Service Connection Models

Overview

The Service Connection models are a key component in Palo Alto Networks' Strata Cloud Manager SDK, providing a structured way to manage and configure connections to cloud service providers. These models work in tandem with Remote Networks and BGP Routing configurations to establish secure, optimized connectivity between your on-premises infrastructure and cloud resources.

Service Connection models support defining connectivity to cloud service providers with various parameters including BGP configuration, protocol settings, QoS, and NAT options. By utilizing these models, you can programmatically manage and customize your cloud connectivity, ensuring consistent security policies and efficient routing across hybrid and multi-cloud environments.

The models handle validation of inputs and outputs when interacting with the SCM API, offering a robust interface for creating, updating, and managing service connections. This abstraction layer simplifies the complex task of configuring cloud connectivity, allowing for more streamlined and error-resistant network management.

Models

The module provides the following Pydantic models:

ServiceConnectionBaseModel: Base model with fields common to all service connection operations
ServiceConnectionCreateModel: Model for creating new service connections
ServiceConnectionUpdateModel: Model for updating existing service connections
ServiceConnectionResponseModel: Response model for service connection operations
BgpPeerModel: Model for BGP peer configuration
BgpProtocolModel: Model for BGP protocol configuration
ProtocolModel: Model for protocol settings
QosModel: Model for QoS configuration
OnboardingType: Enum for onboarding types
NoExportCommunity: Enum for no export community options

All models use extra="forbid" configuration, which rejects any fields not explicitly defined in the model.

Attributes

Attribute	Type	Required	Default	Description
`name`	`str`	Yes	None	Name of the service connection. Max 63 chars, must match pattern: `^[0-9a-zA-Z._\- ]+$`
`id`	`UUID`	Yes***	None	UUID of the service connection (response & update only)
`folder`	`str`	Yes	Service Connections	The folder containing the service connection
`ipsec_tunnel`	`str`	Yes	None	IPsec tunnel for the service connection
`onboarding_type`	`OnboardingType`	Yes	classic	Onboarding type for the service connection
`region`	`str`	Yes	None	Region for the service connection
`backup_SC`	`str`	No	None	Backup service connection
`bgp_peer`	`BgpPeerModel`	No	None	BGP peer configuration
`nat_pool`	`str`	No	None	NAT pool for the service connection
`no_export_community`	`NoExportCommunity`	No	None	No export community configuration
`protocol`	`ProtocolModel`	No	None	Protocol configuration
`qos`	`QosModel`	No	None	QoS configuration
`secondary_ipsec_tunnel`	`str`	No	None	Secondary IPsec tunnel
`source_nat`	`bool`	No	None	Enable source NAT
`subnets`	`List[str]`	No	None	Subnets for the service connection

*** Only required for update and response models

BgpPeerModel Attributes

Attribute	Type	Required	Default	Description
`local_ip_address`	`str`	No	None	Local IPv4 address for BGP peering
`local_ipv6_address`	`str`	No	None	Local IPv6 address for BGP peering
`peer_ip_address`	`str`	No	None	Peer IPv4 address for BGP peering
`peer_ipv6_address`	`str`	No	None	Peer IPv6 address for BGP peering
`secret`	`str`	No	None	BGP authentication secret

BgpProtocolModel Attributes

Attribute	Type	Required	Default	Description
`enable`	`bool`	No	None	Enable BGP
`do_not_export_routes`	`bool`	No	None	Do not export routes option
`fast_failover`	`bool`	No	None	Enable fast failover
`local_ip_address`	`str`	No	None	Local IPv4 address for BGP
`originate_default_route`	`bool`	No	None	Originate default route
`peer_as`	`str`	No	None	BGP peer AS number
`peer_ip_address`	`str`	No	None	Peer IPv4 address for BGP
`secret`	`str`	No	None	BGP authentication secret
`summarize_mobile_user_routes`	`bool`	No	None	Summarize mobile user routes

ProtocolModel Attributes

Attribute	Type	Required	Default	Description
`bgp`	`BgpProtocolModel`	No	None	BGP protocol configuration

QosModel Attributes

Attribute	Type	Required	Default	Description
`enable`	`bool`	No	None	Enable QoS
`qos_profile`	`str`	No	None	QoS profile name

Enum Classes

OnboardingType

Value	Description
`classic`	Classic onboarding type

NoExportCommunity

Value	Description
`Disabled`	No export community disabled
`Enabled-In`	No export community enabled for inbound
`Enabled-Out`	No export community enabled for outbound
`Enabled-Both`	No export community enabled for both

Exceptions

The Service Connection models can raise the following exceptions during validation:

ValueError: Raised in several scenarios:
- When required fields are missing (name, region, ipsec_tunnel)
- When name doesn't match the required pattern
- When invalid subnet formats are provided
- When invalid values are provided for enums (onboarding_type, no_export_community)
- When BGP configuration is incomplete or inconsistent
- When both IPv4 and IPv6 addresses are used inconsistently

Model Validators

Name Validation

The name field must match the required pattern:

from scm.models.deployment import ServiceConnectionCreateModel

# This will raise a validation error
try:
    service_connection = ServiceConnectionCreateModel(
        name="invalid@name!",  # Contains invalid characters
        ipsec_tunnel="tunnel1",
        region="us-east-1"
    )
except ValueError as e:
    print(e)  # "String should match pattern '^[0-9a-zA-Z._\\- ]+$'"

Required Fields Validation

Essential fields must be provided:

from scm.models.deployment import ServiceConnectionCreateModel

# This will raise a validation error
try:
    service_connection = ServiceConnectionCreateModel(
        name="valid-name",
        # Missing required field: ipsec_tunnel
        region="us-east-1"
    )
except ValueError as e:
    print(e)  # "Field required"

Subnet Format Validation

Subnets must be in valid CIDR notation:

from scm.models.deployment import ServiceConnectionCreateModel

# This will raise a validation error
try:
    service_connection = ServiceConnectionCreateModel(
        name="valid-name",
        ipsec_tunnel="tunnel1",
        region="us-east-1",
        subnets=["invalid-subnet"]  # Not in CIDR format
    )
except ValueError as e:
    print(e)  # "Invalid subnet format: 'invalid-subnet'"

Usage Examples

Creating a Basic Service Connection

from scm.client import Scm
from scm.models.deployment import ServiceConnectionCreateModel

# Initialize client
client = Scm(
    client_id="your_client_id",
    client_secret="your_client_secret",
    tsg_id="your_tsg_id"
)

# Using dictionary
basic_dict = {
    "name": "aws-service-connection",
    "ipsec_tunnel": "aws-ipsec-tunnel",
    "region": "us-east-1",
    "onboarding_type": "classic",
    "subnets": ["10.0.0.0/24", "192.168.1.0/24"]
}

# Create the service connection using the client
response = client.service_connection.create(basic_dict)
print(f"Created service connection: {response.name}")

# Using model directly
basic_connection = ServiceConnectionCreateModel(
    name="aws-service-connection-2",
    ipsec_tunnel="aws-ipsec-tunnel-2",
    region="us-east-1",
    onboarding_type="classic",
    subnets=["10.0.0.0/24", "192.168.1.0/24"]
)

payload = basic_connection.model_dump(exclude_unset=True)
response = client.service_connection.create(payload)
print(f"Created service connection with ID: {response.id}")

Creating a Service Connection with BGP Configuration

from scm.models.deployment import (
    ServiceConnectionCreateModel,
    BgpPeerModel,
    ProtocolModel,
    BgpProtocolModel
)

# Create BGP peer configuration
bgp_peer = BgpPeerModel(
    local_ip_address="192.168.1.1",
    peer_ip_address="192.168.1.2",
    secret="mysecretkey"  # Authentication key
)

# Create BGP protocol configuration
bgp_protocol = BgpProtocolModel(
    enable=True,
    peer_as="65000",
    fast_failover=True,
    originate_default_route=True,
    secret="mysecretkey"  # Authentication key should match
)

# Create protocol model
protocol = ProtocolModel(
    bgp=bgp_protocol
)

# Create the service connection model
bgp_connection = ServiceConnectionCreateModel(
    name="aws-service-connection-bgp",
    ipsec_tunnel="aws-ipsec-tunnel-bgp",
    region="us-east-1",
    onboarding_type="classic",
    subnets=["10.0.0.0/24"],
    bgp_peer=bgp_peer,
    protocol=protocol,
    source_nat=True
)

payload = bgp_connection.model_dump(exclude_unset=True)
response = client.service_connection.create(payload)
print(f"Created BGP-enabled service connection: {response.name}")

Creating a Service Connection with QoS Configuration

from scm.models.deployment import (
    ServiceConnectionCreateModel,
    QosModel
)

# Create QoS configuration
qos = QosModel(
    enable=True,
    qos_profile="high-priority"
)

# Create the service connection model
qos_connection = ServiceConnectionCreateModel(
    name="aws-service-connection-qos",
    ipsec_tunnel="aws-ipsec-tunnel-qos",
    region="us-east-1",
    onboarding_type="classic",
    subnets=["10.0.0.0/24"],
    qos=qos,
    source_nat=True
)

payload = qos_connection.model_dump(exclude_unset=True)
response = client.service_connection.create(payload)
print(f"Created QoS-enabled service connection: {response.name}")

Creating a Service Connection with No Export Community

from scm.models.deployment import (
    ServiceConnectionCreateModel,
    NoExportCommunity
)

# Create the service connection model with no export community
community_connection = ServiceConnectionCreateModel(
    name="aws-service-connection-community",
    ipsec_tunnel="aws-ipsec-tunnel-community",
    region="us-east-1",
    onboarding_type="classic",
    subnets=["10.0.0.0/24"],
    no_export_community=NoExportCommunity.ENABLED_BOTH  # Enable in both directions
)

payload = community_connection.model_dump(exclude_unset=True)
response = client.service_connection.create(payload)
print(f"Created service connection with no export community: {response.name}")

Updating a Service Connection

# Fetch existing service connection
existing = client.service_connection.fetch(name="aws-service-connection")

# Modify attributes using dot notation
existing.subnets = ["10.0.0.0/24", "192.168.1.0/24", "172.16.0.0/24"]
existing.source_nat = True

# Pass modified object to update()
updated = client.service_connection.update(existing)
print(f"Updated service connection subnets: {updated.subnets}")

Retrieving and Listing Service Connections

# Get service connection by ID
connection_id = "123e4567-e89b-12d3-a456-426655440000"
connection = client.service_connection.get(connection_id)
print(f"Retrieved service connection: {connection.name}")

# List all service connections
all_connections = client.service_connection.list()
print(f"Found {len(all_connections)} service connections")

# Filter service connections by region
region_connections = client.service_connection.list(region="us-east-1")
print(f"Found {len(region_connections)} connections in us-east-1 region")

# Process connection information
for conn in all_connections:
    print(f"Connection: {conn.name}")
    print(f"Region: {conn.region}")
    print(f"Subnets: {conn.subnets}")
    if conn.bgp_peer:
        print(f"BGP Peer: {conn.bgp_peer.peer_ip_address}")
    if conn.qos and conn.qos.enable:
        print(f"QoS Profile: {conn.qos.qos_profile}")

Overview​

Models​

Attributes​

BgpPeerModel Attributes​

BgpProtocolModel Attributes​

ProtocolModel Attributes​

QosModel Attributes​

Enum Classes​

OnboardingType​

NoExportCommunity​

Exceptions​

Model Validators​

Name Validation​

Required Fields Validation​

Subnet Format Validation​

Usage Examples​

Creating a Basic Service Connection​

Creating a Service Connection with BGP Configuration​

Creating a Service Connection with QoS Configuration​

Creating a Service Connection with No Export Community​

Updating a Service Connection​

Retrieving and Listing Service Connections​