@pulumi/juniper-mist 0.9.0 → 0.10.0

package/types/input.d.ts

@@ -260,6 +260,10 @@ export declare namespace device {
          * enum: `base`, `remote`
          */
         role?: pulumi.Input<string | undefined>;
+        /**
+         * Whether to use WPA3 on the 5 GHz band for mesh links
+         */
+        useWpa3On5?: pulumi.Input<boolean | undefined>;
     }
     interface ApPortConfig {
         disabled?: pulumi.Input<boolean | undefined>;
@@ -769,6 +773,28 @@ export declare namespace device {
          */
         vlanId?: pulumi.Input<number | undefined>;
     }
+    interface ApZigbeeConfig {
+        /**
+         * Controls whether new Zigbee devices are allowed to join the network. enum: `always`, `manual`
+         */
+        allowJoin?: pulumi.Input<string | undefined>;
+        /**
+         * Zigbee channel (2.4 GHz). `0` means auto; valid fixed values are 11–26
+         */
+        channel?: pulumi.Input<number | undefined>;
+        /**
+         * Whether to enable Zigbee on this AP
+         */
+        enabled?: pulumi.Input<boolean | undefined>;
+        /**
+         * Extended PAN ID in hex string format; only applicable when `panId` is also specified
+         */
+        extendedPanId?: pulumi.Input<string | undefined>;
+        /**
+         * PAN ID in hex string format; if not specified, assigned automatically
+         */
+        panId?: pulumi.Input<string | undefined>;
+    }
     interface BaseLatlng {
         lat: pulumi.Input<number>;
         lng: pulumi.Input<number>;
@@ -877,6 +903,10 @@ export declare namespace device {
          * Neighbor AS. Value must be in range 1-4294967295 or a variable (e.g. `{{as_variable}}`)
          */
         neighborAs: pulumi.Input<string>;
+        /**
+         * If `via`==`tunnel`, specifies which tunnel (primary/secondary) this neighbor is associated with. enum: `primary`, `secondary`
+         */
+        tunnelVia?: pulumi.Input<string | undefined>;
     }
     interface GatewayClusterNode {
         /**
@@ -999,10 +1029,125 @@ export declare namespace device {
         via: pulumi.Input<string>;
     }
     interface GatewayGatewayMgmt {
+        /**
+         * For SSR only, as direct root access is not allowed
+         */
+        adminSshkeys?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+        appProbing?: pulumi.Input<inputs.device.GatewayGatewayMgmtAppProbing | undefined>;
+        /**
+         * Consumes uplink bandwidth, requires WA license
+         */
+        appUsage?: pulumi.Input<boolean | undefined>;
+        autoSignatureUpdate?: pulumi.Input<inputs.device.GatewayGatewayMgmtAutoSignatureUpdate | undefined>;
         /**
          * Rollback timer for commit confirmed
          */
         configRevertTimer?: pulumi.Input<number | undefined>;
+        /**
+         * For SSR and SRX, disable console port
+         */
+        disableConsole?: pulumi.Input<boolean | undefined>;
+        /**
+         * For SSR and SRX, disable management interface
+         */
+        disableOob?: pulumi.Input<boolean | undefined>;
+        /**
+         * For SSR and SRX, disable usb interface
+         */
+        disableUsb?: pulumi.Input<boolean | undefined>;
+        fipsEnabled?: pulumi.Input<boolean | undefined>;
+        probeHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+        probeHostsv6s?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+        /**
+         * Restrict inbound-traffic to host
+         * when enabled, all traffic that is not essential to our operation will be dropped
+         * e.g. ntp / dns / traffic to mist will be allowed by default, if dhcpd is enabled, we'll make sure it works
+         */
+        protectRe?: pulumi.Input<inputs.device.GatewayGatewayMgmtProtectRe | undefined>;
+        /**
+         * SRX only
+         */
+        rootPassword?: pulumi.Input<string | undefined>;
+        securityLogSourceAddress?: pulumi.Input<string | undefined>;
+        securityLogSourceInterface?: pulumi.Input<string | undefined>;
+    }
+    interface GatewayGatewayMgmtAppProbing {
+        /**
+         * APp-keys from List Applications
+         */
+        apps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+        customApps?: pulumi.Input<pulumi.Input<inputs.device.GatewayGatewayMgmtAppProbingCustomApp>[] | undefined>;
+        enabled?: pulumi.Input<boolean | undefined>;
+    }
+    interface GatewayGatewayMgmtAppProbingCustomApp {
+        /**
+         * Required if `protocol`==`icmp`
+         */
+        address?: pulumi.Input<string | undefined>;
+        appType?: pulumi.Input<string | undefined>;
+        /**
+         * If `protocol`==`http`
+         */
+        hostnames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+        key?: pulumi.Input<string | undefined>;
+        name?: pulumi.Input<string | undefined>;
+        network?: pulumi.Input<string | undefined>;
+        /**
+         * If `protocol`==`icmp`
+         */
+        packetSize?: pulumi.Input<number | undefined>;
+        /**
+         * enum: `http`, `icmp`
+         */
+        protocol?: pulumi.Input<string | undefined>;
+        /**
+         * If `protocol`==`http`
+         */
+        url?: pulumi.Input<string | undefined>;
+        vrf?: pulumi.Input<string | undefined>;
+    }
+    interface GatewayGatewayMgmtAutoSignatureUpdate {
+        /**
+         * enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`
+         */
+        dayOfWeek?: pulumi.Input<string | undefined>;
+        enable?: pulumi.Input<boolean | undefined>;
+        /**
+         * Optional, Mist will decide the timing
+         */
+        timeOfDay?: pulumi.Input<string | undefined>;
+    }
+    interface GatewayGatewayMgmtProtectRe {
+        /**
+         * Optionally, services we'll allow
+         */
+        allowedServices?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+        customs?: pulumi.Input<pulumi.Input<inputs.device.GatewayGatewayMgmtProtectReCustom>[] | undefined>;
+        /**
+         * When enabled, all traffic that is not essential to our operation will be dropped
+         * e.g. ntp / dns / traffic to mist will be allowed by default
+         *      if dhcpd is enabled, we'll make sure it works
+         */
+        enabled?: pulumi.Input<boolean | undefined>;
+        /**
+         * Whether to enable hit count for Protect_RE policy
+         */
+        hitCount?: pulumi.Input<boolean | undefined>;
+        /**
+         * host/subnets we'll allow traffic to/from
+         */
+        trustedHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    }
+    interface GatewayGatewayMgmtProtectReCustom {
+        /**
+         * Matched dst port, "0" means any
+         */
+        portRange?: pulumi.Input<string | undefined>;
+        /**
+         * enum: `any`, `icmp`, `tcp`, `udp`
+         */
+        protocol?: pulumi.Input<string | undefined>;
+        subnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
     }
     interface GatewayIdpProfiles {
         /**
@@ -1420,6 +1565,10 @@ export declare namespace device {
          */
         outerVlanId?: pulumi.Input<number | undefined>;
         poeDisabled?: pulumi.Input<boolean | undefined>;
+        /**
+         * Whether Perpetual PoE capabilities are enabled for a port
+         */
+        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
         /**
          * Only for SRX and if `usage`==`lan`, the name of the Network to be used as the Untagged VLAN
          */
@@ -1884,7 +2033,7 @@ export declare namespace device {
          */
         ipsecLifetime?: pulumi.Input<number | undefined>;
         /**
-         * Only if  `provider`==`custom-ipsec`
+         * Only if `provider`==`custom-ipsec`
          */
         ipsecProposals?: pulumi.Input<pulumi.Input<inputs.device.GatewayTunnelConfigsIpsecProposal>[] | undefined>;
         /**
@@ -2034,7 +2183,7 @@ export declare namespace device {
         internalIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         /**
-         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         * Only if `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         wanNames: pulumi.Input<pulumi.Input<string>[]>;
@@ -2065,7 +2214,7 @@ export declare namespace device {
         internalIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         /**
-         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         * Only if `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         wanNames: pulumi.Input<pulumi.Input<string>[]>;
@@ -2410,7 +2559,7 @@ export declare namespace device {
             [key: string]: pulumi.Input<inputs.device.SwitchDhcpdConfigConfigFixedBindings>;
         } | undefined>;
         /**
-         * If `type`==`server`  - optional, `ip` will be used if not provided
+         * If `type`==`server` - optional, `ip` will be used if not provided
          */
         gateway?: pulumi.Input<string | undefined>;
         /**
@@ -2500,7 +2649,7 @@ export declare namespace device {
         noResolve?: pulumi.Input<boolean | undefined>;
         preference?: pulumi.Input<number | undefined>;
         /**
-         * Next-hop IP Address
+         * Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.
          */
         via: pulumi.Input<string>;
     }
@@ -2516,7 +2665,7 @@ export declare namespace device {
         noResolve?: pulumi.Input<boolean | undefined>;
         preference?: pulumi.Input<number | undefined>;
         /**
-         * Next-hop IP Address
+         * Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.
          */
         via: pulumi.Input<string>;
     }
@@ -2873,7 +3022,11 @@ export declare namespace device {
          */
         aeIdx?: pulumi.Input<number | undefined>;
         /**
-         * To use fast timeout
+         * If `aggregated`==`true`, sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
+         */
+        aeLacpForceUp?: pulumi.Input<boolean | undefined>;
+        /**
+         * To use slow timeout
          */
         aeLacpSlow?: pulumi.Input<boolean | undefined>;
         aggregated?: pulumi.Input<boolean | undefined>;
@@ -2936,6 +3089,10 @@ export declare namespace device {
          * Whether PoE capabilities are disabled for a port
          */
         poeDisabled?: pulumi.Input<boolean | undefined>;
+        /**
+         * Whether Perpetual PoE is enabled; keeps PoE state across reboots
+         */
+        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
         /**
          * Native network/vlan for untagged traffic
          */
@@ -3076,6 +3233,10 @@ export declare namespace device {
          * Only if `mode`!=`dynamic`. Whether PoE capabilities are disabled for a port
          */
         poeDisabled?: pulumi.Input<boolean | undefined>;
+        /**
+         * Only if `mode`!=`dynamic`. Whether Perpetual PoE is enabled; keeps PoE state across reboots
+         */
+        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
         /**
          * PoE priority. enum: `low`, `high`
          */
@@ -4110,6 +4271,10 @@ export declare namespace org {
          * enum: `base`, `remote`
          */
         role?: pulumi.Input<string | undefined>;
+        /**
+         * Whether to use WPA3 on the 5 GHz band for mesh links
+         */
+        useWpa3On5?: pulumi.Input<boolean | undefined>;
     }
     interface DeviceprofileApPortConfig {
         disabled?: pulumi.Input<boolean | undefined>;
@@ -4619,6 +4784,28 @@ export declare namespace org {
          */
         vlanId?: pulumi.Input<number | undefined>;
     }
+    interface DeviceprofileApZigbeeConfig {
+        /**
+         * Controls whether new Zigbee devices are allowed to join the network. enum: `always`, `manual`
+         */
+        allowJoin?: pulumi.Input<string | undefined>;
+        /**
+         * Zigbee channel (2.4 GHz). `0` means auto; valid fixed values are 11–26
+         */
+        channel?: pulumi.Input<number | undefined>;
+        /**
+         * Whether to enable Zigbee on this AP
+         */
+        enabled?: pulumi.Input<boolean | undefined>;
+        /**
+         * Extended PAN ID in hex string format; only applicable when `panId` is also specified
+         */
+        extendedPanId?: pulumi.Input<string | undefined>;
+        /**
+         * PAN ID in hex string format; if not specified, assigned automatically
+         */
+        panId?: pulumi.Input<string | undefined>;
+    }
     interface DeviceprofileGatewayBgpConfig {
         /**
          * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`
@@ -4723,6 +4910,10 @@ export declare namespace org {
          * Neighbor AS. Value must be in range 1-4294967295 or a variable (e.g. `{{as_variable}}`)
          */
         neighborAs: pulumi.Input<string>;
+        /**
+         * If `via`==`tunnel`, specifies which tunnel (primary/secondary) this neighbor is associated with. enum: `primary`, `secondary`
+         */
+        tunnelVia?: pulumi.Input<string | undefined>;
     }
     interface DeviceprofileGatewayDhcpdConfig {
         /**
@@ -5250,6 +5441,10 @@ export declare namespace org {
          */
         outerVlanId?: pulumi.Input<number | undefined>;
         poeDisabled?: pulumi.Input<boolean | undefined>;
+        /**
+         * Whether Perpetual PoE capabilities are enabled for a port
+         */
+        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
         /**
          * Only for SRX and if `usage`==`lan`, the name of the Network to be used as the Untagged VLAN
          */
@@ -5704,7 +5899,7 @@ export declare namespace org {
          */
         ipsecLifetime?: pulumi.Input<number | undefined>;
         /**
-         * Only if  `provider`==`custom-ipsec`
+         * Only if `provider`==`custom-ipsec`
          */
         ipsecProposals?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsIpsecProposal>[] | undefined>;
         /**
@@ -5854,7 +6049,7 @@ export declare namespace org {
         internalIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         /**
-         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         * Only if `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         wanNames: pulumi.Input<pulumi.Input<string>[]>;
@@ -5885,7 +6080,7 @@ export declare namespace org {
         internalIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         /**
-         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         * Only if `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         wanNames: pulumi.Input<pulumi.Input<string>[]>;
@@ -6058,6 +6253,10 @@ export declare namespace org {
          * Optional, for ERB or CLOS, you can either use esilag to upstream routers or to also be the virtual-gateway. When `routedAt` != `core`, whether to do virtual-gateway at core as well
          */
         coreAsBorder?: pulumi.Input<boolean | undefined>;
+        /**
+         * Whether to route management traffic inband; routes will be propagated to downstream switches
+         */
+        enableInbandMgmt?: pulumi.Input<boolean | undefined>;
         /**
          * if the mangement traffic goes inbnd, during installation, only the border/core switches are connected to the Internet to allow initial configuration to be pushed down and leave the downstream access switches stay in the Factory Default state enabling inband-ztp allows upstream switches to use LLDP to assign IP and gives Internet to downstream switches in that state
          */
@@ -6241,6 +6440,10 @@ export declare namespace org {
          * Neighbor AS. Value must be in range 1-4294967295 or a variable (e.g. `{{as_variable}}`)
          */
         neighborAs: pulumi.Input<string>;
+        /**
+         * If `via`==`tunnel`, specifies which tunnel (primary/secondary) this neighbor is associated with. enum: `primary`, `secondary`
+         */
+        tunnelVia?: pulumi.Input<string | undefined>;
     }
     interface GatewaytemplateDhcpdConfig {
         /**
@@ -6356,6 +6559,127 @@ export declare namespace org {
     interface GatewaytemplateExtraRoutes6 {
         via: pulumi.Input<string>;
     }
+    interface GatewaytemplateGatewayMgmt {
+        /**
+         * For SSR only, as direct root access is not allowed
+         */
+        adminSshkeys?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+        appProbing?: pulumi.Input<inputs.org.GatewaytemplateGatewayMgmtAppProbing | undefined>;
+        /**
+         * Consumes uplink bandwidth, requires WA license
+         */
+        appUsage?: pulumi.Input<boolean | undefined>;
+        autoSignatureUpdate?: pulumi.Input<inputs.org.GatewaytemplateGatewayMgmtAutoSignatureUpdate | undefined>;
+        /**
+         * Rollback timer for commit confirmed
+         */
+        configRevertTimer?: pulumi.Input<number | undefined>;
+        /**
+         * For SSR and SRX, disable console port
+         */
+        disableConsole?: pulumi.Input<boolean | undefined>;
+        /**
+         * For SSR and SRX, disable management interface
+         */
+        disableOob?: pulumi.Input<boolean | undefined>;
+        /**
+         * For SSR and SRX, disable usb interface
+         */
+        disableUsb?: pulumi.Input<boolean | undefined>;
+        fipsEnabled?: pulumi.Input<boolean | undefined>;
+        probeHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+        probeHostsv6s?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+        /**
+         * Restrict inbound-traffic to host
+         * when enabled, all traffic that is not essential to our operation will be dropped
+         * e.g. ntp / dns / traffic to mist will be allowed by default, if dhcpd is enabled, we'll make sure it works
+         */
+        protectRe?: pulumi.Input<inputs.org.GatewaytemplateGatewayMgmtProtectRe | undefined>;
+        /**
+         * SRX only
+         */
+        rootPassword?: pulumi.Input<string | undefined>;
+        securityLogSourceAddress?: pulumi.Input<string | undefined>;
+        securityLogSourceInterface?: pulumi.Input<string | undefined>;
+    }
+    interface GatewaytemplateGatewayMgmtAppProbing {
+        /**
+         * APp-keys from List Applications
+         */
+        apps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+        customApps?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplateGatewayMgmtAppProbingCustomApp>[] | undefined>;
+        enabled?: pulumi.Input<boolean | undefined>;
+    }
+    interface GatewaytemplateGatewayMgmtAppProbingCustomApp {
+        /**
+         * Required if `protocol`==`icmp`
+         */
+        address?: pulumi.Input<string | undefined>;
+        appType?: pulumi.Input<string | undefined>;
+        /**
+         * If `protocol`==`http`
+         */
+        hostnames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+        key?: pulumi.Input<string | undefined>;
+        name?: pulumi.Input<string | undefined>;
+        network?: pulumi.Input<string | undefined>;
+        /**
+         * If `protocol`==`icmp`
+         */
+        packetSize?: pulumi.Input<number | undefined>;
+        /**
+         * enum: `http`, `icmp`
+         */
+        protocol?: pulumi.Input<string | undefined>;
+        /**
+         * If `protocol`==`http`
+         */
+        url?: pulumi.Input<string | undefined>;
+        vrf?: pulumi.Input<string | undefined>;
+    }
+    interface GatewaytemplateGatewayMgmtAutoSignatureUpdate {
+        /**
+         * enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`
+         */
+        dayOfWeek?: pulumi.Input<string | undefined>;
+        enable?: pulumi.Input<boolean | undefined>;
+        /**
+         * Optional, Mist will decide the timing
+         */
+        timeOfDay?: pulumi.Input<string | undefined>;
+    }
+    interface GatewaytemplateGatewayMgmtProtectRe {
+        /**
+         * Optionally, services we'll allow
+         */
+        allowedServices?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+        customs?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplateGatewayMgmtProtectReCustom>[] | undefined>;
+        /**
+         * When enabled, all traffic that is not essential to our operation will be dropped
+         * e.g. ntp / dns / traffic to mist will be allowed by default
+         *      if dhcpd is enabled, we'll make sure it works
+         */
+        enabled?: pulumi.Input<boolean | undefined>;
+        /**
+         * Whether to enable hit count for Protect_RE policy
+         */
+        hitCount?: pulumi.Input<boolean | undefined>;
+        /**
+         * host/subnets we'll allow traffic to/from
+         */
+        trustedHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    }
+    interface GatewaytemplateGatewayMgmtProtectReCustom {
+        /**
+         * Matched dst port, "0" means any
+         */
+        portRange?: pulumi.Input<string | undefined>;
+        /**
+         * enum: `any`, `icmp`, `tcp`, `udp`
+         */
+        protocol?: pulumi.Input<string | undefined>;
+        subnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    }
     interface GatewaytemplateIdpProfiles {
         /**
          * enum: `critical`, `standard`, `strict`
@@ -6768,6 +7092,10 @@ export declare namespace org {
          */
         outerVlanId?: pulumi.Input<number | undefined>;
         poeDisabled?: pulumi.Input<boolean | undefined>;
+        /**
+         * Whether Perpetual PoE capabilities are enabled for a port
+         */
+        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
         /**
          * Only for SRX and if `usage`==`lan`, the name of the Network to be used as the Untagged VLAN
          */
@@ -7222,7 +7550,7 @@ export declare namespace org {
          */
         ipsecLifetime?: pulumi.Input<number | undefined>;
         /**
-         * Only if  `provider`==`custom-ipsec`
+         * Only if `provider`==`custom-ipsec`
          */
         ipsecProposals?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsIpsecProposal>[] | undefined>;
         /**
@@ -7372,7 +7700,7 @@ export declare namespace org {
         internalIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         /**
-         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         * Only if `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         wanNames: pulumi.Input<pulumi.Input<string>[]>;
@@ -7403,7 +7731,7 @@ export declare namespace org {
         internalIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         /**
-         * Only if  `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
+         * Only if `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
          */
         remoteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         wanNames: pulumi.Input<pulumi.Input<string>[]>;
@@ -8403,7 +8731,7 @@ export declare namespace org {
         noResolve?: pulumi.Input<boolean | undefined>;
         preference?: pulumi.Input<number | undefined>;
         /**
-         * Next-hop IP Address
+         * Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.
          */
         via: pulumi.Input<string>;
     }
@@ -8419,7 +8747,7 @@ export declare namespace org {
         noResolve?: pulumi.Input<boolean | undefined>;
         preference?: pulumi.Input<number | undefined>;
         /**
-         * Next-hop IP Address
+         * Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.
          */
         via: pulumi.Input<string>;
     }
@@ -8634,6 +8962,10 @@ export declare namespace org {
          * Only if `mode`!=`dynamic`. Whether PoE capabilities are disabled for a port
          */
         poeDisabled?: pulumi.Input<boolean | undefined>;
+        /**
+         * Only if `mode`!=`dynamic`. Whether Perpetual PoE is enabled; keeps PoE state across reboots
+         */
+        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
         /**
          * PoE priority. enum: `low`, `high`
          */
@@ -9282,7 +9614,11 @@ export declare namespace org {
          */
         aeIdx?: pulumi.Input<number | undefined>;
         /**
-         * To use fast timeout
+         * If `aggregated`==`true`, sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
+         */
+        aeLacpForceUp?: pulumi.Input<boolean | undefined>;
+        /**
+         * To use slow timeout
          */
         aeLacpSlow?: pulumi.Input<boolean | undefined>;
         aggregated?: pulumi.Input<boolean | undefined>;
@@ -10009,18 +10345,24 @@ export declare namespace org {
         write?: pulumi.Input<string | undefined>;
     }
     interface SettingMarvis {
-        autoOperations?: pulumi.Input<inputs.org.SettingMarvisAutoOperations | undefined>;
+        /**
+         * Self-driving network automation settings per domain
+         */
+        selfDriving?: pulumi.Input<inputs.org.SettingMarvisSelfDriving | undefined>;
     }
-    interface SettingMarvisAutoOperations {
-        apInsufficientCapacity?: pulumi.Input<boolean | undefined>;
-        apLoop?: pulumi.Input<boolean | undefined>;
-        apNonCompliant?: pulumi.Input<boolean | undefined>;
-        bouncePortForAbnormalPoeClient?: pulumi.Input<boolean | undefined>;
-        disablePortWhenDdosProtocolViolation?: pulumi.Input<boolean | undefined>;
-        disablePortWhenRogueDhcpServerDetected?: pulumi.Input<boolean | undefined>;
-        gatewayNonCompliant?: pulumi.Input<boolean | undefined>;
-        switchMisconfiguredPort?: pulumi.Input<boolean | undefined>;
-        switchPortStuck?: pulumi.Input<boolean | undefined>;
+    interface SettingMarvisSelfDriving {
+        wan?: pulumi.Input<inputs.org.SettingMarvisSelfDrivingWan | undefined>;
+        wired?: pulumi.Input<inputs.org.SettingMarvisSelfDrivingWired | undefined>;
+        wireless?: pulumi.Input<inputs.org.SettingMarvisSelfDrivingWireless | undefined>;
+    }
+    interface SettingMarvisSelfDrivingWan {
+        enabled?: pulumi.Input<boolean | undefined>;
+    }
+    interface SettingMarvisSelfDrivingWired {
+        enabled?: pulumi.Input<boolean | undefined>;
+    }
+    interface SettingMarvisSelfDrivingWireless {
+        enabled?: pulumi.Input<boolean | undefined>;
     }
     interface SettingMgmt {
         /**
@@ -10037,6 +10379,10 @@ export declare namespace org {
         useWxtunnel?: pulumi.Input<boolean | undefined>;
     }
     interface SettingMistNac {
+        /**
+         * allow clients to connect even when the user cert failed. TEAP authenticates both Machine Cert and User Cert. When enabled, clients who only succeed Machine Cert authentication will be accepted.
+         */
+        allowTeapMachineAuthOnly?: pulumi.Input<boolean | undefined>;
         /**
          * List of PEM-encoded ca certs
          */
@@ -10070,6 +10416,10 @@ export declare namespace org {
          */
         idpUserCertLookupField?: pulumi.Input<string | undefined>;
         idps?: pulumi.Input<pulumi.Input<inputs.org.SettingMistNacIdp>[] | undefined>;
+        /**
+         * MDM (Mobile Device Management) CoA configuration
+         */
+        mdm?: pulumi.Input<inputs.org.SettingMistNacMdm | undefined>;
         /**
          * radius server cert to be presented in EAP TLS
          */
@@ -10121,6 +10471,12 @@ export declare namespace org {
          */
         userRealms: pulumi.Input<pulumi.Input<string>[]>;
     }
+    interface SettingMistNacMdm {
+        /**
+         * CoA type to send. enum: `reauth`, `disconnect`
+         */
+        coaType?: pulumi.Input<string | undefined>;
+    }
     interface SettingMistNacServerCert {
         cert?: pulumi.Input<string | undefined>;
         key?: pulumi.Input<string | undefined>;
@@ -10517,6 +10873,14 @@ export declare namespace org {
          * Whether to trigger EAP reauth when the session ends
          */
         eapReauth?: pulumi.Input<boolean | undefined>;
+        /**
+         * Enable Beacon Protection; default is false for better compatibility
+         */
+        enableBeaconProtection?: pulumi.Input<boolean | undefined>;
+        /**
+         * Enable GCMP-256 encryption suite; default is false for better compatibility
+         */
+        enableGcmp256?: pulumi.Input<boolean | undefined>;
         /**
          * Whether to enable MAC Auth, uses the same auth_servers
          */
@@ -11945,6 +12309,10 @@ export declare namespace site {
          * Optional, for ERB or CLOS, you can either use esilag to upstream routers or to also be the virtual-gateway. When `routedAt` != `core`, whether to do virtual-gateway at core as well
          */
         coreAsBorder?: pulumi.Input<boolean | undefined>;
+        /**
+         * Whether to route management traffic inband; routes will be propagated to downstream switches
+         */
+        enableInbandMgmt?: pulumi.Input<boolean | undefined>;
         /**
          * if the mangement traffic goes inbnd, during installation, only the border/core switches are connected to the Internet to allow initial configuration to be pushed down and leave the downstream access switches stay in the Factory Default state enabling inband-ztp allows upstream switches to use LLDP to assign IP and gives Internet to downstream switches in that state
          */
@@ -12148,7 +12516,7 @@ export declare namespace site {
         noResolve?: pulumi.Input<boolean | undefined>;
         preference?: pulumi.Input<number | undefined>;
         /**
-         * Next-hop IP Address
+         * Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.
          */
         via: pulumi.Input<string>;
     }
@@ -12164,7 +12532,7 @@ export declare namespace site {
         noResolve?: pulumi.Input<boolean | undefined>;
         preference?: pulumi.Input<number | undefined>;
         /**
-         * Next-hop IP Address
+         * Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.
          */
         via: pulumi.Input<string>;
     }
@@ -12379,6 +12747,10 @@ export declare namespace site {
          * Only if `mode`!=`dynamic`. Whether PoE capabilities are disabled for a port
          */
         poeDisabled?: pulumi.Input<boolean | undefined>;
+        /**
+         * Only if `mode`!=`dynamic`. Whether Perpetual PoE is enabled; keeps PoE state across reboots
+         */
+        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
         /**
          * PoE priority. enum: `low`, `high`
          */
@@ -13027,7 +13399,11 @@ export declare namespace site {
          */
         aeIdx?: pulumi.Input<number | undefined>;
         /**
-         * To use fast timeout
+         * If `aggregated`==`true`, sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
+         */
+        aeLacpForceUp?: pulumi.Input<boolean | undefined>;
+        /**
+         * To use slow timeout
          */
         aeLacpSlow?: pulumi.Input<boolean | undefined>;
         aggregated?: pulumi.Input<boolean | undefined>;
@@ -13266,6 +13642,12 @@ export declare namespace site {
          */
         enabled?: pulumi.Input<boolean | undefined>;
     }
+    interface SettingApSyntheticTest {
+        /**
+         * List or Comma separated list of additional VLAN IDs (on the LAN side or from other WLANs) should we be forwarding bonjour queries/responses
+         */
+        additionalVlanIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    }
     interface SettingAutoUpgrade {
         /**
          * Custom versions for different models. Property key is the model name (e.g. "AP41")
@@ -13676,6 +14058,36 @@ export declare namespace site {
         protocol?: pulumi.Input<string | undefined>;
         subnets: pulumi.Input<pulumi.Input<string>[]>;
     }
+    interface SettingIotproxy {
+        enabled?: pulumi.Input<boolean | undefined>;
+        /**
+         * Visionline integration settings for IoT proxy
+         */
+        visionline?: pulumi.Input<inputs.site.SettingIotproxyVisionline | undefined>;
+    }
+    interface SettingIotproxyVisionline {
+        /**
+         * Access ID for the Visionline service
+         */
+        accessId?: pulumi.Input<string | undefined>;
+        enabled?: pulumi.Input<boolean | undefined>;
+        /**
+         * Hostname or IP of the Visionline collector
+         */
+        host?: pulumi.Input<string | undefined>;
+        /**
+         * Password for the Visionline service
+         */
+        password?: pulumi.Input<string | undefined>;
+        /**
+         * TCP port of the Visionline collector
+         */
+        port?: pulumi.Input<number | undefined>;
+        /**
+         * Username for the Visionline service
+         */
+        username?: pulumi.Input<string | undefined>;
+    }
     interface SettingJuniperSrx {
         /**
          * auto_upgrade device first time it is onboarded
@@ -13977,6 +14389,18 @@ export declare namespace site {
          */
         keepWlansUpIfDown?: pulumi.Input<boolean | undefined>;
     }
+    interface SettingVarsAnnotations {
+        /**
+         * User-provided note to describe what this var was created for
+         */
+        note?: pulumi.Input<string | undefined>;
+        /**
+         * Used to identify where to enumerate / auto-complete the field from. Default is `generic` (plain string, no special handling).
+         *
+         * enum: `generic`, `mxtunnelId`
+         */
+        type?: pulumi.Input<string | undefined>;
+    }
     interface SettingVna {
         /**
          * Enable Virtual Network Assistant (using SUB-VNA license). This applied to AP / Switch / Gateway
@@ -14158,6 +14582,14 @@ export declare namespace site {
          * Whether to trigger EAP reauth when the session ends
          */
         eapReauth?: pulumi.Input<boolean | undefined>;
+        /**
+         * Enable Beacon Protection; default is false for better compatibility
+         */
+        enableBeaconProtection?: pulumi.Input<boolean | undefined>;
+        /**
+         * Enable GCMP-256 encryption suite; default is false for better compatibility
+         */
+        enableGcmp256?: pulumi.Input<boolean | undefined>;
         /**
          * Whether to enable MAC Auth, uses the same auth_servers
          */