catalystwan 0.41.2__py3-none-any.whl → 0.41.2.dev1__py3-none-any.whl

catalystwan/models/configuration/feature_profile/sdwan/embedded_security/ngfirewall.py

@@ -0,0 +1,493 @@
+# Copyright 2024 Cisco Systems, Inc. and its affiliates
+from ipaddress import IPv4Network
+from typing import List, Literal, Optional, Union
+from uuid import UUID
+
+from pydantic import AliasPath, BaseModel, ConfigDict, Field, ValidationError, model_validator
+from typing_extensions import Self
+
+from catalystwan.api.configuration_groups.parcel import Global, Variable, _ParcelBase, as_global, as_variable
+from catalystwan.models.common import GeoLocation, ProtocolName, SecurityBaseAction
+from catalystwan.models.configuration.feature_profile.common import RefIdItem, RefIdList
+
+DefaultAction = Literal["pass", "drop"]
+SequenceType = Literal["ngfirewall"]
+AipActionType = Literal["advancedInspectionProfile"]
+SequenceActionType = Literal["log", "connectionEvents"]
+
+
+class Ipv4Match(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    ipv4_value: Union[Global[List[IPv4Network]], Variable] = Field(
+        validation_alias="ipv4Value", serialization_alias="ipv4Value"
+    )
+
+    @classmethod
+    def create_with_ip_networks(cls, ip_networks: List[IPv4Network]) -> Self:
+        return cls(ipv4_value=as_global(ip_networks))
+
+    @classmethod
+    def create_with_variable(cls, variable_name: str) -> Self:
+        return cls(ipv4_value=as_variable(variable_name))
+
+
+class FqdnMatch(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    fqdn_value: Union[Global[List[str]], Variable] = Field(
+        validation_alias="fqdnValue", serialization_alias="fqdnValue"
+    )
+
+    @classmethod
+    def from_domain_names(cls, domain_names: List[str]) -> Self:
+        return cls(fqdn_value=as_global(domain_names))
+
+
+class PortMatch(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    port_value: Union[Global[List[str]], Variable] = Field(
+        validation_alias="portValue", serialization_alias="portValue"
+    )
+
+    @classmethod
+    def from_str_list(cls, ports: List[str]) -> Self:
+        return cls(port_value=as_global(ports))
+
+
+class SourceDataPrefixList(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    source_data_prefix_list: RefIdList = Field(
+        validation_alias="sourceDataPrefixList", serialization_alias="sourceDataPrefixList"
+    )
+
+    @classmethod
+    def create(cls, source_data_prefix_list: List[UUID]) -> Self:
+        return cls(source_data_prefix_list=RefIdList.from_uuids(uuids=source_data_prefix_list))
+
+
+class DestinationDataPrefixList(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    destination_data_prefix_list: RefIdList = Field(
+        validation_alias="destinationDataPrefixList", serialization_alias="destinationDataPrefixList"
+    )
+
+    @classmethod
+    def create(cls, uuids: List[UUID]) -> Self:
+        return cls(destination_data_prefix_list=RefIdList.from_uuids(uuids=uuids))
+
+
+class DestinationFqdnList(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    destination_fqdn_list: RefIdList = Field(
+        validation_alias="destinationFqdnList", serialization_alias="destinationFqdnList"
+    )
+
+    @classmethod
+    def create(cls, uuids: List[UUID]) -> Self:
+        return cls(destination_fqdn_list=RefIdList.from_uuids(uuids=uuids))
+
+
+class SourceGeoLocationList(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    source_geo_location_list: RefIdList = Field(
+        validation_alias="sourceGeoLocationList", serialization_alias="sourceGeoLocationList"
+    )
+
+    @classmethod
+    def create(cls, uuids: List[UUID]) -> Self:
+        return cls(source_geo_location_list=RefIdList.from_uuids(uuids=uuids))
+
+
+class DestinationGeoLocationList(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    destination_geo_location_list: RefIdList = Field(
+        validation_alias="destinationGeoLocationList", serialization_alias="destinationGeoLocationList"
+    )
+
+    @classmethod
+    def create(cls, uuids: List[UUID]) -> Self:
+        return cls(destination_geo_location_list=RefIdList.from_uuids(uuids=uuids))
+
+
+class SourcePortList(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    source_port_list: RefIdList = Field(validation_alias="sourcePortList", serialization_alias="sourcePortList")
+
+    @classmethod
+    def create(cls, uuids: List[UUID]) -> Self:
+        return cls(source_port_list=RefIdList.from_uuids(uuids=uuids))
+
+
+class DestinationPortList(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    destination_port_list: RefIdList = Field(
+        validation_alias="destinationPortList", serialization_alias="destinationPortList"
+    )
+
+    @classmethod
+    def create(cls, uuids: List[UUID]) -> Self:
+        return cls(destination_port_list=RefIdList.from_uuids(uuids))
+
+
+class SourceScalableGroupTagList(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    source_scalable_group_tag_list: RefIdList = Field(
+        validation_alias="sourceScalableGroupTagList", serialization_alias="sourceScalableGroupTagList"
+    )
+
+    @classmethod
+    def create(cls, uuids: List[UUID]) -> Self:
+        return cls(source_scalable_group_tag_list=RefIdList.from_uuids(uuids))
+
+
+class DestinationScalableGroupTagList(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    destination_scalable_group_tag_list: RefIdList = Field(
+        validation_alias="destinationScalableGroupTagList", serialization_alias="destinationScalableGroupTagList"
+    )
+
+    @classmethod  # from_uuids
+    def create(cls, uuids: List[UUID]) -> Self:
+        return cls(destination_scalable_group_tag_list=RefIdList.from_uuids(uuids))
+
+
+class SourceIdentityList(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    source_identity_list: RefIdList = Field(
+        validation_alias="sourceIdentityList", serialization_alias="sourceIdentityList"
+    )
+
+    @classmethod
+    def create(cls, uuids: List[UUID]) -> Self:
+        return cls(source_identity_list=RefIdList.from_uuids(uuids))
+
+
+class ProtocolNameList(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    protocol_name_list: RefIdList = Field(validation_alias="protocolNameList", serialization_alias="protocolNameList")
+
+    @classmethod
+    def create(cls, uuids: List[UUID]) -> Self:
+        return cls(protocol_name_list=RefIdList.from_uuids(uuids))
+
+
+class AppList(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    app_list: RefIdList = Field(validation_alias="appList", serialization_alias="appList")
+
+    @classmethod
+    def create(cls, uuids: List[UUID]) -> Self:
+        return cls(app_list=RefIdList.from_uuids(uuids))
+
+
+class AppListFlat(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    app_list_flat: RefIdList = Field(validation_alias="appListFlat", serialization_alias="appListFlat")
+
+    @classmethod
+    def create(cls, uuids: List[UUID]) -> Self:
+        return cls(app_list_flat=RefIdList.from_uuids(uuids))
+
+
+class RuleSetList(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    rule_set_list: RefIdList = Field(validation_alias="ruleSetList", serialization_alias="ruleSetList")
+
+    @classmethod
+    def create(cls, uuids: List[UUID]) -> Self:
+        return cls(rule_set_list=RefIdList.from_uuids(uuids))
+
+
+class SourceSecurityGroup(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    source_security_group: RefIdList = Field(
+        validation_alias="sourceSecurityGroup", serialization_alias="sourceSecurityGroup"
+    )
+
+
+class DestinationSecurityGroup(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    destination_security_group: RefIdList = Field(
+        validation_alias="destinationSecurityGroup", serialization_alias="destinationSecurityGroup"
+    )
+
+
+class SourceIp(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    source_ip: Ipv4Match = Field(validation_alias="sourceIp", serialization_alias="sourceIp")
+
+    @classmethod
+    def from_ip_networks(cls, ip_networks: List[IPv4Network]) -> Self:
+        return cls(source_ip=Ipv4Match.create_with_ip_networks(ip_networks))
+
+    @classmethod
+    def from_variable(cls, variable_name: str) -> Self:
+        return cls(source_ip=Ipv4Match.create_with_variable(variable_name))
+
+
+class DestinationIp(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    destination_ip: Ipv4Match = Field(validation_alias="destinationIp", serialization_alias="destinationIp")
+
+    @classmethod
+    def from_ip_networks(cls, ip_networks: List[IPv4Network]) -> Self:
+        return cls(destination_ip=Ipv4Match.create_with_ip_networks(ip_networks))
+
+    @classmethod
+    def from_variable(cls, variable_name: str) -> Self:
+        return cls(destination_ip=Ipv4Match.create_with_variable(variable_name))
+
+
+class DestinationFqdn(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    destination_fqdn: FqdnMatch = Field(validation_alias="destinationFqdn", serialization_alias="destinationFqdn")
+
+    @classmethod
+    def from_domain_names(cls, domain_names: List[str]) -> Self:
+        return cls(destination_fqdn=FqdnMatch.from_domain_names(domain_names))
+
+
+class SourcePort(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    source_port: PortMatch = Field(validation_alias="sourcePort", serialization_alias="sourcePort")
+
+    @classmethod
+    def from_str_list(cls, ports: List[str]) -> Self:
+        return cls(source_port=PortMatch.from_str_list(ports))
+
+
+class DestinationPort(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    destination_port: PortMatch = Field(validation_alias="destinationPort", serialization_alias="destinationPort")
+
+    @classmethod
+    def from_str_list(cls, ports: List[str]) -> Self:
+        return cls(destination_port=PortMatch.from_str_list(ports))
+
+
+class SourceGeoLocation(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    source_geo_loacation: Union[Global[List[GeoLocation]], Variable] = Field(
+        validation_alias="sourceGeoLocation", serialization_alias="sourceGeoLocation"
+    )
+
+    @classmethod
+    def from_geo_locations_list(cls, locations: List[GeoLocation]) -> Self:
+        return cls(source_geo_loacation=Global[List[GeoLocation]](value=locations))
+
+
+class DestinationGeoLocation(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    destination_geo_loacation: Union[Global[List[GeoLocation]], Variable] = Field(
+        validation_alias="destinationGeoLocation", serialization_alias="destinationGeoLocation"
+    )
+
+    @classmethod
+    def from_geo_locations_list(cls, locations: List[GeoLocation]) -> Self:
+        return cls(destination_geo_loacation=Global[List[GeoLocation]](value=locations))
+
+
+class SourceIdentityUser(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    source_identity_user: Global[List[str]] = Field(
+        validation_alias="sourceIdentityUser", serialization_alias="sourceIdentityUser"
+    )
+
+
+class SourceIdentityUserGroup(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    source_identity_user_group: Global[List[str]] = Field(
+        validation_alias="sourceIdentityUserGroup", serialization_alias="sourceIdentityUserGroup"
+    )
+
+
+class App(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    app: Global[List[str]]
+
+
+class AppFamily(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    app_family: Global[List[str]] = Field(validation_alias="appFamily", serialization_alias="appFamily")
+
+
+class Protocol(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    protocol: Global[List[str]]
+
+    @classmethod
+    def from_protocol_id_list(cls, ids: List[str]) -> Self:
+        return cls(protocol=as_global(ids))
+
+
+class ProtocolNameMatch(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    protocol_name: Global[List[ProtocolName]] = Field(
+        validation_alias="protocolName", serialization_alias="protocolName"
+    )
+
+    @classmethod
+    def from_protocol_name_list(cls, protocols: List[ProtocolName]) -> Self:
+        return cls(protocol_name=Global[List[ProtocolName]](value=protocols))
+
+
+MatchEntry = Union[
+    App,
+    AppFamily,
+    AppList,
+    AppListFlat,
+    DestinationDataPrefixList,
+    DestinationFqdn,
+    DestinationFqdnList,
+    DestinationGeoLocation,
+    DestinationGeoLocationList,
+    DestinationIp,
+    DestinationPort,
+    DestinationPortList,
+    DestinationScalableGroupTagList,
+    DestinationSecurityGroup,
+    Protocol,
+    ProtocolNameList,
+    ProtocolNameMatch,
+    RuleSetList,
+    SourceDataPrefixList,
+    SourceGeoLocation,
+    SourceGeoLocationList,
+    SourceIdentityList,
+    SourceIdentityUser,
+    SourceIdentityUserGroup,
+    SourceIp,
+    SourcePort,
+    SourcePortList,
+    SourceScalableGroupTagList,
+    SourceSecurityGroup,
+]
+
+
+class AipAction(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    type: Global[AipActionType] = Field(
+        default=Global[AipActionType](value="advancedInspectionProfile"),
+        validation_alias="type",
+        serialization_alias="type",
+    )
+    parameter: RefIdItem
+
+    @classmethod
+    def from_uuid(cls, uuid: UUID) -> Self:
+        return cls(parameter=RefIdItem.from_uuid(uuid))
+
+
+class LogAction(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    type: Optional[Global[SequenceActionType]] = Field(default=None)
+    parameter: Global[str] = Field(default=Global[str](value="true"))
+
+    @classmethod
+    def from_sequence_action(cls, action_type: SequenceActionType) -> Self:
+        return cls(type=Global[SequenceActionType](value=action_type))
+
+
+class Match(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    entries: List[MatchEntry]
+
+    @classmethod
+    def create(cls, entries: Optional[List[MatchEntry]] = None) -> Self:
+        return cls(entries=entries if entries else [])
+
+
+class NgFirewallSequence(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    sequence_id: Global[str] = Field(validation_alias="sequenceId", serialization_alias="sequenceId")
+    sequence_name: Global[str] = Field(validation_alias="sequenceName", serialization_alias="sequenceName")
+    base_action: Global[SecurityBaseAction] = Field(
+        default=Global[SecurityBaseAction](value="drop"),
+        validation_alias="baseAction",
+        serialization_alias="baseAction",
+    )
+    sequence_type: Global[SequenceType] = Field(
+        default=Global[SequenceType](value="ngfirewall"),
+        validation_alias="sequenceType",
+        serialization_alias="sequenceType",
+    )
+    match: Match
+    actions: List[Union[LogAction, AipAction]] = Field(
+        default_factory=list, validation_alias="actions", min_length=0, max_length=2, serialization_alias="actions"
+    )
+    disable_sequence: Global[bool] = Field(
+        default=Global[bool](value=False),
+        validation_alias="disableSequence",
+        serialization_alias="disableSequence",
+    )
+
+    def add_log_action(self) -> None:
+        self.actions.append(LogAction())
+
+    def add_aip_action(self, aip_uuid: UUID) -> None:
+        self.actions.append(AipAction.from_uuid(aip_uuid))
+
+    @model_validator(mode="after")
+    def validate_model(self):
+        if len(self.actions) > len(set(map(type, self.actions))):
+            raise ValidationError(
+                f"NGFirewall sequence cannot contain actions with the same type. Sequence actions: {self.actions}"
+            )
+
+        return self
+
+    @classmethod
+    def create(
+        cls,
+        sequence_id: int,
+        sequence_name: str,
+        base_action: SecurityBaseAction,
+        disable_sequence: bool = False,
+        match: Optional[Match] = None,
+        actions: Optional[List[Union[LogAction, AipAction]]] = None,
+    ) -> Self:
+        return cls(
+            sequence_id=Global[str](value=str(sequence_id)),
+            sequence_name=Global[str](value=sequence_name),
+            base_action=Global[SecurityBaseAction](value=base_action),
+            match=match if match else Match.create(),
+            actions=actions if actions else [],
+            disable_sequence=Global[bool](value=disable_sequence),
+        )
+
+
+class NgfirewallParcel(_ParcelBase):
+    type_: Literal["unified/ngfirewall"] = Field(default="unified/ngfirewall", exclude=True)
+    parcel_description: str = Field(
+        default="",
+        serialization_alias="description",
+        validation_alias="description",
+        description="Set the parcel description",
+    )
+    default_action_type: Global[DefaultAction] = Field(validation_alias=AliasPath("data", "defaultActionType"))
+    sequences: List[NgFirewallSequence] = Field(validation_alias=AliasPath("data", "sequences"))
+    contains_tls: Optional[bool] = Field(
+        default=False, validation_alias="containsTls", serialization_alias="containsTls"
+    )
+    contains_utd: Optional[bool] = Field(
+        default=False, validation_alias="containsUtd", serialization_alias="containsUtd"
+    )
+    optimized: Optional[bool] = Field(default=True)
+
+    @classmethod
+    def create(
+        cls,
+        parcel_name: str,
+        parcel_description: str,
+        default_action_type: DefaultAction,
+        sequences: List[NgFirewallSequence],
+        contains_tls: bool = False,
+        contains_utd: bool = False,
+    ) -> Self:
+        return cls(
+            parcel_name=parcel_name,
+            parcel_description=parcel_description,
+            default_action_type=Global[DefaultAction](value=default_action_type),
+            sequences=sequences,
+            contains_utd=contains_utd,
+            contains_tls=contains_tls,
+        )

catalystwan/models/configuration/feature_profile/sdwan/embedded_security/policy.py

@@ -0,0 +1,171 @@
+# Copyright 2023 Cisco Systems, Inc. and its affiliates
+# Copyright 2024 Cisco Systems, Inc. and its affiliates
+from typing import List, Literal, Optional, Union
+from uuid import UUID
+
+from pydantic import AliasPath, BaseModel, ConfigDict, Field
+from typing_extensions import Self
+
+from catalystwan.api.configuration_groups.parcel import Global, Variable, _ParcelBase, as_global, as_optional_global
+from catalystwan.models.configuration.feature_profile.common import RefIdItem
+
+PredefinedZone = Literal["self", "default", "untrusted"]
+SettingOn = Literal["on"]
+FailureMode = Literal["close", "open"]
+
+
+class AppHosting(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    nat: Union[Global[bool], Variable]
+    database_url: Union[Global[bool], Variable] = Field(validation_alias="databaseUrl")
+    resource_profile: Union[Global[bool], Variable] = Field(validation_alias="resourceProfile")
+
+
+class NetworkSettings(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    option_type: str = Field(default="network-settings", validation_alias="optionType")
+    value: bool
+
+
+class PolicySettings(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    tcp_syn_flood_limit: Optional[Global[str]] = Field(
+        default=None, validation_alias="tcpSynFloodLimit", serialization_alias="tcpSynFloodLimit"
+    )
+    max_incomplete_tcp_limit: Optional[Global[str]] = Field(
+        default=None, validation_alias="maxIncompleteTcpLimit", serialization_alias="maxIncompleteTcpLimit"
+    )
+    max_incomplete_udp_limit: Optional[Global[str]] = Field(
+        default=None, validation_alias="maxIncompleteUdpLimit", serialization_alias="maxIncompleteUdpLimit"
+    )
+    max_incomplete_icmp_limit: Optional[Global[str]] = Field(
+        default=None, validation_alias="maxIncompleteIcmpLimit", serialization_alias="maxIncompleteIcmpLimit"
+    )
+    audit_trail: Optional[Global[SettingOn]] = Field(
+        default=None, validation_alias="auditTrail", serialization_alias="auditTrail"
+    )
+    unified_logging: Optional[Global[SettingOn]] = Field(
+        default=None, validation_alias="unifiedLogging", serialization_alias="unifiedLogging"
+    )
+    session_reclassify_allow: Optional[Global[SettingOn]] = Field(
+        default=None, validation_alias="sessionReclassifyAllow", serialization_alias="sessionReclassifyAllow"
+    )
+    icmp_unreachable_allow: Optional[Global[SettingOn]] = Field(
+        default=None, validation_alias="icmpUnreachableAllow", serialization_alias="icmpUnreachableAllow"
+    )
+    failure_mode: Optional[Global[FailureMode]] = Field(
+        default=None, validation_alias="failureMode", serialization_alias="failureMode"
+    )
+    security_logging: Optional[NetworkSettings] = Field(
+        default=None, validation_alias="securityLogging", serialization_alias="securityLogging"
+    )
+
+    @classmethod
+    def create(
+        cls,
+        tcp_syn_flood_limit: Optional[str] = None,
+        max_incomplete_tcp_limit: Optional[str] = None,
+        max_incomplete_udp_limit: Optional[str] = None,
+        max_incomplete_icmp_limit: Optional[str] = None,
+        unified_logging: Optional[SettingOn] = None,
+        session_reclassify_allow: Optional[SettingOn] = None,
+        failure_mode: Optional[FailureMode] = None,
+        audit_trail: Optional[SettingOn] = None,
+        icmp_unreachable_allow: Optional[SettingOn] = None,
+    ) -> Self:
+        return cls(
+            tcp_syn_flood_limit=as_optional_global(tcp_syn_flood_limit),
+            max_incomplete_tcp_limit=as_optional_global(max_incomplete_tcp_limit),
+            max_incomplete_udp_limit=as_optional_global(max_incomplete_udp_limit),
+            max_incomplete_icmp_limit=as_optional_global(max_incomplete_icmp_limit),
+            unified_logging=as_optional_global(unified_logging, SettingOn),
+            session_reclassify_allow=as_optional_global(session_reclassify_allow, SettingOn),
+            failure_mode=as_optional_global(failure_mode, FailureMode),
+            audit_trail=as_optional_global(audit_trail, SettingOn),
+            icmp_unreachable_allow=as_optional_global(icmp_unreachable_allow, SettingOn),
+        )
+
+
+class NgFirewallEntry(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    src_zone: Union[RefIdItem, Global[PredefinedZone]] = Field(
+        validation_alias="srcZone", serialization_alias="srcZone"
+    )
+    dst_zone: Union[RefIdItem, Global[PredefinedZone]] = Field(
+        validation_alias="dstZone", serialization_alias="dstZone"
+    )
+
+    @classmethod
+    def create(cls, src_zone: Union[UUID, PredefinedZone], dst_zone: Union[UUID, PredefinedZone]) -> Self:
+        if type(src_zone) is UUID:
+            _src_zone = RefIdItem.from_uuid(src_zone)
+        else:
+            _src_zone = as_global(src_zone, PredefinedZone)
+
+        if type(dst_zone) is UUID:
+            _dst_zone = RefIdItem.from_uuid(dst_zone)
+        else:
+            _dst_zone = as_global(dst_zone, PredefinedZone)
+
+        return cls(
+            src_zone=_src_zone,
+            dst_zone=_dst_zone,
+        )
+
+
+class NgFirewall(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    ref_id: Union[Global[UUID], Global[str]] = Field(validation_alias="refId", serialization_alias="refId")
+    entries: List[NgFirewallEntry] = Field(validation_alias="entries", min_length=1)
+
+
+class NgFirewallContainer(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    ng_firewall: NgFirewall = Field(validation_alias="ngfirewall", serialization_alias="ngfirewall")
+
+
+class SslDecryption(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    ssl_decryption: RefIdItem = Field(validation_alias="sslDecryption", serialization_alias="sslDecryption")
+
+    @classmethod
+    def from_uuid(cls, uuid: UUID) -> Self:
+        return cls(ssl_decryption=RefIdItem.from_uuid(uuid))
+
+
+class AdvancedInspectionProfile(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="forbid")
+    advanced_inspection_profile: RefIdItem = Field(
+        validation_alias="advancedInspectionProfile", serialization_alias="advancedInspectionProfile"
+    )
+
+    @classmethod
+    def from_uuid(cls, uuid: UUID) -> Self:
+        return cls(advanced_inspection_profile=RefIdItem.from_uuid(uuid))
+
+
+class PolicyParcel(_ParcelBase):
+    type_: Literal["policy"] = Field(default="policy", exclude=True)
+    parcel_description: str = Field(
+        default="",
+        serialization_alias="description",
+        validation_alias="description",
+        description="Set the parcel description",
+    )
+    assembly: List[Union[NgFirewallContainer, SslDecryption, AdvancedInspectionProfile]] = Field(
+        default_factory=list, validation_alias=AliasPath("data", "assembly")
+    )
+
+    settings: Optional[PolicySettings] = Field(default=None, validation_alias=AliasPath("data", "settings"))
+    app_hosting: Optional[AppHosting] = Field(default=None, validation_alias=AliasPath("data", "appHosting"))
+
+    def add_ng_firewall_assembly(self, ng_firewall_id: UUID, entries: List[NgFirewallEntry] = []) -> None:
+        self.assembly.append(
+            NgFirewallContainer(ng_firewall=NgFirewall(ref_id=as_global(ng_firewall_id), entries=entries))
+        )
+
+    def add_ssl_decryption_assembly(self, ssl_decryption_profile_id: UUID) -> None:
+        self.assembly.append(SslDecryption.from_uuid(ssl_decryption_profile_id))
+
+    def add_advanced_inspection_profile_assembly(self, aip_id: UUID) -> None:
+        self.assembly.append(AdvancedInspectionProfile.from_uuid(aip_id))

catalystwan/models/configuration/feature_profile/sdwan/other/__init__.py

@@ -0,0 +1,25 @@
+# Copyright 2024 Cisco Systems, Inc. and its affiliates
+from typing import List, Union
+
+from pydantic import Field
+from typing_extensions import Annotated
+
+from .cybervision import CyberVisonParcel
+from .thousandeyes import ThousandEyesParcel
+from .ucse import UcseParcel
+
+AnyOtherParcel = Annotated[
+    Union[ThousandEyesParcel, UcseParcel, CyberVisonParcel],
+    Field(discriminator="type_"),
+]
+
+__all__ = [
+    "CyberVisonParcel",
+    "ThousandEyesParcel",
+    "UcseParcel",
+    "AnyOtherParcel",
+]
+
+
+def __dir__() -> "List[str]":
+    return list(__all__)