VRF configuration for agents behind NAT
Following set of APIs are useful to specify policies to assign VRFs to agents behind NAT boxes. These set of APIs require the sensor_management capability associated with the API key and are only available to site admin users.
List VRF configuration rules for agents behind NAT
This endpoint returns a list of VRF configuration rules applicable to agents behind NAT.
GET /openapi/v1/agentnatconfig
Create a new VRF configuration applicable to agents behind NAT
This endpoint is used to specify criteria for VRF labeling for hosts based on their source IP and source port as seen by Secure Workload appliance.
POST /openapi/v1/agentnatconfig
Parameters:
|
Name |
Type |
Description |
|---|---|---|
|
src_subnet |
string |
Subnet to which source IP can belong to (CIDR notation). |
|
src_port_range_start |
integer |
Lower bound of source port range (0-65535). |
|
src_port_range_end |
integer |
Upper bound of source port range (0-65535). |
|
vrf_id |
integer |
VRF ID to use for labeling flows for agents whose source address and port falls in the above specified range. |
Sample python code
req_payload = {
src_subnet: 10.1.1.0/24, # src IP range for sensors
src_port_range_start: 0,
src_port_range_end: 65535,
vrf_id: 676767 # VRF ID to assign
}
resp = rc.post('/agentnatconfig', json_body=json.dumps(req_payload))
print resp.status_code
Delete existing VRF configuration
DELETE /openapi/v1/agentnatconfig/{nat_config_id}