diff --git a/checkpoint/data_source_checkpoint_gaia_show_snmp_trap_receivers.go b/checkpoint/data_source_checkpoint_gaia_show_snmp_trap_receivers.go
index 3182e9f2..bca0b7bd 100644
--- a/checkpoint/data_source_checkpoint_gaia_show_snmp_trap_receivers.go
+++ b/checkpoint/data_source_checkpoint_gaia_show_snmp_trap_receivers.go
@@ -40,6 +40,7 @@ func dataGaiaShowSnmpTrapReceivers() *schema.Resource {
"community_string": {
Type: schema.TypeString,
Computed: true,
+ Sensitive: true,
Description: `N/A`,
},
"member_id": {
diff --git a/checkpoint/data_source_checkpoint_management_access_layer.go b/checkpoint/data_source_checkpoint_management_access_layer.go
index 35354167..346b051a 100644
--- a/checkpoint/data_source_checkpoint_management_access_layer.go
+++ b/checkpoint/data_source_checkpoint_management_access_layer.go
@@ -82,6 +82,16 @@ func dataSourceManagementAccessLayer() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "dynamic_layer": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether this layer is set as a Dynamic layer.",
+ },
+ "parent_layer": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Parent layer of this layer.",
+ },
},
}
}
@@ -190,5 +200,13 @@ func dataSourceManagementAccessLayerRead(d *schema.ResourceData, m interface{})
_ = d.Set("comments", v)
}
+ if v := accessLayer["dynamic-layer"]; v != nil {
+ _ = d.Set("dynamic_layer", v)
+ }
+
+ if v := accessLayer["parent-layer"]; v != nil {
+ _ = d.Set("parent_layer", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_access_role.go b/checkpoint/data_source_checkpoint_management_access_role.go
index 91f976d8..98342b5f 100644
--- a/checkpoint/data_source_checkpoint_management_access_role.go
+++ b/checkpoint/data_source_checkpoint_management_access_role.go
@@ -106,6 +106,11 @@ func dataSourceManagementAccessRole() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "remote_access_client": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Remote access clients identified by name or UID. Level of details in the output corresponds to the number of details for search. This table shows the ...",
+ },
},
}
}
@@ -321,6 +326,10 @@ func dataSourceManagementAccessRoleRead(d *schema.ResourceData, m interface{}) e
_ = d.Set("ignore_errors", v)
}
+ if v := accessRole["remote-access-client"]; v != nil {
+ _ = d.Set("remote_access_client", v.(map[string]interface{})["name"])
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_access_rule.go b/checkpoint/data_source_checkpoint_management_access_rule.go
index 06dc23c0..37d8f559 100644
--- a/checkpoint/data_source_checkpoint_management_access_rule.go
+++ b/checkpoint/data_source_checkpoint_management_access_rule.go
@@ -39,6 +39,103 @@ func dataSourceManagementAccessRule() *schema.Resource {
Description: "Action settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "user_auth_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "N/A",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "allowed_http_servers": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Restricts which HTTP servers authenticated users may access.",
+ },
+ "destination": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "How destination hosts are matched against the user database.",
+ },
+ "source": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "How source users are matched against the user database.",
+ },
+ },
+ },
+ },
+ "client_auth_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "N/A",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "destination": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "How destination hosts are matched against the user database.",
+ },
+ "require_desktop_config_verification": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "When true, the rule only applies if the client's desktop security policy configuration has been verified by the gateway.",
+ },
+ "sessions_limit": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Maximum number of concurrent sessions allowed per user. Only used when unlimited-sessions is false. Must be 1 or greater.",
+ },
+ "sign_on_method": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Mechanism used to authenticate the client.",
+ },
+ "sign_on_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Determines whether a standard or specific sign-on policy is applied. Allowed values: standard, specific.",
+ },
+ "source": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "How source users are matched against the user database.",
+ },
+ "timeout": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Controls how long an authenticated session remains valid.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "enable": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "When true, authenticated sessions expire after the duration defined by minutes. When false, authenticated sessions never expire.",
+ },
+ "minutes": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of minutes before an authenticated session expires. Only used when enable is true. Must be 0 or greater.",
+ },
+ "refreshable": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "When true, the session timeout timer resets each time the authenticated user performs a network action.",
+ },
+ },
+ },
+ },
+ "tracking": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Action to take in the log when a user successfully authenticates. Allowed values: none, log, alert.",
+ },
+ "unlimited_sessions": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "When true, a single user may have any number of concurrent authenticated sessions. When false, the number of concurrent sessions is capped at sessions...",
+ },
+ },
+ },
+ },
"enable_identity_captive_portal": {
Type: schema.TypeBool,
Computed: true,
@@ -286,6 +383,300 @@ func dataSourceManagementAccessRule() *schema.Resource {
Type: schema.TypeString,
},
},
+ "service_resource": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Resource of the service.",
+ },
+ "expiration_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Displays the expiration date settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "expiration_date": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Expiration date.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: `N/A`,
+ },
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: `N/A`,
+ },
+ },
+ },
+ },
+ "expired": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Expired rule.",
+ },
+ "has_expiration_date": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Rule has expiration date.",
+ },
+ },
+ },
+ },
+ "destination_ranges": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Displays the destination as ranges of IP addresses, in case show-as-ranges is set to true.
In this case, 'destination' and 'destination-negate' p...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "excluded_others": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Objects which are not represented as IP addresses and are negated in the given rule - for example if negate is set for the source or destination of th...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ipv4": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Range of IPv4 addresses that match in the given rule.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "end": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "start": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
+ "ipv6": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Range of IPv6 addresses that match in the given rule.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "end": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "start": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
+ "others": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Objects which are not represented as IP addresses and match the given rule. The details-level parameter of the request determines whether they are dis...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ },
+ },
+ "hits": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Hits count object.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "first_date": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "N/A",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ "last_date": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "N/A",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ "level": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "percentage": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
+ "service_ranges": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Displays the services and applications as ranges of port numbers, in case show-as-ranges is set to true.
In this case, 'service' and 'service-neg...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "excluded_others": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Objects which are not represented as port numbers and are negated in the given rule - for example if negate is set for the service of this rule. The d...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "others": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Objects which are not represented as port numbers and match the given rule. The details-level parameter of the request determines whether they are dis...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "tcp": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Range of TCP ports that match in the given rule.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "end": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "start": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
+ "udp": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Range of UDP ports that match in the given rule.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "end": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "start": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "source_ranges": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Displays the source as ranges of IP addresses, in case show-as-ranges is set to true.
In this case, 'source' and 'source-negate' parameters are o...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "excluded_others": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Objects which are not represented as IP addresses and are negated in the given rule - for example if negate is set for the source or destination of th...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ipv4": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Range of IPv4 addresses that match in the given rule.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "end": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "start": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
+ "ipv6": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Range of IPv6 addresses that match in the given rule.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "end": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "start": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
+ "others": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Objects which are not represented as IP addresses and match the given rule. The details-level parameter of the request determines whether they are dis...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ },
+ },
},
}
}
@@ -341,6 +732,63 @@ func dataSourceManagementAccessRuleRead(d *schema.ResourceData, m interface{}) e
actionSettingsMapToReturn := make(map[string]interface{})
+ if v := actionSettingsMap["user-auth-settings"]; v != nil {
+ userAuthSettingsShow := v.(map[string]interface{})
+ userAuthSettingsState := make(map[string]interface{})
+ if v := userAuthSettingsShow["allowed-http-servers"]; v != nil {
+ userAuthSettingsState["allowed_http_servers"] = v
+ }
+ if v := userAuthSettingsShow["destination"]; v != nil {
+ userAuthSettingsState["destination"] = v
+ }
+ if v := userAuthSettingsShow["source"]; v != nil {
+ userAuthSettingsState["source"] = v
+ }
+ actionSettingsMapToReturn["user_auth_settings"] = []interface{}{userAuthSettingsState}
+ }
+ if v := actionSettingsMap["client-auth-settings"]; v != nil {
+ clientAuthSettingsShow := v.(map[string]interface{})
+ clientAuthSettingsState := make(map[string]interface{})
+ if v := clientAuthSettingsShow["destination"]; v != nil {
+ clientAuthSettingsState["destination"] = v
+ }
+ if v := clientAuthSettingsShow["require-desktop-config-verification"]; v != nil {
+ clientAuthSettingsState["require_desktop_config_verification"] = v
+ }
+ if v := clientAuthSettingsShow["sessions-limit"]; v != nil {
+ clientAuthSettingsState["sessions_limit"] = v
+ }
+ if v := clientAuthSettingsShow["sign-on-method"]; v != nil {
+ clientAuthSettingsState["sign_on_method"] = v
+ }
+ if v := clientAuthSettingsShow["sign-on-type"]; v != nil {
+ clientAuthSettingsState["sign_on_type"] = v
+ }
+ if v := clientAuthSettingsShow["source"]; v != nil {
+ clientAuthSettingsState["source"] = v
+ }
+ if v := clientAuthSettingsShow["timeout"]; v != nil {
+ timeoutShow := v.(map[string]interface{})
+ timeoutState := make(map[string]interface{})
+ if v := timeoutShow["enable"]; v != nil {
+ timeoutState["enable"] = v
+ }
+ if v := timeoutShow["minutes"]; v != nil {
+ timeoutState["minutes"] = v
+ }
+ if v := timeoutShow["refreshable"]; v != nil {
+ timeoutState["refreshable"] = v
+ }
+ clientAuthSettingsState["timeout"] = []interface{}{timeoutState}
+ }
+ if v := clientAuthSettingsShow["tracking"]; v != nil {
+ clientAuthSettingsState["tracking"] = v
+ }
+ if v := clientAuthSettingsShow["unlimited-sessions"]; v != nil {
+ clientAuthSettingsState["unlimited_sessions"] = v
+ }
+ actionSettingsMapToReturn["client_auth_settings"] = []interface{}{clientAuthSettingsState}
+ }
if v, _ := actionSettingsMap["enable-identity-captive-portal"]; v != nil {
actionSettingsMapToReturn["enable_identity_captive_portal"] = v.(bool)
}
@@ -545,5 +993,230 @@ func dataSourceManagementAccessRuleRead(d *schema.ResourceData, m interface{}) e
if v := accessRule["comments"]; v != nil {
_ = d.Set("comments", v)
}
+ if v := accessRule["service-resource"]; v != nil {
+ _ = d.Set("service_resource", v.(map[string]interface{})["name"])
+ }
+
+ if v := accessRule["expiration-settings"]; v != nil {
+ expirationSettingsShow := v.(map[string]interface{})
+ expirationSettingsState := make(map[string]interface{})
+ if v, ok := expirationSettingsShow["expiration-date"].(map[string]interface{}); ok {
+ dateState := make(map[string]interface{})
+ if p, ok := v["posix"].(float64); ok {
+ dateState["posix"] = int(p)
+ }
+ if iso := v["iso-8601"]; iso != nil {
+ dateState["iso_8601"] = iso
+ }
+ expirationSettingsState["expiration_date"] = []interface{}{dateState}
+ }
+ if v := expirationSettingsShow["expired"]; v != nil {
+ expirationSettingsState["expired"] = v
+ }
+ if v := expirationSettingsShow["has-expiration-date"]; v != nil {
+ expirationSettingsState["has_expiration_date"] = v
+ }
+ _ = d.Set("expiration_settings", []interface{}{expirationSettingsState})
+ }
+
+ if v := accessRule["destination-ranges"]; v != nil {
+ destinationRangesShow := v.(map[string]interface{})
+ destinationRangesState := make(map[string]interface{})
+ if v := destinationRangesShow["excluded-others"]; v != nil {
+ excludedOthersIdsList := v.([]interface{})
+ var excludedOthersIds = make([]string, 0)
+ for _, item := range excludedOthersIdsList {
+ excludedOthersIds = append(excludedOthersIds, item.(map[string]interface{})["name"].(string))
+ }
+ destinationRangesState["excluded_others"] = excludedOthersIds
+ }
+ if v := destinationRangesShow["ipv4"]; v != nil {
+ ipv4List := v.([]interface{})
+ var ipv4ListState []map[string]interface{}
+ for i := range ipv4List {
+ ipv4Show := ipv4List[i].(map[string]interface{})
+ ipv4State := make(map[string]interface{})
+ if v := ipv4Show["end"]; v != nil {
+ ipv4State["end"] = v
+ }
+ if v := ipv4Show["start"]; v != nil {
+ ipv4State["start"] = v
+ }
+ ipv4ListState = append(ipv4ListState, ipv4State)
+ }
+ destinationRangesState["ipv4"] = ipv4ListState
+ }
+ if v := destinationRangesShow["ipv6"]; v != nil {
+ ipv6List := v.([]interface{})
+ var ipv6ListState []map[string]interface{}
+ for i := range ipv6List {
+ ipv6Show := ipv6List[i].(map[string]interface{})
+ ipv6State := make(map[string]interface{})
+ if v := ipv6Show["end"]; v != nil {
+ ipv6State["end"] = v
+ }
+ if v := ipv6Show["start"]; v != nil {
+ ipv6State["start"] = v
+ }
+ ipv6ListState = append(ipv6ListState, ipv6State)
+ }
+ destinationRangesState["ipv6"] = ipv6ListState
+ }
+ if v := destinationRangesShow["others"]; v != nil {
+ othersIdsList := v.([]interface{})
+ var othersIds = make([]string, 0)
+ for _, item := range othersIdsList {
+ othersIds = append(othersIds, item.(map[string]interface{})["name"].(string))
+ }
+ destinationRangesState["others"] = othersIds
+ }
+ _ = d.Set("destination_ranges", []interface{}{destinationRangesState})
+ }
+
+ if v := accessRule["hits"]; v != nil {
+ hitsShow := v.(map[string]interface{})
+ hitsState := make(map[string]interface{})
+ if v := hitsShow["first-date"]; v != nil {
+ firstDateShow := v.(map[string]interface{})
+ firstDateState := make(map[string]interface{})
+ if v := firstDateShow["iso-8601"]; v != nil {
+ firstDateState["iso_8601"] = v
+ }
+ if v := firstDateShow["posix"]; v != nil {
+ firstDateState["posix"] = v
+ }
+ hitsState["first_date"] = []interface{}{firstDateState}
+ }
+ if v := hitsShow["last-date"]; v != nil {
+ lastDateShow := v.(map[string]interface{})
+ lastDateState := make(map[string]interface{})
+ if v := lastDateShow["iso-8601"]; v != nil {
+ lastDateState["iso_8601"] = v
+ }
+ if v := lastDateShow["posix"]; v != nil {
+ lastDateState["posix"] = v
+ }
+ hitsState["last_date"] = []interface{}{lastDateState}
+ }
+ if v := hitsShow["level"]; v != nil {
+ hitsState["level"] = v
+ }
+ if v := hitsShow["percentage"]; v != nil {
+ hitsState["percentage"] = v
+ }
+ if v := hitsShow["value"]; v != nil {
+ hitsState["value"] = v
+ }
+ _ = d.Set("hits", []interface{}{hitsState})
+ }
+
+ if v := accessRule["service-ranges"]; v != nil {
+ serviceRangesShow := v.(map[string]interface{})
+ serviceRangesState := make(map[string]interface{})
+ if v := serviceRangesShow["excluded-others"]; v != nil {
+ excludedOthersIdsList := v.([]interface{})
+ var excludedOthersIds = make([]string, 0)
+ for _, item := range excludedOthersIdsList {
+ excludedOthersIds = append(excludedOthersIds, item.(map[string]interface{})["name"].(string))
+ }
+ serviceRangesState["excluded_others"] = excludedOthersIds
+ }
+ if v := serviceRangesShow["others"]; v != nil {
+ othersIdsList := v.([]interface{})
+ var othersIds = make([]string, 0)
+ for _, item := range othersIdsList {
+ othersIds = append(othersIds, item.(map[string]interface{})["name"].(string))
+ }
+ serviceRangesState["others"] = othersIds
+ }
+ if v := serviceRangesShow["tcp"]; v != nil {
+ tcpList := v.([]interface{})
+ var tcpListState []map[string]interface{}
+ for i := range tcpList {
+ tcpShow := tcpList[i].(map[string]interface{})
+ tcpState := make(map[string]interface{})
+ if v := tcpShow["end"]; v != nil {
+ tcpState["end"] = v
+ }
+ if v := tcpShow["start"]; v != nil {
+ tcpState["start"] = v
+ }
+ tcpListState = append(tcpListState, tcpState)
+ }
+ serviceRangesState["tcp"] = tcpListState
+ }
+ if v := serviceRangesShow["udp"]; v != nil {
+ udpList := v.([]interface{})
+ var udpListState []map[string]interface{}
+ for i := range udpList {
+ udpShow := udpList[i].(map[string]interface{})
+ udpState := make(map[string]interface{})
+ if v := udpShow["end"]; v != nil {
+ udpState["end"] = v
+ }
+ if v := udpShow["start"]; v != nil {
+ udpState["start"] = v
+ }
+ udpListState = append(udpListState, udpState)
+ }
+ serviceRangesState["udp"] = udpListState
+ }
+ _ = d.Set("service_ranges", []interface{}{serviceRangesState})
+ }
+
+ if v := accessRule["source-ranges"]; v != nil {
+ sourceRangesShow := v.(map[string]interface{})
+ sourceRangesState := make(map[string]interface{})
+ if v := sourceRangesShow["excluded-others"]; v != nil {
+ excludedOthersIdsList := v.([]interface{})
+ var excludedOthersIds = make([]string, 0)
+ for _, item := range excludedOthersIdsList {
+ excludedOthersIds = append(excludedOthersIds, item.(map[string]interface{})["name"].(string))
+ }
+ sourceRangesState["excluded_others"] = excludedOthersIds
+ }
+ if v := sourceRangesShow["ipv4"]; v != nil {
+ ipv4List := v.([]interface{})
+ var ipv4ListState []map[string]interface{}
+ for i := range ipv4List {
+ ipv4Show := ipv4List[i].(map[string]interface{})
+ ipv4State := make(map[string]interface{})
+ if v := ipv4Show["end"]; v != nil {
+ ipv4State["end"] = v
+ }
+ if v := ipv4Show["start"]; v != nil {
+ ipv4State["start"] = v
+ }
+ ipv4ListState = append(ipv4ListState, ipv4State)
+ }
+ sourceRangesState["ipv4"] = ipv4ListState
+ }
+ if v := sourceRangesShow["ipv6"]; v != nil {
+ ipv6List := v.([]interface{})
+ var ipv6ListState []map[string]interface{}
+ for i := range ipv6List {
+ ipv6Show := ipv6List[i].(map[string]interface{})
+ ipv6State := make(map[string]interface{})
+ if v := ipv6Show["end"]; v != nil {
+ ipv6State["end"] = v
+ }
+ if v := ipv6Show["start"]; v != nil {
+ ipv6State["start"] = v
+ }
+ ipv6ListState = append(ipv6ListState, ipv6State)
+ }
+ sourceRangesState["ipv6"] = ipv6ListState
+ }
+ if v := sourceRangesShow["others"]; v != nil {
+ othersIdsList := v.([]interface{})
+ var othersIds = make([]string, 0)
+ for _, item := range othersIdsList {
+ othersIds = append(othersIds, item.(map[string]interface{})["name"].(string))
+ }
+ sourceRangesState["others"] = othersIds
+ }
+ _ = d.Set("source_ranges", []interface{}{sourceRangesState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_access_rulebase.go b/checkpoint/data_source_checkpoint_management_access_rulebase.go
index 384f3f5c..2b66ed06 100644
--- a/checkpoint/data_source_checkpoint_management_access_rulebase.go
+++ b/checkpoint/data_source_checkpoint_management_access_rulebase.go
@@ -630,6 +630,14 @@ func dataSourceManagementAccessRuleBase() *schema.Resource {
},
},
},
+ "objects_dictionary": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Standard level.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -834,6 +842,17 @@ func dataSourceManagementAccessRuleBaseRead(d *schema.ResourceData, m interface{
}
outputRuleBase = append(outputRuleBase, ruleBaseToReturn)
_ = d.Set("rulebase", outputRuleBase)
+ if v := ruleBaseJson["objects-dictionary"]; v != nil {
+ objectsdictionaryIdsList := v.([]interface{})
+ var objectsdictionaryIds = make([]string, 0)
+ if len(objectsdictionaryIdsList) > 0 {
+ for _, item := range objectsdictionaryIdsList {
+ objectsdictionaryIds = append(objectsdictionaryIds, item.(map[string]interface{})["name"].(string))
+ }
+ }
+ _ = d.Set("objects_dictionary", objectsdictionaryIds)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_aci_data_center_server.go b/checkpoint/data_source_checkpoint_management_aci_data_center_server.go
index 23070330..e52bf325 100644
--- a/checkpoint/data_source_checkpoint_management_aci_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_aci_data_center_server.go
@@ -62,6 +62,35 @@ func dataSourceManagementAciDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -152,6 +181,31 @@ func dataSourceAciDataCenterServerRead(d *schema.ResourceData, m interface{}) er
_ = d.Set("ignore_errors", v)
}
+ if v := aciDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := aciDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := aciDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_application_site.go b/checkpoint/data_source_checkpoint_management_application_site.go
index b700b70b..d79b4cdb 100644
--- a/checkpoint/data_source_checkpoint_management_application_site.go
+++ b/checkpoint/data_source_checkpoint_management_application_site.go
@@ -84,6 +84,75 @@ func dataSourceManagementApplicationSite() *schema.Resource {
Type: schema.TypeString,
},
},
+ "application_id": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "N/A",
+ },
+ "primary_category_id": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Primary category id.",
+ },
+ "risk": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "user_defined": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "True if this application site was defined by user (not predefined one).",
+ },
+ "match_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Match settings for application services.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Match mode for the application services.",
+ },
+ "negate": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "All ports except those listed in override-services.",
+ },
+ "override_services": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Services used when matching is customized.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "recommended_services": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Recommended services for this application. Use when mode is set to 'recommended'.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "port": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Service port.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "additional_categories_ids": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional categories Id's.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -212,5 +281,58 @@ func dataSourceManagementApplicationSiteRead(d *schema.ResourceData, m interface
_ = d.Set("groups", nil)
}
+ if v := applicationSite["application-id"]; v != nil {
+ _ = d.Set("application_id", v)
+ }
+
+ if v := applicationSite["primary-category-id"]; v != nil {
+ _ = d.Set("primary_category_id", v)
+ }
+
+ if v := applicationSite["risk"]; v != nil {
+ _ = d.Set("risk", v)
+ }
+
+ if v := applicationSite["user-defined"]; v != nil {
+ _ = d.Set("user_defined", v)
+ }
+
+ if v := applicationSite["match-settings"]; v != nil {
+ matchSettingsShow := v.(map[string]interface{})
+ matchSettingsState := make(map[string]interface{})
+ if v := matchSettingsShow["mode"]; v != nil {
+ matchSettingsState["mode"] = v
+ }
+ if v := matchSettingsShow["negate"]; v != nil {
+ matchSettingsState["negate"] = v
+ }
+ if v := matchSettingsShow["override-services"]; v != nil {
+ overrideServicesIdsList := v.([]interface{})
+ var overrideServicesIds = make([]string, 0)
+ for _, item := range overrideServicesIdsList {
+ overrideServicesIds = append(overrideServicesIds, item.(map[string]interface{})["name"].(string))
+ }
+ matchSettingsState["override_services"] = overrideServicesIds
+ }
+ if v := matchSettingsShow["recommended-services"]; v != nil {
+ recommendedServicesList := v.([]interface{})
+ var recommendedServicesListState []map[string]interface{}
+ for i := range recommendedServicesList {
+ recommendedServicesShow := recommendedServicesList[i].(map[string]interface{})
+ recommendedServicesState := make(map[string]interface{})
+ if v := recommendedServicesShow["port"]; v != nil {
+ recommendedServicesState["port"] = v
+ }
+ recommendedServicesListState = append(recommendedServicesListState, recommendedServicesState)
+ }
+ matchSettingsState["recommended_services"] = recommendedServicesListState
+ }
+ _ = d.Set("match_settings", []interface{}{matchSettingsState})
+ }
+
+ if v := applicationSite["additional-categories-ids"]; v != nil {
+ _ = d.Set("additional_categories_ids", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_application_site_category.go b/checkpoint/data_source_checkpoint_management_application_site_category.go
index 6b0c197f..c7ffe499 100644
--- a/checkpoint/data_source_checkpoint_management_application_site_category.go
+++ b/checkpoint/data_source_checkpoint_management_application_site_category.go
@@ -52,6 +52,16 @@ func dataSourceManagementApplicationSiteCategory() *schema.Resource {
Type: schema.TypeString,
},
},
+ "category_id": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Web category ID.",
+ },
+ "user_defined": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "True if application site category was defined by user (not predefined one).",
+ },
},
}
}
@@ -136,5 +146,13 @@ func dataSourceManagementApplicationSiteCategoryRead(d *schema.ResourceData, m i
_ = d.Set("groups", nil)
}
+ if v := applicationSiteCategory["category-id"]; v != nil {
+ _ = d.Set("category_id", v)
+ }
+
+ if v := applicationSiteCategory["user-defined"]; v != nil {
+ _ = d.Set("user_defined", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_aws_data_center_server.go b/checkpoint/data_source_checkpoint_management_aws_data_center_server.go
index 5e340279..e7e47ce6 100644
--- a/checkpoint/data_source_checkpoint_management_aws_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_aws_data_center_server.go
@@ -69,6 +69,35 @@ func dataSourceManagementAwsDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -156,6 +185,31 @@ func dataSourceAwsDataCenterServerRead(d *schema.ResourceData, m interface{}) er
_ = d.Set("ignore_errors", v)
}
+ if v := awsDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := awsDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := awsDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_azure_data_center_server.go b/checkpoint/data_source_checkpoint_management_azure_data_center_server.go
index 69f6fc4a..8cd9f780 100644
--- a/checkpoint/data_source_checkpoint_management_azure_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_azure_data_center_server.go
@@ -64,6 +64,35 @@ func dataSourceManagementAzureDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -151,6 +180,31 @@ func dataSourceAzureDataCenterServerRead(d *schema.ResourceData, m interface{})
_ = d.Set("ignore_errors", v)
}
+ if v := azureDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := azureDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := azureDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_best_practice.go b/checkpoint/data_source_checkpoint_management_best_practice.go
index f0904cbe..16e50e53 100644
--- a/checkpoint/data_source_checkpoint_management_best_practice.go
+++ b/checkpoint/data_source_checkpoint_management_best_practice.go
@@ -674,6 +674,40 @@ func dataSourceManagementBestPractice() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "deactivation_comment": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The deactivation comment of deactivated best practices. Appears only when the value of the 'active' parameter is set to 'false'.",
+ },
+ "deactivation_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The deactivation mode of deactivated best practices. Appears only when the value of the 'active' parameter is set to 'false'.",
+ },
+ "depends_on": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Shows the dependency of this Best Practice.Level of details in the output corresponds to the number of details for search. This table shows the level ...",
+ },
+ "deactivation_expiration_date": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "The deactivation expiration date of deactivated best practices. Appears only when the value of the 'active' parameter is set to 'false', and the value...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
},
}
}
@@ -1513,6 +1547,30 @@ func dataSourceManagementBestPracticeRead(d *schema.ResourceData, m interface{})
_ = d.Set("show_regulations", v)
}
+ if v := bestPractice["deactivation-comment"]; v != nil {
+ _ = d.Set("deactivation_comment", v)
+ }
+
+ if v := bestPractice["deactivation-mode"]; v != nil {
+ _ = d.Set("deactivation_mode", v)
+ }
+
+ if v := bestPractice["depends-on"]; v != nil {
+ _ = d.Set("depends_on", v.(map[string]interface{})["name"])
+ }
+
+ if v := bestPractice["deactivation-expiration-date"]; v != nil {
+ deactivationExpirationDateShow := v.(map[string]interface{})
+ deactivationExpirationDateState := make(map[string]interface{})
+ if v := deactivationExpirationDateShow["iso-8601"]; v != nil {
+ deactivationExpirationDateState["iso_8601"] = v
+ }
+ if v := deactivationExpirationDateShow["posix"]; v != nil {
+ deactivationExpirationDateState["posix"] = v
+ }
+ _ = d.Set("deactivation_expiration_date", []interface{}{deactivationExpirationDateState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_checkpoint_host.go b/checkpoint/data_source_checkpoint_management_checkpoint_host.go
index ddb749a7..11e696fb 100644
--- a/checkpoint/data_source_checkpoint_management_checkpoint_host.go
+++ b/checkpoint/data_source_checkpoint_management_checkpoint_host.go
@@ -116,6 +116,21 @@ func dataSourceManagementCheckpointHost() *schema.Resource {
Computed: true,
Description: "NAT translation method.",
},
+ "automatic_nat_rules": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Whether to add automatic address translation rules.
checkpoint-gateway: generate automatic address translation rules using the install-on values.
Note: original-ip-only and translated-ip-only Supported only by Security Gateways R82 and higher.",
+ },
+ "enable_address_translation": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to enable address translation.",
+ },
},
},
},
@@ -339,6 +354,36 @@ func dataSourceManagementCheckpointHost() *schema.Resource {
Computed: true,
Description: "Update account log in every amount of seconds.",
},
+ "alert_when_free_disk_space_below_metrics": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Alert when free disk space below metrics.",
+ },
+ "delete_when_free_disk_space_below_metrics": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Delete when free disk space below metrics.",
+ },
+ "distribute_logs_between_all_active_servers": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Distribute logs between all active servers.",
+ },
+ "include_tcp_state_information": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Include TCP state information. Relevant only when Firewall blade is enabled.",
+ },
+ "smart_event_intro_correlation_unit": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "SmartEvent intro correlation unit enabled.",
+ },
+ "stop_logging_when_free_disk_space_below_metrics": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Stop logging when free disk space below metrics.",
+ },
},
},
},
@@ -389,6 +434,16 @@ func dataSourceManagementCheckpointHost() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "dns_server": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "DNS Server.",
+ },
+ "firewall": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Firewall blade enabled.",
+ },
},
}
}
@@ -515,6 +570,15 @@ func dataSourceManagementCheckpointHostRead(d *schema.ResourceData, m interface{
natSettingsMapToReturn["method"] = v
}
+ if v := natSettingsMap["automatic-nat-rules"]; v != nil {
+ natSettingsMapToReturn["automatic_nat_rules"] = v
+ }
+ if v := natSettingsMap["communication-with-this-server"]; v != nil {
+ natSettingsMapToReturn["communication_with_this_server"] = v
+ }
+ if v := natSettingsMap["enable-address-translation"]; v != nil {
+ natSettingsMapToReturn["enable_address_translation"] = v
+ }
_ = d.Set("nat_settings", []interface{}{natSettingsMapToReturn})
} else {
@@ -682,6 +746,24 @@ func dataSourceManagementCheckpointHostRead(d *schema.ResourceData, m interface{
logsSettingsMapToReturn["update_account_log_every"] = v
}
+ if v := logsSettingsMap["alert-when-free-disk-space-below-metrics"]; v != nil {
+ logsSettingsMapToReturn["alert_when_free_disk_space_below_metrics"] = v
+ }
+ if v := logsSettingsMap["delete-when-free-disk-space-below-metrics"]; v != nil {
+ logsSettingsMapToReturn["delete_when_free_disk_space_below_metrics"] = v
+ }
+ if v := logsSettingsMap["distribute-logs-between-all-active-servers"]; v != nil {
+ logsSettingsMapToReturn["distribute_logs_between_all_active_servers"] = v
+ }
+ if v := logsSettingsMap["include-tcp-state-information"]; v != nil {
+ logsSettingsMapToReturn["include_tcp_state_information"] = v
+ }
+ if v := logsSettingsMap["smart-event-intro-correlation-unit"]; v != nil {
+ logsSettingsMapToReturn["smart_event_intro_correlation_unit"] = v
+ }
+ if v := logsSettingsMap["stop-logging-when-free-disk-space-below-metrics"]; v != nil {
+ logsSettingsMapToReturn["stop_logging_when_free_disk_space_below_metrics"] = v
+ }
_ = d.Set("logs_settings", []interface{}{logsSettingsMapToReturn})
} else {
@@ -764,5 +846,13 @@ func dataSourceManagementCheckpointHostRead(d *schema.ResourceData, m interface{
_ = d.Set("comments", v)
}
+ if v := checkpointHost["dns-server"]; v != nil {
+ _ = d.Set("dns_server", v)
+ }
+
+ if v := checkpointHost["firewall"]; v != nil {
+ _ = d.Set("firewall", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_checkpoint_sase_data_center_server.go b/checkpoint/data_source_checkpoint_management_checkpoint_sase_data_center_server.go
index 36dc8db0..2c644c99 100644
--- a/checkpoint/data_source_checkpoint_management_checkpoint_sase_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_checkpoint_sase_data_center_server.go
@@ -53,6 +53,35 @@ func dataSourceManagementCheckpointSaseDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -129,6 +158,31 @@ func dataSourceCheckpointSaseDataCenterServerRead(d *schema.ResourceData, m inte
_ = d.Set("comments", v)
}
+ if v := checkpointSaseDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := checkpointSaseDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := checkpointSaseDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_claroty_ctd_data_center_server.go b/checkpoint/data_source_checkpoint_management_claroty_ctd_data_center_server.go
index fa38c193..41bfb380 100644
--- a/checkpoint/data_source_checkpoint_management_claroty_ctd_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_claroty_ctd_data_center_server.go
@@ -59,6 +59,35 @@ func dataSourceManagementClarotyCtdDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -138,6 +167,31 @@ func dataSourceClarotyCtdDataCenterServerRead(d *schema.ResourceData, m interfac
_ = d.Set("comments", v)
}
+ if v := clarotyCtdDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := clarotyCtdDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := clarotyCtdDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_cloud_services.go b/checkpoint/data_source_checkpoint_management_cloud_services.go
index 49052e38..a4083612 100644
--- a/checkpoint/data_source_checkpoint_management_cloud_services.go
+++ b/checkpoint/data_source_checkpoint_management_cloud_services.go
@@ -70,9 +70,19 @@ func dataSourceManagementCloudServices() *schema.Resource {
Type: schema.TypeString,
},
},
+ "enabled": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable/Disable automatic connection of Security Gateways to Infinity Portal.",
+ },
},
},
},
+ "environment_id": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The connected environment's ID in the Infinity Portal.",
+ },
},
}
}
@@ -148,6 +158,9 @@ func dataSourceManagementCloudServicesRead(d *schema.ResourceData, m interface{}
}
gatewaysOnboardingSettings["specific_gateways"] = specificGatewaysRes
}
+ if v := gatewaysOnboardingSettingsMap["enabled"]; v != nil {
+ gatewaysOnboardingSettings["enabled"] = v
+ }
_ = d.Set("gateways_onboarding_settings", []interface{}{gatewaysOnboardingSettings})
} else {
_ = d.Set("gateways_onboarding_settings", nil)
@@ -155,5 +168,9 @@ func dataSourceManagementCloudServicesRead(d *schema.ResourceData, m interface{}
d.SetId("show-cloud-services-" + acctest.RandString(5))
+ if v := showCloudServicesRes["environment-id"]; v != nil {
+ _ = d.Set("environment_id", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_cluster_member.go b/checkpoint/data_source_checkpoint_management_cluster_member.go
index f194afd1..141c3661 100644
--- a/checkpoint/data_source_checkpoint_management_cluster_member.go
+++ b/checkpoint/data_source_checkpoint_management_cluster_member.go
@@ -150,6 +150,69 @@ func dataSourceManagementClusterMember() *schema.Resource {
},
},
},
+ "auto_generate_ip": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Use an automatically generated IP address for the Gateway object (applies only to Smart-1 Cloud).",
+ },
+ "trust_method": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Trust method that was used for establishing communication.",
+ },
+ "trust_details": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Details for trusted communication.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "authentication_token": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Authentication token to use on the Gateway side to establish the communication between the Gateway and the Management Server (applies only to Smart-1 ...",
+ },
+ "cloud_communication_details": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Details about the communication status with cloud (applies only to Smart-1 Cloud).",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "ip": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "IP address used for communication between the Gateway and the Management Server (used when 'auto-generate-ip=true').",
+ },
+ "status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Status of communication between the Gateway and the Management Server.",
+ },
+ },
+ },
+ },
+ "gateway_mac_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Use the Security Gateway MAC address, relevant for the gateway_mac_address identification-method.",
+ },
+ "identification_method": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "How to identify the gateway (relevant for DAIP gateways only).",
+ },
+ "status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Status of the trusted communication with the Security Gateway.",
+ },
+ "token_expiration_date": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Details about the communication status with cloud (applies only to Smart-1 Cloud).",
+ },
+ },
+ },
+ },
},
}
}
@@ -295,6 +358,46 @@ func dataSourceManagementClusterMemberRead(d *schema.ResourceData, m interface{}
_ = d.Set("nat_settings", nil)
}
+ if v := clusterMember["auto-generate-ip"]; v != nil {
+ _ = d.Set("auto_generate_ip", v)
+ }
+
+ if v := clusterMember["trust-method"]; v != nil {
+ _ = d.Set("trust_method", v)
+ }
+
+ if v := clusterMember["trust-details"]; v != nil {
+ trustDetailsShow := v.(map[string]interface{})
+ trustDetailsState := make(map[string]interface{})
+ if v := trustDetailsShow["authentication-token"]; v != nil {
+ trustDetailsState["authentication_token"] = v
+ }
+ if v := trustDetailsShow["cloud-communication-details"]; v != nil {
+ cloudCommunicationDetailsShow := v.(map[string]interface{})
+ cloudCommunicationDetailsState := make(map[string]interface{})
+ if v := cloudCommunicationDetailsShow["ip"]; v != nil {
+ cloudCommunicationDetailsState["ip"] = v
+ }
+ if v := cloudCommunicationDetailsShow["status"]; v != nil {
+ cloudCommunicationDetailsState["status"] = v
+ }
+ trustDetailsState["cloud_communication_details"] = []interface{}{cloudCommunicationDetailsState}
+ }
+ if v := trustDetailsShow["gateway-mac-address"]; v != nil {
+ trustDetailsState["gateway_mac_address"] = v
+ }
+ if v := trustDetailsShow["identification-method"]; v != nil {
+ trustDetailsState["identification_method"] = v
+ }
+ if v := trustDetailsShow["status"]; v != nil {
+ trustDetailsState["status"] = v
+ }
+ if v := trustDetailsShow["token-expiration-date"]; v != nil {
+ trustDetailsState["token_expiration_date"] = v
+ }
+ _ = d.Set("trust_details", []interface{}{trustDetailsState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_cme_accounts_aws.go b/checkpoint/data_source_checkpoint_management_cme_accounts_aws.go
index 58bc677e..d549a36f 100644
--- a/checkpoint/data_source_checkpoint_management_cme_accounts_aws.go
+++ b/checkpoint/data_source_checkpoint_management_cme_accounts_aws.go
@@ -56,6 +56,7 @@ func dataSourceManagementCMEAccountsAWS() *schema.Resource {
"secret_key": {
Type: schema.TypeString,
Computed: true,
+ Sensitive: true,
Description: "AWS secret key.",
},
"sts_role": {
@@ -125,6 +126,7 @@ func dataSourceManagementCMEAccountsAWS() *schema.Resource {
"secret_key": {
Type: schema.TypeString,
Computed: true,
+ Sensitive: true,
Description: "AWS secret key.",
},
"sts_role": {
diff --git a/checkpoint/data_source_checkpoint_management_cme_accounts_azure.go b/checkpoint/data_source_checkpoint_management_cme_accounts_azure.go
index d96836a0..0017c25c 100644
--- a/checkpoint/data_source_checkpoint_management_cme_accounts_azure.go
+++ b/checkpoint/data_source_checkpoint_management_cme_accounts_azure.go
@@ -35,6 +35,7 @@ func dataSourceManagementCMEAccountsAzure() *schema.Resource {
"client_secret": {
Type: schema.TypeString,
Computed: true,
+ Sensitive: true,
Description: "The service principal's client secret.",
},
"deletion_tolerance": {
diff --git a/checkpoint/data_source_checkpoint_management_cme_accounts_gcp.go b/checkpoint/data_source_checkpoint_management_cme_accounts_gcp.go
index 12261c4e..0be20e64 100644
--- a/checkpoint/data_source_checkpoint_management_cme_accounts_gcp.go
+++ b/checkpoint/data_source_checkpoint_management_cme_accounts_gcp.go
@@ -30,6 +30,7 @@ func dataSourceManagementCMEAccountsGCP() *schema.Resource {
"credentials_data": {
Type: schema.TypeString,
Computed: true,
+ Sensitive: true,
Description: "Base64 encoded string that represents the content of the credentials file.",
},
"deletion_tolerance": {
diff --git a/checkpoint/data_source_checkpoint_management_cme_gw_configurations.go b/checkpoint/data_source_checkpoint_management_cme_gw_configurations.go
index a71b5433..336f6376 100755
--- a/checkpoint/data_source_checkpoint_management_cme_gw_configurations.go
+++ b/checkpoint/data_source_checkpoint_management_cme_gw_configurations.go
@@ -31,6 +31,7 @@ func dataSourceManagementCMEGWConfigurations() *schema.Resource {
"sic_key": {
Type: schema.TypeString,
Computed: true,
+ Sensitive: true,
Description: "The configuration sic key.",
},
"policy": {
diff --git a/checkpoint/data_source_checkpoint_management_cme_gw_configurations_aws.go b/checkpoint/data_source_checkpoint_management_cme_gw_configurations_aws.go
index 1a46a0ae..6f6b254b 100644
--- a/checkpoint/data_source_checkpoint_management_cme_gw_configurations_aws.go
+++ b/checkpoint/data_source_checkpoint_management_cme_gw_configurations_aws.go
@@ -26,6 +26,7 @@ func dataSourceManagementCMEGWConfigurationsAWS() *schema.Resource {
"sic_key": {
Type: schema.TypeString,
Computed: true,
+ Sensitive: true,
Description: "The configuration sic key.",
},
"policy": {
diff --git a/checkpoint/data_source_checkpoint_management_cme_gw_configurations_azure.go b/checkpoint/data_source_checkpoint_management_cme_gw_configurations_azure.go
index 8c211c2c..44eb1866 100644
--- a/checkpoint/data_source_checkpoint_management_cme_gw_configurations_azure.go
+++ b/checkpoint/data_source_checkpoint_management_cme_gw_configurations_azure.go
@@ -25,6 +25,7 @@ func dataSourceManagementCMEGWConfigurationsAzure() *schema.Resource {
"sic_key": {
Type: schema.TypeString,
Computed: true,
+ Sensitive: true,
Description: "The configuration sic key.",
},
"policy": {
diff --git a/checkpoint/data_source_checkpoint_management_cme_gw_configurations_gcp.go b/checkpoint/data_source_checkpoint_management_cme_gw_configurations_gcp.go
index 88c91bb2..cfcc3d62 100644
--- a/checkpoint/data_source_checkpoint_management_cme_gw_configurations_gcp.go
+++ b/checkpoint/data_source_checkpoint_management_cme_gw_configurations_gcp.go
@@ -25,6 +25,7 @@ func dataSourceManagementCMEGWConfigurationsGCP() *schema.Resource {
"sic_key": {
Type: schema.TypeString,
Computed: true,
+ Sensitive: true,
Description: "The configuration sic key.",
},
"policy": {
diff --git a/checkpoint/data_source_checkpoint_management_data_center_content.go b/checkpoint/data_source_checkpoint_management_data_center_content.go
index 651fb279..e56b1653 100644
--- a/checkpoint/data_source_checkpoint_management_data_center_content.go
+++ b/checkpoint/data_source_checkpoint_management_data_center_content.go
@@ -173,6 +173,25 @@ func dataSourceManagementDataCenterContent() *schema.Resource {
Computed: true,
Description: "Total number of elements returned by the query.",
},
+ "last_successful_scan": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Last successful scan time.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
},
}
}
@@ -330,5 +349,17 @@ func dataSourceManagementDataCenterContentRead(d *schema.ResourceData, m interfa
if v := DataCenterContent["total"]; v != nil {
_ = d.Set("total", int(math.Round(v.(float64))))
}
+ if v := DataCenterContent["last-successful-scan"]; v != nil {
+ lastSuccessfulScanShow := v.(map[string]interface{})
+ lastSuccessfulScanState := make(map[string]interface{})
+ if v := lastSuccessfulScanShow["iso-8601"]; v != nil {
+ lastSuccessfulScanState["iso_8601"] = v
+ }
+ if v := lastSuccessfulScanShow["posix"]; v != nil {
+ lastSuccessfulScanState["posix"] = v
+ }
+ _ = d.Set("last_successful_scan", []interface{}{lastSuccessfulScanState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_data_center_query.go b/checkpoint/data_source_checkpoint_management_data_center_query.go
index 7f0f3199..61209b2f 100644
--- a/checkpoint/data_source_checkpoint_management_data_center_query.go
+++ b/checkpoint/data_source_checkpoint_management_data_center_query.go
@@ -74,6 +74,11 @@ func dataSourceManagementDataCenterQuery() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "using_all_data_center": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Using all Data Centers.",
+ },
},
}
}
@@ -209,6 +214,10 @@ func dataSourceDataCenterQueryRead(d *schema.ResourceData, m interface{}) error
_ = d.Set("ignore_errors", v)
}
+ if v := dataCenterQuery["using-all-data-center"]; v != nil {
+ _ = d.Set("using_all_data_center", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_data_type_file_type_attributes.go b/checkpoint/data_source_checkpoint_management_data_type_file_type_attributes.go
index 2b02e86c..4b5aef78 100644
--- a/checkpoint/data_source_checkpoint_management_data_type_file_type_attributes.go
+++ b/checkpoint/data_source_checkpoint_management_data_type_file_type_attributes.go
@@ -79,6 +79,14 @@ func dataSourceManagementDataTypeFileAttributes() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "related_file_types": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of Content Awareness file types.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -186,6 +194,10 @@ func dataSourceManagementDataTypeFileAttributesRead(d *schema.ResourceData, m in
_ = d.Set("comments", v)
}
+ if v := dataTypeFileAttributes["related-file-types"]; v != nil {
+ _ = d.Set("related_file_types", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_data_type_patterns.go b/checkpoint/data_source_checkpoint_management_data_type_patterns.go
index 8bd7bedf..8cdaff88 100644
--- a/checkpoint/data_source_checkpoint_management_data_type_patterns.go
+++ b/checkpoint/data_source_checkpoint_management_data_type_patterns.go
@@ -58,6 +58,11 @@ func dataSourceManagementDataTypePatterns() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "use_statistical_analysis": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use statistical analysis to enhance accuracy. Relevant only for built-in data types.",
+ },
},
}
}
@@ -140,6 +145,10 @@ func dataSourceManagementDataTypePatternsRead(d *schema.ResourceData, m interfac
_ = d.Set("comments", v)
}
+ if v := dataTypePatterns["use-statistical-analysis"]; v != nil {
+ _ = d.Set("use_statistical_analysis", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_domain.go b/checkpoint/data_source_checkpoint_management_domain.go
index 456c3f7d..fa3284d0 100644
--- a/checkpoint/data_source_checkpoint_management_domain.go
+++ b/checkpoint/data_source_checkpoint_management_domain.go
@@ -76,6 +76,64 @@ func dataSourceManagementDomain() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "domain_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "global_domain_assignments": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "N/A",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "assignment_status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "assignment_up_to_date": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "The time when the assignment was assigned.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ "global_access_policy": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Global domain access policy that is assigned to a dependent domain.",
+ },
+ "global_domain": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Global domain. Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Standard l...",
+ },
+ "global_threat_prevention_policy": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Global domain threat prevention policy that is assigned to a dependent domain.",
+ },
+ "manage_protection_actions": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -172,5 +230,46 @@ func dataSourceManagementDomainRead(d *schema.ResourceData, m interface{}) error
_ = d.Set("comments", v)
}
+ if v := domain["domain-type"]; v != nil {
+ _ = d.Set("domain_type", v)
+ }
+
+ if v := domain["global-domain-assignments"]; v != nil {
+ globalDomainAssignmentsList := v.([]interface{})
+ var globalDomainAssignmentsListState []map[string]interface{}
+ for i := range globalDomainAssignmentsList {
+ globalDomainAssignmentsShow := globalDomainAssignmentsList[i].(map[string]interface{})
+ globalDomainAssignmentsState := make(map[string]interface{})
+ if v := globalDomainAssignmentsShow["assignment-status"]; v != nil {
+ globalDomainAssignmentsState["assignment_status"] = v
+ }
+ if v := globalDomainAssignmentsShow["assignment-up-to-date"]; v != nil {
+ assignmentUpToDateShow := v.(map[string]interface{})
+ assignmentUpToDateState := make(map[string]interface{})
+ if v := assignmentUpToDateShow["iso-8601"]; v != nil {
+ assignmentUpToDateState["iso_8601"] = v
+ }
+ if v := assignmentUpToDateShow["posix"]; v != nil {
+ assignmentUpToDateState["posix"] = v
+ }
+ globalDomainAssignmentsState["assignment_up_to_date"] = []interface{}{assignmentUpToDateState}
+ }
+ if v := globalDomainAssignmentsShow["global-access-policy"]; v != nil {
+ globalDomainAssignmentsState["global_access_policy"] = v
+ }
+ if v := globalDomainAssignmentsShow["global-domain"]; v != nil {
+ globalDomainAssignmentsState["global_domain"] = v.(map[string]interface{})["name"]
+ }
+ if v := globalDomainAssignmentsShow["global-threat-prevention-policy"]; v != nil {
+ globalDomainAssignmentsState["global_threat_prevention_policy"] = v
+ }
+ if v := globalDomainAssignmentsShow["manage-protection-actions"]; v != nil {
+ globalDomainAssignmentsState["manage_protection_actions"] = v
+ }
+ globalDomainAssignmentsListState = append(globalDomainAssignmentsListState, globalDomainAssignmentsState)
+ }
+ _ = d.Set("global_domain_assignments", globalDomainAssignmentsListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_domain_permissions_profile.go b/checkpoint/data_source_checkpoint_management_domain_permissions_profile.go
index e0717568..bddab694 100644
--- a/checkpoint/data_source_checkpoint_management_domain_permissions_profile.go
+++ b/checkpoint/data_source_checkpoint_management_domain_permissions_profile.go
@@ -267,6 +267,22 @@ func dataSourceManagementDomainPermissionsProfile() *schema.Resource {
Description: "Management permissions.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "allowed_mgmt_api_commands": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of allowed Management API commands the profile can run. All available commands can be viewed using show-commands Management API.
...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
"cme_operations": {
Type: schema.TypeString,
Computed: true,
@@ -307,6 +323,11 @@ func dataSourceManagementDomainPermissionsProfile() *schema.Resource {
Computed: true,
Description: "Manage integration with Cloud Services.",
},
+ "limit_mgmt_api_commands": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable limitation of Management API commands the profile may or may not run.
Not supported for Multi-Domain Servers.",
+ },
},
},
},
@@ -736,6 +757,15 @@ func dataSourceManagementDomainPermissionsProfileRead(d *schema.ResourceData, m
managementMapToReturn["manage_integration_with_cloud_services"] = v
}
+ if v := managementMap["limit-mgmt-api-commands"]; v != nil {
+ managementMapToReturn["limit_mgmt_api_commands"] = v
+ }
+ if v := managementMap["allowed-mgmt-api-commands"]; v != nil {
+ managementMapToReturn["allowed_mgmt_api_commands"] = v
+ }
+ if v := managementMap["blocked-mgmt-api-commands"]; v != nil {
+ managementMapToReturn["blocked_mgmt_api_commands"] = v
+ }
_ = d.Set("management", []interface{}{managementMapToReturn})
} else {
diff --git a/checkpoint/data_source_checkpoint_management_external_trusted_ca.go b/checkpoint/data_source_checkpoint_management_external_trusted_ca.go
index bce87693..ce7202f1 100644
--- a/checkpoint/data_source_checkpoint_management_external_trusted_ca.go
+++ b/checkpoint/data_source_checkpoint_management_external_trusted_ca.go
@@ -74,6 +74,16 @@ func dataSourceManagementExternalTrustedCa() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "cache_crl": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Cache Certificate Revocation List on the Security Gateway.",
+ },
+ "retrieve_crl_from_ldap_servers": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to retrieve Certificate Revocation List from ldap servers.",
+ },
},
}
}
@@ -202,6 +212,14 @@ func dataSourceManagementExternalTrustedCaRead(d *schema.ResourceData, m interfa
_ = d.Set("ignore_errors", v)
}
+ if v := externalTrustedCa["cache-crl"]; v != nil {
+ _ = d.Set("cache_crl", v)
+ }
+
+ if v := externalTrustedCa["retrieve-crl-from-ldap-servers"]; v != nil {
+ _ = d.Set("retrieve_crl_from_ldap_servers", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_gateway_capabilities.go b/checkpoint/data_source_checkpoint_management_gateway_capabilities.go
index 07ee5b4b..5b32b715 100644
--- a/checkpoint/data_source_checkpoint_management_gateway_capabilities.go
+++ b/checkpoint/data_source_checkpoint_management_gateway_capabilities.go
@@ -50,6 +50,11 @@ func dataSourceManagementSetGatewayCapabilities() *schema.Resource {
Computed: true,
Description: "Gateway platform version.",
},
+ "hardware_subtype": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Gateway type (relevant only for Spark gateways).",
+ },
},
},
},
@@ -255,6 +260,28 @@ func dataSourceManagementSetGatewayCapabilities() *schema.Resource {
},
},
},
+ "supported_hardware_subtypes": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Supported hardware-subtypes according to restrictions.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "default": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Default hardware subtype.",
+ },
+ "hardware_subtypes": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of Check Point hardware subtypes.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ },
+ },
},
}
}
@@ -304,6 +331,9 @@ func dataSourceManagementSetGatewayCapabilitiesRead(d *schema.ResourceData, m in
if v := objMap["version"]; v != nil {
restrictionsMapToAdd["version"] = v
}
+ if v := objMap["hardware-subtype"]; v != nil {
+ restrictionsMapToAdd["hardware_subtype"] = v
+ }
_ = d.Set("restrictions", []interface{}{restrictionsMapToAdd})
}
@@ -509,5 +539,17 @@ func dataSourceManagementSetGatewayCapabilitiesRead(d *schema.ResourceData, m in
_ = d.Set("supported_versions", []interface{}{mapToReturn})
}
+ if v := gatewayCapabilities["supported-hardware-subtypes"]; v != nil {
+ supportedHardwareSubtypesShow := v.(map[string]interface{})
+ supportedHardwareSubtypesState := make(map[string]interface{})
+ if v := supportedHardwareSubtypesShow["default"]; v != nil {
+ supportedHardwareSubtypesState["default"] = v
+ }
+ if v := supportedHardwareSubtypesShow["hardware-subtypes"]; v != nil {
+ supportedHardwareSubtypesState["hardware_subtypes"] = v
+ }
+ _ = d.Set("supported_hardware_subtypes", []interface{}{supportedHardwareSubtypesState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_gateway_global_use.go b/checkpoint/data_source_checkpoint_management_gateway_global_use.go
index 1f51c7c5..96c81b59 100644
--- a/checkpoint/data_source_checkpoint_management_gateway_global_use.go
+++ b/checkpoint/data_source_checkpoint_management_gateway_global_use.go
@@ -56,6 +56,24 @@ func dataSourceManagementSetGatewayGlobalUse() *schema.Resource {
},
},
},
+ "enable_identity_sharing": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether Identity Awareness Sharing global use is enabled on the target.",
+ },
+ "enable_vpn": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether VPN global use is enabled on the target.",
+ },
+ "identity_sharing_domains": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Domains that Identity Awareness Sharing global use applied to them.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -104,5 +122,24 @@ func dataSourceManagementSetGatewayGlobalUseRead(d *schema.ResourceData, m inter
_ = d.Set("domain", []interface{}{mapToReturn})
}
+ if v := showGatewatGlobalUseData["enable-identity-sharing"]; v != nil {
+ _ = d.Set("enable_identity_sharing", v)
+ }
+
+ if v := showGatewatGlobalUseData["enable-vpn"]; v != nil {
+ _ = d.Set("enable_vpn", v)
+ }
+
+ if v := showGatewatGlobalUseData["identity-sharing-domains"]; v != nil {
+ identitysharingdomainsIdsList := v.([]interface{})
+ var identitysharingdomainsIds = make([]string, 0)
+ if len(identitysharingdomainsIdsList) > 0 {
+ for _, item := range identitysharingdomainsIdsList {
+ identitysharingdomainsIds = append(identitysharingdomainsIds, item.(map[string]interface{})["name"].(string))
+ }
+ }
+ _ = d.Set("identity_sharing_domains", identitysharingdomainsIds)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_gcp_data_center_server.go b/checkpoint/data_source_checkpoint_management_gcp_data_center_server.go
index 69d36a45..421ef9ee 100644
--- a/checkpoint/data_source_checkpoint_management_gcp_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_gcp_data_center_server.go
@@ -44,6 +44,35 @@ func dataSourceManagementGcpDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -131,6 +160,31 @@ func dataSourceGcpDataCenterServerRead(d *schema.ResourceData, m interface{}) er
_ = d.Set("ignore_errors", v)
}
+ if v := gcpDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := gcpDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := gcpDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_generic_data_center_server.go b/checkpoint/data_source_checkpoint_management_generic_data_center_server.go
index fcb25b13..ae403dc7 100644
--- a/checkpoint/data_source_checkpoint_management_generic_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_generic_data_center_server.go
@@ -63,6 +63,35 @@ func dataSourceManagementGenericDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -146,6 +175,31 @@ func dataSourceGenericDataCenterServerRead(d *schema.ResourceData, m interface{}
_ = d.Set("comments", v)
}
+ if v := genericDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := genericDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := genericDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_group.go b/checkpoint/data_source_checkpoint_management_group.go
index c5a05f05..d3e81a0e 100644
--- a/checkpoint/data_source_checkpoint_management_group.go
+++ b/checkpoint/data_source_checkpoint_management_group.go
@@ -54,6 +54,69 @@ func dataSourceManagementGroup() *schema.Resource {
Type: schema.TypeString,
},
},
+ "ranges": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Displays the group's matched content as ranges of IP addresses, in case 'show-as-ranges' is set to true.
In this case, the 'members' parameter is...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "excluded_others": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Objects which are not represented as IP addresses and are negated in the given rule - for example if negate is set for the source or destination of th...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ipv4": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Range of IPv4 addresses that match in the given rule.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "end": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "start": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
+ "ipv6": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Range of IPv6 addresses that match in the given rule.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "end": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "start": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
+ "others": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Objects which are not represented as IP addresses and match the given rule. The details-level parameter of the request determines whether they are dis...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ },
+ },
},
}
}
@@ -145,5 +208,59 @@ func dataSourceManagementGroupRead(d *schema.ResourceData, m interface{}) error
_ = d.Set("tags", nil)
}
+ if v := group["ranges"]; v != nil {
+ rangesShow := v.(map[string]interface{})
+ rangesState := make(map[string]interface{})
+ if v := rangesShow["excluded-others"]; v != nil {
+ excludedOthersIdsList := v.([]interface{})
+ var excludedOthersIds = make([]string, 0)
+ for _, item := range excludedOthersIdsList {
+ excludedOthersIds = append(excludedOthersIds, item.(map[string]interface{})["name"].(string))
+ }
+ rangesState["excluded_others"] = excludedOthersIds
+ }
+ if v := rangesShow["ipv4"]; v != nil {
+ ipv4List := v.([]interface{})
+ var ipv4ListState []map[string]interface{}
+ for i := range ipv4List {
+ ipv4Show := ipv4List[i].(map[string]interface{})
+ ipv4State := make(map[string]interface{})
+ if v := ipv4Show["end"]; v != nil {
+ ipv4State["end"] = v
+ }
+ if v := ipv4Show["start"]; v != nil {
+ ipv4State["start"] = v
+ }
+ ipv4ListState = append(ipv4ListState, ipv4State)
+ }
+ rangesState["ipv4"] = ipv4ListState
+ }
+ if v := rangesShow["ipv6"]; v != nil {
+ ipv6List := v.([]interface{})
+ var ipv6ListState []map[string]interface{}
+ for i := range ipv6List {
+ ipv6Show := ipv6List[i].(map[string]interface{})
+ ipv6State := make(map[string]interface{})
+ if v := ipv6Show["end"]; v != nil {
+ ipv6State["end"] = v
+ }
+ if v := ipv6Show["start"]; v != nil {
+ ipv6State["start"] = v
+ }
+ ipv6ListState = append(ipv6ListState, ipv6State)
+ }
+ rangesState["ipv6"] = ipv6ListState
+ }
+ if v := rangesShow["others"]; v != nil {
+ othersIdsList := v.([]interface{})
+ var othersIds = make([]string, 0)
+ for _, item := range othersIdsList {
+ othersIds = append(othersIds, item.(map[string]interface{})["name"].(string))
+ }
+ rangesState["others"] = othersIds
+ }
+ _ = d.Set("ranges", []interface{}{rangesState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_group_with_exclusion.go b/checkpoint/data_source_checkpoint_management_group_with_exclusion.go
index 1c2555c0..edfd2627 100644
--- a/checkpoint/data_source_checkpoint_management_group_with_exclusion.go
+++ b/checkpoint/data_source_checkpoint_management_group_with_exclusion.go
@@ -57,6 +57,69 @@ func dataSourceManagementGroupWithExclusion() *schema.Resource {
Type: schema.TypeString,
},
},
+ "ranges": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Displays the group with exclusion's matched content as ranges of IP addresses, in case 'show-as-ranges' is set to true.
In this case, the 'includ...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "excluded_others": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Objects which are not represented as IP addresses and are negated in the given rule - for example if negate is set for the source or destination of th...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ipv4": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Range of IPv4 addresses that match in the given rule.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "end": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "start": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
+ "ipv6": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Range of IPv6 addresses that match in the given rule.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "end": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "start": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
+ "others": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Objects which are not represented as IP addresses and match the given rule. The details-level parameter of the request determines whether they are dis...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ },
+ },
},
}
}
@@ -145,5 +208,59 @@ func dataSourceManagementGroupWithExclusionRead(d *schema.ResourceData, m interf
_ = d.Set("groups", nil)
}
+ if v := groupWithExclusion["ranges"]; v != nil {
+ rangesShow := v.(map[string]interface{})
+ rangesState := make(map[string]interface{})
+ if v := rangesShow["excluded-others"]; v != nil {
+ excludedOthersIdsList := v.([]interface{})
+ var excludedOthersIds = make([]string, 0)
+ for _, item := range excludedOthersIdsList {
+ excludedOthersIds = append(excludedOthersIds, item.(map[string]interface{})["name"].(string))
+ }
+ rangesState["excluded_others"] = excludedOthersIds
+ }
+ if v := rangesShow["ipv4"]; v != nil {
+ ipv4List := v.([]interface{})
+ var ipv4ListState []map[string]interface{}
+ for i := range ipv4List {
+ ipv4Show := ipv4List[i].(map[string]interface{})
+ ipv4State := make(map[string]interface{})
+ if v := ipv4Show["end"]; v != nil {
+ ipv4State["end"] = v
+ }
+ if v := ipv4Show["start"]; v != nil {
+ ipv4State["start"] = v
+ }
+ ipv4ListState = append(ipv4ListState, ipv4State)
+ }
+ rangesState["ipv4"] = ipv4ListState
+ }
+ if v := rangesShow["ipv6"]; v != nil {
+ ipv6List := v.([]interface{})
+ var ipv6ListState []map[string]interface{}
+ for i := range ipv6List {
+ ipv6Show := ipv6List[i].(map[string]interface{})
+ ipv6State := make(map[string]interface{})
+ if v := ipv6Show["end"]; v != nil {
+ ipv6State["end"] = v
+ }
+ if v := ipv6Show["start"]; v != nil {
+ ipv6State["start"] = v
+ }
+ ipv6ListState = append(ipv6ListState, ipv6State)
+ }
+ rangesState["ipv6"] = ipv6ListState
+ }
+ if v := rangesShow["others"]; v != nil {
+ othersIdsList := v.([]interface{})
+ var othersIds = make([]string, 0)
+ for _, item := range othersIdsList {
+ othersIds = append(othersIds, item.(map[string]interface{})["name"].(string))
+ }
+ rangesState["others"] = othersIds
+ }
+ _ = d.Set("ranges", []interface{}{rangesState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_guardicore_data_center_server.go b/checkpoint/data_source_checkpoint_management_guardicore_data_center_server.go
index d29246d7..81d9bfeb 100644
--- a/checkpoint/data_source_checkpoint_management_guardicore_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_guardicore_data_center_server.go
@@ -59,6 +59,35 @@ func dataSourceManagementGuardicoreDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -138,6 +167,31 @@ func dataSourceGuardicoreDataCenterServerRead(d *schema.ResourceData, m interfac
_ = d.Set("comments", v)
}
+ if v := guardicoreDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := guardicoreDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := guardicoreDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_host.go b/checkpoint/data_source_checkpoint_management_host.go
index 480a39b3..adcec0db 100644
--- a/checkpoint/data_source_checkpoint_management_host.go
+++ b/checkpoint/data_source_checkpoint_management_host.go
@@ -37,6 +37,11 @@ func dataSourceManagementHost() *schema.Resource {
Description: "Host interfaces.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "subnet_mask": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "IPv4 network mask.",
+ },
"name": {
Type: schema.TypeString,
Computed: true,
@@ -168,6 +173,11 @@ func dataSourceManagementHost() *schema.Resource {
Computed: true,
Description: "Network object which protects this server identified by the name or UID.",
},
+ "standard_port_number": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Server standard port number.",
+ },
},
},
},
@@ -291,6 +301,9 @@ func dataSourceManagementHostRead(d *schema.ResourceData, m interface{}) error {
if v, _ := interfaceMap["comments"]; v != nil {
interfaceMapToAdd["comments"] = v
}
+ if v := interfaceMap["subnet-mask"]; v != nil {
+ interfaceMapToAdd["subnet_mask"] = v
+ }
interfacesListToReturn = append(interfacesListToReturn, interfaceMapToAdd)
}
@@ -381,6 +394,9 @@ func dataSourceManagementHostRead(d *schema.ResourceData, m interface{}) error {
webServerConfigMapToReturn["protected_by"] = showProtectedByRes.GetData()["object"].(map[string]interface{})["name"]
}
+ if v := webServerConfigMap["standard-port-number"]; v != nil {
+ webServerConfigMapToReturn["standard_port_number"] = v
+ }
hostServersMapToReturn["web_server_config"] = []interface{}{webServerConfigMapToReturn}
}
diff --git a/checkpoint/data_source_checkpoint_management_https_advanced_settings.go b/checkpoint/data_source_checkpoint_management_https_advanced_settings.go
index 4f665f94..500c4ee2 100644
--- a/checkpoint/data_source_checkpoint_management_https_advanced_settings.go
+++ b/checkpoint/data_source_checkpoint_management_https_advanced_settings.go
@@ -123,6 +123,11 @@ func dataSourceManagementSetHttpsAdvancedSettings() *schema.Resource {
Computed: true,
Description: "The value \"true\" configures the Security Gateway to send HTTPS Inspection session logs.
The default value is true.",
},
+ "show_block_page": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether a block page should be displayed when TLS Inspection rejects a connection due to server certificate issues.",
+ },
},
}
}
@@ -238,5 +243,9 @@ func dataSourceManagementSetHttpsAdvancedSettingsRead(d *schema.ResourceData, m
d.Set("log_sessions", v)
}
+ if v := httpsAdvancedSettings["show-block-page"]; v != nil {
+ _ = d.Set("show_block_page", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_https_rule.go b/checkpoint/data_source_checkpoint_management_https_rule.go
index cdb0da81..ee26965e 100644
--- a/checkpoint/data_source_checkpoint_management_https_rule.go
+++ b/checkpoint/data_source_checkpoint_management_https_rule.go
@@ -124,6 +124,68 @@ func dataSourceManagementHttpsRule() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "hits": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Hits count object.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "first_date": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "N/A",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ "last_date": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "N/A",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ "level": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "percentage": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -298,5 +360,42 @@ func dataSourceManagementHttpsRuleRead(d *schema.ResourceData, m interface{}) er
_ = d.Set("comments", v)
}
+ if v := httpsRule["hits"]; v != nil {
+ hitsShow := v.(map[string]interface{})
+ hitsState := make(map[string]interface{})
+ if v := hitsShow["first-date"]; v != nil {
+ firstDateShow := v.(map[string]interface{})
+ firstDateState := make(map[string]interface{})
+ if v := firstDateShow["iso-8601"]; v != nil {
+ firstDateState["iso_8601"] = v
+ }
+ if v := firstDateShow["posix"]; v != nil {
+ firstDateState["posix"] = v
+ }
+ hitsState["first_date"] = []interface{}{firstDateState}
+ }
+ if v := hitsShow["last-date"]; v != nil {
+ lastDateShow := v.(map[string]interface{})
+ lastDateState := make(map[string]interface{})
+ if v := lastDateShow["iso-8601"]; v != nil {
+ lastDateState["iso_8601"] = v
+ }
+ if v := lastDateShow["posix"]; v != nil {
+ lastDateState["posix"] = v
+ }
+ hitsState["last_date"] = []interface{}{lastDateState}
+ }
+ if v := hitsShow["level"]; v != nil {
+ hitsState["level"] = v
+ }
+ if v := hitsShow["percentage"]; v != nil {
+ hitsState["percentage"] = v
+ }
+ if v := hitsShow["value"]; v != nil {
+ hitsState["value"] = v
+ }
+ _ = d.Set("hits", []interface{}{hitsState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_https_rulebase.go b/checkpoint/data_source_checkpoint_management_https_rulebase.go
index 6010cc87..c8825ead 100644
--- a/checkpoint/data_source_checkpoint_management_https_rulebase.go
+++ b/checkpoint/data_source_checkpoint_management_https_rulebase.go
@@ -409,6 +409,14 @@ func dataSourceManagementHttpsRuleBase() *schema.Resource {
},
},
},
+ "objects_dictionary": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Standard level.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -611,6 +619,17 @@ func dataSourceManagementHttpsRuleBaseRead(d *schema.ResourceData, m interface{}
}
outputRuleBase = append(outputRuleBase, ruleBaseToReturn)
_ = d.Set("rulebase", outputRuleBase)
+ if v := ruleBaseJson["objects-dictionary"]; v != nil {
+ objectsdictionaryIdsList := v.([]interface{})
+ var objectsdictionaryIds = make([]string, 0)
+ if len(objectsdictionaryIdsList) > 0 {
+ for _, item := range objectsdictionaryIdsList {
+ objectsdictionaryIds = append(objectsdictionaryIds, item.(map[string]interface{})["name"].(string))
+ }
+ }
+ _ = d.Set("objects_dictionary", objectsdictionaryIds)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_if_map_server.go b/checkpoint/data_source_checkpoint_management_if_map_server.go
index aa7a5fe3..ab7e6b56 100644
--- a/checkpoint/data_source_checkpoint_management_if_map_server.go
+++ b/checkpoint/data_source_checkpoint_management_if_map_server.go
@@ -82,11 +82,6 @@ func dataSourceManagementIfMapServer() *schema.Resource {
Computed: true,
Description: "Username for the IF-MAP server authentication. Required only when 'authentication-method' is set to 'basic'.",
},
- "password": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Username for the IF-MAP server authentication. Required only when 'authentication-method' is set to 'basic'.",
- },
},
},
},
diff --git a/checkpoint/data_source_checkpoint_management_illumio_data_center_server.go b/checkpoint/data_source_checkpoint_management_illumio_data_center_server.go
index 7fb74352..b67b491f 100644
--- a/checkpoint/data_source_checkpoint_management_illumio_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_illumio_data_center_server.go
@@ -59,6 +59,35 @@ func dataSourceManagementIllumioDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -138,6 +167,31 @@ func dataSourceIllumioDataCenterServerRead(d *schema.ResourceData, m interface{}
_ = d.Set("comments", v)
}
+ if v := illumioDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := illumioDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := illumioDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_interface.go b/checkpoint/data_source_checkpoint_management_interface.go
index 4cf46e18..f07758a9 100644
--- a/checkpoint/data_source_checkpoint_management_interface.go
+++ b/checkpoint/data_source_checkpoint_management_interface.go
@@ -335,6 +335,11 @@ func dataSourceManagementInterface() *schema.Resource {
Optional: true,
Description: "Comments string.",
},
+ "gateway": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Properties of the gateway or cluster that the interface belongs to.",
+ },
},
}
}
@@ -648,6 +653,10 @@ func dataSourceManagementInterfaceRead(d *schema.ResourceData, m interface{}) er
_ = d.Set("ignore_errors", v)
}
+ if v := interfaceMap["gateway"]; v != nil {
+ _ = d.Set("gateway", v.(map[string]interface{})["name"])
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_interoperable_device.go b/checkpoint/data_source_checkpoint_management_interoperable_device.go
index 2292cc09..15963650 100644
--- a/checkpoint/data_source_checkpoint_management_interoperable_device.go
+++ b/checkpoint/data_source_checkpoint_management_interoperable_device.go
@@ -221,6 +221,11 @@ func dataSourceManagementInteroperableDevice() *schema.Resource {
},
},
},
+ "autonomous_system_number": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The Autonomous System Number (ASN) for this Interoperable Device object.",
+ },
},
}
}
@@ -458,5 +463,9 @@ func dataSourceManagementInteroperableDeviceRead(d *schema.ResourceData, m inter
_ = d.Set("ignore_errors", v)
}
+ if v := interoperableDevice["autonomous-system-number"]; v != nil {
+ _ = d.Set("autonomous_system_number", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_ise_data_center_server.go b/checkpoint/data_source_checkpoint_management_ise_data_center_server.go
index 5780dcfd..d6792cfd 100644
--- a/checkpoint/data_source_checkpoint_management_ise_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_ise_data_center_server.go
@@ -62,6 +62,35 @@ func dataSourceManagementIseDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -152,6 +181,31 @@ func dataSourceIseDataCenterServerRead(d *schema.ResourceData, m interface{}) er
_ = d.Set("ignore_errors", v)
}
+ if v := iseDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := iseDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := iseDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_kubernetes_data_center_server.go b/checkpoint/data_source_checkpoint_management_kubernetes_data_center_server.go
index 2cfff389..d1a7db05 100644
--- a/checkpoint/data_source_checkpoint_management_kubernetes_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_kubernetes_data_center_server.go
@@ -59,6 +59,35 @@ func dataSourceManagementKubernetesDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -148,6 +177,31 @@ func dataSourceKubernetesDataCenterServerRead(d *schema.ResourceData, m interfac
_ = d.Set("ignore_errors", v)
}
+ if v := kubernetesDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := kubernetesDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := kubernetesDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_log_exporter.go b/checkpoint/data_source_checkpoint_management_log_exporter.go
index 8f28258c..4aaa511b 100644
--- a/checkpoint/data_source_checkpoint_management_log_exporter.go
+++ b/checkpoint/data_source_checkpoint_management_log_exporter.go
@@ -81,6 +81,16 @@ func dataSourceManagementLogExporter() *schema.Resource {
Computed: true,
Description: "Logs format.",
},
+ "add_custom_log_header": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Custom header for log export.",
+ },
+ "aggregation_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Aggregation mode for aggregated logs.
Determines how log updates are processed when aggregate-log-updates is true or not specified:
- semi-uni...",
+ },
},
},
},
@@ -102,6 +112,268 @@ func dataSourceManagementLogExporter() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "advanced": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Log exporter advanced settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "time_in_milliseconds": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Toggle export logs' time with ms resolution.",
+ },
+ },
+ },
+ },
+ "fields": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Log exporter fields settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "exclusion_list": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of field names excluded or included based on the export mode.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "export": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Field export mode.
all-except (default): exports all fields except those in the exclusion list.
nothing-except: exports nothing ...",
+ },
+ "names_mapping": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Field name mappings applied during export. Format: 'orgName1:dstName1,orgName2:dstName2,...'.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ },
+ },
+ "filters": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Log exporter filters.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "expressions": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "List of filter expressions. Each expression targets a specific log field.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "conditions": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Filter conditions for this field. Present when 'operator' is 'and' or 'or'.
Array of condition objects, each with 'operator' and 'value'.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "operator": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Comparison operator.",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The value to compare against.",
+ },
+ },
+ },
+ },
+ "field_name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Log field name to filter on.",
+ },
+ "operator": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Operator for this expression.
Use 'and'/'or' with 'conditions' (array of condition objects).
Use 'in'/'not-in' with 'values' (flat array of stri...",
+ },
+ "values": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Filter values for this field. Present when 'operator' is 'in' or 'not-in'.
Flat array of string values.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ },
+ },
+ "expressions_operator": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Logical operator for combining all filter expressions.",
+ },
+ "filter_out_connection_logs": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "When set to true, connection logs will be excluded from export.",
+ },
+ },
+ },
+ },
+ "target_cloud": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Cloud target configuration for log export.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "s3_bucket_auth": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "S3 bucket authentication configuration details.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "complete_configuration": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "S3 bucket ARNs configuration details.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "exporter_enabled": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the log exporter is now enabled after ARN configuration.",
+ },
+ "message": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Status message indicating ARN configuration success and exporter enablement.",
+ },
+ "profile_arn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Configured AWS IAM Roles Anywhere profile ARN.",
+ },
+ "role_arn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Configured AWS IAM role ARN.",
+ },
+ "trust_anchor_arn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Configured AWS IAM Roles Anywhere trust anchor ARN.",
+ },
+ },
+ },
+ },
+ "create_certificate": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "S3 bucket configuration with auto-generated certificates details.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "bucket": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Configured S3 bucket name.",
+ },
+ "ca_certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "CA certificate that signed the S3 client certificate. Supplied as base64 encoded PEM string. Decode this certificate and upload it to AWS IAM Roles An...",
+ },
+ "message": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Status message indicating certificate generation success and next steps.",
+ },
+ "prefix": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Configured S3 prefix (if provided).",
+ },
+ "region": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Configured AWS region.",
+ },
+ },
+ },
+ },
+ "operation": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Current S3 authentication operation phase: 'create-certificate' or 'complete-configuration'.",
+ },
+ },
+ },
+ },
+ "type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Cloud target type. Currently only 's3-bucket' is supported.",
+ },
+ },
+ },
+ },
+ "tls": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Log exporter TLS settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "auto_generate_client_certificates": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "TLS mode where user provides server CA certificate only. Check Point Management automatically generates and signs client certificates. This is the sim...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "client_ca_cert": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Client generated CA certificate that signed the client certificate. The server should trust this CA. Supplied as base64 encoded string.",
+ },
+ },
+ },
+ },
+ "client_cert_expiration_date": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Client certificate expiration date extracted from the stored PKCS#12 certificate. Available for all TLS modes when client certificate exists.",
+ },
+ "enabled": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use encrypted connection. Can be true only when protocol is TCP.",
+ },
+ "generate_and_sign_client_csr": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Advanced TLS mode with two separate phases: 'auto-generate-client-csr' to initiate CSR generation (ADD/SET) and 'provide-signed-client-cert' to provid...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "client_csr": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Client certificate signing request (CSR) in PEM format as base64 encoded string. Present when phase is 'auto-generate-client-csr'.",
+ },
+ "phase": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Advanced mode phase type: 'auto-generate-client-csr' indicates CSR generation, or 'provide-signed-client-cert' indicates signed certificate provided.",
+ },
+ },
+ },
+ },
+ "mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "TLS mode. Must match the specific mode configuration provided.",
+ },
+ },
+ },
+ },
},
}
}
@@ -192,6 +464,12 @@ func dataSourceManagementLogExporterRead(d *schema.ResourceData, m interface{})
dataManipulationMapToReturn["format"] = v
}
+ if v := dataManipulationMap["add-custom-log-header"]; v != nil {
+ dataManipulationMapToReturn["add_custom_log_header"] = v
+ }
+ if v := dataManipulationMap["aggregation-mode"]; v != nil {
+ dataManipulationMapToReturn["aggregation_mode"] = v
+ }
_ = d.Set("data_manipulation", []interface{}{dataManipulationMapToReturn})
} else {
_ = d.Set("data_manipulation", nil)
@@ -221,5 +499,167 @@ func dataSourceManagementLogExporterRead(d *schema.ResourceData, m interface{})
_ = d.Set("tags", nil)
}
+ if v := logExporter["advanced"]; v != nil {
+ advancedShow := v.(map[string]interface{})
+ advancedState := make(map[string]interface{})
+ if v := advancedShow["time-in-milliseconds"]; v != nil {
+ advancedState["time_in_milliseconds"] = v
+ }
+ _ = d.Set("advanced", []interface{}{advancedState})
+ }
+
+ if v := logExporter["fields"]; v != nil {
+ fieldsShow := v.(map[string]interface{})
+ fieldsState := make(map[string]interface{})
+ if v := fieldsShow["exclusion-list"]; v != nil {
+ fieldsState["exclusion_list"] = v
+ }
+ if v := fieldsShow["export"]; v != nil {
+ fieldsState["export"] = v
+ }
+ if v := fieldsShow["names-mapping"]; v != nil {
+ fieldsState["names_mapping"] = v
+ }
+ _ = d.Set("fields", []interface{}{fieldsState})
+ }
+
+ if v := logExporter["filters"]; v != nil {
+ filtersShow := v.(map[string]interface{})
+ filtersState := make(map[string]interface{})
+ if v := filtersShow["expressions"]; v != nil {
+ expressionsList := v.([]interface{})
+ var expressionsListState []map[string]interface{}
+ for i := range expressionsList {
+ expressionsShow := expressionsList[i].(map[string]interface{})
+ expressionsState := make(map[string]interface{})
+ if v := expressionsShow["conditions"]; v != nil {
+ conditionsList := v.([]interface{})
+ var conditionsListState []map[string]interface{}
+ for i := range conditionsList {
+ conditionsShow := conditionsList[i].(map[string]interface{})
+ conditionsState := make(map[string]interface{})
+ if v := conditionsShow["operator"]; v != nil {
+ conditionsState["operator"] = v
+ }
+ if v := conditionsShow["value"]; v != nil {
+ conditionsState["value"] = v
+ }
+ conditionsListState = append(conditionsListState, conditionsState)
+ }
+ expressionsState["conditions"] = conditionsListState
+ }
+ if v := expressionsShow["field-name"]; v != nil {
+ expressionsState["field_name"] = v
+ }
+ if v := expressionsShow["operator"]; v != nil {
+ expressionsState["operator"] = v
+ }
+ if v := expressionsShow["values"]; v != nil {
+ expressionsState["values"] = v
+ }
+ expressionsListState = append(expressionsListState, expressionsState)
+ }
+ filtersState["expressions"] = expressionsListState
+ }
+ if v := filtersShow["expressions-operator"]; v != nil {
+ filtersState["expressions_operator"] = v
+ }
+ if v := filtersShow["filter-out-connection-logs"]; v != nil {
+ filtersState["filter_out_connection_logs"] = v
+ }
+ _ = d.Set("filters", []interface{}{filtersState})
+ }
+
+ if v := logExporter["target-cloud"]; v != nil {
+ targetCloudShow := v.(map[string]interface{})
+ targetCloudState := make(map[string]interface{})
+ if v := targetCloudShow["s3-bucket-auth"]; v != nil {
+ s3BucketAuthShow := v.(map[string]interface{})
+ s3BucketAuthState := make(map[string]interface{})
+ if v := s3BucketAuthShow["complete-configuration"]; v != nil {
+ completeConfigurationShow := v.(map[string]interface{})
+ completeConfigurationState := make(map[string]interface{})
+ if v := completeConfigurationShow["exporter-enabled"]; v != nil {
+ completeConfigurationState["exporter_enabled"] = v
+ }
+ if v := completeConfigurationShow["message"]; v != nil {
+ completeConfigurationState["message"] = v
+ }
+ if v := completeConfigurationShow["profile-arn"]; v != nil {
+ completeConfigurationState["profile_arn"] = v
+ }
+ if v := completeConfigurationShow["role-arn"]; v != nil {
+ completeConfigurationState["role_arn"] = v
+ }
+ if v := completeConfigurationShow["trust-anchor-arn"]; v != nil {
+ completeConfigurationState["trust_anchor_arn"] = v
+ }
+ s3BucketAuthState["complete_configuration"] = []interface{}{completeConfigurationState}
+ }
+ if v := s3BucketAuthShow["create-certificate"]; v != nil {
+ createCertificateShow := v.(map[string]interface{})
+ createCertificateState := make(map[string]interface{})
+ if v := createCertificateShow["bucket"]; v != nil {
+ createCertificateState["bucket"] = v
+ }
+ if v := createCertificateShow["ca-certificate"]; v != nil {
+ createCertificateState["ca_certificate"] = v
+ }
+ if v := createCertificateShow["message"]; v != nil {
+ createCertificateState["message"] = v
+ }
+ if v := createCertificateShow["prefix"]; v != nil {
+ createCertificateState["prefix"] = v
+ }
+ if v := createCertificateShow["region"]; v != nil {
+ createCertificateState["region"] = v
+ }
+ s3BucketAuthState["create_certificate"] = []interface{}{createCertificateState}
+ }
+ if v := s3BucketAuthShow["operation"]; v != nil {
+ s3BucketAuthState["operation"] = v
+ }
+ targetCloudState["s3_bucket_auth"] = []interface{}{s3BucketAuthState}
+ }
+ if v := targetCloudShow["type"]; v != nil {
+ targetCloudState["type"] = v
+ }
+ _ = d.Set("target_cloud", []interface{}{targetCloudState})
+ }
+
+ if v := logExporter["tls"]; v != nil {
+ tlsShow := v.(map[string]interface{})
+ tlsState := make(map[string]interface{})
+ if v := tlsShow["auto-generate-client-certificates"]; v != nil {
+ autoGenerateClientCertificatesShow := v.(map[string]interface{})
+ autoGenerateClientCertificatesState := make(map[string]interface{})
+ if v := autoGenerateClientCertificatesShow["client-ca-cert"]; v != nil {
+ autoGenerateClientCertificatesState["client_ca_cert"] = v
+ }
+ tlsState["auto_generate_client_certificates"] = []interface{}{autoGenerateClientCertificatesState}
+ }
+ if v := tlsShow["client-cert-expiration-date"]; v != nil {
+ tlsState["client_cert_expiration_date"] = v
+ }
+ if v := tlsShow["enabled"]; v != nil {
+ tlsState["enabled"] = v
+ }
+ if v := tlsShow["generate-and-sign-client-csr"]; v != nil {
+ generateAndSignClientCsrShow := v.(map[string]interface{})
+ generateAndSignClientCsrState := make(map[string]interface{})
+ if v := generateAndSignClientCsrShow["client-csr"]; v != nil {
+ generateAndSignClientCsrState["client_csr"] = v
+ }
+ if v := generateAndSignClientCsrShow["phase"]; v != nil {
+ generateAndSignClientCsrState["phase"] = v
+ }
+ tlsState["generate_and_sign_client_csr"] = []interface{}{generateAndSignClientCsrState}
+ }
+ if v := tlsShow["mode"]; v != nil {
+ tlsState["mode"] = v
+ }
+ _ = d.Set("tls", []interface{}{tlsState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_lsm_cluster.go b/checkpoint/data_source_checkpoint_management_lsm_cluster.go
index cfa5bd10..baaeb54e 100644
--- a/checkpoint/data_source_checkpoint_management_lsm_cluster.go
+++ b/checkpoint/data_source_checkpoint_management_lsm_cluster.go
@@ -125,6 +125,78 @@ func dataSourceManagementLsmCluster() *schema.Resource {
Description: "Cluster members.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "gateway_status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The current status of the Cluster member. Shown only when the 'show-statuses' parameter is set to 'true'.",
+ },
+ "policy_status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The current status of the Security Policy. Shown only when the 'show-statuses' parameter is set to 'true'.",
+ },
+ "provisioning_settings_status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The current status of the Provisioning Settings. Shown only when the 'show-statuses' parameter is set to 'true'.",
+ },
+ "last_provisioning_settings_sync_time": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "The last time of Provisioning Settings synchronization with the Cluster member. Shown only when the 'show-statuses' parameter is set to 'true'.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ "last_policy_fetch_time": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "The last time when the Security Policy was fetched. Shown only when the 'show-statuses' parameter is set to 'true'.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ "last_applied_provisioning_settings_time": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "The last time when the Provisioning Settings were changed. Shown only when the 'show-statuses' parameter is set to 'true'.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
"member_name": {
Type: schema.TypeString,
Computed: true,
@@ -437,6 +509,39 @@ func dataSourceManagementLsmClusterRead(d *schema.ResourceData, m interface{}) e
memberMap := make(map[string]interface{})
+ if v := memeberObj["last-provisioning-settings-sync-time"]; v != nil {
+ lastProvisioningSettingsSyncTimeShow := v.(map[string]interface{})
+ lastProvisioningSettingsSyncTimeState := make(map[string]interface{})
+ if v := lastProvisioningSettingsSyncTimeShow["iso-8601"]; v != nil {
+ lastProvisioningSettingsSyncTimeState["iso_8601"] = v
+ }
+ if v := lastProvisioningSettingsSyncTimeShow["posix"]; v != nil {
+ lastProvisioningSettingsSyncTimeState["posix"] = v
+ }
+ memberMap["last_provisioning_settings_sync_time"] = []interface{}{lastProvisioningSettingsSyncTimeState}
+ }
+ if v := memeberObj["last-policy-fetch-time"]; v != nil {
+ lastPolicyFetchTimeShow := v.(map[string]interface{})
+ lastPolicyFetchTimeState := make(map[string]interface{})
+ if v := lastPolicyFetchTimeShow["iso-8601"]; v != nil {
+ lastPolicyFetchTimeState["iso_8601"] = v
+ }
+ if v := lastPolicyFetchTimeShow["posix"]; v != nil {
+ lastPolicyFetchTimeState["posix"] = v
+ }
+ memberMap["last_policy_fetch_time"] = []interface{}{lastPolicyFetchTimeState}
+ }
+ if v := memeberObj["last-applied-provisioning-settings-time"]; v != nil {
+ lastAppliedProvisioningSettingsTimeShow := v.(map[string]interface{})
+ lastAppliedProvisioningSettingsTimeState := make(map[string]interface{})
+ if v := lastAppliedProvisioningSettingsTimeShow["iso-8601"]; v != nil {
+ lastAppliedProvisioningSettingsTimeState["iso_8601"] = v
+ }
+ if v := lastAppliedProvisioningSettingsTimeShow["posix"]; v != nil {
+ lastAppliedProvisioningSettingsTimeState["posix"] = v
+ }
+ memberMap["last_applied_provisioning_settings_time"] = []interface{}{lastAppliedProvisioningSettingsTimeState}
+ }
if v := memeberObj["member-name"]; v != nil {
memberMap["member_name"] = v.(string)
}
@@ -502,6 +607,15 @@ func dataSourceManagementLsmClusterRead(d *schema.ResourceData, m interface{}) e
memberMap["interfaces"] = nil
}
+ if v := memeberObj["gateway-status"]; v != nil {
+ memberMap["gateway_status"] = v
+ }
+ if v := memeberObj["policy-status"]; v != nil {
+ memberMap["policy_status"] = v
+ }
+ if v := memeberObj["provisioning-settings-status"]; v != nil {
+ memberMap["provisioning_settings_status"] = v
+ }
listOfMembersObject = append(listOfMembersObject, memberMap)
}
diff --git a/checkpoint/data_source_checkpoint_management_lsm_cluster_profile.go b/checkpoint/data_source_checkpoint_management_lsm_cluster_profile.go
index d1389eda..374f88de 100644
--- a/checkpoint/data_source_checkpoint_management_lsm_cluster_profile.go
+++ b/checkpoint/data_source_checkpoint_management_lsm_cluster_profile.go
@@ -527,6 +527,11 @@ func dataSourceManagementLsmClusterProfile() *schema.Resource {
Optional: true,
Description: "NAT translation method.",
},
+ "apply_control_connections": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "This option performs NAT on VPN control connections to and from this object.",
+ },
},
},
},
@@ -636,11 +641,6 @@ func dataSourceManagementLsmClusterProfile() *schema.Resource {
Computed: true,
Description: "Zero Phishing blade enabled.",
},
- "zero_phishing_fqdn": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Zero Phishing gateway FQDN.",
- },
"color": {
Type: schema.TypeString,
Computed: true,
@@ -779,10 +779,6 @@ func dataSourceManagementLsmClusterProfileRead(d *schema.ResourceData, m interfa
_ = d.Set("version", v)
}
- if v := lsmClusterProfile["zero-phishing-fqdn"]; v != nil {
- _ = d.Set("zero_phishing_fqdn", v)
- }
-
if v := lsmClusterProfile["color"]; v != nil {
_ = d.Set("color", v)
}
@@ -1150,6 +1146,9 @@ func dataSourceManagementLsmClusterProfileRead(d *schema.ResourceData, m interfa
natSettingsMapToReturn["method"] = v
}
+ if v := natSettingsMap["apply-control-connections"]; v != nil {
+ natSettingsMapToReturn["apply_control_connections"] = v
+ }
_ = d.Set("nat_settings", []interface{}{natSettingsMapToReturn})
} else {
diff --git a/checkpoint/data_source_checkpoint_management_lsm_gateway.go b/checkpoint/data_source_checkpoint_management_lsm_gateway.go
index fd4f0fa5..6c367245 100644
--- a/checkpoint/data_source_checkpoint_management_lsm_gateway.go
+++ b/checkpoint/data_source_checkpoint_management_lsm_gateway.go
@@ -125,11 +125,6 @@ func dataSourceManagementLsmGateway() *schema.Resource {
Description: "Secure Internal Communication.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "one_time_password": {
- Type: schema.TypeString,
- Computed: true,
- Description: "One-time password. When one-time password is provided without ip-address- trusted communication is automatically initiated when the gateway connects to the Security Management server for the first time.",
- },
"ip_address": {
Type: schema.TypeString,
Computed: true,
@@ -219,6 +214,78 @@ func dataSourceManagementLsmGateway() *schema.Resource {
Computed: true,
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
},
+ "gateway_status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The current status of the Gateway. Shown only when the 'show-statuses' parameter is set to 'true'.",
+ },
+ "policy_status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The current status of the Security Policy. Shown only when the 'show-statuses' parameter is set to 'true'.",
+ },
+ "provisioning_settings_status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The current status of the Provisioning Settings. Shown only when the 'show-statuses' parameter is set to 'true'.",
+ },
+ "last_applied_provisioning_settings_time": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "The last time when the Provisioning Settings were changed. Shown only when the 'show-statuses' parameter is set to 'true'.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ "last_policy_fetch_time": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "The last time when the Security Policy was fetched. Shown only when the 'show-statuses' parameter is set to 'true'.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ "last_provisioning_settings_sync_time": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "The last time of Provisioning Settings synchronization with the Gateway. Shown only when the 'show-statuses' parameter is set to 'true'.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
},
}
@@ -457,5 +524,53 @@ func dataSourceManagementLsmGatewayRead(d *schema.ResourceData, m interface{}) e
_ = d.Set("ignore_errors", v)
}
+ if v := lsmGateway["gateway-status"]; v != nil {
+ _ = d.Set("gateway_status", v)
+ }
+
+ if v := lsmGateway["policy-status"]; v != nil {
+ _ = d.Set("policy_status", v)
+ }
+
+ if v := lsmGateway["provisioning-settings-status"]; v != nil {
+ _ = d.Set("provisioning_settings_status", v)
+ }
+
+ if v := lsmGateway["last-applied-provisioning-settings-time"]; v != nil {
+ lastAppliedProvisioningSettingsTimeShow := v.(map[string]interface{})
+ lastAppliedProvisioningSettingsTimeState := make(map[string]interface{})
+ if v := lastAppliedProvisioningSettingsTimeShow["iso-8601"]; v != nil {
+ lastAppliedProvisioningSettingsTimeState["iso_8601"] = v
+ }
+ if v := lastAppliedProvisioningSettingsTimeShow["posix"]; v != nil {
+ lastAppliedProvisioningSettingsTimeState["posix"] = v
+ }
+ _ = d.Set("last_applied_provisioning_settings_time", []interface{}{lastAppliedProvisioningSettingsTimeState})
+ }
+
+ if v := lsmGateway["last-policy-fetch-time"]; v != nil {
+ lastPolicyFetchTimeShow := v.(map[string]interface{})
+ lastPolicyFetchTimeState := make(map[string]interface{})
+ if v := lastPolicyFetchTimeShow["iso-8601"]; v != nil {
+ lastPolicyFetchTimeState["iso_8601"] = v
+ }
+ if v := lastPolicyFetchTimeShow["posix"]; v != nil {
+ lastPolicyFetchTimeState["posix"] = v
+ }
+ _ = d.Set("last_policy_fetch_time", []interface{}{lastPolicyFetchTimeState})
+ }
+
+ if v := lsmGateway["last-provisioning-settings-sync-time"]; v != nil {
+ lastProvisioningSettingsSyncTimeShow := v.(map[string]interface{})
+ lastProvisioningSettingsSyncTimeState := make(map[string]interface{})
+ if v := lastProvisioningSettingsSyncTimeShow["iso-8601"]; v != nil {
+ lastProvisioningSettingsSyncTimeState["iso_8601"] = v
+ }
+ if v := lastProvisioningSettingsSyncTimeShow["posix"]; v != nil {
+ lastProvisioningSettingsSyncTimeState["posix"] = v
+ }
+ _ = d.Set("last_provisioning_settings_sync_time", []interface{}{lastProvisioningSettingsSyncTimeState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_lsm_gateway_profile.go b/checkpoint/data_source_checkpoint_management_lsm_gateway_profile.go
index b455af2f..d01b108b 100644
--- a/checkpoint/data_source_checkpoint_management_lsm_gateway_profile.go
+++ b/checkpoint/data_source_checkpoint_management_lsm_gateway_profile.go
@@ -411,6 +411,11 @@ func dataSourceManagementLsmGatewayProfile() *schema.Resource {
Optional: true,
Description: "NAT translation method.",
},
+ "apply_control_connections": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "This option performs NAT on VPN control connections to and from this object.",
+ },
},
},
},
@@ -520,11 +525,6 @@ func dataSourceManagementLsmGatewayProfile() *schema.Resource {
Computed: true,
Description: "Zero Phishing blade enabled.",
},
- "zero_phishing_fqdn": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Zero Phishing gateway FQDN.",
- },
"color": {
Type: schema.TypeString,
Computed: true,
@@ -663,10 +663,6 @@ func dataSourceManagementLsmGatewayProfileRead(d *schema.ResourceData, m interfa
_ = d.Set("version", v)
}
- if v := lsmGatewayProfile["zero-phishing-fqdn"]; v != nil {
- _ = d.Set("zero_phishing_fqdn", v)
- }
-
if v := lsmGatewayProfile["color"]; v != nil {
_ = d.Set("color", v)
}
@@ -928,6 +924,9 @@ func dataSourceManagementLsmGatewayProfileRead(d *schema.ResourceData, m interfa
natSettingsMapToReturn["method"] = v
}
+ if v := natSettingsMap["apply-control-connections"]; v != nil {
+ natSettingsMapToReturn["apply_control_connections"] = v
+ }
_ = d.Set("nat_settings", []interface{}{natSettingsMapToReturn})
} else {
diff --git a/checkpoint/data_source_checkpoint_management_md_permissions_profile.go b/checkpoint/data_source_checkpoint_management_md_permissions_profile.go
index d064af55..bd74f999 100644
--- a/checkpoint/data_source_checkpoint_management_md_permissions_profile.go
+++ b/checkpoint/data_source_checkpoint_management_md_permissions_profile.go
@@ -112,6 +112,32 @@ func dataSourceManagementMdPermissionsProfile() *schema.Resource {
Computed: true,
Description: "The level of the Multi Domain Permissions Profile.
The level cannot be changed after creation.",
},
+ "limit_mgmt_api_commands": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable limitation of Management API commands the profile may or may not run.",
+ },
+ "manage_all_domains": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Create and manage all Domains and Global Domains.",
+ },
+ "allowed_mgmt_api_commands": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of allowed Management API commands the profile can run. All available commands can be viewed using show-commands Management API.
...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -248,5 +274,20 @@ func dataSourceManagementMdPermissionsProfileRead(d *schema.ResourceData, m inte
_ = d.Set("permission_level", v)
}
+ if v := mdPermissionsProfile["limit-mgmt-api-commands"]; v != nil {
+ _ = d.Set("limit_mgmt_api_commands", v)
+ }
+
+ if v := mdPermissionsProfile["manage-all-domains"]; v != nil {
+ _ = d.Set("manage_all_domains", v)
+ }
+
+ if v := mdPermissionsProfile["allowed-mgmt-api-commands"]; v != nil {
+ _ = d.Set("allowed_mgmt_api_commands", v)
+ }
+ if v := mdPermissionsProfile["blocked-mgmt-api-commands"]; v != nil {
+ _ = d.Set("blocked_mgmt_api_commands", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_mds.go b/checkpoint/data_source_checkpoint_management_mds.go
index 9d0077b7..e759be01 100644
--- a/checkpoint/data_source_checkpoint_management_mds.go
+++ b/checkpoint/data_source_checkpoint_management_mds.go
@@ -105,6 +105,11 @@ func dataSourceManagementMds() *schema.Resource {
Computed: true,
Description: "Type of the management server.",
},
+ "platform": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Platform. Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Standard level.",
+ },
},
}
}
@@ -238,5 +243,9 @@ func dataSourceManagementMdsRead(d *schema.ResourceData, m interface{}) error {
_ = d.Set("server_type", v)
}
+ if v := mds["platform"]; v != nil {
+ _ = d.Set("platform", v.(map[string]interface{})["name"])
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_nat_rule.go b/checkpoint/data_source_checkpoint_management_nat_rule.go
index 7cb53154..965f7788 100644
--- a/checkpoint/data_source_checkpoint_management_nat_rule.go
+++ b/checkpoint/data_source_checkpoint_management_nat_rule.go
@@ -84,6 +84,68 @@ func dataSourceManagementNatRule() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "hits": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Hits count object.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "first_date": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "N/A",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ "last_date": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "N/A",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ "level": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "percentage": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -183,5 +245,42 @@ func dataSourceManagementNatRuleRead(d *schema.ResourceData, m interface{}) erro
_ = d.Set("comments", v)
}
+ if v := natRule["hits"]; v != nil {
+ hitsShow := v.(map[string]interface{})
+ hitsState := make(map[string]interface{})
+ if v := hitsShow["first-date"]; v != nil {
+ firstDateShow := v.(map[string]interface{})
+ firstDateState := make(map[string]interface{})
+ if v := firstDateShow["iso-8601"]; v != nil {
+ firstDateState["iso_8601"] = v
+ }
+ if v := firstDateShow["posix"]; v != nil {
+ firstDateState["posix"] = v
+ }
+ hitsState["first_date"] = []interface{}{firstDateState}
+ }
+ if v := hitsShow["last-date"]; v != nil {
+ lastDateShow := v.(map[string]interface{})
+ lastDateState := make(map[string]interface{})
+ if v := lastDateShow["iso-8601"]; v != nil {
+ lastDateState["iso_8601"] = v
+ }
+ if v := lastDateShow["posix"]; v != nil {
+ lastDateState["posix"] = v
+ }
+ hitsState["last_date"] = []interface{}{lastDateState}
+ }
+ if v := hitsShow["level"]; v != nil {
+ hitsState["level"] = v
+ }
+ if v := hitsShow["percentage"]; v != nil {
+ hitsState["percentage"] = v
+ }
+ if v := hitsShow["value"]; v != nil {
+ hitsState["value"] = v
+ }
+ _ = d.Set("hits", []interface{}{hitsState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_nat_rulebase.go b/checkpoint/data_source_checkpoint_management_nat_rulebase.go
index b9608448..383e2e3d 100644
--- a/checkpoint/data_source_checkpoint_management_nat_rulebase.go
+++ b/checkpoint/data_source_checkpoint_management_nat_rulebase.go
@@ -334,6 +334,14 @@ func dataSourceManagementNatRuleBase() *schema.Resource {
},
},
},
+ "objects_dictionary": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Standard level.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -504,6 +512,17 @@ func dataSourceManagementNatRuleBaseRead(d *schema.ResourceData, m interface{})
}
outputRuleBase = append(outputRuleBase, ruleBaseToReturn)
_ = d.Set("rulebase", outputRuleBase)
+ if v := ruleBaseJson["objects-dictionary"]; v != nil {
+ objectsdictionaryIdsList := v.([]interface{})
+ var objectsdictionaryIds = make([]string, 0)
+ if len(objectsdictionaryIdsList) > 0 {
+ for _, item := range objectsdictionaryIdsList {
+ objectsdictionaryIds = append(objectsdictionaryIds, item.(map[string]interface{})["name"].(string))
+ }
+ }
+ _ = d.Set("objects_dictionary", objectsdictionaryIds)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_network.go b/checkpoint/data_source_checkpoint_management_network.go
index 4ee12c03..56c8886c 100644
--- a/checkpoint/data_source_checkpoint_management_network.go
+++ b/checkpoint/data_source_checkpoint_management_network.go
@@ -110,6 +110,11 @@ func dataSourceManagementNetwork() *schema.Resource {
Type: schema.TypeString,
},
},
+ "subnet_mask": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "IPv4 network mask.",
+ },
},
}
}
@@ -241,5 +246,9 @@ func dataSourceManagementNetworkRead(d *schema.ResourceData, m interface{}) erro
_ = d.Set("tags", nil)
}
+ if v := network["subnet-mask"]; v != nil {
+ _ = d.Set("subnet_mask", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_nozomi_data_center_server.go b/checkpoint/data_source_checkpoint_management_nozomi_data_center_server.go
index 6ee0b042..0c945bc8 100644
--- a/checkpoint/data_source_checkpoint_management_nozomi_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_nozomi_data_center_server.go
@@ -59,6 +59,35 @@ func dataSourceManagementNozomiDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -138,6 +167,31 @@ func dataSourceNozomiDataCenterServerRead(d *schema.ResourceData, m interface{})
_ = d.Set("comments", v)
}
+ if v := nozomiDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := nozomiDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := nozomiDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_nuage_data_center_server.go b/checkpoint/data_source_checkpoint_management_nuage_data_center_server.go
index 8db5a879..cad83c9d 100644
--- a/checkpoint/data_source_checkpoint_management_nuage_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_nuage_data_center_server.go
@@ -65,6 +65,35 @@ func dataSourceManagementNuageDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -152,6 +181,31 @@ func dataSourceNuageDataCenterServerRead(d *schema.ResourceData, m interface{})
_ = d.Set("ignore_errors", v)
}
+ if v := nuageDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := nuageDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := nuageDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_openstack_data_center_server.go b/checkpoint/data_source_checkpoint_management_openstack_data_center_server.go
index e82d97e5..da2c0ca9 100644
--- a/checkpoint/data_source_checkpoint_management_openstack_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_openstack_data_center_server.go
@@ -59,6 +59,35 @@ func dataSourceManagementOpenStackDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -146,6 +175,31 @@ func dataSourceOpenStackDataCenterServerRead(d *schema.ResourceData, m interface
_ = d.Set("ignore_errors", v)
}
+ if v := openstackDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := openstackDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := openstackDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_opsec_application.go b/checkpoint/data_source_checkpoint_management_opsec_application.go
index c076f9b9..f472a3f6 100644
--- a/checkpoint/data_source_checkpoint_management_opsec_application.go
+++ b/checkpoint/data_source_checkpoint_management_opsec_application.go
@@ -87,6 +87,11 @@ func dataSourceManagementOpsecApplication() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "server": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The UID or Name of the host that is the OPSEC Server.",
+ },
},
}
}
@@ -203,5 +208,9 @@ func dataSourceManagementOpsecApplicationRead(d *schema.ResourceData, m interfac
_ = d.Set("comments", v)
}
+ if v := opsecApplication["server"]; v != nil {
+ _ = d.Set("server", v.(map[string]interface{})["name"])
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_outbound_inspection_certificate.go b/checkpoint/data_source_checkpoint_management_outbound_inspection_certificate.go
index 104c9331..89d49543 100644
--- a/checkpoint/data_source_checkpoint_management_outbound_inspection_certificate.go
+++ b/checkpoint/data_source_checkpoint_management_outbound_inspection_certificate.go
@@ -70,6 +70,16 @@ func dataSourceManagementOutboundInspectionCertificate() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "public_key_algorithm": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Public key algorithm and size of the outbound certificate.",
+ },
+ "subject": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate's subject.",
+ },
},
}
}
@@ -161,6 +171,14 @@ func dataSourceManagementOutboundInspectionCertificateRead(d *schema.ResourceDat
_ = d.Set("comments", v)
}
+ if v := outboundInspectionCertificate["public-key-algorithm"]; v != nil {
+ _ = d.Set("public_key_algorithm", v)
+ }
+
+ if v := outboundInspectionCertificate["subject"]; v != nil {
+ _ = d.Set("subject", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_override_categorization.go b/checkpoint/data_source_checkpoint_management_override_categorization.go
index a7f53280..e8a69205 100644
--- a/checkpoint/data_source_checkpoint_management_override_categorization.go
+++ b/checkpoint/data_source_checkpoint_management_override_categorization.go
@@ -64,6 +64,11 @@ func dataSourceManagementOverrideCategorization() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "comment": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Comment for the categorization override.",
+ },
},
}
}
@@ -158,6 +163,10 @@ func dataSourceManagementOverrideCategorizationRead(d *schema.ResourceData, m in
_ = d.Set("comments", v)
}
+ if v := overrideCategorization["comment"]; v != nil {
+ _ = d.Set("comment", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_package.go b/checkpoint/data_source_checkpoint_management_package.go
index ea47d19c..bbb4c04f 100644
--- a/checkpoint/data_source_checkpoint_management_package.go
+++ b/checkpoint/data_source_checkpoint_management_package.go
@@ -117,6 +117,84 @@ func dataSourceManagementPackage() *schema.Resource {
Type: schema.TypeString,
},
},
+ "autonomous_threat_policy": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "UID of the Autonomous Threat Prevention policy.",
+ },
+ "https_inspection_policy": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "True - enables, False - disables HTTPS Inspection policy, empty - nothing is changed.",
+ },
+ "nat_layer": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "UID of the NAT policy.",
+ },
+ "nat_policy": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "True - enables, False - disables NAT policy, empty - nothing is changed.",
+ },
+ "sd_wan": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "True - enables, False - disables SD-WAN policy, empty - nothing is changed.",
+ },
+ "installation_targets_revision": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "List of installation targets and revisions on which this policy package was installed.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "cluster_members_revision": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "If this target is a cluster, this list shows a revision which was installed on each cluster member.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "revision": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The revision installed on this target. Level of details in the output corresponds to the number of details for search. This table shows the level of d...",
+ },
+ "target_name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The name of the installation target.",
+ },
+ "target_uid": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Installation target unique identifier.",
+ },
+ },
+ },
+ },
+ "revision": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The revision installed on this target. Level of details in the output corresponds to the number of details for search. This table shows the level of d...",
+ },
+ "target_name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The name of the installation target.",
+ },
+ "target_uid": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Installation target unique identifier.",
+ },
+ },
+ },
+ },
+ "sd_wan_layer": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "SD-WAN policy layer. Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Stan...",
+ },
},
}
}
@@ -269,5 +347,68 @@ func dataSourceManagementPackageRead(d *schema.ResourceData, m interface{}) erro
_ = d.Set("tags", nil)
}
+ if v := _package["autonomous-threat-policy"]; v != nil {
+ _ = d.Set("autonomous_threat_policy", v)
+ }
+
+ if v := _package["https-inspection-policy"]; v != nil {
+ _ = d.Set("https_inspection_policy", v)
+ }
+
+ if v := _package["nat-layer"]; v != nil {
+ _ = d.Set("nat_layer", v)
+ }
+
+ if v := _package["nat-policy"]; v != nil {
+ _ = d.Set("nat_policy", v)
+ }
+
+ if v := _package["sd-wan"]; v != nil {
+ _ = d.Set("sd_wan", v)
+ }
+
+ if v := _package["installation-targets-revision"]; v != nil {
+ installationTargetsRevisionList := v.([]interface{})
+ var installationTargetsRevisionListState []map[string]interface{}
+ for i := range installationTargetsRevisionList {
+ installationTargetsRevisionShow := installationTargetsRevisionList[i].(map[string]interface{})
+ installationTargetsRevisionState := make(map[string]interface{})
+ if v := installationTargetsRevisionShow["cluster-members-revision"]; v != nil {
+ clusterMembersRevisionList := v.([]interface{})
+ var clusterMembersRevisionListState []map[string]interface{}
+ for i := range clusterMembersRevisionList {
+ clusterMembersRevisionShow := clusterMembersRevisionList[i].(map[string]interface{})
+ clusterMembersRevisionState := make(map[string]interface{})
+ if v := clusterMembersRevisionShow["revision"]; v != nil {
+ clusterMembersRevisionState["revision"] = v.(map[string]interface{})["name"]
+ }
+ if v := clusterMembersRevisionShow["target-name"]; v != nil {
+ clusterMembersRevisionState["target_name"] = v
+ }
+ if v := clusterMembersRevisionShow["target-uid"]; v != nil {
+ clusterMembersRevisionState["target_uid"] = v
+ }
+ clusterMembersRevisionListState = append(clusterMembersRevisionListState, clusterMembersRevisionState)
+ }
+ installationTargetsRevisionState["cluster_members_revision"] = clusterMembersRevisionListState
+ }
+ if v := installationTargetsRevisionShow["revision"]; v != nil {
+ installationTargetsRevisionState["revision"] = v.(map[string]interface{})["name"]
+ }
+ if v := installationTargetsRevisionShow["target-name"]; v != nil {
+ installationTargetsRevisionState["target_name"] = v
+ }
+ if v := installationTargetsRevisionShow["target-uid"]; v != nil {
+ installationTargetsRevisionState["target_uid"] = v
+ }
+ installationTargetsRevisionListState = append(installationTargetsRevisionListState, installationTargetsRevisionState)
+ }
+ _ = d.Set("installation_targets_revision", installationTargetsRevisionListState)
+ }
+
+ if v := _package["sd-wan-layer"]; v != nil {
+ _ = d.Set("sd_wan_layer", v.(map[string]interface{})["name"])
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_policy_settings.go b/checkpoint/data_source_checkpoint_management_policy_settings.go
index 6275cace..0b89cec2 100644
--- a/checkpoint/data_source_checkpoint_management_policy_settings.go
+++ b/checkpoint/data_source_checkpoint_management_policy_settings.go
@@ -43,9 +43,19 @@ func dataSourceManagementPolicySettings() *schema.Resource {
Computed: true,
Description: "Source default value identified by name.",
},
+ "track": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Track default value identified by name.",
+ },
},
},
},
+ "log_generation": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Log generation settings for existing and new rules.",
+ },
},
}
}
@@ -92,10 +102,17 @@ func dataSourceManagementPolicySettingsRead(d *schema.ResourceData, m interface{
securityAccessDefaultsMapToReturn["source"] = v
}
+ if v := securityAccessDefaultsMap["track"]; v != nil {
+ securityAccessDefaultsMapToReturn["track"] = v
+ }
_ = d.Set("security_access_defaults", []interface{}{securityAccessDefaultsMapToReturn})
} else {
_ = d.Set("security_access_defaults", nil)
}
+ if v := policySettings["log-generation"]; v != nil {
+ _ = d.Set("log_generation", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_proxmox_data_center_server.go b/checkpoint/data_source_checkpoint_management_proxmox_data_center_server.go
index 04e7ae5c..f3fe41af 100644
--- a/checkpoint/data_source_checkpoint_management_proxmox_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_proxmox_data_center_server.go
@@ -69,6 +69,25 @@ func dataSourceManagementProxmoxDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -164,6 +183,23 @@ func dataSourceProxmoxDataCenterServerRead(d *schema.ResourceData, m interface{}
_ = d.Set("data_center_type", v)
}
+ if v := proxmoxDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_resource_ftp.go b/checkpoint/data_source_checkpoint_management_resource_ftp.go
index c0f7500d..439d45d3 100644
--- a/checkpoint/data_source_checkpoint_management_resource_ftp.go
+++ b/checkpoint/data_source_checkpoint_management_resource_ftp.go
@@ -64,6 +64,11 @@ func dataSourceManagementResourceFtp() *schema.Resource {
Computed: true,
Description: "Designates when the CVP server returns data to the Security Gateway security server.",
},
+ "cvp_server_is_allowed_to_modify_content": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Configures the CVP server to inspect but not modify content.",
+ },
},
},
},
@@ -85,6 +90,11 @@ func dataSourceManagementResourceFtp() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "resource_path": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Refers to a location on the FTP server.",
+ },
},
}
}
@@ -167,6 +177,9 @@ func dataSourceManagementResourceFtpRead(d *schema.ResourceData, m interface{})
if v, _ := cvpMap["reply-order"]; v != nil {
cvpMapToReturn["reply_order"] = v
}
+ if v := cvpMap["cvp-server-is-allowed-to-modify-content"]; v != nil {
+ cvpMapToReturn["cvp_server_is_allowed_to_modify_content"] = v
+ }
_ = d.Set("cvp", []interface{}{cvpMapToReturn})
} else {
_ = d.Set("cvp", nil)
@@ -204,6 +217,10 @@ func dataSourceManagementResourceFtpRead(d *schema.ResourceData, m interface{})
_ = d.Set("ignore_errors", v)
}
+ if v := resourceFtp["resource-path"]; v != nil {
+ _ = d.Set("resource_path", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_resource_smtp.go b/checkpoint/data_source_checkpoint_management_resource_smtp.go
index f490420e..71067968 100644
--- a/checkpoint/data_source_checkpoint_management_resource_smtp.go
+++ b/checkpoint/data_source_checkpoint_management_resource_smtp.go
@@ -232,6 +232,11 @@ func dataSourceManagementResourceSmtp() *schema.Resource {
Computed: true,
Description: "Designates when the CVP server returns data to the Security Gateway security server.",
},
+ "cvp_server_is_allowed_to_modify_content": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Configures the CVP server to inspect but not modify content.",
+ },
},
},
},
@@ -469,6 +474,9 @@ func dataSourceManagementResourceSmtpRead(d *schema.ResourceData, m interface{})
if v, _ := cvpMap["reply-order"]; v != nil {
cvpMapToReturn["reply_order"] = v
}
+ if v := cvpMap["cvp-server-is-allowed-to-modify-content"]; v != nil {
+ cvpMapToReturn["cvp_server_is_allowed_to_modify_content"] = v
+ }
_ = d.Set("cvp", []interface{}{cvpMapToReturn})
} else {
_ = d.Set("cvp", nil)
diff --git a/checkpoint/data_source_checkpoint_management_resource_tcp.go b/checkpoint/data_source_checkpoint_management_resource_tcp.go
index d3c1de91..ff3a6a78 100644
--- a/checkpoint/data_source_checkpoint_management_resource_tcp.go
+++ b/checkpoint/data_source_checkpoint_management_resource_tcp.go
@@ -87,6 +87,11 @@ func dataSourceManagementResourceTcp() *schema.Resource {
Computed: true,
Description: "Designates when the CVP server returns data to the Security Gateway security server.",
},
+ "cvp_server_is_allowed_to_modify_content": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Configures the CVP server to inspect but not modify content.",
+ },
},
},
},
@@ -201,6 +206,9 @@ func dataSourceManagementResourceTcpRead(d *schema.ResourceData, m interface{})
if v, _ := cvpMap["reply-order"]; v != nil {
cvpMapToReturn["reply_order"] = v
}
+ if v := cvpMap["cvp-server-is-allowed-to-modify-content"]; v != nil {
+ cvpMapToReturn["cvp_server_is_allowed_to_modify_content"] = v
+ }
_ = d.Set("cvp_settings", []interface{}{cvpMapToReturn})
} else {
_ = d.Set("cvp_settings", nil)
diff --git a/checkpoint/data_source_checkpoint_management_resource_uri.go b/checkpoint/data_source_checkpoint_management_resource_uri.go
index 4b57150f..c483afe1 100644
--- a/checkpoint/data_source_checkpoint_management_resource_uri.go
+++ b/checkpoint/data_source_checkpoint_management_resource_uri.go
@@ -277,6 +277,11 @@ func dataDourceManagementResourceUri() *schema.Resource {
Computed: true,
Description: "Improves the performance of the CVP server. This option does not send to the CVP server traffic that is considered safe.",
},
+ "cvp_server_is_allowed_to_modify_content": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Configures the CVP server to inspect but not modify content.",
+ },
},
},
},
@@ -565,6 +570,9 @@ func dataSourceManagementResourceUriRead(d *schema.ResourceData, m interface{})
if v, _ := cvpMap["send-only-unsafe-file-types"]; v != nil {
cvpMapToReturn["send_only_unsafe_file_types"] = v
}
+ if v := cvpMap["cvp-server-is-allowed-to-modify-content"]; v != nil {
+ cvpMapToReturn["cvp_server_is_allowed_to_modify_content"] = v
+ }
_ = d.Set("cvp", []interface{}{cvpMapToReturn})
} else {
_ = d.Set("cvp", nil)
diff --git a/checkpoint/data_source_checkpoint_management_server_certificate.go b/checkpoint/data_source_checkpoint_management_server_certificate.go
index 195e8096..2eb7afb3 100644
--- a/checkpoint/data_source_checkpoint_management_server_certificate.go
+++ b/checkpoint/data_source_checkpoint_management_server_certificate.go
@@ -42,6 +42,21 @@ func dataSourceManagementServerCertificate() *schema.Resource {
Computed: true,
Description: "Server certificate comments.",
},
+ "base64_certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate file encoded in base64.",
+ },
+ "base64_public_certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Public Certificate file encoded in base64 (pem format).",
+ },
+ "issued_by": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The DN (Distinguished Name) of the certificate.",
+ },
},
}
}
@@ -93,5 +108,17 @@ func dataSourceManagementServerCertificateRead(d *schema.ResourceData, m interfa
_ = d.Set("comments", v)
}
+ if v := serverCertificate["base64-certificate"]; v != nil {
+ _ = d.Set("base64_certificate", v)
+ }
+
+ if v := serverCertificate["base64-public-certificate"]; v != nil {
+ _ = d.Set("base64_public_certificate", v)
+ }
+
+ if v := serverCertificate["issued-by"]; v != nil {
+ _ = d.Set("issued_by", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_service_citrix_tcp.go b/checkpoint/data_source_checkpoint_management_service_citrix_tcp.go
index 01dff261..d80f2661 100644
--- a/checkpoint/data_source_checkpoint_management_service_citrix_tcp.go
+++ b/checkpoint/data_source_checkpoint_management_service_citrix_tcp.go
@@ -44,6 +44,11 @@ func dataSourceManagementServiceCitrixTcp() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "port": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Service port.",
+ },
},
}
}
@@ -112,5 +117,9 @@ func dataSourceManagementServiceCitrixTcpRead(d *schema.ResourceData, m interfac
_ = d.Set("comments", v)
}
+ if v := serviceCitrixTcp["port"]; v != nil {
+ _ = d.Set("port", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_service_compound_tcp.go b/checkpoint/data_source_checkpoint_management_service_compound_tcp.go
index e9ae37b5..514eab29 100644
--- a/checkpoint/data_source_checkpoint_management_service_compound_tcp.go
+++ b/checkpoint/data_source_checkpoint_management_service_compound_tcp.go
@@ -49,6 +49,11 @@ func dataSourceManagementServiceCompoundTcp() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "port": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Service port.",
+ },
},
}
}
@@ -121,5 +126,9 @@ func dataSourceManagementServiceCompoundTcpRead(d *schema.ResourceData, m interf
_ = d.Set("comments", v)
}
+ if v := serviceCompoundTcp["port"]; v != nil {
+ _ = d.Set("port", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_service_group.go b/checkpoint/data_source_checkpoint_management_service_group.go
index c93fca77..70077d7e 100644
--- a/checkpoint/data_source_checkpoint_management_service_group.go
+++ b/checkpoint/data_source_checkpoint_management_service_group.go
@@ -54,6 +54,69 @@ func dataSourceManagementServiceGroup() *schema.Resource {
Type: schema.TypeString,
},
},
+ "ranges": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Displays the service group's matched content as ranges of port numbers, in case 'show-as-ranges' is set to true.
In this case, the 'members' para...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "excluded_others": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Objects which are not represented as port numbers and are negated in the given rule - for example if negate is set for the service of this rule. The d...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "others": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Objects which are not represented as port numbers and match the given rule. The details-level parameter of the request determines whether they are dis...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "tcp": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Range of TCP ports that match in the given rule.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "end": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "start": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
+ "udp": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Range of UDP ports that match in the given rule.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "end": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "start": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
},
}
}
@@ -150,5 +213,59 @@ func dataSourceManagementServiceGroupRead(d *schema.ResourceData, m interface{})
_ = d.Set("tags", nil)
}
+ if v := serviceGroup["ranges"]; v != nil {
+ rangesShow := v.(map[string]interface{})
+ rangesState := make(map[string]interface{})
+ if v := rangesShow["excluded-others"]; v != nil {
+ excludedOthersIdsList := v.([]interface{})
+ var excludedOthersIds = make([]string, 0)
+ for _, item := range excludedOthersIdsList {
+ excludedOthersIds = append(excludedOthersIds, item.(map[string]interface{})["name"].(string))
+ }
+ rangesState["excluded_others"] = excludedOthersIds
+ }
+ if v := rangesShow["others"]; v != nil {
+ othersIdsList := v.([]interface{})
+ var othersIds = make([]string, 0)
+ for _, item := range othersIdsList {
+ othersIds = append(othersIds, item.(map[string]interface{})["name"].(string))
+ }
+ rangesState["others"] = othersIds
+ }
+ if v := rangesShow["tcp"]; v != nil {
+ tcpList := v.([]interface{})
+ var tcpListState []map[string]interface{}
+ for i := range tcpList {
+ tcpShow := tcpList[i].(map[string]interface{})
+ tcpState := make(map[string]interface{})
+ if v := tcpShow["end"]; v != nil {
+ tcpState["end"] = v
+ }
+ if v := tcpShow["start"]; v != nil {
+ tcpState["start"] = v
+ }
+ tcpListState = append(tcpListState, tcpState)
+ }
+ rangesState["tcp"] = tcpListState
+ }
+ if v := rangesShow["udp"]; v != nil {
+ udpList := v.([]interface{})
+ var udpListState []map[string]interface{}
+ for i := range udpList {
+ udpShow := udpList[i].(map[string]interface{})
+ udpState := make(map[string]interface{})
+ if v := udpShow["end"]; v != nil {
+ udpState["end"] = v
+ }
+ if v := udpShow["start"]; v != nil {
+ udpState["start"] = v
+ }
+ udpListState = append(udpListState, udpState)
+ }
+ rangesState["udp"] = udpListState
+ }
+ _ = d.Set("ranges", []interface{}{rangesState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_service_other.go b/checkpoint/data_source_checkpoint_management_service_other.go
index 6fb2de9c..4e7a5c88 100644
--- a/checkpoint/data_source_checkpoint_management_service_other.go
+++ b/checkpoint/data_source_checkpoint_management_service_other.go
@@ -126,6 +126,11 @@ func dataSourceManagementServiceOther() *schema.Resource {
Type: schema.TypeString,
},
},
+ "protocol": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Protocol name or uid. The protocol type associated with the service, and by implication, the management server (if any) that enforces Content Security...",
+ },
},
}
}
@@ -271,5 +276,9 @@ func dataSourceManagementServiceOtherRead(d *schema.ResourceData, m interface{})
_ = d.Set("groups", nil)
}
+ if v := serviceOther["protocol"]; v != nil {
+ _ = d.Set("protocol", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_service_tcp.go b/checkpoint/data_source_checkpoint_management_service_tcp.go
index 0acca328..04846c11 100644
--- a/checkpoint/data_source_checkpoint_management_service_tcp.go
+++ b/checkpoint/data_source_checkpoint_management_service_tcp.go
@@ -125,6 +125,21 @@ func dataSourceManagementServiceTcp() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "delayed_sync_value": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Specify the delay (in seconds) in which a synchronization will start after connection initiation.",
+ },
+ "enable_tcp_resource": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable for tcp resource.",
+ },
+ "use_delayed_sync": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable this option to delay notifying the Security Gateway about a connection, so that the connection will only be synchronized if it still exists x s...",
+ },
},
}
}
@@ -266,5 +281,17 @@ func dataSourceManagementServiceTcpRead(d *schema.ResourceData, m interface{}) e
_ = d.Set("tags", nil)
}
+ if v := serviceTcp["delayed-sync-value"]; v != nil {
+ _ = d.Set("delayed_sync_value", v)
+ }
+
+ if v := serviceTcp["enable-tcp-resource"]; v != nil {
+ _ = d.Set("enable_tcp_resource", v)
+ }
+
+ if v := serviceTcp["use-delayed-sync"]; v != nil {
+ _ = d.Set("use_delayed_sync", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_servicenow_cmdb_data_center_server.go b/checkpoint/data_source_checkpoint_management_servicenow_cmdb_data_center_server.go
index ed477f9f..ff88302d 100644
--- a/checkpoint/data_source_checkpoint_management_servicenow_cmdb_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_servicenow_cmdb_data_center_server.go
@@ -59,6 +59,35 @@ func dataSourceManagementServicenowCmdbDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -138,6 +167,31 @@ func dataSourceServicenowCmdbDataCenterServerRead(d *schema.ResourceData, m inte
_ = d.Set("comments", v)
}
+ if v := servicenowCmdbDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := servicenowCmdbDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := servicenowCmdbDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_simple_cluster.go b/checkpoint/data_source_checkpoint_management_simple_cluster.go
index 6760894c..ea5cd16b 100644
--- a/checkpoint/data_source_checkpoint_management_simple_cluster.go
+++ b/checkpoint/data_source_checkpoint_management_simple_cluster.go
@@ -147,6 +147,11 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Computed: true,
Description: "Override value.
Required only for 'override-profile' is True.",
},
+ "profile_value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
},
},
},
@@ -166,6 +171,11 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Computed: true,
Description: "Override value.
Required only for 'override-profile' is True.",
},
+ "profile_value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
},
},
},
@@ -185,6 +195,11 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Computed: true,
Description: "Override value.
Required only for 'override-profile' is True.",
},
+ "profile_value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
},
},
},
@@ -204,6 +219,11 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Computed: true,
Description: "Override value.
Required only for 'override-profile' is True.",
},
+ "profile_value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
},
},
},
@@ -223,9 +243,81 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Computed: true,
Description: "Override value.
Required only for 'override-profile' is True.",
},
+ "profile_value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
+ },
+ },
+ },
+ "bypass_on_client_failure": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Bypass HTTPS inspection on client failure.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "profile_value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to bypass on client failure.",
+ },
+ },
+ },
+ },
+ "bypass_under_load": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Bypass HTTPS inspection under load.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to bypass under load.",
+ },
+ },
+ },
+ },
+ "outbound_certificate": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Outbound HTTPS inspection certificate.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "profile_value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Outbound certificate identified by the name or UID.",
+ },
},
},
},
+ "deployment_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "HTTPS inspection deployment mode.",
+ },
},
},
},
@@ -335,6 +427,11 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Computed: true,
Description: "The main URL for the web portal.",
},
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
},
},
},
@@ -349,10 +446,25 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Computed: true,
Description: "The certificate file encoded in Base64 with padding. This file must be in the *.p12 format.",
},
- "base64_password": {
+ "certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate.",
+ },
+ "certificate_dn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate distinguished name.",
+ },
+ "certificate_valid_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date from which the certificate is valid.",
+ },
+ "certificate_valid_to": {
Type: schema.TypeString,
Computed: true,
- Description: "Password (encoded in Base64 with padding) for the certificate file.",
+ Description: "The date until which the certificate is valid.",
},
},
},
@@ -517,6 +629,62 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
},
},
},
+ "certificate_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal certificate.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate.",
+ },
+ "certificate_dn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate distinguished name.",
+ },
+ "certificate_valid_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date from which the certificate is valid.",
+ },
+ "certificate_valid_to": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date until which the certificate is valid.",
+ },
+ },
+ },
+ },
+ "portal_web_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal web settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "aliases": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of URL aliases that are redirected to the main portal URL.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
+ "main_url": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The main URL for the portal.",
+ },
+ },
+ },
+ },
},
},
},
@@ -545,11 +713,6 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Computed: true,
Description: "Host / Network Group Name or UID.",
},
- "client_secret": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Client Secret.",
- },
},
},
},
@@ -638,58 +801,369 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
},
},
},
+ "certificate_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal certificate.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate.",
+ },
+ "certificate_dn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate distinguished name.",
+ },
+ "certificate_valid_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date from which the certificate is valid.",
+ },
+ "certificate_valid_to": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date until which the certificate is valid.",
+ },
+ },
+ },
+ },
+ "portal_web_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal web settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "aliases": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of URL aliases that are redirected to the main portal URL.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
+ "main_url": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The main URL for the portal.",
+ },
+ },
+ },
+ },
},
},
},
},
},
},
- "identity_sharing_settings": {
+ "identity_web_api": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Identity Web API source enabled.",
+ },
+ "identity_web_api_settings": {
Type: schema.TypeList,
Computed: true,
- Description: "Identity sharing settings.",
+ Description: "Identity Web API settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "share_with_other_gateways": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Enable identity sharing with other gateways.",
- },
- "receive_from_other_gateways": {
- Type: schema.TypeBool,
+ "authentication_settings": {
+ Type: schema.TypeList,
Computed: true,
- Description: "Enable receiving identity from other gateways.",
+ Description: "Authentication settings for Identity Web API.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "users_directories": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Users directories.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "external_user_profile": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "External user profile.",
+ },
+ "internal_users": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Internal users.",
+ },
+ "users_from_external_directories": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Users from external directories.",
+ },
+ "specific": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "LDAP AU objects identified by the name or UID.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ },
+ },
+ },
+ },
},
- "receive_from": {
- Type: schema.TypeSet,
+ "authorized_clients": {
+ Type: schema.TypeList,
Computed: true,
- Description: "Gateway(s) to receive identity from.",
- Elem: &schema.Schema{
- Type: schema.TypeString,
+ Description: "Authorized clients.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "client": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Host / Network Group Name or UID.",
+ },
+ },
},
},
- },
- },
- },
- "proxy_settings": {
- Type: schema.TypeList,
- Computed: true,
- Description: "Identity-Awareness Proxy settings.",
- Elem: &schema.Resource{
- Schema: map[string]*schema.Schema{
- "detect_using_x_forward_for": {
- Type: schema.TypeBool,
+ "client_access_permissions": {
+ Type: schema.TypeList,
Computed: true,
- Description: "Whether to use X-Forward-For HTTP header, which is added by the proxy server to keep track of the original source IP.",
- },
- },
- },
- },
- "remote_access": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Enable Remote Access Identity source.",
- },
+ Description: "Identity Web API accessibility settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "accessibility": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal access settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "allow_access_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Allowed access to the web portal (based on interfaces, or security policy).",
+ },
+ "internal_access_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the additional portal access settings for internal interfaces only.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "undefined": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to \"Undefined\".",
+ },
+ "dmz": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to \"DMZ\".",
+ },
+ "vpn": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Controls portal access settings for interfaces that are part of a VPN Encryption Domain.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "certificate_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal certificate.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate.",
+ },
+ "certificate_dn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate distinguished name.",
+ },
+ "certificate_valid_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date from which the certificate is valid.",
+ },
+ "certificate_valid_to": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date until which the certificate is valid.",
+ },
+ },
+ },
+ },
+ "portal_web_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal web settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "aliases": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of URL aliases that are redirected to the main portal URL.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
+ "main_url": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The main URL for the portal.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "ad_query": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "AD Query source enabled.",
+ },
+ "collecting_identities": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "This gateway collects identities.",
+ },
+ "identity_based_enforcement": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Configures this object as a PEP-only object - identity-based enforcement (PEP).",
+ },
+ "radius_accounting": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Radius Accounting source enabled.",
+ },
+ "terminal_servers": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Terminal Servers source enabled.",
+ },
+ "identity_sharing_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Identity sharing settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "share_with_other_gateways": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable identity sharing with other gateways.",
+ },
+ "receive_from_other_gateways": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable receiving identity from other gateways.",
+ },
+ "receive_from": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Gateway(s) to receive identity from.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "cache_mode": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Identity cache mode.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether the identity cache is enabled.",
+ },
+ "profile_value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
+ },
+ },
+ },
+ "cache_mode_duration": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Identity cache mode duration.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Identity cache duration in minutes.",
+ },
+ "profile_value": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "The duration inherited from the profile, in minutes.",
+ },
+ },
+ },
+ },
+ "receive_from_infinity_identity": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to receive identities from Infinity Identity.",
+ },
+ "scaled_sharing": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether scaled identity sharing is enabled.",
+ },
+ },
+ },
+ },
+ "proxy_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Identity-Awareness Proxy settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "detect_using_x_forward_for": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to use X-Forward-For HTTP header, which is added by the proxy server to keep track of the original source IP.",
+ },
+ },
+ },
+ },
+ "remote_access": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable Remote Access Identity source.",
+ },
},
},
},
@@ -739,6 +1213,11 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Computed: true,
Description: "NAT translation method.",
},
+ "apply_control_connections": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "This option performs NAT on VPN control connections to and from this object.",
+ },
},
},
},
@@ -754,6 +1233,11 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Description: "Configuration of the portal web settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Optional: IP address for the web portal to use, if your DNS server fails to resolve the main portal URL. Note: If your DNS server resolves the main po...",
+ },
"aliases": {
Type: schema.TypeSet,
Computed: true,
@@ -776,15 +1260,30 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Description: "Configuration of the portal certificate settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "base64_certificate": {
+ "certificate": {
Type: schema.TypeString,
Computed: true,
- Description: "The certificate file encoded in Base64 with padding. This file must be in the *.p12 format.",
+ Description: "The certificate.",
+ },
+ "certificate_dn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The DN (Distinguished Name) of the certificate.",
+ },
+ "certificate_valid_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date, from which the certificate is valid.",
+ },
+ "certificate_valid_to": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate expiration date.",
},
- "base64_password": {
+ "base64_certificate": {
Type: schema.TypeString,
Computed: true,
- Description: "Password (encoded in Base64 with padding) for the certificate file.",
+ Description: "The certificate file encoded in Base64 with padding. This file must be in the *.p12 format.",
},
},
},
@@ -827,6 +1326,11 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
},
},
},
+ "enabled": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "State of the web portal (enabled or disabled).",
+ },
},
},
},
@@ -878,6 +1382,11 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Description: "Configuration of the portal web settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Optional: IP address for the web portal to use, if your DNS server fails to resolve the main portal URL. Note: If your DNS server resolves the main po...",
+ },
"aliases": {
Type: schema.TypeSet,
Computed: true,
@@ -900,15 +1409,30 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Description: "Configuration of the portal certificate settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "base64_certificate": {
+ "certificate": {
Type: schema.TypeString,
Computed: true,
- Description: "The certificate file encoded in Base64 with padding. This file must be in the *.p12 format.",
+ Description: "The certificate.",
+ },
+ "certificate_dn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The DN (Distinguished Name) of the certificate.",
+ },
+ "certificate_valid_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date, from which the certificate is valid.",
+ },
+ "certificate_valid_to": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate expiration date.",
},
- "base64_password": {
+ "base64_certificate": {
Type: schema.TypeString,
Computed: true,
- Description: "Password (encoded in Base64 with padding) for the certificate file.",
+ Description: "The certificate file encoded in Base64 with padding. This file must be in the *.p12 format.",
},
},
},
@@ -963,6 +1487,7 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Type: schema.TypeString,
Computed: true,
Description: "Zero Phishing gateway FQDN.",
+ Deprecated: "use zero_phishing_settings.manual_fqdn instead - the API replaced zero-phishing-fqdn with zero-phishing-settings",
},
"interfaces": {
Type: schema.TypeList,
@@ -1575,6 +2100,16 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Computed: true,
Description: "Update account log in every amount of seconds.",
},
+ "distribute_logs_between_all_active_servers": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Distribute logs between all active servers.",
+ },
+ "include_tcp_state_information": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Include TCP state information. Relevant only when Firewall blade is enabled.",
+ },
},
},
},
@@ -1603,30 +2138,314 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
Type: schema.TypeString,
},
},
- },
- },
- },
- "link_selection": {
- Type: schema.TypeList,
- Computed: true,
- Description: "Link Selection.",
- Elem: &schema.Resource{
- Schema: map[string]*schema.Schema{
- "ip_selection": {
- Type: schema.TypeString,
- Computed: true,
- Description: "IP selection",
- },
- "dns_resolving_hostname": {
- Type: schema.TypeString,
- Computed: true,
- Description: "DNS Resolving Hostname. Must be set when \"ip-selection\" was selected to be \"dns-resolving-from-hostname\".",
- },
- "ip_address": {
- Type: schema.TypeString,
+ "single_authentication_client": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Settings for clients that support only single authentication method.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "enabled": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Allow clients that support only single authentication method.",
+ },
+ "allow_multiple_authentication_clients": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Allow clients that support multiple authentication methods to connect.",
+ },
+ "display_name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Display name for the authentication method.",
+ },
+ "method": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Authentication method type.",
+ },
+ "secur_id": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "SecurID authentication settings, relevant only when method is \"secur-id\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "server": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Server object identified by the name or UID.",
+ },
+ "token_card_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Token card type.",
+ },
+ },
+ },
+ },
+ "radius": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "RADIUS authentication settings, relevant only when method is \"radius\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "server": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Server object identified by the name or UID.",
+ },
+ "ask_user_password": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Ask user for password during authentication.",
+ },
+ },
+ },
+ },
+ "personal_certificate": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Personal certificate authentication settings, relevant only when method is \"personal-certificate\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "fetch_username_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Fetch username from.",
+ },
+ "storage_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate storage type.",
+ },
+ "source": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate source field.",
+ },
+ "dn_part": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "DN part to extract.",
+ },
+ "dn_concurrence": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "DN part occurrence number.",
+ },
+ },
+ },
+ },
+ "client_display_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Client display configuration settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "headline": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Display headline for authentication dialog.",
+ },
+ "username_label": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Label for username field.",
+ },
+ "password_label": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Label for password field.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "override_global_dynamic_id_settings": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Override global dynamic ID settings.",
+ },
+ "dynamic_id_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Dynamic ID settings, relevant only when \"override-global-dynamic-id-settings\" is true.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "sms_provider_and_email_settings": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "SMS provider and email configuration.",
+ },
+ "sms_provider_credentials": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "SMS provider credentials configuration.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "username": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "SMS provider username.",
+ },
+ "api_id": {
+ Type: schema.TypeString,
+ Computed: true,
+ Sensitive: true,
+ Description: "SMS provider API ID.",
+ },
+ },
+ },
+ },
+ "advanced_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Advanced Dynamic ID configuration settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "dynamic_id_message": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Dynamic ID message displayed to users.",
+ },
+ "otp_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "One Time Password configuration settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "length": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Length of one time password.",
+ },
+ "expiration": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "One time password expiration (in minutes).",
+ },
+ "max_attempts": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of times users can attempt to enter the one time password before the entire authentication process restarts.",
+ },
+ },
+ },
+ },
+ "enable_display_user_details": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable display of user details.",
+ },
+ "country_code": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Country code for SMS services.",
+ },
+ "user_details_retrieval": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "User details retrieval method.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "send_machine_certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Configure when to send machine certificate.",
+ },
+ },
+ },
+ },
+ "link_selection": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Link Selection.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "ip_selection": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "IP selection",
+ },
+ "dns_resolving_hostname": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "DNS Resolving Hostname. Must be set when \"ip-selection\" was selected to be \"dns-resolving-from-hostname\".",
+ },
+ "ip_address": {
+ Type: schema.TypeString,
Computed: true,
Description: "IP Address. Must be set when \"ip-selection\" was selected to be \"use-selected-address-from-topology\" or \"use-statically-nated-ip\"",
},
+ "route_selection_method": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Outgoing route selection method when initiating a tunnel.",
+ },
+ "responding_traffic": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Responding traffic route selection method.",
+ },
+ "source_ip_selection": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Source IP address selection method for outgoing traffic.",
+ },
+ "selected_ip": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Selected IP address. Must be set when \"source-ip-selection\" was selected to be \"manual\".",
+ },
+ "outgoing_link_tracking": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Outgoing link tracking method.",
+ },
+ "probing_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Probing settings configuration. Only available when \"ip-selection\" is \"use-probing-with-high-availability\" or \"use-probing-with-load-sharing\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "probed_interfaces": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Specifies whether to probe all addresses defined in the topology tab or specific addresses.",
+ },
+ "probed_interface_list": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of specific IP addresses to probe. Only relevant when \"probed-interfaces\" is set to \"specific\".",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "use_primary_address": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to use a primary address for high availability probing.",
+ },
+ "primary_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Primary IP address to use. Must be one of the addresses from \"probed-interface-list\". Required when \"use-primary-address\" is true.",
+ },
+ "probing_method": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Probing method.",
+ },
+ },
+ },
+ },
},
},
},
@@ -1659,234 +2478,864 @@ func dataSourceManagementSimpleCluster() *schema.Resource {
"allocate_ip_address_from": {
Type: schema.TypeList,
Computed: true,
- Description: "Allocate IP address Method. Allocate IP address by sequentially trying the given methods until success.",
+ Description: "Allocate IP address Method. Allocate IP address by sequentially trying the given methods until success.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "radius_server": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Radius server used to authenticate the user.",
+ },
+ "use_allocate_method": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Use Allocate Method.",
+ },
+ "allocate_method": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Using either Manual (IP Pool) or Automatic (DHCP). Must be set when \"use-allocate-method\" is true.",
+ },
+ "manual_network": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Manual Network. Identified by name or UID. Must be set when \"allocate-method\" was selected to be \"manual\".",
+ },
+ "dhcp_server": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "DHCP Server. Identified by name or UID. Must be set when \"allocate-method\" was selected to be \"automatic\".",
+ },
+ "virtual_ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Virtual IPV4 address for DHCP server replies. Must be set when \"allocate-method\" was selected to be \"automatic\".",
+ },
+ "dhcp_mac_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Calculated MAC address for DHCP allocation. Must be set when \"allocate-method\" was selected to be \"automatic\".",
+ },
+ "optional_parameters": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "This configuration applies to all Office Mode methods except Automatic (using DHCP) and ipassignment.conf entries which contain this data.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "use_primary_dns_server": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Use Primary DNS Server.",
+ },
+ "primary_dns_server": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Primary DNS Server. Identified by name or UID. Must be set when \"use-primary-dns-server\" is true and can not be set when \"use-primary-dns-server\" is false.",
+ },
+ "use_first_backup_dns_server": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Use First Backup DNS Server.",
+ },
+ "first_backup_dns_server": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "First Backup DNS Server. Identified by name or UID. Must be set when \"use-first-backup-dns-server\" is true and can not be set when \"use-first-backup-dns-server\" is false.",
+ },
+ "use_second_backup_dns_server": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Use Second Backup DNS Server.",
+ },
+ "second_backup_dns_server": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Second Backup DNS Server. Identified by name or UID. Must be set when \"use-second-backup-dns-server\" is true and can not be set when \"use-second-backup-dns-server\" is false.",
+ },
+ "dns_suffixes": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "DNS Suffixes.",
+ },
+ "use_primary_wins_server": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Use Primary WINS Server.",
+ },
+ "primary_wins_server": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Primary WINS Server. Identified by name or UID. Must be set when \"use-primary-wins-server\" is true and can not be set when \"use-primary-wins-server\" is false.",
+ },
+ "use_first_backup_wins_server": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Use First Backup WINS Server.",
+ },
+ "first_backup_wins_server": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "First Backup WINS Server. Identified by name or UID. Must be set when \"use-first-backup-wins-server\" is true and can not be set when \"use-first-backup-wins-server\" is false.",
+ },
+ "use_second_backup_wins_server": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Use Second Backup WINS Server.",
+ },
+ "second_backup_wins_server": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Second Backup WINS Server. Identified by name or UID. Must be set when \"use-second-backup-wins-server\" is true and can not be set when \"use-second-backup-wins-server\" is false.",
+ },
+ "ip_lease_duration": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "IP Lease Duration in Minutes. The value must be in the range 2-32767.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "support_multiple_interfaces": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Support connectivity enhancement for gateways with multiple external interfaces.",
+ },
+ "perform_anti_spoofing": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Perform Anti-Spoofing on Office Mode addresses.",
+ },
+ "anti_spoofing_additional_addresses": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Additional IP Addresses for Anti-Spoofing. Identified by name or UID. Must be set when \"perform-anti-spoofings\" is true.",
+ },
+ },
+ },
+ },
+ "remote_access": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Remote Access.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "support_l2tp": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Support L2TP (relevant only when office mode is active).",
+ },
+ "l2tp_auth_method": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "L2TP Authentication Method. Must be set when \"support-l2tp\" is true.",
+ },
+ "l2tp_certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "L2TP Certificate. Must be set when \"l2tp-auth-method\" was selected to be \"certificate\". Insert \"defaultCert\" when you want to use the default certificate.",
+ },
+ "allow_vpn_clients_to_route_traffic": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Allow VPN clients to route traffic.",
+ },
+ "support_nat_traversal_mechanism": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Support NAT traversal mechanism (UDP encapsulation).",
+ },
+ "nat_traversal_service": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Allocated NAT traversal UDP service. Identified by name or UID. Must be set when \"support-nat-traversal-mechanism\" is true.",
+ },
+ "support_visitor_mode": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Support Visitor Mode.",
+ },
+ "visitor_mode_service": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "TCP Service for Visitor Mode. Identified by name or UID. Must be set when \"support-visitor-mode\" is true.",
+ },
+ "visitor_mode_interface": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Interface for Visitor Mode. Must be set when \"support-visitor-mode\" is true. Insert IPV4 Address of existing interface or \"All IPs\" when you want all interfaces.",
+ },
+ },
+ },
+ },
+ "vpn_domain": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Gateway VPN domain identified by the name or UID.",
+ },
+ "vpn_domain_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Gateway VPN domain type.",
+ },
+ "vpn_domain_exclude_external_ip_addresses": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Exclude the external IP addresses from the VPN domain of this Security Gateway.",
+ },
+ "advanced": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Advanced VPN settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "tunnel_sharing_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Tunnel sharing mode.",
+ },
+ "shutdown_on_gateway_restart": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Shutdown VPN tunnels on gateway restart.",
+ },
+ "enable_wire_mode": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable wire mode.",
+ },
+ "wire_mode_interfaces": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Wire mode interfaces.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "enable_wire_mode_log_traffic": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Log traffic in wire mode.",
+ },
+ "enable_nat_traversal": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable NAT traversal.",
+ },
+ },
+ },
+ },
+ "exported_routes": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Exported routes.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "internal_interfaces": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Export internal interfaces.",
+ },
+ "static_routes": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Export static routes.",
+ },
+ "custom_routes": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Export custom routes.",
+ },
+ "custom_routes_object": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Custom routes object identified by the name or UID.",
+ },
+ },
+ },
+ },
+ "vpn_clients": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "VPN clients settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "enable_endpoint_security_vpn": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable Endpoint Security VPN client.",
+ },
+ "enable_cp_mobile_for_windows": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable Check Point Mobile for Windows client.",
+ },
+ "enable_secu_remote": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable SecuRemote client.",
+ },
+ "enable_capsule_vpn_connect": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable Capsule VPN Connect client.",
+ },
+ "enable_ssl_network_extender": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable SSL Network Extender client.",
+ },
+ "gateway_authentication_certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Gateway authentication certificate.",
+ },
+ },
+ },
+ },
+ "enable_clientless_vpn": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable clientless VPN.",
+ },
+ "clientless_vpn_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Clientless VPN settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "certificate_gateway_authentication": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate gateway authentication.",
+ },
+ "client_authentication": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Client authentication.",
+ },
+ "concurrent_servers_or_processes": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of concurrent servers or processes.",
+ },
+ "accept_only_3des": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Accept only 3DES.",
+ },
+ },
+ },
+ },
+ "saml_portal_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "SAML portal settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "enabled": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether the SAML portal is enabled.",
+ },
+ "portal_web_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the SAML portal web settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "aliases": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of URL aliases that are redirected to the main portal URL.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
+ "main_url": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The main URL for the portal.",
+ },
+ },
+ },
+ },
+ "certificate_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the SAML portal certificate.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate.",
+ },
+ "certificate_dn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate distinguished name.",
+ },
+ "certificate_valid_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date from which the certificate is valid.",
+ },
+ "certificate_valid_to": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date until which the certificate is valid.",
+ },
+ },
+ },
+ },
+ "accessibility": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal access settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "allow_access_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Allowed access to the SAML portal.",
+ },
+ "internal_access_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the additional portal access settings for internal interfaces only.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "undefined": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to \"Undefined\".",
+ },
+ "dmz": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to \"DMZ\".",
+ },
+ "vpn": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Controls portal access settings for interfaces that are part of a VPN Encryption Domain.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "certificates": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "VPN certificates.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate name.",
+ },
+ "stored_at": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Where the certificate is stored.",
+ },
+ "status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate status.",
+ },
+ "distinguished_name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate distinguished name.",
+ },
+ "base64_certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate encoded in Base64.",
+ },
+ "certificate_authority": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate authority identified by the name or UID.",
+ },
+ "expiration_date": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Certificate expiration date.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "interfaces": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "VPN link selection interfaces.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "interface_name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The name of the interface.",
+ },
+ "next_hop_ip": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The IP address of the next hop.",
+ },
+ "static_nat_ip": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The NATed IPv4 address that hides the source IPv4 address of outgoing connections.",
+ },
+ "priority": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Priority of a \"Backup\" interface.",
+ },
+ "redundancy_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Interface redundancy mode (Active/Backup).",
+ },
+ "ip_version": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The IP version of the interface's IP address.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "color": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Color of the object. Should be one of existing colors.",
+ },
+ "comments": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Comments string.",
+ },
+ "tags": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Collection of tag identifiers.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "anti_spam_and_email_security": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Anti-Spam & Email-Security blade enabled.",
+ },
+ "auto_topology_custom_recalculation_time": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Auto topology custom recalculation time (seconds).",
+ },
+ "auto_topology_use_custom_recalculation_time": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Auto topology to use custom recalculation time instead of default.",
+ },
+ "autonomous_system_number": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The Autonomous System Number (ASN) for this Check Point Security Gateway.",
+ },
+ "cluster_xl": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Cluster XL blade enabled.",
+ },
+ "data_loss_prevention": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Data Loss Prevention.",
+ },
+ "dns_server": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "DNS Server.",
+ },
+ "hardware_subtype": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Gateway type (relevant only for Spark gateways).",
+ },
+ "legacy_url_filtering": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Legacy URL Filtering enabled.",
+ },
+ "mobile_access": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Mobile-Access blade enabled.",
+ },
+ "monitoring": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Monitoring blade enabled.",
+ },
+ "policy_server": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Policy-Server blade enabled.",
+ },
+ "rtm_counters_report": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enables monitoring blades system counters report (e.g CPU Usage,Memory Usage).",
+ },
+ "rtm_traffic_report": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enables monitoring blades traffic report.",
+ },
+ "rtm_traffic_report_per_connection": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enables Monitoring blade traffic report per connection.",
+ },
+ "threat_extraction": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Threat Extraction blade enabled.",
+ },
+ "threat_prevention_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The mode of Threat Prevention to use. When using Autonomous Threat Prevention, disabling the Threat Prevention blades is not allowed.",
+ },
+ "workforce_ai": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Workforce AI Security blade enabled. Requires content awareness blade and version R82.20 or higher to be enabled.",
+ },
+ "communication_with_servers_behind_nat": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Gateway behind NAT communications settings with the server.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to override the Server (Check Point Host) object configuration.",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "according-to-topology: Use the original or translated IP address of the server based on the Topology of Security Gateway interfaces.
original-ip-on...",
+ },
+ },
+ },
+ },
+ "smb_logs_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Logs settings that apply to Quantum Spark Appliances that run Gaia Embedded OS.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "alert_when_queue_is_full": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Alert when queue is full enabled.",
+ },
+ "alert_when_queue_is_full_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Alert when queue is full type.",
+ },
+ "detect_new_citrix_ica_application_names": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Detect new citrix ica application names enabled.",
+ },
+ "stop_logging_when_queue_reaches_maximal_capacity": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Stop logging when queue reaches maximal capacity enabled.",
+ },
+ "stop_logging_when_queue_reaches_maximal_capacity_threshold": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Stop logging when queue reaches maximal capacity threshold.",
+ },
+ "turn_on_qos_logging": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Turn on qos logging enabled.",
+ },
+ "update_account_log_every": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Update account log in every amount of seconds.",
+ },
+ },
+ },
+ },
+ "zero_phishing_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Fqdn settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "gateway_fqdn_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Manual Fqdn.",
+ },
+ "manual_fqdn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Zero Phishing gateway FQDN.",
+ },
+ },
+ },
+ },
+ "application_control_and_url_filtering_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Gateway Application Control and URL Filtering settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "global_settings_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Whether to override global settings or not.",
+ },
+ "override_global_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "override global settings object.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "fail_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Fail mode - allow or block all requests.",
+ },
+ "website_categorization": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Website categorization object.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "radius_server": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Radius server used to authenticate the user.",
- },
- "use_allocate_method": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Use Allocate Method.",
- },
- "allocate_method": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Using either Manual (IP Pool) or Automatic (DHCP). Must be set when \"use-allocate-method\" is true.",
- },
- "manual_network": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Manual Network. Identified by name or UID. Must be set when \"allocate-method\" was selected to be \"manual\".",
- },
- "dhcp_server": {
- Type: schema.TypeString,
- Computed: true,
- Description: "DHCP Server. Identified by name or UID. Must be set when \"allocate-method\" was selected to be \"automatic\".",
- },
- "virtual_ip_address": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Virtual IPV4 address for DHCP server replies. Must be set when \"allocate-method\" was selected to be \"automatic\".",
- },
- "dhcp_mac_address": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Calculated MAC address for DHCP allocation. Must be set when \"allocate-method\" was selected to be \"automatic\".",
- },
- "optional_parameters": {
+ "custom_mode": {
Type: schema.TypeList,
Computed: true,
- Description: "This configuration applies to all Office Mode methods except Automatic (using DHCP) and ipassignment.conf entries which contain this data.",
+ Description: "Custom mode object.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "use_primary_dns_server": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Use Primary DNS Server.",
- },
- "primary_dns_server": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Primary DNS Server. Identified by name or UID. Must be set when \"use-primary-dns-server\" is true and can not be set when \"use-primary-dns-server\" is false.",
- },
- "use_first_backup_dns_server": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Use First Backup DNS Server.",
- },
- "first_backup_dns_server": {
- Type: schema.TypeString,
- Computed: true,
- Description: "First Backup DNS Server. Identified by name or UID. Must be set when \"use-first-backup-dns-server\" is true and can not be set when \"use-first-backup-dns-server\" is false.",
- },
- "use_second_backup_dns_server": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Use Second Backup DNS Server.",
- },
- "second_backup_dns_server": {
+ "social_networking_widgets": {
Type: schema.TypeString,
Computed: true,
- Description: "Second Backup DNS Server. Identified by name or UID. Must be set when \"use-second-backup-dns-server\" is true and can not be set when \"use-second-backup-dns-server\" is false.",
- },
- "dns_suffixes": {
- Type: schema.TypeString,
- Computed: true,
- Description: "DNS Suffixes.",
- },
- "use_primary_wins_server": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Use Primary WINS Server.",
- },
- "primary_wins_server": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Primary WINS Server. Identified by name or UID. Must be set when \"use-primary-wins-server\" is true and can not be set when \"use-primary-wins-server\" is false.",
+ Description: "Social networking widgets mode.",
},
- "use_first_backup_wins_server": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Use First Backup WINS Server.",
- },
- "first_backup_wins_server": {
- Type: schema.TypeString,
- Computed: true,
- Description: "First Backup WINS Server. Identified by name or UID. Must be set when \"use-first-backup-wins-server\" is true and can not be set when \"use-first-backup-wins-server\" is false.",
- },
- "use_second_backup_wins_server": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Use Second Backup WINS Server.",
- },
- "second_backup_wins_server": {
+ "url_filtering": {
Type: schema.TypeString,
Computed: true,
- Description: "Second Backup WINS Server. Identified by name or UID. Must be set when \"use-second-backup-wins-server\" is true and can not be set when \"use-second-backup-wins-server\" is false.",
- },
- "ip_lease_duration": {
- Type: schema.TypeInt,
- Computed: true,
- Description: "IP Lease Duration in Minutes. The value must be in the range 2-32767.",
+ Description: "URL filtering mode.",
},
},
},
},
+ "mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Website categorization mode.",
+ },
},
},
},
- "support_multiple_interfaces": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Support connectivity enhancement for gateways with multiple external interfaces.",
- },
- "perform_anti_spoofing": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Perform Anti-Spoofing on Office Mode addresses.",
- },
- "anti_spoofing_additional_addresses": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Additional IP Addresses for Anti-Spoofing. Identified by name or UID. Must be set when \"perform-anti-spoofings\" is true.",
- },
},
},
},
- "remote_access": {
+ },
+ },
+ },
+ "cluster_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "ClusterXL and VRRP Settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "member_recovery_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "In a High Availability cluster, each member is given a priority. The member with the highest priority serves as the gateway. If this gateway fails, co...",
+ },
+ "state_synchronization": {
Type: schema.TypeList,
Computed: true,
- Description: "Remote Access.",
+ Description: "Cluster State Synchronization settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "support_l2tp": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Support L2TP (relevant only when office mode is active).",
- },
- "l2tp_auth_method": {
- Type: schema.TypeString,
- Computed: true,
- Description: "L2TP Authentication Method. Must be set when \"support-l2tp\" is true.",
- },
- "l2tp_certificate": {
- Type: schema.TypeString,
- Computed: true,
- Description: "L2TP Certificate. Must be set when \"l2tp-auth-method\" was selected to be \"certificate\". Insert \"defaultCert\" when you want to use the default certificate.",
- },
- "allow_vpn_clients_to_route_traffic": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Allow VPN clients to route traffic.",
- },
- "support_nat_traversal_mechanism": {
+ "delayed": {
Type: schema.TypeBool,
Computed: true,
- Description: "Support NAT traversal mechanism (UDP encapsulation).",
+ Description: "Start synchronizing with delay of seconds, as defined by delayed-seconds, after connection initiation. Disabled when state-synchronization disabled.",
},
- "nat_traversal_service": {
- Type: schema.TypeString,
+ "delayed_seconds": {
+ Type: schema.TypeInt,
Computed: true,
- Description: "Allocated NAT traversal UDP service. Identified by name or UID. Must be set when \"support-nat-traversal-mechanism\" is true.",
+ Description: "Start synchronizing X seconds after connection initiation . The values must be in a range between 2 and 3600.",
},
- "support_visitor_mode": {
+ "enabled": {
Type: schema.TypeBool,
Computed: true,
- Description: "Support Visitor Mode.",
- },
- "visitor_mode_service": {
- Type: schema.TypeString,
- Computed: true,
- Description: "TCP Service for Visitor Mode. Identified by name or UID. Must be set when \"support-visitor-mode\" is true.",
- },
- "visitor_mode_interface": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Interface for Visitor Mode. Must be set when \"support-visitor-mode\" is true. Insert IPV4 Address of existing interface or \"All IPs\" when you want all interfaces.",
+ Description: "Use State Synchronization.",
},
},
},
},
- "vpn_domain": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Gateway VPN domain identified by the name or UID.",
- },
- "vpn_domain_type": {
+ "track_changes_of_cluster_members": {
Type: schema.TypeString,
Computed: true,
- Description: "Gateway VPN domain type.",
+ Description: "Track changes in the status of Cluster Members.",
},
- "vpn_domain_exclude_external_ip_addresses": {
+ "use_virtual_mac": {
Type: schema.TypeBool,
Computed: true,
- Description: "Exclude the external IP addresses from the VPN domain of this Security Gateway.",
+ Description: "Use Virtual MAC. By enabling Virtual MAC in ClusterXL High Availability New mode, or Load Sharing Unicast mode, all cluster members associate the same...",
},
},
},
},
- "color": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Color of the object. Should be one of existing colors.",
- },
- "comments": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Comments string.",
- },
- "tags": {
- Type: schema.TypeSet,
- Computed: true,
- Description: "Collection of tag identifiers.",
- Elem: &schema.Schema{
- Type: schema.TypeString,
- },
- },
},
}
}
@@ -2031,6 +3480,9 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
if v, _ := bypassOnFailureMap["value"]; v != nil {
bypassOnFailureMapToReturn["value"] = v
}
+ if v, _ := bypassOnFailureMap["profile-value"]; v != nil {
+ bypassOnFailureMapToReturn["profile_value"] = v
+ }
httpsInspectionMapToReturn["bypass_on_failure"] = []interface{}{bypassOnFailureMapToReturn}
}
}
@@ -2046,6 +3498,9 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
if v, _ := siteCategorizationAllowModeMap["value"]; v != nil {
siteCategorizationAllowModeMapToReturn["value"] = v
}
+ if v, _ := siteCategorizationAllowModeMap["profile-value"]; v != nil {
+ siteCategorizationAllowModeMapToReturn["profile_value"] = v
+ }
httpsInspectionMapToReturn["site_categorization_allow_mode"] = []interface{}{siteCategorizationAllowModeMapToReturn}
}
}
@@ -2061,6 +3516,9 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
if v, _ := denyUntrustedServerCertMap["value"]; v != nil {
denyUntrustedServerCertMapToReturn["value"] = v
}
+ if v, _ := denyUntrustedServerCertMap["profile-value"]; v != nil {
+ denyUntrustedServerCertMapToReturn["profile_value"] = v
+ }
httpsInspectionMapToReturn["deny_untrusted_server_cert"] = []interface{}{denyUntrustedServerCertMapToReturn}
}
}
@@ -2076,6 +3534,9 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
if v, _ := denyRevokedServerCertMap["value"]; v != nil {
denyRevokedServerCertMapToReturn["value"] = v
}
+ if v, _ := denyRevokedServerCertMap["profile-value"]; v != nil {
+ denyRevokedServerCertMapToReturn["profile_value"] = v
+ }
httpsInspectionMapToReturn["deny_revoked_server_cert"] = []interface{}{denyRevokedServerCertMapToReturn}
}
}
@@ -2091,9 +3552,63 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
if v, _ := denyExpiredServerCertMap["value"]; v != nil {
denyExpiredServerCertMapToReturn["value"] = v
}
+ if v, _ := denyExpiredServerCertMap["profile-value"]; v != nil {
+ denyExpiredServerCertMapToReturn["profile_value"] = v
+ }
httpsInspectionMapToReturn["deny_expired_server_cert"] = []interface{}{denyExpiredServerCertMapToReturn}
}
}
+ if v, ok := httpsInspectionMap["bypass-on-client-failure"]; ok {
+
+ bypassOnClientFailureMap, ok := v.(map[string]interface{})
+ if ok {
+ bypassOnClientFailureMapToReturn := make(map[string]interface{})
+
+ if v, _ := bypassOnClientFailureMap["override-profile"]; v != nil {
+ bypassOnClientFailureMapToReturn["override_profile"] = v
+ }
+ if v, _ := bypassOnClientFailureMap["profile-value"]; v != nil {
+ bypassOnClientFailureMapToReturn["profile_value"] = v
+ }
+ if v, _ := bypassOnClientFailureMap["value"]; v != nil {
+ bypassOnClientFailureMapToReturn["value"] = v
+ }
+ httpsInspectionMapToReturn["bypass_on_client_failure"] = []interface{}{bypassOnClientFailureMapToReturn}
+ }
+ }
+ if v, ok := httpsInspectionMap["bypass-under-load"]; ok {
+
+ bypassUnderLoadMap, ok := v.(map[string]interface{})
+ if ok {
+ bypassUnderLoadMapToReturn := make(map[string]interface{})
+
+ if v, _ := bypassUnderLoadMap["value"]; v != nil {
+ bypassUnderLoadMapToReturn["value"] = v
+ }
+ httpsInspectionMapToReturn["bypass_under_load"] = []interface{}{bypassUnderLoadMapToReturn}
+ }
+ }
+ if v, ok := httpsInspectionMap["outbound-certificate"]; ok {
+
+ outboundCertificateMap, ok := v.(map[string]interface{})
+ if ok {
+ outboundCertificateMapToReturn := make(map[string]interface{})
+
+ if v, _ := outboundCertificateMap["override-profile"]; v != nil {
+ outboundCertificateMapToReturn["override_profile"] = v
+ }
+ if v, _ := outboundCertificateMap["profile-value"]; v != nil {
+ outboundCertificateMapToReturn["profile_value"] = v.(map[string]interface{})["name"]
+ }
+ if v, _ := outboundCertificateMap["value"]; v != nil {
+ outboundCertificateMapToReturn["value"] = v.(map[string]interface{})["name"]
+ }
+ httpsInspectionMapToReturn["outbound_certificate"] = []interface{}{outboundCertificateMapToReturn}
+ }
+ }
+ if v, _ := httpsInspectionMap["deployment-mode"]; v != nil {
+ httpsInspectionMapToReturn["deployment_mode"] = v
+ }
_ = d.Set("https_inspection", []interface{}{httpsInspectionMapToReturn})
}
@@ -2125,7 +3640,62 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
browserBasedAuthenticationSettingsMapToReturn["authentication_settings"] = v
}
if v, _ := browserBasedAuthenticationSettingsMap["browser-based-authentication-portal-settings"]; v != nil {
- browserBasedAuthenticationSettingsMapToReturn["browser_based_authentication_portal_settings"] = v
+ browserBasedAuthenticationPortalSettingsMap := v.(map[string]interface{})
+ browserBasedAuthenticationPortalSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := browserBasedAuthenticationPortalSettingsMap["accessibility"]; v != nil {
+ accessibilityMap := v.(map[string]interface{})
+ accessibilityMapToReturn := make(map[string]interface{})
+ if v, _ := accessibilityMap["allow-access-from"]; v != nil {
+ accessibilityMapToReturn["allow_access_from"] = v
+ }
+ if v, _ := accessibilityMap["internal-access-settings"]; v != nil {
+ internalAccessSettingsMap := v.(map[string]interface{})
+ internalAccessSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := internalAccessSettingsMap["undefined"]; v != nil {
+ internalAccessSettingsMapToReturn["undefined"] = v
+ }
+ if v, _ := internalAccessSettingsMap["dmz"]; v != nil {
+ internalAccessSettingsMapToReturn["dmz"] = v
+ }
+ if v, _ := internalAccessSettingsMap["vpn"]; v != nil {
+ internalAccessSettingsMapToReturn["vpn"] = v
+ }
+ accessibilityMapToReturn["internal_access_settings"] = []interface{}{internalAccessSettingsMapToReturn}
+ }
+ browserBasedAuthenticationPortalSettingsMapToReturn["accessibility"] = []interface{}{accessibilityMapToReturn}
+ }
+ if v, _ := browserBasedAuthenticationPortalSettingsMap["certificate-settings"]; v != nil {
+ certificateSettingsMap := v.(map[string]interface{})
+ certificateSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := certificateSettingsMap["certificate"]; v != nil {
+ certificateSettingsMapToReturn["certificate"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-dn"]; v != nil {
+ certificateSettingsMapToReturn["certificate_dn"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-from"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_from"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-to"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_to"] = v
+ }
+ browserBasedAuthenticationPortalSettingsMapToReturn["certificate_settings"] = []interface{}{certificateSettingsMapToReturn}
+ }
+ if v, _ := browserBasedAuthenticationPortalSettingsMap["portal-web-settings"]; v != nil {
+ portalWebSettingsMap := v.(map[string]interface{})
+ portalWebSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := portalWebSettingsMap["aliases"]; v != nil {
+ portalWebSettingsMapToReturn["aliases"] = v
+ }
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
+ if v, _ := portalWebSettingsMap["main-url"]; v != nil {
+ portalWebSettingsMapToReturn["main_url"] = v
+ }
+ browserBasedAuthenticationPortalSettingsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
+ }
+ browserBasedAuthenticationSettingsMapToReturn["browser_based_authentication_portal_settings"] = []interface{}{browserBasedAuthenticationPortalSettingsMapToReturn}
}
identityAwarenessSettingsMapToReturn["browser_based_authentication_settings"] = []interface{}{browserBasedAuthenticationSettingsMapToReturn}
}
@@ -2149,7 +3719,62 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
identityAgentSettingsMapToReturn["authentication_settings"] = v
}
if v, _ := identityAgentSettingsMap["identity-agent-portal-settings"]; v != nil {
- identityAgentSettingsMapToReturn["identity_agent_portal_settings"] = v
+ identityAgentPortalSettingsMap := v.(map[string]interface{})
+ identityAgentPortalSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := identityAgentPortalSettingsMap["accessibility"]; v != nil {
+ accessibilityMap := v.(map[string]interface{})
+ accessibilityMapToReturn := make(map[string]interface{})
+ if v, _ := accessibilityMap["allow-access-from"]; v != nil {
+ accessibilityMapToReturn["allow_access_from"] = v
+ }
+ if v, _ := accessibilityMap["internal-access-settings"]; v != nil {
+ internalAccessSettingsMap := v.(map[string]interface{})
+ internalAccessSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := internalAccessSettingsMap["undefined"]; v != nil {
+ internalAccessSettingsMapToReturn["undefined"] = v
+ }
+ if v, _ := internalAccessSettingsMap["dmz"]; v != nil {
+ internalAccessSettingsMapToReturn["dmz"] = v
+ }
+ if v, _ := internalAccessSettingsMap["vpn"]; v != nil {
+ internalAccessSettingsMapToReturn["vpn"] = v
+ }
+ accessibilityMapToReturn["internal_access_settings"] = []interface{}{internalAccessSettingsMapToReturn}
+ }
+ identityAgentPortalSettingsMapToReturn["accessibility"] = []interface{}{accessibilityMapToReturn}
+ }
+ if v, _ := identityAgentPortalSettingsMap["certificate-settings"]; v != nil {
+ certificateSettingsMap := v.(map[string]interface{})
+ certificateSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := certificateSettingsMap["certificate"]; v != nil {
+ certificateSettingsMapToReturn["certificate"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-dn"]; v != nil {
+ certificateSettingsMapToReturn["certificate_dn"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-from"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_from"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-to"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_to"] = v
+ }
+ identityAgentPortalSettingsMapToReturn["certificate_settings"] = []interface{}{certificateSettingsMapToReturn}
+ }
+ if v, _ := identityAgentPortalSettingsMap["portal-web-settings"]; v != nil {
+ portalWebSettingsMap := v.(map[string]interface{})
+ portalWebSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := portalWebSettingsMap["aliases"]; v != nil {
+ portalWebSettingsMapToReturn["aliases"] = v
+ }
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
+ if v, _ := portalWebSettingsMap["main-url"]; v != nil {
+ portalWebSettingsMapToReturn["main_url"] = v
+ }
+ identityAgentPortalSettingsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
+ }
+ identityAgentSettingsMapToReturn["identity_agent_portal_settings"] = []interface{}{identityAgentPortalSettingsMapToReturn}
}
identityAwarenessSettingsMapToReturn["identity_agent_settings"] = []interface{}{identityAgentSettingsMapToReturn}
}
@@ -2170,7 +3795,62 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
identityCollectorSettingsMapToReturn["authentication_settings"] = v
}
if v, _ := identityCollectorSettingsMap["client-access-permissions"]; v != nil {
- identityCollectorSettingsMapToReturn["client_access_permissions"] = v
+ clientAccessPermissionsMap := v.(map[string]interface{})
+ clientAccessPermissionsMapToReturn := make(map[string]interface{})
+ if v, _ := clientAccessPermissionsMap["accessibility"]; v != nil {
+ accessibilityMap := v.(map[string]interface{})
+ accessibilityMapToReturn := make(map[string]interface{})
+ if v, _ := accessibilityMap["allow-access-from"]; v != nil {
+ accessibilityMapToReturn["allow_access_from"] = v
+ }
+ if v, _ := accessibilityMap["internal-access-settings"]; v != nil {
+ internalAccessSettingsMap := v.(map[string]interface{})
+ internalAccessSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := internalAccessSettingsMap["undefined"]; v != nil {
+ internalAccessSettingsMapToReturn["undefined"] = v
+ }
+ if v, _ := internalAccessSettingsMap["dmz"]; v != nil {
+ internalAccessSettingsMapToReturn["dmz"] = v
+ }
+ if v, _ := internalAccessSettingsMap["vpn"]; v != nil {
+ internalAccessSettingsMapToReturn["vpn"] = v
+ }
+ accessibilityMapToReturn["internal_access_settings"] = []interface{}{internalAccessSettingsMapToReturn}
+ }
+ clientAccessPermissionsMapToReturn["accessibility"] = []interface{}{accessibilityMapToReturn}
+ }
+ if v, _ := clientAccessPermissionsMap["certificate-settings"]; v != nil {
+ certificateSettingsMap := v.(map[string]interface{})
+ certificateSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := certificateSettingsMap["certificate"]; v != nil {
+ certificateSettingsMapToReturn["certificate"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-dn"]; v != nil {
+ certificateSettingsMapToReturn["certificate_dn"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-from"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_from"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-to"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_to"] = v
+ }
+ clientAccessPermissionsMapToReturn["certificate_settings"] = []interface{}{certificateSettingsMapToReturn}
+ }
+ if v, _ := clientAccessPermissionsMap["portal-web-settings"]; v != nil {
+ portalWebSettingsMap := v.(map[string]interface{})
+ portalWebSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := portalWebSettingsMap["aliases"]; v != nil {
+ portalWebSettingsMapToReturn["aliases"] = v
+ }
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
+ if v, _ := portalWebSettingsMap["main-url"]; v != nil {
+ portalWebSettingsMapToReturn["main_url"] = v
+ }
+ clientAccessPermissionsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
+ }
+ identityCollectorSettingsMapToReturn["client_access_permissions"] = []interface{}{clientAccessPermissionsMapToReturn}
}
identityAwarenessSettingsMapToReturn["identity_collector_settings"] = []interface{}{identityCollectorSettingsMapToReturn}
}
@@ -2190,6 +3870,40 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
if v, _ := identitySharingSettingsMap["receive-from"]; v != nil {
identitySharingSettingsMapToReturn["receive_from"] = v
}
+ if v, _ := identitySharingSettingsMap["cache-mode"]; v != nil {
+ cacheModeMap := v.(map[string]interface{})
+ cacheModeMapToReturn := make(map[string]interface{})
+ if v, _ := cacheModeMap["override-profile"]; v != nil {
+ cacheModeMapToReturn["override_profile"] = v
+ }
+ if v, _ := cacheModeMap["value"]; v != nil {
+ cacheModeMapToReturn["value"] = v
+ }
+ if v, _ := cacheModeMap["profile-value"]; v != nil {
+ cacheModeMapToReturn["profile_value"] = v
+ }
+ identitySharingSettingsMapToReturn["cache_mode"] = []interface{}{cacheModeMapToReturn}
+ }
+ if v, _ := identitySharingSettingsMap["cache-mode-duration"]; v != nil {
+ cacheModeDurationMap := v.(map[string]interface{})
+ cacheModeDurationMapToReturn := make(map[string]interface{})
+ if v, _ := cacheModeDurationMap["override-profile"]; v != nil {
+ cacheModeDurationMapToReturn["override_profile"] = v
+ }
+ if v, _ := cacheModeDurationMap["value"]; v != nil {
+ cacheModeDurationMapToReturn["value"] = v
+ }
+ if v, _ := cacheModeDurationMap["profile-value"]; v != nil {
+ cacheModeDurationMapToReturn["profile_value"] = v
+ }
+ identitySharingSettingsMapToReturn["cache_mode_duration"] = []interface{}{cacheModeDurationMapToReturn}
+ }
+ if v, _ := identitySharingSettingsMap["receive-from-infinity-identity"]; v != nil {
+ identitySharingSettingsMapToReturn["receive_from_infinity_identity"] = v
+ }
+ if v, _ := identitySharingSettingsMap["scaled-sharing"]; v != nil {
+ identitySharingSettingsMapToReturn["scaled_sharing"] = v
+ }
identityAwarenessSettingsMapToReturn["identity_sharing_settings"] = []interface{}{identitySharingSettingsMapToReturn}
}
}
@@ -2208,6 +3922,124 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
if v := identityAwarenessSettingsMap["remote-access"]; v != nil {
identityAwarenessSettingsMapToReturn["remote_access"] = v
}
+ if v := identityAwarenessSettingsMap["identity-web-api"]; v != nil {
+ identityAwarenessSettingsMapToReturn["identity_web_api"] = v
+ }
+ if v := identityAwarenessSettingsMap["identity-web-api-settings"]; v != nil {
+ identityWebApiSettingsJson := v.(map[string]interface{})
+ identityWebApiSettingsState := make(map[string]interface{})
+ if v := identityWebApiSettingsJson["authentication-settings"]; v != nil {
+ authenticationSettingsJson := v.(map[string]interface{})
+ authenticationSettingsState := make(map[string]interface{})
+ if v := authenticationSettingsJson["users-directories"]; v != nil {
+ usersDirectoriesJson := v.(map[string]interface{})
+ usersDirectoriesState := make(map[string]interface{})
+ if v := usersDirectoriesJson["external-user-profile"]; v != nil {
+ usersDirectoriesState["external_user_profile"] = v
+ }
+ if v := usersDirectoriesJson["internal-users"]; v != nil {
+ usersDirectoriesState["internal_users"] = v
+ }
+ if v := usersDirectoriesJson["users-from-external-directories"]; v != nil {
+ usersDirectoriesState["users_from_external_directories"] = v
+ }
+ if v := usersDirectoriesJson["specific"]; v != nil {
+ usersDirectoriesState["specific"] = v
+ }
+ authenticationSettingsState["users_directories"] = []interface{}{usersDirectoriesState}
+ }
+ identityWebApiSettingsState["authentication_settings"] = []interface{}{authenticationSettingsState}
+ }
+ if v := identityWebApiSettingsJson["authorized-clients"]; v != nil {
+ authorizedClientsList := v.([]interface{})
+ if len(authorizedClientsList) > 0 {
+ var authorizedClientsListState []map[string]interface{}
+ for i := range authorizedClientsList {
+ authorizedClientsItemJson := authorizedClientsList[i].(map[string]interface{})
+ authorizedClientsItemState := make(map[string]interface{})
+ if v := authorizedClientsItemJson["client"]; v != nil {
+ authorizedClientsItemState["client"] = v
+ }
+ authorizedClientsListState = append(authorizedClientsListState, authorizedClientsItemState)
+ }
+ identityWebApiSettingsState["authorized_clients"] = authorizedClientsListState
+ }
+ }
+ if v := identityWebApiSettingsJson["client-access-permissions"]; v != nil {
+ clientAccessPermissionsJson := v.(map[string]interface{})
+ clientAccessPermissionsState := make(map[string]interface{})
+ if v := clientAccessPermissionsJson["accessibility"]; v != nil {
+ accessibilityJson := v.(map[string]interface{})
+ accessibilityState := make(map[string]interface{})
+ if v := accessibilityJson["allow-access-from"]; v != nil {
+ accessibilityState["allow_access_from"] = v
+ }
+ if v := accessibilityJson["internal-access-settings"]; v != nil {
+ internalAccessSettingsJson := v.(map[string]interface{})
+ internalAccessSettingsState := make(map[string]interface{})
+ if v := internalAccessSettingsJson["undefined"]; v != nil {
+ internalAccessSettingsState["undefined"] = v
+ }
+ if v := internalAccessSettingsJson["dmz"]; v != nil {
+ internalAccessSettingsState["dmz"] = v
+ }
+ if v := internalAccessSettingsJson["vpn"]; v != nil {
+ internalAccessSettingsState["vpn"] = v
+ }
+ accessibilityState["internal_access_settings"] = []interface{}{internalAccessSettingsState}
+ }
+ clientAccessPermissionsState["accessibility"] = []interface{}{accessibilityState}
+ }
+ if v := clientAccessPermissionsJson["certificate-settings"]; v != nil {
+ certificateSettingsJson := v.(map[string]interface{})
+ certificateSettingsState := make(map[string]interface{})
+ if v := certificateSettingsJson["certificate"]; v != nil {
+ certificateSettingsState["certificate"] = v
+ }
+ if v := certificateSettingsJson["certificate-dn"]; v != nil {
+ certificateSettingsState["certificate_dn"] = v
+ }
+ if v := certificateSettingsJson["certificate-valid-from"]; v != nil {
+ certificateSettingsState["certificate_valid_from"] = v
+ }
+ if v := certificateSettingsJson["certificate-valid-to"]; v != nil {
+ certificateSettingsState["certificate_valid_to"] = v
+ }
+ clientAccessPermissionsState["certificate_settings"] = []interface{}{certificateSettingsState}
+ }
+ if v := clientAccessPermissionsJson["portal-web-settings"]; v != nil {
+ portalWebSettingsJson := v.(map[string]interface{})
+ portalWebSettingsState := make(map[string]interface{})
+ if v := portalWebSettingsJson["aliases"]; v != nil {
+ portalWebSettingsState["aliases"] = v
+ }
+ if v := portalWebSettingsJson["ip-address"]; v != nil {
+ portalWebSettingsState["ip_address"] = v
+ }
+ if v := portalWebSettingsJson["main-url"]; v != nil {
+ portalWebSettingsState["main_url"] = v
+ }
+ clientAccessPermissionsState["portal_web_settings"] = []interface{}{portalWebSettingsState}
+ }
+ identityWebApiSettingsState["client_access_permissions"] = []interface{}{clientAccessPermissionsState}
+ }
+ identityAwarenessSettingsMapToReturn["identity_web_api_settings"] = []interface{}{identityWebApiSettingsState}
+ }
+ if v := identityAwarenessSettingsMap["ad-query"]; v != nil {
+ identityAwarenessSettingsMapToReturn["ad_query"] = v
+ }
+ if v := identityAwarenessSettingsMap["collecting-identities"]; v != nil {
+ identityAwarenessSettingsMapToReturn["collecting_identities"] = v
+ }
+ if v := identityAwarenessSettingsMap["identity-based-enforcement"]; v != nil {
+ identityAwarenessSettingsMapToReturn["identity_based_enforcement"] = v
+ }
+ if v := identityAwarenessSettingsMap["radius-accounting"]; v != nil {
+ identityAwarenessSettingsMapToReturn["radius_accounting"] = v
+ }
+ if v := identityAwarenessSettingsMap["terminal-servers"]; v != nil {
+ identityAwarenessSettingsMapToReturn["terminal_servers"] = v
+ }
_ = d.Set("identity_awareness_settings", []interface{}{identityAwarenessSettingsMapToReturn})
}
@@ -2248,6 +4080,9 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
natSettingsMapToReturn["method"] = v
}
+ if v := natSettingsMap["apply-control-connections"]; v != nil {
+ natSettingsMapToReturn["apply_control_connections"] = v
+ }
_ = d.Set("nat_settings", []interface{}{natSettingsMapToReturn})
} else {
@@ -2273,6 +4108,9 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
if v, _ := portalWebSettingsMap["main-url"]; v != nil {
portalWebSettingsMapToReturn["main_url"] = v
}
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
platformPortalSettingsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
}
}
@@ -2285,8 +4123,17 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
if v, _ := certificateSettingsMap["base64-certificate"]; v != nil {
certificateSettingsMapToReturn["base64_certificate"] = v
}
- if v, _ := certificateSettingsMap["base64-password"]; v != nil {
- certificateSettingsMapToReturn["base64_password"] = v
+ if v, _ := certificateSettingsMap["certificate"]; v != nil {
+ certificateSettingsMapToReturn["certificate"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-dn"]; v != nil {
+ certificateSettingsMapToReturn["certificate_dn"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-from"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_from"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-to"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_to"] = v
}
platformPortalSettingsMapToReturn["certificate_settings"] = []interface{}{certificateSettingsMapToReturn}
}
@@ -2306,6 +4153,9 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
platformPortalSettingsMapToReturn["accessibility"] = []interface{}{accessibilityMapToReturn}
}
}
+ if v := platformPortalSettingsMap["enabled"]; v != nil {
+ platformPortalSettingsMapToReturn["enabled"] = v
+ }
_ = d.Set("platform_portal_settings", []interface{}{platformPortalSettingsMapToReturn})
}
@@ -2361,6 +4211,9 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
if v, _ := portalWebSettingsMap["main-url"]; v != nil {
portalWebSettingsMapToReturn["main_url"] = v
}
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
usercheckPortalSettingsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
}
}
@@ -2373,8 +4226,17 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
if v, _ := certificateSettingsMap["base64-certificate"]; v != nil {
certificateSettingsMapToReturn["base64_certificate"] = v
}
- if v, _ := certificateSettingsMap["base64-password"]; v != nil {
- certificateSettingsMapToReturn["base64_password"] = v
+ if v, _ := certificateSettingsMap["certificate"]; v != nil {
+ certificateSettingsMapToReturn["certificate"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-dn"]; v != nil {
+ certificateSettingsMapToReturn["certificate_dn"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-from"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_from"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-to"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_to"] = v
}
usercheckPortalSettingsMapToReturn["certificate_settings"] = []interface{}{certificateSettingsMapToReturn}
}
@@ -2812,6 +4674,12 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
logsSettingsMapToReturn["update_account_log_every"] = v
}
+ if v := logsSettingsMap["distribute-logs-between-all-active-servers"]; v != nil {
+ logsSettingsMapToReturn["distribute_logs_between_all_active_servers"] = v
+ }
+ if v := logsSettingsMap["include-tcp-state-information"]; v != nil {
+ logsSettingsMapToReturn["include_tcp_state_information"] = v
+ }
_ = d.Set("logs_settings", []interface{}{logsSettingsMapToReturn})
} else {
@@ -2865,6 +4733,135 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
}
authenticationState["authentication_clients"] = clientsIds
}
+ if v := authenticationJson["single-authentication-client"]; v != nil {
+ singleAuthenticationClientJson := v.(map[string]interface{})
+ singleAuthenticationClientState := make(map[string]interface{})
+ if v := singleAuthenticationClientJson["enabled"]; v != nil {
+ singleAuthenticationClientState["enabled"] = v
+ }
+ if v := singleAuthenticationClientJson["allow-multiple-authentication-clients"]; v != nil {
+ singleAuthenticationClientState["allow_multiple_authentication_clients"] = v
+ }
+ if v := singleAuthenticationClientJson["display-name"]; v != nil {
+ singleAuthenticationClientState["display_name"] = v
+ }
+ if v := singleAuthenticationClientJson["method"]; v != nil {
+ singleAuthenticationClientState["method"] = v
+ }
+ if v := singleAuthenticationClientJson["secur-id"]; v != nil {
+ securIdJson := v.(map[string]interface{})
+ securIdState := make(map[string]interface{})
+ if v := securIdJson["server"]; v != nil {
+ securIdState["server"] = v.(map[string]interface{})["name"]
+ }
+ if v := securIdJson["token-card-type"]; v != nil {
+ securIdState["token_card_type"] = v
+ }
+ singleAuthenticationClientState["secur_id"] = []interface{}{securIdState}
+ }
+ if v := singleAuthenticationClientJson["radius"]; v != nil {
+ radiusJson := v.(map[string]interface{})
+ radiusState := make(map[string]interface{})
+ if v := radiusJson["server"]; v != nil {
+ radiusState["server"] = v.(map[string]interface{})["name"]
+ }
+ if v := radiusJson["ask-user-password"]; v != nil {
+ radiusState["ask_user_password"] = v
+ }
+ singleAuthenticationClientState["radius"] = []interface{}{radiusState}
+ }
+ if v := singleAuthenticationClientJson["personal-certificate"]; v != nil {
+ personalCertificateJson := v.(map[string]interface{})
+ personalCertificateState := make(map[string]interface{})
+ if v := personalCertificateJson["fetch-username-from"]; v != nil {
+ personalCertificateState["fetch_username_from"] = v
+ }
+ if v := personalCertificateJson["storage-type"]; v != nil {
+ personalCertificateState["storage_type"] = v
+ }
+ if v := personalCertificateJson["source"]; v != nil {
+ personalCertificateState["source"] = v
+ }
+ if v := personalCertificateJson["dn-part"]; v != nil {
+ personalCertificateState["dn_part"] = v
+ }
+ if v := personalCertificateJson["dn-concurrence"]; v != nil {
+ personalCertificateState["dn_concurrence"] = v
+ }
+ singleAuthenticationClientState["personal_certificate"] = []interface{}{personalCertificateState}
+ }
+ if v := singleAuthenticationClientJson["client-display-settings"]; v != nil {
+ clientDisplaySettingsJson := v.(map[string]interface{})
+ clientDisplaySettingsState := make(map[string]interface{})
+ if v := clientDisplaySettingsJson["headline"]; v != nil {
+ clientDisplaySettingsState["headline"] = v
+ }
+ if v := clientDisplaySettingsJson["username-label"]; v != nil {
+ clientDisplaySettingsState["username_label"] = v
+ }
+ if v := clientDisplaySettingsJson["password-label"]; v != nil {
+ clientDisplaySettingsState["password_label"] = v
+ }
+ singleAuthenticationClientState["client_display_settings"] = []interface{}{clientDisplaySettingsState}
+ }
+ authenticationState["single_authentication_client"] = []interface{}{singleAuthenticationClientState}
+ }
+ if v := authenticationJson["override-global-dynamic-id-settings"]; v != nil {
+ authenticationState["override_global_dynamic_id_settings"] = v
+ }
+ if v := authenticationJson["dynamic-id-settings"]; v != nil {
+ dynamicIdSettingsJson := v.(map[string]interface{})
+ dynamicIdSettingsState := make(map[string]interface{})
+ if v := dynamicIdSettingsJson["sms-provider-and-email-settings"]; v != nil {
+ dynamicIdSettingsState["sms_provider_and_email_settings"] = v
+ }
+ if v := dynamicIdSettingsJson["sms-provider-credentials"]; v != nil {
+ smsProviderCredentialsJson := v.(map[string]interface{})
+ smsProviderCredentialsState := make(map[string]interface{})
+ if v := smsProviderCredentialsJson["username"]; v != nil {
+ smsProviderCredentialsState["username"] = v
+ }
+ if v := smsProviderCredentialsJson["api-id"]; v != nil {
+ smsProviderCredentialsState["api_id"] = v
+ }
+ dynamicIdSettingsState["sms_provider_credentials"] = []interface{}{smsProviderCredentialsState}
+ }
+ if v := dynamicIdSettingsJson["advanced-settings"]; v != nil {
+ advancedSettingsJson := v.(map[string]interface{})
+ advancedSettingsState := make(map[string]interface{})
+ if v := advancedSettingsJson["dynamic-id-message"]; v != nil {
+ advancedSettingsState["dynamic_id_message"] = v
+ }
+ if v := advancedSettingsJson["otp-settings"]; v != nil {
+ otpSettingsJson := v.(map[string]interface{})
+ otpSettingsState := make(map[string]interface{})
+ if v := otpSettingsJson["length"]; v != nil {
+ otpSettingsState["length"] = v
+ }
+ if v := otpSettingsJson["expiration"]; v != nil {
+ otpSettingsState["expiration"] = v
+ }
+ if v := otpSettingsJson["max-attempts"]; v != nil {
+ otpSettingsState["max_attempts"] = v
+ }
+ advancedSettingsState["otp_settings"] = []interface{}{otpSettingsState}
+ }
+ if v := advancedSettingsJson["enable-display-user-details"]; v != nil {
+ advancedSettingsState["enable_display_user_details"] = v
+ }
+ if v := advancedSettingsJson["country-code"]; v != nil {
+ advancedSettingsState["country_code"] = v
+ }
+ if v := advancedSettingsJson["user-details-retrieval"]; v != nil {
+ advancedSettingsState["user_details_retrieval"] = v
+ }
+ dynamicIdSettingsState["advanced_settings"] = []interface{}{advancedSettingsState}
+ }
+ authenticationState["dynamic_id_settings"] = []interface{}{dynamicIdSettingsState}
+ }
+ if v := authenticationJson["send-machine-certificate"]; v != nil {
+ authenticationState["send_machine_certificate"] = v
+ }
vpnSettingsState["authentication"] = []interface{}{authenticationState}
}
@@ -2880,6 +4877,41 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
if v := linkSelectionJson["ip-address"]; v != nil {
linkSelectionState["ip_address"] = v
}
+ if v := linkSelectionJson["route-selection-method"]; v != nil {
+ linkSelectionState["route_selection_method"] = v
+ }
+ if v := linkSelectionJson["responding-traffic"]; v != nil {
+ linkSelectionState["responding_traffic"] = v
+ }
+ if v := linkSelectionJson["source-ip-selection"]; v != nil {
+ linkSelectionState["source_ip_selection"] = v
+ }
+ if v := linkSelectionJson["selected-ip"]; v != nil {
+ linkSelectionState["selected_ip"] = v
+ }
+ if v := linkSelectionJson["outgoing-link-tracking"]; v != nil {
+ linkSelectionState["outgoing_link_tracking"] = v
+ }
+ if v := linkSelectionJson["probing-settings"]; v != nil {
+ probingSettingsJson := v.(map[string]interface{})
+ probingSettingsState := make(map[string]interface{})
+ if v := probingSettingsJson["probed-interfaces"]; v != nil {
+ probingSettingsState["probed_interfaces"] = v
+ }
+ if v := probingSettingsJson["probed-interface-list"]; v != nil {
+ probingSettingsState["probed_interface_list"] = v
+ }
+ if v := probingSettingsJson["use-primary-address"]; v != nil {
+ probingSettingsState["use_primary_address"] = v
+ }
+ if v := probingSettingsJson["primary-address"]; v != nil {
+ probingSettingsState["primary_address"] = v
+ }
+ if v := probingSettingsJson["probing-method"]; v != nil {
+ probingSettingsState["probing_method"] = v
+ }
+ linkSelectionState["probing_settings"] = []interface{}{probingSettingsState}
+ }
vpnSettingsState["link_selection"] = []interface{}{linkSelectionState}
}
if v := vpnSettingsJson["maximum-concurrent-ike-negotiations"]; v != nil {
@@ -3023,6 +5055,237 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
}
vpnSettingsState["office_mode"] = []interface{}{officeModeState}
}
+
+ if v := vpnSettingsJson["advanced"]; v != nil {
+ advancedJson := v.(map[string]interface{})
+ advancedState := make(map[string]interface{})
+ if v := advancedJson["tunnel-sharing-mode"]; v != nil {
+ advancedState["tunnel_sharing_mode"] = v
+ }
+ if v := advancedJson["shutdown-on-gateway-restart"]; v != nil {
+ advancedState["shutdown_on_gateway_restart"] = v
+ }
+ if v := advancedJson["enable-wire-mode"]; v != nil {
+ advancedState["enable_wire_mode"] = v
+ }
+ if v := advancedJson["wire-mode-interfaces"]; v != nil {
+ interfacesJson := v.([]interface{})
+ var interfacesIds = make([]string, 0)
+ if len(interfacesJson) > 0 {
+ for _, iface := range interfacesJson {
+ interfacesIds = append(interfacesIds, iface.(map[string]interface{})["name"].(string))
+ }
+ }
+ advancedState["wire_mode_interfaces"] = interfacesIds
+ }
+ if v := advancedJson["enable-wire-mode-log-traffic"]; v != nil {
+ advancedState["enable_wire_mode_log_traffic"] = v
+ }
+ if v := advancedJson["enable-nat-traversal"]; v != nil {
+ advancedState["enable_nat_traversal"] = v
+ }
+ vpnSettingsState["advanced"] = []interface{}{advancedState}
+ }
+
+ if v := vpnSettingsJson["exported-routes"]; v != nil {
+ exportedRoutesJson := v.(map[string]interface{})
+ exportedRoutesState := make(map[string]interface{})
+ if v := exportedRoutesJson["internal-interfaces"]; v != nil {
+ exportedRoutesState["internal_interfaces"] = v
+ }
+ if v := exportedRoutesJson["static-routes"]; v != nil {
+ exportedRoutesState["static_routes"] = v
+ }
+ if v := exportedRoutesJson["custom-routes"]; v != nil {
+ exportedRoutesState["custom_routes"] = v
+ }
+ if v := exportedRoutesJson["custom-routes-object"]; v != nil {
+ exportedRoutesState["custom_routes_object"] = v.(map[string]interface{})["name"]
+ }
+ vpnSettingsState["exported_routes"] = []interface{}{exportedRoutesState}
+ }
+
+ if v := vpnSettingsJson["vpn-clients"]; v != nil {
+ vpnClientsJson := v.(map[string]interface{})
+ vpnClientsState := make(map[string]interface{})
+ if v := vpnClientsJson["enable-endpoint-security-vpn"]; v != nil {
+ vpnClientsState["enable_endpoint_security_vpn"] = v
+ }
+ if v := vpnClientsJson["enable-cp-mobile-for-windows"]; v != nil {
+ vpnClientsState["enable_cp_mobile_for_windows"] = v
+ }
+ if v := vpnClientsJson["enable-secu-remote"]; v != nil {
+ vpnClientsState["enable_secu_remote"] = v
+ }
+ if v := vpnClientsJson["enable-capsule-vpn-connect"]; v != nil {
+ vpnClientsState["enable_capsule_vpn_connect"] = v
+ }
+ if v := vpnClientsJson["enable-ssl-network-extender"]; v != nil {
+ vpnClientsState["enable_ssl_network_extender"] = v
+ }
+ if v := vpnClientsJson["gateway-authentication-certificate"]; v != nil {
+ vpnClientsState["gateway_authentication_certificate"] = v
+ }
+ vpnSettingsState["vpn_clients"] = []interface{}{vpnClientsState}
+ }
+
+ if v := vpnSettingsJson["enable-clientless-vpn"]; v != nil {
+ vpnSettingsState["enable_clientless_vpn"] = v
+ }
+
+ if v := vpnSettingsJson["clientless-vpn-settings"]; v != nil {
+ clientlessVpnSettingsJson := v.(map[string]interface{})
+ clientlessVpnSettingsState := make(map[string]interface{})
+ if v := clientlessVpnSettingsJson["certificate-gateway-authentication"]; v != nil {
+ clientlessVpnSettingsState["certificate_gateway_authentication"] = v
+ }
+ if v := clientlessVpnSettingsJson["client-authentication"]; v != nil {
+ clientlessVpnSettingsState["client_authentication"] = v
+ }
+ if v := clientlessVpnSettingsJson["concurrent-servers-or-processes"]; v != nil {
+ clientlessVpnSettingsState["concurrent_servers_or_processes"] = v
+ }
+ if v := clientlessVpnSettingsJson["accept-only-3des"]; v != nil {
+ clientlessVpnSettingsState["accept_only_3des"] = v
+ }
+ vpnSettingsState["clientless_vpn_settings"] = []interface{}{clientlessVpnSettingsState}
+ }
+
+ if v := vpnSettingsJson["saml-portal-settings"]; v != nil {
+ samlPortalSettingsJson := v.(map[string]interface{})
+ samlPortalSettingsState := make(map[string]interface{})
+ if v := samlPortalSettingsJson["enabled"]; v != nil {
+ samlPortalSettingsState["enabled"] = v
+ }
+ if v := samlPortalSettingsJson["portal-web-settings"]; v != nil {
+ portalWebSettingsJson := v.(map[string]interface{})
+ portalWebSettingsState := make(map[string]interface{})
+ if v := portalWebSettingsJson["aliases"]; v != nil {
+ portalWebSettingsState["aliases"] = v
+ }
+ if v := portalWebSettingsJson["ip-address"]; v != nil {
+ portalWebSettingsState["ip_address"] = v
+ }
+ if v := portalWebSettingsJson["main-url"]; v != nil {
+ portalWebSettingsState["main_url"] = v
+ }
+ samlPortalSettingsState["portal_web_settings"] = []interface{}{portalWebSettingsState}
+ }
+ if v := samlPortalSettingsJson["certificate-settings"]; v != nil {
+ certificateSettingsJson := v.(map[string]interface{})
+ certificateSettingsState := make(map[string]interface{})
+ if v := certificateSettingsJson["certificate"]; v != nil {
+ certificateSettingsState["certificate"] = v
+ }
+ if v := certificateSettingsJson["certificate-dn"]; v != nil {
+ certificateSettingsState["certificate_dn"] = v
+ }
+ if v := certificateSettingsJson["certificate-valid-from"]; v != nil {
+ certificateSettingsState["certificate_valid_from"] = v
+ }
+ if v := certificateSettingsJson["certificate-valid-to"]; v != nil {
+ certificateSettingsState["certificate_valid_to"] = v
+ }
+ samlPortalSettingsState["certificate_settings"] = []interface{}{certificateSettingsState}
+ }
+ if v := samlPortalSettingsJson["accessibility"]; v != nil {
+ accessibilityJson := v.(map[string]interface{})
+ accessibilityState := make(map[string]interface{})
+ if v := accessibilityJson["allow-access-from"]; v != nil {
+ accessibilityState["allow_access_from"] = v
+ }
+ if v := accessibilityJson["internal-access-settings"]; v != nil {
+ internalAccessSettingsJson := v.(map[string]interface{})
+ internalAccessSettingsState := make(map[string]interface{})
+ if v := internalAccessSettingsJson["undefined"]; v != nil {
+ internalAccessSettingsState["undefined"] = v
+ }
+ if v := internalAccessSettingsJson["dmz"]; v != nil {
+ internalAccessSettingsState["dmz"] = v
+ }
+ if v := internalAccessSettingsJson["vpn"]; v != nil {
+ internalAccessSettingsState["vpn"] = v
+ }
+ accessibilityState["internal_access_settings"] = []interface{}{internalAccessSettingsState}
+ }
+ samlPortalSettingsState["accessibility"] = []interface{}{accessibilityState}
+ }
+ vpnSettingsState["saml_portal_settings"] = []interface{}{samlPortalSettingsState}
+ }
+
+ if v := vpnSettingsJson["certificates"]; v != nil {
+ certificatesList := v.([]interface{})
+ if len(certificatesList) > 0 {
+ var certificatesListState []map[string]interface{}
+ for i := range certificatesList {
+ certificateJson := certificatesList[i].(map[string]interface{})
+ certificateState := make(map[string]interface{})
+ if v := certificateJson["name"]; v != nil {
+ certificateState["name"] = v
+ }
+ if v := certificateJson["stored-at"]; v != nil {
+ certificateState["stored_at"] = v
+ }
+ if v := certificateJson["status"]; v != nil {
+ certificateState["status"] = v
+ }
+ if v := certificateJson["distinguished-name"]; v != nil {
+ certificateState["distinguished_name"] = v
+ }
+ if v := certificateJson["base64-certificate"]; v != nil {
+ certificateState["base64_certificate"] = v
+ }
+ if v := certificateJson["certificate-authority"]; v != nil {
+ certificateState["certificate_authority"] = v.(map[string]interface{})["name"]
+ }
+ if v := certificateJson["expiration-date"]; v != nil {
+ expirationDateJson := v.(map[string]interface{})
+ expirationDateState := make(map[string]interface{})
+ if v := expirationDateJson["iso-8601"]; v != nil {
+ expirationDateState["iso_8601"] = v
+ }
+ if v := expirationDateJson["posix"]; v != nil {
+ expirationDateState["posix"] = v
+ }
+ certificateState["expiration_date"] = []interface{}{expirationDateState}
+ }
+ certificatesListState = append(certificatesListState, certificateState)
+ }
+ vpnSettingsState["certificates"] = certificatesListState
+ }
+ }
+
+ if v := vpnSettingsJson["interfaces"]; v != nil {
+ interfacesList := v.([]interface{})
+ if len(interfacesList) > 0 {
+ var interfacesListState []map[string]interface{}
+ for i := range interfacesList {
+ interfacesItemJson := interfacesList[i].(map[string]interface{})
+ interfacesItemState := make(map[string]interface{})
+ if v := interfacesItemJson["interface-name"]; v != nil {
+ interfacesItemState["interface_name"] = v
+ }
+ if v := interfacesItemJson["next-hop-ip"]; v != nil {
+ interfacesItemState["next_hop_ip"] = v
+ }
+ if v := interfacesItemJson["static-nat-ip"]; v != nil {
+ interfacesItemState["static_nat_ip"] = v
+ }
+ if v := interfacesItemJson["priority"]; v != nil {
+ interfacesItemState["priority"] = v
+ }
+ if v := interfacesItemJson["redundancy-mode"]; v != nil {
+ interfacesItemState["redundancy_mode"] = v
+ }
+ if v := interfacesItemJson["ip-version"]; v != nil {
+ interfacesItemState["ip_version"] = v
+ }
+ interfacesListState = append(interfacesListState, interfacesItemState)
+ }
+ vpnSettingsState["interfaces"] = interfacesListState
+ }
+ }
+
_ = d.Set("vpn_settings", []interface{}{vpnSettingsState})
} else {
_ = d.Set("vpn_settings", nil)
@@ -3049,5 +5312,193 @@ func dataSourceManagementSimpleClusterRead(d *schema.ResourceData, m interface{}
_ = d.Set("color", v)
}
+ if v := cluster["anti-spam-and-email-security"]; v != nil {
+ _ = d.Set("anti_spam_and_email_security", v)
+ }
+
+ if v := cluster["auto-topology-custom-recalculation-time"]; v != nil {
+ _ = d.Set("auto_topology_custom_recalculation_time", v)
+ }
+
+ if v := cluster["auto-topology-use-custom-recalculation-time"]; v != nil {
+ _ = d.Set("auto_topology_use_custom_recalculation_time", v)
+ }
+
+ if v := cluster["autonomous-system-number"]; v != nil {
+ _ = d.Set("autonomous_system_number", v)
+ }
+
+ if v := cluster["cluster-xl"]; v != nil {
+ _ = d.Set("cluster_xl", v)
+ }
+
+ if v := cluster["data-loss-prevention"]; v != nil {
+ _ = d.Set("data_loss_prevention", v)
+ }
+
+ if v := cluster["dns-server"]; v != nil {
+ _ = d.Set("dns_server", v)
+ }
+
+ if v := cluster["hardware-subtype"]; v != nil {
+ _ = d.Set("hardware_subtype", v)
+ }
+
+ if v := cluster["legacy-url-filtering"]; v != nil {
+ _ = d.Set("legacy_url_filtering", v)
+ }
+
+ if v := cluster["mobile-access"]; v != nil {
+ _ = d.Set("mobile_access", v)
+ }
+
+ if v := cluster["monitoring"]; v != nil {
+ _ = d.Set("monitoring", v)
+ }
+
+ if v := cluster["policy-server"]; v != nil {
+ _ = d.Set("policy_server", v)
+ }
+
+ if v := cluster["rtm-counters-report"]; v != nil {
+ _ = d.Set("rtm_counters_report", v)
+ }
+
+ if v := cluster["rtm-traffic-report"]; v != nil {
+ _ = d.Set("rtm_traffic_report", v)
+ }
+
+ if v := cluster["rtm-traffic-report-per-connection"]; v != nil {
+ _ = d.Set("rtm_traffic_report_per_connection", v)
+ }
+
+ if v := cluster["threat-extraction"]; v != nil {
+ _ = d.Set("threat_extraction", v)
+ }
+
+ if v := cluster["threat-prevention-mode"]; v != nil {
+ _ = d.Set("threat_prevention_mode", v)
+ }
+
+ if v := cluster["workforce-ai"]; v != nil {
+ _ = d.Set("workforce_ai", v)
+ }
+
+ if v := cluster["communication-with-servers-behind-nat"]; v != nil {
+ communicationWithServersBehindNatShow := v.(map[string]interface{})
+ communicationWithServersBehindNatState := make(map[string]interface{})
+ if v := communicationWithServersBehindNatShow["override-profile"]; v != nil {
+ communicationWithServersBehindNatState["override_profile"] = v
+ }
+ if v := communicationWithServersBehindNatShow["value"]; v != nil {
+ communicationWithServersBehindNatState["value"] = v
+ }
+ _ = d.Set("communication_with_servers_behind_nat", []interface{}{communicationWithServersBehindNatState})
+ }
+
+ if v := cluster["smb-logs-settings"]; v != nil {
+ smbLogsSettingsShow := v.(map[string]interface{})
+ smbLogsSettingsState := make(map[string]interface{})
+ if v := smbLogsSettingsShow["alert-when-queue-is-full"]; v != nil {
+ smbLogsSettingsState["alert_when_queue_is_full"] = v
+ }
+ if v := smbLogsSettingsShow["alert-when-queue-is-full-type"]; v != nil {
+ smbLogsSettingsState["alert_when_queue_is_full_type"] = v
+ }
+ if v := smbLogsSettingsShow["detect-new-citrix-ica-application-names"]; v != nil {
+ smbLogsSettingsState["detect_new_citrix_ica_application_names"] = v
+ }
+ if v := smbLogsSettingsShow["stop-logging-when-queue-reaches-maximal-capacity"]; v != nil {
+ smbLogsSettingsState["stop_logging_when_queue_reaches_maximal_capacity"] = v
+ }
+ if v := smbLogsSettingsShow["stop-logging-when-queue-reaches-maximal-capacity-threshold"]; v != nil {
+ smbLogsSettingsState["stop_logging_when_queue_reaches_maximal_capacity_threshold"] = v
+ }
+ if v := smbLogsSettingsShow["turn-on-qos-logging"]; v != nil {
+ smbLogsSettingsState["turn_on_qos_logging"] = v
+ }
+ if v := smbLogsSettingsShow["update-account-log-every"]; v != nil {
+ smbLogsSettingsState["update_account_log_every"] = v
+ }
+ _ = d.Set("smb_logs_settings", []interface{}{smbLogsSettingsState})
+ }
+
+ if v := cluster["zero-phishing-settings"]; v != nil {
+ zeroPhishingSettingsShow := v.(map[string]interface{})
+ zeroPhishingSettingsState := make(map[string]interface{})
+ if v := zeroPhishingSettingsShow["gateway-fqdn-mode"]; v != nil {
+ zeroPhishingSettingsState["gateway_fqdn_mode"] = v
+ }
+ if v := zeroPhishingSettingsShow["manual-fqdn"]; v != nil {
+ zeroPhishingSettingsState["manual_fqdn"] = v
+ }
+ _ = d.Set("zero_phishing_settings", []interface{}{zeroPhishingSettingsState})
+ }
+
+ if v := cluster["application-control-and-url-filtering-settings"]; v != nil {
+ applicationControlAndUrlFilteringSettingsShow := v.(map[string]interface{})
+ applicationControlAndUrlFilteringSettingsState := make(map[string]interface{})
+ if v := applicationControlAndUrlFilteringSettingsShow["global-settings-mode"]; v != nil {
+ applicationControlAndUrlFilteringSettingsState["global_settings_mode"] = v
+ }
+ if v := applicationControlAndUrlFilteringSettingsShow["override-global-settings"]; v != nil {
+ overrideGlobalSettingsShow := v.(map[string]interface{})
+ overrideGlobalSettingsState := make(map[string]interface{})
+ if v := overrideGlobalSettingsShow["fail-mode"]; v != nil {
+ overrideGlobalSettingsState["fail_mode"] = v
+ }
+ if v := overrideGlobalSettingsShow["website-categorization"]; v != nil {
+ websiteCategorizationShow := v.(map[string]interface{})
+ websiteCategorizationState := make(map[string]interface{})
+ if v := websiteCategorizationShow["custom-mode"]; v != nil {
+ customModeShow := v.(map[string]interface{})
+ customModeState := make(map[string]interface{})
+ if v := customModeShow["social-networking-widgets"]; v != nil {
+ customModeState["social_networking_widgets"] = v
+ }
+ if v := customModeShow["url-filtering"]; v != nil {
+ customModeState["url_filtering"] = v
+ }
+ websiteCategorizationState["custom_mode"] = []interface{}{customModeState}
+ }
+ if v := websiteCategorizationShow["mode"]; v != nil {
+ websiteCategorizationState["mode"] = v
+ }
+ overrideGlobalSettingsState["website_categorization"] = []interface{}{websiteCategorizationState}
+ }
+ applicationControlAndUrlFilteringSettingsState["override_global_settings"] = []interface{}{overrideGlobalSettingsState}
+ }
+ _ = d.Set("application_control_and_url_filtering_settings", []interface{}{applicationControlAndUrlFilteringSettingsState})
+ }
+
+ if v := cluster["cluster-settings"]; v != nil {
+ clusterSettingsShow := v.(map[string]interface{})
+ clusterSettingsState := make(map[string]interface{})
+ if v := clusterSettingsShow["member-recovery-mode"]; v != nil {
+ clusterSettingsState["member_recovery_mode"] = v
+ }
+ if v := clusterSettingsShow["state-synchronization"]; v != nil {
+ stateSynchronizationShow := v.(map[string]interface{})
+ stateSynchronizationState := make(map[string]interface{})
+ if v := stateSynchronizationShow["delayed"]; v != nil {
+ stateSynchronizationState["delayed"] = v
+ }
+ if v := stateSynchronizationShow["delayed-seconds"]; v != nil {
+ stateSynchronizationState["delayed_seconds"] = v
+ }
+ if v := stateSynchronizationShow["enabled"]; v != nil {
+ stateSynchronizationState["enabled"] = v
+ }
+ clusterSettingsState["state_synchronization"] = []interface{}{stateSynchronizationState}
+ }
+ if v := clusterSettingsShow["track-changes-of-cluster-members"]; v != nil {
+ clusterSettingsState["track_changes_of_cluster_members"] = v
+ }
+ if v := clusterSettingsShow["use-virtual-mac"]; v != nil {
+ clusterSettingsState["use_virtual_mac"] = v
+ }
+ _ = d.Set("cluster_settings", []interface{}{clusterSettingsState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_simple_gateway.go b/checkpoint/data_source_checkpoint_management_simple_gateway.go
index 192bba7d..c1aa0f99 100644
--- a/checkpoint/data_source_checkpoint_management_simple_gateway.go
+++ b/checkpoint/data_source_checkpoint_management_simple_gateway.go
@@ -137,6 +137,11 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "Override value.
Required only for 'override-profile' is True.",
},
+ "profile_value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
},
},
},
@@ -156,6 +161,11 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "Override value.
Required only for 'override-profile' is True.",
},
+ "profile_value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
},
},
},
@@ -175,6 +185,11 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "Override value.
Required only for 'override-profile' is True.",
},
+ "profile_value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
},
},
},
@@ -194,6 +209,11 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "Override value.
Required only for 'override-profile' is True.",
},
+ "profile_value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
},
},
},
@@ -213,9 +233,81 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "Override value.
Required only for 'override-profile' is True.",
},
+ "profile_value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
+ },
+ },
+ },
+ "bypass_on_client_failure": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Bypass HTTPS inspection on client failure.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "profile_value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to bypass on client failure.",
+ },
+ },
+ },
+ },
+ "bypass_under_load": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Bypass HTTPS inspection under load.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to bypass under load.",
+ },
+ },
+ },
+ },
+ "outbound_certificate": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Outbound HTTPS inspection certificate.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "profile_value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Outbound certificate identified by the name or UID.",
+ },
},
},
},
+ "deployment_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "HTTPS inspection deployment mode.",
+ },
},
},
},
@@ -325,6 +417,11 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "The main URL for the web portal.",
},
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
},
},
},
@@ -339,10 +436,25 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "The certificate file encoded in Base64 with padding. This file must be in the *.p12 format.",
},
- "base64_password": {
+ "certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate.",
+ },
+ "certificate_dn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate distinguished name.",
+ },
+ "certificate_valid_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date from which the certificate is valid.",
+ },
+ "certificate_valid_to": {
Type: schema.TypeString,
Computed: true,
- Description: "Password (encoded in Base64 with padding) for the certificate file.",
+ Description: "The date until which the certificate is valid.",
},
},
},
@@ -507,6 +619,62 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
},
},
},
+ "certificate_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal certificate.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate.",
+ },
+ "certificate_dn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate distinguished name.",
+ },
+ "certificate_valid_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date from which the certificate is valid.",
+ },
+ "certificate_valid_to": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date until which the certificate is valid.",
+ },
+ },
+ },
+ },
+ "portal_web_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal web settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "aliases": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of URL aliases that are redirected to the main portal URL.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
+ "main_url": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The main URL for the portal.",
+ },
+ },
+ },
+ },
},
},
},
@@ -535,11 +703,6 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "Host / Network Group Name or UID.",
},
- "client_secret": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Client Secret.",
- },
},
},
},
@@ -628,58 +791,369 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
},
},
},
+ "certificate_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal certificate.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate.",
+ },
+ "certificate_dn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate distinguished name.",
+ },
+ "certificate_valid_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date from which the certificate is valid.",
+ },
+ "certificate_valid_to": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date until which the certificate is valid.",
+ },
+ },
+ },
+ },
+ "portal_web_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal web settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "aliases": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of URL aliases that are redirected to the main portal URL.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
+ "main_url": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The main URL for the portal.",
+ },
+ },
+ },
+ },
},
},
},
},
},
},
- "identity_sharing_settings": {
+ "identity_web_api": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Identity Web API source enabled.",
+ },
+ "identity_web_api_settings": {
Type: schema.TypeList,
Computed: true,
- Description: "Identity sharing settings.",
+ Description: "Identity Web API settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "share_with_other_gateways": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Enable identity sharing with other gateways.",
- },
- "receive_from_other_gateways": {
- Type: schema.TypeBool,
+ "authentication_settings": {
+ Type: schema.TypeList,
Computed: true,
- Description: "Enable receiving identity from other gateways.",
+ Description: "Authentication settings for Identity Web API.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "users_directories": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Users directories.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "external_user_profile": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "External user profile.",
+ },
+ "internal_users": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Internal users.",
+ },
+ "users_from_external_directories": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Users from external directories.",
+ },
+ "specific": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "LDAP AU objects identified by the name or UID.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ },
+ },
+ },
+ },
},
- "receive_from": {
- Type: schema.TypeSet,
+ "authorized_clients": {
+ Type: schema.TypeList,
Computed: true,
- Description: "Gateway(s) to receive identity from.",
- Elem: &schema.Schema{
- Type: schema.TypeString,
+ Description: "Authorized clients.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "client": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Host / Network Group Name or UID.",
+ },
+ },
},
},
- },
- },
- },
- "proxy_settings": {
- Type: schema.TypeList,
- Computed: true,
- Description: "Identity-Awareness Proxy settings.",
- Elem: &schema.Resource{
- Schema: map[string]*schema.Schema{
- "detect_using_x_forward_for": {
- Type: schema.TypeBool,
+ "client_access_permissions": {
+ Type: schema.TypeList,
Computed: true,
- Description: "Whether to use X-Forward-For HTTP header, which is added by the proxy server to keep track of the original source IP.",
- },
- },
- },
- },
- "remote_access": {
- Type: schema.TypeBool,
- Computed: true,
- Description: "Enable Remote Access Identity source.",
- },
+ Description: "Identity Web API accessibility settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "accessibility": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal access settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "allow_access_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Allowed access to the web portal (based on interfaces, or security policy).",
+ },
+ "internal_access_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the additional portal access settings for internal interfaces only.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "undefined": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to \"Undefined\".",
+ },
+ "dmz": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to \"DMZ\".",
+ },
+ "vpn": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Controls portal access settings for interfaces that are part of a VPN Encryption Domain.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "certificate_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal certificate.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate.",
+ },
+ "certificate_dn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate distinguished name.",
+ },
+ "certificate_valid_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date from which the certificate is valid.",
+ },
+ "certificate_valid_to": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date until which the certificate is valid.",
+ },
+ },
+ },
+ },
+ "portal_web_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal web settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "aliases": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of URL aliases that are redirected to the main portal URL.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
+ "main_url": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The main URL for the portal.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "ad_query": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "AD Query source enabled.",
+ },
+ "collecting_identities": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "This gateway collects identities.",
+ },
+ "identity_based_enforcement": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Configures this object as a PEP-only object - identity-based enforcement (PEP).",
+ },
+ "radius_accounting": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Radius Accounting source enabled.",
+ },
+ "terminal_servers": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Terminal Servers source enabled.",
+ },
+ "identity_sharing_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Identity sharing settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "share_with_other_gateways": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable identity sharing with other gateways.",
+ },
+ "receive_from_other_gateways": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable receiving identity from other gateways.",
+ },
+ "receive_from": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Gateway(s) to receive identity from.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "cache_mode": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Identity cache mode.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether the identity cache is enabled.",
+ },
+ "profile_value": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "The value inherited from the profile.",
+ },
+ },
+ },
+ },
+ "cache_mode_duration": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Identity cache mode duration.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Identity cache duration in minutes.",
+ },
+ "profile_value": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "The duration inherited from the profile, in minutes.",
+ },
+ },
+ },
+ },
+ "receive_from_infinity_identity": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to receive identities from Infinity Identity.",
+ },
+ "scaled_sharing": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether scaled identity sharing is enabled.",
+ },
+ },
+ },
+ },
+ "proxy_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Identity-Awareness Proxy settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "detect_using_x_forward_for": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to use X-Forward-For HTTP header, which is added by the proxy server to keep track of the original source IP.",
+ },
+ },
+ },
+ },
+ "remote_access": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable Remote Access Identity source.",
+ },
},
},
},
@@ -729,6 +1203,11 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "NAT translation method.",
},
+ "apply_control_connections": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "This option performs NAT on VPN control connections to and from this object.",
+ },
},
},
},
@@ -744,6 +1223,11 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Description: "Configuration of the portal web settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Optional: IP address for the web portal to use, if your DNS server fails to resolve the main portal URL. Note: If your DNS server resolves the main po...",
+ },
"aliases": {
Type: schema.TypeSet,
Computed: true,
@@ -766,15 +1250,30 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Description: "Configuration of the portal certificate settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "base64_certificate": {
+ "certificate": {
Type: schema.TypeString,
Computed: true,
- Description: "The certificate file encoded in Base64 with padding. This file must be in the *.p12 format.",
+ Description: "The certificate.",
+ },
+ "certificate_dn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The DN (Distinguished Name) of the certificate.",
+ },
+ "certificate_valid_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date, from which the certificate is valid.",
+ },
+ "certificate_valid_to": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate expiration date.",
},
- "base64_password": {
+ "base64_certificate": {
Type: schema.TypeString,
Computed: true,
- Description: "Password (encoded in Base64 with padding) for the certificate file.",
+ Description: "The certificate file encoded in Base64 with padding. This file must be in the *.p12 format.",
},
},
},
@@ -817,6 +1316,11 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
},
},
},
+ "enabled": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "State of the web portal (enabled or disabled).",
+ },
},
},
},
@@ -866,6 +1370,11 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Description: "Configuration of the portal web settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Optional: IP address for the web portal to use, if your DNS server fails to resolve the main portal URL. Note: If your DNS server resolves the main po...",
+ },
"aliases": {
Type: schema.TypeSet,
Computed: true,
@@ -888,15 +1397,30 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Description: "Configuration of the portal certificate settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "base64_certificate": {
+ "certificate": {
Type: schema.TypeString,
Computed: true,
- Description: "The certificate file encoded in Base64 with padding. This file must be in the *.p12 format.",
+ Description: "The certificate.",
+ },
+ "certificate_dn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The DN (Distinguished Name) of the certificate.",
+ },
+ "certificate_valid_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date, from which the certificate is valid.",
+ },
+ "certificate_valid_to": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate expiration date.",
},
- "base64_password": {
+ "base64_certificate": {
Type: schema.TypeString,
Computed: true,
- Description: "Password (encoded in Base64 with padding) for the certificate file.",
+ Description: "The certificate file encoded in Base64 with padding. This file must be in the *.p12 format.",
},
},
},
@@ -951,6 +1475,7 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Type: schema.TypeString,
Computed: true,
Description: "Zero Phishing gateway FQDN.",
+ Deprecated: "use zero_phishing_settings.manual_fqdn instead - the API replaced zero-phishing-fqdn with zero-phishing-settings",
},
"interfaces": {
Type: schema.TypeList,
@@ -963,6 +1488,16 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "Object name. Should be unique in the domain.",
},
+ "dynamic_ip": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable dynamic interface.",
+ },
+ "network_interface_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Type of network interface.",
+ },
"ipv4_address": {
Type: schema.TypeString,
Computed: true,
@@ -1009,6 +1544,26 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "If packets will be rejected (the Prevent option) or whether the packets will be monitored (the Detect option).",
},
+ "exclude_packets": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Don't check packets from excluded network.",
+ },
+ "excluded_network_name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Excluded network name.",
+ },
+ "excluded_network_uid": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Excluded network UID.",
+ },
+ "spoof_tracking": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Spoof tracking.",
+ },
},
},
},
@@ -1262,11 +1817,6 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "Gateway platform hardware type.",
},
- "one_time_password": {
- Type: schema.TypeString,
- Computed: true,
- Description: "SIC one time password.",
- },
"sic_name": {
Type: schema.TypeString,
Computed: true,
@@ -1306,6 +1856,14 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Type: schema.TypeString,
},
},
+ "export_logs_to_servers": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Export logs to syslog/SIEM servers. NOTE:After you configure a Log Exporter, you must run Install Database.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
"application_control_and_url_filtering_settings": {
Type: schema.TypeList,
Computed: true,
@@ -1538,7 +2096,22 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "Update account log in every amount of seconds.",
},
- },
+ "alert_when_free_disk_space_below_metrics": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Alert when free disk space below metrics.",
+ },
+ "distribute_logs_between_all_active_servers": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Distribute logs between all active servers.",
+ },
+ "include_tcp_state_information": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Include TCP state information. Relevant only when Firewall blade is enabled.",
+ },
+ },
},
},
"vpn": {
@@ -1566,6 +2139,228 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Type: schema.TypeString,
},
},
+ "single_authentication_client": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Settings for clients that support only single authentication method.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "enabled": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Allow clients that support only single authentication method.",
+ },
+ "allow_multiple_authentication_clients": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Allow clients that support multiple authentication methods to connect.",
+ },
+ "display_name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Display name for the authentication method.",
+ },
+ "method": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Authentication method type.",
+ },
+ "secur_id": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "SecurID authentication settings, relevant only when method is \"secur-id\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "server": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Server object identified by the name or UID.",
+ },
+ "token_card_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Token card type.",
+ },
+ },
+ },
+ },
+ "radius": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "RADIUS authentication settings, relevant only when method is \"radius\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "server": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Server object identified by the name or UID.",
+ },
+ "ask_user_password": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Ask user for password during authentication.",
+ },
+ },
+ },
+ },
+ "personal_certificate": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Personal certificate authentication settings, relevant only when method is \"personal-certificate\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "fetch_username_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Fetch username from.",
+ },
+ "storage_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate storage type.",
+ },
+ "source": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate source field.",
+ },
+ "dn_part": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "DN part to extract.",
+ },
+ "dn_concurrence": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "DN part occurrence number.",
+ },
+ },
+ },
+ },
+ "client_display_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Client display configuration settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "headline": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Display headline for authentication dialog.",
+ },
+ "username_label": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Label for username field.",
+ },
+ "password_label": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Label for password field.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "override_global_dynamic_id_settings": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Override global dynamic ID settings.",
+ },
+ "dynamic_id_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Dynamic ID settings, relevant only when \"override-global-dynamic-id-settings\" is true.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "sms_provider_and_email_settings": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "SMS provider and email configuration.",
+ },
+ "sms_provider_credentials": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "SMS provider credentials configuration.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "username": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "SMS provider username.",
+ },
+ "api_id": {
+ Type: schema.TypeString,
+ Computed: true,
+ Sensitive: true,
+ Description: "SMS provider API ID.",
+ },
+ },
+ },
+ },
+ "advanced_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Advanced Dynamic ID configuration settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "dynamic_id_message": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Dynamic ID message displayed to users.",
+ },
+ "otp_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "One Time Password configuration settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "length": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Length of one time password.",
+ },
+ "expiration": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "One time password expiration (in minutes).",
+ },
+ "max_attempts": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of times users can attempt to enter the one time password before the entire authentication process restarts.",
+ },
+ },
+ },
+ },
+ "enable_display_user_details": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable display of user details.",
+ },
+ "country_code": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Country code for SMS services.",
+ },
+ "user_details_retrieval": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "User details retrieval method.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "send_machine_certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Configure when to send machine certificate.",
+ },
},
},
},
@@ -1590,6 +2385,68 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "IP Address. Must be set when \"ip-selection\" was selected to be \"use-selected-address-from-topology\" or \"use-statically-nated-ip\"",
},
+ "route_selection_method": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Outgoing route selection method when initiating a tunnel.",
+ },
+ "responding_traffic": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Responding traffic route selection method.",
+ },
+ "source_ip_selection": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Source IP address selection method for outgoing traffic.",
+ },
+ "selected_ip": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Selected IP address. Must be set when \"source-ip-selection\" was selected to be \"manual\".",
+ },
+ "outgoing_link_tracking": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Outgoing link tracking method.",
+ },
+ "probing_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Probing settings configuration. Only available when \"ip-selection\" is \"use-probing-with-high-availability\" or \"use-probing-with-load-sharing\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "probed_interfaces": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Specifies whether to probe all addresses defined in the topology tab or specific addresses.",
+ },
+ "probed_interface_list": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of specific IP addresses to probe. Only relevant when \"probed-interfaces\" is set to \"specific\".",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "use_primary_address": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to use a primary address for high availability probing.",
+ },
+ "primary_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Primary IP address to use. Must be one of the addresses from \"probed-interface-list\". Required when \"use-primary-address\" is true.",
+ },
+ "probing_method": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Probing method.",
+ },
+ },
+ },
+ },
},
},
},
@@ -1829,66 +2686,704 @@ func dataSourceManagementSimpleGateway() *schema.Resource {
Computed: true,
Description: "Exclude the external IP addresses from the VPN domain of this Security Gateway.",
},
- },
- },
- },
- "color": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Color of the object. Should be one of existing colors.",
- },
- "comments": {
- Type: schema.TypeString,
- Computed: true,
- Description: "Comments string.",
- },
- "tags": {
- Type: schema.TypeSet,
- Computed: true,
- Description: "Collection of tag identifiers.",
- Elem: &schema.Schema{
- Type: schema.TypeString,
- },
- },
- },
- }
-}
-
-func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}) error {
- client := m.(*checkpoint.ApiClient)
-
- name := d.Get("name").(string)
- uid := d.Get("uid").(string)
-
- payload := make(map[string]interface{})
-
- if name != "" {
- payload["name"] = name
- } else if uid != "" {
- payload["uid"] = uid
- }
-
- showGatewayRes, err := client.ApiCall("show-simple-gateway", payload, client.GetSessionID(), true, client.IsProxyUsed())
- if err != nil {
- return fmt.Errorf("%s", err.Error())
- }
- if !showGatewayRes.Success {
- return fmt.Errorf("%s", showGatewayRes.ErrorMsg)
- }
-
- gateway := showGatewayRes.GetData()
-
- log.Println("Read Simple Gateway - Show JSON = ", gateway)
-
- if v := gateway["uid"]; v != nil {
- _ = d.Set("uid", v)
- d.SetId(v.(string))
- }
-
- if v := gateway["name"]; v != nil {
- _ = d.Set("name", v)
- }
-
+ "advanced": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Advanced VPN settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "tunnel_sharing_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Tunnel sharing mode.",
+ },
+ "shutdown_on_gateway_restart": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Shutdown VPN tunnels on gateway restart.",
+ },
+ "enable_wire_mode": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable wire mode.",
+ },
+ "wire_mode_interfaces": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Wire mode interfaces.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "enable_wire_mode_log_traffic": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Log traffic in wire mode.",
+ },
+ "enable_nat_traversal": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable NAT traversal.",
+ },
+ },
+ },
+ },
+ "exported_routes": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Exported routes.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "internal_interfaces": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Export internal interfaces.",
+ },
+ "static_routes": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Export static routes.",
+ },
+ "custom_routes": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Export custom routes.",
+ },
+ "custom_routes_object": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Custom routes object identified by the name or UID.",
+ },
+ },
+ },
+ },
+ "vpn_clients": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "VPN clients settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "enable_endpoint_security_vpn": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable Endpoint Security VPN client.",
+ },
+ "enable_cp_mobile_for_windows": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable Check Point Mobile for Windows client.",
+ },
+ "enable_secu_remote": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable SecuRemote client.",
+ },
+ "enable_capsule_vpn_connect": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable Capsule VPN Connect client.",
+ },
+ "enable_ssl_network_extender": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable SSL Network Extender client.",
+ },
+ "gateway_authentication_certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Gateway authentication certificate.",
+ },
+ },
+ },
+ },
+ "enable_clientless_vpn": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable clientless VPN.",
+ },
+ "clientless_vpn_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Clientless VPN settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "certificate_gateway_authentication": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate gateway authentication.",
+ },
+ "client_authentication": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Client authentication.",
+ },
+ "concurrent_servers_or_processes": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of concurrent servers or processes.",
+ },
+ "accept_only_3des": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Accept only 3DES.",
+ },
+ },
+ },
+ },
+ "saml_portal_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "SAML portal settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "enabled": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether the SAML portal is enabled.",
+ },
+ "portal_web_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the SAML portal web settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "aliases": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "List of URL aliases that are redirected to the main portal URL.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
+ "main_url": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The main URL for the portal.",
+ },
+ },
+ },
+ },
+ "certificate_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the SAML portal certificate.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate.",
+ },
+ "certificate_dn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate distinguished name.",
+ },
+ "certificate_valid_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date from which the certificate is valid.",
+ },
+ "certificate_valid_to": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The date until which the certificate is valid.",
+ },
+ },
+ },
+ },
+ "accessibility": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the portal access settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "allow_access_from": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Allowed access to the SAML portal.",
+ },
+ "internal_access_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Configuration of the additional portal access settings for internal interfaces only.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "undefined": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to \"Undefined\".",
+ },
+ "dmz": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to \"DMZ\".",
+ },
+ "vpn": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Controls portal access settings for interfaces that are part of a VPN Encryption Domain.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "certificates": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "VPN certificates.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate name.",
+ },
+ "stored_at": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Where the certificate is stored.",
+ },
+ "status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate status.",
+ },
+ "distinguished_name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate distinguished name.",
+ },
+ "base64_certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The certificate encoded in Base64.",
+ },
+ "certificate_authority": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate authority identified by the name or UID.",
+ },
+ "expiration_date": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Certificate expiration date.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "interfaces": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "VPN link selection interfaces.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "interface_name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The name of the interface.",
+ },
+ "next_hop_ip": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The IP address of the next hop.",
+ },
+ "static_nat_ip": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The NATed IPv4 address that hides the source IPv4 address of outgoing connections.",
+ },
+ "priority": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Priority of a \"Backup\" interface.",
+ },
+ "redundancy_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Interface redundancy mode (Active/Backup).",
+ },
+ "ip_version": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The IP version of the interface's IP address.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "color": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Color of the object. Should be one of existing colors.",
+ },
+ "comments": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Comments string.",
+ },
+ "tags": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Collection of tag identifiers.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "accept_syslog_messages": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enables the gateway accept syslog messages, relevant only when Logging and Status blade is enabled.",
+ },
+ "anti_spam_and_email_security": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Anti-Spam & Email-Security blade enabled.",
+ },
+ "auto_generate_ip": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Use an automatically generated IP address for the Gateway object (applies only to Smart-1 Cloud).",
+ },
+ "auto_topology_custom_recalculation_time": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Auto topology custom recalculation time (seconds).",
+ },
+ "auto_topology_use_custom_recalculation_time": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Auto topology to use custom recalculation time instead of default.",
+ },
+ "autonomous_system_number": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The Autonomous System Number (ASN) for this Check Point Security Gateway.",
+ },
+ "data_loss_prevention": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Data Loss Prevention.",
+ },
+ "dns_server": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "DNS Server.",
+ },
+ "enable_log_indexing": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enable log indexing, The Log Indexing uses more storage to provide fast log queries. Relevant only when Logging and Status blade is enabled.",
+ },
+ "externally_managed": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Externally Managed Check Point Gateway.",
+ },
+ "hardware_subtype": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Gateway type (relevant only for Spark gateways).",
+ },
+ "install_policy_without_push": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Specifies whether the policy is pushed to the gateway during policy installation, or whether the gateway should fetch the policy.",
+ },
+ "interfaces_topology_settings": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Topology setting for all interfaces on a Security Gateway. Default for Security Gateways that run Gaia OS: 'per interface'. Default for Quantum Spark ...",
+ },
+ "legacy_url_filtering": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Legacy URL Filtering enabled.",
+ },
+ "log_server": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Logging & Status.",
+ },
+ "mobile_access": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Mobile-Access blade enabled.",
+ },
+ "monitoring": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Monitoring blade enabled.",
+ },
+ "network_policy_management": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Management blade enabled.",
+ },
+ "policy_server": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Policy-Server blade enabled.",
+ },
+ "rtm_counters_report": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enables monitoring blades system counters report (e.g CPU Usage,Memory Usage).",
+ },
+ "rtm_traffic_report": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enables monitoring blades traffic report.",
+ },
+ "rtm_traffic_report_per_connection": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enables Monitoring blade traffic report per connection.",
+ },
+ "sic_message": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Secure Internal Communication message.",
+ },
+ "smart_event_intro_correlation_unit": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enables the gateway use SmartEvent intro correlation unit with one Security Gateway Software Blade, relevant only when Logging and Status blade is ena...",
+ },
+ "threat_prevention_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The mode of Threat Prevention to use. When using Autonomous Threat Prevention, disabling the Threat Prevention blades is not allowed.",
+ },
+ "trust_method": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Trust method that was used for establishing communication.",
+ },
+ "workforce_ai": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Workforce AI Security blade enabled. Requires content awareness blade and version R82.20 or higher to be enabled.",
+ },
+ "communication_with_servers_behind_nat": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Gateway behind NAT communications settings with the server.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to override the Server (Check Point Host) object configuration.",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "according-to-topology: Use the original or translated IP address of the server based on the Topology of Security Gateway interfaces.
original-ip-on...",
+ },
+ },
+ },
+ },
+ "smb_logs_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Logs settings that apply to Quantum Spark Appliances that run Gaia Embedded OS.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "alert_when_queue_is_full": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Alert when queue is full enabled.",
+ },
+ "alert_when_queue_is_full_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Alert when queue is full type.",
+ },
+ "detect_new_citrix_ica_application_names": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Detect new citrix ica application names enabled.",
+ },
+ "stop_logging_when_queue_reaches_maximal_capacity": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Stop logging when queue reaches maximal capacity enabled.",
+ },
+ "stop_logging_when_queue_reaches_maximal_capacity_threshold": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Stop logging when queue reaches maximal capacity threshold.",
+ },
+ "turn_on_qos_logging": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Turn on qos logging enabled.",
+ },
+ "update_account_log_every": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Update account log in every amount of seconds.",
+ },
+ },
+ },
+ },
+ "zero_phishing_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Fqdn settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "gateway_fqdn_mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Manual Fqdn.",
+ },
+ "manual_fqdn": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Zero Phishing gateway FQDN.",
+ },
+ },
+ },
+ },
+ "fetch_policy_scheduler": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Fetch policy functionality settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "enabled": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates if the Security Gateway will fetch policy according to a schedule (true) or manually (false).",
+ },
+ "schedule": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Scheduled Event for fetching policy by.
Will be applied only when the `enabled` field is set to true.
When not defined ...",
+ },
+ },
+ },
+ },
+ "trust_details": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Details for trusted communication.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "authentication_token": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Authentication token to use on the Gateway side to establish the communication between the Gateway and the Management Server (applies only to Smart-1 ...",
+ },
+ "cloud_communication_details": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Details about the communication status with cloud (applies only to Smart-1 Cloud).",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "ip": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "IP address used for communication between the Gateway and the Management Server (used when 'auto-generate-ip=true').",
+ },
+ "status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Status of communication between the Gateway and the Management Server.",
+ },
+ },
+ },
+ },
+ "gateway_mac_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Use the Security Gateway MAC address, relevant for the gateway_mac_address identification-method.",
+ },
+ "identification_method": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "How to identify the gateway (relevant for DAIP gateways only).",
+ },
+ "status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Status of the trusted communication with the Security Gateway.",
+ },
+ "token_expiration_date": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Details about the communication status with cloud (applies only to Smart-1 Cloud).",
+ },
+ },
+ },
+ },
+ },
+ }
+}
+
+func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}) error {
+ client := m.(*checkpoint.ApiClient)
+
+ name := d.Get("name").(string)
+ uid := d.Get("uid").(string)
+
+ payload := make(map[string]interface{})
+
+ if name != "" {
+ payload["name"] = name
+ } else if uid != "" {
+ payload["uid"] = uid
+ }
+
+ showGatewayRes, err := client.ApiCall("show-simple-gateway", payload, client.GetSessionID(), true, client.IsProxyUsed())
+ if err != nil {
+ return fmt.Errorf("%s", err.Error())
+ }
+ if !showGatewayRes.Success {
+ return fmt.Errorf("%s", showGatewayRes.ErrorMsg)
+ }
+
+ gateway := showGatewayRes.GetData()
+
+ log.Println("Read Simple Gateway - Show JSON = ", gateway)
+
+ if v := gateway["uid"]; v != nil {
+ _ = d.Set("uid", v)
+ d.SetId(v.(string))
+ }
+
+ if v := gateway["name"]; v != nil {
+ _ = d.Set("name", v)
+ }
+
if v := gateway["ipv4-address"]; v != nil {
_ = d.Set("ipv4_address", v)
}
@@ -1983,6 +3478,9 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
if v, _ := bypassOnFailureMap["value"]; v != nil {
bypassOnFailureMapToReturn["value"] = v
}
+ if v, _ := bypassOnFailureMap["profile-value"]; v != nil {
+ bypassOnFailureMapToReturn["profile_value"] = v
+ }
httpsInspectionMapToReturn["bypass_on_failure"] = []interface{}{bypassOnFailureMapToReturn}
}
}
@@ -1998,6 +3496,9 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
if v, _ := siteCategorizationAllowModeMap["value"]; v != nil {
siteCategorizationAllowModeMapToReturn["value"] = v
}
+ if v, _ := siteCategorizationAllowModeMap["profile-value"]; v != nil {
+ siteCategorizationAllowModeMapToReturn["profile_value"] = v
+ }
httpsInspectionMapToReturn["site_categorization_allow_mode"] = []interface{}{siteCategorizationAllowModeMapToReturn}
}
}
@@ -2013,6 +3514,9 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
if v, _ := denyUntrustedServerCertMap["value"]; v != nil {
denyUntrustedServerCertMapToReturn["value"] = v
}
+ if v, _ := denyUntrustedServerCertMap["profile-value"]; v != nil {
+ denyUntrustedServerCertMapToReturn["profile_value"] = v
+ }
httpsInspectionMapToReturn["deny_untrusted_server_cert"] = []interface{}{denyUntrustedServerCertMapToReturn}
}
}
@@ -2028,24 +3532,81 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
if v, _ := denyRevokedServerCertMap["value"]; v != nil {
denyRevokedServerCertMapToReturn["value"] = v
}
- httpsInspectionMapToReturn["deny_revoked_server_cert"] = []interface{}{denyRevokedServerCertMapToReturn}
+ if v, _ := denyRevokedServerCertMap["profile-value"]; v != nil {
+ denyRevokedServerCertMapToReturn["profile_value"] = v
+ }
+ httpsInspectionMapToReturn["deny_revoked_server_cert"] = []interface{}{denyRevokedServerCertMapToReturn}
+ }
+ }
+ if v, ok := httpsInspectionMap["deny-expired-server-cert"]; ok {
+
+ denyExpiredServerCertMap, ok := v.(map[string]interface{})
+ if ok {
+ denyExpiredServerCertMapToReturn := make(map[string]interface{})
+
+ if v, _ := denyExpiredServerCertMap["override-profile"]; v != nil {
+ denyExpiredServerCertMapToReturn["override_profile"] = v
+ }
+ if v, _ := denyExpiredServerCertMap["value"]; v != nil {
+ denyExpiredServerCertMapToReturn["value"] = v
+ }
+ if v, _ := denyExpiredServerCertMap["profile-value"]; v != nil {
+ denyExpiredServerCertMapToReturn["profile_value"] = v
+ }
+ httpsInspectionMapToReturn["deny_expired_server_cert"] = []interface{}{denyExpiredServerCertMapToReturn}
+ }
+ }
+ if v, ok := httpsInspectionMap["bypass-on-client-failure"]; ok {
+
+ bypassOnClientFailureMap, ok := v.(map[string]interface{})
+ if ok {
+ bypassOnClientFailureMapToReturn := make(map[string]interface{})
+
+ if v, _ := bypassOnClientFailureMap["override-profile"]; v != nil {
+ bypassOnClientFailureMapToReturn["override_profile"] = v
+ }
+ if v, _ := bypassOnClientFailureMap["profile-value"]; v != nil {
+ bypassOnClientFailureMapToReturn["profile_value"] = v
+ }
+ if v, _ := bypassOnClientFailureMap["value"]; v != nil {
+ bypassOnClientFailureMapToReturn["value"] = v
+ }
+ httpsInspectionMapToReturn["bypass_on_client_failure"] = []interface{}{bypassOnClientFailureMapToReturn}
+ }
+ }
+ if v, ok := httpsInspectionMap["bypass-under-load"]; ok {
+
+ bypassUnderLoadMap, ok := v.(map[string]interface{})
+ if ok {
+ bypassUnderLoadMapToReturn := make(map[string]interface{})
+
+ if v, _ := bypassUnderLoadMap["value"]; v != nil {
+ bypassUnderLoadMapToReturn["value"] = v
+ }
+ httpsInspectionMapToReturn["bypass_under_load"] = []interface{}{bypassUnderLoadMapToReturn}
}
}
- if v, ok := httpsInspectionMap["deny-expired-server-cert"]; ok {
+ if v, ok := httpsInspectionMap["outbound-certificate"]; ok {
- denyExpiredServerCertMap, ok := v.(map[string]interface{})
+ outboundCertificateMap, ok := v.(map[string]interface{})
if ok {
- denyExpiredServerCertMapToReturn := make(map[string]interface{})
+ outboundCertificateMapToReturn := make(map[string]interface{})
- if v, _ := denyExpiredServerCertMap["override-profile"]; v != nil {
- denyExpiredServerCertMapToReturn["override_profile"] = v
+ if v, _ := outboundCertificateMap["override-profile"]; v != nil {
+ outboundCertificateMapToReturn["override_profile"] = v
}
- if v, _ := denyExpiredServerCertMap["value"]; v != nil {
- denyExpiredServerCertMapToReturn["value"] = v
+ if v, _ := outboundCertificateMap["profile-value"]; v != nil {
+ outboundCertificateMapToReturn["profile_value"] = v.(map[string]interface{})["name"]
}
- httpsInspectionMapToReturn["deny_expired_server_cert"] = []interface{}{denyExpiredServerCertMapToReturn}
+ if v, _ := outboundCertificateMap["value"]; v != nil {
+ outboundCertificateMapToReturn["value"] = v.(map[string]interface{})["name"]
+ }
+ httpsInspectionMapToReturn["outbound_certificate"] = []interface{}{outboundCertificateMapToReturn}
}
}
+ if v, _ := httpsInspectionMap["deployment-mode"]; v != nil {
+ httpsInspectionMapToReturn["deployment_mode"] = v
+ }
_ = d.Set("https_inspection", []interface{}{httpsInspectionMapToReturn})
}
@@ -2077,7 +3638,62 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
browserBasedAuthenticationSettingsMapToReturn["authentication_settings"] = v
}
if v, _ := browserBasedAuthenticationSettingsMap["browser-based-authentication-portal-settings"]; v != nil {
- browserBasedAuthenticationSettingsMapToReturn["browser_based_authentication_portal_settings"] = v
+ browserBasedAuthenticationPortalSettingsMap := v.(map[string]interface{})
+ browserBasedAuthenticationPortalSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := browserBasedAuthenticationPortalSettingsMap["accessibility"]; v != nil {
+ accessibilityMap := v.(map[string]interface{})
+ accessibilityMapToReturn := make(map[string]interface{})
+ if v, _ := accessibilityMap["allow-access-from"]; v != nil {
+ accessibilityMapToReturn["allow_access_from"] = v
+ }
+ if v, _ := accessibilityMap["internal-access-settings"]; v != nil {
+ internalAccessSettingsMap := v.(map[string]interface{})
+ internalAccessSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := internalAccessSettingsMap["undefined"]; v != nil {
+ internalAccessSettingsMapToReturn["undefined"] = v
+ }
+ if v, _ := internalAccessSettingsMap["dmz"]; v != nil {
+ internalAccessSettingsMapToReturn["dmz"] = v
+ }
+ if v, _ := internalAccessSettingsMap["vpn"]; v != nil {
+ internalAccessSettingsMapToReturn["vpn"] = v
+ }
+ accessibilityMapToReturn["internal_access_settings"] = []interface{}{internalAccessSettingsMapToReturn}
+ }
+ browserBasedAuthenticationPortalSettingsMapToReturn["accessibility"] = []interface{}{accessibilityMapToReturn}
+ }
+ if v, _ := browserBasedAuthenticationPortalSettingsMap["certificate-settings"]; v != nil {
+ certificateSettingsMap := v.(map[string]interface{})
+ certificateSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := certificateSettingsMap["certificate"]; v != nil {
+ certificateSettingsMapToReturn["certificate"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-dn"]; v != nil {
+ certificateSettingsMapToReturn["certificate_dn"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-from"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_from"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-to"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_to"] = v
+ }
+ browserBasedAuthenticationPortalSettingsMapToReturn["certificate_settings"] = []interface{}{certificateSettingsMapToReturn}
+ }
+ if v, _ := browserBasedAuthenticationPortalSettingsMap["portal-web-settings"]; v != nil {
+ portalWebSettingsMap := v.(map[string]interface{})
+ portalWebSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := portalWebSettingsMap["aliases"]; v != nil {
+ portalWebSettingsMapToReturn["aliases"] = v
+ }
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
+ if v, _ := portalWebSettingsMap["main-url"]; v != nil {
+ portalWebSettingsMapToReturn["main_url"] = v
+ }
+ browserBasedAuthenticationPortalSettingsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
+ }
+ browserBasedAuthenticationSettingsMapToReturn["browser_based_authentication_portal_settings"] = []interface{}{browserBasedAuthenticationPortalSettingsMapToReturn}
}
identityAwarenessSettingsMapToReturn["browser_based_authentication_settings"] = []interface{}{browserBasedAuthenticationSettingsMapToReturn}
}
@@ -2101,7 +3717,62 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
identityAgentSettingsMapToReturn["authentication_settings"] = v
}
if v, _ := identityAgentSettingsMap["identity-agent-portal-settings"]; v != nil {
- identityAgentSettingsMapToReturn["identity_agent_portal_settings"] = v
+ identityAgentPortalSettingsMap := v.(map[string]interface{})
+ identityAgentPortalSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := identityAgentPortalSettingsMap["accessibility"]; v != nil {
+ accessibilityMap := v.(map[string]interface{})
+ accessibilityMapToReturn := make(map[string]interface{})
+ if v, _ := accessibilityMap["allow-access-from"]; v != nil {
+ accessibilityMapToReturn["allow_access_from"] = v
+ }
+ if v, _ := accessibilityMap["internal-access-settings"]; v != nil {
+ internalAccessSettingsMap := v.(map[string]interface{})
+ internalAccessSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := internalAccessSettingsMap["undefined"]; v != nil {
+ internalAccessSettingsMapToReturn["undefined"] = v
+ }
+ if v, _ := internalAccessSettingsMap["dmz"]; v != nil {
+ internalAccessSettingsMapToReturn["dmz"] = v
+ }
+ if v, _ := internalAccessSettingsMap["vpn"]; v != nil {
+ internalAccessSettingsMapToReturn["vpn"] = v
+ }
+ accessibilityMapToReturn["internal_access_settings"] = []interface{}{internalAccessSettingsMapToReturn}
+ }
+ identityAgentPortalSettingsMapToReturn["accessibility"] = []interface{}{accessibilityMapToReturn}
+ }
+ if v, _ := identityAgentPortalSettingsMap["certificate-settings"]; v != nil {
+ certificateSettingsMap := v.(map[string]interface{})
+ certificateSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := certificateSettingsMap["certificate"]; v != nil {
+ certificateSettingsMapToReturn["certificate"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-dn"]; v != nil {
+ certificateSettingsMapToReturn["certificate_dn"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-from"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_from"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-to"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_to"] = v
+ }
+ identityAgentPortalSettingsMapToReturn["certificate_settings"] = []interface{}{certificateSettingsMapToReturn}
+ }
+ if v, _ := identityAgentPortalSettingsMap["portal-web-settings"]; v != nil {
+ portalWebSettingsMap := v.(map[string]interface{})
+ portalWebSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := portalWebSettingsMap["aliases"]; v != nil {
+ portalWebSettingsMapToReturn["aliases"] = v
+ }
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
+ if v, _ := portalWebSettingsMap["main-url"]; v != nil {
+ portalWebSettingsMapToReturn["main_url"] = v
+ }
+ identityAgentPortalSettingsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
+ }
+ identityAgentSettingsMapToReturn["identity_agent_portal_settings"] = []interface{}{identityAgentPortalSettingsMapToReturn}
}
identityAwarenessSettingsMapToReturn["identity_agent_settings"] = []interface{}{identityAgentSettingsMapToReturn}
}
@@ -2122,7 +3793,62 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
identityCollectorSettingsMapToReturn["authentication_settings"] = v
}
if v, _ := identityCollectorSettingsMap["client-access-permissions"]; v != nil {
- identityCollectorSettingsMapToReturn["client_access_permissions"] = v
+ clientAccessPermissionsMap := v.(map[string]interface{})
+ clientAccessPermissionsMapToReturn := make(map[string]interface{})
+ if v, _ := clientAccessPermissionsMap["accessibility"]; v != nil {
+ accessibilityMap := v.(map[string]interface{})
+ accessibilityMapToReturn := make(map[string]interface{})
+ if v, _ := accessibilityMap["allow-access-from"]; v != nil {
+ accessibilityMapToReturn["allow_access_from"] = v
+ }
+ if v, _ := accessibilityMap["internal-access-settings"]; v != nil {
+ internalAccessSettingsMap := v.(map[string]interface{})
+ internalAccessSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := internalAccessSettingsMap["undefined"]; v != nil {
+ internalAccessSettingsMapToReturn["undefined"] = v
+ }
+ if v, _ := internalAccessSettingsMap["dmz"]; v != nil {
+ internalAccessSettingsMapToReturn["dmz"] = v
+ }
+ if v, _ := internalAccessSettingsMap["vpn"]; v != nil {
+ internalAccessSettingsMapToReturn["vpn"] = v
+ }
+ accessibilityMapToReturn["internal_access_settings"] = []interface{}{internalAccessSettingsMapToReturn}
+ }
+ clientAccessPermissionsMapToReturn["accessibility"] = []interface{}{accessibilityMapToReturn}
+ }
+ if v, _ := clientAccessPermissionsMap["certificate-settings"]; v != nil {
+ certificateSettingsMap := v.(map[string]interface{})
+ certificateSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := certificateSettingsMap["certificate"]; v != nil {
+ certificateSettingsMapToReturn["certificate"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-dn"]; v != nil {
+ certificateSettingsMapToReturn["certificate_dn"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-from"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_from"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-to"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_to"] = v
+ }
+ clientAccessPermissionsMapToReturn["certificate_settings"] = []interface{}{certificateSettingsMapToReturn}
+ }
+ if v, _ := clientAccessPermissionsMap["portal-web-settings"]; v != nil {
+ portalWebSettingsMap := v.(map[string]interface{})
+ portalWebSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := portalWebSettingsMap["aliases"]; v != nil {
+ portalWebSettingsMapToReturn["aliases"] = v
+ }
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
+ if v, _ := portalWebSettingsMap["main-url"]; v != nil {
+ portalWebSettingsMapToReturn["main_url"] = v
+ }
+ clientAccessPermissionsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
+ }
+ identityCollectorSettingsMapToReturn["client_access_permissions"] = []interface{}{clientAccessPermissionsMapToReturn}
}
identityAwarenessSettingsMapToReturn["identity_collector_settings"] = []interface{}{identityCollectorSettingsMapToReturn}
}
@@ -2142,6 +3868,40 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
if v, _ := identitySharingSettingsMap["receive-from"]; v != nil {
identitySharingSettingsMapToReturn["receive_from"] = v
}
+ if v, _ := identitySharingSettingsMap["cache-mode"]; v != nil {
+ cacheModeMap := v.(map[string]interface{})
+ cacheModeMapToReturn := make(map[string]interface{})
+ if v, _ := cacheModeMap["override-profile"]; v != nil {
+ cacheModeMapToReturn["override_profile"] = v
+ }
+ if v, _ := cacheModeMap["value"]; v != nil {
+ cacheModeMapToReturn["value"] = v
+ }
+ if v, _ := cacheModeMap["profile-value"]; v != nil {
+ cacheModeMapToReturn["profile_value"] = v
+ }
+ identitySharingSettingsMapToReturn["cache_mode"] = []interface{}{cacheModeMapToReturn}
+ }
+ if v, _ := identitySharingSettingsMap["cache-mode-duration"]; v != nil {
+ cacheModeDurationMap := v.(map[string]interface{})
+ cacheModeDurationMapToReturn := make(map[string]interface{})
+ if v, _ := cacheModeDurationMap["override-profile"]; v != nil {
+ cacheModeDurationMapToReturn["override_profile"] = v
+ }
+ if v, _ := cacheModeDurationMap["value"]; v != nil {
+ cacheModeDurationMapToReturn["value"] = v
+ }
+ if v, _ := cacheModeDurationMap["profile-value"]; v != nil {
+ cacheModeDurationMapToReturn["profile_value"] = v
+ }
+ identitySharingSettingsMapToReturn["cache_mode_duration"] = []interface{}{cacheModeDurationMapToReturn}
+ }
+ if v, _ := identitySharingSettingsMap["receive-from-infinity-identity"]; v != nil {
+ identitySharingSettingsMapToReturn["receive_from_infinity_identity"] = v
+ }
+ if v, _ := identitySharingSettingsMap["scaled-sharing"]; v != nil {
+ identitySharingSettingsMapToReturn["scaled_sharing"] = v
+ }
identityAwarenessSettingsMapToReturn["identity_sharing_settings"] = []interface{}{identitySharingSettingsMapToReturn}
}
}
@@ -2160,6 +3920,124 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
if v := identityAwarenessSettingsMap["remote-access"]; v != nil {
identityAwarenessSettingsMapToReturn["remote_access"] = v
}
+ if v := identityAwarenessSettingsMap["identity-web-api"]; v != nil {
+ identityAwarenessSettingsMapToReturn["identity_web_api"] = v
+ }
+ if v := identityAwarenessSettingsMap["identity-web-api-settings"]; v != nil {
+ identityWebApiSettingsJson := v.(map[string]interface{})
+ identityWebApiSettingsState := make(map[string]interface{})
+ if v := identityWebApiSettingsJson["authentication-settings"]; v != nil {
+ authenticationSettingsJson := v.(map[string]interface{})
+ authenticationSettingsState := make(map[string]interface{})
+ if v := authenticationSettingsJson["users-directories"]; v != nil {
+ usersDirectoriesJson := v.(map[string]interface{})
+ usersDirectoriesState := make(map[string]interface{})
+ if v := usersDirectoriesJson["external-user-profile"]; v != nil {
+ usersDirectoriesState["external_user_profile"] = v
+ }
+ if v := usersDirectoriesJson["internal-users"]; v != nil {
+ usersDirectoriesState["internal_users"] = v
+ }
+ if v := usersDirectoriesJson["users-from-external-directories"]; v != nil {
+ usersDirectoriesState["users_from_external_directories"] = v
+ }
+ if v := usersDirectoriesJson["specific"]; v != nil {
+ usersDirectoriesState["specific"] = v
+ }
+ authenticationSettingsState["users_directories"] = []interface{}{usersDirectoriesState}
+ }
+ identityWebApiSettingsState["authentication_settings"] = []interface{}{authenticationSettingsState}
+ }
+ if v := identityWebApiSettingsJson["authorized-clients"]; v != nil {
+ authorizedClientsList := v.([]interface{})
+ if len(authorizedClientsList) > 0 {
+ var authorizedClientsListState []map[string]interface{}
+ for i := range authorizedClientsList {
+ authorizedClientsItemJson := authorizedClientsList[i].(map[string]interface{})
+ authorizedClientsItemState := make(map[string]interface{})
+ if v := authorizedClientsItemJson["client"]; v != nil {
+ authorizedClientsItemState["client"] = v
+ }
+ authorizedClientsListState = append(authorizedClientsListState, authorizedClientsItemState)
+ }
+ identityWebApiSettingsState["authorized_clients"] = authorizedClientsListState
+ }
+ }
+ if v := identityWebApiSettingsJson["client-access-permissions"]; v != nil {
+ clientAccessPermissionsJson := v.(map[string]interface{})
+ clientAccessPermissionsState := make(map[string]interface{})
+ if v := clientAccessPermissionsJson["accessibility"]; v != nil {
+ accessibilityJson := v.(map[string]interface{})
+ accessibilityState := make(map[string]interface{})
+ if v := accessibilityJson["allow-access-from"]; v != nil {
+ accessibilityState["allow_access_from"] = v
+ }
+ if v := accessibilityJson["internal-access-settings"]; v != nil {
+ internalAccessSettingsJson := v.(map[string]interface{})
+ internalAccessSettingsState := make(map[string]interface{})
+ if v := internalAccessSettingsJson["undefined"]; v != nil {
+ internalAccessSettingsState["undefined"] = v
+ }
+ if v := internalAccessSettingsJson["dmz"]; v != nil {
+ internalAccessSettingsState["dmz"] = v
+ }
+ if v := internalAccessSettingsJson["vpn"]; v != nil {
+ internalAccessSettingsState["vpn"] = v
+ }
+ accessibilityState["internal_access_settings"] = []interface{}{internalAccessSettingsState}
+ }
+ clientAccessPermissionsState["accessibility"] = []interface{}{accessibilityState}
+ }
+ if v := clientAccessPermissionsJson["certificate-settings"]; v != nil {
+ certificateSettingsJson := v.(map[string]interface{})
+ certificateSettingsState := make(map[string]interface{})
+ if v := certificateSettingsJson["certificate"]; v != nil {
+ certificateSettingsState["certificate"] = v
+ }
+ if v := certificateSettingsJson["certificate-dn"]; v != nil {
+ certificateSettingsState["certificate_dn"] = v
+ }
+ if v := certificateSettingsJson["certificate-valid-from"]; v != nil {
+ certificateSettingsState["certificate_valid_from"] = v
+ }
+ if v := certificateSettingsJson["certificate-valid-to"]; v != nil {
+ certificateSettingsState["certificate_valid_to"] = v
+ }
+ clientAccessPermissionsState["certificate_settings"] = []interface{}{certificateSettingsState}
+ }
+ if v := clientAccessPermissionsJson["portal-web-settings"]; v != nil {
+ portalWebSettingsJson := v.(map[string]interface{})
+ portalWebSettingsState := make(map[string]interface{})
+ if v := portalWebSettingsJson["aliases"]; v != nil {
+ portalWebSettingsState["aliases"] = v
+ }
+ if v := portalWebSettingsJson["ip-address"]; v != nil {
+ portalWebSettingsState["ip_address"] = v
+ }
+ if v := portalWebSettingsJson["main-url"]; v != nil {
+ portalWebSettingsState["main_url"] = v
+ }
+ clientAccessPermissionsState["portal_web_settings"] = []interface{}{portalWebSettingsState}
+ }
+ identityWebApiSettingsState["client_access_permissions"] = []interface{}{clientAccessPermissionsState}
+ }
+ identityAwarenessSettingsMapToReturn["identity_web_api_settings"] = []interface{}{identityWebApiSettingsState}
+ }
+ if v := identityAwarenessSettingsMap["ad-query"]; v != nil {
+ identityAwarenessSettingsMapToReturn["ad_query"] = v
+ }
+ if v := identityAwarenessSettingsMap["collecting-identities"]; v != nil {
+ identityAwarenessSettingsMapToReturn["collecting_identities"] = v
+ }
+ if v := identityAwarenessSettingsMap["identity-based-enforcement"]; v != nil {
+ identityAwarenessSettingsMapToReturn["identity_based_enforcement"] = v
+ }
+ if v := identityAwarenessSettingsMap["radius-accounting"]; v != nil {
+ identityAwarenessSettingsMapToReturn["radius_accounting"] = v
+ }
+ if v := identityAwarenessSettingsMap["terminal-servers"]; v != nil {
+ identityAwarenessSettingsMapToReturn["terminal_servers"] = v
+ }
_ = d.Set("identity_awareness_settings", []interface{}{identityAwarenessSettingsMapToReturn})
}
@@ -2200,6 +4078,9 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
natSettingsMapToReturn["method"] = v
}
+ if v := natSettingsMap["apply-control-connections"]; v != nil {
+ natSettingsMapToReturn["apply_control_connections"] = v
+ }
_ = d.Set("nat_settings", []interface{}{natSettingsMapToReturn})
} else {
@@ -2225,6 +4106,9 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
if v, _ := portalWebSettingsMap["main-url"]; v != nil {
portalWebSettingsMapToReturn["main_url"] = v
}
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
platformPortalSettingsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
}
}
@@ -2237,8 +4121,17 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
if v, _ := certificateSettingsMap["base64-certificate"]; v != nil {
certificateSettingsMapToReturn["base64_certificate"] = v
}
- if v, _ := certificateSettingsMap["base64-password"]; v != nil {
- certificateSettingsMapToReturn["base64_password"] = v
+ if v, _ := certificateSettingsMap["certificate"]; v != nil {
+ certificateSettingsMapToReturn["certificate"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-dn"]; v != nil {
+ certificateSettingsMapToReturn["certificate_dn"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-from"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_from"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-to"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_to"] = v
}
platformPortalSettingsMapToReturn["certificate_settings"] = []interface{}{certificateSettingsMapToReturn}
}
@@ -2258,6 +4151,9 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
platformPortalSettingsMapToReturn["accessibility"] = []interface{}{accessibilityMapToReturn}
}
}
+ if v := platformPortalSettingsMap["enabled"]; v != nil {
+ platformPortalSettingsMapToReturn["enabled"] = v
+ }
_ = d.Set("platform_portal_settings", []interface{}{platformPortalSettingsMapToReturn})
}
@@ -2313,6 +4209,9 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
if v, _ := portalWebSettingsMap["main-url"]; v != nil {
portalWebSettingsMapToReturn["main_url"] = v
}
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
usercheckPortalSettingsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
}
}
@@ -2325,8 +4224,17 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
if v, _ := certificateSettingsMap["base64-certificate"]; v != nil {
certificateSettingsMapToReturn["base64_certificate"] = v
}
- if v, _ := certificateSettingsMap["base64-password"]; v != nil {
- certificateSettingsMapToReturn["base64_password"] = v
+ if v, _ := certificateSettingsMap["certificate"]; v != nil {
+ certificateSettingsMapToReturn["certificate"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-dn"]; v != nil {
+ certificateSettingsMapToReturn["certificate_dn"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-from"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_from"] = v
+ }
+ if v, _ := certificateSettingsMap["certificate-valid-to"]; v != nil {
+ certificateSettingsMapToReturn["certificate_valid_to"] = v
}
usercheckPortalSettingsMapToReturn["certificate_settings"] = []interface{}{certificateSettingsMapToReturn}
}
@@ -2398,6 +4306,18 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
if v, _ := antiSpoofingSettingsJson["action"]; v != nil {
antiSpoofingSettingsState["action"] = v
}
+ if v := antiSpoofingSettingsJson["exclude-packets"]; v != nil {
+ antiSpoofingSettingsState["exclude_packets"] = v
+ }
+ if v := antiSpoofingSettingsJson["excluded-network-name"]; v != nil {
+ antiSpoofingSettingsState["excluded_network_name"] = v
+ }
+ if v := antiSpoofingSettingsJson["excluded-network-uid"]; v != nil {
+ antiSpoofingSettingsState["excluded_network_uid"] = v
+ }
+ if v := antiSpoofingSettingsJson["spoof-tracking"]; v != nil {
+ antiSpoofingSettingsState["spoof_tracking"] = v
+ }
interfaceState["anti_spoofing_settings"] = []interface{}{antiSpoofingSettingsState}
}
if v, _ := interfaceJson["security-zone"]; v != nil {
@@ -2640,6 +4560,12 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
_ = d.Set("send_logs_to_server", nil)
}
+ if v := gateway["export-logs-to-servers"]; v != nil {
+ _ = d.Set("export_logs_to_servers", v)
+ } else {
+ _ = d.Set("export_logs_to_servers", nil)
+ }
+
if gateway["logs-settings"] != nil {
logsSettingsMap := gateway["logs-settings"].(map[string]interface{})
@@ -2746,6 +4672,15 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
logsSettingsMapToReturn["update_account_log_every"] = v
}
+ if v := logsSettingsMap["alert-when-free-disk-space-below-metrics"]; v != nil {
+ logsSettingsMapToReturn["alert_when_free_disk_space_below_metrics"] = v
+ }
+ if v := logsSettingsMap["distribute-logs-between-all-active-servers"]; v != nil {
+ logsSettingsMapToReturn["distribute_logs_between_all_active_servers"] = v
+ }
+ if v := logsSettingsMap["include-tcp-state-information"]; v != nil {
+ logsSettingsMapToReturn["include_tcp_state_information"] = v
+ }
_ = d.Set("logs_settings", []interface{}{logsSettingsMapToReturn})
} else {
@@ -2799,6 +4734,135 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
}
authenticationState["authentication_clients"] = clientsIds
}
+ if v := authenticationJson["single-authentication-client"]; v != nil {
+ singleAuthenticationClientJson := v.(map[string]interface{})
+ singleAuthenticationClientState := make(map[string]interface{})
+ if v := singleAuthenticationClientJson["enabled"]; v != nil {
+ singleAuthenticationClientState["enabled"] = v
+ }
+ if v := singleAuthenticationClientJson["allow-multiple-authentication-clients"]; v != nil {
+ singleAuthenticationClientState["allow_multiple_authentication_clients"] = v
+ }
+ if v := singleAuthenticationClientJson["display-name"]; v != nil {
+ singleAuthenticationClientState["display_name"] = v
+ }
+ if v := singleAuthenticationClientJson["method"]; v != nil {
+ singleAuthenticationClientState["method"] = v
+ }
+ if v := singleAuthenticationClientJson["secur-id"]; v != nil {
+ securIdJson := v.(map[string]interface{})
+ securIdState := make(map[string]interface{})
+ if v := securIdJson["server"]; v != nil {
+ securIdState["server"] = v.(map[string]interface{})["name"]
+ }
+ if v := securIdJson["token-card-type"]; v != nil {
+ securIdState["token_card_type"] = v
+ }
+ singleAuthenticationClientState["secur_id"] = []interface{}{securIdState}
+ }
+ if v := singleAuthenticationClientJson["radius"]; v != nil {
+ radiusJson := v.(map[string]interface{})
+ radiusState := make(map[string]interface{})
+ if v := radiusJson["server"]; v != nil {
+ radiusState["server"] = v.(map[string]interface{})["name"]
+ }
+ if v := radiusJson["ask-user-password"]; v != nil {
+ radiusState["ask_user_password"] = v
+ }
+ singleAuthenticationClientState["radius"] = []interface{}{radiusState}
+ }
+ if v := singleAuthenticationClientJson["personal-certificate"]; v != nil {
+ personalCertificateJson := v.(map[string]interface{})
+ personalCertificateState := make(map[string]interface{})
+ if v := personalCertificateJson["fetch-username-from"]; v != nil {
+ personalCertificateState["fetch_username_from"] = v
+ }
+ if v := personalCertificateJson["storage-type"]; v != nil {
+ personalCertificateState["storage_type"] = v
+ }
+ if v := personalCertificateJson["source"]; v != nil {
+ personalCertificateState["source"] = v
+ }
+ if v := personalCertificateJson["dn-part"]; v != nil {
+ personalCertificateState["dn_part"] = v
+ }
+ if v := personalCertificateJson["dn-concurrence"]; v != nil {
+ personalCertificateState["dn_concurrence"] = v
+ }
+ singleAuthenticationClientState["personal_certificate"] = []interface{}{personalCertificateState}
+ }
+ if v := singleAuthenticationClientJson["client-display-settings"]; v != nil {
+ clientDisplaySettingsJson := v.(map[string]interface{})
+ clientDisplaySettingsState := make(map[string]interface{})
+ if v := clientDisplaySettingsJson["headline"]; v != nil {
+ clientDisplaySettingsState["headline"] = v
+ }
+ if v := clientDisplaySettingsJson["username-label"]; v != nil {
+ clientDisplaySettingsState["username_label"] = v
+ }
+ if v := clientDisplaySettingsJson["password-label"]; v != nil {
+ clientDisplaySettingsState["password_label"] = v
+ }
+ singleAuthenticationClientState["client_display_settings"] = []interface{}{clientDisplaySettingsState}
+ }
+ authenticationState["single_authentication_client"] = []interface{}{singleAuthenticationClientState}
+ }
+ if v := authenticationJson["override-global-dynamic-id-settings"]; v != nil {
+ authenticationState["override_global_dynamic_id_settings"] = v
+ }
+ if v := authenticationJson["dynamic-id-settings"]; v != nil {
+ dynamicIdSettingsJson := v.(map[string]interface{})
+ dynamicIdSettingsState := make(map[string]interface{})
+ if v := dynamicIdSettingsJson["sms-provider-and-email-settings"]; v != nil {
+ dynamicIdSettingsState["sms_provider_and_email_settings"] = v
+ }
+ if v := dynamicIdSettingsJson["sms-provider-credentials"]; v != nil {
+ smsProviderCredentialsJson := v.(map[string]interface{})
+ smsProviderCredentialsState := make(map[string]interface{})
+ if v := smsProviderCredentialsJson["username"]; v != nil {
+ smsProviderCredentialsState["username"] = v
+ }
+ if v := smsProviderCredentialsJson["api-id"]; v != nil {
+ smsProviderCredentialsState["api_id"] = v
+ }
+ dynamicIdSettingsState["sms_provider_credentials"] = []interface{}{smsProviderCredentialsState}
+ }
+ if v := dynamicIdSettingsJson["advanced-settings"]; v != nil {
+ advancedSettingsJson := v.(map[string]interface{})
+ advancedSettingsState := make(map[string]interface{})
+ if v := advancedSettingsJson["dynamic-id-message"]; v != nil {
+ advancedSettingsState["dynamic_id_message"] = v
+ }
+ if v := advancedSettingsJson["otp-settings"]; v != nil {
+ otpSettingsJson := v.(map[string]interface{})
+ otpSettingsState := make(map[string]interface{})
+ if v := otpSettingsJson["length"]; v != nil {
+ otpSettingsState["length"] = v
+ }
+ if v := otpSettingsJson["expiration"]; v != nil {
+ otpSettingsState["expiration"] = v
+ }
+ if v := otpSettingsJson["max-attempts"]; v != nil {
+ otpSettingsState["max_attempts"] = v
+ }
+ advancedSettingsState["otp_settings"] = []interface{}{otpSettingsState}
+ }
+ if v := advancedSettingsJson["enable-display-user-details"]; v != nil {
+ advancedSettingsState["enable_display_user_details"] = v
+ }
+ if v := advancedSettingsJson["country-code"]; v != nil {
+ advancedSettingsState["country_code"] = v
+ }
+ if v := advancedSettingsJson["user-details-retrieval"]; v != nil {
+ advancedSettingsState["user_details_retrieval"] = v
+ }
+ dynamicIdSettingsState["advanced_settings"] = []interface{}{advancedSettingsState}
+ }
+ authenticationState["dynamic_id_settings"] = []interface{}{dynamicIdSettingsState}
+ }
+ if v := authenticationJson["send-machine-certificate"]; v != nil {
+ authenticationState["send_machine_certificate"] = v
+ }
vpnSettingsState["authentication"] = []interface{}{authenticationState}
}
@@ -2814,6 +4878,41 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
if v := linkSelectionJson["ip-address"]; v != nil {
linkSelectionState["ip_address"] = v
}
+ if v := linkSelectionJson["route-selection-method"]; v != nil {
+ linkSelectionState["route_selection_method"] = v
+ }
+ if v := linkSelectionJson["responding-traffic"]; v != nil {
+ linkSelectionState["responding_traffic"] = v
+ }
+ if v := linkSelectionJson["source-ip-selection"]; v != nil {
+ linkSelectionState["source_ip_selection"] = v
+ }
+ if v := linkSelectionJson["selected-ip"]; v != nil {
+ linkSelectionState["selected_ip"] = v
+ }
+ if v := linkSelectionJson["outgoing-link-tracking"]; v != nil {
+ linkSelectionState["outgoing_link_tracking"] = v
+ }
+ if v := linkSelectionJson["probing-settings"]; v != nil {
+ probingSettingsJson := v.(map[string]interface{})
+ probingSettingsState := make(map[string]interface{})
+ if v := probingSettingsJson["probed-interfaces"]; v != nil {
+ probingSettingsState["probed_interfaces"] = v
+ }
+ if v := probingSettingsJson["probed-interface-list"]; v != nil {
+ probingSettingsState["probed_interface_list"] = v
+ }
+ if v := probingSettingsJson["use-primary-address"]; v != nil {
+ probingSettingsState["use_primary_address"] = v
+ }
+ if v := probingSettingsJson["primary-address"]; v != nil {
+ probingSettingsState["primary_address"] = v
+ }
+ if v := probingSettingsJson["probing-method"]; v != nil {
+ probingSettingsState["probing_method"] = v
+ }
+ linkSelectionState["probing_settings"] = []interface{}{probingSettingsState}
+ }
vpnSettingsState["link_selection"] = []interface{}{linkSelectionState}
}
if v := vpnSettingsJson["maximum-concurrent-ike-negotiations"]; v != nil {
@@ -2957,6 +5056,237 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
}
vpnSettingsState["office_mode"] = []interface{}{officeModeState}
}
+
+ if v := vpnSettingsJson["advanced"]; v != nil {
+ advancedJson := v.(map[string]interface{})
+ advancedState := make(map[string]interface{})
+ if v := advancedJson["tunnel-sharing-mode"]; v != nil {
+ advancedState["tunnel_sharing_mode"] = v
+ }
+ if v := advancedJson["shutdown-on-gateway-restart"]; v != nil {
+ advancedState["shutdown_on_gateway_restart"] = v
+ }
+ if v := advancedJson["enable-wire-mode"]; v != nil {
+ advancedState["enable_wire_mode"] = v
+ }
+ if v := advancedJson["wire-mode-interfaces"]; v != nil {
+ interfacesJson := v.([]interface{})
+ var interfacesIds = make([]string, 0)
+ if len(interfacesJson) > 0 {
+ for _, iface := range interfacesJson {
+ interfacesIds = append(interfacesIds, iface.(map[string]interface{})["name"].(string))
+ }
+ }
+ advancedState["wire_mode_interfaces"] = interfacesIds
+ }
+ if v := advancedJson["enable-wire-mode-log-traffic"]; v != nil {
+ advancedState["enable_wire_mode_log_traffic"] = v
+ }
+ if v := advancedJson["enable-nat-traversal"]; v != nil {
+ advancedState["enable_nat_traversal"] = v
+ }
+ vpnSettingsState["advanced"] = []interface{}{advancedState}
+ }
+
+ if v := vpnSettingsJson["exported-routes"]; v != nil {
+ exportedRoutesJson := v.(map[string]interface{})
+ exportedRoutesState := make(map[string]interface{})
+ if v := exportedRoutesJson["internal-interfaces"]; v != nil {
+ exportedRoutesState["internal_interfaces"] = v
+ }
+ if v := exportedRoutesJson["static-routes"]; v != nil {
+ exportedRoutesState["static_routes"] = v
+ }
+ if v := exportedRoutesJson["custom-routes"]; v != nil {
+ exportedRoutesState["custom_routes"] = v
+ }
+ if v := exportedRoutesJson["custom-routes-object"]; v != nil {
+ exportedRoutesState["custom_routes_object"] = v.(map[string]interface{})["name"]
+ }
+ vpnSettingsState["exported_routes"] = []interface{}{exportedRoutesState}
+ }
+
+ if v := vpnSettingsJson["vpn-clients"]; v != nil {
+ vpnClientsJson := v.(map[string]interface{})
+ vpnClientsState := make(map[string]interface{})
+ if v := vpnClientsJson["enable-endpoint-security-vpn"]; v != nil {
+ vpnClientsState["enable_endpoint_security_vpn"] = v
+ }
+ if v := vpnClientsJson["enable-cp-mobile-for-windows"]; v != nil {
+ vpnClientsState["enable_cp_mobile_for_windows"] = v
+ }
+ if v := vpnClientsJson["enable-secu-remote"]; v != nil {
+ vpnClientsState["enable_secu_remote"] = v
+ }
+ if v := vpnClientsJson["enable-capsule-vpn-connect"]; v != nil {
+ vpnClientsState["enable_capsule_vpn_connect"] = v
+ }
+ if v := vpnClientsJson["enable-ssl-network-extender"]; v != nil {
+ vpnClientsState["enable_ssl_network_extender"] = v
+ }
+ if v := vpnClientsJson["gateway-authentication-certificate"]; v != nil {
+ vpnClientsState["gateway_authentication_certificate"] = v
+ }
+ vpnSettingsState["vpn_clients"] = []interface{}{vpnClientsState}
+ }
+
+ if v := vpnSettingsJson["enable-clientless-vpn"]; v != nil {
+ vpnSettingsState["enable_clientless_vpn"] = v
+ }
+
+ if v := vpnSettingsJson["clientless-vpn-settings"]; v != nil {
+ clientlessVpnSettingsJson := v.(map[string]interface{})
+ clientlessVpnSettingsState := make(map[string]interface{})
+ if v := clientlessVpnSettingsJson["certificate-gateway-authentication"]; v != nil {
+ clientlessVpnSettingsState["certificate_gateway_authentication"] = v
+ }
+ if v := clientlessVpnSettingsJson["client-authentication"]; v != nil {
+ clientlessVpnSettingsState["client_authentication"] = v
+ }
+ if v := clientlessVpnSettingsJson["concurrent-servers-or-processes"]; v != nil {
+ clientlessVpnSettingsState["concurrent_servers_or_processes"] = v
+ }
+ if v := clientlessVpnSettingsJson["accept-only-3des"]; v != nil {
+ clientlessVpnSettingsState["accept_only_3des"] = v
+ }
+ vpnSettingsState["clientless_vpn_settings"] = []interface{}{clientlessVpnSettingsState}
+ }
+
+ if v := vpnSettingsJson["saml-portal-settings"]; v != nil {
+ samlPortalSettingsJson := v.(map[string]interface{})
+ samlPortalSettingsState := make(map[string]interface{})
+ if v := samlPortalSettingsJson["enabled"]; v != nil {
+ samlPortalSettingsState["enabled"] = v
+ }
+ if v := samlPortalSettingsJson["portal-web-settings"]; v != nil {
+ portalWebSettingsJson := v.(map[string]interface{})
+ portalWebSettingsState := make(map[string]interface{})
+ if v := portalWebSettingsJson["aliases"]; v != nil {
+ portalWebSettingsState["aliases"] = v
+ }
+ if v := portalWebSettingsJson["ip-address"]; v != nil {
+ portalWebSettingsState["ip_address"] = v
+ }
+ if v := portalWebSettingsJson["main-url"]; v != nil {
+ portalWebSettingsState["main_url"] = v
+ }
+ samlPortalSettingsState["portal_web_settings"] = []interface{}{portalWebSettingsState}
+ }
+ if v := samlPortalSettingsJson["certificate-settings"]; v != nil {
+ certificateSettingsJson := v.(map[string]interface{})
+ certificateSettingsState := make(map[string]interface{})
+ if v := certificateSettingsJson["certificate"]; v != nil {
+ certificateSettingsState["certificate"] = v
+ }
+ if v := certificateSettingsJson["certificate-dn"]; v != nil {
+ certificateSettingsState["certificate_dn"] = v
+ }
+ if v := certificateSettingsJson["certificate-valid-from"]; v != nil {
+ certificateSettingsState["certificate_valid_from"] = v
+ }
+ if v := certificateSettingsJson["certificate-valid-to"]; v != nil {
+ certificateSettingsState["certificate_valid_to"] = v
+ }
+ samlPortalSettingsState["certificate_settings"] = []interface{}{certificateSettingsState}
+ }
+ if v := samlPortalSettingsJson["accessibility"]; v != nil {
+ accessibilityJson := v.(map[string]interface{})
+ accessibilityState := make(map[string]interface{})
+ if v := accessibilityJson["allow-access-from"]; v != nil {
+ accessibilityState["allow_access_from"] = v
+ }
+ if v := accessibilityJson["internal-access-settings"]; v != nil {
+ internalAccessSettingsJson := v.(map[string]interface{})
+ internalAccessSettingsState := make(map[string]interface{})
+ if v := internalAccessSettingsJson["undefined"]; v != nil {
+ internalAccessSettingsState["undefined"] = v
+ }
+ if v := internalAccessSettingsJson["dmz"]; v != nil {
+ internalAccessSettingsState["dmz"] = v
+ }
+ if v := internalAccessSettingsJson["vpn"]; v != nil {
+ internalAccessSettingsState["vpn"] = v
+ }
+ accessibilityState["internal_access_settings"] = []interface{}{internalAccessSettingsState}
+ }
+ samlPortalSettingsState["accessibility"] = []interface{}{accessibilityState}
+ }
+ vpnSettingsState["saml_portal_settings"] = []interface{}{samlPortalSettingsState}
+ }
+
+ if v := vpnSettingsJson["certificates"]; v != nil {
+ certificatesList := v.([]interface{})
+ if len(certificatesList) > 0 {
+ var certificatesListState []map[string]interface{}
+ for i := range certificatesList {
+ certificateJson := certificatesList[i].(map[string]interface{})
+ certificateState := make(map[string]interface{})
+ if v := certificateJson["name"]; v != nil {
+ certificateState["name"] = v
+ }
+ if v := certificateJson["stored-at"]; v != nil {
+ certificateState["stored_at"] = v
+ }
+ if v := certificateJson["status"]; v != nil {
+ certificateState["status"] = v
+ }
+ if v := certificateJson["distinguished-name"]; v != nil {
+ certificateState["distinguished_name"] = v
+ }
+ if v := certificateJson["base64-certificate"]; v != nil {
+ certificateState["base64_certificate"] = v
+ }
+ if v := certificateJson["certificate-authority"]; v != nil {
+ certificateState["certificate_authority"] = v.(map[string]interface{})["name"]
+ }
+ if v := certificateJson["expiration-date"]; v != nil {
+ expirationDateJson := v.(map[string]interface{})
+ expirationDateState := make(map[string]interface{})
+ if v := expirationDateJson["iso-8601"]; v != nil {
+ expirationDateState["iso_8601"] = v
+ }
+ if v := expirationDateJson["posix"]; v != nil {
+ expirationDateState["posix"] = v
+ }
+ certificateState["expiration_date"] = []interface{}{expirationDateState}
+ }
+ certificatesListState = append(certificatesListState, certificateState)
+ }
+ vpnSettingsState["certificates"] = certificatesListState
+ }
+ }
+
+ if v := vpnSettingsJson["interfaces"]; v != nil {
+ interfacesList := v.([]interface{})
+ if len(interfacesList) > 0 {
+ var interfacesListState []map[string]interface{}
+ for i := range interfacesList {
+ interfacesItemJson := interfacesList[i].(map[string]interface{})
+ interfacesItemState := make(map[string]interface{})
+ if v := interfacesItemJson["interface-name"]; v != nil {
+ interfacesItemState["interface_name"] = v
+ }
+ if v := interfacesItemJson["next-hop-ip"]; v != nil {
+ interfacesItemState["next_hop_ip"] = v
+ }
+ if v := interfacesItemJson["static-nat-ip"]; v != nil {
+ interfacesItemState["static_nat_ip"] = v
+ }
+ if v := interfacesItemJson["priority"]; v != nil {
+ interfacesItemState["priority"] = v
+ }
+ if v := interfacesItemJson["redundancy-mode"]; v != nil {
+ interfacesItemState["redundancy_mode"] = v
+ }
+ if v := interfacesItemJson["ip-version"]; v != nil {
+ interfacesItemState["ip_version"] = v
+ }
+ interfacesListState = append(interfacesListState, interfacesItemState)
+ }
+ vpnSettingsState["interfaces"] = interfacesListState
+ }
+ }
+
_ = d.Set("vpn_settings", []interface{}{vpnSettingsState})
} else {
_ = d.Set("vpn_settings", nil)
@@ -2983,5 +5313,208 @@ func dataSourceManagementSimpleGatewayRead(d *schema.ResourceData, m interface{}
_ = d.Set("color", v)
}
+ if v := gateway["accept-syslog-messages"]; v != nil {
+ _ = d.Set("accept_syslog_messages", v)
+ }
+
+ if v := gateway["anti-spam-and-email-security"]; v != nil {
+ _ = d.Set("anti_spam_and_email_security", v)
+ }
+
+ if v := gateway["auto-generate-ip"]; v != nil {
+ _ = d.Set("auto_generate_ip", v)
+ }
+
+ if v := gateway["auto-topology-custom-recalculation-time"]; v != nil {
+ _ = d.Set("auto_topology_custom_recalculation_time", v)
+ }
+
+ if v := gateway["auto-topology-use-custom-recalculation-time"]; v != nil {
+ _ = d.Set("auto_topology_use_custom_recalculation_time", v)
+ }
+
+ if v := gateway["autonomous-system-number"]; v != nil {
+ _ = d.Set("autonomous_system_number", v)
+ }
+
+ if v := gateway["data-loss-prevention"]; v != nil {
+ _ = d.Set("data_loss_prevention", v)
+ }
+
+ if v := gateway["dns-server"]; v != nil {
+ _ = d.Set("dns_server", v)
+ }
+
+ if v := gateway["enable-log-indexing"]; v != nil {
+ _ = d.Set("enable_log_indexing", v)
+ }
+
+ if v := gateway["externally-managed"]; v != nil {
+ _ = d.Set("externally_managed", v)
+ }
+
+ if v := gateway["hardware-subtype"]; v != nil {
+ _ = d.Set("hardware_subtype", v)
+ }
+
+ if v := gateway["install-policy-without-push"]; v != nil {
+ _ = d.Set("install_policy_without_push", v)
+ }
+
+ if v := gateway["interfaces-topology-settings"]; v != nil {
+ _ = d.Set("interfaces_topology_settings", v)
+ }
+
+ if v := gateway["legacy-url-filtering"]; v != nil {
+ _ = d.Set("legacy_url_filtering", v)
+ }
+
+ if v := gateway["log-server"]; v != nil {
+ _ = d.Set("log_server", v)
+ }
+
+ if v := gateway["mobile-access"]; v != nil {
+ _ = d.Set("mobile_access", v)
+ }
+
+ if v := gateway["monitoring"]; v != nil {
+ _ = d.Set("monitoring", v)
+ }
+
+ if v := gateway["network-policy-management"]; v != nil {
+ _ = d.Set("network_policy_management", v)
+ }
+
+ if v := gateway["policy-server"]; v != nil {
+ _ = d.Set("policy_server", v)
+ }
+
+ if v := gateway["rtm-counters-report"]; v != nil {
+ _ = d.Set("rtm_counters_report", v)
+ }
+
+ if v := gateway["rtm-traffic-report"]; v != nil {
+ _ = d.Set("rtm_traffic_report", v)
+ }
+
+ if v := gateway["rtm-traffic-report-per-connection"]; v != nil {
+ _ = d.Set("rtm_traffic_report_per_connection", v)
+ }
+
+ if v := gateway["sic-message"]; v != nil {
+ _ = d.Set("sic_message", v)
+ }
+
+ if v := gateway["smart-event-intro-correlation-unit"]; v != nil {
+ _ = d.Set("smart_event_intro_correlation_unit", v)
+ }
+
+ if v := gateway["threat-prevention-mode"]; v != nil {
+ _ = d.Set("threat_prevention_mode", v)
+ }
+
+ if v := gateway["trust-method"]; v != nil {
+ _ = d.Set("trust_method", v)
+ }
+
+ if v := gateway["workforce-ai"]; v != nil {
+ _ = d.Set("workforce_ai", v)
+ }
+
+ if v := gateway["communication-with-servers-behind-nat"]; v != nil {
+ communicationWithServersBehindNatShow := v.(map[string]interface{})
+ communicationWithServersBehindNatState := make(map[string]interface{})
+ if v := communicationWithServersBehindNatShow["override-profile"]; v != nil {
+ communicationWithServersBehindNatState["override_profile"] = v
+ }
+ if v := communicationWithServersBehindNatShow["value"]; v != nil {
+ communicationWithServersBehindNatState["value"] = v
+ }
+ _ = d.Set("communication_with_servers_behind_nat", []interface{}{communicationWithServersBehindNatState})
+ }
+
+ if v := gateway["smb-logs-settings"]; v != nil {
+ smbLogsSettingsShow := v.(map[string]interface{})
+ smbLogsSettingsState := make(map[string]interface{})
+ if v := smbLogsSettingsShow["alert-when-queue-is-full"]; v != nil {
+ smbLogsSettingsState["alert_when_queue_is_full"] = v
+ }
+ if v := smbLogsSettingsShow["alert-when-queue-is-full-type"]; v != nil {
+ smbLogsSettingsState["alert_when_queue_is_full_type"] = v
+ }
+ if v := smbLogsSettingsShow["detect-new-citrix-ica-application-names"]; v != nil {
+ smbLogsSettingsState["detect_new_citrix_ica_application_names"] = v
+ }
+ if v := smbLogsSettingsShow["stop-logging-when-queue-reaches-maximal-capacity"]; v != nil {
+ smbLogsSettingsState["stop_logging_when_queue_reaches_maximal_capacity"] = v
+ }
+ if v := smbLogsSettingsShow["stop-logging-when-queue-reaches-maximal-capacity-threshold"]; v != nil {
+ smbLogsSettingsState["stop_logging_when_queue_reaches_maximal_capacity_threshold"] = v
+ }
+ if v := smbLogsSettingsShow["turn-on-qos-logging"]; v != nil {
+ smbLogsSettingsState["turn_on_qos_logging"] = v
+ }
+ if v := smbLogsSettingsShow["update-account-log-every"]; v != nil {
+ smbLogsSettingsState["update_account_log_every"] = v
+ }
+ _ = d.Set("smb_logs_settings", []interface{}{smbLogsSettingsState})
+ }
+
+ if v := gateway["zero-phishing-settings"]; v != nil {
+ zeroPhishingSettingsShow := v.(map[string]interface{})
+ zeroPhishingSettingsState := make(map[string]interface{})
+ if v := zeroPhishingSettingsShow["gateway-fqdn-mode"]; v != nil {
+ zeroPhishingSettingsState["gateway_fqdn_mode"] = v
+ }
+ if v := zeroPhishingSettingsShow["manual-fqdn"]; v != nil {
+ zeroPhishingSettingsState["manual_fqdn"] = v
+ }
+ _ = d.Set("zero_phishing_settings", []interface{}{zeroPhishingSettingsState})
+ }
+
+ if v := gateway["fetch-policy-scheduler"]; v != nil {
+ fetchPolicySchedulerShow := v.(map[string]interface{})
+ fetchPolicySchedulerState := make(map[string]interface{})
+ if v := fetchPolicySchedulerShow["enabled"]; v != nil {
+ fetchPolicySchedulerState["enabled"] = v
+ }
+ if v := fetchPolicySchedulerShow["schedule"]; v != nil {
+ fetchPolicySchedulerState["schedule"] = v.(map[string]interface{})["name"]
+ }
+ _ = d.Set("fetch_policy_scheduler", []interface{}{fetchPolicySchedulerState})
+ }
+
+ if v := gateway["trust-details"]; v != nil {
+ trustDetailsShow := v.(map[string]interface{})
+ trustDetailsState := make(map[string]interface{})
+ if v := trustDetailsShow["authentication-token"]; v != nil {
+ trustDetailsState["authentication_token"] = v
+ }
+ if v := trustDetailsShow["cloud-communication-details"]; v != nil {
+ cloudCommunicationDetailsShow := v.(map[string]interface{})
+ cloudCommunicationDetailsState := make(map[string]interface{})
+ if v := cloudCommunicationDetailsShow["ip"]; v != nil {
+ cloudCommunicationDetailsState["ip"] = v
+ }
+ if v := cloudCommunicationDetailsShow["status"]; v != nil {
+ cloudCommunicationDetailsState["status"] = v
+ }
+ trustDetailsState["cloud_communication_details"] = []interface{}{cloudCommunicationDetailsState}
+ }
+ if v := trustDetailsShow["gateway-mac-address"]; v != nil {
+ trustDetailsState["gateway_mac_address"] = v
+ }
+ if v := trustDetailsShow["identification-method"]; v != nil {
+ trustDetailsState["identification_method"] = v
+ }
+ if v := trustDetailsShow["status"]; v != nil {
+ trustDetailsState["status"] = v
+ }
+ if v := trustDetailsShow["token-expiration-date"]; v != nil {
+ trustDetailsState["token_expiration_date"] = v
+ }
+ _ = d.Set("trust_details", []interface{}{trustDetailsState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_smart_task.go b/checkpoint/data_source_checkpoint_management_smart_task.go
index d07aa1e8..06176824 100644
--- a/checkpoint/data_source_checkpoint_management_smart_task.go
+++ b/checkpoint/data_source_checkpoint_management_smart_task.go
@@ -56,6 +56,7 @@ func dataSourceManagementSmartTask() *schema.Resource {
"shared_secret": {
Type: schema.TypeString,
Computed: true,
+ Sensitive: true,
Description: "Shared secret that can be used by the target server to identify the Management Server.
The value will be sent as part of the request in the \"X-chkp-shared-secret\" header.",
},
"time_out": {
diff --git a/checkpoint/data_source_checkpoint_management_smtp_server.go b/checkpoint/data_source_checkpoint_management_smtp_server.go
index bbc00bd7..eadcfaec 100644
--- a/checkpoint/data_source_checkpoint_management_smtp_server.go
+++ b/checkpoint/data_source_checkpoint_management_smtp_server.go
@@ -41,11 +41,6 @@ func dataSourceManagementSmtpServer() *schema.Resource {
Computed: true,
Description: "Encryption type.",
},
- "password": {
- Type: schema.TypeString,
- Computed: true,
- Description: "A password for the SMTP server.
Required only if authentication is set to true.",
- },
"username": {
Type: schema.TypeString,
Computed: true,
@@ -136,10 +131,6 @@ func dataSourceManagementSmtpServerRead(d *schema.ResourceData, m interface{}) e
_ = d.Set("encryption", v)
}
- if v := smtpServer["password"]; v != nil {
- _ = d.Set("password", v)
- }
-
if v := smtpServer["username"]; v != nil {
_ = d.Set("username", v)
}
diff --git a/checkpoint/data_source_checkpoint_management_subordinate_ca.go b/checkpoint/data_source_checkpoint_management_subordinate_ca.go
index b7655f40..141ba2da 100644
--- a/checkpoint/data_source_checkpoint_management_subordinate_ca.go
+++ b/checkpoint/data_source_checkpoint_management_subordinate_ca.go
@@ -69,6 +69,11 @@ func dataSourceManagementSubordinateCa() *schema.Resource {
Description: "Direct tcp transport layer settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate authority IP address.",
+ },
"port": {
Type: schema.TypeInt,
Computed: true,
@@ -97,6 +102,11 @@ func dataSourceManagementSubordinateCa() *schema.Resource {
Description: "Direct tcp transport layer settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "ip_address": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate authority IP address.",
+ },
"port": {
Type: schema.TypeInt,
Computed: true,
@@ -235,6 +245,9 @@ func dataSourceManagementSubordinateCaRead(d *schema.ResourceData, m interface{}
directTcpSettingsMap := v.(map[string]interface{})
directTcpSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := directTcpSettingsMap["ip-address"]; v != nil {
+ directTcpSettingsMapToReturn["ip_address"] = v
+ }
if v, _ := directTcpSettingsMap["port"]; v != nil {
directTcpSettingsMapToReturn["port"] = v
}
@@ -257,6 +270,9 @@ func dataSourceManagementSubordinateCaRead(d *schema.ResourceData, m interface{}
directTcpSettingsMap := v.(map[string]interface{})
directTcpSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := directTcpSettingsMap["ip-address"]; v != nil {
+ directTcpSettingsMapToReturn["ip_address"] = v
+ }
if v, _ := directTcpSettingsMap["port"]; v != nil {
directTcpSettingsMapToReturn["port"] = v
}
diff --git a/checkpoint/data_source_checkpoint_management_tacacs_server.go b/checkpoint/data_source_checkpoint_management_tacacs_server.go
index 4e093ebf..c6058d85 100644
--- a/checkpoint/data_source_checkpoint_management_tacacs_server.go
+++ b/checkpoint/data_source_checkpoint_management_tacacs_server.go
@@ -69,6 +69,43 @@ func dataSourceManagementTacacsServer() *schema.Resource {
Description: "Server service, only relevant when \"server-type\" is TACACS.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "groups": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Standard level.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "aggressive_aging": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Sets short (aggressive) timeouts for idle connections.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "default_timeout": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Default aggressive aging timeout in seconds.",
+ },
+ "enable": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "N/A",
+ },
+ "timeout": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Aggressive aging timeout in seconds.",
+ },
+ "use_default_timeout": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
"name": {
Type: schema.TypeString,
Computed: true,
@@ -79,6 +116,41 @@ func dataSourceManagementTacacsServer() *schema.Resource {
Computed: true,
Description: "Object unique identifier.",
},
+ "keep_connections_open_after_policy_installation": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Keep connections open after policy has been installed even if they are not allowed under the new policy. This overrides the settings in the Connection...",
+ },
+ "match_for_any": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether this service is used when 'Any' is set as the rule's service and there are several service objects with the same source port and pro...",
+ },
+ "port": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The number of the port used to provide this service.",
+ },
+ "session_timeout": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Time (in seconds) before the session times out.",
+ },
+ "source_port": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Port number for the client side service. If specified, only those Source port Numbers will be Accepted, Dropped, or Rejected during packet inspection....",
+ },
+ "sync_connections_on_cluster": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enables state-synchronized High Availability or Load Sharing on a ClusterXL or OPSEC-certified cluster.",
+ },
+ "use_default_session_timeout": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Use default virtual session timeout.",
+ },
},
},
},
@@ -173,6 +245,23 @@ func dataSourceManagementTacacsServerRead(d *schema.ResourceData, m interface{})
serviceMapToReturn := make(map[string]interface{})
+ if v := serviceMap["aggressive-aging"]; v != nil {
+ aggressiveAgingShow := v.(map[string]interface{})
+ aggressiveAgingState := make(map[string]interface{})
+ if v := aggressiveAgingShow["default-timeout"]; v != nil {
+ aggressiveAgingState["default_timeout"] = v
+ }
+ if v := aggressiveAgingShow["enable"]; v != nil {
+ aggressiveAgingState["enable"] = v
+ }
+ if v := aggressiveAgingShow["timeout"]; v != nil {
+ aggressiveAgingState["timeout"] = v
+ }
+ if v := aggressiveAgingShow["use-default-timeout"]; v != nil {
+ aggressiveAgingState["use_default_timeout"] = v
+ }
+ serviceMapToReturn["aggressive_aging"] = []interface{}{aggressiveAgingState}
+ }
if v := serviceMap["name"]; v != nil {
serviceMapToReturn["name"] = v
}
@@ -180,6 +269,35 @@ func dataSourceManagementTacacsServerRead(d *schema.ResourceData, m interface{})
serviceMapToReturn["uid"] = v
}
+ if v := serviceMap["keep-connections-open-after-policy-installation"]; v != nil {
+ serviceMapToReturn["keep_connections_open_after_policy_installation"] = v
+ }
+ if v := serviceMap["match-for-any"]; v != nil {
+ serviceMapToReturn["match_for_any"] = v
+ }
+ if v := serviceMap["port"]; v != nil {
+ serviceMapToReturn["port"] = v
+ }
+ if v := serviceMap["session-timeout"]; v != nil {
+ serviceMapToReturn["session_timeout"] = v
+ }
+ if v := serviceMap["source-port"]; v != nil {
+ serviceMapToReturn["source_port"] = v
+ }
+ if v := serviceMap["sync-connections-on-cluster"]; v != nil {
+ serviceMapToReturn["sync_connections_on_cluster"] = v
+ }
+ if v := serviceMap["use-default-session-timeout"]; v != nil {
+ serviceMapToReturn["use_default_session_timeout"] = v
+ }
+ if v := serviceMap["groups"]; v != nil {
+ groupsList := v.([]interface{})
+ groupsIds := make([]string, 0)
+ for _, item := range groupsList {
+ groupsIds = append(groupsIds, item.(map[string]interface{})["name"].(string))
+ }
+ serviceMapToReturn["groups"] = groupsIds
+ }
_ = d.Set("service", []interface{}{serviceMapToReturn})
} else {
diff --git a/checkpoint/data_source_checkpoint_management_task.go b/checkpoint/data_source_checkpoint_management_task.go
index db1b01de..9b94ea7c 100644
--- a/checkpoint/data_source_checkpoint_management_task.go
+++ b/checkpoint/data_source_checkpoint_management_task.go
@@ -28,6 +28,59 @@ func dataSourceManagementTask() *schema.Resource {
Description: "N/A",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "previous_task_id": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "ID of the previous task in the execution sequence, on which this task depends.",
+ },
+ "progress_description": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "revert_status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "start_time": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "N/A",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ "last_update_time": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "N/A",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
"status": {
Type: schema.TypeString,
Computed: true,
@@ -104,6 +157,28 @@ func dataSourceManagementTaskRead(d *schema.ResourceData, m interface{}) error {
tasksMapToAdd := make(map[string]interface{})
+ if v := tasksMap["start-time"]; v != nil {
+ startTimeShow := v.(map[string]interface{})
+ startTimeState := make(map[string]interface{})
+ if v := startTimeShow["iso-8601"]; v != nil {
+ startTimeState["iso_8601"] = v
+ }
+ if v := startTimeShow["posix"]; v != nil {
+ startTimeState["posix"] = v
+ }
+ tasksMapToAdd["start_time"] = []interface{}{startTimeState}
+ }
+ if v := tasksMap["last-update-time"]; v != nil {
+ lastUpdateTimeShow := v.(map[string]interface{})
+ lastUpdateTimeState := make(map[string]interface{})
+ if v := lastUpdateTimeShow["iso-8601"]; v != nil {
+ lastUpdateTimeState["iso_8601"] = v
+ }
+ if v := lastUpdateTimeShow["posix"]; v != nil {
+ lastUpdateTimeState["posix"] = v
+ }
+ tasksMapToAdd["last_update_time"] = []interface{}{lastUpdateTimeState}
+ }
if v, _ := tasksMap["comments"]; v != nil {
tasksMapToAdd["comments"] = v
}
@@ -122,6 +197,15 @@ func dataSourceManagementTaskRead(d *schema.ResourceData, m interface{}) error {
if v, _ := tasksMap["suppressed"]; v != nil {
tasksMapToAdd["suppressed"] = v
}
+ if v := tasksMap["previous-task-id"]; v != nil {
+ tasksMapToAdd["previous_task_id"] = v
+ }
+ if v := tasksMap["progress-description"]; v != nil {
+ tasksMapToAdd["progress_description"] = v
+ }
+ if v := tasksMap["revert-status"]; v != nil {
+ tasksMapToAdd["revert_status"] = v
+ }
tasksListToReturn = append(tasksListToReturn, tasksMapToAdd)
}
_ = d.Set("tasks", tasksListToReturn)
diff --git a/checkpoint/data_source_checkpoint_management_threat_indicator.go b/checkpoint/data_source_checkpoint_management_threat_indicator.go
index c9f82915..5d53e055 100644
--- a/checkpoint/data_source_checkpoint_management_threat_indicator.go
+++ b/checkpoint/data_source_checkpoint_management_threat_indicator.go
@@ -63,6 +63,16 @@ func dataSourceManagementThreatIndicator() *schema.Resource {
Type: schema.TypeString,
},
},
+ "number_of_observables": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "The amount of observables in the indicator.",
+ },
+ "observables_raw_data": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The contents of the file containing the indicator's observables.
Available only when details-level is full.",
+ },
},
}
}
@@ -161,5 +171,13 @@ func dataSourceManagementThreatIndicatorRead(d *schema.ResourceData, m interface
_ = d.Set("tags", nil)
}
+ if v := threatIndicator["number-of-observables"]; v != nil {
+ _ = d.Set("number_of_observables", v)
+ }
+
+ if v := threatIndicator["observables-raw-data"]; v != nil {
+ _ = d.Set("observables_raw_data", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_threat_ioc_feed.go b/checkpoint/data_source_checkpoint_management_threat_ioc_feed.go
index 030475c3..c8b12ded 100644
--- a/checkpoint/data_source_checkpoint_management_threat_ioc_feed.go
+++ b/checkpoint/data_source_checkpoint_management_threat_ioc_feed.go
@@ -95,11 +95,6 @@ func dataSourceManagementThreatIocFeed() *schema.Resource {
Computed: true,
Description: "Feed type to be enforced.",
},
- "password": {
- Type: schema.TypeString,
- Computed: true,
- Description: "password for authenticating with the URL.",
- },
"tags": {
Type: schema.TypeSet,
Computed: true,
@@ -143,6 +138,26 @@ func dataSourceManagementThreatIocFeed() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "confidence": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "N/A",
+ },
+ "performance_impact": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "N/A",
+ },
+ "severity": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "N/A",
+ },
+ "use_snort_format": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "N/A",
+ },
},
}
}
@@ -260,10 +275,6 @@ func dataSourceManagementThreatIocFeedRead(d *schema.ResourceData, m interface{}
_ = d.Set("feed_type", v)
}
- if v := threatIocFeed["password"]; v != nil {
- _ = d.Set("password", v)
- }
-
if threatIocFeed["tags"] != nil {
tagsJson, ok := threatIocFeed["tags"].([]interface{})
if ok {
@@ -316,6 +327,22 @@ func dataSourceManagementThreatIocFeedRead(d *schema.ResourceData, m interface{}
_ = d.Set("ignore_errors", v)
}
+ if v := threatIocFeed["confidence"]; v != nil {
+ _ = d.Set("confidence", v)
+ }
+
+ if v := threatIocFeed["performance-impact"]; v != nil {
+ _ = d.Set("performance_impact", v)
+ }
+
+ if v := threatIocFeed["severity"]; v != nil {
+ _ = d.Set("severity", v)
+ }
+
+ if v := threatIocFeed["use-snort-format"]; v != nil {
+ _ = d.Set("use_snort_format", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_threat_layer.go b/checkpoint/data_source_checkpoint_management_threat_layer.go
index ea67ee1e..0e780f11 100644
--- a/checkpoint/data_source_checkpoint_management_threat_layer.go
+++ b/checkpoint/data_source_checkpoint_management_threat_layer.go
@@ -49,6 +49,19 @@ func dataSourceManagementThreatLayer() *schema.Resource {
Computed: true,
Description: "N/A",
},
+ "shared": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether this layer is shared.",
+ },
+ "permissions_profiles": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Collection of permission profile objects associated with this layer.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -119,5 +132,20 @@ func dataSourceManagementThreatLayerRead(d *schema.ResourceData, m interface{})
_ = d.Set("parent_layer", v)
}
+ if v := threatLayer["shared"]; v != nil {
+ _ = d.Set("shared", v)
+ }
+
+ if v := threatLayer["permissions-profiles"]; v != nil {
+ permissionsprofilesIdsList := v.([]interface{})
+ var permissionsprofilesIds = make([]string, 0)
+ if len(permissionsprofilesIdsList) > 0 {
+ for _, item := range permissionsprofilesIdsList {
+ permissionsprofilesIds = append(permissionsprofilesIds, item.(map[string]interface{})["name"].(string))
+ }
+ }
+ _ = d.Set("permissions_profiles", permissionsprofilesIds)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_threat_profile.go b/checkpoint/data_source_checkpoint_management_threat_profile.go
index c5010e87..a2a6ef3e 100644
--- a/checkpoint/data_source_checkpoint_management_threat_profile.go
+++ b/checkpoint/data_source_checkpoint_management_threat_profile.go
@@ -177,6 +177,30 @@ func dataSourceManagementThreatProfile() *schema.Resource {
Description: "Overrides per profile for this protection.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "override": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Settings overrides.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "action": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Protection action.",
+ },
+ "capture_packets": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Capture packets.",
+ },
+ "track": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Tracking method for protection.",
+ },
+ },
+ },
+ },
"protection": {
Type: schema.TypeString,
Computed: true,
@@ -424,6 +448,54 @@ func dataSourceManagementThreatProfile() *schema.Resource {
Type: schema.TypeString,
},
},
+ "ai_guard": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Is AI Guard blade activated.",
+ },
+ "advanced_dns_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Advanced DNS Settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "dga_detection": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Enable/Disable DGA based domains detection.",
+ },
+ "dns_domain_tunneling": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Enable/Disable DNS Tunneling based on domains detection.",
+ },
+ "dns_over_https": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Enable/Disable parsing of DNS over HTTPS protocol.",
+ },
+ "nxns_attack_detection": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Enable/Disable NXNS attack detection.",
+ },
+ },
+ },
+ },
+ "ai_guard_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "AI Guard blade settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "project_id": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Lakera project ID to associate with this profile.",
+ },
+ },
+ },
+ },
},
}
}
@@ -587,6 +659,20 @@ func dataSourceManagementThreatProfileRead(d *schema.ResourceData, m interface{}
for i := range overridesList {
overridesJson := overridesList[i].(map[string]interface{})
overrideState := make(map[string]interface{})
+ if v := overridesJson["override"]; v != nil {
+ overrideObjShow := v.(map[string]interface{})
+ overrideObjState := make(map[string]interface{})
+ if v := overrideObjShow["action"]; v != nil {
+ overrideObjState["action"] = v
+ }
+ if v := overrideObjShow["capture-packets"]; v != nil {
+ overrideObjState["capture_packets"] = v
+ }
+ if v := overrideObjShow["track"]; v != nil {
+ overrideObjState["track"] = v
+ }
+ overrideState["override"] = []interface{}{overrideObjState}
+ }
if v, _ := overridesJson["protection"]; v != nil {
overrideState["protection"] = v
}
@@ -774,5 +860,36 @@ func dataSourceManagementThreatProfileRead(d *schema.ResourceData, m interface{}
_ = d.Set("tags", nil)
}
+ if v := threatProfile["ai-guard"]; v != nil {
+ _ = d.Set("ai_guard", v)
+ }
+
+ if v := threatProfile["advanced-dns-settings"]; v != nil {
+ advancedDnsSettingsShow := v.(map[string]interface{})
+ advancedDnsSettingsState := make(map[string]interface{})
+ if v := advancedDnsSettingsShow["dga-detection"]; v != nil {
+ advancedDnsSettingsState["dga_detection"] = v
+ }
+ if v := advancedDnsSettingsShow["dns-domain-tunneling"]; v != nil {
+ advancedDnsSettingsState["dns_domain_tunneling"] = v
+ }
+ if v := advancedDnsSettingsShow["dns-over-https"]; v != nil {
+ advancedDnsSettingsState["dns_over_https"] = v
+ }
+ if v := advancedDnsSettingsShow["nxns-attack-detection"]; v != nil {
+ advancedDnsSettingsState["nxns_attack_detection"] = v
+ }
+ _ = d.Set("advanced_dns_settings", []interface{}{advancedDnsSettingsState})
+ }
+
+ if v := threatProfile["ai-guard-settings"]; v != nil {
+ aiGuardSettingsShow := v.(map[string]interface{})
+ aiGuardSettingsState := make(map[string]interface{})
+ if v := aiGuardSettingsShow["project-id"]; v != nil {
+ aiGuardSettingsState["project_id"] = v
+ }
+ _ = d.Set("ai_guard_settings", []interface{}{aiGuardSettingsState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_threat_rule.go b/checkpoint/data_source_checkpoint_management_threat_rule.go
index d87f019f..1439aa01 100644
--- a/checkpoint/data_source_checkpoint_management_threat_rule.go
+++ b/checkpoint/data_source_checkpoint_management_threat_rule.go
@@ -112,6 +112,11 @@ func dataSourceManagementThreatRule() *schema.Resource {
Computed: true,
Description: "Packet capture.",
},
+ "forensics": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Whether to enable forensics.",
+ },
},
},
},
@@ -128,6 +133,11 @@ func dataSourceManagementThreatRule() *schema.Resource {
Type: schema.TypeString,
},
},
+ "exceptions_layer": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The rule's exceptions layer.",
+ },
},
}
}
@@ -290,6 +300,9 @@ func dataSourceManagementThreatRuleRead(d *schema.ResourceData, m interface{}) e
trackSettingsState["packet_capture"] = v.(bool)
}
+ if v := trackSettingsMap["forensics"]; v != nil {
+ trackSettingsState["forensics"] = v
+ }
_ = d.Set("track_settings", []interface{}{trackSettingsState})
}
@@ -309,5 +322,9 @@ func dataSourceManagementThreatRuleRead(d *schema.ResourceData, m interface{}) e
_ = d.Set("comments", v)
}
+ if v := threatRule["exceptions-layer"]; v != nil {
+ _ = d.Set("exceptions_layer", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_threat_rulebase.go b/checkpoint/data_source_checkpoint_management_threat_rulebase.go
index 391a2c76..de3c7eaa 100644
--- a/checkpoint/data_source_checkpoint_management_threat_rulebase.go
+++ b/checkpoint/data_source_checkpoint_management_threat_rulebase.go
@@ -330,6 +330,14 @@ func dataSourceManagementThreatRuleBase() *schema.Resource {
},
},
},
+ "objects_dictionary": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Standard level.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -614,5 +622,16 @@ func dataSourceManagementThreatRuleBaseRead(d *schema.ResourceData, m interface{
}
outputRuleBase = append(outputRuleBase, ruleBaseToReturn)
_ = d.Set("rulebase", outputRuleBase)
+ if v := ruleBaseJson["objects-dictionary"]; v != nil {
+ objectsdictionaryIdsList := v.([]interface{})
+ var objectsdictionaryIds = make([]string, 0)
+ if len(objectsdictionaryIdsList) > 0 {
+ for _, item := range objectsdictionaryIdsList {
+ objectsdictionaryIds = append(objectsdictionaryIds, item.(map[string]interface{})["name"].(string))
+ }
+ }
+ _ = d.Set("objects_dictionary", objectsdictionaryIds)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_trusted_client.go b/checkpoint/data_source_checkpoint_management_trusted_client.go
index 6694916b..66f71370 100644
--- a/checkpoint/data_source_checkpoint_management_trusted_client.go
+++ b/checkpoint/data_source_checkpoint_management_trusted_client.go
@@ -102,6 +102,11 @@ func dataSourceManagementTrustedClient() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "subnet_mask4": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "IPv4 mask.",
+ },
},
}
}
@@ -234,6 +239,10 @@ func dataSourceManagementTrustedClientRead(d *schema.ResourceData, m interface{}
_ = d.Set("ignore_errors", v)
}
+ if v := trustedClient["subnet-mask4"]; v != nil {
+ _ = d.Set("subnet_mask4", v)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_user.go b/checkpoint/data_source_checkpoint_management_user.go
index 5e5e85bb..c7d40523 100644
--- a/checkpoint/data_source_checkpoint_management_user.go
+++ b/checkpoint/data_source_checkpoint_management_user.go
@@ -121,6 +121,31 @@ func dataSourceManagementUser() *schema.Resource {
Computed: true,
Description: "Enable IKE shared secret.",
},
+ "data_integrity_algorithm": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "IKE data integrity algorithm.",
+ },
+ "encryption_algorithm": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "IKE encryption algorithm.",
+ },
+ "ike": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "IKE users encryption enabled.",
+ },
+ "public_key": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "IKE public key enabled.",
+ },
+ "shared_secret": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "IKE shared secret enabled.",
+ },
},
},
},
@@ -142,6 +167,64 @@ func dataSourceManagementUser() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "certificates": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "User certificates.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "base64_certificate": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate file encoded in base64.
File format: .P12.",
+ },
+ "comments": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate comments.",
+ },
+ "registration_key": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Registration key for enrollment.",
+ },
+ "status": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate status.",
+ },
+ "subject": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Certificate subject.",
+ },
+ "uid": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Object unique identifier.",
+ },
+ "valid_to": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Expiration date.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "iso_8601": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Date and time represented in international ISO 8601 format.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
},
}
}
@@ -263,6 +346,21 @@ func dataSourceManagementUserRead(d *schema.ResourceData, m interface{}) error {
encryptionMapToReturn["enable_shared_secret"] = v.(bool)
}
+ if v := encryptionMap["data-integrity-algorithm"]; v != nil {
+ encryptionMapToReturn["data_integrity_algorithm"] = v
+ }
+ if v := encryptionMap["encryption-algorithm"]; v != nil {
+ encryptionMapToReturn["encryption_algorithm"] = v
+ }
+ if v := encryptionMap["ike"]; v != nil {
+ encryptionMapToReturn["ike"] = v
+ }
+ if v := encryptionMap["public-key"]; v != nil {
+ encryptionMapToReturn["public_key"] = v
+ }
+ if v := encryptionMap["shared-secret"]; v != nil {
+ encryptionMapToReturn["shared_secret"] = v
+ }
_ = d.Set("encryption", []interface{}{encryptionMapToReturn})
} else {
@@ -293,5 +391,45 @@ func dataSourceManagementUserRead(d *schema.ResourceData, m interface{}) error {
_ = d.Set("comments", v)
}
+ if v := user["certificates"]; v != nil {
+ certificatesList := v.([]interface{})
+ var certificatesListState []map[string]interface{}
+ for i := range certificatesList {
+ certificatesShow := certificatesList[i].(map[string]interface{})
+ certificatesState := make(map[string]interface{})
+ if v := certificatesShow["base64-certificate"]; v != nil {
+ certificatesState["base64_certificate"] = v
+ }
+ if v := certificatesShow["comments"]; v != nil {
+ certificatesState["comments"] = v
+ }
+ if v := certificatesShow["registration-key"]; v != nil {
+ certificatesState["registration_key"] = v
+ }
+ if v := certificatesShow["status"]; v != nil {
+ certificatesState["status"] = v
+ }
+ if v := certificatesShow["subject"]; v != nil {
+ certificatesState["subject"] = v
+ }
+ if v := certificatesShow["uid"]; v != nil {
+ certificatesState["uid"] = v
+ }
+ if v := certificatesShow["valid-to"]; v != nil {
+ validToShow := v.(map[string]interface{})
+ validToState := make(map[string]interface{})
+ if v := validToShow["iso-8601"]; v != nil {
+ validToState["iso_8601"] = v
+ }
+ if v := validToShow["posix"]; v != nil {
+ validToState["posix"] = v
+ }
+ certificatesState["valid_to"] = []interface{}{validToState}
+ }
+ certificatesListState = append(certificatesListState, certificatesState)
+ }
+ _ = d.Set("certificates", certificatesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_user_template.go b/checkpoint/data_source_checkpoint_management_user_template.go
index b9a2dd91..d0db1558 100644
--- a/checkpoint/data_source_checkpoint_management_user_template.go
+++ b/checkpoint/data_source_checkpoint_management_user_template.go
@@ -116,6 +116,31 @@ func dataSourceManagementUserTemplate() *schema.Resource {
Computed: true,
Description: "Enable IKE shared secret.",
},
+ "data_integrity_algorithm": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "IKE data integrity algorithm.",
+ },
+ "encryption_algorithm": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "IKE encryption algorithm.",
+ },
+ "ike": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "IKE users encryption enabled.",
+ },
+ "public_key": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "IKE public key enabled.",
+ },
+ "shared_secret": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "IKE shared secret enabled.",
+ },
},
},
},
@@ -254,6 +279,21 @@ func dataSourceManagementUserTemplateRead(d *schema.ResourceData, m interface{})
encryptionMapToReturn["enable_shared_secret"] = v.(bool)
}
+ if v := encryptionMap["data-integrity-algorithm"]; v != nil {
+ encryptionMapToReturn["data_integrity_algorithm"] = v
+ }
+ if v := encryptionMap["encryption-algorithm"]; v != nil {
+ encryptionMapToReturn["encryption_algorithm"] = v
+ }
+ if v := encryptionMap["ike"]; v != nil {
+ encryptionMapToReturn["ike"] = v
+ }
+ if v := encryptionMap["public-key"]; v != nil {
+ encryptionMapToReturn["public_key"] = v
+ }
+ if v := encryptionMap["shared-secret"]; v != nil {
+ encryptionMapToReturn["shared_secret"] = v
+ }
_ = d.Set("encryption", []interface{}{encryptionMapToReturn})
} else {
diff --git a/checkpoint/data_source_checkpoint_management_vmware_data_center_server.go b/checkpoint/data_source_checkpoint_management_vmware_data_center_server.go
index d548be43..4a648149 100644
--- a/checkpoint/data_source_checkpoint_management_vmware_data_center_server.go
+++ b/checkpoint/data_source_checkpoint_management_vmware_data_center_server.go
@@ -64,6 +64,35 @@ func dataSourceManagementVMwareDataCenterServer() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
+ "automatic_refresh": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether the data center server's content is automatically updated.",
+ },
+ "data_center_type": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Data Center type.",
+ },
+ "properties": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Data Center properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "name": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "N/A",
+ },
+ },
+ },
+ },
},
}
}
@@ -157,6 +186,31 @@ func dataSourceVMwareDataCenterServerRead(d *schema.ResourceData, m interface{})
_ = d.Set("ignore_errors", v)
}
+ if v := vmwareDataCenterServer["automatic-refresh"]; v != nil {
+ _ = d.Set("automatic_refresh", v)
+ }
+
+ if v := vmwareDataCenterServer["data-center-type"]; v != nil {
+ _ = d.Set("data_center_type", v)
+ }
+
+ if v := vmwareDataCenterServer["properties"]; v != nil {
+ propertiesList := v.([]interface{})
+ var propertiesListState []map[string]interface{}
+ for i := range propertiesList {
+ propertiesShow := propertiesList[i].(map[string]interface{})
+ propertiesState := make(map[string]interface{})
+ if v := propertiesShow["name"]; v != nil {
+ propertiesState["name"] = v
+ }
+ if v := propertiesShow["value"]; v != nil {
+ propertiesState["value"] = v
+ }
+ propertiesListState = append(propertiesListState, propertiesState)
+ }
+ _ = d.Set("properties", propertiesListState)
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_vpn_community_meshed.go b/checkpoint/data_source_checkpoint_management_vpn_community_meshed.go
index f871cf46..57945ef4 100644
--- a/checkpoint/data_source_checkpoint_management_vpn_community_meshed.go
+++ b/checkpoint/data_source_checkpoint_management_vpn_community_meshed.go
@@ -193,6 +193,11 @@ func dataSourceManagementVpnCommunityMeshed() *schema.Resource {
Computed: true,
Description: "The name of the interface.",
},
+ "ip_version": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The IP version of the interface's IP address (IPv4/IPv6).",
+ },
"next_hop_ip": {
Type: schema.TypeString,
Computed: true,
@@ -295,6 +300,21 @@ func dataSourceManagementVpnCommunityMeshed() *schema.Resource {
Description: "Ike Phase 1 settings. Only applicable when the encryption-suite is set to [custom].",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "multiple_key_exchanges": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Multiple Key Exchanges proposal object.",
+ },
+ "use_multiple_key_exchanges": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with Multiple Key Exchanges.",
+ },
+ "use_standard_proposal": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with a single Diffie-Hellman group.",
+ },
"data_integrity": {
Type: schema.TypeString,
Computed: true,
@@ -324,6 +344,21 @@ func dataSourceManagementVpnCommunityMeshed() *schema.Resource {
Description: "Ike Phase 2 settings. Only applicable when the encryption-suite is set to [custom].",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "multiple_key_exchanges": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Multiple Key Exchanges proposal object to use when PFS is enabled and multiple key exchanges are configured.",
+ },
+ "use_multiple_key_exchanges": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with Multiple Key Exchanges when PFS is enabled.",
+ },
+ "use_standard_proposal": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with a single Diffie-Hellman group when PFS is enabled.",
+ },
"data_integrity": {
Type: schema.TypeString,
Computed: true,
@@ -532,6 +567,92 @@ func dataSourceManagementVpnCommunityMeshed() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "route_based_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "VPN Community Route-Based settings.
Relevant only in Route-Based VPN Communities.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "add_automatic_routes": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The type of routes to use for the automatic Route-Based configuration.
Relevant only in Route-Based VPN Communities.",
+ },
+ "advanced": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Advanced settings
Relevant only in Route-Based VPN Communities.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "bfd": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to enable Bidirectional Forwarding Detection.
Relevant only in Route-Based VPN Communities.",
+ },
+ "graceful_restart": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to enable Graceful Restart in the applicable Dynamic Routing protocols.
Relevant only in Route-Based VPN Communities...",
+ },
+ },
+ },
+ },
+ "override_routes": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Override automatic routing settings in a specific Security Gateway in this VPN Community.
Relevant only in Route-Based VPN Communities...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "auto_config": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to configure the routing settings automatically for the Security Gateway.
Relevant only in Route-Based VPN CommunitiesExported Routes.
Relevant only in Route-Based VPN Communities.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "custom_routes": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Specifies to export user-defined networks from the Security Gateway.
Relevant only in Route-Based VPN Communities.",
+ },
+ "custom_routes_object": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Specifies the name of the Network object or Network Group object that represents the exported routes.
Relevant only in Route-Based VPN Com...",
+ },
+ "internal_interfaces": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Specifies to export networks from interfaces with Topology 'Internal' from the Security Gateway.
Relevant only in Route-Based VPN Communit...",
+ },
+ "static_routes": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Specifies to export static routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.",
+ },
+ },
+ },
+ },
+ "gateway": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Name of the Security Gateway object in which to override the automatic routing settings.
Relevant only in Route-Based VPN Communities<...",
+ },
+ "mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Specifies how to export routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
},
}
}
@@ -652,6 +773,15 @@ func dataSourceManagementVpnCommunityMeshedRead(d *schema.ResourceData, m interf
ikePhase1MapToReturn["ike_p1_rekey_time"] = strconv.Itoa(int(v.(float64)))
}
+ if v := ikePhase1Map["multiple-key-exchanges"]; v != nil {
+ ikePhase1MapToReturn["multiple_key_exchanges"] = v.(map[string]interface{})["name"]
+ }
+ if v := ikePhase1Map["use-multiple-key-exchanges"]; v != nil {
+ ikePhase1MapToReturn["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase1Map["use-standard-proposal"]; v != nil {
+ ikePhase1MapToReturn["use_standard_proposal"] = v
+ }
_ = d.Set("ike_phase_1", []interface{}{ikePhase1MapToReturn})
} else {
@@ -680,6 +810,15 @@ func dataSourceManagementVpnCommunityMeshedRead(d *schema.ResourceData, m interf
ikePhase2MapToReturn["ike_p2_rekey_time"] = strconv.Itoa(int(v.(float64)))
}
+ if v := ikePhase2Map["multiple-key-exchanges"]; v != nil {
+ ikePhase2MapToReturn["multiple_key_exchanges"] = v.(map[string]interface{})["name"]
+ }
+ if v := ikePhase2Map["use-multiple-key-exchanges"]; v != nil {
+ ikePhase2MapToReturn["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase2Map["use-standard-proposal"]; v != nil {
+ ikePhase2MapToReturn["use_standard_proposal"] = v
+ }
_ = d.Set("ike_phase_2", []interface{}{ikePhase2MapToReturn})
} else {
@@ -710,24 +849,34 @@ func dataSourceManagementVpnCommunityMeshedRead(d *schema.ResourceData, m interf
overrideInterfacesMapToAdd["gateway"] = v
}
if v := overrideInterfacesMap["interfaces"]; v != nil {
- interfacesShow := v.(map[string]interface{})
- interfacesState := make(map[string]interface{})
- if v := interfacesShow["interface-name"]; v != nil {
- interfacesState["interface_name"] = v
- }
- if v := interfacesShow["next-hop-ip"]; v != nil {
- interfacesState["next_hop_ip"] = v
- }
- if v := interfacesShow["static-nat-ip"]; v != nil {
- interfacesState["static_nat_ip"] = v
- }
- if v := interfacesShow["priority"]; v != nil {
- interfacesState["priority"] = v
- }
- if v := interfacesShow["redundancy-mode"]; v != nil {
- interfacesState["redundancy_mode"] = v
+ interfacesList := v.([]interface{})
+ if len(interfacesList) > 0 {
+ var interfacesListState []map[string]interface{}
+ for j := range interfacesList {
+ interfacesShow := interfacesList[j].(map[string]interface{})
+ interfacesState := make(map[string]interface{})
+ if v := interfacesShow["interface-name"]; v != nil {
+ interfacesState["interface_name"] = v
+ }
+ if v := interfacesShow["ip-version"]; v != nil {
+ interfacesState["ip_version"] = v
+ }
+ if v := interfacesShow["next-hop-ip"]; v != nil {
+ interfacesState["next_hop_ip"] = v
+ }
+ if v := interfacesShow["static-nat-ip"]; v != nil {
+ interfacesState["static_nat_ip"] = v
+ }
+ if v := interfacesShow["priority"]; v != nil {
+ interfacesState["priority"] = v
+ }
+ if v := interfacesShow["redundancy-mode"]; v != nil {
+ interfacesState["redundancy_mode"] = v
+ }
+ interfacesListState = append(interfacesListState, interfacesState)
+ }
+ overrideInterfacesMapToAdd["interfaces"] = interfacesListState
}
- overrideInterfacesMapToAdd["interfaces"] = interfacesState
}
overrideInterfacesListToReturn = append(overrideInterfacesListToReturn, overrideInterfacesMapToAdd)
}
@@ -863,6 +1012,15 @@ func dataSourceManagementVpnCommunityMeshedRead(d *schema.ResourceData, m interf
if v := ikePhase1Show["ike-p1-rekey-time"]; v != nil {
ikePhase1State["ike_p1_rekey_time"] = strconv.Itoa(int(v.(float64)))
}
+ if v := ikePhase1Show["multiple-key-exchanges"]; v != nil {
+ ikePhase1State["multiple_key_exchanges"] = v.(map[string]interface{})["name"]
+ }
+ if v := ikePhase1Show["use-multiple-key-exchanges"]; v != nil {
+ ikePhase1State["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase1Show["use-standard-proposal"]; v != nil {
+ ikePhase1State["use_standard_proposal"] = v
+ }
granularEncryptionState["ike_phase_1"] = []interface{}{ikePhase1State}
}
@@ -884,6 +1042,15 @@ func dataSourceManagementVpnCommunityMeshedRead(d *schema.ResourceData, m interf
if v := ikePhase2Show["ike-p2-rekey-time"]; v != nil {
ikePhase2State["ike_p2_rekey_time"] = strconv.Itoa(int(v.(float64)))
}
+ if v := ikePhase2Show["multiple-key-exchanges"]; v != nil {
+ ikePhase2State["multiple_key_exchanges"] = v.(map[string]interface{})["name"]
+ }
+ if v := ikePhase2Show["use-multiple-key-exchanges"]; v != nil {
+ ikePhase2State["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase2Show["use-standard-proposal"]; v != nil {
+ ikePhase2State["use_standard_proposal"] = v
+ }
granularEncryptionState["ike_phase_2"] = []interface{}{ikePhase2State}
}
granularEncryptionsState = append(granularEncryptionsState, granularEncryptionState)
@@ -1083,5 +1250,61 @@ func dataSourceManagementVpnCommunityMeshedRead(d *schema.ResourceData, m interf
_ = d.Set("comments", v)
}
+ if v := vpnCommunityMeshed["route-based-settings"]; v != nil {
+ routeBasedSettingsShow := v.(map[string]interface{})
+ routeBasedSettingsState := make(map[string]interface{})
+ if v := routeBasedSettingsShow["add-automatic-routes"]; v != nil {
+ routeBasedSettingsState["add_automatic_routes"] = v
+ }
+ if v := routeBasedSettingsShow["advanced"]; v != nil {
+ advancedShow := v.(map[string]interface{})
+ advancedState := make(map[string]interface{})
+ if v := advancedShow["bfd"]; v != nil {
+ advancedState["bfd"] = v
+ }
+ if v := advancedShow["graceful-restart"]; v != nil {
+ advancedState["graceful_restart"] = v
+ }
+ routeBasedSettingsState["advanced"] = []interface{}{advancedState}
+ }
+ if v := routeBasedSettingsShow["override-routes"]; v != nil {
+ overrideRoutesList := v.([]interface{})
+ var overrideRoutesListState []map[string]interface{}
+ for i := range overrideRoutesList {
+ overrideRoutesShow := overrideRoutesList[i].(map[string]interface{})
+ overrideRoutesState := make(map[string]interface{})
+ if v := overrideRoutesShow["auto-config"]; v != nil {
+ overrideRoutesState["auto_config"] = v
+ }
+ if v := overrideRoutesShow["exported-routes"]; v != nil {
+ exportedRoutesShow := v.(map[string]interface{})
+ exportedRoutesState := make(map[string]interface{})
+ if v := exportedRoutesShow["custom-routes"]; v != nil {
+ exportedRoutesState["custom_routes"] = v
+ }
+ if v := exportedRoutesShow["custom-routes-object"]; v != nil {
+ exportedRoutesState["custom_routes_object"] = v.(map[string]interface{})["name"]
+ }
+ if v := exportedRoutesShow["internal-interfaces"]; v != nil {
+ exportedRoutesState["internal_interfaces"] = v
+ }
+ if v := exportedRoutesShow["static-routes"]; v != nil {
+ exportedRoutesState["static_routes"] = v
+ }
+ overrideRoutesState["exported_routes"] = []interface{}{exportedRoutesState}
+ }
+ if v := overrideRoutesShow["gateway"]; v != nil {
+ overrideRoutesState["gateway"] = v.(map[string]interface{})["name"]
+ }
+ if v := overrideRoutesShow["mode"]; v != nil {
+ overrideRoutesState["mode"] = v
+ }
+ overrideRoutesListState = append(overrideRoutesListState, overrideRoutesState)
+ }
+ routeBasedSettingsState["override_routes"] = overrideRoutesListState
+ }
+ _ = d.Set("route_based_settings", []interface{}{routeBasedSettingsState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_vpn_community_remote_access.go b/checkpoint/data_source_checkpoint_management_vpn_community_remote_access.go
index bdf72127..47a6f23a 100644
--- a/checkpoint/data_source_checkpoint_management_vpn_community_remote_access.go
+++ b/checkpoint/data_source_checkpoint_management_vpn_community_remote_access.go
@@ -75,6 +75,302 @@ func dataSourceManagementVpnCommunityRemoteAccess() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "encryption": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Encryption settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "encryption_method": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The encryption method to be used.",
+ },
+ "ike_phase_1": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "IKE Phase 1 settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "configured_data_integrity_algorithms": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "The list of configured hash algorithms.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "configured_diffie_hellman_groups": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "The list of configured Diffie-Hellman groups.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "configured_encryption_algorithms": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "The list of configured encryption algorithms.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "data_integrity": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The hash algorithm to be used.",
+ },
+ "diffie_hellman_group": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The Diffie-Hellman group to be used.",
+ },
+ "encryption_algorithm": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The encryption algorithm to be used.",
+ },
+ "ike_p1_rekey_time": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Indicates the time interval for IKE phase 1 renegotiation.",
+ },
+ "multiple_key_exchanges": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Multiple Key Exchanges proposal object.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "additional_key_exchange_1_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional Key-Exchange 1 methods to use.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "additional_key_exchange_2_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional Key-Exchange 2 methods to use.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "additional_key_exchange_3_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional Key-Exchange 3 methods to use.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "additional_key_exchange_4_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional Key-Exchange 4 methods to use.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "additional_key_exchange_5_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional Key-Exchange 5 methods to use.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "additional_key_exchange_6_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional Key-Exchange 6 methods to use.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "additional_key_exchange_7_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional Key-Exchange 7 methods to use.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "key_exchange_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Key-Exchange methods to use. Can contain only Diffie-Hellman groups.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ },
+ },
+ "use_multiple_key_exchanges": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with Multiple Key Exchanges.",
+ },
+ "use_standard_proposal": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with a single Diffie-Hellman group.",
+ },
+ },
+ },
+ },
+ "ike_phase_2": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "IKE Phase 2 settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "configured_data_integrity_algorithms": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "The list of configured hash algorithms.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "configured_diffie_hellman_groups": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "The list of configured Diffie-Hellman groups.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "configured_encryption_algorithms": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "The list of configured encryption algorithms.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "data_integrity": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The hash algorithm to be used.",
+ },
+ "encryption_algorithm": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The encryption algorithm to be used.",
+ },
+ "enforce_encryption_alg_and_data_integrity_on_all_users": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Enforce Encryption Algorithm and Data Integrity on all users.",
+ },
+ "ike_p2_pfs_dh_grp": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The Diffie-Hellman group to be used.",
+ },
+ "ike_p2_rekey_time": {
+ Type: schema.TypeInt,
+ Computed: true,
+ Description: "Indicates the time interval for IKE phase 2 renegotiation.",
+ },
+ "ike_p2_use_pfs": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether Perfect Forward Secrecy (PFS) is being used for IKE phase 2.",
+ },
+ "multiple_key_exchanges": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Multiple Key Exchanges proposal object to use when PFS is enabled and multiple key exchanges are configured.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "additional_key_exchange_1_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional Key-Exchange 1 methods to use.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "additional_key_exchange_2_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional Key-Exchange 2 methods to use.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "additional_key_exchange_3_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional Key-Exchange 3 methods to use.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "additional_key_exchange_4_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional Key-Exchange 4 methods to use.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "additional_key_exchange_5_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional Key-Exchange 5 methods to use.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "additional_key_exchange_6_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional Key-Exchange 6 methods to use.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "additional_key_exchange_7_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Additional Key-Exchange 7 methods to use.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "key_exchange_methods": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Key-Exchange methods to use. Can contain only Diffie-Hellman groups.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ },
+ },
+ "use_multiple_key_exchanges": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with Multiple Key Exchanges when PFS is enabled.",
+ },
+ "use_standard_proposal": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with a single Diffie-Hellman group when PFS is enabled.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
},
}
}
@@ -198,5 +494,142 @@ func dataSourceManagementVpnCommunityRemoteAccessRead(d *schema.ResourceData, m
_ = d.Set("comments", v)
}
+ if v := vpnCommunityRemoteAccess["encryption"]; v != nil {
+ encryptionShow := v.(map[string]interface{})
+ encryptionState := make(map[string]interface{})
+ if v := encryptionShow["encryption-method"]; v != nil {
+ encryptionState["encryption_method"] = v
+ }
+ if v := encryptionShow["ike-phase-1"]; v != nil {
+ ikePhase1Show := v.(map[string]interface{})
+ ikePhase1State := make(map[string]interface{})
+ if v := ikePhase1Show["configured-data-integrity-algorithms"]; v != nil {
+ ikePhase1State["configured_data_integrity_algorithms"] = v
+ }
+ if v := ikePhase1Show["configured-diffie-hellman-groups"]; v != nil {
+ ikePhase1State["configured_diffie_hellman_groups"] = v
+ }
+ if v := ikePhase1Show["configured-encryption-algorithms"]; v != nil {
+ ikePhase1State["configured_encryption_algorithms"] = v
+ }
+ if v := ikePhase1Show["data-integrity"]; v != nil {
+ ikePhase1State["data_integrity"] = v
+ }
+ if v := ikePhase1Show["diffie-hellman-group"]; v != nil {
+ ikePhase1State["diffie_hellman_group"] = v
+ }
+ if v := ikePhase1Show["encryption-algorithm"]; v != nil {
+ ikePhase1State["encryption_algorithm"] = v
+ }
+ if v := ikePhase1Show["ike-p1-rekey-time"]; v != nil {
+ ikePhase1State["ike_p1_rekey_time"] = v
+ }
+ if v := ikePhase1Show["multiple-key-exchanges"]; v != nil {
+ multipleKeyExchangesShow := v.(map[string]interface{})
+ multipleKeyExchangesState := make(map[string]interface{})
+ if v := multipleKeyExchangesShow["additional-key-exchange-1-methods"]; v != nil {
+ multipleKeyExchangesState["additional_key_exchange_1_methods"] = v
+ }
+ if v := multipleKeyExchangesShow["additional-key-exchange-2-methods"]; v != nil {
+ multipleKeyExchangesState["additional_key_exchange_2_methods"] = v
+ }
+ if v := multipleKeyExchangesShow["additional-key-exchange-3-methods"]; v != nil {
+ multipleKeyExchangesState["additional_key_exchange_3_methods"] = v
+ }
+ if v := multipleKeyExchangesShow["additional-key-exchange-4-methods"]; v != nil {
+ multipleKeyExchangesState["additional_key_exchange_4_methods"] = v
+ }
+ if v := multipleKeyExchangesShow["additional-key-exchange-5-methods"]; v != nil {
+ multipleKeyExchangesState["additional_key_exchange_5_methods"] = v
+ }
+ if v := multipleKeyExchangesShow["additional-key-exchange-6-methods"]; v != nil {
+ multipleKeyExchangesState["additional_key_exchange_6_methods"] = v
+ }
+ if v := multipleKeyExchangesShow["additional-key-exchange-7-methods"]; v != nil {
+ multipleKeyExchangesState["additional_key_exchange_7_methods"] = v
+ }
+ if v := multipleKeyExchangesShow["key-exchange-methods"]; v != nil {
+ multipleKeyExchangesState["key_exchange_methods"] = v
+ }
+ ikePhase1State["multiple_key_exchanges"] = []interface{}{multipleKeyExchangesState}
+ }
+ if v := ikePhase1Show["use-multiple-key-exchanges"]; v != nil {
+ ikePhase1State["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase1Show["use-standard-proposal"]; v != nil {
+ ikePhase1State["use_standard_proposal"] = v
+ }
+ encryptionState["ike_phase_1"] = []interface{}{ikePhase1State}
+ }
+ if v := encryptionShow["ike-phase-2"]; v != nil {
+ ikePhase2Show := v.(map[string]interface{})
+ ikePhase2State := make(map[string]interface{})
+ if v := ikePhase2Show["configured-data-integrity-algorithms"]; v != nil {
+ ikePhase2State["configured_data_integrity_algorithms"] = v
+ }
+ if v := ikePhase2Show["configured-diffie-hellman-groups"]; v != nil {
+ ikePhase2State["configured_diffie_hellman_groups"] = v
+ }
+ if v := ikePhase2Show["configured-encryption-algorithms"]; v != nil {
+ ikePhase2State["configured_encryption_algorithms"] = v
+ }
+ if v := ikePhase2Show["data-integrity"]; v != nil {
+ ikePhase2State["data_integrity"] = v
+ }
+ if v := ikePhase2Show["encryption-algorithm"]; v != nil {
+ ikePhase2State["encryption_algorithm"] = v
+ }
+ if v := ikePhase2Show["enforce-encryption-alg-and-data-integrity-on-all-users"]; v != nil {
+ ikePhase2State["enforce_encryption_alg_and_data_integrity_on_all_users"] = v
+ }
+ if v := ikePhase2Show["ike-p2-pfs-dh-grp"]; v != nil {
+ ikePhase2State["ike_p2_pfs_dh_grp"] = v
+ }
+ if v := ikePhase2Show["ike-p2-rekey-time"]; v != nil {
+ ikePhase2State["ike_p2_rekey_time"] = v
+ }
+ if v := ikePhase2Show["ike-p2-use-pfs"]; v != nil {
+ ikePhase2State["ike_p2_use_pfs"] = v
+ }
+ if v := ikePhase2Show["multiple-key-exchanges"]; v != nil {
+ multipleKeyExchangesShow := v.(map[string]interface{})
+ multipleKeyExchangesState := make(map[string]interface{})
+ if v := multipleKeyExchangesShow["additional-key-exchange-1-methods"]; v != nil {
+ multipleKeyExchangesState["additional_key_exchange_1_methods"] = v
+ }
+ if v := multipleKeyExchangesShow["additional-key-exchange-2-methods"]; v != nil {
+ multipleKeyExchangesState["additional_key_exchange_2_methods"] = v
+ }
+ if v := multipleKeyExchangesShow["additional-key-exchange-3-methods"]; v != nil {
+ multipleKeyExchangesState["additional_key_exchange_3_methods"] = v
+ }
+ if v := multipleKeyExchangesShow["additional-key-exchange-4-methods"]; v != nil {
+ multipleKeyExchangesState["additional_key_exchange_4_methods"] = v
+ }
+ if v := multipleKeyExchangesShow["additional-key-exchange-5-methods"]; v != nil {
+ multipleKeyExchangesState["additional_key_exchange_5_methods"] = v
+ }
+ if v := multipleKeyExchangesShow["additional-key-exchange-6-methods"]; v != nil {
+ multipleKeyExchangesState["additional_key_exchange_6_methods"] = v
+ }
+ if v := multipleKeyExchangesShow["additional-key-exchange-7-methods"]; v != nil {
+ multipleKeyExchangesState["additional_key_exchange_7_methods"] = v
+ }
+ if v := multipleKeyExchangesShow["key-exchange-methods"]; v != nil {
+ multipleKeyExchangesState["key_exchange_methods"] = v
+ }
+ ikePhase2State["multiple_key_exchanges"] = []interface{}{multipleKeyExchangesState}
+ }
+ if v := ikePhase2Show["use-multiple-key-exchanges"]; v != nil {
+ ikePhase2State["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase2Show["use-standard-proposal"]; v != nil {
+ ikePhase2State["use_standard_proposal"] = v
+ }
+ encryptionState["ike_phase_2"] = []interface{}{ikePhase2State}
+ }
+ _ = d.Set("encryption", []interface{}{encryptionState})
+ }
+
return nil
}
diff --git a/checkpoint/data_source_checkpoint_management_vpn_community_star.go b/checkpoint/data_source_checkpoint_management_vpn_community_star.go
index 001abafa..9d702768 100644
--- a/checkpoint/data_source_checkpoint_management_vpn_community_star.go
+++ b/checkpoint/data_source_checkpoint_management_vpn_community_star.go
@@ -83,6 +83,21 @@ func dataSourceManagementVpnCommunityStar() *schema.Resource {
Description: "Ike Phase 1 settings. Only applicable when the encryption-suite is set to [custom].",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "multiple_key_exchanges": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Multiple Key Exchanges proposal object.",
+ },
+ "use_multiple_key_exchanges": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with Multiple Key Exchanges.",
+ },
+ "use_standard_proposal": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with a single Diffie-Hellman group.",
+ },
"data_integrity": {
Type: schema.TypeString,
Computed: true,
@@ -112,6 +127,21 @@ func dataSourceManagementVpnCommunityStar() *schema.Resource {
Description: "Ike Phase 2 settings. Only applicable when the encryption-suite is set to [custom].",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "multiple_key_exchanges": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Multiple Key Exchanges proposal object to use when PFS is enabled and multiple key exchanges are configured.",
+ },
+ "use_multiple_key_exchanges": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with Multiple Key Exchanges when PFS is enabled.",
+ },
+ "use_standard_proposal": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with a single Diffie-Hellman group when PFS is enabled.",
+ },
"data_integrity": {
Type: schema.TypeString,
Computed: true,
@@ -167,6 +197,11 @@ func dataSourceManagementVpnCommunityStar() *schema.Resource {
Computed: true,
Description: "The name of the interface.",
},
+ "ip_version": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The IP version of the interface's IP address (IPv4/IPv6).",
+ },
"next_hop_ip": {
Type: schema.TypeString,
Computed: true,
@@ -225,6 +260,14 @@ func dataSourceManagementVpnCommunityStar() *schema.Resource {
Description: "Priority rule for all satellite gateways. Relevant only if 'entry-point-selection-mechanism' is set to 'manual'.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "satellite_gateways": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Collection of satellite VPN Gateway and VPN Device objects identified by the name or UID.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
"first_priority_center_gateways": {
Type: schema.TypeSet,
Computed: true,
@@ -385,6 +428,21 @@ func dataSourceManagementVpnCommunityStar() *schema.Resource {
Description: "Ike Phase 1 settings. Only applicable when the encryption-suite is set to [custom].",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "multiple_key_exchanges": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Multiple Key Exchanges proposal object.",
+ },
+ "use_multiple_key_exchanges": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with Multiple Key Exchanges.",
+ },
+ "use_standard_proposal": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with a single Diffie-Hellman group.",
+ },
"data_integrity": {
Type: schema.TypeString,
Computed: true,
@@ -414,6 +472,21 @@ func dataSourceManagementVpnCommunityStar() *schema.Resource {
Description: "Ike Phase 2 settings. Only applicable when the encryption-suite is set to [custom].",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "multiple_key_exchanges": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Multiple Key Exchanges proposal object to use when PFS is enabled and multiple key exchanges are configured.",
+ },
+ "use_multiple_key_exchanges": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with Multiple Key Exchanges when PFS is enabled.",
+ },
+ "use_standard_proposal": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to use a proposal with a single Diffie-Hellman group when PFS is enabled.",
+ },
"data_integrity": {
Type: schema.TypeString,
Computed: true,
@@ -632,6 +705,92 @@ func dataSourceManagementVpnCommunityStar() *schema.Resource {
Computed: true,
Description: "Comments string.",
},
+ "route_based_settings": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "VPN Community Route-Based settings.
Relevant only in Route-Based VPN Communities.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "add_automatic_routes": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "The type of routes to use for the automatic Route-Based configuration.
Relevant only in Route-Based VPN Communities.",
+ },
+ "advanced": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Advanced settings
Relevant only in Route-Based VPN Communities.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "bfd": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to enable Bidirectional Forwarding Detection.
Relevant only in Route-Based VPN Communities.",
+ },
+ "graceful_restart": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to enable Graceful Restart in the applicable Dynamic Routing protocols.
Relevant only in Route-Based VPN Communities...",
+ },
+ },
+ },
+ },
+ "override_routes": {
+ Type: schema.TypeList,
+ Computed: true,
+ Description: "Override automatic routing settings in a specific Security Gateway in this VPN Community.
Relevant only in Route-Based VPN Communities...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "auto_config": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Indicates whether to configure the routing settings automatically for the Security Gateway.
Relevant only in Route-Based VPN CommunitiesExported Routes.
Relevant only in Route-Based VPN Communities.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "custom_routes": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Specifies to export user-defined networks from the Security Gateway.
Relevant only in Route-Based VPN Communities.",
+ },
+ "custom_routes_object": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Specifies the name of the Network object or Network Group object that represents the exported routes.
Relevant only in Route-Based VPN Com...",
+ },
+ "internal_interfaces": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Specifies to export networks from interfaces with Topology 'Internal' from the Security Gateway.
Relevant only in Route-Based VPN Communit...",
+ },
+ "static_routes": {
+ Type: schema.TypeBool,
+ Computed: true,
+ Description: "Specifies to export static routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.",
+ },
+ },
+ },
+ },
+ "gateway": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Name of the Security Gateway object in which to override the automatic routing settings.
Relevant only in Route-Based VPN Communities<...",
+ },
+ "mode": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Specifies how to export routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
},
}
}
@@ -756,6 +915,15 @@ func dataSourceManagementVpnCommunityStarRead(d *schema.ResourceData, m interfac
ikePhase1MapToReturn["ike_p1_rekey_time"] = strconv.Itoa(int(v.(float64)))
}
+ if v := ikePhase1Map["multiple-key-exchanges"]; v != nil {
+ ikePhase1MapToReturn["multiple_key_exchanges"] = v.(map[string]interface{})["name"]
+ }
+ if v := ikePhase1Map["use-multiple-key-exchanges"]; v != nil {
+ ikePhase1MapToReturn["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase1Map["use-standard-proposal"]; v != nil {
+ ikePhase1MapToReturn["use_standard_proposal"] = v
+ }
_ = d.Set("ike_phase_1", []interface{}{ikePhase1MapToReturn})
} else {
@@ -784,6 +952,15 @@ func dataSourceManagementVpnCommunityStarRead(d *schema.ResourceData, m interfac
ikePhase2MapToReturn["ike_p2_rekey_time"] = strconv.Itoa(int(v.(float64)))
}
+ if v := ikePhase2Map["multiple-key-exchanges"]; v != nil {
+ ikePhase2MapToReturn["multiple_key_exchanges"] = v.(map[string]interface{})["name"]
+ }
+ if v := ikePhase2Map["use-multiple-key-exchanges"]; v != nil {
+ ikePhase2MapToReturn["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase2Map["use-standard-proposal"]; v != nil {
+ ikePhase2MapToReturn["use_standard_proposal"] = v
+ }
_ = d.Set("ike_phase_2", []interface{}{ikePhase2MapToReturn})
} else {
@@ -814,24 +991,34 @@ func dataSourceManagementVpnCommunityStarRead(d *schema.ResourceData, m interfac
overrideInterfacesMapToAdd["gateway"] = v
}
if v := overrideInterfacesMap["interfaces"]; v != nil {
- interfacesShow := v.(map[string]interface{})
- interfacesState := make(map[string]interface{})
- if v := interfacesShow["interface-name"]; v != nil {
- interfacesState["interface_name"] = v
- }
- if v := interfacesShow["next-hop-ip"]; v != nil {
- interfacesState["next_hop_ip"] = v
- }
- if v := interfacesShow["static-nat-ip"]; v != nil {
- interfacesState["static_nat_ip"] = v
- }
- if v := interfacesShow["priority"]; v != nil {
- interfacesState["priority"] = v
- }
- if v := interfacesShow["redundancy-mode"]; v != nil {
- interfacesState["redundancy_mode"] = v
+ interfacesList := v.([]interface{})
+ if len(interfacesList) > 0 {
+ var interfacesListState []map[string]interface{}
+ for j := range interfacesList {
+ interfacesShow := interfacesList[j].(map[string]interface{})
+ interfacesState := make(map[string]interface{})
+ if v := interfacesShow["interface-name"]; v != nil {
+ interfacesState["interface_name"] = v
+ }
+ if v := interfacesShow["ip-version"]; v != nil {
+ interfacesState["ip_version"] = v
+ }
+ if v := interfacesShow["next-hop-ip"]; v != nil {
+ interfacesState["next_hop_ip"] = v
+ }
+ if v := interfacesShow["static-nat-ip"]; v != nil {
+ interfacesState["static_nat_ip"] = v
+ }
+ if v := interfacesShow["priority"]; v != nil {
+ interfacesState["priority"] = v
+ }
+ if v := interfacesShow["redundancy-mode"]; v != nil {
+ interfacesState["redundancy_mode"] = v
+ }
+ interfacesListState = append(interfacesListState, interfacesState)
+ }
+ overrideInterfacesMapToAdd["interfaces"] = interfacesListState
}
- overrideInterfacesMapToAdd["interfaces"] = interfacesState
}
overrideInterfacesListToReturn = append(overrideInterfacesListToReturn, overrideInterfacesMapToAdd)
}
@@ -868,6 +1055,9 @@ func dataSourceManagementVpnCommunityStarRead(d *schema.ResourceData, m interfac
defaultPriorityRuleMap := v.(map[string]interface{})
defaultPriorityRuleMapToReturn := make(map[string]interface{})
+ if v, _ := defaultPriorityRuleMap["satellite-gateways"]; v != nil {
+ defaultPriorityRuleMapToReturn["satellite_gateways"] = v
+ }
if v, _ := defaultPriorityRuleMap["first-priority-center-gateways"]; v != nil {
defaultPriorityRuleMapToReturn["first_priority_center_gateways"] = v
}
@@ -1064,6 +1254,15 @@ func dataSourceManagementVpnCommunityStarRead(d *schema.ResourceData, m interfac
if v := ikePhase1Show["ike-p1-rekey-time"]; v != nil {
ikePhase1State["ike_p1_rekey_time"] = strconv.Itoa(int(v.(float64)))
}
+ if v := ikePhase1Show["multiple-key-exchanges"]; v != nil {
+ ikePhase1State["multiple_key_exchanges"] = v.(map[string]interface{})["name"]
+ }
+ if v := ikePhase1Show["use-multiple-key-exchanges"]; v != nil {
+ ikePhase1State["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase1Show["use-standard-proposal"]; v != nil {
+ ikePhase1State["use_standard_proposal"] = v
+ }
granularEncryptionState["ike_phase_1"] = []interface{}{ikePhase1State}
}
@@ -1085,6 +1284,15 @@ func dataSourceManagementVpnCommunityStarRead(d *schema.ResourceData, m interfac
if v := ikePhase2Show["ike-p2-rekey-time"]; v != nil {
ikePhase2State["ike_p2_rekey_time"] = strconv.Itoa(int(v.(float64)))
}
+ if v := ikePhase2Show["multiple-key-exchanges"]; v != nil {
+ ikePhase2State["multiple_key_exchanges"] = v.(map[string]interface{})["name"]
+ }
+ if v := ikePhase2Show["use-multiple-key-exchanges"]; v != nil {
+ ikePhase2State["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase2Show["use-standard-proposal"]; v != nil {
+ ikePhase2State["use_standard_proposal"] = v
+ }
granularEncryptionState["ike_phase_2"] = []interface{}{ikePhase2State}
}
granularEncryptionsState = append(granularEncryptionsState, granularEncryptionState)
@@ -1287,5 +1495,61 @@ func dataSourceManagementVpnCommunityStarRead(d *schema.ResourceData, m interfac
_ = d.Set("comments", v)
}
+ if v := vpnCommunityStar["route-based-settings"]; v != nil {
+ routeBasedSettingsShow := v.(map[string]interface{})
+ routeBasedSettingsState := make(map[string]interface{})
+ if v := routeBasedSettingsShow["add-automatic-routes"]; v != nil {
+ routeBasedSettingsState["add_automatic_routes"] = v
+ }
+ if v := routeBasedSettingsShow["advanced"]; v != nil {
+ advancedShow := v.(map[string]interface{})
+ advancedState := make(map[string]interface{})
+ if v := advancedShow["bfd"]; v != nil {
+ advancedState["bfd"] = v
+ }
+ if v := advancedShow["graceful-restart"]; v != nil {
+ advancedState["graceful_restart"] = v
+ }
+ routeBasedSettingsState["advanced"] = []interface{}{advancedState}
+ }
+ if v := routeBasedSettingsShow["override-routes"]; v != nil {
+ overrideRoutesList := v.([]interface{})
+ var overrideRoutesListState []map[string]interface{}
+ for i := range overrideRoutesList {
+ overrideRoutesShow := overrideRoutesList[i].(map[string]interface{})
+ overrideRoutesState := make(map[string]interface{})
+ if v := overrideRoutesShow["auto-config"]; v != nil {
+ overrideRoutesState["auto_config"] = v
+ }
+ if v := overrideRoutesShow["exported-routes"]; v != nil {
+ exportedRoutesShow := v.(map[string]interface{})
+ exportedRoutesState := make(map[string]interface{})
+ if v := exportedRoutesShow["custom-routes"]; v != nil {
+ exportedRoutesState["custom_routes"] = v
+ }
+ if v := exportedRoutesShow["custom-routes-object"]; v != nil {
+ exportedRoutesState["custom_routes_object"] = v.(map[string]interface{})["name"]
+ }
+ if v := exportedRoutesShow["internal-interfaces"]; v != nil {
+ exportedRoutesState["internal_interfaces"] = v
+ }
+ if v := exportedRoutesShow["static-routes"]; v != nil {
+ exportedRoutesState["static_routes"] = v
+ }
+ overrideRoutesState["exported_routes"] = []interface{}{exportedRoutesState}
+ }
+ if v := overrideRoutesShow["gateway"]; v != nil {
+ overrideRoutesState["gateway"] = v.(map[string]interface{})["name"]
+ }
+ if v := overrideRoutesShow["mode"]; v != nil {
+ overrideRoutesState["mode"] = v
+ }
+ overrideRoutesListState = append(overrideRoutesListState, overrideRoutesState)
+ }
+ routeBasedSettingsState["override_routes"] = overrideRoutesListState
+ }
+ _ = d.Set("route_based_settings", []interface{}{routeBasedSettingsState})
+ }
+
return nil
}
diff --git a/checkpoint/resource_checkpoint_gaia_command_set_initial_setup.go b/checkpoint/resource_checkpoint_gaia_command_set_initial_setup.go
index 15d89df3..f4937b4d 100644
--- a/checkpoint/resource_checkpoint_gaia_command_set_initial_setup.go
+++ b/checkpoint/resource_checkpoint_gaia_command_set_initial_setup.go
@@ -39,6 +39,7 @@ func dataGaiaSetInitialSetup() *schema.Resource {
Type: schema.TypeString,
Optional: true,
ForceNew: true,
+ Sensitive: true,
Description: `Secure Internal Communication key`,
},
"dynamically_assigned_ip": {
@@ -155,6 +156,7 @@ func dataGaiaSetInitialSetup() *schema.Resource {
Type: schema.TypeString,
Optional: true,
ForceNew: true,
+ Sensitive: true,
Description: `Secure Internal Communication key, relevant in case of secondary or Log Server`,
},
"leading_interface": {
diff --git a/checkpoint/resource_checkpoint_gaia_command_set_snmp_session.go b/checkpoint/resource_checkpoint_gaia_command_set_snmp_session.go
index 7f18dd79..5a93c94b 100644
--- a/checkpoint/resource_checkpoint_gaia_command_set_snmp_session.go
+++ b/checkpoint/resource_checkpoint_gaia_command_set_snmp_session.go
@@ -23,6 +23,7 @@ func dataGaiaSetSnmpSession() *schema.Resource {
Type: schema.TypeString,
Optional: true,
ForceNew: true,
+ Sensitive: true,
Description: `SNMP v2 community password.
required for SNMP v1/v2`,
},
"v3_object": {
diff --git a/checkpoint/resource_checkpoint_gaia_snmp.go b/checkpoint/resource_checkpoint_gaia_snmp.go
index cea715d5..2848dbab 100644
--- a/checkpoint/resource_checkpoint_gaia_snmp.go
+++ b/checkpoint/resource_checkpoint_gaia_snmp.go
@@ -49,11 +49,13 @@ func resourceGaiaSnmp() *schema.Resource {
"read_only_community": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: `SNMP read-only community password, Where:
* read-only: lets you only read the values of SNMP objects`,
},
"read_write_community": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: `SNMP read-write community password, Where:
* read-write: read and set the values as well`,
},
"interfaces": {
diff --git a/checkpoint/resource_checkpoint_gaia_snmp_trap_receiver.go b/checkpoint/resource_checkpoint_gaia_snmp_trap_receiver.go
index 38dc36b9..7b5bc7ee 100644
--- a/checkpoint/resource_checkpoint_gaia_snmp_trap_receiver.go
+++ b/checkpoint/resource_checkpoint_gaia_snmp_trap_receiver.go
@@ -34,6 +34,7 @@ func resourceGaiaSnmpTrapReceiver() *schema.Resource {
"community_string": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: `Receiver community - Required only in case of v1/v2 versions
Trap Community String used by the trap receiver to determine which traps are accepted from a device.`,
},
"member_id": {
diff --git a/checkpoint/resource_checkpoint_management_access_layer.go b/checkpoint/resource_checkpoint_management_access_layer.go
index 3126a472..abc143f7 100644
--- a/checkpoint/resource_checkpoint_management_access_layer.go
+++ b/checkpoint/resource_checkpoint_management_access_layer.go
@@ -108,6 +108,11 @@ func resourceManagementAccessLayer() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "dynamic_layer": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether this layer is set as a Dynamic layer.",
+ },
},
}
}
@@ -179,6 +184,9 @@ func createManagementAccessLayer(d *schema.ResourceData, m interface{}) error {
log.Println("Create AccessLayer - Map = ", accessLayer)
+ if v, ok := d.GetOkExists("dynamic_layer"); ok {
+ accessLayer["dynamic-layer"] = v.(bool)
+ }
addAccessLayerRes, err := client.ApiCall("add-access-layer", accessLayer, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !addAccessLayerRes.Success {
if addAccessLayerRes.ErrorMsg != "" {
@@ -296,6 +304,10 @@ func readManagementAccessLayer(d *schema.ResourceData, m interface{}) error {
_ = d.Set("ignore_errors", v)
}
+ if v := accessLayer["dynamic-layer"]; v != nil {
+ _ = d.Set("dynamic_layer", v)
+ }
+
return nil
}
@@ -374,6 +386,9 @@ func updateManagementAccessLayer(d *schema.ResourceData, m interface{}) error {
log.Println("Update AccessLayer - Map = ", accessLayer)
+ if ok := d.HasChange("dynamic_layer"); ok {
+ accessLayer["dynamic-layer"] = d.Get("dynamic_layer")
+ }
updateAccessLayerRes, err := client.ApiCall("set-access-layer", accessLayer, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !updateAccessLayerRes.Success {
if updateAccessLayerRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_access_rule.go b/checkpoint/resource_checkpoint_management_access_rule.go
index 4a95985e..e7e7f367 100644
--- a/checkpoint/resource_checkpoint_management_access_rule.go
+++ b/checkpoint/resource_checkpoint_management_access_rule.go
@@ -100,6 +100,106 @@ func resourceManagementAccessRule() *schema.Resource {
Optional: true,
Description: "N/A",
},
+ "client_auth_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Client authentication settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "source": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Source object identified by the name or UID.",
+ },
+ "destination": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Destination object identified by the name or UID.",
+ },
+ "sign_on_method": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Sign on method.",
+ },
+ "sign_on_type": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Sign on type.",
+ },
+ "tracking": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Tracking method.",
+ },
+ "sessions_limit": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Maximum number of concurrent sessions.",
+ },
+ "unlimited_sessions": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Allow an unlimited number of sessions.",
+ },
+ "require_desktop_config_verification": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Require Desktop configuration verification.",
+ },
+ "timeout": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Session timeout settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "enable": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable session timeout.",
+ },
+ "minutes": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Session timeout in minutes.",
+ },
+ "refreshable": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether the timeout is refreshable.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "user_auth_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "User authentication settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "source": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Source object identified by the name or UID.",
+ },
+ "destination": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Destination object identified by the name or UID.",
+ },
+ "allowed_http_servers": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Allowed HTTP servers.",
+ },
+ },
+ },
+ },
},
},
},
@@ -360,6 +460,11 @@ func resourceManagementAccessRule() *schema.Resource {
Type: schema.TypeString,
},
},
+ "service_resource": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Resource of the service identified by the name or UID. When a service-resource exists, the service parameter should contains exactly one service element.",
+ },
},
}
}
@@ -420,6 +525,66 @@ func createManagementAccessRule(d *schema.ResourceData, m interface{}) error {
if v, ok := d.GetOk("action_settings.0.limit"); ok {
actionSettingsPayload["limit"] = v.(string)
}
+ if _, ok := d.GetOk("action_settings.0.client_auth_settings"); ok {
+
+ clientAuthSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("action_settings.0.client_auth_settings.0.source"); ok {
+ clientAuthSettingsPayload["source"] = v.(string)
+ }
+ if v, ok := d.GetOk("action_settings.0.client_auth_settings.0.destination"); ok {
+ clientAuthSettingsPayload["destination"] = v.(string)
+ }
+ if v, ok := d.GetOk("action_settings.0.client_auth_settings.0.sign_on_method"); ok {
+ clientAuthSettingsPayload["sign-on-method"] = v.(string)
+ }
+ if v, ok := d.GetOk("action_settings.0.client_auth_settings.0.sign_on_type"); ok {
+ clientAuthSettingsPayload["sign-on-type"] = v.(string)
+ }
+ if v, ok := d.GetOk("action_settings.0.client_auth_settings.0.tracking"); ok {
+ clientAuthSettingsPayload["tracking"] = v.(string)
+ }
+ if v, ok := d.GetOk("action_settings.0.client_auth_settings.0.sessions_limit"); ok {
+ clientAuthSettingsPayload["sessions-limit"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("action_settings.0.client_auth_settings.0.unlimited_sessions"); ok {
+ clientAuthSettingsPayload["unlimited-sessions"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("action_settings.0.client_auth_settings.0.require_desktop_config_verification"); ok {
+ clientAuthSettingsPayload["require-desktop-config-verification"] = v.(bool)
+ }
+ if _, ok := d.GetOk("action_settings.0.client_auth_settings.0.timeout"); ok {
+
+ timeoutPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("action_settings.0.client_auth_settings.0.timeout.0.enable"); ok {
+ timeoutPayload["enable"] = v.(bool)
+ }
+ if v, ok := d.GetOk("action_settings.0.client_auth_settings.0.timeout.0.minutes"); ok {
+ timeoutPayload["minutes"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("action_settings.0.client_auth_settings.0.timeout.0.refreshable"); ok {
+ timeoutPayload["refreshable"] = v.(bool)
+ }
+ clientAuthSettingsPayload["timeout"] = timeoutPayload
+ }
+ actionSettingsPayload["client-auth-settings"] = clientAuthSettingsPayload
+ }
+ if _, ok := d.GetOk("action_settings.0.user_auth_settings"); ok {
+
+ userAuthSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("action_settings.0.user_auth_settings.0.source"); ok {
+ userAuthSettingsPayload["source"] = v.(string)
+ }
+ if v, ok := d.GetOk("action_settings.0.user_auth_settings.0.destination"); ok {
+ userAuthSettingsPayload["destination"] = v.(string)
+ }
+ if v, ok := d.GetOk("action_settings.0.user_auth_settings.0.allowed_http_servers"); ok {
+ userAuthSettingsPayload["allowed-http-servers"] = v.(string)
+ }
+ actionSettingsPayload["user-auth-settings"] = userAuthSettingsPayload
+ }
accessRule["action-settings"] = actionSettingsPayload
}
}
@@ -568,6 +733,10 @@ func createManagementAccessRule(d *schema.ResourceData, m interface{}) error {
log.Println("Create Access Rule - Map = ", accessRule)
+ if v, ok := d.GetOk("service_resource"); ok {
+ accessRule["service-resource"] = v.(string)
+ }
+
addAccessRuleRes, err := client.ApiCall("add-access-rule", accessRule, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !addAccessRuleRes.Success {
if addAccessRuleRes.ErrorMsg != "" {
@@ -631,6 +800,63 @@ func readManagementAccessRule(d *schema.ResourceData, m interface{}) error {
if v := actionSettingsMap["limit"]; v != nil {
actionSettingsMapToReturn["limit"] = v.(map[string]interface{})["name"].(string)
}
+ if v := actionSettingsMap["client-auth-settings"]; v != nil {
+ clientAuthSettingsMap := v.(map[string]interface{})
+ clientAuthSettingsMapToReturn := make(map[string]interface{})
+ if v := clientAuthSettingsMap["source"]; v != nil {
+ clientAuthSettingsMapToReturn["source"] = v
+ }
+ if v := clientAuthSettingsMap["destination"]; v != nil {
+ clientAuthSettingsMapToReturn["destination"] = v
+ }
+ if v := clientAuthSettingsMap["sign-on-method"]; v != nil {
+ clientAuthSettingsMapToReturn["sign_on_method"] = v
+ }
+ if v := clientAuthSettingsMap["sign-on-type"]; v != nil {
+ clientAuthSettingsMapToReturn["sign_on_type"] = v
+ }
+ if v := clientAuthSettingsMap["tracking"]; v != nil {
+ clientAuthSettingsMapToReturn["tracking"] = v
+ }
+ if v := clientAuthSettingsMap["sessions-limit"]; v != nil {
+ clientAuthSettingsMapToReturn["sessions_limit"] = v
+ }
+ if v := clientAuthSettingsMap["unlimited-sessions"]; v != nil {
+ clientAuthSettingsMapToReturn["unlimited_sessions"] = v
+ }
+ if v := clientAuthSettingsMap["require-desktop-config-verification"]; v != nil {
+ clientAuthSettingsMapToReturn["require_desktop_config_verification"] = v
+ }
+ if v := clientAuthSettingsMap["timeout"]; v != nil {
+ timeoutMap := v.(map[string]interface{})
+ timeoutMapToReturn := make(map[string]interface{})
+ if v := timeoutMap["enable"]; v != nil {
+ timeoutMapToReturn["enable"] = v
+ }
+ if v := timeoutMap["minutes"]; v != nil {
+ timeoutMapToReturn["minutes"] = v
+ }
+ if v := timeoutMap["refreshable"]; v != nil {
+ timeoutMapToReturn["refreshable"] = v
+ }
+ clientAuthSettingsMapToReturn["timeout"] = []interface{}{timeoutMapToReturn}
+ }
+ actionSettingsMapToReturn["client_auth_settings"] = []interface{}{clientAuthSettingsMapToReturn}
+ }
+ if v := actionSettingsMap["user-auth-settings"]; v != nil {
+ userAuthSettingsMap := v.(map[string]interface{})
+ userAuthSettingsMapToReturn := make(map[string]interface{})
+ if v := userAuthSettingsMap["source"]; v != nil {
+ userAuthSettingsMapToReturn["source"] = v
+ }
+ if v := userAuthSettingsMap["destination"]; v != nil {
+ userAuthSettingsMapToReturn["destination"] = v
+ }
+ if v := userAuthSettingsMap["allowed-http-servers"]; v != nil {
+ userAuthSettingsMapToReturn["allowed_http_servers"] = v
+ }
+ actionSettingsMapToReturn["user_auth_settings"] = []interface{}{userAuthSettingsMapToReturn}
+ }
_ = d.Set("action_settings", []interface{}{actionSettingsMapToReturn})
} else {
@@ -836,6 +1062,10 @@ func readManagementAccessRule(d *schema.ResourceData, m interface{}) error {
if v := accessRule["comments"]; v != nil {
_ = d.Set("comments", v)
}
+ if v := accessRule["service-resource"]; v != nil {
+ _ = d.Set("service_resource", v.(map[string]interface{})["name"])
+ }
+
return nil
}
@@ -908,6 +1138,66 @@ func updateManagementAccessRule(d *schema.ResourceData, m interface{}) error {
if v, ok := d.GetOk("action_settings.0.limit"); ok {
actionSettingsPayload["limit"] = v.(string)
}
+ if _, ok := d.GetOk("action_settings.0.client_auth_settings"); ok {
+
+ clientAuthSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("action_settings.0.client_auth_settings.0.source"); ok {
+ clientAuthSettingsPayload["source"] = v.(string)
+ }
+ if v, ok := d.GetOk("action_settings.0.client_auth_settings.0.destination"); ok {
+ clientAuthSettingsPayload["destination"] = v.(string)
+ }
+ if v, ok := d.GetOk("action_settings.0.client_auth_settings.0.sign_on_method"); ok {
+ clientAuthSettingsPayload["sign-on-method"] = v.(string)
+ }
+ if v, ok := d.GetOk("action_settings.0.client_auth_settings.0.sign_on_type"); ok {
+ clientAuthSettingsPayload["sign-on-type"] = v.(string)
+ }
+ if v, ok := d.GetOk("action_settings.0.client_auth_settings.0.tracking"); ok {
+ clientAuthSettingsPayload["tracking"] = v.(string)
+ }
+ if v, ok := d.GetOk("action_settings.0.client_auth_settings.0.sessions_limit"); ok {
+ clientAuthSettingsPayload["sessions-limit"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("action_settings.0.client_auth_settings.0.unlimited_sessions"); ok {
+ clientAuthSettingsPayload["unlimited-sessions"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("action_settings.0.client_auth_settings.0.require_desktop_config_verification"); ok {
+ clientAuthSettingsPayload["require-desktop-config-verification"] = v.(bool)
+ }
+ if _, ok := d.GetOk("action_settings.0.client_auth_settings.0.timeout"); ok {
+
+ timeoutPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("action_settings.0.client_auth_settings.0.timeout.0.enable"); ok {
+ timeoutPayload["enable"] = v.(bool)
+ }
+ if v, ok := d.GetOk("action_settings.0.client_auth_settings.0.timeout.0.minutes"); ok {
+ timeoutPayload["minutes"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("action_settings.0.client_auth_settings.0.timeout.0.refreshable"); ok {
+ timeoutPayload["refreshable"] = v.(bool)
+ }
+ clientAuthSettingsPayload["timeout"] = timeoutPayload
+ }
+ actionSettingsPayload["client-auth-settings"] = clientAuthSettingsPayload
+ }
+ if _, ok := d.GetOk("action_settings.0.user_auth_settings"); ok {
+
+ userAuthSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("action_settings.0.user_auth_settings.0.source"); ok {
+ userAuthSettingsPayload["source"] = v.(string)
+ }
+ if v, ok := d.GetOk("action_settings.0.user_auth_settings.0.destination"); ok {
+ userAuthSettingsPayload["destination"] = v.(string)
+ }
+ if v, ok := d.GetOk("action_settings.0.user_auth_settings.0.allowed_http_servers"); ok {
+ userAuthSettingsPayload["allowed-http-servers"] = v.(string)
+ }
+ actionSettingsPayload["user-auth-settings"] = userAuthSettingsPayload
+ }
accessRule["action-settings"] = actionSettingsPayload
}
}
@@ -1137,6 +1427,12 @@ func updateManagementAccessRule(d *schema.ResourceData, m interface{}) error {
log.Println("Update Access Rule - Map = ", accessRule)
if len(accessRule) != 4 {
+ if ok := d.HasChange("service_resource"); ok {
+ if v, ok := d.GetOk("service_resource"); ok {
+ accessRule["service-resource"] = v.(string)
+ }
+ }
+
updateAccessRuleRes, err := client.ApiCall("set-access-rule", accessRule, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !updateAccessRuleRes.Success {
if updateAccessRuleRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_application_site.go b/checkpoint/resource_checkpoint_management_application_site.go
index 08268f77..03e01869 100644
--- a/checkpoint/resource_checkpoint_management_application_site.go
+++ b/checkpoint/resource_checkpoint_management_application_site.go
@@ -91,6 +91,36 @@ func resourceManagementApplicationSite() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "match_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Match settings for application services.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Match mode for the application services.",
+ },
+ "negate": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "All ports except those listed in override-services.",
+ },
+ "override_services": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Service names or UIDs used when matching is customized.
Required only when mode is set to 'customize'.",
+ },
+ "recommended_services": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Recommended services for this application. Use when mode is set to 'recommended'.",
+ },
+ },
+ },
+ },
},
}
}
@@ -150,6 +180,17 @@ func createManagementApplicationSite(d *schema.ResourceData, m interface{}) erro
log.Println("Create ApplicationSite - Map = ", applicationSite)
+ if _, ok := d.GetOk("match_settings"); ok {
+ matchSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("match_settings.0.mode"); ok {
+ matchSettingsPayload["mode"] = v.(string)
+ }
+ if v, ok := d.GetOk("match_settings.0.override_services"); ok {
+ matchSettingsPayload["override-services"] = v.(string)
+ }
+ applicationSite["match-settings"] = matchSettingsPayload
+ }
+
addApplicationSiteRes, err := client.ApiCall("add-application-site", applicationSite, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !addApplicationSiteRes.Success {
if addApplicationSiteRes.ErrorMsg != "" {
@@ -271,6 +312,24 @@ func readManagementApplicationSite(d *schema.ResourceData, m interface{}) error
_ = d.Set("ignore_errors", v)
}
+ if v := applicationSite["match-settings"]; v != nil {
+ matchSettingsShow := v.(map[string]interface{})
+ matchSettingsState := make(map[string]interface{})
+ if v := matchSettingsShow["mode"]; v != nil {
+ matchSettingsState["mode"] = v
+ }
+ if v := matchSettingsShow["negate"]; v != nil {
+ matchSettingsState["negate"] = v
+ }
+ if v := matchSettingsShow["override-services"]; v != nil {
+ matchSettingsState["override_services"] = v
+ }
+ if v := matchSettingsShow["recommended-services"]; v != nil {
+ matchSettingsState["recommended_services"] = v
+ }
+ _ = d.Set("match_settings", []interface{}{matchSettingsState})
+ }
+
return nil
}
@@ -349,6 +408,22 @@ func updateManagementApplicationSite(d *schema.ResourceData, m interface{}) erro
log.Println("Update ApplicationSite - Map = ", applicationSite)
+ if ok := d.HasChange("match_settings"); ok {
+ if _, ok := d.GetOk("match_settings"); ok {
+ matchSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("match_settings.0.mode"); ok {
+ matchSettingsPayload["mode"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("match_settings.0.negate"); ok {
+ matchSettingsPayload["negate"] = v.(bool)
+ }
+ if v, ok := d.GetOk("match_settings.0.override_services"); ok {
+ matchSettingsPayload["override-services"] = v.(string)
+ }
+ applicationSite["match-settings"] = matchSettingsPayload
+ }
+ }
+
updateApplicationSiteRes, err := client.ApiCall("set-application-site", applicationSite, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !updateApplicationSiteRes.Success {
if updateApplicationSiteRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_azure_ad.go b/checkpoint/resource_checkpoint_management_azure_ad.go
index 7607fa77..a049cd65 100644
--- a/checkpoint/resource_checkpoint_management_azure_ad.go
+++ b/checkpoint/resource_checkpoint_management_azure_ad.go
@@ -46,6 +46,7 @@ func resourceManagementAzureAd() *schema.Resource {
"application_key": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "The key created for the Service Principal. Required for authentication-method: service-principal-authentication.",
},
"directory_id": {
diff --git a/checkpoint/resource_checkpoint_management_checkpoint_host.go b/checkpoint/resource_checkpoint_management_checkpoint_host.go
index 6644cc48..d7e5ac78 100644
--- a/checkpoint/resource_checkpoint_management_checkpoint_host.go
+++ b/checkpoint/resource_checkpoint_management_checkpoint_host.go
@@ -141,6 +141,16 @@ func resourceManagementCheckpointHost() *schema.Resource {
Optional: true,
Description: "NAT translation method.",
},
+ "automatic_nat_rules": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Whether to add automatic address translation rules.
checkpoint-gateway: generate automatic address translation rules using the install-on values.
third-pa",
+ },
+ "communication_with_this_server": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "How gateways will communicate with this server.
Note: original-ip-only and translated-ip-only Supported only by Security Gateways R82 and higher.",
+ },
},
},
},
@@ -401,6 +411,16 @@ func resourceManagementCheckpointHost() *schema.Resource {
Description: "Update account log in every amount of seconds.",
Default: 3600,
},
+ "distribute_logs_between_all_active_servers": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Distribute logs between all active servers.",
+ },
+ "include_tcp_state_information": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Include TCP state information. Relevant only when Firewall blade is enabled.",
+ },
},
},
},
@@ -464,6 +484,11 @@ func resourceManagementCheckpointHost() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "dns_server": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "DNS Server.",
+ },
},
}
}
@@ -559,6 +584,12 @@ func createManagementCheckpointHost(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("nat_settings.0.communication_with_this_server"); ok {
natSettingsPayload["communication-with-this-server"] = v.(string)
}
+ if v, ok := d.GetOk("nat_settings.0.automatic_nat_rules"); ok {
+ natSettingsPayload["automatic-nat-rules"] = v.(string)
+ }
+ if v, ok := d.GetOk("nat_settings.0.communication_with_this_server"); ok {
+ natSettingsPayload["communication-with-this-server"] = v.(string)
+ }
checkpointHost["nat-settings"] = natSettingsPayload
}
}
@@ -705,6 +736,12 @@ func createManagementCheckpointHost(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("logs_settings.0.update_account_log_every"); ok {
logsSettingsPayload["update-account-log-every"] = v.(int)
}
+ if v, ok := d.GetOkExists("logs_settings.0.distribute_logs_between_all_active_servers"); ok {
+ logsSettingsPayload["distribute-logs-between-all-active-servers"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.include_tcp_state_information"); ok {
+ logsSettingsPayload["include-tcp-state-information"] = v.(string)
+ }
checkpointHost["logs-settings"] = logsSettingsPayload
}
}
@@ -880,6 +917,12 @@ func readManagementCheckpointHost(d *schema.ResourceData, m interface{}) error {
natSettingsMapToReturn["communication_with_this_server"] = v
}
+ if v := natSettingsMap["automatic-nat-rules"]; v != nil {
+ natSettingsMapToReturn["automatic_nat_rules"] = v
+ }
+ if v := natSettingsMap["communication-with-this-server"]; v != nil {
+ natSettingsMapToReturn["communication_with_this_server"] = v
+ }
_ = d.Set("nat_settings", []interface{}{natSettingsMapToReturn})
} else {
@@ -1019,6 +1062,12 @@ func readManagementCheckpointHost(d *schema.ResourceData, m interface{}) error {
if v := logSettingsJson["update-account-log-every"]; v != nil {
logSettingsState["update_account_log_every"] = int(math.Round(v.(float64)))
}
+ if v := logSettingsJson["distribute-logs-between-all-active-servers"]; v != nil {
+ logSettingsState["distribute_logs_between_all_active_servers"] = v
+ }
+ if v := logSettingsJson["include-tcp-state-information"]; v != nil {
+ logSettingsState["include_tcp_state_information"] = v
+ }
_ = d.Set("logs_settings", []interface{}{logSettingsState})
} else {
_ = d.Set("logs_settings", nil)
@@ -1100,6 +1149,10 @@ func readManagementCheckpointHost(d *schema.ResourceData, m interface{}) error {
_ = d.Set("comments", v)
}
+ if v := checkpointHost["dns-server"]; v != nil {
+ _ = d.Set("dns_server", v)
+ }
+
return nil
}
@@ -1213,6 +1266,12 @@ func updateManagementCheckpointHost(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("nat_settings.0.communication_with_this_server"); ok {
natSettingsPayload["communication-with-this-server"] = v.(string)
}
+ if v, ok := d.GetOk("nat_settings.0.automatic_nat_rules"); ok {
+ natSettingsPayload["automatic-nat-rules"] = v.(string)
+ }
+ if v, ok := d.GetOk("nat_settings.0.communication_with_this_server"); ok {
+ natSettingsPayload["communication-with-this-server"] = v.(string)
+ }
checkpointHost["nat-settings"] = natSettingsPayload
}
} else {
@@ -1362,6 +1421,12 @@ func updateManagementCheckpointHost(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("logs_settings.0.update_account_log_every"); ok {
logsSettingsPayload["update-account-log-every"] = v.(int)
}
+ if v, ok := d.GetOkExists("logs_settings.0.distribute_logs_between_all_active_servers"); ok {
+ logsSettingsPayload["distribute-logs-between-all-active-servers"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.include_tcp_state_information"); ok {
+ logsSettingsPayload["include-tcp-state-information"] = v.(string)
+ }
checkpointHost["logs-settings"] = logsSettingsPayload
}
}
@@ -1434,6 +1499,12 @@ func updateManagementCheckpointHost(d *schema.ResourceData, m interface{}) error
log.Println("Update CheckpointHost - Map = ", checkpointHost)
+ if ok := d.HasChange("dns_server"); ok {
+ if v, ok := d.GetOkExists("dns_server"); ok {
+ checkpointHost["dns-server"] = v.(bool)
+ }
+ }
+
updateCheckpointHostRes, err := client.ApiCall("set-checkpoint-host", checkpointHost, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !updateCheckpointHostRes.Success {
if updateCheckpointHostRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_cme_accounts_gcp.go b/checkpoint/resource_checkpoint_management_cme_accounts_gcp.go
index 118765c1..f9c6fc84 100755
--- a/checkpoint/resource_checkpoint_management_cme_accounts_gcp.go
+++ b/checkpoint/resource_checkpoint_management_cme_accounts_gcp.go
@@ -37,6 +37,7 @@ func resourceManagementCMEAccountsGCP() *schema.Resource {
"credentials_data": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "Base64 encoded string that represents the content of the credentials file.",
},
"deletion_tolerance": {
diff --git a/checkpoint/resource_checkpoint_management_cme_gw_configurations_aws.go b/checkpoint/resource_checkpoint_management_cme_gw_configurations_aws.go
index 3d20d66a..46184407 100644
--- a/checkpoint/resource_checkpoint_management_cme_gw_configurations_aws.go
+++ b/checkpoint/resource_checkpoint_management_cme_gw_configurations_aws.go
@@ -33,6 +33,7 @@ func resourceManagementCMEGWConfigurationsAWS() *schema.Resource {
"base64_sic_key": {
Type: schema.TypeString,
Required: true,
+ Sensitive: true,
Description: "Base64 key for trusted communication between management and GW.",
},
"policy": {
diff --git a/checkpoint/resource_checkpoint_management_cme_gw_configurations_azure.go b/checkpoint/resource_checkpoint_management_cme_gw_configurations_azure.go
index f5646cf9..37c05a1b 100644
--- a/checkpoint/resource_checkpoint_management_cme_gw_configurations_azure.go
+++ b/checkpoint/resource_checkpoint_management_cme_gw_configurations_azure.go
@@ -32,6 +32,7 @@ func resourceManagementCMEGWConfigurationsAzure() *schema.Resource {
"base64_sic_key": {
Type: schema.TypeString,
Required: true,
+ Sensitive: true,
Description: "Base64 key for trusted communication between management and GW.",
},
"policy": {
diff --git a/checkpoint/resource_checkpoint_management_cme_gw_configurations_gcp.go b/checkpoint/resource_checkpoint_management_cme_gw_configurations_gcp.go
index 2d8c994a..fd962142 100644
--- a/checkpoint/resource_checkpoint_management_cme_gw_configurations_gcp.go
+++ b/checkpoint/resource_checkpoint_management_cme_gw_configurations_gcp.go
@@ -32,6 +32,7 @@ func resourceManagementCMEGWConfigurationsGCP() *schema.Resource {
"base64_sic_key": {
Type: schema.TypeString,
Required: true,
+ Sensitive: true,
Description: "Base64 key for trusted communication between management and GW.",
},
"policy": {
diff --git a/checkpoint/resource_checkpoint_management_command_check_network_feed.go b/checkpoint/resource_checkpoint_management_command_check_network_feed.go
index c6638f47..2a4c1d88 100644
--- a/checkpoint/resource_checkpoint_management_command_check_network_feed.go
+++ b/checkpoint/resource_checkpoint_management_command_check_network_feed.go
@@ -62,6 +62,7 @@ func resourceManagementCheckNetworkFeed() *schema.Resource {
"password": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "password for authenticating with the URL.",
},
"username": {
diff --git a/checkpoint/resource_checkpoint_management_command_check_threat_ioc_feed.go b/checkpoint/resource_checkpoint_management_command_check_threat_ioc_feed.go
index c25d590b..bb052a01 100644
--- a/checkpoint/resource_checkpoint_management_command_check_threat_ioc_feed.go
+++ b/checkpoint/resource_checkpoint_management_command_check_threat_ioc_feed.go
@@ -32,6 +32,26 @@ func resourceManagementCheckThreatIocFeed() *schema.Resource {
ForceNew: true,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "use_snort_format": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Set in order to configure a snort format indicator feed.",
+ },
+ "severity": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Set in order to configure the severity of the snort protections in snort format. 1-Low, 4-Critical.",
+ },
+ "performance_impact": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Set in order to configure the performance impact of the snort protections in snort format. 1-Very Low, 4-High.",
+ },
+ "confidence": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Set in order to configure the confidence of the snort protections in snort format. 1-Low, 5-High.",
+ },
"name": {
Type: schema.TypeString,
Optional: true,
@@ -115,6 +135,7 @@ func resourceManagementCheckThreatIocFeed() *schema.Resource {
"password": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "password for authenticating with the URL.",
},
"use_custom_feed_settings": {
diff --git a/checkpoint/resource_checkpoint_management_command_connect_cloud_services.go b/checkpoint/resource_checkpoint_management_command_connect_cloud_services.go
index 96de1cbb..74d1f826 100644
--- a/checkpoint/resource_checkpoint_management_command_connect_cloud_services.go
+++ b/checkpoint/resource_checkpoint_management_command_connect_cloud_services.go
@@ -27,6 +27,7 @@ func resourceManagementConnectCloudServices() *schema.Resource {
Type: schema.TypeString,
Required: true,
ForceNew: true,
+ Sensitive: true,
Description: "Copy the authentication token from the Smart-1 cloud service hosted in the Infinity Portal.",
},
"status": {
@@ -58,6 +59,42 @@ func resourceManagementConnectCloudServices() *schema.Resource {
Computed: true,
Description: "The Management Server's public URL.",
},
+ "gateways_onboarding_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ ForceNew: true,
+ Description: "Gateways on-boarding to Infinity Portal settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "connection_method": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Indicate whether Gateways will be connected to Infinity Portal automatically or only after policy installation.",
+ },
+ "details_level": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed representation o...",
+ },
+ "enabled": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable/Disable automatic connection of Security Gateways to Infinity Portal.",
+ },
+ "participant_gateways": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Which Gateways will be connected to Infinity Portal.",
+ },
+ "specific_gateways": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Selection of targets identified by the name or UID which will be on-boarded to the cloud. Configuration will be applied only when 'participant-gateway...",
+ },
+ },
+ },
+ },
},
}
}
@@ -71,6 +108,26 @@ func createManagementConnectCloudServices(d *schema.ResourceData, m interface{})
payload["auth-token"] = v.(string)
}
+ if _, ok := d.GetOk("gateways_onboarding_settings"); ok {
+ gatewaysOnboardingSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("gateways_onboarding_settings.0.connection_method"); ok {
+ gatewaysOnboardingSettingsPayload["connection-method"] = v.(string)
+ }
+ if v, ok := d.GetOk("gateways_onboarding_settings.0.details_level"); ok {
+ gatewaysOnboardingSettingsPayload["details-level"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("gateways_onboarding_settings.0.enabled"); ok {
+ gatewaysOnboardingSettingsPayload["enabled"] = v.(bool)
+ }
+ if v, ok := d.GetOk("gateways_onboarding_settings.0.participant_gateways"); ok {
+ gatewaysOnboardingSettingsPayload["participant-gateways"] = v.(string)
+ }
+ if v, ok := d.GetOk("gateways_onboarding_settings.0.specific_gateways"); ok {
+ gatewaysOnboardingSettingsPayload["specific-gateways"] = v.(string)
+ }
+ payload["gateways-onboarding-settings"] = gatewaysOnboardingSettingsPayload
+ }
+
ConnectCloudServicesRes, err := client.ApiCall("connect-cloud-services", payload, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil {
return fmt.Errorf("%s", err.Error())
diff --git a/checkpoint/resource_checkpoint_management_command_export_management.go b/checkpoint/resource_checkpoint_management_command_export_management.go
index 6d6ab7be..a85bf5e2 100644
--- a/checkpoint/resource_checkpoint_management_command_export_management.go
+++ b/checkpoint/resource_checkpoint_management_command_export_management.go
@@ -91,6 +91,36 @@ func resourceManagementExportManagement() *schema.Resource {
Computed: true,
Description: "Asynchronous task unique identifier.",
},
+ "verify_all_servers": {
+ Type: schema.TypeBool,
+ Optional: true,
+ ForceNew: true,
+ Description: "Runs the verification process on all Management Servers and Log Servers.
For more information see last days of logs.",
+ },
+ "complete_background_export": {
+ Type: schema.TypeBool,
+ Optional: true,
+ ForceNew: true,
+ Description: "If 'true', export the changes you made during the 'Prepare' phase and the 'Complete' phase will start. You can't make any changes during the 'Complete...",
+ },
+ "cancel_prepare_export": {
+ Type: schema.TypeBool,
+ Optional: true,
+ ForceNew: true,
+ Description: "If 'true', cancels the export in background process. If you do not run this command within the number of days defined in 'show-background-upgrade-sett...",
+ },
},
}
}
@@ -143,6 +173,26 @@ func createManagementExportManagement(d *schema.ResourceData, m interface{}) err
payload["ignore-warnings"] = v.(bool)
}
+ if v, ok := d.GetOkExists("verify_all_servers"); ok {
+ payload["verify-all-servers"] = v.(bool)
+ }
+
+ if v, ok := d.GetOkExists("prepare_background_export"); ok {
+ payload["prepare-background-export"] = v.(bool)
+ }
+
+ if v, ok := d.GetOk("days_of_logs"); ok {
+ payload["days-of-logs"] = v.(int)
+ }
+
+ if v, ok := d.GetOkExists("complete_background_export"); ok {
+ payload["complete-background-export"] = v.(bool)
+ }
+
+ if v, ok := d.GetOkExists("cancel_prepare_export"); ok {
+ payload["cancel-prepare-export"] = v.(bool)
+ }
+
ExportManagementRes, err := client.ApiCall("export-management", payload, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil {
return fmt.Errorf("%s", err.Error())
diff --git a/checkpoint/resource_checkpoint_management_command_import_management.go b/checkpoint/resource_checkpoint_management_command_import_management.go
index bd73d33b..c785ee82 100644
--- a/checkpoint/resource_checkpoint_management_command_import_management.go
+++ b/checkpoint/resource_checkpoint_management_command_import_management.go
@@ -96,6 +96,63 @@ func resourceManagementImportManagement() *schema.Resource {
Computed: true,
Description: "If set to \"True\", session is expired and login is required.",
},
+ "prepare_background_import": {
+ Type: schema.TypeBool,
+ Optional: true,
+ ForceNew: true,
+ Description: "If 'true', the import will run in the background and 'Prepare' phase will be achieved. You can continue making changes on the Management Server during...",
+ },
+ "keep_cloud_sharing": {
+ Type: schema.TypeBool,
+ Optional: true,
+ ForceNew: true,
+ Description: "Preserve the connection of the Management Server to Check Point's Infinity Portal.
Use this flag after ensuring that the original Management Server...",
+ },
+ "domain_ipv6_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ ForceNew: true,
+ Description: "IPv6 address for the imported Domain.",
+ },
+ "days_of_logs": {
+ Type: schema.TypeInt,
+ Optional: true,
+ ForceNew: true,
+ Description: "Export last days of logs.",
+ },
+ "complete_background_import": {
+ Type: schema.TypeBool,
+ Optional: true,
+ ForceNew: true,
+ Description: "If 'true', import the changes you made during the 'Prepare' phase, and the 'Complete' phase will be achieved. You can't make any changes during the 'C...",
+ },
+ "change_ips": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ ForceNew: true,
+ Description: "New IP addresses (IPv4, IPv6, or both) of the servers.
Required only if one or more of the servers in the Security Managem...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "new_ipv4_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The new IPv4 address of the server that migrates to a new IP address.",
+ },
+ "server_name": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The object name of the server that migrates to a new IP address.",
+ },
+ },
+ },
+ },
+ "cancel_prepare_import": {
+ Type: schema.TypeBool,
+ Optional: true,
+ ForceNew: true,
+ Description: "If 'true', cancels the import in background process. If you do not run this command within the number of days defined in 'show-background-upgrade-sett...",
+ },
},
}
}
@@ -148,6 +205,41 @@ func createManagementImportManagement(d *schema.ResourceData, m interface{}) err
payload["ignore-warnings"] = v.(bool)
}
+ if v, ok := d.GetOkExists("prepare_background_import"); ok {
+ payload["prepare-background-import"] = v.(bool)
+ }
+
+ if v, ok := d.GetOkExists("keep_cloud_sharing"); ok {
+ payload["keep-cloud-sharing"] = v.(bool)
+ }
+
+ if v, ok := d.GetOk("domain_ipv6_address"); ok {
+ payload["domain-ipv6-address"] = v.(string)
+ }
+
+ if v, ok := d.GetOk("days_of_logs"); ok {
+ payload["days-of-logs"] = v.(int)
+ }
+
+ if v, ok := d.GetOkExists("complete_background_import"); ok {
+ payload["complete-background-import"] = v.(bool)
+ }
+
+ if _, ok := d.GetOk("change_ips"); ok {
+ changeIpsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("change_ips.0.new_ipv4_address"); ok {
+ changeIpsPayload["new-ipv4-address"] = v.(string)
+ }
+ if v, ok := d.GetOk("change_ips.0.server_name"); ok {
+ changeIpsPayload["server-name"] = v.(string)
+ }
+ payload["change-ips"] = changeIpsPayload
+ }
+
+ if v, ok := d.GetOkExists("cancel_prepare_import"); ok {
+ payload["cancel-prepare-import"] = v.(bool)
+ }
+
ImportManagementRes, err := client.ApiCall("import-management", payload, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil {
return fmt.Errorf("%s", err.Error())
diff --git a/checkpoint/resource_checkpoint_management_command_install_software_package.go b/checkpoint/resource_checkpoint_management_command_install_software_package.go
index aa7b69b1..7fd8a8ec 100644
--- a/checkpoint/resource_checkpoint_management_command_install_software_package.go
+++ b/checkpoint/resource_checkpoint_management_command_install_software_package.go
@@ -71,6 +71,18 @@ func resourceManagementInstallSoftwarePackage() *schema.Resource {
Computed: true,
Description: "Command asynchronous task unique identifier.",
},
+ "package_location": {
+ Type: schema.TypeString,
+ Optional: true,
+ ForceNew: true,
+ Description: "The package repository.",
+ },
+ "method": {
+ Type: schema.TypeString,
+ Optional: true,
+ ForceNew: true,
+ Description: "How we want to use the package.",
+ },
},
}
}
@@ -109,6 +121,14 @@ func createManagementInstallSoftwarePackage(d *schema.ResourceData, m interface{
payload["concurrency-limit"] = v.(int)
}
+ if v, ok := d.GetOk("package_location"); ok {
+ payload["package-location"] = v.(string)
+ }
+
+ if v, ok := d.GetOk("method"); ok {
+ payload["method"] = v.(string)
+ }
+
InstallSoftwarePackageRes, _ := client.ApiCall("install-software-package", payload, client.GetSessionID(), true, client.IsProxyUsed())
if !InstallSoftwarePackageRes.Success {
return fmt.Errorf("%s", InstallSoftwarePackageRes.ErrorMsg)
diff --git a/checkpoint/resource_checkpoint_management_command_reset_sic.go b/checkpoint/resource_checkpoint_management_command_reset_sic.go
index 34e9569c..d4808f92 100644
--- a/checkpoint/resource_checkpoint_management_command_reset_sic.go
+++ b/checkpoint/resource_checkpoint_management_command_reset_sic.go
@@ -30,6 +30,15 @@ func resourceManagementResetSic() *schema.Resource {
Computed: true,
Description: "Command asynchronous task unique identifier.",
},
+ "domains_to_process": {
+ Type: schema.TypeSet,
+ Optional: true,
+ ForceNew: true,
+ Description: "Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and with ig...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -43,6 +52,10 @@ func createManagementResetSic(d *schema.ResourceData, m interface{}) error {
payload["name"] = v.(string)
}
+ if v, ok := d.GetOk("domains_to_process"); ok {
+ payload["domains-to-process"] = v.(*schema.Set).List()
+ }
+
ResetSicRes, _ := client.ApiCall("reset-sic", payload, client.GetSessionID(), true, client.IsProxyUsed())
if !ResetSicRes.Success {
return fmt.Errorf("%s", ResetSicRes.ErrorMsg)
diff --git a/checkpoint/resource_checkpoint_management_command_run_script.go b/checkpoint/resource_checkpoint_management_command_run_script.go
index c4e6cf07..05fd4e74 100644
--- a/checkpoint/resource_checkpoint_management_command_run_script.go
+++ b/checkpoint/resource_checkpoint_management_command_run_script.go
@@ -66,6 +66,12 @@ func resourceManagementRunScript() *schema.Resource {
Computed: true,
Description: "Response message in JSON format",
},
+ "script_type": {
+ Type: schema.TypeString,
+ Optional: true,
+ ForceNew: true,
+ Description: "Type of script. Run a new script ('one time') or an existing script from the repository ('repository').",
+ },
},
}
}
@@ -98,6 +104,10 @@ func createManagementRunScript(d *schema.ResourceData, m interface{}) error {
payload["timeout"] = v
}
+ if v, ok := d.GetOk("script_type"); ok {
+ payload["script-type"] = v.(string)
+ }
+
runScriptRes, err := client.ApiCall("run-script", payload, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil {
return fmt.Errorf("%s", err.Error())
diff --git a/checkpoint/resource_checkpoint_management_command_set_automatic_purge.go b/checkpoint/resource_checkpoint_management_command_set_automatic_purge.go
index cd25b34c..3d4dcd7f 100644
--- a/checkpoint/resource_checkpoint_management_command_set_automatic_purge.go
+++ b/checkpoint/resource_checkpoint_management_command_set_automatic_purge.go
@@ -81,6 +81,12 @@ func resourceManagementSetAutomaticPurge() *schema.Resource {
},
},
},
+ "ignore_domain_backup": {
+ Type: schema.TypeBool,
+ Optional: true,
+ ForceNew: true,
+ Description: "Ignore global domain sessions that are linked to the latest local domain backups, and purge them anyway.",
+ },
},
}
}
@@ -130,6 +136,10 @@ func createManagementSetAutomaticPurge(d *schema.ResourceData, m interface{}) er
}
}
+ if v, ok := d.GetOkExists("ignore_domain_backup"); ok {
+ payload["ignore-domain-backup"] = v.(bool)
+ }
+
SetAutomaticPurgeRes, _ := client.ApiCall("set-automatic-purge", payload, client.GetSessionID(), true, client.IsProxyUsed())
if !SetAutomaticPurgeRes.Success {
return fmt.Errorf("%s", SetAutomaticPurgeRes.ErrorMsg)
diff --git a/checkpoint/resource_checkpoint_management_command_set_gateway_global_use.go b/checkpoint/resource_checkpoint_management_command_set_gateway_global_use.go
index 726f1a38..6b2e8352 100644
--- a/checkpoint/resource_checkpoint_management_command_set_gateway_global_use.go
+++ b/checkpoint/resource_checkpoint_management_command_set_gateway_global_use.go
@@ -29,6 +29,12 @@ func resourceManagementSetGatewayGlobalUse() *schema.Resource {
ForceNew: true,
Description: "On what target to execute this command. Target may be identified by its object name, or object unique identifier.",
},
+ "enable_identity_sharing": {
+ Type: schema.TypeBool,
+ Optional: true,
+ ForceNew: true,
+ Description: "Indicates whether Identity Awareness Sharing global use is enabled on the target.",
+ },
},
}
}
@@ -46,6 +52,10 @@ func createManagementSetGatewayGlobalUse(d *schema.ResourceData, m interface{})
payload["target"] = v.(string)
}
+ if v, ok := d.GetOkExists("enable_identity_sharing"); ok {
+ payload["enable-identity-sharing"] = v.(bool)
+ }
+
SetGatewayGlobalUseRes, _ := client.ApiCall("set-gateway-global-use", payload, client.GetSessionID(), true, false)
if !SetGatewayGlobalUseRes.Success {
return fmt.Errorf("%s", SetGatewayGlobalUseRes.ErrorMsg)
diff --git a/checkpoint/resource_checkpoint_management_command_set_global_properties.go b/checkpoint/resource_checkpoint_management_command_set_global_properties.go
index 0913d735..a31c8238 100644
--- a/checkpoint/resource_checkpoint_management_command_set_global_properties.go
+++ b/checkpoint/resource_checkpoint_management_command_set_global_properties.go
@@ -207,16 +207,6 @@ func resourceManagementSetGlobalProperties() *schema.Resource {
Optional: true,
Description: "SMTP Welcome Message is the message to be displayed when a user begins an SMTP session.",
},
- "http_next_proxy_host": {
- Type: schema.TypeString,
- Optional: true,
- Description: "HTTP next proxy host is the host name of the HTTP proxy behind the Check Point Security Gateway HTTP security server (if there is one). Changing the HTTP Next Proxy fields takes effect after the Security Gateway database is downloaded to the authenticating gateway, or after the security policy is re-installed.
These settings apply only to firewalled gateways prior to NG. For later versions, these settings should be defined in the Node Properties window.",
- },
- "http_next_proxy_port": {
- Type: schema.TypeInt,
- Optional: true,
- Description: "HTTP next proxy port is the port of the HTTP proxy behind the Check Point Security Gateway HTTP security server (if there is one). Changing the HTTP Next Proxy fields takes effect after the Security Gateway database is downloaded to the authenticating gateway, or after the security policy is re-installed.
These settings apply only to firewalled gateways prior to NG. For later versions, these settings should be defined in the Node Properties window.",
- },
"http_servers": {
Type: schema.TypeList,
Optional: true,
@@ -483,224 +473,6 @@ func resourceManagementSetGlobalProperties() *schema.Resource {
Description: "configure supported Encryption and Authentication methods for Remote Access clients.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "encryption_algorithms": {
- Type: schema.TypeList,
- MaxItems: 1,
- Optional: true,
- Description: "Select the methods negotiated in IKE phase 2 and used in IPSec connections.",
- Elem: &schema.Resource{
- Schema: map[string]*schema.Schema{
- "ike": {
- Type: schema.TypeList,
- MaxItems: 1,
- Optional: true,
- Description: "Configure the IKE Phase 1 settings.",
- Elem: &schema.Resource{
- Schema: map[string]*schema.Schema{
- "support_encryption_algorithms": {
- Type: schema.TypeList,
- MaxItems: 1,
- Optional: true,
- Description: "Select the encryption algorithms that will be supported with remote hosts.",
- Elem: &schema.Resource{
- Schema: map[string]*schema.Schema{
- "aes_128": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the AES-128 encryption algorithm will be supported with remote hosts.",
- },
- "aes_256": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the AES-256 encryption algorithm will be supported with remote hosts.",
- },
- "des": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the DES encryption algorithm will be supported with remote hosts.",
- },
- "tdes": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the Triple DES encryption algorithm will be supported with remote hosts.",
- },
- },
- },
- },
- "use_encryption_algorithm": {
- Type: schema.TypeString,
- Optional: true,
- Description: "Choose the encryption algorithm that will have the highest priority of the selected algorithms. If given a choice of more that one encryption algorithm to use, the algorithm selected in this field will be used.",
- },
- "support_data_integrity": {
- Type: schema.TypeList,
- MaxItems: 1,
- Optional: true,
- Description: "Select the hash algorithms that will be supported with remote hosts to ensure data integrity.",
- Elem: &schema.Resource{
- Schema: map[string]*schema.Schema{
- "aes_xcbc": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the AES-XCBC hash algorithm will be supported with remote hosts to ensure data integrity.",
- },
- "md5": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the MD5 hash algorithm will be supported with remote hosts to ensure data integrity.",
- },
- "sha1": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the SHA1 hash algorithm will be supported with remote hosts to ensure data integrity.",
- },
- "sha256": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the SHA256 hash algorithm will be supported with remote hosts to ensure data integrity.",
- },
- },
- },
- },
- "use_data_integrity": {
- Type: schema.TypeString,
- Optional: true,
- Description: "The hash algorithm chosen here will be given the highest priority if more than one choice is offered.",
- },
- "support_diffie_hellman_groups": {
- Type: schema.TypeList,
- MaxItems: 1,
- Optional: true,
- Description: "Select the Diffie-Hellman groups that will be supported with remote hosts.",
- Elem: &schema.Resource{
- Schema: map[string]*schema.Schema{
- "group1": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether Diffie-Hellman Group 1 (768 bit) will be supported with remote hosts.",
- },
- "group14": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether Diffie-Hellman Group 14 (2048 bit) will be supported with remote hosts.",
- },
- "group2": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether Diffie-Hellman Group 2 (1024 bit) will be supported with remote hosts.",
- Default: true,
- },
- "group5": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether Diffie-Hellman Group 5 (1536 bit) will be supported with remote hosts.",
- },
- },
- },
- },
- "use_diffie_hellman_group": {
- Type: schema.TypeString,
- Optional: true,
- Description: "SecureClient users utilize the Diffie-Hellman group selected in this field.",
- Default: "Group 2",
- },
- },
- },
- },
- "ipsec": {
- Type: schema.TypeList,
- MaxItems: 1,
- Optional: true,
- Description: "Configure the IPSEC Phase 2 settings.",
- Elem: &schema.Resource{
- Schema: map[string]*schema.Schema{
- "support_encryption_algorithms": {
- Type: schema.TypeList,
- MaxItems: 1,
- Optional: true,
- Description: "Select the encryption algorithms that will be supported with remote hosts.",
- Elem: &schema.Resource{
- Schema: map[string]*schema.Schema{
- "aes_128": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the AES-128 encryption algorithm will be supported with remote hosts.",
- },
- "aes_256": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the AES-256 encryption algorithm will be supported with remote hosts.",
- },
- "des": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the DES encryption algorithm will be supported with remote hosts.",
- },
- "tdes": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the Triple DES encryption algorithm will be supported with remote hosts.",
- },
- },
- },
- },
- "use_encryption_algorithm": {
- Type: schema.TypeString,
- Optional: true,
- Description: "Choose the encryption algorithm that will have the highest priority of the selected algorithms. If given a choice of more that one encryption algorithm to use, the algorithm selected in this field will be used.",
- },
- "support_data_integrity": {
- Type: schema.TypeList,
- MaxItems: 1,
- Optional: true,
- Description: "Select the hash algorithms that will be supported with remote hosts to ensure data integrity.",
- Elem: &schema.Resource{
- Schema: map[string]*schema.Schema{
- "aes_xcbc": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the AES-XCBC hash algorithm will be supported with remote hosts to ensure data integrity.",
- },
- "md5": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the MD5 hash algorithm will be supported with remote hosts to ensure data integrity.",
- },
- "sha1": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the SHA1 hash algorithm will be supported with remote hosts to ensure data integrity.",
- },
- "sha256": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Select whether the SHA256 hash algorithm will be supported with remote hosts to ensure data integrity.",
- },
- },
- },
- },
- "use_data_integrity": {
- Type: schema.TypeString,
- Optional: true,
- Description: "The hash algorithm chosen here will be given the highest priority if more than one choice is offered.",
- },
- "enforce_encryption_alg_and_data_integrity_on_all_users": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Enforce Encryption Algorithm and Data Integrity on all users.",
- },
- },
- },
- },
- },
- },
- },
- "encryption_method": {
- Type: schema.TypeString,
- Optional: true,
- Description: "Select the encryption method.",
- Default: "ike_v1_only",
- },
"pre_shared_secret": {
Type: schema.TypeBool,
Optional: true,
@@ -728,6 +500,7 @@ func resourceManagementSetGlobalProperties() *schema.Resource {
"l2tp_pre_shared_key": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "Type in the pre-shared key.
Available only if support-l2tp-with-pre-shared-key is set to true.",
},
},
@@ -1596,6 +1369,11 @@ func resourceManagementSetGlobalProperties() *schema.Resource {
ForceNew: true,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "ip_options_drop": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "IP Options drop specifies the action to take when a packet with IP Options is encountered. The Check Point Security Gateway always drops these packets...",
+ },
"administrative_notifications": {
Type: schema.TypeString,
Optional: true,
@@ -1930,6 +1708,11 @@ func resourceManagementSetGlobalProperties() *schema.Resource {
ForceNew: true,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "keep_ike_sas": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enabled: Keep ALL IKEv1 phase 1 Security Associations (SA) upon policy installation.
Disabled: Delete ALL IKEv1 phase 1 Security Associations (SA) ...",
+ },
"certs_and_pki": {
Type: schema.TypeList,
MaxItems: 1,
@@ -1994,6 +1777,27 @@ func resourceManagementSetGlobalProperties() *schema.Resource {
ForceNew: true,
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
},
+ "identity_awareness": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ ForceNew: true,
+ Description: "Configure Identity Awareness properties.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "cache_mode": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "True: In case of connectivity loss from the Policy-Decision-Point (PDP), extend Identity cache up-to 'cache-mode-duration'.
False: Identity Cache M...",
+ },
+ "cache_mode_duration": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Time limit for keeping Identities in the cache.",
+ },
+ },
+ },
+ },
},
}
}
@@ -2291,168 +2095,6 @@ func readManagementSetGlobalProperties(d *schema.ResourceData, m interface{}) er
vpnAuthenticationAndEncryptionPayload := make(map[string]interface{})
- if _, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms"); ok {
-
- encryptionAlgorithmsPayload := make(map[string]interface{})
-
- if _, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike"); ok {
-
- ikePayload := make(map[string]interface{})
-
- if _, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_encryption_algorithms"); ok {
-
- supportEncryptionAlgorithmsPayload := make(map[string]interface{})
-
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_encryption_algorithms.0.aes_128"); ok {
- supportEncryptionAlgorithmsPayload["aes-128"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_encryption_algorithms.0.aes_256"); ok {
- supportEncryptionAlgorithmsPayload["aes-256"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_encryption_algorithms.0.des"); ok {
- supportEncryptionAlgorithmsPayload["des"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_encryption_algorithms.0.tdes"); ok {
- supportEncryptionAlgorithmsPayload["tdes"] = strconv.FormatBool(v.(bool))
- }
- ikePayload["support-encryption-algorithms"] = supportEncryptionAlgorithmsPayload
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.use_encryption_algorithm"); ok {
- ikePayload["use-encryption-algorithm"] = v.(string)
- }
- if _, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_data_integrity"); ok {
-
- supportDataIntegrityPayload := make(map[string]interface{})
-
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_data_integrity.0.aes_xcbc"); ok {
- supportDataIntegrityPayload["aes-xcbc"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_data_integrity.0.md5"); ok {
- supportDataIntegrityPayload["md5"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_data_integrity.0.sha1"); ok {
- supportDataIntegrityPayload["sha1"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_data_integrity.0.sha256"); ok {
- supportDataIntegrityPayload["sha256"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_data_integrity.0.sha384"); ok {
- supportDataIntegrityPayload["sha384"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_data_integrity.0.sha512"); ok {
- supportDataIntegrityPayload["sha512"] = strconv.FormatBool(v.(bool))
- }
- ikePayload["support-data-integrity"] = supportDataIntegrityPayload
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.use_data_integrity"); ok {
- ikePayload["use-data-integrity"] = v.(string)
- }
- if _, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_diffie_hellman_groups"); ok {
-
- supportDiffieHellmanGroupsPayload := make(map[string]interface{})
-
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_diffie_hellman_groups.0.group1"); ok {
- supportDiffieHellmanGroupsPayload["group1"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_diffie_hellman_groups.0.group14"); ok {
- supportDiffieHellmanGroupsPayload["group14"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_diffie_hellman_groups.0.group15"); ok {
- supportDiffieHellmanGroupsPayload["group15"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_diffie_hellman_groups.0.group16"); ok {
- supportDiffieHellmanGroupsPayload["group16"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_diffie_hellman_groups.0.group17"); ok {
- supportDiffieHellmanGroupsPayload["group17"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_diffie_hellman_groups.0.group18"); ok {
- supportDiffieHellmanGroupsPayload["group18"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_diffie_hellman_groups.0.group19"); ok {
- supportDiffieHellmanGroupsPayload["group19"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_diffie_hellman_groups.0.group2"); ok {
- supportDiffieHellmanGroupsPayload["group2"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_diffie_hellman_groups.0.group20"); ok {
- supportDiffieHellmanGroupsPayload["group20"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_diffie_hellman_groups.0.group21"); ok {
- supportDiffieHellmanGroupsPayload["group21"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.support_diffie_hellman_groups.0.group5"); ok {
- supportDiffieHellmanGroupsPayload["group5"] = strconv.FormatBool(v.(bool))
- }
- ikePayload["support-diffie-hellman-groups"] = supportDiffieHellmanGroupsPayload
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ike.0.use_diffie_hellman_group"); ok {
- ikePayload["use-diffie-hellman-group"] = v.(string)
- }
- encryptionAlgorithmsPayload["ike"] = ikePayload
- }
- if _, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec"); ok {
-
- ipsecPayload := make(map[string]interface{})
-
- if _, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.support_encryption_algorithms"); ok {
-
- supportEncryptionAlgorithmsPayload := make(map[string]interface{})
-
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.support_encryption_algorithms.0.aes_128"); ok {
- supportEncryptionAlgorithmsPayload["aes-128"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.support_encryption_algorithms.0.aes_256"); ok {
- supportEncryptionAlgorithmsPayload["aes-256"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.support_encryption_algorithms.0.des"); ok {
- supportEncryptionAlgorithmsPayload["des"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.support_encryption_algorithms.0.tdes"); ok {
- supportEncryptionAlgorithmsPayload["tdes"] = strconv.FormatBool(v.(bool))
- }
- ipsecPayload["support-encryption-algorithms"] = supportEncryptionAlgorithmsPayload
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.use_encryption_algorithm"); ok {
- ipsecPayload["use-encryption-algorithm"] = v.(string)
- }
- if _, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.support_data_integrity"); ok {
-
- supportDataIntegrityPayload := make(map[string]interface{})
-
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.support_data_integrity.0.aes_xcbc"); ok {
- supportDataIntegrityPayload["aes-xcbc"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.support_data_integrity.0.md5"); ok {
- supportDataIntegrityPayload["md5"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.support_data_integrity.0.sha1"); ok {
- supportDataIntegrityPayload["sha1"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.support_data_integrity.0.sha256"); ok {
- supportDataIntegrityPayload["sha256"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.support_data_integrity.0.sha384"); ok {
- supportDataIntegrityPayload["sha384"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.support_data_integrity.0.sha512"); ok {
- supportDataIntegrityPayload["sha512"] = strconv.FormatBool(v.(bool))
- }
- ipsecPayload["support-data-integrity"] = supportDataIntegrityPayload
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.use_data_integrity"); ok {
- ipsecPayload["use-data-integrity"] = v.(string)
- }
- if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.encryption_algorithms.0.ipsec.0.enforce_encryption_alg_and_data_integrity_on_all_users"); ok {
- ipsecPayload["enforce-encryption-alg-and-data-integrity-on-all-users"] = strconv.FormatBool(v.(bool))
- }
- encryptionAlgorithmsPayload["ipsec"] = ipsecPayload
- }
- vpnAuthenticationAndEncryptionPayload["encryption-algorithms"] = encryptionAlgorithmsPayload
- }
- if v, ok := d.GetOk("remote_access.0.vpn_authentication_and_encryption.0.encryption_method"); ok {
- vpnAuthenticationAndEncryptionPayload["encryption-method"] = v.(string)
- }
if v, ok := d.GetOkExists("remote_access.0.vpn_authentication_and_encryption.0.pre_shared_secret"); ok {
vpnAuthenticationAndEncryptionPayload["pre-shared-secret"] = strconv.FormatBool(v.(bool))
}
@@ -3222,6 +2864,9 @@ func readManagementSetGlobalProperties(d *schema.ResourceData, m interface{}) er
}
advancedConfPayload["certs-and-pki"] = certsAndPkiPayload
}
+ if v, ok := d.GetOkExists("advanced_conf.0.keep_ike_sas"); ok {
+ advancedConfPayload["keep-ike-sas"] = v.(bool)
+ }
payload["advanced-conf"] = advancedConfPayload
}
}
@@ -3246,6 +2891,17 @@ func readManagementSetGlobalProperties(d *schema.ResourceData, m interface{}) er
payload["ignore-errors"] = v.(bool)
}
+ if _, ok := d.GetOk("identity_awareness"); ok {
+ identityAwarenessPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("identity_awareness.0.cache_mode"); ok {
+ identityAwarenessPayload["cache-mode"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness.0.cache_mode_duration"); ok {
+ identityAwarenessPayload["cache-mode-duration"] = v.(int)
+ }
+ payload["identity-awareness"] = identityAwarenessPayload
+ }
+
SetGlobalPropertiesRes, _ := client.ApiCall("set-global-properties", payload, client.GetSessionID(), true, client.IsProxyUsed())
if !SetGlobalPropertiesRes.Success {
return fmt.Errorf("%s", SetGlobalPropertiesRes.ErrorMsg)
diff --git a/checkpoint/resource_checkpoint_management_command_set_https_advanced_settings.go b/checkpoint/resource_checkpoint_management_command_set_https_advanced_settings.go
index 94a63a20..e9e6182f 100644
--- a/checkpoint/resource_checkpoint_management_command_set_https_advanced_settings.go
+++ b/checkpoint/resource_checkpoint_management_command_set_https_advanced_settings.go
@@ -163,6 +163,12 @@ func resourceManagementSetHttpsAdvancedSettings() *schema.Resource {
ForceNew: true,
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
},
+ "show_block_page": {
+ Type: schema.TypeBool,
+ Optional: true,
+ ForceNew: true,
+ Description: "Whether a block page should be displayed when TLS Inspection rejects a connection due to server certificate issues.
The default value is true.",
+ },
},
}
}
@@ -278,6 +284,10 @@ func createManagementSetHttpsAdvancedSettings(d *schema.ResourceData, m interfac
payload["ignore-errors"] = v.(bool)
}
+ if v, ok := d.GetOkExists("show_block_page"); ok {
+ payload["show-block-page"] = v.(bool)
+ }
+
SetHttpsAdvancedSettingsRes, _ := client.ApiCall("set-https-advanced-settings", payload, client.GetSessionID(), true, false)
if !SetHttpsAdvancedSettingsRes.Success {
return fmt.Errorf("%s", SetHttpsAdvancedSettingsRes.ErrorMsg)
diff --git a/checkpoint/resource_checkpoint_management_command_set_policy_settings.go b/checkpoint/resource_checkpoint_management_command_set_policy_settings.go
index 2e860e66..65acdd4e 100644
--- a/checkpoint/resource_checkpoint_management_command_set_policy_settings.go
+++ b/checkpoint/resource_checkpoint_management_command_set_policy_settings.go
@@ -42,6 +42,11 @@ func resourceManagementSetPolicySettings() *schema.Resource {
ForceNew: true,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "track": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Track default value for new rule creation. Log or None.",
+ },
"destination": {
Type: schema.TypeString,
Optional: true,
@@ -63,6 +68,12 @@ func resourceManagementSetPolicySettings() *schema.Resource {
},
},
},
+ "log_generation": {
+ Type: schema.TypeString,
+ Optional: true,
+ ForceNew: true,
+ Description: "Log generation settings for existing and new rules.",
+ },
},
}
}
@@ -103,6 +114,10 @@ func createManagementSetPolicySettings(d *schema.ResourceData, m interface{}) er
}
}
+ if v, ok := d.GetOk("log_generation"); ok {
+ payload["log-generation"] = v.(string)
+ }
+
SetPolicySettingsRes, _ := client.ApiCall("set-policy-settings", payload, client.GetSessionID(), true, client.IsProxyUsed())
if !SetPolicySettingsRes.Success {
return fmt.Errorf("%s", SetPolicySettingsRes.ErrorMsg)
diff --git a/checkpoint/resource_checkpoint_management_command_set_trust.go b/checkpoint/resource_checkpoint_management_command_set_trust.go
index f9aed8eb..f86b21ea 100644
--- a/checkpoint/resource_checkpoint_management_command_set_trust.go
+++ b/checkpoint/resource_checkpoint_management_command_set_trust.go
@@ -35,6 +35,7 @@ func resourceManagementSetTrust() *schema.Resource {
Type: schema.TypeString,
Optional: true,
ForceNew: true,
+ Sensitive: true,
Description: "Shared password to establish SIC between the Security Management and the Security Gateway.",
},
"trust_method": {
diff --git a/checkpoint/resource_checkpoint_management_command_test_sic_status.go b/checkpoint/resource_checkpoint_management_command_test_sic_status.go
index e26732e2..3ad53ae6 100644
--- a/checkpoint/resource_checkpoint_management_command_test_sic_status.go
+++ b/checkpoint/resource_checkpoint_management_command_test_sic_status.go
@@ -40,6 +40,15 @@ func resourceManagementTestSicStatus() *schema.Resource {
Computed: true,
Description: "Command asynchronous task unique identifier.",
},
+ "domains_to_process": {
+ Type: schema.TypeSet,
+ Optional: true,
+ ForceNew: true,
+ Description: "Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and with ig...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -57,6 +66,10 @@ func readManagementTestSicStatus(d *schema.ResourceData, m interface{}) error {
payload["name"] = v.(string)
}
+ if v, ok := d.GetOk("domains_to_process"); ok {
+ payload["domains-to-process"] = v.(*schema.Set).List()
+ }
+
TestSicStatusRes, _ := client.ApiCall("test-sic-status", payload, client.GetSessionID(), true, client.IsProxyUsed())
if !TestSicStatusRes.Success {
return fmt.Errorf("%s", TestSicStatusRes.ErrorMsg)
diff --git a/checkpoint/resource_checkpoint_management_command_test_trust.go b/checkpoint/resource_checkpoint_management_command_test_trust.go
index 5d65ca75..b3731156 100644
--- a/checkpoint/resource_checkpoint_management_command_test_trust.go
+++ b/checkpoint/resource_checkpoint_management_command_test_trust.go
@@ -31,6 +31,15 @@ func resourceManagementTestTrust() *schema.Resource {
ForceNew: true,
Description: "Establish the trust communication method.",
},
+ "domains_to_process": {
+ Type: schema.TypeSet,
+ Optional: true,
+ ForceNew: true,
+ Description: "Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and with ig...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -53,6 +62,10 @@ func createManagementTestTrust(d *schema.ResourceData, m interface{}) error {
payload["trust-method"] = v.(string)
}
+ if v, ok := d.GetOk("domains_to_process"); ok {
+ payload["domains-to-process"] = v.(*schema.Set).List()
+ }
+
TestTrustRes, err := client.ApiCall("test-trust", payload, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil {
return fmt.Errorf("%s", err.Error())
diff --git a/checkpoint/resource_checkpoint_management_command_verify_software_package.go b/checkpoint/resource_checkpoint_management_command_verify_software_package.go
index 202aba86..a6c75ad0 100644
--- a/checkpoint/resource_checkpoint_management_command_verify_software_package.go
+++ b/checkpoint/resource_checkpoint_management_command_verify_software_package.go
@@ -39,6 +39,45 @@ func resourceManagementVerifySoftwarePackage() *schema.Resource {
Computed: true,
Description: "Command asynchronous task unique identifier.",
},
+ "operation_context": {
+ Type: schema.TypeString,
+ Optional: true,
+ ForceNew: true,
+ Description: "The operation can be: 'install' (default) or 'uninstall'.",
+ },
+ "download_package_from": {
+ Type: schema.TypeString,
+ Optional: true,
+ ForceNew: true,
+ Description: "Where is the package located.",
+ },
+ "download_package": {
+ Type: schema.TypeBool,
+ Optional: true,
+ ForceNew: true,
+ Description: "Should the package be downloaded before verification.",
+ },
+ "cluster_installation_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ ForceNew: true,
+ Description: "Installation settings for cluster.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "cluster_delay": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "The delay between end of installation on one cluster members and start of installation on the next cluster member.",
+ },
+ "cluster_strategy": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The cluster installation strategy. all-members - Install the package on all members in the cluster non-active-members-and-failover - In the High Avail...",
+ },
+ },
+ },
+ },
},
}
}
@@ -59,6 +98,29 @@ func createManagementVerifySoftwarePackage(d *schema.ResourceData, m interface{}
payload["concurrency-limit"] = v.(int)
}
+ if v, ok := d.GetOk("operation_context"); ok {
+ payload["operation-context"] = v.(string)
+ }
+
+ if v, ok := d.GetOk("download_package_from"); ok {
+ payload["download-package-from"] = v.(string)
+ }
+
+ if v, ok := d.GetOkExists("download_package"); ok {
+ payload["download-package"] = v.(bool)
+ }
+
+ if _, ok := d.GetOk("cluster_installation_settings"); ok {
+ clusterInstallationSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("cluster_installation_settings.0.cluster_delay"); ok {
+ clusterInstallationSettingsPayload["cluster-delay"] = v.(int)
+ }
+ if v, ok := d.GetOk("cluster_installation_settings.0.cluster_strategy"); ok {
+ clusterInstallationSettingsPayload["cluster-strategy"] = v.(string)
+ }
+ payload["cluster-installation-settings"] = clusterInstallationSettingsPayload
+ }
+
VerifySoftwarePackageRes, _ := client.ApiCall("verify-software-package", payload, client.GetSessionID(), true, client.IsProxyUsed())
if !VerifySoftwarePackageRes.Success {
return fmt.Errorf("%s", VerifySoftwarePackageRes.ErrorMsg)
diff --git a/checkpoint/resource_checkpoint_management_command_where_used.go b/checkpoint/resource_checkpoint_management_command_where_used.go
index 17503bbc..8849425d 100644
--- a/checkpoint/resource_checkpoint_management_command_where_used.go
+++ b/checkpoint/resource_checkpoint_management_command_where_used.go
@@ -43,6 +43,15 @@ func resourceManagementWhereUsed() *schema.Resource {
ForceNew: true,
Description: "Maximum nesting level during indirect usage search.",
},
+ "domains_to_process": {
+ Type: schema.TypeSet,
+ Optional: true,
+ ForceNew: true,
+ Description: "Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and with ig...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -71,6 +80,10 @@ func createManagementWhereUsed(d *schema.ResourceData, m interface{}) error {
payload["indirect-max-depth"] = v.(int)
}
+ if v, ok := d.GetOk("domains_to_process"); ok {
+ payload["domains-to-process"] = v.(*schema.Set).List()
+ }
+
WhereUsedRes, _ := client.ApiCall("where-used", payload, client.GetSessionID(), true, client.IsProxyUsed())
if !WhereUsedRes.Success {
return fmt.Errorf("%s", WhereUsedRes.ErrorMsg)
diff --git a/checkpoint/resource_checkpoint_management_data_type_patterns.go b/checkpoint/resource_checkpoint_management_data_type_patterns.go
index 5ea3f891..1b6e8ea4 100644
--- a/checkpoint/resource_checkpoint_management_data_type_patterns.go
+++ b/checkpoint/resource_checkpoint_management_data_type_patterns.go
@@ -69,6 +69,11 @@ func resourceManagementDataTypePatterns() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "use_statistical_analysis": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to use statistical analysis to enhance accuracy. Relevant only for built-in data types.",
+ },
},
}
}
@@ -203,6 +208,10 @@ func readManagementDataTypePatterns(d *schema.ResourceData, m interface{}) error
_ = d.Set("ignore_errors", v)
}
+ if v := dataTypePatterns["use-statistical-analysis"]; v != nil {
+ _ = d.Set("use_statistical_analysis", v)
+ }
+
return nil
}
@@ -264,6 +273,12 @@ func updateManagementDataTypePatterns(d *schema.ResourceData, m interface{}) err
log.Println("Update DataTypePatterns - Map = ", dataTypePatterns)
+ if ok := d.HasChange("use_statistical_analysis"); ok {
+ if v, ok := d.GetOkExists("use_statistical_analysis"); ok {
+ dataTypePatterns["use-statistical-analysis"] = v.(bool)
+ }
+ }
+
updateDataTypePatternsRes, err := client.ApiCall("set-data-type-patterns", dataTypePatterns, client.GetSessionID(), true, false)
if err != nil || !updateDataTypePatternsRes.Success {
if updateDataTypePatternsRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_domain_permissions_profile.go b/checkpoint/resource_checkpoint_management_domain_permissions_profile.go
index 905be422..d97f1048 100644
--- a/checkpoint/resource_checkpoint_management_domain_permissions_profile.go
+++ b/checkpoint/resource_checkpoint_management_domain_permissions_profile.go
@@ -284,6 +284,22 @@ func resourceManagementDomainPermissionsProfile() *schema.Resource {
Description: "Management permissions.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "allowed_mgmt_api_commands": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "List of allowed Management API commands the profile can run. All available commands can be viewed using show-commands Management API.
...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
"cme_operations": {
Type: schema.TypeString,
Optional: true,
@@ -324,6 +340,11 @@ func resourceManagementDomainPermissionsProfile() *schema.Resource {
Optional: true,
Description: "Manage integration with Cloud Services.",
},
+ "limit_mgmt_api_commands": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable limitation of Management API commands the profile may or may not run.
Only a 'Customized' permission-type profile can edit this permission.
Not sup",
+ },
},
},
},
@@ -730,6 +751,15 @@ func createManagementDomainPermissionsProfile(d *schema.ResourceData, m interfac
if v, ok := d.GetOkExists("management.0.manage_integration_with_cloud_services"); ok {
managementPayload["manage-integration-with-cloud-services"] = v.(bool)
}
+ if v, ok := d.GetOkExists("management.0.limit_mgmt_api_commands"); ok {
+ managementPayload["limit-mgmt-api-commands"] = v.(bool)
+ }
+ if v, ok := d.GetOk("management.0.allowed_mgmt_api_commands"); ok {
+ managementPayload["allowed-mgmt-api-commands"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("management.0.blocked_mgmt_api_commands"); ok {
+ managementPayload["blocked-mgmt-api-commands"] = v.(*schema.Set).List()
+ }
domainPermissionsProfile["management"] = managementPayload
}
}
@@ -1116,6 +1146,15 @@ func readManagementDomainPermissionsProfile(d *schema.ResourceData, m interface{
if v, _ := managementMap["manage-integration-with-cloud-services"]; v != nil {
managementMapToReturn["manage_integration_with_cloud_services"] = v.(bool)
}
+ if v := managementMap["limit-mgmt-api-commands"]; v != nil {
+ managementMapToReturn["limit_mgmt_api_commands"] = v
+ }
+ if v := managementMap["allowed-mgmt-api-commands"]; v != nil {
+ managementMapToReturn["allowed_mgmt_api_commands"] = v
+ }
+ if v := managementMap["blocked-mgmt-api-commands"]; v != nil {
+ managementMapToReturn["blocked_mgmt_api_commands"] = v
+ }
_ = d.Set("management", []interface{}{managementMapToReturn})
} else {
@@ -1501,6 +1540,15 @@ func updateManagementDomainPermissionsProfile(d *schema.ResourceData, m interfac
if v, ok := d.GetOkExists("management.0.manage_integration_with_cloud_services"); ok {
managementPayload["manage-integration-with-cloud-services"] = v.(bool)
}
+ if v, ok := d.GetOkExists("management.0.limit_mgmt_api_commands"); ok {
+ managementPayload["limit-mgmt-api-commands"] = v.(bool)
+ }
+ if v, ok := d.GetOk("management.0.allowed_mgmt_api_commands"); ok {
+ managementPayload["allowed-mgmt-api-commands"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("management.0.blocked_mgmt_api_commands"); ok {
+ managementPayload["blocked-mgmt-api-commands"] = v.(*schema.Set).List()
+ }
domainPermissionsProfile["management"] = managementPayload
}
}
diff --git a/checkpoint/resource_checkpoint_management_if_map_server.go b/checkpoint/resource_checkpoint_management_if_map_server.go
index 67fef23c..7e6433bd 100644
--- a/checkpoint/resource_checkpoint_management_if_map_server.go
+++ b/checkpoint/resource_checkpoint_management_if_map_server.go
@@ -89,6 +89,7 @@ func resourceManagementIfMapServer() *schema.Resource {
"password": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "Username for the IF-MAP server authentication. Required only when 'authentication-method' is set to 'basic'.",
},
},
diff --git a/checkpoint/resource_checkpoint_management_interoperable_device.go b/checkpoint/resource_checkpoint_management_interoperable_device.go
index 42e35f4d..2fc68222 100644
--- a/checkpoint/resource_checkpoint_management_interoperable_device.go
+++ b/checkpoint/resource_checkpoint_management_interoperable_device.go
@@ -250,6 +250,11 @@ func resourceManagementInteroperableDevice() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "autonomous_system_number": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The Autonomous System Number (ASN) for this Interoperable Device object.",
+ },
},
}
}
@@ -396,6 +401,9 @@ func createManagementInteroperableDevice(d *schema.ResourceData, m interface{})
log.Println("Create InteroperableDevice - Map = ", interoperableDevice)
+ if v, ok := d.GetOk("autonomous_system_number"); ok {
+ interoperableDevice["autonomous-system-number"] = v.(string)
+ }
addInteroperableDeviceRes, err := client.ApiCall("add-interoperable-device", interoperableDevice, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !addInteroperableDeviceRes.Success {
if addInteroperableDeviceRes.ErrorMsg != "" {
@@ -633,6 +641,10 @@ func readManagementInteroperableDevice(d *schema.ResourceData, m interface{}) er
_ = d.Set("ignore_errors", v)
}
+ if v := interoperableDevice["autonomous-system-number"]; v != nil {
+ _ = d.Set("autonomous_system_number", v)
+ }
+
return nil
}
@@ -806,6 +818,9 @@ func updateManagementInteroperableDevice(d *schema.ResourceData, m interface{})
log.Println("Update InteroperableDevice - Map = ", interoperableDevice)
+ if ok := d.HasChange("autonomous_system_number"); ok {
+ interoperableDevice["autonomous-system-number"] = d.Get("autonomous_system_number")
+ }
updateInteroperableDeviceRes, err := client.ApiCall("set-interoperable-device", interoperableDevice, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !updateInteroperableDeviceRes.Success {
if updateInteroperableDeviceRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_log_exporter.go b/checkpoint/resource_checkpoint_management_log_exporter.go
index 9a0fa5a6..b04740c9 100644
--- a/checkpoint/resource_checkpoint_management_log_exporter.go
+++ b/checkpoint/resource_checkpoint_management_log_exporter.go
@@ -5,6 +5,7 @@ import (
checkpoint "github.com/CheckPointSW/cp-mgmt-api-go-sdk/APIFiles"
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
"log"
+ "strconv"
)
func resourceManagementLogExporter() *schema.Resource {
@@ -86,6 +87,16 @@ func resourceManagementLogExporter() *schema.Resource {
Optional: true,
Description: "Logs format.",
},
+ "add_custom_log_header": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Custom header added to every exported log entry.
This header can be used to identify the source or add metadata to logs.
The custom header is prepended",
+ },
+ "aggregation_mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Aggregation mode for aggregated logs.
Determines how log updates are processed when aggregate-log-updates is true or not specified:
- semi-unified (defa",
+ },
},
},
},
@@ -120,6 +131,213 @@ func resourceManagementLogExporter() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "advanced": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Advanced settings for log exporter.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "time_in_milliseconds": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Toggle export logs' time with ms resolution.",
+ },
+ },
+ },
+ },
+ "tls": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "TLS settings for log exporter.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "auto_generate_client_certificates": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "TLS mode where user provides server CA certificate only. Check Point Management automatically generates and signs client certificates. This is the sim...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "client_ca_cert": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Client generated CA certificate that signed the client certificate. The server should trust this CA. Supplied as base64 encoded string.",
+ },
+ "server_ca_cert": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Server certificate authority certificate, supplied as base64 encoded string.",
+ },
+ },
+ },
+ },
+ "client_cert_expiration_date": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Client certificate expiration date extracted from the stored PKCS#12 certificate. Available for all TLS modes when client certificate exists.",
+ },
+ "enabled": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to use encrypted connection. Can be true only when protocol is TCP.",
+ },
+ "generate_and_sign_client_csr": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Advanced TLS mode with two separate phases: 'auto-generate-client-csr' to initiate CSR generation (ADD/SET) and 'provide-signed-client-cert' to provid...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "client_cert": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Client certificate in PEM format as base64 encoded string, signed by external CA. Can only be provided when phase is 'provide-signed-client-cert'.",
+ },
+ "client_csr": {
+ Type: schema.TypeString,
+ Computed: true,
+ Description: "Client certificate signing request (CSR) in PEM format as base64 encoded string. Present when phase is 'auto-generate-client-csr'.",
+ },
+ "phase": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Mode phase type: 'auto-generate-client-csr' to initiate CSR generation.",
+ },
+ "server_ca_cert": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Server CA certificate in PEM format as base64 encoded string to validate the destination server's identity. Required when phase is 'auto-genera...",
+ },
+ },
+ },
+ },
+ "mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "TLS mode. Must match the specific mode configuration provided.",
+ },
+ "user_provided_certificates": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "TLS mode where user provides server CA certificate, client certificate (PKCS#12 format), and passphrase. All certificates provided by the user, Check ...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "client_cert": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Client certificate, supplied as base64 encoded string.",
+ },
+ "client_secret": {
+ Type: schema.TypeString,
+ Optional: true,
+ Sensitive: true,
+ Description: "Client secret for TLS connection.",
+ },
+ "server_ca_cert": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Server certificate authority certificate, supplied as base64 encoded string.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "filters": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Log exporter filters.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "expressions": {
+ Type: schema.TypeList,
+ Optional: true,
+ Description: "List of filter expressions. Each expression targets a specific log field.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "conditions": {
+ Type: schema.TypeList,
+ Optional: true,
+ Description: "Filter conditions for this field. Required when 'operator' is 'and' or 'or'.
Array of condition objects, each with 'operator' and 'value'.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "operator": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Comparison operator.",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The value to compare against.",
+ },
+ },
+ },
+ },
+ "field_name": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Log field name to filter on.",
+ },
+ "operator": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Operator for this expression.
Use 'and'/'or' with 'conditions' (array of condition objects).
Use 'in'/'not-in' with 'values' (flat array of stri...",
+ },
+ "values": {
+ Type: schema.TypeSet,
+ Computed: true,
+ Description: "Filter values for this field. Present when 'operator' is 'in' or 'not-in'.
Flat array of string values.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ },
+ },
+ "expressions_operator": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Logical operator for combining all filter expressions.",
+ },
+ "filter_out_connection_logs": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "When set to true, connection logs will be excluded from export.",
+ },
+ },
+ },
+ },
+ "fields": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Log exporter fields mapping settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "exclusion_list": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "List of field names to exclude or include based on the export mode.
When export is all-except: fields in this list are excluded from expor...",
+ },
+ "export": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Field export mode.
all-except (default): exports all fields except those in the exclusion list.
nothing-except: exports nothing ...",
+ },
+ "names_mapping": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Field name mappings to rename fields during export.
Specify mappings in the format: 'orgName:dstName' (e.g., 'src:source_ip,dst:destination_ip')....",
+ },
+ },
+ },
+ },
},
}
}
@@ -177,6 +395,12 @@ func createManagementLogExporter(d *schema.ResourceData, m interface{}) error {
res["format"] = v.(string)
}
+ if v, ok := d.GetOk("data_manipulation.0.add_custom_log_header"); ok {
+ res["add-custom-log-header"] = v.(string)
+ }
+ if v, ok := d.GetOk("data_manipulation.0.aggregation_mode"); ok {
+ res["aggregation-mode"] = v.(string)
+ }
logExporter["data-manipulation"] = res
}
@@ -202,6 +426,106 @@ func createManagementLogExporter(d *schema.ResourceData, m interface{}) error {
log.Println("Create LogExporter - Map = ", logExporter)
+ if _, ok := d.GetOk("tls"); ok {
+ tlsPayload := make(map[string]interface{})
+ if _, ok := d.GetOk("tls.0.auto_generate_client_certificates"); ok {
+ autoGenerateClientCertificatesPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("tls.0.auto_generate_client_certificates.0.server_ca_cert"); ok {
+ autoGenerateClientCertificatesPayload["server-ca-cert"] = v.(string)
+ }
+ tlsPayload["auto-generate-client-certificates"] = autoGenerateClientCertificatesPayload
+ }
+ if v, ok := d.GetOkExists("tls.0.enabled"); ok {
+ tlsPayload["enabled"] = v.(bool)
+ }
+ if _, ok := d.GetOk("tls.0.generate_and_sign_client_csr"); ok {
+ generateAndSignClientCsrPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("tls.0.generate_and_sign_client_csr.0.phase"); ok {
+ generateAndSignClientCsrPayload["phase"] = v.(string)
+ }
+ if v, ok := d.GetOk("tls.0.generate_and_sign_client_csr.0.server_ca_cert"); ok {
+ generateAndSignClientCsrPayload["server-ca-cert"] = v.(string)
+ }
+ tlsPayload["generate-and-sign-client-csr"] = generateAndSignClientCsrPayload
+ }
+ if v, ok := d.GetOk("tls.0.mode"); ok {
+ tlsPayload["mode"] = v.(string)
+ }
+ if _, ok := d.GetOk("tls.0.user_provided_certificates"); ok {
+ userProvidedCertificatesPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("tls.0.user_provided_certificates.0.client_cert"); ok {
+ userProvidedCertificatesPayload["client-cert"] = v.(string)
+ }
+ if v, ok := d.GetOk("tls.0.user_provided_certificates.0.client_secret"); ok {
+ userProvidedCertificatesPayload["client-secret"] = v.(string)
+ }
+ if v, ok := d.GetOk("tls.0.user_provided_certificates.0.server_ca_cert"); ok {
+ userProvidedCertificatesPayload["server-ca-cert"] = v.(string)
+ }
+ tlsPayload["user-provided-certificates"] = userProvidedCertificatesPayload
+ }
+ logExporter["tls"] = tlsPayload
+ }
+
+ if _, ok := d.GetOk("filters"); ok {
+ filtersPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("filters.0.expressions"); ok {
+ expressionsList := v.([]interface{})
+ if len(expressionsList) > 0 {
+ var expressionsPayload []map[string]interface{}
+ for i := range expressionsList {
+ expressionsItem := make(map[string]interface{})
+ if v, ok := d.GetOk("filters.0.expressions." + strconv.Itoa(i) + ".conditions"); ok {
+ conditionsList := v.([]interface{})
+ if len(conditionsList) > 0 {
+ var conditionsPayload []map[string]interface{}
+ for j := range conditionsList {
+ conditionsItem := make(map[string]interface{})
+ if v, ok := d.GetOk("filters.0.expressions." + strconv.Itoa(i) + ".conditions." + strconv.Itoa(j) + ".operator"); ok {
+ conditionsItem["operator"] = v.(string)
+ }
+ if v, ok := d.GetOk("filters.0.expressions." + strconv.Itoa(i) + ".conditions." + strconv.Itoa(j) + ".value"); ok {
+ conditionsItem["value"] = v.(string)
+ }
+ conditionsPayload = append(conditionsPayload, conditionsItem)
+ }
+ expressionsItem["conditions"] = conditionsPayload
+ }
+ }
+ if v, ok := d.GetOk("filters.0.expressions." + strconv.Itoa(i) + ".field_name"); ok {
+ expressionsItem["field-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("filters.0.expressions." + strconv.Itoa(i) + ".operator"); ok {
+ expressionsItem["operator"] = v.(string)
+ }
+ expressionsPayload = append(expressionsPayload, expressionsItem)
+ }
+ filtersPayload["expressions"] = expressionsPayload
+ }
+ }
+ if v, ok := d.GetOk("filters.0.expressions_operator"); ok {
+ filtersPayload["expressions-operator"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("filters.0.filter_out_connection_logs"); ok {
+ filtersPayload["filter-out-connection-logs"] = v.(bool)
+ }
+ logExporter["filters"] = filtersPayload
+ }
+
+ if _, ok := d.GetOk("fields"); ok {
+ fieldsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("fields.0.exclusion_list"); ok {
+ fieldsPayload["exclusion-list"] = v.(string)
+ }
+ if v, ok := d.GetOk("fields.0.export"); ok {
+ fieldsPayload["export"] = v.(string)
+ }
+ if v, ok := d.GetOk("fields.0.names_mapping"); ok {
+ fieldsPayload["names-mapping"] = v.(string)
+ }
+ logExporter["fields"] = fieldsPayload
+ }
+
addLogExporterRes, err := client.ApiCallSimple("add-log-exporter", logExporter)
if err != nil || !addLogExporterRes.Success {
if addLogExporterRes.ErrorMsg != "" {
@@ -293,6 +617,12 @@ func readManagementLogExporter(d *schema.ResourceData, m interface{}) error {
dataManipulationMapToReturn["format"] = v
}
+ if v := dataManipulationMap["add-custom-log-header"]; v != nil {
+ dataManipulationMapToReturn["add_custom_log_header"] = v
+ }
+ if v := dataManipulationMap["aggregation-mode"]; v != nil {
+ dataManipulationMapToReturn["aggregation_mode"] = v
+ }
_ = d.Set("data_manipulation", []interface{}{dataManipulationMapToReturn})
} else {
_ = d.Set("data_manipulation", nil)
@@ -330,6 +660,111 @@ func readManagementLogExporter(d *schema.ResourceData, m interface{}) error {
_ = d.Set("ignore_errors", v)
}
+ if v := logExporter["advanced"]; v != nil {
+ advancedJson := v.(map[string]interface{})
+ advancedState := make(map[string]interface{})
+ if v := advancedJson["time-in-milliseconds"]; v != nil {
+ advancedState["time_in_milliseconds"] = v
+ }
+ _ = d.Set("advanced", []interface{}{advancedState})
+ }
+
+ if v := logExporter["tls"]; v != nil {
+ tlsShow := v.(map[string]interface{})
+ tlsState := make(map[string]interface{})
+ if v := tlsShow["auto-generate-client-certificates"]; v != nil {
+ autoGenerateClientCertificatesShow := v.(map[string]interface{})
+ autoGenerateClientCertificatesState := make(map[string]interface{})
+ if v := autoGenerateClientCertificatesShow["client-ca-cert"]; v != nil {
+ autoGenerateClientCertificatesState["client_ca_cert"] = v
+ }
+ tlsState["auto_generate_client_certificates"] = []interface{}{autoGenerateClientCertificatesState}
+ }
+ if v := tlsShow["client-cert-expiration-date"]; v != nil {
+ tlsState["client_cert_expiration_date"] = v
+ }
+ if v := tlsShow["enabled"]; v != nil {
+ tlsState["enabled"] = v
+ }
+ if v := tlsShow["generate-and-sign-client-csr"]; v != nil {
+ generateAndSignClientCsrShow := v.(map[string]interface{})
+ generateAndSignClientCsrState := make(map[string]interface{})
+ if v := generateAndSignClientCsrShow["client-csr"]; v != nil {
+ generateAndSignClientCsrState["client_csr"] = v
+ }
+ if v := generateAndSignClientCsrShow["phase"]; v != nil {
+ generateAndSignClientCsrState["phase"] = v
+ }
+ tlsState["generate_and_sign_client_csr"] = []interface{}{generateAndSignClientCsrState}
+ }
+ if v := tlsShow["mode"]; v != nil {
+ tlsState["mode"] = v
+ }
+ _ = d.Set("tls", []interface{}{tlsState})
+ }
+
+ if v := logExporter["filters"]; v != nil {
+ filtersShow := v.(map[string]interface{})
+ filtersState := make(map[string]interface{})
+ if v := filtersShow["expressions"]; v != nil {
+ expressionsList := v.([]interface{})
+ var expressionsListState []map[string]interface{}
+ for i := range expressionsList {
+ expressionsShow := expressionsList[i].(map[string]interface{})
+ expressionsState := make(map[string]interface{})
+ if v := expressionsShow["conditions"]; v != nil {
+ conditionsList := v.([]interface{})
+ var conditionsListState []map[string]interface{}
+ for j := range conditionsList {
+ conditionsShow := conditionsList[j].(map[string]interface{})
+ conditionsState := make(map[string]interface{})
+ if v := conditionsShow["operator"]; v != nil {
+ conditionsState["operator"] = v
+ }
+ if v := conditionsShow["value"]; v != nil {
+ conditionsState["value"] = v
+ }
+ conditionsListState = append(conditionsListState, conditionsState)
+ }
+ expressionsState["conditions"] = conditionsListState
+ }
+ if v := expressionsShow["field-name"]; v != nil {
+ expressionsState["field_name"] = v
+ }
+ if v := expressionsShow["operator"]; v != nil {
+ expressionsState["operator"] = v
+ }
+ if v := expressionsShow["values"]; v != nil {
+ expressionsState["values"] = v
+ }
+ expressionsListState = append(expressionsListState, expressionsState)
+ }
+ filtersState["expressions"] = expressionsListState
+ }
+ if v := filtersShow["expressions-operator"]; v != nil {
+ filtersState["expressions_operator"] = v
+ }
+ if v := filtersShow["filter-out-connection-logs"]; v != nil {
+ filtersState["filter_out_connection_logs"] = v
+ }
+ _ = d.Set("filters", []interface{}{filtersState})
+ }
+
+ if v := logExporter["fields"]; v != nil {
+ fieldsShow := v.(map[string]interface{})
+ fieldsState := make(map[string]interface{})
+ if v := fieldsShow["exclusion-list"]; v != nil {
+ fieldsState["exclusion_list"] = v
+ }
+ if v := fieldsShow["export"]; v != nil {
+ fieldsState["export"] = v
+ }
+ if v := fieldsShow["names-mapping"]; v != nil {
+ fieldsState["names_mapping"] = v
+ }
+ _ = d.Set("fields", []interface{}{fieldsState})
+ }
+
return nil
}
@@ -399,6 +834,12 @@ func updateManagementLogExporter(d *schema.ResourceData, m interface{}) error {
res["format"] = v.(string)
}
+ if v, ok := d.GetOk("data_manipulation.0.add_custom_log_header"); ok {
+ res["add-custom-log-header"] = v.(string)
+ }
+ if v, ok := d.GetOk("data_manipulation.0.aggregation_mode"); ok {
+ res["aggregation-mode"] = v.(string)
+ }
logExporter["data-manipulation"] = res
}
}
@@ -427,6 +868,115 @@ func updateManagementLogExporter(d *schema.ResourceData, m interface{}) error {
log.Println("Update LogExporter - Map = ", logExporter)
+ if ok := d.HasChange("tls"); ok {
+ if _, ok := d.GetOk("tls"); ok {
+ tlsPayload := make(map[string]interface{})
+ if _, ok := d.GetOk("tls.0.auto_generate_client_certificates"); ok {
+ autoGenerateClientCertificatesPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("tls.0.auto_generate_client_certificates.0.server_ca_cert"); ok {
+ autoGenerateClientCertificatesPayload["server-ca-cert"] = v.(string)
+ }
+ tlsPayload["auto-generate-client-certificates"] = autoGenerateClientCertificatesPayload
+ }
+ if v, ok := d.GetOkExists("tls.0.enabled"); ok {
+ tlsPayload["enabled"] = v.(bool)
+ }
+ if _, ok := d.GetOk("tls.0.generate_and_sign_client_csr"); ok {
+ generateAndSignClientCsrPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("tls.0.generate_and_sign_client_csr.0.client_cert"); ok {
+ generateAndSignClientCsrPayload["client-cert"] = v.(string)
+ }
+ if v, ok := d.GetOk("tls.0.generate_and_sign_client_csr.0.phase"); ok {
+ generateAndSignClientCsrPayload["phase"] = v.(string)
+ }
+ if v, ok := d.GetOk("tls.0.generate_and_sign_client_csr.0.server_ca_cert"); ok {
+ generateAndSignClientCsrPayload["server-ca-cert"] = v.(string)
+ }
+ tlsPayload["generate-and-sign-client-csr"] = generateAndSignClientCsrPayload
+ }
+ if v, ok := d.GetOk("tls.0.mode"); ok {
+ tlsPayload["mode"] = v.(string)
+ }
+ if _, ok := d.GetOk("tls.0.user_provided_certificates"); ok {
+ userProvidedCertificatesPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("tls.0.user_provided_certificates.0.client_cert"); ok {
+ userProvidedCertificatesPayload["client-cert"] = v.(string)
+ }
+ if v, ok := d.GetOk("tls.0.user_provided_certificates.0.client_secret"); ok {
+ userProvidedCertificatesPayload["client-secret"] = v.(string)
+ }
+ if v, ok := d.GetOk("tls.0.user_provided_certificates.0.server_ca_cert"); ok {
+ userProvidedCertificatesPayload["server-ca-cert"] = v.(string)
+ }
+ tlsPayload["user-provided-certificates"] = userProvidedCertificatesPayload
+ }
+ logExporter["tls"] = tlsPayload
+ }
+ }
+
+ if ok := d.HasChange("filters"); ok {
+ if _, ok := d.GetOk("filters"); ok {
+ filtersPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("filters.0.expressions"); ok {
+ expressionsList := v.([]interface{})
+ if len(expressionsList) > 0 {
+ var expressionsPayload []map[string]interface{}
+ for i := range expressionsList {
+ expressionsItem := make(map[string]interface{})
+ if v, ok := d.GetOk("filters.0.expressions." + strconv.Itoa(i) + ".conditions"); ok {
+ conditionsList := v.([]interface{})
+ if len(conditionsList) > 0 {
+ var conditionsPayload []map[string]interface{}
+ for j := range conditionsList {
+ conditionsItem := make(map[string]interface{})
+ if v, ok := d.GetOk("filters.0.expressions." + strconv.Itoa(i) + ".conditions." + strconv.Itoa(j) + ".operator"); ok {
+ conditionsItem["operator"] = v.(string)
+ }
+ if v, ok := d.GetOk("filters.0.expressions." + strconv.Itoa(i) + ".conditions." + strconv.Itoa(j) + ".value"); ok {
+ conditionsItem["value"] = v.(string)
+ }
+ conditionsPayload = append(conditionsPayload, conditionsItem)
+ }
+ expressionsItem["conditions"] = conditionsPayload
+ }
+ }
+ if v, ok := d.GetOk("filters.0.expressions." + strconv.Itoa(i) + ".field_name"); ok {
+ expressionsItem["field-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("filters.0.expressions." + strconv.Itoa(i) + ".operator"); ok {
+ expressionsItem["operator"] = v.(string)
+ }
+ expressionsPayload = append(expressionsPayload, expressionsItem)
+ }
+ filtersPayload["expressions"] = expressionsPayload
+ }
+ }
+ if v, ok := d.GetOk("filters.0.expressions_operator"); ok {
+ filtersPayload["expressions-operator"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("filters.0.filter_out_connection_logs"); ok {
+ filtersPayload["filter-out-connection-logs"] = v.(bool)
+ }
+ logExporter["filters"] = filtersPayload
+ }
+ }
+
+ if ok := d.HasChange("fields"); ok {
+ if _, ok := d.GetOk("fields"); ok {
+ fieldsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("fields.0.exclusion_list"); ok {
+ fieldsPayload["exclusion-list"] = v.(string)
+ }
+ if v, ok := d.GetOk("fields.0.export"); ok {
+ fieldsPayload["export"] = v.(string)
+ }
+ if v, ok := d.GetOk("fields.0.names_mapping"); ok {
+ fieldsPayload["names-mapping"] = v.(string)
+ }
+ logExporter["fields"] = fieldsPayload
+ }
+ }
+
updateLogExporterRes, err := client.ApiCallSimple("set-log-exporter", logExporter)
if err != nil || !updateLogExporterRes.Success {
if updateLogExporterRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_md_permissions_profile.go b/checkpoint/resource_checkpoint_management_md_permissions_profile.go
index 55d900d6..17702c50 100644
--- a/checkpoint/resource_checkpoint_management_md_permissions_profile.go
+++ b/checkpoint/resource_checkpoint_management_md_permissions_profile.go
@@ -130,6 +130,27 @@ func resourceManagementMdPermissionsProfile() *schema.Resource {
Description: "The level of the Multi Domain Permissions Profile.
The level cannot be changed after creation.",
Default: "manager",
},
+ "limit_mgmt_api_commands": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable limitation of Management API commands the profile may or may not run.",
+ },
+ "allowed_mgmt_api_commands": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "List of allowed Management API commands the profile can run. All available commands can be viewed using show-commands Management API.
...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -221,6 +242,16 @@ func createManagementMdPermissionsProfile(d *schema.ResourceData, m interface{})
log.Println("Create MdPermissionsProfile - Map = ", mdPermissionsProfile)
+ if v, ok := d.GetOkExists("limit_mgmt_api_commands"); ok {
+ mdPermissionsProfile["limit-mgmt-api-commands"] = v.(bool)
+ }
+ if v, ok := d.GetOk("allowed_mgmt_api_commands"); ok {
+ mdPermissionsProfile["allowed-mgmt-api-commands"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("blocked_mgmt_api_commands"); ok {
+ mdPermissionsProfile["blocked-mgmt-api-commands"] = v.(*schema.Set).List()
+ }
+
addMdPermissionsProfileRes, err := client.ApiCall("add-md-permissions-profile", mdPermissionsProfile, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !addMdPermissionsProfileRes.Success {
if addMdPermissionsProfileRes.ErrorMsg != "" {
@@ -362,6 +393,17 @@ func readManagementMdPermissionsProfile(d *schema.ResourceData, m interface{}) e
_ = d.Set("permission_level", v)
}
+ if v := mdPermissionsProfile["limit-mgmt-api-commands"]; v != nil {
+ _ = d.Set("limit_mgmt_api_commands", v)
+ }
+
+ if v := mdPermissionsProfile["allowed-mgmt-api-commands"]; v != nil {
+ _ = d.Set("allowed_mgmt_api_commands", v)
+ }
+ if v := mdPermissionsProfile["blocked-mgmt-api-commands"]; v != nil {
+ _ = d.Set("blocked_mgmt_api_commands", v)
+ }
+
return nil
}
@@ -467,6 +509,20 @@ func updateManagementMdPermissionsProfile(d *schema.ResourceData, m interface{})
log.Println("Update MdPermissionsProfile - Map = ", mdPermissionsProfile)
+ if ok := d.HasChange("limit_mgmt_api_commands"); ok {
+ mdPermissionsProfile["limit-mgmt-api-commands"] = d.Get("limit_mgmt_api_commands")
+ }
+ if ok := d.HasChange("allowed_mgmt_api_commands"); ok {
+ if v, ok := d.GetOk("allowed_mgmt_api_commands"); ok {
+ mdPermissionsProfile["allowed-mgmt-api-commands"] = v.(*schema.Set).List()
+ }
+ }
+ if ok := d.HasChange("blocked_mgmt_api_commands"); ok {
+ if v, ok := d.GetOk("blocked_mgmt_api_commands"); ok {
+ mdPermissionsProfile["blocked-mgmt-api-commands"] = v.(*schema.Set).List()
+ }
+ }
+
updateMdPermissionsProfileRes, err := client.ApiCall("set-md-permissions-profile", mdPermissionsProfile, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !updateMdPermissionsProfileRes.Success {
if updateMdPermissionsProfileRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_network_feed.go b/checkpoint/resource_checkpoint_management_network_feed.go
index da50d664..45ac6bf3 100644
--- a/checkpoint/resource_checkpoint_management_network_feed.go
+++ b/checkpoint/resource_checkpoint_management_network_feed.go
@@ -209,7 +209,7 @@ func createManagementNetworkFeed(d *schema.ResourceData, m interface{}) error {
}
customHeaderPayload = append(customHeaderPayload, Payload)
}
- networkFeed["customHeader"] = customHeaderPayload
+ networkFeed["custom-header"] = customHeaderPayload
}
}
diff --git a/checkpoint/resource_checkpoint_management_outbound_inspection_certificate.go b/checkpoint/resource_checkpoint_management_outbound_inspection_certificate.go
index 5acea184..b0e18f8f 100644
--- a/checkpoint/resource_checkpoint_management_outbound_inspection_certificate.go
+++ b/checkpoint/resource_checkpoint_management_outbound_inspection_certificate.go
@@ -27,6 +27,7 @@ func resourceManagementOutboundInspectionCertificate() *schema.Resource {
"base64_password": {
Type: schema.TypeString,
Required: true,
+ Sensitive: true,
Description: "Password (encoded in Base64 with padding) for the certificate file.",
},
"base64_certificate": {
@@ -85,6 +86,11 @@ func resourceManagementOutboundInspectionCertificate() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "public_key_algorithm": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Public key algorithm and size of the outbound certificate.",
+ },
},
}
}
@@ -140,6 +146,9 @@ func createManagementOutboundInspectionCertificate(d *schema.ResourceData, m int
log.Println("Create OutboundInspectionCertificate - Map = ", outboundInspectionCertificate)
+ if v, ok := d.GetOk("public_key_algorithm"); ok {
+ outboundInspectionCertificate["public-key-algorithm"] = v.(string)
+ }
addOutboundInspectionCertificateRes, err := client.ApiCall("add-outbound-inspection-certificate", outboundInspectionCertificate, client.GetSessionID(), true, false)
if err != nil || !addOutboundInspectionCertificateRes.Success {
if addOutboundInspectionCertificateRes.ErrorMsg != "" {
@@ -245,6 +254,10 @@ func readManagementOutboundInspectionCertificate(d *schema.ResourceData, m inter
_ = d.Set("ignore_errors", v)
}
+ if v := outboundInspectionCertificate["public-key-algorithm"]; v != nil {
+ _ = d.Set("public_key_algorithm", v)
+ }
+
return nil
}
@@ -309,6 +322,9 @@ func updateManagementOutboundInspectionCertificate(d *schema.ResourceData, m int
log.Println("Update OutboundInspectionCertificate - Map = ", outboundInspectionCertificate)
+ if ok := d.HasChange("public_key_algorithm"); ok {
+ outboundInspectionCertificate["public-key-algorithm"] = d.Get("public_key_algorithm")
+ }
updateOutboundInspectionCertificateRes, err := client.ApiCall("set-outbound-inspection-certificate", outboundInspectionCertificate, client.GetSessionID(), true, false)
if err != nil || !updateOutboundInspectionCertificateRes.Success {
if updateOutboundInspectionCertificateRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_requirement.go b/checkpoint/resource_checkpoint_management_requirement.go
index ba326b73..d217d0ba 100644
--- a/checkpoint/resource_checkpoint_management_requirement.go
+++ b/checkpoint/resource_checkpoint_management_requirement.go
@@ -63,6 +63,16 @@ func resourceManagementRequirement() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "new_regulation_uid": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The new regulation UID for this requirement.",
+ },
+ "regulation_uid": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The relevant regulation UID for this requirement.",
+ },
},
}
}
@@ -106,6 +116,10 @@ func createManagementRequirement(d *schema.ResourceData, m interface{}) error {
log.Println("Create Requirement - Map = ", requirement)
+ if v, ok := d.GetOk("regulation_uid"); ok {
+ requirement["regulation-uid"] = v.(string)
+ }
+
addRequirementRes, err := client.ApiCall("add-requirement", requirement, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !addRequirementRes.Success {
if addRequirementRes.ErrorMsg != "" {
@@ -254,6 +268,12 @@ func updateManagementRequirement(d *schema.ResourceData, m interface{}) error {
log.Println("Update Requirement - Map = ", requirement)
+ if ok := d.HasChange("new_regulation_uid"); ok {
+ if v, ok := d.GetOk("new_regulation_uid"); ok {
+ requirement["new-regulation-uid"] = v.(string)
+ }
+ }
+
updateRequirementRes, err := client.ApiCall("set-requirement", requirement, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !updateRequirementRes.Success {
if updateRequirementRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_service_other.go b/checkpoint/resource_checkpoint_management_service_other.go
index 02c26d57..3bcd48e5 100644
--- a/checkpoint/resource_checkpoint_management_service_other.go
+++ b/checkpoint/resource_checkpoint_management_service_other.go
@@ -149,6 +149,11 @@ func resourceManagementServiceOther() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "protocol": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Protocol name or uid. The protocol type associated with the service, and by implication, the management server (if any) that enforces Content Security and Authe",
+ },
},
}
}
@@ -248,6 +253,9 @@ func createManagementServiceOther(d *schema.ResourceData, m interface{}) error {
log.Println("Create ServiceOther - Map = ", serviceOther)
+ if v, ok := d.GetOk("protocol"); ok {
+ serviceOther["protocol"] = v.(string)
+ }
addServiceOtherRes, err := client.ApiCall("add-service-other", serviceOther, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !addServiceOtherRes.Success {
if addServiceOtherRes.ErrorMsg != "" {
@@ -386,6 +394,10 @@ func readManagementServiceOther(d *schema.ResourceData, m interface{}) error {
_ = d.Set("ignore_errors", v)
}
+ if v := serviceOther["protocol"]; v != nil {
+ _ = d.Set("protocol", v)
+ }
+
return nil
}
@@ -497,6 +509,9 @@ func updateManagementServiceOther(d *schema.ResourceData, m interface{}) error {
log.Println("Update ServiceOther - Map = ", serviceOther)
+ if ok := d.HasChange("protocol"); ok {
+ serviceOther["protocol"] = d.Get("protocol")
+ }
updateServiceOtherRes, err := client.ApiCall("set-service-other", serviceOther, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !updateServiceOtherRes.Success {
if updateServiceOtherRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_service_tcp.go b/checkpoint/resource_checkpoint_management_service_tcp.go
index cbfca626..e04e2c20 100644
--- a/checkpoint/resource_checkpoint_management_service_tcp.go
+++ b/checkpoint/resource_checkpoint_management_service_tcp.go
@@ -147,6 +147,21 @@ func resourceManagementServiceTcp() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "delayed_sync_value": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Specify the delay (in seconds) in which a synchronization will start after connection initiation.",
+ },
+ "enable_tcp_resource": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable for tcp resource.",
+ },
+ "use_delayed_sync": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable this option to delay notifying the Security Gateway about a connection, so that the connection will only be synchronized if it still exists x seconds aft",
+ },
},
}
}
@@ -233,6 +248,15 @@ func createManagementServiceTcp(d *schema.ResourceData, m interface{}) error {
log.Println("Create Service Tcp - Map = ", serviceTcp)
+ if v, ok := d.GetOk("delayed_sync_value"); ok {
+ serviceTcp["delayed-sync-value"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("enable_tcp_resource"); ok {
+ serviceTcp["enable-tcp-resource"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("use_delayed_sync"); ok {
+ serviceTcp["use-delayed-sync"] = v.(bool)
+ }
addServiceTcpRes, err := client.ApiCall("add-service-tcp", serviceTcp, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !addServiceTcpRes.Success {
if addServiceTcpRes.ErrorMsg != "" {
@@ -361,6 +385,18 @@ func readManagementServiceTcp(d *schema.ResourceData, m interface{}) error {
_ = d.Set("tags", nil)
}
+ if v := serviceTcp["delayed-sync-value"]; v != nil {
+ _ = d.Set("delayed_sync_value", v)
+ }
+
+ if v := serviceTcp["enable-tcp-resource"]; v != nil {
+ _ = d.Set("enable_tcp_resource", v)
+ }
+
+ if v := serviceTcp["use-delayed-sync"]; v != nil {
+ _ = d.Set("use_delayed_sync", v)
+ }
+
return nil
}
@@ -499,6 +535,15 @@ func updateManagementServiceTcp(d *schema.ResourceData, m interface{}) error {
log.Println("Update Service Tcp - Map = ", serviceTcp)
if len(serviceTcp) != 3 {
+ if ok := d.HasChange("delayed_sync_value"); ok {
+ serviceTcp["delayed-sync-value"] = d.Get("delayed_sync_value")
+ }
+ if ok := d.HasChange("enable_tcp_resource"); ok {
+ serviceTcp["enable-tcp-resource"] = d.Get("enable_tcp_resource")
+ }
+ if ok := d.HasChange("use_delayed_sync"); ok {
+ serviceTcp["use-delayed-sync"] = d.Get("use_delayed_sync")
+ }
setServiceTcpRes, err := client.ApiCall("set-service-tcp", serviceTcp, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil {
fmt.Errorf("%s", err.Error())
diff --git a/checkpoint/resource_checkpoint_management_simple_cluster.go b/checkpoint/resource_checkpoint_management_simple_cluster.go
index 679556b9..41856632 100644
--- a/checkpoint/resource_checkpoint_management_simple_cluster.go
+++ b/checkpoint/resource_checkpoint_management_simple_cluster.go
@@ -254,6 +254,66 @@ func resourceManagementSimpleCluster() *schema.Resource {
},
},
},
+ "bypass_on_client_failure": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Bypass HTTPS inspection on client failure.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to bypass on client failure.",
+ },
+ },
+ },
+ },
+ "bypass_under_load": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Bypass HTTPS inspection under load.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "value": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to bypass under load.",
+ },
+ },
+ },
+ },
+ "outbound_certificate": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Outbound HTTPS inspection certificate.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Outbound certificate identified by the name or UID.",
+ },
+ },
+ },
+ },
+ "deployment_mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "HTTPS inspection deployment mode.",
+ },
},
},
},
@@ -269,6 +329,135 @@ func resourceManagementSimpleCluster() *schema.Resource {
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "identity_web_api": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable Identity Web API source.",
+ },
+ "identity_web_api_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Identity Web API settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "authentication_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Authentication Settings for Identity Web Api.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "users_directories": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Users directories.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "specific": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "LDAP AU objects identified by the name or UID. Must be set when 'users-from-external-directories' was selected to be 'specific'.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "external_user_profile": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "External user profile.",
+ },
+ "internal_users": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Internal users.",
+ },
+ "users_from_external_directories": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Users from external directories.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "authorized_clients": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Authorized Clients.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "client": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Host / Network Group Name or UID.",
+ },
+ "client_secret": {
+ Type: schema.TypeString,
+ Optional: true,
+ Sensitive: true,
+ Description: "Client Secret.",
+ },
+ },
+ },
+ },
+ "client_access_permissions": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Identity Web Api accessibility settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "accessibility": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Configuration of the portal access settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "allow_access_from": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Allowed access to the web portal (based on interfaces, or security policy).",
+ },
+ "internal_access_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Configuration of the additional portal access settings for internal interfaces only.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "dmz": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to 'DMZ'.",
+ },
+ "undefined": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to 'Undefined'.",
+ },
+ "vpn": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Controls portal access settings for interfaces that are part of a VPN Encryption Domain.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
"browser_based_authentication": {
Type: schema.TypeBool,
Optional: true,
@@ -373,6 +562,11 @@ func resourceManagementSimpleCluster() *schema.Resource {
Optional: true,
Description: "The main URL for the web portal.",
},
+ "ip_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
},
},
},
@@ -391,6 +585,7 @@ func resourceManagementSimpleCluster() *schema.Resource {
"base64_password": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "Password (encoded in Base64 with padding) for the certificate file.",
},
},
@@ -602,6 +797,7 @@ func resourceManagementSimpleCluster() *schema.Resource {
"client_secret": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "Client Secret.",
},
},
@@ -731,6 +927,56 @@ func resourceManagementSimpleCluster() *schema.Resource {
Type: schema.TypeString,
},
},
+ "cache_mode": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Identity cache mode.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether the identity cache is enabled.",
+ },
+ },
+ },
+ },
+ "cache_mode_duration": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Identity cache mode duration.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Identity cache duration in minutes.",
+ },
+ },
+ },
+ },
+ "receive_from_infinity_identity": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to receive identities from Infinity Identity.",
+ },
+ "scaled_sharing": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether scaled identity sharing is enabled.",
+ },
},
},
},
@@ -755,6 +1001,11 @@ func resourceManagementSimpleCluster() *schema.Resource {
Optional: true,
Description: "Enable Remote Access Identity source.",
},
+ "identity_based_enforcement": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "ON: Configures this object as a PEP-only object - identity-based enforcement (PEP) is enabled.
OFF: Configures this object as a PDP-only object - identity-ba",
+ },
},
},
},
@@ -806,6 +1057,11 @@ func resourceManagementSimpleCluster() *schema.Resource {
Optional: true,
Description: "NAT translation method.",
},
+ "apply_control_connections": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "This option performs NAT on VPN control connections to and from this object.",
+ },
},
},
},
@@ -836,6 +1092,11 @@ func resourceManagementSimpleCluster() *schema.Resource {
Optional: true,
Description: "The main URL for the web portal.",
},
+ "ip_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
},
},
},
@@ -854,6 +1115,7 @@ func resourceManagementSimpleCluster() *schema.Resource {
"base64_password": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "Password (encoded in Base64 with padding) for the certificate file.",
},
},
@@ -966,6 +1228,11 @@ func resourceManagementSimpleCluster() *schema.Resource {
Optional: true,
Description: "The main URL for the web portal.",
},
+ "ip_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
},
},
},
@@ -984,6 +1251,7 @@ func resourceManagementSimpleCluster() *schema.Resource {
"base64_password": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "Password (encoded in Base64 with padding) for the certificate file.",
},
},
@@ -1041,6 +1309,7 @@ func resourceManagementSimpleCluster() *schema.Resource {
Type: schema.TypeString,
Optional: true,
Description: "Zero Phishing gateway FQDN.",
+ Deprecated: "use zero_phishing_settings.manual_fqdn instead - the API replaced zero-phishing-fqdn with zero-phishing-settings",
},
"interfaces": {
Type: schema.TypeList,
@@ -1048,6 +1317,11 @@ func resourceManagementSimpleCluster() *schema.Resource {
Description: "Network interfaces.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "dynamic_ip": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "The Topology of interface with Dynamic IP is set to Automatic - External.",
+ },
"name": {
Type: schema.TypeString,
Required: true,
@@ -1101,6 +1375,26 @@ func resourceManagementSimpleCluster() *schema.Resource {
Description: "Anti spoofing settings",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "exclude_packets": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Don't check packets from excluded network.",
+ },
+ "excluded_network_name": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Excluded network name.",
+ },
+ "excluded_network_uid": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Excluded network UID.",
+ },
+ "spoof_tracking": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Spoof tracking.",
+ },
"action": {
Type: schema.TypeString,
Optional: true,
@@ -1201,6 +1495,16 @@ func resourceManagementSimpleCluster() *schema.Resource {
Description: "Cluster members.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "auto_generate_ip": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Use an automatically generated IP address for the Gateway object (applies only to Smart-1 Cloud).",
+ },
+ "trust_method": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Trust method to use for establishing communication.",
+ },
"name": {
Type: schema.TypeString,
Required: true,
@@ -1214,6 +1518,7 @@ func resourceManagementSimpleCluster() *schema.Resource {
"one_time_password": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "SIC one time password.",
},
"priority": {
@@ -1237,21 +1542,116 @@ func resourceManagementSimpleCluster() *schema.Resource {
Description: "Network interfaces.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "name": {
- Type: schema.TypeString,
- Required: true,
- Description: "Object name. Should be unique in the domain.",
- },
- "ipv4_address": {
- Type: schema.TypeString,
- Optional: true,
- Description: "IPv4 address.",
- },
- "ipv6_address": {
- Type: schema.TypeString,
+ "anti_spoofing_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
Optional: true,
- Description: "IPv6 address.",
- },
+ Description: "N/A",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "action": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "If packets will be rejected (the Prevent option) or whether the packets will be monitored (the Detect option).",
+ },
+ "exclude_packets": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Don't check packets from excluded network.",
+ },
+ "excluded_network_name": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Excluded network name.",
+ },
+ "excluded_network_uid": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Excluded network UID.",
+ },
+ "spoof_tracking": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Spoof tracking.",
+ },
+ },
+ },
+ },
+ "security_zone_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "N/A",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "auto_calculated": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Security Zone is calculated according to where the interface leads to.",
+ },
+ },
+ },
+ },
+ "topology_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "N/A",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "interface_leads_to_dmz": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether this interface leads to demilitarized zone (perimeter network).",
+ },
+ "ip_address_behind_this_interface": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Network settings behind this interface.",
+ },
+ "specific_network": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Network behind this interface.",
+ },
+ },
+ },
+ },
+ "anti_spoofing": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "N/A",
+ },
+ "dynamic_ip": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "The Topology of interface with Dynamic IP is set to Automatic - External.",
+ },
+ "security_zone": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "N/A",
+ },
+ "topology": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "N/A",
+ },
+ "name": {
+ Type: schema.TypeString,
+ Required: true,
+ Description: "Object name. Should be unique in the domain.",
+ },
+ "ipv4_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "IPv4 address.",
+ },
+ "ipv6_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "IPv6 address.",
+ },
"ipv4_network_mask": {
Type: schema.TypeString,
Optional: true,
@@ -1510,205 +1910,193 @@ func resourceManagementSimpleCluster() *schema.Resource {
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "authentication": {
+ "interfaces": {
Type: schema.TypeList,
- MaxItems: 1,
Optional: true,
- Description: "Authentication.",
+ Description: "Enhanced Link Selection Interfaces.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "authentication_clients": {
- Type: schema.TypeSet,
+ "interface_name": {
+ Type: schema.TypeString,
Optional: true,
- Description: "Collection of VPN Authentication clients identified by the name or UID.",
- Elem: &schema.Schema{
- Type: schema.TypeString,
- },
+ Description: "The name of the interface.",
},
- },
- },
- },
- "link_selection": {
- Type: schema.TypeList,
- MaxItems: 1,
- Optional: true,
- Description: "Link Selection.",
- Elem: &schema.Resource{
- Schema: map[string]*schema.Schema{
- "ip_selection": {
+ "ip_version": {
Type: schema.TypeString,
Optional: true,
- Description: "IP selection",
- Default: "use-main-address",
+ Description: "The IP version of the interface's IP address (IPv4/IPv6).",
},
- "dns_resolving_hostname": {
+ "next_hop_ip": {
Type: schema.TypeString,
Optional: true,
- Description: "DNS Resolving Hostname. Must be set when \"ip-selection\" was selected to be \"dns-resolving-from-hostname\".",
+ Description: "The IP address of the next hop.",
},
- "ip_address": {
+ "priority": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Priority of a 'Backup' interface.",
+ },
+ "redundancy_mode": {
Type: schema.TypeString,
Optional: true,
- Description: "IP Address. Must be set when \"ip-selection\" was selected to be \"use-selected-address-from-topology\" or \"use-statically-nated-ip\"",
+ Description: "Interface redundancy mode (Active/Backup).",
+ },
+ "static_nat_ip": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The NATed IPv4 address that hides the source IPv4 address of outgoing connections (applies only to IPv4).",
},
},
},
},
- "maximum_concurrent_ike_negotiations": {
- Type: schema.TypeInt,
- Optional: true,
- Description: "Maximum concurrent ike negotiations",
- },
- "maximum_concurrent_tunnels": {
- Type: schema.TypeInt,
- Optional: true,
- Description: "Maximum concurrent tunnels",
- },
- "office_mode": {
+ "authentication": {
Type: schema.TypeList,
+ MaxItems: 1,
Optional: true,
- Description: "Office Mode. Notation Wide Impact - Office Mode apply IPSec VPN Software Blade clients and to the Mobile Access Software Blade clients.",
+ Description: "Authentication.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "mode": {
- Type: schema.TypeString,
- Optional: true,
- Description: "Office Mode Permissions. When selected to be \"off\", all the other definitions are irrelevant.",
- Default: "off",
- },
- "group": {
- Type: schema.TypeString,
+ "authentication_clients": {
+ Type: schema.TypeSet,
Optional: true,
- Description: "Group. Identified by name or UID. Must be set when \"office-mode-permissions\" was selected to be \"group\".",
+ Description: "Collection of VPN Authentication clients identified by the name or UID.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
},
- "allocate_ip_address_from": {
+ "single_authentication_client": {
Type: schema.TypeList,
MaxItems: 1,
Optional: true,
- Description: "Allocate IP address Method. Allocate IP address by sequentially trying the given methods until success.",
+ Description: "Settings for clients that support only single authentication method.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "radius_server": {
+ "enabled": {
Type: schema.TypeBool,
Optional: true,
- Description: "Radius server used to authenticate the user.",
- Default: false,
+ Description: "Allow clients that support only single authentication method.",
+ Default: true,
},
- "use_allocate_method": {
+ "allow_multiple_authentication_clients": {
Type: schema.TypeBool,
Optional: true,
- Description: "Use Allocate Method.",
+ Description: "Allow clients that support multiple authentication methods to connect.",
Default: true,
},
- "allocate_method": {
- Type: schema.TypeString,
- Optional: true,
- Description: "Using either Manual (IP Pool) or Automatic (DHCP). Must be set when \"use-allocate-method\" is true.",
- Default: "manual",
- },
- "manual_network": {
- Type: schema.TypeString,
- Optional: true,
- Description: "Manual Network. Identified by name or UID. Must be set when \"allocate-method\" was selected to be \"manual\".",
- },
- "dhcp_server": {
- Type: schema.TypeString,
- Optional: true,
- Description: "DHCP Server. Identified by name or UID. Must be set when \"allocate-method\" was selected to be \"automatic\".",
- },
- "virtual_ip_address": {
+ "display_name": {
Type: schema.TypeString,
Optional: true,
- Description: "Virtual IPV4 address for DHCP server replies. Must be set when \"allocate-method\" was selected to be \"automatic\".",
+ Description: "Display name for the authentication method.",
+ Default: "standard",
},
- "dhcp_mac_address": {
+ "method": {
Type: schema.TypeString,
Optional: true,
- Description: "Calculated MAC address for DHCP allocation. Must be set when \"allocate-method\" was selected to be \"automatic\".",
- Default: "per-machine",
+ Description: "Authentication method type.",
+ Default: "defined-on-user-record",
},
- "optional_parameters": {
+ "secur_id": {
Type: schema.TypeList,
MaxItems: 1,
Optional: true,
- Description: "This configuration applies to all Office Mode methods except Automatic (using DHCP) and ipassignment.conf entries which contain this data.",
+ Description: "SecurID authentication settings, relevant only when method is \"secur-id\".",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "use_primary_dns_server": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Use Primary DNS Server.",
- Default: false,
- },
- "primary_dns_server": {
+ "server": {
Type: schema.TypeString,
Optional: true,
- Description: "Primary DNS Server. Identified by name or UID. Must be set when \"use-primary-dns-server\" is true and can not be set when \"use-primary-dns-server\" is false.",
+ Description: "Server object identified by the name or UID.",
},
- "use_first_backup_dns_server": {
- Type: schema.TypeBool,
+ "token_card_type": {
+ Type: schema.TypeString,
Optional: true,
- Description: "Use First Backup DNS Server.",
- Default: false,
+ Description: "Token card type.",
+ Default: "any",
},
- "first_backup_dns_server": {
+ },
+ },
+ },
+ "radius": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "RADIUS authentication settings, relevant only when method is \"radius\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "server": {
Type: schema.TypeString,
Optional: true,
- Description: "First Backup DNS Server. Identified by name or UID. Must be set when \"use-first-backup-dns-server\" is true and can not be set when \"use-first-backup-dns-server\" is false.",
+ Description: "Server object identified by the name or UID.",
},
- "use_second_backup_dns_server": {
+ "ask_user_password": {
Type: schema.TypeBool,
Optional: true,
- Description: "Use Second Backup DNS Server.",
+ Description: "Ask user for password during authentication.",
Default: false,
},
- "second_backup_dns_server": {
+ },
+ },
+ },
+ "personal_certificate": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Personal certificate authentication settings, relevant only when method is \"personal-certificate\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "fetch_username_from": {
Type: schema.TypeString,
Optional: true,
- Description: "Second Backup DNS Server. Identified by name or UID. Must be set when \"use-second-backup-dns-server\" is true and can not be set when \"use-second-backup-dns-server\" is false.",
+ Description: "Fetch username from.",
+ Default: "subject-dn",
},
- "dns_suffixes": {
+ "storage_type": {
Type: schema.TypeString,
Optional: true,
- Description: "DNS Suffixes.",
+ Description: "Certificate storage type.",
+ Default: "any",
},
- "use_primary_wins_server": {
- Type: schema.TypeBool,
+ "source": {
+ Type: schema.TypeString,
Optional: true,
- Description: "Use Primary WINS Server.",
- Default: false,
+ Description: "Certificate source field.",
+ Default: "subject",
},
- "primary_wins_server": {
+ "dn_part": {
Type: schema.TypeString,
Optional: true,
- Description: "Primary WINS Server. Identified by name or UID. Must be set when \"use-primary-wins-server\" is true and can not be set when \"use-primary-wins-server\" is false.",
+ Description: "DN part to extract.",
},
- "use_first_backup_wins_server": {
- Type: schema.TypeBool,
+ "dn_concurrence": {
+ Type: schema.TypeInt,
Optional: true,
- Description: "Use First Backup WINS Server.",
- Default: false,
+ Description: "DN part occurrence number.",
+ Default: 1,
},
- "first_backup_wins_server": {
+ },
+ },
+ },
+ "client_display_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Client display configuration settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "headline": {
Type: schema.TypeString,
Optional: true,
- Description: "First Backup WINS Server. Identified by name or UID. Must be set when \"use-first-backup-wins-server\" is true and can not be set when \"use-first-backup-wins-server\" is false.",
- },
- "use_second_backup_wins_server": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Use Second Backup WINS Server.",
- Default: false,
+ Description: "Display headline for authentication dialog.",
},
- "second_backup_wins_server": {
+ "username_label": {
Type: schema.TypeString,
Optional: true,
- Description: "Second Backup WINS Server. Identified by name or UID. Must be set when \"use-second-backup-wins-server\" is true and can not be set when \"use-second-backup-wins-server\" is false.",
+ Description: "Label for username field.",
},
- "ip_lease_duration": {
- Type: schema.TypeInt,
+ "password_label": {
+ Type: schema.TypeString,
Optional: true,
- Description: "IP Lease Duration in Minutes. The value must be in the range 2-32767.",
+ Description: "Label for password field.",
},
},
},
@@ -1716,138 +2104,1157 @@ func resourceManagementSimpleCluster() *schema.Resource {
},
},
},
- "support_multiple_interfaces": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Support connectivity enhancement for gateways with multiple external interfaces.",
- Default: false,
- },
- "perform_anti_spoofing": {
+ "override_global_dynamic_id_settings": {
Type: schema.TypeBool,
Optional: true,
- Description: "Perform Anti-Spoofing on Office Mode addresses.",
+ Description: "Override global dynamic ID settings.",
Default: false,
},
- "anti_spoofing_additional_addresses": {
- Type: schema.TypeString,
+ "dynamic_id_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
Optional: true,
- Description: "Additional IP Addresses for Anti-Spoofing. Identified by name or UID. Must be set when \"perform-anti-spoofings\" is true.",
- Default: "None",
+ Description: "Dynamic ID settings, relevant only when \"override-global-dynamic-id-settings\" is true.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "sms_provider_and_email_settings": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "SMS provider and email configuration.",
+ },
+ "sms_provider_credentials": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "SMS provider credentials configuration.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "username": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "SMS provider username.",
+ },
+ "password": {
+ Type: schema.TypeString,
+ Optional: true,
+ Sensitive: true,
+ Description: "SMS provider password.",
+ },
+ "api_id": {
+ Type: schema.TypeString,
+ Optional: true,
+ Sensitive: true,
+ Description: "SMS provider API ID.",
+ },
+ },
+ },
+ },
+ "advanced_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Advanced Dynamic ID configuration settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "dynamic_id_message": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Dynamic ID message displayed to users.",
+ },
+ "otp_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "One Time Password configuration settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "length": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Length of one time password.",
+ Default: 6,
+ },
+ "expiration": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "One time password expiration (in minutes).",
+ Default: 5,
+ },
+ "max_attempts": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Number of times users can attempt to enter the one time password before the entire authentication process restarts.",
+ Default: 3,
+ },
+ },
+ },
+ },
+ "enable_display_user_details": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable display of user details.",
+ Default: false,
+ },
+ "country_code": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Country code for SMS services.",
+ },
+ "user_details_retrieval": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "User details retrieval method.",
+ Default: "internal-or-ldap-or-local",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "send_machine_certificate": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Configure when to send machine certificate.",
+ Default: "when-available",
},
},
},
},
- "remote_access": {
+ "link_selection": {
Type: schema.TypeList,
MaxItems: 1,
Optional: true,
- Description: "Remote Access.",
+ Description: "Link Selection.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "support_l2tp": {
- Type: schema.TypeBool,
+ "ip_selection": {
+ Type: schema.TypeString,
Optional: true,
- Description: "Support L2TP (relevant only when office mode is active).",
- Default: false,
+ Description: "IP selection",
+ Default: "use-main-address",
},
- "l2tp_auth_method": {
+ "dns_resolving_hostname": {
Type: schema.TypeString,
Optional: true,
- Description: "L2TP Authentication Method. Must be set when \"support-l2tp\" is true.",
- Default: "md5",
+ Description: "DNS Resolving Hostname. Must be set when \"ip-selection\" was selected to be \"dns-resolving-from-hostname\".",
},
- "l2tp_certificate": {
+ "ip_address": {
Type: schema.TypeString,
Optional: true,
- Description: "L2TP Certificate. Must be set when \"l2tp-auth-method\" was selected to be \"certificate\". Insert \"defaultCert\" when you want to use the default certificate.",
+ Description: "IP Address. Must be set when \"ip-selection\" was selected to be \"use-selected-address-from-topology\" or \"use-statically-nated-ip\"",
},
- "allow_vpn_clients_to_route_traffic": {
- Type: schema.TypeBool,
+ "route_selection_method": {
+ Type: schema.TypeString,
Optional: true,
- Description: "Allow VPN clients to route traffic.",
- Default: false,
+ Description: "Outgoing route selection method when initiating a tunnel.",
+ Default: "os-routing-table",
},
- "support_nat_traversal_mechanism": {
- Type: schema.TypeBool,
+ "responding_traffic": {
+ Type: schema.TypeString,
Optional: true,
- Description: "Support NAT traversal mechanism (UDP encapsulation).",
- Default: true,
+ Description: "Responding traffic route selection method.",
},
- "nat_traversal_service": {
+ "source_ip_selection": {
Type: schema.TypeString,
Optional: true,
- Description: "Allocated NAT traversal UDP service. Identified by name or UID. Must be set when \"support-nat-traversal-mechanism\" is true.",
- Default: "VPN1_IPSEC_encapsulation",
+ Description: "Source IP address selection method for outgoing traffic.",
},
- "support_visitor_mode": {
- Type: schema.TypeBool,
+ "selected_ip": {
+ Type: schema.TypeString,
Optional: true,
- Description: "Support Visitor Mode.",
- Default: false,
+ Description: "Selected IP address. Must be set when \"source-ip-selection\" was selected to be \"manual\".",
},
- "visitor_mode_service": {
+ "outgoing_link_tracking": {
Type: schema.TypeString,
Optional: true,
- Description: "TCP Service for Visitor Mode. Identified by name or UID. Must be set when \"support-visitor-mode\" is true.",
- Default: "https",
+ Description: "Outgoing link tracking method.",
},
- "visitor_mode_interface": {
- Type: schema.TypeString,
+ "probing_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
Optional: true,
- Description: "Interface for Visitor Mode. Must be set when \"support-visitor-mode\" is true. Insert IPV4 Address of existing interface or \"All IPs\" when you want all interfaces.",
- Default: "All IPs",
+ Description: "Probing settings configuration. Only available when \"ip-selection\" is \"use-probing-with-high-availability\" or \"use-probing-with-load-sharing\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "probed_interfaces": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Specifies whether to probe all addresses defined in the topology tab or specific addresses.",
+ Default: "all",
+ },
+ "probed_interface_list": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "List of specific IP addresses to probe. Only relevant when \"probed-interfaces\" is set to \"specific\".",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "use_primary_address": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to use a primary address for high availability probing.",
+ Default: false,
+ },
+ "primary_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Primary IP address to use. Must be one of the addresses from \"probed-interface-list\". Required when \"use-primary-address\" is true.",
+ },
+ "probing_method": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Probing method.",
+ Default: "ongoing",
+ },
+ },
+ },
},
},
},
},
- "vpn_domain": {
+ "maximum_concurrent_ike_negotiations": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Maximum concurrent ike negotiations",
+ },
+ "maximum_concurrent_tunnels": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Maximum concurrent tunnels",
+ },
+ "office_mode": {
+ Type: schema.TypeList,
+ Optional: true,
+ Description: "Office Mode. Notation Wide Impact - Office Mode apply IPSec VPN Software Blade clients and to the Mobile Access Software Blade clients.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Office Mode Permissions. When selected to be \"off\", all the other definitions are irrelevant.",
+ Default: "off",
+ },
+ "group": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Group. Identified by name or UID. Must be set when \"office-mode-permissions\" was selected to be \"group\".",
+ },
+ "allocate_ip_address_from": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Allocate IP address Method. Allocate IP address by sequentially trying the given methods until success.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "radius_server": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Radius server used to authenticate the user.",
+ Default: false,
+ },
+ "use_allocate_method": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Use Allocate Method.",
+ Default: true,
+ },
+ "allocate_method": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Using either Manual (IP Pool) or Automatic (DHCP). Must be set when \"use-allocate-method\" is true.",
+ Default: "manual",
+ },
+ "manual_network": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Manual Network. Identified by name or UID. Must be set when \"allocate-method\" was selected to be \"manual\".",
+ },
+ "dhcp_server": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "DHCP Server. Identified by name or UID. Must be set when \"allocate-method\" was selected to be \"automatic\".",
+ },
+ "virtual_ip_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Virtual IPV4 address for DHCP server replies. Must be set when \"allocate-method\" was selected to be \"automatic\".",
+ },
+ "dhcp_mac_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Calculated MAC address for DHCP allocation. Must be set when \"allocate-method\" was selected to be \"automatic\".",
+ Default: "per-machine",
+ },
+ "optional_parameters": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "This configuration applies to all Office Mode methods except Automatic (using DHCP) and ipassignment.conf entries which contain this data.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "use_primary_dns_server": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Use Primary DNS Server.",
+ Default: false,
+ },
+ "primary_dns_server": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Primary DNS Server. Identified by name or UID. Must be set when \"use-primary-dns-server\" is true and can not be set when \"use-primary-dns-server\" is false.",
+ },
+ "use_first_backup_dns_server": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Use First Backup DNS Server.",
+ Default: false,
+ },
+ "first_backup_dns_server": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "First Backup DNS Server. Identified by name or UID. Must be set when \"use-first-backup-dns-server\" is true and can not be set when \"use-first-backup-dns-server\" is false.",
+ },
+ "use_second_backup_dns_server": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Use Second Backup DNS Server.",
+ Default: false,
+ },
+ "second_backup_dns_server": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Second Backup DNS Server. Identified by name or UID. Must be set when \"use-second-backup-dns-server\" is true and can not be set when \"use-second-backup-dns-server\" is false.",
+ },
+ "dns_suffixes": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "DNS Suffixes.",
+ },
+ "use_primary_wins_server": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Use Primary WINS Server.",
+ Default: false,
+ },
+ "primary_wins_server": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Primary WINS Server. Identified by name or UID. Must be set when \"use-primary-wins-server\" is true and can not be set when \"use-primary-wins-server\" is false.",
+ },
+ "use_first_backup_wins_server": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Use First Backup WINS Server.",
+ Default: false,
+ },
+ "first_backup_wins_server": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "First Backup WINS Server. Identified by name or UID. Must be set when \"use-first-backup-wins-server\" is true and can not be set when \"use-first-backup-wins-server\" is false.",
+ },
+ "use_second_backup_wins_server": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Use Second Backup WINS Server.",
+ Default: false,
+ },
+ "second_backup_wins_server": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Second Backup WINS Server. Identified by name or UID. Must be set when \"use-second-backup-wins-server\" is true and can not be set when \"use-second-backup-wins-server\" is false.",
+ },
+ "ip_lease_duration": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "IP Lease Duration in Minutes. The value must be in the range 2-32767.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "support_multiple_interfaces": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Support connectivity enhancement for gateways with multiple external interfaces.",
+ Default: false,
+ },
+ "perform_anti_spoofing": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Perform Anti-Spoofing on Office Mode addresses.",
+ Default: false,
+ },
+ "anti_spoofing_additional_addresses": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Additional IP Addresses for Anti-Spoofing. Identified by name or UID. Must be set when \"perform-anti-spoofings\" is true.",
+ Default: "None",
+ },
+ },
+ },
+ },
+ "remote_access": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Remote Access.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "support_l2tp": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Support L2TP (relevant only when office mode is active).",
+ Default: false,
+ },
+ "l2tp_auth_method": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "L2TP Authentication Method. Must be set when \"support-l2tp\" is true.",
+ Default: "md5",
+ },
+ "l2tp_certificate": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "L2TP Certificate. Must be set when \"l2tp-auth-method\" was selected to be \"certificate\". Insert \"defaultCert\" when you want to use the default certificate.",
+ },
+ "allow_vpn_clients_to_route_traffic": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Allow VPN clients to route traffic.",
+ Default: false,
+ },
+ "support_nat_traversal_mechanism": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Support NAT traversal mechanism (UDP encapsulation).",
+ Default: true,
+ },
+ "nat_traversal_service": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Allocated NAT traversal UDP service. Identified by name or UID. Must be set when \"support-nat-traversal-mechanism\" is true.",
+ Default: "VPN1_IPSEC_encapsulation",
+ },
+ "support_visitor_mode": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Support Visitor Mode.",
+ Default: false,
+ },
+ "visitor_mode_service": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "TCP Service for Visitor Mode. Identified by name or UID. Must be set when \"support-visitor-mode\" is true.",
+ Default: "https",
+ },
+ "visitor_mode_interface": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Interface for Visitor Mode. Must be set when \"support-visitor-mode\" is true. Insert IPV4 Address of existing interface or \"All IPs\" when you want all interfaces.",
+ Default: "All IPs",
+ },
+ },
+ },
+ },
+ "vpn_domain": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Gateway VPN domain identified by the name or UID.",
+ },
+ "vpn_domain_type": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Gateway VPN domain type.",
+ },
+ "vpn_domain_exclude_external_ip_addresses": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Exclude the external IP addresses from the VPN domain of this Security Gateway.",
+ },
+ "advanced": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Advanced VPN settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "tunnel_sharing_mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Tunnel sharing mode.",
+ },
+ "shutdown_on_gateway_restart": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Shutdown VPN tunnels on gateway restart.",
+ },
+ "enable_wire_mode": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable wire mode.",
+ },
+ "wire_mode_interfaces": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "Wire mode interfaces.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "enable_wire_mode_log_traffic": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Log traffic in wire mode.",
+ },
+ "enable_nat_traversal": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable NAT traversal.",
+ },
+ },
+ },
+ },
+ "exported_routes": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Exported routes.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "internal_interfaces": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Export internal interfaces.",
+ },
+ "static_routes": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Export static routes.",
+ },
+ "custom_routes": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Export custom routes.",
+ },
+ "custom_routes_object": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Custom routes object identified by the name or UID.",
+ },
+ },
+ },
+ },
+ "vpn_clients": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "VPN clients settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "enable_endpoint_security_vpn": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable Endpoint Security VPN client.",
+ },
+ "enable_cp_mobile_for_windows": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable Check Point Mobile for Windows client.",
+ },
+ "enable_secu_remote": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable SecuRemote client.",
+ },
+ "enable_capsule_vpn_connect": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable Capsule VPN Connect client.",
+ },
+ "enable_ssl_network_extender": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable SSL Network Extender client.",
+ },
+ "gateway_authentication_certificate": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Gateway authentication certificate.",
+ },
+ },
+ },
+ },
+ "enable_clientless_vpn": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable clientless VPN.",
+ },
+ "clientless_vpn_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Clientless VPN settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "certificate_gateway_authentication": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Certificate gateway authentication.",
+ },
+ "client_authentication": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Client authentication.",
+ },
+ "concurrent_servers_or_processes": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Number of concurrent servers or processes.",
+ },
+ "accept_only_3des": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Accept only 3DES.",
+ },
+ },
+ },
+ },
+ "saml_portal_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "SAML portal settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "portal_web_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Configuration of the SAML portal web settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "aliases": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "List of URL aliases that are redirected to the main portal URL.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ip_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
+ "main_url": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The main URL for the portal.",
+ },
+ },
+ },
+ },
+ "certificate_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Configuration of the SAML portal certificate.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "base64_certificate": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The certificate file encoded in Base64 with padding.",
+ },
+ "base64_password": {
+ Type: schema.TypeString,
+ Optional: true,
+ Sensitive: true,
+ Description: "Certificate file password.",
+ },
+ },
+ },
+ },
+ "accessibility": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Configuration of the portal access settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "allow_access_from": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Allowed access to the SAML portal.",
+ },
+ "internal_access_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Configuration of the additional portal access settings for internal interfaces only.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "undefined": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to \"Undefined\".",
+ },
+ "dmz": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to \"DMZ\".",
+ },
+ "vpn": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Controls portal access settings for interfaces that are part of a VPN Encryption Domain.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "color": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Color of the object. Should be one of existing colors.",
+ Default: "black",
+ },
+ "comments": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Comments string.",
+ },
+ "tags": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "Collection of tag identifiers.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ignore_warnings": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Apply changes ignoring warnings.",
+ Default: false,
+ },
+ "ignore_errors": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
+ Default: false,
+ },
+ "anti_spam_and_email_security": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enables Anti-Spam & Email-Security blade.",
+ },
+ "auto_topology_custom_recalculation_time": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Auto topology custom recalculation time (seconds).",
+ },
+ "auto_topology_use_custom_recalculation_time": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Auto topology to use custom recalculation time instead of default.",
+ },
+ "data_loss_prevention": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Data Loss Prevention blade.",
+ },
+ "mobile_access": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Mobile Access blade.",
+ },
+ "monitoring": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enables Real Time Monitoring blade.",
+ },
+ "policy_server": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Policy Server blade.",
+ },
+ "rtm_counters_report": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enables monitoring blades system counters report (e.g CPU Usage,Memory Usage).",
+ },
+ "rtm_traffic_report": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enables monitoring blades traffic report.",
+ },
+ "rtm_traffic_report_per_connection": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enables Monitoring blade traffic report per connection.",
+ },
+ "threat_extraction": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Threat Extraction blade enabled.",
+ },
+ "threat_prevention_mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The mode of Threat Prevention to use. When using Autonomous Threat Prevention, disabling the Threat Prevention blades is not allowed.",
+ },
+ "workforce_ai": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Workforce AI Security blade enabled. Requires content awareness blade and version R82.20 or higher to be enabled.",
+ },
+ "application_control_and_url_filtering_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Gateway Application Control and URL filtering settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "global_settings_mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Whether to override global settings or not.",
+ },
+ "override_global_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "override global settings object.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "fail_mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Fail mode - allow or block all requests.",
+ },
+ "website_categorization": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Website categorization object.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "custom_mode": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Custom mode object.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "social_networking_widgets": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Social networking widgets mode.",
+ },
+ "url_filtering": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "URL filtering mode.",
+ },
+ },
+ },
+ },
+ "mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Website categorization mode.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "cluster_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "ClusterXL and VRRP Settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "member_recovery_mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "In a High Availability cluster, each member is given a priority. The member with the highest priority serves as the gateway. If this gateway fails, control is p",
+ },
+ "state_synchronization": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Cluster State Synchronization settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "delayed": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Start synchronizing with delay of seconds, as defined by delayed-seconds, after connection initiation. Disabled when state-synchronization disabled.",
+ },
+ "delayed_seconds": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Start synchronizing X seconds after connection initiation . The values must be in a range between 2 and 3600.",
+ },
+ "enabled": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Use State Synchronization.",
+ },
+ },
+ },
+ },
+ "track_changes_of_cluster_members": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Track changes in the status of Cluster Members.",
+ },
+ "use_virtual_mac": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Use Virtual MAC. By enabling Virtual MAC in ClusterXL High Availability New mode, or Load Sharing Unicast mode, all cluster members associate the same Virtual M",
+ },
+ },
+ },
+ },
+ "communication_with_servers_behind_nat": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Gateway behind NAT communications settings with the server.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to override the Server (Check Point Host) object configuration.",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "according-to-topology: Use the original or translated IP address of the server based on the Topology of Security Gateway interfaces.
original-ip-only: Use on",
+ },
+ },
+ },
+ },
+ "zero_phishing_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Fqdn settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "gateway_fqdn_mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Manual Fqdn.",
+ },
+ "manual_fqdn": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Zero Phishing gateway FQDN.",
+ },
+ },
+ },
+ },
+ "dns_server": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "DNS Server.",
+ },
+ "logs_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Logs settings that apply to Quantum Security Gateways that run Gaia OS.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "alert_when_free_disk_space_below": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable alert when free disk space is below threshold.",
+ },
+ "alert_when_free_disk_space_below_threshold": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Alert when free disk space below threshold.",
+ },
+ "alert_when_free_disk_space_below_type": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Alert when free disk space below type.",
+ },
+ "before_delete_keep_logs_from_the_last_days": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable before delete keep logs from the last days.",
+ },
+ "before_delete_keep_logs_from_the_last_days_threshold": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Before delete keep logs from the last days threshold.",
+ },
+ "before_delete_run_script": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable Before delete run script.",
+ },
+ "before_delete_run_script_command": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Before delete run script command.",
+ },
+ "delete_index_files_older_than_days": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable delete index files older than days.",
+ },
+ "delete_index_files_older_than_days_threshold": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Delete index files older than days threshold.",
+ },
+ "delete_index_files_when_index_size_above": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable delete index files when index size above.",
+ },
+ "delete_index_files_when_index_size_above_threshold": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Delete index files when index size above threshold.",
+ },
+ "delete_when_free_disk_space_below": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable delete when free disk space below.",
+ },
+ "delete_when_free_disk_space_below_threshold": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Delete when free disk space below threshold.",
+ },
+ "detect_new_citrix_ica_application_names": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable detect new Citrix ICA application names.",
+ },
+ "distribute_logs_between_all_active_servers": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Distribute logs between all active servers.",
+ },
+ "forward_logs_to_log_server": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable forward logs to log server.",
+ },
+ "forward_logs_to_log_server_name": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Forward logs to log server name.",
+ },
+ "forward_logs_to_log_server_schedule_name": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Forward logs to log server schedule name.",
+ },
+ "free_disk_space_metrics": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Free disk space metrics.",
+ },
+ "include_tcp_state_information": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Include TCP state information. Relevant only when Firewall blade is enabled.",
+ },
+ "perform_log_rotate_before_log_forwarding": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable perform log rotate before log forwarding.",
+ },
+ "reject_connections_when_free_disk_space_below_threshold": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable reject connections when free disk space below threshold.",
+ },
+ "reserve_for_packet_capture_metrics": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Reserve for packet capture metrics.",
+ },
+ "reserve_for_packet_capture_threshold": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Reserve for packet capture threshold.",
+ },
+ "rotate_log_by_file_size": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable rotate log by file size.",
+ },
+ "rotate_log_file_size_threshold": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Log file size threshold.",
+ },
+ "rotate_log_on_schedule": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable rotate log on schedule.",
+ },
+ "rotate_log_schedule_name": {
Type: schema.TypeString,
Optional: true,
- Description: "Gateway VPN domain identified by the name or UID.",
+ Description: "Rotate log schedule name.",
},
- "vpn_domain_type": {
- Type: schema.TypeString,
+ "stop_logging_when_free_disk_space_below": {
+ Type: schema.TypeBool,
Optional: true,
- Description: "Gateway VPN domain type.",
+ Description: "Enable stop logging when free disk space below.",
},
- "vpn_domain_exclude_external_ip_addresses": {
+ "stop_logging_when_free_disk_space_below_threshold": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Stop logging when free disk space below threshold.",
+ },
+ "turn_on_qos_logging": {
Type: schema.TypeBool,
Optional: true,
- Description: "Exclude the external IP addresses from the VPN domain of this Security Gateway.",
+ Description: "Enable turn on QoS Logging.",
+ },
+ "update_account_log_every": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Update account log in every amount of seconds.",
},
},
},
},
- "color": {
- Type: schema.TypeString,
- Optional: true,
- Description: "Color of the object. Should be one of existing colors.",
- Default: "black",
- },
- "comments": {
- Type: schema.TypeString,
- Optional: true,
- Description: "Comments string.",
- },
- "tags": {
- Type: schema.TypeSet,
- Optional: true,
- Description: "Collection of tag identifiers.",
- Elem: &schema.Schema{
- Type: schema.TypeString,
- },
- },
- "ignore_warnings": {
- Type: schema.TypeBool,
- Optional: true,
- Description: "Apply changes ignoring warnings.",
- Default: false,
- },
- "ignore_errors": {
+ "show_portals_certificate": {
Type: schema.TypeBool,
Optional: true,
- Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
- Default: false,
+ Description: "Indicates whether to show the portals certificate value in the reply.",
},
},
}
@@ -1988,6 +3395,42 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
}
httpsInspectionPayload["deny-expired-server-cert"] = denyExpiredServerCertPayload
}
+ if _, ok := d.GetOk("https_inspection.0.bypass_on_client_failure"); ok {
+
+ bypassOnClientFailurePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("https_inspection.0.bypass_on_client_failure.0.override_profile"); ok {
+ bypassOnClientFailurePayload["override-profile"] = strconv.FormatBool(v.(bool))
+ }
+ if v, ok := d.GetOk("https_inspection.0.bypass_on_client_failure.0.value"); ok {
+ bypassOnClientFailurePayload["value"] = strconv.FormatBool(v.(bool))
+ }
+ httpsInspectionPayload["bypass-on-client-failure"] = bypassOnClientFailurePayload
+ }
+ if _, ok := d.GetOk("https_inspection.0.bypass_under_load"); ok {
+
+ bypassUnderLoadPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("https_inspection.0.bypass_under_load.0.value"); ok {
+ bypassUnderLoadPayload["value"] = strconv.FormatBool(v.(bool))
+ }
+ httpsInspectionPayload["bypass-under-load"] = bypassUnderLoadPayload
+ }
+ if _, ok := d.GetOk("https_inspection.0.outbound_certificate"); ok {
+
+ outboundCertificatePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("https_inspection.0.outbound_certificate.0.override_profile"); ok {
+ outboundCertificatePayload["override-profile"] = strconv.FormatBool(v.(bool))
+ }
+ if v, ok := d.GetOk("https_inspection.0.outbound_certificate.0.value"); ok {
+ outboundCertificatePayload["value"] = v.(string)
+ }
+ httpsInspectionPayload["outbound-certificate"] = outboundCertificatePayload
+ }
+ if v, ok := d.GetOk("https_inspection.0.deployment_mode"); ok {
+ httpsInspectionPayload["deployment-mode"] = v.(string)
+ }
cluster["https-inspection"] = httpsInspectionPayload
}
}
@@ -2011,11 +3454,93 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
browserBasedAuthenticationSettingsPayload := make(map[string]interface{})
- if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings"); ok {
- browserBasedAuthenticationSettingsPayload["authentication-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings"); ok {
+ authenticationSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.authentication_method"); ok {
+ authenticationSettingsPayload["authentication-method"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.identity_provider"); ok {
+ authenticationSettingsPayload["identity-provider"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.radius"); ok {
+ authenticationSettingsPayload["radius"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories"); ok {
+
+ usersDirectoriesPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.external_user_profile"); ok {
+ usersDirectoriesPayload["external-user-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.internal_users"); ok {
+ usersDirectoriesPayload["internal-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.specific"); ok {
+ usersDirectoriesPayload["specific"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.users_from_external_directories"); ok {
+ usersDirectoriesPayload["users-from-external-directories"] = v.(string)
+ }
+ authenticationSettingsPayload["users-directories"] = usersDirectoriesPayload
+ }
+ browserBasedAuthenticationSettingsPayload["authentication-settings"] = authenticationSettingsPayload
}
- if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings"); ok {
- browserBasedAuthenticationSettingsPayload["browser-based-authentication-portal-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings"); ok {
+ browserBasedAuthenticationPortalSettingsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility"); ok {
+
+ accessibilityPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.allow_access_from"); ok {
+ accessibilityPayload["allow-access-from"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings"); ok {
+
+ internalAccessSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings.0.dmz"); ok {
+ internalAccessSettingsPayload["dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings.0.undefined"); ok {
+ internalAccessSettingsPayload["undefined"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings.0.vpn"); ok {
+ internalAccessSettingsPayload["vpn"] = v.(bool)
+ }
+ accessibilityPayload["internal-access-settings"] = internalAccessSettingsPayload
+ }
+ browserBasedAuthenticationPortalSettingsPayload["accessibility"] = accessibilityPayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.certificate_settings"); ok {
+
+ certificateSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.certificate_settings.0.base64_certificate"); ok {
+ certificateSettingsPayload["base64-certificate"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.certificate_settings.0.base64_password"); ok {
+ certificateSettingsPayload["base64-password"] = v.(string)
+ }
+ browserBasedAuthenticationPortalSettingsPayload["certificate-settings"] = certificateSettingsPayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings"); ok {
+
+ portalWebSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings.0.aliases"); ok {
+ portalWebSettingsPayload["aliases"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings.0.ip_address"); ok {
+ portalWebSettingsPayload["ip-address"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings.0.main_url"); ok {
+ portalWebSettingsPayload["main-url"] = v.(string)
+ }
+ browserBasedAuthenticationPortalSettingsPayload["portal-web-settings"] = portalWebSettingsPayload
+ }
+ browserBasedAuthenticationSettingsPayload["browser-based-authentication-portal-settings"] = browserBasedAuthenticationPortalSettingsPayload
}
identityAwarenessSettingsPayload["browser-based-authentication-settings"] = browserBasedAuthenticationSettingsPayload
}
@@ -2032,11 +3557,63 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.user_reauthenticate_interval"); ok {
identityAgentSettingsPayload["user-reauthenticate-interval"] = v
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings"); ok {
- identityAgentSettingsPayload["authentication-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings"); ok {
+ authenticationSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.authentication_method"); ok {
+ authenticationSettingsPayload["authentication-method"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.radius"); ok {
+ authenticationSettingsPayload["radius"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories"); ok {
+
+ usersDirectoriesPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.external_user_profile"); ok {
+ usersDirectoriesPayload["external-user-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.internal_users"); ok {
+ usersDirectoriesPayload["internal-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.specific"); ok {
+ usersDirectoriesPayload["specific"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.users_from_external_directories"); ok {
+ usersDirectoriesPayload["users-from-external-directories"] = v.(string)
+ }
+ authenticationSettingsPayload["users-directories"] = usersDirectoriesPayload
+ }
+ identityAgentSettingsPayload["authentication-settings"] = authenticationSettingsPayload
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings"); ok {
- identityAgentSettingsPayload["identity-agent-portal-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings"); ok {
+ identityAgentPortalSettingsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility"); ok {
+
+ accessibilityPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.allow_access_from"); ok {
+ accessibilityPayload["allow-access-from"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings"); ok {
+
+ internalAccessSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings.0.dmz"); ok {
+ internalAccessSettingsPayload["dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings.0.undefined"); ok {
+ internalAccessSettingsPayload["undefined"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings.0.vpn"); ok {
+ internalAccessSettingsPayload["vpn"] = v.(bool)
+ }
+ accessibilityPayload["internal-access-settings"] = internalAccessSettingsPayload
+ }
+ identityAgentPortalSettingsPayload["accessibility"] = accessibilityPayload
+ }
+ identityAgentSettingsPayload["identity-agent-portal-settings"] = identityAgentPortalSettingsPayload
}
identityAwarenessSettingsPayload["identity-agent-settings"] = identityAgentSettingsPayload
}
@@ -2050,11 +3627,57 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authorized_clients"); ok {
identityCollectorSettingsPayload["authorized-clients"] = v.(*schema.Set).List()
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings"); ok {
- identityCollectorSettingsPayload["authentication-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings"); ok {
+ authenticationSettingsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories"); ok {
+
+ usersDirectoriesPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.external_user_profile"); ok {
+ usersDirectoriesPayload["external-user-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.internal_users"); ok {
+ usersDirectoriesPayload["internal-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.specific"); ok {
+ usersDirectoriesPayload["specific"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.users_from_external_directories"); ok {
+ usersDirectoriesPayload["users-from-external-directories"] = v.(string)
+ }
+ authenticationSettingsPayload["users-directories"] = usersDirectoriesPayload
+ }
+ identityCollectorSettingsPayload["authentication-settings"] = authenticationSettingsPayload
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions"); ok {
- identityCollectorSettingsPayload["client-access-permissions"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions"); ok {
+ clientAccessPermissionsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility"); ok {
+
+ accessibilityPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.allow_access_from"); ok {
+ accessibilityPayload["allow-access-from"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings"); ok {
+
+ internalAccessSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.dmz"); ok {
+ internalAccessSettingsPayload["dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.undefined"); ok {
+ internalAccessSettingsPayload["undefined"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.vpn"); ok {
+ internalAccessSettingsPayload["vpn"] = v.(bool)
+ }
+ accessibilityPayload["internal-access-settings"] = internalAccessSettingsPayload
+ }
+ clientAccessPermissionsPayload["accessibility"] = accessibilityPayload
+ }
+ identityCollectorSettingsPayload["client-access-permissions"] = clientAccessPermissionsPayload
}
identityAwarenessSettingsPayload["identity-collector-settings"] = identityCollectorSettingsPayload
}
@@ -2071,6 +3694,36 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.0.receive_from"); ok {
identitySharingSettingsPayload["receive-from"] = v.(*schema.Set).List()
}
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.cache_mode"); ok {
+
+ cacheModePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.cache_mode.0.override_profile"); ok {
+ cacheModePayload["override-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.cache_mode.0.value"); ok {
+ cacheModePayload["value"] = v.(bool)
+ }
+ identitySharingSettingsPayload["cache-mode"] = cacheModePayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.cache_mode_duration"); ok {
+
+ cacheModeDurationPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.cache_mode_duration.0.override_profile"); ok {
+ cacheModeDurationPayload["override-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.cache_mode_duration.0.value"); ok {
+ cacheModeDurationPayload["value"] = v.(int)
+ }
+ identitySharingSettingsPayload["cache-mode-duration"] = cacheModeDurationPayload
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.receive_from_infinity_identity"); ok {
+ identitySharingSettingsPayload["receive-from-infinity-identity"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.scaled_sharing"); ok {
+ identitySharingSettingsPayload["scaled-sharing"] = v.(bool)
+ }
identityAwarenessSettingsPayload["identity-sharing-settings"] = identitySharingSettingsPayload
}
if _, ok := d.GetOk("identity_awareness_settings.0.proxy_settings"); ok {
@@ -2085,6 +3738,9 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.remote_access"); ok {
identityAwarenessSettingsPayload["remote-access"] = v.(bool)
}
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_based_enforcement"); ok {
+ identityAwarenessSettingsPayload["identity-based-enforcement"] = v.(string)
+ }
cluster["identity-awareness-settings"] = identityAwarenessSettingsPayload
}
}
@@ -2123,6 +3779,9 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("nat_settings.0.method"); ok {
natSettingsPayload["method"] = v.(string)
}
+ if v, ok := d.GetOkExists("nat_settings.0.apply_control_connections"); ok {
+ natSettingsPayload["apply-control-connections"] = v.(bool)
+ }
cluster["nat-settings"] = natSettingsPayload
}
}
@@ -2142,6 +3801,9 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("platform_portal_settings.0.portal_web_settings.0.aliases"); ok {
portalWebSettingsPayload["aliases"] = v.(*schema.Set).List()
}
+ if v, ok := d.GetOk("platform_portal_settings.0.portal_web_settings.0.ip_address"); ok {
+ portalWebSettingsPayload["ip-address"] = v.(string)
+ }
if v, ok := d.GetOk("platform_portal_settings.0.portal_web_settings.0.main_url"); ok {
portalWebSettingsPayload["main-url"] = v.(string)
}
@@ -2218,6 +3880,9 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("usercheck_portal_settings.0.portal_web_settings.0.aliases"); ok {
portalWebSettingsPayload["aliases"] = v.(*schema.Set).List()
}
+ if v, ok := d.GetOk("usercheck_portal_settings.0.portal_web_settings.0.ip_address"); ok {
+ portalWebSettingsPayload["ip-address"] = v.(string)
+ }
if v, ok := d.GetOk("usercheck_portal_settings.0.portal_web_settings.0.main_url"); ok {
portalWebSettingsPayload["main-url"] = v.(string)
}
@@ -2255,10 +3920,6 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
cluster["zero-phishing"] = v.(bool)
}
- if v, ok := d.GetOk("zero_phishing_fqdn"); ok {
- cluster["zero-phishing-fqdn"] = v.(string)
- }
-
if v, ok := d.GetOk("interfaces"); ok {
interfacesList := v.([]interface{})
if len(interfacesList) > 0 {
@@ -2299,8 +3960,23 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".anti_spoofing_settings.0.action"); ok {
antiSpoofingSettings["action"] = v.(string)
}
+ if v, ok := d.GetOkExists("interfaces." + strconv.Itoa(i) + ".anti_spoofing_settings.0.exclude_packets"); ok {
+ antiSpoofingSettings["exclude-packets"] = v.(bool)
+ }
+ if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".anti_spoofing_settings.0.excluded_network_name"); ok {
+ antiSpoofingSettings["excluded-network-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".anti_spoofing_settings.0.excluded_network_uid"); ok {
+ antiSpoofingSettings["excluded-network-uid"] = v.(string)
+ }
+ if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".anti_spoofing_settings.0.spoof_tracking"); ok {
+ antiSpoofingSettings["spoof-tracking"] = v.(string)
+ }
interfacePayload["anti-spoofing-settings"] = antiSpoofingSettings
}
+ if v, ok := d.GetOkExists("interfaces." + strconv.Itoa(i) + ".dynamic_ip"); ok {
+ interfacePayload["dynamic-ip"] = v.(bool)
+ }
if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".multicast_address"); ok {
interfacePayload["multicast-address"] = v.(string)
@@ -2369,6 +4045,12 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("members." + strconv.Itoa(i) + ".one_time_password"); ok {
memberPayload["one-time-password"] = v.(string)
}
+ if v, ok := d.GetOkExists("members." + strconv.Itoa(i) + ".auto_generate_ip"); ok {
+ memberPayload["auto-generate-ip"] = v.(bool)
+ }
+ if v, ok := d.GetOk("members." + strconv.Itoa(i) + ".trust_method"); ok {
+ memberPayload["trust-method"] = v.(string)
+ }
if v, ok := d.GetOk("members." + strconv.Itoa(i) + ".interfaces"); ok {
interfacesList := v.([]interface{})
@@ -2395,9 +4077,60 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk(memberInterfacePrefix + ".ipv4_mask_length"); ok {
interfacePayload["ipv4-mask-length"] = v.(string)
}
+ if v, ok := d.GetOkExists(memberInterfacePrefix + ".anti_spoofing"); ok {
+ interfacePayload["anti-spoofing"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists(memberInterfacePrefix + ".dynamic_ip"); ok {
+ interfacePayload["dynamic-ip"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists(memberInterfacePrefix + ".security_zone"); ok {
+ interfacePayload["security-zone"] = v.(bool)
+ }
+ if v, ok := d.GetOk(memberInterfacePrefix + ".topology"); ok {
+ interfacePayload["topology"] = v.(string)
+ }
if v, ok := d.GetOk(memberInterfacePrefix + ".ipv6_mask_length"); ok {
interfacePayload["ipv6-mask-length"] = v.(string)
}
+ if _, ok := d.GetOk(memberInterfacePrefix + ".anti_spoofing_settings"); ok {
+ antiSpoofingSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk(memberInterfacePrefix + ".anti_spoofing_settings.0.action"); ok {
+ antiSpoofingSettingsPayload["action"] = v.(string)
+ }
+ if v, ok := d.GetOkExists(memberInterfacePrefix + ".anti_spoofing_settings.0.exclude_packets"); ok {
+ antiSpoofingSettingsPayload["exclude-packets"] = v.(bool)
+ }
+ if v, ok := d.GetOk(memberInterfacePrefix + ".anti_spoofing_settings.0.excluded_network_name"); ok {
+ antiSpoofingSettingsPayload["excluded-network-name"] = v.(string)
+ }
+ if v, ok := d.GetOk(memberInterfacePrefix + ".anti_spoofing_settings.0.excluded_network_uid"); ok {
+ antiSpoofingSettingsPayload["excluded-network-uid"] = v.(string)
+ }
+ if v, ok := d.GetOk(memberInterfacePrefix + ".anti_spoofing_settings.0.spoof_tracking"); ok {
+ antiSpoofingSettingsPayload["spoof-tracking"] = v.(string)
+ }
+ interfacePayload["anti-spoofing-settings"] = antiSpoofingSettingsPayload
+ }
+ if _, ok := d.GetOk(memberInterfacePrefix + ".security_zone_settings"); ok {
+ securityZoneSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists(memberInterfacePrefix + ".security_zone_settings.0.auto_calculated"); ok {
+ securityZoneSettingsPayload["auto-calculated"] = v.(bool)
+ }
+ interfacePayload["security-zone-settings"] = securityZoneSettingsPayload
+ }
+ if _, ok := d.GetOk(memberInterfacePrefix + ".topology_settings"); ok {
+ topologySettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists(memberInterfacePrefix + ".topology_settings.0.interface_leads_to_dmz"); ok {
+ topologySettingsPayload["interface-leads-to-dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOk(memberInterfacePrefix + ".topology_settings.0.ip_address_behind_this_interface"); ok {
+ topologySettingsPayload["ip-address-behind-this-interface"] = v.(string)
+ }
+ if v, ok := d.GetOk(memberInterfacePrefix + ".topology_settings.0.specific_network"); ok {
+ topologySettingsPayload["specific-network"] = v.(string)
+ }
+ interfacePayload["topology-settings"] = topologySettingsPayload
+ }
interfacesPayload = append(interfacesPayload, interfacePayload)
}
memberPayload["interfaces"] = interfacesPayload
@@ -2544,45 +4277,186 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
}
}
- // VPN settings
- if v, ok := d.GetOk("vpn_settings"); ok {
+ // VPN settings
+ if v, ok := d.GetOk("vpn_settings"); ok {
+
+ vpnSettingsList := v.([]interface{})
+
+ if len(vpnSettingsList) > 0 {
+
+ vpnSettingsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("vpn_settings.0.advanced"); ok {
+
+ advancedPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.advanced.0.tunnel_sharing_mode"); ok {
+ advancedPayload["tunnel-sharing-mode"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.advanced.0.shutdown_on_gateway_restart"); ok {
+ advancedPayload["shutdown-on-gateway-restart"] = strconv.FormatBool(v.(bool))
+ }
+ if v, ok := d.GetOk("vpn_settings.0.advanced.0.enable_wire_mode"); ok {
+ advancedPayload["enable-wire-mode"] = strconv.FormatBool(v.(bool))
+ }
+ if v, ok := d.GetOk("vpn_settings.0.advanced.0.wire_mode_interfaces"); ok {
+ advancedPayload["wire-mode-interfaces"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("vpn_settings.0.advanced.0.enable_wire_mode_log_traffic"); ok {
+ advancedPayload["enable-wire-mode-log-traffic"] = strconv.FormatBool(v.(bool))
+ }
+ if v, ok := d.GetOk("vpn_settings.0.advanced.0.enable_nat_traversal"); ok {
+ advancedPayload["enable-nat-traversal"] = strconv.FormatBool(v.(bool))
+ }
+ vpnSettingsPayload["advanced"] = advancedPayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication"); ok {
+
+ authenticationPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.authentication_clients"); ok {
+ authenticationPayload["authentication-clients"] = v.(*schema.Set).List()
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client"); ok {
+
+ singleAuthenticationClientPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.single_authentication_client.0.enabled"); ok {
+ singleAuthenticationClientPayload["enabled"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.single_authentication_client.0.allow_multiple_authentication_clients"); ok {
+ singleAuthenticationClientPayload["allow-multiple-authentication-clients"] = v.(bool)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.display_name"); ok {
+ singleAuthenticationClientPayload["display-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.method"); ok {
+ singleAuthenticationClientPayload["method"] = v.(string)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.secur_id"); ok {
+
+ securIdPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.secur_id.0.server"); ok {
+ securIdPayload["server"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.secur_id.0.token_card_type"); ok {
+ securIdPayload["token-card-type"] = v.(string)
+ }
+ singleAuthenticationClientPayload["secur-id"] = securIdPayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.radius"); ok {
+
+ radiusPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.radius.0.server"); ok {
+ radiusPayload["server"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.single_authentication_client.0.radius.0.ask_user_password"); ok {
+ radiusPayload["ask-user-password"] = v.(bool)
+ }
+ singleAuthenticationClientPayload["radius"] = radiusPayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate"); ok {
+
+ personalCertificatePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.fetch_username_from"); ok {
+ personalCertificatePayload["fetch-username-from"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.storage_type"); ok {
+ personalCertificatePayload["storage-type"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.source"); ok {
+ personalCertificatePayload["source"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.dn_part"); ok {
+ personalCertificatePayload["dn-part"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.dn_concurrence"); ok {
+ personalCertificatePayload["dn-concurrence"] = v.(int)
+ }
+ singleAuthenticationClientPayload["personal-certificate"] = personalCertificatePayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings"); ok {
+
+ clientDisplaySettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings.0.headline"); ok {
+ clientDisplaySettingsPayload["headline"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings.0.username_label"); ok {
+ clientDisplaySettingsPayload["username-label"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings.0.password_label"); ok {
+ clientDisplaySettingsPayload["password-label"] = v.(string)
+ }
+ singleAuthenticationClientPayload["client-display-settings"] = clientDisplaySettingsPayload
+ }
+ authenticationPayload["single-authentication-client"] = singleAuthenticationClientPayload
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.override_global_dynamic_id_settings"); ok {
+ authenticationPayload["override-global-dynamic-id-settings"] = v.(bool)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings"); ok {
- vpnSettingsList := v.([]interface{})
+ dynamicIdSettingsPayload := make(map[string]interface{})
- if len(vpnSettingsList) > 0 {
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_and_email_settings"); ok {
+ dynamicIdSettingsPayload["sms-provider-and-email-settings"] = v.(string)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials"); ok {
- vpnSettingsPayload := make(map[string]interface{})
+ smsProviderCredentialsPayload := make(map[string]interface{})
- if _, ok := d.GetOk("vpn_settings.0.advanced"); ok {
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials.0.username"); ok {
+ smsProviderCredentialsPayload["username"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials.0.password"); ok {
+ smsProviderCredentialsPayload["password"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials.0.api_id"); ok {
+ smsProviderCredentialsPayload["api-id"] = v.(string)
+ }
+ dynamicIdSettingsPayload["sms-provider-credentials"] = smsProviderCredentialsPayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings"); ok {
- advancedPayload := make(map[string]interface{})
+ advancedSettingsPayload := make(map[string]interface{})
- if v, ok := d.GetOk("vpn_settings.0.advanced.0.tunnel_sharing_mode"); ok {
- advancedPayload["tunnel-sharing-mode"] = v.(string)
- }
- if v, ok := d.GetOk("vpn_settings.0.advanced.0.shutdown_on_gateway_restart"); ok {
- advancedPayload["shutdown-on-gateway-restart"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOk("vpn_settings.0.advanced.0.enable_wire_mode"); ok {
- advancedPayload["enable-wire-mode"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOk("vpn_settings.0.advanced.0.wire_mode_interfaces"); ok {
- advancedPayload["wire-mode-interfaces"] = v.(*schema.Set).List()
- }
- if v, ok := d.GetOk("vpn_settings.0.advanced.0.enable_wire_mode_log_traffic"); ok {
- advancedPayload["enable-wire-mode-log-traffic"] = strconv.FormatBool(v.(bool))
- }
- if v, ok := d.GetOk("vpn_settings.0.advanced.0.enable_nat_traversal"); ok {
- advancedPayload["enable-nat-traversal"] = strconv.FormatBool(v.(bool))
- }
- vpnSettingsPayload["advanced"] = advancedPayload
- }
- if _, ok := d.GetOk("vpn_settings.0.authentication"); ok {
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.dynamic_id_message"); ok {
+ advancedSettingsPayload["dynamic-id-message"] = v.(string)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings"); ok {
- authenticationPayload := make(map[string]interface{})
+ otpSettingsPayload := make(map[string]interface{})
- if v, ok := d.GetOk("vpn_settings.0.authentication.0.authentication_clients"); ok {
- authenticationPayload["authentication-clients"] = v.(*schema.Set).List()
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings.0.length"); ok {
+ otpSettingsPayload["length"] = v.(int)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings.0.expiration"); ok {
+ otpSettingsPayload["expiration"] = v.(int)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings.0.max_attempts"); ok {
+ otpSettingsPayload["max-attempts"] = v.(int)
+ }
+ advancedSettingsPayload["otp-settings"] = otpSettingsPayload
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.enable_display_user_details"); ok {
+ advancedSettingsPayload["enable-display-user-details"] = v.(bool)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.country_code"); ok {
+ advancedSettingsPayload["country-code"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.user_details_retrieval"); ok {
+ advancedSettingsPayload["user-details-retrieval"] = v.(string)
+ }
+ dynamicIdSettingsPayload["advanced-settings"] = advancedSettingsPayload
+ }
+ authenticationPayload["dynamic-id-settings"] = dynamicIdSettingsPayload
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.send_machine_certificate"); ok {
+ authenticationPayload["send-machine-certificate"] = v.(string)
}
vpnSettingsPayload["authentication"] = authenticationPayload
}
@@ -2688,6 +4562,27 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("vpn_settings.0.link_selection.0.outgoing_link_tracking"); ok {
linkSelectionPayload["outgoing-link-tracking"] = v.(string)
}
+ if _, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings"); ok {
+
+ probingSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.probed_interfaces"); ok {
+ probingSettingsPayload["probed-interfaces"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.probed_interface_list"); ok {
+ probingSettingsPayload["probed-interface-list"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.link_selection.0.probing_settings.0.use_primary_address"); ok {
+ probingSettingsPayload["use-primary-address"] = v.(bool)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.primary_address"); ok {
+ probingSettingsPayload["primary-address"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.probing_method"); ok {
+ probingSettingsPayload["probing-method"] = v.(string)
+ }
+ linkSelectionPayload["probing-settings"] = probingSettingsPayload
+ }
vpnSettingsPayload["link-selection"] = linkSelectionPayload
}
if v, ok := d.GetOk("vpn_settings.0.maximum_concurrent_ike_negotiations"); ok {
@@ -2980,6 +4875,243 @@ func createManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
log.Println("Create Simple Cluster - Map = ", cluster)
+ if v, ok := d.GetOkExists("anti_spam_and_email_security"); ok {
+ cluster["anti-spam-and-email-security"] = v.(bool)
+ }
+ if v, ok := d.GetOk("auto_topology_custom_recalculation_time"); ok {
+ cluster["auto-topology-custom-recalculation-time"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("auto_topology_use_custom_recalculation_time"); ok {
+ cluster["auto-topology-use-custom-recalculation-time"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("data_loss_prevention"); ok {
+ cluster["data-loss-prevention"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("mobile_access"); ok {
+ cluster["mobile-access"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("monitoring"); ok {
+ cluster["monitoring"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("policy_server"); ok {
+ cluster["policy-server"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("rtm_counters_report"); ok {
+ cluster["rtm-counters-report"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("rtm_traffic_report"); ok {
+ cluster["rtm-traffic-report"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("rtm_traffic_report_per_connection"); ok {
+ cluster["rtm-traffic-report-per-connection"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("threat_extraction"); ok {
+ cluster["threat-extraction"] = v.(bool)
+ }
+ if v, ok := d.GetOk("threat_prevention_mode"); ok {
+ cluster["threat-prevention-mode"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("workforce_ai"); ok {
+ cluster["workforce-ai"] = v.(bool)
+ }
+ if _, ok := d.GetOk("application_control_and_url_filtering_settings"); ok {
+
+ applicationControlAndUrlFilteringSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("application_control_and_url_filtering_settings.0.global_settings_mode"); ok {
+ applicationControlAndUrlFilteringSettingsPayload["global-settings-mode"] = v.(string)
+ }
+ if _, ok := d.GetOk("application_control_and_url_filtering_settings.0.override_global_settings"); ok {
+
+ overrideGlobalSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("application_control_and_url_filtering_settings.0.override_global_settings.0.fail_mode"); ok {
+ overrideGlobalSettingsPayload["fail-mode"] = v.(string)
+ }
+ if _, ok := d.GetOk("application_control_and_url_filtering_settings.0.override_global_settings.0.website_categorization"); ok {
+
+ websiteCategorizationPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("application_control_and_url_filtering_settings.0.override_global_settings.0.website_categorization.0.custom_mode"); ok {
+
+ customModePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("application_control_and_url_filtering_settings.0.override_global_settings.0.website_categorization.0.custom_mode.0.social_networking_widgets"); ok {
+ customModePayload["social-networking-widgets"] = v.(string)
+ }
+ if v, ok := d.GetOk("application_control_and_url_filtering_settings.0.override_global_settings.0.website_categorization.0.custom_mode.0.url_filtering"); ok {
+ customModePayload["url-filtering"] = v.(string)
+ }
+ websiteCategorizationPayload["custom-mode"] = customModePayload
+ }
+ if v, ok := d.GetOk("application_control_and_url_filtering_settings.0.override_global_settings.0.website_categorization.0.mode"); ok {
+ websiteCategorizationPayload["mode"] = v.(string)
+ }
+ overrideGlobalSettingsPayload["website-categorization"] = websiteCategorizationPayload
+ }
+ applicationControlAndUrlFilteringSettingsPayload["override-global-settings"] = overrideGlobalSettingsPayload
+ }
+ cluster["application-control-and-url-filtering-settings"] = applicationControlAndUrlFilteringSettingsPayload
+ }
+ if _, ok := d.GetOk("cluster_settings"); ok {
+
+ clusterSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("cluster_settings.0.member_recovery_mode"); ok {
+ clusterSettingsPayload["member-recovery-mode"] = v.(string)
+ }
+ if _, ok := d.GetOk("cluster_settings.0.state_synchronization"); ok {
+
+ stateSynchronizationPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("cluster_settings.0.state_synchronization.0.delayed"); ok {
+ stateSynchronizationPayload["delayed"] = v.(bool)
+ }
+ if v, ok := d.GetOk("cluster_settings.0.state_synchronization.0.delayed_seconds"); ok {
+ stateSynchronizationPayload["delayed-seconds"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("cluster_settings.0.state_synchronization.0.enabled"); ok {
+ stateSynchronizationPayload["enabled"] = v.(bool)
+ }
+ clusterSettingsPayload["state-synchronization"] = stateSynchronizationPayload
+ }
+ if v, ok := d.GetOk("cluster_settings.0.track_changes_of_cluster_members"); ok {
+ clusterSettingsPayload["track-changes-of-cluster-members"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("cluster_settings.0.use_virtual_mac"); ok {
+ clusterSettingsPayload["use-virtual-mac"] = v.(bool)
+ }
+ cluster["cluster-settings"] = clusterSettingsPayload
+ }
+ if _, ok := d.GetOk("communication_with_servers_behind_nat"); ok {
+
+ communicationWithServersBehindNatPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("communication_with_servers_behind_nat.0.override_profile"); ok {
+ communicationWithServersBehindNatPayload["override-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOk("communication_with_servers_behind_nat.0.value"); ok {
+ communicationWithServersBehindNatPayload["value"] = v.(string)
+ }
+ cluster["communication-with-servers-behind-nat"] = communicationWithServersBehindNatPayload
+ }
+ if _, ok := d.GetOk("zero_phishing_settings"); ok {
+
+ zeroPhishingSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("zero_phishing_settings.0.gateway_fqdn_mode"); ok {
+ zeroPhishingSettingsPayload["gateway-fqdn-mode"] = v.(string)
+ }
+ if v, ok := d.GetOk("zero_phishing_settings.0.manual_fqdn"); ok {
+ zeroPhishingSettingsPayload["manual-fqdn"] = v.(string)
+ }
+ cluster["zero-phishing-settings"] = zeroPhishingSettingsPayload
+ }
+ if _, ok := d.GetOk("logs_settings"); ok {
+ logsSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("logs_settings.0.alert_when_free_disk_space_below"); ok {
+ logsSettingsPayload["alert-when-free-disk-space-below"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.alert_when_free_disk_space_below_threshold"); ok {
+ logsSettingsPayload["alert-when-free-disk-space-below-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOk("logs_settings.0.alert_when_free_disk_space_below_type"); ok {
+ logsSettingsPayload["alert-when-free-disk-space-below-type"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.before_delete_keep_logs_from_the_last_days"); ok {
+ logsSettingsPayload["before-delete-keep-logs-from-the-last-days"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.before_delete_keep_logs_from_the_last_days_threshold"); ok {
+ logsSettingsPayload["before-delete-keep-logs-from-the-last-days-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.before_delete_run_script"); ok {
+ logsSettingsPayload["before-delete-run-script"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.before_delete_run_script_command"); ok {
+ logsSettingsPayload["before-delete-run-script-command"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.delete_index_files_older_than_days"); ok {
+ logsSettingsPayload["delete-index-files-older-than-days"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.delete_index_files_older_than_days_threshold"); ok {
+ logsSettingsPayload["delete-index-files-older-than-days-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.delete_index_files_when_index_size_above"); ok {
+ logsSettingsPayload["delete-index-files-when-index-size-above"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.delete_index_files_when_index_size_above_threshold"); ok {
+ logsSettingsPayload["delete-index-files-when-index-size-above-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.delete_when_free_disk_space_below"); ok {
+ logsSettingsPayload["delete-when-free-disk-space-below"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.delete_when_free_disk_space_below_threshold"); ok {
+ logsSettingsPayload["delete-when-free-disk-space-below-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.detect_new_citrix_ica_application_names"); ok {
+ logsSettingsPayload["detect-new-citrix-ica-application-names"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.distribute_logs_between_all_active_servers"); ok {
+ logsSettingsPayload["distribute-logs-between-all-active-servers"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.forward_logs_to_log_server"); ok {
+ logsSettingsPayload["forward-logs-to-log-server"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.forward_logs_to_log_server_name"); ok {
+ logsSettingsPayload["forward-logs-to-log-server-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("logs_settings.0.forward_logs_to_log_server_schedule_name"); ok {
+ logsSettingsPayload["forward-logs-to-log-server-schedule-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("logs_settings.0.free_disk_space_metrics"); ok {
+ logsSettingsPayload["free-disk-space-metrics"] = v.(string)
+ }
+ if v, ok := d.GetOk("logs_settings.0.include_tcp_state_information"); ok {
+ logsSettingsPayload["include-tcp-state-information"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.perform_log_rotate_before_log_forwarding"); ok {
+ logsSettingsPayload["perform-log-rotate-before-log-forwarding"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.reject_connections_when_free_disk_space_below_threshold"); ok {
+ logsSettingsPayload["reject-connections-when-free-disk-space-below-threshold"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.reserve_for_packet_capture_metrics"); ok {
+ logsSettingsPayload["reserve-for-packet-capture-metrics"] = v.(string)
+ }
+ if v, ok := d.GetOk("logs_settings.0.reserve_for_packet_capture_threshold"); ok {
+ logsSettingsPayload["reserve-for-packet-capture-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.rotate_log_by_file_size"); ok {
+ logsSettingsPayload["rotate-log-by-file-size"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.rotate_log_file_size_threshold"); ok {
+ logsSettingsPayload["rotate-log-file-size-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.rotate_log_on_schedule"); ok {
+ logsSettingsPayload["rotate-log-on-schedule"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.rotate_log_schedule_name"); ok {
+ logsSettingsPayload["rotate-log-schedule-name"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.stop_logging_when_free_disk_space_below"); ok {
+ logsSettingsPayload["stop-logging-when-free-disk-space-below"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.stop_logging_when_free_disk_space_below_threshold"); ok {
+ logsSettingsPayload["stop-logging-when-free-disk-space-below-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.turn_on_qos_logging"); ok {
+ logsSettingsPayload["turn-on-qos-logging"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.update_account_log_every"); ok {
+ logsSettingsPayload["update-account-log-every"] = v.(int)
+ }
+ cluster["logs-settings"] = logsSettingsPayload
+ }
+
+ if v, ok := d.GetOkExists("show_portals_certificate"); ok {
+ cluster["show-portals-certificate"] = v.(bool)
+ }
+
addClusterRes, err := client.ApiCall("add-simple-cluster", cluster, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil {
return fmt.Errorf("%s", err.Error())
@@ -3201,6 +5333,51 @@ func readManagementSimpleCluster(d *schema.ResourceData, m interface{}) error {
httpsInspectionMapToReturn["deny_expired_server_cert"] = []interface{}{denyExpiredServerCertMapToReturn}
}
}
+ if v, ok := httpsInspectionMap["bypass-on-client-failure"]; ok {
+
+ bypassOnClientFailureMap, ok := v.(map[string]interface{})
+ if ok {
+ bypassOnClientFailureMapToReturn := make(map[string]interface{})
+
+ if v, _ := bypassOnClientFailureMap["override-profile"]; v != nil {
+ bypassOnClientFailureMapToReturn["override_profile"] = v
+ }
+ if v, _ := bypassOnClientFailureMap["value"]; v != nil {
+ bypassOnClientFailureMapToReturn["value"] = v
+ }
+ httpsInspectionMapToReturn["bypass_on_client_failure"] = []interface{}{bypassOnClientFailureMapToReturn}
+ }
+ }
+ if v, ok := httpsInspectionMap["bypass-under-load"]; ok {
+
+ bypassUnderLoadMap, ok := v.(map[string]interface{})
+ if ok {
+ bypassUnderLoadMapToReturn := make(map[string]interface{})
+
+ if v, _ := bypassUnderLoadMap["value"]; v != nil {
+ bypassUnderLoadMapToReturn["value"] = v
+ }
+ httpsInspectionMapToReturn["bypass_under_load"] = []interface{}{bypassUnderLoadMapToReturn}
+ }
+ }
+ if v, ok := httpsInspectionMap["outbound-certificate"]; ok {
+
+ outboundCertificateMap, ok := v.(map[string]interface{})
+ if ok {
+ outboundCertificateMapToReturn := make(map[string]interface{})
+
+ if v, _ := outboundCertificateMap["override-profile"]; v != nil {
+ outboundCertificateMapToReturn["override_profile"] = v
+ }
+ if v, _ := outboundCertificateMap["value"]; v != nil {
+ outboundCertificateMapToReturn["value"] = v.(map[string]interface{})["name"]
+ }
+ httpsInspectionMapToReturn["outbound_certificate"] = []interface{}{outboundCertificateMapToReturn}
+ }
+ }
+ if v, _ := httpsInspectionMap["deployment-mode"]; v != nil {
+ httpsInspectionMapToReturn["deployment_mode"] = v
+ }
_ = d.Set("https_inspection", []interface{}{httpsInspectionMapToReturn})
}
@@ -3229,10 +5406,87 @@ func readManagementSimpleCluster(d *schema.ResourceData, m interface{}) error {
browserBasedAuthenticationSettingsMapToReturn := make(map[string]interface{})
if v, _ := browserBasedAuthenticationSettingsMap["authentication-settings"]; v != nil {
- browserBasedAuthenticationSettingsMapToReturn["authentication_settings"] = v
+ authenticationSettingsMap := v.(map[string]interface{})
+ authenticationSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := authenticationSettingsMap["authentication-method"]; v != nil {
+ authenticationSettingsMapToReturn["authentication_method"] = v
+ }
+ if v, _ := authenticationSettingsMap["identity-provider"]; v != nil {
+ authenticationSettingsMapToReturn["identity_provider"] = v
+ }
+ if v, _ := authenticationSettingsMap["radius"]; v != nil {
+ authenticationSettingsMapToReturn["radius"] = v
+ }
+ if v, _ := authenticationSettingsMap["users-directories"]; v != nil {
+ usersDirectoriesMap := v.(map[string]interface{})
+ usersDirectoriesMapToReturn := make(map[string]interface{})
+ if v, _ := usersDirectoriesMap["external-user-profile"]; v != nil {
+ usersDirectoriesMapToReturn["external_user_profile"] = v
+ }
+ if v, _ := usersDirectoriesMap["internal-users"]; v != nil {
+ usersDirectoriesMapToReturn["internal_users"] = v
+ }
+ if v, _ := usersDirectoriesMap["specific"]; v != nil {
+ usersDirectoriesMapToReturn["specific"] = v
+ }
+ if v, _ := usersDirectoriesMap["users-from-external-directories"]; v != nil {
+ usersDirectoriesMapToReturn["users_from_external_directories"] = v
+ }
+ authenticationSettingsMapToReturn["users_directories"] = []interface{}{usersDirectoriesMapToReturn}
+ }
+ browserBasedAuthenticationSettingsMapToReturn["authentication_settings"] = []interface{}{authenticationSettingsMapToReturn}
}
if v, _ := browserBasedAuthenticationSettingsMap["browser-based-authentication-portal-settings"]; v != nil {
- browserBasedAuthenticationSettingsMapToReturn["browser_based_authentication_portal_settings"] = v
+ browserBasedAuthenticationPortalSettingsMap := v.(map[string]interface{})
+ browserBasedAuthenticationPortalSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := browserBasedAuthenticationPortalSettingsMap["accessibility"]; v != nil {
+ accessibilityMap := v.(map[string]interface{})
+ accessibilityMapToReturn := make(map[string]interface{})
+ if v, _ := accessibilityMap["allow-access-from"]; v != nil {
+ accessibilityMapToReturn["allow_access_from"] = v
+ }
+ if v, _ := accessibilityMap["internal-access-settings"]; v != nil {
+ internalAccessSettingsMap := v.(map[string]interface{})
+ internalAccessSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := internalAccessSettingsMap["dmz"]; v != nil {
+ internalAccessSettingsMapToReturn["dmz"] = v
+ }
+ if v, _ := internalAccessSettingsMap["undefined"]; v != nil {
+ internalAccessSettingsMapToReturn["undefined"] = v
+ }
+ if v, _ := internalAccessSettingsMap["vpn"]; v != nil {
+ internalAccessSettingsMapToReturn["vpn"] = v
+ }
+ accessibilityMapToReturn["internal_access_settings"] = []interface{}{internalAccessSettingsMapToReturn}
+ }
+ browserBasedAuthenticationPortalSettingsMapToReturn["accessibility"] = []interface{}{accessibilityMapToReturn}
+ }
+ if v, _ := browserBasedAuthenticationPortalSettingsMap["certificate-settings"]; v != nil {
+ certificateSettingsMap := v.(map[string]interface{})
+ certificateSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := certificateSettingsMap["base64-certificate"]; v != nil {
+ certificateSettingsMapToReturn["base64_certificate"] = v
+ }
+ if v, _ := certificateSettingsMap["base64-password"]; v != nil {
+ certificateSettingsMapToReturn["base64_password"] = v
+ }
+ browserBasedAuthenticationPortalSettingsMapToReturn["certificate_settings"] = []interface{}{certificateSettingsMapToReturn}
+ }
+ if v, _ := browserBasedAuthenticationPortalSettingsMap["portal-web-settings"]; v != nil {
+ portalWebSettingsMap := v.(map[string]interface{})
+ portalWebSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := portalWebSettingsMap["aliases"]; v != nil {
+ portalWebSettingsMapToReturn["aliases"] = v
+ }
+ if v, _ := portalWebSettingsMap["main-url"]; v != nil {
+ portalWebSettingsMapToReturn["main_url"] = v
+ }
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
+ browserBasedAuthenticationPortalSettingsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
+ }
+ browserBasedAuthenticationSettingsMapToReturn["browser_based_authentication_portal_settings"] = []interface{}{browserBasedAuthenticationPortalSettingsMapToReturn}
}
identityAwarenessSettingsMapToReturn["browser_based_authentication_settings"] = []interface{}{browserBasedAuthenticationSettingsMapToReturn}
}
@@ -3253,10 +5507,59 @@ func readManagementSimpleCluster(d *schema.ResourceData, m interface{}) error {
identityAgentSettingsMapToReturn["user_reauthenticate_interval"] = v
}
if v, _ := identityAgentSettingsMap["authentication-settings"]; v != nil {
- identityAgentSettingsMapToReturn["authentication_settings"] = v
+ authenticationSettingsMap := v.(map[string]interface{})
+ authenticationSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := authenticationSettingsMap["authentication-method"]; v != nil {
+ authenticationSettingsMapToReturn["authentication_method"] = v
+ }
+ if v, _ := authenticationSettingsMap["radius"]; v != nil {
+ authenticationSettingsMapToReturn["radius"] = v
+ }
+ if v, _ := authenticationSettingsMap["users-directories"]; v != nil {
+ usersDirectoriesMap := v.(map[string]interface{})
+ usersDirectoriesMapToReturn := make(map[string]interface{})
+ if v, _ := usersDirectoriesMap["external-user-profile"]; v != nil {
+ usersDirectoriesMapToReturn["external_user_profile"] = v
+ }
+ if v, _ := usersDirectoriesMap["internal-users"]; v != nil {
+ usersDirectoriesMapToReturn["internal_users"] = v
+ }
+ if v, _ := usersDirectoriesMap["specific"]; v != nil {
+ usersDirectoriesMapToReturn["specific"] = v
+ }
+ if v, _ := usersDirectoriesMap["users-from-external-directories"]; v != nil {
+ usersDirectoriesMapToReturn["users_from_external_directories"] = v
+ }
+ authenticationSettingsMapToReturn["users_directories"] = []interface{}{usersDirectoriesMapToReturn}
+ }
+ identityAgentSettingsMapToReturn["authentication_settings"] = []interface{}{authenticationSettingsMapToReturn}
}
if v, _ := identityAgentSettingsMap["identity-agent-portal-settings"]; v != nil {
- identityAgentSettingsMapToReturn["identity_agent_portal_settings"] = v
+ identityAgentPortalSettingsMap := v.(map[string]interface{})
+ identityAgentPortalSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := identityAgentPortalSettingsMap["accessibility"]; v != nil {
+ accessibilityMap := v.(map[string]interface{})
+ accessibilityMapToReturn := make(map[string]interface{})
+ if v, _ := accessibilityMap["allow-access-from"]; v != nil {
+ accessibilityMapToReturn["allow_access_from"] = v
+ }
+ if v, _ := accessibilityMap["internal-access-settings"]; v != nil {
+ internalAccessSettingsMap := v.(map[string]interface{})
+ internalAccessSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := internalAccessSettingsMap["dmz"]; v != nil {
+ internalAccessSettingsMapToReturn["dmz"] = v
+ }
+ if v, _ := internalAccessSettingsMap["undefined"]; v != nil {
+ internalAccessSettingsMapToReturn["undefined"] = v
+ }
+ if v, _ := internalAccessSettingsMap["vpn"]; v != nil {
+ internalAccessSettingsMapToReturn["vpn"] = v
+ }
+ accessibilityMapToReturn["internal_access_settings"] = []interface{}{internalAccessSettingsMapToReturn}
+ }
+ identityAgentPortalSettingsMapToReturn["accessibility"] = []interface{}{accessibilityMapToReturn}
+ }
+ identityAgentSettingsMapToReturn["identity_agent_portal_settings"] = []interface{}{identityAgentPortalSettingsMapToReturn}
}
identityAwarenessSettingsMapToReturn["identity_agent_settings"] = []interface{}{identityAgentSettingsMapToReturn}
}
@@ -3274,10 +5577,53 @@ func readManagementSimpleCluster(d *schema.ResourceData, m interface{}) error {
identityCollectorSettingsMapToReturn["authorized_clients"] = v
}
if v, _ := identityCollectorSettingsMap["authentication-settings"]; v != nil {
- identityCollectorSettingsMapToReturn["authentication_settings"] = v
+ authenticationSettingsMap := v.(map[string]interface{})
+ authenticationSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := authenticationSettingsMap["users-directories"]; v != nil {
+ usersDirectoriesMap := v.(map[string]interface{})
+ usersDirectoriesMapToReturn := make(map[string]interface{})
+ if v, _ := usersDirectoriesMap["external-user-profile"]; v != nil {
+ usersDirectoriesMapToReturn["external_user_profile"] = v
+ }
+ if v, _ := usersDirectoriesMap["internal-users"]; v != nil {
+ usersDirectoriesMapToReturn["internal_users"] = v
+ }
+ if v, _ := usersDirectoriesMap["specific"]; v != nil {
+ usersDirectoriesMapToReturn["specific"] = v
+ }
+ if v, _ := usersDirectoriesMap["users-from-external-directories"]; v != nil {
+ usersDirectoriesMapToReturn["users_from_external_directories"] = v
+ }
+ authenticationSettingsMapToReturn["users_directories"] = []interface{}{usersDirectoriesMapToReturn}
+ }
+ identityCollectorSettingsMapToReturn["authentication_settings"] = []interface{}{authenticationSettingsMapToReturn}
}
if v, _ := identityCollectorSettingsMap["client-access-permissions"]; v != nil {
- identityCollectorSettingsMapToReturn["client_access_permissions"] = v
+ clientAccessPermissionsMap := v.(map[string]interface{})
+ clientAccessPermissionsMapToReturn := make(map[string]interface{})
+ if v, _ := clientAccessPermissionsMap["accessibility"]; v != nil {
+ accessibilityMap := v.(map[string]interface{})
+ accessibilityMapToReturn := make(map[string]interface{})
+ if v, _ := accessibilityMap["allow-access-from"]; v != nil {
+ accessibilityMapToReturn["allow_access_from"] = v
+ }
+ if v, _ := accessibilityMap["internal-access-settings"]; v != nil {
+ internalAccessSettingsMap := v.(map[string]interface{})
+ internalAccessSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := internalAccessSettingsMap["dmz"]; v != nil {
+ internalAccessSettingsMapToReturn["dmz"] = v
+ }
+ if v, _ := internalAccessSettingsMap["undefined"]; v != nil {
+ internalAccessSettingsMapToReturn["undefined"] = v
+ }
+ if v, _ := internalAccessSettingsMap["vpn"]; v != nil {
+ internalAccessSettingsMapToReturn["vpn"] = v
+ }
+ accessibilityMapToReturn["internal_access_settings"] = []interface{}{internalAccessSettingsMapToReturn}
+ }
+ clientAccessPermissionsMapToReturn["accessibility"] = []interface{}{accessibilityMapToReturn}
+ }
+ identityCollectorSettingsMapToReturn["client_access_permissions"] = []interface{}{clientAccessPermissionsMapToReturn}
}
identityAwarenessSettingsMapToReturn["identity_collector_settings"] = []interface{}{identityCollectorSettingsMapToReturn}
}
@@ -3297,6 +5643,34 @@ func readManagementSimpleCluster(d *schema.ResourceData, m interface{}) error {
if v, _ := identitySharingSettingsMap["receive-from"]; v != nil {
identitySharingSettingsMapToReturn["receive_from"] = v
}
+ if v, _ := identitySharingSettingsMap["cache-mode"]; v != nil {
+ cacheModeMap := v.(map[string]interface{})
+ cacheModeMapToReturn := make(map[string]interface{})
+ if v, _ := cacheModeMap["override-profile"]; v != nil {
+ cacheModeMapToReturn["override_profile"] = v
+ }
+ if v, _ := cacheModeMap["value"]; v != nil {
+ cacheModeMapToReturn["value"] = v
+ }
+ identitySharingSettingsMapToReturn["cache_mode"] = []interface{}{cacheModeMapToReturn}
+ }
+ if v, _ := identitySharingSettingsMap["cache-mode-duration"]; v != nil {
+ cacheModeDurationMap := v.(map[string]interface{})
+ cacheModeDurationMapToReturn := make(map[string]interface{})
+ if v, _ := cacheModeDurationMap["override-profile"]; v != nil {
+ cacheModeDurationMapToReturn["override_profile"] = v
+ }
+ if v, _ := cacheModeDurationMap["value"]; v != nil {
+ cacheModeDurationMapToReturn["value"] = v
+ }
+ identitySharingSettingsMapToReturn["cache_mode_duration"] = []interface{}{cacheModeDurationMapToReturn}
+ }
+ if v, _ := identitySharingSettingsMap["receive-from-infinity-identity"]; v != nil {
+ identitySharingSettingsMapToReturn["receive_from_infinity_identity"] = v
+ }
+ if v, _ := identitySharingSettingsMap["scaled-sharing"]; v != nil {
+ identitySharingSettingsMapToReturn["scaled_sharing"] = v
+ }
identityAwarenessSettingsMapToReturn["identity_sharing_settings"] = []interface{}{identitySharingSettingsMapToReturn}
}
}
@@ -3315,6 +5689,108 @@ func readManagementSimpleCluster(d *schema.ResourceData, m interface{}) error {
if v := identityAwarenessSettingsMap["remote-access"]; v != nil {
identityAwarenessSettingsMapToReturn["remote_access"] = v
}
+ if v := identityAwarenessSettingsMap["identity-based-enforcement"]; v != nil {
+ identityAwarenessSettingsMapToReturn["identity_based_enforcement"] = v
+ }
+ if v := identityAwarenessSettingsMap["identity-web-api"]; v != nil {
+ identityAwarenessSettingsMapToReturn["identity_web_api"] = v
+ }
+ if v := identityAwarenessSettingsMap["identity-web-api-settings"]; v != nil {
+ identityWebApiSettingsShow := v.(map[string]interface{})
+ identityWebApiSettingsState := make(map[string]interface{})
+ if v := identityWebApiSettingsShow["authentication-settings"]; v != nil {
+ authenticationSettingsShow := v.(map[string]interface{})
+ authenticationSettingsState := make(map[string]interface{})
+ if v := authenticationSettingsShow["users-directories"]; v != nil {
+ usersDirectoriesShow := v.(map[string]interface{})
+ usersDirectoriesState := make(map[string]interface{})
+ if v := usersDirectoriesShow["external-user-profile"]; v != nil {
+ usersDirectoriesState["external_user_profile"] = v
+ }
+ if v := usersDirectoriesShow["internal-users"]; v != nil {
+ usersDirectoriesState["internal_users"] = v
+ }
+ if v := usersDirectoriesShow["specific"]; v != nil {
+ usersDirectoriesState["specific"] = v
+ }
+ if v := usersDirectoriesShow["users-from-external-directories"]; v != nil {
+ usersDirectoriesState["users_from_external_directories"] = v
+ }
+ if v := usersDirectoriesShow["specific"]; v != nil {
+ usersDirectoriesState["specific"] = v
+ }
+ authenticationSettingsState["users_directories"] = []interface{}{usersDirectoriesState}
+ }
+ identityWebApiSettingsState["authentication_settings"] = []interface{}{authenticationSettingsState}
+ }
+ if v := identityWebApiSettingsShow["authorized-clients"]; v != nil {
+ authorizedClientsShow := v.(map[string]interface{})
+ authorizedClientsState := make(map[string]interface{})
+ if v := authorizedClientsShow["client"]; v != nil {
+ authorizedClientsState["client"] = v
+ }
+ identityWebApiSettingsState["authorized_clients"] = []interface{}{authorizedClientsState}
+ }
+ if v := identityWebApiSettingsShow["client-access-permissions"]; v != nil {
+ clientAccessPermissionsShow := v.(map[string]interface{})
+ clientAccessPermissionsState := make(map[string]interface{})
+ if v := clientAccessPermissionsShow["accessibility"]; v != nil {
+ accessibilityShow := v.(map[string]interface{})
+ accessibilityState := make(map[string]interface{})
+ if v := accessibilityShow["allow-access-from"]; v != nil {
+ accessibilityState["allow_access_from"] = v
+ }
+ if v := accessibilityShow["internal-access-settings"]; v != nil {
+ internalAccessSettingsShow := v.(map[string]interface{})
+ internalAccessSettingsState := make(map[string]interface{})
+ if v := internalAccessSettingsShow["dmz"]; v != nil {
+ internalAccessSettingsState["dmz"] = v
+ }
+ if v := internalAccessSettingsShow["undefined"]; v != nil {
+ internalAccessSettingsState["undefined"] = v
+ }
+ if v := internalAccessSettingsShow["vpn"]; v != nil {
+ internalAccessSettingsState["vpn"] = v
+ }
+ accessibilityState["internal_access_settings"] = []interface{}{internalAccessSettingsState}
+ }
+ clientAccessPermissionsState["accessibility"] = []interface{}{accessibilityState}
+ }
+ if v := clientAccessPermissionsShow["certificate-settings"]; v != nil {
+ certificateSettingsShow := v.(map[string]interface{})
+ certificateSettingsState := make(map[string]interface{})
+ if v := certificateSettingsShow["certificate"]; v != nil {
+ certificateSettingsState["certificate"] = v
+ }
+ if v := certificateSettingsShow["certificate-dn"]; v != nil {
+ certificateSettingsState["certificate_dn"] = v
+ }
+ if v := certificateSettingsShow["certificate-valid-from"]; v != nil {
+ certificateSettingsState["certificate_valid_from"] = v
+ }
+ if v := certificateSettingsShow["certificate-valid-to"]; v != nil {
+ certificateSettingsState["certificate_valid_to"] = v
+ }
+ clientAccessPermissionsState["certificate_settings"] = []interface{}{certificateSettingsState}
+ }
+ if v := clientAccessPermissionsShow["portal-web-settings"]; v != nil {
+ portalWebSettingsShow := v.(map[string]interface{})
+ portalWebSettingsState := make(map[string]interface{})
+ if v := portalWebSettingsShow["aliases"]; v != nil {
+ portalWebSettingsState["aliases"] = v
+ }
+ if v := portalWebSettingsShow["ip-address"]; v != nil {
+ portalWebSettingsState["ip_address"] = v
+ }
+ if v := portalWebSettingsShow["main-url"]; v != nil {
+ portalWebSettingsState["main_url"] = v
+ }
+ clientAccessPermissionsState["portal_web_settings"] = []interface{}{portalWebSettingsState}
+ }
+ identityWebApiSettingsState["client_access_permissions"] = []interface{}{clientAccessPermissionsState}
+ }
+ identityAwarenessSettingsMapToReturn["identity_web_api_settings"] = []interface{}{identityWebApiSettingsState}
+ }
_ = d.Set("identity_awareness_settings", []interface{}{identityAwarenessSettingsMapToReturn})
}
@@ -3354,6 +5830,9 @@ func readManagementSimpleCluster(d *schema.ResourceData, m interface{}) error {
if v := natSettingsMap["method"]; v != nil {
natSettingsMapToReturn["method"] = v
}
+ if v := natSettingsMap["apply-control-connections"]; v != nil {
+ natSettingsMapToReturn["apply_control_connections"] = v
+ }
_ = d.Set("nat_settings", []interface{}{natSettingsMapToReturn})
} else {
@@ -3379,6 +5858,9 @@ func readManagementSimpleCluster(d *schema.ResourceData, m interface{}) error {
if v, _ := portalWebSettingsMap["main-url"]; v != nil {
portalWebSettingsMapToReturn["main_url"] = v
}
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
platformPortalSettingsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
}
}
@@ -3466,6 +5948,9 @@ func readManagementSimpleCluster(d *schema.ResourceData, m interface{}) error {
if v, _ := portalWebSettingsMap["main-url"]; v != nil {
portalWebSettingsMapToReturn["main_url"] = v
}
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
usercheckPortalSettingsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
}
}
@@ -3852,7 +6337,139 @@ func readManagementSimpleCluster(d *schema.ResourceData, m interface{}) error {
clientsIds = append(clientsIds, client.(map[string]interface{})["name"].(string))
}
}
- authenticationState["authentication_clients"] = clientsIds
+ authenticationState["authentication_clients"] = clientsIds
+ }
+ if v := authenticationJson["single-authentication-client"]; v != nil {
+ singleAuthenticationClientJson := v.(map[string]interface{})
+ singleAuthenticationClientState := make(map[string]interface{})
+ if v := singleAuthenticationClientJson["enabled"]; v != nil {
+ singleAuthenticationClientState["enabled"] = v
+ }
+ if v := singleAuthenticationClientJson["allow-multiple-authentication-clients"]; v != nil {
+ singleAuthenticationClientState["allow_multiple_authentication_clients"] = v
+ }
+ if v := singleAuthenticationClientJson["display-name"]; v != nil {
+ singleAuthenticationClientState["display_name"] = v
+ }
+ if v := singleAuthenticationClientJson["method"]; v != nil {
+ singleAuthenticationClientState["method"] = v
+ }
+ if v := singleAuthenticationClientJson["secur-id"]; v != nil {
+ securIdJson := v.(map[string]interface{})
+ securIdState := make(map[string]interface{})
+ if v := securIdJson["server"]; v != nil {
+ securIdState["server"] = v.(map[string]interface{})["name"]
+ }
+ if v := securIdJson["token-card-type"]; v != nil {
+ securIdState["token_card_type"] = v
+ }
+ singleAuthenticationClientState["secur_id"] = []interface{}{securIdState}
+ }
+ if v := singleAuthenticationClientJson["radius"]; v != nil {
+ radiusJson := v.(map[string]interface{})
+ radiusState := make(map[string]interface{})
+ if v := radiusJson["server"]; v != nil {
+ radiusState["server"] = v.(map[string]interface{})["name"]
+ }
+ if v := radiusJson["ask-user-password"]; v != nil {
+ radiusState["ask_user_password"] = v
+ }
+ singleAuthenticationClientState["radius"] = []interface{}{radiusState}
+ }
+ if v := singleAuthenticationClientJson["personal-certificate"]; v != nil {
+ personalCertificateJson := v.(map[string]interface{})
+ personalCertificateState := make(map[string]interface{})
+ if v := personalCertificateJson["fetch-username-from"]; v != nil {
+ personalCertificateState["fetch_username_from"] = v
+ }
+ if v := personalCertificateJson["storage-type"]; v != nil {
+ personalCertificateState["storage_type"] = v
+ }
+ if v := personalCertificateJson["source"]; v != nil {
+ personalCertificateState["source"] = v
+ }
+ if v := personalCertificateJson["dn-part"]; v != nil {
+ personalCertificateState["dn_part"] = v
+ }
+ if v := personalCertificateJson["dn-concurrence"]; v != nil {
+ personalCertificateState["dn_concurrence"] = v
+ }
+ singleAuthenticationClientState["personal_certificate"] = []interface{}{personalCertificateState}
+ }
+ if v := singleAuthenticationClientJson["client-display-settings"]; v != nil {
+ clientDisplaySettingsJson := v.(map[string]interface{})
+ clientDisplaySettingsState := make(map[string]interface{})
+ if v := clientDisplaySettingsJson["headline"]; v != nil {
+ clientDisplaySettingsState["headline"] = v
+ }
+ if v := clientDisplaySettingsJson["username-label"]; v != nil {
+ clientDisplaySettingsState["username_label"] = v
+ }
+ if v := clientDisplaySettingsJson["password-label"]; v != nil {
+ clientDisplaySettingsState["password_label"] = v
+ }
+ singleAuthenticationClientState["client_display_settings"] = []interface{}{clientDisplaySettingsState}
+ }
+ authenticationState["single_authentication_client"] = []interface{}{singleAuthenticationClientState}
+ }
+ if v := authenticationJson["override-global-dynamic-id-settings"]; v != nil {
+ authenticationState["override_global_dynamic_id_settings"] = v
+ }
+ if v := authenticationJson["dynamic-id-settings"]; v != nil {
+ dynamicIdSettingsJson := v.(map[string]interface{})
+ dynamicIdSettingsState := make(map[string]interface{})
+ if v := dynamicIdSettingsJson["sms-provider-and-email-settings"]; v != nil {
+ dynamicIdSettingsState["sms_provider_and_email_settings"] = v
+ }
+ if v := dynamicIdSettingsJson["sms-provider-credentials"]; v != nil {
+ smsProviderCredentialsJson := v.(map[string]interface{})
+ smsProviderCredentialsState := make(map[string]interface{})
+ if v := smsProviderCredentialsJson["username"]; v != nil {
+ smsProviderCredentialsState["username"] = v
+ }
+ if v := smsProviderCredentialsJson["password"]; v != nil {
+ smsProviderCredentialsState["password"] = v
+ }
+ if v := smsProviderCredentialsJson["api-id"]; v != nil {
+ smsProviderCredentialsState["api_id"] = v
+ }
+ dynamicIdSettingsState["sms_provider_credentials"] = []interface{}{smsProviderCredentialsState}
+ }
+ if v := dynamicIdSettingsJson["advanced-settings"]; v != nil {
+ advancedSettingsJson := v.(map[string]interface{})
+ advancedSettingsState := make(map[string]interface{})
+ if v := advancedSettingsJson["dynamic-id-message"]; v != nil {
+ advancedSettingsState["dynamic_id_message"] = v
+ }
+ if v := advancedSettingsJson["otp-settings"]; v != nil {
+ otpSettingsJson := v.(map[string]interface{})
+ otpSettingsState := make(map[string]interface{})
+ if v := otpSettingsJson["length"]; v != nil {
+ otpSettingsState["length"] = v
+ }
+ if v := otpSettingsJson["expiration"]; v != nil {
+ otpSettingsState["expiration"] = v
+ }
+ if v := otpSettingsJson["max-attempts"]; v != nil {
+ otpSettingsState["max_attempts"] = v
+ }
+ advancedSettingsState["otp_settings"] = []interface{}{otpSettingsState}
+ }
+ if v := advancedSettingsJson["enable-display-user-details"]; v != nil {
+ advancedSettingsState["enable_display_user_details"] = v
+ }
+ if v := advancedSettingsJson["country-code"]; v != nil {
+ advancedSettingsState["country_code"] = v
+ }
+ if v := advancedSettingsJson["user-details-retrieval"]; v != nil {
+ advancedSettingsState["user_details_retrieval"] = v
+ }
+ dynamicIdSettingsState["advanced_settings"] = []interface{}{advancedSettingsState}
+ }
+ authenticationState["dynamic_id_settings"] = []interface{}{dynamicIdSettingsState}
+ }
+ if v := authenticationJson["send-machine-certificate"]; v != nil {
+ authenticationState["send_machine_certificate"] = v
}
vpnSettingsState["authentication"] = []interface{}{authenticationState}
}
@@ -3869,6 +6486,41 @@ func readManagementSimpleCluster(d *schema.ResourceData, m interface{}) error {
if v := linkSelectionJson["ip-address"]; v != nil {
linkSelectionState["ip_address"] = v
}
+ if v := linkSelectionJson["route-selection-method"]; v != nil {
+ linkSelectionState["route_selection_method"] = v
+ }
+ if v := linkSelectionJson["responding-traffic"]; v != nil {
+ linkSelectionState["responding_traffic"] = v
+ }
+ if v := linkSelectionJson["source-ip-selection"]; v != nil {
+ linkSelectionState["source_ip_selection"] = v
+ }
+ if v := linkSelectionJson["selected-ip"]; v != nil {
+ linkSelectionState["selected_ip"] = v
+ }
+ if v := linkSelectionJson["outgoing-link-tracking"]; v != nil {
+ linkSelectionState["outgoing_link_tracking"] = v
+ }
+ if v := linkSelectionJson["probing-settings"]; v != nil {
+ probingSettingsJson := v.(map[string]interface{})
+ probingSettingsState := make(map[string]interface{})
+ if v := probingSettingsJson["probed-interfaces"]; v != nil {
+ probingSettingsState["probed_interfaces"] = v
+ }
+ if v := probingSettingsJson["probed-interface-list"]; v != nil {
+ probingSettingsState["probed_interface_list"] = v
+ }
+ if v := probingSettingsJson["use-primary-address"]; v != nil {
+ probingSettingsState["use_primary_address"] = v
+ }
+ if v := probingSettingsJson["primary-address"]; v != nil {
+ probingSettingsState["primary_address"] = v
+ }
+ if v := probingSettingsJson["probing-method"]; v != nil {
+ probingSettingsState["probing_method"] = v
+ }
+ linkSelectionState["probing_settings"] = []interface{}{probingSettingsState}
+ }
vpnSettingsState["link_selection"] = []interface{}{linkSelectionState}
}
if v := vpnSettingsJson["maximum-concurrent-ike-negotiations"]; v != nil {
@@ -4012,6 +6664,172 @@ func readManagementSimpleCluster(d *schema.ResourceData, m interface{}) error {
}
vpnSettingsState["office_mode"] = []interface{}{officeModeState}
}
+
+ if v := vpnSettingsJson["advanced"]; v != nil {
+ advancedJson := v.(map[string]interface{})
+ advancedState := make(map[string]interface{})
+ if v := advancedJson["tunnel-sharing-mode"]; v != nil {
+ advancedState["tunnel_sharing_mode"] = v
+ }
+ if v := advancedJson["shutdown-on-gateway-restart"]; v != nil {
+ advancedState["shutdown_on_gateway_restart"] = v
+ }
+ if v := advancedJson["enable-wire-mode"]; v != nil {
+ advancedState["enable_wire_mode"] = v
+ }
+ if v := advancedJson["wire-mode-interfaces"]; v != nil {
+ interfacesJson := v.([]interface{})
+ var interfacesIds = make([]string, 0)
+ if len(interfacesJson) > 0 {
+ for _, iface := range interfacesJson {
+ interfacesIds = append(interfacesIds, iface.(map[string]interface{})["name"].(string))
+ }
+ }
+ advancedState["wire_mode_interfaces"] = interfacesIds
+ }
+ if v := advancedJson["enable-wire-mode-log-traffic"]; v != nil {
+ advancedState["enable_wire_mode_log_traffic"] = v
+ }
+ if v := advancedJson["enable-nat-traversal"]; v != nil {
+ advancedState["enable_nat_traversal"] = v
+ }
+ vpnSettingsState["advanced"] = []interface{}{advancedState}
+ }
+
+ if v := vpnSettingsJson["exported-routes"]; v != nil {
+ exportedRoutesJson := v.(map[string]interface{})
+ exportedRoutesState := make(map[string]interface{})
+ if v := exportedRoutesJson["internal-interfaces"]; v != nil {
+ exportedRoutesState["internal_interfaces"] = v
+ }
+ if v := exportedRoutesJson["static-routes"]; v != nil {
+ exportedRoutesState["static_routes"] = v
+ }
+ if v := exportedRoutesJson["custom-routes"]; v != nil {
+ exportedRoutesState["custom_routes"] = v
+ }
+ if v := exportedRoutesJson["custom-routes-object"]; v != nil {
+ exportedRoutesState["custom_routes_object"] = v.(map[string]interface{})["name"]
+ }
+ vpnSettingsState["exported_routes"] = []interface{}{exportedRoutesState}
+ }
+
+ if v := vpnSettingsJson["vpn-clients"]; v != nil {
+ vpnClientsJson := v.(map[string]interface{})
+ vpnClientsState := make(map[string]interface{})
+ if v := vpnClientsJson["enable-endpoint-security-vpn"]; v != nil {
+ vpnClientsState["enable_endpoint_security_vpn"] = v
+ }
+ if v := vpnClientsJson["enable-cp-mobile-for-windows"]; v != nil {
+ vpnClientsState["enable_cp_mobile_for_windows"] = v
+ }
+ if v := vpnClientsJson["enable-secu-remote"]; v != nil {
+ vpnClientsState["enable_secu_remote"] = v
+ }
+ if v := vpnClientsJson["enable-capsule-vpn-connect"]; v != nil {
+ vpnClientsState["enable_capsule_vpn_connect"] = v
+ }
+ if v := vpnClientsJson["enable-ssl-network-extender"]; v != nil {
+ vpnClientsState["enable_ssl_network_extender"] = v
+ }
+ if v := vpnClientsJson["gateway-authentication-certificate"]; v != nil {
+ vpnClientsState["gateway_authentication_certificate"] = v
+ }
+ vpnSettingsState["vpn_clients"] = []interface{}{vpnClientsState}
+ }
+
+ if v := vpnSettingsJson["enable-clientless-vpn"]; v != nil {
+ vpnSettingsState["enable_clientless_vpn"] = v
+ }
+
+ if v := vpnSettingsJson["clientless-vpn-settings"]; v != nil {
+ clientlessVpnSettingsJson := v.(map[string]interface{})
+ clientlessVpnSettingsState := make(map[string]interface{})
+ if v := clientlessVpnSettingsJson["certificate-gateway-authentication"]; v != nil {
+ clientlessVpnSettingsState["certificate_gateway_authentication"] = v
+ }
+ if v := clientlessVpnSettingsJson["client-authentication"]; v != nil {
+ clientlessVpnSettingsState["client_authentication"] = v
+ }
+ if v := clientlessVpnSettingsJson["concurrent-servers-or-processes"]; v != nil {
+ clientlessVpnSettingsState["concurrent_servers_or_processes"] = v
+ }
+ if v := clientlessVpnSettingsJson["accept-only-3des"]; v != nil {
+ clientlessVpnSettingsState["accept_only_3des"] = v
+ }
+ vpnSettingsState["clientless_vpn_settings"] = []interface{}{clientlessVpnSettingsState}
+ }
+
+ if v := vpnSettingsJson["saml-portal-settings"]; v != nil {
+ samlPortalSettingsJson := v.(map[string]interface{})
+ samlPortalSettingsState := make(map[string]interface{})
+ if v := samlPortalSettingsJson["portal-web-settings"]; v != nil {
+ portalWebSettingsJson := v.(map[string]interface{})
+ portalWebSettingsState := make(map[string]interface{})
+ if v := portalWebSettingsJson["aliases"]; v != nil {
+ portalWebSettingsState["aliases"] = v
+ }
+ if v := portalWebSettingsJson["ip-address"]; v != nil {
+ portalWebSettingsState["ip_address"] = v
+ }
+ if v := portalWebSettingsJson["main-url"]; v != nil {
+ portalWebSettingsState["main_url"] = v
+ }
+ samlPortalSettingsState["portal_web_settings"] = []interface{}{portalWebSettingsState}
+ }
+ if v := samlPortalSettingsJson["accessibility"]; v != nil {
+ accessibilityJson := v.(map[string]interface{})
+ accessibilityState := make(map[string]interface{})
+ if v := accessibilityJson["allow-access-from"]; v != nil {
+ accessibilityState["allow_access_from"] = v
+ }
+ if v := accessibilityJson["internal-access-settings"]; v != nil {
+ internalAccessSettingsJson := v.(map[string]interface{})
+ internalAccessSettingsState := make(map[string]interface{})
+ if v := internalAccessSettingsJson["undefined"]; v != nil {
+ internalAccessSettingsState["undefined"] = v
+ }
+ if v := internalAccessSettingsJson["dmz"]; v != nil {
+ internalAccessSettingsState["dmz"] = v
+ }
+ if v := internalAccessSettingsJson["vpn"]; v != nil {
+ internalAccessSettingsState["vpn"] = v
+ }
+ accessibilityState["internal_access_settings"] = []interface{}{internalAccessSettingsState}
+ }
+ samlPortalSettingsState["accessibility"] = []interface{}{accessibilityState}
+ }
+ vpnSettingsState["saml_portal_settings"] = []interface{}{samlPortalSettingsState}
+ }
+
+ if v := vpnSettingsJson["interfaces"]; v != nil {
+ interfacesList := v.([]interface{})
+ var interfacesListState []map[string]interface{}
+ for i := range interfacesList {
+ interfacesShow := interfacesList[i].(map[string]interface{})
+ interfacesState := make(map[string]interface{})
+ if v := interfacesShow["interface-name"]; v != nil {
+ interfacesState["interface_name"] = v
+ }
+ if v := interfacesShow["ip-version"]; v != nil {
+ interfacesState["ip_version"] = v
+ }
+ if v := interfacesShow["next-hop-ip"]; v != nil {
+ interfacesState["next_hop_ip"] = v
+ }
+ if v := interfacesShow["priority"]; v != nil {
+ interfacesState["priority"] = v
+ }
+ if v := interfacesShow["redundancy-mode"]; v != nil {
+ interfacesState["redundancy_mode"] = v
+ }
+ if v := interfacesShow["static-nat-ip"]; v != nil {
+ interfacesState["static_nat_ip"] = v
+ }
+ interfacesListState = append(interfacesListState, interfacesState)
+ }
+ vpnSettingsState["interfaces"] = interfacesListState
+ }
_ = d.Set("vpn_settings", []interface{}{vpnSettingsState})
} else {
_ = d.Set("vpn_settings", nil)
@@ -4038,6 +6856,262 @@ func readManagementSimpleCluster(d *schema.ResourceData, m interface{}) error {
_ = d.Set("color", v)
}
+ if v := cluster["anti-spam-and-email-security"]; v != nil {
+ _ = d.Set("anti_spam_and_email_security", v)
+ }
+
+ if v := cluster["auto-topology-custom-recalculation-time"]; v != nil {
+ _ = d.Set("auto_topology_custom_recalculation_time", v)
+ }
+
+ if v := cluster["auto-topology-use-custom-recalculation-time"]; v != nil {
+ _ = d.Set("auto_topology_use_custom_recalculation_time", v)
+ }
+
+ if v := cluster["data-loss-prevention"]; v != nil {
+ _ = d.Set("data_loss_prevention", v)
+ }
+
+ if v := cluster["mobile-access"]; v != nil {
+ _ = d.Set("mobile_access", v)
+ }
+
+ if v := cluster["monitoring"]; v != nil {
+ _ = d.Set("monitoring", v)
+ }
+
+ if v := cluster["policy-server"]; v != nil {
+ _ = d.Set("policy_server", v)
+ }
+
+ if v := cluster["rtm-counters-report"]; v != nil {
+ _ = d.Set("rtm_counters_report", v)
+ }
+
+ if v := cluster["rtm-traffic-report"]; v != nil {
+ _ = d.Set("rtm_traffic_report", v)
+ }
+
+ if v := cluster["rtm-traffic-report-per-connection"]; v != nil {
+ _ = d.Set("rtm_traffic_report_per_connection", v)
+ }
+
+ if v := cluster["threat-extraction"]; v != nil {
+ _ = d.Set("threat_extraction", v)
+ }
+
+ if v := cluster["threat-prevention-mode"]; v != nil {
+ _ = d.Set("threat_prevention_mode", v)
+ }
+
+ if v := cluster["workforce-ai"]; v != nil {
+ _ = d.Set("workforce_ai", v)
+ }
+
+ if v := cluster["application-control-and-url-filtering-settings"]; v != nil {
+ applicationControlAndUrlFilteringSettingsJson := v.(map[string]interface{})
+ applicationControlAndUrlFilteringSettingsState := make(map[string]interface{})
+ if v := applicationControlAndUrlFilteringSettingsJson["global-settings-mode"]; v != nil {
+ applicationControlAndUrlFilteringSettingsState["global_settings_mode"] = v
+ }
+ if v := applicationControlAndUrlFilteringSettingsJson["override-global-settings"]; v != nil {
+ overrideGlobalSettingsJson := v.(map[string]interface{})
+ overrideGlobalSettingsState := make(map[string]interface{})
+ if v := overrideGlobalSettingsJson["fail-mode"]; v != nil {
+ overrideGlobalSettingsState["fail_mode"] = v
+ }
+ if v := overrideGlobalSettingsJson["website-categorization"]; v != nil {
+ websiteCategorizationJson := v.(map[string]interface{})
+ websiteCategorizationState := make(map[string]interface{})
+ if v := websiteCategorizationJson["custom-mode"]; v != nil {
+ customModeJson := v.(map[string]interface{})
+ customModeState := make(map[string]interface{})
+ if v := customModeJson["social-networking-widgets"]; v != nil {
+ customModeState["social_networking_widgets"] = v
+ }
+ if v := customModeJson["url-filtering"]; v != nil {
+ customModeState["url_filtering"] = v
+ }
+ websiteCategorizationState["custom_mode"] = []interface{}{customModeState}
+ }
+ if v := websiteCategorizationJson["mode"]; v != nil {
+ websiteCategorizationState["mode"] = v
+ }
+ overrideGlobalSettingsState["website_categorization"] = []interface{}{websiteCategorizationState}
+ }
+ applicationControlAndUrlFilteringSettingsState["override_global_settings"] = []interface{}{overrideGlobalSettingsState}
+ }
+ _ = d.Set("application_control_and_url_filtering_settings", []interface{}{applicationControlAndUrlFilteringSettingsState})
+ }
+
+ if v := cluster["cluster-settings"]; v != nil {
+ clusterSettingsJson := v.(map[string]interface{})
+ clusterSettingsState := make(map[string]interface{})
+ if v := clusterSettingsJson["member-recovery-mode"]; v != nil {
+ clusterSettingsState["member_recovery_mode"] = v
+ }
+ if v := clusterSettingsJson["state-synchronization"]; v != nil {
+ stateSynchronizationJson := v.(map[string]interface{})
+ stateSynchronizationState := make(map[string]interface{})
+ if v := stateSynchronizationJson["delayed"]; v != nil {
+ stateSynchronizationState["delayed"] = v
+ }
+ if v := stateSynchronizationJson["delayed-seconds"]; v != nil {
+ stateSynchronizationState["delayed_seconds"] = v
+ }
+ if v := stateSynchronizationJson["enabled"]; v != nil {
+ stateSynchronizationState["enabled"] = v
+ }
+ clusterSettingsState["state_synchronization"] = []interface{}{stateSynchronizationState}
+ }
+ if v := clusterSettingsJson["track-changes-of-cluster-members"]; v != nil {
+ clusterSettingsState["track_changes_of_cluster_members"] = v
+ }
+ if v := clusterSettingsJson["use-virtual-mac"]; v != nil {
+ clusterSettingsState["use_virtual_mac"] = v
+ }
+ _ = d.Set("cluster_settings", []interface{}{clusterSettingsState})
+ }
+
+ if v := cluster["communication-with-servers-behind-nat"]; v != nil {
+ communicationWithServersBehindNatJson := v.(map[string]interface{})
+ communicationWithServersBehindNatState := make(map[string]interface{})
+ if v := communicationWithServersBehindNatJson["override-profile"]; v != nil {
+ communicationWithServersBehindNatState["override_profile"] = v
+ }
+ if v := communicationWithServersBehindNatJson["value"]; v != nil {
+ communicationWithServersBehindNatState["value"] = v
+ }
+ _ = d.Set("communication_with_servers_behind_nat", []interface{}{communicationWithServersBehindNatState})
+ }
+
+ if v := cluster["zero-phishing-settings"]; v != nil {
+ zeroPhishingSettingsJson := v.(map[string]interface{})
+ zeroPhishingSettingsState := make(map[string]interface{})
+ if v := zeroPhishingSettingsJson["gateway-fqdn-mode"]; v != nil {
+ zeroPhishingSettingsState["gateway_fqdn_mode"] = v
+ }
+ if v := zeroPhishingSettingsJson["manual-fqdn"]; v != nil {
+ zeroPhishingSettingsState["manual_fqdn"] = v
+ }
+ _ = d.Set("zero_phishing_settings", []interface{}{zeroPhishingSettingsState})
+ }
+
+ if v := cluster["dns-server"]; v != nil {
+ _ = d.Set("dns_server", v)
+ }
+
+ if v := cluster["logs-settings"]; v != nil {
+ logsSettingsShow := v.(map[string]interface{})
+ logsSettingsState := make(map[string]interface{})
+ if v := logsSettingsShow["alert-when-free-disk-space-below"]; v != nil {
+ logsSettingsState["alert_when_free_disk_space_below"] = v
+ }
+ if v := logsSettingsShow["alert-when-free-disk-space-below-metrics"]; v != nil {
+ logsSettingsState["alert_when_free_disk_space_below_metrics"] = v
+ }
+ if v := logsSettingsShow["alert-when-free-disk-space-below-threshold"]; v != nil {
+ logsSettingsState["alert_when_free_disk_space_below_threshold"] = v
+ }
+ if v := logsSettingsShow["alert-when-free-disk-space-below-type"]; v != nil {
+ logsSettingsState["alert_when_free_disk_space_below_type"] = v
+ }
+ if v := logsSettingsShow["before-delete-keep-logs-from-the-last-days"]; v != nil {
+ logsSettingsState["before_delete_keep_logs_from_the_last_days"] = v
+ }
+ if v := logsSettingsShow["before-delete-keep-logs-from-the-last-days-threshold"]; v != nil {
+ logsSettingsState["before_delete_keep_logs_from_the_last_days_threshold"] = v
+ }
+ if v := logsSettingsShow["before-delete-run-script"]; v != nil {
+ logsSettingsState["before_delete_run_script"] = v
+ }
+ if v := logsSettingsShow["before-delete-run-script-command"]; v != nil {
+ logsSettingsState["before_delete_run_script_command"] = v
+ }
+ if v := logsSettingsShow["delete-index-files-older-than-days"]; v != nil {
+ logsSettingsState["delete_index_files_older_than_days"] = v
+ }
+ if v := logsSettingsShow["delete-index-files-older-than-days-threshold"]; v != nil {
+ logsSettingsState["delete_index_files_older_than_days_threshold"] = v
+ }
+ if v := logsSettingsShow["delete-index-files-when-index-size-above"]; v != nil {
+ logsSettingsState["delete_index_files_when_index_size_above"] = v
+ }
+ if v := logsSettingsShow["delete-index-files-when-index-size-above-metrics"]; v != nil {
+ logsSettingsState["delete_index_files_when_index_size_above_metrics"] = v
+ }
+ if v := logsSettingsShow["delete-index-files-when-index-size-above-threshold"]; v != nil {
+ logsSettingsState["delete_index_files_when_index_size_above_threshold"] = v
+ }
+ if v := logsSettingsShow["delete-when-free-disk-space-below"]; v != nil {
+ logsSettingsState["delete_when_free_disk_space_below"] = v
+ }
+ if v := logsSettingsShow["delete-when-free-disk-space-below-metrics"]; v != nil {
+ logsSettingsState["delete_when_free_disk_space_below_metrics"] = v
+ }
+ if v := logsSettingsShow["delete-when-free-disk-space-below-threshold"]; v != nil {
+ logsSettingsState["delete_when_free_disk_space_below_threshold"] = v
+ }
+ if v := logsSettingsShow["detect-new-citrix-ica-application-names"]; v != nil {
+ logsSettingsState["detect_new_citrix_ica_application_names"] = v
+ }
+ if v := logsSettingsShow["distribute-logs-between-all-active-servers"]; v != nil {
+ logsSettingsState["distribute_logs_between_all_active_servers"] = v
+ }
+ if v := logsSettingsShow["forward-logs-to-log-server"]; v != nil {
+ logsSettingsState["forward_logs_to_log_server"] = v
+ }
+ if v := logsSettingsShow["forward-logs-to-log-server-name"]; v != nil {
+ logsSettingsState["forward_logs_to_log_server_name"] = v
+ }
+ if v := logsSettingsShow["forward-logs-to-log-server-schedule-name"]; v != nil {
+ logsSettingsState["forward_logs_to_log_server_schedule_name"] = v
+ }
+ if v := logsSettingsShow["include-tcp-state-information"]; v != nil {
+ logsSettingsState["include_tcp_state_information"] = v
+ }
+ if v := logsSettingsShow["perform-log-rotate-before-log-forwarding"]; v != nil {
+ logsSettingsState["perform_log_rotate_before_log_forwarding"] = v
+ }
+ if v := logsSettingsShow["reject-connections-when-free-disk-space-below-threshold"]; v != nil {
+ logsSettingsState["reject_connections_when_free_disk_space_below_threshold"] = v
+ }
+ if v := logsSettingsShow["reserve-for-packet-capture-metrics"]; v != nil {
+ logsSettingsState["reserve_for_packet_capture_metrics"] = v
+ }
+ if v := logsSettingsShow["reserve-for-packet-capture-threshold"]; v != nil {
+ logsSettingsState["reserve_for_packet_capture_threshold"] = v
+ }
+ if v := logsSettingsShow["rotate-log-by-file-size"]; v != nil {
+ logsSettingsState["rotate_log_by_file_size"] = v
+ }
+ if v := logsSettingsShow["rotate-log-file-size-threshold"]; v != nil {
+ logsSettingsState["rotate_log_file_size_threshold"] = v
+ }
+ if v := logsSettingsShow["rotate-log-on-schedule"]; v != nil {
+ logsSettingsState["rotate_log_on_schedule"] = v
+ }
+ if v := logsSettingsShow["rotate-log-schedule-name"]; v != nil {
+ logsSettingsState["rotate_log_schedule_name"] = v
+ }
+ if v := logsSettingsShow["stop-logging-when-free-disk-space-below"]; v != nil {
+ logsSettingsState["stop_logging_when_free_disk_space_below"] = v
+ }
+ if v := logsSettingsShow["stop-logging-when-free-disk-space-below-metrics"]; v != nil {
+ logsSettingsState["stop_logging_when_free_disk_space_below_metrics"] = v
+ }
+ if v := logsSettingsShow["stop-logging-when-free-disk-space-below-threshold"]; v != nil {
+ logsSettingsState["stop_logging_when_free_disk_space_below_threshold"] = v
+ }
+ if v := logsSettingsShow["turn-on-qos-logging"]; v != nil {
+ logsSettingsState["turn_on_qos_logging"] = v
+ }
+ if v := logsSettingsShow["update-account-log-every"]; v != nil {
+ logsSettingsState["update_account_log_every"] = v
+ }
+ _ = d.Set("logs_settings", []interface{}{logsSettingsState})
+ }
+
return nil
}
@@ -4204,6 +7278,42 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
}
httpsInspectionPayload["deny-expired-server-cert"] = denyExpiredServerCertPayload
}
+ if _, ok := d.GetOk("https_inspection.0.bypass_on_client_failure"); ok {
+
+ bypassOnClientFailurePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("https_inspection.0.bypass_on_client_failure.0.override_profile"); ok {
+ bypassOnClientFailurePayload["override-profile"] = strconv.FormatBool(v.(bool))
+ }
+ if v, ok := d.GetOk("https_inspection.0.bypass_on_client_failure.0.value"); ok {
+ bypassOnClientFailurePayload["value"] = strconv.FormatBool(v.(bool))
+ }
+ httpsInspectionPayload["bypass-on-client-failure"] = bypassOnClientFailurePayload
+ }
+ if _, ok := d.GetOk("https_inspection.0.bypass_under_load"); ok {
+
+ bypassUnderLoadPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("https_inspection.0.bypass_under_load.0.value"); ok {
+ bypassUnderLoadPayload["value"] = strconv.FormatBool(v.(bool))
+ }
+ httpsInspectionPayload["bypass-under-load"] = bypassUnderLoadPayload
+ }
+ if _, ok := d.GetOk("https_inspection.0.outbound_certificate"); ok {
+
+ outboundCertificatePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("https_inspection.0.outbound_certificate.0.override_profile"); ok {
+ outboundCertificatePayload["override-profile"] = strconv.FormatBool(v.(bool))
+ }
+ if v, ok := d.GetOk("https_inspection.0.outbound_certificate.0.value"); ok {
+ outboundCertificatePayload["value"] = v.(string)
+ }
+ httpsInspectionPayload["outbound-certificate"] = outboundCertificatePayload
+ }
+ if v, ok := d.GetOk("https_inspection.0.deployment_mode"); ok {
+ httpsInspectionPayload["deployment-mode"] = v.(string)
+ }
cluster["https-inspection"] = httpsInspectionPayload
}
}
@@ -4232,11 +7342,93 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
browserBasedAuthenticationSettingsPayload := make(map[string]interface{})
- if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings"); ok {
- browserBasedAuthenticationSettingsPayload["authentication-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings"); ok {
+ authenticationSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.authentication_method"); ok {
+ authenticationSettingsPayload["authentication-method"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.identity_provider"); ok {
+ authenticationSettingsPayload["identity-provider"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.radius"); ok {
+ authenticationSettingsPayload["radius"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories"); ok {
+
+ usersDirectoriesPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.external_user_profile"); ok {
+ usersDirectoriesPayload["external-user-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.internal_users"); ok {
+ usersDirectoriesPayload["internal-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.specific"); ok {
+ usersDirectoriesPayload["specific"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.users_from_external_directories"); ok {
+ usersDirectoriesPayload["users-from-external-directories"] = v.(string)
+ }
+ authenticationSettingsPayload["users-directories"] = usersDirectoriesPayload
+ }
+ browserBasedAuthenticationSettingsPayload["authentication-settings"] = authenticationSettingsPayload
}
- if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings"); ok {
- browserBasedAuthenticationSettingsPayload["browser-based-authentication-portal-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings"); ok {
+ browserBasedAuthenticationPortalSettingsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility"); ok {
+
+ accessibilityPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.allow_access_from"); ok {
+ accessibilityPayload["allow-access-from"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings"); ok {
+
+ internalAccessSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings.0.dmz"); ok {
+ internalAccessSettingsPayload["dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings.0.undefined"); ok {
+ internalAccessSettingsPayload["undefined"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings.0.vpn"); ok {
+ internalAccessSettingsPayload["vpn"] = v.(bool)
+ }
+ accessibilityPayload["internal-access-settings"] = internalAccessSettingsPayload
+ }
+ browserBasedAuthenticationPortalSettingsPayload["accessibility"] = accessibilityPayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.certificate_settings"); ok {
+
+ certificateSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.certificate_settings.0.base64_certificate"); ok {
+ certificateSettingsPayload["base64-certificate"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.certificate_settings.0.base64_password"); ok {
+ certificateSettingsPayload["base64-password"] = v.(string)
+ }
+ browserBasedAuthenticationPortalSettingsPayload["certificate-settings"] = certificateSettingsPayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings"); ok {
+
+ portalWebSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings.0.aliases"); ok {
+ portalWebSettingsPayload["aliases"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings.0.ip_address"); ok {
+ portalWebSettingsPayload["ip-address"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings.0.main_url"); ok {
+ portalWebSettingsPayload["main-url"] = v.(string)
+ }
+ browserBasedAuthenticationPortalSettingsPayload["portal-web-settings"] = portalWebSettingsPayload
+ }
+ browserBasedAuthenticationSettingsPayload["browser-based-authentication-portal-settings"] = browserBasedAuthenticationPortalSettingsPayload
}
identityAwarenessSettingsPayload["browser-based-authentication-settings"] = browserBasedAuthenticationSettingsPayload
}
@@ -4253,11 +7445,63 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.user_reauthenticate_interval"); ok {
identityAgentSettingsPayload["user-reauthenticate-interval"] = v
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings"); ok {
- identityAgentSettingsPayload["authentication-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings"); ok {
+ authenticationSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.authentication_method"); ok {
+ authenticationSettingsPayload["authentication-method"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.radius"); ok {
+ authenticationSettingsPayload["radius"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories"); ok {
+
+ usersDirectoriesPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.external_user_profile"); ok {
+ usersDirectoriesPayload["external-user-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.internal_users"); ok {
+ usersDirectoriesPayload["internal-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.specific"); ok {
+ usersDirectoriesPayload["specific"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.users_from_external_directories"); ok {
+ usersDirectoriesPayload["users-from-external-directories"] = v.(string)
+ }
+ authenticationSettingsPayload["users-directories"] = usersDirectoriesPayload
+ }
+ identityAgentSettingsPayload["authentication-settings"] = authenticationSettingsPayload
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings"); ok {
- identityAgentSettingsPayload["identity-agent-portal-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings"); ok {
+ identityAgentPortalSettingsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility"); ok {
+
+ accessibilityPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.allow_access_from"); ok {
+ accessibilityPayload["allow-access-from"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings"); ok {
+
+ internalAccessSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings.0.dmz"); ok {
+ internalAccessSettingsPayload["dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings.0.undefined"); ok {
+ internalAccessSettingsPayload["undefined"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings.0.vpn"); ok {
+ internalAccessSettingsPayload["vpn"] = v.(bool)
+ }
+ accessibilityPayload["internal-access-settings"] = internalAccessSettingsPayload
+ }
+ identityAgentPortalSettingsPayload["accessibility"] = accessibilityPayload
+ }
+ identityAgentSettingsPayload["identity-agent-portal-settings"] = identityAgentPortalSettingsPayload
}
identityAwarenessSettingsPayload["identity-agent-settings"] = identityAgentSettingsPayload
}
@@ -4271,11 +7515,57 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authorized_clients"); ok {
identityCollectorSettingsPayload["authorized-clients"] = v.(*schema.Set).List()
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings"); ok {
- identityCollectorSettingsPayload["authentication-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings"); ok {
+ authenticationSettingsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories"); ok {
+
+ usersDirectoriesPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.external_user_profile"); ok {
+ usersDirectoriesPayload["external-user-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.internal_users"); ok {
+ usersDirectoriesPayload["internal-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.specific"); ok {
+ usersDirectoriesPayload["specific"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.users_from_external_directories"); ok {
+ usersDirectoriesPayload["users-from-external-directories"] = v.(string)
+ }
+ authenticationSettingsPayload["users-directories"] = usersDirectoriesPayload
+ }
+ identityCollectorSettingsPayload["authentication-settings"] = authenticationSettingsPayload
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions"); ok {
- identityCollectorSettingsPayload["client-access-permissions"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions"); ok {
+ clientAccessPermissionsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility"); ok {
+
+ accessibilityPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.allow_access_from"); ok {
+ accessibilityPayload["allow-access-from"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings"); ok {
+
+ internalAccessSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.dmz"); ok {
+ internalAccessSettingsPayload["dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.undefined"); ok {
+ internalAccessSettingsPayload["undefined"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.vpn"); ok {
+ internalAccessSettingsPayload["vpn"] = v.(bool)
+ }
+ accessibilityPayload["internal-access-settings"] = internalAccessSettingsPayload
+ }
+ clientAccessPermissionsPayload["accessibility"] = accessibilityPayload
+ }
+ identityCollectorSettingsPayload["client-access-permissions"] = clientAccessPermissionsPayload
}
identityAwarenessSettingsPayload["identity-collector-settings"] = identityCollectorSettingsPayload
}
@@ -4292,6 +7582,36 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.0.receive_from"); ok {
identitySharingSettingsPayload["receive-from"] = v.(*schema.Set).List()
}
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.cache_mode"); ok {
+
+ cacheModePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.cache_mode.0.override_profile"); ok {
+ cacheModePayload["override-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.cache_mode.0.value"); ok {
+ cacheModePayload["value"] = v.(bool)
+ }
+ identitySharingSettingsPayload["cache-mode"] = cacheModePayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.cache_mode_duration"); ok {
+
+ cacheModeDurationPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.cache_mode_duration.0.override_profile"); ok {
+ cacheModeDurationPayload["override-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.cache_mode_duration.0.value"); ok {
+ cacheModeDurationPayload["value"] = v.(int)
+ }
+ identitySharingSettingsPayload["cache-mode-duration"] = cacheModeDurationPayload
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.receive_from_infinity_identity"); ok {
+ identitySharingSettingsPayload["receive-from-infinity-identity"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.scaled_sharing"); ok {
+ identitySharingSettingsPayload["scaled-sharing"] = v.(bool)
+ }
identityAwarenessSettingsPayload["identity-sharing-settings"] = identitySharingSettingsPayload
}
if _, ok := d.GetOk("identity_awareness_settings.0.proxy_settings"); ok {
@@ -4306,6 +7626,70 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.remote_access"); ok {
identityAwarenessSettingsPayload["remote-access"] = v.(bool)
}
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_based_enforcement"); ok {
+ identityAwarenessSettingsPayload["identity-based-enforcement"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_web_api"); ok {
+ identityAwarenessSettingsPayload["identity-web-api"] = v.(bool)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings"); ok {
+ identityWebApiSettingsPayload := make(map[string]interface{})
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.authentication_settings"); ok {
+ authenticationSettingsPayload := make(map[string]interface{})
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.authentication_settings.0.users_directories"); ok {
+ usersDirectoriesPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_web_api_settings.0.authentication_settings.0.users_directories.0.external_user_profile"); ok {
+ usersDirectoriesPayload["external-user-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_web_api_settings.0.authentication_settings.0.users_directories.0.internal_users"); ok {
+ usersDirectoriesPayload["internal-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.authentication_settings.0.users_directories.0.users_from_external_directories"); ok {
+ usersDirectoriesPayload["users-from-external-directories"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.authentication_settings.0.users_directories.0.specific"); ok {
+ usersDirectoriesPayload["specific"] = v.(*schema.Set).List()
+ }
+ authenticationSettingsPayload["users-directories"] = usersDirectoriesPayload
+ }
+ identityWebApiSettingsPayload["authentication-settings"] = authenticationSettingsPayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.authorized_clients"); ok {
+ authorizedClientsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.authorized_clients.0.client"); ok {
+ authorizedClientsPayload["client"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.authorized_clients.0.client_secret"); ok {
+ authorizedClientsPayload["client-secret"] = v.(string)
+ }
+ identityWebApiSettingsPayload["authorized-clients"] = authorizedClientsPayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.client_access_permissions"); ok {
+ clientAccessPermissionsPayload := make(map[string]interface{})
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.client_access_permissions.0.accessibility"); ok {
+ accessibilityPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.client_access_permissions.0.accessibility.0.allow_access_from"); ok {
+ accessibilityPayload["allow-access-from"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings"); ok {
+ internalAccessSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_web_api_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.dmz"); ok {
+ internalAccessSettingsPayload["dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_web_api_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.undefined"); ok {
+ internalAccessSettingsPayload["undefined"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_web_api_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.vpn"); ok {
+ internalAccessSettingsPayload["vpn"] = v.(bool)
+ }
+ accessibilityPayload["internal-access-settings"] = internalAccessSettingsPayload
+ }
+ clientAccessPermissionsPayload["accessibility"] = accessibilityPayload
+ }
+ identityWebApiSettingsPayload["client-access-permissions"] = clientAccessPermissionsPayload
+ }
+ identityAwarenessSettingsPayload["identity-web-api-settings"] = identityWebApiSettingsPayload
+ }
cluster["identity-awareness-settings"] = identityAwarenessSettingsPayload
}
}
@@ -4350,6 +7734,9 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("nat_settings.0.method"); ok {
natSettingsPayload["method"] = v.(string)
}
+ if v, ok := d.GetOkExists("nat_settings.0.apply_control_connections"); ok {
+ natSettingsPayload["apply-control-connections"] = v.(bool)
+ }
cluster["nat-settings"] = natSettingsPayload
}
}
@@ -4372,6 +7759,9 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("platform_portal_settings.0.portal_web_settings.0.aliases"); ok {
portalWebSettingsPayload["aliases"] = v.(*schema.Set).List()
}
+ if v, ok := d.GetOk("platform_portal_settings.0.portal_web_settings.0.ip_address"); ok {
+ portalWebSettingsPayload["ip-address"] = v.(string)
+ }
if v, ok := d.GetOk("platform_portal_settings.0.portal_web_settings.0.main_url"); ok {
portalWebSettingsPayload["main-url"] = v.(string)
}
@@ -4456,6 +7846,9 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("usercheck_portal_settings.0.portal_web_settings.0.aliases"); ok {
portalWebSettingsPayload["aliases"] = v.(*schema.Set).List()
}
+ if v, ok := d.GetOk("usercheck_portal_settings.0.portal_web_settings.0.ip_address"); ok {
+ portalWebSettingsPayload["ip-address"] = v.(string)
+ }
if v, ok := d.GetOk("usercheck_portal_settings.0.portal_web_settings.0.main_url"); ok {
portalWebSettingsPayload["main-url"] = v.(string)
}
@@ -4496,12 +7889,6 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
}
}
- if ok := d.HasChange("zero_phishing_fqdn"); ok {
- if v, ok := d.GetOk("zero_phishing_fqdn"); ok {
- cluster["zero-phishing-fqdn"] = v
- }
- }
-
if d.HasChange("interfaces") {
if v, ok := d.GetOk("interfaces"); ok {
interfacesList := v.([]interface{})
@@ -4540,8 +7927,23 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".anti_spoofing_settings.0.action"); ok {
antiSpoofingSettings["action"] = v.(string)
}
+ if v, ok := d.GetOkExists("interfaces." + strconv.Itoa(i) + ".anti_spoofing_settings.0.exclude_packets"); ok {
+ antiSpoofingSettings["exclude-packets"] = v.(bool)
+ }
+ if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".anti_spoofing_settings.0.excluded_network_name"); ok {
+ antiSpoofingSettings["excluded-network-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".anti_spoofing_settings.0.excluded_network_uid"); ok {
+ antiSpoofingSettings["excluded-network-uid"] = v.(string)
+ }
+ if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".anti_spoofing_settings.0.spoof_tracking"); ok {
+ antiSpoofingSettings["spoof-tracking"] = v.(string)
+ }
interfacePayload["anti-spoofing-settings"] = antiSpoofingSettings
}
+ if v, ok := d.GetOkExists("interfaces." + strconv.Itoa(i) + ".dynamic_ip"); ok {
+ interfacePayload["dynamic-ip"] = v.(bool)
+ }
if v, ok := d.GetOkExists("interfaces." + strconv.Itoa(i) + ".security_zone"); ok {
interfacePayload["security-zone"] = v
}
@@ -4621,6 +8023,12 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("members." + strconv.Itoa(i) + ".one_time_password"); ok {
memberPayload["one-time-password"] = v
}
+ if v, ok := d.GetOkExists("members." + strconv.Itoa(i) + ".auto_generate_ip"); ok {
+ memberPayload["auto-generate-ip"] = v.(bool)
+ }
+ if v, ok := d.GetOk("members." + strconv.Itoa(i) + ".trust_method"); ok {
+ memberPayload["trust-method"] = v.(string)
+ }
if v, ok := d.GetOk("members." + strconv.Itoa(i) + ".interfaces"); ok {
interfacesList := v.([]interface{})
@@ -4647,9 +8055,60 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk(memberInterfacePrefix + ".ipv4_mask_length"); ok {
interfacePayload["ipv4-mask-length"] = v.(string)
}
+ if v, ok := d.GetOkExists(memberInterfacePrefix + ".anti_spoofing"); ok {
+ interfacePayload["anti-spoofing"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists(memberInterfacePrefix + ".dynamic_ip"); ok {
+ interfacePayload["dynamic-ip"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists(memberInterfacePrefix + ".security_zone"); ok {
+ interfacePayload["security-zone"] = v.(bool)
+ }
+ if v, ok := d.GetOk(memberInterfacePrefix + ".topology"); ok {
+ interfacePayload["topology"] = v.(string)
+ }
if v, ok := d.GetOk(memberInterfacePrefix + ".ipv6_mask_length"); ok {
interfacePayload["ipv6-mask-length"] = v.(string)
}
+ if _, ok := d.GetOk(memberInterfacePrefix + ".anti_spoofing_settings"); ok {
+ antiSpoofingSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk(memberInterfacePrefix + ".anti_spoofing_settings.0.action"); ok {
+ antiSpoofingSettingsPayload["action"] = v.(string)
+ }
+ if v, ok := d.GetOkExists(memberInterfacePrefix + ".anti_spoofing_settings.0.exclude_packets"); ok {
+ antiSpoofingSettingsPayload["exclude-packets"] = v.(bool)
+ }
+ if v, ok := d.GetOk(memberInterfacePrefix + ".anti_spoofing_settings.0.excluded_network_name"); ok {
+ antiSpoofingSettingsPayload["excluded-network-name"] = v.(string)
+ }
+ if v, ok := d.GetOk(memberInterfacePrefix + ".anti_spoofing_settings.0.excluded_network_uid"); ok {
+ antiSpoofingSettingsPayload["excluded-network-uid"] = v.(string)
+ }
+ if v, ok := d.GetOk(memberInterfacePrefix + ".anti_spoofing_settings.0.spoof_tracking"); ok {
+ antiSpoofingSettingsPayload["spoof-tracking"] = v.(string)
+ }
+ interfacePayload["anti-spoofing-settings"] = antiSpoofingSettingsPayload
+ }
+ if _, ok := d.GetOk(memberInterfacePrefix + ".security_zone_settings"); ok {
+ securityZoneSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists(memberInterfacePrefix + ".security_zone_settings.0.auto_calculated"); ok {
+ securityZoneSettingsPayload["auto-calculated"] = v.(bool)
+ }
+ interfacePayload["security-zone-settings"] = securityZoneSettingsPayload
+ }
+ if _, ok := d.GetOk(memberInterfacePrefix + ".topology_settings"); ok {
+ topologySettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists(memberInterfacePrefix + ".topology_settings.0.interface_leads_to_dmz"); ok {
+ topologySettingsPayload["interface-leads-to-dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOk(memberInterfacePrefix + ".topology_settings.0.ip_address_behind_this_interface"); ok {
+ topologySettingsPayload["ip-address-behind-this-interface"] = v.(string)
+ }
+ if v, ok := d.GetOk(memberInterfacePrefix + ".topology_settings.0.specific_network"); ok {
+ topologySettingsPayload["specific-network"] = v.(string)
+ }
+ interfacePayload["topology-settings"] = topologySettingsPayload
+ }
interfacesPayload = append(interfacesPayload, interfacePayload)
}
memberPayload["interfaces"] = interfacesPayload
@@ -4882,6 +8341,147 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("vpn_settings.0.authentication.0.authentication_clients"); ok {
authenticationPayload["authentication-clients"] = v.(*schema.Set).List()
}
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client"); ok {
+
+ singleAuthenticationClientPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.single_authentication_client.0.enabled"); ok {
+ singleAuthenticationClientPayload["enabled"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.single_authentication_client.0.allow_multiple_authentication_clients"); ok {
+ singleAuthenticationClientPayload["allow-multiple-authentication-clients"] = v.(bool)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.display_name"); ok {
+ singleAuthenticationClientPayload["display-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.method"); ok {
+ singleAuthenticationClientPayload["method"] = v.(string)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.secur_id"); ok {
+
+ securIdPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.secur_id.0.server"); ok {
+ securIdPayload["server"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.secur_id.0.token_card_type"); ok {
+ securIdPayload["token-card-type"] = v.(string)
+ }
+ singleAuthenticationClientPayload["secur-id"] = securIdPayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.radius"); ok {
+
+ radiusPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.radius.0.server"); ok {
+ radiusPayload["server"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.single_authentication_client.0.radius.0.ask_user_password"); ok {
+ radiusPayload["ask-user-password"] = v.(bool)
+ }
+ singleAuthenticationClientPayload["radius"] = radiusPayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate"); ok {
+
+ personalCertificatePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.fetch_username_from"); ok {
+ personalCertificatePayload["fetch-username-from"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.storage_type"); ok {
+ personalCertificatePayload["storage-type"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.source"); ok {
+ personalCertificatePayload["source"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.dn_part"); ok {
+ personalCertificatePayload["dn-part"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.dn_concurrence"); ok {
+ personalCertificatePayload["dn-concurrence"] = v.(int)
+ }
+ singleAuthenticationClientPayload["personal-certificate"] = personalCertificatePayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings"); ok {
+
+ clientDisplaySettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings.0.headline"); ok {
+ clientDisplaySettingsPayload["headline"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings.0.username_label"); ok {
+ clientDisplaySettingsPayload["username-label"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings.0.password_label"); ok {
+ clientDisplaySettingsPayload["password-label"] = v.(string)
+ }
+ singleAuthenticationClientPayload["client-display-settings"] = clientDisplaySettingsPayload
+ }
+ authenticationPayload["single-authentication-client"] = singleAuthenticationClientPayload
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.override_global_dynamic_id_settings"); ok {
+ authenticationPayload["override-global-dynamic-id-settings"] = v.(bool)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings"); ok {
+
+ dynamicIdSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_and_email_settings"); ok {
+ dynamicIdSettingsPayload["sms-provider-and-email-settings"] = v.(string)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials"); ok {
+
+ smsProviderCredentialsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials.0.username"); ok {
+ smsProviderCredentialsPayload["username"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials.0.password"); ok {
+ smsProviderCredentialsPayload["password"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials.0.api_id"); ok {
+ smsProviderCredentialsPayload["api-id"] = v.(string)
+ }
+ dynamicIdSettingsPayload["sms-provider-credentials"] = smsProviderCredentialsPayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings"); ok {
+
+ advancedSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.dynamic_id_message"); ok {
+ advancedSettingsPayload["dynamic-id-message"] = v.(string)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings"); ok {
+
+ otpSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings.0.length"); ok {
+ otpSettingsPayload["length"] = v.(int)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings.0.expiration"); ok {
+ otpSettingsPayload["expiration"] = v.(int)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings.0.max_attempts"); ok {
+ otpSettingsPayload["max-attempts"] = v.(int)
+ }
+ advancedSettingsPayload["otp-settings"] = otpSettingsPayload
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.enable_display_user_details"); ok {
+ advancedSettingsPayload["enable-display-user-details"] = v.(bool)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.country_code"); ok {
+ advancedSettingsPayload["country-code"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.user_details_retrieval"); ok {
+ advancedSettingsPayload["user-details-retrieval"] = v.(string)
+ }
+ dynamicIdSettingsPayload["advanced-settings"] = advancedSettingsPayload
+ }
+ authenticationPayload["dynamic-id-settings"] = dynamicIdSettingsPayload
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.send_machine_certificate"); ok {
+ authenticationPayload["send-machine-certificate"] = v.(string)
+ }
vpnSettingsPayload["authentication"] = authenticationPayload
}
if _, ok := d.GetOk("vpn_settings.0.certificates"); ok {
@@ -4986,6 +8586,27 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("vpn_settings.0.link_selection.0.outgoing_link_tracking"); ok {
linkSelectionPayload["outgoing-link-tracking"] = v.(string)
}
+ if _, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings"); ok {
+
+ probingSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.probed_interfaces"); ok {
+ probingSettingsPayload["probed-interfaces"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.probed_interface_list"); ok {
+ probingSettingsPayload["probed-interface-list"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.link_selection.0.probing_settings.0.use_primary_address"); ok {
+ probingSettingsPayload["use-primary-address"] = v.(bool)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.primary_address"); ok {
+ probingSettingsPayload["primary-address"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.probing_method"); ok {
+ probingSettingsPayload["probing-method"] = v.(string)
+ }
+ linkSelectionPayload["probing-settings"] = probingSettingsPayload
+ }
vpnSettingsPayload["link-selection"] = linkSelectionPayload
}
if v, ok := d.GetOk("vpn_settings.0.maximum_concurrent_ike_negotiations"); ok {
@@ -5234,6 +8855,35 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
}
vpnSettingsPayload["clientless-vpn-settings"] = clientlessVpnSettingsPayload
}
+ if v, ok := d.GetOk("vpn_settings.0.interfaces"); ok {
+ interfacesList := v.([]interface{})
+ if len(interfacesList) > 0 {
+ var interfacesPayload []map[string]interface{}
+ for i := range interfacesList {
+ interfacesItem := make(map[string]interface{})
+ if v, ok := d.GetOk("vpn_settings.0.interfaces." + strconv.Itoa(i) + ".interface_name"); ok {
+ interfacesItem["interface-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.interfaces." + strconv.Itoa(i) + ".ip_version"); ok {
+ interfacesItem["ip-version"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.interfaces." + strconv.Itoa(i) + ".next_hop_ip"); ok {
+ interfacesItem["next-hop-ip"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.interfaces." + strconv.Itoa(i) + ".priority"); ok {
+ interfacesItem["priority"] = v.(int)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.interfaces." + strconv.Itoa(i) + ".redundancy_mode"); ok {
+ interfacesItem["redundancy-mode"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.interfaces." + strconv.Itoa(i) + ".static_nat_ip"); ok {
+ interfacesItem["static-nat-ip"] = v.(string)
+ }
+ interfacesPayload = append(interfacesPayload, interfacesItem)
+ }
+ vpnSettingsPayload["interfaces"] = interfacesPayload
+ }
+ }
cluster["vpn-settings"] = vpnSettingsPayload
}
}
@@ -5316,6 +8966,261 @@ func updateManagementSimpleCluster(d *schema.ResourceData, m interface{}) error
log.Println("Update Simple Cluster - Map = ", cluster)
if len(cluster) != 3 {
+ if ok := d.HasChange("anti_spam_and_email_security"); ok {
+ cluster["anti-spam-and-email-security"] = d.Get("anti_spam_and_email_security")
+ }
+ if ok := d.HasChange("auto_topology_custom_recalculation_time"); ok {
+ cluster["auto-topology-custom-recalculation-time"] = d.Get("auto_topology_custom_recalculation_time")
+ }
+ if ok := d.HasChange("auto_topology_use_custom_recalculation_time"); ok {
+ cluster["auto-topology-use-custom-recalculation-time"] = d.Get("auto_topology_use_custom_recalculation_time")
+ }
+ if ok := d.HasChange("data_loss_prevention"); ok {
+ cluster["data-loss-prevention"] = d.Get("data_loss_prevention")
+ }
+ if ok := d.HasChange("mobile_access"); ok {
+ cluster["mobile-access"] = d.Get("mobile_access")
+ }
+ if ok := d.HasChange("monitoring"); ok {
+ cluster["monitoring"] = d.Get("monitoring")
+ }
+ if ok := d.HasChange("policy_server"); ok {
+ cluster["policy-server"] = d.Get("policy_server")
+ }
+ if ok := d.HasChange("rtm_counters_report"); ok {
+ cluster["rtm-counters-report"] = d.Get("rtm_counters_report")
+ }
+ if ok := d.HasChange("rtm_traffic_report"); ok {
+ cluster["rtm-traffic-report"] = d.Get("rtm_traffic_report")
+ }
+ if ok := d.HasChange("rtm_traffic_report_per_connection"); ok {
+ cluster["rtm-traffic-report-per-connection"] = d.Get("rtm_traffic_report_per_connection")
+ }
+ if ok := d.HasChange("threat_extraction"); ok {
+ cluster["threat-extraction"] = d.Get("threat_extraction")
+ }
+ if ok := d.HasChange("threat_prevention_mode"); ok {
+ cluster["threat-prevention-mode"] = d.Get("threat_prevention_mode")
+ }
+ if ok := d.HasChange("workforce_ai"); ok {
+ cluster["workforce-ai"] = d.Get("workforce_ai")
+ }
+ if ok := d.HasChange("application_control_and_url_filtering_settings"); ok {
+ if _, ok := d.GetOk("application_control_and_url_filtering_settings"); ok {
+
+ applicationControlAndUrlFilteringSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("application_control_and_url_filtering_settings.0.global_settings_mode"); ok {
+ applicationControlAndUrlFilteringSettingsPayload["global-settings-mode"] = v.(string)
+ }
+ if _, ok := d.GetOk("application_control_and_url_filtering_settings.0.override_global_settings"); ok {
+
+ overrideGlobalSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("application_control_and_url_filtering_settings.0.override_global_settings.0.fail_mode"); ok {
+ overrideGlobalSettingsPayload["fail-mode"] = v.(string)
+ }
+ if _, ok := d.GetOk("application_control_and_url_filtering_settings.0.override_global_settings.0.website_categorization"); ok {
+
+ websiteCategorizationPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("application_control_and_url_filtering_settings.0.override_global_settings.0.website_categorization.0.custom_mode"); ok {
+
+ customModePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("application_control_and_url_filtering_settings.0.override_global_settings.0.website_categorization.0.custom_mode.0.social_networking_widgets"); ok {
+ customModePayload["social-networking-widgets"] = v.(string)
+ }
+ if v, ok := d.GetOk("application_control_and_url_filtering_settings.0.override_global_settings.0.website_categorization.0.custom_mode.0.url_filtering"); ok {
+ customModePayload["url-filtering"] = v.(string)
+ }
+ websiteCategorizationPayload["custom-mode"] = customModePayload
+ }
+ if v, ok := d.GetOk("application_control_and_url_filtering_settings.0.override_global_settings.0.website_categorization.0.mode"); ok {
+ websiteCategorizationPayload["mode"] = v.(string)
+ }
+ overrideGlobalSettingsPayload["website-categorization"] = websiteCategorizationPayload
+ }
+ applicationControlAndUrlFilteringSettingsPayload["override-global-settings"] = overrideGlobalSettingsPayload
+ }
+ cluster["application-control-and-url-filtering-settings"] = applicationControlAndUrlFilteringSettingsPayload
+ }
+ }
+ if ok := d.HasChange("cluster_settings"); ok {
+ if _, ok := d.GetOk("cluster_settings"); ok {
+
+ clusterSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("cluster_settings.0.member_recovery_mode"); ok {
+ clusterSettingsPayload["member-recovery-mode"] = v.(string)
+ }
+ if _, ok := d.GetOk("cluster_settings.0.state_synchronization"); ok {
+
+ stateSynchronizationPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("cluster_settings.0.state_synchronization.0.delayed"); ok {
+ stateSynchronizationPayload["delayed"] = v.(bool)
+ }
+ if v, ok := d.GetOk("cluster_settings.0.state_synchronization.0.delayed_seconds"); ok {
+ stateSynchronizationPayload["delayed-seconds"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("cluster_settings.0.state_synchronization.0.enabled"); ok {
+ stateSynchronizationPayload["enabled"] = v.(bool)
+ }
+ clusterSettingsPayload["state-synchronization"] = stateSynchronizationPayload
+ }
+ if v, ok := d.GetOk("cluster_settings.0.track_changes_of_cluster_members"); ok {
+ clusterSettingsPayload["track-changes-of-cluster-members"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("cluster_settings.0.use_virtual_mac"); ok {
+ clusterSettingsPayload["use-virtual-mac"] = v.(bool)
+ }
+ cluster["cluster-settings"] = clusterSettingsPayload
+ }
+ }
+ if ok := d.HasChange("communication_with_servers_behind_nat"); ok {
+ if _, ok := d.GetOk("communication_with_servers_behind_nat"); ok {
+
+ communicationWithServersBehindNatPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("communication_with_servers_behind_nat.0.override_profile"); ok {
+ communicationWithServersBehindNatPayload["override-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOk("communication_with_servers_behind_nat.0.value"); ok {
+ communicationWithServersBehindNatPayload["value"] = v.(string)
+ }
+ cluster["communication-with-servers-behind-nat"] = communicationWithServersBehindNatPayload
+ }
+ }
+ if ok := d.HasChange("zero_phishing_settings"); ok {
+ if _, ok := d.GetOk("zero_phishing_settings"); ok {
+
+ zeroPhishingSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("zero_phishing_settings.0.gateway_fqdn_mode"); ok {
+ zeroPhishingSettingsPayload["gateway-fqdn-mode"] = v.(string)
+ }
+ if v, ok := d.GetOk("zero_phishing_settings.0.manual_fqdn"); ok {
+ zeroPhishingSettingsPayload["manual-fqdn"] = v.(string)
+ }
+ cluster["zero-phishing-settings"] = zeroPhishingSettingsPayload
+ }
+ }
+ if ok := d.HasChange("dns_server"); ok {
+ if v, ok := d.GetOkExists("dns_server"); ok {
+ cluster["dns-server"] = v.(bool)
+ }
+ }
+
+ if ok := d.HasChange("logs_settings"); ok {
+ if _, ok := d.GetOk("logs_settings"); ok {
+ logsSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("logs_settings.0.alert_when_free_disk_space_below"); ok {
+ logsSettingsPayload["alert-when-free-disk-space-below"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.alert_when_free_disk_space_below_threshold"); ok {
+ logsSettingsPayload["alert-when-free-disk-space-below-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOk("logs_settings.0.alert_when_free_disk_space_below_type"); ok {
+ logsSettingsPayload["alert-when-free-disk-space-below-type"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.before_delete_keep_logs_from_the_last_days"); ok {
+ logsSettingsPayload["before-delete-keep-logs-from-the-last-days"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.before_delete_keep_logs_from_the_last_days_threshold"); ok {
+ logsSettingsPayload["before-delete-keep-logs-from-the-last-days-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.before_delete_run_script"); ok {
+ logsSettingsPayload["before-delete-run-script"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.before_delete_run_script_command"); ok {
+ logsSettingsPayload["before-delete-run-script-command"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.delete_index_files_older_than_days"); ok {
+ logsSettingsPayload["delete-index-files-older-than-days"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.delete_index_files_older_than_days_threshold"); ok {
+ logsSettingsPayload["delete-index-files-older-than-days-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.delete_index_files_when_index_size_above"); ok {
+ logsSettingsPayload["delete-index-files-when-index-size-above"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.delete_index_files_when_index_size_above_threshold"); ok {
+ logsSettingsPayload["delete-index-files-when-index-size-above-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.delete_when_free_disk_space_below"); ok {
+ logsSettingsPayload["delete-when-free-disk-space-below"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.delete_when_free_disk_space_below_threshold"); ok {
+ logsSettingsPayload["delete-when-free-disk-space-below-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.detect_new_citrix_ica_application_names"); ok {
+ logsSettingsPayload["detect-new-citrix-ica-application-names"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.distribute_logs_between_all_active_servers"); ok {
+ logsSettingsPayload["distribute-logs-between-all-active-servers"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.forward_logs_to_log_server"); ok {
+ logsSettingsPayload["forward-logs-to-log-server"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.forward_logs_to_log_server_name"); ok {
+ logsSettingsPayload["forward-logs-to-log-server-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("logs_settings.0.forward_logs_to_log_server_schedule_name"); ok {
+ logsSettingsPayload["forward-logs-to-log-server-schedule-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("logs_settings.0.free_disk_space_metrics"); ok {
+ logsSettingsPayload["free-disk-space-metrics"] = v.(string)
+ }
+ if v, ok := d.GetOk("logs_settings.0.include_tcp_state_information"); ok {
+ logsSettingsPayload["include-tcp-state-information"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.perform_log_rotate_before_log_forwarding"); ok {
+ logsSettingsPayload["perform-log-rotate-before-log-forwarding"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.reject_connections_when_free_disk_space_below_threshold"); ok {
+ logsSettingsPayload["reject-connections-when-free-disk-space-below-threshold"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.reserve_for_packet_capture_metrics"); ok {
+ logsSettingsPayload["reserve-for-packet-capture-metrics"] = v.(string)
+ }
+ if v, ok := d.GetOk("logs_settings.0.reserve_for_packet_capture_threshold"); ok {
+ logsSettingsPayload["reserve-for-packet-capture-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.rotate_log_by_file_size"); ok {
+ logsSettingsPayload["rotate-log-by-file-size"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.rotate_log_file_size_threshold"); ok {
+ logsSettingsPayload["rotate-log-file-size-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.rotate_log_on_schedule"); ok {
+ logsSettingsPayload["rotate-log-on-schedule"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.rotate_log_schedule_name"); ok {
+ logsSettingsPayload["rotate-log-schedule-name"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.stop_logging_when_free_disk_space_below"); ok {
+ logsSettingsPayload["stop-logging-when-free-disk-space-below"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.stop_logging_when_free_disk_space_below_threshold"); ok {
+ logsSettingsPayload["stop-logging-when-free-disk-space-below-threshold"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("logs_settings.0.turn_on_qos_logging"); ok {
+ logsSettingsPayload["turn-on-qos-logging"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.update_account_log_every"); ok {
+ logsSettingsPayload["update-account-log-every"] = v.(int)
+ }
+ cluster["logs-settings"] = logsSettingsPayload
+ }
+ }
+
+ if ok := d.HasChange("show_portals_certificate"); ok {
+ if v, ok := d.GetOkExists("show_portals_certificate"); ok {
+ cluster["show-portals-certificate"] = v.(bool)
+ }
+ }
+
updateSimpleClusterRes, err := client.ApiCall("set-simple-cluster", cluster, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil {
return fmt.Errorf("%s", err.Error())
diff --git a/checkpoint/resource_checkpoint_management_simple_gateway.go b/checkpoint/resource_checkpoint_management_simple_gateway.go
index 27159142..2809d7ca 100644
--- a/checkpoint/resource_checkpoint_management_simple_gateway.go
+++ b/checkpoint/resource_checkpoint_management_simple_gateway.go
@@ -244,6 +244,66 @@ func resourceManagementSimpleGateway() *schema.Resource {
},
},
},
+ "bypass_on_client_failure": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Bypass HTTPS inspection on client failure.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to bypass on client failure.",
+ },
+ },
+ },
+ },
+ "bypass_under_load": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Bypass HTTPS inspection under load.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "value": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to bypass under load.",
+ },
+ },
+ },
+ },
+ "outbound_certificate": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Outbound HTTPS inspection certificate.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Outbound certificate identified by the name or UID.",
+ },
+ },
+ },
+ },
+ "deployment_mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "HTTPS inspection deployment mode.",
+ },
},
},
},
@@ -259,6 +319,135 @@ func resourceManagementSimpleGateway() *schema.Resource {
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "identity_web_api": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable Identity Web API source.",
+ },
+ "identity_web_api_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Identity Web API settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "authentication_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Authentication Settings for Identity Web Api.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "users_directories": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Users directories.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "specific": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "LDAP AU objects identified by the name or UID. Must be set when 'users-from-external-directories' was selected to be 'specific'.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "external_user_profile": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "External user profile.",
+ },
+ "internal_users": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Internal users.",
+ },
+ "users_from_external_directories": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Users from external directories.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "authorized_clients": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Authorized Clients.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "client": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Host / Network Group Name or UID.",
+ },
+ "client_secret": {
+ Type: schema.TypeString,
+ Optional: true,
+ Sensitive: true,
+ Description: "Client Secret.",
+ },
+ },
+ },
+ },
+ "client_access_permissions": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Identity Web Api accessibility settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "accessibility": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Configuration of the portal access settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "allow_access_from": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Allowed access to the web portal (based on interfaces, or security policy).",
+ },
+ "internal_access_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Configuration of the additional portal access settings for internal interfaces only.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "dmz": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to 'DMZ'.",
+ },
+ "undefined": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to 'Undefined'.",
+ },
+ "vpn": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Controls portal access settings for interfaces that are part of a VPN Encryption Domain.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
"browser_based_authentication": {
Type: schema.TypeBool,
Optional: true,
@@ -363,6 +552,11 @@ func resourceManagementSimpleGateway() *schema.Resource {
Optional: true,
Description: "The main URL for the web portal.",
},
+ "ip_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
},
},
},
@@ -381,6 +575,7 @@ func resourceManagementSimpleGateway() *schema.Resource {
"base64_password": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "Password (encoded in Base64 with padding) for the certificate file.",
},
},
@@ -592,6 +787,7 @@ func resourceManagementSimpleGateway() *schema.Resource {
"client_secret": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "Client Secret.",
},
},
@@ -721,6 +917,56 @@ func resourceManagementSimpleGateway() *schema.Resource {
Type: schema.TypeString,
},
},
+ "cache_mode": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Identity cache mode.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether the identity cache is enabled.",
+ },
+ },
+ },
+ },
+ "cache_mode_duration": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Identity cache mode duration.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to override the value inherited from the profile.",
+ },
+ "value": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Identity cache duration in minutes.",
+ },
+ },
+ },
+ },
+ "receive_from_infinity_identity": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to receive identities from Infinity Identity.",
+ },
+ "scaled_sharing": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether scaled identity sharing is enabled.",
+ },
},
},
},
@@ -745,6 +991,11 @@ func resourceManagementSimpleGateway() *schema.Resource {
Optional: true,
Description: "Enable Remote Access Identity source.",
},
+ "identity_based_enforcement": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "ON: Configures this object as a PEP-only object - identity-based enforcement (PEP) is enabled.
OFF: Configures this object as a PDP-only object - identity-ba",
+ },
},
},
},
@@ -796,6 +1047,11 @@ func resourceManagementSimpleGateway() *schema.Resource {
Optional: true,
Description: "NAT translation method.",
},
+ "apply_control_connections": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "This option performs NAT on VPN control connections to and from this object.",
+ },
},
},
},
@@ -826,6 +1082,11 @@ func resourceManagementSimpleGateway() *schema.Resource {
Optional: true,
Description: "The main URL for the web portal.",
},
+ "ip_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
},
},
},
@@ -844,6 +1105,7 @@ func resourceManagementSimpleGateway() *schema.Resource {
"base64_password": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "Password (encoded in Base64 with padding) for the certificate file.",
},
},
@@ -956,6 +1218,11 @@ func resourceManagementSimpleGateway() *schema.Resource {
Optional: true,
Description: "The main URL for the web portal.",
},
+ "ip_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
},
},
},
@@ -974,6 +1241,7 @@ func resourceManagementSimpleGateway() *schema.Resource {
"base64_password": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "Password (encoded in Base64 with padding) for the certificate file.",
},
},
@@ -1031,6 +1299,7 @@ func resourceManagementSimpleGateway() *schema.Resource {
Type: schema.TypeString,
Optional: true,
Description: "Zero Phishing gateway FQDN.",
+ Deprecated: "use zero_phishing_settings.manual_fqdn instead - the API replaced zero-phishing-fqdn with zero-phishing-settings",
},
"interfaces": {
Type: schema.TypeList,
@@ -1091,6 +1360,26 @@ func resourceManagementSimpleGateway() *schema.Resource {
Optional: true,
Description: "If packets will be rejected (the Prevent option) or whether the packets will be monitored (the Detect option).",
},
+ "exclude_packets": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Don't check packets from excluded network.",
+ },
+ "excluded_network_name": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Excluded network name.",
+ },
+ "excluded_network_uid": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Excluded network UID.",
+ },
+ "spoof_tracking": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Spoof tracking.",
+ },
},
},
},
@@ -1167,6 +1456,11 @@ func resourceManagementSimpleGateway() *schema.Resource {
Optional: true,
Description: "Comments string.",
},
+ "dynamic_ip": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "The Topology of interface with Dynamic IP is set to Automatic - External.",
+ },
},
},
},
@@ -1469,6 +1763,11 @@ func resourceManagementSimpleGateway() *schema.Resource {
Description: "Logs settings.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
+ "free_disk_space_metrics": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Free disk space metrics.",
+ },
"alert_when_free_disk_space_below": {
Type: schema.TypeBool,
Optional: true,
@@ -1635,6 +1934,16 @@ func resourceManagementSimpleGateway() *schema.Resource {
Optional: true,
Description: "Update account log in every amount of seconds.",
},
+ "distribute_logs_between_all_active_servers": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Distribute logs between all active servers.",
+ },
+ "include_tcp_state_information": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Include TCP state information. Relevant only when Firewall blade is enabled.",
+ },
},
},
},
@@ -1650,23 +1959,316 @@ func resourceManagementSimpleGateway() *schema.Resource {
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "authentication": {
+ "interfaces": {
Type: schema.TypeList,
- MaxItems: 1,
Optional: true,
- Description: "Authentication.",
+ Description: "Enhanced Link Selection Interfaces.",
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
- "authentication_clients": {
- Type: schema.TypeSet,
+ "interface_name": {
+ Type: schema.TypeString,
Optional: true,
- Description: "Collection of VPN Authentication clients identified by the name or UID.",
- Elem: &schema.Schema{
- Type: schema.TypeString,
- },
+ Description: "The name of the interface.",
},
- },
- },
+ "ip_version": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The IP version of the interface's IP address (IPv4/IPv6).",
+ },
+ "next_hop_ip": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The IP address of the next hop.",
+ },
+ "priority": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Priority of a 'Backup' interface.",
+ },
+ "redundancy_mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Interface redundancy mode (Active/Backup).",
+ },
+ "static_nat_ip": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The NATed IPv4 address that hides the source IPv4 address of outgoing connections (applies only to IPv4).",
+ },
+ },
+ },
+ },
+ "authentication": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Authentication.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "authentication_clients": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "Collection of VPN Authentication clients identified by the name or UID.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "single_authentication_client": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Settings for clients that support only single authentication method.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "enabled": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Allow clients that support only single authentication method.",
+ Default: true,
+ },
+ "allow_multiple_authentication_clients": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Allow clients that support multiple authentication methods to connect.",
+ Default: true,
+ },
+ "display_name": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Display name for the authentication method.",
+ Default: "standard",
+ },
+ "method": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Authentication method type.",
+ Default: "defined-on-user-record",
+ },
+ "secur_id": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "SecurID authentication settings, relevant only when method is \"secur-id\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "server": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Server object identified by the name or UID.",
+ },
+ "token_card_type": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Token card type.",
+ Default: "any",
+ },
+ },
+ },
+ },
+ "radius": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "RADIUS authentication settings, relevant only when method is \"radius\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "server": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Server object identified by the name or UID.",
+ },
+ "ask_user_password": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Ask user for password during authentication.",
+ Default: false,
+ },
+ },
+ },
+ },
+ "personal_certificate": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Personal certificate authentication settings, relevant only when method is \"personal-certificate\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "fetch_username_from": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Fetch username from.",
+ Default: "subject-dn",
+ },
+ "storage_type": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Certificate storage type.",
+ Default: "any",
+ },
+ "source": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Certificate source field.",
+ Default: "subject",
+ },
+ "dn_part": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "DN part to extract.",
+ },
+ "dn_concurrence": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "DN part occurrence number.",
+ Default: 1,
+ },
+ },
+ },
+ },
+ "client_display_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Client display configuration settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "headline": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Display headline for authentication dialog.",
+ },
+ "username_label": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Label for username field.",
+ },
+ "password_label": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Label for password field.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "override_global_dynamic_id_settings": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Override global dynamic ID settings.",
+ Default: false,
+ },
+ "dynamic_id_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Dynamic ID settings, relevant only when \"override-global-dynamic-id-settings\" is true.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "sms_provider_and_email_settings": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "SMS provider and email configuration.",
+ },
+ "sms_provider_credentials": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "SMS provider credentials configuration.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "username": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "SMS provider username.",
+ },
+ "password": {
+ Type: schema.TypeString,
+ Optional: true,
+ Sensitive: true,
+ Description: "SMS provider password.",
+ },
+ "api_id": {
+ Type: schema.TypeString,
+ Optional: true,
+ Sensitive: true,
+ Description: "SMS provider API ID.",
+ },
+ },
+ },
+ },
+ "advanced_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Advanced Dynamic ID configuration settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "dynamic_id_message": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Dynamic ID message displayed to users.",
+ },
+ "otp_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "One Time Password configuration settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "length": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Length of one time password.",
+ Default: 6,
+ },
+ "expiration": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "One time password expiration (in minutes).",
+ Default: 5,
+ },
+ "max_attempts": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Number of times users can attempt to enter the one time password before the entire authentication process restarts.",
+ Default: 3,
+ },
+ },
+ },
+ },
+ "enable_display_user_details": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable display of user details.",
+ Default: false,
+ },
+ "country_code": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Country code for SMS services.",
+ },
+ "user_details_retrieval": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "User details retrieval method.",
+ Default: "internal-or-ldap-or-local",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "send_machine_certificate": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Configure when to send machine certificate.",
+ Default: "when-available",
+ },
+ },
+ },
},
"link_selection": {
Type: schema.TypeList,
@@ -1691,6 +2293,73 @@ func resourceManagementSimpleGateway() *schema.Resource {
Optional: true,
Description: "IP Address. Must be set when \"ip-selection\" was selected to be \"use-selected-address-from-topology\" or \"use-statically-nated-ip\"",
},
+ "route_selection_method": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Outgoing route selection method when initiating a tunnel.",
+ Default: "os-routing-table",
+ },
+ "responding_traffic": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Responding traffic route selection method.",
+ },
+ "source_ip_selection": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Source IP address selection method for outgoing traffic.",
+ },
+ "selected_ip": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Selected IP address. Must be set when \"source-ip-selection\" was selected to be \"manual\".",
+ },
+ "outgoing_link_tracking": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Outgoing link tracking method.",
+ },
+ "probing_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Probing settings configuration. Only available when \"ip-selection\" is \"use-probing-with-high-availability\" or \"use-probing-with-load-sharing\".",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "probed_interfaces": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Specifies whether to probe all addresses defined in the topology tab or specific addresses.",
+ Default: "all",
+ },
+ "probed_interface_list": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "List of specific IP addresses to probe. Only relevant when \"probed-interfaces\" is set to \"specific\".",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "use_primary_address": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to use a primary address for high availability probing.",
+ Default: false,
+ },
+ "primary_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Primary IP address to use. Must be one of the addresses from \"probed-interface-list\". Required when \"use-primary-address\" is true.",
+ },
+ "probing_method": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Probing method.",
+ Default: "ongoing",
+ },
+ },
+ },
+ },
},
},
},
@@ -1956,22 +2625,269 @@ func resourceManagementSimpleGateway() *schema.Resource {
Optional: true,
Description: "Exclude the external IP addresses from the VPN domain of this Security Gateway.",
},
- },
- },
- },
- "color": {
- Type: schema.TypeString,
- Optional: true,
- Description: "Color of the object. Should be one of existing colors.",
- Default: "black",
- },
- "comments": {
- Type: schema.TypeString,
- Optional: true,
- Description: "Comments string.",
- },
- "tags": {
- Type: schema.TypeSet,
+ "advanced": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Advanced VPN settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "tunnel_sharing_mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Tunnel sharing mode.",
+ },
+ "shutdown_on_gateway_restart": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Shutdown VPN tunnels on gateway restart.",
+ },
+ "enable_wire_mode": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable wire mode.",
+ },
+ "wire_mode_interfaces": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "Wire mode interfaces.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "enable_wire_mode_log_traffic": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Log traffic in wire mode.",
+ },
+ "enable_nat_traversal": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable NAT traversal.",
+ },
+ },
+ },
+ },
+ "exported_routes": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Exported routes.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "internal_interfaces": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Export internal interfaces.",
+ },
+ "static_routes": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Export static routes.",
+ },
+ "custom_routes": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Export custom routes.",
+ },
+ "custom_routes_object": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Custom routes object identified by the name or UID.",
+ },
+ },
+ },
+ },
+ "vpn_clients": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "VPN clients settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "enable_endpoint_security_vpn": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable Endpoint Security VPN client.",
+ },
+ "enable_cp_mobile_for_windows": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable Check Point Mobile for Windows client.",
+ },
+ "enable_secu_remote": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable SecuRemote client.",
+ },
+ "enable_capsule_vpn_connect": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable Capsule VPN Connect client.",
+ },
+ "enable_ssl_network_extender": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable SSL Network Extender client.",
+ },
+ "gateway_authentication_certificate": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Gateway authentication certificate.",
+ },
+ },
+ },
+ },
+ "enable_clientless_vpn": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable clientless VPN.",
+ },
+ "clientless_vpn_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Clientless VPN settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "certificate_gateway_authentication": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Certificate gateway authentication.",
+ },
+ "client_authentication": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Client authentication.",
+ },
+ "concurrent_servers_or_processes": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Number of concurrent servers or processes.",
+ },
+ "accept_only_3des": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Accept only 3DES.",
+ },
+ },
+ },
+ },
+ "saml_portal_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "SAML portal settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "portal_web_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Configuration of the SAML portal web settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "aliases": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "List of URL aliases that are redirected to the main portal URL.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "ip_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Optional IP address to be used for the portal URL.",
+ },
+ "main_url": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The main URL for the portal.",
+ },
+ },
+ },
+ },
+ "certificate_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Configuration of the SAML portal certificate.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "base64_certificate": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The certificate file encoded in Base64 with padding.",
+ },
+ "base64_password": {
+ Type: schema.TypeString,
+ Optional: true,
+ Sensitive: true,
+ Description: "Certificate file password.",
+ },
+ },
+ },
+ },
+ "accessibility": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Configuration of the portal access settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "allow_access_from": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Allowed access to the SAML portal.",
+ },
+ "internal_access_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Configuration of the additional portal access settings for internal interfaces only.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "undefined": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to \"Undefined\".",
+ },
+ "dmz": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Controls portal access settings for internal interfaces, whose topology is set to \"DMZ\".",
+ },
+ "vpn": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Controls portal access settings for interfaces that are part of a VPN Encryption Domain.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "color": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Color of the object. Should be one of existing colors.",
+ Default: "black",
+ },
+ "comments": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Comments string.",
+ },
+ "tags": {
+ Type: schema.TypeSet,
Optional: true,
Description: "Collection of tag identifiers.",
Elem: &schema.Schema{
@@ -1984,6 +2900,214 @@ func resourceManagementSimpleGateway() *schema.Resource {
Description: "Apply changes ignoring warnings.",
Default: false,
},
+ "accept_syslog_messages": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enables the gateway accept syslog messages, relevant only when Logging and Status/Network Policy Management blades are enabled.",
+ },
+ "anti_spam_and_email_security": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enables Anti-Spam & Email-Security blade.",
+ },
+ "auto_generate_ip": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Use an automatically generated IP address for the Gateway object (applies only to Smart-1 Cloud).",
+ },
+ "auto_topology_custom_recalculation_time": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Auto topology custom recalculation time (seconds).",
+ },
+ "auto_topology_use_custom_recalculation_time": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Auto topology to use custom recalculation time instead of default.",
+ },
+ "data_loss_prevention": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Data Loss Prevention blade.",
+ },
+ "enable_log_indexing": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enable log indexing, The Log Indexing uses more storage to provide fast log queries, relevant only when Logging and Status blade is enabled.",
+ },
+ "hardware_subtype": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Gateway type (relevant only for Spark gateways).",
+ },
+ "install_policy_without_push": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Specifies whether the policy is pushed to the gateway during policy installation, or whether the gateway should fetch the policy.",
+ },
+ "interfaces_topology_settings": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Topology setting for all interfaces on a Security Gateway. Default for Security Gateways that run Gaia OS: 'per interface'. Default for Quantum Spark gateways t",
+ },
+ "mobile_access": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Mobile Access blade.",
+ },
+ "monitoring": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enables Real Time Monitoring blade.",
+ },
+ "policy_server": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Policy Server blade.",
+ },
+ "rtm_counters_report": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enables monitoring blades system counters report (e.g CPU Usage,Memory Usage).",
+ },
+ "rtm_traffic_report": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enables monitoring blades traffic report.",
+ },
+ "rtm_traffic_report_per_connection": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enables Monitoring blade traffic report per connection.",
+ },
+ "smart_event_intro_correlation_unit": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enables the gateway use SmartEvent intro correlation unit with one Security Gateway Software Blade. Relevant only when the Logging and Status blade is enabled,",
+ },
+ "threat_prevention_mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The mode of Threat Prevention to use. When using Autonomous Threat Prevention, disabling the Threat Prevention blades is not allowed.",
+ },
+ "trust_method": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Establish the trust communication method.",
+ },
+ "workforce_ai": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Workforce AI Security blade enabled. Requires content awareness blade and version R82.20 or higher to be enabled.",
+ },
+ "communication_with_servers_behind_nat": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Gateway behind NAT communications settings with the server.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "override_profile": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to override the Server (Check Point Host) object configuration.",
+ },
+ "value": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "according-to-topology: Use the original or translated IP address of the server based on the Topology of Security Gateway interfaces.
original-ip-only: Use on",
+ },
+ },
+ },
+ },
+ "zero_phishing_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Fqdn settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "gateway_fqdn_mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Manual Fqdn.",
+ },
+ "manual_fqdn": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Zero Phishing gateway FQDN.",
+ },
+ },
+ },
+ },
+ "autonomous_system_number": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The Autonomous System Number (ASN). It is automatically fetched from the Security Gateway object. You can change this value only for externally manage...",
+ },
+ "dns_server": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "DNS Server.",
+ },
+ "trust_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Settings for the trusted communication establishment.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "gateway_mac_address": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Use the Security Gateway MAC address, relevant for the gateway_mac_address identification-method.",
+ },
+ "identification_method": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "How to identify the gateway (relevant for DAIP gateways only).",
+ },
+ "initiation_phase": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Push the certificate to the Security Gateway immediately, or wait for the Security Gateway to pull the certificate. Default value for Spark Gateway is...",
+ },
+ },
+ },
+ },
+ "fetch_policy_scheduler": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Fetch policy functionality settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "enabled": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates if the Security Gateway will fetch policy according to a schedule (true) or manually (false).",
+ },
+ "schedule": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Scheduled Event for fetching policy by.
Will be applied only when the `enabled` field is set to true.
When not defined ...",
+ },
+ },
+ },
+ },
+ "export_logs_to_servers": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "Export logs to syslog/SIEM servers. NOTE:After you configure a Log Exporter, you must run Install Database. Relevant only when Logging and Status/Netw...",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "show_portals_certificate": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to show the portals certificate value in the reply.",
+ },
},
}
}
@@ -2114,6 +3238,42 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
}
httpsInspectionPayload["deny-expired-server-cert"] = denyExpiredServerCertPayload
}
+ if _, ok := d.GetOk("https_inspection.0.bypass_on_client_failure"); ok {
+
+ bypassOnClientFailurePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("https_inspection.0.bypass_on_client_failure.0.override_profile"); ok {
+ bypassOnClientFailurePayload["override-profile"] = strconv.FormatBool(v.(bool))
+ }
+ if v, ok := d.GetOk("https_inspection.0.bypass_on_client_failure.0.value"); ok {
+ bypassOnClientFailurePayload["value"] = strconv.FormatBool(v.(bool))
+ }
+ httpsInspectionPayload["bypass-on-client-failure"] = bypassOnClientFailurePayload
+ }
+ if _, ok := d.GetOk("https_inspection.0.bypass_under_load"); ok {
+
+ bypassUnderLoadPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("https_inspection.0.bypass_under_load.0.value"); ok {
+ bypassUnderLoadPayload["value"] = strconv.FormatBool(v.(bool))
+ }
+ httpsInspectionPayload["bypass-under-load"] = bypassUnderLoadPayload
+ }
+ if _, ok := d.GetOk("https_inspection.0.outbound_certificate"); ok {
+
+ outboundCertificatePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("https_inspection.0.outbound_certificate.0.override_profile"); ok {
+ outboundCertificatePayload["override-profile"] = strconv.FormatBool(v.(bool))
+ }
+ if v, ok := d.GetOk("https_inspection.0.outbound_certificate.0.value"); ok {
+ outboundCertificatePayload["value"] = v.(string)
+ }
+ httpsInspectionPayload["outbound-certificate"] = outboundCertificatePayload
+ }
+ if v, ok := d.GetOk("https_inspection.0.deployment_mode"); ok {
+ httpsInspectionPayload["deployment-mode"] = v.(string)
+ }
gateway["https-inspection"] = httpsInspectionPayload
}
}
@@ -2122,26 +3282,108 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
gateway["identity-awareness"] = v.(bool)
}
- if v, ok := d.GetOk("identity_awareness_settings"); ok {
+ if v, ok := d.GetOk("identity_awareness_settings"); ok {
+
+ identityAwarenessSettingsList := v.([]interface{})
+
+ if len(identityAwarenessSettingsList) > 0 {
+
+ identityAwarenessSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication"); ok {
+ identityAwarenessSettingsPayload["browser-based-authentication"] = v.(bool)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings"); ok {
+
+ browserBasedAuthenticationSettingsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings"); ok {
+ authenticationSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.authentication_method"); ok {
+ authenticationSettingsPayload["authentication-method"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.identity_provider"); ok {
+ authenticationSettingsPayload["identity-provider"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.radius"); ok {
+ authenticationSettingsPayload["radius"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories"); ok {
+
+ usersDirectoriesPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.external_user_profile"); ok {
+ usersDirectoriesPayload["external-user-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.internal_users"); ok {
+ usersDirectoriesPayload["internal-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.specific"); ok {
+ usersDirectoriesPayload["specific"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.users_from_external_directories"); ok {
+ usersDirectoriesPayload["users-from-external-directories"] = v.(string)
+ }
+ authenticationSettingsPayload["users-directories"] = usersDirectoriesPayload
+ }
+ browserBasedAuthenticationSettingsPayload["authentication-settings"] = authenticationSettingsPayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings"); ok {
+ browserBasedAuthenticationPortalSettingsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility"); ok {
+
+ accessibilityPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.allow_access_from"); ok {
+ accessibilityPayload["allow-access-from"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings"); ok {
- identityAwarenessSettingsList := v.([]interface{})
+ internalAccessSettingsPayload := make(map[string]interface{})
- if len(identityAwarenessSettingsList) > 0 {
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings.0.dmz"); ok {
+ internalAccessSettingsPayload["dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings.0.undefined"); ok {
+ internalAccessSettingsPayload["undefined"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings.0.vpn"); ok {
+ internalAccessSettingsPayload["vpn"] = v.(bool)
+ }
+ accessibilityPayload["internal-access-settings"] = internalAccessSettingsPayload
+ }
+ browserBasedAuthenticationPortalSettingsPayload["accessibility"] = accessibilityPayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.certificate_settings"); ok {
- identityAwarenessSettingsPayload := make(map[string]interface{})
+ certificateSettingsPayload := make(map[string]interface{})
- if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication"); ok {
- identityAwarenessSettingsPayload["browser-based-authentication"] = v.(bool)
- }
- if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings"); ok {
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.certificate_settings.0.base64_certificate"); ok {
+ certificateSettingsPayload["base64-certificate"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.certificate_settings.0.base64_password"); ok {
+ certificateSettingsPayload["base64-password"] = v.(string)
+ }
+ browserBasedAuthenticationPortalSettingsPayload["certificate-settings"] = certificateSettingsPayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings"); ok {
- browserBasedAuthenticationSettingsPayload := make(map[string]interface{})
+ portalWebSettingsPayload := make(map[string]interface{})
- if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings"); ok {
- browserBasedAuthenticationSettingsPayload["authentication-settings"] = v
- }
- if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings"); ok {
- browserBasedAuthenticationSettingsPayload["browser-based-authentication-portal-settings"] = v
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings.0.aliases"); ok {
+ portalWebSettingsPayload["aliases"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings.0.ip_address"); ok {
+ portalWebSettingsPayload["ip-address"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings.0.main_url"); ok {
+ portalWebSettingsPayload["main-url"] = v.(string)
+ }
+ browserBasedAuthenticationPortalSettingsPayload["portal-web-settings"] = portalWebSettingsPayload
+ }
+ browserBasedAuthenticationSettingsPayload["browser-based-authentication-portal-settings"] = browserBasedAuthenticationPortalSettingsPayload
}
identityAwarenessSettingsPayload["browser-based-authentication-settings"] = browserBasedAuthenticationSettingsPayload
}
@@ -2158,11 +3400,63 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.user_reauthenticate_interval"); ok {
identityAgentSettingsPayload["user-reauthenticate-interval"] = v
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings"); ok {
- identityAgentSettingsPayload["authentication-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings"); ok {
+ authenticationSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.authentication_method"); ok {
+ authenticationSettingsPayload["authentication-method"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.radius"); ok {
+ authenticationSettingsPayload["radius"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories"); ok {
+
+ usersDirectoriesPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.external_user_profile"); ok {
+ usersDirectoriesPayload["external-user-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.internal_users"); ok {
+ usersDirectoriesPayload["internal-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.specific"); ok {
+ usersDirectoriesPayload["specific"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.users_from_external_directories"); ok {
+ usersDirectoriesPayload["users-from-external-directories"] = v.(string)
+ }
+ authenticationSettingsPayload["users-directories"] = usersDirectoriesPayload
+ }
+ identityAgentSettingsPayload["authentication-settings"] = authenticationSettingsPayload
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings"); ok {
- identityAgentSettingsPayload["identity-agent-portal-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings"); ok {
+ identityAgentPortalSettingsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility"); ok {
+
+ accessibilityPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.allow_access_from"); ok {
+ accessibilityPayload["allow-access-from"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings"); ok {
+
+ internalAccessSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings.0.dmz"); ok {
+ internalAccessSettingsPayload["dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings.0.undefined"); ok {
+ internalAccessSettingsPayload["undefined"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings.0.vpn"); ok {
+ internalAccessSettingsPayload["vpn"] = v.(bool)
+ }
+ accessibilityPayload["internal-access-settings"] = internalAccessSettingsPayload
+ }
+ identityAgentPortalSettingsPayload["accessibility"] = accessibilityPayload
+ }
+ identityAgentSettingsPayload["identity-agent-portal-settings"] = identityAgentPortalSettingsPayload
}
identityAwarenessSettingsPayload["identity-agent-settings"] = identityAgentSettingsPayload
}
@@ -2176,11 +3470,57 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authorized_clients"); ok {
identityCollectorSettingsPayload["authorized-clients"] = v.(*schema.Set).List()
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings"); ok {
- identityCollectorSettingsPayload["authentication-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings"); ok {
+ authenticationSettingsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories"); ok {
+
+ usersDirectoriesPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.external_user_profile"); ok {
+ usersDirectoriesPayload["external-user-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.internal_users"); ok {
+ usersDirectoriesPayload["internal-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.specific"); ok {
+ usersDirectoriesPayload["specific"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.users_from_external_directories"); ok {
+ usersDirectoriesPayload["users-from-external-directories"] = v.(string)
+ }
+ authenticationSettingsPayload["users-directories"] = usersDirectoriesPayload
+ }
+ identityCollectorSettingsPayload["authentication-settings"] = authenticationSettingsPayload
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions"); ok {
- identityCollectorSettingsPayload["client-access-permissions"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions"); ok {
+ clientAccessPermissionsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility"); ok {
+
+ accessibilityPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.allow_access_from"); ok {
+ accessibilityPayload["allow-access-from"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings"); ok {
+
+ internalAccessSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.dmz"); ok {
+ internalAccessSettingsPayload["dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.undefined"); ok {
+ internalAccessSettingsPayload["undefined"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.vpn"); ok {
+ internalAccessSettingsPayload["vpn"] = v.(bool)
+ }
+ accessibilityPayload["internal-access-settings"] = internalAccessSettingsPayload
+ }
+ clientAccessPermissionsPayload["accessibility"] = accessibilityPayload
+ }
+ identityCollectorSettingsPayload["client-access-permissions"] = clientAccessPermissionsPayload
}
identityAwarenessSettingsPayload["identity-collector-settings"] = identityCollectorSettingsPayload
}
@@ -2197,6 +3537,36 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.0.receive_from"); ok {
identitySharingSettingsPayload["receive-from"] = v.(*schema.Set).List()
}
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.cache_mode"); ok {
+
+ cacheModePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.cache_mode.0.override_profile"); ok {
+ cacheModePayload["override-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.cache_mode.0.value"); ok {
+ cacheModePayload["value"] = v.(bool)
+ }
+ identitySharingSettingsPayload["cache-mode"] = cacheModePayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.cache_mode_duration"); ok {
+
+ cacheModeDurationPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.cache_mode_duration.0.override_profile"); ok {
+ cacheModeDurationPayload["override-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.cache_mode_duration.0.value"); ok {
+ cacheModeDurationPayload["value"] = v.(int)
+ }
+ identitySharingSettingsPayload["cache-mode-duration"] = cacheModeDurationPayload
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.receive_from_infinity_identity"); ok {
+ identitySharingSettingsPayload["receive-from-infinity-identity"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.scaled_sharing"); ok {
+ identitySharingSettingsPayload["scaled-sharing"] = v.(bool)
+ }
identityAwarenessSettingsPayload["identity-sharing-settings"] = identitySharingSettingsPayload
}
if _, ok := d.GetOk("identity_awareness_settings.0.proxy_settings"); ok {
@@ -2211,6 +3581,9 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.remote_access"); ok {
identityAwarenessSettingsPayload["remote-access"] = v.(bool)
}
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_based_enforcement"); ok {
+ identityAwarenessSettingsPayload["identity-based-enforcement"] = v.(string)
+ }
gateway["identity-awareness-settings"] = identityAwarenessSettingsPayload
}
}
@@ -2249,6 +3622,9 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("nat_settings.0.method"); ok {
natSettingsPayload["method"] = v.(string)
}
+ if v, ok := d.GetOkExists("nat_settings.0.apply_control_connections"); ok {
+ natSettingsPayload["apply-control-connections"] = v.(bool)
+ }
gateway["nat-settings"] = natSettingsPayload
}
}
@@ -2268,6 +3644,9 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("platform_portal_settings.0.portal_web_settings.0.aliases"); ok {
portalWebSettingsPayload["aliases"] = v.(*schema.Set).List()
}
+ if v, ok := d.GetOk("platform_portal_settings.0.portal_web_settings.0.ip_address"); ok {
+ portalWebSettingsPayload["ip-address"] = v.(string)
+ }
if v, ok := d.GetOk("platform_portal_settings.0.portal_web_settings.0.main_url"); ok {
portalWebSettingsPayload["main-url"] = v.(string)
}
@@ -2356,6 +3735,9 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("usercheck_portal_settings.0.portal_web_settings.0.aliases"); ok {
portalWebSettingsPayload["aliases"] = v.(*schema.Set).List()
}
+ if v, ok := d.GetOk("usercheck_portal_settings.0.portal_web_settings.0.ip_address"); ok {
+ portalWebSettingsPayload["ip-address"] = v.(string)
+ }
if v, ok := d.GetOk("usercheck_portal_settings.0.portal_web_settings.0.main_url"); ok {
portalWebSettingsPayload["main-url"] = v.(string)
}
@@ -2405,10 +3787,6 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
gateway["zero-phishing"] = v.(bool)
}
- if v, ok := d.GetOk("zero_phishing_fqdn"); ok {
- gateway["zero-phishing-fqdn"] = v.(string)
- }
-
if v, ok := d.GetOk("interfaces"); ok {
interfacesList := v.([]interface{})
if len(interfacesList) > 0 {
@@ -2446,6 +3824,18 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".anti_spoofing_settings.0.action"); ok {
antiSpoofingSettings["action"] = v.(string)
}
+ if v, ok := d.GetOkExists("interfaces.0.anti_spoofing_settings.0.exclude_packets"); ok {
+ antiSpoofingSettings["exclude-packets"] = v.(bool)
+ }
+ if v, ok := d.GetOk("interfaces.0.anti_spoofing_settings.0.excluded_network_name"); ok {
+ antiSpoofingSettings["excluded-network-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("interfaces.0.anti_spoofing_settings.0.excluded_network_uid"); ok {
+ antiSpoofingSettings["excluded-network-uid"] = v.(string)
+ }
+ if v, ok := d.GetOk("interfaces.0.anti_spoofing_settings.0.spoof_tracking"); ok {
+ antiSpoofingSettings["spoof-tracking"] = v.(string)
+ }
interfacePayload["anti-spoofing-settings"] = antiSpoofingSettings
}
if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".security_zone"); ok {
@@ -2485,6 +3875,9 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".comments"); ok {
interfacePayload["comments"] = v.(string)
}
+ if v, ok := d.GetOkExists("interfaces." + strconv.Itoa(i) + ".dynamic_ip"); ok {
+ interfacePayload["dynamic-ip"] = v.(bool)
+ }
interfacesPayload = append(interfacesPayload, interfacePayload)
}
gateway["interfaces"] = interfacesPayload
@@ -2712,6 +4105,147 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("vpn_settings.0.authentication.0.authentication_clients"); ok {
authenticationPayload["authentication-clients"] = v.(*schema.Set).List()
}
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client"); ok {
+
+ singleAuthenticationClientPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.single_authentication_client.0.enabled"); ok {
+ singleAuthenticationClientPayload["enabled"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.single_authentication_client.0.allow_multiple_authentication_clients"); ok {
+ singleAuthenticationClientPayload["allow-multiple-authentication-clients"] = v.(bool)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.display_name"); ok {
+ singleAuthenticationClientPayload["display-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.method"); ok {
+ singleAuthenticationClientPayload["method"] = v.(string)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.secur_id"); ok {
+
+ securIdPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.secur_id.0.server"); ok {
+ securIdPayload["server"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.secur_id.0.token_card_type"); ok {
+ securIdPayload["token-card-type"] = v.(string)
+ }
+ singleAuthenticationClientPayload["secur-id"] = securIdPayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.radius"); ok {
+
+ radiusPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.radius.0.server"); ok {
+ radiusPayload["server"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.single_authentication_client.0.radius.0.ask_user_password"); ok {
+ radiusPayload["ask-user-password"] = v.(bool)
+ }
+ singleAuthenticationClientPayload["radius"] = radiusPayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate"); ok {
+
+ personalCertificatePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.fetch_username_from"); ok {
+ personalCertificatePayload["fetch-username-from"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.storage_type"); ok {
+ personalCertificatePayload["storage-type"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.source"); ok {
+ personalCertificatePayload["source"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.dn_part"); ok {
+ personalCertificatePayload["dn-part"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.dn_concurrence"); ok {
+ personalCertificatePayload["dn-concurrence"] = v.(int)
+ }
+ singleAuthenticationClientPayload["personal-certificate"] = personalCertificatePayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings"); ok {
+
+ clientDisplaySettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings.0.headline"); ok {
+ clientDisplaySettingsPayload["headline"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings.0.username_label"); ok {
+ clientDisplaySettingsPayload["username-label"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings.0.password_label"); ok {
+ clientDisplaySettingsPayload["password-label"] = v.(string)
+ }
+ singleAuthenticationClientPayload["client-display-settings"] = clientDisplaySettingsPayload
+ }
+ authenticationPayload["single-authentication-client"] = singleAuthenticationClientPayload
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.override_global_dynamic_id_settings"); ok {
+ authenticationPayload["override-global-dynamic-id-settings"] = v.(bool)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings"); ok {
+
+ dynamicIdSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_and_email_settings"); ok {
+ dynamicIdSettingsPayload["sms-provider-and-email-settings"] = v.(string)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials"); ok {
+
+ smsProviderCredentialsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials.0.username"); ok {
+ smsProviderCredentialsPayload["username"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials.0.password"); ok {
+ smsProviderCredentialsPayload["password"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials.0.api_id"); ok {
+ smsProviderCredentialsPayload["api-id"] = v.(string)
+ }
+ dynamicIdSettingsPayload["sms-provider-credentials"] = smsProviderCredentialsPayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings"); ok {
+
+ advancedSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.dynamic_id_message"); ok {
+ advancedSettingsPayload["dynamic-id-message"] = v.(string)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings"); ok {
+
+ otpSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings.0.length"); ok {
+ otpSettingsPayload["length"] = v.(int)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings.0.expiration"); ok {
+ otpSettingsPayload["expiration"] = v.(int)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings.0.max_attempts"); ok {
+ otpSettingsPayload["max-attempts"] = v.(int)
+ }
+ advancedSettingsPayload["otp-settings"] = otpSettingsPayload
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.enable_display_user_details"); ok {
+ advancedSettingsPayload["enable-display-user-details"] = v.(bool)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.country_code"); ok {
+ advancedSettingsPayload["country-code"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.user_details_retrieval"); ok {
+ advancedSettingsPayload["user-details-retrieval"] = v.(string)
+ }
+ dynamicIdSettingsPayload["advanced-settings"] = advancedSettingsPayload
+ }
+ authenticationPayload["dynamic-id-settings"] = dynamicIdSettingsPayload
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.send_machine_certificate"); ok {
+ authenticationPayload["send-machine-certificate"] = v.(string)
+ }
vpnSettingsPayload["authentication"] = authenticationPayload
}
if _, ok := d.GetOk("vpn_settings.0.certificates"); ok {
@@ -2816,6 +4350,27 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("vpn_settings.0.link_selection.0.outgoing_link_tracking"); ok {
linkSelectionPayload["outgoing-link-tracking"] = v.(string)
}
+ if _, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings"); ok {
+
+ probingSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.probed_interfaces"); ok {
+ probingSettingsPayload["probed-interfaces"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.probed_interface_list"); ok {
+ probingSettingsPayload["probed-interface-list"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.link_selection.0.probing_settings.0.use_primary_address"); ok {
+ probingSettingsPayload["use-primary-address"] = v.(bool)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.primary_address"); ok {
+ probingSettingsPayload["primary-address"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.probing_method"); ok {
+ probingSettingsPayload["probing-method"] = v.(string)
+ }
+ linkSelectionPayload["probing-settings"] = probingSettingsPayload
+ }
vpnSettingsPayload["link-selection"] = linkSelectionPayload
}
if v, ok := d.GetOk("vpn_settings.0.maximum_concurrent_ike_negotiations"); ok {
@@ -3186,6 +4741,15 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("logs_settings.0.update_account_log_every"); ok {
logsSettingsPayload["update-account-log-every"] = v.(int)
}
+ if v, ok := d.GetOkExists("logs_settings.0.distribute_logs_between_all_active_servers"); ok {
+ logsSettingsPayload["distribute-logs-between-all-active-servers"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.include_tcp_state_information"); ok {
+ logsSettingsPayload["include-tcp-state-information"] = v.(string)
+ }
+ if v, ok := d.GetOk("logs_settings.0.free_disk_space_metrics"); ok {
+ logsSettingsPayload["free-disk-space-metrics"] = v.(string)
+ }
gateway["logs-settings"] = logsSettingsPayload
}
}
@@ -3209,6 +4773,123 @@ func createManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
log.Println("Create Simple Gateway - Map = ", gateway)
+ if v, ok := d.GetOkExists("accept_syslog_messages"); ok {
+ gateway["accept-syslog-messages"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("anti_spam_and_email_security"); ok {
+ gateway["anti-spam-and-email-security"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("auto_generate_ip"); ok {
+ gateway["auto-generate-ip"] = v.(bool)
+ }
+ if v, ok := d.GetOk("auto_topology_custom_recalculation_time"); ok {
+ gateway["auto-topology-custom-recalculation-time"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("auto_topology_use_custom_recalculation_time"); ok {
+ gateway["auto-topology-use-custom-recalculation-time"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("data_loss_prevention"); ok {
+ gateway["data-loss-prevention"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("enable_log_indexing"); ok {
+ gateway["enable-log-indexing"] = v.(bool)
+ }
+ if v, ok := d.GetOk("hardware_subtype"); ok {
+ gateway["hardware-subtype"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("install_policy_without_push"); ok {
+ gateway["install-policy-without-push"] = v.(bool)
+ }
+ if v, ok := d.GetOk("interfaces_topology_settings"); ok {
+ gateway["interfaces-topology-settings"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("mobile_access"); ok {
+ gateway["mobile-access"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("monitoring"); ok {
+ gateway["monitoring"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("policy_server"); ok {
+ gateway["policy-server"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("rtm_counters_report"); ok {
+ gateway["rtm-counters-report"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("rtm_traffic_report"); ok {
+ gateway["rtm-traffic-report"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("rtm_traffic_report_per_connection"); ok {
+ gateway["rtm-traffic-report-per-connection"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("smart_event_intro_correlation_unit"); ok {
+ gateway["smart-event-intro-correlation-unit"] = v.(bool)
+ }
+ if v, ok := d.GetOk("threat_prevention_mode"); ok {
+ gateway["threat-prevention-mode"] = v.(string)
+ }
+ if v, ok := d.GetOk("trust_method"); ok {
+ gateway["trust-method"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("workforce_ai"); ok {
+ gateway["workforce-ai"] = v.(bool)
+ }
+ if _, ok := d.GetOk("communication_with_servers_behind_nat"); ok {
+
+ communicationWithServersBehindNatPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("communication_with_servers_behind_nat.0.override_profile"); ok {
+ communicationWithServersBehindNatPayload["override-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOk("communication_with_servers_behind_nat.0.value"); ok {
+ communicationWithServersBehindNatPayload["value"] = v.(string)
+ }
+ gateway["communication-with-servers-behind-nat"] = communicationWithServersBehindNatPayload
+ }
+ if _, ok := d.GetOk("zero_phishing_settings"); ok {
+
+ zeroPhishingSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("zero_phishing_settings.0.gateway_fqdn_mode"); ok {
+ zeroPhishingSettingsPayload["gateway-fqdn-mode"] = v.(string)
+ }
+ if v, ok := d.GetOk("zero_phishing_settings.0.manual_fqdn"); ok {
+ zeroPhishingSettingsPayload["manual-fqdn"] = v.(string)
+ }
+ gateway["zero-phishing-settings"] = zeroPhishingSettingsPayload
+ }
+ if _, ok := d.GetOk("trust_settings"); ok {
+ trustSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("trust_settings.0.gateway_mac_address"); ok {
+ trustSettingsPayload["gateway-mac-address"] = v.(string)
+ }
+ if v, ok := d.GetOk("trust_settings.0.identification_method"); ok {
+ trustSettingsPayload["identification-method"] = v.(string)
+ }
+ if v, ok := d.GetOk("trust_settings.0.initiation_phase"); ok {
+ trustSettingsPayload["initiation-phase"] = v.(string)
+ }
+ gateway["trust-settings"] = trustSettingsPayload
+ }
+
+ if _, ok := d.GetOk("fetch_policy_scheduler"); ok {
+ fetchPolicySchedulerPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("fetch_policy_scheduler.0.enabled"); ok {
+ fetchPolicySchedulerPayload["enabled"] = v.(bool)
+ }
+ if v, ok := d.GetOk("fetch_policy_scheduler.0.schedule"); ok {
+ fetchPolicySchedulerPayload["schedule"] = v.(string)
+ }
+ gateway["fetch-policy-scheduler"] = fetchPolicySchedulerPayload
+ }
+
+ if v, ok := d.GetOk("export_logs_to_servers"); ok {
+ gateway["export-logs-to-servers"] = v.(*schema.Set).List()
+ }
+
+ if v, ok := d.GetOkExists("show_portals_certificate"); ok {
+ gateway["show-portals-certificate"] = v.(bool)
+ }
+
addGatewayRes, err := client.ApiCall("add-simple-gateway", gateway, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !addGatewayRes.Success {
if addGatewayRes.ErrorMsg != "" {
@@ -3405,6 +5086,51 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
httpsInspectionMapToReturn["deny_expired_server_cert"] = []interface{}{denyExpiredServerCertMapToReturn}
}
}
+ if v, ok := httpsInspectionMap["bypass-on-client-failure"]; ok {
+
+ bypassOnClientFailureMap, ok := v.(map[string]interface{})
+ if ok {
+ bypassOnClientFailureMapToReturn := make(map[string]interface{})
+
+ if v, _ := bypassOnClientFailureMap["override-profile"]; v != nil {
+ bypassOnClientFailureMapToReturn["override_profile"] = v
+ }
+ if v, _ := bypassOnClientFailureMap["value"]; v != nil {
+ bypassOnClientFailureMapToReturn["value"] = v
+ }
+ httpsInspectionMapToReturn["bypass_on_client_failure"] = []interface{}{bypassOnClientFailureMapToReturn}
+ }
+ }
+ if v, ok := httpsInspectionMap["bypass-under-load"]; ok {
+
+ bypassUnderLoadMap, ok := v.(map[string]interface{})
+ if ok {
+ bypassUnderLoadMapToReturn := make(map[string]interface{})
+
+ if v, _ := bypassUnderLoadMap["value"]; v != nil {
+ bypassUnderLoadMapToReturn["value"] = v
+ }
+ httpsInspectionMapToReturn["bypass_under_load"] = []interface{}{bypassUnderLoadMapToReturn}
+ }
+ }
+ if v, ok := httpsInspectionMap["outbound-certificate"]; ok {
+
+ outboundCertificateMap, ok := v.(map[string]interface{})
+ if ok {
+ outboundCertificateMapToReturn := make(map[string]interface{})
+
+ if v, _ := outboundCertificateMap["override-profile"]; v != nil {
+ outboundCertificateMapToReturn["override_profile"] = v
+ }
+ if v, _ := outboundCertificateMap["value"]; v != nil {
+ outboundCertificateMapToReturn["value"] = v.(map[string]interface{})["name"]
+ }
+ httpsInspectionMapToReturn["outbound_certificate"] = []interface{}{outboundCertificateMapToReturn}
+ }
+ }
+ if v, _ := httpsInspectionMap["deployment-mode"]; v != nil {
+ httpsInspectionMapToReturn["deployment_mode"] = v
+ }
_ = d.Set("https_inspection", []interface{}{httpsInspectionMapToReturn})
}
@@ -3433,10 +5159,87 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
browserBasedAuthenticationSettingsMapToReturn := make(map[string]interface{})
if v, _ := browserBasedAuthenticationSettingsMap["authentication-settings"]; v != nil {
- browserBasedAuthenticationSettingsMapToReturn["authentication_settings"] = v
+ authenticationSettingsMap := v.(map[string]interface{})
+ authenticationSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := authenticationSettingsMap["authentication-method"]; v != nil {
+ authenticationSettingsMapToReturn["authentication_method"] = v
+ }
+ if v, _ := authenticationSettingsMap["identity-provider"]; v != nil {
+ authenticationSettingsMapToReturn["identity_provider"] = v
+ }
+ if v, _ := authenticationSettingsMap["radius"]; v != nil {
+ authenticationSettingsMapToReturn["radius"] = v
+ }
+ if v, _ := authenticationSettingsMap["users-directories"]; v != nil {
+ usersDirectoriesMap := v.(map[string]interface{})
+ usersDirectoriesMapToReturn := make(map[string]interface{})
+ if v, _ := usersDirectoriesMap["external-user-profile"]; v != nil {
+ usersDirectoriesMapToReturn["external_user_profile"] = v
+ }
+ if v, _ := usersDirectoriesMap["internal-users"]; v != nil {
+ usersDirectoriesMapToReturn["internal_users"] = v
+ }
+ if v, _ := usersDirectoriesMap["specific"]; v != nil {
+ usersDirectoriesMapToReturn["specific"] = v
+ }
+ if v, _ := usersDirectoriesMap["users-from-external-directories"]; v != nil {
+ usersDirectoriesMapToReturn["users_from_external_directories"] = v
+ }
+ authenticationSettingsMapToReturn["users_directories"] = []interface{}{usersDirectoriesMapToReturn}
+ }
+ browserBasedAuthenticationSettingsMapToReturn["authentication_settings"] = []interface{}{authenticationSettingsMapToReturn}
}
if v, _ := browserBasedAuthenticationSettingsMap["browser-based-authentication-portal-settings"]; v != nil {
- browserBasedAuthenticationSettingsMapToReturn["browser_based_authentication_portal_settings"] = v
+ browserBasedAuthenticationPortalSettingsMap := v.(map[string]interface{})
+ browserBasedAuthenticationPortalSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := browserBasedAuthenticationPortalSettingsMap["accessibility"]; v != nil {
+ accessibilityMap := v.(map[string]interface{})
+ accessibilityMapToReturn := make(map[string]interface{})
+ if v, _ := accessibilityMap["allow-access-from"]; v != nil {
+ accessibilityMapToReturn["allow_access_from"] = v
+ }
+ if v, _ := accessibilityMap["internal-access-settings"]; v != nil {
+ internalAccessSettingsMap := v.(map[string]interface{})
+ internalAccessSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := internalAccessSettingsMap["dmz"]; v != nil {
+ internalAccessSettingsMapToReturn["dmz"] = v
+ }
+ if v, _ := internalAccessSettingsMap["undefined"]; v != nil {
+ internalAccessSettingsMapToReturn["undefined"] = v
+ }
+ if v, _ := internalAccessSettingsMap["vpn"]; v != nil {
+ internalAccessSettingsMapToReturn["vpn"] = v
+ }
+ accessibilityMapToReturn["internal_access_settings"] = []interface{}{internalAccessSettingsMapToReturn}
+ }
+ browserBasedAuthenticationPortalSettingsMapToReturn["accessibility"] = []interface{}{accessibilityMapToReturn}
+ }
+ if v, _ := browserBasedAuthenticationPortalSettingsMap["certificate-settings"]; v != nil {
+ certificateSettingsMap := v.(map[string]interface{})
+ certificateSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := certificateSettingsMap["base64-certificate"]; v != nil {
+ certificateSettingsMapToReturn["base64_certificate"] = v
+ }
+ if v, _ := certificateSettingsMap["base64-password"]; v != nil {
+ certificateSettingsMapToReturn["base64_password"] = v
+ }
+ browserBasedAuthenticationPortalSettingsMapToReturn["certificate_settings"] = []interface{}{certificateSettingsMapToReturn}
+ }
+ if v, _ := browserBasedAuthenticationPortalSettingsMap["portal-web-settings"]; v != nil {
+ portalWebSettingsMap := v.(map[string]interface{})
+ portalWebSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := portalWebSettingsMap["aliases"]; v != nil {
+ portalWebSettingsMapToReturn["aliases"] = v
+ }
+ if v, _ := portalWebSettingsMap["main-url"]; v != nil {
+ portalWebSettingsMapToReturn["main_url"] = v
+ }
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
+ browserBasedAuthenticationPortalSettingsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
+ }
+ browserBasedAuthenticationSettingsMapToReturn["browser_based_authentication_portal_settings"] = []interface{}{browserBasedAuthenticationPortalSettingsMapToReturn}
}
identityAwarenessSettingsMapToReturn["browser_based_authentication_settings"] = []interface{}{browserBasedAuthenticationSettingsMapToReturn}
}
@@ -3457,10 +5260,59 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
identityAgentSettingsMapToReturn["user_reauthenticate_interval"] = v
}
if v, _ := identityAgentSettingsMap["authentication-settings"]; v != nil {
- identityAgentSettingsMapToReturn["authentication_settings"] = v
+ authenticationSettingsMap := v.(map[string]interface{})
+ authenticationSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := authenticationSettingsMap["authentication-method"]; v != nil {
+ authenticationSettingsMapToReturn["authentication_method"] = v
+ }
+ if v, _ := authenticationSettingsMap["radius"]; v != nil {
+ authenticationSettingsMapToReturn["radius"] = v
+ }
+ if v, _ := authenticationSettingsMap["users-directories"]; v != nil {
+ usersDirectoriesMap := v.(map[string]interface{})
+ usersDirectoriesMapToReturn := make(map[string]interface{})
+ if v, _ := usersDirectoriesMap["external-user-profile"]; v != nil {
+ usersDirectoriesMapToReturn["external_user_profile"] = v
+ }
+ if v, _ := usersDirectoriesMap["internal-users"]; v != nil {
+ usersDirectoriesMapToReturn["internal_users"] = v
+ }
+ if v, _ := usersDirectoriesMap["specific"]; v != nil {
+ usersDirectoriesMapToReturn["specific"] = v
+ }
+ if v, _ := usersDirectoriesMap["users-from-external-directories"]; v != nil {
+ usersDirectoriesMapToReturn["users_from_external_directories"] = v
+ }
+ authenticationSettingsMapToReturn["users_directories"] = []interface{}{usersDirectoriesMapToReturn}
+ }
+ identityAgentSettingsMapToReturn["authentication_settings"] = []interface{}{authenticationSettingsMapToReturn}
}
if v, _ := identityAgentSettingsMap["identity-agent-portal-settings"]; v != nil {
- identityAgentSettingsMapToReturn["identity_agent_portal_settings"] = v
+ identityAgentPortalSettingsMap := v.(map[string]interface{})
+ identityAgentPortalSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := identityAgentPortalSettingsMap["accessibility"]; v != nil {
+ accessibilityMap := v.(map[string]interface{})
+ accessibilityMapToReturn := make(map[string]interface{})
+ if v, _ := accessibilityMap["allow-access-from"]; v != nil {
+ accessibilityMapToReturn["allow_access_from"] = v
+ }
+ if v, _ := accessibilityMap["internal-access-settings"]; v != nil {
+ internalAccessSettingsMap := v.(map[string]interface{})
+ internalAccessSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := internalAccessSettingsMap["dmz"]; v != nil {
+ internalAccessSettingsMapToReturn["dmz"] = v
+ }
+ if v, _ := internalAccessSettingsMap["undefined"]; v != nil {
+ internalAccessSettingsMapToReturn["undefined"] = v
+ }
+ if v, _ := internalAccessSettingsMap["vpn"]; v != nil {
+ internalAccessSettingsMapToReturn["vpn"] = v
+ }
+ accessibilityMapToReturn["internal_access_settings"] = []interface{}{internalAccessSettingsMapToReturn}
+ }
+ identityAgentPortalSettingsMapToReturn["accessibility"] = []interface{}{accessibilityMapToReturn}
+ }
+ identityAgentSettingsMapToReturn["identity_agent_portal_settings"] = []interface{}{identityAgentPortalSettingsMapToReturn}
}
identityAwarenessSettingsMapToReturn["identity_agent_settings"] = []interface{}{identityAgentSettingsMapToReturn}
}
@@ -3478,10 +5330,53 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
identityCollectorSettingsMapToReturn["authorized_clients"] = v
}
if v, _ := identityCollectorSettingsMap["authentication-settings"]; v != nil {
- identityCollectorSettingsMapToReturn["authentication_settings"] = v
+ authenticationSettingsMap := v.(map[string]interface{})
+ authenticationSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := authenticationSettingsMap["users-directories"]; v != nil {
+ usersDirectoriesMap := v.(map[string]interface{})
+ usersDirectoriesMapToReturn := make(map[string]interface{})
+ if v, _ := usersDirectoriesMap["external-user-profile"]; v != nil {
+ usersDirectoriesMapToReturn["external_user_profile"] = v
+ }
+ if v, _ := usersDirectoriesMap["internal-users"]; v != nil {
+ usersDirectoriesMapToReturn["internal_users"] = v
+ }
+ if v, _ := usersDirectoriesMap["specific"]; v != nil {
+ usersDirectoriesMapToReturn["specific"] = v
+ }
+ if v, _ := usersDirectoriesMap["users-from-external-directories"]; v != nil {
+ usersDirectoriesMapToReturn["users_from_external_directories"] = v
+ }
+ authenticationSettingsMapToReturn["users_directories"] = []interface{}{usersDirectoriesMapToReturn}
+ }
+ identityCollectorSettingsMapToReturn["authentication_settings"] = []interface{}{authenticationSettingsMapToReturn}
}
if v, _ := identityCollectorSettingsMap["client-access-permissions"]; v != nil {
- identityCollectorSettingsMapToReturn["client_access_permissions"] = v
+ clientAccessPermissionsMap := v.(map[string]interface{})
+ clientAccessPermissionsMapToReturn := make(map[string]interface{})
+ if v, _ := clientAccessPermissionsMap["accessibility"]; v != nil {
+ accessibilityMap := v.(map[string]interface{})
+ accessibilityMapToReturn := make(map[string]interface{})
+ if v, _ := accessibilityMap["allow-access-from"]; v != nil {
+ accessibilityMapToReturn["allow_access_from"] = v
+ }
+ if v, _ := accessibilityMap["internal-access-settings"]; v != nil {
+ internalAccessSettingsMap := v.(map[string]interface{})
+ internalAccessSettingsMapToReturn := make(map[string]interface{})
+ if v, _ := internalAccessSettingsMap["dmz"]; v != nil {
+ internalAccessSettingsMapToReturn["dmz"] = v
+ }
+ if v, _ := internalAccessSettingsMap["undefined"]; v != nil {
+ internalAccessSettingsMapToReturn["undefined"] = v
+ }
+ if v, _ := internalAccessSettingsMap["vpn"]; v != nil {
+ internalAccessSettingsMapToReturn["vpn"] = v
+ }
+ accessibilityMapToReturn["internal_access_settings"] = []interface{}{internalAccessSettingsMapToReturn}
+ }
+ clientAccessPermissionsMapToReturn["accessibility"] = []interface{}{accessibilityMapToReturn}
+ }
+ identityCollectorSettingsMapToReturn["client_access_permissions"] = []interface{}{clientAccessPermissionsMapToReturn}
}
identityAwarenessSettingsMapToReturn["identity_collector_settings"] = []interface{}{identityCollectorSettingsMapToReturn}
}
@@ -3501,6 +5396,34 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
if v, _ := identitySharingSettingsMap["receive-from"]; v != nil {
identitySharingSettingsMapToReturn["receive_from"] = v
}
+ if v, _ := identitySharingSettingsMap["cache-mode"]; v != nil {
+ cacheModeMap := v.(map[string]interface{})
+ cacheModeMapToReturn := make(map[string]interface{})
+ if v, _ := cacheModeMap["override-profile"]; v != nil {
+ cacheModeMapToReturn["override_profile"] = v
+ }
+ if v, _ := cacheModeMap["value"]; v != nil {
+ cacheModeMapToReturn["value"] = v
+ }
+ identitySharingSettingsMapToReturn["cache_mode"] = []interface{}{cacheModeMapToReturn}
+ }
+ if v, _ := identitySharingSettingsMap["cache-mode-duration"]; v != nil {
+ cacheModeDurationMap := v.(map[string]interface{})
+ cacheModeDurationMapToReturn := make(map[string]interface{})
+ if v, _ := cacheModeDurationMap["override-profile"]; v != nil {
+ cacheModeDurationMapToReturn["override_profile"] = v
+ }
+ if v, _ := cacheModeDurationMap["value"]; v != nil {
+ cacheModeDurationMapToReturn["value"] = v
+ }
+ identitySharingSettingsMapToReturn["cache_mode_duration"] = []interface{}{cacheModeDurationMapToReturn}
+ }
+ if v, _ := identitySharingSettingsMap["receive-from-infinity-identity"]; v != nil {
+ identitySharingSettingsMapToReturn["receive_from_infinity_identity"] = v
+ }
+ if v, _ := identitySharingSettingsMap["scaled-sharing"]; v != nil {
+ identitySharingSettingsMapToReturn["scaled_sharing"] = v
+ }
identityAwarenessSettingsMapToReturn["identity_sharing_settings"] = []interface{}{identitySharingSettingsMapToReturn}
}
}
@@ -3519,6 +5442,108 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
if v := identityAwarenessSettingsMap["remote-access"]; v != nil {
identityAwarenessSettingsMapToReturn["remote_access"] = v
}
+ if v := identityAwarenessSettingsMap["identity-based-enforcement"]; v != nil {
+ identityAwarenessSettingsMapToReturn["identity_based_enforcement"] = v
+ }
+ if v := identityAwarenessSettingsMap["identity-web-api"]; v != nil {
+ identityAwarenessSettingsMapToReturn["identity_web_api"] = v
+ }
+ if v := identityAwarenessSettingsMap["identity-web-api-settings"]; v != nil {
+ identityWebApiSettingsShow := v.(map[string]interface{})
+ identityWebApiSettingsState := make(map[string]interface{})
+ if v := identityWebApiSettingsShow["authentication-settings"]; v != nil {
+ authenticationSettingsShow := v.(map[string]interface{})
+ authenticationSettingsState := make(map[string]interface{})
+ if v := authenticationSettingsShow["users-directories"]; v != nil {
+ usersDirectoriesShow := v.(map[string]interface{})
+ usersDirectoriesState := make(map[string]interface{})
+ if v := usersDirectoriesShow["external-user-profile"]; v != nil {
+ usersDirectoriesState["external_user_profile"] = v
+ }
+ if v := usersDirectoriesShow["internal-users"]; v != nil {
+ usersDirectoriesState["internal_users"] = v
+ }
+ if v := usersDirectoriesShow["specific"]; v != nil {
+ usersDirectoriesState["specific"] = v
+ }
+ if v := usersDirectoriesShow["users-from-external-directories"]; v != nil {
+ usersDirectoriesState["users_from_external_directories"] = v
+ }
+ if v := usersDirectoriesShow["specific"]; v != nil {
+ usersDirectoriesState["specific"] = v
+ }
+ authenticationSettingsState["users_directories"] = []interface{}{usersDirectoriesState}
+ }
+ identityWebApiSettingsState["authentication_settings"] = []interface{}{authenticationSettingsState}
+ }
+ if v := identityWebApiSettingsShow["authorized-clients"]; v != nil {
+ authorizedClientsShow := v.(map[string]interface{})
+ authorizedClientsState := make(map[string]interface{})
+ if v := authorizedClientsShow["client"]; v != nil {
+ authorizedClientsState["client"] = v
+ }
+ identityWebApiSettingsState["authorized_clients"] = []interface{}{authorizedClientsState}
+ }
+ if v := identityWebApiSettingsShow["client-access-permissions"]; v != nil {
+ clientAccessPermissionsShow := v.(map[string]interface{})
+ clientAccessPermissionsState := make(map[string]interface{})
+ if v := clientAccessPermissionsShow["accessibility"]; v != nil {
+ accessibilityShow := v.(map[string]interface{})
+ accessibilityState := make(map[string]interface{})
+ if v := accessibilityShow["allow-access-from"]; v != nil {
+ accessibilityState["allow_access_from"] = v
+ }
+ if v := accessibilityShow["internal-access-settings"]; v != nil {
+ internalAccessSettingsShow := v.(map[string]interface{})
+ internalAccessSettingsState := make(map[string]interface{})
+ if v := internalAccessSettingsShow["dmz"]; v != nil {
+ internalAccessSettingsState["dmz"] = v
+ }
+ if v := internalAccessSettingsShow["undefined"]; v != nil {
+ internalAccessSettingsState["undefined"] = v
+ }
+ if v := internalAccessSettingsShow["vpn"]; v != nil {
+ internalAccessSettingsState["vpn"] = v
+ }
+ accessibilityState["internal_access_settings"] = []interface{}{internalAccessSettingsState}
+ }
+ clientAccessPermissionsState["accessibility"] = []interface{}{accessibilityState}
+ }
+ if v := clientAccessPermissionsShow["certificate-settings"]; v != nil {
+ certificateSettingsShow := v.(map[string]interface{})
+ certificateSettingsState := make(map[string]interface{})
+ if v := certificateSettingsShow["certificate"]; v != nil {
+ certificateSettingsState["certificate"] = v
+ }
+ if v := certificateSettingsShow["certificate-dn"]; v != nil {
+ certificateSettingsState["certificate_dn"] = v
+ }
+ if v := certificateSettingsShow["certificate-valid-from"]; v != nil {
+ certificateSettingsState["certificate_valid_from"] = v
+ }
+ if v := certificateSettingsShow["certificate-valid-to"]; v != nil {
+ certificateSettingsState["certificate_valid_to"] = v
+ }
+ clientAccessPermissionsState["certificate_settings"] = []interface{}{certificateSettingsState}
+ }
+ if v := clientAccessPermissionsShow["portal-web-settings"]; v != nil {
+ portalWebSettingsShow := v.(map[string]interface{})
+ portalWebSettingsState := make(map[string]interface{})
+ if v := portalWebSettingsShow["aliases"]; v != nil {
+ portalWebSettingsState["aliases"] = v
+ }
+ if v := portalWebSettingsShow["ip-address"]; v != nil {
+ portalWebSettingsState["ip_address"] = v
+ }
+ if v := portalWebSettingsShow["main-url"]; v != nil {
+ portalWebSettingsState["main_url"] = v
+ }
+ clientAccessPermissionsState["portal_web_settings"] = []interface{}{portalWebSettingsState}
+ }
+ identityWebApiSettingsState["client_access_permissions"] = []interface{}{clientAccessPermissionsState}
+ }
+ identityAwarenessSettingsMapToReturn["identity_web_api_settings"] = []interface{}{identityWebApiSettingsState}
+ }
_ = d.Set("identity_awareness_settings", []interface{}{identityAwarenessSettingsMapToReturn})
}
@@ -3558,6 +5583,9 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
if v := natSettingsMap["method"]; v != nil {
natSettingsMapToReturn["method"] = v
}
+ if v := natSettingsMap["apply-control-connections"]; v != nil {
+ natSettingsMapToReturn["apply_control_connections"] = v
+ }
_ = d.Set("nat_settings", []interface{}{natSettingsMapToReturn})
} else {
@@ -3583,6 +5611,9 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
if v, _ := portalWebSettingsMap["main-url"]; v != nil {
portalWebSettingsMapToReturn["main_url"] = v
}
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
platformPortalSettingsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
}
}
@@ -3683,6 +5714,9 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
if v, _ := portalWebSettingsMap["main-url"]; v != nil {
portalWebSettingsMapToReturn["main_url"] = v
}
+ if v, _ := portalWebSettingsMap["ip-address"]; v != nil {
+ portalWebSettingsMapToReturn["ip_address"] = v
+ }
usercheckPortalSettingsMapToReturn["portal_web_settings"] = []interface{}{portalWebSettingsMapToReturn}
}
}
@@ -3781,6 +5815,18 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
if v, _ := antiSpoofingSettingsJson["action"]; v != nil {
antiSpoofingSettingsState["action"] = v
}
+ if v := antiSpoofingSettingsJson["exclude-packets"]; v != nil {
+ antiSpoofingSettingsState["exclude_packets"] = v
+ }
+ if v := antiSpoofingSettingsJson["excluded-network-name"]; v != nil {
+ antiSpoofingSettingsState["excluded_network_name"] = v
+ }
+ if v := antiSpoofingSettingsJson["excluded-network-uid"]; v != nil {
+ antiSpoofingSettingsState["excluded_network_uid"] = v
+ }
+ if v := antiSpoofingSettingsJson["spoof-tracking"]; v != nil {
+ antiSpoofingSettingsState["spoof_tracking"] = v
+ }
interfaceState["anti_spoofing_settings"] = []interface{}{antiSpoofingSettingsState}
}
if v, _ := interfaceJson["security-zone"]; v != nil {
@@ -3823,6 +5869,9 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
if v, _ := interfaceJson["comments"]; v != nil {
interfaceState["comments"] = v
}
+ if v, _ := interfaceJson["dynamic-ip"]; v != nil {
+ interfaceState["dynamic_ip"] = v
+ }
interfacesListState = append(interfacesListState, interfaceState)
}
_ = d.Set("interfaces", interfacesListState)
@@ -4114,6 +6163,12 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
if v := logSettingsJson["update-account-log-every"]; v != nil {
logSettingsState["update_account_log_every"] = int(math.Round(v.(float64)))
}
+ if v := logSettingsJson["distribute-logs-between-all-active-servers"]; v != nil {
+ logSettingsState["distribute_logs_between_all_active_servers"] = v
+ }
+ if v := logSettingsJson["include-tcp-state-information"]; v != nil {
+ logSettingsState["include_tcp_state_information"] = v
+ }
_ = d.Set("logs_settings", []interface{}{logSettingsState})
} else {
_ = d.Set("logs_settings", nil)
@@ -4161,6 +6216,138 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
}
authenticationState["authentication_clients"] = clientsIds
}
+ if v := authenticationJson["single-authentication-client"]; v != nil {
+ singleAuthenticationClientJson := v.(map[string]interface{})
+ singleAuthenticationClientState := make(map[string]interface{})
+ if v := singleAuthenticationClientJson["enabled"]; v != nil {
+ singleAuthenticationClientState["enabled"] = v
+ }
+ if v := singleAuthenticationClientJson["allow-multiple-authentication-clients"]; v != nil {
+ singleAuthenticationClientState["allow_multiple_authentication_clients"] = v
+ }
+ if v := singleAuthenticationClientJson["display-name"]; v != nil {
+ singleAuthenticationClientState["display_name"] = v
+ }
+ if v := singleAuthenticationClientJson["method"]; v != nil {
+ singleAuthenticationClientState["method"] = v
+ }
+ if v := singleAuthenticationClientJson["secur-id"]; v != nil {
+ securIdJson := v.(map[string]interface{})
+ securIdState := make(map[string]interface{})
+ if v := securIdJson["server"]; v != nil {
+ securIdState["server"] = v.(map[string]interface{})["name"]
+ }
+ if v := securIdJson["token-card-type"]; v != nil {
+ securIdState["token_card_type"] = v
+ }
+ singleAuthenticationClientState["secur_id"] = []interface{}{securIdState}
+ }
+ if v := singleAuthenticationClientJson["radius"]; v != nil {
+ radiusJson := v.(map[string]interface{})
+ radiusState := make(map[string]interface{})
+ if v := radiusJson["server"]; v != nil {
+ radiusState["server"] = v.(map[string]interface{})["name"]
+ }
+ if v := radiusJson["ask-user-password"]; v != nil {
+ radiusState["ask_user_password"] = v
+ }
+ singleAuthenticationClientState["radius"] = []interface{}{radiusState}
+ }
+ if v := singleAuthenticationClientJson["personal-certificate"]; v != nil {
+ personalCertificateJson := v.(map[string]interface{})
+ personalCertificateState := make(map[string]interface{})
+ if v := personalCertificateJson["fetch-username-from"]; v != nil {
+ personalCertificateState["fetch_username_from"] = v
+ }
+ if v := personalCertificateJson["storage-type"]; v != nil {
+ personalCertificateState["storage_type"] = v
+ }
+ if v := personalCertificateJson["source"]; v != nil {
+ personalCertificateState["source"] = v
+ }
+ if v := personalCertificateJson["dn-part"]; v != nil {
+ personalCertificateState["dn_part"] = v
+ }
+ if v := personalCertificateJson["dn-concurrence"]; v != nil {
+ personalCertificateState["dn_concurrence"] = v
+ }
+ singleAuthenticationClientState["personal_certificate"] = []interface{}{personalCertificateState}
+ }
+ if v := singleAuthenticationClientJson["client-display-settings"]; v != nil {
+ clientDisplaySettingsJson := v.(map[string]interface{})
+ clientDisplaySettingsState := make(map[string]interface{})
+ if v := clientDisplaySettingsJson["headline"]; v != nil {
+ clientDisplaySettingsState["headline"] = v
+ }
+ if v := clientDisplaySettingsJson["username-label"]; v != nil {
+ clientDisplaySettingsState["username_label"] = v
+ }
+ if v := clientDisplaySettingsJson["password-label"]; v != nil {
+ clientDisplaySettingsState["password_label"] = v
+ }
+ singleAuthenticationClientState["client_display_settings"] = []interface{}{clientDisplaySettingsState}
+ }
+ authenticationState["single_authentication_client"] = []interface{}{singleAuthenticationClientState}
+ }
+ if v := authenticationJson["override-global-dynamic-id-settings"]; v != nil {
+ authenticationState["override_global_dynamic_id_settings"] = v
+ }
+ if v := authenticationJson["dynamic-id-settings"]; v != nil {
+ dynamicIdSettingsJson := v.(map[string]interface{})
+ dynamicIdSettingsState := make(map[string]interface{})
+ if v := dynamicIdSettingsJson["sms-provider-and-email-settings"]; v != nil {
+ dynamicIdSettingsState["sms_provider_and_email_settings"] = v
+ }
+ if v := dynamicIdSettingsJson["sms-provider-credentials"]; v != nil {
+ smsProviderCredentialsJson := v.(map[string]interface{})
+ smsProviderCredentialsState := make(map[string]interface{})
+ if v := smsProviderCredentialsJson["username"]; v != nil {
+ smsProviderCredentialsState["username"] = v
+ }
+ if v := smsProviderCredentialsJson["password"]; v != nil {
+ smsProviderCredentialsState["password"] = v
+ }
+ if v := smsProviderCredentialsJson["api-id"]; v != nil {
+ smsProviderCredentialsState["api_id"] = v
+ }
+ dynamicIdSettingsState["sms_provider_credentials"] = []interface{}{smsProviderCredentialsState}
+ }
+ if v := dynamicIdSettingsJson["advanced-settings"]; v != nil {
+ advancedSettingsJson := v.(map[string]interface{})
+ advancedSettingsState := make(map[string]interface{})
+ if v := advancedSettingsJson["dynamic-id-message"]; v != nil {
+ advancedSettingsState["dynamic_id_message"] = v
+ }
+ if v := advancedSettingsJson["otp-settings"]; v != nil {
+ otpSettingsJson := v.(map[string]interface{})
+ otpSettingsState := make(map[string]interface{})
+ if v := otpSettingsJson["length"]; v != nil {
+ otpSettingsState["length"] = v
+ }
+ if v := otpSettingsJson["expiration"]; v != nil {
+ otpSettingsState["expiration"] = v
+ }
+ if v := otpSettingsJson["max-attempts"]; v != nil {
+ otpSettingsState["max_attempts"] = v
+ }
+ advancedSettingsState["otp_settings"] = []interface{}{otpSettingsState}
+ }
+ if v := advancedSettingsJson["enable-display-user-details"]; v != nil {
+ advancedSettingsState["enable_display_user_details"] = v
+ }
+ if v := advancedSettingsJson["country-code"]; v != nil {
+ advancedSettingsState["country_code"] = v
+ }
+ if v := advancedSettingsJson["user-details-retrieval"]; v != nil {
+ advancedSettingsState["user_details_retrieval"] = v
+ }
+ dynamicIdSettingsState["advanced_settings"] = []interface{}{advancedSettingsState}
+ }
+ authenticationState["dynamic_id_settings"] = []interface{}{dynamicIdSettingsState}
+ }
+ if v := authenticationJson["send-machine-certificate"]; v != nil {
+ authenticationState["send_machine_certificate"] = v
+ }
vpnSettingsState["authentication"] = []interface{}{authenticationState}
}
@@ -4176,6 +6363,41 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
if v := linkSelectionJson["ip-address"]; v != nil {
linkSelectionState["ip_address"] = v
}
+ if v := linkSelectionJson["route-selection-method"]; v != nil {
+ linkSelectionState["route_selection_method"] = v
+ }
+ if v := linkSelectionJson["responding-traffic"]; v != nil {
+ linkSelectionState["responding_traffic"] = v
+ }
+ if v := linkSelectionJson["source-ip-selection"]; v != nil {
+ linkSelectionState["source_ip_selection"] = v
+ }
+ if v := linkSelectionJson["selected-ip"]; v != nil {
+ linkSelectionState["selected_ip"] = v
+ }
+ if v := linkSelectionJson["outgoing-link-tracking"]; v != nil {
+ linkSelectionState["outgoing_link_tracking"] = v
+ }
+ if v := linkSelectionJson["probing-settings"]; v != nil {
+ probingSettingsJson := v.(map[string]interface{})
+ probingSettingsState := make(map[string]interface{})
+ if v := probingSettingsJson["probed-interfaces"]; v != nil {
+ probingSettingsState["probed_interfaces"] = v
+ }
+ if v := probingSettingsJson["probed-interface-list"]; v != nil {
+ probingSettingsState["probed_interface_list"] = v
+ }
+ if v := probingSettingsJson["use-primary-address"]; v != nil {
+ probingSettingsState["use_primary_address"] = v
+ }
+ if v := probingSettingsJson["primary-address"]; v != nil {
+ probingSettingsState["primary_address"] = v
+ }
+ if v := probingSettingsJson["probing-method"]; v != nil {
+ probingSettingsState["probing_method"] = v
+ }
+ linkSelectionState["probing_settings"] = []interface{}{probingSettingsState}
+ }
vpnSettingsState["link_selection"] = []interface{}{linkSelectionState}
}
if v := vpnSettingsJson["maximum-concurrent-ike-negotiations"]; v != nil {
@@ -4319,6 +6541,172 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
}
vpnSettingsState["office_mode"] = []interface{}{officeModeState}
}
+
+ if v := vpnSettingsJson["advanced"]; v != nil {
+ advancedJson := v.(map[string]interface{})
+ advancedState := make(map[string]interface{})
+ if v := advancedJson["tunnel-sharing-mode"]; v != nil {
+ advancedState["tunnel_sharing_mode"] = v
+ }
+ if v := advancedJson["shutdown-on-gateway-restart"]; v != nil {
+ advancedState["shutdown_on_gateway_restart"] = v
+ }
+ if v := advancedJson["enable-wire-mode"]; v != nil {
+ advancedState["enable_wire_mode"] = v
+ }
+ if v := advancedJson["wire-mode-interfaces"]; v != nil {
+ interfacesJson := v.([]interface{})
+ var interfacesIds = make([]string, 0)
+ if len(interfacesJson) > 0 {
+ for _, iface := range interfacesJson {
+ interfacesIds = append(interfacesIds, iface.(map[string]interface{})["name"].(string))
+ }
+ }
+ advancedState["wire_mode_interfaces"] = interfacesIds
+ }
+ if v := advancedJson["enable-wire-mode-log-traffic"]; v != nil {
+ advancedState["enable_wire_mode_log_traffic"] = v
+ }
+ if v := advancedJson["enable-nat-traversal"]; v != nil {
+ advancedState["enable_nat_traversal"] = v
+ }
+ vpnSettingsState["advanced"] = []interface{}{advancedState}
+ }
+
+ if v := vpnSettingsJson["exported-routes"]; v != nil {
+ exportedRoutesJson := v.(map[string]interface{})
+ exportedRoutesState := make(map[string]interface{})
+ if v := exportedRoutesJson["internal-interfaces"]; v != nil {
+ exportedRoutesState["internal_interfaces"] = v
+ }
+ if v := exportedRoutesJson["static-routes"]; v != nil {
+ exportedRoutesState["static_routes"] = v
+ }
+ if v := exportedRoutesJson["custom-routes"]; v != nil {
+ exportedRoutesState["custom_routes"] = v
+ }
+ if v := exportedRoutesJson["custom-routes-object"]; v != nil {
+ exportedRoutesState["custom_routes_object"] = v.(map[string]interface{})["name"]
+ }
+ vpnSettingsState["exported_routes"] = []interface{}{exportedRoutesState}
+ }
+
+ if v := vpnSettingsJson["vpn-clients"]; v != nil {
+ vpnClientsJson := v.(map[string]interface{})
+ vpnClientsState := make(map[string]interface{})
+ if v := vpnClientsJson["enable-endpoint-security-vpn"]; v != nil {
+ vpnClientsState["enable_endpoint_security_vpn"] = v
+ }
+ if v := vpnClientsJson["enable-cp-mobile-for-windows"]; v != nil {
+ vpnClientsState["enable_cp_mobile_for_windows"] = v
+ }
+ if v := vpnClientsJson["enable-secu-remote"]; v != nil {
+ vpnClientsState["enable_secu_remote"] = v
+ }
+ if v := vpnClientsJson["enable-capsule-vpn-connect"]; v != nil {
+ vpnClientsState["enable_capsule_vpn_connect"] = v
+ }
+ if v := vpnClientsJson["enable-ssl-network-extender"]; v != nil {
+ vpnClientsState["enable_ssl_network_extender"] = v
+ }
+ if v := vpnClientsJson["gateway-authentication-certificate"]; v != nil {
+ vpnClientsState["gateway_authentication_certificate"] = v
+ }
+ vpnSettingsState["vpn_clients"] = []interface{}{vpnClientsState}
+ }
+
+ if v := vpnSettingsJson["enable-clientless-vpn"]; v != nil {
+ vpnSettingsState["enable_clientless_vpn"] = v
+ }
+
+ if v := vpnSettingsJson["clientless-vpn-settings"]; v != nil {
+ clientlessVpnSettingsJson := v.(map[string]interface{})
+ clientlessVpnSettingsState := make(map[string]interface{})
+ if v := clientlessVpnSettingsJson["certificate-gateway-authentication"]; v != nil {
+ clientlessVpnSettingsState["certificate_gateway_authentication"] = v
+ }
+ if v := clientlessVpnSettingsJson["client-authentication"]; v != nil {
+ clientlessVpnSettingsState["client_authentication"] = v
+ }
+ if v := clientlessVpnSettingsJson["concurrent-servers-or-processes"]; v != nil {
+ clientlessVpnSettingsState["concurrent_servers_or_processes"] = v
+ }
+ if v := clientlessVpnSettingsJson["accept-only-3des"]; v != nil {
+ clientlessVpnSettingsState["accept_only_3des"] = v
+ }
+ vpnSettingsState["clientless_vpn_settings"] = []interface{}{clientlessVpnSettingsState}
+ }
+
+ if v := vpnSettingsJson["saml-portal-settings"]; v != nil {
+ samlPortalSettingsJson := v.(map[string]interface{})
+ samlPortalSettingsState := make(map[string]interface{})
+ if v := samlPortalSettingsJson["portal-web-settings"]; v != nil {
+ portalWebSettingsJson := v.(map[string]interface{})
+ portalWebSettingsState := make(map[string]interface{})
+ if v := portalWebSettingsJson["aliases"]; v != nil {
+ portalWebSettingsState["aliases"] = v
+ }
+ if v := portalWebSettingsJson["ip-address"]; v != nil {
+ portalWebSettingsState["ip_address"] = v
+ }
+ if v := portalWebSettingsJson["main-url"]; v != nil {
+ portalWebSettingsState["main_url"] = v
+ }
+ samlPortalSettingsState["portal_web_settings"] = []interface{}{portalWebSettingsState}
+ }
+ if v := samlPortalSettingsJson["accessibility"]; v != nil {
+ accessibilityJson := v.(map[string]interface{})
+ accessibilityState := make(map[string]interface{})
+ if v := accessibilityJson["allow-access-from"]; v != nil {
+ accessibilityState["allow_access_from"] = v
+ }
+ if v := accessibilityJson["internal-access-settings"]; v != nil {
+ internalAccessSettingsJson := v.(map[string]interface{})
+ internalAccessSettingsState := make(map[string]interface{})
+ if v := internalAccessSettingsJson["undefined"]; v != nil {
+ internalAccessSettingsState["undefined"] = v
+ }
+ if v := internalAccessSettingsJson["dmz"]; v != nil {
+ internalAccessSettingsState["dmz"] = v
+ }
+ if v := internalAccessSettingsJson["vpn"]; v != nil {
+ internalAccessSettingsState["vpn"] = v
+ }
+ accessibilityState["internal_access_settings"] = []interface{}{internalAccessSettingsState}
+ }
+ samlPortalSettingsState["accessibility"] = []interface{}{accessibilityState}
+ }
+ vpnSettingsState["saml_portal_settings"] = []interface{}{samlPortalSettingsState}
+ }
+
+ if v := vpnSettingsJson["interfaces"]; v != nil {
+ interfacesList := v.([]interface{})
+ var interfacesListState []map[string]interface{}
+ for i := range interfacesList {
+ interfacesShow := interfacesList[i].(map[string]interface{})
+ interfacesState := make(map[string]interface{})
+ if v := interfacesShow["interface-name"]; v != nil {
+ interfacesState["interface_name"] = v
+ }
+ if v := interfacesShow["ip-version"]; v != nil {
+ interfacesState["ip_version"] = v
+ }
+ if v := interfacesShow["next-hop-ip"]; v != nil {
+ interfacesState["next_hop_ip"] = v
+ }
+ if v := interfacesShow["priority"]; v != nil {
+ interfacesState["priority"] = v
+ }
+ if v := interfacesShow["redundancy-mode"]; v != nil {
+ interfacesState["redundancy_mode"] = v
+ }
+ if v := interfacesShow["static-nat-ip"]; v != nil {
+ interfacesState["static_nat_ip"] = v
+ }
+ interfacesListState = append(interfacesListState, interfacesState)
+ }
+ vpnSettingsState["interfaces"] = interfacesListState
+ }
_ = d.Set("vpn_settings", []interface{}{vpnSettingsState})
} else {
_ = d.Set("vpn_settings", nil)
@@ -4345,6 +6733,165 @@ func readManagementSimpleGateway(d *schema.ResourceData, m interface{}) error {
_ = d.Set("color", v)
}
+ if v := gateway["accept-syslog-messages"]; v != nil {
+ _ = d.Set("accept_syslog_messages", v)
+ }
+
+ if v := gateway["anti-spam-and-email-security"]; v != nil {
+ _ = d.Set("anti_spam_and_email_security", v)
+ }
+
+ if v := gateway["auto-generate-ip"]; v != nil {
+ _ = d.Set("auto_generate_ip", v)
+ }
+
+ if v := gateway["auto-topology-custom-recalculation-time"]; v != nil {
+ _ = d.Set("auto_topology_custom_recalculation_time", v)
+ }
+
+ if v := gateway["auto-topology-use-custom-recalculation-time"]; v != nil {
+ _ = d.Set("auto_topology_use_custom_recalculation_time", v)
+ }
+
+ if v := gateway["data-loss-prevention"]; v != nil {
+ _ = d.Set("data_loss_prevention", v)
+ }
+
+ if v := gateway["enable-log-indexing"]; v != nil {
+ _ = d.Set("enable_log_indexing", v)
+ }
+
+ if v := gateway["hardware-subtype"]; v != nil {
+ _ = d.Set("hardware_subtype", v)
+ }
+
+ if v := gateway["install-policy-without-push"]; v != nil {
+ _ = d.Set("install_policy_without_push", v)
+ }
+
+ if v := gateway["interfaces-topology-settings"]; v != nil {
+ _ = d.Set("interfaces_topology_settings", v)
+ }
+
+ if v := gateway["mobile-access"]; v != nil {
+ _ = d.Set("mobile_access", v)
+ }
+
+ if v := gateway["monitoring"]; v != nil {
+ _ = d.Set("monitoring", v)
+ }
+
+ if v := gateway["policy-server"]; v != nil {
+ _ = d.Set("policy_server", v)
+ }
+
+ if v := gateway["rtm-counters-report"]; v != nil {
+ _ = d.Set("rtm_counters_report", v)
+ }
+
+ if v := gateway["rtm-traffic-report"]; v != nil {
+ _ = d.Set("rtm_traffic_report", v)
+ }
+
+ if v := gateway["rtm-traffic-report-per-connection"]; v != nil {
+ _ = d.Set("rtm_traffic_report_per_connection", v)
+ }
+
+ if v := gateway["smart-event-intro-correlation-unit"]; v != nil {
+ _ = d.Set("smart_event_intro_correlation_unit", v)
+ }
+
+ if v := gateway["threat-prevention-mode"]; v != nil {
+ _ = d.Set("threat_prevention_mode", v)
+ }
+
+ if v := gateway["trust-method"]; v != nil {
+ _ = d.Set("trust_method", v)
+ }
+
+ if v := gateway["workforce-ai"]; v != nil {
+ _ = d.Set("workforce_ai", v)
+ }
+
+ if v := gateway["communication-with-servers-behind-nat"]; v != nil {
+ communicationWithServersBehindNatJson := v.(map[string]interface{})
+ communicationWithServersBehindNatState := make(map[string]interface{})
+ if v := communicationWithServersBehindNatJson["override-profile"]; v != nil {
+ communicationWithServersBehindNatState["override_profile"] = v
+ }
+ if v := communicationWithServersBehindNatJson["value"]; v != nil {
+ communicationWithServersBehindNatState["value"] = v
+ }
+ _ = d.Set("communication_with_servers_behind_nat", []interface{}{communicationWithServersBehindNatState})
+ }
+
+ if v := gateway["zero-phishing-settings"]; v != nil {
+ zeroPhishingSettingsJson := v.(map[string]interface{})
+ zeroPhishingSettingsState := make(map[string]interface{})
+ if v := zeroPhishingSettingsJson["gateway-fqdn-mode"]; v != nil {
+ zeroPhishingSettingsState["gateway_fqdn_mode"] = v
+ }
+ if v := zeroPhishingSettingsJson["manual-fqdn"]; v != nil {
+ zeroPhishingSettingsState["manual_fqdn"] = v
+ }
+ _ = d.Set("zero_phishing_settings", []interface{}{zeroPhishingSettingsState})
+ }
+
+ if v := gateway["autonomous-system-number"]; v != nil {
+ _ = d.Set("autonomous_system_number", v)
+ }
+
+ if v := gateway["dns-server"]; v != nil {
+ _ = d.Set("dns_server", v)
+ }
+
+ if v := gateway["fetch-policy-scheduler"]; v != nil {
+ fetchPolicySchedulerShow := v.(map[string]interface{})
+ fetchPolicySchedulerState := make(map[string]interface{})
+ if v := fetchPolicySchedulerShow["enabled"]; v != nil {
+ fetchPolicySchedulerState["enabled"] = v
+ }
+ if v := fetchPolicySchedulerShow["schedule"]; v != nil {
+ scheduleShow := v.(map[string]interface{})
+ scheduleState := make(map[string]interface{})
+ if v := scheduleShow["color"]; v != nil {
+ scheduleState["color"] = v
+ }
+ if v := scheduleShow["domain"]; v != nil {
+ domainShow := v.(map[string]interface{})
+ domainState := make(map[string]interface{})
+ if v := domainShow["domain-type"]; v != nil {
+ domainState["domain_type"] = v
+ }
+ if v := domainShow["name"]; v != nil {
+ domainState["name"] = v
+ }
+ if v := domainShow["uid"]; v != nil {
+ domainState["uid"] = v
+ }
+ scheduleState["domain"] = []interface{}{domainState}
+ }
+ if v := scheduleShow["icon"]; v != nil {
+ scheduleState["icon"] = v
+ }
+ if v := scheduleShow["name"]; v != nil {
+ scheduleState["name"] = v
+ }
+ if v := scheduleShow["type"]; v != nil {
+ scheduleState["type"] = v
+ }
+ if v := scheduleShow["uid"]; v != nil {
+ scheduleState["uid"] = v
+ }
+ fetchPolicySchedulerState["schedule"] = []interface{}{scheduleState}
+ }
+ _ = d.Set("fetch_policy_scheduler", []interface{}{fetchPolicySchedulerState})
+ }
+
+ if v := gateway["export-logs-to-servers"]; v != nil {
+ _ = d.Set("export_logs_to_servers", v)
+ }
+
return nil
}
@@ -4494,10 +7041,46 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("https_inspection.0.deny_expired_server_cert.0.override_profile"); ok {
denyExpiredServerCertPayload["override-profile"] = v
}
- if v, ok := d.GetOk("https_inspection.0.deny_expired_server_cert.0.value"); ok {
- denyExpiredServerCertPayload["value"] = v
+ if v, ok := d.GetOk("https_inspection.0.deny_expired_server_cert.0.value"); ok {
+ denyExpiredServerCertPayload["value"] = v
+ }
+ httpsInspectionPayload["deny-expired-server-cert"] = denyExpiredServerCertPayload
+ }
+ if _, ok := d.GetOk("https_inspection.0.bypass_on_client_failure"); ok {
+
+ bypassOnClientFailurePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("https_inspection.0.bypass_on_client_failure.0.override_profile"); ok {
+ bypassOnClientFailurePayload["override-profile"] = strconv.FormatBool(v.(bool))
+ }
+ if v, ok := d.GetOk("https_inspection.0.bypass_on_client_failure.0.value"); ok {
+ bypassOnClientFailurePayload["value"] = strconv.FormatBool(v.(bool))
+ }
+ httpsInspectionPayload["bypass-on-client-failure"] = bypassOnClientFailurePayload
+ }
+ if _, ok := d.GetOk("https_inspection.0.bypass_under_load"); ok {
+
+ bypassUnderLoadPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("https_inspection.0.bypass_under_load.0.value"); ok {
+ bypassUnderLoadPayload["value"] = strconv.FormatBool(v.(bool))
+ }
+ httpsInspectionPayload["bypass-under-load"] = bypassUnderLoadPayload
+ }
+ if _, ok := d.GetOk("https_inspection.0.outbound_certificate"); ok {
+
+ outboundCertificatePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("https_inspection.0.outbound_certificate.0.override_profile"); ok {
+ outboundCertificatePayload["override-profile"] = strconv.FormatBool(v.(bool))
+ }
+ if v, ok := d.GetOk("https_inspection.0.outbound_certificate.0.value"); ok {
+ outboundCertificatePayload["value"] = v.(string)
}
- httpsInspectionPayload["deny-expired-server-cert"] = denyExpiredServerCertPayload
+ httpsInspectionPayload["outbound-certificate"] = outboundCertificatePayload
+ }
+ if v, ok := d.GetOk("https_inspection.0.deployment_mode"); ok {
+ httpsInspectionPayload["deployment-mode"] = v.(string)
}
gateway["https-inspection"] = httpsInspectionPayload
}
@@ -4527,11 +7110,93 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
browserBasedAuthenticationSettingsPayload := make(map[string]interface{})
- if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings"); ok {
- browserBasedAuthenticationSettingsPayload["authentication-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings"); ok {
+ authenticationSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.authentication_method"); ok {
+ authenticationSettingsPayload["authentication-method"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.identity_provider"); ok {
+ authenticationSettingsPayload["identity-provider"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.radius"); ok {
+ authenticationSettingsPayload["radius"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories"); ok {
+
+ usersDirectoriesPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.external_user_profile"); ok {
+ usersDirectoriesPayload["external-user-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.internal_users"); ok {
+ usersDirectoriesPayload["internal-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.specific"); ok {
+ usersDirectoriesPayload["specific"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.authentication_settings.0.users_directories.0.users_from_external_directories"); ok {
+ usersDirectoriesPayload["users-from-external-directories"] = v.(string)
+ }
+ authenticationSettingsPayload["users-directories"] = usersDirectoriesPayload
+ }
+ browserBasedAuthenticationSettingsPayload["authentication-settings"] = authenticationSettingsPayload
}
- if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings"); ok {
- browserBasedAuthenticationSettingsPayload["browser-based-authentication-portal-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings"); ok {
+ browserBasedAuthenticationPortalSettingsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility"); ok {
+
+ accessibilityPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.allow_access_from"); ok {
+ accessibilityPayload["allow-access-from"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings"); ok {
+
+ internalAccessSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings.0.dmz"); ok {
+ internalAccessSettingsPayload["dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings.0.undefined"); ok {
+ internalAccessSettingsPayload["undefined"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.accessibility.0.internal_access_settings.0.vpn"); ok {
+ internalAccessSettingsPayload["vpn"] = v.(bool)
+ }
+ accessibilityPayload["internal-access-settings"] = internalAccessSettingsPayload
+ }
+ browserBasedAuthenticationPortalSettingsPayload["accessibility"] = accessibilityPayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.certificate_settings"); ok {
+
+ certificateSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.certificate_settings.0.base64_certificate"); ok {
+ certificateSettingsPayload["base64-certificate"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.certificate_settings.0.base64_password"); ok {
+ certificateSettingsPayload["base64-password"] = v.(string)
+ }
+ browserBasedAuthenticationPortalSettingsPayload["certificate-settings"] = certificateSettingsPayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings"); ok {
+
+ portalWebSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings.0.aliases"); ok {
+ portalWebSettingsPayload["aliases"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings.0.ip_address"); ok {
+ portalWebSettingsPayload["ip-address"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.browser_based_authentication_settings.0.browser_based_authentication_portal_settings.0.portal_web_settings.0.main_url"); ok {
+ portalWebSettingsPayload["main-url"] = v.(string)
+ }
+ browserBasedAuthenticationPortalSettingsPayload["portal-web-settings"] = portalWebSettingsPayload
+ }
+ browserBasedAuthenticationSettingsPayload["browser-based-authentication-portal-settings"] = browserBasedAuthenticationPortalSettingsPayload
}
identityAwarenessSettingsPayload["browser-based-authentication-settings"] = browserBasedAuthenticationSettingsPayload
}
@@ -4548,11 +7213,63 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.user_reauthenticate_interval"); ok {
identityAgentSettingsPayload["user-reauthenticate-interval"] = v
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings"); ok {
- identityAgentSettingsPayload["authentication-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings"); ok {
+ authenticationSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.authentication_method"); ok {
+ authenticationSettingsPayload["authentication-method"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.radius"); ok {
+ authenticationSettingsPayload["radius"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories"); ok {
+
+ usersDirectoriesPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.external_user_profile"); ok {
+ usersDirectoriesPayload["external-user-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.internal_users"); ok {
+ usersDirectoriesPayload["internal-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.specific"); ok {
+ usersDirectoriesPayload["specific"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.authentication_settings.0.users_directories.0.users_from_external_directories"); ok {
+ usersDirectoriesPayload["users-from-external-directories"] = v.(string)
+ }
+ authenticationSettingsPayload["users-directories"] = usersDirectoriesPayload
+ }
+ identityAgentSettingsPayload["authentication-settings"] = authenticationSettingsPayload
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings"); ok {
- identityAgentSettingsPayload["identity-agent-portal-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings"); ok {
+ identityAgentPortalSettingsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility"); ok {
+
+ accessibilityPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.allow_access_from"); ok {
+ accessibilityPayload["allow-access-from"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings"); ok {
+
+ internalAccessSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings.0.dmz"); ok {
+ internalAccessSettingsPayload["dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings.0.undefined"); ok {
+ internalAccessSettingsPayload["undefined"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_agent_settings.0.identity_agent_portal_settings.0.accessibility.0.internal_access_settings.0.vpn"); ok {
+ internalAccessSettingsPayload["vpn"] = v.(bool)
+ }
+ accessibilityPayload["internal-access-settings"] = internalAccessSettingsPayload
+ }
+ identityAgentPortalSettingsPayload["accessibility"] = accessibilityPayload
+ }
+ identityAgentSettingsPayload["identity-agent-portal-settings"] = identityAgentPortalSettingsPayload
}
identityAwarenessSettingsPayload["identity-agent-settings"] = identityAgentSettingsPayload
}
@@ -4566,11 +7283,57 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authorized_clients"); ok {
identityCollectorSettingsPayload["authorized-clients"] = v.(*schema.Set).List()
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings"); ok {
- identityCollectorSettingsPayload["authentication-settings"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings"); ok {
+ authenticationSettingsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories"); ok {
+
+ usersDirectoriesPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.external_user_profile"); ok {
+ usersDirectoriesPayload["external-user-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.internal_users"); ok {
+ usersDirectoriesPayload["internal-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.specific"); ok {
+ usersDirectoriesPayload["specific"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.authentication_settings.0.users_directories.0.users_from_external_directories"); ok {
+ usersDirectoriesPayload["users-from-external-directories"] = v.(string)
+ }
+ authenticationSettingsPayload["users-directories"] = usersDirectoriesPayload
+ }
+ identityCollectorSettingsPayload["authentication-settings"] = authenticationSettingsPayload
}
- if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions"); ok {
- identityCollectorSettingsPayload["client-access-permissions"] = v
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions"); ok {
+ clientAccessPermissionsPayload := make(map[string]interface{})
+
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility"); ok {
+
+ accessibilityPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.allow_access_from"); ok {
+ accessibilityPayload["allow-access-from"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings"); ok {
+
+ internalAccessSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.dmz"); ok {
+ internalAccessSettingsPayload["dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.undefined"); ok {
+ internalAccessSettingsPayload["undefined"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_collector_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.vpn"); ok {
+ internalAccessSettingsPayload["vpn"] = v.(bool)
+ }
+ accessibilityPayload["internal-access-settings"] = internalAccessSettingsPayload
+ }
+ clientAccessPermissionsPayload["accessibility"] = accessibilityPayload
+ }
+ identityCollectorSettingsPayload["client-access-permissions"] = clientAccessPermissionsPayload
}
identityAwarenessSettingsPayload["identity-collector-settings"] = identityCollectorSettingsPayload
}
@@ -4587,6 +7350,36 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.0.receive_from"); ok {
identitySharingSettingsPayload["receive-from"] = v.(*schema.Set).List()
}
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.cache_mode"); ok {
+
+ cacheModePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.cache_mode.0.override_profile"); ok {
+ cacheModePayload["override-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.cache_mode.0.value"); ok {
+ cacheModePayload["value"] = v.(bool)
+ }
+ identitySharingSettingsPayload["cache-mode"] = cacheModePayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.cache_mode_duration"); ok {
+
+ cacheModeDurationPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.cache_mode_duration.0.override_profile"); ok {
+ cacheModeDurationPayload["override-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_sharing_settings.cache_mode_duration.0.value"); ok {
+ cacheModeDurationPayload["value"] = v.(int)
+ }
+ identitySharingSettingsPayload["cache-mode-duration"] = cacheModeDurationPayload
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.receive_from_infinity_identity"); ok {
+ identitySharingSettingsPayload["receive-from-infinity-identity"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_sharing_settings.scaled_sharing"); ok {
+ identitySharingSettingsPayload["scaled-sharing"] = v.(bool)
+ }
identityAwarenessSettingsPayload["identity-sharing-settings"] = identitySharingSettingsPayload
}
if _, ok := d.GetOk("identity_awareness_settings.0.proxy_settings"); ok {
@@ -4601,6 +7394,70 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("identity_awareness_settings.0.remote_access"); ok {
identityAwarenessSettingsPayload["remote-access"] = v.(bool)
}
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_based_enforcement"); ok {
+ identityAwarenessSettingsPayload["identity-based-enforcement"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_web_api"); ok {
+ identityAwarenessSettingsPayload["identity-web-api"] = v.(bool)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings"); ok {
+ identityWebApiSettingsPayload := make(map[string]interface{})
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.authentication_settings"); ok {
+ authenticationSettingsPayload := make(map[string]interface{})
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.authentication_settings.0.users_directories"); ok {
+ usersDirectoriesPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_web_api_settings.0.authentication_settings.0.users_directories.0.external_user_profile"); ok {
+ usersDirectoriesPayload["external-user-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_web_api_settings.0.authentication_settings.0.users_directories.0.internal_users"); ok {
+ usersDirectoriesPayload["internal-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.authentication_settings.0.users_directories.0.users_from_external_directories"); ok {
+ usersDirectoriesPayload["users-from-external-directories"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.authentication_settings.0.users_directories.0.specific"); ok {
+ usersDirectoriesPayload["specific"] = v.(*schema.Set).List()
+ }
+ authenticationSettingsPayload["users-directories"] = usersDirectoriesPayload
+ }
+ identityWebApiSettingsPayload["authentication-settings"] = authenticationSettingsPayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.authorized_clients"); ok {
+ authorizedClientsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.authorized_clients.0.client"); ok {
+ authorizedClientsPayload["client"] = v.(string)
+ }
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.authorized_clients.0.client_secret"); ok {
+ authorizedClientsPayload["client-secret"] = v.(string)
+ }
+ identityWebApiSettingsPayload["authorized-clients"] = authorizedClientsPayload
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.client_access_permissions"); ok {
+ clientAccessPermissionsPayload := make(map[string]interface{})
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.client_access_permissions.0.accessibility"); ok {
+ accessibilityPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.client_access_permissions.0.accessibility.0.allow_access_from"); ok {
+ accessibilityPayload["allow-access-from"] = v.(string)
+ }
+ if _, ok := d.GetOk("identity_awareness_settings.0.identity_web_api_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings"); ok {
+ internalAccessSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_web_api_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.dmz"); ok {
+ internalAccessSettingsPayload["dmz"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_web_api_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.undefined"); ok {
+ internalAccessSettingsPayload["undefined"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("identity_awareness_settings.0.identity_web_api_settings.0.client_access_permissions.0.accessibility.0.internal_access_settings.0.vpn"); ok {
+ internalAccessSettingsPayload["vpn"] = v.(bool)
+ }
+ accessibilityPayload["internal-access-settings"] = internalAccessSettingsPayload
+ }
+ clientAccessPermissionsPayload["accessibility"] = accessibilityPayload
+ }
+ identityWebApiSettingsPayload["client-access-permissions"] = clientAccessPermissionsPayload
+ }
+ identityAwarenessSettingsPayload["identity-web-api-settings"] = identityWebApiSettingsPayload
+ }
gateway["identity-awareness-settings"] = identityAwarenessSettingsPayload
}
}
@@ -4646,6 +7503,9 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("nat_settings.0.method"); ok {
natSettingsPayload["method"] = v.(string)
}
+ if v, ok := d.GetOkExists("nat_settings.0.apply_control_connections"); ok {
+ natSettingsPayload["apply-control-connections"] = v.(bool)
+ }
gateway["nat-settings"] = natSettingsPayload
}
}
@@ -4668,6 +7528,9 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("platform_portal_settings.0.portal_web_settings.0.aliases"); ok {
portalWebSettingsPayload["aliases"] = v.(*schema.Set).List()
}
+ if v, ok := d.GetOk("platform_portal_settings.0.portal_web_settings.0.ip_address"); ok {
+ portalWebSettingsPayload["ip-address"] = v.(string)
+ }
if v, ok := d.GetOk("platform_portal_settings.0.portal_web_settings.0.main_url"); ok {
portalWebSettingsPayload["main-url"] = v.(string)
}
@@ -4746,6 +7609,9 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("usercheck_portal_settings.0.portal_web_settings.0.aliases"); ok {
portalWebSettingsPayload["aliases"] = v.(*schema.Set).List()
}
+ if v, ok := d.GetOk("usercheck_portal_settings.0.portal_web_settings.0.ip_address"); ok {
+ portalWebSettingsPayload["ip-address"] = v.(string)
+ }
if v, ok := d.GetOk("usercheck_portal_settings.0.portal_web_settings.0.main_url"); ok {
portalWebSettingsPayload["main-url"] = v.(string)
}
@@ -4798,12 +7664,6 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
}
}
- if ok := d.HasChange("zero_phishing_fqdn"); ok {
- if v, ok := d.GetOk("zero_phishing_fqdn"); ok {
- gateway["zero-phishing-fqdn"] = v
- }
- }
-
if d.HasChange("interfaces") {
if v, ok := d.GetOk("interfaces"); ok {
interfacesList := v.([]interface{})
@@ -4837,6 +7697,18 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".anti_spoofing_settings.0.action"); ok {
antiSpoofingSettings["action"] = v.(string)
}
+ if v, ok := d.GetOkExists("interfaces.0.anti_spoofing_settings.0.exclude_packets"); ok {
+ antiSpoofingSettings["exclude-packets"] = v.(bool)
+ }
+ if v, ok := d.GetOk("interfaces.0.anti_spoofing_settings.0.excluded_network_name"); ok {
+ antiSpoofingSettings["excluded-network-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("interfaces.0.anti_spoofing_settings.0.excluded_network_uid"); ok {
+ antiSpoofingSettings["excluded-network-uid"] = v.(string)
+ }
+ if v, ok := d.GetOk("interfaces.0.anti_spoofing_settings.0.spoof_tracking"); ok {
+ antiSpoofingSettings["spoof-tracking"] = v.(string)
+ }
interfacePayload["anti-spoofing-settings"] = antiSpoofingSettings
}
if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".security_zone"); ok {
@@ -4876,6 +7748,9 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("interfaces." + strconv.Itoa(i) + ".comments"); ok {
interfacePayload["comments"] = v.(string)
}
+ if v, ok := d.GetOkExists("interfaces." + strconv.Itoa(i) + ".dynamic_ip"); ok {
+ interfacePayload["dynamic-ip"] = v.(bool)
+ }
interfacesPayload = append(interfacesPayload, interfacePayload)
}
gateway["interfaces"] = interfacesPayload
@@ -5096,6 +7971,147 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("vpn_settings.0.authentication.0.authentication_clients"); ok {
authenticationPayload["authentication-clients"] = v.(*schema.Set).List()
}
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client"); ok {
+
+ singleAuthenticationClientPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.single_authentication_client.0.enabled"); ok {
+ singleAuthenticationClientPayload["enabled"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.single_authentication_client.0.allow_multiple_authentication_clients"); ok {
+ singleAuthenticationClientPayload["allow-multiple-authentication-clients"] = v.(bool)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.display_name"); ok {
+ singleAuthenticationClientPayload["display-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.method"); ok {
+ singleAuthenticationClientPayload["method"] = v.(string)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.secur_id"); ok {
+
+ securIdPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.secur_id.0.server"); ok {
+ securIdPayload["server"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.secur_id.0.token_card_type"); ok {
+ securIdPayload["token-card-type"] = v.(string)
+ }
+ singleAuthenticationClientPayload["secur-id"] = securIdPayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.radius"); ok {
+
+ radiusPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.radius.0.server"); ok {
+ radiusPayload["server"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.single_authentication_client.0.radius.0.ask_user_password"); ok {
+ radiusPayload["ask-user-password"] = v.(bool)
+ }
+ singleAuthenticationClientPayload["radius"] = radiusPayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate"); ok {
+
+ personalCertificatePayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.fetch_username_from"); ok {
+ personalCertificatePayload["fetch-username-from"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.storage_type"); ok {
+ personalCertificatePayload["storage-type"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.source"); ok {
+ personalCertificatePayload["source"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.dn_part"); ok {
+ personalCertificatePayload["dn-part"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.personal_certificate.0.dn_concurrence"); ok {
+ personalCertificatePayload["dn-concurrence"] = v.(int)
+ }
+ singleAuthenticationClientPayload["personal-certificate"] = personalCertificatePayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings"); ok {
+
+ clientDisplaySettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings.0.headline"); ok {
+ clientDisplaySettingsPayload["headline"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings.0.username_label"); ok {
+ clientDisplaySettingsPayload["username-label"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.single_authentication_client.0.client_display_settings.0.password_label"); ok {
+ clientDisplaySettingsPayload["password-label"] = v.(string)
+ }
+ singleAuthenticationClientPayload["client-display-settings"] = clientDisplaySettingsPayload
+ }
+ authenticationPayload["single-authentication-client"] = singleAuthenticationClientPayload
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.override_global_dynamic_id_settings"); ok {
+ authenticationPayload["override-global-dynamic-id-settings"] = v.(bool)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings"); ok {
+
+ dynamicIdSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_and_email_settings"); ok {
+ dynamicIdSettingsPayload["sms-provider-and-email-settings"] = v.(string)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials"); ok {
+
+ smsProviderCredentialsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials.0.username"); ok {
+ smsProviderCredentialsPayload["username"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials.0.password"); ok {
+ smsProviderCredentialsPayload["password"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.sms_provider_credentials.0.api_id"); ok {
+ smsProviderCredentialsPayload["api-id"] = v.(string)
+ }
+ dynamicIdSettingsPayload["sms-provider-credentials"] = smsProviderCredentialsPayload
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings"); ok {
+
+ advancedSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.dynamic_id_message"); ok {
+ advancedSettingsPayload["dynamic-id-message"] = v.(string)
+ }
+ if _, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings"); ok {
+
+ otpSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings.0.length"); ok {
+ otpSettingsPayload["length"] = v.(int)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings.0.expiration"); ok {
+ otpSettingsPayload["expiration"] = v.(int)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.otp_settings.0.max_attempts"); ok {
+ otpSettingsPayload["max-attempts"] = v.(int)
+ }
+ advancedSettingsPayload["otp-settings"] = otpSettingsPayload
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.enable_display_user_details"); ok {
+ advancedSettingsPayload["enable-display-user-details"] = v.(bool)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.country_code"); ok {
+ advancedSettingsPayload["country-code"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.dynamic_id_settings.0.advanced_settings.0.user_details_retrieval"); ok {
+ advancedSettingsPayload["user-details-retrieval"] = v.(string)
+ }
+ dynamicIdSettingsPayload["advanced-settings"] = advancedSettingsPayload
+ }
+ authenticationPayload["dynamic-id-settings"] = dynamicIdSettingsPayload
+ }
+ if v, ok := d.GetOk("vpn_settings.0.authentication.0.send_machine_certificate"); ok {
+ authenticationPayload["send-machine-certificate"] = v.(string)
+ }
vpnSettingsPayload["authentication"] = authenticationPayload
}
if _, ok := d.GetOk("vpn_settings.0.certificates"); ok {
@@ -5200,6 +8216,27 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("vpn_settings.0.link_selection.0.outgoing_link_tracking"); ok {
linkSelectionPayload["outgoing-link-tracking"] = v.(string)
}
+ if _, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings"); ok {
+
+ probingSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.probed_interfaces"); ok {
+ probingSettingsPayload["probed-interfaces"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.probed_interface_list"); ok {
+ probingSettingsPayload["probed-interface-list"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOkExists("vpn_settings.0.link_selection.0.probing_settings.0.use_primary_address"); ok {
+ probingSettingsPayload["use-primary-address"] = v.(bool)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.primary_address"); ok {
+ probingSettingsPayload["primary-address"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.link_selection.0.probing_settings.0.probing_method"); ok {
+ probingSettingsPayload["probing-method"] = v.(string)
+ }
+ linkSelectionPayload["probing-settings"] = probingSettingsPayload
+ }
vpnSettingsPayload["link-selection"] = linkSelectionPayload
}
if v, ok := d.GetOk("vpn_settings.0.maximum_concurrent_ike_negotiations"); ok {
@@ -5448,6 +8485,35 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
}
vpnSettingsPayload["clientless-vpn-settings"] = clientlessVpnSettingsPayload
}
+ if v, ok := d.GetOk("vpn_settings.0.interfaces"); ok {
+ interfacesList := v.([]interface{})
+ if len(interfacesList) > 0 {
+ var interfacesPayload []map[string]interface{}
+ for i := range interfacesList {
+ interfacesItem := make(map[string]interface{})
+ if v, ok := d.GetOk("vpn_settings.0.interfaces." + strconv.Itoa(i) + ".interface_name"); ok {
+ interfacesItem["interface-name"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.interfaces." + strconv.Itoa(i) + ".ip_version"); ok {
+ interfacesItem["ip-version"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.interfaces." + strconv.Itoa(i) + ".next_hop_ip"); ok {
+ interfacesItem["next-hop-ip"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.interfaces." + strconv.Itoa(i) + ".priority"); ok {
+ interfacesItem["priority"] = v.(int)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.interfaces." + strconv.Itoa(i) + ".redundancy_mode"); ok {
+ interfacesItem["redundancy-mode"] = v.(string)
+ }
+ if v, ok := d.GetOk("vpn_settings.0.interfaces." + strconv.Itoa(i) + ".static_nat_ip"); ok {
+ interfacesItem["static-nat-ip"] = v.(string)
+ }
+ interfacesPayload = append(interfacesPayload, interfacesItem)
+ }
+ vpnSettingsPayload["interfaces"] = interfacesPayload
+ }
+ }
gateway["vpn-settings"] = vpnSettingsPayload
}
}
@@ -5597,6 +8663,15 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
if v, ok := d.GetOk("logs_settings.0.update_account_log_every"); ok {
logsSettingsPayload["update-account-log-every"] = v.(int)
}
+ if v, ok := d.GetOkExists("logs_settings.0.distribute_logs_between_all_active_servers"); ok {
+ logsSettingsPayload["distribute-logs-between-all-active-servers"] = v.(bool)
+ }
+ if v, ok := d.GetOk("logs_settings.0.include_tcp_state_information"); ok {
+ logsSettingsPayload["include-tcp-state-information"] = v.(string)
+ }
+ if v, ok := d.GetOk("logs_settings.0.free_disk_space_metrics"); ok {
+ logsSettingsPayload["free-disk-space-metrics"] = v.(string)
+ }
gateway["logs-settings"] = logsSettingsPayload
}
}
@@ -5633,6 +8708,147 @@ func updateManagementSimpleGateway(d *schema.ResourceData, m interface{}) error
log.Println("Update Simple Gateway - Map = ", gateway)
if len(gateway) != 2 {
+ if ok := d.HasChange("accept_syslog_messages"); ok {
+ gateway["accept-syslog-messages"] = d.Get("accept_syslog_messages")
+ }
+ if ok := d.HasChange("anti_spam_and_email_security"); ok {
+ gateway["anti-spam-and-email-security"] = d.Get("anti_spam_and_email_security")
+ }
+ if ok := d.HasChange("auto_generate_ip"); ok {
+ gateway["auto-generate-ip"] = d.Get("auto_generate_ip")
+ }
+ if ok := d.HasChange("auto_topology_custom_recalculation_time"); ok {
+ gateway["auto-topology-custom-recalculation-time"] = d.Get("auto_topology_custom_recalculation_time")
+ }
+ if ok := d.HasChange("auto_topology_use_custom_recalculation_time"); ok {
+ gateway["auto-topology-use-custom-recalculation-time"] = d.Get("auto_topology_use_custom_recalculation_time")
+ }
+ if ok := d.HasChange("data_loss_prevention"); ok {
+ gateway["data-loss-prevention"] = d.Get("data_loss_prevention")
+ }
+ if ok := d.HasChange("enable_log_indexing"); ok {
+ gateway["enable-log-indexing"] = d.Get("enable_log_indexing")
+ }
+ if ok := d.HasChange("hardware_subtype"); ok {
+ gateway["hardware-subtype"] = d.Get("hardware_subtype")
+ }
+ if ok := d.HasChange("install_policy_without_push"); ok {
+ gateway["install-policy-without-push"] = d.Get("install_policy_without_push")
+ }
+ if ok := d.HasChange("interfaces_topology_settings"); ok {
+ gateway["interfaces-topology-settings"] = d.Get("interfaces_topology_settings")
+ }
+ if ok := d.HasChange("mobile_access"); ok {
+ gateway["mobile-access"] = d.Get("mobile_access")
+ }
+ if ok := d.HasChange("monitoring"); ok {
+ gateway["monitoring"] = d.Get("monitoring")
+ }
+ if ok := d.HasChange("policy_server"); ok {
+ gateway["policy-server"] = d.Get("policy_server")
+ }
+ if ok := d.HasChange("rtm_counters_report"); ok {
+ gateway["rtm-counters-report"] = d.Get("rtm_counters_report")
+ }
+ if ok := d.HasChange("rtm_traffic_report"); ok {
+ gateway["rtm-traffic-report"] = d.Get("rtm_traffic_report")
+ }
+ if ok := d.HasChange("rtm_traffic_report_per_connection"); ok {
+ gateway["rtm-traffic-report-per-connection"] = d.Get("rtm_traffic_report_per_connection")
+ }
+ if ok := d.HasChange("smart_event_intro_correlation_unit"); ok {
+ gateway["smart-event-intro-correlation-unit"] = d.Get("smart_event_intro_correlation_unit")
+ }
+ if ok := d.HasChange("threat_prevention_mode"); ok {
+ gateway["threat-prevention-mode"] = d.Get("threat_prevention_mode")
+ }
+ if ok := d.HasChange("trust_method"); ok {
+ gateway["trust-method"] = d.Get("trust_method")
+ }
+ if ok := d.HasChange("workforce_ai"); ok {
+ gateway["workforce-ai"] = d.Get("workforce_ai")
+ }
+ if ok := d.HasChange("communication_with_servers_behind_nat"); ok {
+ if _, ok := d.GetOk("communication_with_servers_behind_nat"); ok {
+
+ communicationWithServersBehindNatPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOkExists("communication_with_servers_behind_nat.0.override_profile"); ok {
+ communicationWithServersBehindNatPayload["override-profile"] = v.(bool)
+ }
+ if v, ok := d.GetOk("communication_with_servers_behind_nat.0.value"); ok {
+ communicationWithServersBehindNatPayload["value"] = v.(string)
+ }
+ gateway["communication-with-servers-behind-nat"] = communicationWithServersBehindNatPayload
+ }
+ }
+ if ok := d.HasChange("zero_phishing_settings"); ok {
+ if _, ok := d.GetOk("zero_phishing_settings"); ok {
+
+ zeroPhishingSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("zero_phishing_settings.0.gateway_fqdn_mode"); ok {
+ zeroPhishingSettingsPayload["gateway-fqdn-mode"] = v.(string)
+ }
+ if v, ok := d.GetOk("zero_phishing_settings.0.manual_fqdn"); ok {
+ zeroPhishingSettingsPayload["manual-fqdn"] = v.(string)
+ }
+ gateway["zero-phishing-settings"] = zeroPhishingSettingsPayload
+ }
+ }
+ if ok := d.HasChange("autonomous_system_number"); ok {
+ if v, ok := d.GetOk("autonomous_system_number"); ok {
+ gateway["autonomous-system-number"] = v.(string)
+ }
+ }
+
+ if ok := d.HasChange("dns_server"); ok {
+ if v, ok := d.GetOkExists("dns_server"); ok {
+ gateway["dns-server"] = v.(bool)
+ }
+ }
+
+ if ok := d.HasChange("trust_settings"); ok {
+ if _, ok := d.GetOk("trust_settings"); ok {
+ trustSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("trust_settings.0.gateway_mac_address"); ok {
+ trustSettingsPayload["gateway-mac-address"] = v.(string)
+ }
+ if v, ok := d.GetOk("trust_settings.0.identification_method"); ok {
+ trustSettingsPayload["identification-method"] = v.(string)
+ }
+ if v, ok := d.GetOk("trust_settings.0.initiation_phase"); ok {
+ trustSettingsPayload["initiation-phase"] = v.(string)
+ }
+ gateway["trust-settings"] = trustSettingsPayload
+ }
+ }
+
+ if ok := d.HasChange("fetch_policy_scheduler"); ok {
+ if _, ok := d.GetOk("fetch_policy_scheduler"); ok {
+ fetchPolicySchedulerPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("fetch_policy_scheduler.0.enabled"); ok {
+ fetchPolicySchedulerPayload["enabled"] = v.(bool)
+ }
+ if v, ok := d.GetOk("fetch_policy_scheduler.0.schedule"); ok {
+ fetchPolicySchedulerPayload["schedule"] = v.(string)
+ }
+ gateway["fetch-policy-scheduler"] = fetchPolicySchedulerPayload
+ }
+ }
+
+ if ok := d.HasChange("export_logs_to_servers"); ok {
+ if v, ok := d.GetOk("export_logs_to_servers"); ok {
+ gateway["export-logs-to-servers"] = v.(*schema.Set).List()
+ }
+ }
+
+ if ok := d.HasChange("show_portals_certificate"); ok {
+ if v, ok := d.GetOkExists("show_portals_certificate"); ok {
+ gateway["show-portals-certificate"] = v.(bool)
+ }
+ }
+
updateSimpleGatewayRes, err := client.ApiCall("set-simple-gateway", gateway, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !updateSimpleGatewayRes.Success {
if updateSimpleGatewayRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_smart_task.go b/checkpoint/resource_checkpoint_management_smart_task.go
index 320e203f..9a3e5da5 100644
--- a/checkpoint/resource_checkpoint_management_smart_task.go
+++ b/checkpoint/resource_checkpoint_management_smart_task.go
@@ -57,6 +57,7 @@ func resourceManagementSmartTask() *schema.Resource {
"shared_secret": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "Shared secret that can be used by the target server to identify the Management Server.
The value will be sent as part of the request in the \"X-chkp-shared-secret\" header.",
},
"time_out": {
diff --git a/checkpoint/resource_checkpoint_management_threat_exception.go b/checkpoint/resource_checkpoint_management_threat_exception.go
index f19ccb50..e0ce3170 100644
--- a/checkpoint/resource_checkpoint_management_threat_exception.go
+++ b/checkpoint/resource_checkpoint_management_threat_exception.go
@@ -211,6 +211,11 @@ func resourceManagementThreatException() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "exception_number": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "N/A",
+ },
},
}
}
@@ -692,6 +697,12 @@ func updateManagementThreatException(d *schema.ResourceData, m interface{}) erro
log.Println("Update Threat Exception - Map = ", threatException)
+ if ok := d.HasChange("exception_number"); ok {
+ if v, ok := d.GetOk("exception_number"); ok {
+ threatException["exception-number"] = v.(int)
+ }
+ }
+
updateThreatExceptionRes, err := client.ApiCall("set-threat-exception", threatException, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !updateThreatExceptionRes.Success {
if updateThreatExceptionRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_threat_ioc_feed.go b/checkpoint/resource_checkpoint_management_threat_ioc_feed.go
index 33f993e0..2256f4b3 100644
--- a/checkpoint/resource_checkpoint_management_threat_ioc_feed.go
+++ b/checkpoint/resource_checkpoint_management_threat_ioc_feed.go
@@ -101,6 +101,7 @@ func resourceManagementThreatIocFeed() *schema.Resource {
"password": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "password for authenticating with the URL.",
},
"tags": {
@@ -160,6 +161,26 @@ func resourceManagementThreatIocFeed() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "confidence": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Set in order to configure the confidence of the snort protections in snort format. 1-Low, 5-High.",
+ },
+ "performance_impact": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Set in order to configure the performance impact of the snort protections in snort format. 1-Very Low, 4-High.",
+ },
+ "severity": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Set in order to configure the severity of the snort protections in snort format. 1-Low, 4-Critical.",
+ },
+ "use_snort_format": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Set in order to configure a snort format indicator feed.",
+ },
},
}
}
@@ -287,6 +308,18 @@ func createManagementThreatIocFeed(d *schema.ResourceData, m interface{}) error
log.Println("Create ThreatIocFeed - Map = ", threatIocFeed)
+ if v, ok := d.GetOk("confidence"); ok {
+ threatIocFeed["confidence"] = v.(int)
+ }
+ if v, ok := d.GetOk("performance_impact"); ok {
+ threatIocFeed["performance-impact"] = v.(int)
+ }
+ if v, ok := d.GetOk("severity"); ok {
+ threatIocFeed["severity"] = v.(int)
+ }
+ if v, ok := d.GetOkExists("use_snort_format"); ok {
+ threatIocFeed["use-snort-format"] = v.(bool)
+ }
addThreatIocFeedRes, err := client.ApiCall("add-threat-ioc-feed", threatIocFeed, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !addThreatIocFeedRes.Success {
if addThreatIocFeedRes.ErrorMsg != "" {
@@ -453,6 +486,22 @@ func readManagementThreatIocFeed(d *schema.ResourceData, m interface{}) error {
_ = d.Set("ignore_errors", v)
}
+ if v := threatIocFeed["confidence"]; v != nil {
+ _ = d.Set("confidence", v)
+ }
+
+ if v := threatIocFeed["performance-impact"]; v != nil {
+ _ = d.Set("performance_impact", v)
+ }
+
+ if v := threatIocFeed["severity"]; v != nil {
+ _ = d.Set("severity", v)
+ }
+
+ if v := threatIocFeed["use-snort-format"]; v != nil {
+ _ = d.Set("use_snort_format", v)
+ }
+
return nil
}
@@ -596,6 +645,18 @@ func updateManagementThreatIocFeed(d *schema.ResourceData, m interface{}) error
log.Println("Update ThreatIocFeed - Map = ", threatIocFeed)
+ if ok := d.HasChange("confidence"); ok {
+ threatIocFeed["confidence"] = d.Get("confidence")
+ }
+ if ok := d.HasChange("performance_impact"); ok {
+ threatIocFeed["performance-impact"] = d.Get("performance_impact")
+ }
+ if ok := d.HasChange("severity"); ok {
+ threatIocFeed["severity"] = d.Get("severity")
+ }
+ if ok := d.HasChange("use_snort_format"); ok {
+ threatIocFeed["use-snort-format"] = d.Get("use_snort_format")
+ }
updateThreatIocFeedRes, err := client.ApiCall("set-threat-ioc-feed", threatIocFeed, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !updateThreatIocFeedRes.Success {
if updateThreatIocFeedRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_threat_layer.go b/checkpoint/resource_checkpoint_management_threat_layer.go
index 2b9fa786..b15290df 100644
--- a/checkpoint/resource_checkpoint_management_threat_layer.go
+++ b/checkpoint/resource_checkpoint_management_threat_layer.go
@@ -69,6 +69,19 @@ func resourceManagementThreatLayer() *schema.Resource {
Computed: true,
Description: "N/A",
},
+ "shared": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether this layer is shared.",
+ },
+ "permissions_profiles": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "Collection of permission profile identifiers. Each can be a name or UUID.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
},
}
}
@@ -108,6 +121,13 @@ func createManagementThreatLayer(d *schema.ResourceData, m interface{}) error {
log.Println("Create Threat Layer - Map = ", threatLayer)
+ if v, ok := d.GetOkExists("shared"); ok {
+ threatLayer["shared"] = v.(bool)
+ }
+ if v, ok := d.GetOk("permissions_profiles"); ok {
+ threatLayer["permissions-profiles"] = v.(*schema.Set).List()
+ }
+
addThreatLayerRes, err := client.ApiCall("add-threat-layer", threatLayer, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !addThreatLayerRes.Success {
@@ -186,6 +206,19 @@ func readManagementThreatLayer(d *schema.ResourceData, m interface{}) error {
_ = d.Set("parent_layer", v)
}
+ if v := threatLayer["shared"]; v != nil {
+ _ = d.Set("shared", v)
+ }
+
+ if v := threatLayer["permissions-profiles"]; v != nil {
+ permissionsProfilesList := v.([]interface{})
+ permissionsProfilesIds := make([]string, 0)
+ for _, item := range permissionsProfilesList {
+ permissionsProfilesIds = append(permissionsProfilesIds, item.(map[string]interface{})["name"].(string))
+ }
+ _ = d.Set("permissions_profiles", permissionsProfilesIds)
+ }
+
return nil
}
@@ -228,6 +261,15 @@ func updateManagementThreatLayer(d *schema.ResourceData, m interface{}) error {
}
log.Println("Update Threat Layer - Map = ", threatLayer)
+ if ok := d.HasChange("shared"); ok {
+ threatLayer["shared"] = d.Get("shared")
+ }
+ if ok := d.HasChange("permissions_profiles"); ok {
+ if v, ok := d.GetOk("permissions_profiles"); ok {
+ threatLayer["permissions-profiles"] = v.(*schema.Set).List()
+ }
+ }
+
updateThreatLayerRes, err := client.ApiCall("set-threat-layer", threatLayer, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !updateThreatLayerRes.Success {
diff --git a/checkpoint/resource_checkpoint_management_threat_profile.go b/checkpoint/resource_checkpoint_management_threat_profile.go
index 5c64a0d2..e2e6bc73 100644
--- a/checkpoint/resource_checkpoint_management_threat_profile.go
+++ b/checkpoint/resource_checkpoint_management_threat_profile.go
@@ -459,6 +459,62 @@ func resourceManagementThreatProfile() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "ai_guard": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Is AI Guard blade activated.",
+ },
+ "advanced_dns_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Advanced DNS Settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "dga_detection": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Enable/Disable DGA based domains detection.",
+ },
+ "dns_domain_tunneling": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Enable/Disable DNS Tunneling based on domains detection.",
+ },
+ "dns_over_https": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Enable/Disable parsing of DNS over HTTPS protocol.",
+ },
+ "nxns_attack_detection": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Enable/Disable NXNS attack detection.",
+ },
+ },
+ },
+ },
+ "ai_guard_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "AI Guard blade settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "project_id": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Lakera project ID to associate with this profile.",
+ },
+ },
+ },
+ },
+ "ai_guard_api_key": {
+ Type: schema.TypeString,
+ Optional: true,
+ Sensitive: true,
+ Description: "Lakera AI Guard API key. Required only if AI Guard is enabled.",
+ },
},
}
}
@@ -716,6 +772,40 @@ func createManagementThreatProfile(d *schema.ResourceData, m interface{}) error
log.Println("Create Threat Profile - Map = ", threatProfile)
+ if v, ok := d.GetOkExists("ai_guard"); ok {
+ threatProfile["ai-guard"] = v.(bool)
+ }
+ if _, ok := d.GetOk("advanced_dns_settings"); ok {
+
+ advancedDnsSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("advanced_dns_settings.0.dga_detection"); ok {
+ advancedDnsSettingsPayload["dga-detection"] = v.(string)
+ }
+ if v, ok := d.GetOk("advanced_dns_settings.0.dns_domain_tunneling"); ok {
+ advancedDnsSettingsPayload["dns-domain-tunneling"] = v.(string)
+ }
+ if v, ok := d.GetOk("advanced_dns_settings.0.dns_over_https"); ok {
+ advancedDnsSettingsPayload["dns-over-https"] = v.(string)
+ }
+ if v, ok := d.GetOk("advanced_dns_settings.0.nxns_attack_detection"); ok {
+ advancedDnsSettingsPayload["nxns-attack-detection"] = v.(string)
+ }
+ threatProfile["advanced-dns-settings"] = advancedDnsSettingsPayload
+ }
+ if _, ok := d.GetOk("ai_guard_settings"); ok {
+
+ aiGuardSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("ai_guard_settings.0.project_id"); ok {
+ aiGuardSettingsPayload["project-id"] = v.(string)
+ }
+ threatProfile["ai-guard-settings"] = aiGuardSettingsPayload
+ }
+ if v, ok := d.GetOk("ai_guard_api_key"); ok {
+ threatProfile["ai-guard-api-key"] = v.(string)
+ }
+
threatProfileRes, err := client.ApiCall("add-threat-profile", threatProfile, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil {
return fmt.Errorf("%s", err.Error())
@@ -1069,6 +1159,37 @@ func readManagementThreatProfile(d *schema.ResourceData, m interface{}) error {
_ = d.Set("tags", nil)
}
+ if v := threatProfile["ai-guard"]; v != nil {
+ _ = d.Set("ai_guard", v)
+ }
+
+ if v := threatProfile["advanced-dns-settings"]; v != nil {
+ advancedDnsSettingsJson := v.(map[string]interface{})
+ advancedDnsSettingsState := make(map[string]interface{})
+ if v := advancedDnsSettingsJson["dga-detection"]; v != nil {
+ advancedDnsSettingsState["dga_detection"] = v
+ }
+ if v := advancedDnsSettingsJson["dns-domain-tunneling"]; v != nil {
+ advancedDnsSettingsState["dns_domain_tunneling"] = v
+ }
+ if v := advancedDnsSettingsJson["dns-over-https"]; v != nil {
+ advancedDnsSettingsState["dns_over_https"] = v
+ }
+ if v := advancedDnsSettingsJson["nxns-attack-detection"]; v != nil {
+ advancedDnsSettingsState["nxns_attack_detection"] = v
+ }
+ _ = d.Set("advanced_dns_settings", []interface{}{advancedDnsSettingsState})
+ }
+
+ if v := threatProfile["ai-guard-settings"]; v != nil {
+ aiGuardSettingsJson := v.(map[string]interface{})
+ aiGuardSettingsState := make(map[string]interface{})
+ if v := aiGuardSettingsJson["project-id"]; v != nil {
+ aiGuardSettingsState["project_id"] = v
+ }
+ _ = d.Set("ai_guard_settings", []interface{}{aiGuardSettingsState})
+ }
+
return nil
}
@@ -1371,6 +1492,46 @@ func updateManagementThreatProfile(d *schema.ResourceData, m interface{}) error
log.Println("Update Threat Profile - Map = ", threatProfile)
+ if ok := d.HasChange("ai_guard"); ok {
+ threatProfile["ai-guard"] = d.Get("ai_guard")
+ }
+ if ok := d.HasChange("advanced_dns_settings"); ok {
+ if _, ok := d.GetOk("advanced_dns_settings"); ok {
+
+ advancedDnsSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("advanced_dns_settings.0.dga_detection"); ok {
+ advancedDnsSettingsPayload["dga-detection"] = v.(string)
+ }
+ if v, ok := d.GetOk("advanced_dns_settings.0.dns_domain_tunneling"); ok {
+ advancedDnsSettingsPayload["dns-domain-tunneling"] = v.(string)
+ }
+ if v, ok := d.GetOk("advanced_dns_settings.0.dns_over_https"); ok {
+ advancedDnsSettingsPayload["dns-over-https"] = v.(string)
+ }
+ if v, ok := d.GetOk("advanced_dns_settings.0.nxns_attack_detection"); ok {
+ advancedDnsSettingsPayload["nxns-attack-detection"] = v.(string)
+ }
+ threatProfile["advanced-dns-settings"] = advancedDnsSettingsPayload
+ }
+ }
+ if ok := d.HasChange("ai_guard_settings"); ok {
+ if _, ok := d.GetOk("ai_guard_settings"); ok {
+
+ aiGuardSettingsPayload := make(map[string]interface{})
+
+ if v, ok := d.GetOk("ai_guard_settings.0.project_id"); ok {
+ aiGuardSettingsPayload["project-id"] = v.(string)
+ }
+ threatProfile["ai-guard-settings"] = aiGuardSettingsPayload
+ }
+ }
+ if ok := d.HasChange("ai_guard_api_key"); ok {
+ if v, ok := d.GetOk("ai_guard_api_key"); ok {
+ threatProfile["ai-guard-api-key"] = v.(string)
+ }
+ }
+
threatProfileRes, err := client.ApiCall("set-threat-profile", threatProfile, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil {
return fmt.Errorf("%s", err.Error())
diff --git a/checkpoint/resource_checkpoint_management_threat_rule.go b/checkpoint/resource_checkpoint_management_threat_rule.go
index ddf66477..2aecbec5 100644
--- a/checkpoint/resource_checkpoint_management_threat_rule.go
+++ b/checkpoint/resource_checkpoint_management_threat_rule.go
@@ -169,6 +169,11 @@ func resourceManagementThreatRule() *schema.Resource {
Optional: true,
Description: "Packet capture.",
},
+ "forensics": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Whether to enable forensics.",
+ },
},
},
},
@@ -300,6 +305,9 @@ func createManagementThreatRule(d *schema.ResourceData, m interface{}) error {
if v, ok := d.GetOkExists("track_settings.0.packet_capture"); ok {
trackSettingsPayload["packet-capture"] = v.(bool)
}
+ if v, ok := d.GetOkExists("track_settings.0.forensics"); ok {
+ trackSettingsPayload["forensics"] = v.(bool)
+ }
threatRule["track-settings"] = trackSettingsPayload
}
}
@@ -480,6 +488,9 @@ func readManagementThreatRule(d *schema.ResourceData, m interface{}) error {
if v := trackSettingsMap["packet-capture"]; v != nil {
trackSettingsState["packet_capture"] = v.(bool)
}
+ if v := trackSettingsMap["forensics"]; v != nil {
+ trackSettingsState["forensics"] = v
+ }
_ = d.Set("track_settings", []interface{}{trackSettingsState})
}
@@ -623,6 +634,9 @@ func updateManagementThreatRule(d *schema.ResourceData, m interface{}) error {
if v, ok := d.GetOkExists("track_settings.0.packet_capture"); ok {
trackSettingsPayload["packet-capture"] = v.(bool)
}
+ if v, ok := d.GetOkExists("track_settings.0.forensics"); ok {
+ trackSettingsPayload["forensics"] = v.(bool)
+ }
threatRule["track-settings"] = trackSettingsPayload
}
}
diff --git a/checkpoint/resource_checkpoint_management_time.go b/checkpoint/resource_checkpoint_management_time.go
index 93fa758d..64257c64 100644
--- a/checkpoint/resource_checkpoint_management_time.go
+++ b/checkpoint/resource_checkpoint_management_time.go
@@ -51,6 +51,16 @@ func resourceManagementTime() *schema.Resource {
Optional: true,
Description: "Time in format HH:mm.",
},
+ "iso_8601": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Date and time represented in international ISO 8601 format. Time zone information is ignored.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
},
},
},
@@ -106,6 +116,16 @@ func resourceManagementTime() *schema.Resource {
Optional: true,
Description: "Time in format HH:mm.",
},
+ "iso_8601": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Date and time represented in international ISO 8601 format. Time zone information is ignored.",
+ },
+ "posix": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.",
+ },
},
},
},
@@ -205,6 +225,12 @@ func createManagementTime(d *schema.ResourceData, m interface{}) error {
if v, ok := d.GetOk("end.0.time"); ok {
res["time"] = v.(string)
}
+ if v, ok := d.GetOk("end.0.iso_8601"); ok {
+ res["iso-8601"] = v.(string)
+ }
+ if v, ok := d.GetOk("end.0.posix"); ok {
+ res["posix"] = v.(int)
+ }
time["end"] = res
}
@@ -251,6 +277,12 @@ func createManagementTime(d *schema.ResourceData, m interface{}) error {
if v, ok := d.GetOk("start.0.time"); ok {
res["time"] = v.(string)
}
+ if v, ok := d.GetOk("start.0.iso_8601"); ok {
+ res["iso-8601"] = v.(string)
+ }
+ if v, ok := d.GetOk("start.0.posix"); ok {
+ res["posix"] = v.(int)
+ }
time["start"] = res
}
@@ -352,6 +384,12 @@ func readManagementTime(d *schema.ResourceData, m interface{}) error {
endMapToReturn["time"] = v.(string)
}
+ if v := endMap["iso-8601"]; v != nil {
+ endMapToReturn["iso_8601"] = v
+ }
+ if v := endMap["posix"]; v != nil {
+ endMapToReturn["posix"] = v
+ }
_ = d.Set("end", []interface{}{endMapToReturn})
}
@@ -407,6 +445,12 @@ func readManagementTime(d *schema.ResourceData, m interface{}) error {
startMapToReturn["time"] = v.(string)
}
+ if v := startMap["iso-8601"]; v != nil {
+ startMapToReturn["iso_8601"] = v
+ }
+ if v := startMap["posix"]; v != nil {
+ startMapToReturn["posix"] = v
+ }
_ = d.Set("start", []interface{}{startMapToReturn})
}
@@ -520,6 +564,12 @@ func updateManagementTime(d *schema.ResourceData, m interface{}) error {
endPayload["time"] = v.(string)
}
if len(endPayload) > 0 {
+ if v, ok := d.GetOk("end.0.iso_8601"); ok {
+ endPayload["iso-8601"] = v.(string)
+ }
+ if v, ok := d.GetOk("end.0.posix"); ok {
+ endPayload["posix"] = v.(int)
+ }
time["end"] = endPayload
}
}
@@ -577,6 +627,12 @@ func updateManagementTime(d *schema.ResourceData, m interface{}) error {
startPayload["time"] = v.(string)
}
if len(startPayload) > 0 {
+ if v, ok := d.GetOk("start.0.iso_8601"); ok {
+ startPayload["iso-8601"] = v.(string)
+ }
+ if v, ok := d.GetOk("start.0.posix"); ok {
+ startPayload["posix"] = v.(int)
+ }
time["start"] = startPayload
}
}
diff --git a/checkpoint/resource_checkpoint_management_trusted_client.go b/checkpoint/resource_checkpoint_management_trusted_client.go
index b3e815af..25b02153 100644
--- a/checkpoint/resource_checkpoint_management_trusted_client.go
+++ b/checkpoint/resource_checkpoint_management_trusted_client.go
@@ -118,6 +118,16 @@ func resourceManagementTrustedClient() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "subnet_mask4": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "IPv4 mask.",
+ },
+ "subnet_mask": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "N/A",
+ },
},
}
}
@@ -201,6 +211,13 @@ func createManagementTrustedClient(d *schema.ResourceData, m interface{}) error
log.Println("Create TrustedClient - Map = ", trustedClient)
+ if v, ok := d.GetOk("subnet_mask4"); ok {
+ trustedClient["subnet-mask4"] = v.(string)
+ }
+ if v, ok := d.GetOk("subnet_mask"); ok {
+ trustedClient["subnet-mask"] = v.(string)
+ }
+
addTrustedClientRes, err := client.ApiCall("add-trusted-client", trustedClient, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !addTrustedClientRes.Success {
if addTrustedClientRes.ErrorMsg != "" {
@@ -334,6 +351,10 @@ func readManagementTrustedClient(d *schema.ResourceData, m interface{}) error {
_ = d.Set("ignore_errors", v)
}
+ if v := trustedClient["subnet-mask4"]; v != nil {
+ _ = d.Set("subnet_mask4", v)
+ }
+
return nil
}
@@ -431,6 +452,15 @@ func updateManagementTrustedClient(d *schema.ResourceData, m interface{}) error
log.Println("Update TrustedClient - Map = ", trustedClient)
+ if ok := d.HasChange("subnet_mask4"); ok {
+ trustedClient["subnet-mask4"] = d.Get("subnet_mask4")
+ }
+ if ok := d.HasChange("subnet_mask"); ok {
+ if v, ok := d.GetOk("subnet_mask"); ok {
+ trustedClient["subnet-mask"] = v.(string)
+ }
+ }
+
updateTrustedClientRes, err := client.ApiCall("set-trusted-client", trustedClient, client.GetSessionID(), true, client.IsProxyUsed())
if err != nil || !updateTrustedClientRes.Success {
if updateTrustedClientRes.ErrorMsg != "" {
diff --git a/checkpoint/resource_checkpoint_management_user.go b/checkpoint/resource_checkpoint_management_user.go
index 66c9a240..7e4b4407 100644
--- a/checkpoint/resource_checkpoint_management_user.go
+++ b/checkpoint/resource_checkpoint_management_user.go
@@ -140,8 +140,19 @@ func resourceManagementUser() *schema.Resource {
"shared_secret": {
Type: schema.TypeString,
Optional: true,
+ Sensitive: true,
Description: "IKE shared secret.",
},
+ "data_integrity_algorithm": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "IKE data integrity algorithm.",
+ },
+ "encryption_algorithm": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "IKE encryption algorithm.",
+ },
},
},
},
@@ -277,6 +288,12 @@ func createManagementUser(d *schema.ResourceData, m interface{}) error {
if v, ok := d.GetOk("encryption.0.shared_secret"); ok {
encryptionPayload["shared-secret"] = v.(string)
}
+ if v, ok := d.GetOk("encryption.0.data_integrity_algorithm"); ok {
+ encryptionPayload["data-integrity-algorithm"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.encryption_algorithm"); ok {
+ encryptionPayload["encryption-algorithm"] = v.(string)
+ }
user["encryption"] = encryptionPayload
}
}
@@ -432,6 +449,12 @@ func readManagementUser(d *schema.ResourceData, m interface{}) error {
encryptionMapToReturn["shared_secret"] = v
}
+ if v := encryptionMap["data-integrity-algorithm"]; v != nil {
+ encryptionMapToReturn["data_integrity_algorithm"] = v
+ }
+ if v := encryptionMap["encryption-algorithm"]; v != nil {
+ encryptionMapToReturn["encryption_algorithm"] = v
+ }
_ = d.Set("encryption", []interface{}{encryptionMapToReturn})
} else {
@@ -567,6 +590,12 @@ func updateManagementUser(d *schema.ResourceData, m interface{}) error {
if v, ok := d.GetOk("encryption.0.shared_secret"); ok {
encryptionPayload["shared-secret"] = v.(string)
}
+ if v, ok := d.GetOk("encryption.0.data_integrity_algorithm"); ok {
+ encryptionPayload["data-integrity-algorithm"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.encryption_algorithm"); ok {
+ encryptionPayload["encryption-algorithm"] = v.(string)
+ }
user["encryption"] = encryptionPayload
}
}
diff --git a/checkpoint/resource_checkpoint_management_user_template.go b/checkpoint/resource_checkpoint_management_user_template.go
index d80d601c..4914c6ba 100644
--- a/checkpoint/resource_checkpoint_management_user_template.go
+++ b/checkpoint/resource_checkpoint_management_user_template.go
@@ -129,6 +129,16 @@ func resourceManagementUserTemplate() *schema.Resource {
Optional: true,
Description: "Enable IKE shared secret.",
},
+ "data_integrity_algorithm": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "IKE data integrity algorithm.",
+ },
+ "encryption_algorithm": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "IKE encryption algorithm.",
+ },
},
},
},
@@ -247,6 +257,12 @@ func createManagementUserTemplate(d *schema.ResourceData, m interface{}) error {
if v, ok := d.GetOkExists("encryption.0.enable_shared_secret"); ok {
encryptionPayload["enable-shared-secret"] = v.(bool)
}
+ if v, ok := d.GetOk("encryption.0.data_integrity_algorithm"); ok {
+ encryptionPayload["data-integrity-algorithm"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.encryption_algorithm"); ok {
+ encryptionPayload["encryption-algorithm"] = v.(string)
+ }
userTemplate["encryption"] = encryptionPayload
}
}
@@ -392,6 +408,12 @@ func readManagementUserTemplate(d *schema.ResourceData, m interface{}) error {
encryptionMapToReturn["enable_shared_secret"] = v
}
+ if v := encryptionMap["data-integrity-algorithm"]; v != nil {
+ encryptionMapToReturn["data_integrity_algorithm"] = v
+ }
+ if v := encryptionMap["encryption-algorithm"]; v != nil {
+ encryptionMapToReturn["encryption_algorithm"] = v
+ }
_ = d.Set("encryption", []interface{}{encryptionMapToReturn})
} else {
@@ -525,6 +547,12 @@ func updateManagementUserTemplate(d *schema.ResourceData, m interface{}) error {
if v, ok := d.GetOkExists("encryption.0.enable_shared_secret"); ok {
encryptionPayload["enable-shared-secret"] = v.(bool)
}
+ if v, ok := d.GetOk("encryption.0.data_integrity_algorithm"); ok {
+ encryptionPayload["data-integrity-algorithm"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.encryption_algorithm"); ok {
+ encryptionPayload["encryption-algorithm"] = v.(string)
+ }
userTemplate["encryption"] = encryptionPayload
}
}
diff --git a/checkpoint/resource_checkpoint_management_vpn_community_meshed.go b/checkpoint/resource_checkpoint_management_vpn_community_meshed.go
index 87ff8e3a..e64a7e66 100644
--- a/checkpoint/resource_checkpoint_management_vpn_community_meshed.go
+++ b/checkpoint/resource_checkpoint_management_vpn_community_meshed.go
@@ -170,6 +170,11 @@ func resourceManagementVpnCommunityMeshed() *schema.Resource {
Description: "Indicates the time interval for IKE phase 2 renegotiation.",
Default: 1440,
},
+ "ike_p2_rekey_time_unit": {
+ Type: schema.TypeString,
+ Optional: true,
+ Computed: true,
+ },
"use_standard_proposal": {
Type: schema.TypeBool,
Optional: true,
@@ -235,6 +240,11 @@ func resourceManagementVpnCommunityMeshed() *schema.Resource {
Optional: true,
Description: "Interface redundancy mode (Active/Backup).",
},
+ "ip_version": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The IP version of the interface's IP address (IPv4/IPv6).",
+ },
},
},
},
@@ -342,6 +352,27 @@ func resourceManagementVpnCommunityMeshed() *schema.Resource {
Description: "Indicates the time interval for IKE phase 1 renegotiation.",
Default: 1440,
},
+ "ike_p1_rekey_time_unit": {
+ Type: schema.TypeString,
+ Optional: true,
+ Computed: true,
+ Description: "Indicates the time unit for the 'ike-p1-rekey-time-unit' parameter, rounded up to minutes scale.",
+ },
+ "use_standard_proposal": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to use a proposal with a single Diffie-Hellman group.",
+ },
+ "use_multiple_key_exchanges": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to use a proposal with Multiple Key Exchanges.",
+ },
+ "multiple_key_exchanges": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Multiple Key Exchanges proposal object.",
+ },
},
},
},
@@ -382,6 +413,27 @@ func resourceManagementVpnCommunityMeshed() *schema.Resource {
Description: "Indicates the time interval for IKE phase 2 renegotiation.",
Default: 1440,
},
+ "ike_p2_rekey_time_unit": {
+ Type: schema.TypeString,
+ Optional: true,
+ Computed: true,
+ Description: "Indicates the time unit for the 'ike-p2-rekey-time-unit' parameter, rounded up to minutes scale.",
+ },
+ "use_standard_proposal": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to use a proposal with a single Diffie-Hellman group.",
+ },
+ "use_multiple_key_exchanges": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to use a proposal with Multiple Key Exchanges.",
+ },
+ "multiple_key_exchanges": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Multiple Key Exchanges proposal object.",
+ },
},
},
},
@@ -583,6 +635,95 @@ func resourceManagementVpnCommunityMeshed() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "route_based_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "VPN Community Route-Based settings.
Relevant only in Route-Based VPN Communities.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "add_automatic_routes": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The type of routes to use for the automatic Route-Based configuration.
Relevant only in Route-Based VPN Communities.",
+ },
+ "advanced": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Advanced settings
Relevant only in Route-Based VPN Communities.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "bfd": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to enable Bidirectional Forwarding Detection.
Relevant only in Route-Based VPN Communities.",
+ },
+ "graceful_restart": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to enable Graceful Restart in the applicable Dynamic Routing protocols.
Relevant only in Route-Based VPN Communities...",
+ },
+ },
+ },
+ },
+ "override_routes": {
+ Type: schema.TypeList,
+ Optional: true,
+ Description: "Override automatic routing settings in a specific Security Gateway in this VPN Community.
Relevant only in Route-Based VPN Communities...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "auto_config": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to configure the routing settings automatically for the Security Gateway.
Relevant only in Route-Based VPN CommunitiesExported Routes.
Relevant only in Route-Based VPN Communities.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "custom_routes": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Specifies to export user-defined networks from the Security Gateway.
Relevant only in Route-Based VPN Communities.",
+ },
+ "custom_routes_object": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Specifies the name of the Network object or Network Group object that represents the exported routes.
Relevant only in Route-Based VPN Com...",
+ },
+ "internal_interfaces": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Specifies to export networks from interfaces with Topology 'Internal' from the Security Gateway.
Relevant only in Route-Based VPN Communit...",
+ },
+ "static_routes": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Specifies to export static routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.",
+ },
+ },
+ },
+ },
+ "gateway": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Name of the Security Gateway object in which to override the automatic routing settings.
Relevant only in Route-Based VPN Communities<...",
+ },
+ "mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Specifies how to export routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
},
}
}
@@ -752,6 +893,9 @@ func createManagementVpnCommunityMeshed(d *schema.ResourceData, m interface{}) e
if v, ok := d.GetOk("override_interfaces." + strconv.Itoa(i) + ".interfaces." + strconv.Itoa(j) + ".redundancy_mode"); ok {
interfacesPayload["redundancy-mode"] = v.(string)
}
+ if v, ok := d.GetOk("override_interfaces." + strconv.Itoa(i) + ".interfaces." + strconv.Itoa(j) + ".ip_version"); ok {
+ interfacesPayload["ip-version"] = v.(string)
+ }
overrideInterfacesInterfacesPayload = append(overrideInterfacesInterfacesPayload, interfacesPayload)
}
Payload["interfaces"] = overrideInterfacesInterfacesPayload
@@ -837,6 +981,15 @@ func createManagementVpnCommunityMeshed(d *schema.ResourceData, m interface{}) e
}
if _, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1"); ok {
ikePhase1Payload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.use_standard_proposal"); ok {
+ ikePhase1Payload["use-standard-proposal"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.use_multiple_key_exchanges"); ok {
+ ikePhase1Payload["use-multiple-key-exchanges"] = v.(bool)
+ }
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.multiple_key_exchanges"); ok {
+ ikePhase1Payload["multiple-key-exchanges"] = v.(string)
+ }
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.encryption_algorithm"); ok {
ikePhase1Payload["encryption-algorithm"] = v.(string)
}
@@ -849,10 +1002,22 @@ func createManagementVpnCommunityMeshed(d *schema.ResourceData, m interface{}) e
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.ike_p1_rekey_time"); ok {
ikePhase1Payload["ike-p1-rekey-time"] = v.(int)
}
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.ike_p1_rekey_time_unit"); ok {
+ ikePhase1Payload["ike-p1-rekey-time-unit"] = v.(string)
+ }
payload["ike-phase-1"] = ikePhase1Payload
}
if _, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2"); ok {
ikePhase2Payload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.use_standard_proposal"); ok {
+ ikePhase2Payload["use-standard-proposal"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.use_multiple_key_exchanges"); ok {
+ ikePhase2Payload["use-multiple-key-exchanges"] = v.(bool)
+ }
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.multiple_key_exchanges"); ok {
+ ikePhase2Payload["multiple-key-exchanges"] = v.(string)
+ }
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.encryption_algorithm"); ok {
ikePhase2Payload["encryption-algorithm"] = v.(string)
}
@@ -868,6 +1033,9 @@ func createManagementVpnCommunityMeshed(d *schema.ResourceData, m interface{}) e
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.ike_p2_rekey_time"); ok {
ikePhase2Payload["ike-p2-rekey-time"] = v.(int)
}
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.ike_p2_rekey_time_unit"); ok {
+ ikePhase2Payload["ike-p2-rekey-time-unit"] = v.(string)
+ }
payload["ike-phase-2"] = ikePhase2Payload
}
granularEncryptionsPayload = append(granularEncryptionsPayload, payload)
@@ -1015,6 +1183,63 @@ func createManagementVpnCommunityMeshed(d *schema.ResourceData, m interface{}) e
vpnCommunityMeshed["ignore-errors"] = v.(bool)
}
+ if v, ok := d.GetOk("route_based_settings"); ok {
+ routeBasedSettingsList := v.([]interface{})
+ if len(routeBasedSettingsList) > 0 {
+ routeBasedSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("route_based_settings.0.add_automatic_routes"); ok {
+ routeBasedSettingsPayload["add-automatic-routes"] = v.(string)
+ }
+ if _, ok := d.GetOk("route_based_settings.0.advanced"); ok {
+ advancedPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("route_based_settings.0.advanced.0.bfd"); ok {
+ advancedPayload["bfd"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("route_based_settings.0.advanced.0.graceful_restart"); ok {
+ advancedPayload["graceful-restart"] = v.(bool)
+ }
+ routeBasedSettingsPayload["advanced"] = advancedPayload
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes"); ok {
+ overrideRoutesList := v.([]interface{})
+ if len(overrideRoutesList) > 0 {
+ var overrideRoutesPayload []map[string]interface{}
+ for i := range overrideRoutesList {
+ overrideRoutesItem := make(map[string]interface{})
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".auto_config"); ok {
+ overrideRoutesItem["auto-config"] = v.(bool)
+ }
+ if _, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes"); ok {
+ exportedRoutesPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.custom_routes"); ok {
+ exportedRoutesPayload["custom-routes"] = v.(bool)
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.custom_routes_object"); ok {
+ exportedRoutesPayload["custom-routes-object"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.internal_interfaces"); ok {
+ exportedRoutesPayload["internal-interfaces"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.static_routes"); ok {
+ exportedRoutesPayload["static-routes"] = v.(bool)
+ }
+ overrideRoutesItem["exported-routes"] = exportedRoutesPayload
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".gateway"); ok {
+ overrideRoutesItem["gateway"] = v.(string)
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".mode"); ok {
+ overrideRoutesItem["mode"] = v.(string)
+ }
+ overrideRoutesPayload = append(overrideRoutesPayload, overrideRoutesItem)
+ }
+ routeBasedSettingsPayload["override-routes"] = overrideRoutesPayload
+ }
+ }
+ vpnCommunityMeshed["route-based-settings"] = routeBasedSettingsPayload
+ }
+ }
+
log.Println("Create VpnCommunityMeshed - Map = ", vpnCommunityMeshed)
addVpnCommunityMeshedRes, err := client.ApiCall("add-vpn-community-meshed", vpnCommunityMeshed, client.GetSessionID(), true, client.IsProxyUsed())
@@ -1220,24 +1445,34 @@ func readManagementVpnCommunityMeshed(d *schema.ResourceData, m interface{}) err
overrideInterfacesMapToAdd["gateway"] = v
}
if v := overrideInterfacesMap["interfaces"]; v != nil {
- interfacesShow := v.(map[string]interface{})
- interfacesState := make(map[string]interface{})
- if v := interfacesShow["interface-name"]; v != nil {
- interfacesState["interface_name"] = v
- }
- if v := interfacesShow["next-hop-ip"]; v != nil {
- interfacesState["next_hop_ip"] = v
- }
- if v := interfacesShow["static-nat-ip"]; v != nil {
- interfacesState["static_nat_ip"] = v
- }
- if v := interfacesShow["priority"]; v != nil {
- interfacesState["priority"] = v
- }
- if v := interfacesShow["redundancy-mode"]; v != nil {
- interfacesState["redundancy_mode"] = v
+ interfacesList := v.([]interface{})
+ if len(interfacesList) > 0 {
+ var interfacesListState []map[string]interface{}
+ for j := range interfacesList {
+ interfacesShow := interfacesList[j].(map[string]interface{})
+ interfacesState := make(map[string]interface{})
+ if v := interfacesShow["interface-name"]; v != nil {
+ interfacesState["interface_name"] = v
+ }
+ if v := interfacesShow["next-hop-ip"]; v != nil {
+ interfacesState["next_hop_ip"] = v
+ }
+ if v := interfacesShow["static-nat-ip"]; v != nil {
+ interfacesState["static_nat_ip"] = v
+ }
+ if v := interfacesShow["priority"]; v != nil {
+ interfacesState["priority"] = v
+ }
+ if v := interfacesShow["redundancy-mode"]; v != nil {
+ interfacesState["redundancy_mode"] = v
+ }
+ if v := interfacesShow["ip-version"]; v != nil {
+ interfacesState["ip_version"] = v
+ }
+ interfacesListState = append(interfacesListState, interfacesState)
+ }
+ overrideInterfacesMapToAdd["interfaces"] = interfacesListState
}
- overrideInterfacesMapToAdd["interfaces"] = interfacesState
}
overrideInterfacesListToReturn = append(overrideInterfacesListToReturn, overrideInterfacesMapToAdd)
}
@@ -1373,6 +1608,18 @@ func readManagementVpnCommunityMeshed(d *schema.ResourceData, m interface{}) err
if v := ikePhase1Show["ike-p1-rekey-time"]; v != nil {
ikePhase1State["ike_p1_rekey_time"] = int(v.(float64))
}
+ if v := ikePhase1Show["ike-p1-rekey-time-unit"]; v != nil {
+ ikePhase1State["ike_p1_rekey_time_unit"] = v
+ }
+ if v := ikePhase1Show["use-standard-proposal"]; v != nil {
+ ikePhase1State["use_standard_proposal"] = v
+ }
+ if v := ikePhase1Show["use-multiple-key-exchanges"]; v != nil {
+ ikePhase1State["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase1Show["multiple-key-exchanges"]; v != nil {
+ ikePhase1State["multiple_key_exchanges"] = v.(map[string]interface{})["name"]
+ }
granularEncryptionState["ike_phase_1"] = []interface{}{ikePhase1State}
}
@@ -1394,6 +1641,18 @@ func readManagementVpnCommunityMeshed(d *schema.ResourceData, m interface{}) err
if v := ikePhase2Show["ike-p2-rekey-time"]; v != nil {
ikePhase2State["ike_p2_rekey_time"] = int(v.(float64))
}
+ if v := ikePhase2Show["ike-p2-rekey-time-unit"]; v != nil {
+ ikePhase2State["ike_p2_rekey_time_unit"] = v
+ }
+ if v := ikePhase2Show["use-standard-proposal"]; v != nil {
+ ikePhase2State["use_standard_proposal"] = v
+ }
+ if v := ikePhase2Show["use-multiple-key-exchanges"]; v != nil {
+ ikePhase2State["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase2Show["multiple-key-exchanges"]; v != nil {
+ ikePhase2State["multiple_key_exchanges"] = v.(map[string]interface{})["name"]
+ }
granularEncryptionState["ike_phase_2"] = []interface{}{ikePhase2State}
}
granularEncryptionsState = append(granularEncryptionsState, granularEncryptionState)
@@ -1601,6 +1860,62 @@ func readManagementVpnCommunityMeshed(d *schema.ResourceData, m interface{}) err
_ = d.Set("ignore_errors", v)
}
+ if v := vpnCommunityMeshed["route-based-settings"]; v != nil {
+ routeBasedSettingsShow := v.(map[string]interface{})
+ routeBasedSettingsState := make(map[string]interface{})
+ if v := routeBasedSettingsShow["add-automatic-routes"]; v != nil {
+ routeBasedSettingsState["add_automatic_routes"] = v
+ }
+ if v := routeBasedSettingsShow["advanced"]; v != nil {
+ advancedShow := v.(map[string]interface{})
+ advancedState := make(map[string]interface{})
+ if v := advancedShow["bfd"]; v != nil {
+ advancedState["bfd"] = v
+ }
+ if v := advancedShow["graceful-restart"]; v != nil {
+ advancedState["graceful_restart"] = v
+ }
+ routeBasedSettingsState["advanced"] = []interface{}{advancedState}
+ }
+ if v := routeBasedSettingsShow["override-routes"]; v != nil {
+ overrideRoutesList := v.([]interface{})
+ var overrideRoutesListState []map[string]interface{}
+ for i := range overrideRoutesList {
+ overrideRoutesShow := overrideRoutesList[i].(map[string]interface{})
+ overrideRoutesState := make(map[string]interface{})
+ if v := overrideRoutesShow["auto-config"]; v != nil {
+ overrideRoutesState["auto_config"] = v
+ }
+ if v := overrideRoutesShow["exported-routes"]; v != nil {
+ exportedRoutesShow := v.(map[string]interface{})
+ exportedRoutesState := make(map[string]interface{})
+ if v := exportedRoutesShow["custom-routes"]; v != nil {
+ exportedRoutesState["custom_routes"] = v
+ }
+ if v := exportedRoutesShow["custom-routes-object"]; v != nil {
+ exportedRoutesState["custom_routes_object"] = v.(map[string]interface{})["name"]
+ }
+ if v := exportedRoutesShow["internal-interfaces"]; v != nil {
+ exportedRoutesState["internal_interfaces"] = v
+ }
+ if v := exportedRoutesShow["static-routes"]; v != nil {
+ exportedRoutesState["static_routes"] = v
+ }
+ overrideRoutesState["exported_routes"] = []interface{}{exportedRoutesState}
+ }
+ if v := overrideRoutesShow["gateway"]; v != nil {
+ overrideRoutesState["gateway"] = v.(map[string]interface{})["name"]
+ }
+ if v := overrideRoutesShow["mode"]; v != nil {
+ overrideRoutesState["mode"] = v
+ }
+ overrideRoutesListState = append(overrideRoutesListState, overrideRoutesState)
+ }
+ routeBasedSettingsState["override_routes"] = overrideRoutesListState
+ }
+ _ = d.Set("route_based_settings", []interface{}{routeBasedSettingsState})
+ }
+
return nil
}
@@ -1790,6 +2105,9 @@ func updateManagementVpnCommunityMeshed(d *schema.ResourceData, m interface{}) e
if v, ok := d.GetOk("override_interfaces." + strconv.Itoa(i) + ".interfaces." + strconv.Itoa(j) + ".redundancy_mode"); ok {
interfacesPayload["redundancy-mode"] = v
}
+ if v, ok := d.GetOk("override_interfaces." + strconv.Itoa(i) + ".interfaces." + strconv.Itoa(j) + ".ip_version"); ok {
+ interfacesPayload["ip-version"] = v.(string)
+ }
overrideInterfacesInterfacesPayload = append(overrideInterfacesInterfacesPayload, interfacesPayload)
}
Payload["interfaces"] = overrideInterfacesInterfacesPayload
@@ -1890,6 +2208,15 @@ func updateManagementVpnCommunityMeshed(d *schema.ResourceData, m interface{}) e
}
if _, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1"); ok {
ikePhase1Payload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.use_standard_proposal"); ok {
+ ikePhase1Payload["use-standard-proposal"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.use_multiple_key_exchanges"); ok {
+ ikePhase1Payload["use-multiple-key-exchanges"] = v.(bool)
+ }
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.multiple_key_exchanges"); ok {
+ ikePhase1Payload["multiple-key-exchanges"] = v.(string)
+ }
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.encryption_algorithm"); ok {
ikePhase1Payload["encryption-algorithm"] = v.(string)
}
@@ -1902,10 +2229,22 @@ func updateManagementVpnCommunityMeshed(d *schema.ResourceData, m interface{}) e
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.ike_p1_rekey_time"); ok {
ikePhase1Payload["ike-p1-rekey-time"] = v.(string)
}
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.ike_p1_rekey_time_unit"); ok {
+ ikePhase1Payload["ike-p1-rekey-time-unit"] = v.(string)
+ }
payload["ike-phase-1"] = ikePhase1Payload
}
if _, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2"); ok {
ikePhase2Payload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.use_standard_proposal"); ok {
+ ikePhase2Payload["use-standard-proposal"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.use_multiple_key_exchanges"); ok {
+ ikePhase2Payload["use-multiple-key-exchanges"] = v.(bool)
+ }
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.multiple_key_exchanges"); ok {
+ ikePhase2Payload["multiple-key-exchanges"] = v.(string)
+ }
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.encryption_algorithm"); ok {
ikePhase2Payload["encryption-algorithm"] = v.(string)
}
@@ -1921,6 +2260,9 @@ func updateManagementVpnCommunityMeshed(d *schema.ResourceData, m interface{}) e
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.ike_p2_rekey_time"); ok {
ikePhase2Payload["ike-p2-rekey-time"] = v.(int)
}
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.ike_p2_rekey_time_unit"); ok {
+ ikePhase2Payload["ike-p2-rekey-time-unit"] = v.(string)
+ }
payload["ike-phase-2"] = ikePhase2Payload
}
granularEncryptionsPayload = append(granularEncryptionsPayload, payload)
@@ -2093,6 +2435,65 @@ func updateManagementVpnCommunityMeshed(d *schema.ResourceData, m interface{}) e
vpnCommunityMeshed["ignore-errors"] = v.(bool)
}
+ if d.HasChange("route_based_settings") {
+ if v, ok := d.GetOk("route_based_settings"); ok {
+ routeBasedSettingsList := v.([]interface{})
+ if len(routeBasedSettingsList) > 0 {
+ routeBasedSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("route_based_settings.0.add_automatic_routes"); ok {
+ routeBasedSettingsPayload["add-automatic-routes"] = v.(string)
+ }
+ if _, ok := d.GetOk("route_based_settings.0.advanced"); ok {
+ advancedPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("route_based_settings.0.advanced.0.bfd"); ok {
+ advancedPayload["bfd"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("route_based_settings.0.advanced.0.graceful_restart"); ok {
+ advancedPayload["graceful-restart"] = v.(bool)
+ }
+ routeBasedSettingsPayload["advanced"] = advancedPayload
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes"); ok {
+ overrideRoutesList := v.([]interface{})
+ if len(overrideRoutesList) > 0 {
+ var overrideRoutesPayload []map[string]interface{}
+ for i := range overrideRoutesList {
+ overrideRoutesItem := make(map[string]interface{})
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".auto_config"); ok {
+ overrideRoutesItem["auto-config"] = v.(bool)
+ }
+ if _, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes"); ok {
+ exportedRoutesPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.custom_routes"); ok {
+ exportedRoutesPayload["custom-routes"] = v.(bool)
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.custom_routes_object"); ok {
+ exportedRoutesPayload["custom-routes-object"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.internal_interfaces"); ok {
+ exportedRoutesPayload["internal-interfaces"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.static_routes"); ok {
+ exportedRoutesPayload["static-routes"] = v.(bool)
+ }
+ overrideRoutesItem["exported-routes"] = exportedRoutesPayload
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".gateway"); ok {
+ overrideRoutesItem["gateway"] = v.(string)
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".mode"); ok {
+ overrideRoutesItem["mode"] = v.(string)
+ }
+ overrideRoutesPayload = append(overrideRoutesPayload, overrideRoutesItem)
+ }
+ routeBasedSettingsPayload["override-routes"] = overrideRoutesPayload
+ }
+ }
+ vpnCommunityMeshed["route-based-settings"] = routeBasedSettingsPayload
+ }
+ }
+ }
+
log.Println("Update VpnCommunityMeshed - Map = ", vpnCommunityMeshed)
updateVpnCommunityMeshedRes, err := client.ApiCall("set-vpn-community-meshed", vpnCommunityMeshed, client.GetSessionID(), true, client.IsProxyUsed())
diff --git a/checkpoint/resource_checkpoint_management_vpn_community_remote_access.go b/checkpoint/resource_checkpoint_management_vpn_community_remote_access.go
index 1f92ce6f..00d7c43c 100644
--- a/checkpoint/resource_checkpoint_management_vpn_community_remote_access.go
+++ b/checkpoint/resource_checkpoint_management_vpn_community_remote_access.go
@@ -85,6 +85,179 @@ func resourceManagementVpnCommunityRemoteAccess() *schema.Resource {
Optional: true,
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
},
+ "encryption": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Encryption settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "encryption_method": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The encryption method to be used.",
+ },
+ "ike_phase_1": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "IKE Phase 1 settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "configured_data_integrity_algorithms": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "The list of configured hash algorithms.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "configured_diffie_hellman_groups": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "The list of configured Diffie-Hellman groups.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "configured_encryption_algorithms": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "The list of configured encryption algorithms.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "data_integrity": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The hash algorithm to be used.",
+ },
+ "diffie_hellman_group": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The Diffie-Hellman group to be used.",
+ },
+ "encryption_algorithm": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The encryption algorithm to be used.",
+ },
+ "ike_p1_rekey_time": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Indicates the time interval for IKE phase 1 renegotiation.",
+ },
+ "ike_p1_rekey_time_unit": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Indicates the time unit for the 'ike-p1-rekey-time-unit' parameter, rounded up to minutes scale.",
+ },
+ "multiple_key_exchanges": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Name of the Multiple Key Exchanges proposal object.",
+ },
+ "use_multiple_key_exchanges": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to use a proposal with Multiple Key Exchanges.",
+ },
+ "use_standard_proposal": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to use a proposal with a single Diffie-Hellman group.",
+ },
+ },
+ },
+ },
+ "ike_phase_2": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "IKE Phase 2 settings.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "configured_data_integrity_algorithms": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "The list of configured hash algorithms.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "configured_diffie_hellman_groups": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "The list of configured Diffie-Hellman groups.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "configured_encryption_algorithms": {
+ Type: schema.TypeSet,
+ Optional: true,
+ Description: "The list of configured encryption algorithms.",
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ "data_integrity": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The hash algorithm to be used.",
+ },
+ "encryption_algorithm": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The encryption algorithm to be used.",
+ },
+ "enforce_encryption_alg_and_data_integrity_on_all_users": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Enforce Encryption Algorithm and Data Integrity on all users.",
+ },
+ "ike_p2_pfs_dh_grp": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The Diffie-Hellman group to be used.",
+ },
+ "ike_p2_rekey_time": {
+ Type: schema.TypeInt,
+ Optional: true,
+ Description: "Indicates the time interval for IKE phase 2 renegotiation.",
+ },
+ "ike_p2_rekey_time_unit": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Indicates the time unit for the 'ike-p2-rekey-time-unit' parameter, rounded up to minutes scale.",
+ },
+ "ike_p2_use_pfs": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether Perfect Forward Secrecy (PFS) is being used for IKE phase 2.",
+ },
+ "multiple_key_exchanges": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Name of the Multiple Key Exchanges proposal object to use when PFS is enabled and multiple key exchanges are configured.",
+ },
+ "use_multiple_key_exchanges": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to use a proposal with Multiple Key Exchanges when PFS is enabled.",
+ },
+ "use_standard_proposal": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to use a proposal with a single Diffie-Hellman group when PFS is enabled.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
},
}
}
@@ -150,6 +323,94 @@ func createManagementVpnCommunityRemoteAccess(d *schema.ResourceData, m interfac
payload["ignore-errors"] = v.(bool)
}
+ if _, ok := d.GetOk("encryption"); ok {
+ encryptionPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("encryption.0.encryption_method"); ok {
+ encryptionPayload["encryption-method"] = v.(string)
+ }
+ if _, ok := d.GetOk("encryption.0.ike_phase_1"); ok {
+ ikePhase1Payload := make(map[string]interface{})
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.configured_data_integrity_algorithms"); ok {
+ ikePhase1Payload["configured-data-integrity-algorithms"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.configured_diffie_hellman_groups"); ok {
+ ikePhase1Payload["configured-diffie-hellman-groups"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.configured_encryption_algorithms"); ok {
+ ikePhase1Payload["configured-encryption-algorithms"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.data_integrity"); ok {
+ ikePhase1Payload["data-integrity"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.diffie_hellman_group"); ok {
+ ikePhase1Payload["diffie-hellman-group"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.encryption_algorithm"); ok {
+ ikePhase1Payload["encryption-algorithm"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.ike_p1_rekey_time"); ok {
+ ikePhase1Payload["ike-p1-rekey-time"] = v.(int)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.ike_p1_rekey_time_unit"); ok {
+ ikePhase1Payload["ike-p1-rekey-time-unit"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.multiple_key_exchanges"); ok {
+ ikePhase1Payload["multiple-key-exchanges"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("encryption.0.ike_phase_1.0.use_multiple_key_exchanges"); ok {
+ ikePhase1Payload["use-multiple-key-exchanges"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("encryption.0.ike_phase_1.0.use_standard_proposal"); ok {
+ ikePhase1Payload["use-standard-proposal"] = v.(bool)
+ }
+ encryptionPayload["ike-phase-1"] = ikePhase1Payload
+ }
+ if _, ok := d.GetOk("encryption.0.ike_phase_2"); ok {
+ ikePhase2Payload := make(map[string]interface{})
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.configured_data_integrity_algorithms"); ok {
+ ikePhase2Payload["configured-data-integrity-algorithms"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.configured_diffie_hellman_groups"); ok {
+ ikePhase2Payload["configured-diffie-hellman-groups"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.configured_encryption_algorithms"); ok {
+ ikePhase2Payload["configured-encryption-algorithms"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.data_integrity"); ok {
+ ikePhase2Payload["data-integrity"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.encryption_algorithm"); ok {
+ ikePhase2Payload["encryption-algorithm"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("encryption.0.ike_phase_2.0.enforce_encryption_alg_and_data_integrity_on_all_users"); ok {
+ ikePhase2Payload["enforce-encryption-alg-and-data-integrity-on-all-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.ike_p2_pfs_dh_grp"); ok {
+ ikePhase2Payload["ike-p2-pfs-dh-grp"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.ike_p2_rekey_time"); ok {
+ ikePhase2Payload["ike-p2-rekey-time"] = v.(int)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.ike_p2_rekey_time_unit"); ok {
+ ikePhase2Payload["ike-p2-rekey-time-unit"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("encryption.0.ike_phase_2.0.ike_p2_use_pfs"); ok {
+ ikePhase2Payload["ike-p2-use-pfs"] = v.(bool)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.multiple_key_exchanges"); ok {
+ ikePhase2Payload["multiple-key-exchanges"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("encryption.0.ike_phase_2.0.use_multiple_key_exchanges"); ok {
+ ikePhase2Payload["use-multiple-key-exchanges"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("encryption.0.ike_phase_2.0.use_standard_proposal"); ok {
+ ikePhase2Payload["use-standard-proposal"] = v.(bool)
+ }
+ encryptionPayload["ike-phase-2"] = ikePhase2Payload
+ }
+ payload["encryption"] = encryptionPayload
+ }
+
SetVpnCommunityRemoteAccessRes, _ := client.ApiCall("set-vpn-community-remote-access", payload, client.GetSessionID(), true, client.IsProxyUsed())
if !SetVpnCommunityRemoteAccessRes.Success {
return fmt.Errorf("%s", SetVpnCommunityRemoteAccessRes.ErrorMsg)
@@ -240,6 +501,96 @@ func updateManagementVpnCommunityRemoteAccess(d *schema.ResourceData, m interfac
payload["ignore-errors"] = v.(bool)
}
+ if d.HasChange("encryption") {
+ if _, ok := d.GetOk("encryption"); ok {
+ encryptionPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("encryption.0.encryption_method"); ok {
+ encryptionPayload["encryption-method"] = v.(string)
+ }
+ if _, ok := d.GetOk("encryption.0.ike_phase_1"); ok {
+ ikePhase1Payload := make(map[string]interface{})
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.configured_data_integrity_algorithms"); ok {
+ ikePhase1Payload["configured-data-integrity-algorithms"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.configured_diffie_hellman_groups"); ok {
+ ikePhase1Payload["configured-diffie-hellman-groups"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.configured_encryption_algorithms"); ok {
+ ikePhase1Payload["configured-encryption-algorithms"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.data_integrity"); ok {
+ ikePhase1Payload["data-integrity"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.diffie_hellman_group"); ok {
+ ikePhase1Payload["diffie-hellman-group"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.encryption_algorithm"); ok {
+ ikePhase1Payload["encryption-algorithm"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.ike_p1_rekey_time"); ok {
+ ikePhase1Payload["ike-p1-rekey-time"] = v.(int)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.ike_p1_rekey_time_unit"); ok {
+ ikePhase1Payload["ike-p1-rekey-time-unit"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_1.0.multiple_key_exchanges"); ok {
+ ikePhase1Payload["multiple-key-exchanges"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("encryption.0.ike_phase_1.0.use_multiple_key_exchanges"); ok {
+ ikePhase1Payload["use-multiple-key-exchanges"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("encryption.0.ike_phase_1.0.use_standard_proposal"); ok {
+ ikePhase1Payload["use-standard-proposal"] = v.(bool)
+ }
+ encryptionPayload["ike-phase-1"] = ikePhase1Payload
+ }
+ if _, ok := d.GetOk("encryption.0.ike_phase_2"); ok {
+ ikePhase2Payload := make(map[string]interface{})
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.configured_data_integrity_algorithms"); ok {
+ ikePhase2Payload["configured-data-integrity-algorithms"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.configured_diffie_hellman_groups"); ok {
+ ikePhase2Payload["configured-diffie-hellman-groups"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.configured_encryption_algorithms"); ok {
+ ikePhase2Payload["configured-encryption-algorithms"] = v.(*schema.Set).List()
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.data_integrity"); ok {
+ ikePhase2Payload["data-integrity"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.encryption_algorithm"); ok {
+ ikePhase2Payload["encryption-algorithm"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("encryption.0.ike_phase_2.0.enforce_encryption_alg_and_data_integrity_on_all_users"); ok {
+ ikePhase2Payload["enforce-encryption-alg-and-data-integrity-on-all-users"] = v.(bool)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.ike_p2_pfs_dh_grp"); ok {
+ ikePhase2Payload["ike-p2-pfs-dh-grp"] = v.(string)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.ike_p2_rekey_time"); ok {
+ ikePhase2Payload["ike-p2-rekey-time"] = v.(int)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.ike_p2_rekey_time_unit"); ok {
+ ikePhase2Payload["ike-p2-rekey-time-unit"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("encryption.0.ike_phase_2.0.ike_p2_use_pfs"); ok {
+ ikePhase2Payload["ike-p2-use-pfs"] = v.(bool)
+ }
+ if v, ok := d.GetOk("encryption.0.ike_phase_2.0.multiple_key_exchanges"); ok {
+ ikePhase2Payload["multiple-key-exchanges"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("encryption.0.ike_phase_2.0.use_multiple_key_exchanges"); ok {
+ ikePhase2Payload["use-multiple-key-exchanges"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("encryption.0.ike_phase_2.0.use_standard_proposal"); ok {
+ ikePhase2Payload["use-standard-proposal"] = v.(bool)
+ }
+ encryptionPayload["ike-phase-2"] = ikePhase2Payload
+ }
+ payload["encryption"] = encryptionPayload
+ }
+ }
+
SetVpnCommunityRemoteAccessRes, _ := client.ApiCall("set-vpn-community-remote-access", payload, client.GetSessionID(), true, client.IsProxyUsed())
if !SetVpnCommunityRemoteAccessRes.Success {
return fmt.Errorf("%s", SetVpnCommunityRemoteAccessRes.ErrorMsg)
@@ -359,6 +710,97 @@ func readManagementVpnCommunityRemoteAccess(d *schema.ResourceData, m interface{
_ = d.Set("comments", v)
}
+ if v := vpnCommunityRemoteAccess["encryption"]; v != nil {
+ encryptionShow := v.(map[string]interface{})
+ encryptionState := make(map[string]interface{})
+ if v := encryptionShow["encryption-method"]; v != nil {
+ encryptionState["encryption_method"] = v
+ }
+ if v := encryptionShow["ike-phase-1"]; v != nil {
+ ikePhase1Show := v.(map[string]interface{})
+ ikePhase1State := make(map[string]interface{})
+ if v := ikePhase1Show["configured-data-integrity-algorithms"]; v != nil {
+ ikePhase1State["configured_data_integrity_algorithms"] = v
+ }
+ if v := ikePhase1Show["configured-diffie-hellman-groups"]; v != nil {
+ ikePhase1State["configured_diffie_hellman_groups"] = v
+ }
+ if v := ikePhase1Show["configured-encryption-algorithms"]; v != nil {
+ ikePhase1State["configured_encryption_algorithms"] = v
+ }
+ if v := ikePhase1Show["data-integrity"]; v != nil {
+ ikePhase1State["data_integrity"] = v
+ }
+ if v := ikePhase1Show["diffie-hellman-group"]; v != nil {
+ ikePhase1State["diffie_hellman_group"] = v
+ }
+ if v := ikePhase1Show["encryption-algorithm"]; v != nil {
+ ikePhase1State["encryption_algorithm"] = v
+ }
+ if v := ikePhase1Show["ike-p1-rekey-time"]; v != nil {
+ ikePhase1State["ike_p1_rekey_time"] = v
+ }
+ if v := ikePhase1Show["ike-p1-rekey-time-unit"]; v != nil {
+ ikePhase1State["ike_p1_rekey_time_unit"] = v
+ }
+ if v := ikePhase1Show["multiple-key-exchanges"]; v != nil {
+ ikePhase1State["multiple_key_exchanges"] = v.(map[string]interface{})["name"]
+ }
+ if v := ikePhase1Show["use-multiple-key-exchanges"]; v != nil {
+ ikePhase1State["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase1Show["use-standard-proposal"]; v != nil {
+ ikePhase1State["use_standard_proposal"] = v
+ }
+ encryptionState["ike_phase_1"] = []interface{}{ikePhase1State}
+ }
+ if v := encryptionShow["ike-phase-2"]; v != nil {
+ ikePhase2Show := v.(map[string]interface{})
+ ikePhase2State := make(map[string]interface{})
+ if v := ikePhase2Show["configured-data-integrity-algorithms"]; v != nil {
+ ikePhase2State["configured_data_integrity_algorithms"] = v
+ }
+ if v := ikePhase2Show["configured-diffie-hellman-groups"]; v != nil {
+ ikePhase2State["configured_diffie_hellman_groups"] = v
+ }
+ if v := ikePhase2Show["configured-encryption-algorithms"]; v != nil {
+ ikePhase2State["configured_encryption_algorithms"] = v
+ }
+ if v := ikePhase2Show["data-integrity"]; v != nil {
+ ikePhase2State["data_integrity"] = v
+ }
+ if v := ikePhase2Show["encryption-algorithm"]; v != nil {
+ ikePhase2State["encryption_algorithm"] = v
+ }
+ if v := ikePhase2Show["enforce-encryption-alg-and-data-integrity-on-all-users"]; v != nil {
+ ikePhase2State["enforce_encryption_alg_and_data_integrity_on_all_users"] = v
+ }
+ if v := ikePhase2Show["ike-p2-pfs-dh-grp"]; v != nil {
+ ikePhase2State["ike_p2_pfs_dh_grp"] = v
+ }
+ if v := ikePhase2Show["ike-p2-rekey-time"]; v != nil {
+ ikePhase2State["ike_p2_rekey_time"] = v
+ }
+ if v := ikePhase2Show["ike-p2-rekey-time-unit"]; v != nil {
+ ikePhase2State["ike_p2_rekey_time_unit"] = v
+ }
+ if v := ikePhase2Show["ike-p2-use-pfs"]; v != nil {
+ ikePhase2State["ike_p2_use_pfs"] = v
+ }
+ if v := ikePhase2Show["multiple-key-exchanges"]; v != nil {
+ ikePhase2State["multiple_key_exchanges"] = v.(map[string]interface{})["name"]
+ }
+ if v := ikePhase2Show["use-multiple-key-exchanges"]; v != nil {
+ ikePhase2State["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase2Show["use-standard-proposal"]; v != nil {
+ ikePhase2State["use_standard_proposal"] = v
+ }
+ encryptionState["ike_phase_2"] = []interface{}{ikePhase2State}
+ }
+ _ = d.Set("encryption", []interface{}{encryptionState})
+ }
+
return nil
}
diff --git a/checkpoint/resource_checkpoint_management_vpn_community_star.go b/checkpoint/resource_checkpoint_management_vpn_community_star.go
index 3a35c723..79dbfbf6 100644
--- a/checkpoint/resource_checkpoint_management_vpn_community_star.go
+++ b/checkpoint/resource_checkpoint_management_vpn_community_star.go
@@ -250,6 +250,11 @@ func resourceManagementVpnCommunityStar() *schema.Resource {
Optional: true,
Description: "Interface redundancy mode (Active/Backup).",
},
+ "ip_version": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The IP version of the interface's IP address (IPv4/IPv6).",
+ },
},
},
},
@@ -476,6 +481,27 @@ func resourceManagementVpnCommunityStar() *schema.Resource {
Description: "Indicates the time interval for IKE phase 1 renegotiation.",
Default: 1440,
},
+ "ike_p1_rekey_time_unit": {
+ Type: schema.TypeString,
+ Optional: true,
+ Computed: true,
+ Description: "Indicates the time unit for the 'ike-p1-rekey-time-unit' parameter, rounded up to minutes scale.",
+ },
+ "use_standard_proposal": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to use a proposal with a single Diffie-Hellman group.",
+ },
+ "use_multiple_key_exchanges": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to use a proposal with Multiple Key Exchanges.",
+ },
+ "multiple_key_exchanges": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Multiple Key Exchanges proposal object.",
+ },
},
},
},
@@ -516,6 +542,27 @@ func resourceManagementVpnCommunityStar() *schema.Resource {
Description: "Indicates the time interval for IKE phase 2 renegotiation.",
Default: 1440,
},
+ "ike_p2_rekey_time_unit": {
+ Type: schema.TypeString,
+ Optional: true,
+ Computed: true,
+ Description: "Indicates the time unit for the 'ike-p2-rekey-time-unit' parameter, rounded up to minutes scale.",
+ },
+ "use_standard_proposal": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to use a proposal with a single Diffie-Hellman group.",
+ },
+ "use_multiple_key_exchanges": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to use a proposal with Multiple Key Exchanges.",
+ },
+ "multiple_key_exchanges": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Multiple Key Exchanges proposal object.",
+ },
},
},
},
@@ -727,6 +774,95 @@ func resourceManagementVpnCommunityStar() *schema.Resource {
Description: "Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.",
Default: false,
},
+ "route_based_settings": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "VPN Community Route-Based settings.
Relevant only in Route-Based VPN Communities.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "add_automatic_routes": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "The type of routes to use for the automatic Route-Based configuration.
Relevant only in Route-Based VPN Communities.",
+ },
+ "advanced": {
+ Type: schema.TypeList,
+ MaxItems: 1,
+ Optional: true,
+ Description: "Advanced settings
Relevant only in Route-Based VPN Communities.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "bfd": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to enable Bidirectional Forwarding Detection.
Relevant only in Route-Based VPN Communities.",
+ },
+ "graceful_restart": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to enable Graceful Restart in the applicable Dynamic Routing protocols.
Relevant only in Route-Based VPN Communities...",
+ },
+ },
+ },
+ },
+ "override_routes": {
+ Type: schema.TypeList,
+ Optional: true,
+ Description: "Override automatic routing settings in a specific Security Gateway in this VPN Community.
Relevant only in Route-Based VPN Communities...",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "auto_config": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Indicates whether to configure the routing settings automatically for the Security Gateway.
Relevant only in Route-Based VPN CommunitiesExported Routes.
Relevant only in Route-Based VPN Communities.",
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "custom_routes": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Specifies to export user-defined networks from the Security Gateway.
Relevant only in Route-Based VPN Communities.",
+ },
+ "custom_routes_object": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Specifies the name of the Network object or Network Group object that represents the exported routes.
Relevant only in Route-Based VPN Com...",
+ },
+ "internal_interfaces": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Specifies to export networks from interfaces with Topology 'Internal' from the Security Gateway.
Relevant only in Route-Based VPN Communit...",
+ },
+ "static_routes": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Description: "Specifies to export static routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.",
+ },
+ },
+ },
+ },
+ "gateway": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Name of the Security Gateway object in which to override the automatic routing settings.
Relevant only in Route-Based VPN Communities<...",
+ },
+ "mode": {
+ Type: schema.TypeString,
+ Optional: true,
+ Description: "Specifies how to export routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.",
+ },
+ },
+ },
+ },
+ },
+ },
+ },
},
}
}
@@ -900,6 +1036,9 @@ func createManagementVpnCommunityStar(d *schema.ResourceData, m interface{}) err
if v, ok := d.GetOk("override_interfaces." + strconv.Itoa(i) + ".interfaces." + strconv.Itoa(j) + ".redundancy_mode"); ok {
interfacesPayload["redundancy-mode"] = v.(string)
}
+ if v, ok := d.GetOk("override_interfaces." + strconv.Itoa(i) + ".interfaces." + strconv.Itoa(j) + ".ip_version"); ok {
+ interfacesPayload["ip-version"] = v.(string)
+ }
overrideInterfacesInterfacesPayload = append(overrideInterfacesInterfacesPayload, interfacesPayload)
}
Payload["interfaces"] = overrideInterfacesInterfacesPayload
@@ -1050,6 +1189,15 @@ func createManagementVpnCommunityStar(d *schema.ResourceData, m interface{}) err
}
if _, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1"); ok {
ikePhase1Payload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.use_standard_proposal"); ok {
+ ikePhase1Payload["use-standard-proposal"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.use_multiple_key_exchanges"); ok {
+ ikePhase1Payload["use-multiple-key-exchanges"] = v.(bool)
+ }
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.multiple_key_exchanges"); ok {
+ ikePhase1Payload["multiple-key-exchanges"] = v.(string)
+ }
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.encryption_algorithm"); ok {
ikePhase1Payload["encryption-algorithm"] = v.(string)
}
@@ -1062,10 +1210,22 @@ func createManagementVpnCommunityStar(d *schema.ResourceData, m interface{}) err
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.ike_p1_rekey_time"); ok {
ikePhase1Payload["ike-p1-rekey-time"] = v.(int)
}
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.ike_p1_rekey_time_unit"); ok {
+ ikePhase1Payload["ike-p1-rekey-time-unit"] = v.(string)
+ }
payload["ike-phase-1"] = ikePhase1Payload
}
if _, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2"); ok {
ikePhase2Payload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.use_standard_proposal"); ok {
+ ikePhase2Payload["use-standard-proposal"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.use_multiple_key_exchanges"); ok {
+ ikePhase2Payload["use-multiple-key-exchanges"] = v.(bool)
+ }
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.multiple_key_exchanges"); ok {
+ ikePhase2Payload["multiple-key-exchanges"] = v.(string)
+ }
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.encryption_algorithm"); ok {
ikePhase2Payload["encryption-algorithm"] = v.(string)
}
@@ -1081,6 +1241,9 @@ func createManagementVpnCommunityStar(d *schema.ResourceData, m interface{}) err
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.ike_p2_rekey_time"); ok {
ikePhase2Payload["ike-p2-rekey-time"] = v.(int)
}
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.ike_p2_rekey_time_unit"); ok {
+ ikePhase2Payload["ike-p2-rekey-time-unit"] = v.(string)
+ }
payload["ike-phase-2"] = ikePhase2Payload
}
granularEncryptionsPayload = append(granularEncryptionsPayload, payload)
@@ -1234,6 +1397,63 @@ func createManagementVpnCommunityStar(d *schema.ResourceData, m interface{}) err
vpnCommunityStar["ignore-errors"] = v.(bool)
}
+ if v, ok := d.GetOk("route_based_settings"); ok {
+ routeBasedSettingsList := v.([]interface{})
+ if len(routeBasedSettingsList) > 0 {
+ routeBasedSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("route_based_settings.0.add_automatic_routes"); ok {
+ routeBasedSettingsPayload["add-automatic-routes"] = v.(string)
+ }
+ if _, ok := d.GetOk("route_based_settings.0.advanced"); ok {
+ advancedPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("route_based_settings.0.advanced.0.bfd"); ok {
+ advancedPayload["bfd"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("route_based_settings.0.advanced.0.graceful_restart"); ok {
+ advancedPayload["graceful-restart"] = v.(bool)
+ }
+ routeBasedSettingsPayload["advanced"] = advancedPayload
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes"); ok {
+ overrideRoutesList := v.([]interface{})
+ if len(overrideRoutesList) > 0 {
+ var overrideRoutesPayload []map[string]interface{}
+ for i := range overrideRoutesList {
+ overrideRoutesItem := make(map[string]interface{})
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".auto_config"); ok {
+ overrideRoutesItem["auto-config"] = v.(bool)
+ }
+ if _, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes"); ok {
+ exportedRoutesPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.custom_routes"); ok {
+ exportedRoutesPayload["custom-routes"] = v.(bool)
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.custom_routes_object"); ok {
+ exportedRoutesPayload["custom-routes-object"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.internal_interfaces"); ok {
+ exportedRoutesPayload["internal-interfaces"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.static_routes"); ok {
+ exportedRoutesPayload["static-routes"] = v.(bool)
+ }
+ overrideRoutesItem["exported-routes"] = exportedRoutesPayload
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".gateway"); ok {
+ overrideRoutesItem["gateway"] = v.(string)
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".mode"); ok {
+ overrideRoutesItem["mode"] = v.(string)
+ }
+ overrideRoutesPayload = append(overrideRoutesPayload, overrideRoutesItem)
+ }
+ routeBasedSettingsPayload["override-routes"] = overrideRoutesPayload
+ }
+ }
+ vpnCommunityStar["route-based-settings"] = routeBasedSettingsPayload
+ }
+ }
+
log.Println("Create VpnCommunityStar - Map = ", vpnCommunityStar)
addVpnCommunityStarRes, err := client.ApiCall("add-vpn-community-star", vpnCommunityStar, client.GetSessionID(), true, client.IsProxyUsed())
@@ -1444,24 +1664,34 @@ func readManagementVpnCommunityStar(d *schema.ResourceData, m interface{}) error
overrideInterfacesMapToAdd["gateway"] = v
}
if v := overrideInterfacesMap["interfaces"]; v != nil {
- interfacesShow := v.(map[string]interface{})
- interfacesState := make(map[string]interface{})
- if v := interfacesShow["interface-name"]; v != nil {
- interfacesState["interface_name"] = v
- }
- if v := interfacesShow["next-hop-ip"]; v != nil {
- interfacesState["next_hop_ip"] = v
- }
- if v := interfacesShow["static-nat-ip"]; v != nil {
- interfacesState["static_nat_ip"] = v
- }
- if v := interfacesShow["priority"]; v != nil {
- interfacesState["priority"] = v
- }
- if v := interfacesShow["redundancy-mode"]; v != nil {
- interfacesState["redundancy_mode"] = v
+ interfacesList := v.([]interface{})
+ if len(interfacesList) > 0 {
+ var interfacesListState []map[string]interface{}
+ for j := range interfacesList {
+ interfacesShow := interfacesList[j].(map[string]interface{})
+ interfacesState := make(map[string]interface{})
+ if v := interfacesShow["interface-name"]; v != nil {
+ interfacesState["interface_name"] = v
+ }
+ if v := interfacesShow["next-hop-ip"]; v != nil {
+ interfacesState["next_hop_ip"] = v
+ }
+ if v := interfacesShow["static-nat-ip"]; v != nil {
+ interfacesState["static_nat_ip"] = v
+ }
+ if v := interfacesShow["priority"]; v != nil {
+ interfacesState["priority"] = v
+ }
+ if v := interfacesShow["redundancy-mode"]; v != nil {
+ interfacesState["redundancy_mode"] = v
+ }
+ if v := interfacesShow["ip-version"]; v != nil {
+ interfacesState["ip_version"] = v
+ }
+ interfacesListState = append(interfacesListState, interfacesState)
+ }
+ overrideInterfacesMapToAdd["interfaces"] = interfacesListState
}
- overrideInterfacesMapToAdd["interfaces"] = interfacesState
}
overrideInterfacesListToReturn = append(overrideInterfacesListToReturn, overrideInterfacesMapToAdd)
}
@@ -1694,6 +1924,18 @@ func readManagementVpnCommunityStar(d *schema.ResourceData, m interface{}) error
if v := ikePhase1Show["ike-p1-rekey-time"]; v != nil {
ikePhase1State["ike_p1_rekey_time"] = int(v.(float64))
}
+ if v := ikePhase1Show["ike-p1-rekey-time-unit"]; v != nil {
+ ikePhase1State["ike_p1_rekey_time_unit"] = v
+ }
+ if v := ikePhase1Show["use-standard-proposal"]; v != nil {
+ ikePhase1State["use_standard_proposal"] = v
+ }
+ if v := ikePhase1Show["use-multiple-key-exchanges"]; v != nil {
+ ikePhase1State["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase1Show["multiple-key-exchanges"]; v != nil {
+ ikePhase1State["multiple_key_exchanges"] = v.(map[string]interface{})["name"]
+ }
granularEncryptionState["ike_phase_1"] = []interface{}{ikePhase1State}
}
@@ -1715,6 +1957,18 @@ func readManagementVpnCommunityStar(d *schema.ResourceData, m interface{}) error
if v := ikePhase2Show["ike-p2-rekey-time"]; v != nil {
ikePhase2State["ike_p2_rekey_time"] = int(v.(float64))
}
+ if v := ikePhase2Show["ike-p2-rekey-time-unit"]; v != nil {
+ ikePhase2State["ike_p2_rekey_time_unit"] = v
+ }
+ if v := ikePhase2Show["use-standard-proposal"]; v != nil {
+ ikePhase2State["use_standard_proposal"] = v
+ }
+ if v := ikePhase2Show["use-multiple-key-exchanges"]; v != nil {
+ ikePhase2State["use_multiple_key_exchanges"] = v
+ }
+ if v := ikePhase2Show["multiple-key-exchanges"]; v != nil {
+ ikePhase2State["multiple_key_exchanges"] = v.(map[string]interface{})["name"]
+ }
granularEncryptionState["ike_phase_2"] = []interface{}{ikePhase2State}
}
granularEncryptionsState = append(granularEncryptionsState, granularEncryptionState)
@@ -1934,6 +2188,62 @@ func readManagementVpnCommunityStar(d *schema.ResourceData, m interface{}) error
_ = d.Set("ignore_errors", v)
}
+ if v := vpnCommunityStar["route-based-settings"]; v != nil {
+ routeBasedSettingsShow := v.(map[string]interface{})
+ routeBasedSettingsState := make(map[string]interface{})
+ if v := routeBasedSettingsShow["add-automatic-routes"]; v != nil {
+ routeBasedSettingsState["add_automatic_routes"] = v
+ }
+ if v := routeBasedSettingsShow["advanced"]; v != nil {
+ advancedShow := v.(map[string]interface{})
+ advancedState := make(map[string]interface{})
+ if v := advancedShow["bfd"]; v != nil {
+ advancedState["bfd"] = v
+ }
+ if v := advancedShow["graceful-restart"]; v != nil {
+ advancedState["graceful_restart"] = v
+ }
+ routeBasedSettingsState["advanced"] = []interface{}{advancedState}
+ }
+ if v := routeBasedSettingsShow["override-routes"]; v != nil {
+ overrideRoutesList := v.([]interface{})
+ var overrideRoutesListState []map[string]interface{}
+ for i := range overrideRoutesList {
+ overrideRoutesShow := overrideRoutesList[i].(map[string]interface{})
+ overrideRoutesState := make(map[string]interface{})
+ if v := overrideRoutesShow["auto-config"]; v != nil {
+ overrideRoutesState["auto_config"] = v
+ }
+ if v := overrideRoutesShow["exported-routes"]; v != nil {
+ exportedRoutesShow := v.(map[string]interface{})
+ exportedRoutesState := make(map[string]interface{})
+ if v := exportedRoutesShow["custom-routes"]; v != nil {
+ exportedRoutesState["custom_routes"] = v
+ }
+ if v := exportedRoutesShow["custom-routes-object"]; v != nil {
+ exportedRoutesState["custom_routes_object"] = v.(map[string]interface{})["name"]
+ }
+ if v := exportedRoutesShow["internal-interfaces"]; v != nil {
+ exportedRoutesState["internal_interfaces"] = v
+ }
+ if v := exportedRoutesShow["static-routes"]; v != nil {
+ exportedRoutesState["static_routes"] = v
+ }
+ overrideRoutesState["exported_routes"] = []interface{}{exportedRoutesState}
+ }
+ if v := overrideRoutesShow["gateway"]; v != nil {
+ overrideRoutesState["gateway"] = v.(map[string]interface{})["name"]
+ }
+ if v := overrideRoutesShow["mode"]; v != nil {
+ overrideRoutesState["mode"] = v
+ }
+ overrideRoutesListState = append(overrideRoutesListState, overrideRoutesState)
+ }
+ routeBasedSettingsState["override_routes"] = overrideRoutesListState
+ }
+ _ = d.Set("route_based_settings", []interface{}{routeBasedSettingsState})
+ }
+
return nil
}
@@ -2130,6 +2440,9 @@ func updateManagementVpnCommunityStar(d *schema.ResourceData, m interface{}) err
if v, ok := d.GetOk("override_interfaces." + strconv.Itoa(i) + ".interfaces." + strconv.Itoa(j) + ".redundancy_mode"); ok {
interfacesPayload["redundancy-mode"] = v
}
+ if v, ok := d.GetOk("override_interfaces." + strconv.Itoa(i) + ".interfaces." + strconv.Itoa(j) + ".ip_version"); ok {
+ interfacesPayload["ip-version"] = v.(string)
+ }
overrideInterfacesInterfacesPayload = append(overrideInterfacesInterfacesPayload, interfacesPayload)
}
Payload["interfaces"] = overrideInterfacesInterfacesPayload
@@ -2301,6 +2614,15 @@ func updateManagementVpnCommunityStar(d *schema.ResourceData, m interface{}) err
}
if _, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1"); ok {
ikePhase1Payload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.use_standard_proposal"); ok {
+ ikePhase1Payload["use-standard-proposal"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.use_multiple_key_exchanges"); ok {
+ ikePhase1Payload["use-multiple-key-exchanges"] = v.(bool)
+ }
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.multiple_key_exchanges"); ok {
+ ikePhase1Payload["multiple-key-exchanges"] = v.(string)
+ }
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.encryption_algorithm"); ok {
ikePhase1Payload["encryption-algorithm"] = v.(string)
}
@@ -2313,10 +2635,22 @@ func updateManagementVpnCommunityStar(d *schema.ResourceData, m interface{}) err
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.ike_p1_rekey_time"); ok {
ikePhase1Payload["ike-p1-rekey-time"] = v.(int)
}
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_1.0.ike_p1_rekey_time_unit"); ok {
+ ikePhase1Payload["ike-p1-rekey-time-unit"] = v.(string)
+ }
payload["ike-phase-1"] = ikePhase1Payload
}
if _, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2"); ok {
ikePhase2Payload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.use_standard_proposal"); ok {
+ ikePhase2Payload["use-standard-proposal"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.use_multiple_key_exchanges"); ok {
+ ikePhase2Payload["use-multiple-key-exchanges"] = v.(bool)
+ }
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.multiple_key_exchanges"); ok {
+ ikePhase2Payload["multiple-key-exchanges"] = v.(string)
+ }
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.encryption_algorithm"); ok {
ikePhase2Payload["encryption-algorithm"] = v.(string)
}
@@ -2332,6 +2666,9 @@ func updateManagementVpnCommunityStar(d *schema.ResourceData, m interface{}) err
if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.ike_p2_rekey_time"); ok {
ikePhase2Payload["ike-p2-rekey-time"] = v.(int)
}
+ if v, ok := d.GetOk("granular_encryptions." + strconv.Itoa(i) + ".ike_phase_2.0.ike_p2_rekey_time_unit"); ok {
+ ikePhase2Payload["ike-p2-rekey-time-unit"] = v.(string)
+ }
payload["ike-phase-2"] = ikePhase2Payload
}
granularEncryptionsPayload = append(granularEncryptionsPayload, payload)
@@ -2511,6 +2848,65 @@ func updateManagementVpnCommunityStar(d *schema.ResourceData, m interface{}) err
vpnCommunityStar["ignore-errors"] = v.(bool)
}
+ if d.HasChange("route_based_settings") {
+ if v, ok := d.GetOk("route_based_settings"); ok {
+ routeBasedSettingsList := v.([]interface{})
+ if len(routeBasedSettingsList) > 0 {
+ routeBasedSettingsPayload := make(map[string]interface{})
+ if v, ok := d.GetOk("route_based_settings.0.add_automatic_routes"); ok {
+ routeBasedSettingsPayload["add-automatic-routes"] = v.(string)
+ }
+ if _, ok := d.GetOk("route_based_settings.0.advanced"); ok {
+ advancedPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("route_based_settings.0.advanced.0.bfd"); ok {
+ advancedPayload["bfd"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("route_based_settings.0.advanced.0.graceful_restart"); ok {
+ advancedPayload["graceful-restart"] = v.(bool)
+ }
+ routeBasedSettingsPayload["advanced"] = advancedPayload
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes"); ok {
+ overrideRoutesList := v.([]interface{})
+ if len(overrideRoutesList) > 0 {
+ var overrideRoutesPayload []map[string]interface{}
+ for i := range overrideRoutesList {
+ overrideRoutesItem := make(map[string]interface{})
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".auto_config"); ok {
+ overrideRoutesItem["auto-config"] = v.(bool)
+ }
+ if _, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes"); ok {
+ exportedRoutesPayload := make(map[string]interface{})
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.custom_routes"); ok {
+ exportedRoutesPayload["custom-routes"] = v.(bool)
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.custom_routes_object"); ok {
+ exportedRoutesPayload["custom-routes-object"] = v.(string)
+ }
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.internal_interfaces"); ok {
+ exportedRoutesPayload["internal-interfaces"] = v.(bool)
+ }
+ if v, ok := d.GetOkExists("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".exported_routes.0.static_routes"); ok {
+ exportedRoutesPayload["static-routes"] = v.(bool)
+ }
+ overrideRoutesItem["exported-routes"] = exportedRoutesPayload
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".gateway"); ok {
+ overrideRoutesItem["gateway"] = v.(string)
+ }
+ if v, ok := d.GetOk("route_based_settings.0.override_routes." + strconv.Itoa(i) + ".mode"); ok {
+ overrideRoutesItem["mode"] = v.(string)
+ }
+ overrideRoutesPayload = append(overrideRoutesPayload, overrideRoutesItem)
+ }
+ routeBasedSettingsPayload["override-routes"] = overrideRoutesPayload
+ }
+ }
+ vpnCommunityStar["route-based-settings"] = routeBasedSettingsPayload
+ }
+ }
+ }
+
log.Println("Update VpnCommunityStar - Map = ", vpnCommunityStar)
updateVpnCommunityStarRes, err := client.ApiCall("set-vpn-community-star", vpnCommunityStar, client.GetSessionID(), true, client.IsProxyUsed())
diff --git a/website/docs/d/checkpoint_management_access_rulebase.html.markdown b/website/docs/d/checkpoint_management_access_rulebase.html.markdown
index dd51144b..c98f2efa 100644
--- a/website/docs/d/checkpoint_management_access_rulebase.html.markdown
+++ b/website/docs/d/checkpoint_management_access_rulebase.html.markdown
@@ -34,6 +34,7 @@ The following arguments are supported:
* `hits_settings` - hits_settings blocks are documented below.
* `dereference_group_members` - Indicates whether to dereference "members" field by details level for every object in reply.
* `show_membership` - Indicates whether to calculate and show "groups" field for every object in reply.
+* `objects_dictionary` - Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Standard level.
`filter_settings` supports the following:
diff --git a/website/docs/d/checkpoint_management_aci_data_center_server.html.markdown b/website/docs/d/checkpoint_management_aci_data_center_server.html.markdown
index fbca6b8f..196ee542 100644
--- a/website/docs/d/checkpoint_management_aci_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_aci_data_center_server.html.markdown
@@ -30,3 +30,12 @@ The following arguments are supported:
* `name` - (Optional) Object name.
* `uid` - (Optional) Object unique identifier.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_aws_data_center_server.html.markdown b/website/docs/d/checkpoint_management_aws_data_center_server.html.markdown
index 84501c09..6d1baf0e 100644
--- a/website/docs/d/checkpoint_management_aws_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_aws_data_center_server.html.markdown
@@ -30,3 +30,12 @@ The following arguments are supported:
* `name` - (Optional) Object name.
* `uid` - (Optional) Object unique identifier.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_azure_data_center_server.html.markdown b/website/docs/d/checkpoint_management_azure_data_center_server.html.markdown
index 7e147d74..ea32ec5f 100644
--- a/website/docs/d/checkpoint_management_azure_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_azure_data_center_server.html.markdown
@@ -30,3 +30,12 @@ The following arguments are supported:
* `name` - (Optional) Object name.
* `uid` - (Optional) Object unique identifier.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_best_practice.html.markdown b/website/docs/d/checkpoint_management_best_practice.html.markdown
index 16258a91..65364613 100644
--- a/website/docs/d/checkpoint_management_best_practice.html.markdown
+++ b/website/docs/d/checkpoint_management_best_practice.html.markdown
@@ -50,6 +50,10 @@ The following arguments are supported:
* `relevant_objects` - The applicable objects of the Best Practice. relevant_objects blocks are documented below.
* `user_defined_firewall` - The definitions of the user-defined Firewall Best Practice. Relevant only for Firewall Best Practices created by the user. user_defined_firewall blocks are documented below.
* `user_defined_gaia_os` - The definitions of the user-defined Gaia OS Best Practice. Relevant only for Gaia OS Best Practices created by the user. user_defined_gaia_os blocks are documented below.
+* `deactivation_comment` - The deactivation comment of deactivated best practices. Appears only when the value of the 'active' parameter is set to 'false'.
+* `deactivation_expiration_date` - The deactivation expiration date of deactivated best practices. Appears only when the value of the 'active' parameter is set to 'false', and the value...deactivation_expiration_date blocks are documented below.
+* `deactivation_mode` - The deactivation mode of deactivated best practices. Appears only when the value of the 'active' parameter is set to 'false'.
+* `depends_on` - Shows the dependency of this Best Practice.Level of details in the output corresponds to the number of details for search. This table shows the level ...
`regulations` supports the following:
@@ -180,3 +184,9 @@ The following arguments are supported:
* `expected_output_base64` - The expected output of the script in the Base64.
* `practice_script_base64` - The script in Base64 to run on Gaia Security Gateways during the Compliance scans.
+
+
+`deactivation_expiration_date` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
diff --git a/website/docs/d/checkpoint_management_checkpoint_host.html.markdown b/website/docs/d/checkpoint_management_checkpoint_host.html.markdown
index 6cfd56d6..c576087d 100644
--- a/website/docs/d/checkpoint_management_checkpoint_host.html.markdown
+++ b/website/docs/d/checkpoint_management_checkpoint_host.html.markdown
@@ -48,6 +48,8 @@ The following arguments are supported:
* `comments` - Comments string.
* `sic_name` - Name of the Secure Internal Connection Trust.
* `sic_state` - State the Secure Internal Connection Trust.
+* `dns_server` - DNS Server.
+* `firewall` - Firewall blade enabled.
`interfaces` supports the following:
@@ -70,6 +72,9 @@ The following arguments are supported:
* `hide_behind` - Hide behind method. This parameter is not required in case "method" parameter is "static".
* `install_on` - Which gateway should apply the NAT translation.
* `method` - NAT translation method.
+* `automatic_nat_rules` - Whether to add automatic address translation rules.
checkpoint-gateway: generate automatic address translation rules using the install-on values.
Note: original-ip-only and translated-ip-only Supported only by Security Gateways R82 and higher.
+* `enable_address_translation` - Whether to enable address translation.
`management_blades` supports the following:
@@ -112,4 +117,10 @@ The following arguments are supported:
* `stop_logging_when_free_disk_space_below` - Enable stop logging when free disk space below.
* `stop_logging_when_free_disk_space_below_threshold` - Stop logging when free disk space below threshold.
* `turn_on_qos_logging` - Enable turn on qos logging.
-* `update_account_log_every` - Update account log in every amount of seconds.
\ No newline at end of file
+* `update_account_log_every` - Update account log in every amount of seconds.
+* `alert_when_free_disk_space_below_metrics` - Alert when free disk space below metrics.
+* `delete_when_free_disk_space_below_metrics` - Delete when free disk space below metrics.
+* `distribute_logs_between_all_active_servers` - Distribute logs between all active servers.
+* `include_tcp_state_information` - Include TCP state information. Relevant only when Firewall blade is enabled.
+* `smart_event_intro_correlation_unit` - SmartEvent intro correlation unit enabled.
+* `stop_logging_when_free_disk_space_below_metrics` - Stop logging when free disk space below metrics.
\ No newline at end of file
diff --git a/website/docs/d/checkpoint_management_checkpoint_sase_data_center_server.html.markdown b/website/docs/d/checkpoint_management_checkpoint_sase_data_center_server.html.markdown
index 5606c164..4a933665 100644
--- a/website/docs/d/checkpoint_management_checkpoint_sase_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_checkpoint_sase_data_center_server.html.markdown
@@ -34,3 +34,12 @@ The following arguments are supported:
* `tags` - (Computed) Collection of tag objects identified by the name or UID.
* `color` - (Computed) Color of the object.
* `comments` - (Computed) Comments string.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_claroty_ctd_data_center_server.html.markdown b/website/docs/d/checkpoint_management_claroty_ctd_data_center_server.html.markdown
index 6aac6f58..24083303 100644
--- a/website/docs/d/checkpoint_management_claroty_ctd_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_claroty_ctd_data_center_server.html.markdown
@@ -37,3 +37,12 @@ The following arguments are supported:
* `tags` - (Computed) Collection of tag objects identified by the name or UID.
* `color` - (Computed) Color of the object.
* `comments` - (Computed) Comments string.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_cloud_services.html.markdown b/website/docs/d/checkpoint_management_cloud_services.html.markdown
index 8cf1f08a..c592594b 100644
--- a/website/docs/d/checkpoint_management_cloud_services.html.markdown
+++ b/website/docs/d/checkpoint_management_cloud_services.html.markdown
@@ -24,6 +24,7 @@ The following arguments are supported:
* `management_url` - The Management Server's public URL.
* `tenant_id` - Tenant ID of Infinity Portal.
* `gateways_onboarding_settings` - Gateways on-boarding to Infinity Portal settings. `gateways_onboarding_settings` is documented below.
+* `environment_id` - The connected environment's ID in the Infinity Portal.
`connected_at` supports the following:
* `iso_8601` - Date and time represented in international ISO 8601 format.
@@ -33,6 +34,7 @@ The following arguments are supported:
* `connection_method` - Indicate whether Gateways will be connected to Infinity Portal automatically or only after policy installation.
* `participant_gateways` - Which Gateways will be connected to Infinity Portal.
* `specific_gateways` - Collection of targets identified by Name or UID.
+* `enabled` - Enable/Disable automatic connection of Security Gateways to Infinity Portal.
## How To Use
Make sure this command will be executed in the right execution order.
diff --git a/website/docs/d/checkpoint_management_cluster_member.html.markdown b/website/docs/d/checkpoint_management_cluster_member.html.markdown
index 6bb79d6c..18032cd8 100644
--- a/website/docs/d/checkpoint_management_cluster_member.html.markdown
+++ b/website/docs/d/checkpoint_management_cluster_member.html.markdown
@@ -25,4 +25,23 @@ data "checkpoint_management_cluster_member" "data_cluster_member" {
The following arguments are supported:
* `uid` - (Required) Object unique identifier.
-* `limit_interfaces` - (Optional) Limit number of cluster member interfaces to show.
\ No newline at end of file
+* `limit_interfaces` - (Optional) Limit number of cluster member interfaces to show.
+* `auto_generate_ip` - Use an automatically generated IP address for the Gateway object (applies only to Smart-1 Cloud).
+* `trust_details` - Details for trusted communication.trust_details blocks are documented below.
+* `trust_method` - Trust method that was used for establishing communication.
+
+
+`trust_details` supports the following:
+
+* `authentication_token` - Authentication token to use on the Gateway side to establish the communication between the Gateway and the Management Server (applies only to Smart-1 ...
+* `cloud_communication_details` - Details about the communication status with cloud (applies only to Smart-1 Cloud).cloud_communication_details blocks are documented below.
+* `gateway_mac_address` - Use the Security Gateway MAC address, relevant for the gateway_mac_address identification-method.
+* `identification_method` - How to identify the gateway (relevant for DAIP gateways only).
+* `status` - Status of the trusted communication with the Security Gateway.
+* `token_expiration_date` - Details about the communication status with cloud (applies only to Smart-1 Cloud).
+
+
+`cloud_communication_details` supports the following:
+
+* `ip` - IP address used for communication between the Gateway and the Management Server (used when 'auto-generate-ip=true').
+* `status` - Status of communication between the Gateway and the Management Server.
diff --git a/website/docs/d/checkpoint_management_data_access_layer.html.markdown b/website/docs/d/checkpoint_management_data_access_layer.html.markdown
index e5611c2f..1d05a7b4 100644
--- a/website/docs/d/checkpoint_management_data_access_layer.html.markdown
+++ b/website/docs/d/checkpoint_management_data_access_layer.html.markdown
@@ -42,3 +42,5 @@ The following arguments are supported:
* `tags` - Collection of tag identifiers.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
+* `dynamic_layer` - Whether this layer is set as a Dynamic layer.
+* `parent_layer` - Parent layer of this layer.
diff --git a/website/docs/d/checkpoint_management_data_access_role.html.markdown b/website/docs/d/checkpoint_management_data_access_role.html.markdown
index 5f5431a8..56b69d06 100644
--- a/website/docs/d/checkpoint_management_data_access_role.html.markdown
+++ b/website/docs/d/checkpoint_management_data_access_role.html.markdown
@@ -36,3 +36,4 @@ The following arguments are supported:
* `name` - (Optional) Object name.
* `uid` - (Optional) Object unique identifier.
+* `remote_access_client` - Remote access clients identified by name or UID. Level of details in the output corresponds to the number of details for search. This table shows the ...
diff --git a/website/docs/d/checkpoint_management_data_access_rule.html.markdown b/website/docs/d/checkpoint_management_data_access_rule.html.markdown
index e323a895..eb4cf46f 100644
--- a/website/docs/d/checkpoint_management_data_access_rule.html.markdown
+++ b/website/docs/d/checkpoint_management_data_access_rule.html.markdown
@@ -70,11 +70,19 @@ The following arguments are supported:
* `vpn_directional` - Collection of VPN directional. VPN directional block documented below.
* `comments` - Comments string.
* `fields_with_uid_identifier` - (Optional) List of resource fields that will use object UIDs as object identifiers. Default is object name.
+* `destination_ranges` - Displays the destination as ranges of IP addresses, in case show-as-ranges is set to true.
In this case, 'destination' and 'destination-negate' p...destination_ranges blocks are documented below.
+* `expiration_settings` - Displays the expiration date settings.expiration_settings blocks are documented below.
+* `hits` - Hits count object.hits blocks are documented below.
+* `service_ranges` - Displays the services and applications as ranges of port numbers, in case show-as-ranges is set to true.
In this case, 'service' and 'service-neg...service_ranges blocks are documented below.
+* `service_resource` - Resource of the service.
+* `source_ranges` - Displays the source as ranges of IP addresses, in case show-as-ranges is set to true.
In this case, 'source' and 'source-negate' parameters are o...source_ranges blocks are documented below.
`action_settings` supports the following:
* `enable_identity_captive_portal`
* `limit`
+* `client_auth_settings` - N/A.client_auth_settings blocks are documented below.
+* `user_auth_settings` - N/A.user_auth_settings blocks are documented below.
`custom_fields` supports the following:
@@ -109,11 +117,122 @@ The following arguments are supported:
* `to` - To VPN community.
+`client_auth_settings` supports the following:
+* `destination` - How destination hosts are matched against the user database.
+* `require_desktop_config_verification` - When true, the rule only applies if the client's desktop security policy configuration has been verified by the gateway.
+* `sessions_limit` - Maximum number of concurrent sessions allowed per user. Only used when unlimited-sessions is false. Must be 1 or greater.
+* `sign_on_method` - Mechanism used to authenticate the client.
+* `sign_on_type` - Determines whether a standard or specific sign-on policy is applied. Allowed values: standard, specific.
+* `source` - How source users are matched against the user database.
+* `timeout` - Controls how long an authenticated session remains valid.timeout blocks are documented below.
+* `tracking` - Action to take in the log when a user successfully authenticates. Allowed values: none, log, alert.
+* `unlimited_sessions` - When true, a single user may have any number of concurrent authenticated sessions. When false, the number of concurrent sessions is capped at sessions...
+`timeout` supports the following:
+* `enable` - When true, authenticated sessions expire after the duration defined by minutes. When false, authenticated sessions never expire.
+* `minutes` - Number of minutes before an authenticated session expires. Only used when enable is true. Must be 0 or greater.
+* `refreshable` - When true, the session timeout timer resets each time the authenticated user performs a network action.
+`user_auth_settings` supports the following:
+* `allowed_http_servers` - Restricts which HTTP servers authenticated users may access.
+* `destination` - How destination hosts are matched against the user database.
+* `source` - How source users are matched against the user database.
+
+`destination_ranges` supports the following:
+
+* `excluded_others` - Objects which are not represented as IP addresses and are negated in the given rule - for example if negate is set for the source or destination of th...
+* `ipv4` - Range of IPv4 addresses that match in the given rule.ipv4 blocks are documented below.
+* `ipv6` - Range of IPv6 addresses that match in the given rule.ipv6 blocks are documented below.
+* `others` - Objects which are not represented as IP addresses and match the given rule. The details-level parameter of the request determines whether they are dis...
+
+
+`ipv4` supports the following:
+
+* `end` - N/A.
+* `start` - N/A.
+
+
+`ipv6` supports the following:
+
+* `end` - N/A.
+* `start` - N/A.
+
+
+`expiration_settings` supports the following:
+
+* `expiration_date` - Expiration date.expiration_date blocks are documented below.
+* `expired` - Expired rule.
+* `has_expiration_date` - Rule has expiration date.
+
+
+`expiration_date` supports the following:
+
+* `iso_8601` - N/A.
+* `posix` - N/A.
+
+
+`hits` supports the following:
+
+* `first_date` - N/A.first_date blocks are documented below.
+* `last_date` - N/A.last_date blocks are documented below.
+* `level` - N/A.
+* `percentage` - N/A.
+* `value` - N/A.
+
+
+`first_date` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
+
+
+`last_date` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
+
+
+`service_ranges` supports the following:
+
+* `excluded_others` - Objects which are not represented as port numbers and are negated in the given rule - for example if negate is set for the service of this rule. The d...
+* `others` - Objects which are not represented as port numbers and match the given rule. The details-level parameter of the request determines whether they are dis...
+* `tcp` - Range of TCP ports that match in the given rule.tcp blocks are documented below.
+* `udp` - Range of UDP ports that match in the given rule.udp blocks are documented below.
+
+
+`tcp` supports the following:
+
+* `end` - N/A.
+* `start` - N/A.
+
+
+`udp` supports the following:
+
+* `end` - N/A.
+* `start` - N/A.
+
+
+`source_ranges` supports the following:
+
+* `excluded_others` - Objects which are not represented as IP addresses and are negated in the given rule - for example if negate is set for the source or destination of th...
+* `ipv4` - Range of IPv4 addresses that match in the given rule.ipv4 blocks are documented below.
+* `ipv6` - Range of IPv6 addresses that match in the given rule.ipv6 blocks are documented below.
+* `others` - Objects which are not represented as IP addresses and match the given rule. The details-level parameter of the request determines whether they are dis...
+
+
+`ipv4` supports the following:
+
+* `end` - N/A.
+* `start` - N/A.
+
+
+`ipv6` supports the following:
+
+* `end` - N/A.
+* `start` - N/A.
diff --git a/website/docs/d/checkpoint_management_data_application_site.html.markdown b/website/docs/d/checkpoint_management_data_application_site.html.markdown
index 370fe022..2212bdc9 100644
--- a/website/docs/d/checkpoint_management_data_application_site.html.markdown
+++ b/website/docs/d/checkpoint_management_data_application_site.html.markdown
@@ -41,3 +41,22 @@ The following arguments are supported:
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
* `groups` - Collection of group identifiers.
+* `additional_categories_ids` - Additional categories Id's.
+* `application_id` - N/A.
+* `match_settings` - Match settings for application services.match_settings blocks are documented below.
+* `primary_category_id` - Primary category id.
+* `risk` - N/A.
+* `user_defined` - True if this application site was defined by user (not predefined one).
+
+
+`match_settings` supports the following:
+
+* `mode` - Match mode for the application services.
+* `negate` - All ports except those listed in override-services.
+* `override_services` - Services used when matching is customized.
+* `recommended_services` - Recommended services for this application. Use when mode is set to 'recommended'.recommended_services blocks are documented below.
+
+
+`recommended_services` supports the following:
+
+* `port` - Service port.
diff --git a/website/docs/d/checkpoint_management_data_application_site_category.html.markdown b/website/docs/d/checkpoint_management_data_application_site_category.html.markdown
index b541da07..301f33ed 100644
--- a/website/docs/d/checkpoint_management_data_application_site_category.html.markdown
+++ b/website/docs/d/checkpoint_management_data_application_site_category.html.markdown
@@ -34,3 +34,5 @@ The following arguments are supported:
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
* `groups` - Collection of group identifiers.
+* `category_id` - Web category ID.
+* `user_defined` - True if application site category was defined by user (not predefined one).
diff --git a/website/docs/d/checkpoint_management_data_center_content.html.markdown b/website/docs/d/checkpoint_management_data_center_content.html.markdown
index afc858a0..88c6a32a 100644
--- a/website/docs/d/checkpoint_management_data_center_content.html.markdown
+++ b/website/docs/d/checkpoint_management_data_center_content.html.markdown
@@ -34,6 +34,7 @@ The following arguments are supported:
orders blocks are documented below.
* `uid_in_data_center` - Return result matching the unique identifier of the object on the Data Center Server.
* `filter` - Return results matching the specified filter.
+* `last_successful_scan` - Last successful scan time.last_successful_scan blocks are documented below.
`filter` supports the following:
@@ -45,3 +46,9 @@ The following arguments are supported:
* `asc` - (Optional) Sorts results by the given field in ascending order.
* `desc` - (Optional) Sorts results by the given field in descending order.
+
+
+`last_successful_scan` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
diff --git a/website/docs/d/checkpoint_management_data_center_query.html.markdown b/website/docs/d/checkpoint_management_data_center_query.html.markdown
index 3043ceb3..7f11ed22 100644
--- a/website/docs/d/checkpoint_management_data_center_query.html.markdown
+++ b/website/docs/d/checkpoint_management_data_center_query.html.markdown
@@ -33,3 +33,4 @@ The following arguments are supported:
* `name` - (Optional) Object name.
* `uid` - (Optional) Object unique identifier.
+* `using_all_data_center` - Using all Data Centers.
diff --git a/website/docs/d/checkpoint_management_data_group.html.markdown b/website/docs/d/checkpoint_management_data_group.html.markdown
index 07f3fa1e..36c78c80 100644
--- a/website/docs/d/checkpoint_management_data_group.html.markdown
+++ b/website/docs/d/checkpoint_management_data_group.html.markdown
@@ -34,4 +34,24 @@ The following arguments are supported:
* `comments` - Comments string.
* `groups` - Collection of group identifiers.
* `tags` - Collection of tag identifiers.
+* `ranges` - Displays the group's matched content as ranges of IP addresses, in case 'show-as-ranges' is set to true.
In this case, the 'members' parameter is...ranges blocks are documented below.
+
+`ranges` supports the following:
+
+* `excluded_others` - Objects which are not represented as IP addresses and are negated in the given rule - for example if negate is set for the source or destination of th...
+* `ipv4` - Range of IPv4 addresses that match in the given rule.ipv4 blocks are documented below.
+* `ipv6` - Range of IPv6 addresses that match in the given rule.ipv6 blocks are documented below.
+* `others` - Objects which are not represented as IP addresses and match the given rule. The details-level parameter of the request determines whether they are dis...
+
+
+`ipv4` supports the following:
+
+* `end` - N/A.
+* `start` - N/A.
+
+
+`ipv6` supports the following:
+
+* `end` - N/A.
+* `start` - N/A.
diff --git a/website/docs/d/checkpoint_management_data_group_with_exclusion.html.markdown b/website/docs/d/checkpoint_management_data_group_with_exclusion.html.markdown
index 95ea0742..1af46b14 100644
--- a/website/docs/d/checkpoint_management_data_group_with_exclusion.html.markdown
+++ b/website/docs/d/checkpoint_management_data_group_with_exclusion.html.markdown
@@ -45,3 +45,24 @@ The following arguments are supported:
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
* `groups` - Collection of group identifiers.
+* `ranges` - Displays the group with exclusion's matched content as ranges of IP addresses, in case 'show-as-ranges' is set to true.
In this case, the 'includ...ranges blocks are documented below.
+
+
+`ranges` supports the following:
+
+* `excluded_others` - Objects which are not represented as IP addresses and are negated in the given rule - for example if negate is set for the source or destination of th...
+* `ipv4` - Range of IPv4 addresses that match in the given rule.ipv4 blocks are documented below.
+* `ipv6` - Range of IPv6 addresses that match in the given rule.ipv6 blocks are documented below.
+* `others` - Objects which are not represented as IP addresses and match the given rule. The details-level parameter of the request determines whether they are dis...
+
+
+`ipv4` supports the following:
+
+* `end` - N/A.
+* `start` - N/A.
+
+
+`ipv6` supports the following:
+
+* `end` - N/A.
+* `start` - N/A.
diff --git a/website/docs/d/checkpoint_management_data_host.html.markdown b/website/docs/d/checkpoint_management_data_host.html.markdown
index 1aa2101e..39d406d0 100644
--- a/website/docs/d/checkpoint_management_data_host.html.markdown
+++ b/website/docs/d/checkpoint_management_data_host.html.markdown
@@ -50,6 +50,7 @@ The following arguments are supported:
* `mask_length6` - IPv6 network mask length.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
+* `subnet_mask` - IPv4 network mask.
`nat_settings` supports the following:
@@ -74,3 +75,4 @@ The following arguments are supported:
* `listen_standard_port` - "Whether server listens to standard port.
* `operating_system` - Operating System.
* `protected_by` - Network object which protects this server identified by the name or UID.
+* `standard_port_number` - Server standard port number.
diff --git a/website/docs/d/checkpoint_management_data_https_rule.html.markdown b/website/docs/d/checkpoint_management_data_https_rule.html.markdown
index 90925ca6..161f08d2 100644
--- a/website/docs/d/checkpoint_management_data_https_rule.html.markdown
+++ b/website/docs/d/checkpoint_management_data_https_rule.html.markdown
@@ -55,4 +55,26 @@ The following arguments are supported:
* `site_category_negate` - TRUE if "negate" value is set for Site Category.
* `source_negate` - TRUE if "negate" value is set for Source.
* `track` - "None","Log","Alert","Mail","SNMP trap","Mail","User Alert", "User Alert 2", "User Alert 3".
-* `comments` - Comments string.
\ No newline at end of file
+* `comments` - Comments string.
+* `hits` - Hits count object.hits blocks are documented below.
+
+
+`hits` supports the following:
+
+* `first_date` - N/A.first_date blocks are documented below.
+* `last_date` - N/A.last_date blocks are documented below.
+* `level` - N/A.
+* `percentage` - N/A.
+* `value` - N/A.
+
+
+`first_date` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
+
+
+`last_date` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
diff --git a/website/docs/d/checkpoint_management_data_network.html.markdown b/website/docs/d/checkpoint_management_data_network.html.markdown
index 4c81b9b6..199a81e2 100644
--- a/website/docs/d/checkpoint_management_data_network.html.markdown
+++ b/website/docs/d/checkpoint_management_data_network.html.markdown
@@ -41,6 +41,7 @@ The following arguments are supported:
* `broadcast` - Allow broadcast address inclusion.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
+* `subnet_mask` - IPv4 network mask.
`nat_settings` supports the following:
diff --git a/website/docs/d/checkpoint_management_data_opsec_application.html.markdown b/website/docs/d/checkpoint_management_data_opsec_application.html.markdown
index b81e1d2d..d3385dc3 100644
--- a/website/docs/d/checkpoint_management_data_opsec_application.html.markdown
+++ b/website/docs/d/checkpoint_management_data_opsec_application.html.markdown
@@ -50,6 +50,7 @@ The following arguments are supported:
* `tags` - Collection of tag identifiers.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
+* `server` - The UID or Name of the host that is the OPSEC Server.
`cpmi` supports the following:
diff --git a/website/docs/d/checkpoint_management_data_package.html.markdown b/website/docs/d/checkpoint_management_data_package.html.markdown
index fb66bcd4..2270a028 100644
--- a/website/docs/d/checkpoint_management_data_package.html.markdown
+++ b/website/docs/d/checkpoint_management_data_package.html.markdown
@@ -37,4 +37,26 @@ The following arguments are supported:
* `vpn_traditional_mode` - True - enables, False - disables VPN traditional mode, empty - nothing is changed.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
-* `tags` - Collection of tag identifiers.
\ No newline at end of file
+* `tags` - Collection of tag identifiers.
+* `autonomous_threat_policy` - UID of the Autonomous Threat Prevention policy.
+* `https_inspection_policy` - True - enables, False - disables HTTPS Inspection policy, empty - nothing is changed.
+* `installation_targets_revision` - List of installation targets and revisions on which this policy package was installed.installation_targets_revision blocks are documented below.
+* `nat_layer` - UID of the NAT policy.
+* `nat_policy` - True - enables, False - disables NAT policy, empty - nothing is changed.
+* `sd_wan` - True - enables, False - disables SD-WAN policy, empty - nothing is changed.
+* `sd_wan_layer` - SD-WAN policy layer. Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Stan...
+
+
+`installation_targets_revision` supports the following:
+
+* `cluster_members_revision` - If this target is a cluster, this list shows a revision which was installed on each cluster member.cluster_members_revision blocks are documented below.
+* `revision` - The revision installed on this target. Level of details in the output corresponds to the number of details for search. This table shows the level of d...
+* `target_name` - The name of the installation target.
+* `target_uid` - Installation target unique identifier.
+
+
+`cluster_members_revision` supports the following:
+
+* `revision` - The revision installed on this target. Level of details in the output corresponds to the number of details for search. This table shows the level of d...
+* `target_name` - The name of the installation target.
+* `target_uid` - Installation target unique identifier.
diff --git a/website/docs/d/checkpoint_management_data_service_group.html.markdown b/website/docs/d/checkpoint_management_data_service_group.html.markdown
index 04f08be3..429773d2 100644
--- a/website/docs/d/checkpoint_management_data_service_group.html.markdown
+++ b/website/docs/d/checkpoint_management_data_service_group.html.markdown
@@ -33,4 +33,25 @@ The following arguments are supported:
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
* `groups` - Collection of group identifiers.
-* `tags` - Collection of tag identifiers.
\ No newline at end of file
+* `tags` - Collection of tag identifiers.
+* `ranges` - Displays the service group's matched content as ranges of port numbers, in case 'show-as-ranges' is set to true.
In this case, the 'members' para...ranges blocks are documented below.
+
+
+`ranges` supports the following:
+
+* `excluded_others` - Objects which are not represented as port numbers and are negated in the given rule - for example if negate is set for the service of this rule. The d...
+* `others` - Objects which are not represented as port numbers and match the given rule. The details-level parameter of the request determines whether they are dis...
+* `tcp` - Range of TCP ports that match in the given rule.tcp blocks are documented below.
+* `udp` - Range of UDP ports that match in the given rule.udp blocks are documented below.
+
+
+`tcp` supports the following:
+
+* `end` - N/A.
+* `start` - N/A.
+
+
+`udp` supports the following:
+
+* `end` - N/A.
+* `start` - N/A.
diff --git a/website/docs/d/checkpoint_management_data_service_other.html.markdown b/website/docs/d/checkpoint_management_data_service_other.html.markdown
index d6e7c203..6ca6e931 100644
--- a/website/docs/d/checkpoint_management_data_service_other.html.markdown
+++ b/website/docs/d/checkpoint_management_data_service_other.html.markdown
@@ -57,6 +57,7 @@ Example: tcp, dport = 21, direction = 0 matches incoming FTP control connections
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
* `groups` - Collection of group identifiers.
+* `protocol` - Protocol name or uid. The protocol type associated with the service, and by implication, the management server (if any) that enforces Content Security...
`aggressive_aging` supports the following:
diff --git a/website/docs/d/checkpoint_management_data_service_tcp.html.markdown b/website/docs/d/checkpoint_management_data_service_tcp.html.markdown
index 4c1c2cef..6848505f 100644
--- a/website/docs/d/checkpoint_management_data_service_tcp.html.markdown
+++ b/website/docs/d/checkpoint_management_data_service_tcp.html.markdown
@@ -45,6 +45,9 @@ The following arguments are supported:
* `comments` - Comments string.
* `groups` - Collection of group identifiers.
* `tags` - Collection of tag identifiers.
+* `delayed_sync_value` - Specify the delay (in seconds) in which a synchronization will start after connection initiation.
+* `enable_tcp_resource` - Enable for tcp resource.
+* `use_delayed_sync` - Enable this option to delay notifying the Security Gateway about a connection, so that the connection will only be synchronized if it still exists x s...
`aggressive_aging` supports the following:
diff --git a/website/docs/d/checkpoint_management_data_threat_indicator.html.markdown b/website/docs/d/checkpoint_management_data_threat_indicator.html.markdown
index 2d98611b..a598af53 100644
--- a/website/docs/d/checkpoint_management_data_threat_indicator.html.markdown
+++ b/website/docs/d/checkpoint_management_data_threat_indicator.html.markdown
@@ -39,6 +39,8 @@ The following arguments are supported:
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
* `tags` - Collection of tag identifiers.
+* `number_of_observables` - The amount of observables in the indicator.
+* `observables_raw_data` - The contents of the file containing the indicator's observables.
Available only when details-level is full.
`profile_overrides` supports the following:
diff --git a/website/docs/d/checkpoint_management_data_type_file_attributes.html.markdown b/website/docs/d/checkpoint_management_data_type_file_attributes.html.markdown
index f4ff0a39..2827e978 100644
--- a/website/docs/d/checkpoint_management_data_type_file_attributes.html.markdown
+++ b/website/docs/d/checkpoint_management_data_type_file_attributes.html.markdown
@@ -47,4 +47,5 @@ Identified by name or UID.file_groups_list blocks are documented below.
* `tags` - Collection of tag identifiers.tags blocks are documented below.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
+* `related_file_types` - List of Content Awareness file types.
diff --git a/website/docs/d/checkpoint_management_data_type_patterns.html.markdown b/website/docs/d/checkpoint_management_data_type_patterns.html.markdown
index 9cfd3161..93312a79 100644
--- a/website/docs/d/checkpoint_management_data_type_patterns.html.markdown
+++ b/website/docs/d/checkpoint_management_data_type_patterns.html.markdown
@@ -39,4 +39,5 @@ For custom-made data types, you can use this field to provide more details.
* `tags` - Collection of tag identifiers.tags blocks are documented below.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
+* `use_statistical_analysis` - Indicates whether to use statistical analysis to enhance accuracy. Relevant only for built-in data types.
diff --git a/website/docs/d/checkpoint_management_data_vpn_community_meshed.html.markdown b/website/docs/d/checkpoint_management_data_vpn_community_meshed.html.markdown
index 1c74655c..f55b3c85 100644
--- a/website/docs/d/checkpoint_management_data_vpn_community_meshed.html.markdown
+++ b/website/docs/d/checkpoint_management_data_vpn_community_meshed.html.markdown
@@ -51,6 +51,7 @@ The following arguments are supported:
* `use_shared_secret` - Indicates whether the shared secret should be used for all external gateways.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
+* `route_based_settings` - VPN Community Route-Based settings.
Relevant only in Route-Based VPN Communities.route_based_settings blocks are documented below.
`encrypted_traffic` supports the following:
@@ -84,6 +85,9 @@ granular_encryptions` supports the following:
* `diffie_hellman_group` - The Diffie-Hellman group to be used.
* `encryption_algorithm` - The encryption algorithm to be used.
* `ike_p1_rekey_time` - Indicates the time interval for IKE phase 1 renegotiation.
+* `multiple_key_exchanges` - Multiple Key Exchanges proposal object.
+* `use_multiple_key_exchanges` - Indicates whether to use a proposal with Multiple Key Exchanges.
+* `use_standard_proposal` - Indicates whether to use a proposal with a single Diffie-Hellman group.
`ike_phase_2` supports the following:
@@ -93,6 +97,9 @@ granular_encryptions` supports the following:
* `ike_p2_use_pfs` - Indicates whether Perfect Forward Secrecy (PFS) is being used for IKE phase 2.
* `ike_p2_pfs_dh_grp` - The Diffie-Hellman group to be used: group-1, group-2, group-5, group-14, group-15, group-16, group-17, group-18, group-19, group-20, group-24.
* `ike_p2_rekey_time` - Indicates the time interval for IKE phase 2 renegotiation.
+* `multiple_key_exchanges` - Multiple Key Exchanges proposal object to use when PFS is enabled and multiple key exchanges are configured.
+* `use_multiple_key_exchanges` - Indicates whether to use a proposal with Multiple Key Exchanges when PFS is enabled.
+* `use_standard_proposal` - Indicates whether to use a proposal with a single Diffie-Hellman group when PFS is enabled.
`permanent_tunnels` supports the following:
@@ -140,3 +147,37 @@ granular_encryptions` supports the following:
* `enabled` - Indicates whether Route Injection Mechanism is enabled.
* `enable_on_gateways` - Indicates whether to enable automatic Route Injection Mechanism for gateways.
* `route_injection_track` - Route injection track method.
+
+
+`interfaces` supports the following:
+
+* `ip_version` - The IP version of the interface's IP address (IPv4/IPv6).
+
+
+`route_based_settings` supports the following:
+
+* `add_automatic_routes` - The type of routes to use for the automatic Route-Based configuration.
Relevant only in Route-Based VPN Communities.
+* `advanced` - Advanced settings
Relevant only in Route-Based VPN Communities.advanced blocks are documented below.
+* `override_routes` - Override automatic routing settings in a specific Security Gateway in this VPN Community.
Relevant only in Route-Based VPN Communities...override_routes blocks are documented below.
+
+
+`advanced` supports the following:
+
+* `bfd` - Indicates whether to enable Bidirectional Forwarding Detection.
Relevant only in Route-Based VPN Communities.
+* `graceful_restart` - Indicates whether to enable Graceful Restart in the applicable Dynamic Routing protocols.
Relevant only in Route-Based VPN Communities...
+
+
+`override_routes` supports the following:
+
+* `auto_config` - Indicates whether to configure the routing settings automatically for the Security Gateway.
Relevant only in Route-Based VPN CommunitiesExported Routes.
Relevant only in Route-Based VPN Communities.exported_routes blocks are documented below.
+* `gateway` - Name of the Security Gateway object in which to override the automatic routing settings.
Relevant only in Route-Based VPN Communities<...
+* `mode` - Specifies how to export routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.
+
+
+`exported_routes` supports the following:
+
+* `custom_routes` - Specifies to export user-defined networks from the Security Gateway.
Relevant only in Route-Based VPN Communities.
+* `custom_routes_object` - Specifies the name of the Network object or Network Group object that represents the exported routes.
Relevant only in Route-Based VPN Com...
+* `internal_interfaces` - Specifies to export networks from interfaces with Topology 'Internal' from the Security Gateway.
Relevant only in Route-Based VPN Communit...
+* `static_routes` - Specifies to export static routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.
diff --git a/website/docs/d/checkpoint_management_data_vpn_community_star.html.markdown b/website/docs/d/checkpoint_management_data_vpn_community_star.html.markdown
index 9a508a3c..d787c3b3 100644
--- a/website/docs/d/checkpoint_management_data_vpn_community_star.html.markdown
+++ b/website/docs/d/checkpoint_management_data_vpn_community_star.html.markdown
@@ -58,6 +58,7 @@ The following arguments are supported:
* `comments` - Comments string.
* `ignore_warnings` - Apply changes ignoring warnings.
* `ignore_errors` - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `route_based_settings` - VPN Community Route-Based settings.
Relevant only in Route-Based VPN Communities.route_based_settings blocks are documented below.
`encrypted_traffic` supports the following:
@@ -93,6 +94,9 @@ granular_encryptions` supports the following:
* `diffie_hellman_group` - The Diffie-Hellman group to be used.
* `encryption_algorithm` - The encryption algorithm to be used.
* `ike_p1_rekey_time` - Indicates the time interval for IKE phase 1 renegotiation.
+* `multiple_key_exchanges` - Multiple Key Exchanges proposal object.
+* `use_multiple_key_exchanges` - Indicates whether to use a proposal with Multiple Key Exchanges.
+* `use_standard_proposal` - Indicates whether to use a proposal with a single Diffie-Hellman group.
`ike_phase_2` supports the following:
@@ -102,6 +106,9 @@ granular_encryptions` supports the following:
* `ike_p2_use_pfs` - Indicates whether Perfect Forward Secrecy (PFS) is being used for IKE phase 2.
* `ike_p2_pfs_dh_grp` - The Diffie-Hellman group to be used: group-1, group-2, group-5, group-14, group-15, group-16, group-17, group-18, group-19, group-20, group-24.
* `ike_p2_rekey_time` - Indicates the time interval for IKE phase 2 renegotiation.
+* `multiple_key_exchanges` - Multiple Key Exchanges proposal object to use when PFS is enabled and multiple key exchanges are configured.
+* `use_multiple_key_exchanges` - Indicates whether to use a proposal with Multiple Key Exchanges when PFS is enabled.
+* `use_standard_proposal` - Indicates whether to use a proposal with a single Diffie-Hellman group when PFS is enabled.
`mep` supports the following:
@@ -137,6 +144,7 @@ granular_encryptions` supports the following:
* `first_priority_center_gateways` - Collection of first priority center gateways identified by the name or UID.first_priority_center_gateways blocks are documented below.
* `second_priority_center_gateways` - Collection of second priority center gateways identified by the name or UID.second_priority_center_gateways blocks are documented below.
* `third_priority_center_gateways` - Collection of third priority center gateways identified by the name or UID.third_priority_center_gateways blocks are documented below.
+* `satellite_gateways` - Collection of satellite VPN Gateway and VPN Device objects identified by the name or UID.
`exception_priority_rules` supports the following:
@@ -170,3 +178,51 @@ granular_encryptions` supports the following:
* `enable_on_center_gateways` - Indicates whether to enable automatic Route Injection Mechanism on center gateways.
* `enable_on_satellite_gateways` - Indicates whether to enable automatic Route Injection Mechanism on satellite gateways.
* `route_injection_track` - Route injection track method.
+
+
+`ike_phase_1` supports the following:
+
+* `multiple_key_exchanges` - Multiple Key Exchanges proposal object.
+* `use_multiple_key_exchanges` - Indicates whether to use a proposal with Multiple Key Exchanges.
+* `use_standard_proposal` - Indicates whether to use a proposal with a single Diffie-Hellman group.
+
+
+`ike_phase_2` supports the following:
+
+* `multiple_key_exchanges` - Multiple Key Exchanges proposal object to use when PFS is enabled and multiple key exchanges are configured.
+* `use_multiple_key_exchanges` - Indicates whether to use a proposal with Multiple Key Exchanges when PFS is enabled.
+* `use_standard_proposal` - Indicates whether to use a proposal with a single Diffie-Hellman group when PFS is enabled.
+
+
+`interfaces` supports the following:
+
+* `ip_version` - The IP version of the interface's IP address (IPv4/IPv6).
+
+
+`route_based_settings` supports the following:
+
+* `add_automatic_routes` - The type of routes to use for the automatic Route-Based configuration.
Relevant only in Route-Based VPN Communities.
+* `advanced` - Advanced settings
Relevant only in Route-Based VPN Communities.advanced blocks are documented below.
+* `override_routes` - Override automatic routing settings in a specific Security Gateway in this VPN Community.
Relevant only in Route-Based VPN Communities...override_routes blocks are documented below.
+
+
+`advanced` supports the following:
+
+* `bfd` - Indicates whether to enable Bidirectional Forwarding Detection.
Relevant only in Route-Based VPN Communities.
+* `graceful_restart` - Indicates whether to enable Graceful Restart in the applicable Dynamic Routing protocols.
Relevant only in Route-Based VPN Communities...
+
+
+`override_routes` supports the following:
+
+* `auto_config` - Indicates whether to configure the routing settings automatically for the Security Gateway.
Relevant only in Route-Based VPN CommunitiesExported Routes.
Relevant only in Route-Based VPN Communities.exported_routes blocks are documented below.
+* `gateway` - Name of the Security Gateway object in which to override the automatic routing settings.
Relevant only in Route-Based VPN Communities<...
+* `mode` - Specifies how to export routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.
+
+
+`exported_routes` supports the following:
+
+* `custom_routes` - Specifies to export user-defined networks from the Security Gateway.
Relevant only in Route-Based VPN Communities.
+* `custom_routes_object` - Specifies the name of the Network object or Network Group object that represents the exported routes.
Relevant only in Route-Based VPN Com...
+* `internal_interfaces` - Specifies to export networks from interfaces with Topology 'Internal' from the Security Gateway.
Relevant only in Route-Based VPN Communit...
+* `static_routes` - Specifies to export static routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.
diff --git a/website/docs/d/checkpoint_management_domain.html.markdown b/website/docs/d/checkpoint_management_domain.html.markdown
index b404dd25..f274cf45 100644
--- a/website/docs/d/checkpoint_management_domain.html.markdown
+++ b/website/docs/d/checkpoint_management_domain.html.markdown
@@ -32,3 +32,21 @@ The following arguments are supported:
* `name` - (Optional) Object name. Must be unique in the domain.
* `uid` - (Optional) Object unique identifier.
+* `domain_type` - N/A.
+* `global_domain_assignments` - N/A.global_domain_assignments blocks are documented below.
+
+
+`global_domain_assignments` supports the following:
+
+* `assignment_status` - N/A.
+* `assignment_up_to_date` - The time when the assignment was assigned.assignment_up_to_date blocks are documented below.
+* `global_access_policy` - Global domain access policy that is assigned to a dependent domain.
+* `global_domain` - Global domain. Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Standard l...
+* `global_threat_prevention_policy` - Global domain threat prevention policy that is assigned to a dependent domain.
+* `manage_protection_actions` - N/A.
+
+
+`assignment_up_to_date` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
diff --git a/website/docs/d/checkpoint_management_domain_permissions_profile.html.markdown b/website/docs/d/checkpoint_management_domain_permissions_profile.html.markdown
index 9b4ea9f2..26ca3a45 100644
--- a/website/docs/d/checkpoint_management_domain_permissions_profile.html.markdown
+++ b/website/docs/d/checkpoint_management_domain_permissions_profile.html.markdown
@@ -29,3 +29,10 @@ The following arguments are supported:
* `uid` - (Optional) Object unique identifier.
* `name` - (Optional) Object name.
+
+
+`management` supports the following:
+
+* `allowed_mgmt_api_commands` - List of allowed Management API commands the profile can run. All available commands can be viewed using show-commands Management API.
...
+* `limit_mgmt_api_commands` - Enable limitation of Management API commands the profile may or may not run.
Not supported for Multi-Domain Servers.
diff --git a/website/docs/d/checkpoint_management_external_trusted_ca.html.markdown b/website/docs/d/checkpoint_management_external_trusted_ca.html.markdown
index 28cba0a3..89653d39 100644
--- a/website/docs/d/checkpoint_management_external_trusted_ca.html.markdown
+++ b/website/docs/d/checkpoint_management_external_trusted_ca.html.markdown
@@ -40,3 +40,5 @@ The following arguments are supported:
* `tags` - Collection of tag identifiers.tags blocks are documented below.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
+* `cache_crl` - Cache Certificate Revocation List on the Security Gateway.
+* `retrieve_crl_from_ldap_servers` - Whether to retrieve Certificate Revocation List from ldap servers.
diff --git a/website/docs/d/checkpoint_management_gateway_capabilities.html.markdown b/website/docs/d/checkpoint_management_gateway_capabilities.html.markdown
index cf376be7..a621dc52 100644
--- a/website/docs/d/checkpoint_management_gateway_capabilities.html.markdown
+++ b/website/docs/d/checkpoint_management_gateway_capabilities.html.markdown
@@ -34,12 +34,14 @@ The following arguments are supported:
* `supported_hardware` - Supported hardware according to restrictions.
* `supported_platforms` - Supported platforms according to restrictions.
* `supported_versions` - Supported versions according to restrictions.
+* `supported_hardware_subtypes` - Supported hardware-subtypes according to restrictions.supported_hardware_subtypes blocks are documented below.
`restrictions` supports the following:
* `hardware` - Check Point hardware.
* `platform` - Check Point gateway platform.
* `version` - Gateway platform version.
+* `hardware_subtype` - Gateway type (relevant only for Spark gateways).
`supported_blades` supports the following:
@@ -101,3 +103,8 @@ The following arguments are supported:
Make sure this command will be executed in the right execution order.
note: terraform execution is not sequential.
+
+`supported_hardware_subtypes` supports the following:
+
+* `default` - Default hardware subtype.
+* `hardware_subtypes` - List of Check Point hardware subtypes.
diff --git a/website/docs/d/checkpoint_management_gateway_global_use.html.markdown b/website/docs/d/checkpoint_management_gateway_global_use.html.markdown
index f810df1e..587d994e 100644
--- a/website/docs/d/checkpoint_management_gateway_global_use.html.markdown
+++ b/website/docs/d/checkpoint_management_gateway_global_use.html.markdown
@@ -32,6 +32,9 @@ The following arguments are supported:
* `uid` - Object Identifier.
* `name` - Object Name.
* `domain` - data about doamin
+* `enable_identity_sharing` - Indicates whether Identity Awareness Sharing global use is enabled on the target.
+* `enable_vpn` - Indicates whether VPN global use is enabled on the target.
+* `identity_sharing_domains` - Domains that Identity Awareness Sharing global use applied to them.
`domain` supports the following:
diff --git a/website/docs/d/checkpoint_management_gcp_data_center_server.html.markdown b/website/docs/d/checkpoint_management_gcp_data_center_server.html.markdown
index 609e50fd..82b4df1c 100644
--- a/website/docs/d/checkpoint_management_gcp_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_gcp_data_center_server.html.markdown
@@ -30,3 +30,12 @@ The following arguments are supported:
* `name` - (Optional) Object name.
* `uid` - (Optional) Object unique identifier.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_generic_data_center_server.html.markdown b/website/docs/d/checkpoint_management_generic_data_center_server.html.markdown
index c547de33..b6f967d5 100644
--- a/website/docs/d/checkpoint_management_generic_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_generic_data_center_server.html.markdown
@@ -33,3 +33,12 @@ The following arguments are supported:
* `name` - (Required if uid is not given) Object name.
* `uid` - (Required if name is not given) Object unique identifier.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_guardicore_data_center_server.html.markdown b/website/docs/d/checkpoint_management_guardicore_data_center_server.html.markdown
index fd71f80b..462be2a4 100644
--- a/website/docs/d/checkpoint_management_guardicore_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_guardicore_data_center_server.html.markdown
@@ -37,3 +37,12 @@ The following arguments are supported:
* `tags` - (Computed) Collection of tag objects identified by the name or UID.
* `color` - (Computed) Color of the object.
* `comments` - (Computed) Comments string.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_https_advanced_settings.html.markdown b/website/docs/d/checkpoint_management_https_advanced_settings.html.markdown
index d7446866..9b0cfab9 100644
--- a/website/docs/d/checkpoint_management_https_advanced_settings.html.markdown
+++ b/website/docs/d/checkpoint_management_https_advanced_settings.html.markdown
@@ -64,6 +64,7 @@ The following arguments are supported:
* `domains_to_process` - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and with ignore-warnings true. Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER.domains_to_process blocks are documented below.
* `ignore_warnings` - Apply changes ignoring warnings.
* `ignore_errors` - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `show_block_page` - Whether a block page should be displayed when TLS Inspection rejects a connection due to server certificate issues.
`bypass_under_load` supports the following:
diff --git a/website/docs/d/checkpoint_management_https_rulebase.html.markdown b/website/docs/d/checkpoint_management_https_rulebase.html.markdown
index 6b12dc14..79539595 100644
--- a/website/docs/d/checkpoint_management_https_rulebase.html.markdown
+++ b/website/docs/d/checkpoint_management_https_rulebase.html.markdown
@@ -31,6 +31,7 @@ The following arguments are supported:
* `package` - Name of the package.
* `dereference_group_members` - Indicates whether to dereference "members" field by details level for every object in reply.
* `show_membership` - Indicates whether to calculate and show "groups" field for every object in reply.
+* `objects_dictionary` - Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Standard level.
`filter_settings` supports the following:
diff --git a/website/docs/d/checkpoint_management_if_map_server.html.markdown b/website/docs/d/checkpoint_management_if_map_server.html.markdown
index 84e40799..ee7b782e 100644
--- a/website/docs/d/checkpoint_management_if_map_server.html.markdown
+++ b/website/docs/d/checkpoint_management_if_map_server.html.markdown
@@ -48,4 +48,3 @@ The following arguments are supported:
* `authentication_method` - Authentication method for the IF-MAP server.
* `username` - Username for the IF-MAP server authentication.
-* `password` - Username for the IF-MAP server authentication.
diff --git a/website/docs/d/checkpoint_management_illumio_data_center_server.html.markdown b/website/docs/d/checkpoint_management_illumio_data_center_server.html.markdown
index d8e10fbd..298f42e1 100644
--- a/website/docs/d/checkpoint_management_illumio_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_illumio_data_center_server.html.markdown
@@ -39,3 +39,12 @@ The following arguments are supported:
* `tags` - Collection of tag objects identified by the name or UID.
* `color` - Color of the object.
* `comments` - Comments string.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_interface.html.markdown b/website/docs/d/checkpoint_management_interface.html.markdown
index dc24cc39..a8985609 100644
--- a/website/docs/d/checkpoint_management_interface.html.markdown
+++ b/website/docs/d/checkpoint_management_interface.html.markdown
@@ -61,6 +61,7 @@ The following arguments are supported:
* `topology_settings_manual` - Topology settings manually defined.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
+* `gateway` - Properties of the gateway or cluster that the interface belongs to.
`anti_spoofing_settings` supports the following:
diff --git a/website/docs/d/checkpoint_management_interoperable_device.html.markdown b/website/docs/d/checkpoint_management_interoperable_device.html.markdown
index e0936ebe..6a2499e4 100644
--- a/website/docs/d/checkpoint_management_interoperable_device.html.markdown
+++ b/website/docs/d/checkpoint_management_interoperable_device.html.markdown
@@ -29,4 +29,5 @@ data "checkpoint_management_interoperable_device" "data_interoperable_device" {
The following arguments are supported:
* `uid` - (Optional) Object unique identifier.
-* `name` - (Optional) Object name.
\ No newline at end of file
+* `name` - (Optional) Object name.
+* `autonomous_system_number` - The Autonomous System Number (ASN) for this Interoperable Device object.
\ No newline at end of file
diff --git a/website/docs/d/checkpoint_management_ise_data_center_server.html.markdown b/website/docs/d/checkpoint_management_ise_data_center_server.html.markdown
index 90cd8f17..20bf9e2c 100644
--- a/website/docs/d/checkpoint_management_ise_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_ise_data_center_server.html.markdown
@@ -30,3 +30,12 @@ The following arguments are supported:
* `name` - (Optional) Object name.
* `uid` - (Optional) Object unique identifier.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_kubernetes_data_center_server.html.markdown b/website/docs/d/checkpoint_management_kubernetes_data_center_server.html.markdown
index 882e97dc..59836945 100644
--- a/website/docs/d/checkpoint_management_kubernetes_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_kubernetes_data_center_server.html.markdown
@@ -29,3 +29,12 @@ The following arguments are supported:
* `name` - (Optional) Object name.
* `uid` - (Optional) Object unique identifier.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_log_exporter.html.markdown b/website/docs/d/checkpoint_management_log_exporter.html.markdown
index b695b912..faea09e2 100644
--- a/website/docs/d/checkpoint_management_log_exporter.html.markdown
+++ b/website/docs/d/checkpoint_management_log_exporter.html.markdown
@@ -34,6 +34,11 @@ The following arguments are supported:
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
* `tags` - Collection of tag identifiers.tags blocks are documented below.
+* `advanced` - Log exporter advanced settings.advanced blocks are documented below.
+* `fields` - Log exporter fields settings.fields blocks are documented below.
+* `filters` - Log exporter filters.filters blocks are documented below.
+* `target_cloud` - Cloud target configuration for log export.target_cloud blocks are documented below.
+* `tls` - Log exporter TLS settings.tls blocks are documented below.
`attachments` supports the following:
@@ -47,3 +52,89 @@ The following arguments are supported:
* `aggregate_log_updates` - Indicates whether to aggregate log updates.
* `format` - Logs format.
+* `add_custom_log_header` - Custom header for log export.
+* `aggregation_mode` - Aggregation mode for aggregated logs.
Determines how log updates are processed when aggregate-log-updates is true or not specified:
- semi-uni...
+
+
+`advanced` supports the following:
+
+* `time_in_milliseconds` - Toggle export logs' time with ms resolution.
+
+
+`fields` supports the following:
+
+* `exclusion_list` - List of field names excluded or included based on the export mode.
+* `export` - Field export mode.
all-except (default): exports all fields except those in the exclusion list.
nothing-except: exports nothing ...
+* `names_mapping` - Field name mappings applied during export. Format: 'orgName1:dstName1,orgName2:dstName2,...'.
+
+
+`filters` supports the following:
+
+* `expressions` - List of filter expressions. Each expression targets a specific log field.expressions blocks are documented below.
+* `expressions_operator` - Logical operator for combining all filter expressions.
+* `filter_out_connection_logs` - When set to true, connection logs will be excluded from export.
+
+
+`expressions` supports the following:
+
+* `conditions` - Filter conditions for this field. Present when 'operator' is 'and' or 'or'.
Array of condition objects, each with 'operator' and 'value'.conditions blocks are documented below.
+* `field_name` - Log field name to filter on.
+* `operator` - Operator for this expression.
Use 'and'/'or' with 'conditions' (array of condition objects).
Use 'in'/'not-in' with 'values' (flat array of stri...
+* `values` - Filter values for this field. Present when 'operator' is 'in' or 'not-in'.
Flat array of string values.
+
+
+`conditions` supports the following:
+
+* `operator` - Comparison operator.
+* `value` - The value to compare against.
+
+
+`target_cloud` supports the following:
+
+* `s3_bucket_auth` - S3 bucket authentication configuration details.s3_bucket_auth blocks are documented below.
+* `type` - Cloud target type. Currently only 's3-bucket' is supported.
+
+
+`s3_bucket_auth` supports the following:
+
+* `complete_configuration` - S3 bucket ARNs configuration details.complete_configuration blocks are documented below.
+* `create_certificate` - S3 bucket configuration with auto-generated certificates details.create_certificate blocks are documented below.
+* `operation` - Current S3 authentication operation phase: 'create-certificate' or 'complete-configuration'.
+
+
+`complete_configuration` supports the following:
+
+* `exporter_enabled` - Indicates whether the log exporter is now enabled after ARN configuration.
+* `message` - Status message indicating ARN configuration success and exporter enablement.
+* `profile_arn` - Configured AWS IAM Roles Anywhere profile ARN.
+* `role_arn` - Configured AWS IAM role ARN.
+* `trust_anchor_arn` - Configured AWS IAM Roles Anywhere trust anchor ARN.
+
+
+`create_certificate` supports the following:
+
+* `bucket` - Configured S3 bucket name.
+* `ca_certificate` - CA certificate that signed the S3 client certificate. Supplied as base64 encoded PEM string. Decode this certificate and upload it to AWS IAM Roles An...
+* `message` - Status message indicating certificate generation success and next steps.
+* `prefix` - Configured S3 prefix (if provided).
+* `region` - Configured AWS region.
+
+
+`tls` supports the following:
+
+* `auto_generate_client_certificates` - TLS mode where user provides server CA certificate only. Check Point Management automatically generates and signs client certificates. This is the sim...auto_generate_client_certificates blocks are documented below.
+* `client_cert_expiration_date` - Client certificate expiration date extracted from the stored PKCS#12 certificate. Available for all TLS modes when client certificate exists.
+* `enabled` - Indicates whether to use encrypted connection. Can be true only when protocol is TCP.
+* `generate_and_sign_client_csr` - Advanced TLS mode with two separate phases: 'auto-generate-client-csr' to initiate CSR generation (ADD/SET) and 'provide-signed-client-cert' to provid...generate_and_sign_client_csr blocks are documented below.
+* `mode` - TLS mode. Must match the specific mode configuration provided.
+
+
+`auto_generate_client_certificates` supports the following:
+
+* `client_ca_cert` - Client generated CA certificate that signed the client certificate. The server should trust this CA. Supplied as base64 encoded string.
+
+
+`generate_and_sign_client_csr` supports the following:
+
+* `client_csr` - Client certificate signing request (CSR) in PEM format as base64 encoded string. Present when phase is 'auto-generate-client-csr'.
+* `phase` - Advanced mode phase type: 'auto-generate-client-csr' indicates CSR generation, or 'provide-signed-client-cert' indicates signed certificate provided.
diff --git a/website/docs/d/checkpoint_management_lsm_cluster.html.markdown b/website/docs/d/checkpoint_management_lsm_cluster.html.markdown
index a0956f13..43b6cf39 100644
--- a/website/docs/d/checkpoint_management_lsm_cluster.html.markdown
+++ b/website/docs/d/checkpoint_management_lsm_cluster.html.markdown
@@ -60,6 +60,12 @@ The following arguments are supported:
* `provisioning_state` - Provisioning state. This field is relevant just for SMB clusters. By default the state is 'manual'- enable provisioning but not attach to profile.If 'using-profile' state is provided a provisioning profile must be provided in provisioning-settings.
* `sic_name` - Secure Internal Communication name.
* `sic_state`- Secure Internal Communication state.
+* `gateway_status` - The current status of the Cluster member. Shown only when the 'show-statuses' parameter is set to 'true'.
+* `last_applied_provisioning_settings_time` - The last time when the Provisioning Settings were changed. Shown only when the 'show-statuses' parameter is set to 'true'.last_applied_provisioning_settings_time blocks are documented below.
+* `last_policy_fetch_time` - The last time when the Security Policy was fetched. Shown only when the 'show-statuses' parameter is set to 'true'.last_policy_fetch_time blocks are documented below.
+* `last_provisioning_settings_sync_time` - The last time of Provisioning Settings synchronization with the Cluster member. Shown only when the 'show-statuses' parameter is set to 'true'.last_provisioning_settings_sync_time blocks are documented below.
+* `policy_status` - The current status of the Security Policy. Shown only when the 'show-statuses' parameter is set to 'true'.
+* `provisioning_settings_status` - The current status of the Provisioning Settings. Shown only when the 'show-statuses' parameter is set to 'true'.
@@ -93,3 +99,21 @@ This field is relevant only when 'manual' option of vpn-domain is checked.manual
* `from_ipv4_address` - First IPv4 address of the IP address range.
* `to_ipv4_address` - Last IPv4 address of the IP address range.
+
+
+`last_applied_provisioning_settings_time` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
+
+
+`last_policy_fetch_time` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
+
+
+`last_provisioning_settings_sync_time` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
diff --git a/website/docs/d/checkpoint_management_lsm_cluster_profile.html.markdown b/website/docs/d/checkpoint_management_lsm_cluster_profile.html.markdown
index 7435729a..be524dd8 100644
--- a/website/docs/d/checkpoint_management_lsm_cluster_profile.html.markdown
+++ b/website/docs/d/checkpoint_management_lsm_cluster_profile.html.markdown
@@ -30,3 +30,7 @@ The following arguments are supported:
Make sure this command will be executed in the right execution order.
note: terraform execution is not sequential.
+
+`nat_settings` supports the following:
+
+* `apply_control_connections` - This option performs NAT on VPN control connections to and from this object.
diff --git a/website/docs/d/checkpoint_management_lsm_gateway.html.markdown b/website/docs/d/checkpoint_management_lsm_gateway.html.markdown
index 4eda3cb5..cd3ae2d4 100644
--- a/website/docs/d/checkpoint_management_lsm_gateway.html.markdown
+++ b/website/docs/d/checkpoint_management_lsm_gateway.html.markdown
@@ -40,6 +40,12 @@ If 'using-profile' state is provided a provisioning profile must be provided in
* `comments` - Comments string.
* `ignore_warnings` - Apply changes ignoring warnings.
* `ignore_errors` - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `gateway_status` - The current status of the Gateway. Shown only when the 'show-statuses' parameter is set to 'true'.
+* `last_applied_provisioning_settings_time` - The last time when the Provisioning Settings were changed. Shown only when the 'show-statuses' parameter is set to 'true'.last_applied_provisioning_settings_time blocks are documented below.
+* `last_policy_fetch_time` - The last time when the Security Policy was fetched. Shown only when the 'show-statuses' parameter is set to 'true'.last_policy_fetch_time blocks are documented below.
+* `last_provisioning_settings_sync_time` - The last time of Provisioning Settings synchronization with the Gateway. Shown only when the 'show-statuses' parameter is set to 'true'.last_provisioning_settings_sync_time blocks are documented below.
+* `policy_status` - The current status of the Security Policy. Shown only when the 'show-statuses' parameter is set to 'true'.
+* `provisioning_settings_status` - The current status of the Provisioning Settings. Shown only when the 'show-statuses' parameter is set to 'true'.
`dynamic_objects` supports the following:
@@ -80,3 +86,21 @@ This field is relevant only when 'manual' option of vpn-domain is checked.manual
* `from_ipv4_address` - (Optional) First IPv4 address of the IP address range.
* `to_ipv4_address` - (Optional) Last IPv4 address of the IP address range.
+
+
+`last_applied_provisioning_settings_time` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
+
+
+`last_policy_fetch_time` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
+
+
+`last_provisioning_settings_sync_time` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
diff --git a/website/docs/d/checkpoint_management_lsm_gateway_profile.html.markdown b/website/docs/d/checkpoint_management_lsm_gateway_profile.html.markdown
index 5757130e..5070b226 100644
--- a/website/docs/d/checkpoint_management_lsm_gateway_profile.html.markdown
+++ b/website/docs/d/checkpoint_management_lsm_gateway_profile.html.markdown
@@ -30,3 +30,7 @@ The following arguments are supported:
Make sure this command will be executed in the right execution order.
note: terraform execution is not sequential.
+
+`nat_settings` supports the following:
+
+* `apply_control_connections` - This option performs NAT on VPN control connections to and from this object.
diff --git a/website/docs/d/checkpoint_management_md_permissions_profile.html.markdown b/website/docs/d/checkpoint_management_md_permissions_profile.html.markdown
index 9d914b63..9073579d 100644
--- a/website/docs/d/checkpoint_management_md_permissions_profile.html.markdown
+++ b/website/docs/d/checkpoint_management_md_permissions_profile.html.markdown
@@ -29,3 +29,7 @@ The following arguments are supported:
* `uid` - (Optional) Object unique identifier.
* `name` - (Optional) Object name.
+* `allowed_mgmt_api_commands` - List of allowed Management API commands the profile can run. All available commands can be viewed using show-commands Management API.
...
+* `limit_mgmt_api_commands` - Enable limitation of Management API commands the profile may or may not run.
+* `manage_all_domains` - Create and manage all Domains and Global Domains.
diff --git a/website/docs/d/checkpoint_management_mds.html.markdown b/website/docs/d/checkpoint_management_mds.html.markdown
index 6d1ede1e..747e16f7 100644
--- a/website/docs/d/checkpoint_management_mds.html.markdown
+++ b/website/docs/d/checkpoint_management_mds.html.markdown
@@ -44,4 +44,5 @@ The following arguments are supported:
* `sic_name` - Name of the Secure Internal Connection Trust..
* `sic_state` - State the Secure Internal Connection Trust..
* `domains` - Collection of Domain objects identified by the name or UID.
-* `global_domains` - Collection of Global domain objects identified by the name or UID.
\ No newline at end of file
+* `global_domains` - Collection of Global domain objects identified by the name or UID.
+* `platform` - Platform. Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Standard level.
\ No newline at end of file
diff --git a/website/docs/d/checkpoint_management_nat_rule.html.markdown b/website/docs/d/checkpoint_management_nat_rule.html.markdown
index d45bf747..62e99c08 100644
--- a/website/docs/d/checkpoint_management_nat_rule.html.markdown
+++ b/website/docs/d/checkpoint_management_nat_rule.html.markdown
@@ -43,4 +43,26 @@ The following arguments are supported:
* `translated_service` - Translated service.
* `translated_source` - Translated source.
* `auto_generated` - Auto generated.
-* `comments` - Comments string.
\ No newline at end of file
+* `comments` - Comments string.
+* `hits` - Hits count object.hits blocks are documented below.
+
+
+`hits` supports the following:
+
+* `first_date` - N/A.first_date blocks are documented below.
+* `last_date` - N/A.last_date blocks are documented below.
+* `level` - N/A.
+* `percentage` - N/A.
+* `value` - N/A.
+
+
+`first_date` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
+
+
+`last_date` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
diff --git a/website/docs/d/checkpoint_management_nat_rulebase.html.markdown b/website/docs/d/checkpoint_management_nat_rulebase.html.markdown
index b17e237f..8cca3d2a 100644
--- a/website/docs/d/checkpoint_management_nat_rulebase.html.markdown
+++ b/website/docs/d/checkpoint_management_nat_rulebase.html.markdown
@@ -31,6 +31,7 @@ The following arguments are supported:
* `dereference_group_members` - Indicates whether to dereference "members" field by details level for every object in
reply.
* `show_membership` - Indicates whether to calculate and show "groups" field for every object in reply.
+* `objects_dictionary` - Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Standard level.
`filter_settings` supports the following:
diff --git a/website/docs/d/checkpoint_management_nozomi_data_center_server.html.markdown b/website/docs/d/checkpoint_management_nozomi_data_center_server.html.markdown
index a50e8d8b..4d2738a0 100644
--- a/website/docs/d/checkpoint_management_nozomi_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_nozomi_data_center_server.html.markdown
@@ -37,3 +37,12 @@ The following arguments are supported:
* `tags` - (Computed) Collection of tag objects identified by the name or UID.
* `color` - (Computed) Color of the object.
* `comments` - (Computed) Comments string.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_nuage_data_center_server.html.markdown b/website/docs/d/checkpoint_management_nuage_data_center_server.html.markdown
index da6e1a4a..0c03b9b7 100644
--- a/website/docs/d/checkpoint_management_nuage_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_nuage_data_center_server.html.markdown
@@ -34,3 +34,12 @@ The following arguments are supported:
* `name` - (Optional) Object name.
* `uid` - (Optional) Object unique identifier.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_openstack_data_center_server.html.markdown b/website/docs/d/checkpoint_management_openstack_data_center_server.html.markdown
index f970faf2..99e116b8 100644
--- a/website/docs/d/checkpoint_management_openstack_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_openstack_data_center_server.html.markdown
@@ -30,3 +30,12 @@ The following arguments are supported:
* `name` - (Optional) Object name.
* `uid` - (Optional) Object unique identifier.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_outbound_inspection_certificate.html.markdown b/website/docs/d/checkpoint_management_outbound_inspection_certificate.html.markdown
index 2d1d52a5..5f89aa03 100644
--- a/website/docs/d/checkpoint_management_outbound_inspection_certificate.html.markdown
+++ b/website/docs/d/checkpoint_management_outbound_inspection_certificate.html.markdown
@@ -41,4 +41,6 @@ The following arguments are supported:
* `tags` - Collection of tag identifiers.tags blocks are documented below.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
+* `public_key_algorithm` - Public key algorithm and size of the outbound certificate.
+* `subject` - Certificate's subject.
diff --git a/website/docs/d/checkpoint_management_override_categorization.html.markdown b/website/docs/d/checkpoint_management_override_categorization.html.markdown
index 33acf6b5..551e6262 100644
--- a/website/docs/d/checkpoint_management_override_categorization.html.markdown
+++ b/website/docs/d/checkpoint_management_override_categorization.html.markdown
@@ -36,4 +36,5 @@ The following arguments are supported:
* `additional_categories` - Uid or name of the categories to override in the Application and URL Filtering or Threat Prevention.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
+* `comment` - Comment for the categorization override.
diff --git a/website/docs/d/checkpoint_management_policy_settings.html.markdown b/website/docs/d/checkpoint_management_policy_settings.html.markdown
index be265cac..16125ea0 100644
--- a/website/docs/d/checkpoint_management_policy_settings.html.markdown
+++ b/website/docs/d/checkpoint_management_policy_settings.html.markdown
@@ -25,10 +25,12 @@ The following arguments are supported:
* `last_in_cell` - Added object after removing the last object in cell.
* `none_object_behavior` - 'None' object behavior. Rules with object 'None' will never be matched.
* `security_access_defaults` - Access Policy default values. security_accesses_defaults blocks are documented below.
+* `log_generation` - Log generation settings for existing and new rules.
`security_access_defaults` supports the following:
* `destination` - Destination default value identified by name.
* `service` - Service and Applications default value identified by name.
-* `source` - Source default value identified by name.
\ No newline at end of file
+* `source` - Source default value identified by name.
+* `track` - Track default value identified by name.
\ No newline at end of file
diff --git a/website/docs/d/checkpoint_management_proxmox_data_center_server.html.markdown b/website/docs/d/checkpoint_management_proxmox_data_center_server.html.markdown
index 21eaebbb..74dcc9cd 100644
--- a/website/docs/d/checkpoint_management_proxmox_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_proxmox_data_center_server.html.markdown
@@ -46,4 +46,10 @@ The following arguments are supported:
`properties` supports the following:
* `name`
-* `value`
\ No newline at end of file
+* `value`
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_resource_ftp.html.markdown b/website/docs/d/checkpoint_management_resource_ftp.html.markdown
index c9030fd8..716f3bbc 100644
--- a/website/docs/d/checkpoint_management_resource_ftp.html.markdown
+++ b/website/docs/d/checkpoint_management_resource_ftp.html.markdown
@@ -45,6 +45,7 @@ The following arguments are supported:
* `tags` - Collection of tag identifiers.tags blocks are documented below.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
+* `resource_path` - Refers to a location on the FTP server.
`cvp` supports the following:
@@ -53,3 +54,4 @@ The following arguments are supported:
* `server` - The UID or Name of the CVP server, make sure the CVP server is already be defined as an OPSEC Application.
* `allowed_to_modify_content` - Configures the CVP server to inspect but not modify content.
* `reply_order` - Designates when the CVP server returns data to the Security Gateway security server.
+* `cvp_server_is_allowed_to_modify_content` - Configures the CVP server to inspect but not modify content.
diff --git a/website/docs/d/checkpoint_management_resource_smtp.html.markdown b/website/docs/d/checkpoint_management_resource_smtp.html.markdown
index 5bfc2b8f..2540e6bd 100644
--- a/website/docs/d/checkpoint_management_resource_smtp.html.markdown
+++ b/website/docs/d/checkpoint_management_resource_smtp.html.markdown
@@ -103,6 +103,7 @@ The following arguments are supported:
* `server` - The UID or Name of the CVP server, make sure the CVP server is already be defined as an OPSEC Application.
* `allowed_to_modify_content` - Configures the CVP server to inspect but not modify content.
* `reply_order` - Designates when the CVP server returns data to the Security Gateway security server.
+* `cvp_server_is_allowed_to_modify_content` - Configures the CVP server to inspect but not modify content.
`sender` supports the following:
diff --git a/website/docs/d/checkpoint_management_resource_tcp.html.markdown b/website/docs/d/checkpoint_management_resource_tcp.html.markdown
index a3bdad0c..201f114a 100644
--- a/website/docs/d/checkpoint_management_resource_tcp.html.markdown
+++ b/website/docs/d/checkpoint_management_resource_tcp.html.markdown
@@ -50,3 +50,4 @@ The following arguments are supported:
The CVP server must already be defined as an OPSEC Application.
* `allowed_to_modify_content` - Configures the CVP server to inspect but not modify content.
* `reply_order` - Designates when the CVP server returns data to the Security Gateway security server.
+* `cvp_server_is_allowed_to_modify_content` - Configures the CVP server to inspect but not modify content.
diff --git a/website/docs/d/checkpoint_management_resource_uri.html.markdown b/website/docs/d/checkpoint_management_resource_uri.html.markdown
index 2e87ba62..05a76570 100644
--- a/website/docs/d/checkpoint_management_resource_uri.html.markdown
+++ b/website/docs/d/checkpoint_management_resource_uri.html.markdown
@@ -130,6 +130,7 @@ The following arguments are supported:
* `reply_order` - Designates when the CVP server returns data to the Security Gateway security server.
* `send_http_request_to_cvp` - Used to protect against undesirable content in the HTTP request, for example, when inspecting peer-to-peer connections.
* `send_only_unsafe_file_types` - Improves the performance of the CVP server. This option does not send to the CVP server traffic that is considered safe.
+* `cvp_server_is_allowed_to_modify_content` - Configures the CVP server to inspect but not modify content.
`soap` supports the following:
diff --git a/website/docs/d/checkpoint_management_server_certificate.html.markdown b/website/docs/d/checkpoint_management_server_certificate.html.markdown
index 530f55fa..d5e9239a 100644
--- a/website/docs/d/checkpoint_management_server_certificate.html.markdown
+++ b/website/docs/d/checkpoint_management_server_certificate.html.markdown
@@ -38,3 +38,5 @@ The following arguments are supported:
* `subject` - Certificate's subject.
* `valid_from` - Server certificate valid from date.
* `valid_to` - Server certificate valid up to date.
+* `base64_public_certificate` - Public Certificate file encoded in base64 (pem format).
+* `issued_by` - The DN (Distinguished Name) of the certificate.
diff --git a/website/docs/d/checkpoint_management_service_citrix_tcp.html.markdown b/website/docs/d/checkpoint_management_service_citrix_tcp.html.markdown
index 629b5e22..d1245701 100644
--- a/website/docs/d/checkpoint_management_service_citrix_tcp.html.markdown
+++ b/website/docs/d/checkpoint_management_service_citrix_tcp.html.markdown
@@ -33,4 +33,5 @@ The following arguments are supported:
* `application` - Citrix application name.
* `tags` - Collection of tag identifiers.
* `color` - Color of the object.
-* `comments` - Comments string.
\ No newline at end of file
+* `comments` - Comments string.
+* `port` - Service port.
\ No newline at end of file
diff --git a/website/docs/d/checkpoint_management_service_compound_tcp.html.markdown b/website/docs/d/checkpoint_management_service_compound_tcp.html.markdown
index ca509a4c..bf911b61 100644
--- a/website/docs/d/checkpoint_management_service_compound_tcp.html.markdown
+++ b/website/docs/d/checkpoint_management_service_compound_tcp.html.markdown
@@ -36,3 +36,4 @@ The following arguments are supported:
* `tags` - Collection of tag identifiers.
* `color` - Color of the object.
* `comments` - Comments string.
+* `port` - Service port.
diff --git a/website/docs/d/checkpoint_management_servicenow_cmdb_data_center_server.html.markdown b/website/docs/d/checkpoint_management_servicenow_cmdb_data_center_server.html.markdown
index 50ebaa41..7ac4bb4a 100644
--- a/website/docs/d/checkpoint_management_servicenow_cmdb_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_servicenow_cmdb_data_center_server.html.markdown
@@ -37,3 +37,12 @@ The following arguments are supported:
* `tags` - (Computed) Collection of tag objects identified by the name or UID.
* `color` - (Computed) Color of the object.
* `comments` - (Computed) Comments string.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_simple_cluster.html.markdown b/website/docs/d/checkpoint_management_simple_cluster.html.markdown
index ca98f5d6..5f7e0314 100644
--- a/website/docs/d/checkpoint_management_simple_cluster.html.markdown
+++ b/website/docs/d/checkpoint_management_simple_cluster.html.markdown
@@ -77,13 +77,32 @@ The following arguments are supported:
* `vpn` - VPN blade enabled.
* `vpn_settings` - Gateway VPN settings.vpn_settings blocks are documented below.
* `zero_phishing` - Zero Phishing blade enabled.
-* `zero_phishing_fqdn` - Zero Phishing gateway FQDN.
+* `zero_phishing_fqdn` - Zero Phishing gateway FQDN. **Deprecated** - use `zero_phishing_settings.manual_fqdn` instead.
* `show_portals_certificate` - Indicates whether to show the portals certificate value in the reply.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
* `groups` - Collection of group identifiers.groups blocks are documented below.
* `ignore_warnings` - Apply changes ignoring warnings.
* `ignore_errors` - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `anti_spam_and_email_security` - Anti-Spam & Email-Security blade enabled.
+* `auto_topology_custom_recalculation_time` - Auto topology custom recalculation time (seconds).
+* `auto_topology_use_custom_recalculation_time` - Auto topology to use custom recalculation time instead of default.
+* `autonomous_system_number` - The Autonomous System Number (ASN) for this Check Point Security Gateway.
+* `cluster_xl` - Cluster XL blade enabled.
+* `communication_with_servers_behind_nat` - Gateway behind NAT communications settings with the server.communication_with_servers_behind_nat blocks are documented below.
+* `data_loss_prevention` - Data Loss Prevention.
+* `dns_server` - DNS Server.
+* `hardware_subtype` - Gateway type (relevant only for Spark gateways).
+* `legacy_url_filtering` - Legacy URL Filtering enabled.
+* `mobile_access` - Mobile-Access blade enabled.
+* `monitoring` - Monitoring blade enabled.
+* `policy_server` - Policy-Server blade enabled.
+* `rtm_counters_report` - Enables monitoring blades system counters report (e.g CPU Usage,Memory Usage).
+* `rtm_traffic_report` - Enables monitoring blades traffic report.
+* `rtm_traffic_report_per_connection` - Enables Monitoring blade traffic report per connection.
+* `smb_logs_settings` - Logs settings that apply to Quantum Spark Appliances that run Gaia Embedded OS.smb_logs_settings blocks are documented below.
+* `workforce_ai` - Workforce AI Security blade enabled. Requires content awareness blade and version R82.20 or higher to be enabled.
+* `zero_phishing_settings` - Fqdn settings.zero_phishing_settings blocks are documented below.
`advanced_settings` supports the following:
@@ -125,6 +144,10 @@ The following arguments are supported:
* `deny_untrusted_server_cert` - Set to be true in order to drop traffic from servers with untrusted server certificate.deny_untrusted_server_cert blocks are documented below.
* `deny_revoked_server_cert` - Set to be true in order to drop traffic from servers with revoked server certificate (validate CRL).deny_revoked_server_cert blocks are documented below.
* `deny_expired_server_cert` - Set to be true in order to drop traffic from servers with expired server certificate.deny_expired_server_cert blocks are documented below.
+* `bypass_on_client_failure` - Bypass HTTPS inspection on client failure.bypass_on_client_failure blocks are documented below.
+* `bypass_under_load` - Bypass HTTPS inspection under load.bypass_under_load blocks are documented below.
+* `deployment_mode` - HTTPS inspection deployment mode.
+* `outbound_certificate` - Outbound HTTPS inspection certificate.outbound_certificate blocks are documented below.
`identity_awareness_settings` supports the following:
@@ -138,6 +161,13 @@ The following arguments are supported:
* `identity_sharing_settings` - Identity sharing settings.identity_sharing_settings blocks are documented below.
* `proxy_settings` - Identity-Awareness Proxy settings.proxy_settings blocks are documented below.
* `remote_access` - Enable Remote Access Identity source.
+* `ad_query` - AD Query source enabled.
+* `collecting_identities` - This gateway collects identities.
+* `identity_based_enforcement` - Configures this object as a PEP-only object - identity-based enforcement (PEP).
+* `identity_web_api` - Identity Web API source enabled.
+* `identity_web_api_settings` - Identity Web API settings.identity_web_api_settings blocks are documented below.
+* `radius_accounting` - Radius Accounting source enabled.
+* `terminal_servers` - Terminal Servers source enabled.
`interfaces` supports the following:
@@ -203,6 +233,7 @@ The following arguments are supported:
* `hide_behind` - Hide behind method. This parameter is forbidden in case "method" parameter is "static".
* `install_on` - Which gateway should apply the NAT translation.
* `method` - NAT translation method.
+* `apply_control_connections` - This option performs NAT on VPN control connections to and from this object.
`platform_portal_settings` supports the following:
@@ -210,6 +241,7 @@ The following arguments are supported:
* `portal_web_settings` - Configuration of the portal web settings.portal_web_settings blocks are documented below.
* `certificate_settings` - Configuration of the portal certificate settings.certificate_settings blocks are documented below.
* `accessibility` - Configuration of the portal access settings.accessibility blocks are documented below.
+* `enabled` - State of the web portal (enabled or disabled).
`proxy_settings` supports the following:
@@ -239,6 +271,14 @@ The following arguments are supported:
* `vpn_domain` - Gateway VPN domain identified by the name or UID.
* `vpn_domain_exclude_external_ip_addresses` - Exclude the external IP addresses from the VPN domain of this Security Gateway.
* `vpn_domain_type` - Gateway VPN domain type.
+* `advanced` - Advanced VPN settings.advanced blocks are documented below.
+* `certificates` - VPN certificates.certificates blocks are documented below.
+* `clientless_vpn_settings` - Clientless VPN settings.clientless_vpn_settings blocks are documented below.
+* `enable_clientless_vpn` - Enable clientless VPN.
+* `exported_routes` - Exported routes.exported_routes blocks are documented below.
+* `interfaces` - VPN link selection interfaces.interfaces blocks are documented below.
+* `saml_portal_settings` - SAML portal settings.saml_portal_settings blocks are documented below.
+* `vpn_clients` - VPN clients settings.vpn_clients blocks are documented below.
`sam` supports the following:
@@ -266,30 +306,35 @@ The following arguments are supported:
* `override_profile` - Override profile of global configuration.
* `value` - Override value.
Required only for 'override-profile' is True.
+* `profile_value` - The value inherited from the profile.
`site_categorization_allow_mode` supports the following:
* `override_profile` - Override profile of global configuration.
* `value` - Override value.
Required only for 'override-profile' is True.
+* `profile_value` - The value inherited from the profile.
`deny_untrusted_server_cert` supports the following:
* `override_profile` - Override profile of global configuration.
* `value` - Override value.
Required only for 'override-profile' is True.
+* `profile_value` - The value inherited from the profile.
`deny_revoked_server_cert` supports the following:
* `override_profile` - Override profile of global configuration.
* `value` - Override value.
Required only for 'override-profile' is True.
+* `profile_value` - The value inherited from the profile.
`deny_expired_server_cert` supports the following:
* `override_profile` - Override profile of global configuration.
* `value` - Override value.
Required only for 'override-profile' is True.
+* `profile_value` - The value inherited from the profile.
`browser_based_authentication_settings` supports the following:
@@ -318,6 +363,10 @@ The following arguments are supported:
* `share_with_other_gateways` - Enable identity sharing with other gateways.
* `receive_from_other_gateways` - Enable receiving identity from other gateways.
* `receive_from` - Gateway(s) to receive identity from.receive_from blocks are documented below.
+* `cache_mode` - Identity cache mode.cache_mode blocks are documented below.
+* `cache_mode_duration` - Identity cache mode duration.cache_mode_duration blocks are documented below.
+* `receive_from_infinity_identity` - Whether to receive identities from Infinity Identity.
+* `scaled_sharing` - Whether scaled identity sharing is enabled.
`proxy_settings` supports the following:
@@ -373,13 +422,17 @@ The following arguments are supported:
* `aliases` - List of URL aliases that are redirected to the main portal URL.aliases blocks are documented below.
* `main_url` - The main URL for the web portal.
+* `ip_address` - Optional IP address to be used for the portal URL.
`certificate_settings` supports the following:
* `base64_certificate` - The certificate file encoded in Base64 with padding.
This file must be in the *.p12 format.
-* `base64_password` - Password (encoded in Base64 with padding) for the certificate file.
+* `certificate` - The certificate.
+* `certificate_dn` - The certificate distinguished name.
+* `certificate_valid_from` - The date from which the certificate is valid.
+* `certificate_valid_to` - The date until which the certificate is valid.
`accessibility` supports the following:
@@ -392,13 +445,17 @@ The following arguments are supported:
* `aliases` - List of URL aliases that are redirected to the main portal URL.aliases blocks are documented below.
* `main_url` - The main URL for the web portal.
+* `ip_address` - Optional: IP address for the web portal to use, if your DNS server fails to resolve the main portal URL. Note: If your DNS server resolves the main po...
`certificate_settings` supports the following:
* `base64_certificate` - The certificate file encoded in Base64 with padding.
This file must be in the *.p12 format.
-* `base64_password` - Password (encoded in Base64 with padding) for the certificate file.
+* `certificate` - The certificate.
+* `certificate_dn` - The DN (Distinguished Name) of the certificate.
+* `certificate_valid_from` - The date, from which the certificate is valid.
+* `certificate_valid_to` - The certificate expiration date.
`accessibility` supports the following:
@@ -410,11 +467,21 @@ The following arguments are supported:
`authentication` supports the following:
* `authentication_clients` - Collection of VPN Authentication clients identified by the name or UID.authentication_clients blocks are documented below.
+* `dynamic_id_settings` - Dynamic ID settings, relevant only when "override-global-dynamic-id-settings" is true.dynamic_id_settings blocks are documented below.
+* `override_global_dynamic_id_settings` - Override global dynamic ID settings.
+* `send_machine_certificate` - Configure when to send machine certificate.
+* `single_authentication_client` - Settings for clients that support only single authentication method.single_authentication_client blocks are documented below.
`link_selection` supports the following:
* `dns_resolving_hostname` - DNS Resolving Hostname. Must be set when "ip-selection" was selected to be "dns-resolving-from-hostname".
+* `outgoing_link_tracking` - Outgoing link tracking method.
+* `probing_settings` - Probing settings configuration. Only available when "ip-selection" is "use-probing-with-high-availability" or "use-probing-with-load-sharing".probing_settings blocks are documented below.
+* `responding_traffic` - Responding traffic route selection method.
+* `route_selection_method` - Outgoing route selection method when initiating a tunnel.
+* `selected_ip` - Selected IP address. Must be set when "source-ip-selection" was selected to be "manual".
+* `source_ip_selection` - Source IP address selection method for outgoing traffic.
`office_mode` supports the following:
@@ -495,12 +562,13 @@ The following arguments are supported:
`identity_agent_portal_settings` supports the following:
* `accessibility` - Configuration of the portal access settings.accessibility blocks are documented below.
+* `certificate_settings` - Configuration of the portal certificate.certificate_settings blocks are documented below.
+* `portal_web_settings` - Configuration of the portal web settings.portal_web_settings blocks are documented below.
`authorized_clients` supports the following:
* `client` - Host / Network Group Name or UID.
-* `client_secret` - Client Secret.
`authentication_settings` supports the following:
@@ -511,6 +579,8 @@ The following arguments are supported:
`client_access_permissions` supports the following:
* `accessibility` - Configuration of the portal access settings.accessibility blocks are documented below.
+* `certificate_settings` - Configuration of the portal certificate.certificate_settings blocks are documented below.
+* `portal_web_settings` - Configuration of the portal web settings.portal_web_settings blocks are documented below.
`anti_spoofing_settings` supports the following:
@@ -583,13 +653,17 @@ The following arguments are supported:
* `aliases` - List of URL aliases that are redirected to the main portal URL.aliases blocks are documented below.
* `main_url` - The main URL for the web portal.
+* `ip_address` - Optional: IP address for the web portal to use, if your DNS server fails to resolve the main portal URL. Note: If your DNS server resolves the main po...
`certificate_settings` supports the following:
* `base64_certificate` - The certificate file encoded in Base64 with padding.
This file must be in the *.p12 format.
-* `base64_password` - Password (encoded in Base64 with padding) for the certificate file.
+* `certificate` - The certificate.
+* `certificate_dn` - The DN (Distinguished Name) of the certificate.
+* `certificate_valid_from` - The date, from which the certificate is valid.
+* `certificate_valid_to` - The certificate expiration date.
`accessibility` supports the following:
@@ -668,3 +742,371 @@ The following arguments are supported:
* `undefined` - Controls portal access settings for internal interfaces, whose topology is set to 'Undefined'.
* `dmz` - Controls portal access settings for internal interfaces, whose topology is set to 'DMZ'.
* `vpn` - Controls portal access settings for interfaces that are part of a VPN Encryption Domain.
+
+
+`logs_settings` supports the following:
+
+* `distribute_logs_between_all_active_servers` - Distribute logs between all active servers.
+* `include_tcp_state_information` - Include TCP state information. Relevant only when Firewall blade is enabled.
+
+
+`application_control_and_url_filtering_settings` supports the following:
+
+* `global_settings_mode` - Whether to override global settings or not.
+* `override_global_settings` - override global settings object.override_global_settings blocks are documented below.
+
+
+`override_global_settings` supports the following:
+
+* `fail_mode` - Fail mode - allow or block all requests.
+* `website_categorization` - Website categorization object.website_categorization blocks are documented below.
+
+
+`website_categorization` supports the following:
+
+* `custom_mode` - Custom mode object.custom_mode blocks are documented below.
+* `mode` - Website categorization mode.
+
+
+`custom_mode` supports the following:
+
+* `social_networking_widgets` - Social networking widgets mode.
+* `url_filtering` - URL filtering mode.
+
+
+`cluster_settings` supports the following:
+
+* `member_recovery_mode` - In a High Availability cluster, each member is given a priority. The member with the highest priority serves as the gateway. If this gateway fails, co...
+* `state_synchronization` - Cluster State Synchronization settings.state_synchronization blocks are documented below.
+* `track_changes_of_cluster_members` - Track changes in the status of Cluster Members.
+* `use_virtual_mac` - Use Virtual MAC. By enabling Virtual MAC in ClusterXL High Availability New mode, or Load Sharing Unicast mode, all cluster members associate the same...
+
+
+`state_synchronization` supports the following:
+
+* `delayed` - Start synchronizing with delay of seconds, as defined by delayed-seconds, after connection initiation. Disabled when state-synchronization disabled.
+* `delayed_seconds` - Start synchronizing X seconds after connection initiation . The values must be in a range between 2 and 3600.
+* `enabled` - Use State Synchronization.
+
+
+`communication_with_servers_behind_nat` supports the following:
+
+* `override_profile` - Whether to override the Server (Check Point Host) object configuration.
+* `value` - according-to-topology: Use the original or translated IP address of the server based on the Topology of Security Gateway interfaces.
original-ip-on...
+
+
+`bypass_on_client_failure` supports the following:
+
+* `override_profile` - Whether to override the value inherited from the profile.
+* `profile_value` - The value inherited from the profile.
+* `value` - Whether to bypass on client failure.
+
+
+`bypass_under_load` supports the following:
+
+* `value` - Whether to bypass under load.
+
+
+`outbound_certificate` supports the following:
+
+* `override_profile` - Whether to override the value inherited from the profile.
+* `profile_value` - The value inherited from the profile.
+* `value` - Outbound certificate identified by the name or UID.
+
+
+`certificate_settings` supports the following:
+
+* `certificate` - The certificate.
+* `certificate_dn` - The certificate distinguished name.
+* `certificate_valid_from` - The date from which the certificate is valid.
+* `certificate_valid_to` - The date until which the certificate is valid.
+
+
+`portal_web_settings` supports the following:
+
+* `aliases` - List of URL aliases that are redirected to the main portal URL.
+* `ip_address` - Optional IP address to be used for the portal URL.
+* `main_url` - The main URL for the portal.
+
+
+`certificate_settings` supports the following:
+
+* `certificate` - The certificate.
+* `certificate_dn` - The certificate distinguished name.
+* `certificate_valid_from` - The date from which the certificate is valid.
+* `certificate_valid_to` - The date until which the certificate is valid.
+
+
+`portal_web_settings` supports the following:
+
+* `aliases` - List of URL aliases that are redirected to the main portal URL.
+* `ip_address` - Optional IP address to be used for the portal URL.
+* `main_url` - The main URL for the portal.
+
+
+`cache_mode` supports the following:
+
+* `override_profile` - Whether to override the value inherited from the profile.
+* `profile_value` - The value inherited from the profile.
+* `value` - Whether the identity cache is enabled.
+
+
+`cache_mode_duration` supports the following:
+
+* `override_profile` - Whether to override the value inherited from the profile.
+* `profile_value` - The duration inherited from the profile, in minutes.
+* `value` - Identity cache duration in minutes.
+
+
+`identity_web_api_settings` supports the following:
+
+* `authentication_settings` - Authentication settings for Identity Web API.authentication_settings blocks are documented below.
+* `authorized_clients` - Authorized clients.authorized_clients blocks are documented below.
+* `client_access_permissions` - Identity Web API accessibility settings.client_access_permissions blocks are documented below.
+
+
+`authentication_settings` supports the following:
+
+* `users_directories` - Users directories.users_directories blocks are documented below.
+
+
+`users_directories` supports the following:
+
+* `external_user_profile` - External user profile.
+* `internal_users` - Internal users.
+* `specific` - LDAP AU objects identified by the name or UID.
+* `users_from_external_directories` - Users from external directories.
+
+
+`authorized_clients` supports the following:
+
+* `client` - Host / Network Group Name or UID.
+
+
+`client_access_permissions` supports the following:
+
+* `accessibility` - Configuration of the portal access settings.accessibility blocks are documented below.
+* `certificate_settings` - Configuration of the portal certificate.certificate_settings blocks are documented below.
+* `portal_web_settings` - Configuration of the portal web settings.portal_web_settings blocks are documented below.
+
+
+`accessibility` supports the following:
+
+* `allow_access_from` - Allowed access to the web portal (based on interfaces, or security policy).
+* `internal_access_settings` - Configuration of the additional portal access settings for internal interfaces only.internal_access_settings blocks are documented below.
+
+
+`internal_access_settings` supports the following:
+
+* `dmz` - Controls portal access settings for internal interfaces, whose topology is set to "DMZ".
+* `undefined` - Controls portal access settings for internal interfaces, whose topology is set to "Undefined".
+* `vpn` - Controls portal access settings for interfaces that are part of a VPN Encryption Domain.
+
+
+`certificate_settings` supports the following:
+
+* `certificate` - The certificate.
+* `certificate_dn` - The certificate distinguished name.
+* `certificate_valid_from` - The date from which the certificate is valid.
+* `certificate_valid_to` - The date until which the certificate is valid.
+
+
+`portal_web_settings` supports the following:
+
+* `aliases` - List of URL aliases that are redirected to the main portal URL.
+* `ip_address` - Optional IP address to be used for the portal URL.
+* `main_url` - The main URL for the portal.
+
+
+`smb_logs_settings` supports the following:
+
+* `alert_when_queue_is_full` - Alert when queue is full enabled.
+* `alert_when_queue_is_full_type` - Alert when queue is full type.
+* `detect_new_citrix_ica_application_names` - Detect new citrix ica application names enabled.
+* `stop_logging_when_queue_reaches_maximal_capacity` - Stop logging when queue reaches maximal capacity enabled.
+* `stop_logging_when_queue_reaches_maximal_capacity_threshold` - Stop logging when queue reaches maximal capacity threshold.
+* `turn_on_qos_logging` - Turn on qos logging enabled.
+* `update_account_log_every` - Update account log in every amount of seconds.
+
+
+`advanced` supports the following:
+
+* `enable_nat_traversal` - Enable NAT traversal.
+* `enable_wire_mode` - Enable wire mode.
+* `enable_wire_mode_log_traffic` - Log traffic in wire mode.
+* `shutdown_on_gateway_restart` - Shutdown VPN tunnels on gateway restart.
+* `tunnel_sharing_mode` - Tunnel sharing mode.
+* `wire_mode_interfaces` - Wire mode interfaces.
+
+
+`dynamic_id_settings` supports the following:
+
+* `advanced_settings` - Advanced Dynamic ID configuration settings.advanced_settings blocks are documented below.
+* `sms_provider_and_email_settings` - SMS provider and email configuration.
+* `sms_provider_credentials` - SMS provider credentials configuration.sms_provider_credentials blocks are documented below.
+
+
+`advanced_settings` supports the following:
+
+* `country_code` - Country code for SMS services.
+* `dynamic_id_message` - Dynamic ID message displayed to users.
+* `enable_display_user_details` - Enable display of user details.
+* `otp_settings` - One Time Password configuration settings.otp_settings blocks are documented below.
+* `user_details_retrieval` - User details retrieval method.
+
+
+`otp_settings` supports the following:
+
+* `expiration` - One time password expiration (in minutes).
+* `length` - Length of one time password.
+* `max_attempts` - Number of times users can attempt to enter the one time password before the entire authentication process restarts.
+
+
+`sms_provider_credentials` supports the following:
+
+* `api_id` - SMS provider API ID.
+* `username` - SMS provider username.
+
+
+`single_authentication_client` supports the following:
+
+* `allow_multiple_authentication_clients` - Allow clients that support multiple authentication methods to connect.
+* `client_display_settings` - Client display configuration settings.client_display_settings blocks are documented below.
+* `display_name` - Display name for the authentication method.
+* `enabled` - Allow clients that support only single authentication method.
+* `method` - Authentication method type.
+* `personal_certificate` - Personal certificate authentication settings, relevant only when method is "personal-certificate".personal_certificate blocks are documented below.
+* `radius` - RADIUS authentication settings, relevant only when method is "radius".radius blocks are documented below.
+* `secur_id` - SecurID authentication settings, relevant only when method is "secur-id".secur_id blocks are documented below.
+
+
+`client_display_settings` supports the following:
+
+* `headline` - Display headline for authentication dialog.
+* `password_label` - Label for password field.
+* `username_label` - Label for username field.
+
+
+`personal_certificate` supports the following:
+
+* `dn_concurrence` - DN part occurrence number.
+* `dn_part` - DN part to extract.
+* `fetch_username_from` - Fetch username from.
+* `source` - Certificate source field.
+* `storage_type` - Certificate storage type.
+
+
+`radius` supports the following:
+
+* `ask_user_password` - Ask user for password during authentication.
+* `server` - Server object identified by the name or UID.
+
+
+`secur_id` supports the following:
+
+* `server` - Server object identified by the name or UID.
+* `token_card_type` - Token card type.
+
+
+`certificates` supports the following:
+
+* `base64_certificate` - The certificate encoded in Base64.
+* `certificate_authority` - Certificate authority identified by the name or UID.
+* `distinguished_name` - Certificate distinguished name.
+* `expiration_date` - Certificate expiration date.expiration_date blocks are documented below.
+* `name` - Certificate name.
+* `status` - Certificate status.
+* `stored_at` - Where the certificate is stored.
+
+
+`expiration_date` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
+
+
+`clientless_vpn_settings` supports the following:
+
+* `accept_only_3des` - Accept only 3DES.
+* `certificate_gateway_authentication` - Certificate gateway authentication.
+* `client_authentication` - Client authentication.
+* `concurrent_servers_or_processes` - Number of concurrent servers or processes.
+
+
+`exported_routes` supports the following:
+
+* `custom_routes` - Export custom routes.
+* `custom_routes_object` - Custom routes object identified by the name or UID.
+* `internal_interfaces` - Export internal interfaces.
+* `static_routes` - Export static routes.
+
+
+`interfaces` supports the following:
+
+* `interface_name` - The name of the interface.
+* `ip_version` - The IP version of the interface's IP address.
+* `next_hop_ip` - The IP address of the next hop.
+* `priority` - Priority of a "Backup" interface.
+* `redundancy_mode` - Interface redundancy mode (Active/Backup).
+* `static_nat_ip` - The NATed IPv4 address that hides the source IPv4 address of outgoing connections.
+
+
+`probing_settings` supports the following:
+
+* `primary_address` - Primary IP address to use. Must be one of the addresses from "probed-interface-list". Required when "use-primary-address" is true.
+* `probed_interface_list` - List of specific IP addresses to probe. Only relevant when "probed-interfaces" is set to "specific".
+* `probed_interfaces` - Specifies whether to probe all addresses defined in the topology tab or specific addresses.
+* `probing_method` - Probing method.
+* `use_primary_address` - Whether to use a primary address for high availability probing.
+
+
+`saml_portal_settings` supports the following:
+
+* `accessibility` - Configuration of the portal access settings.accessibility blocks are documented below.
+* `certificate_settings` - Configuration of the SAML portal certificate.certificate_settings blocks are documented below.
+* `enabled` - Whether the SAML portal is enabled.
+* `portal_web_settings` - Configuration of the SAML portal web settings.portal_web_settings blocks are documented below.
+
+
+`accessibility` supports the following:
+
+* `allow_access_from` - Allowed access to the SAML portal.
+* `internal_access_settings` - Configuration of the additional portal access settings for internal interfaces only.internal_access_settings blocks are documented below.
+
+
+`internal_access_settings` supports the following:
+
+* `dmz` - Controls portal access settings for internal interfaces, whose topology is set to "DMZ".
+* `undefined` - Controls portal access settings for internal interfaces, whose topology is set to "Undefined".
+* `vpn` - Controls portal access settings for interfaces that are part of a VPN Encryption Domain.
+
+
+`certificate_settings` supports the following:
+
+* `certificate` - The certificate.
+* `certificate_dn` - The certificate distinguished name.
+* `certificate_valid_from` - The date from which the certificate is valid.
+* `certificate_valid_to` - The date until which the certificate is valid.
+
+
+`portal_web_settings` supports the following:
+
+* `aliases` - List of URL aliases that are redirected to the main portal URL.
+* `ip_address` - Optional IP address to be used for the portal URL.
+* `main_url` - The main URL for the portal.
+
+
+`vpn_clients` supports the following:
+
+* `enable_capsule_vpn_connect` - Enable Capsule VPN Connect client.
+* `enable_cp_mobile_for_windows` - Enable Check Point Mobile for Windows client.
+* `enable_endpoint_security_vpn` - Enable Endpoint Security VPN client.
+* `enable_secu_remote` - Enable SecuRemote client.
+* `enable_ssl_network_extender` - Enable SSL Network Extender client.
+* `gateway_authentication_certificate` - Gateway authentication certificate.
+
+
+`zero_phishing_settings` supports the following:
+
+* `gateway_fqdn_mode` - Manual Fqdn.
+* `manual_fqdn` - Zero Phishing gateway FQDN.
diff --git a/website/docs/d/checkpoint_management_simple_gateway.html.markdown b/website/docs/d/checkpoint_management_simple_gateway.html.markdown
index ba3e2a1b..10e282ef 100644
--- a/website/docs/d/checkpoint_management_simple_gateway.html.markdown
+++ b/website/docs/d/checkpoint_management_simple_gateway.html.markdown
@@ -55,7 +55,6 @@ The following arguments are supported:
* `ips_update_policy` - Specifies whether the IPS will be downloaded from the Management or directly to the Gateway.
* `nat_hide_internal_interfaces` - Hide internal networks behind the Gateway's external IP.
* `nat_settings` - NAT settings.nat_settings blocks are documented below.
-* `one_time_password` - N/A
* `os_name` - Gateway platform operating system.
* `platform_portal_settings` - Platform portal settings.platform_portal_settings blocks are documented below.
* `proxy_settings` - Proxy Server for Gateway.proxy_settings blocks are documented below.
@@ -74,13 +73,45 @@ The following arguments are supported:
* `vpn` - VPN blade enabled.
* `vpn_settings` - Gateway VPN settings.vpn_settings blocks are documented below.
* `zero_phishing` - Zero Phishing blade enabled.
-* `zero_phishing_fqdn` - Zero Phishing gateway FQDN.
+* `zero_phishing_fqdn` - Zero Phishing gateway FQDN. **Deprecated** - use `zero_phishing_settings.manual_fqdn` instead.
* `logs_settings` - Logs settings that apply to Quantum Security Gateways that run Gaia OS.logs_settings blocks are documented below.
* `show_portals_certificate` - Indicates whether to show the portals certificate value in the reply.
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
* `groups` - Collection of group identifiers.groups blocks are documented below.
* `ignore_errors` - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `accept_syslog_messages` - Enables the gateway accept syslog messages, relevant only when Logging and Status blade is enabled.
+* `anti_spam_and_email_security` - Anti-Spam & Email-Security blade enabled.
+* `auto_generate_ip` - Use an automatically generated IP address for the Gateway object (applies only to Smart-1 Cloud).
+* `auto_topology_custom_recalculation_time` - Auto topology custom recalculation time (seconds).
+* `auto_topology_use_custom_recalculation_time` - Auto topology to use custom recalculation time instead of default.
+* `autonomous_system_number` - The Autonomous System Number (ASN) for this Check Point Security Gateway.
+* `communication_with_servers_behind_nat` - Gateway behind NAT communications settings with the server.communication_with_servers_behind_nat blocks are documented below.
+* `data_loss_prevention` - Data Loss Prevention.
+* `dns_server` - DNS Server.
+* `enable_log_indexing` - Enable log indexing, The Log Indexing uses more storage to provide fast log queries. Relevant only when Logging and Status blade is enabled.
+* `export_logs_to_servers` - Export logs to syslog/SIEM servers. NOTE:After you configure a Log Exporter, you must run Install Database.
+* `externally_managed` - Externally Managed Check Point Gateway.
+* `fetch_policy_scheduler` - Fetch policy functionality settings.fetch_policy_scheduler blocks are documented below.
+* `hardware_subtype` - Gateway type (relevant only for Spark gateways).
+* `install_policy_without_push` - Specifies whether the policy is pushed to the gateway during policy installation, or whether the gateway should fetch the policy.
+* `interfaces_topology_settings` - Topology setting for all interfaces on a Security Gateway. Default for Security Gateways that run Gaia OS: 'per interface'. Default for Quantum Spark ...
+* `legacy_url_filtering` - Legacy URL Filtering enabled.
+* `log_server` - Logging & Status.
+* `mobile_access` - Mobile-Access blade enabled.
+* `monitoring` - Monitoring blade enabled.
+* `network_policy_management` - Management blade enabled.
+* `policy_server` - Policy-Server blade enabled.
+* `rtm_counters_report` - Enables monitoring blades system counters report (e.g CPU Usage,Memory Usage).
+* `rtm_traffic_report` - Enables monitoring blades traffic report.
+* `rtm_traffic_report_per_connection` - Enables Monitoring blade traffic report per connection.
+* `sic_message` - Secure Internal Communication message.
+* `smart_event_intro_correlation_unit` - Enables the gateway use SmartEvent intro correlation unit with one Security Gateway Software Blade, relevant only when Logging and Status blade is ena...
+* `smb_logs_settings` - Logs settings that apply to Quantum Spark Appliances that run Gaia Embedded OS.smb_logs_settings blocks are documented below.
+* `trust_details` - Details for trusted communication.trust_details blocks are documented below.
+* `trust_method` - Trust method that was used for establishing communication.
+* `workforce_ai` - Workforce AI Security blade enabled. Requires content awareness blade and version R82.20 or higher to be enabled.
+* `zero_phishing_settings` - Fqdn settings.zero_phishing_settings blocks are documented below.
`advanced_settings` supports the following:
@@ -112,6 +143,10 @@ The following arguments are supported:
* `deny_untrusted_server_cert` - Set to be true in order to drop traffic from servers with untrusted server certificate.deny_untrusted_server_cert blocks are documented below.
* `deny_revoked_server_cert` - Set to be true in order to drop traffic from servers with revoked server certificate (validate CRL).deny_revoked_server_cert blocks are documented below.
* `deny_expired_server_cert` - Set to be true in order to drop traffic from servers with expired server certificate.deny_expired_server_cert blocks are documented below.
+* `bypass_on_client_failure` - Bypass HTTPS inspection on client failure.bypass_on_client_failure blocks are documented below.
+* `bypass_under_load` - Bypass HTTPS inspection under load.bypass_under_load blocks are documented below.
+* `deployment_mode` - HTTPS inspection deployment mode.
+* `outbound_certificate` - Outbound HTTPS inspection certificate.outbound_certificate blocks are documented below.
`identity_awareness_settings` supports the following:
@@ -125,6 +160,13 @@ The following arguments are supported:
* `identity_sharing_settings` - Identity sharing settings.identity_sharing_settings blocks are documented below.
* `proxy_settings` - Identity-Awareness Proxy settings.proxy_settings blocks are documented below.
* `remote_access` - Enable Remote Access Identity source.
+* `ad_query` - AD Query source enabled.
+* `collecting_identities` - This gateway collects identities.
+* `identity_based_enforcement` - Configures this object as a PEP-only object - identity-based enforcement (PEP).
+* `identity_web_api` - Identity Web API source enabled.
+* `identity_web_api_settings` - Identity Web API settings.identity_web_api_settings blocks are documented below.
+* `radius_accounting` - Radius Accounting source enabled.
+* `terminal_servers` - Terminal Servers source enabled.
`interfaces` supports the following:
@@ -147,6 +189,8 @@ The following arguments are supported:
* `color` - Color of the object. Should be one of existing colors.
* `comments` - Comments string.
* `ignore_errors` - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `dynamic_ip` - Enable dynamic interface.
+* `network_interface_type` - Type of network interface.
`ips_settings` supports the following:
@@ -168,6 +212,7 @@ The following arguments are supported:
* `hide_behind` - Hide behind method. This parameter is forbidden in case "method" parameter is "static".
* `install_on` - Which gateway should apply the NAT translation.
* `method` - NAT translation method.
+* `apply_control_connections` - This option performs NAT on VPN control connections to and from this object.
`platform_portal_settings` supports the following:
@@ -175,6 +220,7 @@ The following arguments are supported:
* `portal_web_settings` - Configuration of the portal web settings.portal_web_settings blocks are documented below.
* `certificate_settings` - Configuration of the portal certificate settings.certificate_settings blocks are documented below.
* `accessibility` - Configuration of the portal access settings.accessibility blocks are documented below.
+* `enabled` - State of the web portal (enabled or disabled).
`proxy_settings` supports the following:
@@ -204,6 +250,14 @@ The following arguments are supported:
* `vpn_domain` - Gateway VPN domain identified by the name or UID.
* `vpn_domain_exclude_external_ip_addresses` - Exclude the external IP addresses from the VPN domain of this Security Gateway.
* `vpn_domain_type` - Gateway VPN domain type.
+* `advanced` - Advanced VPN settings.advanced blocks are documented below.
+* `certificates` - VPN certificates.certificates blocks are documented below.
+* `clientless_vpn_settings` - Clientless VPN settings.clientless_vpn_settings blocks are documented below.
+* `enable_clientless_vpn` - Enable clientless VPN.
+* `exported_routes` - Exported routes.exported_routes blocks are documented below.
+* `interfaces` - VPN link selection interfaces.interfaces blocks are documented below.
+* `saml_portal_settings` - SAML portal settings.saml_portal_settings blocks are documented below.
+* `vpn_clients` - VPN clients settings.vpn_clients blocks are documented below.
`logs_settings` supports the following:
@@ -239,6 +293,8 @@ The following arguments are supported:
* `stop_logging_when_free_disk_space_below_threshold` - Stop logging when free disk space below threshold.
* `turn_on_qos_logging` - Enable turn on QoS Logging.
* `update_account_log_every` - Update account log in every amount of seconds.
+* `alert_when_free_disk_space_below_metrics` - Alert when free disk space below metrics.
+* `include_tcp_state_information` - Include TCP state information. Relevant only when Firewall blade is enabled.
`sam` supports the following:
@@ -258,30 +314,35 @@ The following arguments are supported:
* `override_profile` - Override profile of global configuration.
* `value` - Override value.
Required only for 'override-profile' is True.
+* `profile_value` - The value inherited from the profile.
`site_categorization_allow_mode` supports the following:
* `override_profile` - Override profile of global configuration.
* `value` - Override value.
Required only for 'override-profile' is True.
+* `profile_value` - The value inherited from the profile.
`deny_untrusted_server_cert` supports the following:
* `override_profile` - Override profile of global configuration.
* `value` - Override value.
Required only for 'override-profile' is True.
+* `profile_value` - The value inherited from the profile.
`deny_revoked_server_cert` supports the following:
* `override_profile` - Override profile of global configuration.
* `value` - Override value.
Required only for 'override-profile' is True.
+* `profile_value` - The value inherited from the profile.
`deny_expired_server_cert` supports the following:
* `override_profile` - Override profile of global configuration.
* `value` - Override value.
Required only for 'override-profile' is True.
+* `profile_value` - The value inherited from the profile.
`browser_based_authentication_settings` supports the following:
@@ -310,6 +371,10 @@ The following arguments are supported:
* `share_with_other_gateways` - Enable identity sharing with other gateways.
* `receive_from_other_gateways` - Enable receiving identity from other gateways.
* `receive_from` - Gateway(s) to receive identity from.receive_from blocks are documented below.
+* `cache_mode` - Identity cache mode.cache_mode blocks are documented below.
+* `cache_mode_duration` - Identity cache mode duration.cache_mode_duration blocks are documented below.
+* `receive_from_infinity_identity` - Whether to receive identities from Infinity Identity.
+* `scaled_sharing` - Whether scaled identity sharing is enabled.
`proxy_settings` supports the following:
@@ -342,13 +407,17 @@ The following arguments are supported:
* `aliases` - List of URL aliases that are redirected to the main portal URL.aliases blocks are documented below.
* `main_url` - The main URL for the web portal.
+* `ip_address` - Optional IP address to be used for the portal URL.
`certificate_settings` supports the following:
* `base64_certificate` - The certificate file encoded in Base64 with padding.
This file must be in the *.p12 format.
-* `base64_password` - Password (encoded in Base64 with padding) for the certificate file.
+* `certificate` - The certificate.
+* `certificate_dn` - The certificate distinguished name.
+* `certificate_valid_from` - The date from which the certificate is valid.
+* `certificate_valid_to` - The date until which the certificate is valid.
`accessibility` supports the following:
@@ -361,13 +430,17 @@ The following arguments are supported:
* `aliases` - List of URL aliases that are redirected to the main portal URL.aliases blocks are documented below.
* `main_url` - The main URL for the web portal.
+* `ip_address` - Optional: IP address for the web portal to use, if your DNS server fails to resolve the main portal URL. Note: If your DNS server resolves the main po...
`certificate_settings` supports the following:
* `base64_certificate` - The certificate file encoded in Base64 with padding.
This file must be in the *.p12 format.
-* `base64_password` - Password (encoded in Base64 with padding) for the certificate file.
+* `certificate` - The certificate.
+* `certificate_dn` - The DN (Distinguished Name) of the certificate.
+* `certificate_valid_from` - The date, from which the certificate is valid.
+* `certificate_valid_to` - The certificate expiration date.
`accessibility` supports the following:
@@ -379,11 +452,21 @@ The following arguments are supported:
`authentication` supports the following:
* `authentication_clients` - Collection of VPN Authentication clients identified by the name or UID.authentication_clients blocks are documented below.
+* `dynamic_id_settings` - Dynamic ID settings, relevant only when "override-global-dynamic-id-settings" is true.dynamic_id_settings blocks are documented below.
+* `override_global_dynamic_id_settings` - Override global dynamic ID settings.
+* `send_machine_certificate` - Configure when to send machine certificate.
+* `single_authentication_client` - Settings for clients that support only single authentication method.single_authentication_client blocks are documented below.
`link_selection` supports the following:
* `dns_resolving_hostname` - DNS Resolving Hostname. Must be set when "ip-selection" was selected to be "dns-resolving-from-hostname".
+* `outgoing_link_tracking` - Outgoing link tracking method.
+* `probing_settings` - Probing settings configuration. Only available when "ip-selection" is "use-probing-with-high-availability" or "use-probing-with-load-sharing".probing_settings blocks are documented below.
+* `responding_traffic` - Responding traffic route selection method.
+* `route_selection_method` - Outgoing route selection method when initiating a tunnel.
+* `selected_ip` - Selected IP address. Must be set when "source-ip-selection" was selected to be "manual".
+* `source_ip_selection` - Source IP address selection method for outgoing traffic.
`office_mode` supports the following:
@@ -464,12 +547,13 @@ The following arguments are supported:
`identity_agent_portal_settings` supports the following:
* `accessibility` - Configuration of the portal access settings.accessibility blocks are documented below.
+* `certificate_settings` - Configuration of the portal certificate.certificate_settings blocks are documented below.
+* `portal_web_settings` - Configuration of the portal web settings.portal_web_settings blocks are documented below.
`authorized_clients` supports the following:
* `client` - Host / Network Group Name or UID.
-* `client_secret` - Client Secret.
`authentication_settings` supports the following:
@@ -480,6 +564,8 @@ The following arguments are supported:
`client_access_permissions` supports the following:
* `accessibility` - Configuration of the portal access settings.accessibility blocks are documented below.
+* `certificate_settings` - Configuration of the portal certificate.certificate_settings blocks are documented below.
+* `portal_web_settings` - Configuration of the portal web settings.portal_web_settings blocks are documented below.
`internal_access_settings` supports the following:
@@ -531,13 +617,17 @@ The following arguments are supported:
* `aliases` - List of URL aliases that are redirected to the main portal URL.aliases blocks are documented below.
* `main_url` - The main URL for the web portal.
+* `ip_address` - Optional: IP address for the web portal to use, if your DNS server fails to resolve the main portal URL. Note: If your DNS server resolves the main po...
`certificate_settings` supports the following:
* `base64_certificate` - The certificate file encoded in Base64 with padding.
This file must be in the *.p12 format.
-* `base64_password` - Password (encoded in Base64 with padding) for the certificate file.
+* `certificate` - The certificate.
+* `certificate_dn` - The DN (Distinguished Name) of the certificate.
+* `certificate_valid_from` - The date, from which the certificate is valid.
+* `certificate_valid_to` - The certificate expiration date.
`accessibility` supports the following:
@@ -616,3 +706,348 @@ The following arguments are supported:
* `undefined` - Controls portal access settings for internal interfaces, whose topology is set to 'Undefined'.
* `dmz` - Controls portal access settings for internal interfaces, whose topology is set to 'DMZ'.
* `vpn` - Controls portal access settings for interfaces that are part of a VPN Encryption Domain.
+
+
+`communication_with_servers_behind_nat` supports the following:
+
+* `override_profile` - Whether to override the Server (Check Point Host) object configuration.
+* `value` - according-to-topology: Use the original or translated IP address of the server based on the Topology of Security Gateway interfaces.
original-ip-on...
+
+
+`fetch_policy_scheduler` supports the following:
+
+* `enabled` - Indicates if the Security Gateway will fetch policy according to a schedule (true) or manually (false).
+* `schedule` - Scheduled Event for fetching policy by.
Will be applied only when the `enabled` field is set to true.
When not defined ...
+
+
+`bypass_on_client_failure` supports the following:
+
+* `override_profile` - Whether to override the value inherited from the profile.
+* `profile_value` - The value inherited from the profile.
+* `value` - Whether to bypass on client failure.
+
+
+`bypass_under_load` supports the following:
+
+* `value` - Whether to bypass under load.
+
+
+`outbound_certificate` supports the following:
+
+* `override_profile` - Whether to override the value inherited from the profile.
+* `profile_value` - The value inherited from the profile.
+* `value` - Outbound certificate identified by the name or UID.
+
+
+`certificate_settings` supports the following:
+
+* `certificate` - The certificate.
+* `certificate_dn` - The certificate distinguished name.
+* `certificate_valid_from` - The date from which the certificate is valid.
+* `certificate_valid_to` - The date until which the certificate is valid.
+
+
+`portal_web_settings` supports the following:
+
+* `aliases` - List of URL aliases that are redirected to the main portal URL.
+* `ip_address` - Optional IP address to be used for the portal URL.
+* `main_url` - The main URL for the portal.
+
+
+`certificate_settings` supports the following:
+
+* `certificate` - The certificate.
+* `certificate_dn` - The certificate distinguished name.
+* `certificate_valid_from` - The date from which the certificate is valid.
+* `certificate_valid_to` - The date until which the certificate is valid.
+
+
+`portal_web_settings` supports the following:
+
+* `aliases` - List of URL aliases that are redirected to the main portal URL.
+* `ip_address` - Optional IP address to be used for the portal URL.
+* `main_url` - The main URL for the portal.
+
+
+`cache_mode` supports the following:
+
+* `override_profile` - Whether to override the value inherited from the profile.
+* `profile_value` - The value inherited from the profile.
+* `value` - Whether the identity cache is enabled.
+
+
+`cache_mode_duration` supports the following:
+
+* `override_profile` - Whether to override the value inherited from the profile.
+* `profile_value` - The duration inherited from the profile, in minutes.
+* `value` - Identity cache duration in minutes.
+
+
+`identity_web_api_settings` supports the following:
+
+* `authentication_settings` - Authentication settings for Identity Web API.authentication_settings blocks are documented below.
+* `authorized_clients` - Authorized clients.authorized_clients blocks are documented below.
+* `client_access_permissions` - Identity Web API accessibility settings.client_access_permissions blocks are documented below.
+
+
+`authentication_settings` supports the following:
+
+* `users_directories` - Users directories.users_directories blocks are documented below.
+
+
+`users_directories` supports the following:
+
+* `external_user_profile` - External user profile.
+* `internal_users` - Internal users.
+* `specific` - LDAP AU objects identified by the name or UID.
+* `users_from_external_directories` - Users from external directories.
+
+
+`authorized_clients` supports the following:
+
+* `client` - Host / Network Group Name or UID.
+
+
+`client_access_permissions` supports the following:
+
+* `accessibility` - Configuration of the portal access settings.accessibility blocks are documented below.
+* `certificate_settings` - Configuration of the portal certificate.certificate_settings blocks are documented below.
+* `portal_web_settings` - Configuration of the portal web settings.portal_web_settings blocks are documented below.
+
+
+`accessibility` supports the following:
+
+* `allow_access_from` - Allowed access to the web portal (based on interfaces, or security policy).
+* `internal_access_settings` - Configuration of the additional portal access settings for internal interfaces only.internal_access_settings blocks are documented below.
+
+
+`internal_access_settings` supports the following:
+
+* `dmz` - Controls portal access settings for internal interfaces, whose topology is set to "DMZ".
+* `undefined` - Controls portal access settings for internal interfaces, whose topology is set to "Undefined".
+* `vpn` - Controls portal access settings for interfaces that are part of a VPN Encryption Domain.
+
+
+`certificate_settings` supports the following:
+
+* `certificate` - The certificate.
+* `certificate_dn` - The certificate distinguished name.
+* `certificate_valid_from` - The date from which the certificate is valid.
+* `certificate_valid_to` - The date until which the certificate is valid.
+
+
+`portal_web_settings` supports the following:
+
+* `aliases` - List of URL aliases that are redirected to the main portal URL.
+* `ip_address` - Optional IP address to be used for the portal URL.
+* `main_url` - The main URL for the portal.
+
+
+`smb_logs_settings` supports the following:
+
+* `alert_when_queue_is_full` - Alert when queue is full enabled.
+* `alert_when_queue_is_full_type` - Alert when queue is full type.
+* `detect_new_citrix_ica_application_names` - Detect new citrix ica application names enabled.
+* `stop_logging_when_queue_reaches_maximal_capacity` - Stop logging when queue reaches maximal capacity enabled.
+* `stop_logging_when_queue_reaches_maximal_capacity_threshold` - Stop logging when queue reaches maximal capacity threshold.
+* `turn_on_qos_logging` - Turn on qos logging enabled.
+* `update_account_log_every` - Update account log in every amount of seconds.
+
+
+`trust_details` supports the following:
+
+* `authentication_token` - Authentication token to use on the Gateway side to establish the communication between the Gateway and the Management Server (applies only to Smart-1 ...
+* `cloud_communication_details` - Details about the communication status with cloud (applies only to Smart-1 Cloud).cloud_communication_details blocks are documented below.
+* `gateway_mac_address` - Use the Security Gateway MAC address, relevant for the gateway_mac_address identification-method.
+* `identification_method` - How to identify the gateway (relevant for DAIP gateways only).
+* `status` - Status of the trusted communication with the Security Gateway.
+* `token_expiration_date` - Details about the communication status with cloud (applies only to Smart-1 Cloud).
+
+
+`cloud_communication_details` supports the following:
+
+* `ip` - IP address used for communication between the Gateway and the Management Server (used when 'auto-generate-ip=true').
+* `status` - Status of communication between the Gateway and the Management Server.
+
+
+`advanced` supports the following:
+
+* `enable_nat_traversal` - Enable NAT traversal.
+* `enable_wire_mode` - Enable wire mode.
+* `enable_wire_mode_log_traffic` - Log traffic in wire mode.
+* `shutdown_on_gateway_restart` - Shutdown VPN tunnels on gateway restart.
+* `tunnel_sharing_mode` - Tunnel sharing mode.
+* `wire_mode_interfaces` - Wire mode interfaces.
+
+
+`dynamic_id_settings` supports the following:
+
+* `advanced_settings` - Advanced Dynamic ID configuration settings.advanced_settings blocks are documented below.
+* `sms_provider_and_email_settings` - SMS provider and email configuration.
+* `sms_provider_credentials` - SMS provider credentials configuration.sms_provider_credentials blocks are documented below.
+
+
+`advanced_settings` supports the following:
+
+* `country_code` - Country code for SMS services.
+* `dynamic_id_message` - Dynamic ID message displayed to users.
+* `enable_display_user_details` - Enable display of user details.
+* `otp_settings` - One Time Password configuration settings.otp_settings blocks are documented below.
+* `user_details_retrieval` - User details retrieval method.
+
+
+`otp_settings` supports the following:
+
+* `expiration` - One time password expiration (in minutes).
+* `length` - Length of one time password.
+* `max_attempts` - Number of times users can attempt to enter the one time password before the entire authentication process restarts.
+
+
+`sms_provider_credentials` supports the following:
+
+* `api_id` - SMS provider API ID.
+* `username` - SMS provider username.
+
+
+`single_authentication_client` supports the following:
+
+* `allow_multiple_authentication_clients` - Allow clients that support multiple authentication methods to connect.
+* `client_display_settings` - Client display configuration settings.client_display_settings blocks are documented below.
+* `display_name` - Display name for the authentication method.
+* `enabled` - Allow clients that support only single authentication method.
+* `method` - Authentication method type.
+* `personal_certificate` - Personal certificate authentication settings, relevant only when method is "personal-certificate".personal_certificate blocks are documented below.
+* `radius` - RADIUS authentication settings, relevant only when method is "radius".radius blocks are documented below.
+* `secur_id` - SecurID authentication settings, relevant only when method is "secur-id".secur_id blocks are documented below.
+
+
+`client_display_settings` supports the following:
+
+* `headline` - Display headline for authentication dialog.
+* `password_label` - Label for password field.
+* `username_label` - Label for username field.
+
+
+`personal_certificate` supports the following:
+
+* `dn_concurrence` - DN part occurrence number.
+* `dn_part` - DN part to extract.
+* `fetch_username_from` - Fetch username from.
+* `source` - Certificate source field.
+* `storage_type` - Certificate storage type.
+
+
+`radius` supports the following:
+
+* `ask_user_password` - Ask user for password during authentication.
+* `server` - Server object identified by the name or UID.
+
+
+`secur_id` supports the following:
+
+* `server` - Server object identified by the name or UID.
+* `token_card_type` - Token card type.
+
+
+`certificates` supports the following:
+
+* `base64_certificate` - The certificate encoded in Base64.
+* `certificate_authority` - Certificate authority identified by the name or UID.
+* `distinguished_name` - Certificate distinguished name.
+* `expiration_date` - Certificate expiration date.expiration_date blocks are documented below.
+* `name` - Certificate name.
+* `status` - Certificate status.
+* `stored_at` - Where the certificate is stored.
+
+
+`expiration_date` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
+
+
+`clientless_vpn_settings` supports the following:
+
+* `accept_only_3des` - Accept only 3DES.
+* `certificate_gateway_authentication` - Certificate gateway authentication.
+* `client_authentication` - Client authentication.
+* `concurrent_servers_or_processes` - Number of concurrent servers or processes.
+
+
+`exported_routes` supports the following:
+
+* `custom_routes` - Export custom routes.
+* `custom_routes_object` - Custom routes object identified by the name or UID.
+* `internal_interfaces` - Export internal interfaces.
+* `static_routes` - Export static routes.
+
+
+`interfaces` supports the following:
+
+* `interface_name` - The name of the interface.
+* `ip_version` - The IP version of the interface's IP address.
+* `next_hop_ip` - The IP address of the next hop.
+* `priority` - Priority of a "Backup" interface.
+* `redundancy_mode` - Interface redundancy mode (Active/Backup).
+* `static_nat_ip` - The NATed IPv4 address that hides the source IPv4 address of outgoing connections.
+
+
+`probing_settings` supports the following:
+
+* `primary_address` - Primary IP address to use. Must be one of the addresses from "probed-interface-list". Required when "use-primary-address" is true.
+* `probed_interface_list` - List of specific IP addresses to probe. Only relevant when "probed-interfaces" is set to "specific".
+* `probed_interfaces` - Specifies whether to probe all addresses defined in the topology tab or specific addresses.
+* `probing_method` - Probing method.
+* `use_primary_address` - Whether to use a primary address for high availability probing.
+
+
+`saml_portal_settings` supports the following:
+
+* `accessibility` - Configuration of the portal access settings.accessibility blocks are documented below.
+* `certificate_settings` - Configuration of the SAML portal certificate.certificate_settings blocks are documented below.
+* `enabled` - Whether the SAML portal is enabled.
+* `portal_web_settings` - Configuration of the SAML portal web settings.portal_web_settings blocks are documented below.
+
+
+`accessibility` supports the following:
+
+* `allow_access_from` - Allowed access to the SAML portal.
+* `internal_access_settings` - Configuration of the additional portal access settings for internal interfaces only.internal_access_settings blocks are documented below.
+
+
+`internal_access_settings` supports the following:
+
+* `dmz` - Controls portal access settings for internal interfaces, whose topology is set to "DMZ".
+* `undefined` - Controls portal access settings for internal interfaces, whose topology is set to "Undefined".
+* `vpn` - Controls portal access settings for interfaces that are part of a VPN Encryption Domain.
+
+
+`certificate_settings` supports the following:
+
+* `certificate` - The certificate.
+* `certificate_dn` - The certificate distinguished name.
+* `certificate_valid_from` - The date from which the certificate is valid.
+* `certificate_valid_to` - The date until which the certificate is valid.
+
+
+`portal_web_settings` supports the following:
+
+* `aliases` - List of URL aliases that are redirected to the main portal URL.
+* `ip_address` - Optional IP address to be used for the portal URL.
+* `main_url` - The main URL for the portal.
+
+
+`vpn_clients` supports the following:
+
+* `enable_capsule_vpn_connect` - Enable Capsule VPN Connect client.
+* `enable_cp_mobile_for_windows` - Enable Check Point Mobile for Windows client.
+* `enable_endpoint_security_vpn` - Enable Endpoint Security VPN client.
+* `enable_secu_remote` - Enable SecuRemote client.
+* `enable_ssl_network_extender` - Enable SSL Network Extender client.
+* `gateway_authentication_certificate` - Gateway authentication certificate.
+
+
+`zero_phishing_settings` supports the following:
+
+* `gateway_fqdn_mode` - Manual Fqdn.
+* `manual_fqdn` - Zero Phishing gateway FQDN.
diff --git a/website/docs/d/checkpoint_management_tacacs_server.html.markdown b/website/docs/d/checkpoint_management_tacacs_server.html.markdown
index d8819d6b..c2fffc30 100644
--- a/website/docs/d/checkpoint_management_tacacs_server.html.markdown
+++ b/website/docs/d/checkpoint_management_tacacs_server.html.markdown
@@ -68,4 +68,12 @@ The following arguments are supported:
* `default_timeout` - Default aggressive aging timeout in seconds.
* `enabled`
* `timeout` - Aggressive aging timeout in seconds.
-* `use_default_timeout`
\ No newline at end of file
+* `use_default_timeout`
+
+
+`aggressive_aging` supports the following:
+
+* `default_timeout` - Default aggressive aging timeout in seconds.
+* `enable` - N/A.
+* `timeout` - Aggressive aging timeout in seconds.
+* `use_default_timeout` - N/A.
diff --git a/website/docs/d/checkpoint_management_task.html.markdown b/website/docs/d/checkpoint_management_task.html.markdown
index 74b62e00..82d9d0d4 100644
--- a/website/docs/d/checkpoint_management_task.html.markdown
+++ b/website/docs/d/checkpoint_management_task.html.markdown
@@ -34,4 +34,21 @@ The following arguments are supported:
* `status` - Task status.
* `progress_percentage` - The progress percentage of the task.
* `suppressed` - Is the task suppressed.
-* `comments` - Comments string.
\ No newline at end of file
+* `comments` - Comments string.
+* `last_update_time` - N/A.last_update_time blocks are documented below.
+* `previous_task_id` - ID of the previous task in the execution sequence, on which this task depends.
+* `progress_description` - N/A.
+* `revert_status` - N/A.
+* `start_time` - N/A.start_time blocks are documented below.
+
+
+`last_update_time` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
+
+
+`start_time` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
diff --git a/website/docs/d/checkpoint_management_threat_ioc_feed.html.markdown b/website/docs/d/checkpoint_management_threat_ioc_feed.html.markdown
index 881e3531..7a5152e8 100644
--- a/website/docs/d/checkpoint_management_threat_ioc_feed.html.markdown
+++ b/website/docs/d/checkpoint_management_threat_ioc_feed.html.markdown
@@ -30,4 +30,8 @@ data "checkpoint_management_threat_ioc_feed" "data_threat_ioc_feed" {
The following arguments are supported:
* `uid` - (Optional) Object unique identifier.
-* `name` - (Optional) Object name.
\ No newline at end of file
+* `name` - (Optional) Object name.
+* `confidence` - N/A.
+* `performance_impact` - N/A.
+* `severity` - N/A.
+* `use_snort_format` - N/A.
\ No newline at end of file
diff --git a/website/docs/d/checkpoint_management_threat_layer.html.markdown b/website/docs/d/checkpoint_management_threat_layer.html.markdown
index eddf9beb..c7e1e739 100644
--- a/website/docs/d/checkpoint_management_threat_layer.html.markdown
+++ b/website/docs/d/checkpoint_management_threat_layer.html.markdown
@@ -31,4 +31,6 @@ The following arguments are supported:
* `uid` - (Optional) Object unique identifier.
* `tags` - Collection of tag identifiers.tags blocks are documented below.
* `color` - Color of the object. Should be one of existing colors.
-* `comments` - Comments string.
\ No newline at end of file
+* `comments` - Comments string.
+* `permissions_profiles` - Collection of permission profile objects associated with this layer.
+* `shared` - Whether this layer is shared.
\ No newline at end of file
diff --git a/website/docs/d/checkpoint_management_threat_profile.html.markdown b/website/docs/d/checkpoint_management_threat_profile.html.markdown
index 189c9933..859d6527 100644
--- a/website/docs/d/checkpoint_management_threat_profile.html.markdown
+++ b/website/docs/d/checkpoint_management_threat_profile.html.markdown
@@ -55,6 +55,9 @@ The following arguments are supported:
* `tags` - (Optional) Collection of tag identifiers.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `advanced_dns_settings` - Advanced DNS Settings.advanced_dns_settings blocks are documented below.
+* `ai_guard` - Is AI Guard blade activated.
+* `ai_guard_settings` - AI Guard blade settings.ai_guard_settings blocks are documented below.
`indicator_overrides` supports the following:
@@ -94,6 +97,7 @@ The following arguments are supported:
* `final` - Final settings. final blocks are documented below.
* `protection_external_info` - Collection of industry reference (CVE).
* `protection_uid` - IPS protection unique identifier.
+* `override` - Settings overrides.override blocks are documented below.
`scan_malicious_links` supports the following:
@@ -124,4 +128,24 @@ The following arguments are supported:
* `action` - Protection action.
* `capture_packets` - Capture packets.
-* `track` - Tracking method for protection.
\ No newline at end of file
+* `track` - Tracking method for protection.
+
+
+`advanced_dns_settings` supports the following:
+
+* `dga_detection` - Enable/Disable DGA based domains detection.
+* `dns_domain_tunneling` - Enable/Disable DNS Tunneling based on domains detection.
+* `dns_over_https` - Enable/Disable parsing of DNS over HTTPS protocol.
+* `nxns_attack_detection` - Enable/Disable NXNS attack detection.
+
+
+`ai_guard_settings` supports the following:
+
+* `project_id` - Lakera project ID to associate with this profile.
+
+
+`override` supports the following:
+
+* `action` - Protection action.
+* `capture_packets` - Capture packets.
+* `track` - Tracking method for protection.
diff --git a/website/docs/d/checkpoint_management_threat_rule.html.markdown b/website/docs/d/checkpoint_management_threat_rule.html.markdown
index a419c8cb..548326e4 100644
--- a/website/docs/d/checkpoint_management_threat_rule.html.markdown
+++ b/website/docs/d/checkpoint_management_threat_rule.html.markdown
@@ -48,7 +48,9 @@ The following arguments are supported:
* `track_settings` - Threat rule track settings. track_settings block are documented below.
* `comments` - Comments string.
* `exceptions` - Collection of the rule's exceptions identified by UID.
+* `exceptions_layer` - The rule's exceptions layer.
`track_settings` supports the following:
-* `packet_capture` - Packet capture.
\ No newline at end of file
+* `packet_capture` - Packet capture.
+* `forensics` - Whether to enable forensics.
\ No newline at end of file
diff --git a/website/docs/d/checkpoint_management_threat_rulebase.html.markdown b/website/docs/d/checkpoint_management_threat_rulebase.html.markdown
index 27b437ba..010253e0 100644
--- a/website/docs/d/checkpoint_management_threat_rulebase.html.markdown
+++ b/website/docs/d/checkpoint_management_threat_rulebase.html.markdown
@@ -31,6 +31,7 @@ The following arguments are supported:
* `package` - Name of the package.
* `dereference_group_members` - Indicates whether to dereference "members" field by details level for every object in reply.
* `show_membership` - Indicates whether to calculate and show "groups" field for every object in reply.
+* `objects_dictionary` - Level of details in the output corresponds to the number of details for search. This table shows the level of details in the Standard level.
`filter_settings` supports the following:
diff --git a/website/docs/d/checkpoint_management_trusted_client.html.markdown b/website/docs/d/checkpoint_management_trusted_client.html.markdown
index bb255c35..4aeeedeb 100644
--- a/website/docs/d/checkpoint_management_trusted_client.html.markdown
+++ b/website/docs/d/checkpoint_management_trusted_client.html.markdown
@@ -30,3 +30,4 @@ The following arguments are supported:
* `uid` - (Optional) Object unique identifier.
* `name` - (Optional) Object name.
+* `subnet_mask4` - IPv4 mask.
diff --git a/website/docs/d/checkpoint_management_user.html.markdown b/website/docs/d/checkpoint_management_user.html.markdown
index 65476dc9..3a0f38ae 100644
--- a/website/docs/d/checkpoint_management_user.html.markdown
+++ b/website/docs/d/checkpoint_management_user.html.markdown
@@ -51,6 +51,7 @@ The following arguments are supported:
* `tags` - Collection of tag identifiers.
* `color` - Color of the object.
* `comments` - Comments string.
+* `certificates` - User certificates.certificates blocks are documented below.
`allowed_locations` supports the following:
@@ -62,4 +63,26 @@ The following arguments are supported:
* `enable_ike` - Enable IKE encryption for users.
* `enable_public_key` - Enable IKE public key.
-* `enable_shared_secret` - Enable IKE shared secret.
\ No newline at end of file
+* `enable_shared_secret` - Enable IKE shared secret.
+* `data_integrity_algorithm` - IKE data integrity algorithm.
+* `encryption_algorithm` - IKE encryption algorithm.
+* `ike` - IKE users encryption enabled.
+* `public_key` - IKE public key enabled.
+* `shared_secret` - IKE shared secret enabled.
+
+
+`certificates` supports the following:
+
+* `base64_certificate` - Certificate file encoded in base64.
File format: .P12.
+* `comments` - Certificate comments.
+* `registration_key` - Registration key for enrollment.
+* `status` - Certificate status.
+* `subject` - Certificate subject.
+* `uid` - Object unique identifier.
+* `valid_to` - Expiration date.valid_to blocks are documented below.
+
+
+`valid_to` supports the following:
+
+* `iso_8601` - Date and time represented in international ISO 8601 format.
+* `posix` - Number of milliseconds that have elapsed since 00:00:00, 1 January 1970.
diff --git a/website/docs/d/checkpoint_management_user_template.html.markdown b/website/docs/d/checkpoint_management_user_template.html.markdown
index 6fa5a333..ff06262a 100644
--- a/website/docs/d/checkpoint_management_user_template.html.markdown
+++ b/website/docs/d/checkpoint_management_user_template.html.markdown
@@ -57,4 +57,9 @@ The following arguments are supported:
* `enable_ike` - Enable IKE encryption for users.
* `enable_public_key` - Enable IKE public key.
-* `enable_shared_secret` - Enable IKE shared secret.
\ No newline at end of file
+* `enable_shared_secret` - Enable IKE shared secret.
+* `data_integrity_algorithm` - IKE data integrity algorithm.
+* `encryption_algorithm` - IKE encryption algorithm.
+* `ike` - IKE users encryption enabled.
+* `public_key` - IKE public key enabled.
+* `shared_secret` - IKE shared secret enabled.
\ No newline at end of file
diff --git a/website/docs/d/checkpoint_management_vmware_data_center_server.html.markdown b/website/docs/d/checkpoint_management_vmware_data_center_server.html.markdown
index 1ab9779b..4e980439 100644
--- a/website/docs/d/checkpoint_management_vmware_data_center_server.html.markdown
+++ b/website/docs/d/checkpoint_management_vmware_data_center_server.html.markdown
@@ -35,3 +35,12 @@ The following arguments are supported:
* `name` - (Optional) Object name.
* `uid` - (Optional) Object unique identifier.
+* `automatic_refresh` - Indicates whether the data center server's content is automatically updated.
+* `data_center_type` - Data Center type.
+* `properties` - Data Center properties.properties blocks are documented below.
+
+
+`properties` supports the following:
+
+* `name` - N/A.
+* `value` - N/A.
diff --git a/website/docs/d/checkpoint_management_vpn_community_remote_access.html.markdown b/website/docs/d/checkpoint_management_vpn_community_remote_access.html.markdown
index 3ed79d4c..2413c2ba 100644
--- a/website/docs/d/checkpoint_management_vpn_community_remote_access.html.markdown
+++ b/website/docs/d/checkpoint_management_vpn_community_remote_access.html.markdown
@@ -36,8 +36,70 @@ The following arguments are supported:
* `tags` - Collection of tag identifiers.
* `color` - Color of the object.
* `comments` - Comments string.
+* `encryption` - Encryption settings.encryption blocks are documented below.
`override_vpn_domains` supports the following:
* `gateway` - Participant gateway in override VPN domain identified by the name or UID.
* `vpn_domain` - VPN domain network identified by the name or UID.
+
+
+`encryption` supports the following:
+
+* `encryption_method` - The encryption method to be used.
+* `ike_phase_1` - IKE Phase 1 settings.ike_phase_1 blocks are documented below.
+* `ike_phase_2` - IKE Phase 2 settings.ike_phase_2 blocks are documented below.
+
+
+`ike_phase_1` supports the following:
+
+* `configured_data_integrity_algorithms` - The list of configured hash algorithms.
+* `configured_diffie_hellman_groups` - The list of configured Diffie-Hellman groups.
+* `configured_encryption_algorithms` - The list of configured encryption algorithms.
+* `data_integrity` - The hash algorithm to be used.
+* `diffie_hellman_group` - The Diffie-Hellman group to be used.
+* `encryption_algorithm` - The encryption algorithm to be used.
+* `ike_p1_rekey_time` - Indicates the time interval for IKE phase 1 renegotiation.
+* `multiple_key_exchanges` - Multiple Key Exchanges proposal object.multiple_key_exchanges blocks are documented below.
+* `use_multiple_key_exchanges` - Indicates whether to use a proposal with Multiple Key Exchanges.
+* `use_standard_proposal` - Indicates whether to use a proposal with a single Diffie-Hellman group.
+
+
+`multiple_key_exchanges` supports the following:
+
+* `additional_key_exchange_1_methods` - Additional Key-Exchange 1 methods to use.
+* `additional_key_exchange_2_methods` - Additional Key-Exchange 2 methods to use.
+* `additional_key_exchange_3_methods` - Additional Key-Exchange 3 methods to use.
+* `additional_key_exchange_4_methods` - Additional Key-Exchange 4 methods to use.
+* `additional_key_exchange_5_methods` - Additional Key-Exchange 5 methods to use.
+* `additional_key_exchange_6_methods` - Additional Key-Exchange 6 methods to use.
+* `additional_key_exchange_7_methods` - Additional Key-Exchange 7 methods to use.
+* `key_exchange_methods` - Key-Exchange methods to use. Can contain only Diffie-Hellman groups.
+
+
+`ike_phase_2` supports the following:
+
+* `configured_data_integrity_algorithms` - The list of configured hash algorithms.
+* `configured_diffie_hellman_groups` - The list of configured Diffie-Hellman groups.
+* `configured_encryption_algorithms` - The list of configured encryption algorithms.
+* `data_integrity` - The hash algorithm to be used.
+* `encryption_algorithm` - The encryption algorithm to be used.
+* `enforce_encryption_alg_and_data_integrity_on_all_users` - Enforce Encryption Algorithm and Data Integrity on all users.
+* `ike_p2_pfs_dh_grp` - The Diffie-Hellman group to be used.
+* `ike_p2_rekey_time` - Indicates the time interval for IKE phase 2 renegotiation.
+* `ike_p2_use_pfs` - Indicates whether Perfect Forward Secrecy (PFS) is being used for IKE phase 2.
+* `multiple_key_exchanges` - Multiple Key Exchanges proposal object to use when PFS is enabled and multiple key exchanges are configured.multiple_key_exchanges blocks are documented below.
+* `use_multiple_key_exchanges` - Indicates whether to use a proposal with Multiple Key Exchanges when PFS is enabled.
+* `use_standard_proposal` - Indicates whether to use a proposal with a single Diffie-Hellman group when PFS is enabled.
+
+
+`multiple_key_exchanges` supports the following:
+
+* `additional_key_exchange_1_methods` - Additional Key-Exchange 1 methods to use.
+* `additional_key_exchange_2_methods` - Additional Key-Exchange 2 methods to use.
+* `additional_key_exchange_3_methods` - Additional Key-Exchange 3 methods to use.
+* `additional_key_exchange_4_methods` - Additional Key-Exchange 4 methods to use.
+* `additional_key_exchange_5_methods` - Additional Key-Exchange 5 methods to use.
+* `additional_key_exchange_6_methods` - Additional Key-Exchange 6 methods to use.
+* `additional_key_exchange_7_methods` - Additional Key-Exchange 7 methods to use.
+* `key_exchange_methods` - Key-Exchange methods to use. Can contain only Diffie-Hellman groups.
diff --git a/website/docs/r/checkpoint_management_access_layer.html.markdown b/website/docs/r/checkpoint_management_access_layer.html.markdown
index b4d37919..e742123c 100644
--- a/website/docs/r/checkpoint_management_access_layer.html.markdown
+++ b/website/docs/r/checkpoint_management_access_layer.html.markdown
@@ -38,3 +38,4 @@ The following arguments are supported:
* `comments` - (Optional) Comments string.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `dynamic_layer` - (Optional) Whether this layer is set as a Dynamic layer.
diff --git a/website/docs/r/checkpoint_management_access_rule.html.markdown b/website/docs/r/checkpoint_management_access_rule.html.markdown
index e2190df6..0a47c8df 100644
--- a/website/docs/r/checkpoint_management_access_rule.html.markdown
+++ b/website/docs/r/checkpoint_management_access_rule.html.markdown
@@ -176,6 +176,7 @@ The following arguments are supported:
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
* `comments` - (Optional) Comments string.
* `fields_with_uid_identifier` - (Optional) List of resource fields that will use object UIDs as object identifiers. Default is object name.
+* `service_resource` - (Optional) Resource of the service identified by the name or UID. When a service-resource exists, the service parameter should contains exactly one service element.
`position` supports the following:
@@ -188,6 +189,8 @@ The following arguments are supported:
* `enable_identity_captive_portal` - (Optional) N/A.
* `limit` - (Optional) N/A.
+* `client_auth_settings` - (Optional) Client authentication settings.client_auth_settings blocks are documented below.
+* `user_auth_settings` - (Optional) User authentication settings.user_auth_settings blocks are documented below.
`custom_fields` supports the following:
@@ -227,4 +230,31 @@ The following arguments are supported:
```
$ terraform import checkpoint_management_access_rule.example "Network;9423d36f-2d66-4754-b9e2-e9f4493751d3"
-```
\ No newline at end of file
+```
+
+
+`client_auth_settings` supports the following:
+
+* `destination` - (Optional) Destination object identified by the name or UID.
+* `require_desktop_config_verification` - (Optional) Require Desktop configuration verification.
+* `sessions_limit` - (Optional) Maximum number of concurrent sessions.
+* `sign_on_method` - (Optional) Sign on method.
+* `sign_on_type` - (Optional) Sign on type.
+* `source` - (Optional) Source object identified by the name or UID.
+* `timeout` - (Optional) Session timeout settings.timeout blocks are documented below.
+* `tracking` - (Optional) Tracking method.
+* `unlimited_sessions` - (Optional) Allow an unlimited number of sessions.
+
+
+`timeout` supports the following:
+
+* `enable` - (Optional) Enable session timeout.
+* `minutes` - (Optional) Session timeout in minutes.
+* `refreshable` - (Optional) Whether the timeout is refreshable.
+
+
+`user_auth_settings` supports the following:
+
+* `allowed_http_servers` - (Optional) Allowed HTTP servers.
+* `destination` - (Optional) Destination object identified by the name or UID.
+* `source` - (Optional) Source object identified by the name or UID.
diff --git a/website/docs/r/checkpoint_management_application_site.html.markdown b/website/docs/r/checkpoint_management_application_site.html.markdown
index c9cc5bc9..de1ae5fd 100644
--- a/website/docs/r/checkpoint_management_application_site.html.markdown
+++ b/website/docs/r/checkpoint_management_application_site.html.markdown
@@ -40,3 +40,12 @@ The following arguments are supported:
* `comments` - (Optional) Comments string.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `match_settings` - (Optional) Match settings for application services.match_settings blocks are documented below.
+
+
+`match_settings` supports the following:
+
+* `mode` - (Optional) Match mode for the application services.
+* `negate` - (Optional) All ports except those listed in override-services.
+* `override_services` - (Optional) Service names or UIDs used when matching is customized.
Required only when mode is set to 'customize'.
+* `recommended_services` - (Computed) Recommended services for this application. Use when mode is set to 'recommended'.
diff --git a/website/docs/r/checkpoint_management_check_threat_ioc_feed.html.markdown b/website/docs/r/checkpoint_management_check_threat_ioc_feed.html.markdown
index 737b32a8..63d1d90d 100644
--- a/website/docs/r/checkpoint_management_check_threat_ioc_feed.html.markdown
+++ b/website/docs/r/checkpoint_management_check_threat_ioc_feed.html.markdown
@@ -54,6 +54,10 @@ URL should be written as http or https.
* `use_gateway_proxy` - (Optional) Use the gateway's proxy for retrieving the feed.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `confidence` - (Optional) Set in order to configure the confidence of the snort protections in snort format. 1-Low, 5-High.
+* `performance_impact` - (Optional) Set in order to configure the performance impact of the snort protections in snort format. 1-Very Low, 4-High.
+* `severity` - (Optional) Set in order to configure the severity of the snort protections in snort format. 1-Low, 4-Critical.
+* `use_snort_format` - (Optional) Set in order to configure a snort format indicator feed.
`custom_header` supports the following:
diff --git a/website/docs/r/checkpoint_management_checkpoint_host.html.markdown b/website/docs/r/checkpoint_management_checkpoint_host.html.markdown
index 9f4fa798..6a7c563b 100644
--- a/website/docs/r/checkpoint_management_checkpoint_host.html.markdown
+++ b/website/docs/r/checkpoint_management_checkpoint_host.html.markdown
@@ -46,6 +46,7 @@ The following arguments are supported:
* `sic_state` - (Computed) State the Secure Internal Connection Trust.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `dns_server` - (Optional) DNS Server.
`interfaces` supports the following:
@@ -70,6 +71,8 @@ The following arguments are supported:
* `hide_behind` - (Optional) Hide behind method. This parameter is not required in case "method" parameter is "static".
* `install_on` - (Optional) Which gateway should apply the NAT translation.
* `method` - (Optional) NAT translation method.
+* `automatic_nat_rules` - (Optional) Whether to add automatic address translation rules.
checkpoint-gateway: generate automatic address translation rules using the install-on values.
third-pa.
+* `communication_with_this_server` - (Optional) How gateways will communicate with this server.
Note: original-ip-only and translated-ip-only Supported only by Security Gateways R82 and higher.
`management_blades` supports the following:
@@ -112,4 +115,6 @@ The following arguments are supported:
* `stop_logging_when_free_disk_space_below` - (Optional) Enable stop logging when free disk space below.
* `stop_logging_when_free_disk_space_below_threshold` - (Optional) Stop logging when free disk space below threshold.
* `turn_on_qos_logging` - (Optional) Enable turn on qos logging.
-* `update_account_log_every` - (Optional) Update account log in every amount of seconds.
\ No newline at end of file
+* `update_account_log_every` - (Optional) Update account log in every amount of seconds.
+* `distribute_logs_between_all_active_servers` - (Optional) Distribute logs between all active servers.
+* `include_tcp_state_information` - (Optional) Include TCP state information. Relevant only when Firewall blade is enabled.
\ No newline at end of file
diff --git a/website/docs/r/checkpoint_management_connect_cloud_services.html.markdown b/website/docs/r/checkpoint_management_connect_cloud_services.html.markdown
index 26eadd8f..e6b2b53d 100644
--- a/website/docs/r/checkpoint_management_connect_cloud_services.html.markdown
+++ b/website/docs/r/checkpoint_management_connect_cloud_services.html.markdown
@@ -26,6 +26,7 @@ The following arguments are supported:
* `status` - Status of the connection to the Infinity Portal.
* `connected_at` - The time of the connection between the Management Server and the Infinity Portal. connected_at is documented below.
* `management_url` - The Management Server's public URL.
+* `gateways_onboarding_settings` - (Optional) Gateways on-boarding to Infinity Portal settings.gateways_onboarding_settings blocks are documented below.
`connected_at` supports the following:
* `iso_8601` - Date and time represented in international ISO 8601 format.
@@ -35,3 +36,11 @@ The following arguments are supported:
Make sure this command will be executed in the right execution order.
note: terraform execution is not sequential.
+
+`gateways_onboarding_settings` supports the following:
+
+* `connection_method` - (Optional) Indicate whether Gateways will be connected to Infinity Portal automatically or only after policy installation.
+* `details_level` - (Optional) The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed representation o...
+* `enabled` - (Optional) Enable/Disable automatic connection of Security Gateways to Infinity Portal.
+* `participant_gateways` - (Optional) Which Gateways will be connected to Infinity Portal.
+* `specific_gateways` - (Optional) Selection of targets identified by the name or UID which will be on-boarded to the cloud. Configuration will be applied only when 'participant-gateway...
diff --git a/website/docs/r/checkpoint_management_data_type_patterns.html.markdown b/website/docs/r/checkpoint_management_data_type_patterns.html.markdown
index aa5ac3eb..33d41765 100644
--- a/website/docs/r/checkpoint_management_data_type_patterns.html.markdown
+++ b/website/docs/r/checkpoint_management_data_type_patterns.html.markdown
@@ -35,4 +35,5 @@ For custom-made data types, you can use this field to provide more details.
* `color` - (Optional) Color of the object. Should be one of existing colors.
* `comments` - (Optional) Comments string.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
-* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
\ No newline at end of file
+* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `use_statistical_analysis` - (Optional) Indicates whether to use statistical analysis to enhance accuracy. Relevant only for built-in data types.
\ No newline at end of file
diff --git a/website/docs/r/checkpoint_management_domain_permissions_profile.html.markdown b/website/docs/r/checkpoint_management_domain_permissions_profile.html.markdown
index 9553bfb3..bb778286 100644
--- a/website/docs/r/checkpoint_management_domain_permissions_profile.html.markdown
+++ b/website/docs/r/checkpoint_management_domain_permissions_profile.html.markdown
@@ -100,6 +100,9 @@ The following arguments are supported:
* `approve_or_reject_sessions` - (Optional) Approve / reject other sessions.
* `publish_sessions` - (Optional) Allow session publishing without an approval.
* `manage_integration_with_cloud_services` - (Optional) Manage integration with Cloud Services.
+* `allowed_mgmt_api_commands` - (Optional) List of allowed Management API commands the profile can run. All available commands can be viewed using show-commands Management API.
...
+* `limit_mgmt_api_commands` - (Optional) Enable limitation of Management API commands the profile may or may not run.
Only a 'Customized' permission-type profile can edit this permission.
Not sup.
`monitoring_and_logging` supports the following:
diff --git a/website/docs/r/checkpoint_management_export_management.html.markdown b/website/docs/r/checkpoint_management_export_management.html.markdown
index d1ee49b7..0fe11b75 100644
--- a/website/docs/r/checkpoint_management_export_management.html.markdown
+++ b/website/docs/r/checkpoint_management_export_management.html.markdown
@@ -37,6 +37,11 @@ The following arguments are supported:
* `pre_export_verification_only` - (Optional) If true, only runs the pre-export verifications instead of the full export.
* `ignore_warnings` - (Optional) Ignoring the verification warnings. By Setting this parameter to 'true' export will not be blocked by warnings.
* `task_id` - Asynchronous task unique identifier. Use show-task command to check the progress of the task.
+* `cancel_prepare_export` - (Optional) If 'true', cancels the export in background process. If you do not run this command within the number of days defined in 'show-background-upgrade-sett...
+* `complete_background_export` - (Optional) If 'true', export the changes you made during the 'Prepare' phase and the 'Complete' phase will start. You can't make any changes during the 'Complete...
+* `days_of_logs` - (Optional) Export last days of logs.
+* `prepare_background_export` - (Optional) If 'true', the export will run in the background and 'Prepare' phase will start. You can continue making changes on the Management Server during and a...
+* `verify_all_servers` - (Optional) Runs the verification process on all Management Servers and Log Servers.
For more information see Required only if one or more of the servers in the Security Managem...change_ips blocks are documented below.
+* `complete_background_import` - (Optional) If 'true', import the changes you made during the 'Prepare' phase, and the 'Complete' phase will be achieved. You can't make any changes during the 'C...
+* `days_of_logs` - (Optional) Export last days of logs.
+* `domain_ipv6_address` - (Optional) IPv6 address for the imported Domain.
+* `keep_cloud_sharing` - (Optional) Preserve the connection of the Management Server to Check Point's Infinity Portal.
Use this flag after ensuring that the original Management Server...
+* `prepare_background_import` - (Optional) If 'true', the import will run in the background and 'Prepare' phase will be achieved. You can continue making changes on the Management Server during...
## How To Use
Make sure this command will be executed in the right execution order.
note: terraform execution is not sequential.
+
+`change_ips` supports the following:
+
+* `new_ipv4_address` - (Optional) The new IPv4 address of the server that migrates to a new IP address.
+* `server_name` - (Optional) The object name of the server that migrates to a new IP address.
diff --git a/website/docs/r/checkpoint_management_install_software_package.html.markdown b/website/docs/r/checkpoint_management_install_software_package.html.markdown
index 1558f5aa..336267ba 100644
--- a/website/docs/r/checkpoint_management_install_software_package.html.markdown
+++ b/website/docs/r/checkpoint_management_install_software_package.html.markdown
@@ -28,6 +28,8 @@ The following arguments are supported:
* `cluster_installation_settings` - (Optional) Installation settings for cluster.cluster_installation_settings blocks are documented below.
* `concurrency_limit` - (Optional) The number of targets, on which the same package is installed at the same time.
* `task_id` - (Computed) Asynchronous task unique identifier.
+* `method` - (Optional) How we want to use the package.
+* `package_location` - (Optional) The package repository.
`cluster_installation_settings` supports the following:
diff --git a/website/docs/r/checkpoint_management_interoperable_device.html.markdown b/website/docs/r/checkpoint_management_interoperable_device.html.markdown
index 635f22b6..9ea8e86d 100644
--- a/website/docs/r/checkpoint_management_interoperable_device.html.markdown
+++ b/website/docs/r/checkpoint_management_interoperable_device.html.markdown
@@ -36,6 +36,7 @@ The following arguments are supported:
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `groups` - (Optional) Collection of group identifiers.groups blocks are documented below.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `autonomous_system_number` - (Optional) The Autonomous System Number (ASN) for this Interoperable Device object.
`interfaces` supports the following:
diff --git a/website/docs/r/checkpoint_management_log_exporter.html.markdown b/website/docs/r/checkpoint_management_log_exporter.html.markdown
index 3724e8ba..512202ef 100644
--- a/website/docs/r/checkpoint_management_log_exporter.html.markdown
+++ b/website/docs/r/checkpoint_management_log_exporter.html.markdown
@@ -41,6 +41,10 @@ The following arguments are supported:
* `tags` - (Optional) Collection of tag identifiers.tags blocks are documented below.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `advanced` - (Optional) Advanced settings for log exporter.advanced blocks are documented below.
+* `fields` - (Optional) Log exporter fields mapping settings.fields blocks are documented below.
+* `filters` - (Optional) Log exporter filters.filters blocks are documented below.
+* `tls` - (Optional) TLS settings for log exporter.tls blocks are documented below.
`attachments` supports the following:
@@ -54,3 +58,69 @@ The following arguments are supported:
* `aggregate_log_updates` - (Optional) Indicates whether to aggregate log updates.
* `format` - (Optional) Logs format.
+* `add_custom_log_header` - (Optional) Custom header added to every exported log entry.
This header can be used to identify the source or add metadata to logs.
The custom header is prepended.
+* `aggregation_mode` - (Optional) Aggregation mode for aggregated logs.
Determines how log updates are processed when aggregate-log-updates is true or not specified:
- semi-unified (defa.
+
+
+`advanced` supports the following:
+
+* `time_in_milliseconds` - (Optional) Toggle export logs' time with ms resolution.
+
+
+`fields` supports the following:
+
+* `exclusion_list` - (Optional) List of field names to exclude or include based on the export mode.
When export is all-except: fields in this list are excluded from expor...
+* `export` - (Optional) Field export mode.
all-except (default): exports all fields except those in the exclusion list.
nothing-except: exports nothing ...
+* `names_mapping` - (Optional) Field name mappings to rename fields during export.
Specify mappings in the format: 'orgName:dstName' (e.g., 'src:source_ip,dst:destination_ip')....
+
+
+`filters` supports the following:
+
+* `expressions` - (Optional) List of filter expressions. Each expression targets a specific log field.expressions blocks are documented below.
+* `expressions_operator` - (Optional) Logical operator for combining all filter expressions.
+* `filter_out_connection_logs` - (Optional) When set to true, connection logs will be excluded from export.
+
+
+`expressions` supports the following:
+
+* `conditions` - (Optional) Filter conditions for this field. Required when 'operator' is 'and' or 'or'.
Array of condition objects, each with 'operator' and 'value'.conditions blocks are documented below.
+* `field_name` - (Optional) Log field name to filter on.
+* `operator` - (Optional) Operator for this expression.
Use 'and'/'or' with 'conditions' (array of condition objects).
Use 'in'/'not-in' with 'values' (flat array of stri...
+* `values` - (Computed) Filter values for this field. Present when 'operator' is 'in' or 'not-in'.
Flat array of string values.
+
+
+`conditions` supports the following:
+
+* `operator` - (Optional) Comparison operator.
+* `value` - (Optional) The value to compare against.
+
+
+`tls` supports the following:
+
+* `auto_generate_client_certificates` - (Optional) TLS mode where user provides server CA certificate only. Check Point Management automatically generates and signs client certificates. This is the sim...auto_generate_client_certificates blocks are documented below.
+* `client_cert_expiration_date` - (Computed) Client certificate expiration date extracted from the stored PKCS#12 certificate. Available for all TLS modes when client certificate exists.
+* `enabled` - (Optional) Indicates whether to use encrypted connection. Can be true only when protocol is TCP.
+* `generate_and_sign_client_csr` - (Optional) Advanced TLS mode with two separate phases: 'auto-generate-client-csr' to initiate CSR generation (ADD/SET) and 'provide-signed-client-cert' to provid...generate_and_sign_client_csr blocks are documented below.
+* `mode` - (Optional) TLS mode. Must match the specific mode configuration provided.
+* `user_provided_certificates` - (Optional) TLS mode where user provides server CA certificate, client certificate (PKCS#12 format), and passphrase. All certificates provided by the user, Check ...user_provided_certificates blocks are documented below.
+
+
+`auto_generate_client_certificates` supports the following:
+
+* `client_ca_cert` - (Computed) Client generated CA certificate that signed the client certificate. The server should trust this CA. Supplied as base64 encoded string.
+* `server_ca_cert` - (Optional) Server certificate authority certificate, supplied as base64 encoded string.
+
+
+`generate_and_sign_client_csr` supports the following:
+
+* `client_cert` - (Optional) Client certificate in PEM format as base64 encoded string, signed by external CA. Can only be provided when phase is 'provide-signed-client-cert'.
+* `client_csr` - (Computed) Client certificate signing request (CSR) in PEM format as base64 encoded string. Present when phase is 'auto-generate-client-csr'.
+* `phase` - (Optional) Mode phase type: 'auto-generate-client-csr' to initiate CSR generation.
+* `server_ca_cert` - (Optional) Server CA certificate in PEM format as base64 encoded string to validate the destination server's identity. Required when phase is 'auto-genera...
+
+
+`user_provided_certificates` supports the following:
+
+* `client_cert` - (Optional) Client certificate, supplied as base64 encoded string.
+* `client_secret` - (Optional) Client secret for TLS connection.
+* `server_ca_cert` - (Optional) Server certificate authority certificate, supplied as base64 encoded string.
diff --git a/website/docs/r/checkpoint_management_md_permissions_profile.html.markdown b/website/docs/r/checkpoint_management_md_permissions_profile.html.markdown
index 0e56c2be..cae44e53 100644
--- a/website/docs/r/checkpoint_management_md_permissions_profile.html.markdown
+++ b/website/docs/r/checkpoint_management_md_permissions_profile.html.markdown
@@ -43,3 +43,6 @@ The following arguments are supported:
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
* `permission_level` - (Optional) The level of the Multi Domain Permissions Profile.
The level cannot be changed after creation.
+* `allowed_mgmt_api_commands` - (Optional) List of allowed Management API commands the profile can run. All available commands can be viewed using show-commands Management API.
...
+* `limit_mgmt_api_commands` - (Optional) Enable limitation of Management API commands the profile may or may not run.
diff --git a/website/docs/r/checkpoint_management_outbound_inspection_certificate.html.markdown b/website/docs/r/checkpoint_management_outbound_inspection_certificate.html.markdown
index 439d2764..1ee2a2ca 100644
--- a/website/docs/r/checkpoint_management_outbound_inspection_certificate.html.markdown
+++ b/website/docs/r/checkpoint_management_outbound_inspection_certificate.html.markdown
@@ -40,4 +40,5 @@ The following arguments are supported:
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
* `base64_certificate` - Certificate file encoded in base64.
-* `base64_public_certificate` - Public Certificate file encoded in base64 (pem format).
\ No newline at end of file
+* `base64_public_certificate` - Public Certificate file encoded in base64 (pem format).
+* `public_key_algorithm` - (Optional) Public key algorithm and size of the outbound certificate.
\ No newline at end of file
diff --git a/website/docs/r/checkpoint_management_requirement.html.markdown b/website/docs/r/checkpoint_management_requirement.html.markdown
index 94cbdaac..a000cb23 100644
--- a/website/docs/r/checkpoint_management_requirement.html.markdown
+++ b/website/docs/r/checkpoint_management_requirement.html.markdown
@@ -33,3 +33,5 @@ The following arguments are supported:
* `tags` - (Optional) Collection of tag identifiers.tags blocks are documented below.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `new_regulation_uid` - (Optional) The new regulation UID for this requirement.
+* `regulation_uid` - (Optional) The relevant regulation UID for this requirement.
diff --git a/website/docs/r/checkpoint_management_reset_sic.html.markdown b/website/docs/r/checkpoint_management_reset_sic.html.markdown
index e373b873..907cdc4a 100644
--- a/website/docs/r/checkpoint_management_reset_sic.html.markdown
+++ b/website/docs/r/checkpoint_management_reset_sic.html.markdown
@@ -25,6 +25,7 @@ The following arguments are supported:
* `uid` - (Optional) Gateway, cluster member or Check Point host unique identifier.
* `name` - (Optional) Gateway, cluster member or Check Point host name.
+* `domains_to_process` - (Optional) Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and with ig...
## How To Use
diff --git a/website/docs/r/checkpoint_management_run_script.html.markdown b/website/docs/r/checkpoint_management_run_script.html.markdown
index 05469955..537985f7 100644
--- a/website/docs/r/checkpoint_management_run_script.html.markdown
+++ b/website/docs/r/checkpoint_management_run_script.html.markdown
@@ -33,6 +33,7 @@ The following arguments are supported:
* `timeout` - (Optional) Script timeout in seconds.
* `tasks` - (Computed) Collection of asynchronous task unique identifiers.
* `response` - Response message in JSON format.
+* `script_type` - (Optional) Type of script. Run a new script ('one time') or an existing script from the repository ('repository').
## How To Use
Make sure this command will be executed in the right execution order.
diff --git a/website/docs/r/checkpoint_management_service_other.html.markdown b/website/docs/r/checkpoint_management_service_other.html.markdown
index 26ac742e..dc0ac0c7 100644
--- a/website/docs/r/checkpoint_management_service_other.html.markdown
+++ b/website/docs/r/checkpoint_management_service_other.html.markdown
@@ -47,6 +47,7 @@ Example: tcp, dport = 21, direction = 0 matches incoming FTP control connections
* `comments` - (Optional) Comments string.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `protocol` - (Optional) Protocol name or uid. The protocol type associated with the service, and by implication, the management server (if any) that enforces Content Security and Authe.
`aggressive_aging` supports the following:
diff --git a/website/docs/r/checkpoint_management_service_tcp.html.markdown b/website/docs/r/checkpoint_management_service_tcp.html.markdown
index 05a36054..ef07e542 100644
--- a/website/docs/r/checkpoint_management_service_tcp.html.markdown
+++ b/website/docs/r/checkpoint_management_service_tcp.html.markdown
@@ -51,6 +51,9 @@ The following arguments are supported:
* `color` - (Optional) Color of the object. Should be one of existing colors.
* `comments` - (Optional) Comments string.
* `tags` - (Optional) Collection of tag identifiers.
+* `delayed_sync_value` - (Optional) Specify the delay (in seconds) in which a synchronization will start after connection initiation.
+* `enable_tcp_resource` - (Optional) Enable for tcp resource.
+* `use_delayed_sync` - (Optional) Enable this option to delay notifying the Security Gateway about a connection, so that the connection will only be synchronized if it still exists x seconds aft.
`aggressive_aging` supports the following:
diff --git a/website/docs/r/checkpoint_management_set_automatic_purge.html.markdown b/website/docs/r/checkpoint_management_set_automatic_purge.html.markdown
index d1baac76..7166fa71 100644
--- a/website/docs/r/checkpoint_management_set_automatic_purge.html.markdown
+++ b/website/docs/r/checkpoint_management_set_automatic_purge.html.markdown
@@ -33,6 +33,7 @@ Note: when the automatic purge feature is enabled, this field and/or the "keep-s
Note: when the automatic purge feature is enabled, this field and/or the "keep-sessions-by-count" field must be set to 'true'.
* `number_of_days_to_keep` - (Optional) When "keep-sessions-by-days = true" this sets the number of days to keep the sessions.
* `scheduling` - (Optional) When to purge sessions that do not meet the "keep" criteria. Note: when the automatic purge feature is enabled, this field must be set.scheduling blocks are documented below.
+* `ignore_domain_backup` - (Optional) Ignore global domain sessions that are linked to the latest local domain backups, and purge them anyway.
`scheduling` supports the following:
diff --git a/website/docs/r/checkpoint_management_set_gateway_global_use.html.markdown b/website/docs/r/checkpoint_management_set_gateway_global_use.html.markdown
index e83d0ec1..58b5a9b0 100644
--- a/website/docs/r/checkpoint_management_set_gateway_global_use.html.markdown
+++ b/website/docs/r/checkpoint_management_set_gateway_global_use.html.markdown
@@ -26,6 +26,7 @@ The following arguments are supported:
* `enabled` - (Required) Indicates whether global use is enabled on the target.
* `target` - (Required) On what target to execute this command. Target may be identified by its object name, or object unique identifier.
+* `enable_identity_sharing` - (Optional) Indicates whether Identity Awareness Sharing global use is enabled on the target.
## How To Use
diff --git a/website/docs/r/checkpoint_management_set_global_properties.html.markdown b/website/docs/r/checkpoint_management_set_global_properties.html.markdown
index aaa6f9fe..26b8dc5b 100644
--- a/website/docs/r/checkpoint_management_set_global_properties.html.markdown
+++ b/website/docs/r/checkpoint_management_set_global_properties.html.markdown
@@ -52,6 +52,7 @@ The following arguments are supported:
* `domains_to_process` - (Optional) Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and with ignore-warnings true. Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER.domains_to_process blocks are documented below.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `identity_awareness` - (Optional) Configure Identity Awareness properties.identity_awareness blocks are documented below.
`firewall` supports the following:
@@ -292,6 +293,7 @@ The following arguments are supported:
`advanced_conf` supports the following:
* `certs_and_pki` - (Optional) Configure Certificates and PKI properties.certs_and_pki blocks are documented below.
+* `keep_ike_sas` - (Optional) Enabled: Keep ALL IKEv1 phase 1 Security Associations (SA) upon policy installation.
Disabled: Delete ALL IKEv1 phase 1 Security Associations (SA) ...
`security_server` supports the following:
@@ -302,16 +304,12 @@ The following arguments are supported:
* `telnet_welcome_msg_file` - (Optional) Telnet welcome message file is the name of a file whose contents are to be displayed when a user begins an Authenticated Telnet session.
* `mdq_welcome_msg` - (Optional) MDQ Welcome Message is the message to be displayed when a user begins an MDQ session. The MDQ Welcome Message should contain characters according to RFC 1035 and it must follow the ARPANET host name rules:
- This message must begin with a number or letter. After the first letter or number character the remaining characters can be a letter, number, space, tab or hyphen.
- This message must not end with a space or a tab and is limited to 63 characters.
* `smtp_welcome_msg` - (Optional) SMTP Welcome Message is the message to be displayed when a user begins an SMTP session.
-* `http_next_proxy_host` - (Optional) HTTP next proxy host is the host name of the HTTP proxy behind the Check Point Security Gateway HTTP security server (if there is one). Changing the HTTP Next Proxy fields takes effect after the Security Gateway database is downloaded to the authenticating gateway, or after the security policy is re-installed.
These settings apply only to firewalled gateways prior to NG. For later versions, these settings should be defined in the Node Properties window.
-* `http_next_proxy_port` - (Optional) HTTP next proxy port is the port of the HTTP proxy behind the Check Point Security Gateway HTTP security server (if there is one). Changing the HTTP Next Proxy fields takes effect after the Security Gateway database is downloaded to the authenticating gateway, or after the security policy is re-installed.
These settings apply only to firewalled gateways prior to NG. For later versions, these settings should be defined in the Node Properties window.
* `http_servers` - (Optional) This list specifies the HTTP servers. Defining HTTP servers allows you to restrict incoming HTTP.http_servers blocks are documented below.
* `server_for_null_requests` - (Optional) The Logical Name of a Null Requests Server from http-servers.
`vpn_authentication_and_encryption` supports the following:
-* `encryption_algorithms` - (Optional) Select the methods negotiated in IKE phase 2 and used in IPSec connections.encryption_algorithms blocks are documented below.
-* `encryption_method` - (Optional) Select the encryption method.
* `pre_shared_secret` - (Optional) the user password is specified in the Authentication tab in the user's IKE properties (in the user properties window: Encryption tab > Edit).
* `support_legacy_auth_for_sc_l2tp_nokia_clients` - (Optional) Support Legacy Authentication for SC (hybrid mode), L2TP (PAP) and Nokia clients (CRACK).
* `support_legacy_eap` - (Optional) Support Legacy EAP (Extensible Authentication Protocol).
@@ -426,12 +424,6 @@ The following arguments are supported:
* `reauthentication` - (Optional) Specify whether users must reauthenticate when accessing a specific server.
-`encryption_algorithms` supports the following:
-
-* `ike` - (Optional) Configure the IKE Phase 1 settings.ike blocks are documented below.
-* `ipsec` - (Optional) Configure the IPSEC Phase 2 settings.ipsec blocks are documented below.
-
-
`exceptions` supports the following:
* `hosts` - (Optional) Specify the Hosts to be excluded from SCV.hosts blocks are documented below.
@@ -449,66 +441,12 @@ The following arguments are supported:
* `remember_previously_detected_external_networks` - (Optional) The speed at which locations are classified as internal or external can be increased by caching (on the client side) names of networks that were previously determined to be external.
-`ike` supports the following:
-
-* `support_encryption_algorithms` - (Optional) Select the encryption algorithms that will be supported with remote hosts.support_encryption_algorithms blocks are documented below.
-* `use_encryption_algorithm` - (Optional) Choose the encryption algorithm that will have the highest priority of the selected algorithms. If given a choice of more that one encryption algorithm to use, the algorithm selected in this field will be used.
-* `support_data_integrity` - (Optional) Select the hash algorithms that will be supported with remote hosts to ensure data integrity.support_data_integrity blocks are documented below.
-* `use_data_integrity` - (Optional) The hash algorithm chosen here will be given the highest priority if more than one choice is offered.
-* `support_diffie_hellman_groups` - (Optional) Select the Diffie-Hellman groups that will be supported with remote hosts.support_diffie_hellman_groups blocks are documented below.
-* `use_diffie_hellman_group` - (Optional) SecureClient users utilize the Diffie-Hellman group selected in this field.
-
-
-`ipsec` supports the following:
-
-* `support_encryption_algorithms` - (Optional) Select the encryption algorithms that will be supported with remote hosts.support_encryption_algorithms blocks are documented below.
-* `use_encryption_algorithm` - (Optional) Choose the encryption algorithm that will have the highest priority of the selected algorithms. If given a choice of more that one encryption algorithm to use, the algorithm selected in this field will be used.
-* `support_data_integrity` - (Optional) Select the hash algorithms that will be supported with remote hosts to ensure data integrity.support_data_integrity blocks are documented below.
-* `use_data_integrity` - (Optional) The hash algorithm chosen here will be given the highest priority if more than one choice is offered.
-* `enforce_encryption_alg_and_data_integrity_on_all_users` - (Optional) Enforce Encryption Algorithm and Data Integrity on all users.
-
-
-`support_encryption_algorithms` supports the following:
-
-* `aes_128` - (Optional) Select whether the AES-128 encryption algorithm will be supported with remote hosts.
-* `aes_256` - (Optional) Select whether the AES-256 encryption algorithm will be supported with remote hosts.
-* `des` - (Optional) Select whether the DES encryption algorithm will be supported with remote hosts.
-* `tdes` - (Optional) Select whether the Triple DES encryption algorithm will be supported with remote hosts.
-
-
-`support_data_integrity` supports the following:
-
-* `aes_xcbc` - (Optional) Select whether the AES-XCBC hash algorithm will be supported with remote hosts to ensure data integrity.
-* `md5` - (Optional) Select whether the MD5 hash algorithm will be supported with remote hosts to ensure data integrity.
-* `sha1` - (Optional) Select whether the SHA1 hash algorithm will be supported with remote hosts to ensure data integrity.
-* `sha256` - (Optional) Select whether the SHA256 hash algorithm will be supported with remote hosts to ensure data integrity.
-
-
-`support_diffie_hellman_groups` supports the following:
-
-* `group1` - (Optional) Select whether Diffie-Hellman Group 1 (768 bit) will be supported with remote hosts.
-* `group14` - (Optional) Select whether Diffie-Hellman Group 14 (2048 bit) will be supported with remote hosts.
-* `group2` - (Optional) Select whether Diffie-Hellman Group 2 (1024 bit) will be supported with remote hosts.
-* `group5` - (Optional) Select whether Diffie-Hellman Group 5 (1536 bit) will be supported with remote hosts.
-
-
-`support_encryption_algorithms` supports the following:
-
-* `aes_128` - (Optional) Select whether the AES-128 encryption algorithm will be supported with remote hosts.
-* `aes_256` - (Optional) Select whether the AES-256 encryption algorithm will be supported with remote hosts.
-* `des` - (Optional) Select whether the DES encryption algorithm will be supported with remote hosts.
-* `tdes` - (Optional) Select whether the Triple DES encryption algorithm will be supported with remote hosts.
-
-
-`support_data_integrity` supports the following:
-
-* `aes_xcbc` - (Optional) Select whether the AES-XCBC hash algorithm will be supported with remote hosts to ensure data integrity.
-* `md5` - (Optional) Select whether the MD5 hash algorithm will be supported with remote hosts to ensure data integrity.
-* `sha1` - (Optional) Select whether the SHA1 hash algorithm will be supported with remote hosts to ensure data integrity.
-* `sha256` - (Optional) Select whether the SHA256 hash algorithm will be supported with remote hosts to ensure data integrity.
-
-
## How To Use
Make sure this command will be executed in the right execution order.
note: terraform execution is not sequential.
+
+`identity_awareness` supports the following:
+
+* `cache_mode` - (Optional) True: In case of connectivity loss from the Policy-Decision-Point (PDP), extend Identity cache up-to 'cache-mode-duration'.
False: Identity Cache M...
+* `cache_mode_duration` - (Optional) Time limit for keeping Identities in the cache.
diff --git a/website/docs/r/checkpoint_management_set_https_advanced_settings.html.markdown b/website/docs/r/checkpoint_management_set_https_advanced_settings.html.markdown
index a6991dea..b28279b7 100644
--- a/website/docs/r/checkpoint_management_set_https_advanced_settings.html.markdown
+++ b/website/docs/r/checkpoint_management_set_https_advanced_settings.html.markdown
@@ -60,6 +60,7 @@ The following arguments are supported:
* `domains_to_process` - (Optional) Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and with ignore-warnings true. Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER.domains_to_process blocks are documented below.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `show_block_page` - (Optional) Whether a block page should be displayed when TLS Inspection rejects a connection due to server certificate issues.
The default value is true.
`bypass_under_load` supports the following:
diff --git a/website/docs/r/checkpoint_management_set_policy_settings.html.markdown b/website/docs/r/checkpoint_management_set_policy_settings.html.markdown
index 1c0bc1c9..598d745c 100644
--- a/website/docs/r/checkpoint_management_set_policy_settings.html.markdown
+++ b/website/docs/r/checkpoint_management_set_policy_settings.html.markdown
@@ -27,6 +27,7 @@ The following arguments are supported:
* `last_in_cell` - (Optional) Added object after removing the last object in cell.
* `none_object_behavior` - (Optional) 'None' object behavior. Rules with object 'None' will never be matched.
* `security_access_defaults` - (Optional) Access Policy default values. security_access_defaults blocks are documented below.
+* `log_generation` - (Optional) Log generation settings for existing and new rules.
`security_access_defaults` supports the following:
@@ -34,6 +35,7 @@ The following arguments are supported:
* `destination` - (Optional) Destination default value for new rule creation. Any or None.
* `service` - (Optional) Service and Applications default value for new rule creation. Any or None.
* `source` - (Optional) Source default value for new rule creation. Any or None.
+* `track` - (Optional) Track default value for new rule creation. Log or None.
diff --git a/website/docs/r/checkpoint_management_simple_cluster.html.markdown b/website/docs/r/checkpoint_management_simple_cluster.html.markdown
index 1bb1e04a..b8db5b44 100644
--- a/website/docs/r/checkpoint_management_simple_cluster.html.markdown
+++ b/website/docs/r/checkpoint_management_simple_cluster.html.markdown
@@ -74,13 +74,28 @@ The following arguments are supported:
* `vpn` - (Optional) VPN blade enabled.
* `vpn_settings` - (Optional) Gateway VPN settings.vpn_settings blocks are documented below.
* `zero_phishing` - (Optional) Zero Phishing blade enabled.
-* `zero_phishing_fqdn` - (Optional) Zero Phishing gateway FQDN.
+* `zero_phishing_fqdn` - (Optional) Zero Phishing gateway FQDN. **Deprecated** - use `zero_phishing_settings.manual_fqdn` instead.
* `show_portals_certificate` - (Optional) Indicates whether to show the portals certificate value in the reply.
* `color` - (Optional) Color of the object. Should be one of existing colors.
* `comments` - (Optional) Comments string.
* `groups` - (Optional) Collection of group identifiers.groups blocks are documented below.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `anti_spam_and_email_security` - (Optional) Enables Anti-Spam & Email-Security blade.
+* `auto_topology_custom_recalculation_time` - (Optional) Auto topology custom recalculation time (seconds).
+* `auto_topology_use_custom_recalculation_time` - (Optional) Auto topology to use custom recalculation time instead of default.
+* `communication_with_servers_behind_nat` - (Optional) Gateway behind NAT communications settings with the server.communication_with_servers_behind_nat blocks are documented below.
+* `data_loss_prevention` - (Optional) Data Loss Prevention blade.
+* `dns_server` - (Optional) DNS Server.
+* `logs_settings` - (Optional) Logs settings that apply to Quantum Security Gateways that run Gaia OS.logs_settings blocks are documented below.
+* `mobile_access` - (Optional) Mobile Access blade.
+* `monitoring` - (Optional) Enables Real Time Monitoring blade.
+* `policy_server` - (Optional) Policy Server blade.
+* `rtm_counters_report` - (Optional) Enables monitoring blades system counters report (e.g CPU Usage,Memory Usage).
+* `rtm_traffic_report` - (Optional) Enables monitoring blades traffic report.
+* `rtm_traffic_report_per_connection` - (Optional) Enables Monitoring blade traffic report per connection.
+* `workforce_ai` - (Optional) Workforce AI Security blade enabled. Requires content awareness blade and version R82.20 or higher to be enabled.
+* `zero_phishing_settings` - (Optional) Fqdn settings.zero_phishing_settings blocks are documented below.
`advanced_settings` supports the following:
@@ -122,6 +137,10 @@ Switch to higher priority Cluster Member (according-to-priority).
* `deny_untrusted_server_cert` - (Optional) Set to be true in order to drop traffic from servers with untrusted server certificate.deny_untrusted_server_cert blocks are documented below.
* `deny_revoked_server_cert` - (Optional) Set to be true in order to drop traffic from servers with revoked server certificate (validate CRL).deny_revoked_server_cert blocks are documented below.
* `deny_expired_server_cert` - (Optional) Set to be true in order to drop traffic from servers with expired server certificate.deny_expired_server_cert blocks are documented below.
+* `bypass_on_client_failure` - (Optional) Bypass HTTPS inspection on client failure.bypass_on_client_failure blocks are documented below.
+* `bypass_under_load` - (Optional) Bypass HTTPS inspection under load.bypass_under_load blocks are documented below.
+* `deployment_mode` - (Optional) HTTPS inspection deployment mode.
+* `outbound_certificate` - (Optional) Outbound HTTPS inspection certificate.outbound_certificate blocks are documented below.
`identity_awareness_settings` supports the following:
@@ -135,6 +154,9 @@ Switch to higher priority Cluster Member (according-to-priority).
* `identity_sharing_settings` - (Optional) Identity sharing settings.identity_sharing_settings blocks are documented below.
* `proxy_settings` - (Optional) Identity-Awareness Proxy settings.proxy_settings blocks are documented below.
* `remote_access` - (Optional) Enable Remote Access Identity source.
+* `identity_based_enforcement` - (Optional) ON: Configures this object as a PEP-only object - identity-based enforcement (PEP) is enabled.
OFF: Configures this object as a PDP-only object - identity-ba.
+* `identity_web_api` - (Optional) Enable Identity Web API source.
+* `identity_web_api_settings` - (Optional) Identity Web API settings.identity_web_api_settings blocks are documented below.
`interfaces` supports the following:
@@ -161,6 +183,7 @@ Switch to higher priority Cluster Member (according-to-priority).
* `comments` - (Optional) Comments string.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `dynamic_ip` - (Optional) The Topology of interface with Dynamic IP is set to Automatic - External.
`ips_settings` supports the following:
@@ -190,6 +213,8 @@ The values must be in a range from 1 to N, where N is number of cluster members.
* `comments` - (Optional) Comments string.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `auto_generate_ip` - (Optional) Use an automatically generated IP address for the Gateway object (applies only to Smart-1 Cloud).
+* `trust_method` - (Optional) Trust method to use for establishing communication.
`nat_settings` supports the following:
@@ -200,6 +225,7 @@ The values must be in a range from 1 to N, where N is number of cluster members.
* `hide_behind` - (Optional) Hide behind method. This parameter is forbidden in case "method" parameter is "static".
* `install_on` - (Optional) Which gateway should apply the NAT translation.
* `method` - (Optional) NAT translation method.
+* `apply_control_connections` - (Optional) This option performs NAT on VPN control connections to and from this object.
`platform_portal_settings` supports the following:
@@ -236,6 +262,13 @@ Notation Wide Impact - Office Mode apply IPSec VPN Software Blade clients and to
* `vpn_domain` - (Optional) Gateway VPN domain identified by the name or UID.
* `vpn_domain_exclude_external_ip_addresses` - (Optional) Exclude the external IP addresses from the VPN domain of this Security Gateway.
* `vpn_domain_type` - (Optional) Gateway VPN domain type.
+* `advanced` - (Optional) Advanced VPN settings.advanced blocks are documented below.
+* `clientless_vpn_settings` - (Optional) Clientless VPN settings.clientless_vpn_settings blocks are documented below.
+* `enable_clientless_vpn` - (Optional) Enable clientless VPN.
+* `exported_routes` - (Optional) Exported routes.exported_routes blocks are documented below.
+* `interfaces` - (Optional) Enhanced Link Selection Interfaces.interfaces blocks are documented below.
+* `saml_portal_settings` - (Optional) SAML portal settings.saml_portal_settings blocks are documented below.
+* `vpn_clients` - (Optional) VPN clients settings.vpn_clients blocks are documented below.
`sam` supports the following:
@@ -315,6 +348,10 @@ Notation Wide Impact - Office Mode apply IPSec VPN Software Blade clients and to
* `share_with_other_gateways` - (Optional) Enable identity sharing with other gateways.
* `receive_from_other_gateways` - (Optional) Enable receiving identity from other gateways.
* `receive_from` - (Optional) Gateway(s) to receive identity from.receive_from blocks are documented below.
+* `cache_mode` - (Optional) Identity cache mode.cache_mode blocks are documented below.
+* `cache_mode_duration` - (Optional) Identity cache mode duration.cache_mode_duration blocks are documented below.
+* `receive_from_infinity_identity` - (Optional) Whether to receive identities from Infinity Identity.
+* `scaled_sharing` - (Optional) Whether scaled identity sharing is enabled.
`proxy_settings` supports the following:
@@ -364,12 +401,14 @@ Notation Wide Impact - Office Mode apply IPSec VPN Software Blade clients and to
* `comments` - (Optional) Comments string.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `dynamic_ip` - (Optional) The Topology of interface with Dynamic IP is set to Automatic - External.
`portal_web_settings` supports the following:
* `aliases` - (Optional) List of URL aliases that are redirected to the main portal URL.aliases blocks are documented below.
* `main_url` - (Optional) The main URL for the web portal.
+* `ip_address` - (Optional) Optional IP address to be used for the portal URL.
`certificate_settings` supports the following:
@@ -389,6 +428,7 @@ This file must be in the *.p12 format.
* `aliases` - (Optional) List of URL aliases that are redirected to the main portal URL.aliases blocks are documented below.
* `main_url` - (Optional) The main URL for the web portal.
+* `ip_address` - (Optional) Optional IP address to be used for the portal URL.
`certificate_settings` supports the following:
@@ -407,11 +447,21 @@ This file must be in the *.p12 format.
`authentication` supports the following:
* `authentication_clients` - (Optional) Collection of VPN Authentication clients identified by the name or UID.authentication_clients blocks are documented below.
+* `dynamic_id_settings` - (Optional) Dynamic ID settings, relevant only when "override-global-dynamic-id-settings" is true.dynamic_id_settings blocks are documented below.
+* `override_global_dynamic_id_settings` - (Optional) Override global dynamic ID settings.
+* `send_machine_certificate` - (Optional) Configure when to send machine certificate.
+* `single_authentication_client` - (Optional) Settings for clients that support only single authentication method.single_authentication_client blocks are documented below.
`link_selection` supports the following:
* `dns_resolving_hostname` - (Optional) DNS Resolving Hostname. Must be set when "ip-selection" was selected to be "dns-resolving-from-hostname".
+* `outgoing_link_tracking` - (Optional) Outgoing link tracking method.
+* `probing_settings` - (Optional) Probing settings configuration. Only available when "ip-selection" is "use-probing-with-high-availability" or "use-probing-with-load-sharing".probing_settings blocks are documented below.
+* `responding_traffic` - (Optional) Responding traffic route selection method.
+* `route_selection_method` - (Optional) Outgoing route selection method when initiating a tunnel.
+* `selected_ip` - (Optional) Selected IP address. Must be set when "source-ip-selection" was selected to be "manual".
+* `source_ip_selection` - (Optional) Source IP address selection method for outgoing traffic.
`office_mode` supports the following:
@@ -580,6 +630,7 @@ Must be set when "allocate-method" was selected to be "automatic".
* `aliases` - (Optional) List of URL aliases that are redirected to the main portal URL.aliases blocks are documented below.
* `main_url` - (Optional) The main URL for the web portal.
+* `ip_address` - (Optional) Optional IP address to be used for the portal URL.
`certificate_settings` supports the following:
@@ -665,3 +716,342 @@ Must be set when "use-second-backup-wins-server" is true and can not be set when
* `undefined` - (Optional) Controls portal access settings for internal interfaces, whose topology is set to 'Undefined'.
* `dmz` - (Optional) Controls portal access settings for internal interfaces, whose topology is set to 'DMZ'.
* `vpn` - (Optional) Controls portal access settings for interfaces that are part of a VPN Encryption Domain.
+
+
+`application_control_and_url_filtering_settings` supports the following:
+
+* `global_settings_mode` - (Optional) Whether to override global settings or not.
+* `override_global_settings` - (Optional) override global settings object.override_global_settings blocks are documented below.
+
+
+`override_global_settings` supports the following:
+
+* `fail_mode` - (Optional) Fail mode - allow or block all requests.
+* `website_categorization` - (Optional) Website categorization object.website_categorization blocks are documented below.
+
+
+`website_categorization` supports the following:
+
+* `custom_mode` - (Optional) Custom mode object.custom_mode blocks are documented below.
+* `mode` - (Optional) Website categorization mode.
+
+
+`custom_mode` supports the following:
+
+* `social_networking_widgets` - (Optional) Social networking widgets mode.
+* `url_filtering` - (Optional) URL filtering mode.
+
+
+`cluster_settings` supports the following:
+
+* `member_recovery_mode` - (Optional) In a High Availability cluster, each member is given a priority. The member with the highest priority serves as the gateway. If this gateway fails, control is p.
+* `state_synchronization` - (Optional) Cluster State Synchronization settings.state_synchronization blocks are documented below.
+* `track_changes_of_cluster_members` - (Optional) Track changes in the status of Cluster Members.
+* `use_virtual_mac` - (Optional) Use Virtual MAC. By enabling Virtual MAC in ClusterXL High Availability New mode, or Load Sharing Unicast mode, all cluster members associate the same Virtual M.
+
+
+`state_synchronization` supports the following:
+
+* `delayed` - (Optional) Start synchronizing with delay of seconds, as defined by delayed-seconds, after connection initiation. Disabled when state-synchronization disabled.
+* `delayed_seconds` - (Optional) Start synchronizing X seconds after connection initiation . The values must be in a range between 2 and 3600.
+* `enabled` - (Optional) Use State Synchronization.
+
+
+`communication_with_servers_behind_nat` supports the following:
+
+* `override_profile` - (Optional) Whether to override the Server (Check Point Host) object configuration.
+* `value` - (Optional) according-to-topology: Use the original or translated IP address of the server based on the Topology of Security Gateway interfaces.
original-ip-only: Use on.
+
+
+`bypass_on_client_failure` supports the following:
+
+* `override_profile` - (Optional) Whether to override the value inherited from the profile.
+* `value` - (Optional) Whether to bypass on client failure.
+
+
+`bypass_under_load` supports the following:
+
+* `value` - (Optional) Whether to bypass under load.
+
+
+`outbound_certificate` supports the following:
+
+* `override_profile` - (Optional) Whether to override the value inherited from the profile.
+* `value` - (Optional) Outbound certificate identified by the name or UID.
+
+
+`cache_mode` supports the following:
+
+* `override_profile` - (Optional) Whether to override the value inherited from the profile.
+* `value` - (Optional) Whether the identity cache is enabled.
+
+
+`cache_mode_duration` supports the following:
+
+* `override_profile` - (Optional) Whether to override the value inherited from the profile.
+* `value` - (Optional) Identity cache duration in minutes.
+
+
+`identity_web_api_settings` supports the following:
+
+* `authentication_settings` - (Optional) Authentication Settings for Identity Web Api.authentication_settings blocks are documented below.
+* `authorized_clients` - (Optional) Authorized Clients.authorized_clients blocks are documented below.
+* `client_access_permissions` - (Optional) Identity Web Api accessibility settings.client_access_permissions blocks are documented below.
+
+
+`authentication_settings` supports the following:
+
+* `users_directories` - (Optional) Users directories.users_directories blocks are documented below.
+
+
+`users_directories` supports the following:
+
+* `external_user_profile` - (Optional) External user profile.
+* `internal_users` - (Optional) Internal users.
+* `specific` - (Optional) LDAP AU objects identified by the name or UID. Must be set when 'users-from-external-directories' was selected to be 'specific'.
+* `users_from_external_directories` - (Optional) Users from external directories.
+
+
+`authorized_clients` supports the following:
+
+* `client` - (Optional) Host / Network Group Name or UID.
+* `client_secret` - (Optional) Client Secret.
+
+
+`client_access_permissions` supports the following:
+
+* `accessibility` - (Optional) Configuration of the portal access settings.accessibility blocks are documented below.
+
+
+`accessibility` supports the following:
+
+* `allow_access_from` - (Optional) Allowed access to the web portal (based on interfaces, or security policy).
+* `internal_access_settings` - (Optional) Configuration of the additional portal access settings for internal interfaces only.internal_access_settings blocks are documented below.
+
+
+`internal_access_settings` supports the following:
+
+* `dmz` - (Optional) Controls portal access settings for internal interfaces, whose topology is set to 'DMZ'.
+* `undefined` - (Optional) Controls portal access settings for internal interfaces, whose topology is set to 'Undefined'.
+* `vpn` - (Optional) Controls portal access settings for interfaces that are part of a VPN Encryption Domain.
+
+
+`logs_settings` supports the following:
+
+* `alert_when_free_disk_space_below` - (Optional) Enable alert when free disk space is below threshold.
+* `alert_when_free_disk_space_below_threshold` - (Optional) Alert when free disk space below threshold.
+* `alert_when_free_disk_space_below_type` - (Optional) Alert when free disk space below type.
+* `before_delete_keep_logs_from_the_last_days` - (Optional) Enable before delete keep logs from the last days.
+* `before_delete_keep_logs_from_the_last_days_threshold` - (Optional) Before delete keep logs from the last days threshold.
+* `before_delete_run_script` - (Optional) Enable Before delete run script.
+* `before_delete_run_script_command` - (Optional) Before delete run script command.
+* `delete_index_files_older_than_days` - (Optional) Enable delete index files older than days.
+* `delete_index_files_older_than_days_threshold` - (Optional) Delete index files older than days threshold.
+* `delete_index_files_when_index_size_above` - (Optional) Enable delete index files when index size above.
+* `delete_index_files_when_index_size_above_threshold` - (Optional) Delete index files when index size above threshold.
+* `delete_when_free_disk_space_below` - (Optional) Enable delete when free disk space below.
+* `delete_when_free_disk_space_below_threshold` - (Optional) Delete when free disk space below threshold.
+* `detect_new_citrix_ica_application_names` - (Optional) Enable detect new Citrix ICA application names.
+* `distribute_logs_between_all_active_servers` - (Optional) Distribute logs between all active servers.
+* `forward_logs_to_log_server` - (Optional) Enable forward logs to log server.
+* `forward_logs_to_log_server_name` - (Optional) Forward logs to log server name.
+* `forward_logs_to_log_server_schedule_name` - (Optional) Forward logs to log server schedule name.
+* `free_disk_space_metrics` - (Optional) Free disk space metrics.
+* `include_tcp_state_information` - (Optional) Include TCP state information. Relevant only when Firewall blade is enabled.
+* `perform_log_rotate_before_log_forwarding` - (Optional) Enable perform log rotate before log forwarding.
+* `reject_connections_when_free_disk_space_below_threshold` - (Optional) Enable reject connections when free disk space below threshold.
+* `reserve_for_packet_capture_metrics` - (Optional) Reserve for packet capture metrics.
+* `reserve_for_packet_capture_threshold` - (Optional) Reserve for packet capture threshold.
+* `rotate_log_by_file_size` - (Optional) Enable rotate log by file size.
+* `rotate_log_file_size_threshold` - (Optional) Log file size threshold.
+* `rotate_log_on_schedule` - (Optional) Enable rotate log on schedule.
+* `rotate_log_schedule_name` - (Optional) Rotate log schedule name.
+* `stop_logging_when_free_disk_space_below` - (Optional) Enable stop logging when free disk space below.
+* `stop_logging_when_free_disk_space_below_threshold` - (Optional) Stop logging when free disk space below threshold.
+* `turn_on_qos_logging` - (Optional) Enable turn on QoS Logging.
+* `update_account_log_every` - (Optional) Update account log in every amount of seconds.
+
+
+`anti_spoofing_settings` supports the following:
+
+* `action` - (Optional) If packets will be rejected (the Prevent option) or whether the packets will be monitored (the Detect option).
+* `exclude_packets` - (Optional) Don't check packets from excluded network.
+* `excluded_network_name` - (Optional) Excluded network name.
+* `excluded_network_uid` - (Optional) Excluded network UID.
+* `spoof_tracking` - (Optional) Spoof tracking.
+
+
+`security_zone_settings` supports the following:
+
+* `auto_calculated` - (Optional) Security Zone is calculated according to where the interface leads to.
+
+
+`topology_settings` supports the following:
+
+* `interface_leads_to_dmz` - (Optional) Whether this interface leads to demilitarized zone (perimeter network).
+* `ip_address_behind_this_interface` - (Optional) Network settings behind this interface.
+* `specific_network` - (Optional) Network behind this interface.
+
+
+`advanced` supports the following:
+
+* `enable_nat_traversal` - (Optional) Enable NAT traversal.
+* `enable_wire_mode` - (Optional) Enable wire mode.
+* `enable_wire_mode_log_traffic` - (Optional) Log traffic in wire mode.
+* `shutdown_on_gateway_restart` - (Optional) Shutdown VPN tunnels on gateway restart.
+* `tunnel_sharing_mode` - (Optional) Tunnel sharing mode.
+* `wire_mode_interfaces` - (Optional) Wire mode interfaces.
+
+
+`dynamic_id_settings` supports the following:
+
+* `advanced_settings` - (Optional) Advanced Dynamic ID configuration settings.advanced_settings blocks are documented below.
+* `sms_provider_and_email_settings` - (Optional) SMS provider and email configuration.
+* `sms_provider_credentials` - (Optional) SMS provider credentials configuration.sms_provider_credentials blocks are documented below.
+
+
+`advanced_settings` supports the following:
+
+* `country_code` - (Optional) Country code for SMS services.
+* `dynamic_id_message` - (Optional) Dynamic ID message displayed to users.
+* `enable_display_user_details` - (Optional) Enable display of user details.
+* `otp_settings` - (Optional) One Time Password configuration settings.otp_settings blocks are documented below.
+* `user_details_retrieval` - (Optional) User details retrieval method.
+
+
+`otp_settings` supports the following:
+
+* `expiration` - (Optional) One time password expiration (in minutes).
+* `length` - (Optional) Length of one time password.
+* `max_attempts` - (Optional) Number of times users can attempt to enter the one time password before the entire authentication process restarts.
+
+
+`sms_provider_credentials` supports the following:
+
+* `api_id` - (Optional) SMS provider API ID.
+* `password` - (Optional) SMS provider password.
+* `username` - (Optional) SMS provider username.
+
+
+`single_authentication_client` supports the following:
+
+* `allow_multiple_authentication_clients` - (Optional) Allow clients that support multiple authentication methods to connect.
+* `client_display_settings` - (Optional) Client display configuration settings.client_display_settings blocks are documented below.
+* `display_name` - (Optional) Display name for the authentication method.
+* `enabled` - (Optional) Allow clients that support only single authentication method.
+* `method` - (Optional) Authentication method type.
+* `personal_certificate` - (Optional) Personal certificate authentication settings, relevant only when method is "personal-certificate".personal_certificate blocks are documented below.
+* `radius` - (Optional) RADIUS authentication settings, relevant only when method is "radius".radius blocks are documented below.
+* `secur_id` - (Optional) SecurID authentication settings, relevant only when method is "secur-id".secur_id blocks are documented below.
+
+
+`client_display_settings` supports the following:
+
+* `headline` - (Optional) Display headline for authentication dialog.
+* `password_label` - (Optional) Label for password field.
+* `username_label` - (Optional) Label for username field.
+
+
+`personal_certificate` supports the following:
+
+* `dn_concurrence` - (Optional) DN part occurrence number.
+* `dn_part` - (Optional) DN part to extract.
+* `fetch_username_from` - (Optional) Fetch username from.
+* `source` - (Optional) Certificate source field.
+* `storage_type` - (Optional) Certificate storage type.
+
+
+`radius` supports the following:
+
+* `ask_user_password` - (Optional) Ask user for password during authentication.
+* `server` - (Optional) Server object identified by the name or UID.
+
+
+`secur_id` supports the following:
+
+* `server` - (Optional) Server object identified by the name or UID.
+* `token_card_type` - (Optional) Token card type.
+
+
+`clientless_vpn_settings` supports the following:
+
+* `accept_only_3des` - (Optional) Accept only 3DES.
+* `certificate_gateway_authentication` - (Optional) Certificate gateway authentication.
+* `client_authentication` - (Optional) Client authentication.
+* `concurrent_servers_or_processes` - (Optional) Number of concurrent servers or processes.
+
+
+`exported_routes` supports the following:
+
+* `custom_routes` - (Optional) Export custom routes.
+* `custom_routes_object` - (Optional) Custom routes object identified by the name or UID.
+* `internal_interfaces` - (Optional) Export internal interfaces.
+* `static_routes` - (Optional) Export static routes.
+
+
+`interfaces` supports the following:
+
+* `interface_name` - (Optional) The name of the interface.
+* `ip_version` - (Optional) The IP version of the interface's IP address (IPv4/IPv6).
+* `next_hop_ip` - (Optional) The IP address of the next hop.
+* `priority` - (Optional) Priority of a 'Backup' interface.
+* `redundancy_mode` - (Optional) Interface redundancy mode (Active/Backup).
+* `static_nat_ip` - (Optional) The NATed IPv4 address that hides the source IPv4 address of outgoing connections (applies only to IPv4).
+
+
+`probing_settings` supports the following:
+
+* `primary_address` - (Optional) Primary IP address to use. Must be one of the addresses from "probed-interface-list". Required when "use-primary-address" is true.
+* `probed_interface_list` - (Optional) List of specific IP addresses to probe. Only relevant when "probed-interfaces" is set to "specific".
+* `probed_interfaces` - (Optional) Specifies whether to probe all addresses defined in the topology tab or specific addresses.
+* `probing_method` - (Optional) Probing method.
+* `use_primary_address` - (Optional) Whether to use a primary address for high availability probing.
+
+
+`saml_portal_settings` supports the following:
+
+* `accessibility` - (Optional) Configuration of the portal access settings.accessibility blocks are documented below.
+* `certificate_settings` - (Optional) Configuration of the SAML portal certificate.certificate_settings blocks are documented below.
+* `portal_web_settings` - (Optional) Configuration of the SAML portal web settings.portal_web_settings blocks are documented below.
+
+
+`accessibility` supports the following:
+
+* `allow_access_from` - (Optional) Allowed access to the SAML portal.
+* `internal_access_settings` - (Optional) Configuration of the additional portal access settings for internal interfaces only.internal_access_settings blocks are documented below.
+
+
+`internal_access_settings` supports the following:
+
+* `dmz` - (Optional) Controls portal access settings for internal interfaces, whose topology is set to "DMZ".
+* `undefined` - (Optional) Controls portal access settings for internal interfaces, whose topology is set to "Undefined".
+* `vpn` - (Optional) Controls portal access settings for interfaces that are part of a VPN Encryption Domain.
+
+
+`certificate_settings` supports the following:
+
+* `base64_certificate` - (Optional) The certificate file encoded in Base64 with padding.
+* `base64_password` - (Optional) Certificate file password.
+
+
+`portal_web_settings` supports the following:
+
+* `aliases` - (Optional) List of URL aliases that are redirected to the main portal URL.
+* `ip_address` - (Optional) Optional IP address to be used for the portal URL.
+* `main_url` - (Optional) The main URL for the portal.
+
+
+`vpn_clients` supports the following:
+
+* `enable_capsule_vpn_connect` - (Optional) Enable Capsule VPN Connect client.
+* `enable_cp_mobile_for_windows` - (Optional) Enable Check Point Mobile for Windows client.
+* `enable_endpoint_security_vpn` - (Optional) Enable Endpoint Security VPN client.
+* `enable_secu_remote` - (Optional) Enable SecuRemote client.
+* `enable_ssl_network_extender` - (Optional) Enable SSL Network Extender client.
+* `gateway_authentication_certificate` - (Optional) Gateway authentication certificate.
+
+
+`zero_phishing_settings` supports the following:
+
+* `gateway_fqdn_mode` - (Optional) Manual Fqdn.
+* `manual_fqdn` - (Optional) Zero Phishing gateway FQDN.
diff --git a/website/docs/r/checkpoint_management_simple_gateway.html.markdown b/website/docs/r/checkpoint_management_simple_gateway.html.markdown
index 47cf7cb8..4b95602a 100644
--- a/website/docs/r/checkpoint_management_simple_gateway.html.markdown
+++ b/website/docs/r/checkpoint_management_simple_gateway.html.markdown
@@ -67,13 +67,39 @@ The following arguments are supported:
* `vpn` - (Optional) VPN blade enabled.
* `vpn_settings` - (Optional) Gateway VPN settings.vpn_settings blocks are documented below.
* `zero_phishing` - (Optional) Zero Phishing blade enabled.
-* `zero_phishing_fqdn` - (Optional) Zero Phishing gateway FQDN.
+* `zero_phishing_fqdn` - (Optional) Zero Phishing gateway FQDN. **Deprecated** - use `zero_phishing_settings.manual_fqdn` instead.
* `logs_settings` - (Optional) Logs settings that apply to Quantum Security Gateways that run Gaia OS.logs_settings blocks are documented below.
* `show_portals_certificate` - (Optional) Indicates whether to show the portals certificate value in the reply.
* `color` - (Optional) Color of the object. Should be one of existing colors.
* `comments` - (Optional) Comments string.
* `groups` - (Optional) Collection of group identifiers.groups blocks are documented below.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `accept_syslog_messages` - (Optional) Enables the gateway accept syslog messages, relevant only when Logging and Status/Network Policy Management blades are enabled.
+* `anti_spam_and_email_security` - (Optional) Enables Anti-Spam & Email-Security blade.
+* `auto_generate_ip` - (Optional) Use an automatically generated IP address for the Gateway object (applies only to Smart-1 Cloud).
+* `auto_topology_custom_recalculation_time` - (Optional) Auto topology custom recalculation time (seconds).
+* `auto_topology_use_custom_recalculation_time` - (Optional) Auto topology to use custom recalculation time instead of default.
+* `autonomous_system_number` - (Optional) The Autonomous System Number (ASN). It is automatically fetched from the Security Gateway object. You can change this value only for externally manage...
+* `communication_with_servers_behind_nat` - (Optional) Gateway behind NAT communications settings with the server.communication_with_servers_behind_nat blocks are documented below.
+* `data_loss_prevention` - (Optional) Data Loss Prevention blade.
+* `dns_server` - (Optional) DNS Server.
+* `enable_log_indexing` - (Optional) Enable log indexing, The Log Indexing uses more storage to provide fast log queries, relevant only when Logging and Status blade is enabled.
+* `export_logs_to_servers` - (Optional) Export logs to syslog/SIEM servers. NOTE:After you configure a Log Exporter, you must run Install Database. Relevant only when Logging and Status/Netw...
+* `fetch_policy_scheduler` - (Optional) Fetch policy functionality settings.fetch_policy_scheduler blocks are documented below.
+* `hardware_subtype` - (Optional) Gateway type (relevant only for Spark gateways).
+* `install_policy_without_push` - (Optional) Specifies whether the policy is pushed to the gateway during policy installation, or whether the gateway should fetch the policy.
+* `interfaces_topology_settings` - (Optional) Topology setting for all interfaces on a Security Gateway. Default for Security Gateways that run Gaia OS: 'per interface'. Default for Quantum Spark gateways t.
+* `mobile_access` - (Optional) Mobile Access blade.
+* `monitoring` - (Optional) Enables Real Time Monitoring blade.
+* `policy_server` - (Optional) Policy Server blade.
+* `rtm_counters_report` - (Optional) Enables monitoring blades system counters report (e.g CPU Usage,Memory Usage).
+* `rtm_traffic_report` - (Optional) Enables monitoring blades traffic report.
+* `rtm_traffic_report_per_connection` - (Optional) Enables Monitoring blade traffic report per connection.
+* `smart_event_intro_correlation_unit` - (Optional) Enables the gateway use SmartEvent intro correlation unit with one Security Gateway Software Blade. Relevant only when the Logging and Status blade is enabled,.
+* `trust_method` - (Optional) Establish the trust communication method.
+* `trust_settings` - (Optional) Settings for the trusted communication establishment.trust_settings blocks are documented below.
+* `workforce_ai` - (Optional) Workforce AI Security blade enabled. Requires content awareness blade and version R82.20 or higher to be enabled.
+* `zero_phishing_settings` - (Optional) Fqdn settings.zero_phishing_settings blocks are documented below.
`advanced_settings` supports the following:
@@ -105,6 +131,10 @@ The following arguments are supported:
* `deny_untrusted_server_cert` - (Optional) Set to be true in order to drop traffic from servers with untrusted server certificate.deny_untrusted_server_cert blocks are documented below.
* `deny_revoked_server_cert` - (Optional) Set to be true in order to drop traffic from servers with revoked server certificate (validate CRL).deny_revoked_server_cert blocks are documented below.
* `deny_expired_server_cert` - (Optional) Set to be true in order to drop traffic from servers with expired server certificate.deny_expired_server_cert blocks are documented below.
+* `bypass_on_client_failure` - (Optional) Bypass HTTPS inspection on client failure.bypass_on_client_failure blocks are documented below.
+* `bypass_under_load` - (Optional) Bypass HTTPS inspection under load.bypass_under_load blocks are documented below.
+* `deployment_mode` - (Optional) HTTPS inspection deployment mode.
+* `outbound_certificate` - (Optional) Outbound HTTPS inspection certificate.outbound_certificate blocks are documented below.
`identity_awareness_settings` supports the following:
@@ -118,6 +148,9 @@ The following arguments are supported:
* `identity_sharing_settings` - (Optional) Identity sharing settings.identity_sharing_settings blocks are documented below.
* `proxy_settings` - (Optional) Identity-Awareness Proxy settings.proxy_settings blocks are documented below.
* `remote_access` - (Optional) Enable Remote Access Identity source.
+* `identity_based_enforcement` - (Optional) ON: Configures this object as a PEP-only object - identity-based enforcement (PEP) is enabled.
OFF: Configures this object as a PDP-only object - identity-ba.
+* `identity_web_api` - (Optional) Enable Identity Web API source.
+* `identity_web_api_settings` - (Optional) Identity Web API settings.identity_web_api_settings blocks are documented below.
`interfaces` supports the following:
@@ -140,6 +173,7 @@ The following arguments are supported:
* `color` - (Optional) Color of the object. Should be one of existing colors.
* `comments` - (Optional) Comments string.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `dynamic_ip` - (Optional) The Topology of interface with Dynamic IP is set to Automatic - External.
`ips_settings` supports the following:
@@ -161,6 +195,7 @@ The following arguments are supported:
* `hide_behind` - (Optional) Hide behind method. This parameter is forbidden in case "method" parameter is "static".
* `install_on` - (Optional) Which gateway should apply the NAT translation.
* `method` - (Optional) NAT translation method.
+* `apply_control_connections` - (Optional) This option performs NAT on VPN control connections to and from this object.
`platform_portal_settings` supports the following:
@@ -197,6 +232,13 @@ Notation Wide Impact - Office Mode apply IPSec VPN Software Blade clients and to
* `vpn_domain` - (Optional) Gateway VPN domain identified by the name or UID.
* `vpn_domain_exclude_external_ip_addresses` - (Optional) Exclude the external IP addresses from the VPN domain of this Security Gateway.
* `vpn_domain_type` - (Optional) Gateway VPN domain type.
+* `advanced` - (Optional) Advanced VPN settings.advanced blocks are documented below.
+* `clientless_vpn_settings` - (Optional) Clientless VPN settings.clientless_vpn_settings blocks are documented below.
+* `enable_clientless_vpn` - (Optional) Enable clientless VPN.
+* `exported_routes` - (Optional) Exported routes.exported_routes blocks are documented below.
+* `interfaces` - (Optional) Enhanced Link Selection Interfaces.interfaces blocks are documented below.
+* `saml_portal_settings` - (Optional) SAML portal settings.saml_portal_settings blocks are documented below.
+* `vpn_clients` - (Optional) VPN clients settings.vpn_clients blocks are documented below.
`logs_settings` supports the following:
@@ -232,6 +274,7 @@ Notation Wide Impact - Office Mode apply IPSec VPN Software Blade clients and to
* `stop_logging_when_free_disk_space_below_threshold` - (Optional) Stop logging when free disk space below threshold.
* `turn_on_qos_logging` - (Optional) Enable turn on QoS Logging.
* `update_account_log_every` - (Optional) Update account log in every amount of seconds.
+* `include_tcp_state_information` - (Optional) Include TCP state information. Relevant only when Firewall blade is enabled.
`sam` supports the following:
@@ -303,6 +346,10 @@ Notation Wide Impact - Office Mode apply IPSec VPN Software Blade clients and to
* `share_with_other_gateways` - (Optional) Enable identity sharing with other gateways.
* `receive_from_other_gateways` - (Optional) Enable receiving identity from other gateways.
* `receive_from` - (Optional) Gateway(s) to receive identity from.receive_from blocks are documented below.
+* `cache_mode` - (Optional) Identity cache mode.cache_mode blocks are documented below.
+* `cache_mode_duration` - (Optional) Identity cache mode duration.cache_mode_duration blocks are documented below.
+* `receive_from_infinity_identity` - (Optional) Whether to receive identities from Infinity Identity.
+* `scaled_sharing` - (Optional) Whether scaled identity sharing is enabled.
`proxy_settings` supports the following:
@@ -335,6 +382,7 @@ Notation Wide Impact - Office Mode apply IPSec VPN Software Blade clients and to
* `aliases` - (Optional) List of URL aliases that are redirected to the main portal URL.aliases blocks are documented below.
* `main_url` - (Optional) The main URL for the web portal.
+* `ip_address` - (Optional) Optional IP address to be used for the portal URL.
`certificate_settings` supports the following:
@@ -354,6 +402,7 @@ This file must be in the *.p12 format.
* `aliases` - (Optional) List of URL aliases that are redirected to the main portal URL.aliases blocks are documented below.
* `main_url` - (Optional) The main URL for the web portal.
+* `ip_address` - (Optional) Optional IP address to be used for the portal URL.
`certificate_settings` supports the following:
@@ -372,11 +421,21 @@ This file must be in the *.p12 format.
`authentication` supports the following:
* `authentication_clients` - (Optional) Collection of VPN Authentication clients identified by the name or UID.authentication_clients blocks are documented below.
+* `dynamic_id_settings` - (Optional) Dynamic ID settings, relevant only when "override-global-dynamic-id-settings" is true.dynamic_id_settings blocks are documented below.
+* `override_global_dynamic_id_settings` - (Optional) Override global dynamic ID settings.
+* `send_machine_certificate` - (Optional) Configure when to send machine certificate.
+* `single_authentication_client` - (Optional) Settings for clients that support only single authentication method.single_authentication_client blocks are documented below.
`link_selection` supports the following:
* `dns_resolving_hostname` - (Optional) DNS Resolving Hostname. Must be set when "ip-selection" was selected to be "dns-resolving-from-hostname".
+* `outgoing_link_tracking` - (Optional) Outgoing link tracking method.
+* `probing_settings` - (Optional) Probing settings configuration. Only available when "ip-selection" is "use-probing-with-high-availability" or "use-probing-with-load-sharing".probing_settings blocks are documented below.
+* `responding_traffic` - (Optional) Responding traffic route selection method.
+* `route_selection_method` - (Optional) Outgoing route selection method when initiating a tunnel.
+* `selected_ip` - (Optional) Selected IP address. Must be set when "source-ip-selection" was selected to be "manual".
+* `source_ip_selection` - (Optional) Source IP address selection method for outgoing traffic.
`office_mode` supports the following:
@@ -524,6 +583,7 @@ Must be set when "allocate-method" was selected to be "automatic".
* `aliases` - (Optional) List of URL aliases that are redirected to the main portal URL.aliases blocks are documented below.
* `main_url` - (Optional) The main URL for the web portal.
+* `ip_address` - (Optional) Optional IP address to be used for the portal URL.
`certificate_settings` supports the following:
@@ -609,3 +669,259 @@ Must be set when "use-second-backup-wins-server" is true and can not be set when
* `undefined` - (Optional) Controls portal access settings for internal interfaces, whose topology is set to 'Undefined'.
* `dmz` - (Optional) Controls portal access settings for internal interfaces, whose topology is set to 'DMZ'.
* `vpn` - (Optional) Controls portal access settings for interfaces that are part of a VPN Encryption Domain.
+
+
+`communication_with_servers_behind_nat` supports the following:
+
+* `override_profile` - (Optional) Whether to override the Server (Check Point Host) object configuration.
+* `value` - (Optional) according-to-topology: Use the original or translated IP address of the server based on the Topology of Security Gateway interfaces.
original-ip-only: Use on.
+
+
+`fetch_policy_scheduler` supports the following:
+
+* `enabled` - (Optional) Indicates if the Security Gateway will fetch policy according to a schedule (true) or manually (false).
+* `schedule` - (Optional) Scheduled Event for fetching policy by.
Will be applied only when the `enabled` field is set to true.
When not defined ...
+
+
+`bypass_on_client_failure` supports the following:
+
+* `override_profile` - (Optional) Whether to override the value inherited from the profile.
+* `value` - (Optional) Whether to bypass on client failure.
+
+
+`bypass_under_load` supports the following:
+
+* `value` - (Optional) Whether to bypass under load.
+
+
+`outbound_certificate` supports the following:
+
+* `override_profile` - (Optional) Whether to override the value inherited from the profile.
+* `value` - (Optional) Outbound certificate identified by the name or UID.
+
+
+`cache_mode` supports the following:
+
+* `override_profile` - (Optional) Whether to override the value inherited from the profile.
+* `value` - (Optional) Whether the identity cache is enabled.
+
+
+`cache_mode_duration` supports the following:
+
+* `override_profile` - (Optional) Whether to override the value inherited from the profile.
+* `value` - (Optional) Identity cache duration in minutes.
+
+
+`identity_web_api_settings` supports the following:
+
+* `authentication_settings` - (Optional) Authentication Settings for Identity Web Api.authentication_settings blocks are documented below.
+* `authorized_clients` - (Optional) Authorized Clients.authorized_clients blocks are documented below.
+* `client_access_permissions` - (Optional) Identity Web Api accessibility settings.client_access_permissions blocks are documented below.
+
+
+`authentication_settings` supports the following:
+
+* `users_directories` - (Optional) Users directories.users_directories blocks are documented below.
+
+
+`users_directories` supports the following:
+
+* `external_user_profile` - (Optional) External user profile.
+* `internal_users` - (Optional) Internal users.
+* `specific` - (Optional) LDAP AU objects identified by the name or UID. Must be set when 'users-from-external-directories' was selected to be 'specific'.
+* `users_from_external_directories` - (Optional) Users from external directories.
+
+
+`authorized_clients` supports the following:
+
+* `client` - (Optional) Host / Network Group Name or UID.
+* `client_secret` - (Optional) Client Secret.
+
+
+`client_access_permissions` supports the following:
+
+* `accessibility` - (Optional) Configuration of the portal access settings.accessibility blocks are documented below.
+
+
+`accessibility` supports the following:
+
+* `allow_access_from` - (Optional) Allowed access to the web portal (based on interfaces, or security policy).
+* `internal_access_settings` - (Optional) Configuration of the additional portal access settings for internal interfaces only.internal_access_settings blocks are documented below.
+
+
+`internal_access_settings` supports the following:
+
+* `dmz` - (Optional) Controls portal access settings for internal interfaces, whose topology is set to 'DMZ'.
+* `undefined` - (Optional) Controls portal access settings for internal interfaces, whose topology is set to 'Undefined'.
+* `vpn` - (Optional) Controls portal access settings for interfaces that are part of a VPN Encryption Domain.
+
+
+`trust_settings` supports the following:
+
+* `gateway_mac_address` - (Optional) Use the Security Gateway MAC address, relevant for the gateway_mac_address identification-method.
+* `identification_method` - (Optional) How to identify the gateway (relevant for DAIP gateways only).
+* `initiation_phase` - (Optional) Push the certificate to the Security Gateway immediately, or wait for the Security Gateway to pull the certificate. Default value for Spark Gateway is...
+
+
+`advanced` supports the following:
+
+* `enable_nat_traversal` - (Optional) Enable NAT traversal.
+* `enable_wire_mode` - (Optional) Enable wire mode.
+* `enable_wire_mode_log_traffic` - (Optional) Log traffic in wire mode.
+* `shutdown_on_gateway_restart` - (Optional) Shutdown VPN tunnels on gateway restart.
+* `tunnel_sharing_mode` - (Optional) Tunnel sharing mode.
+* `wire_mode_interfaces` - (Optional) Wire mode interfaces.
+
+
+`dynamic_id_settings` supports the following:
+
+* `advanced_settings` - (Optional) Advanced Dynamic ID configuration settings.advanced_settings blocks are documented below.
+* `sms_provider_and_email_settings` - (Optional) SMS provider and email configuration.
+* `sms_provider_credentials` - (Optional) SMS provider credentials configuration.sms_provider_credentials blocks are documented below.
+
+
+`advanced_settings` supports the following:
+
+* `country_code` - (Optional) Country code for SMS services.
+* `dynamic_id_message` - (Optional) Dynamic ID message displayed to users.
+* `enable_display_user_details` - (Optional) Enable display of user details.
+* `otp_settings` - (Optional) One Time Password configuration settings.otp_settings blocks are documented below.
+* `user_details_retrieval` - (Optional) User details retrieval method.
+
+
+`otp_settings` supports the following:
+
+* `expiration` - (Optional) One time password expiration (in minutes).
+* `length` - (Optional) Length of one time password.
+* `max_attempts` - (Optional) Number of times users can attempt to enter the one time password before the entire authentication process restarts.
+
+
+`sms_provider_credentials` supports the following:
+
+* `api_id` - (Optional) SMS provider API ID.
+* `password` - (Optional) SMS provider password.
+* `username` - (Optional) SMS provider username.
+
+
+`single_authentication_client` supports the following:
+
+* `allow_multiple_authentication_clients` - (Optional) Allow clients that support multiple authentication methods to connect.
+* `client_display_settings` - (Optional) Client display configuration settings.client_display_settings blocks are documented below.
+* `display_name` - (Optional) Display name for the authentication method.
+* `enabled` - (Optional) Allow clients that support only single authentication method.
+* `method` - (Optional) Authentication method type.
+* `personal_certificate` - (Optional) Personal certificate authentication settings, relevant only when method is "personal-certificate".personal_certificate blocks are documented below.
+* `radius` - (Optional) RADIUS authentication settings, relevant only when method is "radius".radius blocks are documented below.
+* `secur_id` - (Optional) SecurID authentication settings, relevant only when method is "secur-id".secur_id blocks are documented below.
+
+
+`client_display_settings` supports the following:
+
+* `headline` - (Optional) Display headline for authentication dialog.
+* `password_label` - (Optional) Label for password field.
+* `username_label` - (Optional) Label for username field.
+
+
+`personal_certificate` supports the following:
+
+* `dn_concurrence` - (Optional) DN part occurrence number.
+* `dn_part` - (Optional) DN part to extract.
+* `fetch_username_from` - (Optional) Fetch username from.
+* `source` - (Optional) Certificate source field.
+* `storage_type` - (Optional) Certificate storage type.
+
+
+`radius` supports the following:
+
+* `ask_user_password` - (Optional) Ask user for password during authentication.
+* `server` - (Optional) Server object identified by the name or UID.
+
+
+`secur_id` supports the following:
+
+* `server` - (Optional) Server object identified by the name or UID.
+* `token_card_type` - (Optional) Token card type.
+
+
+`clientless_vpn_settings` supports the following:
+
+* `accept_only_3des` - (Optional) Accept only 3DES.
+* `certificate_gateway_authentication` - (Optional) Certificate gateway authentication.
+* `client_authentication` - (Optional) Client authentication.
+* `concurrent_servers_or_processes` - (Optional) Number of concurrent servers or processes.
+
+
+`exported_routes` supports the following:
+
+* `custom_routes` - (Optional) Export custom routes.
+* `custom_routes_object` - (Optional) Custom routes object identified by the name or UID.
+* `internal_interfaces` - (Optional) Export internal interfaces.
+* `static_routes` - (Optional) Export static routes.
+
+
+`interfaces` supports the following:
+
+* `interface_name` - (Optional) The name of the interface.
+* `ip_version` - (Optional) The IP version of the interface's IP address (IPv4/IPv6).
+* `next_hop_ip` - (Optional) The IP address of the next hop.
+* `priority` - (Optional) Priority of a 'Backup' interface.
+* `redundancy_mode` - (Optional) Interface redundancy mode (Active/Backup).
+* `static_nat_ip` - (Optional) The NATed IPv4 address that hides the source IPv4 address of outgoing connections (applies only to IPv4).
+
+
+`probing_settings` supports the following:
+
+* `primary_address` - (Optional) Primary IP address to use. Must be one of the addresses from "probed-interface-list". Required when "use-primary-address" is true.
+* `probed_interface_list` - (Optional) List of specific IP addresses to probe. Only relevant when "probed-interfaces" is set to "specific".
+* `probed_interfaces` - (Optional) Specifies whether to probe all addresses defined in the topology tab or specific addresses.
+* `probing_method` - (Optional) Probing method.
+* `use_primary_address` - (Optional) Whether to use a primary address for high availability probing.
+
+
+`saml_portal_settings` supports the following:
+
+* `accessibility` - (Optional) Configuration of the portal access settings.accessibility blocks are documented below.
+* `certificate_settings` - (Optional) Configuration of the SAML portal certificate.certificate_settings blocks are documented below.
+* `portal_web_settings` - (Optional) Configuration of the SAML portal web settings.portal_web_settings blocks are documented below.
+
+
+`accessibility` supports the following:
+
+* `allow_access_from` - (Optional) Allowed access to the SAML portal.
+* `internal_access_settings` - (Optional) Configuration of the additional portal access settings for internal interfaces only.internal_access_settings blocks are documented below.
+
+
+`internal_access_settings` supports the following:
+
+* `dmz` - (Optional) Controls portal access settings for internal interfaces, whose topology is set to "DMZ".
+* `undefined` - (Optional) Controls portal access settings for internal interfaces, whose topology is set to "Undefined".
+* `vpn` - (Optional) Controls portal access settings for interfaces that are part of a VPN Encryption Domain.
+
+
+`certificate_settings` supports the following:
+
+* `base64_certificate` - (Optional) The certificate file encoded in Base64 with padding.
+* `base64_password` - (Optional) Certificate file password.
+
+
+`portal_web_settings` supports the following:
+
+* `aliases` - (Optional) List of URL aliases that are redirected to the main portal URL.
+* `ip_address` - (Optional) Optional IP address to be used for the portal URL.
+* `main_url` - (Optional) The main URL for the portal.
+
+
+`vpn_clients` supports the following:
+
+* `enable_capsule_vpn_connect` - (Optional) Enable Capsule VPN Connect client.
+* `enable_cp_mobile_for_windows` - (Optional) Enable Check Point Mobile for Windows client.
+* `enable_endpoint_security_vpn` - (Optional) Enable Endpoint Security VPN client.
+* `enable_secu_remote` - (Optional) Enable SecuRemote client.
+* `enable_ssl_network_extender` - (Optional) Enable SSL Network Extender client.
+* `gateway_authentication_certificate` - (Optional) Gateway authentication certificate.
+
+
+`zero_phishing_settings` supports the following:
+
+* `gateway_fqdn_mode` - (Optional) Manual Fqdn.
+* `manual_fqdn` - (Optional) Zero Phishing gateway FQDN.
diff --git a/website/docs/r/checkpoint_management_test_sic_status.html.markdown b/website/docs/r/checkpoint_management_test_sic_status.html.markdown
index 028fa328..8e8960b0 100644
--- a/website/docs/r/checkpoint_management_test_sic_status.html.markdown
+++ b/website/docs/r/checkpoint_management_test_sic_status.html.markdown
@@ -25,6 +25,7 @@ The following arguments are supported:
* `name` - (Optional) Gateway, cluster member or Check Point host name.
* `uid` - (Optional) Gateway, cluster member or Check Point host name.
+* `domains_to_process` - (Optional) Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and with ig...
## How To Use
diff --git a/website/docs/r/checkpoint_management_test_trust.html.markdown b/website/docs/r/checkpoint_management_test_trust.html.markdown
index 66faec8e..922606cb 100644
--- a/website/docs/r/checkpoint_management_test_trust.html.markdown
+++ b/website/docs/r/checkpoint_management_test_trust.html.markdown
@@ -27,6 +27,7 @@ The following arguments are supported:
* `uid` - (Optional) Object unique identifier.
* `name` - (Optional) Minimum Check Point password length.
* `trust_method` - (Optional) Trust method to use for establishing communication.
+* `domains_to_process` - (Optional) Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and with ig...
## How To Use
Make sure this command will be executed in the right execution order.
diff --git a/website/docs/r/checkpoint_management_threat_exception.html.markdown b/website/docs/r/checkpoint_management_threat_exception.html.markdown
index 816fa5ab..cc5e917b 100644
--- a/website/docs/r/checkpoint_management_threat_exception.html.markdown
+++ b/website/docs/r/checkpoint_management_threat_exception.html.markdown
@@ -56,6 +56,7 @@ The following arguments are supported:
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
* `comments` - (Optional) Comments string.
* `owner` - (Computed) Owner UID.
+* `exception_number` - (Optional) N/A.
`position` supports the following:
diff --git a/website/docs/r/checkpoint_management_threat_ioc_feed.html.markdown b/website/docs/r/checkpoint_management_threat_ioc_feed.html.markdown
index afcc66e2..39af1a75 100644
--- a/website/docs/r/checkpoint_management_threat_ioc_feed.html.markdown
+++ b/website/docs/r/checkpoint_management_threat_ioc_feed.html.markdown
@@ -50,6 +50,10 @@ URL should be written as http or https.
* `comments` - (Optional) Comments string.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `confidence` - (Optional) Set in order to configure the confidence of the snort protections in snort format. 1-Low, 5-High.
+* `performance_impact` - (Optional) Set in order to configure the performance impact of the snort protections in snort format. 1-Very Low, 4-High.
+* `severity` - (Optional) Set in order to configure the severity of the snort protections in snort format. 1-Low, 4-Critical.
+* `use_snort_format` - (Optional) Set in order to configure a snort format indicator feed.
`custom_header` supports the following:
diff --git a/website/docs/r/checkpoint_management_threat_layer.html.markdown b/website/docs/r/checkpoint_management_threat_layer.html.markdown
index 3e08c0d4..f3d0ea15 100644
--- a/website/docs/r/checkpoint_management_threat_layer.html.markdown
+++ b/website/docs/r/checkpoint_management_threat_layer.html.markdown
@@ -30,3 +30,5 @@ The following arguments are supported:
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
* `add_default_rule` - (Optional) Indicates whether to include a default rule in the new layer.
+* `permissions_profiles` - (Optional) Collection of permission profile identifiers. Each can be a name or UUID.
+* `shared` - (Optional) Whether this layer is shared.
diff --git a/website/docs/r/checkpoint_management_threat_profile.html.markdown b/website/docs/r/checkpoint_management_threat_profile.html.markdown
index 6709928b..53202224 100644
--- a/website/docs/r/checkpoint_management_threat_profile.html.markdown
+++ b/website/docs/r/checkpoint_management_threat_profile.html.markdown
@@ -51,6 +51,10 @@ The following arguments are supported:
* `tags` - (Optional) Collection of tag identifiers.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `advanced_dns_settings` - (Optional) Advanced DNS Settings.advanced_dns_settings blocks are documented below.
+* `ai_guard` - (Optional) Is AI Guard blade activated.
+* `ai_guard_api_key` - (Optional) Lakera AI Guard API key. Required only if AI Guard is enabled.
+* `ai_guard_settings` - (Optional) AI Guard blade settings.ai_guard_settings blocks are documented below.
`indicator_overrides` supports the following:
@@ -120,4 +124,17 @@ The following arguments are supported:
* `action` - Protection action.
* `capture_packets` - Capture packets.
-* `track` - Tracking method for protection.
\ No newline at end of file
+* `track` - Tracking method for protection.
+
+
+`advanced_dns_settings` supports the following:
+
+* `dga_detection` - (Optional) Enable/Disable DGA based domains detection.
+* `dns_domain_tunneling` - (Optional) Enable/Disable DNS Tunneling based on domains detection.
+* `dns_over_https` - (Optional) Enable/Disable parsing of DNS over HTTPS protocol.
+* `nxns_attack_detection` - (Optional) Enable/Disable NXNS attack detection.
+
+
+`ai_guard_settings` supports the following:
+
+* `project_id` - (Optional) Lakera project ID to associate with this profile.
diff --git a/website/docs/r/checkpoint_management_threat_rule.html.markdown b/website/docs/r/checkpoint_management_threat_rule.html.markdown
index 9d6ecd84..18be6b48 100644
--- a/website/docs/r/checkpoint_management_threat_rule.html.markdown
+++ b/website/docs/r/checkpoint_management_threat_rule.html.markdown
@@ -57,6 +57,7 @@ The following arguments are supported:
`track_settings` supports the following:
* `packet_capture` - (Optional) Packet capture.
+* `forensics` - (Optional) Whether to enable forensics.
## Import
diff --git a/website/docs/r/checkpoint_management_trusted_client.html.markdown b/website/docs/r/checkpoint_management_trusted_client.html.markdown
index 3aacc1ae..0a3303a3 100644
--- a/website/docs/r/checkpoint_management_trusted_client.html.markdown
+++ b/website/docs/r/checkpoint_management_trusted_client.html.markdown
@@ -42,3 +42,5 @@ The following arguments are supported:
* `comments` - (Optional) Comments string.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `subnet_mask` - (Optional) N/A.
+* `subnet_mask4` - (Optional) IPv4 mask.
diff --git a/website/docs/r/checkpoint_management_user.html.markdown b/website/docs/r/checkpoint_management_user.html.markdown
index 42d8e70c..792bbace 100644
--- a/website/docs/r/checkpoint_management_user.html.markdown
+++ b/website/docs/r/checkpoint_management_user.html.markdown
@@ -62,4 +62,6 @@ The following arguments are supported:
* `enable_ike` - (Optional) Enable IKE encryption for users.
* `enable_public_key` - (Optional) Enable IKE public key.
* `enable_shared_secret` - (Optional) Enable IKE shared secret.
-* `shared_secret` - (Optional) IKE shared secret.
\ No newline at end of file
+* `shared_secret` - (Optional) IKE shared secret.
+* `data_integrity_algorithm` - (Optional) IKE data integrity algorithm.
+* `encryption_algorithm` - (Optional) IKE encryption algorithm.
\ No newline at end of file
diff --git a/website/docs/r/checkpoint_management_user_template.html.markdown b/website/docs/r/checkpoint_management_user_template.html.markdown
index 8897cbc7..b81b8a4f 100644
--- a/website/docs/r/checkpoint_management_user_template.html.markdown
+++ b/website/docs/r/checkpoint_management_user_template.html.markdown
@@ -54,4 +54,6 @@ The following arguments are supported:
* `enable_ike` - (Optional) Enable IKE encryption for users.
* `enable_public_key` - (Optional) Enable IKE public key.
-* `enable_shared_secret` - (Optional) Enable IKE shared secret.
\ No newline at end of file
+* `enable_shared_secret` - (Optional) Enable IKE shared secret.
+* `data_integrity_algorithm` - (Optional) IKE data integrity algorithm.
+* `encryption_algorithm` - (Optional) IKE encryption algorithm.
\ No newline at end of file
diff --git a/website/docs/r/checkpoint_management_verify_software_package.html.markdown b/website/docs/r/checkpoint_management_verify_software_package.html.markdown
index 74a7b69b..f180bea3 100644
--- a/website/docs/r/checkpoint_management_verify_software_package.html.markdown
+++ b/website/docs/r/checkpoint_management_verify_software_package.html.markdown
@@ -27,8 +27,17 @@ The following arguments are supported:
* `targets` - (Required) On what targets to execute this command. Targets may be identified by their name, or object unique identifier.targets blocks are documented below.
* `concurrency_limit` - (Optional) The number of targets, on which the same package is installed at the same time.
* `task_id` - (Computed) Asynchronous task unique identifier.
+* `cluster_installation_settings` - (Optional) Installation settings for cluster.cluster_installation_settings blocks are documented below.
+* `download_package` - (Optional) Should the package be downloaded before verification.
+* `download_package_from` - (Optional) Where is the package located.
+* `operation_context` - (Optional) The operation can be: 'install' (default) or 'uninstall'.
## How To Use
Make sure this command will be executed in the right execution order.
note: terraform execution is not sequential.
+
+`cluster_installation_settings` supports the following:
+
+* `cluster_delay` - (Optional) The delay between end of installation on one cluster members and start of installation on the next cluster member.
+* `cluster_strategy` - (Optional) The cluster installation strategy. all-members - Install the package on all members in the cluster non-active-members-and-failover - In the High Avail...
diff --git a/website/docs/r/checkpoint_management_vpn_community_meshed.html.markdown b/website/docs/r/checkpoint_management_vpn_community_meshed.html.markdown
index 5c42937f..ea678b8f 100644
--- a/website/docs/r/checkpoint_management_vpn_community_meshed.html.markdown
+++ b/website/docs/r/checkpoint_management_vpn_community_meshed.html.markdown
@@ -48,6 +48,7 @@ The following arguments are supported:
* `comments` - (Optional) Comments string.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `route_based_settings` - (Optional) VPN Community Route-Based settings.
Relevant only in Route-Based VPN Communities.route_based_settings blocks are documented below.
`encrypted_traffic` supports the following:
@@ -79,6 +80,10 @@ The following arguments are supported:
* `diffie_hellman_group` - (Optional) The Diffie-Hellman group to be used.
* `encryption_algorithm` - (Optional) The encryption algorithm to be used.
* `ike_p1_rekey_time` - (Optional) Indicates the time interval for IKE phase 1 renegotiation.
+* `ike_p1_rekey_time_unit` - (Optional) Indicates the time unit for the 'ike-p1-rekey-time-unit' parameter, rounded up to minutes scale.
+* `multiple_key_exchanges` - (Optional) Multiple Key Exchanges proposal object.
+* `use_multiple_key_exchanges` - (Optional) Indicates whether to use a proposal with Multiple Key Exchanges.
+* `use_standard_proposal` - (Optional) Indicates whether to use a proposal with a single Diffie-Hellman group.
`ike_phase_2` supports the following:
@@ -88,6 +93,7 @@ The following arguments are supported:
* `ike_p2_use_pfs` - (Optional) Indicates whether Perfect Forward Secrecy (PFS) is being used for IKE phase 2.
* `ike_p2_pfs_dh_grp` - (Optional) The Diffie-Hellman group to be used: group-1, group-2, group-5, group-14, group-15, group-16, group-17, group-18, group-19, group-20, group-24.
* `ike_p2_rekey_time` - (Optional) Indicates the time interval for IKE phase 2 renegotiation.
+* `ike_p2_rekey_time_unit` - (Optional) N/A.
`permanent_tunnels` supports the following:
@@ -134,3 +140,45 @@ The following arguments are supported:
* `enabled` - (Optional) Indicates whether Route Injection Mechanism is enabled.
* `enable_on_gateways` - (Optional) Indicates whether to enable automatic Route Injection Mechanism for gateways.
* `route_injection_track` - (Optional) Route injection track method.
+
+
+`ike_phase_2` supports the following:
+
+* `ike_p2_rekey_time_unit` - (Optional) Indicates the time unit for the 'ike-p2-rekey-time-unit' parameter, rounded up to minutes scale.
+* `multiple_key_exchanges` - (Optional) Multiple Key Exchanges proposal object.
+* `use_multiple_key_exchanges` - (Optional) Indicates whether to use a proposal with Multiple Key Exchanges.
+* `use_standard_proposal` - (Optional) Indicates whether to use a proposal with a single Diffie-Hellman group.
+
+
+`interfaces` supports the following:
+
+* `ip_version` - (Optional) The IP version of the interface's IP address (IPv4/IPv6).
+
+
+`route_based_settings` supports the following:
+
+* `add_automatic_routes` - (Optional) The type of routes to use for the automatic Route-Based configuration.
Relevant only in Route-Based VPN Communities.
+* `advanced` - (Optional) Advanced settings
Relevant only in Route-Based VPN Communities.advanced blocks are documented below.
+* `override_routes` - (Optional) Override automatic routing settings in a specific Security Gateway in this VPN Community.
Relevant only in Route-Based VPN Communities...override_routes blocks are documented below.
+
+
+`advanced` supports the following:
+
+* `bfd` - (Optional) Indicates whether to enable Bidirectional Forwarding Detection.
Relevant only in Route-Based VPN Communities.
+* `graceful_restart` - (Optional) Indicates whether to enable Graceful Restart in the applicable Dynamic Routing protocols.
Relevant only in Route-Based VPN Communities...
+
+
+`override_routes` supports the following:
+
+* `auto_config` - (Optional) Indicates whether to configure the routing settings automatically for the Security Gateway.
Relevant only in Route-Based VPN CommunitiesExported Routes.
Relevant only in Route-Based VPN Communities.exported_routes blocks are documented below.
+* `gateway` - (Optional) Name of the Security Gateway object in which to override the automatic routing settings.
Relevant only in Route-Based VPN Communities<...
+* `mode` - (Optional) Specifies how to export routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.
+
+
+`exported_routes` supports the following:
+
+* `custom_routes` - (Optional) Specifies to export user-defined networks from the Security Gateway.
Relevant only in Route-Based VPN Communities.
+* `custom_routes_object` - (Optional) Specifies the name of the Network object or Network Group object that represents the exported routes.
Relevant only in Route-Based VPN Com...
+* `internal_interfaces` - (Optional) Specifies to export networks from interfaces with Topology 'Internal' from the Security Gateway.
Relevant only in Route-Based VPN Communit...
+* `static_routes` - (Optional) Specifies to export static routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.
diff --git a/website/docs/r/checkpoint_management_vpn_community_remote_access.html.markdown b/website/docs/r/checkpoint_management_vpn_community_remote_access.html.markdown
index f200f770..8dabce0d 100644
--- a/website/docs/r/checkpoint_management_vpn_community_remote_access.html.markdown
+++ b/website/docs/r/checkpoint_management_vpn_community_remote_access.html.markdown
@@ -33,8 +33,48 @@ The following arguments are supported:
* `comments` - (Optional) Comments string.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `encryption` - (Optional) Encryption settings.encryption blocks are documented below.
`override_vpn_domains` supports the following:
* `gateway` - Participant gateway in override VPN domain identified by the name or UID.
* `vpn_domain` - VPN domain network identified by the name or UID.
+
+
+`encryption` supports the following:
+
+* `encryption_method` - (Optional) The encryption method to be used.
+* `ike_phase_1` - (Optional) IKE Phase 1 settings.ike_phase_1 blocks are documented below.
+* `ike_phase_2` - (Optional) IKE Phase 2 settings.ike_phase_2 blocks are documented below.
+
+
+`ike_phase_1` supports the following:
+
+* `configured_data_integrity_algorithms` - (Optional) The list of configured hash algorithms.
+* `configured_diffie_hellman_groups` - (Optional) The list of configured Diffie-Hellman groups.
+* `configured_encryption_algorithms` - (Optional) The list of configured encryption algorithms.
+* `data_integrity` - (Optional) The hash algorithm to be used.
+* `diffie_hellman_group` - (Optional) The Diffie-Hellman group to be used.
+* `encryption_algorithm` - (Optional) The encryption algorithm to be used.
+* `ike_p1_rekey_time` - (Optional) Indicates the time interval for IKE phase 1 renegotiation.
+* `ike_p1_rekey_time_unit` - (Optional) Indicates the time unit for the 'ike-p1-rekey-time-unit' parameter, rounded up to minutes scale.
+* `multiple_key_exchanges` - (Optional) Name of the Multiple Key Exchanges proposal object.
+* `use_multiple_key_exchanges` - (Optional) Indicates whether to use a proposal with Multiple Key Exchanges.
+* `use_standard_proposal` - (Optional) Indicates whether to use a proposal with a single Diffie-Hellman group.
+
+
+`ike_phase_2` supports the following:
+
+* `configured_data_integrity_algorithms` - (Optional) The list of configured hash algorithms.
+* `configured_diffie_hellman_groups` - (Optional) The list of configured Diffie-Hellman groups.
+* `configured_encryption_algorithms` - (Optional) The list of configured encryption algorithms.
+* `data_integrity` - (Optional) The hash algorithm to be used.
+* `encryption_algorithm` - (Optional) The encryption algorithm to be used.
+* `enforce_encryption_alg_and_data_integrity_on_all_users` - (Optional) Enforce Encryption Algorithm and Data Integrity on all users.
+* `ike_p2_pfs_dh_grp` - (Optional) The Diffie-Hellman group to be used.
+* `ike_p2_rekey_time` - (Optional) Indicates the time interval for IKE phase 2 renegotiation.
+* `ike_p2_rekey_time_unit` - (Optional) Indicates the time unit for the 'ike-p2-rekey-time-unit' parameter, rounded up to minutes scale.
+* `ike_p2_use_pfs` - (Optional) Indicates whether Perfect Forward Secrecy (PFS) is being used for IKE phase 2.
+* `multiple_key_exchanges` - (Optional) Name of the Multiple Key Exchanges proposal object to use when PFS is enabled and multiple key exchanges are configured.
+* `use_multiple_key_exchanges` - (Optional) Indicates whether to use a proposal with Multiple Key Exchanges when PFS is enabled.
+* `use_standard_proposal` - (Optional) Indicates whether to use a proposal with a single Diffie-Hellman group when PFS is enabled.
diff --git a/website/docs/r/checkpoint_management_vpn_community_star.html.markdown b/website/docs/r/checkpoint_management_vpn_community_star.html.markdown
index 48794a1c..b0b74ccd 100644
--- a/website/docs/r/checkpoint_management_vpn_community_star.html.markdown
+++ b/website/docs/r/checkpoint_management_vpn_community_star.html.markdown
@@ -53,6 +53,7 @@ The following arguments are supported:
* `comments` - (Optional) Comments string.
* `ignore_warnings` - (Optional) Apply changes ignoring warnings.
* `ignore_errors` - (Optional) Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
+* `route_based_settings` - (Optional) VPN Community Route-Based settings.
Relevant only in Route-Based VPN Communities.route_based_settings blocks are documented below.
`encrypted_traffic` supports the following:
@@ -87,6 +88,10 @@ granular_encryptions` supports the following:
* `diffie_hellman_group` - (Optional) The Diffie-Hellman group to be used.
* `encryption_algorithm` - (Optional) The encryption algorithm to be used.
* `ike_p1_rekey_time` - (Optional) Indicates the time interval for IKE phase 1 renegotiation.
+* `ike_p1_rekey_time_unit` - (Optional) Indicates the time unit for the 'ike-p1-rekey-time-unit' parameter, rounded up to minutes scale.
+* `multiple_key_exchanges` - (Optional) Multiple Key Exchanges proposal object.
+* `use_multiple_key_exchanges` - (Optional) Indicates whether to use a proposal with Multiple Key Exchanges.
+* `use_standard_proposal` - (Optional) Indicates whether to use a proposal with a single Diffie-Hellman group.
`ike_phase_2` supports the following:
@@ -96,6 +101,10 @@ granular_encryptions` supports the following:
* `ike_p2_use_pfs` - (Optional) Indicates whether Perfect Forward Secrecy (PFS) is being used for IKE phase 2.
* `ike_p2_pfs_dh_grp` - (Optional) The Diffie-Hellman group to be used: group-1, group-2, group-5, group-14, group-15, group-16, group-17, group-18, group-19, group-20, group-24.
* `ike_p2_rekey_time` - (Optional) Indicates the time interval for IKE phase 2 renegotiation.
+* `ike_p2_rekey_time_unit` - (Optional) Indicates the time unit for the 'ike-p2-rekey-time-unit' parameter, rounded up to minutes scale.
+* `multiple_key_exchanges` - (Optional) Multiple Key Exchanges proposal object.
+* `use_multiple_key_exchanges` - (Optional) Indicates whether to use a proposal with Multiple Key Exchanges.
+* `use_standard_proposal` - (Optional) Indicates whether to use a proposal with a single Diffie-Hellman group.
`mep` supports the following:
@@ -164,3 +173,37 @@ granular_encryptions` supports the following:
* `enable_on_center_gateways` - (Optional) Indicates whether to enable automatic Route Injection Mechanism on center gateways.
* `enable_on_satellite_gateways` - (Optional) Indicates whether to enable automatic Route Injection Mechanism on satellite gateways.
* `route_injection_track` - (Optional) Route injection track method.
+
+
+`interfaces` supports the following:
+
+* `ip_version` - (Optional) The IP version of the interface's IP address (IPv4/IPv6).
+
+
+`route_based_settings` supports the following:
+
+* `add_automatic_routes` - (Optional) The type of routes to use for the automatic Route-Based configuration.
Relevant only in Route-Based VPN Communities.
+* `advanced` - (Optional) Advanced settings
Relevant only in Route-Based VPN Communities.advanced blocks are documented below.
+* `override_routes` - (Optional) Override automatic routing settings in a specific Security Gateway in this VPN Community.
Relevant only in Route-Based VPN Communities...override_routes blocks are documented below.
+
+
+`advanced` supports the following:
+
+* `bfd` - (Optional) Indicates whether to enable Bidirectional Forwarding Detection.
Relevant only in Route-Based VPN Communities.
+* `graceful_restart` - (Optional) Indicates whether to enable Graceful Restart in the applicable Dynamic Routing protocols.
Relevant only in Route-Based VPN Communities...
+
+
+`override_routes` supports the following:
+
+* `auto_config` - (Optional) Indicates whether to configure the routing settings automatically for the Security Gateway.
Relevant only in Route-Based VPN CommunitiesExported Routes.
Relevant only in Route-Based VPN Communities.exported_routes blocks are documented below.
+* `gateway` - (Optional) Name of the Security Gateway object in which to override the automatic routing settings.
Relevant only in Route-Based VPN Communities<...
+* `mode` - (Optional) Specifies how to export routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.
+
+
+`exported_routes` supports the following:
+
+* `custom_routes` - (Optional) Specifies to export user-defined networks from the Security Gateway.
Relevant only in Route-Based VPN Communities.
+* `custom_routes_object` - (Optional) Specifies the name of the Network object or Network Group object that represents the exported routes.
Relevant only in Route-Based VPN Com...
+* `internal_interfaces` - (Optional) Specifies to export networks from interfaces with Topology 'Internal' from the Security Gateway.
Relevant only in Route-Based VPN Communit...
+* `static_routes` - (Optional) Specifies to export static routes from the Security Gateway.
Relevant only in Route-Based VPN Communities.
diff --git a/website/docs/r/checkpoint_management_where_used.html.markdown b/website/docs/r/checkpoint_management_where_used.html.markdown
index 0837f139..bfdf96c5 100644
--- a/website/docs/r/checkpoint_management_where_used.html.markdown
+++ b/website/docs/r/checkpoint_management_where_used.html.markdown
@@ -28,6 +28,7 @@ The following arguments are supported:
* `show_membership` - (Optional) Indicates whether to calculate and show "groups" field for every object in reply.
* `indirect` - (Optional) Search for indirect usage.
* `indirect_max_depth` - (Optional) Maximum nesting level during indirect usage search.
+* `domains_to_process` - (Optional) Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and with ig...
## How To Use