinationNat: {
+        destinationNat?: {
             [key: string]: outputs.org.DeviceprofileGatewayNetworkVpnAccessDestinationNat;
         };
         /**
@@ -5549,13 +5633,11 @@ export declare namespace org {
          */
         noReadvertiseToLanOspf: boolean;
         /**
-         * toward overlay
-         * how HUB should deal with routes it received from Spokes
+         * toward overlay, how HUB should deal with routes it received from Spokes
          */
         noReadvertiseToOverlay?: boolean;
         /**
-         * by default, the routes are only readvertised toward the same vrf on spoke
-         * to allow it to be leaked to other vrfs
+         * by default, the routes are only readvertised toward the same vrf on spoke. To allow it to be leaked to other vrfs
          */
         otherVrfs: string[];
         /**
@@ -5567,14 +5649,13 @@ export declare namespace org {
          */
         sourceNat: outputs.org.DeviceprofileGatewayNetworkVpnAccessSourceNat;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat: {
             [key: string]: outputs.org.DeviceprofileGatewayNetworkVpnAccessStaticNat;
         };
         /**
-         * toward overlay
-         * how HUB should deal with routes it received from Spokes
+         * toward overlay, how HUB should deal with routes it received from Spokes
          */
         summarizedSubnet?: string;
         /**
@@ -5587,20 +5668,22 @@ export declare namespace org {
         summarizedSubnetToLanOspf?: string;
     }
     interface DeviceprofileGatewayNetworkVpnAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: string;
         name?: string;
-        port?: number;
+        port?: string;
     }
     interface DeviceprofileGatewayNetworkVpnAccessSourceNat {
         externalIp?: string;
     }
     interface DeviceprofileGatewayNetworkVpnAccessStaticNat {
-        internalIp?: string;
-        name?: string;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
          */
-        wanName?: string;
+        internalIp: string;
+        name: string;
     }
     interface DeviceprofileGatewayOobIpConfig {
         /**
@@ -5711,9 +5794,7 @@ export declare namespace org {
          */
         aeIdx?: string;
         /**
-         * For SRX Only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability.\n
-         * Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end\n
-         * Note: Turning this on will enable force-up on one of the interfaces in the bundle only
+         * For SRX Only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
          */
         aeLacpForceUp: boolean;
         aggregated: boolean;
@@ -5721,6 +5802,9 @@ export declare namespace org {
          * if want to generate port up/down alarm, set it to true
          */
         critical: boolean;
+        /**
+         * Interface Description. Can be a variable (i.e. "{{myvar}}")
+         */
         description?: string;
         disableAutoneg: boolean;
         /**
@@ -5732,13 +5816,11 @@ export declare namespace org {
          */
         dslType: string;
         /**
-         * if `wanType`==`dsl`
-         * 16 bit int
+         * if `wanType`==`dsl`, 16 bit int
          */
         dslVci: number;
         /**
-         * if `wanType`==`dsl`
-         * 8 bit int
+         * if `wanType`==`dsl`, 8 bit int
          */
         dslVpi: number;
         /**
@@ -5772,7 +5854,7 @@ export declare namespace org {
          */
         name?: string;
         /**
-         * if `usage`==`lan`
+         * if `usage`==`lan`, name of the `junipermist.org.Network` resource
          */
         networks: string[];
         /**
@@ -5781,7 +5863,7 @@ export declare namespace org {
         outerVlanId?: number;
         poeDisabled: boolean;
         /**
-         * if `usage`==`lan`
+         * Only for SRX and if `usage`==`lan`, the Untagged VLAN Network
          */
         portNetwork?: string;
         /**
@@ -5818,10 +5900,7 @@ export declare namespace org {
          * port usage name. enum: `haControl`, `haData`, `lan`, `wan`
          */
         usage: string;
-        /**
-         * if WAN interface is on a VLAN
-         */
-        vlanId?: number;
+        vlanId?: string;
         /**
          * Property key is the VPN name
          */
@@ -5829,29 +5908,33 @@ export declare namespace org {
             [key: string]: outputs.org.DeviceprofileGatewayPortConfigVpnPaths;
         };
         /**
-         * when `wanType`==`broadband`. enum: `default`, `max`, `recommended`
+         * Only when `wanType`==`broadband`. enum: `default`, `max`, `recommended`
          */
         wanArpPolicer: string;
         /**
-         * optional, if spoke should reach this port by a different IP
+         * Only if `usage`==`wan`, optional. If spoke should reach this port by a different IP
          */
         wanExtIp?: string;
         /**
-         * Property Key is the destianation CIDR (e.g "100.100.100.0/24")
+         * Only if `usage`==`wan`. Property Key is the destianation CIDR (e.g "100.100.100.0/24")
          */
         wanExtraRoutes?: {
             [key: string]: outputs.org.DeviceprofileGatewayPortConfigWanExtraRoutes;
         };
         /**
-         * if `usage`==`wan`
+         * Only if `usage`==`wan`. If some networks are connected to this WAN port, it can be added here so policies can be defined
+         */
+        wanNetworks: string[];
+        /**
+         * Only if `usage`==`wan`
          */
         wanProbeOverride?: outputs.org.DeviceprofileGatewayPortConfigWanProbeOverride;
         /**
-         * optional, by default, source-NAT is performed on all WAN Ports using the interface-ip
+         * Only if `usage`==`wan`, optional. By default, source-NAT is performed on all WAN Ports using the interface-ip
          */
         wanSourceNat?: outputs.org.DeviceprofileGatewayPortConfigWanSourceNat;
         /**
-         * if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`
+         * Only if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`
          */
         wanType: string;
     }
@@ -5865,12 +5948,15 @@ export declare namespace org {
          */
         dnsSuffixes?: string[];
         /**
-         * except for out-of_band interface (vme/em0/fxp0)
+         * except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP Address (i.e. "192.168.1.1") or a Variable (i.e. "{{myvar}}")
          */
         gateway?: string;
+        /**
+         * Interface IP Address (i.e. "192.168.1.8") or a Variable (i.e. "{{myvar}}")
+         */
         ip?: string;
         /**
-         * used only if `subnet` is not specified in `networks`
+         * used only if `subnet` is not specified in `networks`. Interface Netmask (i.e. "/24") or a Variable (i.e. "{{myvar}}")
          */
         netmask?: string;
         /**
@@ -5896,11 +5982,14 @@ export declare namespace org {
     }
     interface DeviceprofileGatewayPortConfigTrafficShaping {
         /**
-         * percentages for differet class of traffic: high / medium / low / best-effort
-         * sum must be equal to 100
+         * percentages for differet class of traffic: high / medium / low / best-effort. Sum must be equal to 100
          */
         classPercentages?: number[];
         enabled: boolean;
+        /**
+         * Interface Transmit Cap in kbps
+         */
+        maxTxKbps?: number;
     }
     interface DeviceprofileGatewayPortConfigVpnPaths {
         /**
@@ -5927,11 +6016,14 @@ export declare namespace org {
     }
     interface DeviceprofileGatewayPortConfigVpnPathsTrafficShaping {
         /**
-         * percentages for differet class of traffic: high / medium / low / best-effort
-         * sum must be equal to 100
+         * percentages for differet class of traffic: high / medium / low / best-effort. Sum must be equal to 100
          */
         classPercentages?: number[];
         enabled: boolean;
+        /**
+         * Interface Transmit Cap in kbps
+         */
+        maxTxKbps?: number;
     }
     interface DeviceprofileGatewayPortConfigWanExtraRoutes {
         via?: string;
@@ -5976,6 +6068,10 @@ export declare namespace org {
          * for SSR, hub decides how VRF routes are leaked on spoke
          */
         addTargetVrfs?: string[];
+        /**
+         * route aggregation
+         */
+        aggregates?: string[];
         /**
          * when used as export policy, optional
          */
@@ -6020,16 +6116,14 @@ export declare namespace org {
         vpnNeighborMacs?: string[];
         vpnPathSla?: outputs.org.DeviceprofileGatewayRoutingPoliciesTermMatchingVpnPathSla;
         /**
-         * overlay-facing criteria (used for bgpConfig where via=vpn)
-         * ordered-
+         * overlay-facing criteria (used for bgpConfig where via=vpn). ordered-
          */
         vpnPaths?: string[];
     }
     interface DeviceprofileGatewayRoutingPoliciesTermMatchingRouteExists {
         route?: string;
         /**
-         * name of the vrf instance
-         * it can also be the name of the VPN or wan if they
+         * name of the vrf instance, it can also be the name of the VPN or wan if they
          */
         vrfName: string;
     }
@@ -6058,8 +6152,7 @@ export declare namespace org {
          */
         name?: string;
         /**
-         * by default, we derive all paths available and use them
-         * optionally, you can customize by using `pathPreference`
+         * by default, we derive all paths available and use them. Optionally, you can customize by using `pathPreference`
          */
         pathPreference?: string;
         /**
@@ -6102,70 +6195,81 @@ export declare namespace org {
     interface DeviceprofileGatewayTunnelConfigs {
         autoProvision?: outputs.org.DeviceprofileGatewayTunnelConfigsAutoProvision;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
          */
         ikeLifetime?: number;
         /**
-         * Only if `provider`== `custom-ipsec`. enum: `aggressive`, `main`
+         * Only if `provider`==`custom-ipsec`. enum: `aggressive`, `main`
          */
         ikeMode: string;
         /**
-         * if `provider`== `custom-ipsec`
+         * if `provider`==`custom-ipsec`
          */
         ikeProposals?: outputs.org.DeviceprofileGatewayTunnelConfigsIkeProposal[];
         /**
-         * if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
          */
         ipsecLifetime?: number;
         /**
-         * Only if  `provider`== `custom-ipsec`
+         * Only if  `provider`==`custom-ipsec`
          */
         ipsecProposals?: outputs.org.DeviceprofileGatewayTunnelConfigsIpsecProposal[];
         /**
-         * Only if:
-         *   * `provider`== `zscaler-ipsec`
-         *   * `provider`==`jse-ipsec`
-         *   * `provider`== `custom-ipsec`
+         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         localId?: string;
         /**
-         * enum: `active-active`, `active-standby`
+         * Required if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`. enum: `active-active`, `active-standby`
          */
         mode: string;
         /**
-         * networks reachable via this tunnel
+         * if `provider`==`custom-ipsec`, networks reachable via this tunnel
          */
         networks: string[];
+        /**
+         * Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         */
         primary?: outputs.org.DeviceprofileGatewayTunnelConfigsPrimary;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`
          */
         probe?: outputs.org.DeviceprofileGatewayTunnelConfigsProbe;
         /**
-         * Only if `provider`== `custom-ipsec`. enum: `gre`, `ipsec`
+         * Only if `provider`==`custom-ipsec`. enum: `gre`, `ipsec`
          */
         protocol?: string;
         /**
-         * enum: `custom-ipsec`, `customer-gre`, `jse-ipsec`, `zscaler-gre`, `zscaler-ipsec`
+         * Only if `auto_provision.enabled`==`false`. enum: `custom-ipsec`, `customer-gre`, `jse-ipsec`, `zscaler-gre`, `zscaler-ipsec`
          */
         provider?: string;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-ipsec`
-         *   * `provider`==`jse-ipsec`
-         *   * `provider`== `custom-ipsec`
+         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         psk?: string;
+        /**
+         * Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         */
         secondary?: outputs.org.DeviceprofileGatewayTunnelConfigsSecondary;
         /**
-         * Only if `provider`== `custom-gre` or `provider`== `custom-ipsec`. enum: `1`, `2`
+         * Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. enum: `1`, `2`
          */
         version: string;
     }
     interface DeviceprofileGatewayTunnelConfigsAutoProvision {
         enable?: boolean;
+        /**
+         * API override for POP selection
+         */
         latlng?: outputs.org.DeviceprofileGatewayTunnelConfigsAutoProvisionLatlng;
         primary?: outputs.org.DeviceprofileGatewayTunnelConfigsAutoProvisionPrimary;
+        /**
+         * enum: `jse-ipsec`, `zscaler-ipsec`
+         */
+        provider: string;
+        /**
+         * API override for POP selection
+         */
+        region?: string;
         secondary?: outputs.org.DeviceprofileGatewayTunnelConfigsAutoProvisionSecondary;
     }
     interface DeviceprofileGatewayTunnelConfigsAutoProvisionLatlng {
@@ -6173,14 +6277,14 @@ export declare namespace org {
         lng: number;
     }
     interface DeviceprofileGatewayTunnelConfigsAutoProvisionPrimary {
-        numHosts?: string;
+        probeIps?: string[];
         /**
          * optional, only needed if `varsOnly`==`false`
          */
         wanNames?: string[];
     }
     interface DeviceprofileGatewayTunnelConfigsAutoProvisionSecondary {
-        numHosts?: string;
+        probeIps?: string[];
         /**
          * optional, only needed if `varsOnly`==`false`
          */
@@ -6216,7 +6320,7 @@ export declare namespace org {
          */
         authAlgo?: string;
         /**
-         * Only if `provider`== `custom-ipsec`. enum:
+         * Only if `provider`==`custom-ipsec`. enum:
          *   * 1
          *   * 2 (1024-bit)
          *   * 5
@@ -6235,19 +6339,17 @@ export declare namespace org {
         encAlgo: string;
     }
     interface DeviceprofileGatewayTunnelConfigsPrimary {
-        hosts?: string[];
+        hosts: string[];
         /**
-         * Only if:
-         *   * `provider`== `zscaler-gre`
-         *   * `provider`== `custom-gre`
+         * Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`
          */
         internalIps?: string[];
         probeIps?: string[];
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: string[];
-        wanNames?: string[];
+        wanNames: string[];
     }
     interface DeviceprofileGatewayTunnelConfigsProbe {
         /**
@@ -6268,19 +6370,17 @@ export declare namespace org {
         type: string;
     }
     interface DeviceprofileGatewayTunnelConfigsSecondary {
-        hosts?: string[];
+        hosts: string[];
         /**
-         * Only if:
-         *   * `provider`== `zscaler-gre`
-         *   * `provider`== `custom-gre`
+         * Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`
          */
         internalIps?: string[];
         probeIps?: string[];
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: string[];
-        wanNames?: string[];
+        wanNames: string[];
     }
     interface DeviceprofileGatewayTunnelProviderOptions {
         /**
@@ -6293,74 +6393,125 @@ export declare namespace org {
         zscaler?: outputs.org.DeviceprofileGatewayTunnelProviderOptionsZscaler;
     }
     interface DeviceprofileGatewayTunnelProviderOptionsJse {
-        name?: string;
         numUsers?: number;
+        /**
+         * JSE Organization name
+         */
+        orgName?: string;
     }
     interface DeviceprofileGatewayTunnelProviderOptionsZscaler {
-        aupAcceptanceRequired: boolean;
+        aupBlockInternetUntilAccepted?: boolean;
         /**
-         * days before AUP is requested again
+         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
          */
-        aupExpire: number;
+        aupEnabled?: boolean;
         /**
          * proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
          */
-        aupSslProxy: boolean;
+        aupForceSslInspection?: boolean;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Required if `aupEnabled`==`true`. Days before AUP is requested again
          */
-        downloadMbps?: number;
+        aupTimeoutInDays?: number;
         /**
-         * if `useXff`==`true`, display Acceptable Use Policy (AUP)
+         * Enable this option to enforce user authentication
          */
-        enableAup: boolean;
+        authRequired?: boolean;
         /**
-         * when `enforceAuthentication`==`false`, display caution notification for non-authenticated users
+         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
          */
-        enableCaution: boolean;
-        enforceAuthentication: boolean;
-        name?: string;
+        cautionEnabled?: boolean;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        dnBandwidth?: number;
         /**
-         * if `useXff`==`true`
+         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
+         */
+        idleTimeInMinutes?: number;
+        /**
+         * if `true`, enable the firewall control option
+         */
+        ofwEnabled?: boolean;
+        /**
+         * `sub-locations` can be used for specific uses cases to define different configuration based on the user network
          */
         subLocations?: outputs.org.DeviceprofileGatewayTunnelProviderOptionsZscalerSubLocation[];
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
+         */
+        surrogateIp?: boolean;
+        /**
+         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
+         */
+        surrogateIpEnforcedForKnownBrowsers?: boolean;
+        /**
+         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
          */
-        uploadMbps?: number;
+        surrogateRefreshTimeInMinutes?: number;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        upBandwidth?: number;
         /**
          * location uses proxy chaining to forward traffic
          */
-        useXff?: boolean;
+        xffForwardEnabled?: boolean;
     }
     interface DeviceprofileGatewayTunnelProviderOptionsZscalerSubLocation {
-        aupAcceptanceRequired: boolean;
+        aupBlockInternetUntilAccepted?: boolean;
         /**
-         * days before AUP is requested again
+         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
          */
-        aupExpire: number;
+        aupEnabled?: boolean;
         /**
          * proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
          */
-        aupSslProxy: boolean;
+        aupForceSslInspection?: boolean;
+        /**
+         * Required if `aupEnabled`==`true`. Days before AUP is requested again
+         */
+        aupTimeoutInDays?: number;
+        /**
+         * Enable this option to authenticate users
+         */
+        authRequired?: boolean;
+        /**
+         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
+         */
+        cautionEnabled?: boolean;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
          */
-        downloadMbps?: number;
+        dnBandwidth?: number;
         /**
-         * if `useXff`==`true`, display Acceptable Use Policy (AUP)
+         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
          */
-        enableAup?: boolean;
+        idleTimeInMinutes?: number;
         /**
-         * when `enforceAuthentication`==`false`, display caution notification for non-authenticated users
+         * Network name
          */
-        enableCaution: boolean;
-        enforceAuthentication: boolean;
-        subnets?: string[];
+        name?: string;
+        /**
+         * if `true`, enable the firewall control option
+         */
+        ofwEnabled?: boolean;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
          */
-        uploadMbps?: number;
+        surrogateIp?: boolean;
+        /**
+         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
+         */
+        surrogateIpEnforcedForKnownBrowsers?: boolean;
+        /**
+         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
+         */
+        surrogateRefreshTimeInMinutes?: number;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        upBandwidth?: number;
     }
     interface DeviceprofileGatewayVrfConfig {
         /**
@@ -6480,8 +6631,7 @@ export declare namespace org {
          */
         exportPolicy?: string;
         /**
-         * by default, either inet/net6 unicast depending on neighbor IP family (v4 or v6)
-         * for v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
+         * by default, either inet/net6 unicast depending on neighbor IP family (v4 or v6). For v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
          */
         extendedV4Nexthop?: boolean;
         /**
@@ -6717,6 +6867,9 @@ export declare namespace org {
         routedForNetworks?: string[];
         subnet: string;
         subnet6?: string;
+        /**
+         * Property key must be the user/tenant name (i.e. "printer-1") or a Variable (i.e. "{{myvar}}")
+         */
         tenants?: {
             [key: string]: outputs.org.GatewaytemplateNetworkTenants;
         };
@@ -6734,7 +6887,7 @@ export declare namespace org {
     interface GatewaytemplateNetworkInternetAccess {
         createSimpleServicePolicy: boolean;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
         destinationNat?: {
             [key: string]: outputs.org.GatewaytemplateNetworkInternetAccessDestinationNat;
@@ -6745,22 +6898,35 @@ export declare namespace org {
          */
         restricted: boolean;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat?: {
             [key: string]: outputs.org.GatewaytemplateNetworkInternetAccessStaticNat;
         };
     }
     interface GatewaytemplateNetworkInternetAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: string;
         name?: string;
-        port?: number;
+        /**
+         * The Destination NAT destination IP Address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}")
+         */
+        port?: string;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity
+         */
+        wanName?: string;
     }
     interface GatewaytemplateNetworkInternetAccessStaticNat {
-        internalIp?: string;
-        name?: string;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
+         */
+        internalIp: string;
+        name: string;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}")
          */
         wanName?: string;
     }
@@ -6796,9 +6962,9 @@ export declare namespace org {
          */
         allowPing?: boolean;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
-        destinationNat: {
+        destinationNat?: {
             [key: string]: outputs.org.GatewaytemplateNetworkVpnAccessDestinationNat;
         };
         /**
@@ -6814,13 +6980,11 @@ export declare namespace org {
          */
         noReadvertiseToLanOspf: boolean;
         /**
-         * toward overlay
-         * how HUB should deal with routes it received from Spokes
+         * toward overlay, how HUB should deal with routes it received from Spokes
          */
         noReadvertiseToOverlay?: boolean;
         /**
-         * by default, the routes are only readvertised toward the same vrf on spoke
-         * to allow it to be leaked to other vrfs
+         * by default, the routes are only readvertised toward the same vrf on spoke. To allow it to be leaked to other vrfs
          */
         otherVrfs: string[];
         /**
@@ -6832,14 +6996,13 @@ export declare namespace org {
          */
         sourceNat: outputs.org.GatewaytemplateNetworkVpnAccessSourceNat;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat: {
             [key: string]: outputs.org.GatewaytemplateNetworkVpnAccessStaticNat;
         };
         /**
-         * toward overlay
-         * how HUB should deal with routes it received from Spokes
+         * toward overlay, how HUB should deal with routes it received from Spokes
          */
         summarizedSubnet?: string;
         /**
@@ -6852,20 +7015,22 @@ export declare namespace org {
         summarizedSubnetToLanOspf?: string;
     }
     interface GatewaytemplateNetworkVpnAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: string;
         name?: string;
-        port?: number;
+        port?: string;
     }
     interface GatewaytemplateNetworkVpnAccessSourceNat {
         externalIp?: string;
     }
     interface GatewaytemplateNetworkVpnAccessStaticNat {
-        internalIp?: string;
-        name?: string;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
          */
-        wanName?: string;
+        internalIp: string;
+        name: string;
     }
     interface GatewaytemplateOobIpConfig {
         /**
@@ -6976,9 +7141,7 @@ export declare namespace org {
          */
         aeIdx?: string;
         /**
-         * For SRX Only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability.\n
-         * Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end\n
-         * Note: Turning this on will enable force-up on one of the interfaces in the bundle only
+         * For SRX Only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
          */
         aeLacpForceUp: boolean;
         aggregated: boolean;
@@ -6986,6 +7149,9 @@ export declare namespace org {
          * if want to generate port up/down alarm, set it to true
          */
         critical: boolean;
+        /**
+         * Interface Description. Can be a variable (i.e. "{{myvar}}")
+         */
         description?: string;
         disableAutoneg: boolean;
         /**
@@ -6997,13 +7163,11 @@ export declare namespace org {
          */
         dslType: string;
         /**
-         * if `wanType`==`dsl`
-         * 16 bit int
+         * if `wanType`==`dsl`, 16 bit int
          */
         dslVci: number;
         /**
-         * if `wanType`==`dsl`
-         * 8 bit int
+         * if `wanType`==`dsl`, 8 bit int
          */
         dslVpi: number;
         /**
@@ -7037,7 +7201,7 @@ export declare namespace org {
          */
         name?: string;
         /**
-         * if `usage`==`lan`
+         * if `usage`==`lan`, name of the `junipermist.org.Network` resource
          */
         networks: string[];
         /**
@@ -7046,7 +7210,7 @@ export declare namespace org {
         outerVlanId?: number;
         poeDisabled: boolean;
         /**
-         * if `usage`==`lan`
+         * Only for SRX and if `usage`==`lan`, the Untagged VLAN Network
          */
         portNetwork?: string;
         /**
@@ -7056,7 +7220,7 @@ export declare namespace org {
         /**
          * if HA mode
          */
-        redundant?: boolean;
+        redundant: boolean;
         /**
          * if HA mode
          */
@@ -7083,10 +7247,7 @@ export declare namespace org {
          * port usage name. enum: `haControl`, `haData`, `lan`, `wan`
          */
         usage: string;
-        /**
-         * if WAN interface is on a VLAN
-         */
-        vlanId?: number;
+        vlanId?: string;
         /**
          * Property key is the VPN name
          */
@@ -7094,29 +7255,33 @@ export declare namespace org {
             [key: string]: outputs.org.GatewaytemplatePortConfigVpnPaths;
         };
         /**
-         * when `wanType`==`broadband`. enum: `default`, `max`, `recommended`
+         * Only when `wanType`==`broadband`. enum: `default`, `max`, `recommended`
          */
         wanArpPolicer: string;
         /**
-         * optional, if spoke should reach this port by a different IP
+         * Only if `usage`==`wan`, optional. If spoke should reach this port by a different IP
          */
         wanExtIp?: string;
         /**
-         * Property Key is the destianation CIDR (e.g "100.100.100.0/24")
+         * Only if `usage`==`wan`. Property Key is the destianation CIDR (e.g "100.100.100.0/24")
          */
         wanExtraRoutes?: {
             [key: string]: outputs.org.GatewaytemplatePortConfigWanExtraRoutes;
         };
         /**
-         * if `usage`==`wan`
+         * Only if `usage`==`wan`. If some networks are connected to this WAN port, it can be added here so policies can be defined
+         */
+        wanNetworks: string[];
+        /**
+         * Only if `usage`==`wan`
          */
         wanProbeOverride?: outputs.org.GatewaytemplatePortConfigWanProbeOverride;
         /**
-         * optional, by default, source-NAT is performed on all WAN Ports using the interface-ip
+         * Only if `usage`==`wan`, optional. By default, source-NAT is performed on all WAN Ports using the interface-ip
          */
         wanSourceNat?: outputs.org.GatewaytemplatePortConfigWanSourceNat;
         /**
-         * if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`
+         * Only if `usage`==`wan`. enum: `broadband`, `dsl`, `lte`
          */
         wanType: string;
     }
@@ -7130,12 +7295,15 @@ export declare namespace org {
          */
         dnsSuffixes?: string[];
         /**
-         * except for out-of_band interface (vme/em0/fxp0)
+         * except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP Address (i.e. "192.168.1.1") or a Variable (i.e. "{{myvar}}")
          */
         gateway?: string;
+        /**
+         * Interface IP Address (i.e. "192.168.1.8") or a Variable (i.e. "{{myvar}}")
+         */
         ip?: string;
         /**
-         * used only if `subnet` is not specified in `networks`
+         * used only if `subnet` is not specified in `networks`. Interface Netmask (i.e. "/24") or a Variable (i.e. "{{myvar}}")
          */
         netmask?: string;
         /**
@@ -7161,11 +7329,14 @@ export declare namespace org {
     }
     interface GatewaytemplatePortConfigTrafficShaping {
         /**
-         * percentages for differet class of traffic: high / medium / low / best-effort
-         * sum must be equal to 100
+         * percentages for differet class of traffic: high / medium / low / best-effort. Sum must be equal to 100
          */
         classPercentages?: number[];
         enabled: boolean;
+        /**
+         * Interface Transmit Cap in kbps
+         */
+        maxTxKbps?: number;
     }
     interface GatewaytemplatePortConfigVpnPaths {
         /**
@@ -7192,11 +7363,14 @@ export declare namespace org {
     }
     interface GatewaytemplatePortConfigVpnPathsTrafficShaping {
         /**
-         * percentages for differet class of traffic: high / medium / low / best-effort
-         * sum must be equal to 100
+         * percentages for differet class of traffic: high / medium / low / best-effort. Sum must be equal to 100
          */
         classPercentages?: number[];
         enabled: boolean;
+        /**
+         * Interface Transmit Cap in kbps
+         */
+        maxTxKbps?: number;
     }
     interface GatewaytemplatePortConfigWanExtraRoutes {
         via?: string;
@@ -7241,6 +7415,10 @@ export declare namespace org {
          * for SSR, hub decides how VRF routes are leaked on spoke
          */
         addTargetVrfs?: string[];
+        /**
+         * route aggregation
+         */
+        aggregates?: string[];
         /**
          * when used as export policy, optional
          */
@@ -7285,16 +7463,14 @@ export declare namespace org {
         vpnNeighborMacs?: string[];
         vpnPathSla?: outputs.org.GatewaytemplateRoutingPoliciesTermMatchingVpnPathSla;
         /**
-         * overlay-facing criteria (used for bgpConfig where via=vpn)
-         * ordered-
+         * overlay-facing criteria (used for bgpConfig where via=vpn). ordered-
          */
         vpnPaths?: string[];
     }
     interface GatewaytemplateRoutingPoliciesTermMatchingRouteExists {
         route?: string;
         /**
-         * name of the vrf instance
-         * it can also be the name of the VPN or wan if they
+         * name of the vrf instance, it can also be the name of the VPN or wan if they
          */
         vrfName: string;
     }
@@ -7323,8 +7499,7 @@ export declare namespace org {
          */
         name?: string;
         /**
-         * by default, we derive all paths available and use them
-         * optionally, you can customize by using `pathPreference`
+         * by default, we derive all paths available and use them. Optionally, you can customize by using `pathPreference`
          */
         pathPreference?: string;
         /**
@@ -7367,70 +7542,81 @@ export declare namespace org {
     interface GatewaytemplateTunnelConfigs {
         autoProvision?: outputs.org.GatewaytemplateTunnelConfigsAutoProvision;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
          */
         ikeLifetime?: number;
         /**
-         * Only if `provider`== `custom-ipsec`. enum: `aggressive`, `main`
+         * Only if `provider`==`custom-ipsec`. enum: `aggressive`, `main`
          */
         ikeMode: string;
         /**
-         * if `provider`== `custom-ipsec`
+         * if `provider`==`custom-ipsec`
          */
         ikeProposals?: outputs.org.GatewaytemplateTunnelConfigsIkeProposal[];
         /**
-         * if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
          */
         ipsecLifetime?: number;
         /**
-         * Only if  `provider`== `custom-ipsec`
+         * Only if  `provider`==`custom-ipsec`
          */
         ipsecProposals?: outputs.org.GatewaytemplateTunnelConfigsIpsecProposal[];
         /**
-         * Only if:
-         *   * `provider`== `zscaler-ipsec`
-         *   * `provider`==`jse-ipsec`
-         *   * `provider`== `custom-ipsec`
+         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         localId?: string;
         /**
-         * enum: `active-active`, `active-standby`
+         * Required if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`. enum: `active-active`, `active-standby`
          */
         mode: string;
         /**
-         * networks reachable via this tunnel
+         * if `provider`==`custom-ipsec`, networks reachable via this tunnel
          */
         networks: string[];
+        /**
+         * Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         */
         primary?: outputs.org.GatewaytemplateTunnelConfigsPrimary;
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if `provider`==`custom-ipsec`
          */
         probe?: outputs.org.GatewaytemplateTunnelConfigsProbe;
         /**
-         * Only if `provider`== `custom-ipsec`. enum: `gre`, `ipsec`
+         * Only if `provider`==`custom-ipsec`. enum: `gre`, `ipsec`
          */
         protocol?: string;
         /**
-         * enum: `custom-ipsec`, `customer-gre`, `jse-ipsec`, `zscaler-gre`, `zscaler-ipsec`
+         * Only if `auto_provision.enabled`==`false`. enum: `custom-ipsec`, `customer-gre`, `jse-ipsec`, `zscaler-gre`, `zscaler-ipsec`
          */
         provider?: string;
         /**
-         * Only if:
-         *   * `provider`== `zscaler-ipsec`
-         *   * `provider`==`jse-ipsec`
-         *   * `provider`== `custom-ipsec`
+         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         psk?: string;
+        /**
+         * Only if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         */
         secondary?: outputs.org.GatewaytemplateTunnelConfigsSecondary;
         /**
-         * Only if `provider`== `custom-gre` or `provider`== `custom-ipsec`. enum: `1`, `2`
+         * Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. enum: `1`, `2`
          */
         version: string;
     }
     interface GatewaytemplateTunnelConfigsAutoProvision {
         enable?: boolean;
+        /**
+         * API override for POP selection
+         */
         latlng?: outputs.org.GatewaytemplateTunnelConfigsAutoProvisionLatlng;
         primary?: outputs.org.GatewaytemplateTunnelConfigsAutoProvisionPrimary;
+        /**
+         * enum: `jse-ipsec`, `zscaler-ipsec`
+         */
+        provider: string;
+        /**
+         * API override for POP selection
+         */
+        region?: string;
         secondary?: outputs.org.GatewaytemplateTunnelConfigsAutoProvisionSecondary;
     }
     interface GatewaytemplateTunnelConfigsAutoProvisionLatlng {
@@ -7438,14 +7624,14 @@ export declare namespace org {
         lng: number;
     }
     interface GatewaytemplateTunnelConfigsAutoProvisionPrimary {
-        numHosts?: string;
+        probeIps?: string[];
         /**
          * optional, only needed if `varsOnly`==`false`
          */
         wanNames?: string[];
     }
     interface GatewaytemplateTunnelConfigsAutoProvisionSecondary {
-        numHosts?: string;
+        probeIps?: string[];
         /**
          * optional, only needed if `varsOnly`==`false`
          */
@@ -7481,7 +7667,7 @@ export declare namespace org {
          */
         authAlgo?: string;
         /**
-         * Only if `provider`== `custom-ipsec`. enum:
+         * Only if `provider`==`custom-ipsec`. enum:
          *   * 1
          *   * 2 (1024-bit)
          *   * 5
@@ -7500,19 +7686,17 @@ export declare namespace org {
         encAlgo: string;
     }
     interface GatewaytemplateTunnelConfigsPrimary {
-        hosts?: string[];
+        hosts: string[];
         /**
-         * Only if:
-         *   * `provider`== `zscaler-gre`
-         *   * `provider`== `custom-gre`
+         * Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`
          */
         internalIps?: string[];
         probeIps?: string[];
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: string[];
-        wanNames?: string[];
+        wanNames: string[];
     }
     interface GatewaytemplateTunnelConfigsProbe {
         /**
@@ -7533,19 +7717,17 @@ export declare namespace org {
         type: string;
     }
     interface GatewaytemplateTunnelConfigsSecondary {
-        hosts?: string[];
+        hosts: string[];
         /**
-         * Only if:
-         *   * `provider`== `zscaler-gre`
-         *   * `provider`== `custom-gre`
+         * Only if `provider`==`zscaler-gre`, `provider`==`jse-ipsec`, `provider`==`custom-ipsec` or `provider`==`custom-gre`
          */
         internalIps?: string[];
         probeIps?: string[];
         /**
-         * Only if `provider`== `custom-ipsec`
+         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: string[];
-        wanNames?: string[];
+        wanNames: string[];
     }
     interface GatewaytemplateTunnelProviderOptions {
         /**
@@ -7558,74 +7740,125 @@ export declare namespace org {
         zscaler?: outputs.org.GatewaytemplateTunnelProviderOptionsZscaler;
     }
     interface GatewaytemplateTunnelProviderOptionsJse {
-        name?: string;
         numUsers?: number;
+        /**
+         * JSE Organization name
+         */
+        orgName?: string;
     }
     interface GatewaytemplateTunnelProviderOptionsZscaler {
-        aupAcceptanceRequired?: boolean;
+        aupBlockInternetUntilAccepted?: boolean;
         /**
-         * days before AUP is requested again
+         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
          */
-        aupExpire?: number;
+        aupEnabled?: boolean;
         /**
          * proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
          */
-        aupSslProxy?: boolean;
+        aupForceSslInspection?: boolean;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Required if `aupEnabled`==`true`. Days before AUP is requested again
          */
-        downloadMbps?: number;
+        aupTimeoutInDays?: number;
         /**
-         * if `useXff`==`true`, display Acceptable Use Policy (AUP)
+         * Enable this option to enforce user authentication
          */
-        enableAup?: boolean;
+        authRequired?: boolean;
         /**
-         * when `enforceAuthentication`==`false`, display caution notification for non-authenticated users
+         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
          */
-        enableCaution?: boolean;
-        enforceAuthentication?: boolean;
-        name?: string;
+        cautionEnabled?: boolean;
         /**
-         * if `useXff`==`true`
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        dnBandwidth?: number;
+        /**
+         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
+         */
+        idleTimeInMinutes?: number;
+        /**
+         * if `true`, enable the firewall control option
+         */
+        ofwEnabled?: boolean;
+        /**
+         * `sub-locations` can be used for specific uses cases to define different configuration based on the user network
          */
         subLocations?: outputs.org.GatewaytemplateTunnelProviderOptionsZscalerSubLocation[];
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
+         */
+        surrogateIp?: boolean;
+        /**
+         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
          */
-        uploadMbps?: number;
+        surrogateIpEnforcedForKnownBrowsers?: boolean;
+        /**
+         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
+         */
+        surrogateRefreshTimeInMinutes?: number;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        upBandwidth?: number;
         /**
          * location uses proxy chaining to forward traffic
          */
-        useXff?: boolean;
+        xffForwardEnabled?: boolean;
     }
     interface GatewaytemplateTunnelProviderOptionsZscalerSubLocation {
-        aupAcceptanceRequired: boolean;
+        aupBlockInternetUntilAccepted?: boolean;
         /**
-         * days before AUP is requested again
+         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
          */
-        aupExpire: number;
+        aupEnabled?: boolean;
         /**
          * proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
          */
-        aupSslProxy: boolean;
+        aupForceSslInspection?: boolean;
+        /**
+         * Required if `aupEnabled`==`true`. Days before AUP is requested again
+         */
+        aupTimeoutInDays?: number;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * Enable this option to authenticate users
          */
-        downloadMbps?: number;
+        authRequired?: boolean;
         /**
-         * if `useXff`==`true`, display Acceptable Use Policy (AUP)
+         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
          */
-        enableAup?: boolean;
+        cautionEnabled?: boolean;
         /**
-         * when `enforceAuthentication`==`false`, display caution notification for non-authenticated users
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
          */
-        enableCaution: boolean;
-        enforceAuthentication: boolean;
-        subnets?: string[];
+        dnBandwidth?: number;
+        /**
+         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
+         */
+        idleTimeInMinutes?: number;
+        /**
+         * Network name
+         */
+        name?: string;
         /**
-         * the download bandwidth cap of the link, in Mbps
+         * if `true`, enable the firewall control option
          */
-        uploadMbps?: number;
+        ofwEnabled?: boolean;
+        /**
+         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
+         */
+        surrogateIp?: boolean;
+        /**
+         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
+         */
+        surrogateIpEnforcedForKnownBrowsers?: boolean;
+        /**
+         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
+         */
+        surrogateRefreshTimeInMinutes?: number;
+        /**
+         * the download bandwidth cap of the link, in Mbps. Disabled if not set
+         */
+        upBandwidth?: number;
     }
     interface GatewaytemplateVrfConfig {
         /**
@@ -8235,7 +8468,7 @@ export declare namespace org {
     interface NetworkInternetAccess {
         createSimpleServicePolicy: boolean;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
         destinationNat?: {
             [key: string]: outputs.org.NetworkInternetAccessDestinationNat;
@@ -8246,25 +8479,57 @@ export declare namespace org {
          */
         restricted: boolean;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat?: {
             [key: string]: outputs.org.NetworkInternetAccessStaticNat;
         };
     }
     interface NetworkInternetAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: string;
         name?: string;
-        port?: number;
+        /**
+         * The Destination NAT destination IP Address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}")
+         */
+        port?: string;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity
+         */
+        wanName?: string;
     }
     interface NetworkInternetAccessStaticNat {
-        internalIp?: string;
-        name?: string;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
+         */
+        internalIp: string;
+        name: string;
+        /**
+         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}")
          */
         wanName?: string;
     }
+    interface NetworkMulticast {
+        /**
+         * if the network will only be the soruce of the multicast traffic, IGMP can be disabled
+         */
+        disableIgmp: boolean;
+        enabled: boolean;
+        /**
+         * Group address to RP (rendezvous point) mapping. Property Key is the CIDR (example "225.1.0.3/32")
+         */
+        groups?: {
+            [key: string]: outputs.org.NetworkMulticastGroups;
+        };
+    }
+    interface NetworkMulticastGroups {
+        /**
+         * RP (rendezvous point) IP Address
+         */
+        rpIp?: string;
+    }
     interface NetworkTenants {
         addresses?: string[];
     }
@@ -8278,9 +8543,9 @@ export declare namespace org {
          */
         allowPing?: boolean;
         /**
-         * Property key may be an IP/Port (i.e. "63.16.0.3:443"), or a port (i.e. ":2222")
+         * Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internalIp` or `port` must be defined
          */
-        destinationNat: {
+        destinationNat?: {
             [key: string]: outputs.org.NetworkVpnAccessDestinationNat;
         };
         /**
@@ -8314,7 +8579,7 @@ export declare namespace org {
          */
         sourceNat: outputs.org.NetworkVpnAccessSourceNat;
         /**
-         * Property key may be an IP Address (i.e. "172.16.0.1"), and IP Address and Port (i.e. "172.16.0.1:8443") or a CIDR (i.e. "172.16.0.12/20")
+         * Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
          */
         staticNat: {
             [key: string]: outputs.org.NetworkVpnAccessStaticNat;
@@ -8334,31 +8599,35 @@ export declare namespace org {
         summarizedSubnetToLanOspf?: string;
     }
     interface NetworkVpnAccessDestinationNat {
+        /**
+         * The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
+         */
         internalIp?: string;
         name?: string;
-        port?: number;
+        port?: string;
     }
     interface NetworkVpnAccessSourceNat {
         externalIp?: string;
     }
     interface NetworkVpnAccessStaticNat {
-        internalIp?: string;
-        name?: string;
         /**
-         * If not set, we configure the nat policies against all WAN ports for simplicity
+         * The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
          */
-        wanName?: string;
+        internalIp: string;
+        name: string;
     }
     interface NetworktemplateAclPolicy {
         /**
-         * - for GBP-based policy, all srcTags and dstTags have to be gbp-based
-         * - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
+         * ACL Policy Actions:
+         *   - for GBP-based policy, all srcTags and dstTags have to be gbp-based
+         *   - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
          */
         actions?: outputs.org.NetworktemplateAclPolicyAction[];
         name?: string;
         /**
-         * - for GBP-based policy, all srcTags and dstTags have to be gbp-based
-         * - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
+         * ACL Policy Source Tags:
+         *   - for GBP-based policy, all srcTags and dstTags have to be gbp-based
+         *   - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
          */
         srcTags?: string[];
     }
@@ -8372,9 +8641,9 @@ export declare namespace org {
     interface NetworktemplateAclTags {
         /**
          * required if
-         * - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
-         * - `type`==`gbpResource`
-         * - `type`==`staticGbp` (applying gbp tag against matching conditions)
+         *   - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
+         *   - `type`==`gbpResource`
+         *   - `type`==`staticGbp` (applying gbp tag against matching conditions)
          */
         gbpTag?: number;
         /**
@@ -8400,8 +8669,7 @@ export declare namespace org {
          */
         radiusGroup?: string;
         /**
-         * if `type`==`resource` or `type`==`gbpResource`
-         * empty means unrestricted, i.e. any
+         * if `type`==`resource` or `type`==`gbpResource`. Empty means unrestricted, i.e. any
          */
         specs?: outputs.org.NetworktemplateAclTagsSpec[];
         /**
@@ -8431,7 +8699,7 @@ export declare namespace org {
          */
         portRange: string;
         /**
-         * `tcp` / `udp` / `icmp` / `gre` / `any` / `:protocol_number`. `protocolNumber` is between 1-254
+         * `tcp` / `udp` / `icmp` / `icmp6` / `gre` / `any` / `:protocol_number`, `protocolNumber` is between 1-254, default is `any` `protocolNumber` is between 1-254
          */
         protocol: string;
     }
@@ -8505,8 +8773,7 @@ export declare namespace org {
          */
         gateway6?: string;
         /**
-         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required)
-         * NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set
+         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required). NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set
          */
         isolation: boolean;
         isolationVlanId?: string;
@@ -8592,9 +8859,7 @@ export declare namespace org {
          */
         allNetworks: boolean;
         /**
-         * Only if `mode`!=`dynamic`. If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with.
-         * All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state.
-         * When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
+         * Only if `mode`!=`dynamic`. If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with. All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state. When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
          */
         allowDhcpd?: boolean;
         /**
@@ -8642,8 +8907,7 @@ export declare namespace org {
          */
         guestNetwork?: string;
         /**
-         * Only if `mode`!=`dynamic` interSwitchLink is used together with "isolation" under networks
-         * NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
+         * Only if `mode`!=`dynamic` interSwitchLink is used together with "isolation" under networks. NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
          */
         interSwitchLink: boolean;
         /**
@@ -8715,8 +8979,7 @@ export declare namespace org {
          */
         speed: string;
         /**
-         * Switch storm control
-         * Only if `mode`!=`dynamic`
+         * Switch storm control. Only if `mode`!=`dynamic`
          */
         stormControl?: outputs.org.NetworktemplatePortUsagesStormControl;
         /**
@@ -8797,8 +9060,7 @@ export declare namespace org {
          */
         authServersTimeout: number;
         /**
-         * use `network`or `sourceIp`
-         * which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
+         * use `network`or `sourceIp`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
          */
         network?: string;
         /**
@@ -9078,8 +9340,7 @@ export declare namespace org {
     }
     interface NetworktemplateSnmpConfigV3ConfigUsmUser {
         /**
-         * Not required if `authenticationType`==`authenticationNone`
-         * include alphabetic, numeric, and special characters, but it cannot include control characters.
+         * Not required if `authenticationType`==`authenticationNone`. Include alphabetic, numeric, and special characters, but it cannot include control characters.
          */
         authenticationPassword?: string;
         /**
@@ -9087,8 +9348,7 @@ export declare namespace org {
          */
         authenticationType?: string;
         /**
-         * Not required if `encryptionType`==`privacy-none`
-         * include alphabetic, numeric, and special characters, but it cannot include control characters
+         * Not required if `encryptionType`==`privacy-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters
          */
         encryptionPassword?: string;
         /**
@@ -9213,8 +9473,7 @@ Please update your configurations.
             [key: string]: outputs.org.NetworktemplateSwitchMatchingRulePortConfig;
         };
         /**
-         * Property key is the port mirroring instance name
-         * portMirroring can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 port mirrorings is allowed
+         * Property key is the port mirroring instance name. `portMirroring` can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 port mirrorings is allowed
          */
         portMirroring?: {
             [key: string]: outputs.org.NetworktemplateSwitchMatchingRulePortMirroring;
@@ -10140,8 +10399,7 @@ Please update your configurations.
         };
         enabled: boolean;
         /**
-         * Map from wxtagId of Hostname Wxlan Tags to bandwidth in kbps
-         * Property key is the wxtag id
+         * Map from wxtagId of Hostname Wxlan Tags to bandwidth in kbps. Property key is the `wxtagId`
          */
         wxtagIds: {
             [key: string]: number;
@@ -10306,8 +10564,7 @@ Please update your configurations.
     interface WlanDnsServerRewrite {
         enabled: boolean;
         /**
-         * map between radiusGroup and the desired DNS server (IPv4 only)
-         * Property key is the RADIUS group, property value is the desired DNS Server
+         * map between radiusGroup and the desired DNS server (IPv4 only). Property key is the RADIUS group, property value is the desired DNS Server
          */
         radiusGroups?: {
             [key: string]: string;
@@ -10321,8 +10578,7 @@ Please update your configurations.
         defaultVlanId?: string;
         enabled: boolean;
         /**
-         * when 11r is enabled, we'll try to use the cached PMK, this can be disabled
-         * `false` means auto
+         * when 11r is enabled, we'll try to use the cached PMK, this can be disabled. `false` means auto
          */
         forceLookup: boolean;
         /**
@@ -11380,13 +11636,11 @@ Please update your configurations.
         enabled?: boolean;
         idleTimeout?: number;
         /**
-         * To use Org mxedges when this WLAN does not use mxtunnel, specify their mxcluster_ids.
-         * Org mxedge(s) identified by mxcluster_ids
+         * To use Org mxedges when this WLAN does not use mxtunnel, specify their mxcluster_ids. Org mxedge(s) identified by mxcluster_ids
          */
         mxclusterIds: string[];
         /**
-         * default is site.mxedge.radsec.proxy_hosts which must be a superset of all wlans[*].radsec.proxy_hosts
-         * when radsec.proxy_hosts are not used, tunnel peers (org or site mxedges) are used irrespective of use_site_mxedge
+         * default is site.mxedge.radsec.proxy_hosts which must be a superset of all `wlans[*].radsec.proxy_hosts`. When `radsec.proxy_hosts` are not used, tunnel peers (org or site mxedges) are used irrespective of `useSiteMxedge`
          */
         proxyHosts: string[];
         /**
@@ -11712,14 +11966,16 @@ export declare namespace site {
     }
     interface NetworktemplateAclPolicy {
         /**
-         * - for GBP-based policy, all srcTags and dstTags have to be gbp-based
-         * - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
+         * ACL Policy Actions:
+         *   - for GBP-based policy, all srcTags and dstTags have to be gbp-based
+         *   - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
          */
         actions?: outputs.site.NetworktemplateAclPolicyAction[];
         name?: string;
         /**
-         * - for GBP-based policy, all srcTags and dstTags have to be gbp-based
-         * - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
+         * ACL Policy Source Tags:
+         *   - for GBP-based policy, all srcTags and dstTags have to be gbp-based
+         *   - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
          */
         srcTags?: string[];
     }
@@ -11733,9 +11989,9 @@ export declare namespace site {
     interface NetworktemplateAclTags {
         /**
          * required if
-         * - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
-         * - `type`==`gbpResource`
-         * - `type`==`staticGbp` (applying gbp tag against matching conditions)
+         *   - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
+         *   - `type`==`gbpResource`
+         *   - `type`==`staticGbp` (applying gbp tag against matching conditions)
          */
         gbpTag?: number;
         /**
@@ -11761,8 +12017,7 @@ export declare namespace site {
          */
         radiusGroup?: string;
         /**
-         * if `type`==`resource` or `type`==`gbpResource`
-         * empty means unrestricted, i.e. any
+         * if `type`==`resource` or `type`==`gbpResource`. Empty means unrestricted, i.e. any
          */
         specs?: outputs.site.NetworktemplateAclTagsSpec[];
         /**
@@ -11792,7 +12047,7 @@ export declare namespace site {
          */
         portRange: string;
         /**
-         * `tcp` / `udp` / `icmp` / `gre` / `any` / `:protocol_number`. `protocolNumber` is between 1-254
+         * `tcp` / `udp` / `icmp` / `icmp6` / `gre` / `any` / `:protocol_number`, `protocolNumber` is between 1-254, default is `any` `protocolNumber` is between 1-254
          */
         protocol: string;
     }
@@ -11866,8 +12121,7 @@ export declare namespace site {
          */
         gateway6?: string;
         /**
-         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required)
-         * NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set
+         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required). NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set
          */
         isolation: boolean;
         isolationVlanId?: string;
@@ -11953,9 +12207,7 @@ export declare namespace site {
          */
         allNetworks: boolean;
         /**
-         * Only if `mode`!=`dynamic`. If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with.
-         * All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state.
-         * When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
+         * Only if `mode`!=`dynamic`. If DHCP snooping is enabled, whether DHCP server is allowed on the interfaces with. All the interfaces from port configs using this port usage are effected. Please notice that allowDhcpd is a tri_state. When it is not defined, it means using the system's default setting which depends on whether the port is a access or trunk port.
          */
         allowDhcpd?: boolean;
         /**
@@ -12003,8 +12255,7 @@ export declare namespace site {
          */
         guestNetwork?: string;
         /**
-         * Only if `mode`!=`dynamic` interSwitchLink is used together with "isolation" under networks
-         * NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
+         * Only if `mode`!=`dynamic` interSwitchLink is used together with "isolation" under networks. NOTE: interSwitchLink works only between Juniper device. This has to be applied to both ports connected together
          */
         interSwitchLink: boolean;
         /**
@@ -12076,8 +12327,7 @@ export declare namespace site {
          */
         speed: string;
         /**
-         * Switch storm control
-         * Only if `mode`!=`dynamic`
+         * Switch storm control. Only if `mode`!=`dynamic`
          */
         stormControl?: outputs.site.NetworktemplatePortUsagesStormControl;
         /**
@@ -12158,8 +12408,7 @@ export declare namespace site {
          */
         authServersTimeout: number;
         /**
-         * use `network`or `sourceIp`
-         * which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
+         * use `network`or `sourceIp`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
          */
         network?: string;
         /**
@@ -12439,8 +12688,7 @@ export declare namespace site {
     }
     interface NetworktemplateSnmpConfigV3ConfigUsmUser {
         /**
-         * Not required if `authenticationType`==`authenticationNone`
-         * include alphabetic, numeric, and special characters, but it cannot include control characters.
+         * Not required if `authenticationType`==`authenticationNone`. Include alphabetic, numeric, and special characters, but it cannot include control characters.
          */
         authenticationPassword?: string;
         /**
@@ -12448,8 +12696,7 @@ export declare namespace site {
          */
         authenticationType?: string;
         /**
-         * Not required if `encryptionType`==`privacy-none`
-         * include alphabetic, numeric, and special characters, but it cannot include control characters
+         * Not required if `encryptionType`==`privacy-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters
          */
         encryptionPassword?: string;
         /**
@@ -12574,8 +12821,7 @@ Please update your configurations.
             [key: string]: outputs.site.NetworktemplateSwitchMatchingRulePortConfig;
         };
         /**
-         * Property key is the port mirroring instance name
-         * portMirroring can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 port mirrorings is allowed
+         * Property key is the port mirroring instance name. `portMirroring` can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 port mirrorings is allowed
          */
         portMirroring?: {
             [key: string]: outputs.site.NetworktemplateSwitchMatchingRulePortMirroring;
@@ -13396,8 +13642,7 @@ Please update your configurations.
         };
         enabled: boolean;
         /**
-         * Map from wxtagId of Hostname Wxlan Tags to bandwidth in kbps
-         * Property key is the wxtag id
+         * Map from wxtagId of Hostname Wxlan Tags to bandwidth in kbps. Property key is the `wxtagId`
          */
         wxtagIds: {
             [key: string]: number;
@@ -13562,8 +13807,7 @@ Please update your configurations.
     interface WlanDnsServerRewrite {
         enabled: boolean;
         /**
-         * map between radiusGroup and the desired DNS server (IPv4 only)
-         * Property key is the RADIUS group, property value is the desired DNS Server
+         * map between radiusGroup and the desired DNS server (IPv4 only). Property key is the RADIUS group, property value is the desired DNS Server
          */
         radiusGroups?: {
             [key: string]: string;
@@ -13577,8 +13821,7 @@ Please update your configurations.
         defaultVlanId?: string;
         enabled: boolean;
         /**
-         * when 11r is enabled, we'll try to use the cached PMK, this can be disabled
-         * `false` means auto
+         * when 11r is enabled, we'll try to use the cached PMK, this can be disabled. `false` means auto
          */
         forceLookup: boolean;
         /**
@@ -14636,13 +14879,11 @@ Please update your configurations.
         enabled?: boolean;
         idleTimeout?: number;
         /**
-         * To use Org mxedges when this WLAN does not use mxtunnel, specify their mxcluster_ids.
-         * Org mxedge(s) identified by mxcluster_ids
+         * To use Org mxedges when this WLAN does not use mxtunnel, specify their mxcluster_ids. Org mxedge(s) identified by mxcluster_ids
          */
         mxclusterIds: string[];
         /**
-         * default is site.mxedge.radsec.proxy_hosts which must be a superset of all wlans[*].radsec.proxy_hosts
-         * when radsec.proxy_hosts are not used, tunnel peers (org or site mxedges) are used irrespective of use_site_mxedge
+         * default is site.mxedge.radsec.proxy_hosts which must be a superset of all `wlans[*].radsec.proxy_hosts`. When `radsec.proxy_hosts` are not used, tunnel peers (org or site mxedges) are used irrespective of `useSiteMxedge`
          */
         proxyHosts: string[];
         /**