VSX provisioning tool - VS topology - Security Zone support?

[Mark_Ewest]

Hello Fine Community!

Quick question regarding VSX provisioning tool.  I've used this tool over the years to build/manage interfaces on Virtual Systems - but more recently have been utilizing Security Zones on interfaces.  Is anyone aware of support for tagging an interface with a Security Zone via VSX provisioning tool?   I've searched some documentation, but haven't found much (perhaps I'm just missing it, or perhaps this is not available [yet?]).  Any insights appreciated.  Below is a basic example of a command I use; but ideally could also tag the eth0.123 interface with "InternalZone" on the same line.  Apologies if I've missed a similar post on this topic!

add interface name eth0.123 ip x.x.x.x/24 topology internal_this_network

[genisis__]

Not see anything myself,  I would also like to know if there is a way to enable anti-spoofing in detect and log mode per interface.

[Chris_Atkinson · Accepted solution]

In future versions there will be a shift towards APIs for VSX.

With that said the last I saw regarding the VSX provisioning tool pertained to "defined by routed" behavior... i.e.

PRJ-32534, PMTR-74770

VSX

UPDATE: It is now possible to define interface topology as "defined by routes" using the VSX provisioning tool.

Will check the status regarding Zones and revert.

[Mark_Ewest]

Got it, yea a shift towards APIs makes sense and I was kind of wondering how much more new functionality will be added to the VSX provisioning tool if that was the case.  But didn't know if APIs would leverage the provisioning tool on the backend or be independent.  I have more questions than answers 🙂  Thanks for your input.

[_Val_ · Accepted solution]

Just to make sure, we are now working on VSX Pro - a completely new architecture for virtualized security, and it will have native APIs for management. You will not need the provisioning tool with it anymore, AFAIK.

That said, it will not be available before some time the next year.

[genisis__]

Would be really good to get more info on VSX Pro!

[_Val_]

I promise we will talk about that as soon as we can 🙂 But before, please let R&D do their magic.

[Mark_Ewest]

Just wanted to say thanks to @_Val_  and @Chris_Atkinson  for the comments!  Will certainly look forward to hearing more about VSX Pro and native Mgmt APIs.

[amoruck]

Hello,

Any news regarding this feature/project? is there any other way to configure security zone/anti-spoofing  for VSX virtual system interfaces?

[Chris_Atkinson]

Further changes are expected with the release of R82.