resource_security.go

package junos

import (
	"context"
	"fmt"
	"regexp"
	"strconv"
	"strings"

	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
	balt "github.com/jeremmfr/go-utils/basicalter"
	bchk "github.com/jeremmfr/go-utils/basiccheck"
)

type securityOptions struct {
	alg                 []map[string]interface{}
	flow                []map[string]interface{}
	forwardingOpts      []map[string]interface{}
	forwardingProcess   []map[string]interface{}
	idpSecurityPackage  []map[string]interface{}
	idpSensorConfig     []map[string]interface{}
	ikeTraceoptions     []map[string]interface{}
	log                 []map[string]interface{}
	policies            []map[string]interface{}
	userIdentAuthSource []map[string]interface{}
	utm                 []map[string]interface{}
}

func resourceSecurity() *schema.Resource {
	return &schema.Resource{
		CreateWithoutTimeout: resourceSecurityCreate,
		ReadWithoutTimeout:   resourceSecurityRead,
		UpdateWithoutTimeout: resourceSecurityUpdate,
		DeleteWithoutTimeout: resourceSecurityDelete,
		Importer: &schema.ResourceImporter{
			StateContext: resourceSecurityImport,
		},
		Schema: map[string]*schema.Schema{
			"clean_on_destroy": {
				Type:     schema.TypeBool,
				Optional: true,
			},
			"alg": {
				Type:     schema.TypeList,
				Optional: true,
				MaxItems: 1,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"dns_disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"ftp_disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"h323_disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"mgcp_disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"msrpc_disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"pptp_disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"rsh_disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"rtsp_disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"sccp_disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"sip_disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"sql_disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"sunrpc_disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"talk_disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"tftp_disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
					},
				},
			},
			"flow": {
				Type:     schema.TypeList,
				Optional: true,
				MaxItems: 1,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"advanced_options": {
							Type:     schema.TypeList,
							Optional: true,
							MaxItems: 1,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"drop_matching_reserved_ip_address": {
										Type:     schema.TypeBool,
										Optional: true,
									},
									"drop_matching_link_local_address": {
										Type:     schema.TypeBool,
										Optional: true,
									},
									"reverse_route_packet_mode_vr": {
										Type:     schema.TypeBool,
										Optional: true,
									},
								},
							},
						},
						"aging": {
							Type:     schema.TypeList,
							Optional: true,
							MaxItems: 1,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"early_ageout": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(1, 65535),
									},
									"high_watermark": {
										Type:         schema.TypeInt,
										Optional:     true,
										Default:      -1,
										ValidateFunc: validation.IntBetween(0, 100),
									},
									"low_watermark": {
										Type:         schema.TypeInt,
										Optional:     true,
										Default:      -1,
										ValidateFunc: validation.IntBetween(0, 100),
									},
								},
							},
						},
						"allow_dns_reply": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"allow_embedded_icmp": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"allow_reverse_ecmp": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"enable_reroute_uniform_link_check_nat": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"ethernet_switching": {
							Type:     schema.TypeList,
							Optional: true,
							MaxItems: 1,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"block_non_ip_all": {
										Type:          schema.TypeBool,
										Optional:      true,
										ConflictsWith: []string{"flow.0.ethernet_switching.0.bypass_non_ip_unicast"},
									},
									"bypass_non_ip_unicast": {
										Type:          schema.TypeBool,
										Optional:      true,
										ConflictsWith: []string{"flow.0.ethernet_switching.0.block_non_ip_all"},
									},
									"bpdu_vlan_flooding": {
										Type:     schema.TypeBool,
										Optional: true,
									},
									"no_packet_flooding": {
										Type:     schema.TypeList,
										Optional: true,
										MaxItems: 1,
										Elem: &schema.Resource{
											Schema: map[string]*schema.Schema{
												"no_trace_route": {
													Type:     schema.TypeBool,
													Optional: true,
												},
											},
										},
									},
								},
							},
						},
						"force_ip_reassembly": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"ipsec_performance_acceleration": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"mcast_buffer_enhance": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"pending_sess_queue_length": {
							Type:         schema.TypeString,
							Optional:     true,
							ValidateFunc: validation.StringInSlice([]string{"high", "moderate", "normal"}, false),
						},
						"preserve_incoming_fragment_size": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"route_change_timeout": {
							Type:         schema.TypeInt,
							Optional:     true,
							ValidateFunc: validation.IntBetween(6, 1800),
						},
						"syn_flood_protection_mode": {
							Type:         schema.TypeString,
							Optional:     true,
							ValidateFunc: validation.StringInSlice([]string{"syn-cookie", "syn-proxy"}, false),
						},
						"sync_icmp_session": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"tcp_mss": {
							Type:     schema.TypeList,
							Optional: true,
							MaxItems: 1,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"all_tcp_mss": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(64, 65535),
									},
									"gre_in": {
										Type:     schema.TypeList,
										Optional: true,
										MaxItems: 1,
										Elem: &schema.Resource{
											Schema: map[string]*schema.Schema{
												"mss": {
													Type:         schema.TypeInt,
													Optional:     true,
													ValidateFunc: validation.IntBetween(64, 65535),
												},
											},
										},
									},
									"gre_out": {
										Type:     schema.TypeList,
										Optional: true,
										MaxItems: 1,
										Elem: &schema.Resource{
											Schema: map[string]*schema.Schema{
												"mss": {
													Type:         schema.TypeInt,
													Optional:     true,
													ValidateFunc: validation.IntBetween(64, 65535),
												},
											},
										},
									},
									"ipsec_vpn": {
										Type:     schema.TypeList,
										Optional: true,
										MaxItems: 1,
										Elem: &schema.Resource{
											Schema: map[string]*schema.Schema{
												"mss": {
													Type:         schema.TypeInt,
													Optional:     true,
													ValidateFunc: validation.IntBetween(64, 65535),
												},
											},
										},
									},
								},
							},
						},
						"tcp_session": {
							Type:     schema.TypeList,
							Optional: true,
							MaxItems: 1,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"fin_invalidate_session": {
										Type:     schema.TypeBool,
										Optional: true,
									},
									"maximum_window": {
										Type:     schema.TypeString,
										Optional: true,
										ValidateFunc: validation.StringInSlice([]string{
											"64K", "128K", "256K", "512K", "1M",
										}, false),
									},
									"no_sequence_check": {
										Type:     schema.TypeBool,
										Optional: true,
									},
									"no_syn_check": {
										Type:          schema.TypeBool,
										Optional:      true,
										ConflictsWith: []string{"flow.0.tcp_session.0.strict_syn_check"},
									},
									"no_syn_check_in_tunnel": {
										Type:          schema.TypeBool,
										Optional:      true,
										ConflictsWith: []string{"flow.0.tcp_session.0.strict_syn_check"},
									},
									"rst_invalidate_session": {
										Type:     schema.TypeBool,
										Optional: true,
									},
									"rst_sequence_check": {
										Type:     schema.TypeBool,
										Optional: true,
									},
									"strict_syn_check": {
										Type:          schema.TypeBool,
										Optional:      true,
										ConflictsWith: []string{"flow.0.tcp_session.0.no_syn_check", "flow.0.tcp_session.0.no_syn_check_in_tunnel"},
									},
									"tcp_initial_timeout": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(4, 300),
									},
									"time_wait_state": {
										Type:     schema.TypeList,
										Optional: true,
										MaxItems: 1,
										Elem: &schema.Resource{
											Schema: map[string]*schema.Schema{
												"apply_to_half_close_state": {
													Type:     schema.TypeBool,
													Optional: true,
												},
												"session_ageout": {
													Type:          schema.TypeBool,
													Optional:      true,
													ConflictsWith: []string{"flow.0.tcp_session.0.time_wait_state.0.session_timeout"},
												},
												"session_timeout": {
													Type:          schema.TypeInt,
													Optional:      true,
													ValidateFunc:  validation.IntBetween(2, 600),
													ConflictsWith: []string{"flow.0.tcp_session.0.time_wait_state.0.session_ageout"},
												},
											},
										},
									},
								},
							},
						},
					},
				},
			},
			"forwarding_options": {
				Type:     schema.TypeList,
				Optional: true,
				MaxItems: 1,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"inet6_mode": {
							Type:         schema.TypeString,
							Optional:     true,
							ValidateFunc: validation.StringInSlice([]string{"drop", "flow-based", "packet-based"}, false),
						},
						"iso_mode_packet_based": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"mpls_mode": {
							Type:         schema.TypeString,
							Optional:     true,
							ValidateFunc: validation.StringInSlice([]string{"flow-based", "packet-based"}, false),
						},
					},
				},
			},
			"forwarding_process": {
				Type:     schema.TypeList,
				Optional: true,
				MaxItems: 1,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"enhanced_services_mode": {
							Type:     schema.TypeBool,
							Optional: true,
						},
					},
				},
			},
			"idp_security_package": {
				Type:     schema.TypeList,
				Optional: true,
				MaxItems: 1,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"automatic_enable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"automatic_interval": {
							Type:         schema.TypeInt,
							Optional:     true,
							ValidateFunc: validation.IntBetween(1, 336),
						},
						"automatic_start_time": {
							Type:     schema.TypeString,
							Optional: true,
							ValidateFunc: validation.StringMatch(
								regexp.MustCompile(`^\d{4}\-\d\d?\-\d\d?\.\d{2}:\d{2}:\d{2}$`),
								"must be in the format 'YYYY-MM-DD.HH:MM:SS'"),
						},
						"install_ignore_version_check": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"proxy_profile": {
							Type:     schema.TypeString,
							Optional: true,
						},
						"source_address": {
							Type:         schema.TypeString,
							Optional:     true,
							ValidateFunc: validation.IsIPAddress,
						},
						"url": {
							Type:     schema.TypeString,
							Optional: true,
						},
					},
				},
			},
			"idp_sensor_configuration": {
				Type:     schema.TypeList,
				Optional: true,
				MaxItems: 1,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"log_cache_size": {
							Type:         schema.TypeInt,
							Optional:     true,
							ValidateFunc: validation.IntBetween(1, 65535),
						},
						"log_suppression": {
							Type:     schema.TypeList,
							Optional: true,
							MaxItems: 1,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"disable": {
										Type:     schema.TypeBool,
										Optional: true,
									},
									"include_destination_address": {
										Type:          schema.TypeBool,
										Optional:      true,
										ConflictsWith: []string{"idp_sensor_configuration.0.log_suppression.0.no_include_destination_address"},
									},
									"no_include_destination_address": {
										Type:          schema.TypeBool,
										Optional:      true,
										ConflictsWith: []string{"idp_sensor_configuration.0.log_suppression.0.include_destination_address"},
									},
									"max_logs_operate": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(256, 65536),
									},
									"max_time_report": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(1, 60),
									},
									"start_log": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(1, 128),
									},
								},
							},
						},
						"packet_log": {
							Type:     schema.TypeList,
							Optional: true,
							MaxItems: 1,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"source_address": {
										Type:         schema.TypeString,
										Required:     true,
										ValidateFunc: validation.IsIPAddress,
									},
									"host_address": {
										Type:         schema.TypeString,
										Optional:     true,
										ValidateFunc: validation.IsIPAddress,
									},
									"host_port": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(1, 65535),
										RequiredWith: []string{"idp_sensor_configuration.0.packet_log.0.host_address"},
									},
									"max_sessions": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(1, 100),
									},
									"threshold_logging_interval": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(1, 60),
									},
									"total_memory": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(1, 100),
									},
								},
							},
						},
						"security_configuration_protection_mode": {
							Type:     schema.TypeString,
							Optional: true,
							ValidateFunc: validation.StringInSlice(
								[]string{"datacenter", "datacenter-full", "perimeter", "perimeter-full"}, false),
						},
					},
				},
			},
			"ike_traceoptions": {
				Type:     schema.TypeList,
				Optional: true,
				MaxItems: 1,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"file": {
							Type:     schema.TypeList,
							Optional: true,
							MaxItems: 1,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"name": {
										Type:         schema.TypeString,
										Optional:     true,
										ValidateFunc: validation.StringDoesNotContainAny("/% "),
									},
									"files": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(2, 1000),
									},
									"match": {
										Type:     schema.TypeString,
										Optional: true,
									},
									"size": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(10240, 1073741824),
									},
									"no_world_readable": {
										Type:     schema.TypeBool,
										Optional: true,
									},
									"world_readable": {
										Type:     schema.TypeBool,
										Optional: true,
									},
								},
							},
						},
						"flag": {
							Type:     schema.TypeSet,
							Optional: true,
							Elem:     &schema.Schema{Type: schema.TypeString},
						},
						"no_remote_trace": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"rate_limit": {
							Type:         schema.TypeInt,
							Optional:     true,
							Default:      -1,
							ValidateFunc: validation.IntBetween(0, 4294967295),
						},
					},
				},
			},
			"log": {
				Type:     schema.TypeList,
				Optional: true,
				MaxItems: 1,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"disable": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"event_rate": {
							Type:         schema.TypeInt,
							Optional:     true,
							Default:      -1,
							ValidateFunc: validation.IntBetween(0, 1500),
						},
						"facility_override": {
							Type:         schema.TypeString,
							Optional:     true,
							ValidateFunc: validation.StringInSlice(listOfSyslogFacility(), false),
						},
						"file": {
							Type:     schema.TypeList,
							Optional: true,
							MaxItems: 1,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"files": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(2, 10),
									},
									"name": {
										Type:     schema.TypeString,
										Optional: true,
									},
									"path": {
										Type:     schema.TypeString,
										Optional: true,
									},
									"size": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(1, 10),
									},
								},
							},
						},
						"format": {
							Type:         schema.TypeString,
							Optional:     true,
							ValidateFunc: validation.StringInSlice([]string{"binary", "sd-syslog", "syslog"}, false),
						},
						"max_database_record": {
							Type:         schema.TypeInt,
							Optional:     true,
							Default:      -1,
							ValidateFunc: validation.IntBetween(0, 1000000),
						},
						"mode": {
							Type:         schema.TypeString,
							Optional:     true,
							ValidateFunc: validation.StringInSlice([]string{"event", "stream"}, false),
						},
						"rate_cap": {
							Type:         schema.TypeInt,
							Optional:     true,
							Default:      -1,
							ValidateFunc: validation.IntBetween(0, 5000),
						},
						"report": {
							Type:     schema.TypeBool,
							Optional: true,
						},
						"source_address": {
							Type:          schema.TypeString,
							Optional:      true,
							ValidateFunc:  validation.IsIPAddress,
							ConflictsWith: []string{"log.0.source_interface"},
						},
						"source_interface": {
							Type:          schema.TypeString,
							Optional:      true,
							ConflictsWith: []string{"log.0.source_address"},
						},
						"transport": {
							Type:     schema.TypeList,
							Optional: true,
							MaxItems: 1,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"protocol": {
										Type:         schema.TypeString,
										Optional:     true,
										ValidateFunc: validation.StringInSlice([]string{"tcp", "tls", "udp"}, false),
									},
									"tcp_connections": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(1, 5),
									},
									"tls_profile": {
										Type:     schema.TypeString,
										Optional: true,
									},
								},
							},
						},
						"utc_timestamp": {
							Type:     schema.TypeBool,
							Optional: true,
						},
					},
				},
			},
			"policies": {
				Type:     schema.TypeList,
				Optional: true,
				MaxItems: 1,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"policy_rematch": {
							Type:          schema.TypeBool,
							Optional:      true,
							ConflictsWith: []string{"policies.0.policy_rematch_extensive"},
						},
						"policy_rematch_extensive": {
							Type:          schema.TypeBool,
							Optional:      true,
							ConflictsWith: []string{"policies.0.policy_rematch"},
						},
					},
				},
			},
			"user_identification_auth_source": {
				Type:     schema.TypeList,
				Optional: true,
				MaxItems: 1,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"ad_auth_priority": {
							Type:         schema.TypeInt,
							Optional:     true,
							Default:      -1,
							ValidateFunc: validation.IntBetween(0, 65535),
						},
						"aruba_clearpass_priority": {
							Type:         schema.TypeInt,
							Optional:     true,
							Default:      -1,
							ValidateFunc: validation.IntBetween(0, 65535),
						},
						"firewall_auth_priority": {
							Type:         schema.TypeInt,
							Optional:     true,
							Default:      -1,
							ValidateFunc: validation.IntBetween(0, 65535),
						},
						"local_auth_priority": {
							Type:         schema.TypeInt,
							Optional:     true,
							Default:      -1,
							ValidateFunc: validation.IntBetween(0, 65535),
						},
						"unified_access_control_priority": {
							Type:         schema.TypeInt,
							Optional:     true,
							Default:      -1,
							ValidateFunc: validation.IntBetween(0, 65535),
						},
					},
				},
			},
			"utm": {
				Type:     schema.TypeList,
				Optional: true,
				MaxItems: 1,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"feature_profile_web_filtering_type": {
							Type:     schema.TypeString,
							Optional: true,
							ValidateFunc: validation.StringInSlice([]string{
								"juniper-enhanced", "juniper-local", "web-filtering-none", "websense-redirect",
							}, false),
						},
						"feature_profile_web_filtering_juniper_enhanced_server": {
							Type:     schema.TypeList,
							Optional: true,
							MaxItems: 1,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"host": {
										Type:     schema.TypeString,
										Optional: true,
									},
									"port": {
										Type:         schema.TypeInt,
										Optional:     true,
										ValidateFunc: validation.IntBetween(1, 65535),
									},
									"proxy_profile": {
										Type:     schema.TypeString,
										Optional: true,
									},
									"routing_instance": {
										Type:     schema.TypeString,
										Optional: true,
									},
								},
							},
						},
					},
				},
			},
		},
	}
}

func resourceSecurityCreate(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
	clt := m.(*Client)
	if clt.fakeCreateSetFile != "" {
		if err := setSecurity(d, clt, nil); err != nil {
			return diag.FromErr(err)
		}
		d.SetId("security")

		return nil
	}
	junSess, err := clt.startNewSession(ctx)
	if err != nil {
		return diag.FromErr(err)
	}
	defer clt.closeSession(junSess)
	if !checkCompatibilitySecurity(junSess) {
		return diag.FromErr(fmt.Errorf("security not compatible with Junos device %s",
			junSess.SystemInformation.HardwareModel))
	}
	if err := clt.configLock(ctx, junSess); err != nil {
		return diag.FromErr(err)
	}
	var diagWarns diag.Diagnostics
	if err := setSecurity(d, clt, junSess); err != nil {
		appendDiagWarns(&diagWarns, clt.configClear(junSess))

		return append(diagWarns, diag.FromErr(err)...)
	}
	warns, err := clt.commitConf("create resource junos_security", junSess)
	appendDiagWarns(&diagWarns, warns)
	if err != nil {
		appendDiagWarns(&diagWarns, clt.configClear(junSess))

		return append(diagWarns, diag.FromErr(err)...)
	}
	d.SetId("security")

	return append(diagWarns, resourceSecurityReadWJunSess(d, clt, junSess)...)
}

func resourceSecurityRead(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
	clt := m.(*Client)
	junSess, err := clt.startNewSession(ctx)
	if err != nil {
		return diag.FromErr(err)
	}
	defer clt.closeSession(junSess)

	return resourceSecurityReadWJunSess(d, clt, junSess)
}

func resourceSecurityReadWJunSess(d *schema.ResourceData, clt *Client, junSess *junosSession) diag.Diagnostics {
	mutex.Lock()
	securityOptions, err := readSecurity(clt, junSess)
	mutex.Unlock()
	if err != nil {
		return diag.FromErr(err)
	}
	fillSecurity(d, securityOptions)

	return nil
}

func resourceSecurityUpdate(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
	d.Partial(true)
	clt := m.(*Client)
	if clt.fakeUpdateAlso {
		if err := delSecurity(clt, nil); err != nil {
			return diag.FromErr(err)
		}
		if err := setSecurity(d, clt, nil); err != nil {
			return diag.FromErr(err)
		}
		d.Partial(false)

		return nil
	}
	junSess, err := clt.startNewSession(ctx)
	if err != nil {
		return diag.FromErr(err)
	}
	defer clt.closeSession(junSess)
	if err := clt.configLock(ctx, junSess); err != nil {
		return diag.FromErr(err)
	}
	var diagWarns diag.Diagnostics
	if err := delSecurity(clt, junSess); err != nil {
		appendDiagWarns(&diagWarns, clt.configClear(junSess))

		return append(diagWarns, diag.FromErr(err)...)
	}
	if err := setSecurity(d, clt, junSess); err != nil {
		appendDiagWarns(&diagWarns, clt.configClear(junSess))

		return append(diagWarns, diag.FromErr(err)...)
	}
	warns, err := clt.commitConf("update resource junos_security", junSess)
	appendDiagWarns(&diagWarns, warns)
	if err != nil {
		appendDiagWarns(&diagWarns, clt.configClear(junSess))

		return append(diagWarns, diag.FromErr(err)...)
	}
	d.Partial(false)

	return append(diagWarns, resourceSecurityReadWJunSess(d, clt, junSess)...)
}

func resourceSecurityDelete(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
	if d.Get("clean_on_destroy").(bool) {
		clt := m.(*Client)
		if clt.fakeDeleteAlso {
			if err := delSecurity(clt, nil); err != nil {
				return diag.FromErr(err)
			}

			return nil
		}
		junSess, err := clt.startNewSession(ctx)
		if err != nil {
			return diag.FromErr(err)
		}
		defer clt.closeSession(junSess)
		if err := clt.configLock(ctx, junSess); err != nil {
			return diag.FromErr(err)
		}
		var diagWarns diag.Diagnostics
		if err := delSecurity(clt, junSess); err != nil {
			appendDiagWarns(&diagWarns, clt.configClear(junSess))

			return append(diagWarns, diag.FromErr(err)...)
		}
		warns, err := clt.commitConf("delete resource junos_security", junSess)
		appendDiagWarns(&diagWarns, warns)
		if err != nil {
			appendDiagWarns(&diagWarns, clt.configClear(junSess))

			return append(diagWarns, diag.FromErr(err)...)
		}
	}

	return nil
}

func resourceSecurityImport(ctx context.Context, d *schema.ResourceData, m interface{},
) ([]*schema.ResourceData, error) {
	clt := m.(*Client)
	junSess, err := clt.startNewSession(ctx)
	if err != nil {
		return nil, err
	}
	defer clt.closeSession(junSess)
	result := make([]*schema.ResourceData, 1)
	securityOptions, err := readSecurity(clt, junSess)
	if err != nil {
		return nil, err
	}
	fillSecurity(d, securityOptions)
	d.SetId("security")
	result[0] = d

	return result, nil
}

func setSecurity(d *schema.ResourceData, clt *Client, junSess *junosSession) error {
	setPrefix := "set security "
	configSet := make([]string, 0)

	for _, v := range d.Get("alg").([]interface{}) {
		configSetAlg, err := setSecurityAlg(v)
		if err != nil {
			return err
		}
		configSet = append(configSet, configSetAlg...)
	}
	for _, v := range d.Get("flow").([]interface{}) {
		configSetFlow, err := setSecurityFlow(v)
		if err != nil {
			return err
		}
		configSet = append(configSet, configSetFlow...)
	}
	for _, v := range d.Get("forwarding_options").([]interface{}) {
		configSetForwOpts, err := setSecurityForwOpts(v)
		if err != nil {
			return err
		}
		configSet = append(configSet, configSetForwOpts...)
	}
	for _, v := range d.Get("forwarding_process").([]interface{}) {
		if v != nil {
			forwardingProcess := v.(map[string]interface{})
			if forwardingProcess["enhanced_services_mode"].(bool) {
				configSet = append(configSet, setPrefix+"forwarding-process enhanced-services-mode")
			}
		} else {
			return fmt.Errorf("forwarding_process block is empty")
		}
	}
	for _, v := range d.Get("idp_security_package").([]interface{}) {
		configSetIdpSecurityPackage, err := setSecurityIdpSecurityPackage(v)
		if err != nil {
			return err
		}
		configSet = append(configSet, configSetIdpSecurityPackage...)
	}
	for _, v := range d.Get("idp_sensor_configuration").([]interface{}) {
		configSetIdpSensorConfig, err := setSecurityIdpSensorConfig(v)
		if err != nil {
			return err
		}
		configSet = append(configSet, configSetIdpSensorConfig...)
	}
	for _, ikeTrace := range d.Get("ike_traceoptions").([]interface{}) {
		configSetIkeTrace, err := setSecurityIkeTraceOpts(ikeTrace)
		if err != nil {
			return err
		}
		configSet = append(configSet, configSetIkeTrace...)
	}
	for _, v := range d.Get("log").([]interface{}) {
		configSetLog, err := setSecurityLog(v)
		if err != nil {
			return err
		}
		configSet = append(configSet, configSetLog...)
	}
	for _, v := range d.Get("policies").([]interface{}) {
		if v != nil {
			policies := v.(map[string]interface{})
			if policies["policy_rematch"].(bool) {
				configSet = append(configSet, setPrefix+"policies policy-rematch")
			}
			if policies["policy_rematch_extensive"].(bool) {
				configSet = append(configSet, setPrefix+"policies policy-rematch extensive")
			}
		} else {
			return fmt.Errorf("policies block is empty")
		}
	}
	for _, v := range d.Get("user_identification_auth_source").([]interface{}) {
		userIdentAuthSource := v.(map[string]interface{})
		if p := userIdentAuthSource["ad_auth_priority"].(int); p != -1 {
			configSet = append(configSet, setPrefix+"user-identification authentication-source "+
				"active-directory-authentication-table priority "+strconv.Itoa(p))
		}
		if p := userIdentAuthSource["aruba_clearpass_priority"].(int); p != -1 {
			configSet = append(configSet, setPrefix+"user-identification authentication-source "+
				"aruba-clearpass priority "+strconv.Itoa(p))
		}
		if p := userIdentAuthSource["firewall_auth_priority"].(int); p != -1 {
			configSet = append(configSet, setPrefix+"user-identification authentication-source "+
				"firewall-authentication priority "+strconv.Itoa(p))
		}
		if p := userIdentAuthSource["local_auth_priority"].(int); p != -1 {
			configSet = append(configSet, setPrefix+"user-identification authentication-source "+
				"local-authentication-table priority "+strconv.Itoa(p))
		}
		if p := userIdentAuthSource["unified_access_control_priority"].(int); p != -1 {
			configSet = append(configSet, setPrefix+"user-identification authentication-source "+
				"unified-access-control priority "+strconv.Itoa(p))
		}
		if len(configSet) == 0 ||
			!strings.HasPrefix(configSet[len(configSet)-1], setPrefix+"user-identification authentication-source ") {
			return fmt.Errorf("user_identification_auth_source block is empty")
		}
	}
	for _, v := range d.Get("utm").([]interface{}) {
		if v != nil {
			utm := v.(map[string]interface{})
			if utm["feature_profile_web_filtering_type"].(string) != "" {
				configSet = append(configSet, setPrefix+"utm feature-profile web-filtering type "+
					utm["feature_profile_web_filtering_type"].(string))
			}
			for _, v2 := range utm["feature_profile_web_filtering_juniper_enhanced_server"].([]interface{}) {
				configSet = append(configSet, setPrefix+"utm feature-profile web-filtering juniper-enhanced server")
				if v2 != nil {
					utmJnpEnhServer := v2.(map[string]interface{})
					if v3 := utmJnpEnhServer["host"].(string); v3 != "" {
						configSet = append(configSet, setPrefix+"utm feature-profile web-filtering juniper-enhanced server host "+v3)
					}
					if v3 := utmJnpEnhServer["port"].(int); v3 != 0 {
						configSet = append(configSet,
							setPrefix+"utm feature-profile web-filtering juniper-enhanced server port "+strconv.Itoa(v3))
					}
					if v3 := utmJnpEnhServer["proxy_profile"].(string); v3 != "" {
						configSet = append(configSet,
							setPrefix+"utm feature-profile web-filtering juniper-enhanced server proxy-profile \""+v3+"\"")
					}
					if v3 := utmJnpEnhServer["routing_instance"].(string); v3 != "" {
						configSet = append(configSet,
							setPrefix+"utm feature-profile web-filtering juniper-enhanced server routing-instance "+v3)
					}
				}
			}
		} else {
			return fmt.Errorf("utm block is empty")
		}
	}

	return clt.configSet(configSet, junSess)
}

func setSecurityAlg(alg interface{}) ([]string, error) {
	setPrefix := "set security alg "
	configSet := make([]string, 0)
	if alg != nil {
		algM := alg.(map[string]interface{})
		if algM["dns_disable"].(bool) {
			configSet = append(configSet, setPrefix+"dns disable")
		}
		if algM["ftp_disable"].(bool) {
			configSet = append(configSet, setPrefix+"ftp disable")
		}
		if algM["h323_disable"].(bool) {
			configSet = append(configSet, setPrefix+"h323 disable")
		}
		if algM["mgcp_disable"].(bool) {
			configSet = append(configSet, setPrefix+"mgcp disable")
		}
		if algM["msrpc_disable"].(bool) {
			configSet = append(configSet, setPrefix+"msrpc disable")
		}
		if algM["pptp_disable"].(bool) {
			configSet = append(configSet, setPrefix+"pptp disable")
		}
		if algM["rsh_disable"].(bool) {
			configSet = append(configSet, setPrefix+"rsh disable")
		}
		if algM["rtsp_disable"].(bool) {
			configSet = append(configSet, setPrefix+"rtsp disable")
		}
		if algM["sccp_disable"].(bool) {
			configSet = append(configSet, setPrefix+"sccp disable")
		}
		if algM["sip_disable"].(bool) {
			configSet = append(configSet, setPrefix+"sip disable")
		}
		if algM["sql_disable"].(bool) {
			configSet = append(configSet, setPrefix+"sql disable")
		}
		if algM["sunrpc_disable"].(bool) {
			configSet = append(configSet, setPrefix+"sunrpc disable")
		}
		if algM["talk_disable"].(bool) {
			configSet = append(configSet, setPrefix+"talk disable")
		}
		if algM["tftp_disable"].(bool) {
			configSet = append(configSet, setPrefix+"tftp disable")
		}
	} else {
		return configSet, fmt.Errorf("alg block is empty")
	}

	return configSet, nil
}

func setSecurityFlow(flow interface{}) ([]string, error) { //nolint: gocognit
	setPrefix := "set security flow "
	configSet := make([]string, 0)
	if flow != nil {
		flowM := flow.(map[string]interface{})
		for _, v := range flowM["advanced_options"].([]interface{}) {
			if v != nil {
				advOpt := v.(map[string]interface{})
				if advOpt["drop_matching_reserved_ip_address"].(bool) {
					configSet = append(configSet, setPrefix+"advanced-options drop-matching-reserved-ip-address")
				}
				if advOpt["drop_matching_link_local_address"].(bool) {
					configSet = append(configSet, setPrefix+"advanced-options drop-matching-link-local-address")
				}
				if advOpt["reverse_route_packet_mode_vr"].(bool) {
					configSet = append(configSet, setPrefix+"advanced-options reverse-route-packet-mode-vr")
				}
			} else {
				return configSet, fmt.Errorf("flow advanced_options block is empty")
			}
		}
		for _, v := range flowM["aging"].([]interface{}) {
			aging := v.(map[string]interface{})
			if aging["early_ageout"].(int) != 0 {
				configSet = append(configSet, setPrefix+"aging early-ageout "+
					strconv.Itoa(aging["early_ageout"].(int)))
			}
			if aging["high_watermark"].(int) != -1 {
				configSet = append(configSet, setPrefix+"aging high-watermark "+
					strconv.Itoa(aging["high_watermark"].(int)))
			}
			if aging["low_watermark"].(int) != -1 {
				configSet = append(configSet, setPrefix+"aging low-watermark "+
					strconv.Itoa(aging["low_watermark"].(int)))
			}
			if len(configSet) == 0 || !strings.HasPrefix(configSet[len(configSet)-1], setPrefix+"aging ") {
				return configSet, fmt.Errorf("flow aging block is empty")
			}
		}
		if flowM["allow_dns_reply"].(bool) {
			configSet = append(configSet, setPrefix+"allow-dns-reply")
		}
		if flowM["allow_embedded_icmp"].(bool) {
			configSet = append(configSet, setPrefix+"allow-embedded-icmp")
		}
		if flowM["allow_reverse_ecmp"].(bool) {
			configSet = append(configSet, setPrefix+"allow-reverse-ecmp")
		}
		if flowM["enable_reroute_uniform_link_check_nat"].(bool) {
			configSet = append(configSet, setPrefix+"enable-reroute-uniform-link-check nat")
		}
		for _, v := range flowM["ethernet_switching"].([]interface{}) {
			if v != nil {
				ethSwitch := v.(map[string]interface{})
				if ethSwitch["block_non_ip_all"].(bool) {
					configSet = append(configSet, setPrefix+"ethernet-switching block-non-ip-all")
				}
				if ethSwitch["bypass_non_ip_unicast"].(bool) {
					configSet = append(configSet, setPrefix+"ethernet-switching bypass-non-ip-unicast")
				}
				if ethSwitch["bpdu_vlan_flooding"].(bool) {
					configSet = append(configSet, setPrefix+"ethernet-switching bpdu-vlan-flooding")
				}
				for _, v2 := range ethSwitch["no_packet_flooding"].([]interface{}) {
					configSet = append(configSet, setPrefix+"ethernet-switching no-packet-flooding")
					if v2 != nil {
						noPktFlo := v2.(map[string]interface{})
						if noPktFlo["no_trace_route"].(bool) {
							configSet = append(configSet, setPrefix+"ethernet-switching no-packet-flooding no-trace-route")
						}
					}
				}
			} else {
				return configSet, fmt.Errorf("flow ethernet_switching block is empty")
			}
		}
		if flowM["force_ip_reassembly"].(bool) {
			configSet = append(configSet, setPrefix+"force-ip-reassembly")
		}
		if flowM["ipsec_performance_acceleration"].(bool) {
			configSet = append(configSet, setPrefix+"ipsec-performance-acceleration")
		}
		if flowM["mcast_buffer_enhance"].(bool) {
			configSet = append(configSet, setPrefix+"mcast-buffer-enhance")
		}
		if flowM["pending_sess_queue_length"].(string) != "" {
			configSet = append(configSet, setPrefix+"pending-sess-queue-length "+
				flowM["pending_sess_queue_length"].(string))
		}
		if flowM["preserve_incoming_fragment_size"].(bool) {
			configSet = append(configSet, setPrefix+"preserve-incoming-fragment-size")
		}
		if flowM["route_change_timeout"].(int) != 0 {
			configSet = append(configSet, setPrefix+"route-change-timeout "+
				strconv.Itoa(flowM["route_change_timeout"].(int)))
		}
		if flowM["syn_flood_protection_mode"].(string) != "" {
			configSet = append(configSet, setPrefix+"syn-flood-protection-mode "+
				flowM["syn_flood_protection_mode"].(string))
		}
		if flowM["sync_icmp_session"].(bool) {
			configSet = append(configSet, setPrefix+"sync-icmp-session")
		}
		for _, v := range flowM["tcp_mss"].([]interface{}) {
			if v != nil {
				tcpMss := v.(map[string]interface{})
				if tcpMss["all_tcp_mss"].(int) != 0 {
					configSet = append(configSet, setPrefix+"tcp-mss all-tcp mss "+
						strconv.Itoa(tcpMss["all_tcp_mss"].(int)))
				}
				for _, v2 := range tcpMss["gre_in"].([]interface{}) {
					configSet = append(configSet, setPrefix+"tcp-mss gre-in")
					if v2 != nil {
						greIn := v2.(map[string]interface{})
						if greIn["mss"].(int) != 0 {
							configSet = append(configSet, setPrefix+"tcp-mss gre-in mss "+
								strconv.Itoa(greIn["mss"].(int)))
						}
					}
				}
				for _, v2 := range tcpMss["gre_out"].([]interface{}) {
					configSet = append(configSet, setPrefix+"tcp-mss gre-out")
					if v2 != nil {
						greOut := v2.(map[string]interface{})
						if greOut["mss"].(int) != 0 {
							configSet = append(configSet, setPrefix+"tcp-mss gre-out mss "+
								strconv.Itoa(greOut["mss"].(int)))
						}
					}
				}
				for _, v2 := range tcpMss["ipsec_vpn"].([]interface{}) {
					configSet = append(configSet, setPrefix+"tcp-mss ipsec-vpn")
					if v2 != nil {
						ipsecVpn := v2.(map[string]interface{})
						if ipsecVpn["mss"].(int) != 0 {
							configSet = append(configSet, setPrefix+"tcp-mss ipsec-vpn mss "+
								strconv.Itoa(ipsecVpn["mss"].(int)))
						}
					}
				}
			} else {
				return configSet, fmt.Errorf("flow tcp_mss block is empty")
			}
		}
		for _, v := range flowM["tcp_session"].([]interface{}) {
			if v != nil {
				tcpSess := v.(map[string]interface{})
				if tcpSess["fin_invalidate_session"].(bool) {
					configSet = append(configSet, setPrefix+"tcp-session fin-invalidate-session")
				}
				if tcpSess["maximum_window"].(string) != "" {
					configSet = append(configSet, setPrefix+"tcp-session maximum-window "+
						tcpSess["maximum_window"].(string))
				}
				if tcpSess["no_sequence_check"].(bool) {
					configSet = append(configSet, setPrefix+"tcp-session no-sequence-check")
				}
				if tcpSess["no_syn_check"].(bool) {
					configSet = append(configSet, setPrefix+"tcp-session no-syn-check")
				}
				if tcpSess["no_syn_check_in_tunnel"].(bool) {
					configSet = append(configSet, setPrefix+"tcp-session no-syn-check-in-tunnel")
				}
				if tcpSess["rst_invalidate_session"].(bool) {
					configSet = append(configSet, setPrefix+"tcp-session rst-invalidate-session")
				}
				if tcpSess["rst_sequence_check"].(bool) {
					configSet = append(configSet, setPrefix+"tcp-session rst-sequence-check")
				}
				if tcpSess["strict_syn_check"].(bool) {
					configSet = append(configSet, setPrefix+"tcp-session strict-syn-check")
				}
				if tcpSess["tcp_initial_timeout"].(int) != 0 {
					configSet = append(configSet, setPrefix+"tcp-session tcp-initial-timeout "+
						strconv.Itoa(tcpSess["tcp_initial_timeout"].(int)))
				}
				for _, v2 := range tcpSess["time_wait_state"].([]interface{}) {
					configSet = append(configSet, setPrefix+"tcp-session time-wait-state")
					if v2 != nil {
						timWaiSta := v2.(map[string]interface{})
						if timWaiSta["apply_to_half_close_state"].(bool) {
							configSet = append(configSet, setPrefix+"tcp-session time-wait-state apply-to-half-close-state")
						}
						if timWaiSta["session_ageout"].(bool) {
							configSet = append(configSet, setPrefix+"tcp-session time-wait-state session-ageout")
						}
						if timWaiSta["session_timeout"].(int) != 0 {
							configSet = append(configSet, setPrefix+"tcp-session time-wait-state session-timeout "+
								strconv.Itoa(timWaiSta["session_timeout"].(int)))
						}
					}
				}
			} else {
				return configSet, fmt.Errorf("flow tcp_session block is empty")
			}
		}
	} else {
		return configSet, fmt.Errorf("flow block is empty")
	}

	return configSet, nil
}

func setSecurityForwOpts(forwOpts interface{}) ([]string, error) {
	setPrefix := "set security forwarding-options "
	configSet := make([]string, 0)
	if forwOpts != nil {
		forwOptsM := forwOpts.(map[string]interface{})
		if forwOptsM["inet6_mode"].(string) != "" {
			configSet = append(configSet, setPrefix+"family inet6 mode "+forwOptsM["inet6_mode"].(string))
		}
		if forwOptsM["iso_mode_packet_based"].(bool) {
			configSet = append(configSet, setPrefix+"family iso mode packet-based")
		}
		if forwOptsM["mpls_mode"].(string) != "" {
			configSet = append(configSet, setPrefix+"family mpls mode "+forwOptsM["mpls_mode"].(string))
		}
	} else {
		return configSet, fmt.Errorf("forwarding_options block is empty")
	}

	return configSet, nil
}

func setSecurityIdpSecurityPackage(idpSecurityPackage interface{}) ([]string, error) {
	setPrefix := "set security idp security-package "
	configSet := make([]string, 0)
	if idpSecurityPackage != nil {
		idpSecurityPackageM := idpSecurityPackage.(map[string]interface{})
		if idpSecurityPackageM["automatic_enable"].(bool) {
			configSet = append(configSet, setPrefix+"automatic enable")
		}
		if v := idpSecurityPackageM["automatic_interval"].(int); v != 0 {
			configSet = append(configSet, setPrefix+"automatic interval "+strconv.Itoa(v))
		}
		if v := idpSecurityPackageM["automatic_start_time"].(string); v != "" {
			configSet = append(configSet, setPrefix+"automatic start-time "+v)
		}
		if idpSecurityPackageM["install_ignore_version_check"].(bool) {
			configSet = append(configSet, setPrefix+"install ignore-version-check")
		}
		if v := idpSecurityPackageM["proxy_profile"].(string); v != "" {
			configSet = append(configSet, setPrefix+"proxy-profile \""+v+"\"")
		}
		if v := idpSecurityPackageM["source_address"].(string); v != "" {
			configSet = append(configSet, setPrefix+"source-address "+v)
		}
		if v := idpSecurityPackageM["url"].(string); v != "" {
			configSet = append(configSet, setPrefix+"url \""+v+"\"")
		}
	} else {
		return configSet, fmt.Errorf("idp_security_package block is empty")
	}

	return configSet, nil
}

func setSecurityIdpSensorConfig(idpSensorConfig interface{}) ([]string, error) {
	setPrefix := "set security idp sensor-configuration "
	configSet := make([]string, 0)
	if idpSensorConfig != nil {
		idpSensorConfigM := idpSensorConfig.(map[string]interface{})
		if v := idpSensorConfigM["log_cache_size"].(int); v != 0 {
			configSet = append(configSet, setPrefix+"log cache-size "+strconv.Itoa(v))
		}
		for _, v := range idpSensorConfigM["log_suppression"].([]interface{}) {
			configSet = append(configSet, setPrefix+"log suppression")
			if v != nil {
				logSupp := v.(map[string]interface{})
				if logSupp["disable"].(bool) {
					configSet = append(configSet, setPrefix+"log suppression disable")
				}
				if logSupp["include_destination_address"].(bool) {
					configSet = append(configSet, setPrefix+"log suppression include-destination-address")
				}
				if logSupp["no_include_destination_address"].(bool) {
					configSet = append(configSet, setPrefix+"log suppression no-include-destination-address")
				}
				if v2 := logSupp["max_logs_operate"].(int); v2 != 0 {
					configSet = append(configSet, setPrefix+"log suppression max-logs-operate "+strconv.Itoa(v2))
				}
				if v2 := logSupp["max_time_report"].(int); v2 != 0 {
					configSet = append(configSet, setPrefix+"log suppression max-time-report "+strconv.Itoa(v2))
				}
				if v2 := logSupp["start_log"].(int); v2 != 0 {
					configSet = append(configSet, setPrefix+"log suppression start-log "+strconv.Itoa(v2))
				}
			}
		}
		for _, v := range idpSensorConfigM["packet_log"].([]interface{}) {
			packetLog := v.(map[string]interface{})
			configSet = append(configSet, setPrefix+"packet-log source-address "+packetLog["source_address"].(string))
			if v2 := packetLog["host_address"].(string); v2 != "" {
				configSet = append(configSet, setPrefix+"packet-log host "+v2)
			}
			if v2 := packetLog["host_port"].(int); v2 != 0 {
				configSet = append(configSet, setPrefix+"packet-log host port "+strconv.Itoa(v2))
			}
			if v2 := packetLog["max_sessions"].(int); v2 != 0 {
				configSet = append(configSet, setPrefix+"packet-log max-sessions "+strconv.Itoa(v2))
			}
			if v2 := packetLog["threshold_logging_interval"].(int); v2 != 0 {
				configSet = append(configSet, setPrefix+"packet-log threshold-logging-interval "+strconv.Itoa(v2))
			}
			if v2 := packetLog["total_memory"].(int); v2 != 0 {
				configSet = append(configSet, setPrefix+"packet-log total-memory "+strconv.Itoa(v2))
			}
		}
		if v := idpSensorConfigM["security_configuration_protection_mode"].(string); v != "" {
			configSet = append(configSet, setPrefix+"security-configuration protection-mode "+v)
		}
	} else {
		return configSet, fmt.Errorf("idp_sensor_configuration block is empty")
	}

	return configSet, nil
}

func setSecurityIkeTraceOpts(ikeTrace interface{}) ([]string, error) {
	setPrefix := "set security ike traceoptions "
	configSet := make([]string, 0)
	ikeTraceM := ikeTrace.(map[string]interface{})
	for _, v := range ikeTraceM["file"].([]interface{}) {
		if v != nil {
			ikeTraceFile := v.(map[string]interface{})
			if ikeTraceFile["name"].(string) != "" {
				configSet = append(configSet, setPrefix+"file "+
					ikeTraceFile["name"].(string))
			}
			if ikeTraceFile["files"].(int) > 0 {
				configSet = append(configSet, setPrefix+"file files "+
					strconv.Itoa(ikeTraceFile["files"].(int)))
			}
			if ikeTraceFile["match"].(string) != "" {
				configSet = append(configSet, setPrefix+"file match \""+
					ikeTraceFile["match"].(string)+"\"")
			}
			if ikeTraceFile["size"].(int) > 0 {
				configSet = append(configSet, setPrefix+"file size "+
					strconv.Itoa(ikeTraceFile["size"].(int)))
			}
			if ikeTraceFile["world_readable"].(bool) && ikeTraceFile["no_world_readable"].(bool) {
				return configSet, fmt.Errorf("conflict between 'world_readable' and 'no_world_readable' for ike_traceoptions file")
			}
			if ikeTraceFile["world_readable"].(bool) {
				configSet = append(configSet, setPrefix+"file world-readable")
			}
			if ikeTraceFile["no_world_readable"].(bool) {
				configSet = append(configSet, setPrefix+"file no-world-readable")
			}
		} else {
			return configSet, fmt.Errorf("ike_traceoptions file block is empty")
		}
	}
	for _, ikeTraceFlag := range sortSetOfString(ikeTraceM["flag"].(*schema.Set).List()) {
		configSet = append(configSet, setPrefix+"flag "+ikeTraceFlag)
	}
	if ikeTraceM["no_remote_trace"].(bool) {
		configSet = append(configSet, setPrefix+"no-remote-trace")
	}
	if ikeTraceM["rate_limit"].(int) > -1 {
		configSet = append(configSet, setPrefix+"rate-limit "+
			strconv.Itoa(ikeTraceM["rate_limit"].(int)))
	}
	if len(configSet) == 0 {
		return configSet, fmt.Errorf("ike_traceoptions block is empty")
	}

	return configSet, nil
}

func setSecurityLog(log interface{}) ([]string, error) {
	setPrefix := "set security log "
	configSet := make([]string, 0)
	logM := log.(map[string]interface{})
	if logM["disable"].(bool) {
		configSet = append(configSet, setPrefix+"disable")
	}
	if logM["event_rate"].(int) != -1 {
		configSet = append(configSet, setPrefix+"event-rate "+strconv.Itoa(logM["event_rate"].(int)))
	}
	if logM["facility_override"].(string) != "" {
		configSet = append(configSet, setPrefix+"facility-override "+logM["facility_override"].(string))
	}
	for _, v := range logM["file"].([]interface{}) {
		if v != nil {
			file := v.(map[string]interface{})
			if file["files"].(int) != 0 {
				configSet = append(configSet, setPrefix+"file files "+strconv.Itoa(file["files"].(int)))
			}
			if file["name"].(string) != "" {
				configSet = append(configSet, setPrefix+"file name "+file["name"].(string))
			}
			if file["path"].(string) != "" {
				configSet = append(configSet, setPrefix+"file path "+file["path"].(string))
			}
			if file["size"].(int) != 0 {
				configSet = append(configSet, setPrefix+"file size "+strconv.Itoa(file["size"].(int)))
			}
		} else {
			return configSet, fmt.Errorf("log file block is empty")
		}
	}
	if logM["format"].(string) != "" {
		configSet = append(configSet, setPrefix+"format "+logM["format"].(string))
	}
	if logM["max_database_record"].(int) != -1 {
		configSet = append(configSet, setPrefix+"max-database-record "+strconv.Itoa(logM["max_database_record"].(int)))
	}
	if logM["mode"].(string) != "" {
		configSet = append(configSet, setPrefix+"mode "+logM["mode"].(string))
	}
	if logM["rate_cap"].(int) != -1 {
		configSet = append(configSet, setPrefix+"rate-cap "+strconv.Itoa(logM["rate_cap"].(int)))
	}
	if logM["report"].(bool) {
		configSet = append(configSet, setPrefix+"report")
	}
	if logM["source_address"].(string) != "" {
		configSet = append(configSet, setPrefix+"source-address "+logM["source_address"].(string))
	}
	if logM["source_interface"].(string) != "" {
		configSet = append(configSet, setPrefix+"source-interface "+logM["source_interface"].(string))
	}
	for _, v := range logM["transport"].([]interface{}) {
		configSet = append(configSet, setPrefix+"transport")
		if v != nil {
			trans := v.(map[string]interface{})
			if trans["protocol"].(string) != "" {
				configSet = append(configSet, setPrefix+"transport protocol "+trans["protocol"].(string))
			}
			if trans["tcp_connections"].(int) != 0 {
				configSet = append(configSet, setPrefix+"transport tcp-connections "+strconv.Itoa(trans["tcp_connections"].(int)))
			}
			if trans["tls_profile"].(string) != "" {
				configSet = append(configSet, setPrefix+"transport tls-profile "+trans["tls_profile"].(string))
			}
		}
	}
	if logM["utc_timestamp"].(bool) {
		configSet = append(configSet, setPrefix+"utc-timestamp")
	}
	if len(configSet) == 0 {
		return configSet, fmt.Errorf("log block is empty")
	}

	return configSet, nil
}

func listLinesSecurityAlg() []string {
	return []string{
		"alg dns disable",
		"alg ftp disable",
		"alg h323 disable",
		"alg mgcp disable",
		"alg msrpc disable",
		"alg pptp disable",
		"alg rsh disable",
		"alg rtsp disable",
		"alg sccp disable",
		"alg sip disable",
		"alg sql disable",
		"alg sunrpc disable",
		"alg talk disable",
		"alg tftp disable",
	}
}

func listLinesSecurityFlow() []string {
	return []string{
		"flow advanced-options",
		"flow aging",
		"flow allow-dns-reply",
		"flow allow-embedded-icmp",
		"flow allow-reverse-ecmp",
		"flow enable-reroute-uniform-link-check",
		"flow ethernet-switching",
		"flow force-ip-reassembly",
		"flow ipsec-performance-acceleration",
		"flow mcast-buffer-enhance",
		"flow pending-sess-queue-length",
		"flow preserve-incoming-fragment-size",
		"flow route-change-timeout",
		"flow syn-flood-protection-mode",
		"flow sync-icmp-session",
		"flow tcp-mss",
		"flow tcp-session",
	}
}

func listLinesSecurityForwardingOptions() []string {
	return []string{
		"forwarding-options family mpls mode",
		"forwarding-options family inet6 mode",
		"forwarding-options family iso mode",
	}
}

func listLinesSecurityForwardingProcess() []string {
	return []string{
		"forwarding-process enhanced-services-mode",
	}
}

func listLinesSecurityIdpSecurityPackage() []string {
	return []string{
		"idp security-package automatic",
		"idp security-package install",
		"idp security-package proxy-profile",
		"idp security-package source-address",
		"idp security-package url",
	}
}

func listLinesSecurityIdpSensorConfiguration() []string {
	return []string{
		"idp sensor-configuration log",
		"idp sensor-configuration packet-log",
		"idp sensor-configuration security-configuration",
	}
}

func listLinesSecurityLog() []string {
	return []string{
		"log disable",
		"log event-rate",
		"log facility-override",
		"log file",
		"log format",
		"log max-database-record",
		"log mode",
		"log rate-cap",
		"log report",
		"log source-address",
		"log source-interface",
		"log transport",
		"log utc-timestamp",
	}
}

func listLinesSecurityPolicies() []string {
	return []string{
		"policies policy-rematch",
	}
}

func listLinesSecurityUserIdentificationAuthSource() []string {
	return []string{
		"user-identification authentication-source active-directory-authentication-table",
		"user-identification authentication-source aruba-clearpass",
		"user-identification authentication-source firewall-authentication",
		"user-identification authentication-source local-authentication-table",
		"user-identification authentication-source unified-access-control",
	}
}

func listLinesSecurityUtm() []string {
	return []string{
		"utm feature-profile web-filtering type",
		"utm feature-profile web-filtering juniper-enhanced server",
	}
}

func delSecurity(clt *Client, junSess *junosSession) error {
	listLinesToDelete := []string{
		"ike traceoptions",
	}
	listLinesToDelete = append(listLinesToDelete, listLinesSecurityAlg()...)
	listLinesToDelete = append(listLinesToDelete, listLinesSecurityFlow()...)
	listLinesToDelete = append(listLinesToDelete, listLinesSecurityForwardingOptions()...)
	listLinesToDelete = append(listLinesToDelete, listLinesSecurityForwardingProcess()...)
	listLinesToDelete = append(listLinesToDelete, listLinesSecurityIdpSecurityPackage()...)
	listLinesToDelete = append(listLinesToDelete, listLinesSecurityIdpSensorConfiguration()...)
	listLinesToDelete = append(listLinesToDelete, listLinesSecurityLog()...)
	listLinesToDelete = append(listLinesToDelete, listLinesSecurityPolicies()...)
	listLinesToDelete = append(listLinesToDelete, listLinesSecurityUserIdentificationAuthSource()...)
	listLinesToDelete = append(listLinesToDelete, listLinesSecurityUtm()...)

	configSet := make([]string, 0)
	delPrefix := "delete security "
	for _, line := range listLinesToDelete {
		configSet = append(configSet,
			delPrefix+line)
	}

	return clt.configSet(configSet, junSess)
}

func readSecurity(clt *Client, junSess *junosSession) (confRead securityOptions, err error) {
	showConfig, err := clt.command(cmdShowConfig+"security"+pipeDisplaySetRelative, junSess)
	if err != nil {
		return confRead, err
	}
	if showConfig != emptyW {
		for _, item := range strings.Split(showConfig, "\n") {
			if strings.Contains(item, xmlStartTagConfigOut) {
				continue
			}
			if strings.Contains(item, xmlEndTagConfigOut) {
				break
			}
			itemTrim := strings.TrimPrefix(item, setLS)
			switch {
			case bchk.StringHasOneOfPrefixes(itemTrim, listLinesSecurityAlg()):
				confRead.readSecurityAlg(itemTrim)
			case bchk.StringHasOneOfPrefixes(itemTrim, listLinesSecurityFlow()):
				if err := confRead.readSecurityFlow(itemTrim); err != nil {
					return confRead, err
				}
			case bchk.StringHasOneOfPrefixes(itemTrim, listLinesSecurityForwardingOptions()):
				confRead.readSecurityForwardingOpts(itemTrim)
			case bchk.StringHasOneOfPrefixes(itemTrim, listLinesSecurityForwardingProcess()):
				if len(confRead.forwardingProcess) == 0 {
					confRead.forwardingProcess = append(confRead.forwardingProcess, map[string]interface{}{
						"enhanced_services_mode": false,
					})
				}
				if itemTrim == "forwarding-process enhanced-services-mode" {
					confRead.forwardingProcess[0]["enhanced_services_mode"] = true
				}
			case bchk.StringHasOneOfPrefixes(itemTrim, listLinesSecurityIdpSecurityPackage()):
				if err := confRead.readSecurityIdpSecurityPackage(itemTrim); err != nil {
					return confRead, err
				}
			case bchk.StringHasOneOfPrefixes(itemTrim, listLinesSecurityIdpSensorConfiguration()):
				if err := confRead.readSecurityIdpSensorConfig(itemTrim); err != nil {
					return confRead, err
				}
			case bchk.StringHasOneOfPrefixes(itemTrim, listLinesSecurityLog()):
				if err := confRead.readSecurityLog(itemTrim); err != nil {
					return confRead, err
				}
			case balt.CutPrefixInString(&itemTrim, "ike traceoptions "):
				if err := confRead.readSecurityIkeTraceOptions(itemTrim); err != nil {
					return confRead, err
				}
			case bchk.StringHasOneOfPrefixes(itemTrim, listLinesSecurityPolicies()):
				if len(confRead.policies) == 0 {
					confRead.policies = append(confRead.policies, map[string]interface{}{
						"policy_rematch":           false,
						"policy_rematch_extensive": false,
					})
				}
				if itemTrim == "policies policy-rematch" {
					confRead.policies[0]["policy_rematch"] = true
				}
				if itemTrim == "policies policy-rematch extensive" {
					confRead.policies[0]["policy_rematch_extensive"] = true
				}
			case bchk.StringHasOneOfPrefixes(itemTrim, listLinesSecurityUserIdentificationAuthSource()):
				if err := confRead.readSecurityUserIdentAuthSource(itemTrim); err != nil {
					return confRead, err
				}
			case bchk.StringHasOneOfPrefixes(itemTrim, listLinesSecurityUtm()):
				if err := confRead.readSecurityUtm(itemTrim); err != nil {
					return confRead, err
				}
			}
		}
	}

	return confRead, nil
}

func (confRead *securityOptions) readSecurityAlg(itemTrim string) {
	balt.CutPrefixInString(&itemTrim, "alg ")
	if len(confRead.alg) == 0 {
		confRead.alg = append(confRead.alg, map[string]interface{}{
			"dns_disable":    false,
			"ftp_disable":    false,
			"h323_disable":   false,
			"mgcp_disable":   false,
			"msrpc_disable":  false,
			"pptp_disable":   false,
			"rsh_disable":    false,
			"rtsp_disable":   false,
			"sccp_disable":   false,
			"sip_disable":    false,
			"sql_disable":    false,
			"sunrpc_disable": false,
			"talk_disable":   false,
			"tftp_disable":   false,
		})
	}
	if itemTrim == "dns disable" {
		confRead.alg[0]["dns_disable"] = true
	}
	if itemTrim == "ftp disable" {
		confRead.alg[0]["ftp_disable"] = true
	}
	if itemTrim == "h323 disable" {
		confRead.alg[0]["h323_disable"] = true
	}
	if itemTrim == "mgcp disable" {
		confRead.alg[0]["mgcp_disable"] = true
	}
	if itemTrim == "msrpc disable" {
		confRead.alg[0]["msrpc_disable"] = true
	}
	if itemTrim == "pptp disable" {
		confRead.alg[0]["pptp_disable"] = true
	}
	if itemTrim == "rsh disable" {
		confRead.alg[0]["rsh_disable"] = true
	}
	if itemTrim == "rtsp disable" {
		confRead.alg[0]["rtsp_disable"] = true
	}
	if itemTrim == "sccp disable" {
		confRead.alg[0]["sccp_disable"] = true
	}
	if itemTrim == "sip disable" {
		confRead.alg[0]["sip_disable"] = true
	}
	if itemTrim == "sql disable" {
		confRead.alg[0]["sql_disable"] = true
	}
	if itemTrim == "sunrpc disable" {
		confRead.alg[0]["sunrpc_disable"] = true
	}
	if itemTrim == "talk disable" {
		confRead.alg[0]["talk_disable"] = true
	}
	if itemTrim == "tftp disable" {
		confRead.alg[0]["tftp_disable"] = true
	}
}

func (confRead *securityOptions) readSecurityFlow(itemTrim string) (err error) {
	balt.CutPrefixInString(&itemTrim, "flow ")
	if len(confRead.flow) == 0 {
		confRead.flow = append(confRead.flow, map[string]interface{}{
			"advanced_options":                make([]map[string]interface{}, 0),
			"aging":                           make([]map[string]interface{}, 0),
			"allow_dns_reply":                 false,
			"allow_embedded_icmp":             false,
			"allow_reverse_ecmp":              false,
			"ethernet_switching":              make([]map[string]interface{}, 0),
			"force_ip_reassembly":             false,
			"ipsec_performance_acceleration":  false,
			"mcast_buffer_enhance":            false,
			"pending_sess_queue_length":       "",
			"preserve_incoming_fragment_size": false,
			"route_change_timeout":            0,
			"syn_flood_protection_mode":       "",
			"sync_icmp_session":               false,
			"tcp_mss":                         make([]map[string]interface{}, 0),
			"tcp_session":                     make([]map[string]interface{}, 0),
		})
	}
	switch {
	case balt.CutPrefixInString(&itemTrim, "advanced-options"):
		if len(confRead.flow[0]["advanced_options"].([]map[string]interface{})) == 0 {
			confRead.flow[0]["advanced_options"] = append(
				confRead.flow[0]["advanced_options"].([]map[string]interface{}), map[string]interface{}{
					"drop_matching_reserved_ip_address": false,
					"drop_matching_link_local_address":  false,
					"reverse_route_packet_mode_vr":      false,
				})
		}
		switch {
		case itemTrim == " drop-matching-reserved-ip-address":
			confRead.flow[0]["advanced_options"].([]map[string]interface{})[0]["drop_matching_reserved_ip_address"] = true
		case itemTrim == " drop-matching-link-local-address":
			confRead.flow[0]["advanced_options"].([]map[string]interface{})[0]["drop_matching_link_local_address"] = true
		case itemTrim == " reverse-route-packet-mode-vr":
			confRead.flow[0]["advanced_options"].([]map[string]interface{})[0]["reverse_route_packet_mode_vr"] = true
		}
	case balt.CutPrefixInString(&itemTrim, "aging"):
		if len(confRead.flow[0]["aging"].([]map[string]interface{})) == 0 {
			confRead.flow[0]["aging"] = append(
				confRead.flow[0]["aging"].([]map[string]interface{}), map[string]interface{}{
					"early_ageout":   0,
					"high_watermark": -1,
					"low_watermark":  -1,
				})
		}
		switch {
		case balt.CutPrefixInString(&itemTrim, " early-ageout "):
			confRead.flow[0]["aging"].([]map[string]interface{})[0]["early_ageout"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		case balt.CutPrefixInString(&itemTrim, " high-watermark "):
			confRead.flow[0]["aging"].([]map[string]interface{})[0]["high_watermark"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		case balt.CutPrefixInString(&itemTrim, " low-watermark "):
			confRead.flow[0]["aging"].([]map[string]interface{})[0]["low_watermark"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		}
	case itemTrim == "allow-dns-reply":
		confRead.flow[0]["allow_dns_reply"] = true
	case itemTrim == "allow-embedded-icmp":
		confRead.flow[0]["allow_embedded_icmp"] = true
	case itemTrim == "allow-reverse-ecmp":
		confRead.flow[0]["allow_reverse_ecmp"] = true
	case itemTrim == "enable-reroute-uniform-link-check nat":
		confRead.flow[0]["enable_reroute_uniform_link_check_nat"] = true
	case balt.CutPrefixInString(&itemTrim, "ethernet-switching"):
		if len(confRead.flow[0]["ethernet_switching"].([]map[string]interface{})) == 0 {
			confRead.flow[0]["ethernet_switching"] = append(
				confRead.flow[0]["ethernet_switching"].([]map[string]interface{}), map[string]interface{}{
					"block_non_ip_all":      false,
					"bypass_non_ip_unicast": false,
					"bpdu_vlan_flooding":    false,
					"no_packet_flooding":    make([]map[string]interface{}, 0),
				})
		}
		flowEthernetSwitching := confRead.flow[0]["ethernet_switching"].([]map[string]interface{})[0]
		switch {
		case itemTrim == " block-non-ip-all":
			flowEthernetSwitching["block_non_ip_all"] = true
		case itemTrim == " bypass-non-ip-unicast":
			flowEthernetSwitching["bypass_non_ip_unicast"] = true
		case itemTrim == " bpdu-vlan-flooding":
			flowEthernetSwitching["bpdu_vlan_flooding"] = true
		case balt.CutPrefixInString(&itemTrim, " no-packet-flooding"):
			if len(flowEthernetSwitching["no_packet_flooding"].([]map[string]interface{})) == 0 {
				flowEthernetSwitching["no_packet_flooding"] = append(
					flowEthernetSwitching["no_packet_flooding"].([]map[string]interface{}), map[string]interface{}{
						"no_trace_route": false,
					})
			}
			if itemTrim == " no-trace-route" {
				flowEthernetSwitching["no_packet_flooding"].([]map[string]interface{})[0]["no_trace_route"] = true
			}
		}
	case itemTrim == "force-ip-reassembly":
		confRead.flow[0]["force_ip_reassembly"] = true
	case itemTrim == "ipsec-performance-acceleration":
		confRead.flow[0]["ipsec_performance_acceleration"] = true
	case itemTrim == "mcast-buffer-enhance":
		confRead.flow[0]["mcast_buffer_enhance"] = true
	case balt.CutPrefixInString(&itemTrim, "pending-sess-queue-length "):
		confRead.flow[0]["pending_sess_queue_length"] = itemTrim
	case itemTrim == "preserve-incoming-fragment-size":
		confRead.flow[0]["preserve_incoming_fragment_size"] = true
	case balt.CutPrefixInString(&itemTrim, "route-change-timeout "):
		confRead.flow[0]["route_change_timeout"], err = strconv.Atoi(itemTrim)
		if err != nil {
			return fmt.Errorf(failedConvAtoiError, itemTrim, err)
		}
	case balt.CutPrefixInString(&itemTrim, "syn-flood-protection-mode "):
		confRead.flow[0]["syn_flood_protection_mode"] = itemTrim
	case itemTrim == "sync-icmp-session":
		confRead.flow[0]["sync_icmp_session"] = true
	case balt.CutPrefixInString(&itemTrim, "tcp-mss "):
		if len(confRead.flow[0]["tcp_mss"].([]map[string]interface{})) == 0 {
			confRead.flow[0]["tcp_mss"] = append(
				confRead.flow[0]["tcp_mss"].([]map[string]interface{}), map[string]interface{}{
					"all_tcp_mss": 0,
					"gre_in":      make([]map[string]interface{}, 0),
					"gre_out":     make([]map[string]interface{}, 0),
					"ipsec_vpn":   make([]map[string]interface{}, 0),
				})
		}
		switch {
		case balt.CutPrefixInString(&itemTrim, "all-tcp mss "):
			confRead.flow[0]["tcp_mss"].([]map[string]interface{})[0]["all_tcp_mss"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		case balt.CutPrefixInString(&itemTrim, "gre-in"):
			if len(confRead.flow[0]["tcp_mss"].([]map[string]interface{})[0]["gre_in"].([]map[string]interface{})) == 0 {
				confRead.flow[0]["tcp_mss"].([]map[string]interface{})[0]["gre_in"] = append(
					confRead.flow[0]["tcp_mss"].([]map[string]interface{})[0]["gre_in"].([]map[string]interface{}),
					map[string]interface{}{
						"mss": 0,
					})
			}
			if balt.CutPrefixInString(&itemTrim, " mss ") {
				confRead.flow[0]["tcp_mss"].([]map[string]interface{})[0]["gre_in"].([]map[string]interface{})[0]["mss"],
					err = strconv.Atoi(itemTrim)
				if err != nil {
					return fmt.Errorf(failedConvAtoiError, itemTrim, err)
				}
			}
		case balt.CutPrefixInString(&itemTrim, "gre-out"):
			if len(confRead.flow[0]["tcp_mss"].([]map[string]interface{})[0]["gre_out"].([]map[string]interface{})) == 0 {
				confRead.flow[0]["tcp_mss"].([]map[string]interface{})[0]["gre_out"] = append(
					confRead.flow[0]["tcp_mss"].([]map[string]interface{})[0]["gre_out"].([]map[string]interface{}),
					map[string]interface{}{
						"mss": 0,
					})
			}
			if balt.CutPrefixInString(&itemTrim, " mss ") {
				confRead.flow[0]["tcp_mss"].([]map[string]interface{})[0]["gre_out"].([]map[string]interface{})[0]["mss"],
					err = strconv.Atoi(itemTrim)
				if err != nil {
					return fmt.Errorf(failedConvAtoiError, itemTrim, err)
				}
			}
		case balt.CutPrefixInString(&itemTrim, "ipsec-vpn"):
			if len(confRead.flow[0]["tcp_mss"].([]map[string]interface{})[0]["ipsec_vpn"].([]map[string]interface{})) == 0 {
				confRead.flow[0]["tcp_mss"].([]map[string]interface{})[0]["ipsec_vpn"] = append(
					confRead.flow[0]["tcp_mss"].([]map[string]interface{})[0]["ipsec_vpn"].([]map[string]interface{}),
					map[string]interface{}{
						"mss": 0,
					})
			}
			if balt.CutPrefixInString(&itemTrim, " mss ") {
				confRead.flow[0]["tcp_mss"].([]map[string]interface{})[0]["ipsec_vpn"].([]map[string]interface{})[0]["mss"],
					err = strconv.Atoi(itemTrim)
				if err != nil {
					return fmt.Errorf(failedConvAtoiError, itemTrim, err)
				}
			}
		}
	case balt.CutPrefixInString(&itemTrim, "tcp-session "):
		if len(confRead.flow[0]["tcp_session"].([]map[string]interface{})) == 0 {
			confRead.flow[0]["tcp_session"] = append(
				confRead.flow[0]["tcp_session"].([]map[string]interface{}), map[string]interface{}{
					"fin_invalidate_session": false,
					"maximum_window":         "",
					"no_sequence_check":      false,
					"no_syn_check":           false,
					"no_syn_check_in_tunnel": false,
					"rst_invalidate_session": false,
					"rst_sequence_check":     false,
					"strict_syn_check":       false,
					"tcp_initial_timeout":    0,
					"time_wait_state":        make([]map[string]interface{}, 0),
				})
		}
		flowTCPSession := confRead.flow[0]["tcp_session"].([]map[string]interface{})[0]
		switch {
		case itemTrim == "fin-invalidate-session":
			flowTCPSession["fin_invalidate_session"] = true
		case balt.CutPrefixInString(&itemTrim, "maximum-window "):
			flowTCPSession["maximum_window"] = itemTrim
		case itemTrim == "no-sequence-check":
			flowTCPSession["no_sequence_check"] = true
		case itemTrim == "no-syn-check":
			flowTCPSession["no_syn_check"] = true
		case itemTrim == "no-syn-check-in-tunnel":
			flowTCPSession["no_syn_check_in_tunnel"] = true
		case itemTrim == "rst-invalidate-session":
			flowTCPSession["rst_invalidate_session"] = true
		case itemTrim == "rst-sequence-check":
			flowTCPSession["rst_sequence_check"] = true
		case itemTrim == "strict-syn-check":
			flowTCPSession["strict_syn_check"] = true
		case balt.CutPrefixInString(&itemTrim, "tcp-initial-timeout "):
			flowTCPSession["tcp_initial_timeout"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		case balt.CutPrefixInString(&itemTrim, "time-wait-state"):
			if len(flowTCPSession["time_wait_state"].([]map[string]interface{})) == 0 {
				flowTCPSession["time_wait_state"] = append(flowTCPSession["time_wait_state"].([]map[string]interface{}),
					map[string]interface{}{
						"apply_to_half_close_state": false,
						"session_ageout":            false,
						"session_timeout":           0,
					})
			}
			timeWaitState := flowTCPSession["time_wait_state"].([]map[string]interface{})[0]
			switch {
			case itemTrim == " apply-to-half-close-state":
				timeWaitState["apply_to_half_close_state"] = true
			case itemTrim == " session-ageout":
				timeWaitState["session_ageout"] = true
			case balt.CutPrefixInString(&itemTrim, " session-timeout "):
				timeWaitState["session_timeout"], err = strconv.Atoi(itemTrim)
				if err != nil {
					return fmt.Errorf(failedConvAtoiError, itemTrim, err)
				}
			}
		}
	}

	return nil
}

func (confRead *securityOptions) readSecurityForwardingOpts(itemTrim string) {
	balt.CutPrefixInString(&itemTrim, "forwarding-options ")
	if len(confRead.forwardingOpts) == 0 {
		confRead.forwardingOpts = append(confRead.forwardingOpts, map[string]interface{}{
			"inet6_mode":            "",
			"iso_mode_packet_based": false,
			"mpls_mode":             "",
		})
	}
	switch {
	case balt.CutPrefixInString(&itemTrim, "family inet6 mode "):
		confRead.forwardingOpts[0]["inet6_mode"] = itemTrim
	case itemTrim == "family iso mode packet-based":
		confRead.forwardingOpts[0]["iso_mode_packet_based"] = true
	case balt.CutPrefixInString(&itemTrim, "family mpls mode "):
		confRead.forwardingOpts[0]["mpls_mode"] = itemTrim
	}
}

func (confRead *securityOptions) readSecurityIdpSecurityPackage(itemTrim string) (err error) {
	balt.CutPrefixInString(&itemTrim, "idp security-package ")
	if len(confRead.idpSecurityPackage) == 0 {
		confRead.idpSecurityPackage = append(confRead.idpSecurityPackage, map[string]interface{}{
			"automatic_enable":             false,
			"automatic_interval":           0,
			"automatic_start_time":         "",
			"install_ignore_version_check": false,
			"proxy_profile":                "",
			"source_address":               "",
			"url":                          "",
		})
	}
	switch {
	case itemTrim == "automatic enable":
		confRead.idpSecurityPackage[0]["automatic_enable"] = true
	case balt.CutPrefixInString(&itemTrim, "automatic interval "):
		confRead.idpSecurityPackage[0]["automatic_interval"], err = strconv.Atoi(itemTrim)
		if err != nil {
			return fmt.Errorf(failedConvAtoiError, itemTrim, err)
		}
	case balt.CutPrefixInString(&itemTrim, "automatic start-time "):
		confRead.idpSecurityPackage[0]["automatic_start_time"] = strings.Split(strings.Trim(itemTrim, "\""), " ")[0]
	case itemTrim == "install ignore-version-check":
		confRead.idpSecurityPackage[0]["install_ignore_version_check"] = true
	case balt.CutPrefixInString(&itemTrim, "proxy-profile "):
		confRead.idpSecurityPackage[0]["proxy_profile"] = strings.Trim(itemTrim, "\"")
	case balt.CutPrefixInString(&itemTrim, "source-address "):
		confRead.idpSecurityPackage[0]["source_address"] = itemTrim
	case balt.CutPrefixInString(&itemTrim, "url "):
		confRead.idpSecurityPackage[0]["url"] = strings.Trim(itemTrim, "\"")
	}

	return nil
}

func (confRead *securityOptions) readSecurityIdpSensorConfig(itemTrim string) (err error) {
	balt.CutPrefixInString(&itemTrim, "idp sensor-configuration ")
	if len(confRead.idpSensorConfig) == 0 {
		confRead.idpSensorConfig = append(confRead.idpSensorConfig, map[string]interface{}{
			"log_cache_size":                         0,
			"log_suppression":                        make([]map[string]interface{}, 0),
			"packet_log":                             make([]map[string]interface{}, 0),
			"security_configuration_protection_mode": "",
		})
	}
	switch {
	case balt.CutPrefixInString(&itemTrim, "log cache-size "):
		confRead.idpSensorConfig[0]["log_cache_size"], err = strconv.Atoi(itemTrim)
		if err != nil {
			return fmt.Errorf(failedConvAtoiError, itemTrim, err)
		}
	case balt.CutPrefixInString(&itemTrim, "log suppression"):
		if len(confRead.idpSensorConfig[0]["log_suppression"].([]map[string]interface{})) == 0 {
			confRead.idpSensorConfig[0]["log_suppression"] = append(
				confRead.idpSensorConfig[0]["log_suppression"].([]map[string]interface{}), map[string]interface{}{
					"disable":                        false,
					"include_destination_address":    false,
					"no_include_destination_address": false,
					"max_logs_operate":               0,
					"max_time_report":                0,
					"start_log":                      0,
				})
		}
		logSupp := confRead.idpSensorConfig[0]["log_suppression"].([]map[string]interface{})[0]
		switch {
		case itemTrim == " disable":
			logSupp["disable"] = true
		case itemTrim == " include-destination-address":
			logSupp["include_destination_address"] = true
		case itemTrim == " no-include-destination-address":
			logSupp["no_include_destination_address"] = true
		case balt.CutPrefixInString(&itemTrim, " max-logs-operate "):
			logSupp["max_logs_operate"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		case balt.CutPrefixInString(&itemTrim, " max-time-report "):
			logSupp["max_time_report"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		case balt.CutPrefixInString(&itemTrim, " start-log "):
			logSupp["start_log"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		}
	case balt.CutPrefixInString(&itemTrim, "packet-log "):
		if len(confRead.idpSensorConfig[0]["packet_log"].([]map[string]interface{})) == 0 {
			confRead.idpSensorConfig[0]["packet_log"] = append(
				confRead.idpSensorConfig[0]["packet_log"].([]map[string]interface{}), map[string]interface{}{
					"source_address":             "",
					"host_address":               "",
					"host_port":                  0,
					"max_sessions":               0,
					"threshold_logging_interval": 0,
					"total_memory":               0,
				})
		}
		packetLog := confRead.idpSensorConfig[0]["packet_log"].([]map[string]interface{})[0]
		switch {
		case balt.CutPrefixInString(&itemTrim, "source-address "):
			packetLog["source_address"] = itemTrim
		case balt.CutPrefixInString(&itemTrim, "host port "):
			packetLog["host_port"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		case balt.CutPrefixInString(&itemTrim, "host "):
			packetLog["host_address"] = itemTrim
		case balt.CutPrefixInString(&itemTrim, "max-sessions "):
			packetLog["max_sessions"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		case balt.CutPrefixInString(&itemTrim, "threshold-logging-interval "):
			packetLog["threshold_logging_interval"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		case balt.CutPrefixInString(&itemTrim, "total-memory "):
			packetLog["total_memory"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		}
	case balt.CutPrefixInString(&itemTrim, "security-configuration protection-mode "):
		confRead.idpSensorConfig[0]["security_configuration_protection_mode"] = itemTrim
	}

	return nil
}

func (confRead *securityOptions) readSecurityIkeTraceOptions(itemTrim string) (err error) {
	if len(confRead.ikeTraceoptions) == 0 {
		confRead.ikeTraceoptions = append(confRead.ikeTraceoptions, map[string]interface{}{
			"file":            make([]map[string]interface{}, 0),
			"flag":            make([]string, 0),
			"no_remote_trace": false,
			"rate_limit":      -1,
		})
	}
	switch {
	case balt.CutPrefixInString(&itemTrim, "file"):
		if len(confRead.ikeTraceoptions[0]["file"].([]map[string]interface{})) == 0 {
			confRead.ikeTraceoptions[0]["file"] = append(
				confRead.ikeTraceoptions[0]["file"].([]map[string]interface{}), map[string]interface{}{
					"name":              "",
					"files":             0,
					"match":             "",
					"size":              0,
					"world_readable":    false,
					"no_world_readable": false,
				})
		}
		file := confRead.ikeTraceoptions[0]["file"].([]map[string]interface{})[0]
		switch {
		case balt.CutPrefixInString(&itemTrim, " files "):
			file["files"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		case balt.CutPrefixInString(&itemTrim, " match "):
			file["match"] = strings.Trim(itemTrim, "\"")
		case balt.CutPrefixInString(&itemTrim, " size "):
			switch {
			case balt.CutSuffixInString(&itemTrim, "k"):
				file["size"], err = strconv.Atoi(itemTrim)
				file["size"] = file["size"].(int) * 1024
			case balt.CutSuffixInString(&itemTrim, "m"):
				file["size"], err = strconv.Atoi(itemTrim)
				file["size"] = file["size"].(int) * 1024 * 1024
			case balt.CutSuffixInString(&itemTrim, "g"):
				file["size"], err = strconv.Atoi(itemTrim)
				file["size"] = file["size"].(int) * 1024 * 1024 * 1024
			default:
				file["size"], err = strconv.Atoi(itemTrim)
			}
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		case itemTrim == " world-readable":
			file["world_readable"] = true
		case itemTrim == " no-world-readable":
			file["no_world_readable"] = true
		case balt.CutPrefixInString(&itemTrim, " "):
			file["name"] = strings.Trim(itemTrim, "\"")
		}
	case balt.CutPrefixInString(&itemTrim, "flag "):
		confRead.ikeTraceoptions[0]["flag"] = append(confRead.ikeTraceoptions[0]["flag"].([]string), itemTrim)
	case itemTrim == "no-remote-trace":
		confRead.ikeTraceoptions[0]["no_remote_trace"] = true
	case balt.CutPrefixInString(&itemTrim, "rate-limit "):
		confRead.ikeTraceoptions[0]["rate_limit"], err = strconv.Atoi(itemTrim)
		if err != nil {
			return fmt.Errorf(failedConvAtoiError, itemTrim, err)
		}
	}

	return nil
}

func (confRead *securityOptions) readSecurityLog(itemTrim string) (err error) {
	balt.CutPrefixInString(&itemTrim, "log ")
	if len(confRead.log) == 0 {
		confRead.log = append(confRead.log, map[string]interface{}{
			"disable":             false,
			"event_rate":          -1,
			"facility_override":   "",
			"file":                make([]map[string]interface{}, 0),
			"format":              "",
			"max_database_record": -1,
			"mode":                "",
			"rate_cap":            -1,
			"report":              false,
			"source_address":      "",
			"source_interface":    "",
			"transport":           make([]map[string]interface{}, 0),
			"utc_timestamp":       false,
		})
	}
	switch {
	case itemTrim == disableW:
		confRead.log[0]["disable"] = true
	case balt.CutPrefixInString(&itemTrim, "event-rate "):
		confRead.log[0]["event_rate"], err = strconv.Atoi(itemTrim)
		if err != nil {
			return fmt.Errorf(failedConvAtoiError, itemTrim, err)
		}
	case balt.CutPrefixInString(&itemTrim, "facility-override "):
		confRead.log[0]["facility_override"] = itemTrim
	case balt.CutPrefixInString(&itemTrim, "file"):
		if len(confRead.log[0]["file"].([]map[string]interface{})) == 0 {
			confRead.log[0]["file"] = append(confRead.log[0]["file"].([]map[string]interface{}), map[string]interface{}{
				"files": 0,
				"name":  "",
				"path":  "",
				"size":  0,
			})
		}
		file := confRead.log[0]["file"].([]map[string]interface{})[0]
		switch {
		case balt.CutPrefixInString(&itemTrim, " files "):
			file["files"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		case balt.CutPrefixInString(&itemTrim, " name "):
			file["name"] = itemTrim
		case balt.CutPrefixInString(&itemTrim, " path "):
			file["path"] = itemTrim
		case balt.CutPrefixInString(&itemTrim, " size "):
			file["size"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		}
	case balt.CutPrefixInString(&itemTrim, "format "):
		confRead.log[0]["format"] = itemTrim
	case balt.CutPrefixInString(&itemTrim, "max-database-record "):
		confRead.log[0]["max_database_record"], err = strconv.Atoi(itemTrim)
		if err != nil {
			return fmt.Errorf(failedConvAtoiError, itemTrim, err)
		}
	case balt.CutPrefixInString(&itemTrim, "mode "):
		confRead.log[0]["mode"] = itemTrim
	case balt.CutPrefixInString(&itemTrim, "rate-cap "):
		confRead.log[0]["rate_cap"], err = strconv.Atoi(itemTrim)
		if err != nil {
			return fmt.Errorf(failedConvAtoiError, itemTrim, err)
		}
	case itemTrim == "report":
		confRead.log[0]["report"] = true
	case balt.CutPrefixInString(&itemTrim, "source-address "):
		confRead.log[0]["source_address"] = itemTrim
	case balt.CutPrefixInString(&itemTrim, "source-interface "):
		confRead.log[0]["source_interface"] = itemTrim
	case balt.CutPrefixInString(&itemTrim, "transport"):
		if len(confRead.log[0]["transport"].([]map[string]interface{})) == 0 {
			confRead.log[0]["transport"] = append(
				confRead.log[0]["transport"].([]map[string]interface{}), map[string]interface{}{
					"protocol":        "",
					"tcp_connections": 0,
					"tls_profile":     "",
				})
		}
		transport := confRead.log[0]["transport"].([]map[string]interface{})[0]
		switch {
		case balt.CutPrefixInString(&itemTrim, " protocol "):
			transport["protocol"] = itemTrim
		case balt.CutPrefixInString(&itemTrim, " tcp-connections "):
			transport["tcp_connections"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		case balt.CutPrefixInString(&itemTrim, " tls-profile "):
			transport["tls_profile"] = itemTrim
		}
	case itemTrim == "utc-timestamp":
		confRead.log[0]["utc_timestamp"] = true
	}

	return nil
}

func (confRead *securityOptions) readSecurityUserIdentAuthSource(itemTrim string) (err error) {
	balt.CutPrefixInString(&itemTrim, "user-identification authentication-source ")
	if len(confRead.userIdentAuthSource) == 0 {
		confRead.userIdentAuthSource = append(confRead.userIdentAuthSource, map[string]interface{}{
			"ad_auth_priority":                -1,
			"aruba_clearpass_priority":        -1,
			"firewall_auth_priority":          -1,
			"local_auth_priority":             -1,
			"unified_access_control_priority": -1,
		})
	}
	switch {
	case balt.CutPrefixInString(&itemTrim, "active-directory-authentication-table priority "):
		confRead.userIdentAuthSource[0]["ad_auth_priority"], err = strconv.Atoi(itemTrim)
	case balt.CutPrefixInString(&itemTrim, "aruba-clearpass priority "):
		confRead.userIdentAuthSource[0]["aruba_clearpass_priority"], err = strconv.Atoi(itemTrim)
	case balt.CutPrefixInString(&itemTrim, "firewall-authentication priority "):
		confRead.userIdentAuthSource[0]["firewall_auth_priority"], err = strconv.Atoi(itemTrim)
	case balt.CutPrefixInString(&itemTrim, "local-authentication-table priority "):
		confRead.userIdentAuthSource[0]["local_auth_priority"], err = strconv.Atoi(itemTrim)
	case balt.CutPrefixInString(&itemTrim, "unified-access-control priority "):
		confRead.userIdentAuthSource[0]["unified_access_control_priority"], err = strconv.Atoi(itemTrim)
	}
	if err != nil {
		return fmt.Errorf(failedConvAtoiError, itemTrim, err)
	}

	return nil
}

func (confRead *securityOptions) readSecurityUtm(itemTrim string) (err error) {
	if len(confRead.utm) == 0 {
		confRead.utm = append(confRead.utm, map[string]interface{}{
			"feature_profile_web_filtering_type":                    "",
			"feature_profile_web_filtering_juniper_enhanced_server": make([]map[string]interface{}, 0),
		})
	}
	switch {
	case balt.CutPrefixInString(&itemTrim, "utm feature-profile web-filtering type "):
		confRead.utm[0]["feature_profile_web_filtering_type"] = itemTrim
	case balt.CutPrefixInString(&itemTrim, "utm feature-profile web-filtering juniper-enhanced server"):
		utmArg := "feature_profile_web_filtering_juniper_enhanced_server"
		if len(confRead.utm[0][utmArg].([]map[string]interface{})) == 0 {
			confRead.utm[0][utmArg] = append(confRead.utm[0][utmArg].([]map[string]interface{}),
				map[string]interface{}{
					"host":             "",
					"port":             0,
					"proxy_profile":    "",
					"routing_instance": "",
				})
		}
		utmFeatProfWebFiltJunEnhServer := confRead.utm[0][utmArg].([]map[string]interface{})[0]
		switch {
		case balt.CutPrefixInString(&itemTrim, " host "):
			utmFeatProfWebFiltJunEnhServer["host"] = itemTrim
		case balt.CutPrefixInString(&itemTrim, " port "):
			utmFeatProfWebFiltJunEnhServer["port"], err = strconv.Atoi(itemTrim)
			if err != nil {
				return fmt.Errorf(failedConvAtoiError, itemTrim, err)
			}
		case balt.CutPrefixInString(&itemTrim, " proxy-profile "):
			utmFeatProfWebFiltJunEnhServer["proxy_profile"] = strings.Trim(itemTrim, "\"")
		case balt.CutPrefixInString(&itemTrim, " routing-instance "):
			utmFeatProfWebFiltJunEnhServer["routing_instance"] = itemTrim
		}
	}

	return nil
}

func fillSecurity(d *schema.ResourceData, securityOptions securityOptions) {
	if tfErr := d.Set("alg", securityOptions.alg); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("flow", securityOptions.flow); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("forwarding_options", securityOptions.forwardingOpts); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("forwarding_process", securityOptions.forwardingProcess); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("idp_security_package", securityOptions.idpSecurityPackage); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("idp_sensor_configuration", securityOptions.idpSensorConfig); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("ike_traceoptions", securityOptions.ikeTraceoptions); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("log", securityOptions.log); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("policies", securityOptions.policies); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("user_identification_auth_source", securityOptions.userIdentAuthSource); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("utm", securityOptions.utm); tfErr != nil {
		panic(tfErr)
	}
}