Security Zone Models

Overview

The Security Zone models provide a structured way to represent and validate security zone configuration data for Palo Alto Networks' Strata Cloud Manager. These models ensure data integrity when creating and updating security zones, enforcing proper network interface types, container specifications, and field validations.

Models

The module provides the following Pydantic models:

• SecurityZoneBaseModel: Base model with fields common to all security zone operations
• SecurityZoneCreateModel: Model for creating new security zones
• SecurityZoneUpdateModel: Model for updating existing security zones
• SecurityZoneResponseModel: Response model for security zone operations
• NetworkConfig: Network configuration model for interface assignments
• UserAcl: User access control list configuration model
• DeviceAcl: Device access control list configuration model
• NetworkInterfaceType: Enum for network interface type options

All models use extra="forbid" configuration, which rejects any fields not explicitly defined in the model.

Model Attributes

SecurityZoneBaseModel

This is the base model containing fields common to all security zone operations.

Attribute	Type	Required	Default	Description
name	str	Yes	None	Name of security zone. Pattern: ^[0-9a-zA-Z._\- ]+$. Max 63 chars.
enable_user_identification	bool	No	None	Enable user identification for this zone.
enable_device_identification	bool	No	None	Enable device identification for this zone.
dos_profile	str	No	None	DoS profile name associated with this zone.
dos_log_setting	str	No	None	DoS log setting name for this zone.
network	NetworkConfig	No	None	Network configuration with interface assignments.
user_acl	UserAcl	No	None	User access control list configuration.
device_acl	DeviceAcl	No	None	Device access control list configuration.
folder	str	No**	None	Folder location. Pattern: ^[a-zA-Z\d\-_. ]+$. Max 64 chars.
snippet	str	No**	None	Snippet location. Pattern: ^[a-zA-Z\d\-_. ]+$. Max 64 chars.
device	str	No**	None	Device location. Pattern: ^[a-zA-Z\d\-_. ]+$. Max 64 chars.

** Exactly one container (folder/snippet/device) must be provided for create operations

SecurityZoneCreateModel

Inherits all fields from SecurityZoneBaseModel and enforces that exactly one of folder, snippet, or device is provided during creation.

SecurityZoneUpdateModel

Extends SecurityZoneBaseModel by adding:

Attribute	Type	Required	Default	Description
id	UUID	Yes	None	The unique identifier of the security zone

SecurityZoneResponseModel

Extends SecurityZoneBaseModel by adding:

Attribute	Type	Required	Default	Description
id	UUID	Yes	None	The unique identifier of the security zone

Enum Types

NetworkInterfaceType

Defines the types of network interfaces supported for security zones:

Value	Description
tap	TAP interface for traffic monitoring
virtual_wire	Virtual wire interface
layer2	Layer 2 (switching) interface
layer3	Layer 3 (routing) interface
tunnel	Tunnel interface for VPN
external	External network interface

Supporting Models

NetworkConfig

This model defines the network configuration for a security zone, including interfaces and security settings.

Attribute	Type	Required	Default	Description
zone_protection_profile	str	No	None	Zone protection profile name for enhanced security
enable_packet_buffer_protection	bool	No	None	Enable packet buffer protection for this zone
log_setting	str	No	None	Log setting name for this zone
tap	List[str]	No*	None	TAP interfaces assigned to this zone
virtual_wire	List[str]	No*	None	Virtual wire interfaces assigned to this zone
layer2	List[str]	No*	None	Layer 2 interfaces assigned to this zone
layer3	List[str]	No*	None	Layer 3 interfaces assigned to this zone
tunnel	Dict[str, Any]	No*	None	Tunnel configuration for this zone
external	List[str]	No*	None	External interfaces assigned to this zone

* Only one network interface type (tap, virtual_wire, layer2, layer3, tunnel, or external) can be configured at a time.

UserAcl

This model defines the user access control list configuration.

Attribute	Type	Required	Default	Description
include_list	List[str]	No	[]	List of users to include
exclude_list	List[str]	No	[]	List of users to exclude

DeviceAcl

This model defines the device access control list configuration.

Attribute	Type	Required	Default	Description
include_list	List[str]	No	[]	List of devices to include
exclude_list	List[str]	No	[]	List of devices to exclude

Exceptions

The models perform strict validation and will raise ValueError in scenarios such as:

• When creating a security zone (SecurityZoneCreateModel), if not exactly one container (folder, snippet, or device) is provided.
• When the network configuration specifies more than one network interface type (e.g., both layer3 and layer2 are set).
• When the security zone name does not match the required pattern or exceeds the maximum length.
• When container identifiers (folder, snippet, device) do not match the required pattern or exceed the maximum length.

Model Validators

Field Validators in NetworkConfig

• validate_network_type: Ensures that only one network interface type is configured at a time. If multiple interface types are set, it raises a ValueError.

Container Validation in SecurityZoneCreateModel

• validate_container: After model initialization, this validator checks that exactly one of the container fields (folder, snippet, or device) is provided. If not, it raises a ValueError.

Usage Examples

Creating a Security Zone

Using a Dictionary with Layer 3 Interfaces

from scm.models.network import SecurityZoneCreateModel

zone_data = {
    "name": "trust-zone",
    "enable_user_identification": True,
    "enable_device_identification": False,
    "network": {
        "layer3": ["ethernet1/1", "ethernet1/2"],
        "zone_protection_profile": "default",
        "enable_packet_buffer_protection": True
    },
    "user_acl": {
        "include_list": ["user1", "user2"],
        "exclude_list": []
    },
    "folder": "Security Zones"
}

# Validate and create model instance
security_zone = SecurityZoneCreateModel(**zone_data)
payload = security_zone.model_dump(exclude_unset=True, by_alias=True)
print(payload)

Using the Model Directly with Virtual Wire Interfaces

from scm.models.network import SecurityZoneCreateModel, NetworkConfig, UserAcl, DeviceAcl

# Create the network configuration
network_config = NetworkConfig(
    virtual_wire=["ethernet1/3", "ethernet1/4"],
    zone_protection_profile="default"
)

# Create user ACL
user_acl = UserAcl(
    include_list=["admin", "operator"],
    exclude_list=["guest"]
)

# Create security zone
security_zone = SecurityZoneCreateModel(
    name="virtual-wire-zone",
    enable_user_identification=True,
    enable_device_identification=True,
    network=network_config,
    user_acl=user_acl,
    folder="Security Zones"
)
payload = security_zone.model_dump(exclude_unset=True, by_alias=True)
print(payload)

Updating a Security Zone

from scm.client import Scm

# Initialize client
client = Scm(
    client_id="your_client_id",
    client_secret="your_client_secret",
    tsg_id="your_tsg_id"
)

# Fetch existing security zone
existing = client.security_zone.fetch(name="trust-zone", folder="Security Zones")

# Modify attributes using dot notation
existing.enable_device_identification = True

# Add a new interface to the existing list
if existing.network and existing.network.layer3:
    existing.network.layer3.append("ethernet1/3")

# Update protection profile
if existing.network:
    existing.network.zone_protection_profile = "enhanced-security"

# Pass modified object to update()
updated = client.security_zone.update(existing)
print(f"Updated security zone: {updated.name}")

Creating a Security Zone with ACLs

from scm.models.network import SecurityZoneCreateModel, UserAcl, DeviceAcl

# Create a security zone with both user and device ACLs
zone_data = {
    "name": "restricted-zone",
    "enable_user_identification": True,
    "enable_device_identification": True,
    "network": {
        "layer3": ["ethernet1/5"]
    },
    "user_acl": {
        "include_list": ["admin", "security-team"],
        "exclude_list": ["contractor", "guest"]
    },
    "device_acl": {
        "include_list": ["corporate-laptops"],
        "exclude_list": ["byod-devices", "unmanaged-devices"]
    },
    "folder": "Security Zones"
}

security_zone = SecurityZoneCreateModel(**zone_data)
payload = security_zone.model_dump(exclude_unset=True, by_alias=True)
print(payload)