catalystwan 0.41.2__py3-none-any.whl → 0.41.2.dev0__py3-none-any.whl

catalystwan/models/policy/{definitions → definition}/access_control_list.py

@@ -1,31 +1,36 @@
 # Copyright 2024 Cisco Systems, Inc. and its affiliates
 
 from ipaddress import IPv4Address, IPv4Network
-from typing import Any, List, Literal, Set, Tuple, Union
+from typing import List, Literal, Set, Tuple, Union
 from uuid import UUID
 
 from pydantic import ConfigDict, Field
 from typing_extensions import Annotated
 
+from catalystwan.models.common import IcmpMsgType
 from catalystwan.models.policy.policy_definition import (
+    AcceptDropActionType,
+    ActionSet,
     ClassMapAction,
     ClassMapListEntry,
     CountAction,
-    DefaultAction,
     DefinitionWithSequencesCommonBase,
     DestinationDataPrefixListEntry,
     DestinationIPEntry,
     DestinationPortEntry,
     DSCPEntry,
+    ICMPMessageEntry,
     LogAction,
     Match,
     MirrorAction,
-    NextHopEntry,
+    NextHopActionEntry,
     PacketLengthEntry,
     PLPEntry,
     PolicerAction,
-    PolicyActionType,
+    PolicyAcceptDropAction,
     PolicyDefinitionBase,
+    PolicyDefinitionGetResponse,
+    PolicyDefinitionId,
     PolicyDefinitionSequenceBase,
     ProtocolEntry,
     Reference,
@@ -43,6 +48,7 @@ AclPolicySequenceMatchEntry = Annotated[
         DestinationIPEntry,
         DestinationPortEntry,
         DSCPEntry,
+        ICMPMessageEntry,
         PacketLengthEntry,
         PLPEntry,
         ProtocolEntry,
@@ -54,7 +60,16 @@ AclPolicySequenceMatchEntry = Annotated[
     Field(discriminator="field"),
 ]
 
-AclPolicySequenceActions = Any  # TODO
+AclPolicySequenceActions = Annotated[
+    Union[
+        CountAction,
+        LogAction,
+        MirrorAction,
+        ClassMapAction,
+        PolicerAction,
+    ],
+    Field(discriminator="type"),
+]
 
 
 class AclPolicyHeader(PolicyDefinitionBase):
@@ -69,15 +84,18 @@ class AclPolicySequence(PolicyDefinitionSequenceBase):
     sequence_type: Literal["acl"] = Field(
         default="acl", serialization_alias="sequenceType", validation_alias="sequenceType"
     )
-    base_action: PolicyActionType = Field(
+    base_action: AcceptDropActionType = Field(
         default="accept", serialization_alias="baseAction", validation_alias="baseAction"
     )
     match: AclPolicySequenceMatch = AclPolicySequenceMatch()
-    actions: List[AclPolicySequenceActions] = []
+    actions: List[Union[AclPolicySequenceActions, ActionSet]] = []
     model_config = ConfigDict(populate_by_name=True)
 
-    def match_dscp(self, dscp: int) -> None:
-        self._insert_match(DSCPEntry(value=str(dscp)))
+    def match_dscp(self, dscp: List[int]) -> None:
+        self._insert_match(DSCPEntry(value=dscp))
+
+    def match_icmp(self, icmp_message_types: List[IcmpMsgType]) -> None:
+        self._insert_match(ICMPMessageEntry(value=icmp_message_types))
 
     def match_packet_length(self, packet_lengths: Tuple[int, int]) -> None:
         self._insert_match(PacketLengthEntry.from_range(packet_lengths))
@@ -92,7 +110,7 @@ class AclPolicySequence(PolicyDefinitionSequenceBase):
         self._insert_match(ProtocolEntry.from_protocol_set(protocols))
 
     def match_source_data_prefix_list(self, data_prefix_list_id: UUID) -> None:
-        self._insert_match(SourceDataPrefixListEntry(ref=data_prefix_list_id))
+        self._insert_match(SourceDataPrefixListEntry(ref=[data_prefix_list_id]))
 
     def match_source_ip(self, networks: List[IPv4Network]) -> None:
         self._insert_match(SourceIPEntry.from_ipv4_networks(networks))
@@ -101,7 +119,7 @@ class AclPolicySequence(PolicyDefinitionSequenceBase):
         self._insert_match(SourcePortEntry.from_port_set_and_ranges(ports, port_ranges))
 
     def match_destination_data_prefix_list(self, data_prefix_list_id: UUID) -> None:
-        self._insert_match(DestinationDataPrefixListEntry(ref=data_prefix_list_id))
+        self._insert_match(DestinationDataPrefixListEntry(ref=[data_prefix_list_id]))
 
     def match_destination_ip(self, networks: List[IPv4Network]) -> None:
         self._insert_match(DestinationIPEntry.from_ipv4_networks(networks))
@@ -123,11 +141,11 @@ class AclPolicySequence(PolicyDefinitionSequenceBase):
 
     @accept_action
     def associate_dscp_action(self, dscp: int) -> None:
-        self._insert_action_in_set(DSCPEntry(value=str(dscp)))
+        self._insert_action_in_set(DSCPEntry(value=[dscp]))
 
     @accept_action
     def associate_next_hop_action(self, next_hop: IPv4Address) -> None:
-        self._insert_action_in_set(NextHopEntry(value=next_hop))
+        self._insert_action_in_set(NextHopActionEntry(value=next_hop))
 
     @accept_action
     def associate_mirror_action(self, mirror_list_id: UUID) -> None:
@@ -144,20 +162,32 @@ class AclPolicySequence(PolicyDefinitionSequenceBase):
 
 class AclPolicy(AclPolicyHeader, DefinitionWithSequencesCommonBase):
     sequences: List[AclPolicySequence] = []
-    default_action: DefaultAction = Field(
-        default=DefaultAction(type="drop"),
+    default_action: PolicyAcceptDropAction = Field(
+        default=PolicyAcceptDropAction(type="drop"),
         serialization_alias="defaultAction",
         validation_alias="defaultAction",
     )
     model_config = ConfigDict(populate_by_name=True)
 
-    def add_acl_sequence(
-        self, name: str = "Access Control List", base_action: PolicyActionType = "accept"
+    def set_default_action(self, action: AcceptDropActionType):
+        self.default_action = PolicyAcceptDropAction(type=action)
+
+    def add_sequence(
+        self, id_: int, name: str = "Access Control List", base_action: AcceptDropActionType = "accept"
     ) -> AclPolicySequence:
         seq = AclPolicySequence(
+            sequence_id=id_,
             sequence_name=name,
             base_action=base_action,
             sequence_ip_type="ipv4",
         )
         self.add(seq)
         return seq
+
+
+class AclPolicyEditPayload(AclPolicy, PolicyDefinitionId):
+    pass
+
+
+class AclPolicyGetResponse(AclPolicy, PolicyDefinitionGetResponse):
+    pass

catalystwan/models/policy/{definitions → definition}/access_control_list_ipv6.py

@@ -1,17 +1,18 @@
 # Copyright 2024 Cisco Systems, Inc. and its affiliates
 
-from ipaddress import IPv4Address, IPv6Network
-from typing import Any, List, Literal, Set, Tuple, Union
+from ipaddress import IPv6Address, IPv6Network
+from typing import List, Literal, Set, Tuple, Union
 from uuid import UUID
 
 from pydantic import ConfigDict, Field
 from typing_extensions import Annotated
 
+from catalystwan.models.common import AcceptDropActionType
 from catalystwan.models.policy.policy_definition import (
+    ActionSet,
     ClassMapAction,
     ClassMapListEntry,
     CountAction,
-    DefaultAction,
     DefinitionWithSequencesCommonBase,
     DestinationDataIPv6PrefixListEntry,
     DestinationIPv6Entry,
@@ -20,12 +21,14 @@ from catalystwan.models.policy.policy_definition import (
     Match,
     MirrorAction,
     NextHeaderEntry,
-    NextHopEntry,
+    NextHopActionEntry,
     PacketLengthEntry,
     PLPEntry,
     PolicerAction,
-    PolicyActionType,
+    PolicyAcceptDropAction,
     PolicyDefinitionBase,
+    PolicyDefinitionGetResponse,
+    PolicyDefinitionId,
     PolicyDefinitionSequenceBase,
     Reference,
     SourceDataIPv6PrefixListEntry,
@@ -54,7 +57,16 @@ AclIPv6PolicySequenceMatchEntry = Annotated[
     Field(discriminator="field"),
 ]
 
-AclIPv6PolicySequenceActions = Any  # TODO
+AclIPv6PolicySequenceActions = Annotated[
+    Union[
+        CountAction,
+        LogAction,
+        MirrorAction,
+        ClassMapAction,
+        PolicerAction,
+    ],
+    Field(discriminator="type"),
+]
 
 
 class AclIPv6PolicyHeader(PolicyDefinitionBase):
@@ -69,11 +81,11 @@ class AclIPv6PolicySequence(PolicyDefinitionSequenceBase):
     sequence_type: Literal["aclv6"] = Field(
         default="aclv6", serialization_alias="sequenceType", validation_alias="sequenceType"
     )
-    base_action: PolicyActionType = Field(
+    base_action: AcceptDropActionType = Field(
         default="accept", serialization_alias="baseAction", validation_alias="baseAction"
     )
     match: AclIPv6PolicySequenceMatch = AclIPv6PolicySequenceMatch()
-    actions: List[AclIPv6PolicySequenceActions] = []
+    actions: List[Union[AclIPv6PolicySequenceActions, ActionSet]] = []
     model_config = ConfigDict(populate_by_name=True)
 
     def match_next_header(self, next_header: int) -> None:
@@ -89,7 +101,7 @@ class AclIPv6PolicySequence(PolicyDefinitionSequenceBase):
         self._insert_match(PLPEntry(value="high"))
 
     def match_source_data_prefix_list(self, data_prefix_list_id: UUID) -> None:
-        self._insert_match(SourceDataIPv6PrefixListEntry(ref=data_prefix_list_id))
+        self._insert_match(SourceDataIPv6PrefixListEntry(ref=[data_prefix_list_id]))
 
     def match_source_ip(self, networks: List[IPv6Network]) -> None:
         self._insert_match(SourceIPv6Entry.from_ipv6_networks(networks))
@@ -98,7 +110,7 @@ class AclIPv6PolicySequence(PolicyDefinitionSequenceBase):
         self._insert_match(SourcePortEntry.from_port_set_and_ranges(ports, port_ranges))
 
     def match_destination_data_prefix_list(self, data_prefix_list_id: UUID) -> None:
-        self._insert_match(DestinationDataIPv6PrefixListEntry(ref=data_prefix_list_id))
+        self._insert_match(DestinationDataIPv6PrefixListEntry(ref=[data_prefix_list_id]))
 
     def match_destination_ip(self, networks: List[IPv6Network]) -> None:
         self._insert_match(DestinationIPv6Entry.from_ipv6_networks(networks))
@@ -112,8 +124,8 @@ class AclIPv6PolicySequence(PolicyDefinitionSequenceBase):
     def match_class_map_list_entry(self, class_map_list_id: UUID) -> None:
         self._insert_match(ClassMapListEntry(ref=class_map_list_id))
 
-    def match_traffic_class(self, traffic_class: int) -> None:
-        self._insert_match(TrafficClassEntry(value=str(traffic_class)))
+    def match_traffic_class(self, traffic_class: List[int]) -> None:
+        self._insert_match(TrafficClassEntry(value=" ".join([str(tc) for tc in traffic_class])))
 
     def associate_count_action(self, counter_name: str) -> None:
         self._insert_action(CountAction(parameter=counter_name))
@@ -122,8 +134,8 @@ class AclIPv6PolicySequence(PolicyDefinitionSequenceBase):
         self._insert_action(LogAction())
 
     @accept_action
-    def associate_next_hop_action(self, next_hop: IPv4Address) -> None:
-        self._insert_action_in_set(NextHopEntry(value=next_hop))
+    def associate_next_hop_action(self, next_hop: IPv6Address) -> None:
+        self._insert_action_in_set(NextHopActionEntry(value=next_hop))
 
     @accept_action
     def associate_traffic_class_action(self, traffic_class: int) -> None:
@@ -144,20 +156,32 @@ class AclIPv6PolicySequence(PolicyDefinitionSequenceBase):
 
 class AclIPv6Policy(AclIPv6PolicyHeader, DefinitionWithSequencesCommonBase):
     sequences: List[AclIPv6PolicySequence] = []
-    default_action: DefaultAction = Field(
-        default=DefaultAction(type="drop"),
+    default_action: PolicyAcceptDropAction = Field(
+        default=PolicyAcceptDropAction(type="drop"),
         serialization_alias="defaultAction",
         validation_alias="defaultAction",
     )
     model_config = ConfigDict(populate_by_name=True)
 
-    def add_acl_sequence(
-        self, name: str = "Access Control List", base_action: PolicyActionType = "accept"
+    def set_default_action(self, action: AcceptDropActionType):
+        self.default_action = PolicyAcceptDropAction(type=action)
+
+    def add_sequence(
+        self, id_: int, name: str = "Access Control List", base_action: AcceptDropActionType = "accept"
     ) -> AclIPv6PolicySequence:
         seq = AclIPv6PolicySequence(
+            sequence_id=id_,
             sequence_name=name,
             base_action=base_action,
             sequence_ip_type="ipv6",
         )
         self.add(seq)
         return seq
+
+
+class AclIPv6PolicyEditPayload(AclIPv6Policy, PolicyDefinitionId):
+    pass
+
+
+class AclIPv6PolicyGetResponse(AclIPv6Policy, PolicyDefinitionGetResponse):
+    pass

catalystwan/models/policy/definition/aip.py

@@ -0,0 +1,60 @@
+# Copyright 2024 Cisco Systems, Inc. and its affiliates
+
+from typing import Literal, Optional
+
+from pydantic import BaseModel, ConfigDict, Field, model_validator
+from typing_extensions import Self
+
+from catalystwan.models.policy.policy_definition import (
+    PolicyDefinitionBase,
+    PolicyDefinitionGetResponse,
+    PolicyDefinitionId,
+    Reference,
+)
+
+TlsDecryptionAction = Literal["decrypt", "neverDecrypt", "skipDecrypt"]
+
+
+class AdvancedInspectionProfileDefinition(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+
+    tls_decryption_action: TlsDecryptionAction = Field(
+        validation_alias="tlsDecryptionAction", serialization_alias="tlsDecryptionAction"
+    )
+
+    advanced_malware_protection: Optional[Reference] = Field(
+        default=None, validation_alias="advancedMalwareProtection", serialization_alias="advancedMalwareProtection"
+    )
+
+    intrusion_prevention: Optional[Reference] = Field(
+        default=None, validation_alias="intrusionPrevention", serialization_alias="intrusionPrevention"
+    )
+    url_filtering: Optional[Reference] = Field(
+        default=None, validation_alias="urlFiltering", serialization_alias="urlFiltering"
+    )
+
+    ssl_utd_decrypt_profile: Optional[Reference] = Field(
+        default=None, validation_alias="sslUtdDecryptProfile", serialization_alias="sslUtdDecryptProfile"
+    )
+
+    @model_validator(mode="after")
+    def check_at_least_one_optional_filled(self) -> Self:
+        if not any([self.advanced_malware_protection, self.intrusion_prevention, self.url_filtering]):
+            raise ValueError(
+                "At least one of Intrusion Prevention, URL Filtering, Advanced Malware Protection shall be filled."
+            )
+        return self
+
+
+class AdvancedInspectionProfilePolicy(PolicyDefinitionBase):
+    type: Literal["advancedInspectionProfile"] = "advancedInspectionProfile"
+    mode: Literal["unified"] = "unified"
+    definition: AdvancedInspectionProfileDefinition
+
+
+class AdvancedInspectionProfilePolicyEditPayload(AdvancedInspectionProfilePolicy, PolicyDefinitionId):
+    pass
+
+
+class AdvancedInspectionProfilePolicyGetResponse(AdvancedInspectionProfilePolicy, PolicyDefinitionGetResponse):
+    pass

catalystwan/models/policy/definition/amp.py

@@ -0,0 +1,65 @@
+# Copyright 2024 Cisco Systems, Inc. and its affiliates
+
+from typing import List, Literal, Optional
+
+from pydantic import BaseModel, ConfigDict, Field
+
+from catalystwan.models.common import (
+    AmpFileAlertLevel,
+    AmpFileAnalysisFileTypes,
+    AmpFileAnalysisServer,
+    AmpFileReputationServer,
+    PolicyModeType,
+    VpnId,
+)
+from catalystwan.models.policy.policy_definition import (
+    PolicyDefinitionBase,
+    PolicyDefinitionGetResponse,
+    PolicyDefinitionId,
+)
+
+OptionalAmpFileAnalysisServer = Literal["", AmpFileAnalysisServer]
+OptionalAmpFileAlertLevel = Literal["", AmpFileAlertLevel]
+
+
+class AdvancedMalwareProtectionDefinition(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+    match_all_vpn: bool = Field(validation_alias="matchAllVpn", serialization_alias="matchAllVpn")
+    file_reputation_cloud_server: AmpFileReputationServer = Field(
+        validation_alias="fileReputationCloudServer", serialization_alias="fileReputationCloudServer"
+    )
+    file_reputation_est_server: AmpFileReputationServer = Field(
+        validation_alias="fileReputationEstServer", serialization_alias="fileReputationEstServer"
+    )
+    file_reputation_alert: AmpFileAlertLevel = Field(
+        validation_alias="fileReputationAlert", serialization_alias="fileReputationAlert"
+    )
+    file_analysis_enabled: Optional[bool] = Field(
+        default=False, validation_alias="fileAnalysisEnabled", serialization_alias="fileAnalysisEnabled"
+    )
+    file_analysis_file_types: List[AmpFileAnalysisFileTypes] = Field(
+        default_factory=list, validation_alias="fileAnalysisFileTypes", serialization_alias="fileAnalysisFileTypes"
+    )
+    file_analysis_alert: OptionalAmpFileAlertLevel = Field(
+        default="", validation_alias="fileAnalysisAlert", serialization_alias="fileAnalysisAlert"
+    )
+    file_analysis_cloud_server: OptionalAmpFileAnalysisServer = Field(
+        default="", validation_alias="fileAnalysisCloudServer", serialization_alias="fileAnalysisCloudServer"
+    )
+    target_vpns: List[VpnId] = Field(
+        default_factory=list, validation_alias="targetVpns", serialization_alias="targetVpns"
+    )
+
+
+class AdvancedMalwareProtectionPolicy(PolicyDefinitionBase):
+    type: Literal["advancedMalwareProtection"] = "advancedMalwareProtection"
+    mode: PolicyModeType = "security"
+    definition: AdvancedMalwareProtectionDefinition
+
+
+class AdvancedMalwareProtectionPolicyEditPayload(AdvancedMalwareProtectionPolicy, PolicyDefinitionId):
+    pass
+
+
+class AdvancedMalwareProtectionPolicyGetResponse(AdvancedMalwareProtectionPolicy, PolicyDefinitionGetResponse):
+    pass

catalystwan/models/policy/definition/app_route.py

@@ -0,0 +1,246 @@
+# Copyright 2024 Cisco Systems, Inc. and its affiliates
+from ipaddress import IPv4Network, IPv6Network
+from typing import List, Literal, Optional, Set, Tuple, Union, overload
+from uuid import UUID
+
+from pydantic import ConfigDict, Field
+from typing_extensions import Annotated
+
+from catalystwan.models.common import (
+    DestinationRegion,
+    DNSEntryType,
+    SequenceIpType,
+    ServiceAreaValue,
+    TLOCColor,
+    TrafficCategory,
+    TrafficTargetType,
+)
+from catalystwan.models.policy.policy_definition import (
+    AppListEntry,
+    BackupSlaPrefferedColorAction,
+    CloudSaaSAction,
+    CountAction,
+    DefinitionWithSequencesCommonBase,
+    DestinationDataIPv6PrefixListEntry,
+    DestinationDataPrefixListEntry,
+    DestinationIPEntry,
+    DestinationIPv6Entry,
+    DestinationPortEntry,
+    DestinationRegionEntry,
+    DNSAppListEntry,
+    DNSEntry,
+    DSCPEntry,
+    LogAction,
+    Match,
+    PLPEntry,
+    PLPEntryType,
+    PolicyActionBase,
+    PolicyDefinitionBase,
+    PolicyDefinitionGetResponse,
+    PolicyDefinitionId,
+    PolicyDefinitionSequenceBase,
+    ProtocolEntry,
+    SaaSAppListEntry,
+    ServiceAreaEntry,
+    SlaClassAction,
+    SlaNotMetAction,
+    SourceDataIPv6PrefixListEntry,
+    SourceDataPrefixListEntry,
+    SourceIPEntry,
+    SourceIPv6Entry,
+    SourcePortEntry,
+    TrafficCategoryEntry,
+    TrafficToEntry,
+)
+
+AppRoutePolicySequenceEntry = Annotated[
+    Union[
+        AppListEntry,
+        DestinationDataIPv6PrefixListEntry,
+        DestinationDataPrefixListEntry,
+        DestinationIPEntry,
+        DestinationIPv6Entry,
+        DestinationPortEntry,
+        DestinationRegionEntry,
+        DNSAppListEntry,
+        DNSEntry,
+        DSCPEntry,
+        PLPEntry,
+        ProtocolEntry,
+        SaaSAppListEntry,
+        ServiceAreaEntry,
+        SourceDataIPv6PrefixListEntry,
+        SourceDataPrefixListEntry,
+        SourceIPEntry,
+        SourceIPv6Entry,
+        SourcePortEntry,
+        TrafficCategoryEntry,
+        TrafficToEntry,
+    ],
+    Field(discriminator="field"),
+]
+
+AppRoutePolicySequenceActionEntry = Annotated[
+    Union[
+        BackupSlaPrefferedColorAction,
+        CloudSaaSAction,
+        CountAction,
+        LogAction,
+        SlaClassAction,
+    ],
+    Field(discriminator="type"),
+]
+
+
+class AppRoutePolicySequenceMatch(Match):
+    entries: List[AppRoutePolicySequenceEntry] = []
+
+
+class AppRoutePolicySequence(PolicyDefinitionSequenceBase):
+    sequence_type: Literal["appRoute"] = Field(
+        default="appRoute", serialization_alias="sequenceType", validation_alias="sequenceType"
+    )
+    match: AppRoutePolicySequenceMatch = AppRoutePolicySequenceMatch()
+    actions: List[AppRoutePolicySequenceActionEntry] = []
+    model_config = ConfigDict(populate_by_name=True)
+
+    def match_app_list(self, app_list_id: UUID) -> None:
+        self._insert_match(AppListEntry(ref=[app_list_id]))
+
+    def match_destination_data_prefix_list(self, data_prefix_list_id: UUID) -> None:
+        self._insert_match(DestinationDataPrefixListEntry(ref=[data_prefix_list_id]))
+
+    def match_destination_ip(self, networks: List[IPv4Network]) -> None:
+        self._insert_match(DestinationIPEntry.from_ipv4_networks(networks))
+
+    def match_destination_ipv6(self, networks: List[IPv6Network]) -> None:
+        self._insert_match(DestinationIPv6Entry.from_ipv6_networks(networks))
+
+    def match_destination_region(self, region: DestinationRegion) -> None:
+        self._insert_match(DestinationRegionEntry(value=region))
+
+    def match_destination_port(self, ports: Set[int] = set(), port_ranges: List[Tuple[int, int]] = []) -> None:
+        self._insert_match(DestinationPortEntry.from_port_set_and_ranges(ports, port_ranges))
+
+    def match_dns(self, dns: DNSEntryType) -> None:
+        self._insert_match(DNSEntry(value=dns))
+
+    def match_dns_app_list(self, dns_app_list_id: UUID) -> None:
+        self._insert_match(DNSAppListEntry(ref=dns_app_list_id))
+
+    def match_dscp(self, dscp: List[int]) -> None:
+        self._insert_match(DSCPEntry(value=dscp))
+
+    def match_plp(self, plp: PLPEntryType) -> None:
+        self._insert_match(PLPEntry(value=plp))
+
+    def match_protocols(self, protocols: Set[int]) -> None:
+        self._insert_match(ProtocolEntry.from_protocol_set(protocols))
+
+    def match_saas_app_list(self, saas_app_list_id: UUID) -> None:
+        self._insert_match(SaaSAppListEntry(ref=saas_app_list_id))
+
+    def match_service_areas(self, service_areas: Set[ServiceAreaValue]) -> None:
+        self._insert_match(ServiceAreaEntry(value=list(service_areas)))
+
+    def match_source_data_prefix_list(self, data_prefix_list_id: UUID) -> None:
+        self._insert_match(SourceDataPrefixListEntry(ref=[data_prefix_list_id]))
+
+    def match_source_ip(self, networks: List[IPv4Network]) -> None:
+        self._insert_match(SourceIPEntry.from_ipv4_networks(networks))
+
+    def match_source_ipv6(self, networks: List[IPv6Network]) -> None:
+        self._insert_match(SourceIPv6Entry.from_ipv6_networks(networks))
+
+    def match_source_port(self, ports: Set[int] = set(), port_ranges: List[Tuple[int, int]] = []) -> None:
+        self._insert_match(SourcePortEntry.from_port_set_and_ranges(ports, port_ranges))
+
+    def match_traffic_category(self, traffic_category: TrafficCategory) -> None:
+        self._insert_match(TrafficCategoryEntry(value=traffic_category))
+
+    def match_traffic_to(self, traffic_to: TrafficTargetType) -> None:
+        self._insert_match(TrafficToEntry(value=traffic_to))
+
+    def associate_backup_sla_preferred_color_action(self, tloc_colors: List[TLOCColor]) -> None:
+        self._insert_action(BackupSlaPrefferedColorAction(parameter=tloc_colors))
+
+    def associate_cloud_saas_action(self) -> None:
+        self._insert_action(CloudSaaSAction())
+
+    def associate_count_action(self, counter_name: str) -> None:
+        self._insert_action(CountAction(parameter=counter_name))
+
+    def associate_log_action(self) -> None:
+        self._insert_action(LogAction())
+
+    @overload
+    def associate_sla_class_action(
+        self, sla_class: UUID, not_met_action: Optional[SlaNotMetAction] = None, *, preferred_color: List[TLOCColor]
+    ) -> None:
+        ...
+
+    @overload
+    def associate_sla_class_action(
+        self, sla_class: UUID, not_met_action: Optional[SlaNotMetAction] = None, *, preferred_color_group: UUID
+    ) -> None:
+        ...
+
+    def associate_sla_class_action(
+        self,
+        sla_class: UUID,
+        not_met_action: Optional[SlaNotMetAction] = None,
+        *,
+        preferred_color: Optional[List[TLOCColor]] = None,
+        preferred_color_group: Optional[UUID] = None,
+    ) -> None:
+        if preferred_color is not None:
+            action = SlaClassAction.from_params(
+                sla_class=sla_class, not_met_action=not_met_action, preferred_color=preferred_color
+            )
+        elif preferred_color_group is not None:
+            action = SlaClassAction.from_params(
+                sla_class=sla_class, not_met_action=not_met_action, preferred_color_group=preferred_color_group
+            )
+        else:
+            action = SlaClassAction()
+        self._insert_action(action)
+
+
+class AppRouteDefaultAction(PolicyActionBase):
+    type: Literal["slaClass"] = "slaClass"
+    ref: UUID
+
+
+class AppRoutePolicyHeader(PolicyDefinitionBase):
+    type: Literal["appRoute"] = "appRoute"
+
+
+class AppRoutePolicy(AppRoutePolicyHeader, DefinitionWithSequencesCommonBase):
+    sequences: List[AppRoutePolicySequence] = []
+    default_action: Optional[AppRouteDefaultAction] = Field(
+        default=None, serialization_alias="defaultAction", validation_alias="defaultAction"
+    )
+    model_config = ConfigDict(populate_by_name=True)
+
+    def set_default_action(self, sla_class: Optional[UUID]) -> None:
+        self.default_action = AppRouteDefaultAction(ref=sla_class) if sla_class else None
+
+    def add_sequence(
+        self,
+        name: str = "App Route",
+        sequence_ip_type: SequenceIpType = "ipv4",
+    ) -> AppRoutePolicySequence:
+        seq = AppRoutePolicySequence(
+            sequence_name=name,
+            sequence_ip_type=sequence_ip_type,
+        )
+        self.add(seq)
+        return seq
+
+
+class AppRoutePolicyEditPayload(AppRoutePolicy, PolicyDefinitionId):
+    pass
+
+
+class AppRoutePolicyGetResponse(AppRoutePolicy, PolicyDefinitionGetResponse):
+    pass