import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
export interface UpgradeDeviceAutoUpgradeStat {
    /**
     * Time when the device last checked for auto-upgrade, in epoch seconds
     */
    lastcheck?: pulumi.Input<number | undefined>;
}
export interface UpgradeDeviceFwupdate {
    /**
     * Firmware update progress percentage, or null when unavailable
     */
    progress?: pulumi.Input<number | undefined>;
    /**
     * Current firmware update status
     */
    status?: pulumi.Input<string | undefined>;
    /**
     * Numeric firmware update status identifier
     */
    statusId?: pulumi.Input<number | undefined>;
    /**
     * Time when the firmware update status was last updated
     */
    timestamp?: pulumi.Input<number | undefined>;
    /**
     * Whether the firmware update process will retry after the current status
     */
    willRetry?: pulumi.Input<boolean | undefined>;
}
export declare namespace device {
    interface ApAeroscout {
        /**
         * Whether to enable aeroscout config
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Required if enabled, aeroscout server host
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * Whether to enable the feature to allow wireless clients data received and sent to AES server for location calculation
         */
        locateConnected?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if enabled, Aeroscout server port. Defaults to 1144
         */
        port?: pulumi.Input<number | undefined>;
    }
    interface ApAirista {
        /**
         * Whether to enable Airista config
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Required if enabled, Airista server host
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * Optional if enabled, Airista server port. Defaults to 1144
         */
        port?: pulumi.Input<number | undefined>;
    }
    interface ApBleConfig {
        /**
         * Whether Mist beacons is enabled
         */
        beaconEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `beaconRateMode`==`custom`, 1-10, in number-beacons-per-second
         */
        beaconRate?: pulumi.Input<number | undefined>;
        /**
         * Beacon rate mode for Mist BLE beacons; use custom to set beacon_rate
         */
        beaconRateMode?: pulumi.Input<string | undefined>;
        /**
         * AP BLE beam numbers disabled for location advertisements
         */
        beamDisableds?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Can be enabled if `beaconEnabled`==`true`, whether to send custom packet
         */
        customBlePacketEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * The custom frame to be sent out in this beacon. The frame must be a hexstring
         */
        customBlePacketFrame?: pulumi.Input<string | undefined>;
        /**
         * Frequency (msec) of data emitted by custom ble beacon
         */
        customBlePacketFreqMsec?: pulumi.Input<number | undefined>;
        /**
         * Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default
         */
        eddystoneUidAdvPower?: pulumi.Input<number | undefined>;
        /**
         * BLE beams used to transmit Eddystone-UID advertisements, expressed as ranges such as `2-4,7`
         */
        eddystoneUidBeams?: pulumi.Input<string | undefined>;
        /**
         * Only if `beaconEnabled`==`false`, Whether Eddystone-UID beacon is enabled
         */
        eddystoneUidEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Frequency (msec) of data emit by Eddystone-UID beacon
         */
        eddystoneUidFreqMsec?: pulumi.Input<number | undefined>;
        /**
         * Eddystone-UID instance for the device
         */
        eddystoneUidInstance?: pulumi.Input<string | undefined>;
        /**
         * Eddystone-UID namespace broadcast by the AP, as a 10-byte hex string
         */
        eddystoneUidNamespace?: pulumi.Input<string | undefined>;
        /**
         * Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default
         */
        eddystoneUrlAdvPower?: pulumi.Input<number | undefined>;
        /**
         * BLE beams used to transmit Eddystone-URL advertisements, expressed as ranges such as `2-4,7`
         */
        eddystoneUrlBeams?: pulumi.Input<string | undefined>;
        /**
         * Only if `beaconEnabled`==`false`, Whether Eddystone-URL beacon is enabled
         */
        eddystoneUrlEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Frequency (msec) of data emitted by Eddystone-URL beacon
         */
        eddystoneUrlFreqMsec?: pulumi.Input<number | undefined>;
        /**
         * URL pointed by Eddystone-URL beacon
         */
        eddystoneUrlUrl?: pulumi.Input<string | undefined>;
        /**
         * Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default
         */
        ibeaconAdvPower?: pulumi.Input<number | undefined>;
        /**
         * BLE beams used to transmit iBeacon advertisements, expressed as ranges such as `2-4,7`
         */
        ibeaconBeams?: pulumi.Input<string | undefined>;
        /**
         * Can be enabled if `beaconEnabled`==`true`, whether to send iBeacon
         */
        ibeaconEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Frequency (msec) of data emit for iBeacon
         */
        ibeaconFreqMsec?: pulumi.Input<number | undefined>;
        /**
         * iBeacon major value broadcast by the AP
         */
        ibeaconMajor?: pulumi.Input<number | undefined>;
        /**
         * iBeacon minor value broadcast by the AP
         */
        ibeaconMinor?: pulumi.Input<number | undefined>;
        /**
         * Optional, if not specified, the same UUID as the beacon will be used
         */
        ibeaconUuid?: pulumi.Input<string | undefined>;
        /**
         * Required if `powerMode`==`custom`; else use `powerMode` as default
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * Transmit power mode for BLE beacons; use custom to set `power`
         */
        powerMode?: pulumi.Input<string | undefined>;
    }
    interface ApCentrak {
        /**
         * Whether to enable Centrak config
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface ApClientBridge {
        /**
         * Credentials and security mode used when the AP connects as a wireless client bridge
         */
        auth?: pulumi.Input<inputs.device.ApClientBridgeAuth | undefined>;
        /**
         * When acted as client bridge:
         *   * only 5G radio can be used
         *   * will not serve as AP on any radios
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Uplink SSID used by the AP when client bridge mode is enabled
         */
        ssid?: pulumi.Input<string | undefined>;
    }
    interface ApClientBridgeAuth {
        /**
         * Pre-shared key used when `type`==`psk` for client bridge authentication
         */
        psk?: pulumi.Input<string | undefined>;
        /**
         * Authentication mode for the client bridge connection
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface ApEslConfig {
        /**
         * Only if `type`==`imagotag` or `type`==`native`
         */
        cacert?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`imagotag` or `type`==`native`
         */
        channel?: pulumi.Input<number | undefined>;
        /**
         * usb_config is ignored if eslConfig enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `type`==`imagotag` or `type`==`native`
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`imagotag` or `type`==`native`
         */
        port?: pulumi.Input<number | undefined>;
        /**
         * ESL integration type to enable on the AP
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`imagotag` or `type`==`native`
         */
        verifyCert?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `type`==`solum` or `type`==`hanshow`
         */
        vlanId?: pulumi.Input<number | undefined>;
    }
    interface ApIpConfig {
        /**
         * If `type`==`static`. DNS server IP addresses for AP management traffic
         */
        dns?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type`==`static`. DNS search suffixes applied to AP management lookups
         */
        dnsSuffixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Required if `type`==`static`. IPv4 default gateway for AP management traffic
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Required if `type6`==`static`. IPv6 default gateway for AP management traffic when static IPv6 addressing is used
         */
        gateway6?: pulumi.Input<string | undefined>;
        /**
         * Required if `type`==`static`. Static IPv4 address for the AP management interface
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Required if `type6`==`static`. Static IPv6 address for the AP management interface
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * Maximum transmission unit for AP management traffic
         */
        mtu?: pulumi.Input<number | undefined>;
        /**
         * Required if `type`==`static`. IPv4 netmask for the AP management interface
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * Required if `type6`==`static`. IPv6 prefix length for the AP management interface
         */
        netmask6?: pulumi.Input<string | undefined>;
        /**
         * IPv4 address assignment mode for AP management traffic
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 address assignment mode for AP management traffic
         */
        type6?: pulumi.Input<string | undefined>;
        /**
         * Management VLAN ID, default is 1 (untagged)
         */
        vlanId?: pulumi.Input<number | undefined>;
    }
    interface ApLacpConfig {
        /**
         * Whether to enable LACP on supported AP Ethernet uplinks
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface ApLed {
        /**
         * Indicator LED brightness level from 0 to 255
         */
        brightness?: pulumi.Input<number | undefined>;
        /**
         * Whether the AP indicator LED is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface ApMesh {
        /**
         * Radio bands allowed for AP mesh links
         */
        bands?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether mesh is enabled on this AP
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Mesh group, base AP(s) will only allow remote AP(s) in the same mesh group to join, 1-9, optional
         */
        group?: pulumi.Input<number | undefined>;
        /**
         * Mesh role for this AP, either base or remote
         */
        role?: pulumi.Input<string | undefined>;
        /**
         * Whether to use WPA3 on the 5 GHz band for mesh links
         */
        useWpa3On5?: pulumi.Input<boolean | undefined>;
    }
    interface ApMqttConfig {
        /**
         * MQTT broker hostname or IP address; required when `enabled` is `true`
         */
        brokerHost?: pulumi.Input<string | undefined>;
        /**
         * MQTT broker port; defaults to `1883` for `tcp` and `8883` for `ssl`
         */
        brokerPort?: pulumi.Input<number | undefined>;
        /**
         * MQTT broker transport protocol
         */
        brokerProto?: pulumi.Input<string | undefined>;
        /**
         * Whether to enable MQTT publishing
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Payload format for published messages
         */
        format?: pulumi.Input<string | undefined>;
        /**
         * Optional MQTT password; masked in GET responses
         */
        password?: pulumi.Input<string | undefined>;
        /**
         * Optional MQTT username
         */
        username?: pulumi.Input<string | undefined>;
    }
    interface ApPortConfig {
        /**
         * Whether this AP Ethernet port is disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * RADIUS-assigned VLAN settings for AP port authentication
         */
        dynamicVlan?: pulumi.Input<inputs.device.ApPortConfigDynamicVlan | undefined>;
        /**
         * Whether MAC authentication is enabled on this AP port
         */
        enableMacAuth?: pulumi.Input<boolean | undefined>;
        /**
         * Traffic forwarding mode for this AP Ethernet port
         */
        forwarding?: pulumi.Input<string | undefined>;
        /**
         * When `true`, we'll do dot1x then mac_auth. enable this to prefer mac_auth
         */
        macAuthPreferred?: pulumi.Input<boolean | undefined>;
        /**
         * Protocol used for MAC authentication when `enableMacAuth` is `true`
         */
        macAuthProtocol?: pulumi.Input<string | undefined>;
        /**
         * Juniper Mist NAC settings used by AP port authentication
         */
        mistNac?: pulumi.Input<inputs.device.ApPortConfigMistNac | undefined>;
        /**
         * If `forwarding`==`mxtunnel`, vlanIds comes from mxtunnel
         */
        mxTunnelId?: pulumi.Input<string | undefined>;
        /**
         * If `forwarding`==`siteMxedge`, vlanIds comes from siteMxedge (`mxtunnels` under site setting)
         */
        mxtunnelName?: pulumi.Input<string | undefined>;
        /**
         * Authentication mode for this AP Ethernet port
         */
        portAuth?: pulumi.Input<string | undefined>;
        /**
         * If `forwarding`==`limited`. VLAN ID allowed on this AP Ethernet port
         */
        portVlanId?: pulumi.Input<number | undefined>;
        /**
         * RADIUS authentication and accounting settings for this AP port
         */
        radiusConfig?: pulumi.Input<inputs.device.ApPortConfigRadiusConfig | undefined>;
        /**
         * TLS-secured RADIUS settings for this AP port
         */
        radsec?: pulumi.Input<inputs.device.ApPortConfigRadsec | undefined>;
        /**
         * Optional to specify the VLAN ID for a tunnel if forwarding is for `wxtunnel`, `mxtunnel` or `siteMxedge`.
         *   * if vlanId is not specified then it will use first one in vlan_ids[] of the mxtunnel.
         *   * if forwarding == site_mxedge, vlanIds comes from siteMxedge (`mxtunnels` under site setting)
         */
        vlanId?: pulumi.Input<number | undefined>;
        /**
         * If `forwarding`==`limited`, comma separated list of additional VLAN IDs allowed on this port
         */
        vlanIds?: pulumi.Input<string | undefined>;
        /**
         * If `forwarding`==`wxtunnel`, the port is bridged to the vlan of the session
         */
        wxtunnelId?: pulumi.Input<string | undefined>;
        /**
         * If `forwarding`==`wxtunnel`, the port is bridged to the vlan of the session
         */
        wxtunnelRemoteId?: pulumi.Input<string | undefined>;
    }
    interface ApPortConfigDynamicVlan {
        /**
         * Fallback VLAN ID used when RADIUS does not return a dynamic VLAN match
         */
        defaultVlanId?: pulumi.Input<number | undefined>;
        /**
         * Whether dynamic VLAN assignment is enabled for this AP port
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Mapping mode for interpreting dynamic VLAN attributes returned by RADIUS
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Mapping entries for RADIUS-assigned VLAN values on this AP port. For `type`==`airespace-interface-name`, the property key is the Airespace interface name returned by RADIUS (e.g. "guest"), and the value is the corresponding VLAN ID (e.g. 100). For `type`==`standard`, the property key is the VLAN ID number returned by RADIUS, and the value is ignored.
         */
        vlans?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
    }
    interface ApPortConfigMistNac {
        /**
         * How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled.
         */
        acctInterimInterval?: pulumi.Input<number | undefined>;
        /**
         * RADIUS auth session retries. Following fast timers are set if `fastDot1xTimers` knob is enabled. "retries" are set to value of `authServersTimeout`. "max-requests" is also set when setting `authServersRetries` is set to default value to 3.
         */
        authServersRetries?: pulumi.Input<number | undefined>;
        /**
         * RADIUS auth session timeout. Following fast timers are set if `fastDot1xTimers` knob is enabled. "quite-period" and "transmit-period" are set to half the value of `authServersTimeout`. "supplicant-timeout" is also set when setting `authServersTimeout` is set to default value of 10.
         */
        authServersTimeout?: pulumi.Input<number | undefined>;
        /**
         * Allows a RADIUS server to dynamically modify the authorization status of a user session.
         */
        coaEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * the communication port used for “Change of Authorization” (CoA) messages
         */
        coaPort?: pulumi.Input<number | undefined>;
        /**
         * When enabled:
         *   * `authServers` is ignored
         *   * `acctServers` is ignored
         *   * `auth_servers_*` are ignored
         *   * `coaServers` is ignored
         *   * `radsec` is ignored
         *   * `coaEnabled` is assumed
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * If set to true, sets default fast-timers with values calculated from `authServersTimeout` and `authServerRetries`.
         */
        fastDot1xTimers?: pulumi.Input<boolean | undefined>;
        /**
         * Which network the mist nac server resides in
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * In case there is a static IP for this network, we can specify it using source ip
         */
        sourceIp?: pulumi.Input<string | undefined>;
    }
    interface ApPortConfigRadiusConfig {
        /**
         * How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled
         */
        acctInterimInterval?: pulumi.Input<number | undefined>;
        /**
         * RADIUS accounting servers used by this Junos configuration
         */
        acctServers?: pulumi.Input<pulumi.Input<inputs.device.ApPortConfigRadiusConfigAcctServer>[] | undefined>;
        /**
         * RADIUS authentication servers used by this Junos configuration
         */
        authServers?: pulumi.Input<pulumi.Input<inputs.device.ApPortConfigRadiusConfigAuthServer>[] | undefined>;
        /**
         * Number of RADIUS authentication request retries before failover
         */
        authServersRetries?: pulumi.Input<number | undefined>;
        /**
         * RADIUS authentication server timeout, in seconds
         */
        authServersTimeout?: pulumi.Input<number | undefined>;
        /**
         * Whether RADIUS Change of Authorization (CoA) is enabled
         */
        coaEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * UDP port used for RADIUS Change of Authorization (CoA)
         */
        coaPort?: pulumi.Input<number | undefined>;
        /**
         * Use `network` or `sourceIp`. Network where the RADIUS server resides; if the network has a static IP, Mist uses it as the source IP
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Use `network` or `sourceIp`. Explicit source IP address for RADIUS traffic
         */
        sourceIp?: pulumi.Input<string | undefined>;
    }
    interface ApPortConfigRadiusConfigAcctServer {
        /**
         * Address or hostname of the RADIUS accounting server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this accounting server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS accounting server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used with this RADIUS accounting server
         */
        secret: pulumi.Input<string>;
    }
    interface ApPortConfigRadiusConfigAuthServer {
        /**
         * Address or hostname of the RADIUS authentication server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this authentication server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS authentication server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Whether to require Message-Authenticator in requests
         */
        requireMessageAuthenticator?: pulumi.Input<boolean | undefined>;
        /**
         * Shared secret used with this RADIUS authentication server
         */
        secret: pulumi.Input<string>;
    }
    interface ApPortConfigRadsec {
        /**
         * Whether RADIUS Change of Authorization (CoA) is enabled for RadSec traffic
         */
        coaEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether RadSec is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Idle timeout, in seconds, for RadSec connections
         */
        idleTimeout?: pulumi.Input<string | undefined>;
        /**
         * Mist Edge cluster IDs used as RadSec proxies when the WLAN does not use mxtunnel
         */
        mxclusterIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * RadSec proxy hostnames advertised to APs
         */
        proxyHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * TLS server name to verify against the CA certificates in Org Setting. Only if not Mist Edge.
         */
        serverName?: pulumi.Input<string | undefined>;
        /**
         * External RadSec servers. Only if not Mist Edge.
         */
        servers?: pulumi.Input<pulumi.Input<inputs.device.ApPortConfigRadsecServer>[] | undefined>;
        /**
         * Whether to use organization Mist Edge instances as RadSec proxies
         */
        useMxedge?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to use site Mist Edge instances when this WLAN does not use mxtunnel
         */
        useSiteMxedge?: pulumi.Input<boolean | undefined>;
    }
    interface ApPortConfigRadsecServer {
        /**
         * Address or hostname of the RadSec server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * TCP port used by the RadSec server
         */
        port?: pulumi.Input<number | undefined>;
    }
    interface ApPwrConfig {
        /**
         * Additional power to request during negotiating with PSE over PoE, in mW
         */
        base?: pulumi.Input<number | undefined>;
        /**
         * Whether to enable power out to peripheral, meanwhile will reduce power to Wi-Fi (only for AP45 at power mode)
         */
        preferUsbOverWifi?: pulumi.Input<boolean | undefined>;
    }
    interface ApRadioConfig {
        /**
         * Whether RRM can be disabled for individual radio-band settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * Antenna gain for 2.4G - for models with external antenna only
         */
        antGain24?: pulumi.Input<number | undefined>;
        /**
         * Antenna gain for 5G - for models with external antenna only
         */
        antGain5?: pulumi.Input<number | undefined>;
        /**
         * Antenna gain for 6G - for models with external antenna only
         */
        antGain6?: pulumi.Input<number | undefined>;
        /**
         * Selected radio chain mode for AP models that support antenna mode control
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Internal or external antenna selection for AP models with selectable antennas
         */
        antennaSelect?: pulumi.Input<string | undefined>;
        /**
         * 2.4 GHz radio settings for this access point
         */
        band24?: pulumi.Input<inputs.device.ApRadioConfigBand24 | undefined>;
        /**
         * Radio usage mode for the 2.4 GHz-capable radio
         */
        band24Usage?: pulumi.Input<string | undefined>;
        /**
         * 5 GHz radio settings for this access point
         */
        band5?: pulumi.Input<inputs.device.ApRadioConfigBand5 | undefined>;
        /**
         * 5 GHz settings used when the 2.4 GHz radio operates in 5 GHz mode
         */
        band5On24Radio?: pulumi.Input<inputs.device.ApRadioConfigBand5On24Radio | undefined>;
        /**
         * 6 GHz radio settings for this access point
         */
        band6?: pulumi.Input<inputs.device.ApRadioConfigBand6 | undefined>;
        /**
         * Let RRM control everything, only the `channels` and `antGain` will be honored (i.e. disabled/bandwidth/power/band_24_usage are all controlled by RRM)
         */
        fullAutomaticRrm?: pulumi.Input<boolean | undefined>;
        /**
         * To make an outdoor operate indoor. For an outdoor-ap, some channels are disallowed by default, this allows the user to use it as an indoor-ap
         */
        indoorUse?: pulumi.Input<boolean | undefined>;
        /**
         * Enable RRM to manage all radio settings (ignores all bandXxx configs)
         */
        rrmManaged?: pulumi.Input<boolean | undefined>;
        /**
         * Whether scanning radio is enabled
         */
        scanningEnabled?: pulumi.Input<boolean | undefined>;
    }
    interface ApRadioConfigBand24 {
        /**
         * Whether RRM may disable the 2.4 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 2.4 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Radio chain mode for the 2.4 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 2.4 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * For Device. (primary) channel for the band, 0 means using the Site Setting
         */
        channel?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 2.4 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 2.4 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
    }
    interface ApRadioConfigBand5 {
        /**
         * Whether RRM may disable the 5 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 5 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Beam pattern used by the 5 GHz radio antenna
         */
        antennaBeamPattern?: pulumi.Input<string | undefined>;
        /**
         * Radio chain mode for the 5 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 5 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * For Device. (primary) channel for the band, 0 means using the Site Setting
         */
        channel?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 5 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
    }
    interface ApRadioConfigBand5On24Radio {
        /**
         * Whether RRM may disable the 5 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 5 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Beam pattern used by the 5 GHz radio antenna
         */
        antennaBeamPattern?: pulumi.Input<string | undefined>;
        /**
         * Radio chain mode for the 5 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 5 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * For Device. (primary) channel for the band, 0 means using the Site Setting
         */
        channel?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 5 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
    }
    interface ApRadioConfigBand6 {
        /**
         * Whether RRM may disable the 6 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 6 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Beam pattern used by the 6 GHz radio antenna
         */
        antennaBeamPattern?: pulumi.Input<string | undefined>;
        /**
         * Radio chain mode for the 6 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 6 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * For Device. (primary) channel for the band, 0 means using the Site Setting
         */
        channel?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 6 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 6 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
        /**
         * For 6GHz Only, standard-power operation, AFC (Automatic Frequency Coordination) will be performed, and we'll fall back to Low Power Indoor if AFC failed
         */
        standardPower?: pulumi.Input<boolean | undefined>;
    }
    interface ApUplinkPortConfig {
        /**
         * Whether to do 802.1x against uplink switch. When enabled, AP cert will be used to do EAP-TLS and the Org's CA Cert has to be provisioned at the switch
         */
        dot1x?: pulumi.Input<boolean | undefined>;
        /**
         * By default, WLANs are disabled when uplink is down. In some scenario, like SiteSurvey, one would want the AP to keep sending beacons.
         */
        keepWlansUpIfDown?: pulumi.Input<boolean | undefined>;
    }
    interface ApUsbConfig {
        /**
         * Only if `type`==`imagotag`. CA certificate used to validate the Imagotag service certificate
         */
        cacert?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`imagotag`, channel selection, not needed by default, required for manual channel override only
         */
        channel?: pulumi.Input<number | undefined>;
        /**
         * Whether to enable any usb config
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `type`==`imagotag`. Imagotag service host or IP address contacted by the AP
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`imagotag`. TCP port used to reach the Imagotag service
         */
        port?: pulumi.Input<number | undefined>;
        /**
         * USB integration type for this legacy AP USB configuration
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`imagotag`, whether to turn on SSL verification
         */
        verifyCert?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `type`==`solum` or `type`==`hanshow`
         */
        vlanId?: pulumi.Input<number | undefined>;
    }
    interface ApZigbeeConfig {
        /**
         * Join policy for new Zigbee devices on this AP
         */
        allowJoin?: pulumi.Input<string | undefined>;
        /**
         * Zigbee channel (2.4 GHz). `0` means auto; valid fixed values are 11–26
         */
        channel?: pulumi.Input<number | undefined>;
        /**
         * Whether to enable Zigbee on this AP
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Extended PAN ID in hex string format; only applicable when `panId` is also specified
         */
        extendedPanId?: pulumi.Input<string | undefined>;
        /**
         * PAN ID in hex string format; if not specified, assigned automatically
         */
        panId?: pulumi.Input<string | undefined>;
    }
    interface BaseLatlng {
        /**
         * Geographic latitude in decimal degrees
         */
        lat: pulumi.Input<number>;
        /**
         * Geographic longitude in decimal degrees
         */
        lng: pulumi.Input<number>;
    }
    interface GatewayBgpConfig {
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`
         */
        authKey?: pulumi.Input<string | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`, when bfdMultiplier is configured alone. Default:
         *   * 1000 if `type`==`external`
         *   * 350 `type`==`internal`
         */
        bfdMinimumInterval?: pulumi.Input<number | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`, when bfdMinimumIntervalIsConfigured alone
         */
        bfdMultiplier?: pulumi.Input<number | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. BFD provides faster path failure detection and is enabled by default
         */
        disableBfd?: pulumi.Input<boolean | undefined>;
        /**
         * Routing policy applied to routes exported by this BGP session
         */
        export?: pulumi.Input<string | undefined>;
        /**
         * Default export policies if no per-neighbor policies defined
         */
        exportPolicy?: pulumi.Input<string | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. By default, either inet/net6 unicast depending on neighbor IP family (v4 or v6). For v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
         */
        extendedV4Nexthop?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. `0` means disable
         */
        gracefulRestartTime?: pulumi.Input<number | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. Default is 90.
         */
        holdTime?: pulumi.Input<number | undefined>;
        /**
         * Routing policy applied to routes imported by this BGP session
         */
        import?: pulumi.Input<string | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. Default import policies if no per-neighbor policies defined
         */
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. BGPLocal AS. Value must be in range 1-4294967295 or a variable (e.g. `{{as_variable}}`)
         */
        localAs?: pulumi.Input<string | undefined>;
        /**
         * Neighbor AS. If `type`==`internal`, must be equal to `localAs`. Value must be in range 1-4294967295 or a variable (e.g. `{{as_variable}}`)
         */
        neighborAs?: pulumi.Input<string | undefined>;
        /**
         * Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. If per-neighbor as is desired. Property key is the neighbor address
         */
        neighbors?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayBgpConfigNeighbors>;
        } | undefined>;
        /**
         * Optional if `via`==`lan`; networks where BGP neighbors can connect to or from
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. If true, we will not advertise private ASNs (AS 64512-65534) to this neighbor
         */
        noPrivateAs?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. By default, we'll re-advertise all learned BGP routers toward overlay
         */
        noReadvertiseToOverlay?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `via`==`tunnel`; tunnel name used for this BGP session
         */
        tunnelName?: pulumi.Input<string | undefined>;
        /**
         * Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; BGP session type, internal or external
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Transport used for this BGP session, such as LAN, tunnel, VPN, or WAN
         */
        via: pulumi.Input<string>;
        /**
         * Optional if `via`==`vpn`; VPN name used for this BGP session
         */
        vpnName?: pulumi.Input<string | undefined>;
        /**
         * Optional if `via`==`wan`; WAN interface name used for this BGP session
         */
        wanName?: pulumi.Input<string | undefined>;
    }
    interface GatewayBgpConfigNeighbors {
        /**
         * If true, the BGP session to this neighbor will be administratively disabled/shutdown
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Export policy applied only to this BGP neighbor
         */
        exportPolicy?: pulumi.Input<string | undefined>;
        /**
         * BGP hold time for this neighbor, in seconds
         */
        holdTime?: pulumi.Input<number | undefined>;
        /**
         * Import policy applied only to this BGP neighbor
         */
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * Assuming BGP neighbor is directly connected
         */
        multihopTtl?: pulumi.Input<number | undefined>;
        /**
         * Neighbor AS. Value must be in range 1-4294967295 or a variable (e.g. `{{as_variable}}`)
         */
        neighborAs: pulumi.Input<string>;
        /**
         * If `via`==`tunnel`, primary or secondary tunnel associated with this BGP neighbor
         */
        tunnelVia?: pulumi.Input<string | undefined>;
    }
    interface GatewayClusterNode {
        /**
         * Gateway device MAC address. Format is `[0-9a-f]{12}` (e.g. "5684dae9ac8b")
         */
        mac: pulumi.Input<string>;
    }
    interface GatewayDhcpdConfig {
        /**
         * Property key is the network name
         */
        config?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayDhcpdConfigConfig>;
        } | undefined>;
        /**
         * If set to `false`, disable the DHCP server
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewayDhcpdConfigConfig {
        /**
         * If `type`==`local` or `type6`==`local`, DNS servers advertised to DHCP clients
         */
        dnsServers?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type`==`local` or `type6`==`local`, DNS search suffixes advertised to DHCP clients
         *
         * @deprecated Configuring `dnsSuffix` is deprecated and will not be supported in the future, please configure Code 15 or Code 119 in Server `options` instead
         */
        dnsSuffixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type`==`local` or `type6`==`local`, fixed client bindings for local DHCP service
         */
        fixedBindings?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayDhcpdConfigConfigFixedBindings>;
        } | undefined>;
        /**
         * If `type`==`local` - optional, `ip` will be used if not provided
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * If `type6`==`local`, ending IPv6 address for the DHCP lease pool
         */
        ip6End?: pulumi.Input<string | undefined>;
        /**
         * If `type6`==`local`, starting IPv6 address for the DHCP lease pool
         */
        ip6Start?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`local`, ending IPv4 address for the DHCP lease pool
         */
        ipEnd?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`local`, starting IPv4 address for the DHCP lease pool
         */
        ipStart?: pulumi.Input<string | undefined>;
        /**
         * In seconds, lease time has to be between 3600 [1hr] - 604800 [1 week], default is 86400 [1 day]
         */
        leaseTime?: pulumi.Input<number | undefined>;
        /**
         * If `type`==`local` or `type6`==`local`, custom DHCP options advertised to clients
         */
        options?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayDhcpdConfigConfigOptions>;
        } | undefined>;
        /**
         * `serverIdOverride`==`true` means the device, when acts as DHCP relay and forwards DHCP responses from DHCP server to clients,
         * should overwrite the Sever Identifier option (i.e. DHCP option 54) in DHCP responses with its own IP address.
         */
        serverIdOverride?: pulumi.Input<boolean | undefined>;
        /**
         * If `type`==`relay`, upstream IPv4 DHCP servers
         */
        servers?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type6`==`relay`, upstream IPv6 DHCP servers
         */
        serversv6s?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IPv4 DHCP mode for this network
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 DHCP mode for this network
         */
        type6?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`local` or `type6`==`local`, vendor-encapsulated DHCP options advertised to clients
         */
        vendorEncapsulated?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayDhcpdConfigConfigVendorEncapsulated>;
        } | undefined>;
    }
    interface GatewayDhcpdConfigConfigFixedBindings {
        /**
         * Reserved IPv4 address for this fixed DHCP binding
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Reserved IPv6 address for this fixed DHCP binding
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * Friendly name for this fixed DHCP binding
         */
        name?: pulumi.Input<string | undefined>;
    }
    interface GatewayDhcpdConfigConfigOptions {
        /**
         * Data type used to encode this DHCP option value
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Option value to send for this DHCP option
         */
        value?: pulumi.Input<string | undefined>;
    }
    interface GatewayDhcpdConfigConfigVendorEncapsulated {
        /**
         * Data type used to encode this vendor option value
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Option value to send for this vendor option
         */
        value?: pulumi.Input<string | undefined>;
    }
    interface GatewayExtraRoutes {
        /**
         * Next-hop IPv4 address for the gateway extra route
         */
        via: pulumi.Input<string>;
    }
    interface GatewayExtraRoutes6 {
        /**
         * Next-hop IPv6 address for the gateway extra route
         */
        via: pulumi.Input<string>;
    }
    interface GatewayGatewayMgmt {
        /**
         * SSR-only SSH public keys for administrative access
         */
        adminSshkeys?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Application probing configuration for gateway monitoring
         */
        appProbing?: pulumi.Input<inputs.device.GatewayGatewayMgmtAppProbing | undefined>;
        /**
         * Consumes uplink bandwidth, requires WA license
         */
        appUsage?: pulumi.Input<boolean | undefined>;
        /**
         * Schedule for automatic security signature updates
         */
        autoSignatureUpdate?: pulumi.Input<inputs.device.GatewayGatewayMgmtAutoSignatureUpdate | undefined>;
        /**
         * Rollback timer for commit confirmed
         */
        configRevertTimer?: pulumi.Input<number | undefined>;
        /**
         * For SSR and SRX, disable console port
         */
        disableConsole?: pulumi.Input<boolean | undefined>;
        /**
         * For SSR and SRX, disable management interface
         */
        disableOob?: pulumi.Input<boolean | undefined>;
        /**
         * For SSR and SRX, disable usb interface
         */
        disableUsb?: pulumi.Input<boolean | undefined>;
        /**
         * Whether FIPS mode is enabled on the gateway
         */
        fipsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * IPv4 probe targets used for gateway connectivity checks
         */
        probeHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IPv6 probe targets used for gateway connectivity checks
         */
        probeHostsv6s?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Control-plane protection settings for the gateway
         */
        protectRe?: pulumi.Input<inputs.device.GatewayGatewayMgmtProtectRe | undefined>;
        /**
         * SRX only. Root password for local gateway access
         */
        rootPassword?: pulumi.Input<string | undefined>;
        /**
         * IPv4 source address used for gateway security log traffic
         */
        securityLogSourceAddress?: pulumi.Input<string | undefined>;
        /**
         * Source interface used for gateway security log traffic
         */
        securityLogSourceInterface?: pulumi.Input<string | undefined>;
    }
    interface GatewayGatewayMgmtAppProbing {
        /**
         * Predefined application keys to probe
         */
        apps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * User-defined application probe definitions
         */
        customApps?: pulumi.Input<pulumi.Input<inputs.device.GatewayGatewayMgmtAppProbingCustomApp>[] | undefined>;
        /**
         * Whether gateway application probing is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewayGatewayMgmtAppProbingCustomApp {
        /**
         * Required if `protocol`==`icmp`. IP address probed by the ICMP custom app
         */
        address?: pulumi.Input<string | undefined>;
        /**
         * Category label used for this custom application probe
         */
        appType?: pulumi.Input<string | undefined>;
        /**
         * If `protocol`==`http`. Hostnames or URLs probed by this custom app
         */
        hostnames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Stable key used to identify this custom application probe
         */
        key?: pulumi.Input<string | undefined>;
        /**
         * Display name for this custom application probe
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Gateway network used as the source context for this probe
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * If `protocol`==`icmp`. ICMP packet size used by this custom app probe
         */
        packetSize?: pulumi.Input<number | undefined>;
        /**
         * Probe protocol used by this custom application definition
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * If `protocol`==`http`. HTTP URL or hostname probed by this custom app
         */
        url?: pulumi.Input<string | undefined>;
        /**
         * Gateway VRF used as the source context for this probe
         */
        vrf?: pulumi.Input<string | undefined>;
    }
    interface GatewayGatewayMgmtAutoSignatureUpdate {
        /**
         * Scheduled weekday for automatic signature updates
         */
        dayOfWeek?: pulumi.Input<string | undefined>;
        /**
         * Whether automatic security signature updates are enabled
         */
        enable?: pulumi.Input<boolean | undefined>;
        /**
         * Optional, Mist will decide the timing
         */
        timeOfDay?: pulumi.Input<string | undefined>;
    }
    interface GatewayGatewayMgmtProtectRe {
        /**
         * Built-in services explicitly allowed by the Protect RE policy
         */
        allowedServices?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Additional ACL entries allowed by the Protect RE policy
         */
        customs?: pulumi.Input<pulumi.Input<inputs.device.GatewayGatewayMgmtProtectReCustom>[] | undefined>;
        /**
         * When enabled, all traffic that is not essential to our operation will be dropped
         * e.g. ntp / dns / traffic to mist will be allowed by default
         *      if dhcpd is enabled, we'll make sure it works
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to enable hit count for Protect_RE policy
         */
        hitCount?: pulumi.Input<boolean | undefined>;
        /**
         * Trusted host or subnet entries allowed by the Protect RE policy
         */
        trustedHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewayGatewayMgmtProtectReCustom {
        /**
         * Matched dst port, "0" means any
         */
        portRange?: pulumi.Input<string | undefined>;
        /**
         * Transport protocol matched by this custom Protect RE ACL
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Source subnets matched by this custom Protect RE ACL
         */
        subnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewayIdpProfiles {
        /**
         * Built-in IDP baseline profile inherited before applying overwrites
         */
        baseProfile?: pulumi.Input<string | undefined>;
        /**
         * Unique identifier of the IDP profile
         */
        id?: pulumi.Input<string | undefined>;
        /**
         * Display name of the IDP profile
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Owning organization for the IDP profile
         */
        orgId?: pulumi.Input<string | undefined>;
        /**
         * IDP signature override rules applied on top of the base profile
         */
        overwrites?: pulumi.Input<pulumi.Input<inputs.device.GatewayIdpProfilesOverwrite>[] | undefined>;
    }
    interface GatewayIdpProfilesOverwrite {
        /**
         * Enforcement action applied when this overwrite rule matches
         */
        action?: pulumi.Input<string | undefined>;
        /**
         * Criteria that select signatures for this overwrite rule
         */
        matching?: pulumi.Input<inputs.device.GatewayIdpProfilesOverwriteMatching | undefined>;
        /**
         * Display name for this IDP profile overwrite rule
         */
        name?: pulumi.Input<string | undefined>;
    }
    interface GatewayIdpProfilesOverwriteMatching {
        /**
         * Signature names matched by the IDP profile overwrite
         */
        attackNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Destination subnets matched by the IDP profile overwrite
         */
        dstSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Threat levels matched by the IDP profile overwrite
         */
        severities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewayIpConfigs {
        /**
         * Static IPv4 address for the gateway network interface when `type`==`static`
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Static IPv6 address for the gateway network interface when `type6`==`static`
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * IPv4 netmask or prefix length for the gateway network interface when `type`==`static`
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * IPv6 netmask or prefix length for the gateway network interface when `type6`==`static`
         */
        netmask6?: pulumi.Input<string | undefined>;
        /**
         * Additional IPv4 addresses in CIDR notation for this gateway network interface
         */
        secondaryIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IPv4 address assignment mode for this gateway network interface
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 address assignment mode for this gateway network interface
         */
        type6?: pulumi.Input<string | undefined>;
    }
    interface GatewayNetwork {
        /**
         * Whether to disallow Mist Devices in the network
         */
        disallowMistServices?: pulumi.Input<boolean | undefined>;
        /**
         * IPv4 gateway address for this network
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * IPv6 gateway address for this network
         */
        gateway6?: pulumi.Input<string | undefined>;
        /**
         * Internal access settings for this network
         */
        internalAccess?: pulumi.Input<inputs.device.GatewayNetworkInternalAccess | undefined>;
        /**
         * Direct internet access and NAT settings for this network
         */
        internetAccess?: pulumi.Input<inputs.device.GatewayNetworkInternetAccess | undefined>;
        /**
         * Whether to allow clients in the network to talk to each other
         */
        isolation?: pulumi.Input<boolean | undefined>;
        /**
         * Settings for multicast routing on this network
         */
        multicast?: pulumi.Input<inputs.device.GatewayNetworkMulticast | undefined>;
        /**
         * Display name of the organization network
         */
        name: pulumi.Input<string>;
        /**
         * Other network names this network can route to, for example through BGP, OSPF or static routes
         */
        routedForNetworks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IPv4 subnet CIDR for this network
         */
        subnet: pulumi.Input<string>;
        /**
         * IPv6 subnet CIDR for this network
         */
        subnet6?: pulumi.Input<string | undefined>;
        /**
         * Tenant address mappings associated with this network
         */
        tenants?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayNetworkTenants>;
        } | undefined>;
        /**
         * VLAN ID or variable associated with this network
         */
        vlanId?: pulumi.Input<string | undefined>;
        /**
         * VPN access settings keyed by VPN name for this network
         */
        vpnAccess?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayNetworkVpnAccess>;
        } | undefined>;
    }
    interface GatewayNetworkInternalAccess {
        /**
         * Whether internal access is enabled for this network
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewayNetworkInternetAccess {
        /**
         * Whether Mist should create simple service policies for restricted internet access
         */
        createSimpleServicePolicy?: pulumi.Input<boolean | undefined>;
        /**
         * Destination NAT rules for direct internet access
         */
        destinationNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayNetworkInternetAccessDestinationNat>;
        } | undefined>;
        /**
         * Whether direct internet access is enabled for this network
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * By default, all access is allowed, to only allow certain traffic, make `restricted`=`true` and define service_policies
         */
        restricted?: pulumi.Input<boolean | undefined>;
        /**
         * Static NAT rules for direct internet access
         */
        staticNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayNetworkInternetAccessStaticNat>;
        } | undefined>;
    }
    interface GatewayNetworkInternetAccessDestinationNat {
        /**
         * The Destination NAT destination IP address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
         */
        internalIp?: pulumi.Input<string | undefined>;
        /**
         * Label for this direct internet destination NAT rule
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * The Destination NAT destination IP address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}")
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity
         */
        wanName?: pulumi.Input<string | undefined>;
    }
    interface GatewayNetworkInternetAccessStaticNat {
        /**
         * The Static NAT destination IP address. Must be an IP address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
         */
        internalIp: pulumi.Input<string>;
        /**
         * Label for this direct internet static NAT rule
         */
        name: pulumi.Input<string>;
        /**
         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}")
         */
        wanName?: pulumi.Input<string | undefined>;
    }
    interface GatewayNetworkMulticast {
        /**
         * If the network will only be the source of the multicast traffic, IGMP can be disabled
         */
        disableIgmp?: pulumi.Input<boolean | undefined>;
        /**
         * Whether multicast support is enabled for this network
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Multicast group-to-RP mappings for this network
         */
        groups?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayNetworkMulticastGroups>;
        } | undefined>;
    }
    interface GatewayNetworkMulticastGroups {
        /**
         * RP (rendezvous point) IP address
         */
        rpIp?: pulumi.Input<string | undefined>;
    }
    interface GatewayNetworkTenants {
        /**
         * IP addresses or subnets assigned to this tenant in the network
         */
        addresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewayNetworkVpnAccess {
        /**
         * If `routed`==`true`, whether to advertise an aggregated subnet toward HUB this is useful when there are multiple networks on SPOKE's side
         */
        advertisedSubnet?: pulumi.Input<string | undefined>;
        /**
         * Whether to allow ping from vpn into this routed network
         */
        allowPing?: pulumi.Input<boolean | undefined>;
        /**
         * Destination NAT rules applied for VPN access to this network
         */
        destinationNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayNetworkVpnAccessDestinationNat>;
        } | undefined>;
        /**
         * If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub, a subnet is required to create and advertise the route to Hub
         */
        natPool?: pulumi.Input<string | undefined>;
        /**
         * toward LAN-side BGP peers
         */
        noReadvertiseToLanBgp?: pulumi.Input<boolean | undefined>;
        /**
         * toward LAN-side OSPF peers
         */
        noReadvertiseToLanOspf?: pulumi.Input<boolean | undefined>;
        /**
         * toward overlay, how HUB should deal with routes it received from Spokes
         */
        noReadvertiseToOverlay?: pulumi.Input<boolean | undefined>;
        /**
         * Other VRFs that can receive leaked routes from this spoke network
         */
        otherVrfs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether this network is routable
         */
        routed?: pulumi.Input<boolean | undefined>;
        /**
         * Source NAT settings used when non-routed spoke hosts must be reachable from the hub
         */
        sourceNat?: pulumi.Input<inputs.device.GatewayNetworkVpnAccessSourceNat | undefined>;
        /**
         * Static NAT rules applied for VPN access to this network
         */
        staticNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayNetworkVpnAccessStaticNat>;
        } | undefined>;
        /**
         * toward overlay, how HUB should deal with routes it received from Spokes
         */
        summarizedSubnet?: pulumi.Input<string | undefined>;
        /**
         * toward LAN-side BGP peers
         */
        summarizedSubnetToLanBgp?: pulumi.Input<string | undefined>;
        /**
         * toward LAN-side OSPF peers
         */
        summarizedSubnetToLanOspf?: pulumi.Input<string | undefined>;
    }
    interface GatewayNetworkVpnAccessDestinationNat {
        /**
         * The Destination NAT destination IP address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
         */
        internalIp?: pulumi.Input<string | undefined>;
        /**
         * Label for this VPN destination NAT rule
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Destination port or variable for this VPN destination NAT rule
         */
        port?: pulumi.Input<string | undefined>;
    }
    interface GatewayNetworkVpnAccessSourceNat {
        /**
         * External source NAT IP or subnet used when spoke hosts must be reachable from the hub
         */
        externalIp?: pulumi.Input<string | undefined>;
    }
    interface GatewayNetworkVpnAccessStaticNat {
        /**
         * The Static NAT destination IP address. Must be an IP address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
         */
        internalIp: pulumi.Input<string>;
        /**
         * Label for this VPN static NAT rule
         */
        name: pulumi.Input<string>;
    }
    interface GatewayOobIpConfig {
        /**
         * Default gateway for the out-of-band management interface when `type`==`static`
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Static IPv4 address for the out-of-band management interface when `type`==`static`
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * IPv4 netmask or prefix length for the out-of-band management interface when `type`==`static`
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * Out-of-band management IP configuration override for node1 in an HA cluster
         */
        node1?: pulumi.Input<inputs.device.GatewayOobIpConfigNode1 | undefined>;
        /**
         * IP assignment mode for the out-of-band management interface
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * If supported on the platform. If enabled, DNS will be using this routing-instance, too
         */
        useMgmtVrf?: pulumi.Input<boolean | undefined>;
        /**
         * For host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired
         */
        useMgmtVrfForHostOut?: pulumi.Input<boolean | undefined>;
        /**
         * VLAN ID used for out-of-band management traffic
         */
        vlanId?: pulumi.Input<string | undefined>;
    }
    interface GatewayOobIpConfigNode1 {
        /**
         * Default gateway for the node1 out-of-band management interface when `type`==`static`
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Static IPv4 address for the node1 out-of-band management interface when `type`==`static`
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * IPv4 netmask or prefix length for the node1 out-of-band management interface when `type`==`static`; used only if `subnet` is not specified in `networks`
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * IP assignment mode for the node1 out-of-band management interface
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * If supported on the platform. If enabled, DNS will be using this routing-instance, too
         */
        useMgmtVrf?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to use `mgmtJunos` for host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired
         */
        useMgmtVrfForHostOut?: pulumi.Input<boolean | undefined>;
        /**
         * VLAN ID used for node1 out-of-band management traffic
         */
        vlanId?: pulumi.Input<string | undefined>;
    }
    interface GatewayPathPreferences {
        /**
         * Candidate paths evaluated for this gateway path preference
         */
        paths?: pulumi.Input<pulumi.Input<inputs.device.GatewayPathPreferencesPath>[] | undefined>;
        /**
         * Selection strategy used to evaluate the candidate paths
         */
        strategy?: pulumi.Input<string | undefined>;
    }
    interface GatewayPathPreferencesPath {
        /**
         * Relative cost assigned to this path for gateway path selection
         */
        cost?: pulumi.Input<number | undefined>;
        /**
         * For SSR Only. `true`, if this specific path is undesired
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `type`==`local`, if a different gateway is desired
         */
        gatewayIp?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`vpn`, if this vpn path can be used for internet
         */
        internetAccess?: pulumi.Input<boolean | undefined>;
        /**
         * Required when
         *   * `type`==`vpn`: the name of the VPN Path to use
         *   * `type`==`wan`: the name of the WAN interface to use
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * List of network names used when `type`==`local`
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * List of destination IP addresses to replace when `type`==`local`
         */
        targetIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Gateway path source type, such as local network, WAN interface, VPN path, or tunnel
         */
        type: pulumi.Input<string>;
        /**
         * Optional if `type`==`vpn`; WAN interface name associated with the VPN path
         */
        wanName?: pulumi.Input<string | undefined>;
    }
    interface GatewayPortConfig {
        /**
         * If `aggregated`==`true`. To disable LCP support for the AE interface
         */
        aeDisableLacp?: pulumi.Input<boolean | undefined>;
        /**
         * If `aggregated`==`true`. Users could force to use the designated AE name (must be an integer between 0 and 127)
         */
        aeIdx?: pulumi.Input<string | undefined>;
        /**
         * For SRX only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
         */
        aeLacpForceUp?: pulumi.Input<boolean | undefined>;
        /**
         * Whether the port participates in an aggregated Ethernet interface
         */
        aggregated?: pulumi.Input<boolean | undefined>;
        /**
         * To generate port up/down alarm, set it to true
         */
        critical?: pulumi.Input<boolean | undefined>;
        /**
         * Interface Description. Can be a variable (i.e. "{{myvar}}")
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Whether Ethernet autonegotiation is disabled on the port
         */
        disableAutoneg?: pulumi.Input<boolean | undefined>;
        /**
         * Port admin up (true) / down (false)
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * If `wanType`==`dsl`. DSL technology used by the WAN port
         */
        dslType?: pulumi.Input<string | undefined>;
        /**
         * If `wanType`==`dsl`, 16 bit int
         */
        dslVci?: pulumi.Input<number | undefined>;
        /**
         * If `wanType`==`dsl`, 8 bit int
         */
        dslVpi?: pulumi.Input<number | undefined>;
        /**
         * Ethernet duplex mode configured on the port
         */
        duplex?: pulumi.Input<string | undefined>;
        /**
         * Layer 3 IP configuration for the port
         */
        ipConfig?: pulumi.Input<inputs.device.GatewayPortConfigIpConfig | undefined>;
        /**
         * If `wanType`==`lte`. APN used by the LTE uplink
         */
        lteApn?: pulumi.Input<string | undefined>;
        /**
         * If `wanType`==`lte`. Authentication method used by the LTE uplink
         */
        lteAuth?: pulumi.Input<string | undefined>;
        /**
         * Whether the LTE uplink is used as a backup WAN connection
         */
        lteBackup?: pulumi.Input<boolean | undefined>;
        /**
         * If `wanType`==`lte`. Password used for LTE uplink authentication
         */
        ltePassword?: pulumi.Input<string | undefined>;
        /**
         * If `wanType`==`lte`. Username used for LTE uplink authentication
         */
        lteUsername?: pulumi.Input<string | undefined>;
        /**
         * Layer 3 MTU configured on the port
         */
        mtu?: pulumi.Input<number | undefined>;
        /**
         * Interface name used to derive device configuration
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * if `usage`==`lan`, name of the `junipermist.org.Network` resource
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * For Q-in-Q. Outer VLAN ID used for QinQ encapsulation
         */
        outerVlanId?: pulumi.Input<number | undefined>;
        /**
         * Whether PoE output is disabled on the port
         */
        poeDisabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether Perpetual PoE capabilities are enabled for a port
         */
        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
        /**
         * Only for SRX and if `usage`==`lan`, the name of the Network to be used as the Untagged VLAN
         */
        portNetwork?: pulumi.Input<string | undefined>;
        /**
         * Whether to preserve dscp when sending traffic over VPN (SSR-only)
         */
        preserveDscp?: pulumi.Input<boolean | undefined>;
        /**
         * If HA mode. Whether the port participates in the redundant Ethernet configuration
         */
        redundant?: pulumi.Input<boolean | undefined>;
        /**
         * If HA mode, SRX Only - support redundancy-group. 1-128 for physical SRX, 1-64 for virtual SRX
         */
        redundantGroup?: pulumi.Input<number | undefined>;
        /**
         * For SRX only and if HA Mode
         */
        rethIdx?: pulumi.Input<string | undefined>;
        /**
         * If HA mode. Node associated with the redundant Ethernet interface
         */
        rethNode?: pulumi.Input<string | undefined>;
        /**
         * If HA mode and for SSR only. Per-network node assignment used for VLAN-based redundancy
         */
        rethNodes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Link speed configured on the port
         */
        speed?: pulumi.Input<string | undefined>;
        /**
         * When SSR is running as VM, this is required on certain hosting platforms
         */
        ssrNoVirtualMac?: pulumi.Input<boolean | undefined>;
        /**
         * For SSR only. Port range configured on the interface
         */
        svrPortRange?: pulumi.Input<string | undefined>;
        /**
         * Traffic shaping settings applied to the port
         */
        trafficShaping?: pulumi.Input<inputs.device.GatewayPortConfigTrafficShaping | undefined>;
        /**
         * Logical usage assigned to the port
         */
        usage: pulumi.Input<string>;
        /**
         * VLAN ID or variable used when the WAN interface is carried on a VLAN
         */
        vlanId?: pulumi.Input<string | undefined>;
        /**
         * Per-VPN path settings for traffic that uses this port
         */
        vpnPaths?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayPortConfigVpnPaths>;
        } | undefined>;
        /**
         * Only when `wanType`==`broadband`. ARP policer profile applied to the WAN port
         */
        wanArpPolicer?: pulumi.Input<string | undefined>;
        /**
         * Only if `usage`==`wan`, optional. If spoke should reach this port by a different IP
         */
        wanExtIp?: pulumi.Input<string | undefined>;
        /**
         * Only if `usage`==`wan`, optional. If spoke should reach this port by a different IPv6
         */
        wanExtIp6?: pulumi.Input<string | undefined>;
        /**
         * Only if `usage`==`wan`. Property Key is the destination CIDR (e.g. "100.100.100.0/24")
         */
        wanExtraRoutes?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayPortConfigWanExtraRoutes>;
        } | undefined>;
        /**
         * Only if `usage`==`wan`. Property Key is the destination CIDR (e.g. "2a02:1234:420a:10c9::/64")
         */
        wanExtraRoutes6?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.GatewayPortConfigWanExtraRoutes6>;
        } | undefined>;
        /**
         * Only if `usage`==`wan`. Networks reachable through this WAN port for policy definition
         */
        wanNetworks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Optional WAN health probe override settings for this port
         */
        wanProbeOverride?: pulumi.Input<inputs.device.GatewayPortConfigWanProbeOverride | undefined>;
        /**
         * Source NAT settings applied to traffic leaving this WAN port
         */
        wanSourceNat?: pulumi.Input<inputs.device.GatewayPortConfigWanSourceNat | undefined>;
        /**
         * Controls whether Marvis or the scheduler can run speed tests on this WAN port
         */
        wanSpeedtestMode?: pulumi.Input<string | undefined>;
        /**
         * Only if `usage`==`wan`. WAN uplink type configured on the port
         */
        wanType?: pulumi.Input<string | undefined>;
    }
    interface GatewayPortConfigIpConfig {
        /**
         * Resolver server IP addresses used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0
         */
        dns?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * DNS search suffixes used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0
         */
        dnsSuffixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP address (i.e. "192.168.1.1") or a Variable (i.e. "{{myvar}}")
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IPv6 Address (i.e. "2001:db8::1") or a Variable (i.e. "{{myvar}}")
         */
        gateway6?: pulumi.Input<string | undefined>;
        /**
         * Interface IP address (i.e. "192.168.1.8") or a Variable (i.e. "{{myvar}}")
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Interface IPv6 Address (i.e. "2001:db8::123") or a Variable (i.e. "{{myvar}}")
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * Used only if `subnet` is not specified in `networks`. Interface Netmask (i.e. "/24") or a Variable (i.e. "{{myvar}}")
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * Used only if `subnet` is not specified in `networks`. Interface IPv6 Netmask (i.e. "/64") or a Variable (i.e. "{{myvar}}")
         */
        netmask6?: pulumi.Input<string | undefined>;
        /**
         * Optional, the network to be used for mgmt
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Password used for PPPoE when `type`==`pppoe`
         */
        poserPassword?: pulumi.Input<string | undefined>;
        /**
         * Authentication protocol used for PPPoE when `type`==`pppoe`
         */
        pppoeAuth?: pulumi.Input<string | undefined>;
        /**
         * Username used for PPPoE when `type`==`pppoe`
         */
        pppoeUsername?: pulumi.Input<string | undefined>;
        /**
         * IPv4 assignment mode for this gateway port interface
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 assignment mode for this gateway port interface
         */
        type6?: pulumi.Input<string | undefined>;
    }
    interface GatewayPortConfigTrafficShaping {
        /**
         * Traffic class bandwidth percentages for high, medium, low, and best-effort queues
         */
        classPercentages?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether traffic shaping is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Maximum transmit bandwidth for the interface, in Kbps
         */
        maxTxKbps?: pulumi.Input<number | undefined>;
    }
    interface GatewayPortConfigVpnPaths {
        /**
         * BFD profile used for this VPN path when the VPN `type`==`hubSpoke`
         */
        bfdProfile?: pulumi.Input<string | undefined>;
        /**
         * Only if the VPN `type`==`hubSpoke`. Whether to use tunnel mode. SSR only
         */
        bfdUseTunnelMode?: pulumi.Input<boolean | undefined>;
        /**
         * Only if the VPN `type`==`hubSpoke`. For a given VPN, when `path_selection.strategy`==`simple`, the preference for a path (lower is preferred)
         */
        preference?: pulumi.Input<number | undefined>;
        /**
         * Gateway role for this VPN path; valid values depend on the VPN `type`
         */
        role?: pulumi.Input<string | undefined>;
        /**
         * Traffic shaping settings applied to this VPN path
         */
        trafficShaping?: pulumi.Input<inputs.device.GatewayPortConfigVpnPathsTrafficShaping | undefined>;
    }
    interface GatewayPortConfigVpnPathsTrafficShaping {
        /**
         * Traffic class bandwidth percentages for high, medium, low, and best-effort queues
         */
        classPercentages?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether traffic shaping is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Maximum transmit bandwidth for the interface, in Kbps
         */
        maxTxKbps?: pulumi.Input<number | undefined>;
    }
    interface GatewayPortConfigWanExtraRoutes {
        /**
         * IPv4 next-hop address for this WAN extra route
         */
        via?: pulumi.Input<string | undefined>;
    }
    interface GatewayPortConfigWanExtraRoutes6 {
        /**
         * IPv6 next-hop address for this WAN extra route
         */
        via?: pulumi.Input<string | undefined>;
    }
    interface GatewayPortConfigWanProbeOverride {
        /**
         * List of IPv6 probe host addresses used by this WAN override
         */
        ip6s?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * List of IPv4 probe host addresses used by this WAN override
         */
        ips?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * WAN probe profile used for health checks on this port
         */
        probeProfile?: pulumi.Input<string | undefined>;
    }
    interface GatewayPortConfigWanSourceNat {
        /**
         * Or to disable the source-nat
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * If alternative natPool is desired
         */
        nat6Pool?: pulumi.Input<string | undefined>;
        /**
         * If alternative natPool is desired
         */
        natPool?: pulumi.Input<string | undefined>;
    }
    interface GatewayPortMirroring {
        /**
         * Mirroring rule that copies ingress traffic from source ports to an output port
         */
        portMirror?: pulumi.Input<inputs.device.GatewayPortMirroringPortMirror | undefined>;
    }
    interface GatewayPortMirroringPortMirror {
        /**
         * Packet family used for this port mirroring rule
         */
        familyType?: pulumi.Input<string | undefined>;
        /**
         * Source gateway port IDs whose ingress traffic is mirrored
         */
        ingressPortIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Destination gateway port ID that receives mirrored traffic
         */
        outputPortId?: pulumi.Input<string | undefined>;
        /**
         * Sampling rate applied to mirrored traffic
         */
        rate?: pulumi.Input<number | undefined>;
        /**
         * Number of bytes copied from each mirrored packet
         */
        runLength?: pulumi.Input<number | undefined>;
    }
    interface GatewayRoutingPolicies {
        /**
         * Ordered terms evaluated by this gateway routing policy
         */
        terms?: pulumi.Input<pulumi.Input<inputs.device.GatewayRoutingPoliciesTerm>[] | undefined>;
    }
    interface GatewayRoutingPoliciesTerm {
        /**
         * Policy actions applied when this routing policy term matches
         */
        actions?: pulumi.Input<inputs.device.GatewayRoutingPoliciesTermActions | undefined>;
        /**
         * Route match criteria that must be satisfied before actions are applied
         */
        matching?: pulumi.Input<inputs.device.GatewayRoutingPoliciesTermMatching | undefined>;
    }
    interface GatewayRoutingPoliciesTermActions {
        /**
         * Whether to accept routes that match this term
         */
        accept?: pulumi.Input<boolean | undefined>;
        /**
         * BGP communities to add to routes that match this term
         */
        addCommunities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * SSR target VRFs to add when leaking routes from hub to spoke
         */
        addTargetVrfs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities to set when this term is used as an export policy
         */
        communities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * AS path values to exclude when this term is used as an export policy
         */
        excludeAsPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities to exclude from routes that match this term
         */
        excludeCommunities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities allowed for export when this term is used as an export policy
         */
        exportCommunities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Preference value to set when this term is used as an import policy
         */
        localPreference?: pulumi.Input<string | undefined>;
        /**
         * AS path values to prepend when this term is used as an export policy
         */
        prependAsPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewayRoutingPoliciesTermMatching {
        /**
         * BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}`)
         */
        asPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities that routes must match
         */
        communities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Configured network names that routes must match
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Route prefixes that routes must match
         */
        prefixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * enum: `aggregate`, `bgp`, `direct`, `ospf`, `static` (SRX Only)
         */
        protocols?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Existing route condition that must be satisfied before this term matches
         */
        routeExists?: pulumi.Input<inputs.device.GatewayRoutingPoliciesTermMatchingRouteExists | undefined>;
        /**
         * Overlay neighbor MAC addresses used as match criteria for BGP sessions with `via`==`vpn`
         */
        vpnNeighborMacs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * SLA thresholds used when matching a VPN path
         */
        vpnPathSla?: pulumi.Input<inputs.device.GatewayRoutingPoliciesTermMatchingVpnPathSla | undefined>;
        /**
         * Overlay path names used as match criteria for BGP sessions with `via`==`vpn`
         */
        vpnPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewayRoutingPoliciesTermMatchingRouteExists {
        /**
         * Prefix that must exist for this condition to match
         */
        route?: pulumi.Input<string | undefined>;
        /**
         * Name of the VRF instance where the route is checked; can also be a VPN or WAN name when applicable
         */
        vrfName?: pulumi.Input<string | undefined>;
    }
    interface GatewayRoutingPoliciesTermMatchingVpnPathSla {
        /**
         * Maximum jitter threshold allowed for the VPN path
         */
        maxJitter?: pulumi.Input<number | undefined>;
        /**
         * Maximum latency threshold allowed for the VPN path
         */
        maxLatency?: pulumi.Input<number | undefined>;
        /**
         * Maximum packet-loss threshold allowed for the VPN path
         */
        maxLoss?: pulumi.Input<number | undefined>;
    }
    interface GatewayServicePolicy {
        /**
         * Required when `servicepolicyId` is not defined, optional otherwise (override the servicepolicy action). enum: `allow`, `deny`
         */
        action?: pulumi.Input<string | undefined>;
        /**
         * Malware and virus inspection settings applied by this service policy
         */
        antivirus?: pulumi.Input<inputs.device.GatewayServicePolicyAntivirus | undefined>;
        /**
         * Application QoE settings applied by this service policy
         */
        appqoe?: pulumi.Input<inputs.device.GatewayServicePolicyAppqoe | undefined>;
        /**
         * Enhanced web filtering rules applied by this service policy
         */
        ewfs?: pulumi.Input<pulumi.Input<inputs.device.GatewayServicePolicyEwf>[] | undefined>;
        /**
         * Intrusion detection and prevention settings applied by this service policy
         */
        idp?: pulumi.Input<inputs.device.GatewayServicePolicyIdp | undefined>;
        /**
         * Whether the policy permits access within the same VRF
         */
        localRouting?: pulumi.Input<boolean | undefined>;
        /**
         * Required when `servicepolicyId` is not defined, optional otherwise (override the servicepolicy name)
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * By default, we derive all paths available and use them. Optionally, you can customize by using `pathPreference`
         */
        pathPreference?: pulumi.Input<string | undefined>;
        /**
         * Organization-level service policy identifier used to link and override selected attributes
         */
        servicepolicyId?: pulumi.Input<string | undefined>;
        /**
         * Required when `servicepolicyId` is not defined. List of Applications / Destinations
         */
        services?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Threat inspection settings provided by Sky ATP for this service policy
         */
        skyatp?: pulumi.Input<inputs.device.GatewayServicePolicySkyatp | undefined>;
        /**
         * TLS inspection settings applied by this service policy
         */
        sslProxy?: pulumi.Input<inputs.device.GatewayServicePolicySslProxy | undefined>;
        /**
         * Remote logging settings applied by this service policy
         */
        syslog?: pulumi.Input<inputs.device.GatewayServicePolicySyslog | undefined>;
        /**
         * Required when `servicepolicyId` is not defined. List of Networks / Users
         */
        tenants?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewayServicePolicyAntivirus {
        /**
         * Organization-level antivirus profile ID; takes precedence over inline `profile` settings
         */
        avprofileId?: pulumi.Input<string | undefined>;
        /**
         * Whether antivirus inspection is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Antivirus profile name to apply, such as `default`, `noftp`, `httponly`, or an AV profile key
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface GatewayServicePolicyAppqoe {
        /**
         * Whether application QoE is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewayServicePolicyEwf {
        /**
         * Whether matching enhanced web filtering traffic is logged without being blocked
         */
        alertOnly?: pulumi.Input<boolean | undefined>;
        /**
         * Message returned when enhanced web filtering blocks a request
         */
        blockMessage?: pulumi.Input<string | undefined>;
        /**
         * Whether this enhanced web filtering rule is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Enhanced web filtering profile applied by this rule
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface GatewayServicePolicyIdp {
        /**
         * Whether to alert without enforcing IDP prevention actions
         */
        alertOnly?: pulumi.Input<boolean | undefined>;
        /**
         * Whether IDP inspection is enabled for the policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * org_level IDP Profile can be used, this takes precedence over `profile`
         */
        idpprofileId?: pulumi.Input<string | undefined>;
        /**
         * enum: `Custom`, `strict` (default), `standard` or keys from idp_profiles
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface GatewayServicePolicySkyatp {
        /**
         * Detection settings for DNS DGA threats provided by Sky ATP
         */
        dnsDgaDetection?: pulumi.Input<inputs.device.GatewayServicePolicySkyatpDnsDgaDetection | undefined>;
        /**
         * Detection settings for DNS tunneling threats provided by Sky ATP
         */
        dnsTunnelDetection?: pulumi.Input<inputs.device.GatewayServicePolicySkyatpDnsTunnelDetection | undefined>;
        /**
         * Web traffic inspection settings provided by Sky ATP
         */
        httpInspection?: pulumi.Input<inputs.device.GatewayServicePolicySkyatpHttpInspection | undefined>;
        /**
         * Device threat policy settings provided by Sky ATP for IoT clients
         */
        iotDevicePolicy?: pulumi.Input<inputs.device.GatewayServicePolicySkyatpIotDevicePolicy | undefined>;
    }
    interface GatewayServicePolicySkyatpDnsDgaDetection {
        /**
         * Whether Sky ATP DNS DGA detection is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Sky ATP DNS DGA detection profile to apply
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface GatewayServicePolicySkyatpDnsTunnelDetection {
        /**
         * Whether Sky ATP DNS tunneling detection is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Sky ATP DNS tunneling detection profile to apply
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface GatewayServicePolicySkyatpHttpInspection {
        /**
         * Whether Sky ATP HTTP inspection is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Sky ATP HTTP inspection profile to apply
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface GatewayServicePolicySkyatpIotDevicePolicy {
        /**
         * Whether Sky ATP IoT device policy inspection is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewayServicePolicySslProxy {
        /**
         * Allowed cipher strength category for SSL proxy inspection
         */
        ciphersCategory?: pulumi.Input<string | undefined>;
        /**
         * Whether SSL proxy inspection is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewayServicePolicySyslog {
        /**
         * Whether syslog logging is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Names of syslog servers that receive logs for this service policy
         */
        serverNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewayTunnelConfigs {
        /**
         * Provider auto-provisioning settings for tunnel endpoints
         */
        autoProvision?: pulumi.Input<inputs.device.GatewayTunnelConfigsAutoProvision | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
         */
        ikeLifetime?: pulumi.Input<number | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. IKE negotiation mode for the tunnel
         */
        ikeMode?: pulumi.Input<string | undefined>;
        /**
         * If `provider`==`custom-ipsec`, IKE proposals used for custom IPsec negotiation
         */
        ikeProposals?: pulumi.Input<pulumi.Input<inputs.device.GatewayTunnelConfigsIkeProposal>[] | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
         */
        ipsecLifetime?: pulumi.Input<number | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. IPsec proposals used for custom IPsec negotiation
         */
        ipsecProposals?: pulumi.Input<pulumi.Input<inputs.device.GatewayTunnelConfigsIpsecProposal>[] | undefined>;
        /**
         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
         */
        localId?: pulumi.Input<string | undefined>;
        /**
         * Local protected subnets advertised by this tunnel
         */
        localSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Tunnel failover mode used for primary and secondary endpoints
         */
        mode?: pulumi.Input<string | undefined>;
        /**
         * Destination networks reachable through this tunnel
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Main remote tunnel endpoint settings
         */
        primary?: pulumi.Input<inputs.device.GatewayTunnelConfigsPrimary | undefined>;
        /**
         * Tunnel health probe settings
         */
        probe?: pulumi.Input<inputs.device.GatewayTunnelConfigsProbe | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. Tunnel protocol for custom tunnel negotiation
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Tunnel provider used when auto provisioning is disabled
         */
        provider?: pulumi.Input<string | undefined>;
        /**
         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
         */
        psk?: pulumi.Input<string | undefined>;
        /**
         * Remote protected subnets reached through policy-based IPsec
         */
        remoteSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Backup remote tunnel endpoint settings
         */
        secondary?: pulumi.Input<inputs.device.GatewayTunnelConfigsSecondary | undefined>;
        /**
         * Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. Tunnel version value for custom tunnel configuration
         */
        version?: pulumi.Input<string | undefined>;
    }
    interface GatewayTunnelConfigsAutoProvision {
        /**
         * Enable auto provisioning for the tunnel. If enabled, the `primary` and `secondary` nodes will be ignored.
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Geographic coordinate override used for tunnel POP selection
         */
        latlng?: pulumi.Input<inputs.device.GatewayTunnelConfigsAutoProvisionLatlng | undefined>;
        /**
         * Main auto-provisioned tunnel endpoint settings
         */
        primary?: pulumi.Input<inputs.device.GatewayTunnelConfigsAutoProvisionPrimary | undefined>;
        /**
         * Tunnel provider used for automatic endpoint provisioning
         */
        provider: pulumi.Input<string>;
        /**
         * API override for POP selection in the case user wants to override the auto discovery of remote network location and force the tunnel to use the specified peer location.
         */
        region?: pulumi.Input<string | undefined>;
        /**
         * Backup auto-provisioned tunnel endpoint settings
         */
        secondary?: pulumi.Input<inputs.device.GatewayTunnelConfigsAutoProvisionSecondary | undefined>;
        /**
         * if `provider`==`prisma-ipsec`. By default, we'll use the location of the site to determine the optimal Remote Network location, optionally, serviceConnection can be considered, then we'll also consider this along with the site location. Define serviceConnection if the traffic is to be routed to a specific service connection. This field takes a service connection name that is configured in the Prisma cloud, Prisma Access Setup > Service Connections.
         */
        serviceConnection?: pulumi.Input<string | undefined>;
    }
    interface GatewayTunnelConfigsAutoProvisionLatlng {
        /**
         * Geographic latitude used for POP selection override
         */
        lat: pulumi.Input<number>;
        /**
         * Geographic longitude used for POP selection override
         */
        lng: pulumi.Input<number>;
    }
    interface GatewayTunnelConfigsAutoProvisionPrimary {
        /**
         * Probe IP addresses used to monitor auto-provisioned tunnel reachability
         */
        probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * WAN interface names used by the auto-provisioned tunnel endpoint
         */
        wanNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewayTunnelConfigsAutoProvisionSecondary {
        /**
         * Probe IP addresses used to monitor auto-provisioned tunnel reachability
         */
        probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * WAN interface names used by the auto-provisioned tunnel endpoint
         */
        wanNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewayTunnelConfigsIkeProposal {
        /**
         * Integrity algorithm used by this IKE proposal
         */
        authAlgo?: pulumi.Input<string | undefined>;
        /**
         * Diffie-Hellman group used by this IKE proposal
         */
        dhGroup?: pulumi.Input<string | undefined>;
        /**
         * Cipher algorithm used by this IKE proposal
         */
        encAlgo?: pulumi.Input<string | undefined>;
    }
    interface GatewayTunnelConfigsIpsecProposal {
        /**
         * Integrity algorithm used by this IPsec proposal
         */
        authAlgo?: pulumi.Input<string | undefined>;
        /**
         * Diffie-Hellman group used by this IPsec proposal
         */
        dhGroup?: pulumi.Input<string | undefined>;
        /**
         * Cipher algorithm used by this IPsec proposal
         */
        encAlgo?: pulumi.Input<string | undefined>;
    }
    interface GatewayTunnelConfigsPrimary {
        /**
         * Remote gateway host addresses for this tunnel node
         */
        hosts: pulumi.Input<pulumi.Input<string>[]>;
        /**
         * Internal IP addresses configured on this tunnel node
         */
        internalIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Health-check IP addresses used to monitor this tunnel node
         */
        probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IKE identities expected from this tunnel node
         */
        remoteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Interface names that source tunnel traffic for this node
         */
        wanNames: pulumi.Input<pulumi.Input<string>[]>;
    }
    interface GatewayTunnelConfigsProbe {
        /**
         * How often to trigger the probe
         */
        interval?: pulumi.Input<number | undefined>;
        /**
         * Number of consecutive misses before declaring the tunnel down
         */
        threshold?: pulumi.Input<number | undefined>;
        /**
         * Time within which to complete the connectivity check
         */
        timeout?: pulumi.Input<number | undefined>;
        /**
         * Protocol used by the custom IPsec tunnel health probe
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface GatewayTunnelConfigsSecondary {
        /**
         * Remote gateway host addresses for this tunnel node
         */
        hosts: pulumi.Input<pulumi.Input<string>[]>;
        /**
         * Internal IP addresses configured on this tunnel node
         */
        internalIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Health-check IP addresses used to monitor this tunnel node
         */
        probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IKE identities expected from this tunnel node
         */
        remoteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Interface names that source tunnel traffic for this node
         */
        wanNames: pulumi.Input<pulumi.Input<string>[]>;
    }
    interface GatewayTunnelProviderOptions {
        /**
         * Juniper Secure Edge provisioning options for tunnel endpoints
         */
        jse?: pulumi.Input<inputs.device.GatewayTunnelProviderOptionsJse | undefined>;
        /**
         * Palo Alto Prisma Access provisioning options for tunnel endpoints
         */
        prisma?: pulumi.Input<inputs.device.GatewayTunnelProviderOptionsPrisma | undefined>;
        /**
         * Provider settings for Zscaler tunnel endpoints
         */
        zscaler?: pulumi.Input<inputs.device.GatewayTunnelProviderOptionsZscaler | undefined>;
    }
    interface GatewayTunnelProviderOptionsJse {
        /**
         * User capacity to provision on Juniper Secure Edge
         */
        numUsers?: pulumi.Input<number | undefined>;
        /**
         * JSE Organization name
         */
        orgName?: pulumi.Input<string | undefined>;
    }
    interface GatewayTunnelProviderOptionsPrisma {
        /**
         * For prisma-ipsec, service account name to used for tunnel auto provisioning
         */
        serviceAccountName?: pulumi.Input<string | undefined>;
    }
    interface GatewayTunnelProviderOptionsZscaler {
        /**
         * Whether Zscaler blocks internet access until the Acceptable Use Policy is accepted
         */
        aupBlockInternetUntilAccepted?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
         */
        aupEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
         */
        aupForceSslInspection?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `aupEnabled`==`true`. Days before AUP is requested again
         */
        aupTimeoutInDays?: pulumi.Input<number | undefined>;
        /**
         * Enable this option to enforce user authentication
         */
        authRequired?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
         */
        cautionEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Download bandwidth cap of the link, in Mbps. Disabled if not set
         */
        dnBandwidth?: pulumi.Input<number | undefined>;
        /**
         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
         */
        idleTimeInMinutes?: pulumi.Input<number | undefined>;
        /**
         * If `true`, enable the firewall control option
         */
        ofwEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Per-network Zscaler sub-location settings
         */
        subLocations?: pulumi.Input<pulumi.Input<inputs.device.GatewayTunnelProviderOptionsZscalerSubLocation>[] | undefined>;
        /**
         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
         */
        surrogateIp?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
         */
        surrogateIpEnforcedForKnownBrowsers?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
         */
        surrogateRefreshTimeInMinutes?: pulumi.Input<number | undefined>;
        /**
         * Download bandwidth cap of the link, in Mbps. Disabled if not set
         */
        upBandwidth?: pulumi.Input<number | undefined>;
        /**
         * Location uses proxy chaining to forward traffic
         */
        xffForwardEnabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewayTunnelProviderOptionsZscalerSubLocation {
        /**
         * Whether this sub-location blocks internet access until the Acceptable Use Policy is accepted
         */
        aupBlockInternetUntilAccepted?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
         */
        aupEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
         */
        aupForceSslInspection?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `aupEnabled`==`true`. Days before AUP is requested again
         */
        aupTimeoutInDays?: pulumi.Input<number | undefined>;
        /**
         * Enable this option to authenticate users
         */
        authRequired?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
         */
        cautionEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Download bandwidth cap of the link, in Mbps. Disabled if not set
         */
        dnBandwidth?: pulumi.Input<number | undefined>;
        /**
         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
         */
        idleTimeInMinutes?: pulumi.Input<number | undefined>;
        /**
         * Network name
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * If `true`, enable the firewall control option
         */
        ofwEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
         */
        surrogateIp?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
         */
        surrogateIpEnforcedForKnownBrowsers?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
         */
        surrogateRefreshTimeInMinutes?: pulumi.Input<number | undefined>;
        /**
         * Download bandwidth cap of the link, in Mbps. Disabled if not set
         */
        upBandwidth?: pulumi.Input<number | undefined>;
    }
    interface GatewayVrfConfig {
        /**
         * Whether to enable VRF (when supported on the device)
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewayVrfInstances {
        /**
         * Network names included in this gateway VRF instance
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SwitchAclPolicy {
        /**
         * Destination tag actions evaluated for sources matching this ACL policy
         */
        actions?: pulumi.Input<pulumi.Input<inputs.device.SwitchAclPolicyAction>[] | undefined>;
        /**
         * Display name of the ACL policy
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Source ACL tags that select traffic for this ACL policy
         */
        srcTags?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SwitchAclPolicyAction {
        /**
         * Allow or deny decision applied to traffic matching the destination tag
         */
        action?: pulumi.Input<string | undefined>;
        /**
         * Destination ACL tag matched by this policy action
         */
        dstTag: pulumi.Input<string>;
    }
    interface SwitchAclTags {
        /**
         * Layer 2 EtherTypes matched by this ACL tag; defaults to `any`
         */
        etherTypes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Required if
         *   - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
         *   - `type`==`gbpResource`
         *   - `type`==`staticGbp` (applying gbp tag against matching conditions)
         */
        gbpTag?: pulumi.Input<number | undefined>;
        /**
         * Client or resource MAC addresses matched by this ACL tag
         */
        macs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If:
         *   * `type`==`mac` (optional. default is `any`)
         *   * `type`==`subnet` (optional. default is `any`)
         *   * `type`==`network`
         *   * `type`==`resource` (optional. default is `any`)
         *   * `type`==`staticGbp` if from matching network (vlan)
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Required if `type`==`portUsage`. Switch port usage name matched by this ACL tag
         */
        portUsage?: pulumi.Input<string | undefined>;
        /**
         * Required if:
         *   * `type`==`radiusGroup`
         *   * `type`==`staticGbp`
         * if from matching radius_group
         */
        radiusGroup?: pulumi.Input<string | undefined>;
        /**
         * Layer 4 protocol and destination-port constraints for this ACL tag
         */
        specs?: pulumi.Input<pulumi.Input<inputs.device.SwitchAclTagsSpec>[] | undefined>;
        /**
         * IP subnets matched by this ACL tag
         */
        subnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Classifier type that determines which ACL tag fields are evaluated
         */
        type: pulumi.Input<string>;
    }
    interface SwitchAclTagsSpec {
        /**
         * Matched dst port, "0" means any
         */
        portRange?: pulumi.Input<string | undefined>;
        /**
         * `tcp` / `udp` / `icmp` / `icmp6` / `gre` / `any` / `:protocol_number`, `protocolNumber` is between 1-254, default is `any` `protocolNumber` is between 1-254
         */
        protocol?: pulumi.Input<string | undefined>;
    }
    interface SwitchBgpConfig {
        /**
         * Authentication key used for BGP neighbor sessions, when configured
         */
        authKey?: pulumi.Input<string | undefined>;
        /**
         * Minimum interval in milliseconds for BFD hello packets. A neighbor is considered failed when the device stops receiving replies after the specified interval. Value must be between 1 and 255000.
         */
        bfdMinimumInterval?: pulumi.Input<number | undefined>;
        /**
         * Export policy must match one of the policy names defined in the `routingPolicies` property.
         */
        exportPolicy?: pulumi.Input<string | undefined>;
        /**
         * Default BGP hold time for switch BGP sessions
         */
        holdTime?: pulumi.Input<number | undefined>;
        /**
         * Import policy must match one of the policy names defined in the `routingPolicies` property.
         */
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * Local BGP Autonomous System (AS) number for the switch
         */
        localAs: pulumi.Input<string>;
        /**
         * BGP neighbor settings keyed by neighbor IP address
         */
        neighbors?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.SwitchBgpConfigNeighbors>;
        } | undefined>;
        /**
         * Network names used to add BGP groups to the corresponding VRFs
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP session type for this switch BGP configuration
         */
        type: pulumi.Input<string>;
    }
    interface SwitchBgpConfigNeighbors {
        /**
         * Export policy must match one of the policy names defined in the `routingPolicies` property.
         */
        exportPolicy?: pulumi.Input<string | undefined>;
        /**
         * BGP hold time for this neighbor
         */
        holdTime?: pulumi.Input<number | undefined>;
        /**
         * Import policy must match one of the policy names defined in the `routingPolicies` property.
         */
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * Time-to-live value for multihop BGP sessions to this neighbor
         */
        multihopTtl?: pulumi.Input<number | undefined>;
        /**
         * Autonomous System (AS) number of the BGP neighbor. For internal BGP, this must match `localAs`. For external BGP, this must differ from `localAs`.
         */
        neighborAs: pulumi.Input<string>;
    }
    interface SwitchDhcpSnooping {
        /**
         * Whether DHCP snooping applies to all configured networks
         */
        allNetworks?: pulumi.Input<boolean | undefined>;
        /**
         * Enable for dynamic ARP inspection check
         */
        enableArpSpoofCheck?: pulumi.Input<boolean | undefined>;
        /**
         * Enable for check for forging source IP address
         */
        enableIpSourceGuard?: pulumi.Input<boolean | undefined>;
        /**
         * Whether DHCP snooping is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Network names with DHCP snooping enabled when `allNetworks`==`false`
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SwitchDhcpdConfig {
        /**
         * Property key is the network name
         */
        config?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.SwitchDhcpdConfigConfig>;
        } | undefined>;
        /**
         * Whether switch DHCP server or relay configuration is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SwitchDhcpdConfigConfig {
        /**
         * If `type`==`server` or `type6`==`server`, DNS servers advertised to DHCP clients
         */
        dnsServers?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type`==`server` or `type6`==`server`, DNS search suffixes advertised to DHCP clients
         */
        dnsSuffixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type`==`server` or `type6`==`server`, fixed client bindings for DHCP service
         */
        fixedBindings?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.SwitchDhcpdConfigConfigFixedBindings>;
        } | undefined>;
        /**
         * If `type`==`server` - optional, `ip` will be used if not provided
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`server`, ending IPv4 address for the DHCP lease pool
         */
        ipEnd?: pulumi.Input<string | undefined>;
        /**
         * If `type6`==`server`, ending IPv6 address for the DHCP lease pool
         */
        ipEnd6?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`server`, starting IPv4 address for the DHCP lease pool
         */
        ipStart?: pulumi.Input<string | undefined>;
        /**
         * If `type6`==`server`, starting IPv6 address for the DHCP lease pool
         */
        ipStart6?: pulumi.Input<string | undefined>;
        /**
         * In seconds, lease time has to be between 3600 [1hr] - 604800 [1 week], default is 86400 [1 day]
         */
        leaseTime?: pulumi.Input<number | undefined>;
        /**
         * If `type`==`server` or `type6`==`server`, custom DHCP options advertised to clients
         */
        options?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.SwitchDhcpdConfigConfigOptions>;
        } | undefined>;
        /**
         * `serverIdOverride`==`true` means the device, when acts as DHCP relay and forwards DHCP responses from DHCP server to clients,
         * should overwrite the Sever Identifier option (i.e. DHCP option 54) in DHCP responses with its own IP address.
         */
        serverIdOverride?: pulumi.Input<boolean | undefined>;
        /**
         * If `type`==`relay`, upstream IPv4 DHCP servers
         */
        servers?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type6`==`relay`, upstream IPv6 DHCP servers
         */
        servers6s?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IPv4 DHCP mode for this switch network
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 DHCP mode for this switch network
         */
        type6?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`server` or `type6`==`server`, vendor-encapsulated DHCP options advertised to clients
         */
        vendorEncapsulated?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.SwitchDhcpdConfigConfigVendorEncapsulated>;
        } | undefined>;
    }
    interface SwitchDhcpdConfigConfigFixedBindings {
        /**
         * Reserved IPv4 address for this fixed DHCP binding
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Reserved IPv6 address for this fixed DHCP binding
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * Friendly name for this fixed DHCP binding
         */
        name?: pulumi.Input<string | undefined>;
    }
    interface SwitchDhcpdConfigConfigOptions {
        /**
         * Data type used to encode this DHCP option value
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Option value to send for this DHCP option
         */
        value?: pulumi.Input<string | undefined>;
    }
    interface SwitchDhcpdConfigConfigVendorEncapsulated {
        /**
         * Data type used to encode this vendor option value
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Option value to send for this vendor option
         */
        value?: pulumi.Input<string | undefined>;
    }
    interface SwitchExtraRoutes {
        /**
         * Whether to install a discard route; this takes precedence over next-hop settings
         */
        discard?: pulumi.Input<boolean | undefined>;
        /**
         * Route metric for the IPv4 static route
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * Qualified next-hop settings keyed by IPv4 next-hop address
         */
        nextQualified?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.SwitchExtraRoutesNextQualified>;
        } | undefined>;
        /**
         * Whether to prevent recursive next-hop resolution for the IPv4 static route
         */
        noResolve?: pulumi.Input<boolean | undefined>;
        /**
         * Route preference for the IPv4 static route
         */
        preference?: pulumi.Input<number | undefined>;
        /**
         * Next-hop IPv4 address or ECMP next-hop IPv4 addresses for the route
         */
        via: pulumi.Input<string>;
    }
    interface SwitchExtraRoutes6 {
        /**
         * Whether to install a discard route; this takes precedence over next-hop settings
         */
        discard?: pulumi.Input<boolean | undefined>;
        /**
         * Route metric for the IPv6 static route
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * Qualified next-hop settings keyed by IPv6 next-hop address
         */
        nextQualified?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.SwitchExtraRoutes6NextQualified>;
        } | undefined>;
        /**
         * Whether to prevent recursive next-hop resolution for the IPv6 static route
         */
        noResolve?: pulumi.Input<boolean | undefined>;
        /**
         * Route preference for the IPv6 static route
         */
        preference?: pulumi.Input<number | undefined>;
        /**
         * Next-hop IPv6 address or ECMP next-hop IPv6 addresses for the route
         */
        via: pulumi.Input<string>;
    }
    interface SwitchExtraRoutes6NextQualified {
        /**
         * Route metric for this qualified IPv6 next hop
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * Route preference for this qualified IPv6 next hop
         */
        preference?: pulumi.Input<number | undefined>;
    }
    interface SwitchExtraRoutesNextQualified {
        /**
         * Route metric for this qualified IPv4 next hop
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * Route preference for this qualified IPv4 next hop
         */
        preference?: pulumi.Input<number | undefined>;
    }
    interface SwitchIpConfig {
        /**
         * Required when `type`==`static`
         */
        dns?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * DNS search suffixes configured for Junos management traffic
         */
        dnsSuffixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Default gateway IPv4 address for this Junos IP configuration
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Configured IPv4 address for this Junos IP configuration
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Used only if `subnet` is not specified in `networks`
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * Management network for this IP configuration; used as the default source network for outbound SSH, DNS, NTP, TACACS+, RADIUS, syslog, and SNMP
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * IP assignment mode for this Junos IP configuration
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface SwitchLocalPortConfig {
        /**
         * Only if `mode`==`trunk` whether to trunk all network/vlans
         */
        allNetworks?: pulumi.Input<boolean | undefined>;
        /**
         * Controls whether DHCP server traffic is allowed on ports using this configuration if DHCP snooping is enabled. This is a tri-state setting; `true`: ports become trusted ports allowing DHCP server traffic, `false`: ports become untrusted blocking DHCP server traffic, undefined: use system defaults (access ports default to untrusted, trunk ports default to trusted).
         */
        allowDhcpd?: pulumi.Input<boolean | undefined>;
        /**
         * Whether multiple supplicants may authenticate on the port
         */
        allowMultipleSupplicants?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `portAuth`==`dot1x` bypass auth for known clients if set to true when RADIUS server is down
         */
        bypassAuthWhenServerDown?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `portAuth`=`dot1x` bypass auth for all (including unknown clients) if set to true when RADIUS server is down
         */
        bypassAuthWhenServerDownForUnknownClient?: pulumi.Input<boolean | undefined>;
        /**
         * Human-readable description for this local port configuration
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` if speed and duplex are specified, whether to disable autonegotiation
         */
        disableAutoneg?: pulumi.Input<boolean | undefined>;
        /**
         * Whether the port is disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Link duplex mode for this local port configuration
         */
        duplex?: pulumi.Input<string | undefined>;
        /**
         * Only if `portAuth`==`dot1x`, networks or VLANs that RADIUS can return for dynamic VLAN assignment
         */
        dynamicVlanNetworks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Only if `portAuth`==`dot1x` whether to enable MAC Auth
         */
        enableMacAuth?: pulumi.Input<boolean | undefined>;
        /**
         * Whether QoS is enabled on ports using this local configuration
         */
        enableQos?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `portAuth`==`dot1x` which network to put the device into if the device cannot do dot1x. default is null (i.e. not allowed)
         */
        guestNetwork?: pulumi.Input<string | undefined>;
        /**
         * Used together with "isolation" under networks for links between Juniper devices; must be applied to both connected ports
         */
        interSwitchLink?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `enableMacAuth`==`true`, whether to use MAC authentication without 802.1X
         */
        macAuthOnly?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `enableMacAuth`==`true` + `macAuthOnly`==`false`, dot1x will be given priority then mac_auth. Enable this to prefer macAuth over dot1x.
         */
        macAuthPreferred?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `enableMacAuth`==`true`, MAC authentication protocol to use
         */
        macAuthProtocol?: pulumi.Input<string | undefined>;
        /**
         * Max number of MAC addresses, default is 0 for unlimited, otherwise range is 1 or higher, with upper bound constrained by platform
         */
        macLimit?: pulumi.Input<number | undefined>;
        /**
         * Switching mode for this local port configuration
         */
        mode?: pulumi.Input<string | undefined>;
        /**
         * Media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation. The default value is 1514.
         */
        mtu?: pulumi.Input<number | undefined>;
        /**
         * Only if `mode`==`trunk`, network or VLAN names to trunk
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Additional note for the port config override
         */
        note?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`==`access` and `portAuth`!=`dot1x` whether the port should retain dynamically learned MAC addresses
         */
        persistMac?: pulumi.Input<boolean | undefined>;
        /**
         * Whether PoE capabilities are disabled for a port
         */
        poeDisabled?: pulumi.Input<boolean | undefined>;
        /**
         * 802.1X authentication mode for this local port configuration
         */
        portAuth?: pulumi.Input<string | undefined>;
        /**
         * Native network/vlan for untagged traffic
         */
        portNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only `portAuth`=`dot1x`, reauthentication interval range between 10 and 65535 (default: 3600)
         */
        reauthInterval?: pulumi.Input<string | undefined>;
        /**
         * Only if `portAuth`==`dot1x` sets server fail fallback vlan
         */
        serverFailNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `portAuth`==`dot1x` when RADIUS server reject / fails
         */
        serverRejectNetwork?: pulumi.Input<string | undefined>;
        /**
         * Link speed for this local port configuration
         */
        speed?: pulumi.Input<string | undefined>;
        /**
         * Storm-control settings for this local port configuration
         */
        stormControl?: pulumi.Input<inputs.device.SwitchLocalPortConfigStormControl | undefined>;
        /**
         * When enabled, the port is not expected to receive BPDU frames
         */
        stpEdge?: pulumi.Input<boolean | undefined>;
        /**
         * Whether STP should prevent this port from becoming a root port
         */
        stpNoRootPort?: pulumi.Input<boolean | undefined>;
        /**
         * Whether STP treats this port as a point-to-point link
         */
        stpP2p?: pulumi.Input<boolean | undefined>;
        /**
         * Port usage profile name for this local port configuration
         */
        usage: pulumi.Input<string>;
        /**
         * If this is connected to a vstp network
         */
        useVstp?: pulumi.Input<boolean | undefined>;
        /**
         * Network/vlan for voip traffic, must also set port_network. to authenticate device, set port_auth
         */
        voipNetwork?: pulumi.Input<string | undefined>;
    }
    interface SwitchLocalPortConfigStormControl {
        /**
         * Whether to disable the port when storm control is triggered
         */
        disablePort?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on broadcast traffic
         */
        noBroadcast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on multicast traffic
         */
        noMulticast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on registered multicast traffic
         */
        noRegisteredMulticast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on unknown unicast traffic
         */
        noUnknownUnicast?: pulumi.Input<boolean | undefined>;
        /**
         * Bandwidth-percentage, configures the storm control level as a percentage of the available bandwidth
         */
        percentage?: pulumi.Input<number | undefined>;
    }
    interface SwitchMistNac {
        /**
         * Whether Mist NAC RadSec is enabled for the switch
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Switch network used for Mist NAC RadSec connectivity
         */
        network?: pulumi.Input<string | undefined>;
    }
    interface SwitchNetworks {
        /**
         * Only required for EVPN-VXLAN networks, IPv4 Virtual Gateway
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Only required for EVPN-VXLAN networks, IPv6 Virtual Gateway
         */
        gateway6?: pulumi.Input<string | undefined>;
        /**
         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required). NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set. See also `interIsolationNetworkLink` and `communityVlanId` in port_usage
         */
        isolation?: pulumi.Input<boolean | undefined>;
        /**
         * Required when `isolation`==`true`. Unique VLAN ID used for client isolation
         */
        isolationVlanId?: pulumi.Input<string | undefined>;
        /**
         * Optional for pure switching, required when L3 / routing features are used
         */
        subnet?: pulumi.Input<string | undefined>;
        /**
         * Optional for pure switching, required when L3 / routing features are used
         */
        subnet6?: pulumi.Input<string | undefined>;
        /**
         * VLAN identifier for this switch network
         */
        vlanId: pulumi.Input<string>;
    }
    interface SwitchOobIpConfig {
        /**
         * Default gateway for the out-of-band management interface when `type`==`static`
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Static IPv4 address for the out-of-band management interface when `type`==`static`
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Used only if `subnet` is not specified in `networks`
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * Optional, the network to be used for mgmt
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * IP assignment mode for the out-of-band management interface
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * If supported on the platform. If enabled, DNS will be using this routing-instance, too
         */
        useMgmtVrf?: pulumi.Input<boolean | undefined>;
        /**
         * For host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired
         */
        useMgmtVrfForHostOut?: pulumi.Input<boolean | undefined>;
    }
    interface SwitchOspfAreas {
        /**
         * Whether loopback interfaces are included in this OSPF area
         */
        includeLoopback?: pulumi.Input<boolean | undefined>;
        /**
         * OSPF network settings keyed by network name
         */
        networks: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.SwitchOspfAreasNetworks>;
        }>;
        /**
         * Area type for this OSPF area
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface SwitchOspfAreasNetworks {
        /**
         * Required if `authType`==`md5`. Property key is the key number
         */
        authKeys?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
        /**
         * Required if `authType`==`password`, the password, max length is 8
         */
        authPassword?: pulumi.Input<string | undefined>;
        /**
         * Authentication method used by this OSPF network
         */
        authType?: pulumi.Input<string | undefined>;
        /**
         * Minimum BFD interval for this OSPF network, in milliseconds
         */
        bfdMinimumInterval?: pulumi.Input<number | undefined>;
        /**
         * OSPF dead interval for this network, in seconds
         */
        deadInterval?: pulumi.Input<number | undefined>;
        /**
         * Routing policy used to export routes from this OSPF network
         */
        exportPolicy?: pulumi.Input<string | undefined>;
        /**
         * OSPF hello interval for this network, in seconds
         */
        helloInterval?: pulumi.Input<number | undefined>;
        /**
         * Routing policy used to import routes for this OSPF network
         */
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * OSPF interface type used for this network
         */
        interfaceType?: pulumi.Input<string | undefined>;
        /**
         * OSPF metric assigned to this network
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * By default, we'll re-advertise all learned OSPF routes toward overlay
         */
        noReadvertiseToOverlay?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to send OSPF-Hello
         */
        passive?: pulumi.Input<boolean | undefined>;
    }
    interface SwitchOspfConfig {
        /**
         * OSPF areas configured on the switch
         */
        areas?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.SwitchOspfConfigAreas>;
        } | undefined>;
        /**
         * Enable OSPF on the switch
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * optional, for basic scenario, `importPolicy` can be specified and can be applied to all networks in all areas if not explicitly specified
         */
        exportPolicy?: pulumi.Input<string | undefined>;
        /**
         * optional, for basic scenario, `importPolicy` can be specified and can be applied to all networks in all areas if not explicitly specified
         */
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * Reference bandwidth used for OSPF cost calculation
         */
        referenceBandwidth?: pulumi.Input<string | undefined>;
    }
    interface SwitchOspfConfigAreas {
        /**
         * Disable OSPF summary routes for this area
         */
        noSummary?: pulumi.Input<boolean | undefined>;
    }
    interface SwitchOtherIpConfigs {
        /**
         * For EVPN, whether anycast is desired
         */
        evpnAnycast?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `type`==`static`; IPv4 address for the additional Junos L3 presence
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Required if `type6`==`static`; IPv6 address for the additional Junos L3 presence
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * Optional IPv4 netmask; `subnet` from `network` definition will be used if defined
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * Optional IPv6 prefix length; `subnet` from `network` definition will be used if defined
         */
        netmask6?: pulumi.Input<string | undefined>;
        /**
         * IPv4 assignment mode for the additional Junos L3 presence
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 assignment mode for the additional Junos L3 presence
         */
        type6?: pulumi.Input<string | undefined>;
    }
    interface SwitchPortConfig {
        /**
         * To disable LACP support for the AE interface
         */
        aeDisableLacp?: pulumi.Input<boolean | undefined>;
        /**
         * Users could force to use the designated AE name
         */
        aeIdx?: pulumi.Input<number | undefined>;
        /**
         * If `aggregated`==`true`, sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
         */
        aeLacpForceUp?: pulumi.Input<boolean | undefined>;
        /**
         * If `aggregated`==`true`, sets LACP to passive mode on this AE interface; by default, active (fast) mode is used
         */
        aeLacpPassive?: pulumi.Input<boolean | undefined>;
        /**
         * To use slow timeout
         */
        aeLacpSlow?: pulumi.Input<boolean | undefined>;
        /**
         * Whether this port is configured as an aggregated Ethernet member
         */
        aggregated?: pulumi.Input<boolean | undefined>;
        /**
         * To generate port up/down alarm
         */
        critical?: pulumi.Input<boolean | undefined>;
        /**
         * Human-readable description for this Junos port
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * If `speed` and `duplex` are specified, whether to disable autonegotiation
         */
        disableAutoneg?: pulumi.Input<boolean | undefined>;
        /**
         * Link duplex mode for this Junos port
         */
        duplex?: pulumi.Input<string | undefined>;
        /**
         * Enable dynamic usage for this port. Set to `dynamic` to enable.
         */
        dynamicUsage?: pulumi.Input<string | undefined>;
        /**
         * Whether this Junos port participates in an ESI-LAG
         */
        esilag?: pulumi.Input<boolean | undefined>;
        /**
         * Media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation
         */
        mtu?: pulumi.Input<number | undefined>;
        /**
         * List of network names. Required if `usage`==`inet`
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Prevent helpdesk to override the port config
         */
        noLocalOverwrite?: pulumi.Input<boolean | undefined>;
        /**
         * Whether PoE capabilities are disabled for this Junos port
         */
        poeDisabled?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `usage`==`vlanTunnel`. Q-in-Q tunneling using All-in-one bundling. This also enables standard L2PT for interfaces that are not encapsulation tunnel interfaces and uses MAC rewrite operation. [View more information](https://www.juniper.net/documentation/us/en/software/junos/multicast-l2/topics/topic-map/q-in-q.html#id-understanding-qinq-tunneling-and-vlan-translation)
         */
        portNetwork?: pulumi.Input<string | undefined>;
        /**
         * Link speed for this Junos port
         */
        speed?: pulumi.Input<string | undefined>;
        /**
         * Port usage name. For Q-in-Q, use `vlanTunnel`. If EVPN is used, use `evpnUplink`or `evpnDownlink`
         */
        usage: pulumi.Input<string>;
    }
    interface SwitchPortConfigOverwrite {
        /**
         * Administrative description applied to the switch port override
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Whether the port is disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Link duplex mode override for the switch port
         */
        duplex?: pulumi.Input<string | undefined>;
        /**
         * MAC address learning limit override for the switch port
         */
        macLimit?: pulumi.Input<string | undefined>;
        /**
         * Whether PoE capabilities are disabled for a port
         */
        poeDisabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether Perpetual PoE is enabled; keeps PoE state across reboots
         */
        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
        /**
         * Native network/vlan for untagged traffic
         */
        portNetwork?: pulumi.Input<string | undefined>;
        /**
         * Link speed override for the switch port
         */
        speed?: pulumi.Input<string | undefined>;
    }
    interface SwitchPortMirroring {
        /**
         * At least one mirror input source should be specified. Networks whose ingress traffic is mirrored
         */
        inputNetworksIngresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * At least one mirror input source should be specified. Switch ports whose egress traffic is mirrored
         */
        inputPortIdsEgresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * At least one mirror input source should be specified. Switch ports whose ingress traffic is mirrored
         */
        inputPortIdsIngresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputIpAddress?: pulumi.Input<string | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputNetwork?: pulumi.Input<string | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputPortId?: pulumi.Input<string | undefined>;
    }
    interface SwitchPortUsages {
        /**
         * Only if `mode`==`trunk`. Whether to trunk all network/vlans
         */
        allNetworks?: pulumi.Input<boolean | undefined>;
        /**
         * Only applies when `mode`!=`dynamic`. Controls whether DHCP server traffic is allowed on ports using this configuration if DHCP snooping is enabled. This is a tri-state setting; `true`: ports become trusted ports allowing DHCP server traffic, `false`: ports become untrusted blocking DHCP server traffic, undefined: use system defaults (access ports default to untrusted, trunk ports default to trusted).
         */
        allowDhcpd?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        allowMultipleSupplicants?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Bypass auth for known clients if set to true when RADIUS server is down
         */
        bypassAuthWhenServerDown?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`=`dot1x`. Bypass auth for all (including unknown clients) if set to true when RADIUS server is down
         */
        bypassAuthWhenServerDownForUnknownClient?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Bypass auth for VOIP if set to true when RADIUS server is down
         */
        bypassAuthWhenServerDownForVoip?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. To be used together with `isolation` under networks. Signaling that this port connects to the networks isolated but wired clients belong to the same community can talk to each other
         */
        communityVlanId?: pulumi.Input<number | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. If speed and duplex are specified, whether to disable autonegotiation
         */
        disableAutoneg?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether the port is disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Link duplex mode for this port usage
         */
        duplex?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Networks or VLANs that RADIUS can return for dynamic VLAN assignment
         */
        dynamicVlanNetworks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Whether to enable MAC Auth
         */
        enableMacAuth?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        enableQos?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Which network to put the device into if the device cannot do dot1x. default is null (i.e. not allowed)
         */
        guestNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. `interIsolationNetworkLink` is used together with `isolation` under networks, signaling that this port connects to isolated networks
         */
        interIsolationNetworkLink?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. `interSwitchLink` is used together with `isolation` under networks. NOTE: `interSwitchLink` works only between Juniper devices. This has to be applied to both ports connected together
         */
        interSwitchLink?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `enableMacAuth`==`true`
         */
        macAuthOnly?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` + `enableMacAuth`==`true` + `macAuthOnly`==`false`, dot1x will be given priority then mac_auth. Enable this to prefer macAuth over dot1x.
         */
        macAuthPreferred?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `enableMacAuth`==`true`. MAC authentication protocol to use; ignored if Mist NAC is enabled
         */
        macAuthProtocol?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` max number of mac addresses, default is 0 for unlimited, otherwise range is 1 to 16383 (upper bound constrained by platform)
         */
        macLimit?: pulumi.Input<string | undefined>;
        /**
         * Switching mode for this port usage
         */
        mode?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation. Value between 256 and 9216, default value is 1514.
         */
        mtu?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`==`trunk`. Network or VLAN names to trunk
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Only if `mode`==`access` and `portAuth`!=`dot1x`. Whether the port should retain dynamically learned MAC addresses
         */
        persistMac?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether PoE capabilities are disabled for a port
         */
        poeDisabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether Perpetual PoE is enabled; keeps PoE state across reboots
         */
        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. PoE priority for ports using this port usage
         */
        poePriority?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. 802.1X authentication mode for this port usage
         */
        portAuth?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Native network/vlan for untagged traffic
         */
        portNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`=`dot1x` reauthentication interval range between 10 and 65535 (default: 3600)
         */
        reauthInterval?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`==`dynamic`. Condition that resets a dynamic port to the default port usage
         */
        resetDefaultWhen?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`==`dynamic`. Dynamic matching rules that select the port usage to apply
         */
        rules?: pulumi.Input<pulumi.Input<inputs.device.SwitchPortUsagesRule>[] | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Sets server fail fallback vlan
         */
        serverFailNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Interval, in seconds. Sets the wait time before retrying authentication after RADIUS failure to reduce client flapping. Range 120-65535
         */
        serverFailRetryInterval?: pulumi.Input<number | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. When RADIUS server reject / fails
         */
        serverRejectNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Link speed for this port usage
         */
        speed?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Storm-control settings for this port usage
         */
        stormControl?: pulumi.Input<inputs.device.SwitchPortUsagesStormControl | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `stpRequired`==`false`. Drop bridge protocol data units (BPDUs ) that enter any interface or a specified interface
         */
        stpDisable?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. When enabled, the port is not expected to receive BPDU frames
         */
        stpEdge?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        stpNoRootPort?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        stpP2p?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether to remain in block state if no BPDU is received
         */
        stpRequired?: pulumi.Input<boolean | undefined>;
        /**
         * If this is connected to a vstp network
         */
        useVstp?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Network/vlan for voip traffic, must also set port_network. to authenticate device, set port_auth
         */
        voipNetwork?: pulumi.Input<string | undefined>;
    }
    interface SwitchPortUsagesRule {
        /**
         * Optional description of the rule
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Exact value that the selected source attribute must match
         */
        equals?: pulumi.Input<string | undefined>;
        /**
         * List of values where any match satisfies this dynamic rule
         */
        equalsAnies?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * "[0:3]":"abcdef" > "abc"
         * "split(.)[1]": "a.b.c" > "b"
         * "split(-)[1][0:3]: "a1234-b5678-c90" > "b56"
         */
        expression?: pulumi.Input<string | undefined>;
        /**
         * Source attribute evaluated by this dynamic rule
         */
        src: pulumi.Input<string>;
        /**
         * Port usage name to apply when this dynamic rule matches
         */
        usage?: pulumi.Input<string | undefined>;
    }
    interface SwitchPortUsagesStormControl {
        /**
         * Whether to disable the port when storm control is triggered
         */
        disablePort?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on broadcast traffic
         */
        noBroadcast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on multicast traffic
         */
        noMulticast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on registered multicast traffic
         */
        noRegisteredMulticast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on unknown unicast traffic
         */
        noUnknownUnicast?: pulumi.Input<boolean | undefined>;
        /**
         * Bandwidth-percentage, configures the storm control level as a percentage of the available bandwidth
         */
        percentage?: pulumi.Input<number | undefined>;
    }
    interface SwitchRadiusConfig {
        /**
         * Whether immediate RADIUS accounting updates are sent
         */
        acctImmediateUpdate?: pulumi.Input<boolean | undefined>;
        /**
         * How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled
         */
        acctInterimInterval?: pulumi.Input<number | undefined>;
        /**
         * RADIUS accounting servers used by this switch configuration
         */
        acctServers?: pulumi.Input<pulumi.Input<inputs.device.SwitchRadiusConfigAcctServer>[] | undefined>;
        /**
         * Selection strategy for RADIUS authentication servers
         */
        authServerSelection?: pulumi.Input<string | undefined>;
        /**
         * RADIUS authentication servers used by this switch configuration
         */
        authServers?: pulumi.Input<pulumi.Input<inputs.device.SwitchRadiusConfigAuthServer>[] | undefined>;
        /**
         * RADIUS auth session retries
         */
        authServersRetries?: pulumi.Input<number | undefined>;
        /**
         * RADIUS auth session timeout
         */
        authServersTimeout?: pulumi.Input<number | undefined>;
        /**
         * Whether RADIUS Change of Authorization (CoA) is enabled
         */
        coaEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * UDP port used for RADIUS Change of Authorization (CoA)
         */
        coaPort?: pulumi.Input<string | undefined>;
        /**
         * Whether fast 802.1X timers are enabled for RADIUS authentication
         */
        fastDot1xTimers?: pulumi.Input<boolean | undefined>;
        /**
         * Use `network`or `sourceIp`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Use `network` or `sourceIp`. Explicit source IP address for RADIUS traffic
         */
        sourceIp?: pulumi.Input<string | undefined>;
    }
    interface SwitchRadiusConfigAcctServer {
        /**
         * Address or hostname of the RADIUS accounting server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this accounting server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS accounting server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used with this RADIUS accounting server
         */
        secret: pulumi.Input<string>;
    }
    interface SwitchRadiusConfigAuthServer {
        /**
         * Address or hostname of the RADIUS authentication server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this authentication server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS authentication server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Whether to require Message-Authenticator in requests
         */
        requireMessageAuthenticator?: pulumi.Input<boolean | undefined>;
        /**
         * Shared secret used with this RADIUS authentication server
         */
        secret: pulumi.Input<string>;
    }
    interface SwitchRemoteSyslog {
        /**
         * Retention settings for generated syslog archive files
         */
        archive?: pulumi.Input<inputs.device.SwitchRemoteSyslogArchive | undefined>;
        /**
         * CA certificates used to verify TLS syslog servers
         */
        cacerts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Log forwarding filters for console messages sent to remote syslog
         */
        console?: pulumi.Input<inputs.device.SwitchRemoteSyslogConsole | undefined>;
        /**
         * Whether remote syslog forwarding is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Local syslog file definitions to generate and forward
         */
        files?: pulumi.Input<pulumi.Input<inputs.device.SwitchRemoteSyslogFile>[] | undefined>;
        /**
         * Source network used for syslog traffic. If `sourceAddress` is configured, Mist uses the VLAN first; otherwise it uses `sourceIp`
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Whether each log entry is sent to all configured remote syslog servers
         */
        sendToAllServers?: pulumi.Input<boolean | undefined>;
        /**
         * Remote syslog server destinations
         */
        servers?: pulumi.Input<pulumi.Input<inputs.device.SwitchRemoteSyslogServer>[] | undefined>;
        /**
         * Timestamp format used in forwarded syslog messages
         */
        timeFormat?: pulumi.Input<string | undefined>;
        /**
         * User-specific syslog logging rules
         */
        users?: pulumi.Input<pulumi.Input<inputs.device.SwitchRemoteSyslogUser>[] | undefined>;
    }
    interface SwitchRemoteSyslogArchive {
        /**
         * Number of archived syslog files to retain
         */
        files?: pulumi.Input<string | undefined>;
        /**
         * Maximum size of each archived syslog file, such as 5m
         */
        size?: pulumi.Input<string | undefined>;
    }
    interface SwitchRemoteSyslogConsole {
        /**
         * Syslog facilities and severities forwarded from console logs
         */
        contents?: pulumi.Input<pulumi.Input<inputs.device.SwitchRemoteSyslogConsoleContent>[] | undefined>;
    }
    interface SwitchRemoteSyslogConsoleContent {
        /**
         * Syslog facility to match for this selector
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Syslog severity to match for this selector
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface SwitchRemoteSyslogFile {
        /**
         * Retention settings for this generated syslog file
         */
        archive?: pulumi.Input<inputs.device.SwitchRemoteSyslogFileArchive | undefined>;
        /**
         * Syslog facilities and severities written to this file
         */
        contents?: pulumi.Input<pulumi.Input<inputs.device.SwitchRemoteSyslogFileContent>[] | undefined>;
        /**
         * Only if `protocol`==`tcp`, enable TLS for this syslog file destination
         */
        enableTls?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to include explicit syslog priority values in file output
         */
        explicitPriority?: pulumi.Input<boolean | undefined>;
        /**
         * Generated syslog file name
         */
        file?: pulumi.Input<string | undefined>;
        /**
         * Expression used to filter log messages written to this file
         */
        match?: pulumi.Input<string | undefined>;
        /**
         * Whether to include structured syslog data in file output
         */
        structuredData?: pulumi.Input<boolean | undefined>;
    }
    interface SwitchRemoteSyslogFileArchive {
        /**
         * Number of archived syslog files to retain
         */
        files?: pulumi.Input<string | undefined>;
        /**
         * Maximum size of each archived syslog file, such as 5m
         */
        size?: pulumi.Input<string | undefined>;
    }
    interface SwitchRemoteSyslogFileContent {
        /**
         * Syslog facility to match for this selector
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Syslog severity to match for this selector
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface SwitchRemoteSyslogServer {
        /**
         * Syslog facilities and severities sent to this server
         */
        contents?: pulumi.Input<pulumi.Input<inputs.device.SwitchRemoteSyslogServerContent>[] | undefined>;
        /**
         * Whether to include explicit syslog priority values in messages sent to this server
         */
        explicitPriority?: pulumi.Input<boolean | undefined>;
        /**
         * Default syslog facility for messages sent to this server
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Address or hostname of the remote syslog server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * Expression used to filter log messages sent to this server
         */
        match?: pulumi.Input<string | undefined>;
        /**
         * Network port used by the remote syslog server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Transport protocol used for this remote syslog server
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Routing instance used to reach this remote syslog server
         */
        routingInstance?: pulumi.Input<string | undefined>;
        /**
         * TLS server name used when verifying the remote syslog server certificate
         */
        serverName?: pulumi.Input<string | undefined>;
        /**
         * Default syslog severity for messages sent to this server
         */
        severity?: pulumi.Input<string | undefined>;
        /**
         * Source address for syslog traffic. If configured, Mist uses the VLAN first; otherwise it uses `sourceIp`
         */
        sourceAddress?: pulumi.Input<string | undefined>;
        /**
         * Whether to include structured syslog data in messages sent to this server
         */
        structuredData?: pulumi.Input<boolean | undefined>;
        /**
         * Syslog tag value added to messages sent to this server
         */
        tag?: pulumi.Input<string | undefined>;
    }
    interface SwitchRemoteSyslogServerContent {
        /**
         * Syslog facility to match for this selector
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Syslog severity to match for this selector
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface SwitchRemoteSyslogUser {
        /**
         * Syslog facilities and severities logged for this user rule
         */
        contents?: pulumi.Input<pulumi.Input<inputs.device.SwitchRemoteSyslogUserContent>[] | undefined>;
        /**
         * Expression used to filter user log messages
         */
        match?: pulumi.Input<string | undefined>;
        /**
         * Account name or wildcard matched by this syslog rule
         */
        user?: pulumi.Input<string | undefined>;
    }
    interface SwitchRemoteSyslogUserContent {
        /**
         * Syslog facility to match for this selector
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Syslog severity to match for this selector
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface SwitchRoutingPolicies {
        /**
         * Ordered terms evaluated by this switch routing policy
         */
        terms?: pulumi.Input<pulumi.Input<inputs.device.SwitchRoutingPoliciesTerm>[] | undefined>;
    }
    interface SwitchRoutingPoliciesTerm {
        /**
         * Policy actions applied when this routing policy term matches
         */
        actions?: pulumi.Input<inputs.device.SwitchRoutingPoliciesTermActions | undefined>;
        /**
         * Route match criteria that must be satisfied before actions are applied
         */
        matching?: pulumi.Input<inputs.device.SwitchRoutingPoliciesTermMatching | undefined>;
        /**
         * Display name of the switch routing policy term
         */
        name: pulumi.Input<string>;
    }
    interface SwitchRoutingPoliciesTermActions {
        /**
         * Whether to accept routes that match this term
         */
        accept?: pulumi.Input<boolean | undefined>;
        /**
         * BGP communities to set when this term is used as an export policy
         */
        communities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Optional, for an import policy, localPreference can be changed, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}`)
         */
        localPreference?: pulumi.Input<string | undefined>;
        /**
         * AS path values to prepend when this term is used as an export policy
         */
        prependAsPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SwitchRoutingPoliciesTermMatching {
        /**
         * BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}`)
         */
        asPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities that routes must match
         */
        communities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Route prefixes that routes must match
         */
        prefixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * enum: `bgp`, `direct`, `evpn`, `ospf`, `static`
         */
        protocols?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SwitchSnmpConfig {
        /**
         * SNMP client allowlists that can be referenced by communities
         */
        clientLists?: pulumi.Input<pulumi.Input<inputs.device.SwitchSnmpConfigClientList>[] | undefined>;
        /**
         * Administrative contact string advertised through SNMP
         */
        contact?: pulumi.Input<string | undefined>;
        /**
         * Device description string advertised through SNMP
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Whether SNMP is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * SNMP engine ID used for SNMPv3
         */
        engineId?: pulumi.Input<string | undefined>;
        /**
         * Method used to derive the SNMP engine ID
         */
        engineIdType?: pulumi.Input<string | undefined>;
        /**
         * Physical location string advertised through SNMP
         */
        location?: pulumi.Input<string | undefined>;
        /**
         * System name advertised through SNMP
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Management network used for SNMP traffic
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * SNMP trap group definitions
         */
        trapGroups?: pulumi.Input<pulumi.Input<inputs.device.SwitchSnmpConfigTrapGroup>[] | undefined>;
        /**
         * SNMPv2c community configuration entries for this SNMP profile
         */
        v2cConfigs?: pulumi.Input<pulumi.Input<inputs.device.SwitchSnmpConfigV2cConfig>[] | undefined>;
        /**
         * SNMPv3 user, VACM, notify, and target configuration
         */
        v3Config?: pulumi.Input<inputs.device.SwitchSnmpConfigV3Config | undefined>;
        /**
         * SNMP MIB view definitions
         */
        views?: pulumi.Input<pulumi.Input<inputs.device.SwitchSnmpConfigView>[] | undefined>;
    }
    interface SwitchSnmpConfigClientList {
        /**
         * Name of the SNMP client list
         */
        clientListName?: pulumi.Input<string | undefined>;
        /**
         * SNMP client IP addresses or CIDR ranges allowed by this list
         */
        clients?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SwitchSnmpConfigTrapGroup {
        /**
         * Trap categories included in this SNMP trap group
         */
        categories?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Trap group name for this SNMP trap group
         */
        groupName?: pulumi.Input<string | undefined>;
        /**
         * Trap target addresses for this SNMP trap group
         */
        targets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * SNMP trap protocol version used by this group
         */
        version?: pulumi.Input<string | undefined>;
    }
    interface SwitchSnmpConfigV2cConfig {
        /**
         * Access level for the SNMPv2c community
         */
        authorization?: pulumi.Input<string | undefined>;
        /**
         * SNMP client list name referenced by this community
         */
        clientListName?: pulumi.Input<string | undefined>;
        /**
         * SNMPv2c community string name
         */
        communityName?: pulumi.Input<string | undefined>;
        /**
         * SNMP view name that must be defined in the views list
         */
        view?: pulumi.Input<string | undefined>;
    }
    interface SwitchSnmpConfigV3Config {
        /**
         * SNMPv3 notification definitions used for traps and informs
         */
        notifies?: pulumi.Input<pulumi.Input<inputs.device.SwitchSnmpConfigV3ConfigNotify>[] | undefined>;
        /**
         * SNMPv3 notification filter profiles
         */
        notifyFilters?: pulumi.Input<pulumi.Input<inputs.device.SwitchSnmpConfigV3ConfigNotifyFilter>[] | undefined>;
        /**
         * SNMPv3 notification target addresses
         */
        targetAddresses?: pulumi.Input<pulumi.Input<inputs.device.SwitchSnmpConfigV3ConfigTargetAddress>[] | undefined>;
        /**
         * SNMPv3 target parameter profiles
         */
        targetParameters?: pulumi.Input<pulumi.Input<inputs.device.SwitchSnmpConfigV3ConfigTargetParameter>[] | undefined>;
        /**
         * SNMPv3 USM engine configurations
         */
        usms?: pulumi.Input<pulumi.Input<inputs.device.SwitchSnmpConfigV3ConfigUsm>[] | undefined>;
        /**
         * SNMPv3 VACM access control configuration
         */
        vacm?: pulumi.Input<inputs.device.SwitchSnmpConfigV3ConfigVacm | undefined>;
    }
    interface SwitchSnmpConfigV3ConfigNotify {
        /**
         * Identifier for this SNMPv3 notification definition
         */
        name: pulumi.Input<string>;
        /**
         * Notification tag used to select target addresses
         */
        tag: pulumi.Input<string>;
        /**
         * Delivery mode for this SNMPv3 notification, such as trap or inform
         */
        type: pulumi.Input<string>;
    }
    interface SwitchSnmpConfigV3ConfigNotifyFilter {
        /**
         * OID filter rules in this notification filter profile
         */
        contents?: pulumi.Input<pulumi.Input<inputs.device.SwitchSnmpConfigV3ConfigNotifyFilterContent>[] | undefined>;
        /**
         * Notification filter profile name
         */
        profileName?: pulumi.Input<string | undefined>;
    }
    interface SwitchSnmpConfigV3ConfigNotifyFilterContent {
        /**
         * Whether the matching OID subtree is included
         */
        include?: pulumi.Input<boolean | undefined>;
        /**
         * Matched OID subtree for this notification filter rule
         */
        oid: pulumi.Input<string>;
    }
    interface SwitchSnmpConfigV3ConfigTargetAddress {
        /**
         * IP address or hostname of the SNMP target
         */
        address: pulumi.Input<string>;
        /**
         * Mask applied to the SNMP target address
         */
        addressMask: pulumi.Input<string>;
        /**
         * UDP port used by the SNMP target
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Set of notification tags for this target address; use spaces between multiple tags
         */
        tagList?: pulumi.Input<string | undefined>;
        /**
         * Name of the SNMP target address entry
         */
        targetAddressName: pulumi.Input<string>;
        /**
         * Target parameter profile referenced by this target address
         */
        targetParameters?: pulumi.Input<string | undefined>;
    }
    interface SwitchSnmpConfigV3ConfigTargetParameter {
        /**
         * SNMP message processing model used by this target parameter profile
         */
        messageProcessingModel: pulumi.Input<string>;
        /**
         * Target parameter profile name
         */
        name: pulumi.Input<string>;
        /**
         * Notification filter profile referenced by this target parameter profile
         */
        notifyFilter?: pulumi.Input<string | undefined>;
        /**
         * Required security level for this target parameter profile
         */
        securityLevel?: pulumi.Input<string | undefined>;
        /**
         * Required security model for this target parameter profile
         */
        securityModel?: pulumi.Input<string | undefined>;
        /**
         * USM security name referenced by this target parameter profile
         */
        securityName?: pulumi.Input<string | undefined>;
    }
    interface SwitchSnmpConfigV3ConfigUsm {
        /**
         * SNMP engine type used for this USM configuration
         */
        engineType: pulumi.Input<string>;
        /**
         * Required only if `engineType`==`remoteEngine`
         */
        remoteEngineId?: pulumi.Input<string | undefined>;
        /**
         * SNMPv3 USM users for this engine
         */
        users?: pulumi.Input<pulumi.Input<inputs.device.SwitchSnmpConfigV3ConfigUsmUser>[] | undefined>;
    }
    interface SwitchSnmpConfigV3ConfigUsmUser {
        /**
         * Not required if `authenticationType`==`authentication-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters.
         */
        authenticationPassword?: pulumi.Input<string | undefined>;
        /**
         * Authentication protocol used by this SNMPv3 USM user
         */
        authenticationType?: pulumi.Input<string | undefined>;
        /**
         * Not required if `encryptionType`==`privacy-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters
         */
        encryptionPassword?: pulumi.Input<string | undefined>;
        /**
         * Privacy protocol used by this SNMPv3 USM user
         */
        encryptionType?: pulumi.Input<string | undefined>;
        /**
         * Username for the SNMPv3 USM user
         */
        name?: pulumi.Input<string | undefined>;
    }
    interface SwitchSnmpConfigV3ConfigVacm {
        /**
         * VACM access rules for SNMPv3
         */
        accesses?: pulumi.Input<pulumi.Input<inputs.device.SwitchSnmpConfigV3ConfigVacmAccess>[] | undefined>;
        /**
         * VACM security-name to group mappings
         */
        securityToGroup?: pulumi.Input<inputs.device.SwitchSnmpConfigV3ConfigVacmSecurityToGroup | undefined>;
    }
    interface SwitchSnmpConfigV3ConfigVacmAccess {
        /**
         * SNMP VACM group name
         */
        groupName?: pulumi.Input<string | undefined>;
        /**
         * Context prefix rules for this VACM group
         */
        prefixLists?: pulumi.Input<pulumi.Input<inputs.device.SwitchSnmpConfigV3ConfigVacmAccessPrefixList>[] | undefined>;
    }
    interface SwitchSnmpConfigV3ConfigVacmAccessPrefixList {
        /**
         * Context prefix for this VACM access rule. Required only if `type`==`contextPrefix`
         */
        contextPrefix?: pulumi.Input<string | undefined>;
        /**
         * Notify view name referenced by this VACM access rule
         */
        notifyView?: pulumi.Input<string | undefined>;
        /**
         * Read view name referenced by this VACM access rule
         */
        readView?: pulumi.Input<string | undefined>;
        /**
         * Required security level for this VACM access rule
         */
        securityLevel?: pulumi.Input<string | undefined>;
        /**
         * Required security model for this VACM access rule
         */
        securityModel?: pulumi.Input<string | undefined>;
        /**
         * VACM context matching type for this access rule
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Write view name referenced by this VACM access rule
         */
        writeView?: pulumi.Input<string | undefined>;
    }
    interface SwitchSnmpConfigV3ConfigVacmSecurityToGroup {
        /**
         * VACM security-name to group mapping entries
         */
        contents?: pulumi.Input<pulumi.Input<inputs.device.SwitchSnmpConfigV3ConfigVacmSecurityToGroupContent>[] | undefined>;
        /**
         * Required security model for these VACM group mappings
         */
        securityModel?: pulumi.Input<string | undefined>;
    }
    interface SwitchSnmpConfigV3ConfigVacmSecurityToGroupContent {
        /**
         * VACM group name referenced by this mapping
         */
        group?: pulumi.Input<string | undefined>;
        /**
         * Name of the SNMP security principal mapped to a VACM group
         */
        securityName?: pulumi.Input<string | undefined>;
    }
    interface SwitchSnmpConfigView {
        /**
         * Whether the root OID is included in this SNMP view
         */
        include?: pulumi.Input<boolean | undefined>;
        /**
         * Root OID for this SNMP view
         */
        oid?: pulumi.Input<string | undefined>;
        /**
         * Name of the SNMP MIB view definition
         */
        viewName?: pulumi.Input<string | undefined>;
    }
    interface SwitchStpConfig {
        /**
         * Switch STP priority. Range [0, 4k, 8k.. 60k] in steps of 4k. Bridge priority applies to both VSTP and RSTP.
         */
        bridgePriority?: pulumi.Input<string | undefined>;
    }
    interface SwitchSwitchMgmt {
        /**
         * AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used.
         */
        apAffinityThreshold?: pulumi.Input<number | undefined>;
        /**
         * Set Banners for switches. Allows markup formatting
         */
        cliBanner?: pulumi.Input<string | undefined>;
        /**
         * Sets timeout for switches
         */
        cliIdleTimeout?: pulumi.Input<number | undefined>;
        /**
         * Rollback timer for commit confirmed
         */
        configRevertTimer?: pulumi.Input<number | undefined>;
        /**
         * Enable to provide the FQDN with DHCP option 81
         */
        dhcpOptionFqdn?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to suppress alarms when the switch out-of-band management interface is down
         */
        disableOobDownAlarm?: pulumi.Input<boolean | undefined>;
        /**
         * Whether FIPS mode is enabled on the switch
         */
        fipsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Local switch user accounts keyed by username
         */
        localAccounts?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.SwitchSwitchMgmtLocalAccounts>;
        } | undefined>;
        /**
         * IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud
         */
        mxedgeProxyHost?: pulumi.Input<string | undefined>;
        /**
         * Mist Edge port used to proxy the switch management traffic to the Mist Cloud. Value in range 1-65535
         */
        mxedgeProxyPort?: pulumi.Input<string | undefined>;
        /**
         * Control-plane protection settings for the switch
         */
        protectRe?: pulumi.Input<inputs.device.SwitchSwitchMgmtProtectRe | undefined>;
        /**
         * By default, only the configuration generated by Mist is cleaned up during the configuration process. If `true`, all the existing configuration will be removed.
         */
        removeExistingConfigs?: pulumi.Input<boolean | undefined>;
        /**
         * Root password for local switch access
         */
        rootPassword?: pulumi.Input<string | undefined>;
        /**
         * Management authentication settings using TACACS+
         */
        tacacs?: pulumi.Input<inputs.device.SwitchSwitchMgmtTacacs | undefined>;
        /**
         * Whether to use Mist Edge as a proxy for switch management traffic
         */
        useMxedgeProxy?: pulumi.Input<boolean | undefined>;
    }
    interface SwitchSwitchMgmtLocalAccounts {
        /**
         * Local password for the switch user account
         */
        password?: pulumi.Input<string | undefined>;
        /**
         * Access role granted to the local switch user account
         */
        role?: pulumi.Input<string | undefined>;
    }
    interface SwitchSwitchMgmtProtectRe {
        /**
         * optionally, services we'll allow. enum: `icmp`, `ssh`
         */
        allowedServices?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Additional ACL entries allowed by the Protect RE policy
         */
        customs?: pulumi.Input<pulumi.Input<inputs.device.SwitchSwitchMgmtProtectReCustom>[] | undefined>;
        /**
         * When enabled, all traffic that is not essential to our operation will be dropped
         * e.g. ntp / dns / traffic to mist will be allowed by default
         *      if dhcpd is enabled, we'll make sure it works
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to enable hit count for Protect_RE policy
         */
        hitCount?: pulumi.Input<boolean | undefined>;
        /**
         * Trusted host or subnet entries allowed by the Protect RE policy
         */
        trustedHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SwitchSwitchMgmtProtectReCustom {
        /**
         * matched dst port, "0" means any. Note: For `protocol`==`any` and  `portRange`==`any`, configure `trustedHosts` instead
         */
        portRange?: pulumi.Input<string | undefined>;
        /**
         * enum: `any`, `icmp`, `tcp`, `udp`. Note: For `protocol`==`any` and  `portRange`==`any`, configure `trustedHosts` instead
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Source subnets matched by this custom Protect RE ACL
         */
        subnets: pulumi.Input<pulumi.Input<string>[]>;
    }
    interface SwitchSwitchMgmtTacacs {
        /**
         * TACACS+ accounting servers used for switch management sessions
         */
        acctServers?: pulumi.Input<pulumi.Input<inputs.device.SwitchSwitchMgmtTacacsAcctServer>[] | undefined>;
        /**
         * Default switch-management role to use for TACACS+ logins
         */
        defaultRole?: pulumi.Input<string | undefined>;
        /**
         * Whether TACACS+ is enabled for switch management authentication
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Source network used for connectivity to the TACACS+ servers
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * TACACS+ authentication servers used for switch management logins
         */
        tacplusServers?: pulumi.Input<pulumi.Input<inputs.device.SwitchSwitchMgmtTacacsTacplusServer>[] | undefined>;
    }
    interface SwitchSwitchMgmtTacacsAcctServer {
        /**
         * Address or hostname of the TACACS+ accounting server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * TCP port used by the TACACS+ accounting server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used with this TACACS+ accounting server
         */
        secret?: pulumi.Input<string | undefined>;
        /**
         * TACACS+ accounting server timeout, in seconds
         */
        timeout?: pulumi.Input<number | undefined>;
    }
    interface SwitchSwitchMgmtTacacsTacplusServer {
        /**
         * Address or hostname of the TACACS+ authentication server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * TCP port used by the TACACS+ authentication server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used with this TACACS+ authentication server
         */
        secret?: pulumi.Input<string | undefined>;
        /**
         * TACACS+ authentication server timeout, in seconds
         */
        timeout?: pulumi.Input<number | undefined>;
    }
    interface SwitchVirtualChassis {
        /**
         * Virtual Chassis members and their expected roles
         */
        members?: pulumi.Input<pulumi.Input<inputs.device.SwitchVirtualChassisMember>[] | undefined>;
        /**
         * To configure whether the VC is preprovisioned or nonprovisioned
         */
        preprovisioned?: pulumi.Input<boolean | undefined>;
    }
    interface SwitchVirtualChassisMember {
        /**
         * Virtual Chassis member MAC address; for FPC0 this matches the device ID MAC
         */
        mac: pulumi.Input<string>;
        /**
         * Virtual Chassis member identifier
         */
        memberId: pulumi.Input<number>;
        /**
         * Role of this member in the Virtual Chassis
         */
        vcRole: pulumi.Input<string>;
    }
    interface SwitchVrfConfig {
        /**
         * Whether to enable VRF (when supported on the device)
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SwitchVrfInstances {
        /**
         * IPv4 subnet used for automatic EVPN loopback addresses in this VRF instance
         */
        evpnAutoLoopbackSubnet?: pulumi.Input<string | undefined>;
        /**
         * IPv6 subnet used for automatic EVPN loopback addresses in this VRF instance
         */
        evpnAutoLoopbackSubnet6?: pulumi.Input<string | undefined>;
        /**
         * Additional IPv4 static routes configured for this VRF instance
         */
        extraRoutes?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.SwitchVrfInstancesExtraRoutes>;
        } | undefined>;
        /**
         * Additional IPv6 static routes configured for this VRF instance
         */
        extraRoutes6?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.SwitchVrfInstancesExtraRoutes6>;
        } | undefined>;
        /**
         * Names of switch networks included in this VRF instance
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SwitchVrfInstancesExtraRoutes {
        /**
         * IPv4 next-hop address for this VRF extra route
         */
        via: pulumi.Input<string>;
    }
    interface SwitchVrfInstancesExtraRoutes6 {
        /**
         * IPv6 next-hop address for this VRF extra route
         */
        via?: pulumi.Input<string | undefined>;
    }
    interface SwitchVrrpConfig {
        /**
         * Whether VRRP configuration is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * VRRP groups keyed by group name
         */
        groups?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.device.SwitchVrrpConfigGroups>;
        } | undefined>;
    }
    interface SwitchVrrpConfigGroups {
        /**
         * If `true`, allow preemption (a backup router can preempt a primary router)
         */
        preempt?: pulumi.Input<boolean | undefined>;
        /**
         * VRRP priority for this router in the group
         */
        priority?: pulumi.Input<number | undefined>;
    }
}
export declare namespace org {
    interface AlarmtemplateDelivery {
        /**
         * Additional email recipients for alarm delivery
         */
        additionalEmails?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether to enable the alarm delivery via emails or not
         */
        enabled: pulumi.Input<boolean>;
        /**
         * Whether to deliver the alarms via emails to Org admins or not
         */
        toOrgAdmins?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to deliver the alarms via emails to Site admins or not
         */
        toSiteAdmins?: pulumi.Input<boolean | undefined>;
    }
    interface AlarmtemplateRules {
        /**
         * Overrides for the alarm template delivery defaults for this alarm rule
         */
        delivery?: pulumi.Input<inputs.org.AlarmtemplateRulesDelivery | undefined>;
        /**
         * Whether this alarm rule is enabled in the template
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface AlarmtemplateRulesDelivery {
        /**
         * Additional email recipients for alarm delivery
         */
        additionalEmails?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether to enable the alarm delivery via emails or not
         */
        enabled: pulumi.Input<boolean>;
        /**
         * Whether to deliver the alarms via emails to Org admins or not
         */
        toOrgAdmins?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to deliver the alarms via emails to Site admins or not
         */
        toSiteAdmins?: pulumi.Input<boolean | undefined>;
    }
    interface ApitokenPrivilege {
        /**
         * Access role granted by this organization privilege
         */
        role: pulumi.Input<string>;
        /**
         * Organization hierarchy level where this privilege applies
         */
        scope: pulumi.Input<string>;
        /**
         * Required if `scope`==`site`
         */
        siteId?: pulumi.Input<string | undefined>;
        /**
         * Required if `scope`==`sitegroup`
         */
        sitegroupId?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileApAeroscout {
        /**
         * Whether to enable aeroscout config
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Required if enabled, aeroscout server host
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * Whether to enable the feature to allow wireless clients data received and sent to AES server for location calculation
         */
        locateConnected?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if enabled, Aeroscout server port. Defaults to 1144
         */
        port?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileApAirista {
        /**
         * Whether to enable Airista config
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Required if enabled, Airista server host
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * Optional if enabled, Airista server port. Defaults to 1144
         */
        port?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileApBleConfig {
        /**
         * Whether Mist beacons is enabled
         */
        beaconEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `beaconRateMode`==`custom`, 1-10, in number-beacons-per-second
         */
        beaconRate?: pulumi.Input<number | undefined>;
        /**
         * Beacon rate mode for Mist BLE beacons; use custom to set beacon_rate
         */
        beaconRateMode?: pulumi.Input<string | undefined>;
        /**
         * AP BLE beam numbers disabled for location advertisements
         */
        beamDisableds?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Can be enabled if `beaconEnabled`==`true`, whether to send custom packet
         */
        customBlePacketEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * The custom frame to be sent out in this beacon. The frame must be a hexstring
         */
        customBlePacketFrame?: pulumi.Input<string | undefined>;
        /**
         * Frequency (msec) of data emitted by custom ble beacon
         */
        customBlePacketFreqMsec?: pulumi.Input<number | undefined>;
        /**
         * Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default
         */
        eddystoneUidAdvPower?: pulumi.Input<number | undefined>;
        /**
         * BLE beams used to transmit Eddystone-UID advertisements, expressed as ranges such as `2-4,7`
         */
        eddystoneUidBeams?: pulumi.Input<string | undefined>;
        /**
         * Only if `beaconEnabled`==`false`, Whether Eddystone-UID beacon is enabled
         */
        eddystoneUidEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Frequency (msec) of data emit by Eddystone-UID beacon
         */
        eddystoneUidFreqMsec?: pulumi.Input<number | undefined>;
        /**
         * Eddystone-UID instance for the device
         */
        eddystoneUidInstance?: pulumi.Input<string | undefined>;
        /**
         * Eddystone-UID namespace broadcast by the AP, as a 10-byte hex string
         */
        eddystoneUidNamespace?: pulumi.Input<string | undefined>;
        /**
         * Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default
         */
        eddystoneUrlAdvPower?: pulumi.Input<number | undefined>;
        /**
         * BLE beams used to transmit Eddystone-URL advertisements, expressed as ranges such as `2-4,7`
         */
        eddystoneUrlBeams?: pulumi.Input<string | undefined>;
        /**
         * Only if `beaconEnabled`==`false`, Whether Eddystone-URL beacon is enabled
         */
        eddystoneUrlEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Frequency (msec) of data emitted by Eddystone-URL beacon
         */
        eddystoneUrlFreqMsec?: pulumi.Input<number | undefined>;
        /**
         * URL pointed by Eddystone-URL beacon
         */
        eddystoneUrlUrl?: pulumi.Input<string | undefined>;
        /**
         * Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default
         */
        ibeaconAdvPower?: pulumi.Input<number | undefined>;
        /**
         * BLE beams used to transmit iBeacon advertisements, expressed as ranges such as `2-4,7`
         */
        ibeaconBeams?: pulumi.Input<string | undefined>;
        /**
         * Can be enabled if `beaconEnabled`==`true`, whether to send iBeacon
         */
        ibeaconEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Frequency (msec) of data emit for iBeacon
         */
        ibeaconFreqMsec?: pulumi.Input<number | undefined>;
        /**
         * iBeacon major value broadcast by the AP
         */
        ibeaconMajor?: pulumi.Input<number | undefined>;
        /**
         * iBeacon minor value broadcast by the AP
         */
        ibeaconMinor?: pulumi.Input<number | undefined>;
        /**
         * Optional, if not specified, the same UUID as the beacon will be used
         */
        ibeaconUuid?: pulumi.Input<string | undefined>;
        /**
         * Required if `powerMode`==`custom`; else use `powerMode` as default
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * Transmit power mode for BLE beacons; use custom to set `power`
         */
        powerMode?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileApEslConfig {
        /**
         * Only if `type`==`imagotag` or `type`==`native`
         */
        cacert?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`imagotag` or `type`==`native`
         */
        channel?: pulumi.Input<number | undefined>;
        /**
         * usb_config is ignored if eslConfig enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `type`==`imagotag` or `type`==`native`
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`imagotag` or `type`==`native`
         */
        port?: pulumi.Input<number | undefined>;
        /**
         * ESL integration type to enable on the AP
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`imagotag` or `type`==`native`
         */
        verifyCert?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `type`==`solum` or `type`==`hanshow`
         */
        vlanId?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileApIpConfig {
        /**
         * If `type`==`static`. DNS server IP addresses for AP management traffic
         */
        dns?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type`==`static`. DNS search suffixes applied to AP management lookups
         */
        dnsSuffixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Required if `type`==`static`. IPv4 default gateway for AP management traffic
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Required if `type6`==`static`. IPv6 default gateway for AP management traffic when static IPv6 addressing is used
         */
        gateway6?: pulumi.Input<string | undefined>;
        /**
         * Required if `type`==`static`. Static IPv4 address for the AP management interface
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Required if `type6`==`static`. Static IPv6 address for the AP management interface
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * Maximum transmission unit for AP management traffic
         */
        mtu?: pulumi.Input<number | undefined>;
        /**
         * Required if `type`==`static`. IPv4 netmask for the AP management interface
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * Required if `type6`==`static`. IPv6 prefix length for the AP management interface
         */
        netmask6?: pulumi.Input<string | undefined>;
        /**
         * IPv4 address assignment mode for AP management traffic
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 address assignment mode for AP management traffic
         */
        type6?: pulumi.Input<string | undefined>;
        /**
         * Management VLAN ID, default is 1 (untagged)
         */
        vlanId?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileApLacpConfig {
        /**
         * Whether to enable LACP on supported AP Ethernet uplinks
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileApLed {
        /**
         * Indicator LED brightness level from 0 to 255
         */
        brightness?: pulumi.Input<number | undefined>;
        /**
         * Whether the AP indicator LED is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileApMesh {
        /**
         * Radio bands allowed for AP mesh links
         */
        bands?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether mesh is enabled on this AP
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Mesh group, base AP(s) will only allow remote AP(s) in the same mesh group to join, 1-9, optional
         */
        group?: pulumi.Input<number | undefined>;
        /**
         * Mesh role for this AP, either base or remote
         */
        role?: pulumi.Input<string | undefined>;
        /**
         * Whether to use WPA3 on the 5 GHz band for mesh links
         */
        useWpa3On5?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileApMqttConfig {
        /**
         * MQTT broker hostname or IP address; required when `enabled` is `true`
         */
        brokerHost?: pulumi.Input<string | undefined>;
        /**
         * MQTT broker port; defaults to `1883` for `tcp` and `8883` for `ssl`
         */
        brokerPort?: pulumi.Input<number | undefined>;
        /**
         * MQTT broker transport protocol
         */
        brokerProto?: pulumi.Input<string | undefined>;
        /**
         * Whether to enable MQTT publishing
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Payload format for published messages
         */
        format?: pulumi.Input<string | undefined>;
        /**
         * Optional MQTT password; masked in GET responses
         */
        password?: pulumi.Input<string | undefined>;
        /**
         * Optional MQTT username
         */
        username?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileApPortConfig {
        /**
         * Whether this AP Ethernet port is disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * RADIUS-assigned VLAN settings for AP port authentication
         */
        dynamicVlan?: pulumi.Input<inputs.org.DeviceprofileApPortConfigDynamicVlan | undefined>;
        /**
         * Whether MAC authentication is enabled on this AP port
         */
        enableMacAuth?: pulumi.Input<boolean | undefined>;
        /**
         * Traffic forwarding mode for this AP Ethernet port
         */
        forwarding?: pulumi.Input<string | undefined>;
        /**
         * When `true`, we'll do dot1x then mac_auth. enable this to prefer mac_auth
         */
        macAuthPreferred?: pulumi.Input<boolean | undefined>;
        /**
         * Protocol used for MAC authentication when `enableMacAuth` is `true`
         */
        macAuthProtocol?: pulumi.Input<string | undefined>;
        /**
         * Juniper Mist NAC settings used by AP port authentication
         */
        mistNac?: pulumi.Input<inputs.org.DeviceprofileApPortConfigMistNac | undefined>;
        /**
         * If `forwarding`==`mxtunnel`, vlanIds comes from mxtunnel
         */
        mxTunnelId?: pulumi.Input<string | undefined>;
        /**
         * If `forwarding`==`siteMxedge`, vlanIds comes from siteMxedge (`mxtunnels` under site setting)
         */
        mxtunnelName?: pulumi.Input<string | undefined>;
        /**
         * Authentication mode for this AP Ethernet port
         */
        portAuth?: pulumi.Input<string | undefined>;
        /**
         * If `forwarding`==`limited`. VLAN ID allowed on this AP Ethernet port
         */
        portVlanId?: pulumi.Input<number | undefined>;
        /**
         * RADIUS authentication and accounting settings for this AP port
         */
        radiusConfig?: pulumi.Input<inputs.org.DeviceprofileApPortConfigRadiusConfig | undefined>;
        /**
         * TLS-secured RADIUS settings for this AP port
         */
        radsec?: pulumi.Input<inputs.org.DeviceprofileApPortConfigRadsec | undefined>;
        /**
         * Optional to specify the VLAN ID for a tunnel if forwarding is for `wxtunnel`, `mxtunnel` or `siteMxedge`.
         *   * if vlanId is not specified then it will use first one in vlan_ids[] of the mxtunnel.
         *   * if forwarding == site_mxedge, vlanIds comes from siteMxedge (`mxtunnels` under site setting)
         */
        vlanId?: pulumi.Input<number | undefined>;
        /**
         * If `forwarding`==`limited`, comma separated list of additional VLAN IDs allowed on this port
         */
        vlanIds?: pulumi.Input<string | undefined>;
        /**
         * If `forwarding`==`wxtunnel`, the port is bridged to the vlan of the session
         */
        wxtunnelId?: pulumi.Input<string | undefined>;
        /**
         * If `forwarding`==`wxtunnel`, the port is bridged to the vlan of the session
         */
        wxtunnelRemoteId?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileApPortConfigDynamicVlan {
        /**
         * Fallback VLAN ID used when RADIUS does not return a dynamic VLAN match
         */
        defaultVlanId?: pulumi.Input<number | undefined>;
        /**
         * Whether dynamic VLAN assignment is enabled for this AP port
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Mapping mode for interpreting dynamic VLAN attributes returned by RADIUS
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Mapping entries for RADIUS-assigned VLAN values on this AP port. For `type`==`airespace-interface-name`, the property key is the Airespace interface name returned by RADIUS (e.g. "guest"), and the value is the corresponding VLAN ID (e.g. 100). For `type`==`standard`, the property key is the VLAN ID number returned by RADIUS, and the value is ignored.
         */
        vlans?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
    }
    interface DeviceprofileApPortConfigMistNac {
        /**
         * How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled.
         */
        acctInterimInterval?: pulumi.Input<number | undefined>;
        /**
         * RADIUS auth session retries. Following fast timers are set if `fastDot1xTimers` knob is enabled. "retries" are set to value of `authServersTimeout`. "max-requests" is also set when setting `authServersRetries` is set to default value to 3.
         */
        authServersRetries?: pulumi.Input<number | undefined>;
        /**
         * RADIUS auth session timeout. Following fast timers are set if `fastDot1xTimers` knob is enabled. "quite-period" and "transmit-period" are set to half the value of `authServersTimeout`. "supplicant-timeout" is also set when setting `authServersTimeout` is set to default value of 10.
         */
        authServersTimeout?: pulumi.Input<number | undefined>;
        /**
         * Allows a RADIUS server to dynamically modify the authorization status of a user session.
         */
        coaEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * the communication port used for “Change of Authorization” (CoA) messages
         */
        coaPort?: pulumi.Input<number | undefined>;
        /**
         * When enabled:
         *   * `authServers` is ignored
         *   * `acctServers` is ignored
         *   * `auth_servers_*` are ignored
         *   * `coaServers` is ignored
         *   * `radsec` is ignored
         *   * `coaEnabled` is assumed
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * If set to true, sets default fast-timers with values calculated from `authServersTimeout` and `authServerRetries`.
         */
        fastDot1xTimers?: pulumi.Input<boolean | undefined>;
        /**
         * Which network the mist nac server resides in
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * In case there is a static IP for this network, we can specify it using source ip
         */
        sourceIp?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileApPortConfigRadiusConfig {
        /**
         * How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled
         */
        acctInterimInterval?: pulumi.Input<number | undefined>;
        /**
         * RADIUS accounting servers used by this Junos configuration
         */
        acctServers?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileApPortConfigRadiusConfigAcctServer>[] | undefined>;
        /**
         * RADIUS authentication servers used by this Junos configuration
         */
        authServers?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileApPortConfigRadiusConfigAuthServer>[] | undefined>;
        /**
         * Number of RADIUS authentication request retries before failover
         */
        authServersRetries?: pulumi.Input<number | undefined>;
        /**
         * RADIUS authentication server timeout, in seconds
         */
        authServersTimeout?: pulumi.Input<number | undefined>;
        /**
         * Whether RADIUS Change of Authorization (CoA) is enabled
         */
        coaEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * UDP port used for RADIUS Change of Authorization (CoA)
         */
        coaPort?: pulumi.Input<number | undefined>;
        /**
         * Use `network` or `sourceIp`. Network where the RADIUS server resides; if the network has a static IP, Mist uses it as the source IP
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Use `network` or `sourceIp`. Explicit source IP address for RADIUS traffic
         */
        sourceIp?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileApPortConfigRadiusConfigAcctServer {
        /**
         * Address or hostname of the RADIUS accounting server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this accounting server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS accounting server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used with this RADIUS accounting server
         */
        secret: pulumi.Input<string>;
    }
    interface DeviceprofileApPortConfigRadiusConfigAuthServer {
        /**
         * Address or hostname of the RADIUS authentication server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this authentication server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS authentication server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Whether to require Message-Authenticator in requests
         */
        requireMessageAuthenticator?: pulumi.Input<boolean | undefined>;
        /**
         * Shared secret used with this RADIUS authentication server
         */
        secret: pulumi.Input<string>;
    }
    interface DeviceprofileApPortConfigRadsec {
        /**
         * Whether RADIUS Change of Authorization (CoA) is enabled for RadSec traffic
         */
        coaEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether RadSec is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Idle timeout, in seconds, for RadSec connections
         */
        idleTimeout?: pulumi.Input<string | undefined>;
        /**
         * Mist Edge cluster IDs used as RadSec proxies when the WLAN does not use mxtunnel
         */
        mxclusterIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * RadSec proxy hostnames advertised to APs
         */
        proxyHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * TLS server name to verify against the CA certificates in Org Setting. Only if not Mist Edge.
         */
        serverName?: pulumi.Input<string | undefined>;
        /**
         * External RadSec servers. Only if not Mist Edge.
         */
        servers?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileApPortConfigRadsecServer>[] | undefined>;
        /**
         * Whether to use organization Mist Edge instances as RadSec proxies
         */
        useMxedge?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to use site Mist Edge instances when this WLAN does not use mxtunnel
         */
        useSiteMxedge?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileApPortConfigRadsecServer {
        /**
         * Address or hostname of the RadSec server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * TCP port used by the RadSec server
         */
        port?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileApPwrConfig {
        /**
         * Additional power to request during negotiating with PSE over PoE, in mW
         */
        base?: pulumi.Input<number | undefined>;
        /**
         * Whether to enable power out to peripheral, meanwhile will reduce power to Wi-Fi (only for AP45 at power mode)
         */
        preferUsbOverWifi?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileApRadioConfig {
        /**
         * Whether RRM can be disabled for individual radio-band settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * Antenna gain for 2.4G - for models with external antenna only
         */
        antGain24?: pulumi.Input<number | undefined>;
        /**
         * Antenna gain for 5G - for models with external antenna only
         */
        antGain5?: pulumi.Input<number | undefined>;
        /**
         * Antenna gain for 6G - for models with external antenna only
         */
        antGain6?: pulumi.Input<number | undefined>;
        /**
         * Selected radio chain mode for AP models that support antenna mode control
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Internal or external antenna selection for AP models with selectable antennas
         */
        antennaSelect?: pulumi.Input<string | undefined>;
        /**
         * 2.4 GHz radio settings for this access point
         */
        band24?: pulumi.Input<inputs.org.DeviceprofileApRadioConfigBand24 | undefined>;
        /**
         * Radio usage mode for the 2.4 GHz-capable radio
         */
        band24Usage?: pulumi.Input<string | undefined>;
        /**
         * 5 GHz radio settings for this access point
         */
        band5?: pulumi.Input<inputs.org.DeviceprofileApRadioConfigBand5 | undefined>;
        /**
         * 5 GHz settings used when the 2.4 GHz radio operates in 5 GHz mode
         */
        band5On24Radio?: pulumi.Input<inputs.org.DeviceprofileApRadioConfigBand5On24Radio | undefined>;
        /**
         * 6 GHz radio settings for this access point
         */
        band6?: pulumi.Input<inputs.org.DeviceprofileApRadioConfigBand6 | undefined>;
        /**
         * Let RRM control everything, only the `channels` and `antGain` will be honored (i.e. disabled/bandwidth/power/band_24_usage are all controlled by RRM)
         */
        fullAutomaticRrm?: pulumi.Input<boolean | undefined>;
        /**
         * To make an outdoor operate indoor. For an outdoor-ap, some channels are disallowed by default, this allows the user to use it as an indoor-ap
         */
        indoorUse?: pulumi.Input<boolean | undefined>;
        /**
         * Enable RRM to manage all radio settings (ignores all bandXxx configs)
         */
        rrmManaged?: pulumi.Input<boolean | undefined>;
        /**
         * Whether scanning radio is enabled
         */
        scanningEnabled?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileApRadioConfigBand24 {
        /**
         * Whether RRM may disable the 2.4 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 2.4 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Radio chain mode for the 2.4 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 2.4 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * For Device. (primary) channel for the band, 0 means using the Site Setting
         */
        channel?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 2.4 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 2.4 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileApRadioConfigBand5 {
        /**
         * Whether RRM may disable the 5 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 5 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Beam pattern used by the 5 GHz radio antenna
         */
        antennaBeamPattern?: pulumi.Input<string | undefined>;
        /**
         * Radio chain mode for the 5 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 5 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * For Device. (primary) channel for the band, 0 means using the Site Setting
         */
        channel?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 5 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileApRadioConfigBand5On24Radio {
        /**
         * Whether RRM may disable the 5 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 5 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Beam pattern used by the 5 GHz radio antenna
         */
        antennaBeamPattern?: pulumi.Input<string | undefined>;
        /**
         * Radio chain mode for the 5 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 5 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * For Device. (primary) channel for the band, 0 means using the Site Setting
         */
        channel?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 5 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileApRadioConfigBand6 {
        /**
         * Whether RRM may disable the 6 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 6 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Beam pattern used by the 6 GHz radio antenna
         */
        antennaBeamPattern?: pulumi.Input<string | undefined>;
        /**
         * Radio chain mode for the 6 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 6 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * For Device. (primary) channel for the band, 0 means using the Site Setting
         */
        channel?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 6 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 6 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
        /**
         * For 6GHz Only, standard-power operation, AFC (Automatic Frequency Coordination) will be performed, and we'll fall back to Low Power Indoor if AFC failed
         */
        standardPower?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileApUplinkPortConfig {
        /**
         * Whether to do 802.1x against uplink switch. When enabled, AP cert will be used to do EAP-TLS and the Org's CA Cert has to be provisioned at the switch
         */
        dot1x?: pulumi.Input<boolean | undefined>;
        /**
         * By default, WLANs are disabled when uplink is down. In some scenario, like SiteSurvey, one would want the AP to keep sending beacons.
         */
        keepWlansUpIfDown?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileApUsbConfig {
        /**
         * Only if `type`==`imagotag`. CA certificate used to validate the Imagotag service certificate
         */
        cacert?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`imagotag`, channel selection, not needed by default, required for manual channel override only
         */
        channel?: pulumi.Input<number | undefined>;
        /**
         * Whether to enable any usb config
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `type`==`imagotag`. Imagotag service host or IP address contacted by the AP
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`imagotag`. TCP port used to reach the Imagotag service
         */
        port?: pulumi.Input<number | undefined>;
        /**
         * USB integration type for this legacy AP USB configuration
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`imagotag`, whether to turn on SSL verification
         */
        verifyCert?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `type`==`solum` or `type`==`hanshow`
         */
        vlanId?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileApZigbeeConfig {
        /**
         * Join policy for new Zigbee devices on this AP
         */
        allowJoin?: pulumi.Input<string | undefined>;
        /**
         * Zigbee channel (2.4 GHz). `0` means auto; valid fixed values are 11–26
         */
        channel?: pulumi.Input<number | undefined>;
        /**
         * Whether to enable Zigbee on this AP
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Extended PAN ID in hex string format; only applicable when `panId` is also specified
         */
        extendedPanId?: pulumi.Input<string | undefined>;
        /**
         * PAN ID in hex string format; if not specified, assigned automatically
         */
        panId?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayBgpConfig {
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`
         */
        authKey?: pulumi.Input<string | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`, when bfdMultiplier is configured alone. Default:
         *   * 1000 if `type`==`external`
         *   * 350 `type`==`internal`
         */
        bfdMinimumInterval?: pulumi.Input<number | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`, when bfdMinimumIntervalIsConfigured alone
         */
        bfdMultiplier?: pulumi.Input<number | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. BFD provides faster path failure detection and is enabled by default
         */
        disableBfd?: pulumi.Input<boolean | undefined>;
        /**
         * Routing policy applied to routes exported by this BGP session
         */
        export?: pulumi.Input<string | undefined>;
        /**
         * Default export policies if no per-neighbor policies defined
         */
        exportPolicy?: pulumi.Input<string | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. By default, either inet/net6 unicast depending on neighbor IP family (v4 or v6). For v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
         */
        extendedV4Nexthop?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. `0` means disable
         */
        gracefulRestartTime?: pulumi.Input<number | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. Default is 90.
         */
        holdTime?: pulumi.Input<number | undefined>;
        /**
         * Routing policy applied to routes imported by this BGP session
         */
        import?: pulumi.Input<string | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. Default import policies if no per-neighbor policies defined
         */
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. BGPLocal AS. Value must be in range 1-4294967295 or a variable (e.g. `{{as_variable}}`)
         */
        localAs?: pulumi.Input<string | undefined>;
        /**
         * Neighbor AS. If `type`==`internal`, must be equal to `localAs`. Value must be in range 1-4294967295 or a variable (e.g. `{{as_variable}}`)
         */
        neighborAs?: pulumi.Input<string | undefined>;
        /**
         * Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. If per-neighbor as is desired. Property key is the neighbor address
         */
        neighbors?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayBgpConfigNeighbors>;
        } | undefined>;
        /**
         * Optional if `via`==`lan`; networks where BGP neighbors can connect to or from
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. If true, we will not advertise private ASNs (AS 64512-65534) to this neighbor
         */
        noPrivateAs?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. By default, we'll re-advertise all learned BGP routers toward overlay
         */
        noReadvertiseToOverlay?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `via`==`tunnel`; tunnel name used for this BGP session
         */
        tunnelName?: pulumi.Input<string | undefined>;
        /**
         * Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; BGP session type, internal or external
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Transport used for this BGP session, such as LAN, tunnel, VPN, or WAN
         */
        via: pulumi.Input<string>;
        /**
         * Optional if `via`==`vpn`; VPN name used for this BGP session
         */
        vpnName?: pulumi.Input<string | undefined>;
        /**
         * Optional if `via`==`wan`; WAN interface name used for this BGP session
         */
        wanName?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayBgpConfigNeighbors {
        /**
         * If true, the BGP session to this neighbor will be administratively disabled/shutdown
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Export policy applied only to this BGP neighbor
         */
        exportPolicy?: pulumi.Input<string | undefined>;
        /**
         * BGP hold time for this neighbor, in seconds
         */
        holdTime?: pulumi.Input<number | undefined>;
        /**
         * Import policy applied only to this BGP neighbor
         */
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * Assuming BGP neighbor is directly connected
         */
        multihopTtl?: pulumi.Input<number | undefined>;
        /**
         * Neighbor AS. Value must be in range 1-4294967295 or a variable (e.g. `{{as_variable}}`)
         */
        neighborAs: pulumi.Input<string>;
        /**
         * If `via`==`tunnel`, primary or secondary tunnel associated with this BGP neighbor
         */
        tunnelVia?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayDhcpdConfig {
        /**
         * Property key is the network name
         */
        config?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayDhcpdConfigConfig>;
        } | undefined>;
        /**
         * If set to `false`, disable the DHCP server
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileGatewayDhcpdConfigConfig {
        /**
         * If `type`==`local` or `type6`==`local`, DNS servers advertised to DHCP clients
         */
        dnsServers?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type`==`local` or `type6`==`local`, DNS search suffixes advertised to DHCP clients
         *
         * @deprecated Configuring `dnsSuffix` is deprecated and will not be supported in the future, please configure Code 15 or Code 119 in Server `options` instead
         */
        dnsSuffixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type`==`local` or `type6`==`local`, fixed client bindings for local DHCP service
         */
        fixedBindings?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayDhcpdConfigConfigFixedBindings>;
        } | undefined>;
        /**
         * If `type`==`local` - optional, `ip` will be used if not provided
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * If `type6`==`local`, ending IPv6 address for the DHCP lease pool
         */
        ip6End?: pulumi.Input<string | undefined>;
        /**
         * If `type6`==`local`, starting IPv6 address for the DHCP lease pool
         */
        ip6Start?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`local`, ending IPv4 address for the DHCP lease pool
         */
        ipEnd?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`local`, starting IPv4 address for the DHCP lease pool
         */
        ipStart?: pulumi.Input<string | undefined>;
        /**
         * In seconds, lease time has to be between 3600 [1hr] - 604800 [1 week], default is 86400 [1 day]
         */
        leaseTime?: pulumi.Input<number | undefined>;
        /**
         * If `type`==`local` or `type6`==`local`, custom DHCP options advertised to clients
         */
        options?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayDhcpdConfigConfigOptions>;
        } | undefined>;
        /**
         * `serverIdOverride`==`true` means the device, when acts as DHCP relay and forwards DHCP responses from DHCP server to clients,
         * should overwrite the Sever Identifier option (i.e. DHCP option 54) in DHCP responses with its own IP address.
         */
        serverIdOverride?: pulumi.Input<boolean | undefined>;
        /**
         * If `type`==`relay`, upstream IPv4 DHCP servers
         */
        servers?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type6`==`relay`, upstream IPv6 DHCP servers
         */
        serversv6s?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IPv4 DHCP mode for this network
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 DHCP mode for this network
         */
        type6?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`local` or `type6`==`local`, vendor-encapsulated DHCP options advertised to clients
         */
        vendorEncapsulated?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayDhcpdConfigConfigVendorEncapsulated>;
        } | undefined>;
    }
    interface DeviceprofileGatewayDhcpdConfigConfigFixedBindings {
        /**
         * Reserved IPv4 address for this fixed DHCP binding
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Reserved IPv6 address for this fixed DHCP binding
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * Friendly name for this fixed DHCP binding
         */
        name?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayDhcpdConfigConfigOptions {
        /**
         * Data type used to encode this DHCP option value
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Option value to send for this DHCP option
         */
        value?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayDhcpdConfigConfigVendorEncapsulated {
        /**
         * Data type used to encode this vendor option value
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Option value to send for this vendor option
         */
        value?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayExtraRoutes {
        /**
         * Next-hop IPv4 address for the gateway extra route
         */
        via: pulumi.Input<string>;
    }
    interface DeviceprofileGatewayExtraRoutes6 {
        /**
         * Next-hop IPv6 address for the gateway extra route
         */
        via: pulumi.Input<string>;
    }
    interface DeviceprofileGatewayIdpProfiles {
        /**
         * Built-in IDP baseline profile inherited before applying overwrites
         */
        baseProfile?: pulumi.Input<string | undefined>;
        /**
         * Display name of the IDP profile
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Owning organization for the IDP profile
         */
        orgId?: pulumi.Input<string | undefined>;
        /**
         * IDP signature override rules applied on top of the base profile
         */
        overwrites?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileGatewayIdpProfilesOverwrite>[] | undefined>;
    }
    interface DeviceprofileGatewayIdpProfilesOverwrite {
        /**
         * Enforcement action applied when this overwrite rule matches
         */
        action?: pulumi.Input<string | undefined>;
        /**
         * Criteria that select signatures for this overwrite rule
         */
        matching?: pulumi.Input<inputs.org.DeviceprofileGatewayIdpProfilesOverwriteMatching | undefined>;
        /**
         * Display name for this IDP profile overwrite rule
         */
        name?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayIdpProfilesOverwriteMatching {
        /**
         * Signature names matched by the IDP profile overwrite
         */
        attackNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Destination subnets matched by the IDP profile overwrite
         */
        dstSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Threat levels matched by the IDP profile overwrite
         */
        severities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileGatewayIpConfigs {
        /**
         * Static IPv4 address for the gateway network interface when `type`==`static`
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Static IPv6 address for the gateway network interface when `type6`==`static`
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * IPv4 netmask or prefix length for the gateway network interface when `type`==`static`
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * IPv6 netmask or prefix length for the gateway network interface when `type6`==`static`
         */
        netmask6?: pulumi.Input<string | undefined>;
        /**
         * Additional IPv4 addresses in CIDR notation for this gateway network interface
         */
        secondaryIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IPv4 address assignment mode for this gateway network interface
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 address assignment mode for this gateway network interface
         */
        type6?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayNetwork {
        /**
         * Whether to disallow Mist Devices in the network
         */
        disallowMistServices?: pulumi.Input<boolean | undefined>;
        /**
         * IPv4 gateway address for this network
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * IPv6 gateway address for this network
         */
        gateway6?: pulumi.Input<string | undefined>;
        /**
         * Internal access settings for this network
         */
        internalAccess?: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkInternalAccess | undefined>;
        /**
         * Direct internet access and NAT settings for this network
         */
        internetAccess?: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkInternetAccess | undefined>;
        /**
         * Whether to allow clients in the network to talk to each other
         */
        isolation?: pulumi.Input<boolean | undefined>;
        /**
         * Settings for multicast routing on this network
         */
        multicast?: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkMulticast | undefined>;
        /**
         * Display name of the organization network
         */
        name: pulumi.Input<string>;
        /**
         * Other network names this network can route to, for example through BGP, OSPF or static routes
         */
        routedForNetworks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IPv4 subnet CIDR for this network
         */
        subnet: pulumi.Input<string>;
        /**
         * IPv6 subnet CIDR for this network
         */
        subnet6?: pulumi.Input<string | undefined>;
        /**
         * Tenant address mappings associated with this network
         */
        tenants?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkTenants>;
        } | undefined>;
        /**
         * VLAN ID or variable associated with this network
         */
        vlanId?: pulumi.Input<string | undefined>;
        /**
         * VPN access settings keyed by VPN name for this network
         */
        vpnAccess?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkVpnAccess>;
        } | undefined>;
    }
    interface DeviceprofileGatewayNetworkInternalAccess {
        /**
         * Whether internal access is enabled for this network
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileGatewayNetworkInternetAccess {
        /**
         * Whether Mist should create simple service policies for restricted internet access
         */
        createSimpleServicePolicy?: pulumi.Input<boolean | undefined>;
        /**
         * Destination NAT rules for direct internet access
         */
        destinationNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkInternetAccessDestinationNat>;
        } | undefined>;
        /**
         * Whether direct internet access is enabled for this network
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * By default, all access is allowed, to only allow certain traffic, make `restricted`=`true` and define service_policies
         */
        restricted?: pulumi.Input<boolean | undefined>;
        /**
         * Static NAT rules for direct internet access
         */
        staticNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkInternetAccessStaticNat>;
        } | undefined>;
    }
    interface DeviceprofileGatewayNetworkInternetAccessDestinationNat {
        /**
         * The Destination NAT destination IP address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
         */
        internalIp?: pulumi.Input<string | undefined>;
        /**
         * Label for this direct internet destination NAT rule
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * The Destination NAT destination IP address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}")
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity
         */
        wanName?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayNetworkInternetAccessStaticNat {
        /**
         * The Static NAT destination IP address. Must be an IP address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
         */
        internalIp: pulumi.Input<string>;
        /**
         * Label for this direct internet static NAT rule
         */
        name: pulumi.Input<string>;
        /**
         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}")
         */
        wanName?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayNetworkMulticast {
        /**
         * If the network will only be the source of the multicast traffic, IGMP can be disabled
         */
        disableIgmp?: pulumi.Input<boolean | undefined>;
        /**
         * Whether multicast support is enabled for this network
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Multicast group-to-RP mappings for this network
         */
        groups?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkMulticastGroups>;
        } | undefined>;
    }
    interface DeviceprofileGatewayNetworkMulticastGroups {
        /**
         * RP (rendezvous point) IP address
         */
        rpIp?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayNetworkTenants {
        /**
         * IP addresses or subnets assigned to this tenant in the network
         */
        addresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileGatewayNetworkVpnAccess {
        /**
         * If `routed`==`true`, whether to advertise an aggregated subnet toward HUB this is useful when there are multiple networks on SPOKE's side
         */
        advertisedSubnet?: pulumi.Input<string | undefined>;
        /**
         * Whether to allow ping from vpn into this routed network
         */
        allowPing?: pulumi.Input<boolean | undefined>;
        /**
         * Destination NAT rules applied for VPN access to this network
         */
        destinationNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkVpnAccessDestinationNat>;
        } | undefined>;
        /**
         * If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub, a subnet is required to create and advertise the route to Hub
         */
        natPool?: pulumi.Input<string | undefined>;
        /**
         * toward LAN-side BGP peers
         */
        noReadvertiseToLanBgp?: pulumi.Input<boolean | undefined>;
        /**
         * toward LAN-side OSPF peers
         */
        noReadvertiseToLanOspf?: pulumi.Input<boolean | undefined>;
        /**
         * toward overlay, how HUB should deal with routes it received from Spokes
         */
        noReadvertiseToOverlay?: pulumi.Input<boolean | undefined>;
        /**
         * Other VRFs that can receive leaked routes from this spoke network
         */
        otherVrfs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether this network is routable
         */
        routed?: pulumi.Input<boolean | undefined>;
        /**
         * Source NAT settings used when non-routed spoke hosts must be reachable from the hub
         */
        sourceNat?: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkVpnAccessSourceNat | undefined>;
        /**
         * Static NAT rules applied for VPN access to this network
         */
        staticNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayNetworkVpnAccessStaticNat>;
        } | undefined>;
        /**
         * toward overlay, how HUB should deal with routes it received from Spokes
         */
        summarizedSubnet?: pulumi.Input<string | undefined>;
        /**
         * toward LAN-side BGP peers
         */
        summarizedSubnetToLanBgp?: pulumi.Input<string | undefined>;
        /**
         * toward LAN-side OSPF peers
         */
        summarizedSubnetToLanOspf?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayNetworkVpnAccessDestinationNat {
        /**
         * The Destination NAT destination IP address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
         */
        internalIp?: pulumi.Input<string | undefined>;
        /**
         * Label for this VPN destination NAT rule
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Destination port or variable for this VPN destination NAT rule
         */
        port?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayNetworkVpnAccessSourceNat {
        /**
         * External source NAT IP or subnet used when spoke hosts must be reachable from the hub
         */
        externalIp?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayNetworkVpnAccessStaticNat {
        /**
         * The Static NAT destination IP address. Must be an IP address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
         */
        internalIp: pulumi.Input<string>;
        /**
         * Label for this VPN static NAT rule
         */
        name: pulumi.Input<string>;
    }
    interface DeviceprofileGatewayOobIpConfig {
        /**
         * Default gateway for the out-of-band management interface when `type`==`static`
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Static IPv4 address for the out-of-band management interface when `type`==`static`
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * IPv4 netmask or prefix length for the out-of-band management interface when `type`==`static`
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * Out-of-band management IP configuration override for node1 in an HA cluster
         */
        node1?: pulumi.Input<inputs.org.DeviceprofileGatewayOobIpConfigNode1 | undefined>;
        /**
         * IP assignment mode for the out-of-band management interface
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * If supported on the platform. If enabled, DNS will be using this routing-instance, too
         */
        useMgmtVrf?: pulumi.Input<boolean | undefined>;
        /**
         * For host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired
         */
        useMgmtVrfForHostOut?: pulumi.Input<boolean | undefined>;
        /**
         * VLAN ID used for out-of-band management traffic
         */
        vlanId?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayOobIpConfigNode1 {
        /**
         * Default gateway for the node1 out-of-band management interface when `type`==`static`
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Static IPv4 address for the node1 out-of-band management interface when `type`==`static`
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * IPv4 netmask or prefix length for the node1 out-of-band management interface when `type`==`static`; used only if `subnet` is not specified in `networks`
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * IP assignment mode for the node1 out-of-band management interface
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * If supported on the platform. If enabled, DNS will be using this routing-instance, too
         */
        useMgmtVrf?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to use `mgmtJunos` for host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired
         */
        useMgmtVrfForHostOut?: pulumi.Input<boolean | undefined>;
        /**
         * VLAN ID used for node1 out-of-band management traffic
         */
        vlanId?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayPathPreferences {
        /**
         * Candidate paths evaluated for this gateway path preference
         */
        paths?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileGatewayPathPreferencesPath>[] | undefined>;
        /**
         * Selection strategy used to evaluate the candidate paths
         */
        strategy?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayPathPreferencesPath {
        /**
         * Relative cost assigned to this path for gateway path selection
         */
        cost?: pulumi.Input<number | undefined>;
        /**
         * For SSR Only. `true`, if this specific path is undesired
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `type`==`local`, if a different gateway is desired
         */
        gatewayIp?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`vpn`, if this vpn path can be used for internet
         */
        internetAccess?: pulumi.Input<boolean | undefined>;
        /**
         * Required when
         *   * `type`==`vpn`: the name of the VPN Path to use
         *   * `type`==`wan`: the name of the WAN interface to use
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * List of network names used when `type`==`local`
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * List of destination IP addresses to replace when `type`==`local`
         */
        targetIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Gateway path source type, such as local network, WAN interface, VPN path, or tunnel
         */
        type: pulumi.Input<string>;
        /**
         * Optional if `type`==`vpn`; WAN interface name associated with the VPN path
         */
        wanName?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayPortConfig {
        /**
         * If `aggregated`==`true`. To disable LCP support for the AE interface
         */
        aeDisableLacp?: pulumi.Input<boolean | undefined>;
        /**
         * If `aggregated`==`true`. Users could force to use the designated AE name (must be an integer between 0 and 127)
         */
        aeIdx?: pulumi.Input<string | undefined>;
        /**
         * For SRX only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
         */
        aeLacpForceUp?: pulumi.Input<boolean | undefined>;
        /**
         * Whether the port participates in an aggregated Ethernet interface
         */
        aggregated?: pulumi.Input<boolean | undefined>;
        /**
         * To generate port up/down alarm, set it to true
         */
        critical?: pulumi.Input<boolean | undefined>;
        /**
         * Interface Description. Can be a variable (i.e. "{{myvar}}")
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Whether Ethernet autonegotiation is disabled on the port
         */
        disableAutoneg?: pulumi.Input<boolean | undefined>;
        /**
         * Port admin up (true) / down (false)
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * If `wanType`==`dsl`. DSL technology used by the WAN port
         */
        dslType?: pulumi.Input<string | undefined>;
        /**
         * If `wanType`==`dsl`, 16 bit int
         */
        dslVci?: pulumi.Input<number | undefined>;
        /**
         * If `wanType`==`dsl`, 8 bit int
         */
        dslVpi?: pulumi.Input<number | undefined>;
        /**
         * Ethernet duplex mode configured on the port
         */
        duplex?: pulumi.Input<string | undefined>;
        /**
         * Layer 3 IP configuration for the port
         */
        ipConfig?: pulumi.Input<inputs.org.DeviceprofileGatewayPortConfigIpConfig | undefined>;
        /**
         * If `wanType`==`lte`. APN used by the LTE uplink
         */
        lteApn?: pulumi.Input<string | undefined>;
        /**
         * If `wanType`==`lte`. Authentication method used by the LTE uplink
         */
        lteAuth?: pulumi.Input<string | undefined>;
        /**
         * Whether the LTE uplink is used as a backup WAN connection
         */
        lteBackup?: pulumi.Input<boolean | undefined>;
        /**
         * If `wanType`==`lte`. Password used for LTE uplink authentication
         */
        ltePassword?: pulumi.Input<string | undefined>;
        /**
         * If `wanType`==`lte`. Username used for LTE uplink authentication
         */
        lteUsername?: pulumi.Input<string | undefined>;
        /**
         * Layer 3 MTU configured on the port
         */
        mtu?: pulumi.Input<number | undefined>;
        /**
         * Interface name used to derive device configuration
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * if `usage`==`lan`, name of the `junipermist.org.Network` resource
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * For Q-in-Q. Outer VLAN ID used for QinQ encapsulation
         */
        outerVlanId?: pulumi.Input<number | undefined>;
        /**
         * Whether PoE output is disabled on the port
         */
        poeDisabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether Perpetual PoE capabilities are enabled for a port
         */
        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
        /**
         * Only for SRX and if `usage`==`lan`, the name of the Network to be used as the Untagged VLAN
         */
        portNetwork?: pulumi.Input<string | undefined>;
        /**
         * Whether to preserve dscp when sending traffic over VPN (SSR-only)
         */
        preserveDscp?: pulumi.Input<boolean | undefined>;
        /**
         * If HA mode. Whether the port participates in the redundant Ethernet configuration
         */
        redundant?: pulumi.Input<boolean | undefined>;
        /**
         * If HA mode, SRX Only - support redundancy-group. 1-128 for physical SRX, 1-64 for virtual SRX
         */
        redundantGroup?: pulumi.Input<number | undefined>;
        /**
         * For SRX only and if HA Mode
         */
        rethIdx?: pulumi.Input<string | undefined>;
        /**
         * If HA mode. Node associated with the redundant Ethernet interface
         */
        rethNode?: pulumi.Input<string | undefined>;
        /**
         * If HA mode and for SSR only. Per-network node assignment used for VLAN-based redundancy
         */
        rethNodes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Link speed configured on the port
         */
        speed?: pulumi.Input<string | undefined>;
        /**
         * When SSR is running as VM, this is required on certain hosting platforms
         */
        ssrNoVirtualMac?: pulumi.Input<boolean | undefined>;
        /**
         * For SSR only. Port range configured on the interface
         */
        svrPortRange?: pulumi.Input<string | undefined>;
        /**
         * Traffic shaping settings applied to the port
         */
        trafficShaping?: pulumi.Input<inputs.org.DeviceprofileGatewayPortConfigTrafficShaping | undefined>;
        /**
         * Logical usage assigned to the port
         */
        usage: pulumi.Input<string>;
        /**
         * VLAN ID or variable used when the WAN interface is carried on a VLAN
         */
        vlanId?: pulumi.Input<string | undefined>;
        /**
         * Per-VPN path settings for traffic that uses this port
         */
        vpnPaths?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayPortConfigVpnPaths>;
        } | undefined>;
        /**
         * Only when `wanType`==`broadband`. ARP policer profile applied to the WAN port
         */
        wanArpPolicer?: pulumi.Input<string | undefined>;
        /**
         * Only if `usage`==`wan`, optional. If spoke should reach this port by a different IP
         */
        wanExtIp?: pulumi.Input<string | undefined>;
        /**
         * Only if `usage`==`wan`, optional. If spoke should reach this port by a different IPv6
         */
        wanExtIp6?: pulumi.Input<string | undefined>;
        /**
         * Only if `usage`==`wan`. Property Key is the destination CIDR (e.g. "100.100.100.0/24")
         */
        wanExtraRoutes?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayPortConfigWanExtraRoutes>;
        } | undefined>;
        /**
         * Only if `usage`==`wan`. Property Key is the destination CIDR (e.g. "2a02:1234:420a:10c9::/64")
         */
        wanExtraRoutes6?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileGatewayPortConfigWanExtraRoutes6>;
        } | undefined>;
        /**
         * Only if `usage`==`wan`. Networks reachable through this WAN port for policy definition
         */
        wanNetworks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Optional WAN health probe override settings for this port
         */
        wanProbeOverride?: pulumi.Input<inputs.org.DeviceprofileGatewayPortConfigWanProbeOverride | undefined>;
        /**
         * Source NAT settings applied to traffic leaving this WAN port
         */
        wanSourceNat?: pulumi.Input<inputs.org.DeviceprofileGatewayPortConfigWanSourceNat | undefined>;
        /**
         * Controls whether Marvis or the scheduler can run speed tests on this WAN port
         */
        wanSpeedtestMode?: pulumi.Input<string | undefined>;
        /**
         * Only if `usage`==`wan`. WAN uplink type configured on the port
         */
        wanType?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayPortConfigIpConfig {
        /**
         * Resolver server IP addresses used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0
         */
        dns?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * DNS search suffixes used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0
         */
        dnsSuffixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP address (i.e. "192.168.1.1") or a Variable (i.e. "{{myvar}}")
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IPv6 Address (i.e. "2001:db8::1") or a Variable (i.e. "{{myvar}}")
         */
        gateway6?: pulumi.Input<string | undefined>;
        /**
         * Interface IP address (i.e. "192.168.1.8") or a Variable (i.e. "{{myvar}}")
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Interface IPv6 Address (i.e. "2001:db8::123") or a Variable (i.e. "{{myvar}}")
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * Used only if `subnet` is not specified in `networks`. Interface Netmask (i.e. "/24") or a Variable (i.e. "{{myvar}}")
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * Used only if `subnet` is not specified in `networks`. Interface IPv6 Netmask (i.e. "/64") or a Variable (i.e. "{{myvar}}")
         */
        netmask6?: pulumi.Input<string | undefined>;
        /**
         * Optional, the network to be used for mgmt
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Password used for PPPoE when `type`==`pppoe`
         */
        poserPassword?: pulumi.Input<string | undefined>;
        /**
         * Authentication protocol used for PPPoE when `type`==`pppoe`
         */
        pppoeAuth?: pulumi.Input<string | undefined>;
        /**
         * Username used for PPPoE when `type`==`pppoe`
         */
        pppoeUsername?: pulumi.Input<string | undefined>;
        /**
         * IPv4 assignment mode for this gateway port interface
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 assignment mode for this gateway port interface
         */
        type6?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayPortConfigTrafficShaping {
        /**
         * Traffic class bandwidth percentages for high, medium, low, and best-effort queues
         */
        classPercentages?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether traffic shaping is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Maximum transmit bandwidth for the interface, in Kbps
         */
        maxTxKbps?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileGatewayPortConfigVpnPaths {
        /**
         * BFD profile used for this VPN path when the VPN `type`==`hubSpoke`
         */
        bfdProfile?: pulumi.Input<string | undefined>;
        /**
         * Only if the VPN `type`==`hubSpoke`. Whether to use tunnel mode. SSR only
         */
        bfdUseTunnelMode?: pulumi.Input<boolean | undefined>;
        /**
         * Only if the VPN `type`==`hubSpoke`. For a given VPN, when `path_selection.strategy`==`simple`, the preference for a path (lower is preferred)
         */
        preference?: pulumi.Input<number | undefined>;
        /**
         * Gateway role for this VPN path; valid values depend on the VPN `type`
         */
        role?: pulumi.Input<string | undefined>;
        /**
         * Traffic shaping settings applied to this VPN path
         */
        trafficShaping?: pulumi.Input<inputs.org.DeviceprofileGatewayPortConfigVpnPathsTrafficShaping | undefined>;
    }
    interface DeviceprofileGatewayPortConfigVpnPathsTrafficShaping {
        /**
         * Traffic class bandwidth percentages for high, medium, low, and best-effort queues
         */
        classPercentages?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether traffic shaping is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Maximum transmit bandwidth for the interface, in Kbps
         */
        maxTxKbps?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileGatewayPortConfigWanExtraRoutes {
        /**
         * IPv4 next-hop address for this WAN extra route
         */
        via?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayPortConfigWanExtraRoutes6 {
        /**
         * IPv6 next-hop address for this WAN extra route
         */
        via?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayPortConfigWanProbeOverride {
        /**
         * List of IPv6 probe host addresses used by this WAN override
         */
        ip6s?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * List of IPv4 probe host addresses used by this WAN override
         */
        ips?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * WAN probe profile used for health checks on this port
         */
        probeProfile?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayPortConfigWanSourceNat {
        /**
         * Or to disable the source-nat
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * If alternative natPool is desired
         */
        nat6Pool?: pulumi.Input<string | undefined>;
        /**
         * If alternative natPool is desired
         */
        natPool?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayRoutingPolicies {
        /**
         * Ordered terms evaluated by this gateway routing policy
         */
        terms?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileGatewayRoutingPoliciesTerm>[] | undefined>;
    }
    interface DeviceprofileGatewayRoutingPoliciesTerm {
        /**
         * Policy actions applied when this routing policy term matches
         */
        actions?: pulumi.Input<inputs.org.DeviceprofileGatewayRoutingPoliciesTermActions | undefined>;
        /**
         * Route match criteria that must be satisfied before actions are applied
         */
        matching?: pulumi.Input<inputs.org.DeviceprofileGatewayRoutingPoliciesTermMatching | undefined>;
    }
    interface DeviceprofileGatewayRoutingPoliciesTermActions {
        /**
         * Whether to accept routes that match this term
         */
        accept?: pulumi.Input<boolean | undefined>;
        /**
         * BGP communities to add to routes that match this term
         */
        addCommunities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * SSR target VRFs to add when leaking routes from hub to spoke
         */
        addTargetVrfs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities to set when this term is used as an export policy
         */
        communities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * AS path values to exclude when this term is used as an export policy
         */
        excludeAsPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities to exclude from routes that match this term
         */
        excludeCommunities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities allowed for export when this term is used as an export policy
         */
        exportCommunities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Preference value to set when this term is used as an import policy
         */
        localPreference?: pulumi.Input<string | undefined>;
        /**
         * AS path values to prepend when this term is used as an export policy
         */
        prependAsPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileGatewayRoutingPoliciesTermMatching {
        /**
         * BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}`)
         */
        asPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities that routes must match
         */
        communities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Configured network names that routes must match
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Route prefixes that routes must match
         */
        prefixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * enum: `aggregate`, `bgp`, `direct`, `ospf`, `static` (SRX Only)
         */
        protocols?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Existing route condition that must be satisfied before this term matches
         */
        routeExists?: pulumi.Input<inputs.org.DeviceprofileGatewayRoutingPoliciesTermMatchingRouteExists | undefined>;
        /**
         * Overlay neighbor MAC addresses used as match criteria for BGP sessions with `via`==`vpn`
         */
        vpnNeighborMacs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * SLA thresholds used when matching a VPN path
         */
        vpnPathSla?: pulumi.Input<inputs.org.DeviceprofileGatewayRoutingPoliciesTermMatchingVpnPathSla | undefined>;
        /**
         * Overlay path names used as match criteria for BGP sessions with `via`==`vpn`
         */
        vpnPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileGatewayRoutingPoliciesTermMatchingRouteExists {
        /**
         * Prefix that must exist for this condition to match
         */
        route?: pulumi.Input<string | undefined>;
        /**
         * Name of the VRF instance where the route is checked; can also be a VPN or WAN name when applicable
         */
        vrfName?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayRoutingPoliciesTermMatchingVpnPathSla {
        /**
         * Maximum jitter threshold allowed for the VPN path
         */
        maxJitter?: pulumi.Input<number | undefined>;
        /**
         * Maximum latency threshold allowed for the VPN path
         */
        maxLatency?: pulumi.Input<number | undefined>;
        /**
         * Maximum packet-loss threshold allowed for the VPN path
         */
        maxLoss?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileGatewayServicePolicy {
        /**
         * Required when `servicepolicyId` is not defined, optional otherwise (override the servicepolicy action). enum: `allow`, `deny`
         */
        action?: pulumi.Input<string | undefined>;
        /**
         * Malware and virus inspection settings applied by this service policy
         */
        antivirus?: pulumi.Input<inputs.org.DeviceprofileGatewayServicePolicyAntivirus | undefined>;
        /**
         * Application QoE settings applied by this service policy
         */
        appqoe?: pulumi.Input<inputs.org.DeviceprofileGatewayServicePolicyAppqoe | undefined>;
        /**
         * Enhanced web filtering rules applied by this service policy
         */
        ewfs?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileGatewayServicePolicyEwf>[] | undefined>;
        /**
         * Intrusion detection and prevention settings applied by this service policy
         */
        idp?: pulumi.Input<inputs.org.DeviceprofileGatewayServicePolicyIdp | undefined>;
        /**
         * Whether the policy permits access within the same VRF
         */
        localRouting?: pulumi.Input<boolean | undefined>;
        /**
         * Required when `servicepolicyId` is not defined, optional otherwise (override the servicepolicy name)
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * By default, we derive all paths available and use them. Optionally, you can customize by using `pathPreference`
         */
        pathPreference?: pulumi.Input<string | undefined>;
        /**
         * Organization-level service policy identifier used to link and override selected attributes
         */
        servicepolicyId?: pulumi.Input<string | undefined>;
        /**
         * Required when `servicepolicyId` is not defined. List of Applications / Destinations
         */
        services?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Threat inspection settings provided by Sky ATP for this service policy
         */
        skyatp?: pulumi.Input<inputs.org.DeviceprofileGatewayServicePolicySkyatp | undefined>;
        /**
         * TLS inspection settings applied by this service policy
         */
        sslProxy?: pulumi.Input<inputs.org.DeviceprofileGatewayServicePolicySslProxy | undefined>;
        /**
         * Remote logging settings applied by this service policy
         */
        syslog?: pulumi.Input<inputs.org.DeviceprofileGatewayServicePolicySyslog | undefined>;
        /**
         * Required when `servicepolicyId` is not defined. List of Networks / Users
         */
        tenants?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileGatewayServicePolicyAntivirus {
        /**
         * Organization-level antivirus profile ID; takes precedence over inline `profile` settings
         */
        avprofileId?: pulumi.Input<string | undefined>;
        /**
         * Whether antivirus inspection is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Antivirus profile name to apply, such as `default`, `noftp`, `httponly`, or an AV profile key
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayServicePolicyAppqoe {
        /**
         * Whether application QoE is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileGatewayServicePolicyEwf {
        /**
         * Whether matching enhanced web filtering traffic is logged without being blocked
         */
        alertOnly?: pulumi.Input<boolean | undefined>;
        /**
         * Message returned when enhanced web filtering blocks a request
         */
        blockMessage?: pulumi.Input<string | undefined>;
        /**
         * Whether this enhanced web filtering rule is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Enhanced web filtering profile applied by this rule
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayServicePolicyIdp {
        /**
         * Whether to alert without enforcing IDP prevention actions
         */
        alertOnly?: pulumi.Input<boolean | undefined>;
        /**
         * Whether IDP inspection is enabled for the policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * org_level IDP Profile can be used, this takes precedence over `profile`
         */
        idpprofileId?: pulumi.Input<string | undefined>;
        /**
         * enum: `Custom`, `strict` (default), `standard` or keys from idp_profiles
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayServicePolicySkyatp {
        /**
         * Detection settings for DNS DGA threats provided by Sky ATP
         */
        dnsDgaDetection?: pulumi.Input<inputs.org.DeviceprofileGatewayServicePolicySkyatpDnsDgaDetection | undefined>;
        /**
         * Detection settings for DNS tunneling threats provided by Sky ATP
         */
        dnsTunnelDetection?: pulumi.Input<inputs.org.DeviceprofileGatewayServicePolicySkyatpDnsTunnelDetection | undefined>;
        /**
         * Web traffic inspection settings provided by Sky ATP
         */
        httpInspection?: pulumi.Input<inputs.org.DeviceprofileGatewayServicePolicySkyatpHttpInspection | undefined>;
        /**
         * Device threat policy settings provided by Sky ATP for IoT clients
         */
        iotDevicePolicy?: pulumi.Input<inputs.org.DeviceprofileGatewayServicePolicySkyatpIotDevicePolicy | undefined>;
    }
    interface DeviceprofileGatewayServicePolicySkyatpDnsDgaDetection {
        /**
         * Whether Sky ATP DNS DGA detection is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Sky ATP DNS DGA detection profile to apply
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayServicePolicySkyatpDnsTunnelDetection {
        /**
         * Whether Sky ATP DNS tunneling detection is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Sky ATP DNS tunneling detection profile to apply
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayServicePolicySkyatpHttpInspection {
        /**
         * Whether Sky ATP HTTP inspection is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Sky ATP HTTP inspection profile to apply
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayServicePolicySkyatpIotDevicePolicy {
        /**
         * Whether Sky ATP IoT device policy inspection is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileGatewayServicePolicySslProxy {
        /**
         * Allowed cipher strength category for SSL proxy inspection
         */
        ciphersCategory?: pulumi.Input<string | undefined>;
        /**
         * Whether SSL proxy inspection is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileGatewayServicePolicySyslog {
        /**
         * Whether syslog logging is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Names of syslog servers that receive logs for this service policy
         */
        serverNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileGatewayTunnelConfigs {
        /**
         * Provider auto-provisioning settings for tunnel endpoints
         */
        autoProvision?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsAutoProvision | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
         */
        ikeLifetime?: pulumi.Input<number | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. IKE negotiation mode for the tunnel
         */
        ikeMode?: pulumi.Input<string | undefined>;
        /**
         * If `provider`==`custom-ipsec`, IKE proposals used for custom IPsec negotiation
         */
        ikeProposals?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsIkeProposal>[] | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
         */
        ipsecLifetime?: pulumi.Input<number | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. IPsec proposals used for custom IPsec negotiation
         */
        ipsecProposals?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsIpsecProposal>[] | undefined>;
        /**
         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
         */
        localId?: pulumi.Input<string | undefined>;
        /**
         * Local protected subnets advertised by this tunnel
         */
        localSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Tunnel failover mode used for primary and secondary endpoints
         */
        mode?: pulumi.Input<string | undefined>;
        /**
         * Destination networks reachable through this tunnel
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Main remote tunnel endpoint settings
         */
        primary?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsPrimary | undefined>;
        /**
         * Tunnel health probe settings
         */
        probe?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsProbe | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. Tunnel protocol for custom tunnel negotiation
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Tunnel provider used when auto provisioning is disabled
         */
        provider?: pulumi.Input<string | undefined>;
        /**
         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
         */
        psk?: pulumi.Input<string | undefined>;
        /**
         * Remote protected subnets reached through policy-based IPsec
         */
        remoteSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Backup remote tunnel endpoint settings
         */
        secondary?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsSecondary | undefined>;
        /**
         * Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. Tunnel version value for custom tunnel configuration
         */
        version?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayTunnelConfigsAutoProvision {
        /**
         * Enable auto provisioning for the tunnel. If enabled, the `primary` and `secondary` nodes will be ignored.
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Geographic coordinate override used for tunnel POP selection
         */
        latlng?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsAutoProvisionLatlng | undefined>;
        /**
         * Main auto-provisioned tunnel endpoint settings
         */
        primary?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsAutoProvisionPrimary | undefined>;
        /**
         * Tunnel provider used for automatic endpoint provisioning
         */
        provider: pulumi.Input<string>;
        /**
         * API override for POP selection in the case user wants to override the auto discovery of remote network location and force the tunnel to use the specified peer location.
         */
        region?: pulumi.Input<string | undefined>;
        /**
         * Backup auto-provisioned tunnel endpoint settings
         */
        secondary?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelConfigsAutoProvisionSecondary | undefined>;
        /**
         * if `provider`==`prisma-ipsec`. By default, we'll use the location of the site to determine the optimal Remote Network location, optionally, serviceConnection can be considered, then we'll also consider this along with the site location. Define serviceConnection if the traffic is to be routed to a specific service connection. This field takes a service connection name that is configured in the Prisma cloud, Prisma Access Setup > Service Connections.
         */
        serviceConnection?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayTunnelConfigsAutoProvisionLatlng {
        /**
         * Geographic latitude used for POP selection override
         */
        lat: pulumi.Input<number>;
        /**
         * Geographic longitude used for POP selection override
         */
        lng: pulumi.Input<number>;
    }
    interface DeviceprofileGatewayTunnelConfigsAutoProvisionPrimary {
        /**
         * Probe IP addresses used to monitor auto-provisioned tunnel reachability
         */
        probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * WAN interface names used by the auto-provisioned tunnel endpoint
         */
        wanNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileGatewayTunnelConfigsAutoProvisionSecondary {
        /**
         * Probe IP addresses used to monitor auto-provisioned tunnel reachability
         */
        probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * WAN interface names used by the auto-provisioned tunnel endpoint
         */
        wanNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileGatewayTunnelConfigsIkeProposal {
        /**
         * Integrity algorithm used by this IKE proposal
         */
        authAlgo?: pulumi.Input<string | undefined>;
        /**
         * Diffie-Hellman group used by this IKE proposal
         */
        dhGroup?: pulumi.Input<string | undefined>;
        /**
         * Cipher algorithm used by this IKE proposal
         */
        encAlgo?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayTunnelConfigsIpsecProposal {
        /**
         * Integrity algorithm used by this IPsec proposal
         */
        authAlgo?: pulumi.Input<string | undefined>;
        /**
         * Diffie-Hellman group used by this IPsec proposal
         */
        dhGroup?: pulumi.Input<string | undefined>;
        /**
         * Cipher algorithm used by this IPsec proposal
         */
        encAlgo?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayTunnelConfigsPrimary {
        /**
         * Remote gateway host addresses for this tunnel node
         */
        hosts: pulumi.Input<pulumi.Input<string>[]>;
        /**
         * Internal IP addresses configured on this tunnel node
         */
        internalIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Health-check IP addresses used to monitor this tunnel node
         */
        probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IKE identities expected from this tunnel node
         */
        remoteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Interface names that source tunnel traffic for this node
         */
        wanNames: pulumi.Input<pulumi.Input<string>[]>;
    }
    interface DeviceprofileGatewayTunnelConfigsProbe {
        /**
         * How often to trigger the probe
         */
        interval?: pulumi.Input<number | undefined>;
        /**
         * Number of consecutive misses before declaring the tunnel down
         */
        threshold?: pulumi.Input<number | undefined>;
        /**
         * Time within which to complete the connectivity check
         */
        timeout?: pulumi.Input<number | undefined>;
        /**
         * Protocol used by the custom IPsec tunnel health probe
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayTunnelConfigsSecondary {
        /**
         * Remote gateway host addresses for this tunnel node
         */
        hosts: pulumi.Input<pulumi.Input<string>[]>;
        /**
         * Internal IP addresses configured on this tunnel node
         */
        internalIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Health-check IP addresses used to monitor this tunnel node
         */
        probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IKE identities expected from this tunnel node
         */
        remoteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Interface names that source tunnel traffic for this node
         */
        wanNames: pulumi.Input<pulumi.Input<string>[]>;
    }
    interface DeviceprofileGatewayTunnelProviderOptions {
        /**
         * Juniper Secure Edge provisioning options for tunnel endpoints
         */
        jse?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelProviderOptionsJse | undefined>;
        /**
         * Palo Alto Prisma Access provisioning options for tunnel endpoints
         */
        prisma?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelProviderOptionsPrisma | undefined>;
        /**
         * Provider settings for Zscaler tunnel endpoints
         */
        zscaler?: pulumi.Input<inputs.org.DeviceprofileGatewayTunnelProviderOptionsZscaler | undefined>;
    }
    interface DeviceprofileGatewayTunnelProviderOptionsJse {
        /**
         * User capacity to provision on Juniper Secure Edge
         */
        numUsers?: pulumi.Input<number | undefined>;
        /**
         * JSE Organization name
         */
        orgName?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayTunnelProviderOptionsPrisma {
        /**
         * For prisma-ipsec, service account name to used for tunnel auto provisioning
         */
        serviceAccountName?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileGatewayTunnelProviderOptionsZscaler {
        /**
         * Whether Zscaler blocks internet access until the Acceptable Use Policy is accepted
         */
        aupBlockInternetUntilAccepted?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
         */
        aupEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
         */
        aupForceSslInspection?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `aupEnabled`==`true`. Days before AUP is requested again
         */
        aupTimeoutInDays?: pulumi.Input<number | undefined>;
        /**
         * Enable this option to enforce user authentication
         */
        authRequired?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
         */
        cautionEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Download bandwidth cap of the link, in Mbps. Disabled if not set
         */
        dnBandwidth?: pulumi.Input<number | undefined>;
        /**
         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
         */
        idleTimeInMinutes?: pulumi.Input<number | undefined>;
        /**
         * If `true`, enable the firewall control option
         */
        ofwEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Per-network Zscaler sub-location settings
         */
        subLocations?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileGatewayTunnelProviderOptionsZscalerSubLocation>[] | undefined>;
        /**
         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
         */
        surrogateIp?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
         */
        surrogateIpEnforcedForKnownBrowsers?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
         */
        surrogateRefreshTimeInMinutes?: pulumi.Input<number | undefined>;
        /**
         * Download bandwidth cap of the link, in Mbps. Disabled if not set
         */
        upBandwidth?: pulumi.Input<number | undefined>;
        /**
         * Location uses proxy chaining to forward traffic
         */
        xffForwardEnabled?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileGatewayTunnelProviderOptionsZscalerSubLocation {
        /**
         * Whether this sub-location blocks internet access until the Acceptable Use Policy is accepted
         */
        aupBlockInternetUntilAccepted?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
         */
        aupEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
         */
        aupForceSslInspection?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `aupEnabled`==`true`. Days before AUP is requested again
         */
        aupTimeoutInDays?: pulumi.Input<number | undefined>;
        /**
         * Enable this option to authenticate users
         */
        authRequired?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
         */
        cautionEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Download bandwidth cap of the link, in Mbps. Disabled if not set
         */
        dnBandwidth?: pulumi.Input<number | undefined>;
        /**
         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
         */
        idleTimeInMinutes?: pulumi.Input<number | undefined>;
        /**
         * Network name
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * If `true`, enable the firewall control option
         */
        ofwEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
         */
        surrogateIp?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
         */
        surrogateIpEnforcedForKnownBrowsers?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
         */
        surrogateRefreshTimeInMinutes?: pulumi.Input<number | undefined>;
        /**
         * Download bandwidth cap of the link, in Mbps. Disabled if not set
         */
        upBandwidth?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileGatewayVrfConfig {
        /**
         * Whether to enable VRF (when supported on the device)
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileGatewayVrfInstances {
        /**
         * Network names included in this gateway VRF instance
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileSwitchAclPolicy {
        /**
         * Destination tag actions evaluated for sources matching this ACL policy
         */
        actions?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchAclPolicyAction>[] | undefined>;
        /**
         * Display name of the ACL policy
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Source ACL tags that select traffic for this ACL policy
         */
        srcTags?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileSwitchAclPolicyAction {
        /**
         * Allow or deny decision applied to traffic matching the destination tag
         */
        action?: pulumi.Input<string | undefined>;
        /**
         * Destination ACL tag matched by this policy action
         */
        dstTag: pulumi.Input<string>;
    }
    interface DeviceprofileSwitchAclTags {
        /**
         * Layer 2 EtherTypes matched by this ACL tag; defaults to `any`
         */
        etherTypes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Required if
         *   - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
         *   - `type`==`gbpResource`
         *   - `type`==`staticGbp` (applying gbp tag against matching conditions)
         */
        gbpTag?: pulumi.Input<number | undefined>;
        /**
         * Client or resource MAC addresses matched by this ACL tag
         */
        macs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If:
         *   * `type`==`mac` (optional. default is `any`)
         *   * `type`==`subnet` (optional. default is `any`)
         *   * `type`==`network`
         *   * `type`==`resource` (optional. default is `any`)
         *   * `type`==`staticGbp` if from matching network (vlan)
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Required if `type`==`portUsage`. Switch port usage name matched by this ACL tag
         */
        portUsage?: pulumi.Input<string | undefined>;
        /**
         * Required if:
         *   * `type`==`radiusGroup`
         *   * `type`==`staticGbp`
         * if from matching radius_group
         */
        radiusGroup?: pulumi.Input<string | undefined>;
        /**
         * Layer 4 protocol and destination-port constraints for this ACL tag
         */
        specs?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchAclTagsSpec>[] | undefined>;
        /**
         * IP subnets matched by this ACL tag
         */
        subnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Classifier type that determines which ACL tag fields are evaluated
         */
        type: pulumi.Input<string>;
    }
    interface DeviceprofileSwitchAclTagsSpec {
        /**
         * Matched dst port, "0" means any
         */
        portRange?: pulumi.Input<string | undefined>;
        /**
         * `tcp` / `udp` / `icmp` / `icmp6` / `gre` / `any` / `:protocol_number`, `protocolNumber` is between 1-254, default is `any` `protocolNumber` is between 1-254
         */
        protocol?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchDhcpSnooping {
        /**
         * Whether DHCP snooping applies to all configured networks
         */
        allNetworks?: pulumi.Input<boolean | undefined>;
        /**
         * Enable for dynamic ARP inspection check
         */
        enableArpSpoofCheck?: pulumi.Input<boolean | undefined>;
        /**
         * Enable for check for forging source IP address
         */
        enableIpSourceGuard?: pulumi.Input<boolean | undefined>;
        /**
         * Whether DHCP snooping is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Network names with DHCP snooping enabled when `allNetworks`==`false`
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileSwitchDhcpdConfig {
        /**
         * Property key is the network name
         */
        config?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileSwitchDhcpdConfigConfig>;
        } | undefined>;
        /**
         * Whether switch DHCP server or relay configuration is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileSwitchDhcpdConfigConfig {
        /**
         * If `type`==`server` or `type6`==`server`, DNS servers advertised to DHCP clients
         */
        dnsServers?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type`==`server` or `type6`==`server`, DNS search suffixes advertised to DHCP clients
         */
        dnsSuffixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type`==`server` or `type6`==`server`, fixed client bindings for DHCP service
         */
        fixedBindings?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileSwitchDhcpdConfigConfigFixedBindings>;
        } | undefined>;
        /**
         * If `type`==`server` - optional, `ip` will be used if not provided
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`server`, ending IPv4 address for the DHCP lease pool
         */
        ipEnd?: pulumi.Input<string | undefined>;
        /**
         * If `type6`==`server`, ending IPv6 address for the DHCP lease pool
         */
        ipEnd6?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`server`, starting IPv4 address for the DHCP lease pool
         */
        ipStart?: pulumi.Input<string | undefined>;
        /**
         * If `type6`==`server`, starting IPv6 address for the DHCP lease pool
         */
        ipStart6?: pulumi.Input<string | undefined>;
        /**
         * In seconds, lease time has to be between 3600 [1hr] - 604800 [1 week], default is 86400 [1 day]
         */
        leaseTime?: pulumi.Input<number | undefined>;
        /**
         * If `type`==`server` or `type6`==`server`, custom DHCP options advertised to clients
         */
        options?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileSwitchDhcpdConfigConfigOptions>;
        } | undefined>;
        /**
         * `serverIdOverride`==`true` means the device, when acts as DHCP relay and forwards DHCP responses from DHCP server to clients,
         * should overwrite the Sever Identifier option (i.e. DHCP option 54) in DHCP responses with its own IP address.
         */
        serverIdOverride?: pulumi.Input<boolean | undefined>;
        /**
         * If `type`==`relay`, upstream IPv4 DHCP servers
         */
        servers?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type6`==`relay`, upstream IPv6 DHCP servers
         */
        servers6s?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IPv4 DHCP mode for this switch network
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 DHCP mode for this switch network
         */
        type6?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`server` or `type6`==`server`, vendor-encapsulated DHCP options advertised to clients
         */
        vendorEncapsulated?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileSwitchDhcpdConfigConfigVendorEncapsulated>;
        } | undefined>;
    }
    interface DeviceprofileSwitchDhcpdConfigConfigFixedBindings {
        /**
         * Reserved IPv4 address for this fixed DHCP binding
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Reserved IPv6 address for this fixed DHCP binding
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * Friendly name for this fixed DHCP binding
         */
        name?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchDhcpdConfigConfigOptions {
        /**
         * Data type used to encode this DHCP option value
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Option value to send for this DHCP option
         */
        value?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchDhcpdConfigConfigVendorEncapsulated {
        /**
         * Data type used to encode this vendor option value
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Option value to send for this vendor option
         */
        value?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchEvpnConfig {
        /**
         * Whether EVPN configuration is enabled on the switch
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * EVPN topology role for the switch
         */
        role?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchExtraRoutes {
        /**
         * Whether to install a discard route; this takes precedence over next-hop settings
         */
        discard?: pulumi.Input<boolean | undefined>;
        /**
         * Route metric for the IPv4 static route
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * Qualified next-hop settings keyed by IPv4 next-hop address
         */
        nextQualified?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileSwitchExtraRoutesNextQualified>;
        } | undefined>;
        /**
         * Whether to prevent recursive next-hop resolution for the IPv4 static route
         */
        noResolve?: pulumi.Input<boolean | undefined>;
        /**
         * Route preference for the IPv4 static route
         */
        preference?: pulumi.Input<number | undefined>;
        /**
         * Next-hop IPv4 address or ECMP next-hop IPv4 addresses for the route
         */
        via: pulumi.Input<string>;
    }
    interface DeviceprofileSwitchExtraRoutes6 {
        /**
         * Whether to install a discard route; this takes precedence over next-hop settings
         */
        discard?: pulumi.Input<boolean | undefined>;
        /**
         * Route metric for the IPv6 static route
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * Qualified next-hop settings keyed by IPv6 next-hop address
         */
        nextQualified?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileSwitchExtraRoutes6NextQualified>;
        } | undefined>;
        /**
         * Whether to prevent recursive next-hop resolution for the IPv6 static route
         */
        noResolve?: pulumi.Input<boolean | undefined>;
        /**
         * Route preference for the IPv6 static route
         */
        preference?: pulumi.Input<number | undefined>;
        /**
         * Next-hop IPv6 address or ECMP next-hop IPv6 addresses for the route
         */
        via: pulumi.Input<string>;
    }
    interface DeviceprofileSwitchExtraRoutes6NextQualified {
        /**
         * Route metric for this qualified IPv6 next hop
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * Route preference for this qualified IPv6 next hop
         */
        preference?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileSwitchExtraRoutesNextQualified {
        /**
         * Route metric for this qualified IPv4 next hop
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * Route preference for this qualified IPv4 next hop
         */
        preference?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileSwitchIotConfig {
        /**
         * Alarm severity class raised for input-triggered switch IOT port events
         */
        alarmClass?: pulumi.Input<string | undefined>;
        /**
         * Whether this switch IOT port is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only for `OUT` ports. Input port that triggers this output port
         */
        inputSrc?: pulumi.Input<string | undefined>;
        /**
         * Display name for the switch IOT port
         */
        name?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchIpConfig {
        /**
         * Configured DNS server addresses for Junos management traffic
         */
        dns?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * DNS search suffixes configured for Junos management traffic
         */
        dnsSuffixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Default gateway IPv4 address for this Junos IP configuration
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Configured IPv4 address for this Junos IP configuration
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Used only if `subnet` is not specified in `networks`
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * Management network for this IP configuration; used as the default source network for outbound SSH, DNS, NTP, TACACS+, RADIUS, syslog, and SNMP
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * IP assignment mode for this Junos IP configuration
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchMistNac {
        /**
         * Whether Mist NAC RadSec is enabled for the switch
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Switch network used for Mist NAC RadSec connectivity
         */
        network?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchNetworks {
        /**
         * Only required for EVPN-VXLAN networks, IPv4 Virtual Gateway
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Only required for EVPN-VXLAN networks, IPv6 Virtual Gateway
         */
        gateway6?: pulumi.Input<string | undefined>;
        /**
         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required). NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set. See also `interIsolationNetworkLink` and `communityVlanId` in port_usage
         */
        isolation?: pulumi.Input<boolean | undefined>;
        /**
         * Required when `isolation`==`true`. Unique VLAN ID used for client isolation
         */
        isolationVlanId?: pulumi.Input<string | undefined>;
        /**
         * Optional for pure switching, required when L3 / routing features are used
         */
        subnet?: pulumi.Input<string | undefined>;
        /**
         * Optional for pure switching, required when L3 / routing features are used
         */
        subnet6?: pulumi.Input<string | undefined>;
        /**
         * VLAN identifier for this switch network
         */
        vlanId: pulumi.Input<string>;
    }
    interface DeviceprofileSwitchOobIpConfig {
        /**
         * Default gateway for the out-of-band management interface when `type`==`static`
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Static IPv4 address for the out-of-band management interface when `type`==`static`
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Used only if `subnet` is not specified in `networks`
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * Optional, the network to be used for mgmt
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * IP assignment mode for the out-of-band management interface
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * If supported on the platform. If enabled, DNS will be using this routing-instance, too
         */
        useMgmtVrf?: pulumi.Input<boolean | undefined>;
        /**
         * For host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired
         */
        useMgmtVrfForHostOut?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileSwitchOspfAreas {
        /**
         * Whether loopback interfaces are included in this OSPF area
         */
        includeLoopback?: pulumi.Input<boolean | undefined>;
        /**
         * OSPF network settings keyed by network name
         */
        networks: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileSwitchOspfAreasNetworks>;
        }>;
        /**
         * Area type for this OSPF area
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchOspfAreasNetworks {
        /**
         * Required if `authType`==`md5`. Property key is the key number
         */
        authKeys?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
        /**
         * Required if `authType`==`password`, the password, max length is 8
         */
        authPassword?: pulumi.Input<string | undefined>;
        /**
         * Authentication method used by this OSPF network
         */
        authType?: pulumi.Input<string | undefined>;
        /**
         * Minimum BFD interval for this OSPF network, in milliseconds
         */
        bfdMinimumInterval?: pulumi.Input<number | undefined>;
        /**
         * OSPF dead interval for this network, in seconds
         */
        deadInterval?: pulumi.Input<number | undefined>;
        /**
         * Routing policy used to export routes from this OSPF network
         */
        exportPolicy?: pulumi.Input<string | undefined>;
        /**
         * OSPF hello interval for this network, in seconds
         */
        helloInterval?: pulumi.Input<number | undefined>;
        /**
         * Routing policy used to import routes for this OSPF network
         */
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * OSPF interface type used for this network
         */
        interfaceType?: pulumi.Input<string | undefined>;
        /**
         * OSPF metric assigned to this network
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * By default, we'll re-advertise all learned OSPF routes toward overlay
         */
        noReadvertiseToOverlay?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to send OSPF-Hello
         */
        passive?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileSwitchOtherIpConfigs {
        /**
         * For EVPN, whether anycast is desired
         */
        evpnAnycast?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `type`==`static`; IPv4 address for the additional Junos L3 presence
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Required if `type6`==`static`; IPv6 address for the additional Junos L3 presence
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * Optional IPv4 netmask; `subnet` from `network` definition will be used if defined
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * Optional IPv6 prefix length; `subnet` from `network` definition will be used if defined
         */
        netmask6?: pulumi.Input<string | undefined>;
        /**
         * IPv4 assignment mode for the additional Junos L3 presence
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 assignment mode for the additional Junos L3 presence
         */
        type6?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchPortConfig {
        /**
         * To disable LACP support for the AE interface
         */
        aeDisableLacp?: pulumi.Input<boolean | undefined>;
        /**
         * Users could force to use the designated AE name
         */
        aeIdx?: pulumi.Input<number | undefined>;
        /**
         * If `aggregated`==`true`, sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
         */
        aeLacpForceUp?: pulumi.Input<boolean | undefined>;
        /**
         * If `aggregated`==`true`, sets LACP to passive mode on this AE interface; by default, active (fast) mode is used
         */
        aeLacpPassive?: pulumi.Input<boolean | undefined>;
        /**
         * To use slow timeout
         */
        aeLacpSlow?: pulumi.Input<boolean | undefined>;
        /**
         * Whether this port is configured as an aggregated Ethernet member
         */
        aggregated?: pulumi.Input<boolean | undefined>;
        /**
         * To generate port up/down alarm
         */
        critical?: pulumi.Input<boolean | undefined>;
        /**
         * Human-readable description for this Junos port
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * If `speed` and `duplex` are specified, whether to disable autonegotiation
         */
        disableAutoneg?: pulumi.Input<boolean | undefined>;
        /**
         * Link duplex mode for this Junos port
         */
        duplex?: pulumi.Input<string | undefined>;
        /**
         * Enable dynamic usage for this port. Set to `dynamic` to enable.
         */
        dynamicUsage?: pulumi.Input<string | undefined>;
        /**
         * Whether this Junos port participates in an ESI-LAG
         */
        esilag?: pulumi.Input<boolean | undefined>;
        /**
         * Media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation
         */
        mtu?: pulumi.Input<number | undefined>;
        /**
         * List of network names. Required if `usage`==`inet`
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Prevent helpdesk to override the port config
         */
        noLocalOverwrite?: pulumi.Input<boolean | undefined>;
        /**
         * Whether PoE capabilities are disabled for this Junos port
         */
        poeDisabled?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `usage`==`vlanTunnel`. Q-in-Q tunneling using All-in-one bundling. This also enables standard L2PT for interfaces that are not encapsulation tunnel interfaces and uses MAC rewrite operation. [View more information](https://www.juniper.net/documentation/us/en/software/junos/multicast-l2/topics/topic-map/q-in-q.html#id-understanding-qinq-tunneling-and-vlan-translation)
         */
        portNetwork?: pulumi.Input<string | undefined>;
        /**
         * Link speed for this Junos port
         */
        speed?: pulumi.Input<string | undefined>;
        /**
         * Port usage name. For Q-in-Q, use `vlanTunnel`. If EVPN is used, use `evpnUplink`or `evpnDownlink`
         */
        usage: pulumi.Input<string>;
    }
    interface DeviceprofileSwitchPortMirroring {
        /**
         * At least one mirror input source should be specified. Networks whose ingress traffic is mirrored
         */
        inputNetworksIngresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * At least one mirror input source should be specified. Switch ports whose egress traffic is mirrored
         */
        inputPortIdsEgresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * At least one mirror input source should be specified. Switch ports whose ingress traffic is mirrored
         */
        inputPortIdsIngresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputIpAddress?: pulumi.Input<string | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputNetwork?: pulumi.Input<string | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputPortId?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchPortUsages {
        /**
         * Only if `mode`==`trunk`. Whether to trunk all network/vlans
         */
        allNetworks?: pulumi.Input<boolean | undefined>;
        /**
         * Only applies when `mode`!=`dynamic`. Controls whether DHCP server traffic is allowed on ports using this configuration if DHCP snooping is enabled. This is a tri-state setting; `true`: ports become trusted ports allowing DHCP server traffic, `false`: ports become untrusted blocking DHCP server traffic, undefined: use system defaults (access ports default to untrusted, trunk ports default to trusted).
         */
        allowDhcpd?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        allowMultipleSupplicants?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Bypass auth for known clients if set to true when RADIUS server is down
         */
        bypassAuthWhenServerDown?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`=`dot1x`. Bypass auth for all (including unknown clients) if set to true when RADIUS server is down
         */
        bypassAuthWhenServerDownForUnknownClient?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Bypass auth for VOIP if set to true when RADIUS server is down
         */
        bypassAuthWhenServerDownForVoip?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. To be used together with `isolation` under networks. Signaling that this port connects to the networks isolated but wired clients belong to the same community can talk to each other
         */
        communityVlanId?: pulumi.Input<number | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. If speed and duplex are specified, whether to disable autonegotiation
         */
        disableAutoneg?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether the port is disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Link duplex mode for this port usage
         */
        duplex?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Networks or VLANs that RADIUS can return for dynamic VLAN assignment
         */
        dynamicVlanNetworks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Whether to enable MAC Auth
         */
        enableMacAuth?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        enableQos?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Which network to put the device into if the device cannot do dot1x. default is null (i.e. not allowed)
         */
        guestNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. `interIsolationNetworkLink` is used together with `isolation` under networks, signaling that this port connects to isolated networks
         */
        interIsolationNetworkLink?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. `interSwitchLink` is used together with `isolation` under networks. NOTE: `interSwitchLink` works only between Juniper devices. This has to be applied to both ports connected together
         */
        interSwitchLink?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `enableMacAuth`==`true`
         */
        macAuthOnly?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` + `enableMacAuth`==`true` + `macAuthOnly`==`false`, dot1x will be given priority then mac_auth. Enable this to prefer macAuth over dot1x.
         */
        macAuthPreferred?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `enableMacAuth`==`true`. MAC authentication protocol to use; ignored if Mist NAC is enabled
         */
        macAuthProtocol?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` max number of mac addresses, default is 0 for unlimited, otherwise range is 1 to 16383 (upper bound constrained by platform)
         */
        macLimit?: pulumi.Input<string | undefined>;
        /**
         * Switching mode for this port usage
         */
        mode?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation. Value between 256 and 9216, default value is 1514.
         */
        mtu?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`==`trunk`. Network or VLAN names to trunk
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Only if `mode`==`access` and `portAuth`!=`dot1x`. Whether the port should retain dynamically learned MAC addresses
         */
        persistMac?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether PoE capabilities are disabled for a port
         */
        poeDisabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether Perpetual PoE is enabled; keeps PoE state across reboots
         */
        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. PoE priority for ports using this port usage
         */
        poePriority?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. 802.1X authentication mode for this port usage
         */
        portAuth?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Native network/vlan for untagged traffic
         */
        portNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`=`dot1x` reauthentication interval range between 10 and 65535 (default: 3600)
         */
        reauthInterval?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`==`dynamic`. Condition that resets a dynamic port to the default port usage
         */
        resetDefaultWhen?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`==`dynamic`. Dynamic matching rules that select the port usage to apply
         */
        rules?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchPortUsagesRule>[] | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Sets server fail fallback vlan
         */
        serverFailNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Interval, in seconds. Sets the wait time before retrying authentication after RADIUS failure to reduce client flapping. Range 120-65535
         */
        serverFailRetryInterval?: pulumi.Input<number | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. When RADIUS server reject / fails
         */
        serverRejectNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Link speed for this port usage
         */
        speed?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Storm-control settings for this port usage
         */
        stormControl?: pulumi.Input<inputs.org.DeviceprofileSwitchPortUsagesStormControl | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `stpRequired`==`false`. Drop bridge protocol data units (BPDUs ) that enter any interface or a specified interface
         */
        stpDisable?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. When enabled, the port is not expected to receive BPDU frames
         */
        stpEdge?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        stpNoRootPort?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        stpP2p?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether to remain in block state if no BPDU is received
         */
        stpRequired?: pulumi.Input<boolean | undefined>;
        /**
         * If this is connected to a vstp network
         */
        useVstp?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Network/vlan for voip traffic, must also set port_network. to authenticate device, set port_auth
         */
        voipNetwork?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchPortUsagesRule {
        /**
         * Optional description of the rule
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Exact value that the selected source attribute must match
         */
        equals?: pulumi.Input<string | undefined>;
        /**
         * List of values where any match satisfies this dynamic rule
         */
        equalsAnies?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * "[0:3]":"abcdef" > "abc"
         * "split(.)[1]": "a.b.c" > "b"
         * "split(-)[1][0:3]: "a1234-b5678-c90" > "b56"
         */
        expression?: pulumi.Input<string | undefined>;
        /**
         * Source attribute evaluated by this dynamic rule
         */
        src: pulumi.Input<string>;
        /**
         * Port usage name to apply when this dynamic rule matches
         */
        usage?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchPortUsagesStormControl {
        /**
         * Whether to disable the port when storm control is triggered
         */
        disablePort?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on broadcast traffic
         */
        noBroadcast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on multicast traffic
         */
        noMulticast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on registered multicast traffic
         */
        noRegisteredMulticast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on unknown unicast traffic
         */
        noUnknownUnicast?: pulumi.Input<boolean | undefined>;
        /**
         * Bandwidth-percentage, configures the storm control level as a percentage of the available bandwidth
         */
        percentage?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileSwitchRadiusConfig {
        /**
         * Whether immediate RADIUS accounting updates are sent
         */
        acctImmediateUpdate?: pulumi.Input<boolean | undefined>;
        /**
         * How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled
         */
        acctInterimInterval?: pulumi.Input<number | undefined>;
        /**
         * RADIUS accounting servers used by this switch configuration
         */
        acctServers?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchRadiusConfigAcctServer>[] | undefined>;
        /**
         * Selection strategy for RADIUS authentication servers
         */
        authServerSelection?: pulumi.Input<string | undefined>;
        /**
         * RADIUS authentication servers used by this switch configuration
         */
        authServers?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchRadiusConfigAuthServer>[] | undefined>;
        /**
         * RADIUS auth session retries
         */
        authServersRetries?: pulumi.Input<number | undefined>;
        /**
         * RADIUS auth session timeout
         */
        authServersTimeout?: pulumi.Input<number | undefined>;
        /**
         * Whether RADIUS Change of Authorization (CoA) is enabled
         */
        coaEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * UDP port used for RADIUS Change of Authorization (CoA)
         */
        coaPort?: pulumi.Input<string | undefined>;
        /**
         * Whether fast 802.1X timers are enabled for RADIUS authentication
         */
        fastDot1xTimers?: pulumi.Input<boolean | undefined>;
        /**
         * Use `network`or `sourceIp`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Use `network` or `sourceIp`. Explicit source IP address for RADIUS traffic
         */
        sourceIp?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchRadiusConfigAcctServer {
        /**
         * Address or hostname of the RADIUS accounting server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this accounting server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS accounting server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used with this RADIUS accounting server
         */
        secret: pulumi.Input<string>;
    }
    interface DeviceprofileSwitchRadiusConfigAuthServer {
        /**
         * Address or hostname of the RADIUS authentication server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this authentication server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS authentication server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Whether to require Message-Authenticator in requests
         */
        requireMessageAuthenticator?: pulumi.Input<boolean | undefined>;
        /**
         * Shared secret used with this RADIUS authentication server
         */
        secret: pulumi.Input<string>;
    }
    interface DeviceprofileSwitchRemoteSyslog {
        /**
         * Retention settings for generated syslog archive files
         */
        archive?: pulumi.Input<inputs.org.DeviceprofileSwitchRemoteSyslogArchive | undefined>;
        /**
         * CA certificates used to verify TLS syslog servers
         */
        cacerts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Log forwarding filters for console messages sent to remote syslog
         */
        console?: pulumi.Input<inputs.org.DeviceprofileSwitchRemoteSyslogConsole | undefined>;
        /**
         * Whether remote syslog forwarding is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Local syslog file definitions to generate and forward
         */
        files?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchRemoteSyslogFile>[] | undefined>;
        /**
         * Source network used for syslog traffic. If `sourceAddress` is configured, Mist uses the VLAN first; otherwise it uses `sourceIp`
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Whether each log entry is sent to all configured remote syslog servers
         */
        sendToAllServers?: pulumi.Input<boolean | undefined>;
        /**
         * Remote syslog server destinations
         */
        servers?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchRemoteSyslogServer>[] | undefined>;
        /**
         * Timestamp format used in forwarded syslog messages
         */
        timeFormat?: pulumi.Input<string | undefined>;
        /**
         * User-specific syslog logging rules
         */
        users?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchRemoteSyslogUser>[] | undefined>;
    }
    interface DeviceprofileSwitchRemoteSyslogArchive {
        /**
         * Number of archived syslog files to retain
         */
        files?: pulumi.Input<string | undefined>;
        /**
         * Maximum size of each archived syslog file, such as 5m
         */
        size?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchRemoteSyslogConsole {
        /**
         * Syslog facilities and severities forwarded from console logs
         */
        contents?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchRemoteSyslogConsoleContent>[] | undefined>;
    }
    interface DeviceprofileSwitchRemoteSyslogConsoleContent {
        /**
         * Syslog facility to match for this selector
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Syslog severity to match for this selector
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchRemoteSyslogFile {
        /**
         * Retention settings for this generated syslog file
         */
        archive?: pulumi.Input<inputs.org.DeviceprofileSwitchRemoteSyslogFileArchive | undefined>;
        /**
         * Syslog facilities and severities written to this file
         */
        contents?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchRemoteSyslogFileContent>[] | undefined>;
        /**
         * Only if `protocol`==`tcp`, enable TLS for this syslog file destination
         */
        enableTls?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to include explicit syslog priority values in file output
         */
        explicitPriority?: pulumi.Input<boolean | undefined>;
        /**
         * Generated syslog file name
         */
        file?: pulumi.Input<string | undefined>;
        /**
         * Expression used to filter log messages written to this file
         */
        match?: pulumi.Input<string | undefined>;
        /**
         * Whether to include structured syslog data in file output
         */
        structuredData?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileSwitchRemoteSyslogFileArchive {
        /**
         * Number of archived syslog files to retain
         */
        files?: pulumi.Input<string | undefined>;
        /**
         * Maximum size of each archived syslog file, such as 5m
         */
        size?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchRemoteSyslogFileContent {
        /**
         * Syslog facility to match for this selector
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Syslog severity to match for this selector
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchRemoteSyslogServer {
        /**
         * Syslog facilities and severities sent to this server
         */
        contents?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchRemoteSyslogServerContent>[] | undefined>;
        /**
         * Whether to include explicit syslog priority values in messages sent to this server
         */
        explicitPriority?: pulumi.Input<boolean | undefined>;
        /**
         * Default syslog facility for messages sent to this server
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Address or hostname of the remote syslog server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * Expression used to filter log messages sent to this server
         */
        match?: pulumi.Input<string | undefined>;
        /**
         * Network port used by the remote syslog server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Transport protocol used for this remote syslog server
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Routing instance used to reach this remote syslog server
         */
        routingInstance?: pulumi.Input<string | undefined>;
        /**
         * TLS server name used when verifying the remote syslog server certificate
         */
        serverName?: pulumi.Input<string | undefined>;
        /**
         * Default syslog severity for messages sent to this server
         */
        severity?: pulumi.Input<string | undefined>;
        /**
         * Source address for syslog traffic. If configured, Mist uses the VLAN first; otherwise it uses `sourceIp`
         */
        sourceAddress?: pulumi.Input<string | undefined>;
        /**
         * Whether to include structured syslog data in messages sent to this server
         */
        structuredData?: pulumi.Input<boolean | undefined>;
        /**
         * Syslog tag value added to messages sent to this server
         */
        tag?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchRemoteSyslogServerContent {
        /**
         * Syslog facility to match for this selector
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Syslog severity to match for this selector
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchRemoteSyslogUser {
        /**
         * Syslog facilities and severities logged for this user rule
         */
        contents?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchRemoteSyslogUserContent>[] | undefined>;
        /**
         * Expression used to filter user log messages
         */
        match?: pulumi.Input<string | undefined>;
        /**
         * Account name or wildcard matched by this syslog rule
         */
        user?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchRemoteSyslogUserContent {
        /**
         * Syslog facility to match for this selector
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Syslog severity to match for this selector
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchRoutingPolicies {
        /**
         * Ordered terms evaluated by this switch routing policy
         */
        terms?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchRoutingPoliciesTerm>[] | undefined>;
    }
    interface DeviceprofileSwitchRoutingPoliciesTerm {
        /**
         * Route match criteria that must be satisfied before actions are applied
         */
        matching?: pulumi.Input<inputs.org.DeviceprofileSwitchRoutingPoliciesTermMatching | undefined>;
        /**
         * Display name of the switch routing policy term
         */
        name: pulumi.Input<string>;
        /**
         * Policy actions applied when this routing policy term matches
         */
        routingPolicyTermActions?: pulumi.Input<inputs.org.DeviceprofileSwitchRoutingPoliciesTermRoutingPolicyTermActions | undefined>;
    }
    interface DeviceprofileSwitchRoutingPoliciesTermMatching {
        /**
         * BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}`)
         */
        asPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities that routes must match
         */
        communities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Route prefixes that routes must match
         */
        prefixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * enum: `bgp`, `direct`, `evpn`, `ospf`, `static`
         */
        protocols?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileSwitchRoutingPoliciesTermRoutingPolicyTermActions {
        /**
         * Whether to accept routes that match this term
         */
        accept?: pulumi.Input<boolean | undefined>;
        /**
         * BGP communities to set when this term is used as an export policy
         */
        communities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Optional, for an import policy, localPreference can be changed, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}`)
         */
        localPreference?: pulumi.Input<string | undefined>;
        /**
         * AS path values to prepend when this term is used as an export policy
         */
        prependAsPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfig {
        /**
         * SNMP client allowlists that can be referenced by communities
         */
        clientLists?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigClientList>[] | undefined>;
        /**
         * Administrative contact string advertised through SNMP
         */
        contact?: pulumi.Input<string | undefined>;
        /**
         * Device description string advertised through SNMP
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Whether SNMP is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * SNMP engine ID used for SNMPv3
         */
        engineId?: pulumi.Input<string | undefined>;
        /**
         * Method used to derive the SNMP engine ID
         */
        engineIdType?: pulumi.Input<string | undefined>;
        /**
         * Physical location string advertised through SNMP
         */
        location?: pulumi.Input<string | undefined>;
        /**
         * System name advertised through SNMP
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Management network used for SNMP traffic
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * SNMP trap group definitions
         */
        trapGroups?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigTrapGroup>[] | undefined>;
        /**
         * SNMPv2c community configuration entries for this SNMP profile
         */
        v2cConfigs?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigV2cConfig>[] | undefined>;
        /**
         * SNMPv3 user, VACM, notify, and target configuration
         */
        v3Config?: pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigV3Config | undefined>;
        /**
         * SNMP MIB view definitions
         */
        views?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigView>[] | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigClientList {
        /**
         * Name of the SNMP client list
         */
        clientListName?: pulumi.Input<string | undefined>;
        /**
         * SNMP client IP addresses or CIDR ranges allowed by this list
         */
        clients?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigTrapGroup {
        /**
         * Trap categories included in this SNMP trap group
         */
        categories?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Trap group name for this SNMP trap group
         */
        groupName?: pulumi.Input<string | undefined>;
        /**
         * Trap target addresses for this SNMP trap group
         */
        targets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * SNMP trap protocol version used by this group
         */
        version?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigV2cConfig {
        /**
         * Access level for the SNMPv2c community
         */
        authorization?: pulumi.Input<string | undefined>;
        /**
         * SNMP client list name referenced by this community
         */
        clientListName?: pulumi.Input<string | undefined>;
        /**
         * SNMPv2c community string name
         */
        communityName?: pulumi.Input<string | undefined>;
        /**
         * SNMP view name that must be defined in the views list
         */
        view?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigV3Config {
        /**
         * SNMPv3 notification definitions used for traps and informs
         */
        notifies?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigV3ConfigNotify>[] | undefined>;
        /**
         * SNMPv3 notification filter profiles
         */
        notifyFilters?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigV3ConfigNotifyFilter>[] | undefined>;
        /**
         * SNMPv3 notification target addresses
         */
        targetAddresses?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigV3ConfigTargetAddress>[] | undefined>;
        /**
         * SNMPv3 target parameter profiles
         */
        targetParameters?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigV3ConfigTargetParameter>[] | undefined>;
        /**
         * SNMPv3 USM engine configurations
         */
        usms?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigV3ConfigUsm>[] | undefined>;
        /**
         * SNMPv3 VACM access control configuration
         */
        vacm?: pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigV3ConfigVacm | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigV3ConfigNotify {
        /**
         * Identifier for this SNMPv3 notification definition
         */
        name: pulumi.Input<string>;
        /**
         * Notification tag used to select target addresses
         */
        tag: pulumi.Input<string>;
        /**
         * Delivery mode for this SNMPv3 notification, such as trap or inform
         */
        type: pulumi.Input<string>;
    }
    interface DeviceprofileSwitchSnmpConfigV3ConfigNotifyFilter {
        /**
         * OID filter rules in this notification filter profile
         */
        contents?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigV3ConfigNotifyFilterContent>[] | undefined>;
        /**
         * Notification filter profile name
         */
        profileName?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigV3ConfigNotifyFilterContent {
        /**
         * Whether the matching OID subtree is included
         */
        include?: pulumi.Input<boolean | undefined>;
        /**
         * Matched OID subtree for this notification filter rule
         */
        oid: pulumi.Input<string>;
    }
    interface DeviceprofileSwitchSnmpConfigV3ConfigTargetAddress {
        /**
         * IP address or hostname of the SNMP target
         */
        address: pulumi.Input<string>;
        /**
         * Mask applied to the SNMP target address
         */
        addressMask: pulumi.Input<string>;
        /**
         * UDP port used by the SNMP target
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Set of notification tags for this target address; use spaces between multiple tags
         */
        tagList?: pulumi.Input<string | undefined>;
        /**
         * Name of the SNMP target address entry
         */
        targetAddressName: pulumi.Input<string>;
        /**
         * Target parameter profile referenced by this target address
         */
        targetParameters?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigV3ConfigTargetParameter {
        /**
         * SNMP message processing model used by this target parameter profile
         */
        messageProcessingModel: pulumi.Input<string>;
        /**
         * Target parameter profile name
         */
        name: pulumi.Input<string>;
        /**
         * Notification filter profile referenced by this target parameter profile
         */
        notifyFilter?: pulumi.Input<string | undefined>;
        /**
         * Required security level for this target parameter profile
         */
        securityLevel?: pulumi.Input<string | undefined>;
        /**
         * Required security model for this target parameter profile
         */
        securityModel?: pulumi.Input<string | undefined>;
        /**
         * USM security name referenced by this target parameter profile
         */
        securityName?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigV3ConfigUsm {
        /**
         * SNMP engine type used for this USM configuration
         */
        engineType: pulumi.Input<string>;
        /**
         * Required only if `engineType`==`remoteEngine`
         */
        remoteEngineId?: pulumi.Input<string | undefined>;
        /**
         * SNMPv3 USM users for this engine
         */
        users?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigV3ConfigUsmUser>[] | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigV3ConfigUsmUser {
        /**
         * Not required if `authenticationType`==`authentication-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters.
         */
        authenticationPassword?: pulumi.Input<string | undefined>;
        /**
         * Authentication protocol used by this SNMPv3 USM user
         */
        authenticationType?: pulumi.Input<string | undefined>;
        /**
         * Not required if `encryptionType`==`privacy-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters
         */
        encryptionPassword?: pulumi.Input<string | undefined>;
        /**
         * Privacy protocol used by this SNMPv3 USM user
         */
        encryptionType?: pulumi.Input<string | undefined>;
        /**
         * Username for the SNMPv3 USM user
         */
        name?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigV3ConfigVacm {
        /**
         * VACM access rules for SNMPv3
         */
        accesses?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigV3ConfigVacmAccess>[] | undefined>;
        /**
         * VACM security-name to group mappings
         */
        securityToGroup?: pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigV3ConfigVacmSecurityToGroup | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigV3ConfigVacmAccess {
        /**
         * SNMP VACM group name
         */
        groupName?: pulumi.Input<string | undefined>;
        /**
         * Context prefix rules for this VACM group
         */
        prefixLists?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigV3ConfigVacmAccessPrefixList>[] | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigV3ConfigVacmAccessPrefixList {
        /**
         * Context prefix for this VACM access rule. Required only if `type`==`contextPrefix`
         */
        contextPrefix?: pulumi.Input<string | undefined>;
        /**
         * Notify view name referenced by this VACM access rule
         */
        notifyView?: pulumi.Input<string | undefined>;
        /**
         * Read view name referenced by this VACM access rule
         */
        readView?: pulumi.Input<string | undefined>;
        /**
         * Required security level for this VACM access rule
         */
        securityLevel?: pulumi.Input<string | undefined>;
        /**
         * Required security model for this VACM access rule
         */
        securityModel?: pulumi.Input<string | undefined>;
        /**
         * VACM context matching type for this access rule
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Write view name referenced by this VACM access rule
         */
        writeView?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigV3ConfigVacmSecurityToGroup {
        /**
         * VACM security-name to group mapping entries
         */
        contents?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSnmpConfigV3ConfigVacmSecurityToGroupContent>[] | undefined>;
        /**
         * Required security model for these VACM group mappings
         */
        securityModel?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigV3ConfigVacmSecurityToGroupContent {
        /**
         * VACM group name referenced by this mapping
         */
        group?: pulumi.Input<string | undefined>;
        /**
         * Name of the SNMP security principal mapped to a VACM group
         */
        securityName?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchSnmpConfigView {
        /**
         * Whether the root OID is included in this SNMP view
         */
        include?: pulumi.Input<boolean | undefined>;
        /**
         * Root OID for this SNMP view
         */
        oid?: pulumi.Input<string | undefined>;
        /**
         * Name of the SNMP MIB view definition
         */
        viewName?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchStpConfig {
        /**
         * Switch STP priority. Range [0, 4k, 8k.. 60k] in steps of 4k. Bridge priority applies to both VSTP and RSTP.
         */
        bridgePriority?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchSwitchMgmt {
        /**
         * AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used.
         */
        apAffinityThreshold?: pulumi.Input<number | undefined>;
        /**
         * Set Banners for switches. Allows markup formatting
         */
        cliBanner?: pulumi.Input<string | undefined>;
        /**
         * Sets timeout for switches
         */
        cliIdleTimeout?: pulumi.Input<number | undefined>;
        /**
         * Rollback timer for commit confirmed
         */
        configRevertTimer?: pulumi.Input<number | undefined>;
        /**
         * Enable to provide the FQDN with DHCP option 81
         */
        dhcpOptionFqdn?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to suppress alarms when the switch out-of-band management interface is down
         */
        disableOobDownAlarm?: pulumi.Input<boolean | undefined>;
        /**
         * Whether FIPS mode is enabled on the switch
         */
        fipsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Local switch user accounts keyed by username
         */
        localAccounts?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileSwitchSwitchMgmtLocalAccounts>;
        } | undefined>;
        /**
         * IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud
         */
        mxedgeProxyHost?: pulumi.Input<string | undefined>;
        /**
         * Mist Edge port used to proxy the switch management traffic to the Mist Cloud. Value in range 1-65535
         */
        mxedgeProxyPort?: pulumi.Input<string | undefined>;
        /**
         * Control-plane protection settings for the switch
         */
        protectRe?: pulumi.Input<inputs.org.DeviceprofileSwitchSwitchMgmtProtectRe | undefined>;
        /**
         * By default, only the configuration generated by Mist is cleaned up during the configuration process. If `true`, all the existing configuration will be removed.
         */
        removeExistingConfigs?: pulumi.Input<boolean | undefined>;
        /**
         * Root password for local switch access
         */
        rootPassword?: pulumi.Input<string | undefined>;
        /**
         * Management authentication settings using TACACS+
         */
        tacacs?: pulumi.Input<inputs.org.DeviceprofileSwitchSwitchMgmtTacacs | undefined>;
        /**
         * Whether to use Mist Edge as a proxy for switch management traffic
         */
        useMxedgeProxy?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileSwitchSwitchMgmtLocalAccounts {
        /**
         * Local password for the switch user account
         */
        password?: pulumi.Input<string | undefined>;
        /**
         * Access role granted to the local switch user account
         */
        role?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchSwitchMgmtProtectRe {
        /**
         * optionally, services we'll allow. enum: `icmp`, `ssh`
         */
        allowedServices?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Additional ACL entries allowed by the Protect RE policy
         */
        customs?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSwitchMgmtProtectReCustom>[] | undefined>;
        /**
         * When enabled, all traffic that is not essential to our operation will be dropped
         * e.g. ntp / dns / traffic to mist will be allowed by default
         *      if dhcpd is enabled, we'll make sure it works
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to enable hit count for Protect_RE policy
         */
        hitCount?: pulumi.Input<boolean | undefined>;
        /**
         * Trusted host or subnet entries allowed by the Protect RE policy
         */
        trustedHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileSwitchSwitchMgmtProtectReCustom {
        /**
         * matched dst port, "0" means any. Note: For `protocol`==`any` and  `portRange`==`any`, configure `trustedHosts` instead
         */
        portRange?: pulumi.Input<string | undefined>;
        /**
         * enum: `any`, `icmp`, `tcp`, `udp`. Note: For `protocol`==`any` and  `portRange`==`any`, configure `trustedHosts` instead
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Source subnets matched by this custom Protect RE ACL
         */
        subnets: pulumi.Input<pulumi.Input<string>[]>;
    }
    interface DeviceprofileSwitchSwitchMgmtTacacs {
        /**
         * TACACS+ accounting servers used for switch management sessions
         */
        acctServers?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSwitchMgmtTacacsAcctServer>[] | undefined>;
        /**
         * Default switch-management role to use for TACACS+ logins
         */
        defaultRole?: pulumi.Input<string | undefined>;
        /**
         * Whether TACACS+ is enabled for switch management authentication
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Source network used for connectivity to the TACACS+ servers
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * TACACS+ authentication servers used for switch management logins
         */
        tacplusServers?: pulumi.Input<pulumi.Input<inputs.org.DeviceprofileSwitchSwitchMgmtTacacsTacplusServer>[] | undefined>;
    }
    interface DeviceprofileSwitchSwitchMgmtTacacsAcctServer {
        /**
         * Address or hostname of the TACACS+ accounting server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * TCP port used by the TACACS+ accounting server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used with this TACACS+ accounting server
         */
        secret?: pulumi.Input<string | undefined>;
        /**
         * TACACS+ accounting server timeout, in seconds
         */
        timeout?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileSwitchSwitchMgmtTacacsTacplusServer {
        /**
         * Address or hostname of the TACACS+ authentication server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * TCP port used by the TACACS+ authentication server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used with this TACACS+ authentication server
         */
        secret?: pulumi.Input<string | undefined>;
        /**
         * TACACS+ authentication server timeout, in seconds
         */
        timeout?: pulumi.Input<number | undefined>;
    }
    interface DeviceprofileSwitchVrfConfig {
        /**
         * Whether to enable VRF (when supported on the device)
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface DeviceprofileSwitchVrfInstances {
        /**
         * IPv4 subnet used for automatic EVPN loopback addresses in this VRF instance
         */
        evpnAutoLoopbackSubnet?: pulumi.Input<string | undefined>;
        /**
         * IPv6 subnet used for automatic EVPN loopback addresses in this VRF instance
         */
        evpnAutoLoopbackSubnet6?: pulumi.Input<string | undefined>;
        /**
         * Additional IPv4 static routes configured for this VRF instance
         */
        extraRoutes?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileSwitchVrfInstancesExtraRoutes>;
        } | undefined>;
        /**
         * Additional IPv6 static routes configured for this VRF instance
         */
        extraRoutes6?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileSwitchVrfInstancesExtraRoutes6>;
        } | undefined>;
        /**
         * Names of switch networks included in this VRF instance
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface DeviceprofileSwitchVrfInstancesExtraRoutes {
        /**
         * IPv4 next-hop address for this VRF extra route
         */
        via: pulumi.Input<string>;
    }
    interface DeviceprofileSwitchVrfInstancesExtraRoutes6 {
        /**
         * IPv6 next-hop address for this VRF extra route
         */
        via?: pulumi.Input<string | undefined>;
    }
    interface DeviceprofileSwitchVrrpConfig {
        /**
         * Whether VRRP configuration is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * VRRP groups keyed by group name
         */
        groups?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.DeviceprofileSwitchVrrpConfigGroups>;
        } | undefined>;
    }
    interface DeviceprofileSwitchVrrpConfigGroups {
        /**
         * If `true`, allow preemption (a backup router can preempt a primary router)
         */
        preempt?: pulumi.Input<boolean | undefined>;
        /**
         * VRRP priority for this router in the group
         */
        priority?: pulumi.Input<number | undefined>;
    }
    interface EvpnTopologyEvpnOptions {
        /**
         * Optional, for dhcp_relay, unique loopback IPs are required for ERB or IPClos where we can set option-82 server_id-overrides
         */
        autoLoopbackSubnet?: pulumi.Input<string | undefined>;
        /**
         * Optional, for dhcp_relay, unique loopback IPs are required for ERB or IPClos where we can set option-82 server_id-overrides
         */
        autoLoopbackSubnet6?: pulumi.Input<string | undefined>;
        /**
         * Optional, this generates routerId automatically, if specified, `routerIdPrefix` is ignored
         */
        autoRouterIdSubnet?: pulumi.Input<string | undefined>;
        /**
         * Optional, this generates routerId automatically, if specified, `routerIdPrefix` is ignored
         */
        autoRouterIdSubnet6?: pulumi.Input<string | undefined>;
        /**
         * Optional, for ERB or CLOS, you can either use esilag to upstream routers or to also be the virtual-gateway. When `routedAt` != `core`, whether to do virtual-gateway at core as well
         */
        coreAsBorder?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to route management traffic inband; routes will be propagated to downstream switches
         */
        enableInbandMgmt?: pulumi.Input<boolean | undefined>;
        /**
         * if the mangement traffic goes inbnd, during installation, only the border/core switches are connected to the Internet to allow initial configuration to be pushed down and leave the downstream access switches stay in the Factory Default state enabling inband-ztp allows upstream switches to use LLDP to assign IP and gives Internet to downstream switches in that state
         */
        enableInbandZtp?: pulumi.Input<boolean | undefined>;
        /**
         * EVPN overlay BGP settings for the topology
         */
        overlay?: pulumi.Input<inputs.org.EvpnTopologyEvpnOptionsOverlay | undefined>;
        /**
         * Only for by Core-Distribution architecture when `evpn_options.routed_at`==`core`. By default, JUNOS uses 00-00-5e-00-01-01 as the virtual-gateway-address's v4_mac. If enabled, 00-00-5e-00-0X-YY will be used (where XX=vlan_id/256, YY=vlan_id%256)
         */
        perVlanVgaV4Mac?: pulumi.Input<boolean | undefined>;
        /**
         * Only for by Core-Distribution architecture when `evpn_options.routed_at`==`core`. By default, JUNOS uses 00-00-5e-00-02-01 as the virtual-gateway-address's v6_mac. If enabled, 00-00-5e-00-1X-YY will be used (where XX=vlan_id/256, YY=vlan_id%256)
         */
        perVlanVgaV6Mac?: pulumi.Input<boolean | undefined>;
        /**
         * Topology tier where EVPN virtual gateway routing is placed
         */
        routedAt?: pulumi.Input<string | undefined>;
        /**
         * EVPN underlay BGP and subnet settings for the topology
         */
        underlay?: pulumi.Input<inputs.org.EvpnTopologyEvpnOptionsUnderlay | undefined>;
        /**
         * Virtual-switch instance mappings used to segregate EVPN networks
         */
        vsInstances?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.EvpnTopologyEvpnOptionsVsInstances>;
        } | undefined>;
    }
    interface EvpnTopologyEvpnOptionsOverlay {
        /**
         * Overlay BGP Local AS Number
         */
        as?: pulumi.Input<number | undefined>;
    }
    interface EvpnTopologyEvpnOptionsUnderlay {
        /**
         * Underlay BGP Base AS Number
         */
        asBase?: pulumi.Input<number | undefined>;
        /**
         * Prefix length used for automatically derived underlay router identifiers
         */
        routedIdPrefix?: pulumi.Input<string | undefined>;
        /**
         * Underlay subnet, by default, `10.255.240.0/20`, or `fd31:5700::/64` for ipv6
         */
        subnet?: pulumi.Input<string | undefined>;
        /**
         * If v6 is desired for underlay
         */
        useIpv6?: pulumi.Input<boolean | undefined>;
    }
    interface EvpnTopologyEvpnOptionsVsInstances {
        /**
         * List of network names included in this virtual-switch instance
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface EvpnTopologySwitches {
        /**
         * Associated device profile identifier for the switch. Use the Assign Org Device Profile endpoint to assign a Device Profile to the switch.
         */
        deviceprofileId?: pulumi.Input<string | undefined>;
        /**
         * IP addresses used by this switch for EVPN downlinks
         */
        downlinkIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Switch MAC addresses connected as downlinks from this topology member
         */
        downlinks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Switch MAC addresses connected through ESI-LAG from this topology member
         */
        esilaglinks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Topology identifier number for this EVPN switch member
         */
        evpnId?: pulumi.Input<number | undefined>;
        /**
         * Switch MAC address used to identify the topology member
         */
        mac?: pulumi.Input<string | undefined>;
        /**
         * Switch model for this topology member
         */
        model?: pulumi.Input<string | undefined>;
        /**
         * Optionally, for distribution / access / esilag-access, they can be placed into different pods. e.g.
         *   * for CLOS, to group dist / access switches into pods
         *   * for ERB/CRB, to group dist / esilag-access into pods
         */
        pod?: pulumi.Input<number | undefined>;
        /**
         * List of pod numbers this switch participates in
         */
        pods?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * EVPN topology role for this switch
         */
        role: pulumi.Input<string>;
        /**
         * Routing identifier used by this switch for EVPN routing
         */
        routerId?: pulumi.Input<string | undefined>;
        /**
         * Associated site for this EVPN topology switch
         */
        siteId?: pulumi.Input<string | undefined>;
        /**
         * Builder-suggested downlink switch MAC addresses
         */
        suggestedDownlinks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Builder-suggested ESI-LAG switch MAC addresses
         */
        suggestedEsilaglinks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Builder-suggested uplink switch MAC addresses
         */
        suggestedUplinks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Switch MAC addresses connected as uplinks from this topology member
         */
        uplinks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewaytemplateBgpConfig {
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`
         */
        authKey?: pulumi.Input<string | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`, when bfdMultiplier is configured alone. Default:
         *   * 1000 if `type`==`external`
         *   * 350 `type`==`internal`
         */
        bfdMinimumInterval?: pulumi.Input<number | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`, when bfdMinimumIntervalIsConfigured alone
         */
        bfdMultiplier?: pulumi.Input<number | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. BFD provides faster path failure detection and is enabled by default
         */
        disableBfd?: pulumi.Input<boolean | undefined>;
        /**
         * Routing policy applied to routes exported by this BGP session
         */
        export?: pulumi.Input<string | undefined>;
        /**
         * Default export policies if no per-neighbor policies defined
         */
        exportPolicy?: pulumi.Input<string | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. By default, either inet/net6 unicast depending on neighbor IP family (v4 or v6). For v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this
         */
        extendedV4Nexthop?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. `0` means disable
         */
        gracefulRestartTime?: pulumi.Input<number | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. Default is 90.
         */
        holdTime?: pulumi.Input<number | undefined>;
        /**
         * Routing policy applied to routes imported by this BGP session
         */
        import?: pulumi.Input<string | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. Default import policies if no per-neighbor policies defined
         */
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. BGPLocal AS. Value must be in range 1-4294967295 or a variable (e.g. `{{as_variable}}`)
         */
        localAs?: pulumi.Input<string | undefined>;
        /**
         * Neighbor AS. If `type`==`internal`, must be equal to `localAs`. Value must be in range 1-4294967295 or a variable (e.g. `{{as_variable}}`)
         */
        neighborAs?: pulumi.Input<string | undefined>;
        /**
         * Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. If per-neighbor as is desired. Property key is the neighbor address
         */
        neighbors?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplateBgpConfigNeighbors>;
        } | undefined>;
        /**
         * Optional if `via`==`lan`; networks where BGP neighbors can connect to or from
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. If true, we will not advertise private ASNs (AS 64512-65534) to this neighbor
         */
        noPrivateAs?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. By default, we'll re-advertise all learned BGP routers toward overlay
         */
        noReadvertiseToOverlay?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `via`==`tunnel`; tunnel name used for this BGP session
         */
        tunnelName?: pulumi.Input<string | undefined>;
        /**
         * Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; BGP session type, internal or external
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Transport used for this BGP session, such as LAN, tunnel, VPN, or WAN
         */
        via: pulumi.Input<string>;
        /**
         * Optional if `via`==`vpn`; VPN name used for this BGP session
         */
        vpnName?: pulumi.Input<string | undefined>;
        /**
         * Optional if `via`==`wan`; WAN interface name used for this BGP session
         */
        wanName?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateBgpConfigNeighbors {
        /**
         * If true, the BGP session to this neighbor will be administratively disabled/shutdown
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Export policy applied only to this BGP neighbor
         */
        exportPolicy?: pulumi.Input<string | undefined>;
        /**
         * BGP hold time for this neighbor, in seconds
         */
        holdTime?: pulumi.Input<number | undefined>;
        /**
         * Import policy applied only to this BGP neighbor
         */
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * Assuming BGP neighbor is directly connected
         */
        multihopTtl?: pulumi.Input<number | undefined>;
        /**
         * Neighbor AS. Value must be in range 1-4294967295 or a variable (e.g. `{{as_variable}}`)
         */
        neighborAs: pulumi.Input<string>;
        /**
         * If `via`==`tunnel`, primary or secondary tunnel associated with this BGP neighbor
         */
        tunnelVia?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateDhcpdConfig {
        /**
         * Property key is the network name
         */
        config?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplateDhcpdConfigConfig>;
        } | undefined>;
        /**
         * If set to `false`, disable the DHCP server
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewaytemplateDhcpdConfigConfig {
        /**
         * If `type`==`local` or `type6`==`local`, DNS servers advertised to DHCP clients
         */
        dnsServers?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type`==`local` or `type6`==`local`, DNS search suffixes advertised to DHCP clients
         *
         * @deprecated Configuring `dnsSuffix` is deprecated and will not be supported in the future, please configure Code 15 or Code 119 in Server `options` instead
         */
        dnsSuffixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type`==`local` or `type6`==`local`, fixed client bindings for local DHCP service
         */
        fixedBindings?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplateDhcpdConfigConfigFixedBindings>;
        } | undefined>;
        /**
         * If `type`==`local` - optional, `ip` will be used if not provided
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * If `type6`==`local`, ending IPv6 address for the DHCP lease pool
         */
        ip6End?: pulumi.Input<string | undefined>;
        /**
         * If `type6`==`local`, starting IPv6 address for the DHCP lease pool
         */
        ip6Start?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`local`, ending IPv4 address for the DHCP lease pool
         */
        ipEnd?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`local`, starting IPv4 address for the DHCP lease pool
         */
        ipStart?: pulumi.Input<string | undefined>;
        /**
         * In seconds, lease time has to be between 3600 [1hr] - 604800 [1 week], default is 86400 [1 day]
         */
        leaseTime?: pulumi.Input<number | undefined>;
        /**
         * If `type`==`local` or `type6`==`local`, custom DHCP options advertised to clients
         */
        options?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplateDhcpdConfigConfigOptions>;
        } | undefined>;
        /**
         * `serverIdOverride`==`true` means the device, when acts as DHCP relay and forwards DHCP responses from DHCP server to clients,
         * should overwrite the Sever Identifier option (i.e. DHCP option 54) in DHCP responses with its own IP address.
         */
        serverIdOverride?: pulumi.Input<boolean | undefined>;
        /**
         * If `type`==`relay`, upstream IPv4 DHCP servers
         */
        servers?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type6`==`relay`, upstream IPv6 DHCP servers
         */
        serversv6s?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IPv4 DHCP mode for this network
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 DHCP mode for this network
         */
        type6?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`local` or `type6`==`local`, vendor-encapsulated DHCP options advertised to clients
         */
        vendorEncapsulated?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplateDhcpdConfigConfigVendorEncapsulated>;
        } | undefined>;
    }
    interface GatewaytemplateDhcpdConfigConfigFixedBindings {
        /**
         * Reserved IPv4 address for this fixed DHCP binding
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Reserved IPv6 address for this fixed DHCP binding
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * Friendly name for this fixed DHCP binding
         */
        name?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateDhcpdConfigConfigOptions {
        /**
         * Data type used to encode this DHCP option value
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Option value to send for this DHCP option
         */
        value?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateDhcpdConfigConfigVendorEncapsulated {
        /**
         * Data type used to encode this vendor option value
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Option value to send for this vendor option
         */
        value?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateExtraRoutes {
        /**
         * Next-hop IPv4 address for the gateway extra route
         */
        via: pulumi.Input<string>;
    }
    interface GatewaytemplateExtraRoutes6 {
        /**
         * Next-hop IPv6 address for the gateway extra route
         */
        via: pulumi.Input<string>;
    }
    interface GatewaytemplateGatewayMgmt {
        /**
         * SSR-only SSH public keys for administrative access
         */
        adminSshkeys?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Application probing configuration for gateway monitoring
         */
        appProbing?: pulumi.Input<inputs.org.GatewaytemplateGatewayMgmtAppProbing | undefined>;
        /**
         * Consumes uplink bandwidth, requires WA license
         */
        appUsage?: pulumi.Input<boolean | undefined>;
        /**
         * Schedule for automatic security signature updates
         */
        autoSignatureUpdate?: pulumi.Input<inputs.org.GatewaytemplateGatewayMgmtAutoSignatureUpdate | undefined>;
        /**
         * Rollback timer for commit confirmed
         */
        configRevertTimer?: pulumi.Input<number | undefined>;
        /**
         * For SSR and SRX, disable console port
         */
        disableConsole?: pulumi.Input<boolean | undefined>;
        /**
         * For SSR and SRX, disable management interface
         */
        disableOob?: pulumi.Input<boolean | undefined>;
        /**
         * For SSR and SRX, disable usb interface
         */
        disableUsb?: pulumi.Input<boolean | undefined>;
        /**
         * Whether FIPS mode is enabled on the gateway
         */
        fipsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * IPv4 probe targets used for gateway connectivity checks
         */
        probeHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IPv6 probe targets used for gateway connectivity checks
         */
        probeHostsv6s?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Control-plane protection settings for the gateway
         */
        protectRe?: pulumi.Input<inputs.org.GatewaytemplateGatewayMgmtProtectRe | undefined>;
        /**
         * SRX only. Root password for local gateway access
         */
        rootPassword?: pulumi.Input<string | undefined>;
        /**
         * IPv4 source address used for gateway security log traffic
         */
        securityLogSourceAddress?: pulumi.Input<string | undefined>;
        /**
         * Source interface used for gateway security log traffic
         */
        securityLogSourceInterface?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateGatewayMgmtAppProbing {
        /**
         * Predefined application keys to probe
         */
        apps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * User-defined application probe definitions
         */
        customApps?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplateGatewayMgmtAppProbingCustomApp>[] | undefined>;
        /**
         * Whether gateway application probing is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewaytemplateGatewayMgmtAppProbingCustomApp {
        /**
         * Required if `protocol`==`icmp`. IP address probed by the ICMP custom app
         */
        address?: pulumi.Input<string | undefined>;
        /**
         * Category label used for this custom application probe
         */
        appType?: pulumi.Input<string | undefined>;
        /**
         * If `protocol`==`http`. Hostnames or URLs probed by this custom app
         */
        hostnames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Stable key used to identify this custom application probe
         */
        key?: pulumi.Input<string | undefined>;
        /**
         * Display name for this custom application probe
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Gateway network used as the source context for this probe
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * If `protocol`==`icmp`. ICMP packet size used by this custom app probe
         */
        packetSize?: pulumi.Input<number | undefined>;
        /**
         * Probe protocol used by this custom application definition
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * If `protocol`==`http`. HTTP URL or hostname probed by this custom app
         */
        url?: pulumi.Input<string | undefined>;
        /**
         * Gateway VRF used as the source context for this probe
         */
        vrf?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateGatewayMgmtAutoSignatureUpdate {
        /**
         * Scheduled weekday for automatic signature updates
         */
        dayOfWeek?: pulumi.Input<string | undefined>;
        /**
         * Whether automatic security signature updates are enabled
         */
        enable?: pulumi.Input<boolean | undefined>;
        /**
         * Optional, Mist will decide the timing
         */
        timeOfDay?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateGatewayMgmtProtectRe {
        /**
         * Built-in services explicitly allowed by the Protect RE policy
         */
        allowedServices?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Additional ACL entries allowed by the Protect RE policy
         */
        customs?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplateGatewayMgmtProtectReCustom>[] | undefined>;
        /**
         * When enabled, all traffic that is not essential to our operation will be dropped
         * e.g. ntp / dns / traffic to mist will be allowed by default
         *      if dhcpd is enabled, we'll make sure it works
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to enable hit count for Protect_RE policy
         */
        hitCount?: pulumi.Input<boolean | undefined>;
        /**
         * Trusted host or subnet entries allowed by the Protect RE policy
         */
        trustedHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewaytemplateGatewayMgmtProtectReCustom {
        /**
         * Matched dst port, "0" means any
         */
        portRange?: pulumi.Input<string | undefined>;
        /**
         * Transport protocol matched by this custom Protect RE ACL
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Source subnets matched by this custom Protect RE ACL
         */
        subnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewaytemplateIdpProfiles {
        /**
         * Built-in IDP baseline profile inherited before applying overwrites
         */
        baseProfile?: pulumi.Input<string | undefined>;
        /**
         * Display name of the IDP profile
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Owning organization for the IDP profile
         */
        orgId?: pulumi.Input<string | undefined>;
        /**
         * IDP signature override rules applied on top of the base profile
         */
        overwrites?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplateIdpProfilesOverwrite>[] | undefined>;
    }
    interface GatewaytemplateIdpProfilesOverwrite {
        /**
         * Enforcement action applied when this overwrite rule matches
         */
        action?: pulumi.Input<string | undefined>;
        /**
         * Criteria that select signatures for this overwrite rule
         */
        matching?: pulumi.Input<inputs.org.GatewaytemplateIdpProfilesOverwriteMatching | undefined>;
        /**
         * Display name for this IDP profile overwrite rule
         */
        name?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateIdpProfilesOverwriteMatching {
        /**
         * Signature names matched by the IDP profile overwrite
         */
        attackNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Destination subnets matched by the IDP profile overwrite
         */
        dstSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Threat levels matched by the IDP profile overwrite
         */
        severities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewaytemplateIpConfigs {
        /**
         * Static IPv4 address for the gateway network interface when `type`==`static`
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Static IPv6 address for the gateway network interface when `type6`==`static`
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * IPv4 netmask or prefix length for the gateway network interface when `type`==`static`
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * IPv6 netmask or prefix length for the gateway network interface when `type6`==`static`
         */
        netmask6?: pulumi.Input<string | undefined>;
        /**
         * Additional IPv4 addresses in CIDR notation for this gateway network interface
         */
        secondaryIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IPv4 address assignment mode for this gateway network interface
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 address assignment mode for this gateway network interface
         */
        type6?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateNetwork {
        /**
         * Whether to disallow Mist Devices in the network
         */
        disallowMistServices?: pulumi.Input<boolean | undefined>;
        /**
         * IPv4 gateway address for this network
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * IPv6 gateway address for this network
         */
        gateway6?: pulumi.Input<string | undefined>;
        /**
         * Internal access settings for this network
         */
        internalAccess?: pulumi.Input<inputs.org.GatewaytemplateNetworkInternalAccess | undefined>;
        /**
         * Direct internet access and NAT settings for this network
         */
        internetAccess?: pulumi.Input<inputs.org.GatewaytemplateNetworkInternetAccess | undefined>;
        /**
         * Whether to allow clients in the network to talk to each other
         */
        isolation?: pulumi.Input<boolean | undefined>;
        /**
         * Settings for multicast routing on this network
         */
        multicast?: pulumi.Input<inputs.org.GatewaytemplateNetworkMulticast | undefined>;
        /**
         * Display name of the organization network
         */
        name: pulumi.Input<string>;
        /**
         * Other network names this network can route to, for example through BGP, OSPF or static routes
         */
        routedForNetworks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IPv4 subnet CIDR for this network
         */
        subnet: pulumi.Input<string>;
        /**
         * IPv6 subnet CIDR for this network
         */
        subnet6?: pulumi.Input<string | undefined>;
        /**
         * Tenant address mappings associated with this network
         */
        tenants?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplateNetworkTenants>;
        } | undefined>;
        /**
         * VLAN ID or variable associated with this network
         */
        vlanId?: pulumi.Input<string | undefined>;
        /**
         * VPN access settings keyed by VPN name for this network
         */
        vpnAccess?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplateNetworkVpnAccess>;
        } | undefined>;
    }
    interface GatewaytemplateNetworkInternalAccess {
        /**
         * Whether internal access is enabled for this network
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewaytemplateNetworkInternetAccess {
        /**
         * Whether Mist should create simple service policies for restricted internet access
         */
        createSimpleServicePolicy?: pulumi.Input<boolean | undefined>;
        /**
         * Destination NAT rules for direct internet access
         */
        destinationNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplateNetworkInternetAccessDestinationNat>;
        } | undefined>;
        /**
         * Whether direct internet access is enabled for this network
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * By default, all access is allowed, to only allow certain traffic, make `restricted`=`true` and define service_policies
         */
        restricted?: pulumi.Input<boolean | undefined>;
        /**
         * Static NAT rules for direct internet access
         */
        staticNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplateNetworkInternetAccessStaticNat>;
        } | undefined>;
    }
    interface GatewaytemplateNetworkInternetAccessDestinationNat {
        /**
         * The Destination NAT destination IP address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
         */
        internalIp?: pulumi.Input<string | undefined>;
        /**
         * Label for this direct internet destination NAT rule
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * The Destination NAT destination IP address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}")
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity
         */
        wanName?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateNetworkInternetAccessStaticNat {
        /**
         * The Static NAT destination IP address. Must be an IP address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
         */
        internalIp: pulumi.Input<string>;
        /**
         * Label for this direct internet static NAT rule
         */
        name: pulumi.Input<string>;
        /**
         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}")
         */
        wanName?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateNetworkMulticast {
        /**
         * If the network will only be the source of the multicast traffic, IGMP can be disabled
         */
        disableIgmp?: pulumi.Input<boolean | undefined>;
        /**
         * Whether multicast support is enabled for this network
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Multicast group-to-RP mappings for this network
         */
        groups?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplateNetworkMulticastGroups>;
        } | undefined>;
    }
    interface GatewaytemplateNetworkMulticastGroups {
        /**
         * RP (rendezvous point) IP address
         */
        rpIp?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateNetworkTenants {
        /**
         * IP addresses or subnets assigned to this tenant in the network
         */
        addresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewaytemplateNetworkVpnAccess {
        /**
         * If `routed`==`true`, whether to advertise an aggregated subnet toward HUB this is useful when there are multiple networks on SPOKE's side
         */
        advertisedSubnet?: pulumi.Input<string | undefined>;
        /**
         * Whether to allow ping from vpn into this routed network
         */
        allowPing?: pulumi.Input<boolean | undefined>;
        /**
         * Destination NAT rules applied for VPN access to this network
         */
        destinationNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplateNetworkVpnAccessDestinationNat>;
        } | undefined>;
        /**
         * If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub, a subnet is required to create and advertise the route to Hub
         */
        natPool?: pulumi.Input<string | undefined>;
        /**
         * toward LAN-side BGP peers
         */
        noReadvertiseToLanBgp?: pulumi.Input<boolean | undefined>;
        /**
         * toward LAN-side OSPF peers
         */
        noReadvertiseToLanOspf?: pulumi.Input<boolean | undefined>;
        /**
         * toward overlay, how HUB should deal with routes it received from Spokes
         */
        noReadvertiseToOverlay?: pulumi.Input<boolean | undefined>;
        /**
         * Other VRFs that can receive leaked routes from this spoke network
         */
        otherVrfs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether this network is routable
         */
        routed?: pulumi.Input<boolean | undefined>;
        /**
         * Source NAT settings used when non-routed spoke hosts must be reachable from the hub
         */
        sourceNat?: pulumi.Input<inputs.org.GatewaytemplateNetworkVpnAccessSourceNat | undefined>;
        /**
         * Static NAT rules applied for VPN access to this network
         */
        staticNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplateNetworkVpnAccessStaticNat>;
        } | undefined>;
        /**
         * toward overlay, how HUB should deal with routes it received from Spokes
         */
        summarizedSubnet?: pulumi.Input<string | undefined>;
        /**
         * toward LAN-side BGP peers
         */
        summarizedSubnetToLanBgp?: pulumi.Input<string | undefined>;
        /**
         * toward LAN-side OSPF peers
         */
        summarizedSubnetToLanOspf?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateNetworkVpnAccessDestinationNat {
        /**
         * The Destination NAT destination IP address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
         */
        internalIp?: pulumi.Input<string | undefined>;
        /**
         * Label for this VPN destination NAT rule
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Destination port or variable for this VPN destination NAT rule
         */
        port?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateNetworkVpnAccessSourceNat {
        /**
         * External source NAT IP or subnet used when spoke hosts must be reachable from the hub
         */
        externalIp?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateNetworkVpnAccessStaticNat {
        /**
         * The Static NAT destination IP address. Must be an IP address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
         */
        internalIp: pulumi.Input<string>;
        /**
         * Label for this VPN static NAT rule
         */
        name: pulumi.Input<string>;
    }
    interface GatewaytemplateOobIpConfig {
        /**
         * Default gateway for the out-of-band management interface when `type`==`static`
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Static IPv4 address for the out-of-band management interface when `type`==`static`
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * IPv4 netmask or prefix length for the out-of-band management interface when `type`==`static`
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * Out-of-band management IP configuration override for node1 in an HA cluster
         */
        node1?: pulumi.Input<inputs.org.GatewaytemplateOobIpConfigNode1 | undefined>;
        /**
         * IP assignment mode for the out-of-band management interface
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * If supported on the platform. If enabled, DNS will be using this routing-instance, too
         */
        useMgmtVrf?: pulumi.Input<boolean | undefined>;
        /**
         * For host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired
         */
        useMgmtVrfForHostOut?: pulumi.Input<boolean | undefined>;
        /**
         * VLAN ID used for out-of-band management traffic
         */
        vlanId?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateOobIpConfigNode1 {
        /**
         * Default gateway for the node1 out-of-band management interface when `type`==`static`
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Static IPv4 address for the node1 out-of-band management interface when `type`==`static`
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * IPv4 netmask or prefix length for the node1 out-of-band management interface when `type`==`static`; used only if `subnet` is not specified in `networks`
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * IP assignment mode for the node1 out-of-band management interface
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * If supported on the platform. If enabled, DNS will be using this routing-instance, too
         */
        useMgmtVrf?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to use `mgmtJunos` for host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired
         */
        useMgmtVrfForHostOut?: pulumi.Input<boolean | undefined>;
        /**
         * VLAN ID used for node1 out-of-band management traffic
         */
        vlanId?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplatePathPreferences {
        /**
         * Candidate paths evaluated for this gateway path preference
         */
        paths?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplatePathPreferencesPath>[] | undefined>;
        /**
         * Selection strategy used to evaluate the candidate paths
         */
        strategy?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplatePathPreferencesPath {
        /**
         * Relative cost assigned to this path for gateway path selection
         */
        cost?: pulumi.Input<number | undefined>;
        /**
         * For SSR Only. `true`, if this specific path is undesired
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `type`==`local`, if a different gateway is desired
         */
        gatewayIp?: pulumi.Input<string | undefined>;
        /**
         * Only if `type`==`vpn`, if this vpn path can be used for internet
         */
        internetAccess?: pulumi.Input<boolean | undefined>;
        /**
         * Required when
         *   * `type`==`vpn`: the name of the VPN Path to use
         *   * `type`==`wan`: the name of the WAN interface to use
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * List of network names used when `type`==`local`
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * List of destination IP addresses to replace when `type`==`local`
         */
        targetIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Gateway path source type, such as local network, WAN interface, VPN path, or tunnel
         */
        type: pulumi.Input<string>;
        /**
         * Optional if `type`==`vpn`; WAN interface name associated with the VPN path
         */
        wanName?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplatePortConfig {
        /**
         * If `aggregated`==`true`. To disable LCP support for the AE interface
         */
        aeDisableLacp?: pulumi.Input<boolean | undefined>;
        /**
         * If `aggregated`==`true`. Users could force to use the designated AE name (must be an integer between 0 and 127)
         */
        aeIdx?: pulumi.Input<string | undefined>;
        /**
         * For SRX only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
         */
        aeLacpForceUp?: pulumi.Input<boolean | undefined>;
        /**
         * Whether the port participates in an aggregated Ethernet interface
         */
        aggregated?: pulumi.Input<boolean | undefined>;
        /**
         * To generate port up/down alarm, set it to true
         */
        critical?: pulumi.Input<boolean | undefined>;
        /**
         * Interface Description. Can be a variable (i.e. "{{myvar}}")
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Whether Ethernet autonegotiation is disabled on the port
         */
        disableAutoneg?: pulumi.Input<boolean | undefined>;
        /**
         * Port admin up (true) / down (false)
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * If `wanType`==`dsl`. DSL technology used by the WAN port
         */
        dslType?: pulumi.Input<string | undefined>;
        /**
         * If `wanType`==`dsl`, 16 bit int
         */
        dslVci?: pulumi.Input<number | undefined>;
        /**
         * If `wanType`==`dsl`, 8 bit int
         */
        dslVpi?: pulumi.Input<number | undefined>;
        /**
         * Ethernet duplex mode configured on the port
         */
        duplex?: pulumi.Input<string | undefined>;
        /**
         * Layer 3 IP configuration for the port
         */
        ipConfig?: pulumi.Input<inputs.org.GatewaytemplatePortConfigIpConfig | undefined>;
        /**
         * If `wanType`==`lte`. APN used by the LTE uplink
         */
        lteApn?: pulumi.Input<string | undefined>;
        /**
         * If `wanType`==`lte`. Authentication method used by the LTE uplink
         */
        lteAuth?: pulumi.Input<string | undefined>;
        /**
         * Whether the LTE uplink is used as a backup WAN connection
         */
        lteBackup?: pulumi.Input<boolean | undefined>;
        /**
         * If `wanType`==`lte`. Password used for LTE uplink authentication
         */
        ltePassword?: pulumi.Input<string | undefined>;
        /**
         * If `wanType`==`lte`. Username used for LTE uplink authentication
         */
        lteUsername?: pulumi.Input<string | undefined>;
        /**
         * Layer 3 MTU configured on the port
         */
        mtu?: pulumi.Input<number | undefined>;
        /**
         * Interface name used to derive device configuration
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * if `usage`==`lan`, name of the `junipermist.org.Network` resource
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * For Q-in-Q. Outer VLAN ID used for QinQ encapsulation
         */
        outerVlanId?: pulumi.Input<number | undefined>;
        /**
         * Whether PoE output is disabled on the port
         */
        poeDisabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether Perpetual PoE capabilities are enabled for a port
         */
        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
        /**
         * Only for SRX and if `usage`==`lan`, the name of the Network to be used as the Untagged VLAN
         */
        portNetwork?: pulumi.Input<string | undefined>;
        /**
         * Whether to preserve dscp when sending traffic over VPN (SSR-only)
         */
        preserveDscp?: pulumi.Input<boolean | undefined>;
        /**
         * If HA mode. Whether the port participates in the redundant Ethernet configuration
         */
        redundant?: pulumi.Input<boolean | undefined>;
        /**
         * If HA mode, SRX Only - support redundancy-group. 1-128 for physical SRX, 1-64 for virtual SRX
         */
        redundantGroup?: pulumi.Input<number | undefined>;
        /**
         * For SRX only and if HA Mode
         */
        rethIdx?: pulumi.Input<string | undefined>;
        /**
         * If HA mode. Node associated with the redundant Ethernet interface
         */
        rethNode?: pulumi.Input<string | undefined>;
        /**
         * If HA mode and for SSR only. Per-network node assignment used for VLAN-based redundancy
         */
        rethNodes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Link speed configured on the port
         */
        speed?: pulumi.Input<string | undefined>;
        /**
         * When SSR is running as VM, this is required on certain hosting platforms
         */
        ssrNoVirtualMac?: pulumi.Input<boolean | undefined>;
        /**
         * For SSR only. Port range configured on the interface
         */
        svrPortRange?: pulumi.Input<string | undefined>;
        /**
         * Traffic shaping settings applied to the port
         */
        trafficShaping?: pulumi.Input<inputs.org.GatewaytemplatePortConfigTrafficShaping | undefined>;
        /**
         * Logical usage assigned to the port
         */
        usage: pulumi.Input<string>;
        /**
         * VLAN ID or variable used when the WAN interface is carried on a VLAN
         */
        vlanId?: pulumi.Input<string | undefined>;
        /**
         * Per-VPN path settings for traffic that uses this port
         */
        vpnPaths?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplatePortConfigVpnPaths>;
        } | undefined>;
        /**
         * Only when `wanType`==`broadband`. ARP policer profile applied to the WAN port
         */
        wanArpPolicer?: pulumi.Input<string | undefined>;
        /**
         * Only if `usage`==`wan`, optional. If spoke should reach this port by a different IP
         */
        wanExtIp?: pulumi.Input<string | undefined>;
        /**
         * Only if `usage`==`wan`, optional. If spoke should reach this port by a different IPv6
         */
        wanExtIp6?: pulumi.Input<string | undefined>;
        /**
         * Only if `usage`==`wan`. Property Key is the destination CIDR (e.g. "100.100.100.0/24")
         */
        wanExtraRoutes?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplatePortConfigWanExtraRoutes>;
        } | undefined>;
        /**
         * Only if `usage`==`wan`. Property Key is the destination CIDR (e.g. "2a02:1234:420a:10c9::/64")
         */
        wanExtraRoutes6?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.GatewaytemplatePortConfigWanExtraRoutes6>;
        } | undefined>;
        /**
         * Only if `usage`==`wan`. Networks reachable through this WAN port for policy definition
         */
        wanNetworks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Optional WAN health probe override settings for this port
         */
        wanProbeOverride?: pulumi.Input<inputs.org.GatewaytemplatePortConfigWanProbeOverride | undefined>;
        /**
         * Source NAT settings applied to traffic leaving this WAN port
         */
        wanSourceNat?: pulumi.Input<inputs.org.GatewaytemplatePortConfigWanSourceNat | undefined>;
        /**
         * Controls whether Marvis or the scheduler can run speed tests on this WAN port
         */
        wanSpeedtestMode?: pulumi.Input<string | undefined>;
        /**
         * Only if `usage`==`wan`. WAN uplink type configured on the port
         */
        wanType?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplatePortConfigIpConfig {
        /**
         * Resolver server IP addresses used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0
         */
        dns?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * DNS search suffixes used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0
         */
        dnsSuffixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP address (i.e. "192.168.1.1") or a Variable (i.e. "{{myvar}}")
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IPv6 Address (i.e. "2001:db8::1") or a Variable (i.e. "{{myvar}}")
         */
        gateway6?: pulumi.Input<string | undefined>;
        /**
         * Interface IP address (i.e. "192.168.1.8") or a Variable (i.e. "{{myvar}}")
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Interface IPv6 Address (i.e. "2001:db8::123") or a Variable (i.e. "{{myvar}}")
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * Used only if `subnet` is not specified in `networks`. Interface Netmask (i.e. "/24") or a Variable (i.e. "{{myvar}}")
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * Used only if `subnet` is not specified in `networks`. Interface IPv6 Netmask (i.e. "/64") or a Variable (i.e. "{{myvar}}")
         */
        netmask6?: pulumi.Input<string | undefined>;
        /**
         * Optional, the network to be used for mgmt
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Password used for PPPoE when `type`==`pppoe`
         */
        poserPassword?: pulumi.Input<string | undefined>;
        /**
         * Authentication protocol used for PPPoE when `type`==`pppoe`
         */
        pppoeAuth?: pulumi.Input<string | undefined>;
        /**
         * Username used for PPPoE when `type`==`pppoe`
         */
        pppoeUsername?: pulumi.Input<string | undefined>;
        /**
         * IPv4 assignment mode for this gateway port interface
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 assignment mode for this gateway port interface
         */
        type6?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplatePortConfigTrafficShaping {
        /**
         * Traffic class bandwidth percentages for high, medium, low, and best-effort queues
         */
        classPercentages?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether traffic shaping is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Maximum transmit bandwidth for the interface, in Kbps
         */
        maxTxKbps?: pulumi.Input<number | undefined>;
    }
    interface GatewaytemplatePortConfigVpnPaths {
        /**
         * BFD profile used for this VPN path when the VPN `type`==`hubSpoke`
         */
        bfdProfile?: pulumi.Input<string | undefined>;
        /**
         * Only if the VPN `type`==`hubSpoke`. Whether to use tunnel mode. SSR only
         */
        bfdUseTunnelMode?: pulumi.Input<boolean | undefined>;
        /**
         * Only if the VPN `type`==`hubSpoke`. For a given VPN, when `path_selection.strategy`==`simple`, the preference for a path (lower is preferred)
         */
        preference?: pulumi.Input<number | undefined>;
        /**
         * Gateway role for this VPN path; valid values depend on the VPN `type`
         */
        role?: pulumi.Input<string | undefined>;
        /**
         * Traffic shaping settings applied to this VPN path
         */
        trafficShaping?: pulumi.Input<inputs.org.GatewaytemplatePortConfigVpnPathsTrafficShaping | undefined>;
    }
    interface GatewaytemplatePortConfigVpnPathsTrafficShaping {
        /**
         * Traffic class bandwidth percentages for high, medium, low, and best-effort queues
         */
        classPercentages?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether traffic shaping is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Maximum transmit bandwidth for the interface, in Kbps
         */
        maxTxKbps?: pulumi.Input<number | undefined>;
    }
    interface GatewaytemplatePortConfigWanExtraRoutes {
        /**
         * IPv4 next-hop address for this WAN extra route
         */
        via?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplatePortConfigWanExtraRoutes6 {
        /**
         * IPv6 next-hop address for this WAN extra route
         */
        via?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplatePortConfigWanProbeOverride {
        /**
         * List of IPv6 probe host addresses used by this WAN override
         */
        ip6s?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * List of IPv4 probe host addresses used by this WAN override
         */
        ips?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * WAN probe profile used for health checks on this port
         */
        probeProfile?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplatePortConfigWanSourceNat {
        /**
         * Or to disable the source-nat
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * If alternative natPool is desired
         */
        nat6Pool?: pulumi.Input<string | undefined>;
        /**
         * If alternative natPool is desired
         */
        natPool?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateRoutingPolicies {
        /**
         * Ordered terms evaluated by this gateway routing policy
         */
        terms?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplateRoutingPoliciesTerm>[] | undefined>;
    }
    interface GatewaytemplateRoutingPoliciesTerm {
        /**
         * Policy actions applied when this routing policy term matches
         */
        actions?: pulumi.Input<inputs.org.GatewaytemplateRoutingPoliciesTermActions | undefined>;
        /**
         * Route match criteria that must be satisfied before actions are applied
         */
        matching?: pulumi.Input<inputs.org.GatewaytemplateRoutingPoliciesTermMatching | undefined>;
    }
    interface GatewaytemplateRoutingPoliciesTermActions {
        /**
         * Whether to accept routes that match this term
         */
        accept?: pulumi.Input<boolean | undefined>;
        /**
         * BGP communities to add to routes that match this term
         */
        addCommunities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * SSR target VRFs to add when leaking routes from hub to spoke
         */
        addTargetVrfs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities to set when this term is used as an export policy
         */
        communities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * AS path values to exclude when this term is used as an export policy
         */
        excludeAsPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities to exclude from routes that match this term
         */
        excludeCommunities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities allowed for export when this term is used as an export policy
         */
        exportCommunities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Preference value to set when this term is used as an import policy
         */
        localPreference?: pulumi.Input<string | undefined>;
        /**
         * AS path values to prepend when this term is used as an export policy
         */
        prependAsPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewaytemplateRoutingPoliciesTermMatching {
        /**
         * BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}`)
         */
        asPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities that routes must match
         */
        communities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Configured network names that routes must match
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Route prefixes that routes must match
         */
        prefixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * enum: `aggregate`, `bgp`, `direct`, `ospf`, `static` (SRX Only)
         */
        protocols?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Existing route condition that must be satisfied before this term matches
         */
        routeExists?: pulumi.Input<inputs.org.GatewaytemplateRoutingPoliciesTermMatchingRouteExists | undefined>;
        /**
         * Overlay neighbor MAC addresses used as match criteria for BGP sessions with `via`==`vpn`
         */
        vpnNeighborMacs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * SLA thresholds used when matching a VPN path
         */
        vpnPathSla?: pulumi.Input<inputs.org.GatewaytemplateRoutingPoliciesTermMatchingVpnPathSla | undefined>;
        /**
         * Overlay path names used as match criteria for BGP sessions with `via`==`vpn`
         */
        vpnPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewaytemplateRoutingPoliciesTermMatchingRouteExists {
        /**
         * Prefix that must exist for this condition to match
         */
        route?: pulumi.Input<string | undefined>;
        /**
         * Name of the VRF instance where the route is checked; can also be a VPN or WAN name when applicable
         */
        vrfName?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateRoutingPoliciesTermMatchingVpnPathSla {
        /**
         * Maximum jitter threshold allowed for the VPN path
         */
        maxJitter?: pulumi.Input<number | undefined>;
        /**
         * Maximum latency threshold allowed for the VPN path
         */
        maxLatency?: pulumi.Input<number | undefined>;
        /**
         * Maximum packet-loss threshold allowed for the VPN path
         */
        maxLoss?: pulumi.Input<number | undefined>;
    }
    interface GatewaytemplateServicePolicy {
        /**
         * Required when `servicepolicyId` is not defined, optional otherwise (override the servicepolicy action). enum: `allow`, `deny`
         */
        action?: pulumi.Input<string | undefined>;
        /**
         * Malware and virus inspection settings applied by this service policy
         */
        antivirus?: pulumi.Input<inputs.org.GatewaytemplateServicePolicyAntivirus | undefined>;
        /**
         * Application QoE settings applied by this service policy
         */
        appqoe?: pulumi.Input<inputs.org.GatewaytemplateServicePolicyAppqoe | undefined>;
        /**
         * Enhanced web filtering rules applied by this service policy
         */
        ewfs?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplateServicePolicyEwf>[] | undefined>;
        /**
         * Intrusion detection and prevention settings applied by this service policy
         */
        idp?: pulumi.Input<inputs.org.GatewaytemplateServicePolicyIdp | undefined>;
        /**
         * Whether the policy permits access within the same VRF
         */
        localRouting?: pulumi.Input<boolean | undefined>;
        /**
         * Required when `servicepolicyId` is not defined, optional otherwise (override the servicepolicy name)
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * By default, we derive all paths available and use them. Optionally, you can customize by using `pathPreference`
         */
        pathPreference?: pulumi.Input<string | undefined>;
        /**
         * Organization-level service policy identifier used to link and override selected attributes
         */
        servicepolicyId?: pulumi.Input<string | undefined>;
        /**
         * Required when `servicepolicyId` is not defined. List of Applications / Destinations
         */
        services?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Threat inspection settings provided by Sky ATP for this service policy
         */
        skyatp?: pulumi.Input<inputs.org.GatewaytemplateServicePolicySkyatp | undefined>;
        /**
         * TLS inspection settings applied by this service policy
         */
        sslProxy?: pulumi.Input<inputs.org.GatewaytemplateServicePolicySslProxy | undefined>;
        /**
         * Remote logging settings applied by this service policy
         */
        syslog?: pulumi.Input<inputs.org.GatewaytemplateServicePolicySyslog | undefined>;
        /**
         * Required when `servicepolicyId` is not defined. List of Networks / Users
         */
        tenants?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewaytemplateServicePolicyAntivirus {
        /**
         * Organization-level antivirus profile ID; takes precedence over inline `profile` settings
         */
        avprofileId?: pulumi.Input<string | undefined>;
        /**
         * Whether antivirus inspection is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Antivirus profile name to apply, such as `default`, `noftp`, `httponly`, or an AV profile key
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateServicePolicyAppqoe {
        /**
         * Whether application QoE is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewaytemplateServicePolicyEwf {
        /**
         * Whether matching enhanced web filtering traffic is logged without being blocked
         */
        alertOnly?: pulumi.Input<boolean | undefined>;
        /**
         * Message returned when enhanced web filtering blocks a request
         */
        blockMessage?: pulumi.Input<string | undefined>;
        /**
         * Whether this enhanced web filtering rule is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Enhanced web filtering profile applied by this rule
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateServicePolicyIdp {
        /**
         * Whether to alert without enforcing IDP prevention actions
         */
        alertOnly?: pulumi.Input<boolean | undefined>;
        /**
         * Whether IDP inspection is enabled for the policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * org_level IDP Profile can be used, this takes precedence over `profile`
         */
        idpprofileId?: pulumi.Input<string | undefined>;
        /**
         * enum: `Custom`, `strict` (default), `standard` or keys from idp_profiles
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateServicePolicySkyatp {
        /**
         * Detection settings for DNS DGA threats provided by Sky ATP
         */
        dnsDgaDetection?: pulumi.Input<inputs.org.GatewaytemplateServicePolicySkyatpDnsDgaDetection | undefined>;
        /**
         * Detection settings for DNS tunneling threats provided by Sky ATP
         */
        dnsTunnelDetection?: pulumi.Input<inputs.org.GatewaytemplateServicePolicySkyatpDnsTunnelDetection | undefined>;
        /**
         * Web traffic inspection settings provided by Sky ATP
         */
        httpInspection?: pulumi.Input<inputs.org.GatewaytemplateServicePolicySkyatpHttpInspection | undefined>;
        /**
         * Device threat policy settings provided by Sky ATP for IoT clients
         */
        iotDevicePolicy?: pulumi.Input<inputs.org.GatewaytemplateServicePolicySkyatpIotDevicePolicy | undefined>;
    }
    interface GatewaytemplateServicePolicySkyatpDnsDgaDetection {
        /**
         * Whether Sky ATP DNS DGA detection is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Sky ATP DNS DGA detection profile to apply
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateServicePolicySkyatpDnsTunnelDetection {
        /**
         * Whether Sky ATP DNS tunneling detection is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Sky ATP DNS tunneling detection profile to apply
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateServicePolicySkyatpHttpInspection {
        /**
         * Whether Sky ATP HTTP inspection is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Sky ATP HTTP inspection profile to apply
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateServicePolicySkyatpIotDevicePolicy {
        /**
         * Whether Sky ATP IoT device policy inspection is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewaytemplateServicePolicySslProxy {
        /**
         * Allowed cipher strength category for SSL proxy inspection
         */
        ciphersCategory?: pulumi.Input<string | undefined>;
        /**
         * Whether SSL proxy inspection is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewaytemplateServicePolicySyslog {
        /**
         * Whether syslog logging is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Names of syslog servers that receive logs for this service policy
         */
        serverNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewaytemplateTunnelConfigs {
        /**
         * Provider auto-provisioning settings for tunnel endpoints
         */
        autoProvision?: pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsAutoProvision | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
         */
        ikeLifetime?: pulumi.Input<number | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. IKE negotiation mode for the tunnel
         */
        ikeMode?: pulumi.Input<string | undefined>;
        /**
         * If `provider`==`custom-ipsec`, IKE proposals used for custom IPsec negotiation
         */
        ikeProposals?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsIkeProposal>[] | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. Must be between 180 and 86400
         */
        ipsecLifetime?: pulumi.Input<number | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. IPsec proposals used for custom IPsec negotiation
         */
        ipsecProposals?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsIpsecProposal>[] | undefined>;
        /**
         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
         */
        localId?: pulumi.Input<string | undefined>;
        /**
         * Local protected subnets advertised by this tunnel
         */
        localSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Tunnel failover mode used for primary and secondary endpoints
         */
        mode?: pulumi.Input<string | undefined>;
        /**
         * Destination networks reachable through this tunnel
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Main remote tunnel endpoint settings
         */
        primary?: pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsPrimary | undefined>;
        /**
         * Tunnel health probe settings
         */
        probe?: pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsProbe | undefined>;
        /**
         * Only if `provider`==`custom-ipsec`. Tunnel protocol for custom tunnel negotiation
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Tunnel provider used when auto provisioning is disabled
         */
        provider?: pulumi.Input<string | undefined>;
        /**
         * Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec`
         */
        psk?: pulumi.Input<string | undefined>;
        /**
         * Remote protected subnets reached through policy-based IPsec
         */
        remoteSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Backup remote tunnel endpoint settings
         */
        secondary?: pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsSecondary | undefined>;
        /**
         * Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. Tunnel version value for custom tunnel configuration
         */
        version?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateTunnelConfigsAutoProvision {
        /**
         * Enable auto provisioning for the tunnel. If enabled, the `primary` and `secondary` nodes will be ignored.
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Geographic coordinate override used for tunnel POP selection
         */
        latlng?: pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsAutoProvisionLatlng | undefined>;
        /**
         * Main auto-provisioned tunnel endpoint settings
         */
        primary?: pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsAutoProvisionPrimary | undefined>;
        /**
         * Tunnel provider used for automatic endpoint provisioning
         */
        provider: pulumi.Input<string>;
        /**
         * API override for POP selection in the case user wants to override the auto discovery of remote network location and force the tunnel to use the specified peer location.
         */
        region?: pulumi.Input<string | undefined>;
        /**
         * Backup auto-provisioned tunnel endpoint settings
         */
        secondary?: pulumi.Input<inputs.org.GatewaytemplateTunnelConfigsAutoProvisionSecondary | undefined>;
        /**
         * if `provider`==`prisma-ipsec`. By default, we'll use the location of the site to determine the optimal Remote Network location, optionally, serviceConnection can be considered, then we'll also consider this along with the site location. Define serviceConnection if the traffic is to be routed to a specific service connection. This field takes a service connection name that is configured in the Prisma cloud, Prisma Access Setup > Service Connections.
         */
        serviceConnection?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateTunnelConfigsAutoProvisionLatlng {
        /**
         * Geographic latitude used for POP selection override
         */
        lat: pulumi.Input<number>;
        /**
         * Geographic longitude used for POP selection override
         */
        lng: pulumi.Input<number>;
    }
    interface GatewaytemplateTunnelConfigsAutoProvisionPrimary {
        /**
         * Probe IP addresses used to monitor auto-provisioned tunnel reachability
         */
        probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * WAN interface names used by the auto-provisioned tunnel endpoint
         */
        wanNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewaytemplateTunnelConfigsAutoProvisionSecondary {
        /**
         * Probe IP addresses used to monitor auto-provisioned tunnel reachability
         */
        probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * WAN interface names used by the auto-provisioned tunnel endpoint
         */
        wanNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface GatewaytemplateTunnelConfigsIkeProposal {
        /**
         * Integrity algorithm used by this IKE proposal
         */
        authAlgo?: pulumi.Input<string | undefined>;
        /**
         * Diffie-Hellman group used by this IKE proposal
         */
        dhGroup?: pulumi.Input<string | undefined>;
        /**
         * Cipher algorithm used by this IKE proposal
         */
        encAlgo?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateTunnelConfigsIpsecProposal {
        /**
         * Integrity algorithm used by this IPsec proposal
         */
        authAlgo?: pulumi.Input<string | undefined>;
        /**
         * Diffie-Hellman group used by this IPsec proposal
         */
        dhGroup?: pulumi.Input<string | undefined>;
        /**
         * Cipher algorithm used by this IPsec proposal
         */
        encAlgo?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateTunnelConfigsPrimary {
        /**
         * Remote gateway host addresses for this tunnel node
         */
        hosts: pulumi.Input<pulumi.Input<string>[]>;
        /**
         * Internal IP addresses configured on this tunnel node
         */
        internalIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Health-check IP addresses used to monitor this tunnel node
         */
        probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IKE identities expected from this tunnel node
         */
        remoteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Interface names that source tunnel traffic for this node
         */
        wanNames: pulumi.Input<pulumi.Input<string>[]>;
    }
    interface GatewaytemplateTunnelConfigsProbe {
        /**
         * How often to trigger the probe
         */
        interval?: pulumi.Input<number | undefined>;
        /**
         * Number of consecutive misses before declaring the tunnel down
         */
        threshold?: pulumi.Input<number | undefined>;
        /**
         * Time within which to complete the connectivity check
         */
        timeout?: pulumi.Input<number | undefined>;
        /**
         * Protocol used by the custom IPsec tunnel health probe
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateTunnelConfigsSecondary {
        /**
         * Remote gateway host addresses for this tunnel node
         */
        hosts: pulumi.Input<pulumi.Input<string>[]>;
        /**
         * Internal IP addresses configured on this tunnel node
         */
        internalIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Health-check IP addresses used to monitor this tunnel node
         */
        probeIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IKE identities expected from this tunnel node
         */
        remoteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Interface names that source tunnel traffic for this node
         */
        wanNames: pulumi.Input<pulumi.Input<string>[]>;
    }
    interface GatewaytemplateTunnelProviderOptions {
        /**
         * Juniper Secure Edge provisioning options for tunnel endpoints
         */
        jse?: pulumi.Input<inputs.org.GatewaytemplateTunnelProviderOptionsJse | undefined>;
        /**
         * Palo Alto Prisma Access provisioning options for tunnel endpoints
         */
        prisma?: pulumi.Input<inputs.org.GatewaytemplateTunnelProviderOptionsPrisma | undefined>;
        /**
         * Provider settings for Zscaler tunnel endpoints
         */
        zscaler?: pulumi.Input<inputs.org.GatewaytemplateTunnelProviderOptionsZscaler | undefined>;
    }
    interface GatewaytemplateTunnelProviderOptionsJse {
        /**
         * User capacity to provision on Juniper Secure Edge
         */
        numUsers?: pulumi.Input<number | undefined>;
        /**
         * JSE Organization name
         */
        orgName?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateTunnelProviderOptionsPrisma {
        /**
         * For prisma-ipsec, service account name to used for tunnel auto provisioning
         */
        serviceAccountName?: pulumi.Input<string | undefined>;
    }
    interface GatewaytemplateTunnelProviderOptionsZscaler {
        /**
         * Whether Zscaler blocks internet access until the Acceptable Use Policy is accepted
         */
        aupBlockInternetUntilAccepted?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
         */
        aupEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
         */
        aupForceSslInspection?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `aupEnabled`==`true`. Days before AUP is requested again
         */
        aupTimeoutInDays?: pulumi.Input<number | undefined>;
        /**
         * Enable this option to enforce user authentication
         */
        authRequired?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
         */
        cautionEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Download bandwidth cap of the link, in Mbps. Disabled if not set
         */
        dnBandwidth?: pulumi.Input<number | undefined>;
        /**
         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
         */
        idleTimeInMinutes?: pulumi.Input<number | undefined>;
        /**
         * If `true`, enable the firewall control option
         */
        ofwEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Per-network Zscaler sub-location settings
         */
        subLocations?: pulumi.Input<pulumi.Input<inputs.org.GatewaytemplateTunnelProviderOptionsZscalerSubLocation>[] | undefined>;
        /**
         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
         */
        surrogateIp?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
         */
        surrogateIpEnforcedForKnownBrowsers?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
         */
        surrogateRefreshTimeInMinutes?: pulumi.Input<number | undefined>;
        /**
         * Download bandwidth cap of the link, in Mbps. Disabled if not set
         */
        upBandwidth?: pulumi.Input<number | undefined>;
        /**
         * Location uses proxy chaining to forward traffic
         */
        xffForwardEnabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewaytemplateTunnelProviderOptionsZscalerSubLocation {
        /**
         * Whether this sub-location blocks internet access until the Acceptable Use Policy is accepted
         */
        aupBlockInternetUntilAccepted?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`false`, display Acceptable Use Policy (AUP)
         */
        aupEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Proxy HTTPs traffic, requiring Zscaler cert to be installed in browser
         */
        aupForceSslInspection?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `aupEnabled`==`true`. Days before AUP is requested again
         */
        aupTimeoutInDays?: pulumi.Input<number | undefined>;
        /**
         * Enable this option to authenticate users
         */
        authRequired?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`false`, display caution notification for non-authenticated users
         */
        cautionEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Download bandwidth cap of the link, in Mbps. Disabled if not set
         */
        dnBandwidth?: pulumi.Input<number | undefined>;
        /**
         * Required if `surrogate_IP`==`true`, idle Time to Disassociation
         */
        idleTimeInMinutes?: pulumi.Input<number | undefined>;
        /**
         * Network name
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * If `true`, enable the firewall control option
         */
        ofwEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `authRequired`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies
         */
        surrogateIp?: pulumi.Input<boolean | undefined>;
        /**
         * Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers
         */
        surrogateIpEnforcedForKnownBrowsers?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idleTimeInMinutes`, refresh Time for re-validation of Surrogacy
         */
        surrogateRefreshTimeInMinutes?: pulumi.Input<number | undefined>;
        /**
         * Download bandwidth cap of the link, in Mbps. Disabled if not set
         */
        upBandwidth?: pulumi.Input<number | undefined>;
    }
    interface GatewaytemplateVrfConfig {
        /**
         * Whether to enable VRF (when supported on the device)
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface GatewaytemplateVrfInstances {
        /**
         * Network names included in this gateway VRF instance
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface IdpprofileOverwrite {
        /**
         * Enforcement action applied when this overwrite rule matches
         */
        action?: pulumi.Input<string | undefined>;
        /**
         * Criteria that select signatures for this overwrite rule
         */
        matching?: pulumi.Input<inputs.org.IdpprofileOverwriteMatching | undefined>;
        /**
         * Display name for this IDP profile overwrite rule
         */
        name: pulumi.Input<string>;
    }
    interface IdpprofileOverwriteMatching {
        /**
         * Signature names matched by the IDP profile overwrite
         */
        attackNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Destination subnets matched by the IDP profile overwrite
         */
        dstSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Threat levels matched by the IDP profile overwrite
         */
        severities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface InventoryInventory {
        /**
         * device claim code
         */
        claimCode?: pulumi.Input<string | undefined>;
        /**
         * deviceprofile id if assigned, null if not assigned
         */
        deviceprofileId?: pulumi.Input<string | undefined>;
        /**
         * hostname reported by the device
         */
        hostname?: pulumi.Input<string | undefined>;
        /**
         * device id
         */
        id?: pulumi.Input<string | undefined>;
        /**
         * device MAC address
         */
        mac?: pulumi.Input<string | undefined>;
        /**
         * device model
         */
        model?: pulumi.Input<string | undefined>;
        /**
         * Unique identifier of a Mist organization
         */
        orgId?: pulumi.Input<string | undefined>;
        /**
         * device serial
         */
        serial?: pulumi.Input<string | undefined>;
        /**
         * Site ID. Used to assign device to a Site
         */
        siteId?: pulumi.Input<string | undefined>;
        /**
         * enum: `ap`, `gateway`, `switch`
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Unclaim the device from the Mist Organization when removed from the provider inventory. Default is `false`
         */
        unclaimWhenDestroyed?: pulumi.Input<boolean | undefined>;
        /**
         * if `type`==`switch` and device part of a Virtual Chassis, MAC Address of the Virtual Chassis. if `type`==`gateway` and device part of a Cluster, MAC Address of the Cluster
         */
        vcMac?: pulumi.Input<string | undefined>;
    }
    interface MxclusterMistDas {
        /**
         * Dynamic authorization clients allowed to send CoA or Disconnect-Message requests
         */
        coaServers?: pulumi.Input<pulumi.Input<inputs.org.MxclusterMistDasCoaServer>[] | undefined>;
        /**
         * Whether cloud-assisted DAS is enabled for the Mist Edge cluster
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface MxclusterMistDasCoaServer {
        /**
         * Whether to disable Event-Timestamp Check
         */
        disableEventTimestampCheck?: pulumi.Input<boolean | undefined>;
        /**
         * Whether this DAS CoA or Disconnect-Message client is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Server host allowed to send CoA or Disconnect-Message requests to Mist Edges
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * UDP port where Mist Edges accept CoA or Disconnect-Message requests from this host
         */
        port?: pulumi.Input<number | undefined>;
        /**
         * Whether to require Message-Authenticator in requests
         */
        requireMessageAuthenticator?: pulumi.Input<boolean | undefined>;
        /**
         * Shared secret used by this DAS CoA or Disconnect-Message client
         */
        secret?: pulumi.Input<string | undefined>;
    }
    interface MxclusterMistNac {
        /**
         * RADIUS accounting port used by Mist NAC on the cluster
         */
        acctServerPort?: pulumi.Input<number | undefined>;
        /**
         * RADIUS authentication port used by Mist NAC on the cluster
         */
        authServerPort?: pulumi.Input<number | undefined>;
        /**
         * Property key is the RADIUS Client IP/Subnet.
         */
        clientIps?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.MxclusterMistNacClientIps>;
        } | undefined>;
        /**
         * Whether Mist NAC is enabled on the cluster
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Shared RADIUS secret used by Mist NAC clients
         */
        secret?: pulumi.Input<string | undefined>;
    }
    interface MxclusterMistNacClientIps {
    }
    interface MxclusterMistNacedge {
        /**
         * Cache TTL for last auth result in seconds
         */
        authTtl?: pulumi.Input<number | undefined>;
        /**
         * List of site UUIDs whose auth requests should be cached by NAC Edges in this cluster
         */
        cachingSiteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Default VLAN for all dot1x devices, if different from default_vlan
         */
        defaultDot1xVlan?: pulumi.Input<string | undefined>;
        /**
         * Default VLAN to assign for devices not in the cache
         */
        defaultVlan?: pulumi.Input<string | undefined>;
        /**
         * Whether NAC Edge survivability is enabled for this cluster
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * NAC Edge hostnames used by APs for survivability authentication
         */
        nacEdgeHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface MxclusterMxedgeMgmt {
        /**
         * Whether the Mist Edge automatically reverts configuration changes if connectivity is lost
         */
        configAutoRevert?: pulumi.Input<boolean | undefined>;
        /**
         * Whether FIPS mode is enabled on the Mist Edge
         */
        fipsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Password for the Mist service account on the Mist Edge
         */
        mistPassword?: pulumi.Input<string | undefined>;
        /**
         * IPv4 address assignment mode for out-of-band management
         */
        oobIpType?: pulumi.Input<string | undefined>;
        /**
         * IPv6 address assignment mode for out-of-band management
         */
        oobIpType6?: pulumi.Input<string | undefined>;
        /**
         * Root account password for the Mist Edge
         */
        rootPassword?: pulumi.Input<string | undefined>;
    }
    interface MxclusterProxy {
        /**
         * Whether this proxy configuration is disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Proxy URL used to reach Mist
         */
        url?: pulumi.Input<string | undefined>;
    }
    interface MxclusterRadsec {
        /**
         * RADIUS accounting servers used by the RadSec proxy
         */
        acctServers?: pulumi.Input<pulumi.Input<inputs.org.MxclusterRadsecAcctServer>[] | undefined>;
        /**
         * RADIUS authentication servers used by the RadSec proxy
         */
        authServers?: pulumi.Input<pulumi.Input<inputs.org.MxclusterRadsecAuthServer>[] | undefined>;
        /**
         * Whether to enable service on Mist Edge i.e. RADIUS proxy over TLS
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to match ssid in request message to select from a subset of RADIUS servers
         */
        matchSsid?: pulumi.Input<boolean | undefined>;
        /**
         * Source used to populate NAS-IP-Address and NAS-IPv6-Address attributes
         */
        nasIpSource?: pulumi.Input<string | undefined>;
        /**
         * AP-reachable hostnames or IP addresses advertised as RadSec TLS servers
         */
        proxyHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * RADIUS server selection strategy for RadSec failover
         */
        serverSelection?: pulumi.Input<string | undefined>;
        /**
         * Connection source interface or address used when reaching RADIUS servers
         */
        srcIpSource?: pulumi.Input<string | undefined>;
    }
    interface MxclusterRadsecAcctServer {
        /**
         * IP / hostname of RADIUS server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * Acct port of RADIUS server
         */
        port?: pulumi.Input<number | undefined>;
        /**
         * Shared secret used with this RADIUS accounting server
         */
        secret?: pulumi.Input<string | undefined>;
        /**
         * WLAN SSID filters that use this accounting server when matching is enabled
         */
        ssids?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface MxclusterRadsecAuthServer {
        /**
         * IP / hostname of RADIUS server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * Whether to enable inband status check
         */
        inbandStatusCheck?: pulumi.Input<boolean | undefined>;
        /**
         * Inband status interval, in seconds
         */
        inbandStatusInterval?: pulumi.Input<number | undefined>;
        /**
         * If used for Mist APs, enable keywrap algorithm. Default is false
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for Mist AP RADIUS keywrap keys
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * If used for Mist APs, encryption key
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * If used for Mist APs, Message Authentication Code Key
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * Auth port of RADIUS server
         */
        port?: pulumi.Input<number | undefined>;
        /**
         * Number of authentication request retries before failing over
         */
        retry?: pulumi.Input<number | undefined>;
        /**
         * Shared secret used with this RADIUS authentication server
         */
        secret?: pulumi.Input<string | undefined>;
        /**
         * WLAN SSID filters that use this authentication server when matching is enabled
         */
        ssids?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Authentication request timeout, in seconds
         */
        timeout?: pulumi.Input<number | undefined>;
    }
    interface MxclusterRadsecTls {
        /**
         * Name or identifier of the TLS keypair used by RadSec
         */
        keypair?: pulumi.Input<string | undefined>;
    }
    interface MxclusterTuntermDhcpdConfig {
        /**
         * Whether DHCP relay is enabled for this tunneled VLAN
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * DHCP server IP addresses used as relay targets for this VLAN
         */
        servers?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * DHCP forwarding mode for this tunneled VLAN
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface MxclusterTuntermExtraRoutes {
        /**
         * Next-hop IP address for this extra route
         */
        via?: pulumi.Input<string | undefined>;
    }
    interface MxclusterTuntermMonitoring {
        host: pulumi.Input<string>;
        port: pulumi.Input<number>;
        protocol: pulumi.Input<string>;
        srcVlanId: pulumi.Input<number>;
        /**
         * Authentication request timeout, in seconds
         */
        timeout: pulumi.Input<number>;
    }
    interface MxedgeMxedgeMgmt {
        /**
         * Whether the Mist Edge automatically reverts configuration changes if connectivity is lost
         */
        configAutoRevert?: pulumi.Input<boolean | undefined>;
        /**
         * Whether FIPS mode is enabled on the Mist Edge
         */
        fipsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Password for the Mist service account on the Mist Edge
         */
        mistPassword?: pulumi.Input<string | undefined>;
        /**
         * IPv4 address assignment mode for out-of-band management
         */
        oobIpType?: pulumi.Input<string | undefined>;
        /**
         * IPv6 address assignment mode for out-of-band management
         */
        oobIpType6?: pulumi.Input<string | undefined>;
        /**
         * Root account password for the Mist Edge
         */
        rootPassword?: pulumi.Input<string | undefined>;
    }
    interface MxedgeOobIpConfig {
        /**
         * Whether IPv6 autoconfiguration is enabled on the out-of-band management interface
         */
        autoconf6?: pulumi.Input<boolean | undefined>;
        /**
         * Whether DHCPv6 is enabled on the out-of-band management interface
         */
        dhcp6?: pulumi.Input<boolean | undefined>;
        /**
         * Name server addresses for out-of-band management
         */
        dns?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If `type`=`static`, IPv4 default gateway for the out-of-band management interface
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * If `type6`=`static`, IPv6 default gateway for the out-of-band management interface
         */
        gateway6?: pulumi.Input<string | undefined>;
        /**
         * If `type`=`static`, IPv4 address for the out-of-band management interface
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * If `type6`=`static`, IPv6 address for the out-of-band management interface
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * If `type`=`static`, IPv4 netmask for the out-of-band management interface
         */
        netmask?: pulumi.Input<string | undefined>;
        /**
         * If `type6`=`static`, IPv6 prefix length for the out-of-band management interface
         */
        netmask6?: pulumi.Input<string | undefined>;
        /**
         * IPv4 address assignment mode for out-of-band management
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * IPv6 address assignment mode for out-of-band management
         */
        type6?: pulumi.Input<string | undefined>;
    }
    interface MxedgeProxy {
        /**
         * Whether this proxy configuration is disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Proxy URL used to reach Mist
         */
        url?: pulumi.Input<string | undefined>;
    }
    interface MxedgeTuntermDhcpdConfig {
        /**
         * Whether DHCP relay is enabled for this tunneled VLAN
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * DHCP relay server addresses used by this tunneled VLAN
         */
        servers?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * DHCP handling mode for this tunneled VLAN
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface MxedgeTuntermExtraRoutes {
        /**
         * Next-hop IP address for this Mist Tunnel extra route
         */
        via?: pulumi.Input<string | undefined>;
    }
    interface MxedgeTuntermIgmpSnoopingConfig {
        /**
         * Whether IGMP snooping is enabled for the configured VLANs
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * IGMP querier settings used with tunnel termination snooping
         */
        querier?: pulumi.Input<inputs.org.MxedgeTuntermIgmpSnoopingConfigQuerier | undefined>;
        /**
         * List of VLAN IDs where tunnel termination performs IGMP snooping
         */
        vlanIds?: pulumi.Input<pulumi.Input<number>[] | undefined>;
    }
    interface MxedgeTuntermIgmpSnoopingConfigQuerier {
        /**
         * Querier's query response interval, in tenths-of-seconds
         */
        maxResponseTime?: pulumi.Input<number | undefined>;
        /**
         * The MTU we use (needed when forming large IGMPv3 Reports)
         */
        mtu?: pulumi.Input<number | undefined>;
        /**
         * Querier's query interval, in seconds
         */
        queryInterval?: pulumi.Input<number | undefined>;
        /**
         * IGMP querier robustness variable
         */
        robustness?: pulumi.Input<number | undefined>;
        /**
         * Querier's maximum protocol version
         */
        version?: pulumi.Input<number | undefined>;
    }
    interface MxedgeTuntermIpConfig {
        /**
         * IPv4 gateway for the Mist Tunnel interface
         */
        gateway: pulumi.Input<string>;
        /**
         * IPv6 gateway for the Mist Tunnel interface
         */
        gateway6?: pulumi.Input<string | undefined>;
        /**
         * Address on the untagged Mist Tunnel interface, in IPv4 format
         */
        ip: pulumi.Input<string>;
        /**
         * Address on the Mist Tunnel interface, in IPv6 format
         */
        ip6?: pulumi.Input<string | undefined>;
        /**
         * Subnet mask for the Mist Tunnel IPv4 address
         */
        netmask: pulumi.Input<string>;
        /**
         * Prefix length for the Mist Tunnel IPv6 address
         */
        netmask6?: pulumi.Input<string | undefined>;
    }
    interface MxedgeTuntermMonitoring {
        host: pulumi.Input<string>;
        port: pulumi.Input<number>;
        protocol: pulumi.Input<string>;
        srcVlanId: pulumi.Input<number>;
        timeout: pulumi.Input<number>;
    }
    interface MxedgeTuntermMulticastConfig {
        /**
         * Settings for mDNS forwarding on tunnel termination VLANs
         */
        mdns?: pulumi.Input<inputs.org.MxedgeTuntermMulticastConfigMdns | undefined>;
        /**
         * Settings for SSDP forwarding on tunnel termination VLANs
         */
        ssdp?: pulumi.Input<inputs.org.MxedgeTuntermMulticastConfigSsdp | undefined>;
    }
    interface MxedgeTuntermMulticastConfigMdns {
        /**
         * Whether mDNS forwarding is enabled for the configured VLANs
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * List of VLAN IDs where mDNS forwarding is enabled
         */
        vlanIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface MxedgeTuntermMulticastConfigSsdp {
        /**
         * Whether SSDP forwarding is enabled for the configured VLANs
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * List of VLAN IDs where SSDP forwarding is enabled
         */
        vlanIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface MxedgeTuntermOtherIpConfigs {
        /**
         * Address for the additional Mist Tunnel interface, in IPv4 format
         */
        ip: pulumi.Input<string>;
        /**
         * Subnet mask for the additional Mist Tunnel IPv4 address
         */
        netmask: pulumi.Input<string>;
    }
    interface MxedgeTuntermPortConfig {
        /**
         * Ports connected downstream toward APs for tunnel termination
         */
        downstreamPorts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether to separate upstream / downstream ports. default is false where all ports will be used.
         */
        separateUpstreamDownstream?: pulumi.Input<boolean | undefined>;
        /**
         * Native VLAN ID applied to upstream tunnel termination ports
         */
        upstreamPortVlanId?: pulumi.Input<string | undefined>;
        /**
         * Ports connected upstream toward the LAN for tunnel termination
         */
        upstreamPorts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface MxedgeTuntermSwitchConfig {
        /**
         * Untagged VLAN ID for this tunnel termination switch port
         */
        portVlanId?: pulumi.Input<number | undefined>;
        /**
         * List of tagged VLAN IDs allowed on this tunnel termination switch port
         */
        vlanIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface MxedgeVersions {
        /**
         * Reported version of the mxagent service
         */
        mxagent?: pulumi.Input<string | undefined>;
        /**
         * Reported version of the tunnel termination service
         */
        tunterm?: pulumi.Input<string | undefined>;
    }
    interface MxtunnelAutoPreemption {
        /**
         * Scheduled weekday for auto preemption
         */
        dayOfWeek?: pulumi.Input<string | undefined>;
        /**
         * Whether auto preemption is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Scheduled time of day for auto preemption
         */
        timeOfDay?: pulumi.Input<string | undefined>;
    }
    interface MxtunnelIpsec {
        /**
         * Name server addresses advertised for IPsec tunnel clients
         */
        dnsServers?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Search suffixes advertised for IPsec tunnel clients
         */
        dnsSuffixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether IPsec support is enabled for this Mist Tunnel
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Additional routes advertised for the IPsec tunnel
         */
        extraRoutes?: pulumi.Input<pulumi.Input<inputs.org.MxtunnelIpsecExtraRoute>[] | undefined>;
        /**
         * Whether split tunneling is enabled for IPsec clients
         */
        splitTunnel?: pulumi.Input<boolean | undefined>;
        /**
         * Whether IPsec termination uses Mist Edge
         */
        useMxedge?: pulumi.Input<boolean | undefined>;
    }
    interface MxtunnelIpsecExtraRoute {
        /**
         * Route destination CIDR for the IPsec extra route
         */
        dest?: pulumi.Input<string | undefined>;
        /**
         * Route next-hop IPv4 address for the IPsec extra route
         */
        nextHop?: pulumi.Input<string | undefined>;
    }
    interface NacPortalPortal {
        /**
         * Mode presented by the NAC guest portal for user authentication
         */
        auth?: pulumi.Input<string | undefined>;
        /**
         * If `auth`==`none` or `auth`==`multi`, whether to expire the guest after a certain time
         */
        expire?: pulumi.Input<number | undefined>;
        /**
         * If `auth`==`external`, the URL to redirect the user to for authentication
         */
        externalPortalUrl?: pulumi.Input<string | undefined>;
        /**
         * Disconnect client (workaround for reauth issues)
         */
        forceReconnect?: pulumi.Input<boolean | undefined>;
        /**
         * If `auth`==`none` or `auth`==`multi`, whether to forward the user to the guest portal after authentication
         */
        forward?: pulumi.Input<boolean | undefined>;
        /**
         * If `auth`==`none` or `auth`==`multi`, URL to forward the user to after authentication
         */
        forwardUrl?: pulumi.Input<string | undefined>;
        /**
         * Maximum number of clients allowed per guest. 0 (default, unlimited), 1-100 range
         */
        maxNumDevices?: pulumi.Input<number | undefined>;
        /**
         * If `auth`==`none` or `auth`==`multi`, whether to show the privacy policy
         */
        privacy?: pulumi.Input<boolean | undefined>;
    }
    interface NacPortalSso {
        /**
         * Identity provider certificate used to verify signed SAML responses
         */
        idpCert?: pulumi.Input<string | undefined>;
        /**
         * Signing algorithm expected for SAML assertions from the identity provider
         */
        idpSignAlgo?: pulumi.Input<string | undefined>;
        /**
         * Identity provider Single Sign-On URL for SAML authentication
         */
        idpSsoUrl?: pulumi.Input<string | undefined>;
        /**
         * Identity provider issuer URL for SAML authentication
         */
        issuer?: pulumi.Input<string | undefined>;
        /**
         * SAML NameID format expected from the identity provider
         */
        nameidFormat?: pulumi.Input<string | undefined>;
        /**
         * Rules that map SSO role values from the identity provider to NAC portal roles
         */
        ssoRoleMatchings?: pulumi.Input<pulumi.Input<inputs.org.NacPortalSsoSsoRoleMatching>[] | undefined>;
        /**
         * Whether to include the matched SSO role in the issued certificate subject for later policy matching
         */
        useSsoRoleForCert?: pulumi.Input<boolean | undefined>;
    }
    interface NacPortalSsoSsoRoleMatching {
        /**
         * NAC portal role assigned when the SSO role value matches
         */
        assigned?: pulumi.Input<string | undefined>;
        /**
         * SSO role value to match from the SAML assertion
         */
        match?: pulumi.Input<string | undefined>;
    }
    interface NacruleMatching {
        /**
         * NAC authentication method that must match the request
         */
        authType?: pulumi.Input<string | undefined>;
        /**
         * Client device family values that must match the request
         */
        families?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Client device manufacturer values that must match the request
         */
        mfgs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Client device model values that must match the request
         */
        models?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * NAC tag IDs whose match criteria must be satisfied by the request
         */
        nactags?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Client OS type values that must match the request
         */
        osTypes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Wired or wireless access types that must match the request
         */
        portTypes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Site IDs where the rule criteria apply
         */
        siteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Site group IDs where the rule criteria apply
         */
        sitegroupIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Client device vendor values that must match the request
         */
        vendors?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NacruleNotMatching {
        /**
         * NAC authentication method that must match the request
         */
        authType?: pulumi.Input<string | undefined>;
        /**
         * Client device family values that must match the request
         */
        families?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Client device manufacturer values that must match the request
         */
        mfgs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Client device model values that must match the request
         */
        models?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * NAC tag IDs whose match criteria must be satisfied by the request
         */
        nactags?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Client OS type values that must match the request
         */
        osTypes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Wired or wireless access types that must match the request
         */
        portTypes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Site IDs where the rule criteria apply
         */
        siteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Site group IDs where the rule criteria apply
         */
        sitegroupIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Client device vendor values that must match the request
         */
        vendors?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworkInternalAccess {
        /**
         * Whether internal access is enabled for this network
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface NetworkInternetAccess {
        /**
         * Whether Mist should create simple service policies for restricted internet access
         */
        createSimpleServicePolicy?: pulumi.Input<boolean | undefined>;
        /**
         * Destination NAT rules for direct internet access
         */
        destinationNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.NetworkInternetAccessDestinationNat>;
        } | undefined>;
        /**
         * Whether direct internet access is enabled for this network
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * By default, all access is allowed, to only allow certain traffic, make `restricted`=`true` and define service_policies
         */
        restricted?: pulumi.Input<boolean | undefined>;
        /**
         * Static NAT rules for direct internet access
         */
        staticNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.NetworkInternetAccessStaticNat>;
        } | undefined>;
    }
    interface NetworkInternetAccessDestinationNat {
        /**
         * The Destination NAT destination IP address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
         */
        internalIp?: pulumi.Input<string | undefined>;
        /**
         * Label for this direct internet destination NAT rule
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * The Destination NAT destination IP address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}")
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity
         */
        wanName?: pulumi.Input<string | undefined>;
    }
    interface NetworkInternetAccessStaticNat {
        /**
         * The Static NAT destination IP address. Must be an IP address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
         */
        internalIp: pulumi.Input<string>;
        /**
         * Label for this direct internet static NAT rule
         */
        name: pulumi.Input<string>;
        /**
         * SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}")
         */
        wanName?: pulumi.Input<string | undefined>;
    }
    interface NetworkMulticast {
        /**
         * If the network will only be the source of the multicast traffic, IGMP can be disabled
         */
        disableIgmp?: pulumi.Input<boolean | undefined>;
        /**
         * Whether multicast support is enabled for this network
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Multicast group-to-RP mappings for this network
         */
        groups?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.NetworkMulticastGroups>;
        } | undefined>;
    }
    interface NetworkMulticastGroups {
        /**
         * RP (rendezvous point) IP address
         */
        rpIp?: pulumi.Input<string | undefined>;
    }
    interface NetworkTenants {
        /**
         * IP addresses or subnets assigned to this tenant in the network
         */
        addresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworkVpnAccess {
        /**
         * If `routed`==`true`, whether to advertise an aggregated subnet toward HUB this is useful when there are multiple networks on SPOKE's side
         */
        advertisedSubnet?: pulumi.Input<string | undefined>;
        /**
         * Whether to allow ping from vpn into this routed network
         */
        allowPing?: pulumi.Input<boolean | undefined>;
        /**
         * Destination NAT rules applied for VPN access to this network
         */
        destinationNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.NetworkVpnAccessDestinationNat>;
        } | undefined>;
        /**
         * If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub, a subnet is required to create and advertise the route to Hub
         */
        natPool?: pulumi.Input<string | undefined>;
        /**
         * toward LAN-side BGP peers
         */
        noReadvertiseToLanBgp?: pulumi.Input<boolean | undefined>;
        /**
         * toward LAN-side OSPF peers
         */
        noReadvertiseToLanOspf?: pulumi.Input<boolean | undefined>;
        /**
         * toward overlay, how HUB should deal with routes it received from Spokes
         */
        noReadvertiseToOverlay?: pulumi.Input<boolean | undefined>;
        /**
         * Other VRFs that can receive leaked routes from this spoke network
         */
        otherVrfs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether this network is routable
         */
        routed?: pulumi.Input<boolean | undefined>;
        /**
         * Source NAT settings used when non-routed spoke hosts must be reachable from the hub
         */
        sourceNat?: pulumi.Input<inputs.org.NetworkVpnAccessSourceNat | undefined>;
        /**
         * Static NAT rules applied for VPN access to this network
         */
        staticNat?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.NetworkVpnAccessStaticNat>;
        } | undefined>;
        /**
         * toward overlay, how HUB should deal with routes it received from Spokes
         */
        summarizedSubnet?: pulumi.Input<string | undefined>;
        /**
         * toward LAN-side BGP peers
         */
        summarizedSubnetToLanBgp?: pulumi.Input<string | undefined>;
        /**
         * toward LAN-side OSPF peers
         */
        summarizedSubnetToLanOspf?: pulumi.Input<string | undefined>;
    }
    interface NetworkVpnAccessDestinationNat {
        /**
         * The Destination NAT destination IP address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
         */
        internalIp?: pulumi.Input<string | undefined>;
        /**
         * Label for this VPN destination NAT rule
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Destination port or variable for this VPN destination NAT rule
         */
        port?: pulumi.Input<string | undefined>;
    }
    interface NetworkVpnAccessSourceNat {
        /**
         * External source NAT IP or subnet used when spoke hosts must be reachable from the hub
         */
        externalIp?: pulumi.Input<string | undefined>;
    }
    interface NetworkVpnAccessStaticNat {
        /**
         * The Static NAT destination IP address. Must be an IP address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
         */
        internalIp: pulumi.Input<string>;
        /**
         * Label for this VPN static NAT rule
         */
        name: pulumi.Input<string>;
    }
    interface NetworktemplateAclPolicy {
        /**
         * Destination tag actions evaluated for sources matching this ACL policy
         */
        actions?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateAclPolicyAction>[] | undefined>;
        /**
         * Display name of the ACL policy
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Source ACL tags that select traffic for this ACL policy
         */
        srcTags?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateAclPolicyAction {
        /**
         * Allow or deny decision applied to traffic matching the destination tag
         */
        action?: pulumi.Input<string | undefined>;
        /**
         * Destination ACL tag matched by this policy action
         */
        dstTag: pulumi.Input<string>;
    }
    interface NetworktemplateAclTags {
        /**
         * Layer 2 EtherTypes matched by this ACL tag; defaults to `any`
         */
        etherTypes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Required if
         *   - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
         *   - `type`==`gbpResource`
         *   - `type`==`staticGbp` (applying gbp tag against matching conditions)
         */
        gbpTag?: pulumi.Input<number | undefined>;
        /**
         * Client or resource MAC addresses matched by this ACL tag
         */
        macs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If:
         *   * `type`==`mac` (optional. default is `any`)
         *   * `type`==`subnet` (optional. default is `any`)
         *   * `type`==`network`
         *   * `type`==`resource` (optional. default is `any`)
         *   * `type`==`staticGbp` if from matching network (vlan)
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Required if `type`==`portUsage`. Switch port usage name matched by this ACL tag
         */
        portUsage?: pulumi.Input<string | undefined>;
        /**
         * Required if:
         *   * `type`==`radiusGroup`
         *   * `type`==`staticGbp`
         * if from matching radius_group
         */
        radiusGroup?: pulumi.Input<string | undefined>;
        /**
         * Layer 4 protocol and destination-port constraints for this ACL tag
         */
        specs?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateAclTagsSpec>[] | undefined>;
        /**
         * IP subnets matched by this ACL tag
         */
        subnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Classifier type that determines which ACL tag fields are evaluated
         */
        type: pulumi.Input<string>;
    }
    interface NetworktemplateAclTagsSpec {
        /**
         * Matched dst port, "0" means any
         */
        portRange?: pulumi.Input<string | undefined>;
        /**
         * `tcp` / `udp` / `icmp` / `icmp6` / `gre` / `any` / `:protocol_number`, `protocolNumber` is between 1-254, default is `any` `protocolNumber` is between 1-254
         */
        protocol?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateBgpConfig {
        /**
         * Authentication key used for BGP neighbor sessions, when configured
         */
        authKey?: pulumi.Input<string | undefined>;
        /**
         * Minimum interval in milliseconds for BFD hello packets. A neighbor is considered failed when the device stops receiving replies after the specified interval. Value must be between 1 and 255000.
         */
        bfdMinimumInterval?: pulumi.Input<number | undefined>;
        /**
         * Export policy must match one of the policy names defined in the `routingPolicies` property.
         */
        exportPolicy?: pulumi.Input<string | undefined>;
        /**
         * Default BGP hold time for switch BGP sessions
         */
        holdTime?: pulumi.Input<number | undefined>;
        /**
         * Import policy must match one of the policy names defined in the `routingPolicies` property.
         */
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * Local BGP Autonomous System (AS) number for the switch
         */
        localAs: pulumi.Input<string>;
        /**
         * BGP neighbor settings keyed by neighbor IP address
         */
        neighbors?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.NetworktemplateBgpConfigNeighbors>;
        } | undefined>;
        /**
         * Network names used to add BGP groups to the corresponding VRFs
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP session type for this switch BGP configuration
         */
        type: pulumi.Input<string>;
    }
    interface NetworktemplateBgpConfigNeighbors {
        /**
         * Export policy must match one of the policy names defined in the `routingPolicies` property.
         */
        exportPolicy?: pulumi.Input<string | undefined>;
        /**
         * BGP hold time for this neighbor
         */
        holdTime?: pulumi.Input<number | undefined>;
        /**
         * Import policy must match one of the policy names defined in the `routingPolicies` property.
         */
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * Time-to-live value for multihop BGP sessions to this neighbor
         */
        multihopTtl?: pulumi.Input<number | undefined>;
        /**
         * Autonomous System (AS) number of the BGP neighbor. For internal BGP, this must match `localAs`. For external BGP, this must differ from `localAs`.
         */
        neighborAs: pulumi.Input<string>;
    }
    interface NetworktemplateDhcpSnooping {
        /**
         * Whether DHCP snooping applies to all configured networks
         */
        allNetworks?: pulumi.Input<boolean | undefined>;
        /**
         * Enable for dynamic ARP inspection check
         */
        enableArpSpoofCheck?: pulumi.Input<boolean | undefined>;
        /**
         * Enable for check for forging source IP address
         */
        enableIpSourceGuard?: pulumi.Input<boolean | undefined>;
        /**
         * Whether DHCP snooping is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Network names with DHCP snooping enabled when `allNetworks`==`false`
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateExtraRoutes {
        /**
         * Whether to install a discard route; this takes precedence over next-hop settings
         */
        discard?: pulumi.Input<boolean | undefined>;
        /**
         * Route metric for the IPv4 static route
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * Qualified next-hop settings keyed by IPv4 next-hop address
         */
        nextQualified?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.NetworktemplateExtraRoutesNextQualified>;
        } | undefined>;
        /**
         * Whether to prevent recursive next-hop resolution for the IPv4 static route
         */
        noResolve?: pulumi.Input<boolean | undefined>;
        /**
         * Route preference for the IPv4 static route
         */
        preference?: pulumi.Input<number | undefined>;
        /**
         * Next-hop IPv4 address or ECMP next-hop IPv4 addresses for the route
         */
        via: pulumi.Input<string>;
    }
    interface NetworktemplateExtraRoutes6 {
        /**
         * Whether to install a discard route; this takes precedence over next-hop settings
         */
        discard?: pulumi.Input<boolean | undefined>;
        /**
         * Route metric for the IPv6 static route
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * Qualified next-hop settings keyed by IPv6 next-hop address
         */
        nextQualified?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.NetworktemplateExtraRoutes6NextQualified>;
        } | undefined>;
        /**
         * Whether to prevent recursive next-hop resolution for the IPv6 static route
         */
        noResolve?: pulumi.Input<boolean | undefined>;
        /**
         * Route preference for the IPv6 static route
         */
        preference?: pulumi.Input<number | undefined>;
        /**
         * Next-hop IPv6 address or ECMP next-hop IPv6 addresses for the route
         */
        via: pulumi.Input<string>;
    }
    interface NetworktemplateExtraRoutes6NextQualified {
        /**
         * Route metric for this qualified IPv6 next hop
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * Route preference for this qualified IPv6 next hop
         */
        preference?: pulumi.Input<number | undefined>;
    }
    interface NetworktemplateExtraRoutesNextQualified {
        /**
         * Route metric for this qualified IPv4 next hop
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * Route preference for this qualified IPv4 next hop
         */
        preference?: pulumi.Input<number | undefined>;
    }
    interface NetworktemplateMistNac {
        /**
         * Whether Mist NAC RadSec is enabled for the switch
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Switch network used for Mist NAC RadSec connectivity
         */
        network?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateNetworks {
        /**
         * Only required for EVPN-VXLAN networks, IPv4 Virtual Gateway
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Only required for EVPN-VXLAN networks, IPv6 Virtual Gateway
         */
        gateway6?: pulumi.Input<string | undefined>;
        /**
         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required). NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set. See also `interIsolationNetworkLink` and `communityVlanId` in port_usage
         */
        isolation?: pulumi.Input<boolean | undefined>;
        /**
         * Required when `isolation`==`true`. Unique VLAN ID used for client isolation
         */
        isolationVlanId?: pulumi.Input<string | undefined>;
        /**
         * Optional for pure switching, required when L3 / routing features are used
         */
        subnet?: pulumi.Input<string | undefined>;
        /**
         * Optional for pure switching, required when L3 / routing features are used
         */
        subnet6?: pulumi.Input<string | undefined>;
        /**
         * VLAN identifier for this switch network
         */
        vlanId: pulumi.Input<string>;
    }
    interface NetworktemplateOspfAreas {
        /**
         * Whether loopback interfaces are included in this OSPF area
         */
        includeLoopback?: pulumi.Input<boolean | undefined>;
        /**
         * OSPF network settings keyed by network name
         */
        networks: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.NetworktemplateOspfAreasNetworks>;
        }>;
        /**
         * Area type for this OSPF area
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateOspfAreasNetworks {
        /**
         * Required if `authType`==`md5`. Property key is the key number
         */
        authKeys?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
        /**
         * Required if `authType`==`password`, the password, max length is 8
         */
        authPassword?: pulumi.Input<string | undefined>;
        /**
         * Authentication method used by this OSPF network
         */
        authType?: pulumi.Input<string | undefined>;
        /**
         * Minimum BFD interval for this OSPF network, in milliseconds
         */
        bfdMinimumInterval?: pulumi.Input<number | undefined>;
        /**
         * OSPF dead interval for this network, in seconds
         */
        deadInterval?: pulumi.Input<number | undefined>;
        /**
         * Routing policy used to export routes from this OSPF network
         */
        exportPolicy?: pulumi.Input<string | undefined>;
        /**
         * OSPF hello interval for this network, in seconds
         */
        helloInterval?: pulumi.Input<number | undefined>;
        /**
         * Routing policy used to import routes for this OSPF network
         */
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * OSPF interface type used for this network
         */
        interfaceType?: pulumi.Input<string | undefined>;
        /**
         * OSPF metric assigned to this network
         */
        metric?: pulumi.Input<number | undefined>;
        /**
         * By default, we'll re-advertise all learned OSPF routes toward overlay
         */
        noReadvertiseToOverlay?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to send OSPF-Hello
         */
        passive?: pulumi.Input<boolean | undefined>;
    }
    interface NetworktemplatePortMirroring {
        /**
         * At least one mirror input source should be specified. Networks whose ingress traffic is mirrored
         */
        inputNetworksIngresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * At least one mirror input source should be specified. Switch ports whose egress traffic is mirrored
         */
        inputPortIdsEgresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * At least one mirror input source should be specified. Switch ports whose ingress traffic is mirrored
         */
        inputPortIdsIngresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputIpAddress?: pulumi.Input<string | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputNetwork?: pulumi.Input<string | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputPortId?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplatePortUsages {
        /**
         * Only if `mode`==`trunk`. Whether to trunk all network/vlans
         */
        allNetworks?: pulumi.Input<boolean | undefined>;
        /**
         * Only applies when `mode`!=`dynamic`. Controls whether DHCP server traffic is allowed on ports using this configuration if DHCP snooping is enabled. This is a tri-state setting; `true`: ports become trusted ports allowing DHCP server traffic, `false`: ports become untrusted blocking DHCP server traffic, undefined: use system defaults (access ports default to untrusted, trunk ports default to trusted).
         */
        allowDhcpd?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        allowMultipleSupplicants?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Bypass auth for known clients if set to true when RADIUS server is down
         */
        bypassAuthWhenServerDown?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`=`dot1x`. Bypass auth for all (including unknown clients) if set to true when RADIUS server is down
         */
        bypassAuthWhenServerDownForUnknownClient?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Bypass auth for VOIP if set to true when RADIUS server is down
         */
        bypassAuthWhenServerDownForVoip?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. To be used together with `isolation` under networks. Signaling that this port connects to the networks isolated but wired clients belong to the same community can talk to each other
         */
        communityVlanId?: pulumi.Input<number | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. If speed and duplex are specified, whether to disable autonegotiation
         */
        disableAutoneg?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether the port is disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Link duplex mode for this port usage
         */
        duplex?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Networks or VLANs that RADIUS can return for dynamic VLAN assignment
         */
        dynamicVlanNetworks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Whether to enable MAC Auth
         */
        enableMacAuth?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        enableQos?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Which network to put the device into if the device cannot do dot1x. default is null (i.e. not allowed)
         */
        guestNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. `interIsolationNetworkLink` is used together with `isolation` under networks, signaling that this port connects to isolated networks
         */
        interIsolationNetworkLink?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. `interSwitchLink` is used together with `isolation` under networks. NOTE: `interSwitchLink` works only between Juniper devices. This has to be applied to both ports connected together
         */
        interSwitchLink?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `enableMacAuth`==`true`
         */
        macAuthOnly?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` + `enableMacAuth`==`true` + `macAuthOnly`==`false`, dot1x will be given priority then mac_auth. Enable this to prefer macAuth over dot1x.
         */
        macAuthPreferred?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `enableMacAuth`==`true`. MAC authentication protocol to use; ignored if Mist NAC is enabled
         */
        macAuthProtocol?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` max number of mac addresses, default is 0 for unlimited, otherwise range is 1 to 16383 (upper bound constrained by platform)
         */
        macLimit?: pulumi.Input<string | undefined>;
        /**
         * Switching mode for this port usage
         */
        mode?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation. Value between 256 and 9216, default value is 1514.
         */
        mtu?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`==`trunk`. Network or VLAN names to trunk
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Only if `mode`==`access` and `portAuth`!=`dot1x`. Whether the port should retain dynamically learned MAC addresses
         */
        persistMac?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether PoE capabilities are disabled for a port
         */
        poeDisabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether Perpetual PoE is enabled; keeps PoE state across reboots
         */
        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. PoE priority for ports using this port usage
         */
        poePriority?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. 802.1X authentication mode for this port usage
         */
        portAuth?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Native network/vlan for untagged traffic
         */
        portNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`=`dot1x` reauthentication interval range between 10 and 65535 (default: 3600)
         */
        reauthInterval?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`==`dynamic`. Condition that resets a dynamic port to the default port usage
         */
        resetDefaultWhen?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`==`dynamic`. Dynamic matching rules that select the port usage to apply
         */
        rules?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplatePortUsagesRule>[] | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Sets server fail fallback vlan
         */
        serverFailNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Interval, in seconds. Sets the wait time before retrying authentication after RADIUS failure to reduce client flapping. Range 120-65535
         */
        serverFailRetryInterval?: pulumi.Input<number | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. When RADIUS server reject / fails
         */
        serverRejectNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Link speed for this port usage
         */
        speed?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Storm-control settings for this port usage
         */
        stormControl?: pulumi.Input<inputs.org.NetworktemplatePortUsagesStormControl | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `stpRequired`==`false`. Drop bridge protocol data units (BPDUs ) that enter any interface or a specified interface
         */
        stpDisable?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. When enabled, the port is not expected to receive BPDU frames
         */
        stpEdge?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        stpNoRootPort?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        stpP2p?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether to remain in block state if no BPDU is received
         */
        stpRequired?: pulumi.Input<boolean | undefined>;
        /**
         * Optional for Campus Fabric Core-Distribution ESI-LAG profile. Helper used by the UI to select this port profile as the ESI-Lag between Distribution and Access switches
         */
        uiEvpntopoId?: pulumi.Input<string | undefined>;
        /**
         * If this is connected to a vstp network
         */
        useVstp?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Network/vlan for voip traffic, must also set port_network. to authenticate device, set port_auth
         */
        voipNetwork?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplatePortUsagesRule {
        /**
         * Optional description of the rule
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Exact value that the selected source attribute must match
         */
        equals?: pulumi.Input<string | undefined>;
        /**
         * List of values where any match satisfies this dynamic rule
         */
        equalsAnies?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * "[0:3]":"abcdef" > "abc"
         * "split(.)[1]": "a.b.c" > "b"
         * "split(-)[1][0:3]: "a1234-b5678-c90" > "b56"
         */
        expression?: pulumi.Input<string | undefined>;
        /**
         * Source attribute evaluated by this dynamic rule
         */
        src: pulumi.Input<string>;
        /**
         * Port usage name to apply when this dynamic rule matches
         */
        usage?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplatePortUsagesStormControl {
        /**
         * Whether to disable the port when storm control is triggered
         */
        disablePort?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on broadcast traffic
         */
        noBroadcast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on multicast traffic
         */
        noMulticast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on registered multicast traffic
         */
        noRegisteredMulticast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on unknown unicast traffic
         */
        noUnknownUnicast?: pulumi.Input<boolean | undefined>;
        /**
         * Bandwidth-percentage, configures the storm control level as a percentage of the available bandwidth
         */
        percentage?: pulumi.Input<number | undefined>;
    }
    interface NetworktemplateRadiusConfig {
        /**
         * Whether immediate RADIUS accounting updates are sent
         */
        acctImmediateUpdate?: pulumi.Input<boolean | undefined>;
        /**
         * How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled
         */
        acctInterimInterval?: pulumi.Input<number | undefined>;
        /**
         * RADIUS accounting servers used by this switch configuration
         */
        acctServers?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateRadiusConfigAcctServer>[] | undefined>;
        /**
         * Selection strategy for RADIUS authentication servers
         */
        authServerSelection?: pulumi.Input<string | undefined>;
        /**
         * RADIUS authentication servers used by this switch configuration
         */
        authServers?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateRadiusConfigAuthServer>[] | undefined>;
        /**
         * RADIUS auth session retries
         */
        authServersRetries?: pulumi.Input<number | undefined>;
        /**
         * RADIUS auth session timeout
         */
        authServersTimeout?: pulumi.Input<number | undefined>;
        /**
         * Whether RADIUS Change of Authorization (CoA) is enabled
         */
        coaEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * UDP port used for RADIUS Change of Authorization (CoA)
         */
        coaPort?: pulumi.Input<string | undefined>;
        /**
         * Whether fast 802.1X timers are enabled for RADIUS authentication
         */
        fastDot1xTimers?: pulumi.Input<boolean | undefined>;
        /**
         * Use `network`or `sourceIp`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Use `network` or `sourceIp`. Explicit source IP address for RADIUS traffic
         */
        sourceIp?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRadiusConfigAcctServer {
        /**
         * Address or hostname of the RADIUS accounting server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this accounting server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS accounting server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used with this RADIUS accounting server
         */
        secret: pulumi.Input<string>;
    }
    interface NetworktemplateRadiusConfigAuthServer {
        /**
         * Address or hostname of the RADIUS authentication server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this authentication server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS authentication server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Whether to require Message-Authenticator in requests
         */
        requireMessageAuthenticator?: pulumi.Input<boolean | undefined>;
        /**
         * Shared secret used with this RADIUS authentication server
         */
        secret: pulumi.Input<string>;
    }
    interface NetworktemplateRemoteSyslog {
        /**
         * Retention settings for generated syslog archive files
         */
        archive?: pulumi.Input<inputs.org.NetworktemplateRemoteSyslogArchive | undefined>;
        /**
         * CA certificates used to verify TLS syslog servers
         */
        cacerts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Log forwarding filters for console messages sent to remote syslog
         */
        console?: pulumi.Input<inputs.org.NetworktemplateRemoteSyslogConsole | undefined>;
        /**
         * Whether remote syslog forwarding is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Local syslog file definitions to generate and forward
         */
        files?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateRemoteSyslogFile>[] | undefined>;
        /**
         * Source network used for syslog traffic. If `sourceAddress` is configured, Mist uses the VLAN first; otherwise it uses `sourceIp`
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Whether each log entry is sent to all configured remote syslog servers
         */
        sendToAllServers?: pulumi.Input<boolean | undefined>;
        /**
         * Remote syslog server destinations
         */
        servers?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateRemoteSyslogServer>[] | undefined>;
        /**
         * Timestamp format used in forwarded syslog messages
         */
        timeFormat?: pulumi.Input<string | undefined>;
        /**
         * User-specific syslog logging rules
         */
        users?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateRemoteSyslogUser>[] | undefined>;
    }
    interface NetworktemplateRemoteSyslogArchive {
        /**
         * Number of archived syslog files to retain
         */
        files?: pulumi.Input<string | undefined>;
        /**
         * Maximum size of each archived syslog file, such as 5m
         */
        size?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRemoteSyslogConsole {
        /**
         * Syslog facilities and severities forwarded from console logs
         */
        contents?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateRemoteSyslogConsoleContent>[] | undefined>;
    }
    interface NetworktemplateRemoteSyslogConsoleContent {
        /**
         * Syslog facility to match for this selector
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Syslog severity to match for this selector
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRemoteSyslogFile {
        /**
         * Retention settings for this generated syslog file
         */
        archive?: pulumi.Input<inputs.org.NetworktemplateRemoteSyslogFileArchive | undefined>;
        /**
         * Syslog facilities and severities written to this file
         */
        contents?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateRemoteSyslogFileContent>[] | undefined>;
        /**
         * Only if `protocol`==`tcp`, enable TLS for this syslog file destination
         */
        enableTls?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to include explicit syslog priority values in file output
         */
        explicitPriority?: pulumi.Input<boolean | undefined>;
        /**
         * Generated syslog file name
         */
        file?: pulumi.Input<string | undefined>;
        /**
         * Expression used to filter log messages written to this file
         */
        match?: pulumi.Input<string | undefined>;
        /**
         * Whether to include structured syslog data in file output
         */
        structuredData?: pulumi.Input<boolean | undefined>;
    }
    interface NetworktemplateRemoteSyslogFileArchive {
        /**
         * Number of archived syslog files to retain
         */
        files?: pulumi.Input<string | undefined>;
        /**
         * Maximum size of each archived syslog file, such as 5m
         */
        size?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRemoteSyslogFileContent {
        /**
         * Syslog facility to match for this selector
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Syslog severity to match for this selector
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRemoteSyslogServer {
        /**
         * Syslog facilities and severities sent to this server
         */
        contents?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateRemoteSyslogServerContent>[] | undefined>;
        /**
         * Whether to include explicit syslog priority values in messages sent to this server
         */
        explicitPriority?: pulumi.Input<boolean | undefined>;
        /**
         * Default syslog facility for messages sent to this server
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Address or hostname of the remote syslog server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * Expression used to filter log messages sent to this server
         */
        match?: pulumi.Input<string | undefined>;
        /**
         * Network port used by the remote syslog server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Transport protocol used for this remote syslog server
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Routing instance used to reach this remote syslog server
         */
        routingInstance?: pulumi.Input<string | undefined>;
        /**
         * TLS server name used when verifying the remote syslog server certificate
         */
        serverName?: pulumi.Input<string | undefined>;
        /**
         * Default syslog severity for messages sent to this server
         */
        severity?: pulumi.Input<string | undefined>;
        /**
         * Source address for syslog traffic. If configured, Mist uses the VLAN first; otherwise it uses `sourceIp`
         */
        sourceAddress?: pulumi.Input<string | undefined>;
        /**
         * Whether to include structured syslog data in messages sent to this server
         */
        structuredData?: pulumi.Input<boolean | undefined>;
        /**
         * Syslog tag value added to messages sent to this server
         */
        tag?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRemoteSyslogServerContent {
        /**
         * Syslog facility to match for this selector
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Syslog severity to match for this selector
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRemoteSyslogUser {
        /**
         * Syslog facilities and severities logged for this user rule
         */
        contents?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateRemoteSyslogUserContent>[] | undefined>;
        /**
         * Expression used to filter user log messages
         */
        match?: pulumi.Input<string | undefined>;
        /**
         * Account name or wildcard matched by this syslog rule
         */
        user?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRemoteSyslogUserContent {
        /**
         * Syslog facility to match for this selector
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * Syslog severity to match for this selector
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRoutingPolicies {
        /**
         * Ordered terms evaluated by this switch routing policy
         */
        terms?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateRoutingPoliciesTerm>[] | undefined>;
    }
    interface NetworktemplateRoutingPoliciesTerm {
        /**
         * Policy actions applied when this routing policy term matches
         */
        actions?: pulumi.Input<inputs.org.NetworktemplateRoutingPoliciesTermActions | undefined>;
        /**
         * Route match criteria that must be satisfied before actions are applied
         */
        matching?: pulumi.Input<inputs.org.NetworktemplateRoutingPoliciesTermMatching | undefined>;
        /**
         * Display name of the switch routing policy term
         */
        name: pulumi.Input<string>;
    }
    interface NetworktemplateRoutingPoliciesTermActions {
        /**
         * Whether to accept routes that match this term
         */
        accept?: pulumi.Input<boolean | undefined>;
        /**
         * BGP communities to set when this term is used as an export policy
         */
        communities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Optional, for an import policy, localPreference can be changed, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}`)
         */
        localPreference?: pulumi.Input<string | undefined>;
        /**
         * AS path values to prepend when this term is used as an export policy
         */
        prependAsPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateRoutingPoliciesTermMatching {
        /**
         * BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}`)
         */
        asPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * BGP communities that routes must match
         */
        communities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Route prefixes that routes must match
         */
        prefixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * enum: `bgp`, `direct`, `evpn`, `ospf`, `static`
         */
        protocols?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateSnmpConfig {
        /**
         * SNMP client allowlists that can be referenced by communities
         */
        clientLists?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSnmpConfigClientList>[] | undefined>;
        /**
         * Administrative contact string advertised through SNMP
         */
        contact?: pulumi.Input<string | undefined>;
        /**
         * Device description string advertised through SNMP
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Whether SNMP is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * SNMP engine ID used for SNMPv3
         */
        engineId?: pulumi.Input<string | undefined>;
        /**
         * Method used to derive the SNMP engine ID
         */
        engineIdType?: pulumi.Input<string | undefined>;
        /**
         * Physical location string advertised through SNMP
         */
        location?: pulumi.Input<string | undefined>;
        /**
         * System name advertised through SNMP
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Management network used for SNMP traffic
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * SNMP trap group definitions
         */
        trapGroups?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSnmpConfigTrapGroup>[] | undefined>;
        /**
         * SNMPv2c community configuration entries for this SNMP profile
         */
        v2cConfigs?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSnmpConfigV2cConfig>[] | undefined>;
        /**
         * SNMPv3 user, VACM, notify, and target configuration
         */
        v3Config?: pulumi.Input<inputs.org.NetworktemplateSnmpConfigV3Config | undefined>;
        /**
         * SNMP MIB view definitions
         */
        views?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSnmpConfigView>[] | undefined>;
    }
    interface NetworktemplateSnmpConfigClientList {
        /**
         * Name of the SNMP client list
         */
        clientListName?: pulumi.Input<string | undefined>;
        /**
         * SNMP client IP addresses or CIDR ranges allowed by this list
         */
        clients?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateSnmpConfigTrapGroup {
        /**
         * Trap categories included in this SNMP trap group
         */
        categories?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Trap group name for this SNMP trap group
         */
        groupName?: pulumi.Input<string | undefined>;
        /**
         * Trap target addresses for this SNMP trap group
         */
        targets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * SNMP trap protocol version used by this group
         */
        version?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV2cConfig {
        /**
         * Access level for the SNMPv2c community
         */
        authorization?: pulumi.Input<string | undefined>;
        /**
         * SNMP client list name referenced by this community
         */
        clientListName?: pulumi.Input<string | undefined>;
        /**
         * SNMPv2c community string name
         */
        communityName?: pulumi.Input<string | undefined>;
        /**
         * SNMP view name that must be defined in the views list
         */
        view?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV3Config {
        /**
         * SNMPv3 notification definitions used for traps and informs
         */
        notifies?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSnmpConfigV3ConfigNotify>[] | undefined>;
        /**
         * SNMPv3 notification filter profiles
         */
        notifyFilters?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSnmpConfigV3ConfigNotifyFilter>[] | undefined>;
        /**
         * SNMPv3 notification target addresses
         */
        targetAddresses?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSnmpConfigV3ConfigTargetAddress>[] | undefined>;
        /**
         * SNMPv3 target parameter profiles
         */
        targetParameters?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSnmpConfigV3ConfigTargetParameter>[] | undefined>;
        /**
         * SNMPv3 USM engine configurations
         */
        usms?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSnmpConfigV3ConfigUsm>[] | undefined>;
        /**
         * SNMPv3 VACM access control configuration
         */
        vacm?: pulumi.Input<inputs.org.NetworktemplateSnmpConfigV3ConfigVacm | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigNotify {
        /**
         * Identifier for this SNMPv3 notification definition
         */
        name: pulumi.Input<string>;
        /**
         * Notification tag used to select target addresses
         */
        tag: pulumi.Input<string>;
        /**
         * Delivery mode for this SNMPv3 notification, such as trap or inform
         */
        type: pulumi.Input<string>;
    }
    interface NetworktemplateSnmpConfigV3ConfigNotifyFilter {
        /**
         * OID filter rules in this notification filter profile
         */
        contents?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSnmpConfigV3ConfigNotifyFilterContent>[] | undefined>;
        /**
         * Notification filter profile name
         */
        profileName?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigNotifyFilterContent {
        /**
         * Whether the matching OID subtree is included
         */
        include?: pulumi.Input<boolean | undefined>;
        /**
         * Matched OID subtree for this notification filter rule
         */
        oid: pulumi.Input<string>;
    }
    interface NetworktemplateSnmpConfigV3ConfigTargetAddress {
        /**
         * IP address or hostname of the SNMP target
         */
        address: pulumi.Input<string>;
        /**
         * Mask applied to the SNMP target address
         */
        addressMask: pulumi.Input<string>;
        /**
         * UDP port used by the SNMP target
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Set of notification tags for this target address; use spaces between multiple tags
         */
        tagList?: pulumi.Input<string | undefined>;
        /**
         * Name of the SNMP target address entry
         */
        targetAddressName: pulumi.Input<string>;
        /**
         * Target parameter profile referenced by this target address
         */
        targetParameters?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigTargetParameter {
        /**
         * SNMP message processing model used by this target parameter profile
         */
        messageProcessingModel: pulumi.Input<string>;
        /**
         * Target parameter profile name
         */
        name: pulumi.Input<string>;
        /**
         * Notification filter profile referenced by this target parameter profile
         */
        notifyFilter?: pulumi.Input<string | undefined>;
        /**
         * Required security level for this target parameter profile
         */
        securityLevel?: pulumi.Input<string | undefined>;
        /**
         * Required security model for this target parameter profile
         */
        securityModel?: pulumi.Input<string | undefined>;
        /**
         * USM security name referenced by this target parameter profile
         */
        securityName?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigUsm {
        /**
         * SNMP engine type used for this USM configuration
         */
        engineType: pulumi.Input<string>;
        /**
         * Required only if `engineType`==`remoteEngine`
         */
        remoteEngineId?: pulumi.Input<string | undefined>;
        /**
         * SNMPv3 USM users for this engine
         */
        users?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSnmpConfigV3ConfigUsmUser>[] | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigUsmUser {
        /**
         * Not required if `authenticationType`==`authentication-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters.
         */
        authenticationPassword?: pulumi.Input<string | undefined>;
        /**
         * Authentication protocol used by this SNMPv3 USM user
         */
        authenticationType?: pulumi.Input<string | undefined>;
        /**
         * Not required if `encryptionType`==`privacy-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters
         */
        encryptionPassword?: pulumi.Input<string | undefined>;
        /**
         * Privacy protocol used by this SNMPv3 USM user
         */
        encryptionType?: pulumi.Input<string | undefined>;
        /**
         * Username for the SNMPv3 USM user
         */
        name?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigVacm {
        /**
         * VACM access rules for SNMPv3
         */
        accesses?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSnmpConfigV3ConfigVacmAccess>[] | undefined>;
        /**
         * VACM security-name to group mappings
         */
        securityToGroup?: pulumi.Input<inputs.org.NetworktemplateSnmpConfigV3ConfigVacmSecurityToGroup | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigVacmAccess {
        /**
         * SNMP VACM group name
         */
        groupName?: pulumi.Input<string | undefined>;
        /**
         * Context prefix rules for this VACM group
         */
        prefixLists?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSnmpConfigV3ConfigVacmAccessPrefixList>[] | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigVacmAccessPrefixList {
        /**
         * Context prefix for this VACM access rule. Required only if `type`==`contextPrefix`
         */
        contextPrefix?: pulumi.Input<string | undefined>;
        /**
         * Notify view name referenced by this VACM access rule
         */
        notifyView?: pulumi.Input<string | undefined>;
        /**
         * Read view name referenced by this VACM access rule
         */
        readView?: pulumi.Input<string | undefined>;
        /**
         * Required security level for this VACM access rule
         */
        securityLevel?: pulumi.Input<string | undefined>;
        /**
         * Required security model for this VACM access rule
         */
        securityModel?: pulumi.Input<string | undefined>;
        /**
         * VACM context matching type for this access rule
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Write view name referenced by this VACM access rule
         */
        writeView?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigVacmSecurityToGroup {
        /**
         * VACM security-name to group mapping entries
         */
        contents?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSnmpConfigV3ConfigVacmSecurityToGroupContent>[] | undefined>;
        /**
         * Required security model for these VACM group mappings
         */
        securityModel?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigVacmSecurityToGroupContent {
        /**
         * VACM group name referenced by this mapping
         */
        group?: pulumi.Input<string | undefined>;
        /**
         * Name of the SNMP security principal mapped to a VACM group
         */
        securityName?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigView {
        /**
         * Whether the root OID is included in this SNMP view
         */
        include?: pulumi.Input<boolean | undefined>;
        /**
         * Root OID for this SNMP view
         */
        oid?: pulumi.Input<string | undefined>;
        /**
         * Name of the SNMP MIB view definition
         */
        viewName?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSwitchMatching {
        /**
         * Whether custom switch matching rules are enabled
         */
        enable?: pulumi.Input<boolean | undefined>;
        /**
         * list of rules to define custom switch configuration based on different criteria. Each list must have at least one of `matchModel`, `matchName` or `matchRole` must be defined
         */
        rules?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSwitchMatchingRule>[] | undefined>;
    }
    interface NetworktemplateSwitchMatchingRule {
        /**
         * Additional Junos CLI commands applied when this matching rule matches
         */
        additionalConfigCmds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Port usage to assign to switch ports without any port usage assigned. Default: `default` to preserve default behavior
         */
        defaultPortUsage?: pulumi.Input<string | undefined>;
        /**
         * In-band management IP configuration applied when this matching rule matches
         */
        ipConfig?: pulumi.Input<inputs.org.NetworktemplateSwitchMatchingRuleIpConfig | undefined>;
        /**
         * string the switch model must start with to use this rule. It is possible to combine with the `matchName` and `matchRole` attributes
         */
        matchModel?: pulumi.Input<string | undefined>;
        /**
         * string the switch name must start with to use this rule. Use the `matchNameOffset` to indicate the first character of the switch name to compare to. It is possible to combine with the `matchModel` and `matchRole` attributes
         */
        matchName?: pulumi.Input<string | undefined>;
        /**
         * first character of the switch name to compare to the `matchName` value
         */
        matchNameOffset?: pulumi.Input<number | undefined>;
        /**
         * string the switch role must start with to use this rule. It is possible to combine with the `matchName` and `matchModel` attributes
         */
        matchRole?: pulumi.Input<string | undefined>;
        /**
         * Rule name. WARNING: the name `default` is reserved and can only be used for the last rule in the list
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Out-of-band management IP configuration applied when this matching rule matches
         */
        oobIpConfig?: pulumi.Input<inputs.org.NetworktemplateSwitchMatchingRuleOobIpConfig | undefined>;
        /**
         * Per-port wired configuration applied when this matching rule matches
         */
        portConfig?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.NetworktemplateSwitchMatchingRulePortConfig>;
        } | undefined>;
        /**
         * Port mirroring configuration applied when this matching rule matches
         */
        portMirroring?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.NetworktemplateSwitchMatchingRulePortMirroring>;
        } | undefined>;
        /**
         * Spanning Tree Protocol configuration applied when this matching rule matches
         */
        stpConfig?: pulumi.Input<inputs.org.NetworktemplateSwitchMatchingRuleStpConfig | undefined>;
    }
    interface NetworktemplateSwitchMatchingRuleIpConfig {
        /**
         * VLAN Name for the management interface
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * IP assignment mode for in-band switch management
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSwitchMatchingRuleOobIpConfig {
        /**
         * IP assignment mode for out-of-band switch management
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * If supported on the platform. If enabled, DNS will be using this routing-instance, too
         */
        useMgmtVrf?: pulumi.Input<boolean | undefined>;
        /**
         * For host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired
         */
        useMgmtVrfForHostOut?: pulumi.Input<boolean | undefined>;
    }
    interface NetworktemplateSwitchMatchingRulePortConfig {
        /**
         * To disable LACP support for the AE interface
         */
        aeDisableLacp?: pulumi.Input<boolean | undefined>;
        /**
         * Users could force to use the designated AE name
         */
        aeIdx?: pulumi.Input<number | undefined>;
        /**
         * If `aggregated`==`true`, sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
         */
        aeLacpForceUp?: pulumi.Input<boolean | undefined>;
        /**
         * If `aggregated`==`true`, sets LACP to passive mode on this AE interface; by default, active (fast) mode is used
         */
        aeLacpPassive?: pulumi.Input<boolean | undefined>;
        /**
         * To use slow timeout
         */
        aeLacpSlow?: pulumi.Input<boolean | undefined>;
        /**
         * Whether this port is configured as an aggregated Ethernet member
         */
        aggregated?: pulumi.Input<boolean | undefined>;
        /**
         * To generate port up/down alarm
         */
        critical?: pulumi.Input<boolean | undefined>;
        /**
         * Human-readable description for this Junos port
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * If `speed` and `duplex` are specified, whether to disable autonegotiation
         */
        disableAutoneg?: pulumi.Input<boolean | undefined>;
        /**
         * Link duplex mode for this Junos port
         */
        duplex?: pulumi.Input<string | undefined>;
        /**
         * Enable dynamic usage for this port. Set to `dynamic` to enable.
         */
        dynamicUsage?: pulumi.Input<string | undefined>;
        /**
         * Whether this Junos port participates in an ESI-LAG
         */
        esilag?: pulumi.Input<boolean | undefined>;
        /**
         * Media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation
         */
        mtu?: pulumi.Input<number | undefined>;
        /**
         * List of network names. Required if `usage`==`inet`
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Prevent helpdesk to override the port config
         */
        noLocalOverwrite?: pulumi.Input<boolean | undefined>;
        /**
         * Whether PoE capabilities are disabled for this Junos port
         */
        poeDisabled?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `usage`==`vlanTunnel`. Q-in-Q tunneling using All-in-one bundling. This also enables standard L2PT for interfaces that are not encapsulation tunnel interfaces and uses MAC rewrite operation. [View more information](https://www.juniper.net/documentation/us/en/software/junos/multicast-l2/topics/topic-map/q-in-q.html#id-understanding-qinq-tunneling-and-vlan-translation)
         */
        portNetwork?: pulumi.Input<string | undefined>;
        /**
         * Link speed for this Junos port
         */
        speed?: pulumi.Input<string | undefined>;
        /**
         * Port usage name. For Q-in-Q, use `vlanTunnel`. If EVPN is used, use `evpnUplink`or `evpnDownlink`
         */
        usage: pulumi.Input<string>;
    }
    interface NetworktemplateSwitchMatchingRulePortMirroring {
        /**
         * At least one mirror input source should be specified. Networks whose ingress traffic is mirrored
         */
        inputNetworksIngresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * At least one mirror input source should be specified. Switch ports whose egress traffic is mirrored
         */
        inputPortIdsEgresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * At least one mirror input source should be specified. Switch ports whose ingress traffic is mirrored
         */
        inputPortIdsIngresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputIpAddress?: pulumi.Input<string | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputNetwork?: pulumi.Input<string | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputPortId?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSwitchMatchingRuleStpConfig {
        /**
         * Switch STP priority. Range [0, 4k, 8k.. 60k] in steps of 4k. Bridge priority applies to both VSTP and RSTP.
         */
        bridgePriority?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSwitchMgmt {
        /**
         * AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used.
         */
        apAffinityThreshold?: pulumi.Input<number | undefined>;
        /**
         * Set Banners for switches. Allows markup formatting
         */
        cliBanner?: pulumi.Input<string | undefined>;
        /**
         * Sets timeout for switches
         */
        cliIdleTimeout?: pulumi.Input<number | undefined>;
        /**
         * Rollback timer for commit confirmed
         */
        configRevertTimer?: pulumi.Input<number | undefined>;
        /**
         * Enable to provide the FQDN with DHCP option 81
         */
        dhcpOptionFqdn?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to suppress alarms when the switch out-of-band management interface is down
         */
        disableOobDownAlarm?: pulumi.Input<boolean | undefined>;
        /**
         * Whether FIPS mode is enabled on the switch
         */
        fipsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Local switch user accounts keyed by username
         */
        localAccounts?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.NetworktemplateSwitchMgmtLocalAccounts>;
        } | undefined>;
        /**
         * IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud
         */
        mxedgeProxyHost?: pulumi.Input<string | undefined>;
        /**
         * Mist Edge port used to proxy the switch management traffic to the Mist Cloud. Value in range 1-65535
         */
        mxedgeProxyPort?: pulumi.Input<string | undefined>;
        /**
         * Control-plane protection settings for the switch
         */
        protectRe?: pulumi.Input<inputs.org.NetworktemplateSwitchMgmtProtectRe | undefined>;
        /**
         * By default, only the configuration generated by Mist is cleaned up during the configuration process. If `true`, all the existing configuration will be removed.
         */
        removeExistingConfigs?: pulumi.Input<boolean | undefined>;
        /**
         * Root password for local switch access
         */
        rootPassword?: pulumi.Input<string | undefined>;
        /**
         * Management authentication settings using TACACS+
         */
        tacacs?: pulumi.Input<inputs.org.NetworktemplateSwitchMgmtTacacs | undefined>;
        /**
         * Whether to use Mist Edge as a proxy for switch management traffic
         */
        useMxedgeProxy?: pulumi.Input<boolean | undefined>;
    }
    interface NetworktemplateSwitchMgmtLocalAccounts {
        /**
         * Local password for the switch user account
         */
        password?: pulumi.Input<string | undefined>;
        /**
         * Access role granted to the local switch user account
         */
        role?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSwitchMgmtProtectRe {
        /**
         * optionally, services we'll allow. enum: `icmp`, `ssh`
         */
        allowedServices?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Additional ACL entries allowed by the Protect RE policy
         */
        customs?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSwitchMgmtProtectReCustom>[] | undefined>;
        /**
         * When enabled, all traffic that is not essential to our operation will be dropped
         * e.g. ntp / dns / traffic to mist will be allowed by default
         *      if dhcpd is enabled, we'll make sure it works
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to enable hit count for Protect_RE policy
         */
        hitCount?: pulumi.Input<boolean | undefined>;
        /**
         * Trusted host or subnet entries allowed by the Protect RE policy
         */
        trustedHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateSwitchMgmtProtectReCustom {
        /**
         * matched dst port, "0" means any. Note: For `protocol`==`any` and  `portRange`==`any`, configure `trustedHosts` instead
         */
        portRange?: pulumi.Input<string | undefined>;
        /**
         * enum: `any`, `icmp`, `tcp`, `udp`. Note: For `protocol`==`any` and  `portRange`==`any`, configure `trustedHosts` instead
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Source subnets matched by this custom Protect RE ACL
         */
        subnets: pulumi.Input<pulumi.Input<string>[]>;
    }
    interface NetworktemplateSwitchMgmtTacacs {
        /**
         * TACACS+ accounting servers used for switch management sessions
         */
        acctServers?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSwitchMgmtTacacsAcctServer>[] | undefined>;
        /**
         * Default switch-management role to use for TACACS+ logins
         */
        defaultRole?: pulumi.Input<string | undefined>;
        /**
         * Whether TACACS+ is enabled for switch management authentication
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Source network used for connectivity to the TACACS+ servers
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * TACACS+ authentication servers used for switch management logins
         */
        tacplusServers?: pulumi.Input<pulumi.Input<inputs.org.NetworktemplateSwitchMgmtTacacsTacplusServer>[] | undefined>;
    }
    interface NetworktemplateSwitchMgmtTacacsAcctServer {
        /**
         * Address or hostname of the TACACS+ accounting server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * TCP port used by the TACACS+ accounting server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used with this TACACS+ accounting server
         */
        secret?: pulumi.Input<string | undefined>;
        /**
         * TACACS+ accounting server timeout, in seconds
         */
        timeout?: pulumi.Input<number | undefined>;
    }
    interface NetworktemplateSwitchMgmtTacacsTacplusServer {
        /**
         * Address or hostname of the TACACS+ authentication server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * TCP port used by the TACACS+ authentication server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used with this TACACS+ authentication server
         */
        secret?: pulumi.Input<string | undefined>;
        /**
         * TACACS+ authentication server timeout, in seconds
         */
        timeout?: pulumi.Input<number | undefined>;
    }
    interface NetworktemplateVrfConfig {
        /**
         * Whether to enable VRF (when supported on the device)
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface NetworktemplateVrfInstances {
        /**
         * IPv4 subnet used for automatic EVPN loopback addresses in this VRF instance
         */
        evpnAutoLoopbackSubnet?: pulumi.Input<string | undefined>;
        /**
         * IPv6 subnet used for automatic EVPN loopback addresses in this VRF instance
         */
        evpnAutoLoopbackSubnet6?: pulumi.Input<string | undefined>;
        /**
         * Additional IPv4 static routes configured for this VRF instance
         */
        extraRoutes?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.NetworktemplateVrfInstancesExtraRoutes>;
        } | undefined>;
        /**
         * Additional IPv6 static routes configured for this VRF instance
         */
        extraRoutes6?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.NetworktemplateVrfInstancesExtraRoutes6>;
        } | undefined>;
        /**
         * Names of switch networks included in this VRF instance
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateVrfInstancesExtraRoutes {
        /**
         * IPv4 next-hop address for this VRF extra route
         */
        via: pulumi.Input<string>;
    }
    interface NetworktemplateVrfInstancesExtraRoutes6 {
        /**
         * IPv6 next-hop address for this VRF extra route
         */
        via?: pulumi.Input<string | undefined>;
    }
    interface RftemplateBand24 {
        /**
         * Whether RRM may disable the 2.4 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 2.4 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Radio chain mode for the 2.4 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 2.4 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 2.4 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 2.4 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
    }
    interface RftemplateBand5 {
        /**
         * Whether RRM may disable the 5 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 5 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Radio chain mode for the 5 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 5 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 5 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
    }
    interface RftemplateBand5On24Radio {
        /**
         * Whether RRM may disable the 5 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 5 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Radio chain mode for the 5 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 5 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 5 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
    }
    interface RftemplateBand6 {
        /**
         * Whether RRM may disable the 6 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 6 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Radio chain mode for the 6 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 6 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 6 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 6 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
        /**
         * For 6GHz Only, standard-power operation, AFC (Automatic Frequency Coordination) will be performed, and we'll fall back to Low Power Indoor if AFC failed
         */
        standardPower?: pulumi.Input<boolean | undefined>;
    }
    interface RftemplateModelSpecific {
        /**
         * Model-specific external antenna gain for the 2.4 GHz radio
         */
        antGain24?: pulumi.Input<number | undefined>;
        /**
         * Model-specific external antenna gain for the 5 GHz radio
         */
        antGain5?: pulumi.Input<number | undefined>;
        /**
         * Model-specific external antenna gain for the 6 GHz radio
         */
        antGain6?: pulumi.Input<number | undefined>;
        /**
         * Model-specific 2.4 GHz radio settings that override RF template defaults
         */
        band24?: pulumi.Input<inputs.org.RftemplateModelSpecificBand24 | undefined>;
        /**
         * Model-specific radio usage mode for the 2.4 GHz-capable radio
         */
        band24Usage?: pulumi.Input<string | undefined>;
        /**
         * Model-specific 5 GHz radio settings that override RF template defaults
         */
        band5?: pulumi.Input<inputs.org.RftemplateModelSpecificBand5 | undefined>;
        /**
         * Model-specific 5 GHz settings used when the 2.4 GHz radio operates in 5 GHz mode
         */
        band5On24Radio?: pulumi.Input<inputs.org.RftemplateModelSpecificBand5On24Radio | undefined>;
        /**
         * Model-specific 6 GHz radio settings that override RF template defaults
         */
        band6?: pulumi.Input<inputs.org.RftemplateModelSpecificBand6 | undefined>;
    }
    interface RftemplateModelSpecificBand24 {
        /**
         * Whether RRM may disable the 2.4 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 2.4 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Radio chain mode for the 2.4 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 2.4 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 2.4 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 2.4 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
    }
    interface RftemplateModelSpecificBand5 {
        /**
         * Whether RRM may disable the 5 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 5 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Radio chain mode for the 5 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 5 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 5 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
    }
    interface RftemplateModelSpecificBand5On24Radio {
        /**
         * Whether RRM may disable the 5 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 5 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Radio chain mode for the 5 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 5 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 5 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
    }
    interface RftemplateModelSpecificBand6 {
        /**
         * Whether RRM may disable the 6 GHz radio when optimizing RF settings
         */
        allowRrmDisable?: pulumi.Input<boolean | undefined>;
        /**
         * External antenna gain for the 6 GHz radio
         */
        antGain?: pulumi.Input<number | undefined>;
        /**
         * Radio chain mode for the 6 GHz radio
         */
        antennaMode?: pulumi.Input<string | undefined>;
        /**
         * Channel width configured for the 6 GHz radio
         */
        bandwidth?: pulumi.Input<number | undefined>;
        /**
         * Allowed channel list for the 6 GHz radio; null or an empty array uses automatic selection
         */
        channels?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether to disable the radio
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, max tx power to use, HW-specific values will be used if not set
         */
        powerMax?: pulumi.Input<number | undefined>;
        /**
         * When power=null/unset, min tx power to use, HW-specific values will be used if not set
         */
        powerMin?: pulumi.Input<number | undefined>;
        /**
         * 802.11 preamble mode used by the 6 GHz radio
         */
        preamble?: pulumi.Input<string | undefined>;
        /**
         * For 6GHz Only, standard-power operation, AFC (Automatic Frequency Coordination) will be performed, and we'll fall back to Low Power Indoor if AFC failed
         */
        standardPower?: pulumi.Input<boolean | undefined>;
    }
    interface ServiceSpec {
        /**
         * Port number, port range, or variable
         */
        portRange?: pulumi.Input<string | undefined>;
        /**
         * `https`/ `tcp` / `udp` / `icmp` / `gre` / `any` / `:protocol_number`, `protocolNumber` is between 1-254
         */
        protocol?: pulumi.Input<string | undefined>;
    }
    interface ServicepolicyAamw {
        /**
         * Organization-level advanced anti-malware profile ID; takes precedence over inline `profile` settings
         */
        aamwprofileId?: pulumi.Input<string | undefined>;
        /**
         * Whether advanced anti-malware inspection is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Built-in advanced anti-malware inspection profile to apply
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface ServicepolicyAntivirus {
        /**
         * Organization-level antivirus profile ID; takes precedence over inline `profile` settings
         */
        avprofileId?: pulumi.Input<string | undefined>;
        /**
         * Whether antivirus inspection is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Antivirus profile name to apply, such as `default`, `noftp`, `httponly`, or an AV profile key
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface ServicepolicyAppqoe {
        /**
         * Whether application QoE is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface ServicepolicyEwf {
        /**
         * Whether matching enhanced web filtering traffic is logged without being blocked
         */
        alertOnly?: pulumi.Input<boolean | undefined>;
        /**
         * Message returned when enhanced web filtering blocks a request
         */
        blockMessage?: pulumi.Input<string | undefined>;
        /**
         * Whether this enhanced web filtering rule is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Enhanced web filtering profile applied by this rule
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface ServicepolicyIdp {
        /**
         * Whether to alert without enforcing IDP prevention actions
         */
        alertOnly?: pulumi.Input<boolean | undefined>;
        /**
         * Whether IDP inspection is enabled for the policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * org_level IDP Profile can be used, this takes precedence over `profile`
         */
        idpprofileId?: pulumi.Input<string | undefined>;
        /**
         * enum: `Custom`, `strict` (default), `standard` or keys from idp_profiles
         */
        profile?: pulumi.Input<string | undefined>;
    }
    interface ServicepolicySslProxy {
        /**
         * Allowed cipher strength category for SSL proxy inspection
         */
        ciphersCategory?: pulumi.Input<string | undefined>;
        /**
         * Whether SSL proxy inspection is enabled for the service policy
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SettingApiPolicy {
        /**
         * By default, API hides password/secrets when the user doesn't have write access
         *   * `true`: API will hide passwords/secrets for all users
         *   * `false`: API will hide passwords/secrets for read-only users
         */
        noReveal?: pulumi.Input<boolean | undefined>;
        /**
         * Optional list of IP addresses or CIDR subnets from which org API access is allowed. At most 10 entries. The source IP of the request making this update must be within one of the specified subnets.
         */
        srcIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SettingAutoUpgrade {
        /**
         * Per-AP-model firmware versions or channels used for auto-upgrade
         */
        customVersions?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
        /**
         * Day of the week for the AP auto-upgrade maintenance window
         */
        dayOfWeek?: pulumi.Input<string | undefined>;
        /**
         * Whether AP auto-upgrade is enabled. Note that Mist may auto-upgrade APs if the running version is no longer supported.
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * `any` or HH:MM (24-hour format). Upgrade will happen within up to 1 hour from this time.
         */
        timeOfDay?: pulumi.Input<string | undefined>;
        /**
         * Firmware release channel or specific version used for AP auto-upgrade
         */
        version?: pulumi.Input<string | undefined>;
    }
    interface SettingCelona {
        /**
         * Credential used by Mist for the Celona integration
         */
        apiKey: pulumi.Input<string>;
        /**
         * Celona API prefix configured for the integration
         */
        apiPrefix: pulumi.Input<string>;
    }
    interface SettingCloudshark {
        /**
         * Token used by Mist to access the CloudShark integration
         */
        apitoken?: pulumi.Input<string | undefined>;
        /**
         * CloudShark Enterprise URL, if using a self-hosted CS Enterprise instance
         */
        url?: pulumi.Input<string | undefined>;
    }
    interface SettingCradlepoint {
        /**
         * Cradlepoint API ID used by Mist for the integration
         */
        cpApiId?: pulumi.Input<string | undefined>;
        /**
         * Cradlepoint API key paired with the Cradlepoint API ID
         */
        cpApiKey?: pulumi.Input<string | undefined>;
        /**
         * Cradlepoint ECM API ID used by Mist for the integration
         */
        ecmApiId?: pulumi.Input<string | undefined>;
        /**
         * Cradlepoint ECM API key paired with the ECM API ID
         */
        ecmApiKey?: pulumi.Input<string | undefined>;
        /**
         * Whether Mist uses Cradlepoint LLDP data to link routers to Mist sites and devices
         */
        enableLldp?: pulumi.Input<boolean | undefined>;
    }
    interface SettingDeviceCert {
        /**
         * PEM-encoded common device certificate used by organization settings
         */
        cert: pulumi.Input<string>;
        /**
         * Private key paired with the common device certificate
         */
        key: pulumi.Input<string>;
    }
    interface SettingInstaller {
        /**
         * Whether installers may work with all eligible devices
         */
        allowAllDevices?: pulumi.Input<boolean | undefined>;
        /**
         * Whether installers may work with all sites
         */
        allowAllSites?: pulumi.Input<boolean | undefined>;
        /**
         * Additional site IDs that installers may access
         */
        extraSiteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Grace period, in days, during which installers can modify recent sites or devices
         */
        gracePeriod?: pulumi.Input<number | undefined>;
    }
    interface SettingJcloud {
        /**
         * JCloud organization API token used by this Mist organization
         */
        orgApitoken: pulumi.Input<string>;
        /**
         * Display name for the JCloud organization API token
         */
        orgApitokenName: pulumi.Input<string>;
        /**
         * JCloud organization identifier linked to this Mist organization
         */
        orgId: pulumi.Input<string>;
    }
    interface SettingJcloudRa {
        /**
         * JCloud Routing Assurance Org Token
         */
        orgApitoken?: pulumi.Input<string | undefined>;
        /**
         * JCloud Routing Assurance Org Token Name
         */
        orgApitokenName?: pulumi.Input<string | undefined>;
        /**
         * JCloud Routing Assurance Org ID
         */
        orgId?: pulumi.Input<string | undefined>;
    }
    interface SettingJuniper {
        /**
         * List of linked Juniper account records
         */
        accounts?: pulumi.Input<pulumi.Input<inputs.org.SettingJuniperAccount>[] | undefined>;
    }
    interface SettingJuniperAccount {
        /**
         * User who linked this Juniper account
         */
        linkedBy?: pulumi.Input<string | undefined>;
        /**
         * Display name of the linked Juniper account
         */
        name?: pulumi.Input<string | undefined>;
    }
    interface SettingJuniperSrx {
        /**
         * SRX auto-upgrade settings applied when Juniper SRX devices are first onboarded
         */
        autoUpgrade?: pulumi.Input<inputs.org.SettingJuniperSrxAutoUpgrade | undefined>;
    }
    interface SettingJuniperSrxAutoUpgrade {
        /**
         * Per-SRX-model firmware versions to deploy instead of the default version
         */
        customVersions?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
        /**
         * Whether SRX auto-upgrade is enabled for newly onboarded devices
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to take a snapshot during the SRX upgrade process
         */
        snapshot?: pulumi.Input<boolean | undefined>;
        /**
         * Firmware version to deploy (e.g. 23.4R2-S5.5). Optional, used when customVersions not specified
         */
        version?: pulumi.Input<string | undefined>;
    }
    interface SettingJunosShellAccess {
        /**
         * Shell access level used for administrator web-shell sessions
         */
        admin?: pulumi.Input<string | undefined>;
        /**
         * Shell access level used for helpdesk web-shell sessions
         */
        helpdesk?: pulumi.Input<string | undefined>;
        /**
         * Shell access level used for read-only web-shell sessions
         */
        read?: pulumi.Input<string | undefined>;
        /**
         * Shell access level used for write-role web-shell sessions
         */
        write?: pulumi.Input<string | undefined>;
    }
    interface SettingMarvis {
        /**
         * Disable proactive monitoring in Marvis. NOTE: support access must be enabled for the org (`allowMist`=`true`) for proactive monitoring to function.
         */
        disableProactiveMonitoring?: pulumi.Input<boolean | undefined>;
        /**
         * Self-driving network automation settings by domain
         */
        selfDriving?: pulumi.Input<inputs.org.SettingMarvisSelfDriving | undefined>;
    }
    interface SettingMarvisSelfDriving {
        /**
         * Self-driving automation settings for the WAN domain
         */
        wan?: pulumi.Input<inputs.org.SettingMarvisSelfDrivingWan | undefined>;
        /**
         * Self-driving automation settings for the wired domain
         */
        wired?: pulumi.Input<inputs.org.SettingMarvisSelfDrivingWired | undefined>;
        /**
         * Self-driving automation settings for the wireless domain
         */
        wireless?: pulumi.Input<inputs.org.SettingMarvisSelfDrivingWireless | undefined>;
    }
    interface SettingMarvisSelfDrivingWan {
        /**
         * Whether self-driving automation is enabled for this domain
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SettingMarvisSelfDrivingWired {
        /**
         * Whether self-driving automation is enabled for this domain
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SettingMarvisSelfDrivingWireless {
        /**
         * Whether self-driving automation is enabled for this domain
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SettingMgmt {
        /**
         * Mist Tunnel IDs selected for management connectivity
         */
        mxtunnelIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether to use Mist Tunnel for mgmt connectivity, this takes precedence over use_wxtunnel
         */
        useMxtunnel?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to use wxtunnel for mgmt connectivity
         */
        useWxtunnel?: pulumi.Input<boolean | undefined>;
    }
    interface SettingMistNac {
        /**
         * allow clients to connect even when the user cert failed. TEAP authenticates both Machine Cert and User Cert. When enabled, clients who only succeed Machine Cert authentication will be accepted.
         */
        allowTeapMachineAuthOnly?: pulumi.Input<boolean | undefined>;
        /**
         * CA certificates trusted by Mist NAC for certificate-based authentication
         */
        cacerts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * use this IDP when no explicit realm present in the incoming username/CN OR when no IDP is explicitly mapped to the incoming realm.
         */
        defaultIdpId?: pulumi.Input<string | undefined>;
        /**
         * to disable RSAE_PSS_SHA256, RSAE_PSS_SHA384, RSAE_PSS_SHA512 from server side. see https://www.openssl.org/docs/man3.0/man1/openssl-ciphers.html
         */
        disableRsaeAlgorithms?: pulumi.Input<boolean | undefined>;
        /**
         * eap ssl security level, see https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_security_level.html#DEFAULT-CALLBACK-BEHAVIOUR
         */
        eapSslSecurityLevel?: pulumi.Input<number | undefined>;
        /**
         * By default, NAC POD failover considers all NAC pods available around the globe, i.e. EU, US, or APAC based, failover happens based on geo IP of the originating site. For strict GDPR compliance NAC POD failover would only happen between the PODs located within the EU environment, and no authentication would take place outside of EU. This is an org setting that is applicable to WLANs, switch templates, Mist Edge clusters that have mistNac enabled
         */
        euOnly?: pulumi.Input<boolean | undefined>;
        /**
         * Client fingerprinting settings used by Mist NAC
         */
        fingerprinting?: pulumi.Input<inputs.org.SettingMistNacFingerprinting | undefined>;
        /**
         * Client certificate field used to look up machine groups in identity providers
         */
        idpMachineCertLookupField?: pulumi.Input<string | undefined>;
        /**
         * Client certificate field used to look up user groups in identity providers
         */
        idpUserCertLookupField?: pulumi.Input<string | undefined>;
        /**
         * Identity provider mappings used by Mist NAC realm matching
         */
        idps?: pulumi.Input<pulumi.Input<inputs.org.SettingMistNacIdp>[] | undefined>;
        /**
         * Mobile Device Management CoA settings for Mist NAC
         */
        mdm?: pulumi.Input<inputs.org.SettingMistNacMdm | undefined>;
        /**
         * RADIUS server certificate presented by Mist NAC during EAP-TLS
         */
        serverCert?: pulumi.Input<inputs.org.SettingMistNacServerCert | undefined>;
        /**
         * IP version used by NAS devices and Mist Edge proxies to reach Mist NAC
         */
        useIpVersion?: pulumi.Input<string | undefined>;
        /**
         * By default, NAS devices (switches/aps) and proxies(mxedge) are configured to use port TCP2083(RadSec) to reach mist-nac. Set `useSslPort`==`true` to override that port with TCP43 (ssl), This is an org level setting that is applicable to wlans, switch_templates, and mxedgeClusters that have mist-nac enabled
         */
        useSslPort?: pulumi.Input<boolean | undefined>;
        /**
         * Allow customer to configure an expiry time for usermacs by attaching a Quarantine label to those which have been inactive for the configured period of time (in days). 0 means no expiry
         */
        usermacExpiry?: pulumi.Input<number | undefined>;
    }
    interface SettingMistNacFingerprinting {
        /**
         * enable/disable writes to NAC DDB fingerprint table
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * enable/disable CoA triggers on fingerprint change for wired clients, always port-bounce
         */
        generateCoa?: pulumi.Input<boolean | undefined>;
        /**
         * enable/disable CoA triggers on fingerprint change for wireless clients
         */
        generateWirelessCoa?: pulumi.Input<boolean | undefined>;
        /**
         * Change of Authorization action sent to wireless clients when fingerprints change
         */
        wirelessCoaType?: pulumi.Input<string | undefined>;
    }
    interface SettingMistNacIdp {
        /**
         * When the IDP is `mxedgeProxy` type, realms excluded from proxying in addition to other valid home realms in this org
         */
        excludeRealms?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * ID of the `mistNacidp`
         */
        id: pulumi.Input<string>;
        /**
         * User realms that select this identity provider
         */
        userRealms: pulumi.Input<pulumi.Input<string>[]>;
    }
    interface SettingMistNacMdm {
        /**
         * Change of Authorization action sent for MDM posture changes
         */
        coaType?: pulumi.Input<string | undefined>;
    }
    interface SettingMistNacServerCert {
        /**
         * PEM-encoded RADIUS server certificate presented during EAP-TLS
         */
        cert?: pulumi.Input<string | undefined>;
        /**
         * Private key paired with the Mist NAC RADIUS server certificate
         */
        key?: pulumi.Input<string | undefined>;
        /**
         * Optional password for the private key
         */
        password?: pulumi.Input<string | undefined>;
    }
    interface SettingMxedgeMgmt {
        /**
         * Whether the Mist Edge automatically reverts configuration changes if connectivity is lost
         */
        configAutoRevert?: pulumi.Input<boolean | undefined>;
        /**
         * Whether FIPS mode is enabled on the Mist Edge
         */
        fipsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Password for the Mist service account on the Mist Edge
         */
        mistPassword?: pulumi.Input<string | undefined>;
        /**
         * IPv4 address assignment mode for out-of-band management
         */
        oobIpType?: pulumi.Input<string | undefined>;
        /**
         * IPv6 address assignment mode for out-of-band management
         */
        oobIpType6?: pulumi.Input<string | undefined>;
        /**
         * Root account password for the Mist Edge
         */
        rootPassword?: pulumi.Input<string | undefined>;
    }
    interface SettingOpticPortConfig {
        /**
         * Whether channelization is enabled on this optic port
         */
        channelized?: pulumi.Input<boolean | undefined>;
        /**
         * Interface speed (e.g. `25g`, `50g`), use the chassis speed by default
         */
        speed?: pulumi.Input<string | undefined>;
    }
    interface SettingPasswordPolicy {
        /**
         * Whether the policy is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Password expiry in days. Password Expiry Notice banner will display in the UI 14 days before expiration
         */
        expiryInDays?: pulumi.Input<number | undefined>;
        /**
         * Minimum number of characters required for passwords
         */
        minLength?: pulumi.Input<number | undefined>;
        /**
         * Whether to require special character
         */
        requiresSpecialChar?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to require two-factor auth
         */
        requiresTwoFactorAuth?: pulumi.Input<boolean | undefined>;
    }
    interface SettingPcap {
        /**
         * Storage bucket name used for organization packet capture files
         */
        bucket?: pulumi.Input<string | undefined>;
        /**
         * Maximum length of non-management packets to capture, in bytes
         */
        maxPktLen?: pulumi.Input<number | undefined>;
    }
    interface SettingSecurity {
        /**
         * Whether to disable local SSH (by default, local SSH is enabled with allowMist in Org is enabled
         */
        disableLocalSsh?: pulumi.Input<boolean | undefined>;
        /**
         * password required to zeroize devices (FIPS) on site level
         */
        fipsZeroizePassword?: pulumi.Input<string | undefined>;
        /**
         * Whether to allow certain SSH keys to SSH into the AP (see Site:Setting)
         */
        limitSshAccess?: pulumi.Input<boolean | undefined>;
    }
    interface SettingSsr {
        /**
         * Automatic SSR firmware upgrade settings for newly onboarded devices
         */
        autoUpgrade?: pulumi.Input<inputs.org.SettingSsrAutoUpgrade | undefined>;
        /**
         * IP addresses or hostnames of conductors used by SSR devices
         */
        conductorHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Registration token used by SSR devices to connect to the conductor
         */
        conductorToken?: pulumi.Input<string | undefined>;
        /**
         * Whether stats collection is disabled on SSR devices
         */
        disableStats?: pulumi.Input<boolean | undefined>;
        /**
         * Network proxy settings used by SSR devices to reach Mist
         */
        proxy?: pulumi.Input<inputs.org.SettingSsrProxy | undefined>;
    }
    interface SettingSsrAutoUpgrade {
        /**
         * Firmware release channel used for SSR auto-upgrade
         */
        channel?: pulumi.Input<string | undefined>;
        /**
         * Per-model SSR firmware versions used for auto-upgrade
         */
        customVersions?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
        /**
         * Whether SSR auto-upgrade is enabled for newly onboarded devices
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Firmware version to deploy (e.g. 6.3.0-107.r1). Optional, used when customVersions not specified
         */
        version?: pulumi.Input<string | undefined>;
    }
    interface SettingSsrProxy {
        /**
         * Whether the SSR proxy configuration is disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Proxy URL that SSR devices use to reach Mist
         */
        url?: pulumi.Input<string | undefined>;
    }
    interface SettingSwitch {
        /**
         * Auto-upgrade defaults for switches in this organization
         */
        autoUpgrade?: pulumi.Input<inputs.org.SettingSwitchAutoUpgrade | undefined>;
    }
    interface SettingSwitchAutoUpgrade {
        /**
         * Per-model switch firmware versions to use for auto-upgrade
         */
        customVersions?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
        /**
         * Whether switch auto-upgrade is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to create a recovery snapshot during the upgrade process
         */
        snapshot?: pulumi.Input<boolean | undefined>;
    }
    interface SettingSwitchMgmt {
        /**
         * If the field is set in both site/setting and org/setting, the value from site/setting will be used.
         */
        apAffinityThreshold?: pulumi.Input<number | undefined>;
    }
    interface SettingSyntheticTest {
        /**
         * Overall aggressiveness level for synthetic test probes
         */
        aggressiveness?: pulumi.Input<string | undefined>;
        /**
         * Custom synthetic probe definitions keyed by probe name
         */
        customProbes?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.SettingSyntheticTestCustomProbes>;
        } | undefined>;
        /**
         * Whether synthetic tests are disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * LAN network probe groups used by synthetic tests
         */
        lanNetworks?: pulumi.Input<pulumi.Input<inputs.org.SettingSyntheticTestLanNetwork>[] | undefined>;
        /**
         * Deprecated VLAN-based synthetic test settings
         *
         * @deprecated This attribute is deprecated.
         */
        vlans?: pulumi.Input<pulumi.Input<inputs.org.SettingSyntheticTestVlan>[] | undefined>;
        /**
         * WAN speedtest settings for synthetic tests
         */
        wanSpeedtest?: pulumi.Input<inputs.org.SettingSyntheticTestWanSpeedtest | undefined>;
    }
    interface SettingSyntheticTestCustomProbes {
        /**
         * Probe aggressiveness level for this custom synthetic probe
         */
        aggressiveness?: pulumi.Input<string | undefined>;
        /**
         * Can be URL (e.g. http://x.com, https://x.com:8080/path/to/resource), IP address, or IP:port combination
         */
        target?: pulumi.Input<string | undefined>;
        /**
         * Response-time threshold for this custom probe, in milliseconds
         */
        threshold?: pulumi.Input<number | undefined>;
        /**
         * Probe type used by this custom synthetic probe
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface SettingSyntheticTestLanNetwork {
        /**
         * LAN network names where synthetic probes are run
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Synthetic probe names to run on the listed LAN networks
         */
        probes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SettingSyntheticTestVlan {
        /**
         * Deprecated custom URLs tested by VLAN-based synthetic probes
         *
         * @deprecated This attribute is deprecated.
         */
        customTestUrls?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * For some vlans where we don't want this to run
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Synthetic probe names to run for the listed VLANs
         */
        probes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * VLAN identifiers where synthetic probes are run
         */
        vlanIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SettingSyntheticTestWanSpeedtest {
        /**
         * Whether scheduled WAN speedtests are enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Scheduled time of day for WAN speedtests
         */
        timeOfDay?: pulumi.Input<string | undefined>;
    }
    interface SettingVpnOptions {
        /**
         * Base BGP autonomous system number used for generated VPN configurations
         */
        asBase?: pulumi.Input<number | undefined>;
        /**
         * Whether IPv6 is enabled for organization VPN configuration
         */
        enableIpv6?: pulumi.Input<boolean | undefined>;
        /**
         * requiring /12 or bigger to support 16 private IPs for 65535 gateways
         */
        stSubnet?: pulumi.Input<string | undefined>;
    }
    interface SettingWanPma {
        /**
         * Whether PMA is enabled for WAN Assurance
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SettingWiredPma {
        /**
         * Whether PMA is enabled for Wired Assurance
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SettingWirelessPma {
        /**
         * Whether PMA is enabled for Wireless Assurance
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SsoRolePrivilege {
        /**
         * Access role granted by this organization privilege
         */
        role: pulumi.Input<string>;
        /**
         * Organization hierarchy level where this privilege applies
         */
        scope: pulumi.Input<string>;
        /**
         * Required if `scope`==`site`
         */
        siteId?: pulumi.Input<string | undefined>;
        /**
         * Required if `scope`==`sitegroup`
         */
        sitegroupId?: pulumi.Input<string | undefined>;
        /**
         * UI views allowed by custom role restrictions
         */
        views?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface VpnPathSelection {
        /**
         * Path selection strategy for a hub-and-spoke VPN
         */
        strategy?: pulumi.Input<string | undefined>;
    }
    interface VpnPaths {
        /**
         * BFD profile used for this VPN path
         */
        bfdProfile?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`mesh` and for SSR only, whether to use tunnel mode
         */
        bfdUseTunnelMode?: pulumi.Input<boolean | undefined>;
        /**
         * Source IP address for this VPN path, if different from the WAN port IP
         */
        ip?: pulumi.Input<string | undefined>;
        /**
         * Peer path preferences used when `type`==`mesh`
         */
        peerPaths?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.VpnPathsPeerPaths>;
        } | undefined>;
        /**
         * Grouping index used to place this VPN path into a pod
         */
        pod?: pulumi.Input<number | undefined>;
        /**
         * Traffic shaping settings applied to this VPN path
         */
        trafficShaping?: pulumi.Input<inputs.org.VpnPathsTrafficShaping | undefined>;
    }
    interface VpnPathsPeerPaths {
        /**
         * Lower numeric value makes this outgoing WAN path more preferred
         */
        preference?: pulumi.Input<number | undefined>;
    }
    interface VpnPathsTrafficShaping {
        /**
         * Bandwidth percentages for high, medium, low, and best-effort traffic classes
         */
        classPercentages?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether traffic shaping is enabled for this VPN path
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Maximum transmit rate for this VPN path, in Kbps; `null` means no explicit limit
         */
        maxTxKbps?: pulumi.Input<number | undefined>;
    }
    interface WlanAcctServer {
        /**
         * Address or hostname of the RADIUS accounting server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this accounting server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS accounting server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used with this RADIUS accounting server
         */
        secret: pulumi.Input<string>;
    }
    interface WlanAirwatch {
        /**
         * API key used to authenticate to the AirWatch service
         */
        apiKey?: pulumi.Input<string | undefined>;
        /**
         * Base console URL of the AirWatch deployment
         */
        consoleUrl?: pulumi.Input<string | undefined>;
        /**
         * Whether AirWatch integration is enabled for the WLAN
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * AirWatch integration account password for this WLAN
         */
        password?: pulumi.Input<string | undefined>;
        /**
         * AirWatch integration account username for this WLAN
         */
        username?: pulumi.Input<string | undefined>;
    }
    interface WlanAppLimit {
        /**
         * Map from app key to bandwidth in kbps.
         * Property key is the app key, defined in Get Application List
         */
        apps?: pulumi.Input<{
            [key: string]: pulumi.Input<number>;
        } | undefined>;
        /**
         * Whether application bandwidth limits are enabled for this WLAN
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Map from wxtagId of Hostname Wxlan Tags to bandwidth in kbps. Property key is the `wxtagId`
         */
        wxtagIds?: pulumi.Input<{
            [key: string]: pulumi.Input<number>;
        } | undefined>;
    }
    interface WlanAppQos {
        /**
         * Map of application keys to QoS rewrite settings
         */
        apps?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.WlanAppQosApps>;
        } | undefined>;
        /**
         * Whether application QoS rewrite rules are enabled for this WLAN
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Custom traffic QoS rules that are not tied to named applications
         */
        others?: pulumi.Input<pulumi.Input<inputs.org.WlanAppQosOther>[] | undefined>;
    }
    interface WlanAppQosApps {
        /**
         * DSCP value range between 0 and 63
         */
        dscp?: pulumi.Input<string | undefined>;
        /**
         * Subnet filter is not required but helps AP to only inspect certain traffic (thus reducing AP load)
         */
        dstSubnet?: pulumi.Input<string | undefined>;
        /**
         * Subnet filter is not required but helps AP to only inspect certain traffic (thus reducing AP load)
         */
        srcSubnet?: pulumi.Input<string | undefined>;
    }
    interface WlanAppQosOther {
        /**
         * Differentiated Services Code Point value applied to matching traffic
         */
        dscp?: pulumi.Input<string | undefined>;
        /**
         * Destination subnet filter for this custom QoS rule
         */
        dstSubnet?: pulumi.Input<string | undefined>;
        /**
         * TCP or UDP port ranges matched by this custom QoS rule
         */
        portRanges?: pulumi.Input<string | undefined>;
        /**
         * IP protocol matched by this custom QoS rule
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Source subnet filter for this custom QoS rule
         */
        srcSubnet?: pulumi.Input<string | undefined>;
    }
    interface WlanAuth {
        /**
         * SAE anti-clogging token threshold
         */
        anticlogThreshold?: pulumi.Input<number | undefined>;
        /**
         * Whether to trigger EAP reauth when the session ends
         */
        eapReauth?: pulumi.Input<boolean | undefined>;
        /**
         * Enable Beacon Protection; default is false for better compatibility
         */
        enableBeaconProtection?: pulumi.Input<boolean | undefined>;
        /**
         * Enable GCMP-256 encryption suite; default is false for better compatibility
         */
        enableGcmp256?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to enable MAC Auth, uses the same auth_servers
         */
        enableMacAuth?: pulumi.Input<boolean | undefined>;
        /**
         * When `type`==`wep`, index of the WEP key used as the default transmit key
         */
        keyIdx?: pulumi.Input<number | undefined>;
        /**
         * When `type`==`wep`, WEP keys configured for this WLAN
         */
        keys?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * When `type`==`psk`, whether to only use multi_psk
         */
        multiPskOnly?: pulumi.Input<boolean | undefined>;
        /**
         * When `type`==`open`, Opportunistic Wireless Encryption mode for this WLAN
         */
        owe?: pulumi.Input<string | undefined>;
        /**
         * When `type`==`psk` or `type`==`eap`, pairwise cipher suites allowed for this WLAN
         */
        pairwises?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * When `multiPskOnly`==`true`, whether private wlan is enabled
         */
        privateWlan?: pulumi.Input<boolean | undefined>;
        /**
         * When `type`==`psk`, 8-64 characters, or 64 hex characters
         */
        psk?: pulumi.Input<string | undefined>;
        /**
         * Authentication mode used by this WLAN
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Enable WEP as secondary auth
         */
        wepAsSecondaryAuth?: pulumi.Input<boolean | undefined>;
    }
    interface WlanAuthServer {
        /**
         * Address or hostname of the RADIUS authentication server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this authentication server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS authentication server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Whether to require Message-Authenticator in requests
         */
        requireMessageAuthenticator?: pulumi.Input<boolean | undefined>;
        /**
         * Shared secret used with this RADIUS authentication server
         */
        secret: pulumi.Input<string>;
    }
    interface WlanBonjour {
        /**
         * additional VLAN IDs (on the LAN side or from other WLANs) should we be forwarding bonjour queries/responses
         */
        additionalVlanIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether to enable bonjour for this WLAN. Once enabled, limitBcast is assumed true, allowMdns is assumed false
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * What services are allowed.
         * Property key is the service name
         */
        services?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.WlanBonjourServices>;
        } | undefined>;
    }
    interface WlanBonjourServices {
        /**
         * Whether to prevent wireless clients to discover bonjour devices on the same WLAN
         */
        disableLocal?: pulumi.Input<boolean | undefined>;
        /**
         * RADIUS groups allowed to discover this Bonjour service, when restricted
         */
        radiusGroups?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Discovery scope for this Bonjour service on the WLAN
         */
        scope?: pulumi.Input<string | undefined>;
    }
    interface WlanCiscoCwa {
        /**
         * Hostnames allowed for Cisco CWA client access before authorization
         */
        allowedHostnames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * CIDR subnets allowed for Cisco CWA client access before authorization
         */
        allowedSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * CIDR subnets blocked for Cisco CWA client access
         */
        blockedSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether Cisco CWA is enabled for this WLAN
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface WlanCoaServer {
        /**
         * Whether to disable Event-Timestamp Check
         */
        disableEventTimestampCheck?: pulumi.Input<boolean | undefined>;
        /**
         * Whether this RADIUS CoA server is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Server IPv4 address for RADIUS CoA messages
         */
        ip: pulumi.Input<string>;
        /**
         * UDP port used to send RADIUS CoA messages to the server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used to authenticate RADIUS CoA messages
         */
        secret: pulumi.Input<string>;
    }
    interface WlanDnsServerRewrite {
        /**
         * Whether DNS server rewrite by RADIUS group is enabled for this WLAN
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Map between radiusGroup and the desired DNS server (IPv4 only). Property key is the RADIUS group, property value is the desired DNS Server
         */
        radiusGroups?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
    }
    interface WlanDynamicPsk {
        /**
         * Default PSK to use if cloud WLC is not available, 8-63 characters
         */
        defaultPsk?: pulumi.Input<string | undefined>;
        /**
         * Default VLAN ID used when dynamic PSK lookup does not return a VLAN
         */
        defaultVlanId?: pulumi.Input<string | undefined>;
        /**
         * Whether dynamic PSK is enabled for this WLAN
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * When 11r is enabled, we'll try to use the cached PMK, this can be disabled. `false` means auto
         */
        forceLookup?: pulumi.Input<boolean | undefined>;
        /**
         * Origin used to retrieve per-user PSKs
         */
        source?: pulumi.Input<string | undefined>;
    }
    interface WlanDynamicVlan {
        /**
         * Fallback VLAN IDs, ranges, or variables used when no RADIUS VLAN match is returned
         */
        defaultVlanIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Requires `vlanEnabled`==`true` to be set to `true`. Whether to enable dynamic vlan
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * VLAN IDs that should be locally bridged for dynamic VLAN assignment
         */
        localVlanIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Dynamic VLAN mapping method used for RADIUS-provided VLAN attributes
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Map between vlanId (as string) to airespace interface names (comma-separated) or null for standard mapping
         *   * if `dynamic_vlan.type`==`standard`, property key is the VLAN ID and property value is \"\"
         *   * if `dynamic_vlan.type`==`airespace-interface-name`, property key is the VLAN ID and property value is the Airespace Interface Name
         */
        vlans?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
    }
    interface WlanHotspot20 {
        /**
         * Advertised domain names for Hotspot 2.0 clients
         */
        domainNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether to enable hotspot 2.0 config
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * NAI realms advertised for Hotspot 2.0 authentication
         */
        naiRealms?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Operator profiles supported by this Hotspot 2.0 configuration
         */
        operators?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Roaming Consortium Organization Identifiers advertised for Hotspot 2.0
         */
        rcois?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Venue name, default is site name
         */
        venueName?: pulumi.Input<string | undefined>;
    }
    interface WlanInjectDhcpOption82 {
        /**
         * Information to set in the `circuitId` field of the DHCP Option 82. It is possible to use static string or the following variables (e.g. `{{SSID}}:{{AP_MAC}}`):
         *   * {{AP_MAC}}
         *   * {{AP_MAC_DASHED}}
         *   * {{AP_MODEL}}
         *   * {{AP_NAME}}
         *   * {{SITE_NAME}}
         *   * {{SSID}}
         */
        circuitId?: pulumi.Input<string | undefined>;
        /**
         * Whether to inject option 82 when forwarding DHCP packets
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface WlanMistNac {
        /**
         * How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled.
         */
        acctInterimInterval?: pulumi.Input<number | undefined>;
        /**
         * RADIUS auth session retries. Following fast timers are set if `fastDot1xTimers` knob is enabled. "retries" are set to value of `authServersTimeout`. "max-requests" is also set when setting `authServersRetries` is set to default value to 3.
         */
        authServersRetries?: pulumi.Input<number | undefined>;
        /**
         * RADIUS auth session timeout. Following fast timers are set if `fastDot1xTimers` knob is enabled. "quite-period" and "transmit-period" are set to half the value of `authServersTimeout`. "supplicant-timeout" is also set when setting `authServersTimeout` is set to default value of 10.
         */
        authServersTimeout?: pulumi.Input<number | undefined>;
        /**
         * Allows a RADIUS server to dynamically modify the authorization status of a user session.
         */
        coaEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * the communication port used for “Change of Authorization” (CoA) messages
         */
        coaPort?: pulumi.Input<number | undefined>;
        /**
         * When enabled:
         *   * `authServers` is ignored
         *   * `acctServers` is ignored
         *   * `auth_servers_*` are ignored
         *   * `coaServers` is ignored
         *   * `radsec` is ignored
         *   * `coaEnabled` is assumed
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * If set to true, sets default fast-timers with values calculated from `authServersTimeout` and `authServerRetries`.
         */
        fastDot1xTimers?: pulumi.Input<boolean | undefined>;
        /**
         * Which network the mist nac server resides in
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * In case there is a static IP for this network, we can specify it using source ip
         */
        sourceIp?: pulumi.Input<string | undefined>;
    }
    interface WlanPortal {
        /**
         * Optional if `amazonEnabled`==`true`. Whether to allow guest to connect to other Guest WLANs (with different `WLAN.ssid`) of same org without reauthentication (disable randomMac for seamless roaming)
         */
        allowWlanIdRoam?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `amazonEnabled`==`true`. Amazon OAuth2 client id. This is optional. If not provided, it will use a default one.
         */
        amazonClientId?: pulumi.Input<string | undefined>;
        /**
         * Optional if `amazonEnabled`==`true`. Amazon OAuth2 client secret. If amazonClientId was provided, provide a corresponding value. Else leave blank.
         */
        amazonClientSecret?: pulumi.Input<string | undefined>;
        /**
         * Optional if `amazonEnabled`==`true`. Email domains allowed for Amazon-authenticated guest users. If null or empty, any authenticated Amazon email domain is allowed.
         */
        amazonEmailDomains?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether amazon is enabled as a login method
         */
        amazonEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `amazonEnabled`==`true`. Interval for which guest remains authorized using amazon auth (in minutes), if not provided, uses expire`
         */
        amazonExpire?: pulumi.Input<number | undefined>;
        /**
         * Guest portal login scheme used by the WLAN
         */
        auth?: pulumi.Input<string | undefined>;
        /**
         * Required if `azureEnabled`==`true`. Azure active directory app client id
         */
        azureClientId?: pulumi.Input<string | undefined>;
        /**
         * Required if `azureEnabled`==`true`. Azure active directory app client secret
         */
        azureClientSecret?: pulumi.Input<string | undefined>;
        /**
         * Whether Azure Active Directory is enabled as a login method
         */
        azureEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Interval for which guest remains authorized using azure auth (in minutes), if not provided, uses expire`
         */
        azureExpire?: pulumi.Input<number | undefined>;
        /**
         * Required if `azureEnabled`==`true`. Azure active directory tenant id.
         */
        azureTenantId?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`broadnet`. Password for the Broadnet SMS provider account
         */
        broadnetPassword?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`broadnet`. SID for the Broadnet SMS provider account
         */
        broadnetSid?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`broadnet`. User ID for the Broadnet SMS provider account
         */
        broadnetUserId?: pulumi.Input<string | undefined>;
        /**
         * Whether to bypass the guest portal when cloud not reachable (and apply the default policies)
         */
        bypassWhenCloudDown?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `smsProvider`==`clickatell`. API key for the Clickatell SMS provider account
         */
        clickatellApiKey?: pulumi.Input<string | undefined>;
        /**
         * Whether to allow guest to roam between WLANs (with same `WLAN.ssid`, regardless of variables) of different sites of same org without reauthentication (disable randomMac for seamless roaming)
         */
        crossSite?: pulumi.Input<boolean | undefined>;
        /**
         * Whether email (access code verification) is enabled as a login method
         */
        emailEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether guest portal is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * How long to remain authorized, in minutes
         */
        expire?: pulumi.Input<number | undefined>;
        /**
         * Required if `wlanPortalAuth`==`external`. External portal URL (e.g. https://host/url) where we can append our query parameters to
         */
        externalPortalUrl?: pulumi.Input<string | undefined>;
        /**
         * Required if `facebookEnabled`==`true`. Facebook OAuth2 app id. This is optional. If not provided, it will use a default one.
         */
        facebookClientId?: pulumi.Input<string | undefined>;
        /**
         * Required if `facebookEnabled`==`true`. Facebook OAuth2 app secret. If facebookClientId was provided, provide a corresponding value. Else leave blank.
         */
        facebookClientSecret?: pulumi.Input<string | undefined>;
        /**
         * Optional if `facebookEnabled`==`true`. Email domains allowed for Facebook-authenticated guest users. If null or empty, any authenticated Facebook email domain is allowed.
         */
        facebookEmailDomains?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether facebook is enabled as a login method
         */
        facebookEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `facebookEnabled`==`true`. Interval for which guest remains authorized using facebook auth (in minutes), if not provided, uses expire`
         */
        facebookExpire?: pulumi.Input<number | undefined>;
        /**
         * Whether to forward the user to another URL after authorized
         */
        forward?: pulumi.Input<boolean | undefined>;
        /**
         * URL to forward the user to
         */
        forwardUrl?: pulumi.Input<string | undefined>;
        /**
         * Google OAuth2 app id. This is optional. If not provided, it will use a default one.
         */
        googleClientId?: pulumi.Input<string | undefined>;
        /**
         * Optional if `googleEnabled`==`true`. Google OAuth2 app secret. If googleClientId was provided, provide a corresponding value. Else leave blank.
         */
        googleClientSecret?: pulumi.Input<string | undefined>;
        /**
         * Optional if `googleEnabled`==`true`. Email domains allowed for Google-authenticated guest users. If null or empty, any authenticated Google email domain is allowed.
         */
        googleEmailDomains?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether Google is enabled as login method
         */
        googleEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `googleEnabled`==`true`. Interval for which guest remains authorized using Google Auth (in minutes), if not provided, uses expire`
         */
        googleExpire?: pulumi.Input<number | undefined>;
        /**
         * Required if `smsProvider`==`gupshup`. Password for the Gupshup SMS provider account
         */
        gupshupPassword?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`gupshup`. User ID for the Gupshup SMS provider account
         */
        gupshupUserid?: pulumi.Input<string | undefined>;
        /**
         * Optional if `microsoftEnabled`==`true`. Microsoft 365 OAuth2 client id. This is optional. If not provided, it will use a default one.
         */
        microsoftClientId?: pulumi.Input<string | undefined>;
        /**
         * Optional if `microsoftEnabled`==`true`. Microsoft 365 OAuth2 client secret. If microsoftClientId was provided, provide a corresponding value. Else leave blank.
         */
        microsoftClientSecret?: pulumi.Input<string | undefined>;
        /**
         * Optional if `microsoftEnabled`==`true`. Email domains allowed for Microsoft 365-authenticated guest users. If null or empty, any authenticated Microsoft 365 email domain is allowed.
         */
        microsoftEmailDomains?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether microsoft 365 is enabled as a login method
         */
        microsoftEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `microsoftEnabled`==`true`. Interval for which guest remains authorized using microsoft auth (in minutes), if not provided, uses expire`
         */
        microsoftExpire?: pulumi.Input<number | undefined>;
        /**
         * Whether password is enabled
         */
        passphraseEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `passphraseEnabled`==`true`. Interval for which guest remains authorized using passphrase auth (in minutes), if not provided, uses `expire`
         */
        passphraseExpire?: pulumi.Input<number | undefined>;
        /**
         * Required if `passphraseEnabled`==`true`. Passphrase guests must enter when passphrase authentication is enabled
         */
        password?: pulumi.Input<string | undefined>;
        /**
         * Whether to show list of sponsor emails mentioned in `sponsors` object as a dropdown. If both `sponsorNotifyAll` and `predefinedSponsorsEnabled` are false, behavior is acc to `sponsorEmailDomains`
         */
        predefinedSponsorsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to hide sponsor’s email from list of sponsors
         */
        predefinedSponsorsHideEmail?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to show the privacy policy in the WLAN guest portal
         */
        privacy?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `smsProvider`==`puzzel`. Password for the Puzzel SMS provider account
         */
        puzzelPassword?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`puzzel`. Service ID for the Puzzel SMS provider account
         */
        puzzelServiceId?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`puzzel`. Username for the Puzzel SMS provider account
         */
        puzzelUsername?: pulumi.Input<string | undefined>;
        /**
         * Whether sms is enabled as a login method
         */
        smsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `smsEnabled`==`true`. Interval for which guest remains authorized using sms auth (in minutes), if not provided, uses expire`
         */
        smsExpire?: pulumi.Input<number | undefined>;
        /**
         * Optional if `smsEnabled`==`true`. SMS Message format
         */
        smsMessageFormat?: pulumi.Input<string | undefined>;
        /**
         * Optional if `smsEnabled`==`true`. SMS provider used to deliver guest portal access codes
         */
        smsProvider?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`smsglobal`, Client API Key
         */
        smsglobalApiKey?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`smsglobal`, Client secret
         */
        smsglobalApiSecret?: pulumi.Input<string | undefined>;
        /**
         * Optional sender's number or sender ID for SMSGlobal. If not provided, uses the default number associated with the account
         */
        smsglobalSender?: pulumi.Input<string | undefined>;
        /**
         * Optional if `sponsorEnabled`==`true`. Whether to automatically approve guest and allow sponsor to revoke guest access, needs predefinedSponsorsEnabled enabled and sponsorNotifyAll disabled
         */
        sponsorAutoApprove?: pulumi.Input<boolean | undefined>;
        /**
         * Email domains allowed for sponsor email addresses. Required if `sponsorEnabled` is `true` and `sponsors` is empty.
         */
        sponsorEmailDomains?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether sponsor is enabled
         */
        sponsorEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `sponsorEnabled`==`true`. Interval for which guest remains authorized using sponsor auth (in minutes), if not provided, uses expire`
         */
        sponsorExpire?: pulumi.Input<number | undefined>;
        /**
         * Optional if `sponsorEnabled`==`true`. How long to remain valid sponsored guest request approve/deny link received in email, in minutes. Default is 60 minutes.
         */
        sponsorLinkValidityDuration?: pulumi.Input<string | undefined>;
        /**
         * Optional if `sponsorEnabled`==`true`. whether to notify all sponsors that are mentioned in `sponsors` object. Both `sponsorNotifyAll` and `predefinedSponsorsEnabled` should be true in order to notify sponsors. If true, email sent to 10 sponsors in no particular order.
         */
        sponsorNotifyAll?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `sponsorEnabled`==`true`. If enabled, guest will get email about sponsor's action (approve/deny)
         */
        sponsorStatusNotify?: pulumi.Input<boolean | undefined>;
        /**
         * object of allowed sponsors email with name. Required if `sponsorEnabled`
         *             is `true` and `sponsorEmailDomains` is empty.
         *
         *             Property key is the sponsor email, Property value is the sponsor name
         */
        sponsors?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
        /**
         * Optional if `wlanPortalAuth`==`sso`, default role to assign if there’s no match. By default, an assertion is treated as invalid when there’s no role matched
         */
        ssoDefaultRole?: pulumi.Input<string | undefined>;
        /**
         * Optional if `wlanPortalAuth`==`sso`. Role assigned to authenticated users when guest SSO is used
         */
        ssoForcedRole?: pulumi.Input<string | undefined>;
        /**
         * Required if `wlanPortalAuth`==`sso`. IDP Cert (used to verify the signed response)
         */
        ssoIdpCert?: pulumi.Input<string | undefined>;
        /**
         * Optional if `wlanPortalAuth`==`sso`. Signing algorithm used for SAML assertions from the identity provider
         */
        ssoIdpSignAlgo?: pulumi.Input<string | undefined>;
        /**
         * Required if `wlanPortalAuth`==`sso`, IDP Single-Sign-On URL
         */
        ssoIdpSsoUrl?: pulumi.Input<string | undefined>;
        /**
         * Required if `wlanPortalAuth`==`sso`, IDP issuer URL
         */
        ssoIssuer?: pulumi.Input<string | undefined>;
        /**
         * Optional if `wlanPortalAuth`==`sso`. SAML NameID format expected from the identity provider
         */
        ssoNameidFormat?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`telstra`, Client ID provided by Telstra
         */
        telstraClientId?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`telstra`, Client secret provided by Telstra
         */
        telstraClientSecret?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`twilio`, Auth token account with twilio account
         */
        twilioAuthToken?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`twilio`, Twilio phone number associated with the account. See example for accepted format.
         */
        twilioPhoneNumber?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`twilio`, Account SID provided by Twilio
         */
        twilioSid?: pulumi.Input<string | undefined>;
    }
    interface WlanPortalTemplatePortalTemplate {
        /**
         * Link text for using an alternate email address during access-code login
         */
        accessCodeAlternateEmail?: pulumi.Input<string | undefined>;
        /**
         * Text and content alignment used by the guest portal template
         */
        alignment?: pulumi.Input<string | undefined>;
        /**
         * Label for Amazon auth button
         */
        authButtonAmazon?: pulumi.Input<string | undefined>;
        /**
         * Label for Azure auth button
         */
        authButtonAzure?: pulumi.Input<string | undefined>;
        /**
         * Label for Email auth button
         */
        authButtonEmail?: pulumi.Input<string | undefined>;
        /**
         * Label for Facebook auth button
         */
        authButtonFacebook?: pulumi.Input<string | undefined>;
        /**
         * Label for Google auth button
         */
        authButtonGoogle?: pulumi.Input<string | undefined>;
        /**
         * Label for Microsoft auth button
         */
        authButtonMicrosoft?: pulumi.Input<string | undefined>;
        /**
         * Label for passphrase auth button
         */
        authButtonPassphrase?: pulumi.Input<string | undefined>;
        /**
         * Label for SMS auth button
         */
        authButtonSms?: pulumi.Input<string | undefined>;
        /**
         * Label for Sponsor auth button
         */
        authButtonSponsor?: pulumi.Input<string | undefined>;
        /**
         * Heading text displayed above portal authentication options
         */
        authLabel?: pulumi.Input<string | undefined>;
        /**
         * Label of the link to go back to /logon
         */
        backLink?: pulumi.Input<string | undefined>;
        /**
         * Primary color used by the portal template
         */
        color?: pulumi.Input<string | undefined>;
        /**
         * Darker accent color used by the portal template
         */
        colorDark?: pulumi.Input<string | undefined>;
        /**
         * Lighter accent color used by the portal template
         */
        colorLight?: pulumi.Input<string | undefined>;
        /**
         * Whether company field is required
         */
        company?: pulumi.Input<boolean | undefined>;
        /**
         * Error message when company not provided
         */
        companyError?: pulumi.Input<string | undefined>;
        /**
         * Label displayed for the company input field
         */
        companyLabel?: pulumi.Input<string | undefined>;
        /**
         * Whether email field is required
         */
        email?: pulumi.Input<boolean | undefined>;
        /**
         * Error message when a user has valid social login but doesn't match specified email domains.
         */
        emailAccessDomainError?: pulumi.Input<string | undefined>;
        /**
         * Label for cancel confirmation code submission using email auth
         */
        emailCancel?: pulumi.Input<string | undefined>;
        /**
         * Link text for requesting help when the email access code was not received
         */
        emailCodeCancel?: pulumi.Input<string | undefined>;
        /**
         * Error message shown when the alternate email address for access-code delivery is invalid
         */
        emailCodeError?: pulumi.Input<string | undefined>;
        /**
         * Label for the email access-code input field
         */
        emailCodeFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Instructional text shown before entering the email access code
         */
        emailCodeMessage?: pulumi.Input<string | undefined>;
        /**
         * Button label for submitting the email access code
         */
        emailCodeSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title shown on the email access-code entry page
         */
        emailCodeTitle?: pulumi.Input<string | undefined>;
        /**
         * Error message when email not provided
         */
        emailError?: pulumi.Input<string | undefined>;
        /**
         * Label for the email address input field
         */
        emailFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Label displayed for the email input field
         */
        emailLabel?: pulumi.Input<string | undefined>;
        /**
         * Instructional text explaining email access-code delivery
         */
        emailMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for confirmation code submit button using email auth
         */
        emailSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title for the Email registration
         */
        emailTitle?: pulumi.Input<string | undefined>;
        /**
         * Whether to ask field1
         */
        field1?: pulumi.Input<boolean | undefined>;
        /**
         * Error message when field1 not provided
         */
        field1error?: pulumi.Input<string | undefined>;
        /**
         * Label for custom field 1 input
         */
        field1label?: pulumi.Input<string | undefined>;
        /**
         * Whether custom field 1 must be provided when the field is shown
         */
        field1required?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to ask field2
         */
        field2?: pulumi.Input<boolean | undefined>;
        /**
         * Error message when field2 not provided
         */
        field2error?: pulumi.Input<string | undefined>;
        /**
         * Label for custom field 2 input
         */
        field2label?: pulumi.Input<string | undefined>;
        /**
         * Whether custom field 2 must be provided when the field is shown
         */
        field2required?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to ask field3
         */
        field3?: pulumi.Input<boolean | undefined>;
        /**
         * Error message when field3 not provided
         */
        field3error?: pulumi.Input<string | undefined>;
        /**
         * Label for custom field 3 input
         */
        field3label?: pulumi.Input<string | undefined>;
        /**
         * Whether custom field 3 must be provided when the field is shown
         */
        field3required?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to ask field4
         */
        field4?: pulumi.Input<boolean | undefined>;
        /**
         * Error message when field4 not provided
         */
        field4error?: pulumi.Input<string | undefined>;
        /**
         * Label for custom field 4 input
         */
        field4label?: pulumi.Input<string | undefined>;
        /**
         * Whether custom field 4 must be provided when the field is shown
         */
        field4required?: pulumi.Input<boolean | undefined>;
        /**
         * Can be used to localize the portal based on the User Agent. Allowed property key values are:
         *   `ar`, `ca-ES`, `cs-CZ`, `da-DK`, `de-DE`, `el-GR`, `en-GB`, `en-US`, `es-ES`, `fi-FI`, `fr-FR`,
         *   `he-IL`, `hi-IN`, `hr-HR`, `hu-HU`, `id-ID`, `it-IT`, `ja-J^`, `ko-KT`, `ms-MY`, `nb-NO`, `nl-NL`,
         *   `pl-PL`, `pt-BR`, `pt-PT`, `ro-RO`, `ru-RU`, `sk-SK`, `sv-SE`, `th-TH`, `tr-TR`, `uk-UA`, `vi-VN`,
         *   `zh-Hans`, `zh-Hant`
         */
        locales?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.org.WlanPortalTemplatePortalTemplateLocales>;
        } | undefined>;
        /**
         * path to the background image file. File must be a `png` image less than 100kB and image dimension must be less 500px x 200px (width x height).
         */
        logo?: pulumi.Input<string | undefined>;
        /**
         * label of the link to go to /marketing_policy
         */
        marketingPolicyLink?: pulumi.Input<string | undefined>;
        /**
         * Whether marketing policy optin is enabled
         */
        marketingPolicyOptIn?: pulumi.Input<boolean | undefined>;
        /**
         * label for marketing optin
         */
        marketingPolicyOptInLabel?: pulumi.Input<string | undefined>;
        /**
         * Text of the marketing policy opt-in content
         */
        marketingPolicyOptInText?: pulumi.Input<string | undefined>;
        /**
         * Main message displayed on the guest portal sign-in page
         */
        message?: pulumi.Input<string | undefined>;
        /**
         * Whether the portal presents multiple authentication methods
         */
        multiAuth?: pulumi.Input<boolean | undefined>;
        /**
         * Whether name field is required
         */
        name?: pulumi.Input<boolean | undefined>;
        /**
         * Error message when name not provided
         */
        nameError?: pulumi.Input<string | undefined>;
        /**
         * Label displayed for the name input field
         */
        nameLabel?: pulumi.Input<string | undefined>;
        /**
         * Default value for the `Do not store` checkbox
         */
        optOutDefault?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to display Do Not Store My Personal Information
         */
        optout?: pulumi.Input<boolean | undefined>;
        /**
         * Label for Do Not Store My Personal Information
         */
        optoutLabel?: pulumi.Input<string | undefined>;
        /**
         * Browser or page title shown for the guest portal
         */
        pageTitle?: pulumi.Input<string | undefined>;
        /**
         * Label for the Passphrase cancel button
         */
        passphraseCancel?: pulumi.Input<string | undefined>;
        /**
         * Error message when invalid passphrase is provided
         */
        passphraseError?: pulumi.Input<string | undefined>;
        /**
         * Label for the passphrase input field
         */
        passphraseLabel?: pulumi.Input<string | undefined>;
        /**
         * Instructional text shown on the passphrase sign-in page
         */
        passphraseMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for the Passphrase submit button
         */
        passphraseSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title for passphrase details page
         */
        passphraseTitle?: pulumi.Input<string | undefined>;
        /**
         * Whether to show \"Powered by Mist\"
         */
        poweredBy?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to require the Privacy Term acceptance
         */
        privacy?: pulumi.Input<boolean | undefined>;
        /**
         * Prefix of the label of the link to go to Privacy Policy
         */
        privacyPolicyAcceptLabel?: pulumi.Input<string | undefined>;
        /**
         * Error message when Privacy Policy not accepted
         */
        privacyPolicyError?: pulumi.Input<string | undefined>;
        /**
         * Label of the link to go to Privacy Policy
         */
        privacyPolicyLink?: pulumi.Input<string | undefined>;
        /**
         * Text of the Privacy Policy
         */
        privacyPolicyText?: pulumi.Input<string | undefined>;
        /**
         * Text used to mark a form field as required
         */
        requiredFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Whether the portal template uses a responsive layout
         */
        responsiveLayout?: pulumi.Input<boolean | undefined>;
        /**
         * Label of the button to signin
         */
        signInLabel?: pulumi.Input<string | undefined>;
        /**
         * Default option text shown in the SMS carrier selector
         */
        smsCarrierDefault?: pulumi.Input<string | undefined>;
        /**
         * Error message shown when no mobile carrier is selected
         */
        smsCarrierError?: pulumi.Input<string | undefined>;
        /**
         * Label for mobile carrier drop-down list
         */
        smsCarrierFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Label for cancel confirmation code submission
         */
        smsCodeCancel?: pulumi.Input<string | undefined>;
        /**
         * Error message when confirmation code is invalid
         */
        smsCodeError?: pulumi.Input<string | undefined>;
        /**
         * Label for the SMS confirmation-code input field
         */
        smsCodeFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Instructional text shown before entering the SMS access code
         */
        smsCodeMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for confirmation code submit button
         */
        smsCodeSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title shown on the SMS access-code entry page
         */
        smsCodeTitle?: pulumi.Input<string | undefined>;
        /**
         * Label for the SMS country-code input field
         */
        smsCountryFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Example country code format shown for SMS authentication
         */
        smsCountryFormat?: pulumi.Input<string | undefined>;
        /**
         * Label for checkbox to specify that the user has access code
         */
        smsHaveAccessCode?: pulumi.Input<string | undefined>;
        /**
         * Whether the SMS portal flow uses Twilio-specific behavior
         */
        smsIsTwilio?: pulumi.Input<boolean | undefined>;
        /**
         * Format of access code sms message. {{code}} and {{duration}} are placeholders and should be retained as is.
         */
        smsMessageFormat?: pulumi.Input<string | undefined>;
        /**
         * Label for canceling mobile details for SMS auth
         */
        smsNumberCancel?: pulumi.Input<string | undefined>;
        /**
         * Error message shown when the mobile number is invalid
         */
        smsNumberError?: pulumi.Input<string | undefined>;
        /**
         * Label for field to provide mobile number
         */
        smsNumberFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Example mobile number format shown for SMS authentication
         */
        smsNumberFormat?: pulumi.Input<string | undefined>;
        /**
         * Instructional text explaining SMS access-code delivery
         */
        smsNumberMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for submit button for code generation
         */
        smsNumberSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title for phone number details
         */
        smsNumberTitle?: pulumi.Input<string | undefined>;
        /**
         * Example username format shown for SMS authentication
         */
        smsUsernameFormat?: pulumi.Input<string | undefined>;
        /**
         * How long confirmation code should be considered valid (in minutes)
         */
        smsValidityDuration?: pulumi.Input<number | undefined>;
        /**
         * Link text for returning to edit the sponsor request form
         */
        sponsorBackLink?: pulumi.Input<string | undefined>;
        /**
         * Button label for canceling sponsor authentication
         */
        sponsorCancel?: pulumi.Input<string | undefined>;
        /**
         * Label for Sponsor Email
         */
        sponsorEmail?: pulumi.Input<string | undefined>;
        /**
         * Error message shown when the sponsor email address is invalid
         */
        sponsorEmailError?: pulumi.Input<string | undefined>;
        /**
         * HTML template to replace/override default sponsor email template
         * Sponsor Email Template supports following template variables:
         *   * `approveUrl`: Renders URL to approve the request; optionally &minutes=N query param can be appended to change the Authorization period of the guest, where N is a valid integer denoting number of minutes a guest remains authorized
         *   * `denyUrl`: Renders URL to reject the request
         *   * `guestEmail`: Renders Email ID of the guest
         *   * `guestName`: Renders Name of the guest
         *   * `field1`: Renders value of the Custom Field 1
         *   * `field2`: Renders value of the Custom Field 2
         *   * `sponsorLinkValidityDuration`: Renders validity time of the request (i.e. Approve/Deny URL)
         *   * `authExpireMinutes`: Renders Wlan-level configured Guest Authorization Expiration time period (in minutes), If not configured then default (1 day in minutes)
         */
        sponsorEmailTemplate?: pulumi.Input<string | undefined>;
        /**
         * Status message prefix shown when a sponsor approves the request
         */
        sponsorInfoApproved?: pulumi.Input<string | undefined>;
        /**
         * Status message prefix shown when a sponsor denies the request
         */
        sponsorInfoDenied?: pulumi.Input<string | undefined>;
        /**
         * Status message prefix shown after a sponsor notification is sent
         */
        sponsorInfoPending?: pulumi.Input<string | undefined>;
        /**
         * Label for Sponsor Name
         */
        sponsorName?: pulumi.Input<string | undefined>;
        /**
         * Error message shown when the sponsor name is missing
         */
        sponsorNameError?: pulumi.Input<string | undefined>;
        /**
         * Additional status text shown while sponsor approval is pending
         */
        sponsorNotePending?: pulumi.Input<string | undefined>;
        /**
         * Submit button label request Wifi Access and notify sponsor about guest request
         */
        sponsorRequestAccess?: pulumi.Input<string | undefined>;
        /**
         * Text to display if sponsor approves request
         */
        sponsorStatusApproved?: pulumi.Input<string | undefined>;
        /**
         * Text to display when sponsor denies request
         */
        sponsorStatusDenied?: pulumi.Input<string | undefined>;
        /**
         * Text to display if request is still pending
         */
        sponsorStatusPending?: pulumi.Input<string | undefined>;
        /**
         * Submit button label to notify sponsor about guest request
         */
        sponsorSubmit?: pulumi.Input<string | undefined>;
        /**
         * Error message shown when no sponsor is selected
         */
        sponsorsError?: pulumi.Input<string | undefined>;
        /**
         * Label for the sponsor selection field
         */
        sponsorsFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Whether the portal requires Terms of Service acceptance
         */
        tos?: pulumi.Input<boolean | undefined>;
        /**
         * Prefix of the label of the link to go to tos
         */
        tosAcceptLabel?: pulumi.Input<string | undefined>;
        /**
         * Error message when tos not accepted
         */
        tosError?: pulumi.Input<string | undefined>;
        /**
         * Label of the link to go to tos
         */
        tosLink?: pulumi.Input<string | undefined>;
        /**
         * Text of the Terms of Service
         */
        tosText?: pulumi.Input<string | undefined>;
    }
    interface WlanPortalTemplatePortalTemplateLocales {
        /**
         * Label for Amazon auth button
         */
        authButtonAmazon?: pulumi.Input<string | undefined>;
        /**
         * Label for Azure auth button
         */
        authButtonAzure?: pulumi.Input<string | undefined>;
        /**
         * Label for Email auth button
         */
        authButtonEmail?: pulumi.Input<string | undefined>;
        /**
         * Label for Facebook auth button
         */
        authButtonFacebook?: pulumi.Input<string | undefined>;
        /**
         * Label for Google auth button
         */
        authButtonGoogle?: pulumi.Input<string | undefined>;
        /**
         * Label for Microsoft auth button
         */
        authButtonMicrosoft?: pulumi.Input<string | undefined>;
        /**
         * Label for passphrase auth button
         */
        authButtonPassphrase?: pulumi.Input<string | undefined>;
        /**
         * Label for SMS auth button
         */
        authButtonSms?: pulumi.Input<string | undefined>;
        /**
         * Label for Sponsor auth button
         */
        authButtonSponsor?: pulumi.Input<string | undefined>;
        /**
         * Localized heading text displayed above portal authentication options
         */
        authLabel?: pulumi.Input<string | undefined>;
        /**
         * Label of the link to go back to /logon
         */
        backLink?: pulumi.Input<string | undefined>;
        /**
         * Error message when company not provided
         */
        companyError?: pulumi.Input<string | undefined>;
        /**
         * Localized label displayed for the company input field
         */
        companyLabel?: pulumi.Input<string | undefined>;
        /**
         * Error message when a user has valid social login but doesn't match specified email domains.
         */
        emailAccessDomainError?: pulumi.Input<string | undefined>;
        /**
         * Label for cancel confirmation code submission using email auth
         */
        emailCancel?: pulumi.Input<string | undefined>;
        /**
         * Localized link text for requesting help when the email access code was not received
         */
        emailCodeCancel?: pulumi.Input<string | undefined>;
        /**
         * Localized error message shown when the alternate email address for access-code delivery is invalid
         */
        emailCodeError?: pulumi.Input<string | undefined>;
        /**
         * Localized label for the email access-code input field
         */
        emailCodeFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized instructional text shown before entering the email access code
         */
        emailCodeMessage?: pulumi.Input<string | undefined>;
        /**
         * Localized button label for submitting the email access code
         */
        emailCodeSubmit?: pulumi.Input<string | undefined>;
        /**
         * Localized title shown on the email access-code entry page
         */
        emailCodeTitle?: pulumi.Input<string | undefined>;
        /**
         * Error message when email not provided
         */
        emailError?: pulumi.Input<string | undefined>;
        /**
         * Localized label for the email address input field
         */
        emailFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized label displayed for the email input field
         */
        emailLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized instructional text explaining email access-code delivery
         */
        emailMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for confirmation code submit button using email auth
         */
        emailSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title for the Email registration
         */
        emailTitle?: pulumi.Input<string | undefined>;
        /**
         * Error message when field1 not provided
         */
        field1error?: pulumi.Input<string | undefined>;
        /**
         * Localized label for custom field 1 input
         */
        field1label?: pulumi.Input<string | undefined>;
        /**
         * Error message when field2 not provided
         */
        field2error?: pulumi.Input<string | undefined>;
        /**
         * Localized label for custom field 2 input
         */
        field2label?: pulumi.Input<string | undefined>;
        /**
         * Error message when field3 not provided
         */
        field3error?: pulumi.Input<string | undefined>;
        /**
         * Localized label for custom field 3 input
         */
        field3label?: pulumi.Input<string | undefined>;
        /**
         * Error message when field4 not provided
         */
        field4error?: pulumi.Input<string | undefined>;
        /**
         * Localized label for custom field 4 input
         */
        field4label?: pulumi.Input<string | undefined>;
        /**
         * label of the link to go to /marketing_policy
         */
        marketingPolicyLink?: pulumi.Input<string | undefined>;
        /**
         * Whether marketing policy optin is enabled
         */
        marketingPolicyOptIn?: pulumi.Input<boolean | undefined>;
        /**
         * label for marketing optin
         */
        marketingPolicyOptInLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized text of the marketing policy opt-in content
         */
        marketingPolicyOptInText?: pulumi.Input<string | undefined>;
        /**
         * Localized main message displayed on the guest portal sign-in page
         */
        message?: pulumi.Input<string | undefined>;
        /**
         * Error message when name not provided
         */
        nameError?: pulumi.Input<string | undefined>;
        /**
         * Localized label displayed for the name input field
         */
        nameLabel?: pulumi.Input<string | undefined>;
        /**
         * Label for Do Not Store My Personal Information
         */
        optoutLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized browser or page title shown for the guest portal
         */
        pageTitle?: pulumi.Input<string | undefined>;
        /**
         * Label for the Passphrase cancel button
         */
        passphraseCancel?: pulumi.Input<string | undefined>;
        /**
         * Error message when invalid passphrase is provided
         */
        passphraseError?: pulumi.Input<string | undefined>;
        /**
         * Localized label for the passphrase input field
         */
        passphraseLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized instructional text shown on the passphrase sign-in page
         */
        passphraseMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for the Passphrase submit button
         */
        passphraseSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title for passphrase details page
         */
        passphraseTitle?: pulumi.Input<string | undefined>;
        /**
         * Prefix of the label of the link to go to Privacy Policy
         */
        privacyPolicyAcceptLabel?: pulumi.Input<string | undefined>;
        /**
         * Error message when Privacy Policy not accepted
         */
        privacyPolicyError?: pulumi.Input<string | undefined>;
        /**
         * Label of the link to go to Privacy Policy
         */
        privacyPolicyLink?: pulumi.Input<string | undefined>;
        /**
         * Text of the Privacy Policy
         */
        privacyPolicyText?: pulumi.Input<string | undefined>;
        /**
         * Localized text used to mark a form field as required
         */
        requiredFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Label of the button to signin
         */
        signInLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized default option text shown in the SMS carrier selector
         */
        smsCarrierDefault?: pulumi.Input<string | undefined>;
        /**
         * Localized error message shown when no mobile carrier is selected
         */
        smsCarrierError?: pulumi.Input<string | undefined>;
        /**
         * Label for mobile carrier drop-down list
         */
        smsCarrierFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Label for cancel confirmation code submission
         */
        smsCodeCancel?: pulumi.Input<string | undefined>;
        /**
         * Error message when confirmation code is invalid
         */
        smsCodeError?: pulumi.Input<string | undefined>;
        /**
         * Localized label for the SMS confirmation-code input field
         */
        smsCodeFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized instructional text shown before entering the SMS access code
         */
        smsCodeMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for confirmation code submit button
         */
        smsCodeSubmit?: pulumi.Input<string | undefined>;
        /**
         * Localized title shown on the SMS access-code entry page
         */
        smsCodeTitle?: pulumi.Input<string | undefined>;
        /**
         * Localized label for the SMS country-code input field
         */
        smsCountryFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized example country code format shown for SMS authentication
         */
        smsCountryFormat?: pulumi.Input<string | undefined>;
        /**
         * Label for checkbox to specify that the user has access code
         */
        smsHaveAccessCode?: pulumi.Input<string | undefined>;
        /**
         * Format of access code sms message. {{code}} and {{duration}} are placeholders and should be retained as is.
         */
        smsMessageFormat?: pulumi.Input<string | undefined>;
        /**
         * Label for canceling mobile details for SMS auth
         */
        smsNumberCancel?: pulumi.Input<string | undefined>;
        /**
         * Localized error message shown when the mobile number is invalid
         */
        smsNumberError?: pulumi.Input<string | undefined>;
        /**
         * Label for field to provide mobile number
         */
        smsNumberFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized example mobile number format shown for SMS authentication
         */
        smsNumberFormat?: pulumi.Input<string | undefined>;
        /**
         * Localized instructional text explaining SMS access-code delivery
         */
        smsNumberMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for submit button for code generation
         */
        smsNumberSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title for phone number details
         */
        smsNumberTitle?: pulumi.Input<string | undefined>;
        /**
         * Localized example username format shown for SMS authentication
         */
        smsUsernameFormat?: pulumi.Input<string | undefined>;
        /**
         * Localized link text for returning to edit the sponsor request form
         */
        sponsorBackLink?: pulumi.Input<string | undefined>;
        /**
         * Localized button label for canceling sponsor authentication
         */
        sponsorCancel?: pulumi.Input<string | undefined>;
        /**
         * Label for Sponsor Email
         */
        sponsorEmail?: pulumi.Input<string | undefined>;
        /**
         * Localized error message shown when the sponsor email address is invalid
         */
        sponsorEmailError?: pulumi.Input<string | undefined>;
        /**
         * Localized status message prefix shown when a sponsor approves the request
         */
        sponsorInfoApproved?: pulumi.Input<string | undefined>;
        /**
         * Localized status message prefix shown when a sponsor denies the request
         */
        sponsorInfoDenied?: pulumi.Input<string | undefined>;
        /**
         * Localized status message prefix shown after a sponsor notification is sent
         */
        sponsorInfoPending?: pulumi.Input<string | undefined>;
        /**
         * Label for Sponsor Name
         */
        sponsorName?: pulumi.Input<string | undefined>;
        /**
         * Localized error message shown when the sponsor name is missing
         */
        sponsorNameError?: pulumi.Input<string | undefined>;
        /**
         * Localized additional status text shown while sponsor approval is pending
         */
        sponsorNotePending?: pulumi.Input<string | undefined>;
        /**
         * Submit button label request Wifi Access and notify sponsor about guest request
         */
        sponsorRequestAccess?: pulumi.Input<string | undefined>;
        /**
         * Text to display if sponsor approves request
         */
        sponsorStatusApproved?: pulumi.Input<string | undefined>;
        /**
         * Text to display when sponsor denies request
         */
        sponsorStatusDenied?: pulumi.Input<string | undefined>;
        /**
         * Text to display if request is still pending
         */
        sponsorStatusPending?: pulumi.Input<string | undefined>;
        /**
         * Submit button label to notify sponsor about guest request
         */
        sponsorSubmit?: pulumi.Input<string | undefined>;
        /**
         * Localized error message shown when no sponsor is selected
         */
        sponsorsError?: pulumi.Input<string | undefined>;
        /**
         * Localized label for the sponsor selection field
         */
        sponsorsFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Prefix of the label of the link to go to tos
         */
        tosAcceptLabel?: pulumi.Input<string | undefined>;
        /**
         * Error message when tos not accepted
         */
        tosError?: pulumi.Input<string | undefined>;
        /**
         * Label of the link to go to tos
         */
        tosLink?: pulumi.Input<string | undefined>;
        /**
         * Text of the Terms of Service
         */
        tosText?: pulumi.Input<string | undefined>;
    }
    interface WlanQos {
        /**
         * QoS traffic class applied when WLAN QoS override is enabled
         */
        class?: pulumi.Input<string | undefined>;
        /**
         * Whether to overwrite QoS
         */
        overwrite?: pulumi.Input<boolean | undefined>;
    }
    interface WlanRadsec {
        /**
         * Whether RADIUS Change of Authorization (CoA) is enabled for RadSec traffic
         */
        coaEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether RadSec is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Idle timeout, in seconds, for RadSec connections
         */
        idleTimeout?: pulumi.Input<string | undefined>;
        /**
         * Mist Edge cluster IDs used as RadSec proxies when the WLAN does not use mxtunnel
         */
        mxclusterIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * RadSec proxy hostnames advertised to APs
         */
        proxyHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * TLS server name to verify against the CA certificates in Org Setting. Only if not Mist Edge.
         */
        serverName?: pulumi.Input<string | undefined>;
        /**
         * External RadSec servers. Only if not Mist Edge.
         */
        servers?: pulumi.Input<pulumi.Input<inputs.org.WlanRadsecServer>[] | undefined>;
        /**
         * Whether to use organization Mist Edge instances as RadSec proxies
         */
        useMxedge?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to use site Mist Edge instances when this WLAN does not use mxtunnel
         */
        useSiteMxedge?: pulumi.Input<boolean | undefined>;
    }
    interface WlanRadsecServer {
        /**
         * Address or hostname of the RadSec server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * TCP port used by the RadSec server
         */
        port?: pulumi.Input<number | undefined>;
    }
    interface WlanRateset {
        /**
         * If `template`==`custom`. EHT MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit)
         */
        eht?: pulumi.Input<string | undefined>;
        /**
         * If `template`==`custom`. HE MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit
         */
        he?: pulumi.Input<string | undefined>;
        /**
         * If `template`==`custom`. MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit), e.g. 00ff 00f0 001f limits HT rates to MCS 0-7 for 1 stream, MCS 4-7 for 2 stream (i.e. MCS 12-15), MCS 1-5 for 3 stream (i.e. MCS 16-20)
         */
        ht?: pulumi.Input<string | undefined>;
        /**
         * if `template`==`custom`. List of supported rates (IE=1) and extended supported rates (IE=50) for custom template, append ‘b’ at the end to indicate a rate being basic/mandatory. If `template`==`custom` is configured and legacy does not define at least one basic rate, it will use `no-legacy` default values. enum: `1`, `11`, `11b`, `12`, `12b`, `18`, `18b`, `1b`, `2`, `24`, `24b`, `2b`, `36`, `36b`, `48`, `48b`, `5.5`, `5.5b`, `54`, `54b`, `6`, `6b`, `9`, `9b`
         */
        legacies?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Minimum RSSI for client to connect, 0 means not enforcing
         */
        minRssi?: pulumi.Input<number | undefined>;
        /**
         * Data rate template used to derive WLAN rate settings
         */
        template?: pulumi.Input<string | undefined>;
        /**
         * If `template`==`custom`. MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit), e.g. 03ff 01ff 00ff limits VHT rates to MCS 0-9 for 1 stream, MCS 0-8 for 2 streams, and MCS 0-7 for 3 streams.
         */
        vht?: pulumi.Input<string | undefined>;
    }
    interface WlanSchedule {
        /**
         * Whether the WLAN operating schedule is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Time ranges when the WLAN is scheduled to operate
         */
        hours?: pulumi.Input<inputs.org.WlanScheduleHours | undefined>;
    }
    interface WlanScheduleHours {
        /**
         * Operating hour range for Friday
         */
        fri?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Monday
         */
        mon?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Saturday
         */
        sat?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Sunday
         */
        sun?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Thursday
         */
        thu?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Tuesday
         */
        tue?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Wednesday
         */
        wed?: pulumi.Input<string | undefined>;
    }
    interface WlantemplateApplies {
        /**
         * Organization included in the WLAN template application scope
         */
        orgId?: pulumi.Input<string | undefined>;
        /**
         * Sites included in the WLAN template application scope
         */
        siteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Site groups included in the WLAN template application scope
         */
        sitegroupIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface WlantemplateExceptions {
        /**
         * Sites excluded from the WLAN template application scope
         */
        siteIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Site groups excluded from the WLAN template application scope
         */
        sitegroupIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface WxtagSpec {
        /**
         * Matched destination port, "0" means any
         */
        portRange?: pulumi.Input<string | undefined>;
        /**
         * tcp / udp / icmp / gre / any / ":protocol_number", `protocolNumber` is between 1-254
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Destination subnets or IP addresses matched by this WxLAN tag spec
         */
        subnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
}
export declare namespace site {
    interface BaseLatlng {
        /**
         * Geographic latitude in decimal degrees
         */
        lat: pulumi.Input<number>;
        /**
         * Geographic longitude in decimal degrees
         */
        lng: pulumi.Input<number>;
    }
    interface EvpnTopologyEvpnOptions {
        /**
         * Optional, for dhcp_relay, unique loopback IPs are required for ERB or IPClos where we can set option-82 server_id-overrides
         */
        autoLoopbackSubnet?: pulumi.Input<string | undefined>;
        /**
         * Optional, for dhcp_relay, unique loopback IPs are required for ERB or IPClos where we can set option-82 server_id-overrides
         */
        autoLoopbackSubnet6?: pulumi.Input<string | undefined>;
        /**
         * Optional, this generates routerId automatically, if specified, `routerIdPrefix` is ignored
         */
        autoRouterIdSubnet?: pulumi.Input<string | undefined>;
        /**
         * Optional, this generates routerId automatically, if specified, `routerIdPrefix` is ignored
         */
        autoRouterIdSubnet6?: pulumi.Input<string | undefined>;
        /**
         * Optional, for ERB or CLOS, you can either use esilag to upstream routers or to also be the virtual-gateway. When `routedAt` != `core`, whether to do virtual-gateway at core as well
         */
        coreAsBorder?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to route management traffic inband; routes will be propagated to downstream switches
         */
        enableInbandMgmt?: pulumi.Input<boolean | undefined>;
        /**
         * if the mangement traffic goes inbnd, during installation, only the border/core switches are connected to the Internet to allow initial configuration to be pushed down and leave the downstream access switches stay in the Factory Default state enabling inband-ztp allows upstream switches to use LLDP to assign IP and gives Internet to downstream switches in that state
         */
        enableInbandZtp?: pulumi.Input<boolean | undefined>;
        /**
         * EVPN overlay BGP settings for the topology
         */
        overlay?: pulumi.Input<inputs.site.EvpnTopologyEvpnOptionsOverlay | undefined>;
        /**
         * Only for by Core-Distribution architecture when `evpn_options.routed_at`==`core`. By default, JUNOS uses 00-00-5e-00-01-01 as the virtual-gateway-address's v4_mac. If enabled, 00-00-5e-00-0X-YY will be used (where XX=vlan_id/256, YY=vlan_id%256)
         */
        perVlanVgaV4Mac?: pulumi.Input<boolean | undefined>;
        /**
         * Only for by Core-Distribution architecture when `evpn_options.routed_at`==`core`. By default, JUNOS uses 00-00-5e-00-02-01 as the virtual-gateway-address's v6_mac. If enabled, 00-00-5e-00-1X-YY will be used (where XX=vlan_id/256, YY=vlan_id%256)
         */
        perVlanVgaV6Mac?: pulumi.Input<boolean | undefined>;
        /**
         * Topology tier where EVPN virtual gateway routing is placed
         */
        routedAt?: pulumi.Input<string | undefined>;
        /**
         * EVPN underlay BGP and subnet settings for the topology
         */
        underlay?: pulumi.Input<inputs.site.EvpnTopologyEvpnOptionsUnderlay | undefined>;
        /**
         * Virtual-switch instance mappings used to segregate EVPN networks
         */
        vsInstances?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.site.EvpnTopologyEvpnOptionsVsInstances>;
        } | undefined>;
    }
    interface EvpnTopologyEvpnOptionsOverlay {
        /**
         * Overlay BGP Local AS Number
         */
        as?: pulumi.Input<number | undefined>;
    }
    interface EvpnTopologyEvpnOptionsUnderlay {
        /**
         * Underlay BGP Base AS Number
         */
        asBase?: pulumi.Input<number | undefined>;
        /**
         * Prefix length used for automatically derived underlay router identifiers
         */
        routedIdPrefix?: pulumi.Input<string | undefined>;
        /**
         * Underlay subnet, by default, `10.255.240.0/20`, or `fd31:5700::/64` for ipv6
         */
        subnet?: pulumi.Input<string | undefined>;
        /**
         * If v6 is desired for underlay
         */
        useIpv6?: pulumi.Input<boolean | undefined>;
    }
    interface EvpnTopologyEvpnOptionsVsInstances {
        /**
         * List of network names included in this virtual-switch instance
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface EvpnTopologySwitches {
        /**
         * Associated device profile identifier for the switch. Use the Assign Org Device Profile endpoint to assign a Device Profile to the switch.
         */
        deviceprofileId?: pulumi.Input<string | undefined>;
        /**
         * IP addresses used by this switch for EVPN downlinks
         */
        downlinkIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Switch MAC addresses connected as downlinks from this topology member
         */
        downlinks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Switch MAC addresses connected through ESI-LAG from this topology member
         */
        esilaglinks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Topology identifier number for this EVPN switch member
         */
        evpnId?: pulumi.Input<number | undefined>;
        /**
         * Switch MAC address used to identify the topology member
         */
        mac?: pulumi.Input<string | undefined>;
        /**
         * Switch model for this topology member
         */
        model?: pulumi.Input<string | undefined>;
        /**
         * Optionally, for distribution / access / esilag-access, they can be placed into different pods. e.g.
         *   * for CLOS, to group dist / access switches into pods
         *   * for ERB/CRB, to group dist / esilag-access into pods
         */
        pod?: pulumi.Input<number | undefined>;
        /**
         * List of pod numbers this switch participates in
         */
        pods?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * EVPN topology role for this switch
         */
        role: pulumi.Input<string>;
        /**
         * Routing identifier used by this switch for EVPN routing
         */
        routerId?: pulumi.Input<string | undefined>;
        /**
         * Associated site for this EVPN topology switch
         */
        siteId?: pulumi.Input<string | undefined>;
        /**
         * Builder-suggested downlink switch MAC addresses
         */
        suggestedDownlinks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Builder-suggested ESI-LAG switch MAC addresses
         */
        suggestedEsilaglinks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Builder-suggested uplink switch MAC addresses
         */
        suggestedUplinks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Switch MAC addresses connected as uplinks from this topology member
         */
        uplinks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateAclPolicy {
        /**
         * ACL Policy Actions:
         *   - for GBP-based policy, all srcTags and dstTags have to be gbp-based
         *   - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
         */
        actions?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateAclPolicyAction>[] | undefined>;
        name?: pulumi.Input<string | undefined>;
        /**
         * ACL Policy Source Tags:
         *   - for GBP-based policy, all srcTags and dstTags have to be gbp-based
         *   - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to
         */
        srcTags?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateAclPolicyAction {
        /**
         * enum: `allow`, `deny`
         */
        action?: pulumi.Input<string | undefined>;
        dstTag: pulumi.Input<string>;
    }
    interface NetworktemplateAclTags {
        /**
         * ARP / IPv6. Default is `any`
         */
        etherTypes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Required if
         *   - `type`==`dynamicGbp` (gbp_tag received from RADIUS)
         *   - `type`==`gbpResource`
         *   - `type`==`staticGbp` (applying gbp tag against matching conditions)
         */
        gbpTag?: pulumi.Input<number | undefined>;
        /**
         * Required if
         * - `type`==`mac`
         * - `type`==`staticGbp` if from matching mac
         */
        macs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * If:
         *   * `type`==`mac` (optional. default is `any`)
         *   * `type`==`subnet` (optional. default is `any`)
         *   * `type`==`network`
         *   * `type`==`resource` (optional. default is `any`)
         *   * `type`==`staticGbp` if from matching network (vlan)
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Required if `type`==`portUsage`
         */
        portUsage?: pulumi.Input<string | undefined>;
        /**
         * Required if:
         *   * `type`==`radiusGroup`
         *   * `type`==`staticGbp`
         * if from matching radius_group
         */
        radiusGroup?: pulumi.Input<string | undefined>;
        /**
         * If `type`==`resource`, `type`==`radiusGroup`, `type`==`portUsage` or `type`==`gbpResource`. Empty means unrestricted, i.e. any
         */
        specs?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateAclTagsSpec>[] | undefined>;
        /**
         * If
         * - `type`==`subnet`
         * - `type`==`resource` (optional. default is `any`)
         * - `type`==`staticGbp` if from matching subnet
         */
        subnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * enum:
         *   * `any`: matching anything not identified
         *   * `dynamicGbp`: from the gbpTag received from RADIUS
         *   * `gbpResource`: can only be used in `dstTags`
         *   * `mac`
         *   * `network`
         *   * `portUsage`
         *   * `radiusGroup`
         *   * `resource`: can only be used in `dstTags`
         *   * `staticGbp`: applying gbp tag against matching conditions
         *   * `subnet`'
         */
        type: pulumi.Input<string>;
    }
    interface NetworktemplateAclTagsSpec {
        /**
         * Matched dst port, "0" means any
         */
        portRange?: pulumi.Input<string | undefined>;
        /**
         * `tcp` / `udp` / `icmp` / `icmp6` / `gre` / `any` / `:protocol_number`, `protocolNumber` is between 1-254, default is `any` `protocolNumber` is between 1-254
         */
        protocol?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateDhcpSnooping {
        allNetworks?: pulumi.Input<boolean | undefined>;
        /**
         * Enable for dynamic ARP inspection check
         */
        enableArpSpoofCheck?: pulumi.Input<boolean | undefined>;
        /**
         * Enable for check for forging source IP address
         */
        enableIpSourceGuard?: pulumi.Input<boolean | undefined>;
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * If `allNetworks`==`false`, list of network with DHCP snooping enabled
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateExtraRoutes {
        /**
         * This takes precedence
         */
        discard?: pulumi.Input<boolean | undefined>;
        metric?: pulumi.Input<number | undefined>;
        nextQualified?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.site.NetworktemplateExtraRoutesNextQualified>;
        } | undefined>;
        noResolve?: pulumi.Input<boolean | undefined>;
        preference?: pulumi.Input<number | undefined>;
        /**
         * Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.
         */
        via: pulumi.Input<string>;
    }
    interface NetworktemplateExtraRoutes6 {
        /**
         * This takes precedence
         */
        discard?: pulumi.Input<boolean | undefined>;
        metric?: pulumi.Input<number | undefined>;
        nextQualified?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.site.NetworktemplateExtraRoutes6NextQualified>;
        } | undefined>;
        noResolve?: pulumi.Input<boolean | undefined>;
        preference?: pulumi.Input<number | undefined>;
        /**
         * Next-hop IP Address. Can be a single IP address or an array of IP addresses for ECMP (Equal-Cost Multi-Path) load balancing across multiple next-hops.
         */
        via: pulumi.Input<string>;
    }
    interface NetworktemplateExtraRoutes6NextQualified {
        metric?: pulumi.Input<number | undefined>;
        preference?: pulumi.Input<number | undefined>;
    }
    interface NetworktemplateExtraRoutesNextQualified {
        metric?: pulumi.Input<number | undefined>;
        preference?: pulumi.Input<number | undefined>;
    }
    interface NetworktemplateMistNac {
        enabled?: pulumi.Input<boolean | undefined>;
        network?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateNetworks {
        /**
         * Only required for EVPN-VXLAN networks, IPv4 Virtual Gateway
         */
        gateway?: pulumi.Input<string | undefined>;
        /**
         * Only required for EVPN-VXLAN networks, IPv6 Virtual Gateway
         */
        gateway6?: pulumi.Input<string | undefined>;
        /**
         * whether to stop clients to talk to each other, default is false (when enabled, a unique isolationVlanId is required). NOTE: this features requires uplink device to also a be Juniper device and `interSwitchLink` to be set. See also `interIsolationNetworkLink` and `communityVlanId` in port_usage
         */
        isolation?: pulumi.Input<boolean | undefined>;
        isolationVlanId?: pulumi.Input<string | undefined>;
        /**
         * Optional for pure switching, required when L3 / routing features are used
         */
        subnet?: pulumi.Input<string | undefined>;
        /**
         * Optional for pure switching, required when L3 / routing features are used
         */
        subnet6?: pulumi.Input<string | undefined>;
        vlanId: pulumi.Input<string>;
    }
    interface NetworktemplateOspfAreas {
        includeLoopback?: pulumi.Input<boolean | undefined>;
        networks: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.site.NetworktemplateOspfAreasNetworks>;
        }>;
        /**
         * OSPF type. enum: `default`, `nssa`, `stub`
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateOspfAreasNetworks {
        /**
         * Required if `authType`==`md5`. Property key is the key number
         */
        authKeys?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
        /**
         * Required if `authType`==`password`, the password, max length is 8
         */
        authPassword?: pulumi.Input<string | undefined>;
        /**
         * auth type. enum: `md5`, `none`, `password`
         */
        authType?: pulumi.Input<string | undefined>;
        bfdMinimumInterval?: pulumi.Input<number | undefined>;
        deadInterval?: pulumi.Input<number | undefined>;
        exportPolicy?: pulumi.Input<string | undefined>;
        helloInterval?: pulumi.Input<number | undefined>;
        importPolicy?: pulumi.Input<string | undefined>;
        /**
         * interface type (nbma = non-broadcast multi-access). enum: `broadcast`, `nbma`, `p2mp`, `p2p`
         */
        interfaceType?: pulumi.Input<string | undefined>;
        metric?: pulumi.Input<number | undefined>;
        /**
         * By default, we'll re-advertise all learned OSPF routes toward overlay
         */
        noReadvertiseToOverlay?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to send OSPF-Hello
         */
        passive?: pulumi.Input<boolean | undefined>;
    }
    interface NetworktemplatePortMirroring {
        /**
         * At least one of the `inputPortIdsIngress`, `inputPortIdsEgress` or `inputNetworksIngress ` should be specified
         */
        inputNetworksIngresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * At least one of the `inputPortIdsIngress`, `inputPortIdsEgress` or `inputNetworksIngress ` should be specified
         */
        inputPortIdsEgresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * At least one of the `inputPortIdsIngress`, `inputPortIdsEgress` or `inputNetworksIngress ` should be specified
         */
        inputPortIdsIngresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputIpAddress?: pulumi.Input<string | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputNetwork?: pulumi.Input<string | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputPortId?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplatePortUsages {
        /**
         * Only if `mode`==`trunk`. Whether to trunk all network/vlans
         */
        allNetworks?: pulumi.Input<boolean | undefined>;
        /**
         * Only applies when `mode`!=`dynamic`. Controls whether DHCP server traffic is allowed on ports using this configuration if DHCP snooping is enabled. This is a tri-state setting; `true`: ports become trusted ports allowing DHCP server traffic, `false`: ports become untrusted blocking DHCP server traffic, undefined: use system defaults (access ports default to untrusted, trunk ports default to trusted).
         */
        allowDhcpd?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        allowMultipleSupplicants?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Bypass auth for known clients if set to true when RADIUS server is down
         */
        bypassAuthWhenServerDown?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`=`dot1x`. Bypass auth for all (including unknown clients) if set to true when RADIUS server is down
         */
        bypassAuthWhenServerDownForUnknownClient?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Bypass auth for VOIP if set to true when RADIUS server is down
         */
        bypassAuthWhenServerDownForVoip?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. To be used together with `isolation` under networks. Signaling that this port connects to the networks isolated but wired clients belong to the same community can talk to each other
         */
        communityVlanId?: pulumi.Input<number | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        description?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. If speed and duplex are specified, whether to disable autonegotiation
         */
        disableAutoneg?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether the port is disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Link connection mode. enum: `auto`, `full`, `half`
         */
        duplex?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`, if dynamic vlan is used, specify the possible networks/vlans RADIUS can return
         */
        dynamicVlanNetworks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Whether to enable MAC Auth
         */
        enableMacAuth?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        enableQos?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Which network to put the device into if the device cannot do dot1x. default is null (i.e. not allowed)
         */
        guestNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. `interIsolationNetworkLink` is used together with `isolation` under networks, signaling that this port connects to isolated networks
         */
        interIsolationNetworkLink?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. `interSwitchLink` is used together with `isolation` under networks. NOTE: `interSwitchLink` works only between Juniper devices. This has to be applied to both ports connected together
         */
        interSwitchLink?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `enableMacAuth`==`true`
         */
        macAuthOnly?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` + `enableMacAuth`==`true` + `macAuthOnly`==`false`, dot1x will be given priority then mac_auth. Enable this to prefer macAuth over dot1x.
         */
        macAuthPreferred?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `enableMacAuth` ==`true`. This type is ignored if mistNac is enabled. enum: `eap-md5`, `eap-peap`, `pap`
         */
        macAuthProtocol?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` max number of mac addresses, default is 0 for unlimited, otherwise range is 1 to 16383 (upper bound constrained by platform)
         */
        macLimit?: pulumi.Input<string | undefined>;
        /**
         * `mode`==`dynamic` must only be used if the port usage name is `dynamic`. enum: `access`, `dynamic`, `inet`, `trunk`
         */
        mode?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation. Value between 256 and 9216, default value is 1514.
         */
        mtu?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`==`trunk`, the list of network/vlans
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Only if `mode`==`access` and `portAuth`!=`dot1x`. Whether the port should retain dynamically learned MAC addresses
         */
        persistMac?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether PoE capabilities are disabled for a port
         */
        poeDisabled?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether Perpetual PoE is enabled; keeps PoE state across reboots
         */
        poeKeepStateWhenReboot?: pulumi.Input<boolean | undefined>;
        /**
         * PoE priority. enum: `low`, `high`
         */
        poePriority?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. If dot1x is desired, set to dot1x. enum: `dot1x`
         */
        portAuth?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Native network/vlan for untagged traffic
         */
        portNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`=`dot1x` reauthentication interval range between 10 and 65535 (default: 3600)
         */
        reauthInterval?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`==`dynamic` Control when the DPC port should be changed to the default port usage. enum: `linkDown`, `none` (let the DPC port keep at the current port usage)
         */
        resetDefaultWhen?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`==`dynamic`
         */
        rules?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplatePortUsagesRule>[] | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. Sets server fail fallback vlan
         */
        serverFailNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `portAuth`==`dot1x`. When radius server reject / fails
         */
        serverRejectNetwork?: pulumi.Input<string | undefined>;
        /**
         * Only if `mode`!=`dynamic`, Port speed, default is auto to automatically negotiate speed enum: `100m`, `10m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`,`auto`
         */
        speed?: pulumi.Input<string | undefined>;
        /**
         * Switch storm control. Only if `mode`!=`dynamic`
         */
        stormControl?: pulumi.Input<inputs.site.NetworktemplatePortUsagesStormControl | undefined>;
        /**
         * Only if `mode`!=`dynamic` and `stpRequired`==`false`. Drop bridge protocol data units (BPDUs ) that enter any interface or a specified interface
         */
        stpDisable?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. When enabled, the port is not expected to receive BPDU frames
         */
        stpEdge?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        stpNoRootPort?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`
         */
        stpP2p?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Whether to remain in block state if no BPDU is received
         */
        stpRequired?: pulumi.Input<boolean | undefined>;
        /**
         * Optional for Campus Fabric Core-Distribution ESI-LAG profile. Helper used by the UI to select this port profile as the ESI-Lag between Distribution and Access switches
         */
        uiEvpntopoId?: pulumi.Input<string | undefined>;
        /**
         * If this is connected to a vstp network
         */
        useVstp?: pulumi.Input<boolean | undefined>;
        /**
         * Only if `mode`!=`dynamic`. Network/vlan for voip traffic, must also set port_network. to authenticate device, set port_auth
         */
        voipNetwork?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplatePortUsagesRule {
        /**
         * Optional description of the rule
         */
        description?: pulumi.Input<string | undefined>;
        equals?: pulumi.Input<string | undefined>;
        /**
         * Use `equalsAny` to match any item in a list
         */
        equalsAnies?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * "[0:3]":"abcdef" > "abc"
         * "split(.)[1]": "a.b.c" > "b"
         * "split(-)[1][0:3]: "a1234-b5678-c90" > "b56"
         */
        expression?: pulumi.Input<string | undefined>;
        /**
         * enum: `linkPeermac`, `lldpChassisId`, `lldpHardwareRevision`, `lldpManufacturerName`, `lldpOui`, `lldpSerialNumber`, `lldpSystemDescription`, `lldpSystemName`, `radiusDynamicfilter`, `radiusUsermac`, `radiusUsername`
         */
        src: pulumi.Input<string>;
        /**
         * `portUsage` name
         */
        usage?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplatePortUsagesStormControl {
        /**
         * Whether to disable the port when storm control is triggered
         */
        disablePort?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on broadcast traffic
         */
        noBroadcast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on multicast traffic
         */
        noMulticast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on registered multicast traffic
         */
        noRegisteredMulticast?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable storm control on unknown unicast traffic
         */
        noUnknownUnicast?: pulumi.Input<boolean | undefined>;
        /**
         * Bandwidth-percentage, configures the storm control level as a percentage of the available bandwidth
         */
        percentage?: pulumi.Input<number | undefined>;
    }
    interface NetworktemplateRadiusConfig {
        acctImmediateUpdate?: pulumi.Input<boolean | undefined>;
        /**
         * How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled
         */
        acctInterimInterval?: pulumi.Input<number | undefined>;
        acctServers?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateRadiusConfigAcctServer>[] | undefined>;
        /**
         * enum: `ordered`, `unordered`
         */
        authServerSelection?: pulumi.Input<string | undefined>;
        authServers?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateRadiusConfigAuthServer>[] | undefined>;
        /**
         * Radius auth session retries
         */
        authServersRetries?: pulumi.Input<number | undefined>;
        /**
         * Radius auth session timeout
         */
        authServersTimeout?: pulumi.Input<number | undefined>;
        coaEnabled?: pulumi.Input<boolean | undefined>;
        coaPort?: pulumi.Input<string | undefined>;
        fastDot1xTimers?: pulumi.Input<boolean | undefined>;
        /**
         * Use `network`or `sourceIp`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * Use `network`or `sourceIp`
         */
        sourceIp?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRadiusConfigAcctServer {
        /**
         * IP/ hostname of RADIUS server
         */
        host: pulumi.Input<string>;
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * enum: `ascii`, `hex`
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        keywrapKek?: pulumi.Input<string | undefined>;
        keywrapMack?: pulumi.Input<string | undefined>;
        port?: pulumi.Input<string | undefined>;
        /**
         * Secret of RADIUS server
         */
        secret: pulumi.Input<string>;
    }
    interface NetworktemplateRadiusConfigAuthServer {
        /**
         * IP/ hostname of RADIUS server
         */
        host: pulumi.Input<string>;
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * enum: `ascii`, `hex`
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        keywrapKek?: pulumi.Input<string | undefined>;
        keywrapMack?: pulumi.Input<string | undefined>;
        port?: pulumi.Input<string | undefined>;
        /**
         * Whether to require Message-Authenticator in requests
         */
        requireMessageAuthenticator?: pulumi.Input<boolean | undefined>;
        /**
         * Secret of RADIUS server
         */
        secret: pulumi.Input<string>;
    }
    interface NetworktemplateRemoteSyslog {
        archive?: pulumi.Input<inputs.site.NetworktemplateRemoteSyslogArchive | undefined>;
        cacerts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        console?: pulumi.Input<inputs.site.NetworktemplateRemoteSyslogConsole | undefined>;
        enabled?: pulumi.Input<boolean | undefined>;
        files?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateRemoteSyslogFile>[] | undefined>;
        /**
         * If sourceAddress is configured, will use the vlan firstly otherwise use source_ip
         */
        network?: pulumi.Input<string | undefined>;
        sendToAllServers?: pulumi.Input<boolean | undefined>;
        servers?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateRemoteSyslogServer>[] | undefined>;
        /**
         * enum: `millisecond`, `year`, `year millisecond`
         */
        timeFormat?: pulumi.Input<string | undefined>;
        users?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateRemoteSyslogUser>[] | undefined>;
    }
    interface NetworktemplateRemoteSyslogArchive {
        files?: pulumi.Input<string | undefined>;
        size?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRemoteSyslogConsole {
        contents?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateRemoteSyslogConsoleContent>[] | undefined>;
    }
    interface NetworktemplateRemoteSyslogConsoleContent {
        /**
         * enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRemoteSyslogFile {
        archive?: pulumi.Input<inputs.site.NetworktemplateRemoteSyslogFileArchive | undefined>;
        contents?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateRemoteSyslogFileContent>[] | undefined>;
        /**
         * Only if `protocol`==`tcp`
         */
        enableTls?: pulumi.Input<boolean | undefined>;
        explicitPriority?: pulumi.Input<boolean | undefined>;
        file?: pulumi.Input<string | undefined>;
        match?: pulumi.Input<string | undefined>;
        structuredData?: pulumi.Input<boolean | undefined>;
    }
    interface NetworktemplateRemoteSyslogFileArchive {
        files?: pulumi.Input<string | undefined>;
        size?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRemoteSyslogFileContent {
        /**
         * enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRemoteSyslogServer {
        contents?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateRemoteSyslogServerContent>[] | undefined>;
        explicitPriority?: pulumi.Input<boolean | undefined>;
        /**
         * enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`
         */
        facility?: pulumi.Input<string | undefined>;
        host?: pulumi.Input<string | undefined>;
        match?: pulumi.Input<string | undefined>;
        port?: pulumi.Input<string | undefined>;
        /**
         * enum: `tcp`, `udp`
         */
        protocol?: pulumi.Input<string | undefined>;
        routingInstance?: pulumi.Input<string | undefined>;
        /**
         * Name of the server
         */
        serverName?: pulumi.Input<string | undefined>;
        /**
         * enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`
         */
        severity?: pulumi.Input<string | undefined>;
        /**
         * If sourceAddress is configured, will use the vlan firstly otherwise use source_ip
         */
        sourceAddress?: pulumi.Input<string | undefined>;
        structuredData?: pulumi.Input<boolean | undefined>;
        tag?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRemoteSyslogServerContent {
        /**
         * enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRemoteSyslogUser {
        contents?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateRemoteSyslogUserContent>[] | undefined>;
        match?: pulumi.Input<string | undefined>;
        user?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRemoteSyslogUserContent {
        /**
         * enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`
         */
        facility?: pulumi.Input<string | undefined>;
        /**
         * enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`
         */
        severity?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateRoutingPolicies {
        /**
         * at least criteria/filter must be specified to match the term, all criteria have to be met
         */
        terms?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateRoutingPoliciesTerm>[] | undefined>;
    }
    interface NetworktemplateRoutingPoliciesTerm {
        /**
         * When used as import policy
         */
        actions?: pulumi.Input<inputs.site.NetworktemplateRoutingPoliciesTermActions | undefined>;
        /**
         * zero or more criteria/filter can be specified to match the term, all criteria have to be met
         */
        matching?: pulumi.Input<inputs.site.NetworktemplateRoutingPoliciesTermMatching | undefined>;
        name: pulumi.Input<string>;
    }
    interface NetworktemplateRoutingPoliciesTermActions {
        accept?: pulumi.Input<boolean | undefined>;
        /**
         * When used as export policy, optional
         */
        communities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Optional, for an import policy, localPreference can be changed, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}`)
         */
        localPreference?: pulumi.Input<string | undefined>;
        /**
         * When used as export policy, optional. By default, the local AS will be prepended, to change it. Can be a Variable (e.g. `{{as_path}}`)
         */
        prependAsPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateRoutingPoliciesTermMatching {
        /**
         * BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}`)
         */
        asPaths?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        communities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * zero or more criteria/filter can be specified to match the term, all criteria have to be met
         */
        prefixes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * enum: `bgp`, `direct`, `evpn`, `ospf`, `static`
         */
        protocols?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateSnmpConfig {
        clientLists?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSnmpConfigClientList>[] | undefined>;
        contact?: pulumi.Input<string | undefined>;
        description?: pulumi.Input<string | undefined>;
        enabled?: pulumi.Input<boolean | undefined>;
        engineId?: pulumi.Input<string | undefined>;
        /**
         * enum: `local`, `useMacAddress`
         */
        engineIdType?: pulumi.Input<string | undefined>;
        location?: pulumi.Input<string | undefined>;
        name?: pulumi.Input<string | undefined>;
        network?: pulumi.Input<string | undefined>;
        trapGroups?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSnmpConfigTrapGroup>[] | undefined>;
        v2cConfigs?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSnmpConfigV2cConfig>[] | undefined>;
        v3Config?: pulumi.Input<inputs.site.NetworktemplateSnmpConfigV3Config | undefined>;
        views?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSnmpConfigView>[] | undefined>;
    }
    interface NetworktemplateSnmpConfigClientList {
        clientListName?: pulumi.Input<string | undefined>;
        clients?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateSnmpConfigTrapGroup {
        categories?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Categories list can refer to https://www.juniper.net/documentation/software/topics/task/configuration/snmp_trap-groups-configuring-junos-nm.html
         */
        groupName?: pulumi.Input<string | undefined>;
        targets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * enum: `all`, `v1`, `v2`
         */
        version?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV2cConfig {
        authorization?: pulumi.Input<string | undefined>;
        /**
         * Client_list_name here should refer to clientList above
         */
        clientListName?: pulumi.Input<string | undefined>;
        communityName?: pulumi.Input<string | undefined>;
        /**
         * View name here should be defined in views above
         */
        view?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV3Config {
        notifies?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSnmpConfigV3ConfigNotify>[] | undefined>;
        notifyFilters?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSnmpConfigV3ConfigNotifyFilter>[] | undefined>;
        targetAddresses?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSnmpConfigV3ConfigTargetAddress>[] | undefined>;
        targetParameters?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSnmpConfigV3ConfigTargetParameter>[] | undefined>;
        usms?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSnmpConfigV3ConfigUsm>[] | undefined>;
        vacm?: pulumi.Input<inputs.site.NetworktemplateSnmpConfigV3ConfigVacm | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigNotify {
        name: pulumi.Input<string>;
        tag: pulumi.Input<string>;
        /**
         * enum: `inform`, `trap`
         */
        type: pulumi.Input<string>;
    }
    interface NetworktemplateSnmpConfigV3ConfigNotifyFilter {
        contents?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSnmpConfigV3ConfigNotifyFilterContent>[] | undefined>;
        profileName?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigNotifyFilterContent {
        include?: pulumi.Input<boolean | undefined>;
        oid: pulumi.Input<string>;
    }
    interface NetworktemplateSnmpConfigV3ConfigTargetAddress {
        address: pulumi.Input<string>;
        addressMask: pulumi.Input<string>;
        port?: pulumi.Input<string | undefined>;
        /**
         * Refer to notify tag, can be multiple with blank
         */
        tagList?: pulumi.Input<string | undefined>;
        targetAddressName: pulumi.Input<string>;
        /**
         * Refer to notify target parameters name
         */
        targetParameters?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigTargetParameter {
        /**
         * enum: `v1`, `v2c`, `v3`
         */
        messageProcessingModel: pulumi.Input<string>;
        name: pulumi.Input<string>;
        /**
         * Refer to profile-name in notify_filter
         */
        notifyFilter?: pulumi.Input<string | undefined>;
        /**
         * enum: `authentication`, `none`, `privacy`
         */
        securityLevel?: pulumi.Input<string | undefined>;
        /**
         * enum: `usm`, `v1`, `v2c`
         */
        securityModel?: pulumi.Input<string | undefined>;
        /**
         * Refer to securityName in usm
         */
        securityName?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigUsm {
        /**
         * enum: `localEngine`, `remoteEngine`
         */
        engineType: pulumi.Input<string>;
        /**
         * Required only if `engineType`==`remoteEngine`
         */
        remoteEngineId?: pulumi.Input<string | undefined>;
        users?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSnmpConfigV3ConfigUsmUser>[] | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigUsmUser {
        /**
         * Not required if `authenticationType`==`authentication-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters.
         */
        authenticationPassword?: pulumi.Input<string | undefined>;
        /**
         * sha224, sha256, sha384, sha512 are supported in 21.1 and newer release. enum: `authentication-md5`, `authentication-none`, `authentication-sha`, `authentication-sha224`, `authentication-sha256`, `authentication-sha384`, `authentication-sha512`
         */
        authenticationType?: pulumi.Input<string | undefined>;
        /**
         * Not required if `encryptionType`==`privacy-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters
         */
        encryptionPassword?: pulumi.Input<string | undefined>;
        /**
         * enum: `privacy-3des`, `privacy-aes128`, `privacy-des`, `privacy-none`
         */
        encryptionType?: pulumi.Input<string | undefined>;
        name?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigVacm {
        accesses?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSnmpConfigV3ConfigVacmAccess>[] | undefined>;
        securityToGroup?: pulumi.Input<inputs.site.NetworktemplateSnmpConfigV3ConfigVacmSecurityToGroup | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigVacmAccess {
        groupName?: pulumi.Input<string | undefined>;
        prefixLists?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSnmpConfigV3ConfigVacmAccessPrefixList>[] | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigVacmAccessPrefixList {
        /**
         * Only required if `type`==`contextPrefix`
         */
        contextPrefix?: pulumi.Input<string | undefined>;
        /**
         * Refer to view name
         */
        notifyView?: pulumi.Input<string | undefined>;
        /**
         * Refer to view name
         */
        readView?: pulumi.Input<string | undefined>;
        /**
         * enum: `authentication`, `none`, `privacy`
         */
        securityLevel?: pulumi.Input<string | undefined>;
        /**
         * enum: `any`, `usm`, `v1`, `v2c`
         */
        securityModel?: pulumi.Input<string | undefined>;
        /**
         * enum: `contextPrefix`, `defaultContextPrefix`
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Refer to view name
         */
        writeView?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigVacmSecurityToGroup {
        contents?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSnmpConfigV3ConfigVacmSecurityToGroupContent>[] | undefined>;
        /**
         * enum: `usm`, `v1`, `v2c`
         */
        securityModel?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigV3ConfigVacmSecurityToGroupContent {
        /**
         * Refer to groupName under access
         */
        group?: pulumi.Input<string | undefined>;
        securityName?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSnmpConfigView {
        /**
         * If the root oid configured is included
         */
        include?: pulumi.Input<boolean | undefined>;
        oid?: pulumi.Input<string | undefined>;
        viewName?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSwitchMatching {
        enable?: pulumi.Input<boolean | undefined>;
        /**
         * list of rules to define custom switch configuration based on different criteria. Each list must have at least one of `matchModel`, `matchName` or `matchRole` must be defined
         */
        rules?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSwitchMatchingRule>[] | undefined>;
    }
    interface NetworktemplateSwitchMatchingRule {
        /**
         * additional CLI commands to append to the generated Junos config. **Note**: no check is done
         */
        additionalConfigCmds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Port usage to assign to switch ports without any port usage assigned. Default: `default` to preserve default behavior
         */
        defaultPortUsage?: pulumi.Input<string | undefined>;
        /**
         * In-Band Management interface configuration
         */
        ipConfig?: pulumi.Input<inputs.site.NetworktemplateSwitchMatchingRuleIpConfig | undefined>;
        /**
         * string the switch model must start with to use this rule. It is possible to combine with the `matchName` and `matchRole` attributes
         */
        matchModel?: pulumi.Input<string | undefined>;
        /**
         * string the switch name must start with to use this rule. Use the `matchNameOffset` to indicate the first character of the switch name to compare to. It is possible to combine with the `matchModel` and `matchRole` attributes
         */
        matchName?: pulumi.Input<string | undefined>;
        /**
         * first character of the switch name to compare to the `matchName` value
         */
        matchNameOffset?: pulumi.Input<number | undefined>;
        /**
         * string the switch role must start with to use this rule. It is possible to combine with the `matchName` and `matchModel` attributes
         */
        matchRole?: pulumi.Input<string | undefined>;
        /**
         * Rule name. WARNING: the name `default` is reserved and can only be used for the last rule in the list
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Out-of-Band Management interface configuration
         */
        oobIpConfig?: pulumi.Input<inputs.site.NetworktemplateSwitchMatchingRuleOobIpConfig | undefined>;
        /**
         * Property key is the port name or range (e.g. "ge-0/0/0-10")
         */
        portConfig?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.site.NetworktemplateSwitchMatchingRulePortConfig>;
        } | undefined>;
        /**
         * Property key is the port mirroring instance name. `portMirroring` can be added under device/site settings. It takes interface and ports as input for ingress, interface as input for egress and can take interface and port as output. A maximum 4 mirroring ports is allowed
         */
        portMirroring?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.site.NetworktemplateSwitchMatchingRulePortMirroring>;
        } | undefined>;
        stpConfig?: pulumi.Input<inputs.site.NetworktemplateSwitchMatchingRuleStpConfig | undefined>;
    }
    interface NetworktemplateSwitchMatchingRuleIpConfig {
        /**
         * VLAN Name for the management interface
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * enum: `dhcp`, `static`
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSwitchMatchingRuleOobIpConfig {
        /**
         * enum: `dhcp`, `static`
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * If supported on the platform. If enabled, DNS will be using this routing-instance, too
         */
        useMgmtVrf?: pulumi.Input<boolean | undefined>;
        /**
         * For host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired
         */
        useMgmtVrfForHostOut?: pulumi.Input<boolean | undefined>;
    }
    interface NetworktemplateSwitchMatchingRulePortConfig {
        /**
         * To disable LACP support for the AE interface
         */
        aeDisableLacp?: pulumi.Input<boolean | undefined>;
        /**
         * Users could force to use the designated AE name
         */
        aeIdx?: pulumi.Input<number | undefined>;
        /**
         * If `aggregated`==`true`, sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only
         */
        aeLacpForceUp?: pulumi.Input<boolean | undefined>;
        /**
         * To use slow timeout
         */
        aeLacpSlow?: pulumi.Input<boolean | undefined>;
        aggregated?: pulumi.Input<boolean | undefined>;
        /**
         * To generate port up/down alarm
         */
        critical?: pulumi.Input<boolean | undefined>;
        description?: pulumi.Input<string | undefined>;
        /**
         * If `speed` and `duplex` are specified, whether to disable autonegotiation
         */
        disableAutoneg?: pulumi.Input<boolean | undefined>;
        /**
         * enum: `auto`, `full`, `half`
         */
        duplex?: pulumi.Input<string | undefined>;
        /**
         * Enable dynamic usage for this port. Set to `dynamic` to enable.
         */
        dynamicUsage?: pulumi.Input<string | undefined>;
        esilag?: pulumi.Input<boolean | undefined>;
        /**
         * Media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation
         */
        mtu?: pulumi.Input<number | undefined>;
        /**
         * List of network names. Required if `usage`==`inet`
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Prevent helpdesk to override the port config
         */
        noLocalOverwrite?: pulumi.Input<boolean | undefined>;
        poeDisabled?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `usage`==`vlanTunnel`. Q-in-Q tunneling using All-in-one bundling. This also enables standard L2PT for interfaces that are not encapsulation tunnel interfaces and uses MAC rewrite operation. [View more information](https://www.juniper.net/documentation/us/en/software/junos/multicast-l2/topics/topic-map/q-in-q.html#id-understanding-qinq-tunneling-and-vlan-translation)
         */
        portNetwork?: pulumi.Input<string | undefined>;
        /**
         * enum: `100m`, `10m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`,`auto`
         */
        speed?: pulumi.Input<string | undefined>;
        /**
         * Port usage name. For Q-in-Q, use `vlanTunnel`. If EVPN is used, use `evpnUplink`or `evpnDownlink`
         */
        usage: pulumi.Input<string>;
    }
    interface NetworktemplateSwitchMatchingRulePortMirroring {
        /**
         * At least one of the `inputPortIdsIngress`, `inputPortIdsEgress` or `inputNetworksIngress ` should be specified
         */
        inputNetworksIngresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * At least one of the `inputPortIdsIngress`, `inputPortIdsEgress` or `inputNetworksIngress ` should be specified
         */
        inputPortIdsEgresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * At least one of the `inputPortIdsIngress`, `inputPortIdsEgress` or `inputNetworksIngress ` should be specified
         */
        inputPortIdsIngresses?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputIpAddress?: pulumi.Input<string | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputNetwork?: pulumi.Input<string | undefined>;
        /**
         * Exactly one of the `outputIpAddress`, `outputPortId` or `outputNetwork` should be provided
         */
        outputPortId?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSwitchMatchingRuleStpConfig {
        /**
         * Switch STP priority. Range [0, 4k, 8k.. 60k] in steps of 4k. Bridge priority applies to both VSTP and RSTP.
         */
        bridgePriority?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSwitchMgmt {
        /**
         * AP_affinity_threshold apAffinityThreshold can be added as a field under site/setting. By default, this value is set to 12. If the field is set in both site/setting and org/setting, the value from site/setting will be used.
         */
        apAffinityThreshold?: pulumi.Input<number | undefined>;
        /**
         * Set Banners for switches. Allows markup formatting
         */
        cliBanner?: pulumi.Input<string | undefined>;
        /**
         * Sets timeout for switches
         */
        cliIdleTimeout?: pulumi.Input<number | undefined>;
        /**
         * Rollback timer for commit confirmed
         */
        configRevertTimer?: pulumi.Input<number | undefined>;
        /**
         * Enable to provide the FQDN with DHCP option 81
         */
        dhcpOptionFqdn?: pulumi.Input<boolean | undefined>;
        disableOobDownAlarm?: pulumi.Input<boolean | undefined>;
        fipsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Property key is the user name. For Local user authentication
         */
        localAccounts?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.site.NetworktemplateSwitchMgmtLocalAccounts>;
        } | undefined>;
        /**
         * IP Address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud
         */
        mxedgeProxyHost?: pulumi.Input<string | undefined>;
        /**
         * Mist Edge port used to proxy the switch management traffic to the Mist Cloud. Value in range 1-65535
         */
        mxedgeProxyPort?: pulumi.Input<string | undefined>;
        /**
         * Restrict inbound-traffic to host
         * when enabled, all traffic that is not essential to our operation will be dropped
         * e.g. ntp / dns / traffic to mist will be allowed by default, if dhcpd is enabled, we'll make sure it works
         */
        protectRe?: pulumi.Input<inputs.site.NetworktemplateSwitchMgmtProtectRe | undefined>;
        /**
         * By default, only the configuration generated by Mist is cleaned up during the configuration process. If `true`, all the existing configuration will be removed.
         */
        removeExistingConfigs?: pulumi.Input<boolean | undefined>;
        rootPassword?: pulumi.Input<string | undefined>;
        tacacs?: pulumi.Input<inputs.site.NetworktemplateSwitchMgmtTacacs | undefined>;
        /**
         * To use mxedge as proxy
         */
        useMxedgeProxy?: pulumi.Input<boolean | undefined>;
    }
    interface NetworktemplateSwitchMgmtLocalAccounts {
        password?: pulumi.Input<string | undefined>;
        /**
         * enum: `admin`, `helpdesk`, `none`, `read`
         */
        role?: pulumi.Input<string | undefined>;
    }
    interface NetworktemplateSwitchMgmtProtectRe {
        /**
         * optionally, services we'll allow. enum: `icmp`, `ssh`
         */
        allowedServices?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        customs?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSwitchMgmtProtectReCustom>[] | undefined>;
        /**
         * When enabled, all traffic that is not essential to our operation will be dropped
         * e.g. ntp / dns / traffic to mist will be allowed by default
         *      if dhcpd is enabled, we'll make sure it works
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to enable hit count for Protect_RE policy
         */
        hitCount?: pulumi.Input<boolean | undefined>;
        /**
         * host/subnets we'll allow traffic to/from
         */
        trustedHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateSwitchMgmtProtectReCustom {
        /**
         * matched dst port, "0" means any. Note: For `protocol`==`any` and  `portRange`==`any`, configure `trustedHosts` instead
         */
        portRange?: pulumi.Input<string | undefined>;
        /**
         * enum: `any`, `icmp`, `tcp`, `udp`. Note: For `protocol`==`any` and  `portRange`==`any`, configure `trustedHosts` instead
         */
        protocol?: pulumi.Input<string | undefined>;
        subnets: pulumi.Input<pulumi.Input<string>[]>;
    }
    interface NetworktemplateSwitchMgmtTacacs {
        acctServers?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSwitchMgmtTacacsAcctServer>[] | undefined>;
        /**
         * enum: `admin`, `helpdesk`, `none`, `read`
         */
        defaultRole?: pulumi.Input<string | undefined>;
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Which network the TACACS server resides
         */
        network?: pulumi.Input<string | undefined>;
        tacplusServers?: pulumi.Input<pulumi.Input<inputs.site.NetworktemplateSwitchMgmtTacacsTacplusServer>[] | undefined>;
    }
    interface NetworktemplateSwitchMgmtTacacsAcctServer {
        host?: pulumi.Input<string | undefined>;
        port?: pulumi.Input<string | undefined>;
        secret?: pulumi.Input<string | undefined>;
        timeout?: pulumi.Input<number | undefined>;
    }
    interface NetworktemplateSwitchMgmtTacacsTacplusServer {
        host?: pulumi.Input<string | undefined>;
        port?: pulumi.Input<string | undefined>;
        secret?: pulumi.Input<string | undefined>;
        timeout?: pulumi.Input<number | undefined>;
    }
    interface NetworktemplateVrfConfig {
        /**
         * Whether to enable VRF (when supported on the device)
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface NetworktemplateVrfInstances {
        evpnAutoLoopbackSubnet?: pulumi.Input<string | undefined>;
        evpnAutoLoopbackSubnet6?: pulumi.Input<string | undefined>;
        /**
         * Property key is the destination CIDR (e.g. "10.0.0.0/8")
         */
        extraRoutes?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.site.NetworktemplateVrfInstancesExtraRoutes>;
        } | undefined>;
        /**
         * Property key is the destination CIDR (e.g. "2a02:1234:420a:10c9::/64")
         */
        extraRoutes6?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.site.NetworktemplateVrfInstancesExtraRoutes6>;
        } | undefined>;
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface NetworktemplateVrfInstancesExtraRoutes {
        /**
         * Next-hop address
         */
        via: pulumi.Input<string>;
    }
    interface NetworktemplateVrfInstancesExtraRoutes6 {
        /**
         * Next-hop address
         */
        via?: pulumi.Input<string | undefined>;
    }
    interface SettingAnalytic {
        /**
         * Enable Advanced Analytic feature (using SUB-ANA license)
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SettingApSyntheticTest {
        /**
         * VLAN IDs included in addition to the default VLAN set for AP synthetic tests
         */
        additionalVlanIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SettingAutoUpgrade {
        /**
         * Per-AP-model firmware versions or channels used for auto-upgrade
         */
        customVersions?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
        /**
         * Weekly AP auto-upgrade day for the maintenance window
         */
        dayOfWeek?: pulumi.Input<string | undefined>;
        /**
         * Whether auto upgrade should happen (Note that Mist may auto-upgrade if the version is not supported)
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * `any` / HH:MM (24-hour format), upgrade will happen within up to 1-hour from this time
         */
        timeOfDay?: pulumi.Input<string | undefined>;
        /**
         * Firmware release channel or custom version used for AP auto-upgrade
         */
        version?: pulumi.Input<string | undefined>;
    }
    interface SettingAutoUpgradeEsl {
        /**
         * If true, it will allow downgrade to a lower version
         */
        allowDowngrade?: pulumi.Input<boolean | undefined>;
        /**
         * Custom versions for different models. Property key is the model name (e.g. "AP41")
         */
        customVersions?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
        /**
         * Weekly ESL auto-upgrade day for the maintenance window
         */
        dayOfWeek?: pulumi.Input<string | undefined>;
        /**
         * Whether auto upgrade should happen (Note that Mist may auto-upgrade if the version is not supported)
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * `any` / HH:MM (24-hour format), upgrade will happen within up to 1-hour from this time
         */
        timeOfDay?: pulumi.Input<string | undefined>;
        /**
         * ESL firmware version used for auto-upgrade
         */
        version?: pulumi.Input<string | undefined>;
    }
    interface SettingBleConfig {
        /**
         * Whether Mist beacons is enabled
         */
        beaconEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `beaconRateMode`==`custom`, 1-10, in number-beacons-per-second
         */
        beaconRate?: pulumi.Input<number | undefined>;
        /**
         * Beacon rate mode for Mist BLE beacons; use custom to set beacon_rate
         */
        beaconRateMode?: pulumi.Input<string | undefined>;
        /**
         * AP BLE beam numbers disabled for location advertisements
         */
        beamDisableds?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Can be enabled if `beaconEnabled`==`true`, whether to send custom packet
         */
        customBlePacketEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * The custom frame to be sent out in this beacon. The frame must be a hexstring
         */
        customBlePacketFrame?: pulumi.Input<string | undefined>;
        /**
         * Frequency (msec) of data emitted by custom ble beacon
         */
        customBlePacketFreqMsec?: pulumi.Input<number | undefined>;
        /**
         * Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default
         */
        eddystoneUidAdvPower?: pulumi.Input<number | undefined>;
        /**
         * BLE beams used to transmit Eddystone-UID advertisements, expressed as ranges such as `2-4,7`
         */
        eddystoneUidBeams?: pulumi.Input<string | undefined>;
        /**
         * Only if `beaconEnabled`==`false`, Whether Eddystone-UID beacon is enabled
         */
        eddystoneUidEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Frequency (msec) of data emit by Eddystone-UID beacon
         */
        eddystoneUidFreqMsec?: pulumi.Input<number | undefined>;
        /**
         * Eddystone-UID instance for the device
         */
        eddystoneUidInstance?: pulumi.Input<string | undefined>;
        /**
         * Eddystone-UID namespace broadcast by the AP, as a 10-byte hex string
         */
        eddystoneUidNamespace?: pulumi.Input<string | undefined>;
        /**
         * Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default
         */
        eddystoneUrlAdvPower?: pulumi.Input<number | undefined>;
        /**
         * BLE beams used to transmit Eddystone-URL advertisements, expressed as ranges such as `2-4,7`
         */
        eddystoneUrlBeams?: pulumi.Input<string | undefined>;
        /**
         * Only if `beaconEnabled`==`false`, Whether Eddystone-URL beacon is enabled
         */
        eddystoneUrlEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Frequency (msec) of data emitted by Eddystone-URL beacon
         */
        eddystoneUrlFreqMsec?: pulumi.Input<number | undefined>;
        /**
         * URL pointed by Eddystone-URL beacon
         */
        eddystoneUrlUrl?: pulumi.Input<string | undefined>;
        /**
         * Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default
         */
        ibeaconAdvPower?: pulumi.Input<number | undefined>;
        /**
         * BLE beams used to transmit iBeacon advertisements, expressed as ranges such as `2-4,7`
         */
        ibeaconBeams?: pulumi.Input<string | undefined>;
        /**
         * Can be enabled if `beaconEnabled`==`true`, whether to send iBeacon
         */
        ibeaconEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Frequency (msec) of data emit for iBeacon
         */
        ibeaconFreqMsec?: pulumi.Input<number | undefined>;
        /**
         * iBeacon major value broadcast by the AP
         */
        ibeaconMajor?: pulumi.Input<number | undefined>;
        /**
         * iBeacon minor value broadcast by the AP
         */
        ibeaconMinor?: pulumi.Input<number | undefined>;
        /**
         * Optional, if not specified, the same UUID as the beacon will be used
         */
        ibeaconUuid?: pulumi.Input<string | undefined>;
        /**
         * Required if `powerMode`==`custom`; else use `powerMode` as default
         */
        power?: pulumi.Input<number | undefined>;
        /**
         * Transmit power mode for BLE beacons; use custom to set `power`
         */
        powerMode?: pulumi.Input<string | undefined>;
    }
    interface SettingConfigPushPolicy {
        /**
         * Stop any new config from being pushed to the device
         */
        noPush?: pulumi.Input<boolean | undefined>;
        /**
         * Allowed time window during which configuration pushes may run
         */
        pushWindow?: pulumi.Input<inputs.site.SettingConfigPushPolicyPushWindow | undefined>;
    }
    interface SettingConfigPushPolicyPushWindow {
        /**
         * Whether configuration pushes are limited to the configured push window
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Day-of-week hour ranges when configuration pushes are allowed
         */
        hours?: pulumi.Input<inputs.site.SettingConfigPushPolicyPushWindowHours | undefined>;
    }
    interface SettingConfigPushPolicyPushWindowHours {
        /**
         * Operating hour range for Friday
         */
        fri?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Monday
         */
        mon?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Saturday
         */
        sat?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Sunday
         */
        sun?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Thursday
         */
        thu?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Tuesday
         */
        tue?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Wednesday
         */
        wed?: pulumi.Input<string | undefined>;
    }
    interface SettingCriticalUrlMonitoring {
        /**
         * Whether critical URL monitoring is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Critical URLs monitored for site health latency
         */
        monitors?: pulumi.Input<pulumi.Input<inputs.site.SettingCriticalUrlMonitoringMonitor>[] | undefined>;
    }
    interface SettingCriticalUrlMonitoringMonitor {
        /**
         * Monitored HTTP or HTTPS URL used for site health latency
         */
        url?: pulumi.Input<string | undefined>;
        /**
         * Source VLAN ID used to run the critical URL monitor
         */
        vlanId?: pulumi.Input<string | undefined>;
    }
    interface SettingEngagement {
        /**
         * Display labels for dwell-time visit categories
         */
        dwellTagNames?: pulumi.Input<inputs.site.SettingEngagementDwellTagNames | undefined>;
        /**
         * Visit duration ranges used to assign engagement categories
         */
        dwellTags?: pulumi.Input<inputs.site.SettingEngagementDwellTags | undefined>;
        /**
         * Schedule during which engagement analytics rules apply
         */
        hours?: pulumi.Input<inputs.site.SettingEngagementHours | undefined>;
        /**
         * Maximum dwell time in seconds considered by engagement analytics
         */
        maxDwell?: pulumi.Input<number | undefined>;
        /**
         * Minimum dwell time in seconds for engagement analytics
         */
        minDwell?: pulumi.Input<number | undefined>;
    }
    interface SettingEngagementDwellTagNames {
        /**
         * Default to `Visitor`
         */
        bounce?: pulumi.Input<string | undefined>;
        /**
         * Default to `Associates`
         */
        engaged?: pulumi.Input<string | undefined>;
        /**
         * Default to `Passerby`
         */
        passerby?: pulumi.Input<string | undefined>;
        /**
         * Default to `Assets`
         */
        stationed?: pulumi.Input<string | undefined>;
    }
    interface SettingEngagementDwellTags {
        /**
         * Default to `301-14400`
         */
        bounce?: pulumi.Input<string | undefined>;
        /**
         * Default to `14401-28800`
         */
        engaged?: pulumi.Input<string | undefined>;
        /**
         * Default to `1-300`
         */
        passerby?: pulumi.Input<string | undefined>;
        /**
         * Default to `28801-42000`
         */
        stationed?: pulumi.Input<string | undefined>;
    }
    interface SettingEngagementHours {
        /**
         * Operating hour range for Friday
         */
        fri?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Monday
         */
        mon?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Saturday
         */
        sat?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Sunday
         */
        sun?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Thursday
         */
        thu?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Tuesday
         */
        tue?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Wednesday
         */
        wed?: pulumi.Input<string | undefined>;
    }
    interface SettingGatewayMgmt {
        /**
         * SSR-only SSH public keys for administrative access
         */
        adminSshkeys?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Application probing configuration for gateway monitoring
         */
        appProbing?: pulumi.Input<inputs.site.SettingGatewayMgmtAppProbing | undefined>;
        /**
         * Consumes uplink bandwidth, requires WA license
         */
        appUsage?: pulumi.Input<boolean | undefined>;
        /**
         * Schedule for automatic security signature updates
         */
        autoSignatureUpdate?: pulumi.Input<inputs.site.SettingGatewayMgmtAutoSignatureUpdate | undefined>;
        /**
         * Rollback timer for commit confirmed
         */
        configRevertTimer?: pulumi.Input<number | undefined>;
        /**
         * For SSR and SRX, disable console port
         */
        disableConsole?: pulumi.Input<boolean | undefined>;
        /**
         * For SSR and SRX, disable management interface
         */
        disableOob?: pulumi.Input<boolean | undefined>;
        /**
         * For SSR and SRX, disable usb interface
         */
        disableUsb?: pulumi.Input<boolean | undefined>;
        /**
         * Whether FIPS mode is enabled on the gateway
         */
        fipsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * IPv4 probe targets used for gateway connectivity checks
         */
        probeHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * IPv6 probe targets used for gateway connectivity checks
         */
        probeHostsv6s?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Control-plane protection settings for the gateway
         */
        protectRe?: pulumi.Input<inputs.site.SettingGatewayMgmtProtectRe | undefined>;
        /**
         * SRX only. Root password for local gateway access
         */
        rootPassword?: pulumi.Input<string | undefined>;
        /**
         * IPv4 source address used for gateway security log traffic
         */
        securityLogSourceAddress?: pulumi.Input<string | undefined>;
        /**
         * Source interface used for gateway security log traffic
         */
        securityLogSourceInterface?: pulumi.Input<string | undefined>;
    }
    interface SettingGatewayMgmtAppProbing {
        /**
         * Predefined application keys to probe
         */
        apps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * User-defined application probe definitions
         */
        customApps?: pulumi.Input<pulumi.Input<inputs.site.SettingGatewayMgmtAppProbingCustomApp>[] | undefined>;
        /**
         * Whether gateway application probing is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SettingGatewayMgmtAppProbingCustomApp {
        address?: pulumi.Input<string | undefined>;
        /**
         * Category label used for this custom application probe
         */
        appType?: pulumi.Input<string | undefined>;
        /**
         * Only 1 entry is allowed:
         *     * if `protocol`==`http`: URL (e.g. `http://test.com` or `https://test.com`)
         *     * if `protocol`==`icmp`: IP Address (e.g. `1.2.3.4`)
         */
        hostnames: pulumi.Input<pulumi.Input<string>[]>;
        /**
         * Stable key used to identify this custom application probe
         */
        key?: pulumi.Input<string | undefined>;
        /**
         * Display name for this custom application probe
         */
        name: pulumi.Input<string>;
        /**
         * Gateway network used as the source context for this probe
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * If `protocol`==`icmp`. ICMP packet size used by this custom app probe
         */
        packetSize?: pulumi.Input<number | undefined>;
        /**
         * Probe protocol used by this custom application definition
         */
        protocol: pulumi.Input<string>;
        url?: pulumi.Input<string | undefined>;
        /**
         * Gateway VRF used as the source context for this probe
         */
        vrf?: pulumi.Input<string | undefined>;
    }
    interface SettingGatewayMgmtAutoSignatureUpdate {
        /**
         * Scheduled weekday for automatic signature updates
         */
        dayOfWeek?: pulumi.Input<string | undefined>;
        /**
         * Whether automatic security signature updates are enabled
         */
        enable?: pulumi.Input<boolean | undefined>;
        /**
         * Optional, Mist will decide the timing
         */
        timeOfDay?: pulumi.Input<string | undefined>;
    }
    interface SettingGatewayMgmtProtectRe {
        /**
         * optionally, services we'll allow. enum: `icmp`, `ssh`
         */
        allowedServices?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Additional ACL entries allowed by the Protect RE policy
         */
        customs?: pulumi.Input<pulumi.Input<inputs.site.SettingGatewayMgmtProtectReCustom>[] | undefined>;
        /**
         * When enabled, all traffic that is not essential to our operation will be dropped
         * e.g. ntp / dns / traffic to mist will be allowed by default
         *      if dhcpd is enabled, we'll make sure it works
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to enable hit count for Protect_RE policy
         */
        hitCount?: pulumi.Input<boolean | undefined>;
        /**
         * Trusted host or subnet entries allowed by the Protect RE policy
         */
        trustedHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SettingGatewayMgmtProtectReCustom {
        /**
         * matched dst port, "0" means any. Note: For `protocol`==`any` and  `portRange`==`any`, configure `trustedHosts` instead
         */
        portRange?: pulumi.Input<string | undefined>;
        /**
         * enum: `any`, `icmp`, `tcp`, `udp`. Note: For `protocol`==`any` and  `portRange`==`any`, configure `trustedHosts` instead
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Source subnets matched by this custom Protect RE ACL
         */
        subnets: pulumi.Input<pulumi.Input<string>[]>;
    }
    interface SettingIotproxy {
        /**
         * Whether the site IoT proxy is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Site access-control integration settings for Visionline
         */
        visionline?: pulumi.Input<inputs.site.SettingIotproxyVisionline | undefined>;
    }
    interface SettingIotproxyVisionline {
        /**
         * Access ID for the Visionline service
         */
        accessId?: pulumi.Input<string | undefined>;
        /**
         * PEM-encoded CA certificates used to verify the Visionline collector's TLS certificate. Required when the collector uses a self-signed certificate
         */
        cacerts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether the Visionline integration is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Collector hostname or IP address for Visionline
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * Visionline service password used by the IoT proxy
         */
        password?: pulumi.Input<string | undefined>;
        /**
         * TCP port of the Visionline collector
         */
        port?: pulumi.Input<number | undefined>;
        /**
         * Visionline service username used by the IoT proxy
         */
        username?: pulumi.Input<string | undefined>;
    }
    interface SettingJuniperSrx {
        /**
         * SRX auto-upgrade settings applied when SRX devices are onboarded
         */
        autoUpgrade?: pulumi.Input<inputs.site.SettingJuniperSrxAutoUpgrade | undefined>;
        /**
         * SRX gateways integrated with this site
         */
        gateways?: pulumi.Input<pulumi.Input<inputs.site.SettingJuniperSrxGateway>[] | undefined>;
        /**
         * Whether Mist NAC user information is sent to Juniper SRX gateways
         */
        sendMistNacUserInfo?: pulumi.Input<boolean | undefined>;
    }
    interface SettingJuniperSrxAutoUpgrade {
        /**
         * Per-SRX-model firmware versions to deploy instead of the default version
         */
        customVersions?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
        /**
         * Whether SRX auto-upgrade is enabled for newly onboarded devices
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to take a snapshot during the SRX upgrade process
         */
        snapshot?: pulumi.Input<boolean | undefined>;
        /**
         * Firmware version to deploy (e.g. 23.4R2-S5.5). Optional, used when customVersions not specified
         */
        version?: pulumi.Input<string | undefined>;
    }
    interface SettingJuniperSrxGateway {
        /**
         * Authentication key used to access the Juniper SRX gateway API
         */
        apiKey?: pulumi.Input<string | undefined>;
        /**
         * Authentication password used to access the Juniper SRX gateway API
         */
        apiPassword?: pulumi.Input<string | undefined>;
        /**
         * Base URL for the Juniper SRX gateway API
         */
        apiUrl?: pulumi.Input<string | undefined>;
    }
    interface SettingLed {
        /**
         * Indicator LED brightness level from 0 to 255
         */
        brightness?: pulumi.Input<number | undefined>;
        /**
         * Whether the AP indicator LED is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SettingMarvis {
        /**
         * Automatic remediation operations controlled by Marvis
         */
        autoOperations?: pulumi.Input<inputs.site.SettingMarvisAutoOperations | undefined>;
    }
    interface SettingMarvisAutoOperations {
        /**
         * Whether Marvis may remediate AP insufficient-capacity issues automatically
         */
        apInsufficientCapacity?: pulumi.Input<boolean | undefined>;
        /**
         * Whether Marvis may remediate AP loop issues automatically
         */
        apLoop?: pulumi.Input<boolean | undefined>;
        /**
         * Whether Marvis may remediate AP non-compliance automatically
         */
        apNonCompliant?: pulumi.Input<boolean | undefined>;
        /**
         * Whether Marvis may bounce switch ports for abnormal PoE clients
         */
        bouncePortForAbnormalPoeClient?: pulumi.Input<boolean | undefined>;
        /**
         * Whether Marvis may disable a port when DDOS protocol violations are detected
         */
        disablePortWhenDdosProtocolViolation?: pulumi.Input<boolean | undefined>;
        /**
         * Whether Marvis may disable a port when a rogue DHCP server is detected
         */
        disablePortWhenRogueDhcpServerDetected?: pulumi.Input<boolean | undefined>;
        /**
         * Whether Marvis may remediate non-compliant gateways automatically
         */
        gatewayNonCompliant?: pulumi.Input<boolean | undefined>;
        /**
         * Whether Marvis may remediate misconfigured switch ports automatically
         */
        switchMisconfiguredPort?: pulumi.Input<boolean | undefined>;
        /**
         * Whether Marvis may remediate stuck switch ports automatically
         */
        switchPortStuck?: pulumi.Input<boolean | undefined>;
    }
    interface SettingMxedgeMgmt {
        /**
         * Whether the Mist Edge automatically reverts configuration changes if connectivity is lost
         */
        configAutoRevert?: pulumi.Input<boolean | undefined>;
        /**
         * Whether FIPS mode is enabled on the Mist Edge
         */
        fipsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Password for the Mist service account on the Mist Edge
         */
        mistPassword?: pulumi.Input<string | undefined>;
        /**
         * IPv4 address assignment mode for out-of-band management
         */
        oobIpType?: pulumi.Input<string | undefined>;
        /**
         * IPv6 address assignment mode for out-of-band management
         */
        oobIpType6?: pulumi.Input<string | undefined>;
        /**
         * Root account password for the Mist Edge
         */
        rootPassword?: pulumi.Input<string | undefined>;
    }
    interface SettingMxtunnel {
        /**
         * Additional named Mist Tunnel definitions configured for the site
         */
        additionalMxtunnels?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.site.SettingMxtunnelAdditionalMxtunnels>;
        } | undefined>;
        /**
         * AP source subnets allowed to establish Mist Tunnels
         */
        apSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Preemption behavior for restoring preferred tunnel peers after failover
         */
        autoPreemption?: pulumi.Input<inputs.site.SettingMxtunnelAutoPreemption | undefined>;
        /**
         * Tunnel peer clusters used by APs for this site Mist Tunnel
         */
        clusters?: pulumi.Input<pulumi.Input<inputs.site.SettingMxtunnelCluster>[] | undefined>;
        /**
         * Timestamp when the site Mist Tunnel configuration was created
         */
        createdTime?: pulumi.Input<number | undefined>;
        /**
         * Whether site Mist Tunnel tunneling is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether this Mist Tunnel configuration is scoped to a site
         */
        forSite?: pulumi.Input<boolean | undefined>;
        /**
         * In seconds, used as heartbeat to detect if a tunnel is alive. AP will try another peer after missing N hellos specified by hello_retries
         */
        helloInterval?: pulumi.Input<number | undefined>;
        /**
         * Number of missed hello heartbeats before an AP tries another tunnel peer
         */
        helloRetries?: pulumi.Input<number | undefined>;
        /**
         * Tunnel peer hostnames or IP addresses reachable from APs
         */
        hosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Unique value identifying the site Mist Tunnel configuration
         */
        id?: pulumi.Input<string | undefined>;
        /**
         * Timestamp when the site Mist Tunnel configuration was last modified
         */
        modifiedTime?: pulumi.Input<number | undefined>;
        /**
         * 0 to enable MTU, 552-1500 to start MTU with a lower MTU
         */
        mtu?: pulumi.Input<number | undefined>;
        /**
         * Identifier of the org that owns the site Mist Tunnel configuration
         */
        orgId?: pulumi.Input<string | undefined>;
        /**
         * Encapsulation protocol used for the site Mist Tunnel
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * TLS-secured RADIUS proxy settings for the site Mist Tunnel
         */
        radsec?: pulumi.Input<inputs.site.SettingMxtunnelRadsec | undefined>;
        /**
         * Identifier of the site that owns this Mist Tunnel configuration
         */
        siteId?: pulumi.Input<string | undefined>;
        /**
         * List of VLAN IDs carried by this site Mist Tunnel
         */
        vlanIds?: pulumi.Input<pulumi.Input<number>[] | undefined>;
    }
    interface SettingMxtunnelAdditionalMxtunnels {
        /**
         * In seconds, used as heartbeat to detect if a tunnel is alive. AP will try another peer after missing N hellos specified by hello_retries
         */
        helloInterval?: pulumi.Input<number | undefined>;
        /**
         * Number of missed hello heartbeats before an AP tries another tunnel peer
         */
        helloRetries?: pulumi.Input<number | undefined>;
        /**
         * Encapsulation protocol used for this additional Mist Tunnel
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Tunnel peer clusters used by APs for this additional Mist Tunnel
         */
        tuntermClusters?: pulumi.Input<pulumi.Input<inputs.site.SettingMxtunnelAdditionalMxtunnelsTuntermCluster>[] | undefined>;
        /**
         * List of VLAN IDs carried by this additional Mist Tunnel
         */
        vlanIds?: pulumi.Input<pulumi.Input<number>[] | undefined>;
    }
    interface SettingMxtunnelAdditionalMxtunnelsTuntermCluster {
        /**
         * Peer cluster name used in the site Mist Tunnel configuration
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Tunnel termination hostnames or IP addresses in this peer cluster
         */
        tuntermHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SettingMxtunnelAutoPreemption {
        /**
         * Scheduled weekday for auto preemption
         */
        dayOfWeek?: pulumi.Input<string | undefined>;
        /**
         * Whether auto preemption is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Scheduled time of day for auto preemption
         */
        timeOfDay?: pulumi.Input<string | undefined>;
    }
    interface SettingMxtunnelCluster {
        /**
         * Peer cluster name used in the site Mist Tunnel configuration
         */
        name?: pulumi.Input<string | undefined>;
        /**
         * Tunnel termination hostnames or IP addresses in this peer cluster
         */
        tuntermHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SettingMxtunnelRadsec {
        /**
         * RADIUS accounting servers used by the site Mist Tunnel RadSec proxy
         */
        acctServers?: pulumi.Input<pulumi.Input<inputs.site.SettingMxtunnelRadsecAcctServer>[] | undefined>;
        /**
         * RADIUS authentication servers used by the site Mist Tunnel RadSec proxy
         */
        authServers?: pulumi.Input<pulumi.Input<inputs.site.SettingMxtunnelRadsecAuthServer>[] | undefined>;
        /**
         * Whether RadSec proxying is enabled for this site Mist Tunnel
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether RadSec proxying uses Mist Edge
         */
        useMxedge?: pulumi.Input<boolean | undefined>;
    }
    interface SettingMxtunnelRadsecAcctServer {
        /**
         * Address or hostname of the RADIUS accounting server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this accounting server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS accounting server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used with this RADIUS accounting server
         */
        secret: pulumi.Input<string>;
    }
    interface SettingMxtunnelRadsecAuthServer {
        /**
         * Address or hostname of the RADIUS authentication server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this authentication server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS authentication server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Whether to require Message-Authenticator in requests
         */
        requireMessageAuthenticator?: pulumi.Input<boolean | undefined>;
        /**
         * Shared secret used with this RADIUS authentication server
         */
        secret: pulumi.Input<string>;
    }
    interface SettingOccupancy {
        /**
         * Indicate whether named BLE assets should be included in the zone occupancy calculation
         */
        assetsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Indicate whether connected Wi-Fi clients should be included in the zone occupancy calculation
         */
        clientsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Minimum dwell duration before a client or asset is counted in occupancy analytics
         */
        minDuration?: pulumi.Input<number | undefined>;
        /**
         * Indicate whether SDK clients should be included in the zone occupancy calculation
         */
        sdkclientsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Indicate whether unconnected Wi-Fi clients should be included in the zone occupancy calculation
         */
        unconnectedClientsEnabled?: pulumi.Input<boolean | undefined>;
    }
    interface SettingProxy {
        /**
         * Whether this proxy configuration is disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Proxy URL used to reach Mist
         */
        url?: pulumi.Input<string | undefined>;
    }
    interface SettingRogue {
        /**
         * VLAN IDs allowed by the rogue detection policy
         */
        allowedVlanIds?: pulumi.Input<pulumi.Input<number>[] | undefined>;
        /**
         * Whether rogue detection is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether honeypot detection is enabled
         */
        honeypotEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Minimum duration for a bssid to be considered neighbor
         */
        minDuration?: pulumi.Input<number | undefined>;
        /**
         * Minimum duration for a bssid to be considered rogue
         */
        minRogueDuration?: pulumi.Input<number | undefined>;
        /**
         * Minimum RSSI for an AP to be considered rogue
         */
        minRogueRssi?: pulumi.Input<number | undefined>;
        /**
         * Minimum RSSI for an AP to be considered neighbor (ignoring APs that’s far away)
         */
        minRssi?: pulumi.Input<number | undefined>;
        /**
         * BSSID values or wildcard patterns excluded from rogue detection
         */
        whitelistedBssids?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * SSID names excluded from rogue detection
         */
        whitelistedSsids?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SettingRtsa {
        /**
         * Whether app wake-up support is enabled for managed mobility
         */
        appWaking?: pulumi.Input<boolean | undefined>;
        /**
         * Whether dead reckoning is disabled for managed mobility
         */
        disableDeadReckoning?: pulumi.Input<boolean | undefined>;
        /**
         * Whether pressure sensor use is disabled for managed mobility
         */
        disablePressureSensor?: pulumi.Input<boolean | undefined>;
        /**
         * Whether managed mobility features are enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether BLE asset tracking is enabled for managed mobility
         */
        trackAsset?: pulumi.Input<boolean | undefined>;
    }
    interface SettingSimpleAlert {
        /**
         * Thresholds for ARP failure heuristic alerts
         */
        arpFailure?: pulumi.Input<inputs.site.SettingSimpleAlertArpFailure | undefined>;
        /**
         * Thresholds for DHCP failure heuristic alerts
         */
        dhcpFailure?: pulumi.Input<inputs.site.SettingSimpleAlertDhcpFailure | undefined>;
        /**
         * Thresholds for DNS failure heuristic alerts
         */
        dnsFailure?: pulumi.Input<inputs.site.SettingSimpleAlertDnsFailure | undefined>;
    }
    interface SettingSimpleAlertArpFailure {
        /**
         * Number of distinct clients that must encounter ARP failures before alerting
         */
        clientCount?: pulumi.Input<number | undefined>;
        /**
         * Time window in minutes for evaluating ARP failures
         */
        duration?: pulumi.Input<number | undefined>;
        /**
         * Number of ARP failure incidents required within the duration window
         */
        incidentCount?: pulumi.Input<number | undefined>;
    }
    interface SettingSimpleAlertDhcpFailure {
        /**
         * Number of distinct clients that must encounter DHCP failures before alerting
         */
        clientCount?: pulumi.Input<number | undefined>;
        /**
         * Time window in minutes for evaluating DHCP failures
         */
        duration?: pulumi.Input<number | undefined>;
        /**
         * Number of DHCP failure incidents required within the duration window
         */
        incidentCount?: pulumi.Input<number | undefined>;
    }
    interface SettingSimpleAlertDnsFailure {
        /**
         * Number of distinct clients that must encounter DNS failures before alerting
         */
        clientCount?: pulumi.Input<number | undefined>;
        /**
         * Time window in minutes for evaluating DNS failures
         */
        duration?: pulumi.Input<number | undefined>;
        /**
         * Number of DNS failure incidents required within the duration window
         */
        incidentCount?: pulumi.Input<number | undefined>;
    }
    interface SettingSkyatp {
        /**
         * Whether Sky ATP is enabled for the site
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether IP-to-MAC mappings are sent to Sky ATP
         */
        sendIpMacMapping?: pulumi.Input<boolean | undefined>;
    }
    interface SettingSleThresholds {
        /**
         * Threshold percentage for capacity SLE scoring
         */
        capacity?: pulumi.Input<number | undefined>;
        /**
         * RSSI threshold for coverage SLE scoring, in dBm
         */
        coverage?: pulumi.Input<number | undefined>;
        /**
         * Minimum throughput threshold for SLE scoring, in Mbps
         */
        throughput?: pulumi.Input<number | undefined>;
        /**
         * Time to connect, in seconds
         */
        timetoconnect?: pulumi.Input<number | undefined>;
    }
    interface SettingSrxApp {
        /**
         * Whether Juniper SRX application visibility is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SettingSsr {
        /**
         * Automatic SSR firmware upgrade settings for newly onboarded devices
         */
        autoUpgrade?: pulumi.Input<inputs.site.SettingSsrAutoUpgrade | undefined>;
        /**
         * IP addresses or hostnames of conductors used by SSR devices
         */
        conductorHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Registration token used by SSR devices to connect to the conductor
         */
        conductorToken?: pulumi.Input<string | undefined>;
        /**
         * Whether stats collection is disabled on SSR devices
         */
        disableStats?: pulumi.Input<boolean | undefined>;
        /**
         * Network proxy settings used by SSR devices to reach Mist
         */
        proxy?: pulumi.Input<inputs.site.SettingSsrProxy | undefined>;
    }
    interface SettingSsrAutoUpgrade {
        /**
         * Firmware release channel used for SSR auto-upgrade
         */
        channel?: pulumi.Input<string | undefined>;
        /**
         * Per-model SSR firmware versions used for auto-upgrade
         */
        customVersions?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
        /**
         * Whether SSR auto-upgrade is enabled for newly onboarded devices
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Firmware version to deploy (e.g. 6.3.0-107.r1). Optional, used when customVersions not specified
         */
        version?: pulumi.Input<string | undefined>;
    }
    interface SettingSsrProxy {
        /**
         * Whether the SSR proxy configuration is disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Proxy URL that SSR devices use to reach Mist
         */
        url?: pulumi.Input<string | undefined>;
    }
    interface SettingSyntheticTest {
        /**
         * Overall aggressiveness level for synthetic test probes
         */
        aggressiveness?: pulumi.Input<string | undefined>;
        /**
         * Custom synthetic probe definitions keyed by probe name
         */
        customProbes?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.site.SettingSyntheticTestCustomProbes>;
        } | undefined>;
        /**
         * Whether synthetic tests are disabled
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * LAN network probe groups used by synthetic tests
         */
        lanNetworks?: pulumi.Input<pulumi.Input<inputs.site.SettingSyntheticTestLanNetwork>[] | undefined>;
        /**
         * Deprecated VLAN-based synthetic test settings
         *
         * @deprecated This attribute is deprecated.
         */
        vlans?: pulumi.Input<pulumi.Input<inputs.site.SettingSyntheticTestVlan>[] | undefined>;
        /**
         * WAN speedtest settings for synthetic tests
         */
        wanSpeedtest?: pulumi.Input<inputs.site.SettingSyntheticTestWanSpeedtest | undefined>;
    }
    interface SettingSyntheticTestCustomProbes {
        /**
         * Probe aggressiveness level for this custom synthetic probe
         */
        aggressiveness?: pulumi.Input<string | undefined>;
        /**
         * Can be URL (e.g. http://x.com, https://x.com:8080/path/to/resource), IP address, or IP:port combination
         */
        target?: pulumi.Input<string | undefined>;
        /**
         * Response-time threshold for this custom probe, in milliseconds
         */
        threshold?: pulumi.Input<number | undefined>;
        /**
         * Probe type used by this custom synthetic probe
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface SettingSyntheticTestLanNetwork {
        /**
         * LAN network names where synthetic probes are run
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Synthetic probe names to run on the listed LAN networks
         */
        probes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SettingSyntheticTestVlan {
        /**
         * Deprecated custom URLs tested by VLAN-based synthetic probes
         *
         * @deprecated This attribute is deprecated.
         */
        customTestUrls?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * For some vlans where we don't want this to run
         */
        disabled?: pulumi.Input<boolean | undefined>;
        /**
         * Synthetic probe names to run for the listed VLANs
         */
        probes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * VLAN identifiers where synthetic probes are run
         */
        vlanIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SettingSyntheticTestWanSpeedtest {
        /**
         * Whether scheduled WAN speedtests are enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Scheduled time of day for WAN speedtests
         */
        timeOfDay?: pulumi.Input<string | undefined>;
    }
    interface SettingTuntermMonitoring {
        /**
         * Can be ip, ipv6, hostname
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * When `protocol`==`tcp`, TCP port checked by the monitoring probe
         */
        port?: pulumi.Input<number | undefined>;
        /**
         * Monitoring method used for this tunnel termination check
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Optional source for the monitoring check, vlanId configured in tunterm_other_ip_configs
         */
        srcVlanId?: pulumi.Input<number | undefined>;
        /**
         * Maximum time for this monitoring check, in seconds
         */
        timeout?: pulumi.Input<number | undefined>;
    }
    interface SettingTuntermMulticastConfig {
        /**
         * Multicast DNS forwarding settings for tunneled VLANs
         */
        mdns?: pulumi.Input<inputs.site.SettingTuntermMulticastConfigMdns | undefined>;
        /**
         * Whether all multicast traffic is forwarded through tunnel termination
         */
        multicastAll?: pulumi.Input<boolean | undefined>;
        /**
         * Simple Service Discovery Protocol forwarding settings for tunneled VLANs
         */
        ssdp?: pulumi.Input<inputs.site.SettingTuntermMulticastConfigSsdp | undefined>;
    }
    interface SettingTuntermMulticastConfigMdns {
        /**
         * Whether mDNS multicast forwarding is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * VLAN IDs where mDNS multicast forwarding is enabled
         */
        vlanIds?: pulumi.Input<pulumi.Input<number>[] | undefined>;
    }
    interface SettingTuntermMulticastConfigSsdp {
        /**
         * Whether SSDP multicast forwarding is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * VLAN IDs where SSDP multicast forwarding is enabled
         */
        vlanIds?: pulumi.Input<pulumi.Input<number>[] | undefined>;
    }
    interface SettingUplinkPortConfig {
        /**
         * Whether to do 802.1x against uplink switch. When enabled, AP cert will be used to do EAP-TLS and the Org's CA Cert has to be provisioned at the switch
         */
        dot1x?: pulumi.Input<boolean | undefined>;
        /**
         * By default, WLANs are disabled when uplink is down. In some scenario, like SiteSurvey, one would want the AP to keep sending beacons.
         */
        keepWlansUpIfDown?: pulumi.Input<boolean | undefined>;
    }
    interface SettingVarsAnnotations {
        /**
         * User-provided note to describe what this var was created for
         */
        note?: pulumi.Input<string | undefined>;
        /**
         * Used to identify where to enumerate / auto-complete the field from. Default is `generic` (plain string, no special handling).
         *
         * enum: `generic`, `mxtunnelId`
         */
        type?: pulumi.Input<string | undefined>;
    }
    interface SettingVna {
        /**
         * Enable Virtual Network Assistant (using SUB-VNA license). This applied to AP / Switch / Gateway
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SettingVsInstance {
        /**
         * List of network names included in this virtual-switch instance
         */
        networks?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
    interface SettingWanVna {
        /**
         * Whether WAN VNA is enabled for the site
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SettingWids {
        /**
         * Detection settings for repeated authentication failures
         */
        repeatedAuthFailures?: pulumi.Input<inputs.site.SettingWidsRepeatedAuthFailures | undefined>;
    }
    interface SettingWidsRepeatedAuthFailures {
        /**
         * Window where a trigger will be detected and action to be taken (in seconds)
         */
        duration?: pulumi.Input<number | undefined>;
        /**
         * Count of events to trigger
         */
        threshold?: pulumi.Input<number | undefined>;
    }
    interface SettingWifi {
        /**
         * Whether Cisco compatibility features are enabled for site Wi-Fi
         */
        ciscoEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to disable 11k
         */
        disable11k?: pulumi.Input<boolean | undefined>;
        /**
         * Whether AP radios are disabled when AP power is constrained
         */
        disableRadiosWhenPowerConstrained?: pulumi.Input<boolean | undefined>;
        /**
         * When proxyArp is enabled, check for arp spoofing.
         */
        enableArpSpoofCheck?: pulumi.Input<boolean | undefined>;
        /**
         * Whether shared radio scanning is enabled for site Wi-Fi
         */
        enableSharedRadioScanning?: pulumi.Input<boolean | undefined>;
        /**
         * Enable Wi-Fi feature (using SUB-MAN license)
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to locate connected clients
         */
        locateConnected?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to locate unconnected clients
         */
        locateUnconnected?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to allow Mesh to use DFS channels. For DFS channels, Remote Mesh AP would have to do CAC when scanning for new Base AP, which is slow and will disrupt the connection. If roaming is desired, keep it disabled.
         */
        meshAllowDfs?: pulumi.Input<boolean | undefined>;
        /**
         * Used to enable/disable CRM
         */
        meshEnableCrm?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to enable Mesh feature for the site
         */
        meshEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional passphrase of mesh networking, default is generated randomly
         */
        meshPsk?: pulumi.Input<string | undefined>;
        /**
         * Optional ssid of mesh networking, default is based on site_id
         */
        meshSsid?: pulumi.Input<string | undefined>;
        /**
         * ARP proxy mode for site Wi-Fi
         */
        proxyArp?: pulumi.Input<string | undefined>;
    }
    interface SettingWiredVna {
        /**
         * Whether Wired VNA is enabled for the site
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface SettingZoneOccupancyAlert {
        /**
         * Notification email recipients for zone occupancy alerts
         */
        emailNotifiers?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Indicate whether zone occupancy alert is enabled for the site
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Sending zone-occupancy-alert webhook message only if a zone stays non-compliant (i.e. actual occupancy > occupancy_limit) for a minimum duration specified in the threshold, in minutes
         */
        threshold?: pulumi.Input<number | undefined>;
    }
    interface WlanAcctServer {
        /**
         * Address or hostname of the RADIUS accounting server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this accounting server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS accounting server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used with this RADIUS accounting server
         */
        secret: pulumi.Input<string>;
    }
    interface WlanAirwatch {
        /**
         * API key used to authenticate to the AirWatch service
         */
        apiKey?: pulumi.Input<string | undefined>;
        /**
         * Base console URL of the AirWatch deployment
         */
        consoleUrl?: pulumi.Input<string | undefined>;
        /**
         * Whether AirWatch integration is enabled for the WLAN
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * AirWatch integration account password for this WLAN
         */
        password?: pulumi.Input<string | undefined>;
        /**
         * AirWatch integration account username for this WLAN
         */
        username?: pulumi.Input<string | undefined>;
    }
    interface WlanAppLimit {
        /**
         * Map from app key to bandwidth in kbps.
         * Property key is the app key, defined in Get Application List
         */
        apps?: pulumi.Input<{
            [key: string]: pulumi.Input<number>;
        } | undefined>;
        /**
         * Whether application bandwidth limits are enabled for this WLAN
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Map from wxtagId of Hostname Wxlan Tags to bandwidth in kbps. Property key is the `wxtagId`
         */
        wxtagIds?: pulumi.Input<{
            [key: string]: pulumi.Input<number>;
        } | undefined>;
    }
    interface WlanAppQos {
        /**
         * Map of application keys to QoS rewrite settings
         */
        apps?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.site.WlanAppQosApps>;
        } | undefined>;
        /**
         * Whether application QoS rewrite rules are enabled for this WLAN
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Custom traffic QoS rules that are not tied to named applications
         */
        others?: pulumi.Input<pulumi.Input<inputs.site.WlanAppQosOther>[] | undefined>;
    }
    interface WlanAppQosApps {
        /**
         * DSCP value range between 0 and 63
         */
        dscp?: pulumi.Input<string | undefined>;
        /**
         * Subnet filter is not required but helps AP to only inspect certain traffic (thus reducing AP load)
         */
        dstSubnet?: pulumi.Input<string | undefined>;
        /**
         * Subnet filter is not required but helps AP to only inspect certain traffic (thus reducing AP load)
         */
        srcSubnet?: pulumi.Input<string | undefined>;
    }
    interface WlanAppQosOther {
        /**
         * Differentiated Services Code Point value applied to matching traffic
         */
        dscp?: pulumi.Input<string | undefined>;
        /**
         * Destination subnet filter for this custom QoS rule
         */
        dstSubnet?: pulumi.Input<string | undefined>;
        /**
         * TCP or UDP port ranges matched by this custom QoS rule
         */
        portRanges?: pulumi.Input<string | undefined>;
        /**
         * IP protocol matched by this custom QoS rule
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Source subnet filter for this custom QoS rule
         */
        srcSubnet?: pulumi.Input<string | undefined>;
    }
    interface WlanAuth {
        /**
         * SAE anti-clogging token threshold
         */
        anticlogThreshold?: pulumi.Input<number | undefined>;
        /**
         * Whether to trigger EAP reauth when the session ends
         */
        eapReauth?: pulumi.Input<boolean | undefined>;
        /**
         * Enable Beacon Protection; default is false for better compatibility
         */
        enableBeaconProtection?: pulumi.Input<boolean | undefined>;
        /**
         * Enable GCMP-256 encryption suite; default is false for better compatibility
         */
        enableGcmp256?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to enable MAC Auth, uses the same auth_servers
         */
        enableMacAuth?: pulumi.Input<boolean | undefined>;
        /**
         * When `type`==`wep`, index of the WEP key used as the default transmit key
         */
        keyIdx?: pulumi.Input<number | undefined>;
        /**
         * When `type`==`wep`, WEP keys configured for this WLAN
         */
        keys?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * When `type`==`psk`, whether to only use multi_psk
         */
        multiPskOnly?: pulumi.Input<boolean | undefined>;
        /**
         * When `type`==`open`, Opportunistic Wireless Encryption mode for this WLAN
         */
        owe?: pulumi.Input<string | undefined>;
        /**
         * When `type`==`psk` or `type`==`eap`, pairwise cipher suites allowed for this WLAN
         */
        pairwises?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * When `multiPskOnly`==`true`, whether private wlan is enabled
         */
        privateWlan?: pulumi.Input<boolean | undefined>;
        /**
         * When `type`==`psk`, 8-64 characters, or 64 hex characters
         */
        psk?: pulumi.Input<string | undefined>;
        /**
         * Authentication mode used by this WLAN
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Enable WEP as secondary auth
         */
        wepAsSecondaryAuth?: pulumi.Input<boolean | undefined>;
    }
    interface WlanAuthServer {
        /**
         * Address or hostname of the RADIUS authentication server
         */
        host: pulumi.Input<string>;
        /**
         * Whether RADIUS keywrap is enabled for messages sent to this authentication server
         */
        keywrapEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Encoding format for RADIUS keywrap KEK and MACK values
         */
        keywrapFormat?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap key encryption key (KEK)
         */
        keywrapKek?: pulumi.Input<string | undefined>;
        /**
         * RADIUS keywrap message authentication code key (MACK)
         */
        keywrapMack?: pulumi.Input<string | undefined>;
        /**
         * UDP port used by the RADIUS authentication server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Whether to require Message-Authenticator in requests
         */
        requireMessageAuthenticator?: pulumi.Input<boolean | undefined>;
        /**
         * Shared secret used with this RADIUS authentication server
         */
        secret: pulumi.Input<string>;
    }
    interface WlanBonjour {
        /**
         * additional VLAN IDs (on the LAN side or from other WLANs) should we be forwarding bonjour queries/responses
         */
        additionalVlanIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether to enable bonjour for this WLAN. Once enabled, limitBcast is assumed true, allowMdns is assumed false
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * What services are allowed.
         * Property key is the service name
         */
        services?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.site.WlanBonjourServices>;
        } | undefined>;
    }
    interface WlanBonjourServices {
        /**
         * Whether to prevent wireless clients to discover bonjour devices on the same WLAN
         */
        disableLocal?: pulumi.Input<boolean | undefined>;
        /**
         * RADIUS groups allowed to discover this Bonjour service, when restricted
         */
        radiusGroups?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Discovery scope for this Bonjour service on the WLAN
         */
        scope?: pulumi.Input<string | undefined>;
    }
    interface WlanCiscoCwa {
        /**
         * Hostnames allowed for Cisco CWA client access before authorization
         */
        allowedHostnames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * CIDR subnets allowed for Cisco CWA client access before authorization
         */
        allowedSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * CIDR subnets blocked for Cisco CWA client access
         */
        blockedSubnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether Cisco CWA is enabled for this WLAN
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface WlanCoaServer {
        /**
         * Whether to disable Event-Timestamp Check
         */
        disableEventTimestampCheck?: pulumi.Input<boolean | undefined>;
        /**
         * Whether this RADIUS CoA server is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Server IPv4 address for RADIUS CoA messages
         */
        ip: pulumi.Input<string>;
        /**
         * UDP port used to send RADIUS CoA messages to the server
         */
        port?: pulumi.Input<string | undefined>;
        /**
         * Shared secret used to authenticate RADIUS CoA messages
         */
        secret: pulumi.Input<string>;
    }
    interface WlanDnsServerRewrite {
        /**
         * Whether DNS server rewrite by RADIUS group is enabled for this WLAN
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Map between radiusGroup and the desired DNS server (IPv4 only). Property key is the RADIUS group, property value is the desired DNS Server
         */
        radiusGroups?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
    }
    interface WlanDynamicPsk {
        /**
         * Default PSK to use if cloud WLC is not available, 8-63 characters
         */
        defaultPsk?: pulumi.Input<string | undefined>;
        /**
         * Default VLAN ID used when dynamic PSK lookup does not return a VLAN
         */
        defaultVlanId?: pulumi.Input<string | undefined>;
        /**
         * Whether dynamic PSK is enabled for this WLAN
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * When 11r is enabled, we'll try to use the cached PMK, this can be disabled. `false` means auto
         */
        forceLookup?: pulumi.Input<boolean | undefined>;
        /**
         * Origin used to retrieve per-user PSKs
         */
        source?: pulumi.Input<string | undefined>;
    }
    interface WlanDynamicVlan {
        /**
         * Fallback VLAN IDs, ranges, or variables used when no RADIUS VLAN match is returned
         */
        defaultVlanIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Requires `vlanEnabled`==`true` to be set to `true`. Whether to enable dynamic vlan
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * VLAN IDs that should be locally bridged for dynamic VLAN assignment
         */
        localVlanIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Dynamic VLAN mapping method used for RADIUS-provided VLAN attributes
         */
        type?: pulumi.Input<string | undefined>;
        /**
         * Map between vlanId (as string) to airespace interface names (comma-separated) or null for standard mapping
         *   * if `dynamic_vlan.type`==`standard`, property key is the VLAN ID and property value is \"\"
         *   * if `dynamic_vlan.type`==`airespace-interface-name`, property key is the VLAN ID and property value is the Airespace Interface Name
         */
        vlans?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
    }
    interface WlanHotspot20 {
        /**
         * Advertised domain names for Hotspot 2.0 clients
         */
        domainNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether to enable hotspot 2.0 config
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * NAI realms advertised for Hotspot 2.0 authentication
         */
        naiRealms?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Operator profiles supported by this Hotspot 2.0 configuration
         */
        operators?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Roaming Consortium Organization Identifiers advertised for Hotspot 2.0
         */
        rcois?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Venue name, default is site name
         */
        venueName?: pulumi.Input<string | undefined>;
    }
    interface WlanInjectDhcpOption82 {
        /**
         * Information to set in the `circuitId` field of the DHCP Option 82. It is possible to use static string or the following variables (e.g. `{{SSID}}:{{AP_MAC}}`):
         *   * {{AP_MAC}}
         *   * {{AP_MAC_DASHED}}
         *   * {{AP_MODEL}}
         *   * {{AP_NAME}}
         *   * {{SITE_NAME}}
         *   * {{SSID}}
         */
        circuitId?: pulumi.Input<string | undefined>;
        /**
         * Whether to inject option 82 when forwarding DHCP packets
         */
        enabled?: pulumi.Input<boolean | undefined>;
    }
    interface WlanMistNac {
        /**
         * How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled.
         */
        acctInterimInterval?: pulumi.Input<number | undefined>;
        /**
         * RADIUS auth session retries. Following fast timers are set if `fastDot1xTimers` knob is enabled. "retries" are set to value of `authServersTimeout`. "max-requests" is also set when setting `authServersRetries` is set to default value to 3.
         */
        authServersRetries?: pulumi.Input<number | undefined>;
        /**
         * RADIUS auth session timeout. Following fast timers are set if `fastDot1xTimers` knob is enabled. "quite-period" and "transmit-period" are set to half the value of `authServersTimeout`. "supplicant-timeout" is also set when setting `authServersTimeout` is set to default value of 10.
         */
        authServersTimeout?: pulumi.Input<number | undefined>;
        /**
         * Allows a RADIUS server to dynamically modify the authorization status of a user session.
         */
        coaEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * the communication port used for “Change of Authorization” (CoA) messages
         */
        coaPort?: pulumi.Input<number | undefined>;
        /**
         * When enabled:
         *   * `authServers` is ignored
         *   * `acctServers` is ignored
         *   * `auth_servers_*` are ignored
         *   * `coaServers` is ignored
         *   * `radsec` is ignored
         *   * `coaEnabled` is assumed
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * If set to true, sets default fast-timers with values calculated from `authServersTimeout` and `authServerRetries`.
         */
        fastDot1xTimers?: pulumi.Input<boolean | undefined>;
        /**
         * Which network the mist nac server resides in
         */
        network?: pulumi.Input<string | undefined>;
        /**
         * In case there is a static IP for this network, we can specify it using source ip
         */
        sourceIp?: pulumi.Input<string | undefined>;
    }
    interface WlanPortal {
        /**
         * Optional if `amazonEnabled`==`true`. Whether to allow guest to connect to other Guest WLANs (with different `WLAN.ssid`) of same org without reauthentication (disable randomMac for seamless roaming)
         */
        allowWlanIdRoam?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `amazonEnabled`==`true`. Amazon OAuth2 client id. This is optional. If not provided, it will use a default one.
         */
        amazonClientId?: pulumi.Input<string | undefined>;
        /**
         * Optional if `amazonEnabled`==`true`. Amazon OAuth2 client secret. If amazonClientId was provided, provide a corresponding value. Else leave blank.
         */
        amazonClientSecret?: pulumi.Input<string | undefined>;
        /**
         * Optional if `amazonEnabled`==`true`. Email domains allowed for Amazon-authenticated guest users. If null or empty, any authenticated Amazon email domain is allowed.
         */
        amazonEmailDomains?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether amazon is enabled as a login method
         */
        amazonEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `amazonEnabled`==`true`. Interval for which guest remains authorized using amazon auth (in minutes), if not provided, uses expire`
         */
        amazonExpire?: pulumi.Input<number | undefined>;
        /**
         * Guest portal login scheme used by the WLAN
         */
        auth?: pulumi.Input<string | undefined>;
        /**
         * Required if `azureEnabled`==`true`. Azure active directory app client id
         */
        azureClientId?: pulumi.Input<string | undefined>;
        /**
         * Required if `azureEnabled`==`true`. Azure active directory app client secret
         */
        azureClientSecret?: pulumi.Input<string | undefined>;
        /**
         * Whether Azure Active Directory is enabled as a login method
         */
        azureEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Interval for which guest remains authorized using azure auth (in minutes), if not provided, uses expire`
         */
        azureExpire?: pulumi.Input<number | undefined>;
        /**
         * Required if `azureEnabled`==`true`. Azure active directory tenant id.
         */
        azureTenantId?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`broadnet`. Password for the Broadnet SMS provider account
         */
        broadnetPassword?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`broadnet`. SID for the Broadnet SMS provider account
         */
        broadnetSid?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`broadnet`. User ID for the Broadnet SMS provider account
         */
        broadnetUserId?: pulumi.Input<string | undefined>;
        /**
         * Whether to bypass the guest portal when cloud not reachable (and apply the default policies)
         */
        bypassWhenCloudDown?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `smsProvider`==`clickatell`. API key for the Clickatell SMS provider account
         */
        clickatellApiKey?: pulumi.Input<string | undefined>;
        /**
         * Whether to allow guest to roam between WLANs (with same `WLAN.ssid`, regardless of variables) of different sites of same org without reauthentication (disable randomMac for seamless roaming)
         */
        crossSite?: pulumi.Input<boolean | undefined>;
        /**
         * Whether email (access code verification) is enabled as a login method
         */
        emailEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether guest portal is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * How long to remain authorized, in minutes
         */
        expire?: pulumi.Input<number | undefined>;
        /**
         * Required if `wlanPortalAuth`==`external`. External portal URL (e.g. https://host/url) where we can append our query parameters to
         */
        externalPortalUrl?: pulumi.Input<string | undefined>;
        /**
         * Required if `facebookEnabled`==`true`. Facebook OAuth2 app id. This is optional. If not provided, it will use a default one.
         */
        facebookClientId?: pulumi.Input<string | undefined>;
        /**
         * Required if `facebookEnabled`==`true`. Facebook OAuth2 app secret. If facebookClientId was provided, provide a corresponding value. Else leave blank.
         */
        facebookClientSecret?: pulumi.Input<string | undefined>;
        /**
         * Optional if `facebookEnabled`==`true`. Email domains allowed for Facebook-authenticated guest users. If null or empty, any authenticated Facebook email domain is allowed.
         */
        facebookEmailDomains?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether facebook is enabled as a login method
         */
        facebookEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `facebookEnabled`==`true`. Interval for which guest remains authorized using facebook auth (in minutes), if not provided, uses expire`
         */
        facebookExpire?: pulumi.Input<number | undefined>;
        /**
         * Whether to forward the user to another URL after authorized
         */
        forward?: pulumi.Input<boolean | undefined>;
        /**
         * URL to forward the user to
         */
        forwardUrl?: pulumi.Input<string | undefined>;
        /**
         * Google OAuth2 app id. This is optional. If not provided, it will use a default one.
         */
        googleClientId?: pulumi.Input<string | undefined>;
        /**
         * Optional if `googleEnabled`==`true`. Google OAuth2 app secret. If googleClientId was provided, provide a corresponding value. Else leave blank.
         */
        googleClientSecret?: pulumi.Input<string | undefined>;
        /**
         * Optional if `googleEnabled`==`true`. Email domains allowed for Google-authenticated guest users. If null or empty, any authenticated Google email domain is allowed.
         */
        googleEmailDomains?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether Google is enabled as login method
         */
        googleEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `googleEnabled`==`true`. Interval for which guest remains authorized using Google Auth (in minutes), if not provided, uses expire`
         */
        googleExpire?: pulumi.Input<number | undefined>;
        /**
         * Required if `smsProvider`==`gupshup`. Password for the Gupshup SMS provider account
         */
        gupshupPassword?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`gupshup`. User ID for the Gupshup SMS provider account
         */
        gupshupUserid?: pulumi.Input<string | undefined>;
        /**
         * Optional if `microsoftEnabled`==`true`. Microsoft 365 OAuth2 client id. This is optional. If not provided, it will use a default one.
         */
        microsoftClientId?: pulumi.Input<string | undefined>;
        /**
         * Optional if `microsoftEnabled`==`true`. Microsoft 365 OAuth2 client secret. If microsoftClientId was provided, provide a corresponding value. Else leave blank.
         */
        microsoftClientSecret?: pulumi.Input<string | undefined>;
        /**
         * Optional if `microsoftEnabled`==`true`. Email domains allowed for Microsoft 365-authenticated guest users. If null or empty, any authenticated Microsoft 365 email domain is allowed.
         */
        microsoftEmailDomains?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether microsoft 365 is enabled as a login method
         */
        microsoftEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `microsoftEnabled`==`true`. Interval for which guest remains authorized using microsoft auth (in minutes), if not provided, uses expire`
         */
        microsoftExpire?: pulumi.Input<number | undefined>;
        /**
         * Whether password is enabled
         */
        passphraseEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `passphraseEnabled`==`true`. Interval for which guest remains authorized using passphrase auth (in minutes), if not provided, uses `expire`
         */
        passphraseExpire?: pulumi.Input<number | undefined>;
        /**
         * Required if `passphraseEnabled`==`true`. Passphrase guests must enter when passphrase authentication is enabled
         */
        password?: pulumi.Input<string | undefined>;
        /**
         * Whether to show list of sponsor emails mentioned in `sponsors` object as a dropdown. If both `sponsorNotifyAll` and `predefinedSponsorsEnabled` are false, behavior is acc to `sponsorEmailDomains`
         */
        predefinedSponsorsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to hide sponsor’s email from list of sponsors
         */
        predefinedSponsorsHideEmail?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to show the privacy policy in the WLAN guest portal
         */
        privacy?: pulumi.Input<boolean | undefined>;
        /**
         * Required if `smsProvider`==`puzzel`. Password for the Puzzel SMS provider account
         */
        puzzelPassword?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`puzzel`. Service ID for the Puzzel SMS provider account
         */
        puzzelServiceId?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`puzzel`. Username for the Puzzel SMS provider account
         */
        puzzelUsername?: pulumi.Input<string | undefined>;
        /**
         * Whether sms is enabled as a login method
         */
        smsEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `smsEnabled`==`true`. Interval for which guest remains authorized using sms auth (in minutes), if not provided, uses expire`
         */
        smsExpire?: pulumi.Input<number | undefined>;
        /**
         * Optional if `smsEnabled`==`true`. SMS Message format
         */
        smsMessageFormat?: pulumi.Input<string | undefined>;
        /**
         * Optional if `smsEnabled`==`true`. SMS provider used to deliver guest portal access codes
         */
        smsProvider?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`smsglobal`, Client API Key
         */
        smsglobalApiKey?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`smsglobal`, Client secret
         */
        smsglobalApiSecret?: pulumi.Input<string | undefined>;
        /**
         * Optional sender's number or sender ID for SMSGlobal. If not provided, uses the default number associated with the account
         */
        smsglobalSender?: pulumi.Input<string | undefined>;
        /**
         * Optional if `sponsorEnabled`==`true`. Whether to automatically approve guest and allow sponsor to revoke guest access, needs predefinedSponsorsEnabled enabled and sponsorNotifyAll disabled
         */
        sponsorAutoApprove?: pulumi.Input<boolean | undefined>;
        /**
         * Email domains allowed for sponsor email addresses. Required if `sponsorEnabled` is `true` and `sponsors` is empty.
         */
        sponsorEmailDomains?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Whether sponsor is enabled
         */
        sponsorEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `sponsorEnabled`==`true`. Interval for which guest remains authorized using sponsor auth (in minutes), if not provided, uses expire`
         */
        sponsorExpire?: pulumi.Input<number | undefined>;
        /**
         * Optional if `sponsorEnabled`==`true`. How long to remain valid sponsored guest request approve/deny link received in email, in minutes. Default is 60 minutes.
         */
        sponsorLinkValidityDuration?: pulumi.Input<string | undefined>;
        /**
         * Optional if `sponsorEnabled`==`true`. whether to notify all sponsors that are mentioned in `sponsors` object. Both `sponsorNotifyAll` and `predefinedSponsorsEnabled` should be true in order to notify sponsors. If true, email sent to 10 sponsors in no particular order.
         */
        sponsorNotifyAll?: pulumi.Input<boolean | undefined>;
        /**
         * Optional if `sponsorEnabled`==`true`. If enabled, guest will get email about sponsor's action (approve/deny)
         */
        sponsorStatusNotify?: pulumi.Input<boolean | undefined>;
        /**
         * object of allowed sponsors email with name. Required if `sponsorEnabled`
         *             is `true` and `sponsorEmailDomains` is empty.
         *
         *             Property key is the sponsor email, Property value is the sponsor name
         */
        sponsors?: pulumi.Input<{
            [key: string]: pulumi.Input<string>;
        } | undefined>;
        /**
         * Optional if `wlanPortalAuth`==`sso`, default role to assign if there’s no match. By default, an assertion is treated as invalid when there’s no role matched
         */
        ssoDefaultRole?: pulumi.Input<string | undefined>;
        /**
         * Optional if `wlanPortalAuth`==`sso`. Role assigned to authenticated users when guest SSO is used
         */
        ssoForcedRole?: pulumi.Input<string | undefined>;
        /**
         * Required if `wlanPortalAuth`==`sso`. IDP Cert (used to verify the signed response)
         */
        ssoIdpCert?: pulumi.Input<string | undefined>;
        /**
         * Optional if `wlanPortalAuth`==`sso`. Signing algorithm used for SAML assertions from the identity provider
         */
        ssoIdpSignAlgo?: pulumi.Input<string | undefined>;
        /**
         * Required if `wlanPortalAuth`==`sso`, IDP Single-Sign-On URL
         */
        ssoIdpSsoUrl?: pulumi.Input<string | undefined>;
        /**
         * Required if `wlanPortalAuth`==`sso`, IDP issuer URL
         */
        ssoIssuer?: pulumi.Input<string | undefined>;
        /**
         * Optional if `wlanPortalAuth`==`sso`. SAML NameID format expected from the identity provider
         */
        ssoNameidFormat?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`telstra`, Client ID provided by Telstra
         */
        telstraClientId?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`telstra`, Client secret provided by Telstra
         */
        telstraClientSecret?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`twilio`, Auth token account with twilio account
         */
        twilioAuthToken?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`twilio`, Twilio phone number associated with the account. See example for accepted format.
         */
        twilioPhoneNumber?: pulumi.Input<string | undefined>;
        /**
         * Required if `smsProvider`==`twilio`, Account SID provided by Twilio
         */
        twilioSid?: pulumi.Input<string | undefined>;
    }
    interface WlanPortalTemplatePortalTemplate {
        /**
         * Link text for using an alternate email address during access-code login
         */
        accessCodeAlternateEmail?: pulumi.Input<string | undefined>;
        /**
         * Text and content alignment used by the guest portal template
         */
        alignment?: pulumi.Input<string | undefined>;
        /**
         * Label for Amazon auth button
         */
        authButtonAmazon?: pulumi.Input<string | undefined>;
        /**
         * Label for Azure auth button
         */
        authButtonAzure?: pulumi.Input<string | undefined>;
        /**
         * Label for Email auth button
         */
        authButtonEmail?: pulumi.Input<string | undefined>;
        /**
         * Label for Facebook auth button
         */
        authButtonFacebook?: pulumi.Input<string | undefined>;
        /**
         * Label for Google auth button
         */
        authButtonGoogle?: pulumi.Input<string | undefined>;
        /**
         * Label for Microsoft auth button
         */
        authButtonMicrosoft?: pulumi.Input<string | undefined>;
        /**
         * Label for passphrase auth button
         */
        authButtonPassphrase?: pulumi.Input<string | undefined>;
        /**
         * Label for SMS auth button
         */
        authButtonSms?: pulumi.Input<string | undefined>;
        /**
         * Label for Sponsor auth button
         */
        authButtonSponsor?: pulumi.Input<string | undefined>;
        /**
         * Heading text displayed above portal authentication options
         */
        authLabel?: pulumi.Input<string | undefined>;
        /**
         * Label of the link to go back to /logon
         */
        backLink?: pulumi.Input<string | undefined>;
        /**
         * Primary color used by the portal template
         */
        color?: pulumi.Input<string | undefined>;
        /**
         * Darker accent color used by the portal template
         */
        colorDark?: pulumi.Input<string | undefined>;
        /**
         * Lighter accent color used by the portal template
         */
        colorLight?: pulumi.Input<string | undefined>;
        /**
         * Whether company field is required
         */
        company?: pulumi.Input<boolean | undefined>;
        /**
         * Error message when company not provided
         */
        companyError?: pulumi.Input<string | undefined>;
        /**
         * Label displayed for the company input field
         */
        companyLabel?: pulumi.Input<string | undefined>;
        /**
         * Whether email field is required
         */
        email?: pulumi.Input<boolean | undefined>;
        /**
         * Error message when a user has valid social login but doesn't match specified email domains.
         */
        emailAccessDomainError?: pulumi.Input<string | undefined>;
        /**
         * Label for cancel confirmation code submission using email auth
         */
        emailCancel?: pulumi.Input<string | undefined>;
        /**
         * Link text for requesting help when the email access code was not received
         */
        emailCodeCancel?: pulumi.Input<string | undefined>;
        /**
         * Error message shown when the alternate email address for access-code delivery is invalid
         */
        emailCodeError?: pulumi.Input<string | undefined>;
        /**
         * Label for the email access-code input field
         */
        emailCodeFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Instructional text shown before entering the email access code
         */
        emailCodeMessage?: pulumi.Input<string | undefined>;
        /**
         * Button label for submitting the email access code
         */
        emailCodeSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title shown on the email access-code entry page
         */
        emailCodeTitle?: pulumi.Input<string | undefined>;
        /**
         * Error message when email not provided
         */
        emailError?: pulumi.Input<string | undefined>;
        /**
         * Label for the email address input field
         */
        emailFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Label displayed for the email input field
         */
        emailLabel?: pulumi.Input<string | undefined>;
        /**
         * Instructional text explaining email access-code delivery
         */
        emailMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for confirmation code submit button using email auth
         */
        emailSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title for the Email registration
         */
        emailTitle?: pulumi.Input<string | undefined>;
        /**
         * Whether to ask field1
         */
        field1?: pulumi.Input<boolean | undefined>;
        /**
         * Error message when field1 not provided
         */
        field1error?: pulumi.Input<string | undefined>;
        /**
         * Label for custom field 1 input
         */
        field1label?: pulumi.Input<string | undefined>;
        /**
         * Whether custom field 1 must be provided when the field is shown
         */
        field1required?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to ask field2
         */
        field2?: pulumi.Input<boolean | undefined>;
        /**
         * Error message when field2 not provided
         */
        field2error?: pulumi.Input<string | undefined>;
        /**
         * Label for custom field 2 input
         */
        field2label?: pulumi.Input<string | undefined>;
        /**
         * Whether custom field 2 must be provided when the field is shown
         */
        field2required?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to ask field3
         */
        field3?: pulumi.Input<boolean | undefined>;
        /**
         * Error message when field3 not provided
         */
        field3error?: pulumi.Input<string | undefined>;
        /**
         * Label for custom field 3 input
         */
        field3label?: pulumi.Input<string | undefined>;
        /**
         * Whether custom field 3 must be provided when the field is shown
         */
        field3required?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to ask field4
         */
        field4?: pulumi.Input<boolean | undefined>;
        /**
         * Error message when field4 not provided
         */
        field4error?: pulumi.Input<string | undefined>;
        /**
         * Label for custom field 4 input
         */
        field4label?: pulumi.Input<string | undefined>;
        /**
         * Whether custom field 4 must be provided when the field is shown
         */
        field4required?: pulumi.Input<boolean | undefined>;
        /**
         * Can be used to localize the portal based on the User Agent. Allowed property key values are:
         *   `ar`, `ca-ES`, `cs-CZ`, `da-DK`, `de-DE`, `el-GR`, `en-GB`, `en-US`, `es-ES`, `fi-FI`, `fr-FR`,
         *   `he-IL`, `hi-IN`, `hr-HR`, `hu-HU`, `id-ID`, `it-IT`, `ja-J^`, `ko-KT`, `ms-MY`, `nb-NO`, `nl-NL`,
         *   `pl-PL`, `pt-BR`, `pt-PT`, `ro-RO`, `ru-RU`, `sk-SK`, `sv-SE`, `th-TH`, `tr-TR`, `uk-UA`, `vi-VN`,
         *   `zh-Hans`, `zh-Hant`
         */
        locales?: pulumi.Input<{
            [key: string]: pulumi.Input<inputs.site.WlanPortalTemplatePortalTemplateLocales>;
        } | undefined>;
        /**
         * path to the background image file. File must be a `png` image`
         */
        logo?: pulumi.Input<string | undefined>;
        /**
         * label of the link to go to /marketing_policy
         */
        marketingPolicyLink?: pulumi.Input<string | undefined>;
        /**
         * Whether marketing policy optin is enabled
         */
        marketingPolicyOptIn?: pulumi.Input<boolean | undefined>;
        /**
         * label for marketing optin
         */
        marketingPolicyOptInLabel?: pulumi.Input<string | undefined>;
        /**
         * Text of the marketing policy opt-in content
         */
        marketingPolicyOptInText?: pulumi.Input<string | undefined>;
        /**
         * Main message displayed on the guest portal sign-in page
         */
        message?: pulumi.Input<string | undefined>;
        /**
         * Whether the portal presents multiple authentication methods
         */
        multiAuth?: pulumi.Input<boolean | undefined>;
        /**
         * Whether name field is required
         */
        name?: pulumi.Input<boolean | undefined>;
        /**
         * Error message when name not provided
         */
        nameError?: pulumi.Input<string | undefined>;
        /**
         * Label displayed for the name input field
         */
        nameLabel?: pulumi.Input<string | undefined>;
        /**
         * Default value for the `Do not store` checkbox
         */
        optOutDefault?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to display Do Not Store My Personal Information
         */
        optout?: pulumi.Input<boolean | undefined>;
        /**
         * Label for Do Not Store My Personal Information
         */
        optoutLabel?: pulumi.Input<string | undefined>;
        /**
         * Browser or page title shown for the guest portal
         */
        pageTitle?: pulumi.Input<string | undefined>;
        /**
         * Label for the Passphrase cancel button
         */
        passphraseCancel?: pulumi.Input<string | undefined>;
        /**
         * Error message when invalid passphrase is provided
         */
        passphraseError?: pulumi.Input<string | undefined>;
        /**
         * Label for the passphrase input field
         */
        passphraseLabel?: pulumi.Input<string | undefined>;
        /**
         * Instructional text shown on the passphrase sign-in page
         */
        passphraseMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for the Passphrase submit button
         */
        passphraseSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title for passphrase details page
         */
        passphraseTitle?: pulumi.Input<string | undefined>;
        /**
         * Whether to show \"Powered by Mist\"
         */
        poweredBy?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to require the Privacy Term acceptance
         */
        privacy?: pulumi.Input<boolean | undefined>;
        /**
         * Prefix of the label of the link to go to Privacy Policy
         */
        privacyPolicyAcceptLabel?: pulumi.Input<string | undefined>;
        /**
         * Error message when Privacy Policy not accepted
         */
        privacyPolicyError?: pulumi.Input<string | undefined>;
        /**
         * Label of the link to go to Privacy Policy
         */
        privacyPolicyLink?: pulumi.Input<string | undefined>;
        /**
         * Text of the Privacy Policy
         */
        privacyPolicyText?: pulumi.Input<string | undefined>;
        /**
         * Text used to mark a form field as required
         */
        requiredFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Whether the portal template uses a responsive layout
         */
        responsiveLayout?: pulumi.Input<boolean | undefined>;
        /**
         * Label of the button to signin
         */
        signInLabel?: pulumi.Input<string | undefined>;
        /**
         * Default option text shown in the SMS carrier selector
         */
        smsCarrierDefault?: pulumi.Input<string | undefined>;
        /**
         * Error message shown when no mobile carrier is selected
         */
        smsCarrierError?: pulumi.Input<string | undefined>;
        /**
         * Label for mobile carrier drop-down list
         */
        smsCarrierFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Label for cancel confirmation code submission
         */
        smsCodeCancel?: pulumi.Input<string | undefined>;
        /**
         * Error message when confirmation code is invalid
         */
        smsCodeError?: pulumi.Input<string | undefined>;
        /**
         * Label for the SMS confirmation-code input field
         */
        smsCodeFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Instructional text shown before entering the SMS access code
         */
        smsCodeMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for confirmation code submit button
         */
        smsCodeSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title shown on the SMS access-code entry page
         */
        smsCodeTitle?: pulumi.Input<string | undefined>;
        /**
         * Label for the SMS country-code input field
         */
        smsCountryFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Example country code format shown for SMS authentication
         */
        smsCountryFormat?: pulumi.Input<string | undefined>;
        /**
         * Label for checkbox to specify that the user has access code
         */
        smsHaveAccessCode?: pulumi.Input<string | undefined>;
        /**
         * Whether the SMS portal flow uses Twilio-specific behavior
         */
        smsIsTwilio?: pulumi.Input<boolean | undefined>;
        /**
         * Format of access code sms message. {{code}} and {{duration}} are placeholders and should be retained as is.
         */
        smsMessageFormat?: pulumi.Input<string | undefined>;
        /**
         * Label for canceling mobile details for SMS auth
         */
        smsNumberCancel?: pulumi.Input<string | undefined>;
        /**
         * Error message shown when the mobile number is invalid
         */
        smsNumberError?: pulumi.Input<string | undefined>;
        /**
         * Label for field to provide mobile number
         */
        smsNumberFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Example mobile number format shown for SMS authentication
         */
        smsNumberFormat?: pulumi.Input<string | undefined>;
        /**
         * Instructional text explaining SMS access-code delivery
         */
        smsNumberMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for submit button for code generation
         */
        smsNumberSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title for phone number details
         */
        smsNumberTitle?: pulumi.Input<string | undefined>;
        /**
         * Example username format shown for SMS authentication
         */
        smsUsernameFormat?: pulumi.Input<string | undefined>;
        /**
         * How long confirmation code should be considered valid (in minutes)
         */
        smsValidityDuration?: pulumi.Input<number | undefined>;
        /**
         * Link text for returning to edit the sponsor request form
         */
        sponsorBackLink?: pulumi.Input<string | undefined>;
        /**
         * Button label for canceling sponsor authentication
         */
        sponsorCancel?: pulumi.Input<string | undefined>;
        /**
         * Label for Sponsor Email
         */
        sponsorEmail?: pulumi.Input<string | undefined>;
        /**
         * Error message shown when the sponsor email address is invalid
         */
        sponsorEmailError?: pulumi.Input<string | undefined>;
        /**
         * HTML template to replace/override default sponsor email template
         * Sponsor Email Template supports following template variables:
         *   * `approveUrl`: Renders URL to approve the request; optionally &minutes=N query param can be appended to change the Authorization period of the guest, where N is a valid integer denoting number of minutes a guest remains authorized
         *   * `denyUrl`: Renders URL to reject the request
         *   * `guestEmail`: Renders Email ID of the guest
         *   * `guestName`: Renders Name of the guest
         *   * `field1`: Renders value of the Custom Field 1
         *   * `field2`: Renders value of the Custom Field 2
         *   * `sponsorLinkValidityDuration`: Renders validity time of the request (i.e. Approve/Deny URL)
         *   * `authExpireMinutes`: Renders Wlan-level configured Guest Authorization Expiration time period (in minutes), If not configured then default (1 day in minutes)
         */
        sponsorEmailTemplate?: pulumi.Input<string | undefined>;
        /**
         * Status message prefix shown when a sponsor approves the request
         */
        sponsorInfoApproved?: pulumi.Input<string | undefined>;
        /**
         * Status message prefix shown when a sponsor denies the request
         */
        sponsorInfoDenied?: pulumi.Input<string | undefined>;
        /**
         * Status message prefix shown after a sponsor notification is sent
         */
        sponsorInfoPending?: pulumi.Input<string | undefined>;
        /**
         * Label for Sponsor Name
         */
        sponsorName?: pulumi.Input<string | undefined>;
        /**
         * Error message shown when the sponsor name is missing
         */
        sponsorNameError?: pulumi.Input<string | undefined>;
        /**
         * Additional status text shown while sponsor approval is pending
         */
        sponsorNotePending?: pulumi.Input<string | undefined>;
        /**
         * Submit button label request Wifi Access and notify sponsor about guest request
         */
        sponsorRequestAccess?: pulumi.Input<string | undefined>;
        /**
         * Text to display if sponsor approves request
         */
        sponsorStatusApproved?: pulumi.Input<string | undefined>;
        /**
         * Text to display when sponsor denies request
         */
        sponsorStatusDenied?: pulumi.Input<string | undefined>;
        /**
         * Text to display if request is still pending
         */
        sponsorStatusPending?: pulumi.Input<string | undefined>;
        /**
         * Submit button label to notify sponsor about guest request
         */
        sponsorSubmit?: pulumi.Input<string | undefined>;
        /**
         * Error message shown when no sponsor is selected
         */
        sponsorsError?: pulumi.Input<string | undefined>;
        /**
         * Label for the sponsor selection field
         */
        sponsorsFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Whether the portal requires Terms of Service acceptance
         */
        tos?: pulumi.Input<boolean | undefined>;
        /**
         * Prefix of the label of the link to go to tos
         */
        tosAcceptLabel?: pulumi.Input<string | undefined>;
        /**
         * Error message when tos not accepted
         */
        tosError?: pulumi.Input<string | undefined>;
        /**
         * Label of the link to go to tos
         */
        tosLink?: pulumi.Input<string | undefined>;
        /**
         * Text of the Terms of Service
         */
        tosText?: pulumi.Input<string | undefined>;
    }
    interface WlanPortalTemplatePortalTemplateLocales {
        /**
         * Label for Amazon auth button
         */
        authButtonAmazon?: pulumi.Input<string | undefined>;
        /**
         * Label for Azure auth button
         */
        authButtonAzure?: pulumi.Input<string | undefined>;
        /**
         * Label for Email auth button
         */
        authButtonEmail?: pulumi.Input<string | undefined>;
        /**
         * Label for Facebook auth button
         */
        authButtonFacebook?: pulumi.Input<string | undefined>;
        /**
         * Label for Google auth button
         */
        authButtonGoogle?: pulumi.Input<string | undefined>;
        /**
         * Label for Microsoft auth button
         */
        authButtonMicrosoft?: pulumi.Input<string | undefined>;
        /**
         * Label for passphrase auth button
         */
        authButtonPassphrase?: pulumi.Input<string | undefined>;
        /**
         * Label for SMS auth button
         */
        authButtonSms?: pulumi.Input<string | undefined>;
        /**
         * Label for Sponsor auth button
         */
        authButtonSponsor?: pulumi.Input<string | undefined>;
        /**
         * Localized heading text displayed above portal authentication options
         */
        authLabel?: pulumi.Input<string | undefined>;
        /**
         * Label of the link to go back to /logon
         */
        backLink?: pulumi.Input<string | undefined>;
        /**
         * Error message when company not provided
         */
        companyError?: pulumi.Input<string | undefined>;
        /**
         * Localized label displayed for the company input field
         */
        companyLabel?: pulumi.Input<string | undefined>;
        /**
         * Error message when a user has valid social login but doesn't match specified email domains.
         */
        emailAccessDomainError?: pulumi.Input<string | undefined>;
        /**
         * Label for cancel confirmation code submission using email auth
         */
        emailCancel?: pulumi.Input<string | undefined>;
        /**
         * Localized link text for requesting help when the email access code was not received
         */
        emailCodeCancel?: pulumi.Input<string | undefined>;
        /**
         * Localized error message shown when the alternate email address for access-code delivery is invalid
         */
        emailCodeError?: pulumi.Input<string | undefined>;
        /**
         * Localized label for the email access-code input field
         */
        emailCodeFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized instructional text shown before entering the email access code
         */
        emailCodeMessage?: pulumi.Input<string | undefined>;
        /**
         * Localized button label for submitting the email access code
         */
        emailCodeSubmit?: pulumi.Input<string | undefined>;
        /**
         * Localized title shown on the email access-code entry page
         */
        emailCodeTitle?: pulumi.Input<string | undefined>;
        /**
         * Error message when email not provided
         */
        emailError?: pulumi.Input<string | undefined>;
        /**
         * Localized label for the email address input field
         */
        emailFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized label displayed for the email input field
         */
        emailLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized instructional text explaining email access-code delivery
         */
        emailMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for confirmation code submit button using email auth
         */
        emailSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title for the Email registration
         */
        emailTitle?: pulumi.Input<string | undefined>;
        /**
         * Error message when field1 not provided
         */
        field1error?: pulumi.Input<string | undefined>;
        /**
         * Localized label for custom field 1 input
         */
        field1label?: pulumi.Input<string | undefined>;
        /**
         * Error message when field2 not provided
         */
        field2error?: pulumi.Input<string | undefined>;
        /**
         * Localized label for custom field 2 input
         */
        field2label?: pulumi.Input<string | undefined>;
        /**
         * Error message when field3 not provided
         */
        field3error?: pulumi.Input<string | undefined>;
        /**
         * Localized label for custom field 3 input
         */
        field3label?: pulumi.Input<string | undefined>;
        /**
         * Error message when field4 not provided
         */
        field4error?: pulumi.Input<string | undefined>;
        /**
         * Localized label for custom field 4 input
         */
        field4label?: pulumi.Input<string | undefined>;
        /**
         * label of the link to go to /marketing_policy
         */
        marketingPolicyLink?: pulumi.Input<string | undefined>;
        /**
         * Whether marketing policy optin is enabled
         */
        marketingPolicyOptIn?: pulumi.Input<boolean | undefined>;
        /**
         * label for marketing optin
         */
        marketingPolicyOptInLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized text of the marketing policy opt-in content
         */
        marketingPolicyOptInText?: pulumi.Input<string | undefined>;
        /**
         * Localized main message displayed on the guest portal sign-in page
         */
        message?: pulumi.Input<string | undefined>;
        /**
         * Error message when name not provided
         */
        nameError?: pulumi.Input<string | undefined>;
        /**
         * Localized label displayed for the name input field
         */
        nameLabel?: pulumi.Input<string | undefined>;
        /**
         * Label for Do Not Store My Personal Information
         */
        optoutLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized browser or page title shown for the guest portal
         */
        pageTitle?: pulumi.Input<string | undefined>;
        /**
         * Label for the Passphrase cancel button
         */
        passphraseCancel?: pulumi.Input<string | undefined>;
        /**
         * Error message when invalid passphrase is provided
         */
        passphraseError?: pulumi.Input<string | undefined>;
        /**
         * Localized label for the passphrase input field
         */
        passphraseLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized instructional text shown on the passphrase sign-in page
         */
        passphraseMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for the Passphrase submit button
         */
        passphraseSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title for passphrase details page
         */
        passphraseTitle?: pulumi.Input<string | undefined>;
        /**
         * Prefix of the label of the link to go to Privacy Policy
         */
        privacyPolicyAcceptLabel?: pulumi.Input<string | undefined>;
        /**
         * Error message when Privacy Policy not accepted
         */
        privacyPolicyError?: pulumi.Input<string | undefined>;
        /**
         * Label of the link to go to Privacy Policy
         */
        privacyPolicyLink?: pulumi.Input<string | undefined>;
        /**
         * Text of the Privacy Policy
         */
        privacyPolicyText?: pulumi.Input<string | undefined>;
        /**
         * Localized text used to mark a form field as required
         */
        requiredFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Label of the button to signin
         */
        signInLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized default option text shown in the SMS carrier selector
         */
        smsCarrierDefault?: pulumi.Input<string | undefined>;
        /**
         * Localized error message shown when no mobile carrier is selected
         */
        smsCarrierError?: pulumi.Input<string | undefined>;
        /**
         * Label for mobile carrier drop-down list
         */
        smsCarrierFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Label for cancel confirmation code submission
         */
        smsCodeCancel?: pulumi.Input<string | undefined>;
        /**
         * Error message when confirmation code is invalid
         */
        smsCodeError?: pulumi.Input<string | undefined>;
        /**
         * Localized label for the SMS confirmation-code input field
         */
        smsCodeFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized instructional text shown before entering the SMS access code
         */
        smsCodeMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for confirmation code submit button
         */
        smsCodeSubmit?: pulumi.Input<string | undefined>;
        /**
         * Localized title shown on the SMS access-code entry page
         */
        smsCodeTitle?: pulumi.Input<string | undefined>;
        /**
         * Localized label for the SMS country-code input field
         */
        smsCountryFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized example country code format shown for SMS authentication
         */
        smsCountryFormat?: pulumi.Input<string | undefined>;
        /**
         * Label for checkbox to specify that the user has access code
         */
        smsHaveAccessCode?: pulumi.Input<string | undefined>;
        /**
         * Format of access code sms message. {{code}} and {{duration}} are placeholders and should be retained as is.
         */
        smsMessageFormat?: pulumi.Input<string | undefined>;
        /**
         * Label for canceling mobile details for SMS auth
         */
        smsNumberCancel?: pulumi.Input<string | undefined>;
        /**
         * Localized error message shown when the mobile number is invalid
         */
        smsNumberError?: pulumi.Input<string | undefined>;
        /**
         * Label for field to provide mobile number
         */
        smsNumberFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Localized example mobile number format shown for SMS authentication
         */
        smsNumberFormat?: pulumi.Input<string | undefined>;
        /**
         * Localized instructional text explaining SMS access-code delivery
         */
        smsNumberMessage?: pulumi.Input<string | undefined>;
        /**
         * Label for submit button for code generation
         */
        smsNumberSubmit?: pulumi.Input<string | undefined>;
        /**
         * Title for phone number details
         */
        smsNumberTitle?: pulumi.Input<string | undefined>;
        /**
         * Localized example username format shown for SMS authentication
         */
        smsUsernameFormat?: pulumi.Input<string | undefined>;
        /**
         * Localized link text for returning to edit the sponsor request form
         */
        sponsorBackLink?: pulumi.Input<string | undefined>;
        /**
         * Localized button label for canceling sponsor authentication
         */
        sponsorCancel?: pulumi.Input<string | undefined>;
        /**
         * Label for Sponsor Email
         */
        sponsorEmail?: pulumi.Input<string | undefined>;
        /**
         * Localized error message shown when the sponsor email address is invalid
         */
        sponsorEmailError?: pulumi.Input<string | undefined>;
        /**
         * Localized status message prefix shown when a sponsor approves the request
         */
        sponsorInfoApproved?: pulumi.Input<string | undefined>;
        /**
         * Localized status message prefix shown when a sponsor denies the request
         */
        sponsorInfoDenied?: pulumi.Input<string | undefined>;
        /**
         * Localized status message prefix shown after a sponsor notification is sent
         */
        sponsorInfoPending?: pulumi.Input<string | undefined>;
        /**
         * Label for Sponsor Name
         */
        sponsorName?: pulumi.Input<string | undefined>;
        /**
         * Localized error message shown when the sponsor name is missing
         */
        sponsorNameError?: pulumi.Input<string | undefined>;
        /**
         * Localized additional status text shown while sponsor approval is pending
         */
        sponsorNotePending?: pulumi.Input<string | undefined>;
        /**
         * Submit button label request Wifi Access and notify sponsor about guest request
         */
        sponsorRequestAccess?: pulumi.Input<string | undefined>;
        /**
         * Text to display if sponsor approves request
         */
        sponsorStatusApproved?: pulumi.Input<string | undefined>;
        /**
         * Text to display when sponsor denies request
         */
        sponsorStatusDenied?: pulumi.Input<string | undefined>;
        /**
         * Text to display if request is still pending
         */
        sponsorStatusPending?: pulumi.Input<string | undefined>;
        /**
         * Submit button label to notify sponsor about guest request
         */
        sponsorSubmit?: pulumi.Input<string | undefined>;
        /**
         * Localized error message shown when no sponsor is selected
         */
        sponsorsError?: pulumi.Input<string | undefined>;
        /**
         * Localized label for the sponsor selection field
         */
        sponsorsFieldLabel?: pulumi.Input<string | undefined>;
        /**
         * Prefix of the label of the link to go to tos
         */
        tosAcceptLabel?: pulumi.Input<string | undefined>;
        /**
         * Error message when tos not accepted
         */
        tosError?: pulumi.Input<string | undefined>;
        /**
         * Label of the link to go to tos
         */
        tosLink?: pulumi.Input<string | undefined>;
        /**
         * Text of the Terms of Service
         */
        tosText?: pulumi.Input<string | undefined>;
    }
    interface WlanQos {
        /**
         * QoS traffic class applied when WLAN QoS override is enabled
         */
        class?: pulumi.Input<string | undefined>;
        /**
         * Whether to overwrite QoS
         */
        overwrite?: pulumi.Input<boolean | undefined>;
    }
    interface WlanRadsec {
        /**
         * Whether RADIUS Change of Authorization (CoA) is enabled for RadSec traffic
         */
        coaEnabled?: pulumi.Input<boolean | undefined>;
        /**
         * Whether RadSec is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Idle timeout, in seconds, for RadSec connections
         */
        idleTimeout?: pulumi.Input<string | undefined>;
        /**
         * Mist Edge cluster IDs used as RadSec proxies when the WLAN does not use mxtunnel
         */
        mxclusterIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * RadSec proxy hostnames advertised to APs
         */
        proxyHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * TLS server name to verify against the CA certificates in Org Setting. Only if not Mist Edge.
         */
        serverName?: pulumi.Input<string | undefined>;
        /**
         * External RadSec servers. Only if not Mist Edge.
         */
        servers?: pulumi.Input<pulumi.Input<inputs.site.WlanRadsecServer>[] | undefined>;
        /**
         * Whether to use organization Mist Edge instances as RadSec proxies
         */
        useMxedge?: pulumi.Input<boolean | undefined>;
        /**
         * Whether to use site Mist Edge instances when this WLAN does not use mxtunnel
         */
        useSiteMxedge?: pulumi.Input<boolean | undefined>;
    }
    interface WlanRadsecServer {
        /**
         * Address or hostname of the RadSec server
         */
        host?: pulumi.Input<string | undefined>;
        /**
         * TCP port used by the RadSec server
         */
        port?: pulumi.Input<number | undefined>;
    }
    interface WlanRateset {
        /**
         * If `template`==`custom`. EHT MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit)
         */
        eht?: pulumi.Input<string | undefined>;
        /**
         * If `template`==`custom`. HE MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit
         */
        he?: pulumi.Input<string | undefined>;
        /**
         * If `template`==`custom`. MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit), e.g. 00ff 00f0 001f limits HT rates to MCS 0-7 for 1 stream, MCS 4-7 for 2 stream (i.e. MCS 12-15), MCS 1-5 for 3 stream (i.e. MCS 16-20)
         */
        ht?: pulumi.Input<string | undefined>;
        /**
         * if `template`==`custom`. List of supported rates (IE=1) and extended supported rates (IE=50) for custom template, append ‘b’ at the end to indicate a rate being basic/mandatory. If `template`==`custom` is configured and legacy does not define at least one basic rate, it will use `no-legacy` default values. enum: `1`, `11`, `11b`, `12`, `12b`, `18`, `18b`, `1b`, `2`, `24`, `24b`, `2b`, `36`, `36b`, `48`, `48b`, `5.5`, `5.5b`, `54`, `54b`, `6`, `6b`, `9`, `9b`
         */
        legacies?: pulumi.Input<pulumi.Input<string>[] | undefined>;
        /**
         * Minimum RSSI for client to connect, 0 means not enforcing
         */
        minRssi?: pulumi.Input<number | undefined>;
        /**
         * Data rate template used to derive WLAN rate settings
         */
        template?: pulumi.Input<string | undefined>;
        /**
         * If `template`==`custom`. MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit), e.g. 03ff 01ff 00ff limits VHT rates to MCS 0-9 for 1 stream, MCS 0-8 for 2 streams, and MCS 0-7 for 3 streams.
         */
        vht?: pulumi.Input<string | undefined>;
    }
    interface WlanSchedule {
        /**
         * Whether the WLAN operating schedule is enabled
         */
        enabled?: pulumi.Input<boolean | undefined>;
        /**
         * Time ranges when the WLAN is scheduled to operate
         */
        hours?: pulumi.Input<inputs.site.WlanScheduleHours | undefined>;
    }
    interface WlanScheduleHours {
        /**
         * Operating hour range for Friday
         */
        fri?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Monday
         */
        mon?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Saturday
         */
        sat?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Sunday
         */
        sun?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Thursday
         */
        thu?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Tuesday
         */
        tue?: pulumi.Input<string | undefined>;
        /**
         * Operating hour range for Wednesday
         */
        wed?: pulumi.Input<string | undefined>;
    }
    interface WxtagSpec {
        /**
         * Matched destination port, "0" means any
         */
        portRange?: pulumi.Input<string | undefined>;
        /**
         * tcp / udp / icmp / gre / any / ":protocol_number", `protocolNumber` is between 1-254
         */
        protocol?: pulumi.Input<string | undefined>;
        /**
         * Destination subnets or IP addresses matched by this WxLAN tag spec
         */
        subnets?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    }
}
//# sourceMappingURL=input.d.ts.map