Skip to main content

Route Access List Models

Overview​

The Route Access List models provide a structured way to represent and validate route access list configuration data for Palo Alto Networks' Strata Cloud Manager. Route access lists are used to filter routes based on source and destination IP addresses with optional wildcard masks, commonly applied in BGP and OSPF routing policies.

Models​

The module provides the following Pydantic models:

  • RouteAccessListBaseModel: Base model with fields common to all route access list operations
  • RouteAccessListCreateModel: Model for creating new route access lists
  • RouteAccessListUpdateModel: Model for updating existing route access lists
  • RouteAccessListResponseModel: Response model for route access list operations
  • RouteAccessListType: Access list type container
  • RouteAccessListIpv4: IPv4 access list container
  • RouteAccessListIpv4Entry: Individual IPv4 access list entry
  • RouteAccessListSourceAddress: Source address with optional wildcard mask
  • RouteAccessListDestinationAddress: Destination address with optional wildcard mask

The RouteAccessListBaseModel and RouteAccessListCreateModel / RouteAccessListUpdateModel use extra="forbid" configuration, which rejects any fields not explicitly defined in the model. The RouteAccessListResponseModel uses extra="ignore" to provide resilience against unexpected fields returned by the API.

Model Attributes​

RouteAccessListBaseModel​

This is the base model containing fields common to all route access list operations.

AttributeTypeRequiredDefaultDescription
namestrYesNoneRoute access list name.
descriptionstrNoNoneDescription.
typeRouteAccessListTypeNoNoneAccess list type configuration.
folderstrNo**NoneFolder location. Pattern: ^[a-zA-Z\d\-_. ]+$. Max 64 chars.
snippetstrNo**NoneSnippet location. Pattern: ^[a-zA-Z\d\-_. ]+$. Max 64 chars.
devicestrNo**NoneDevice location. Pattern: ^[a-zA-Z\d\-_. ]+$. Max 64 chars.

** Exactly one container (folder/snippet/device) must be provided for create operations

RouteAccessListCreateModel​

Inherits all fields from RouteAccessListBaseModel and enforces that exactly one of folder, snippet, or device is provided during creation.

RouteAccessListUpdateModel​

Extends RouteAccessListBaseModel by adding:

AttributeTypeRequiredDefaultDescription
idUUIDYesNoneThe unique identifier of the route access list

RouteAccessListResponseModel​

Extends RouteAccessListBaseModel by adding:

AttributeTypeRequiredDefaultDescription
idUUIDYesNoneThe unique identifier of the route access list
note

The RouteAccessListResponseModel uses extra="ignore" instead of extra="forbid". This means it will silently ignore any extra fields returned by the API that are not defined in the model, providing resilience against API changes.

Supporting Models​

RouteAccessListType​

Container for the access list type.

AttributeTypeRequiredDefaultDescription
ipv4RouteAccessListIpv4NoNoneIPv4 access list.

RouteAccessListIpv4​

IPv4 access list container holding the list of entries.

AttributeTypeRequiredDefaultDescription
ipv4_entryList[RouteAccessListIpv4Entry]NoNoneIPv4 access list entries.

RouteAccessListIpv4Entry​

Individual IPv4 access list entry with sequence number, action, and address matching.

AttributeTypeRequiredDefaultDescription
nameintNoNoneSequence number (1-65535).
actionstrNoNoneAction: deny or permit. Pattern: ^(deny|permit)$
source_addressRouteAccessListSourceAddressNoNoneSource address configuration.
destination_addressRouteAccessListDestinationAddressNoNoneDestination address configuration.

RouteAccessListSourceAddress​

Source address configuration with optional wildcard mask.

AttributeTypeRequiredDefaultDescription
addressstrNoNoneSource IP address.
wildcardstrNoNoneSource IP wildcard mask.

RouteAccessListDestinationAddress​

Destination address configuration with optional wildcard mask.

AttributeTypeRequiredDefaultDescription
addressstrNoNoneDestination IP address.
wildcardstrNoNoneDestination IP wildcard mask.

Exceptions​

The models perform strict validation and will raise ValueError in scenarios such as:

  • When creating a route access list (RouteAccessListCreateModel), if not exactly one container (folder, snippet, or device) is provided.
  • When an entry sequence number is outside the valid range (1-65535).
  • When an entry action is not deny or permit.
  • When container identifiers (folder, snippet, device) do not match the required pattern or exceed the maximum length.

Model Validators​

Container Validation in RouteAccessListCreateModel​

  • validate_container_type: After model initialization, this validator checks that exactly one of the container fields (folder, snippet, or device) is provided. If not, it raises a ValueError.

Usage Examples​

Creating a Route Access List​

Using a Dictionary​

from scm.models.network import RouteAccessListCreateModel

acl_data = {
    "name": "acl-1",
    "description": "Block private networks",
    "type": {
        "ipv4": {
            "ipv4_entry": [
                {
                    "name": 10,
                    "action": "deny",
                    "source_address": {
                        "address": "10.0.0.0",
                        "wildcard": "0.255.255.255",
                    },
                },
                {
                    "name": 20,
                    "action": "deny",
                    "source_address": {
                        "address": "172.16.0.0",
                        "wildcard": "0.15.255.255",
                    },
                },
                {
                    "name": 30,
                    "action": "permit",
                    "source_address": {
                        "address": "0.0.0.0",
                        "wildcard": "255.255.255.255",
                    },
                },
            ],
        },
    },
    "folder": "Routing",
}

# Validate and create model instance
acl = RouteAccessListCreateModel(**acl_data)
payload = acl.model_dump(exclude_unset=True, by_alias=True)
print(payload)

Using the Model Directly​

from scm.models.network import (
    RouteAccessListCreateModel,
    RouteAccessListType,
    RouteAccessListIpv4,
    RouteAccessListIpv4Entry,
    RouteAccessListSourceAddress,
)

# Build access list entries
entries = [
    RouteAccessListIpv4Entry(
        name=10,
        action="deny",
        source_address=RouteAccessListSourceAddress(
            address="10.0.0.0",
            wildcard="0.255.255.255",
        ),
    ),
    RouteAccessListIpv4Entry(
        name=20,
        action="permit",
        source_address=RouteAccessListSourceAddress(
            address="0.0.0.0",
            wildcard="255.255.255.255",
        ),
    ),
]

# Create the access list
acl = RouteAccessListCreateModel(
    name="acl-2",
    description="Filter specific networks",
    type=RouteAccessListType(
        ipv4=RouteAccessListIpv4(ipv4_entry=entries),
    ),
    folder="Routing",
)
payload = acl.model_dump(exclude_unset=True, by_alias=True)
print(payload)

Updating a Route Access List​

from scm.client import Scm

# Initialize client
client = Scm(
    client_id="your_client_id",
    client_secret="your_client_secret",
    tsg_id="your_tsg_id",
)

# Fetch existing access list
existing = client.route_access_list.fetch(name="acl-1", folder="Routing")

# Modify description
existing.description = "Updated filter for private networks"

# Pass modified object to update()
updated = client.route_access_list.update(existing)
print(f"Updated access list: {updated.name}")