Skip to content

Commit

Permalink
Added policy_based_vpn_mode to NAT resource
Browse files Browse the repository at this point in the history 
Signed-off-by: Wouter van der Waal <w.vanderwaal@iqmessenger.com>
  • Loading branch information
@wvanderwaal-iqmessenger
wvanderwaal-iqmessenger committed Mar 7, 2024
1 parent 0c0ec19 commit 4cbf619
Show file tree
Hide file tree
Showing 3 changed files with 93 additions and 56 deletions.
21 changes: 21 additions & 0 deletions nsxt/resource_nsxt_policy_nat_rule.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,11 @@ var policyNATRuleFirewallMatchTypeValues = []string{
model.PolicyNatRule_FIREWALL_MATCH_BYPASS,
}

var policyNATRulePolicyBasedVpnModeTypeValues = []string{
model.PolicyNatRule_POLICY_BASED_VPN_MODE_BYPASS,
model.PolicyNatRule_POLICY_BASED_VPN_MODE_MATCH,
}

func resourceNsxtPolicyNATRule() *schema.Resource {
return &schema.Resource{
Create: resourceNsxtPolicyNATRuleCreate,
Expand Down Expand Up @@ -131,6 +136,13 @@ func resourceNsxtPolicyNATRule() *schema.Resource {
Computed: true,
Elem: getElemPolicyPathSchema(),
},
"policy_based_vpn_mode": {
Type: schema.TypeString,
Description: "Policy based vpn mode match flag. DNAT only",
Optional: true,
Default: model.PolicyNatRule_POLICY_BASED_VPN_MODE_BYPASS,
ValidateFunc: validation.StringInSlice(policyNATRulePolicyBasedVpnModeTypeValues, false),
},
},
}
}
Expand Down Expand Up @@ -263,6 +275,7 @@ func resourceNsxtPolicyNATRuleRead(d *schema.ResourceData, m interface{}) error
}
d.Set("translated_ports", obj.TranslatedPorts)
d.Set("scope", obj.Scope)
d.Set("policy_based_vpn_mode", obj.PolicyBasedVpnMode)

d.SetId(id)

Expand Down Expand Up @@ -305,6 +318,7 @@ func resourceNsxtPolicyNATRuleCreate(d *schema.ResourceData, m interface{}) erro
priority := int64(d.Get("rule_priority").(int))
service := d.Get("service").(string)
ports := d.Get("translated_ports").(string)
pbvmMatch := d.Get("policy_based_vpn_mode").(string)
dNets := stringListToCommaSeparatedString(interfaceListToStringList(d.Get("destination_networks").([]interface{})))
sNets := stringListToCommaSeparatedString(interfaceListToStringList(d.Get("source_networks").([]interface{})))
tNets := stringListToCommaSeparatedString(interfaceListToStringList(d.Get("translated_networks").([]interface{})))
Expand Down Expand Up @@ -334,6 +348,9 @@ func resourceNsxtPolicyNATRuleCreate(d *schema.ResourceData, m interface{}) erro
if ports != "" {
ruleStruct.TranslatedPorts = &ports
}
if pbvmMatch != "" {
ruleStruct.PolicyBasedVpnMode = &pbvmMatch
}

log.Printf("[INFO] Creating NAT Rule with ID %s", id)

Expand Down Expand Up @@ -404,6 +421,10 @@ func resourceNsxtPolicyNATRuleUpdate(d *schema.ResourceData, m interface{}) erro
if tPorts != "" {
ruleStruct.TranslatedPorts = &tPorts
}
pbvmMatch := d.Get("policy_based_vpn_mode").(string)
if pbvmMatch != "" {
ruleStruct.PolicyBasedVpnMode = &pbvmMatch
}

log.Printf("[INFO] Updating NAT Rule with ID %s", id)
err := patchNsxtPolicyNATRule(context, connector, gwID, ruleStruct, isT0)
Expand Down
93 changes: 53 additions & 40 deletions nsxt/resource_nsxt_policy_nat_rule_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ func testAccResourceNsxtPolicyNATRuleBasicT1(t *testing.T, withContext bool, pre
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "action", action),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "logging", "false"),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "firewall_match", model.PolicyNatRule_FIREWALL_MATCH_BYPASS),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "policy_based_vpn_mode", model.PolicyNatRule_POLICY_BASED_VPN_MODE_BYPASS),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "path"),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "revision"),
),
Expand All @@ -112,6 +113,7 @@ func testAccResourceNsxtPolicyNATRuleBasicT1(t *testing.T, withContext bool, pre
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "action", action),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "logging", "false"),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "firewall_match", model.PolicyNatRule_FIREWALL_MATCH_BYPASS),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "policy_based_vpn_mode", model.PolicyNatRule_POLICY_BASED_VPN_MODE_BYPASS),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "path"),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "revision"),
),
Expand All @@ -131,6 +133,7 @@ func testAccResourceNsxtPolicyNATRuleBasicT1(t *testing.T, withContext bool, pre
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "action", action),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "logging", "false"),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "firewall_match", model.PolicyNatRule_FIREWALL_MATCH_MATCH_EXTERNAL_ADDRESS),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "policy_based_vpn_mode", model.PolicyNatRule_POLICY_BASED_VPN_MODE_MATCH),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "path"),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "revision"),
),
Expand Down Expand Up @@ -169,6 +172,7 @@ func TestAccResourceNsxtPolicyNATRule_basicT0(t *testing.T) {
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "action", action),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "logging", "false"),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "firewall_match", model.PolicyNatRule_FIREWALL_MATCH_MATCH_EXTERNAL_ADDRESS),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "policy_based_vpn_mode", model.PolicyNatRule_POLICY_BASED_VPN_MODE_BYPASS),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "scope.#", "2"),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "path"),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "revision"),
Expand All @@ -188,6 +192,7 @@ func TestAccResourceNsxtPolicyNATRule_basicT0(t *testing.T) {
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "action", action),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "logging", "false"),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "firewall_match", model.PolicyNatRule_FIREWALL_MATCH_MATCH_EXTERNAL_ADDRESS),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "policy_based_vpn_mode", model.PolicyNatRule_POLICY_BASED_VPN_MODE_BYPASS),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "scope.#", "2"),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "path"),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "revision"),
Expand Down Expand Up @@ -277,6 +282,7 @@ func TestAccResourceNsxtPolicyNATRule_nat64T1(t *testing.T) {
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "action", action),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "logging", "false"),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "firewall_match", model.PolicyNatRule_FIREWALL_MATCH_BYPASS),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "policy_based_vpn_mode", model.PolicyNatRule_POLICY_BASED_VPN_MODE_BYPASS),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "path"),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "revision"),
),
Expand All @@ -297,6 +303,7 @@ func TestAccResourceNsxtPolicyNATRule_nat64T1(t *testing.T) {
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "action", action),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "logging", "false"),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "firewall_match", model.PolicyNatRule_FIREWALL_MATCH_BYPASS),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "policy_based_vpn_mode", model.PolicyNatRule_POLICY_BASED_VPN_MODE_BYPASS),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "path"),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "revision"),
),
Expand Down Expand Up @@ -334,6 +341,7 @@ func TestAccResourceNsxtPolicyNATRuleNoSnatWithoutTNet(t *testing.T) {
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "action", action),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "logging", "false"),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "firewall_match", model.PolicyNatRule_FIREWALL_MATCH_MATCH_EXTERNAL_ADDRESS),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "policy_based_vpn_mode", model.PolicyNatRule_POLICY_BASED_VPN_MODE_BYPASS),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "path"),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "revision"),
),
Expand All @@ -352,6 +360,7 @@ func TestAccResourceNsxtPolicyNATRuleNoSnatWithoutTNet(t *testing.T) {
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "action", action),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "logging", "false"),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "firewall_match", model.PolicyNatRule_FIREWALL_MATCH_MATCH_EXTERNAL_ADDRESS),
resource.TestCheckResourceAttr(testAccResourcePolicyNATRuleName, "policy_based_vpn_mode", model.PolicyNatRule_POLICY_BASED_VPN_MODE_BYPASS),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "path"),
resource.TestCheckResourceAttrSet(testAccResourcePolicyNATRuleName, "revision"),
),
Expand Down Expand Up @@ -455,16 +464,17 @@ data "nsxt_policy_service" "test" {
resource "nsxt_policy_nat_rule" "test" {
%s
display_name = "%s"
description = "Acceptance Test"
gateway_path = nsxt_policy_tier1_gateway.test.path
action = "%s"
source_networks = ["%s"]
destination_networks = ["%s"]
translated_networks = ["%s"]
logging = false
firewall_match = "%s"
service = data.nsxt_policy_service.test.path
display_name = "%s"
description = "Acceptance Test"
gateway_path = nsxt_policy_tier1_gateway.test.path
action = "%s"
source_networks = ["%s"]
destination_networks = ["%s"]
translated_networks = ["%s"]
logging = false
firewall_match = "%s"
service = data.nsxt_policy_service.test.path
policy_based_vpn_mode = "%s"
tag {
scope = "scope1"
Expand All @@ -476,7 +486,7 @@ resource "nsxt_policy_nat_rule" "test" {
tag = "tag2"
}
}
`, context, name, action, sourceNet, destNet, translatedNet, model.PolicyNatRule_FIREWALL_MATCH_BYPASS)
`, context, name, action, sourceNet, destNet, translatedNet, model.PolicyNatRule_FIREWALL_MATCH_BYPASS, model.PolicyNatRule_POLICY_BASED_VPN_MODE_BYPASS)
}

func testAccNsxtPolicyNATRuleTier1UpdateMultipleSourceNetworksTemplate(name string, action string, sourceNet1 string, sourceNet2 string, destNet string, translatedNet string, withContext bool) string {
Expand All @@ -488,15 +498,16 @@ func testAccNsxtPolicyNATRuleTier1UpdateMultipleSourceNetworksTemplate(name stri
testAccNsxtPolicyTier1WithEdgeClusterTemplate("test", false, withContext) + fmt.Sprintf(`
resource "nsxt_policy_nat_rule" "test" {
%s
display_name = "%s"
description = "Acceptance Test"
gateway_path = nsxt_policy_tier1_gateway.test.path
action = "%s"
source_networks = ["%s", "%s"]
destination_networks = ["%s"]
translated_networks = ["%s"]
logging = false
firewall_match = "%s"
display_name = "%s"
description = "Acceptance Test"
gateway_path = nsxt_policy_tier1_gateway.test.path
action = "%s"
source_networks = ["%s", "%s"]
destination_networks = ["%s"]
translated_networks = ["%s"]
logging = false
firewall_match = "%s"
policy_based_vpn_mode = "%s"
tag {
scope = "scope1"
Expand All @@ -508,7 +519,7 @@ resource "nsxt_policy_nat_rule" "test" {
tag = "tag2"
}
}
`, context, name, action, sourceNet1, sourceNet2, destNet, translatedNet, model.PolicyNatRule_FIREWALL_MATCH_MATCH_EXTERNAL_ADDRESS)
`, context, name, action, sourceNet1, sourceNet2, destNet, translatedNet, model.PolicyNatRule_FIREWALL_MATCH_MATCH_EXTERNAL_ADDRESS, model.PolicyNatRule_POLICY_BASED_VPN_MODE_MATCH)
}

func testAccNsxtPolicyNATRuleTier0CreateTemplate(name string, action string, sourceNet string, translatedNet string) string {
Expand Down Expand Up @@ -549,15 +560,16 @@ resource "nsxt_policy_tier0_gateway_interface" "test" {
}
resource "nsxt_policy_nat_rule" "test" {
display_name = "%s"
description = "Acceptance Test"
gateway_path = nsxt_policy_tier0_gateway.test.path
action = "%s"
source_networks = ["%s"]
translated_networks = ["%s"]
logging = false
firewall_match = "%s"
scope = [nsxt_policy_tier0_gateway_interface.test[1].path, nsxt_policy_tier0_gateway_interface.test[0].path]
display_name = "%s"
description = "Acceptance Test"
gateway_path = nsxt_policy_tier0_gateway.test.path
action = "%s"
source_networks = ["%s"]
translated_networks = ["%s"]
logging = false
firewall_match = "%s"
scope = [nsxt_policy_tier0_gateway_interface.test[1].path, nsxt_policy_tier0_gateway_interface.test[0].path]
policy_based_vpn_mode = "%s"
tag {
scope = "scope1"
Expand All @@ -570,21 +582,22 @@ resource "nsxt_policy_nat_rule" "test" {
}
}
`, interfaceSite, name, action, sourceNet, translatedNet, model.PolicyNatRule_FIREWALL_MATCH_MATCH_EXTERNAL_ADDRESS)
`, interfaceSite, name, action, sourceNet, translatedNet, model.PolicyNatRule_FIREWALL_MATCH_MATCH_EXTERNAL_ADDRESS, model.PolicyNatRule_POLICY_BASED_VPN_MODE_BYPASS)
}

func testAccNsxPolicyNatRuleNoTranslatedNetworkTemplate(name string, action string, sourceNet string, destNet string) string {
return testAccNsxtPolicyEdgeClusterReadTemplate(getEdgeClusterName()) +
testAccNsxtPolicyTier1WithEdgeClusterTemplate("test", false, false) + fmt.Sprintf(`
resource "nsxt_policy_nat_rule" "test" {
display_name = "%s"
description = "Acceptance Test"
gateway_path = nsxt_policy_tier1_gateway.test.path
action = "%s"
source_networks = ["%s"]
destination_networks = ["%s"]
logging = false
firewall_match = "%s"
display_name = "%s"
description = "Acceptance Test"
gateway_path = nsxt_policy_tier1_gateway.test.path
action = "%s"
source_networks = ["%s"]
destination_networks = ["%s"]
logging = false
firewall_match = "%s"
policy_based_vpn_mode = "%s"
tag {
scope = "scope1"
Expand All @@ -596,5 +609,5 @@ func testAccNsxPolicyNatRuleNoTranslatedNetworkTemplate(name string, action stri
tag = "tag2"
}
}
`, name, action, sourceNet, destNet, model.PolicyNatRule_FIREWALL_MATCH_MATCH_EXTERNAL_ADDRESS)
`, name, action, sourceNet, destNet, model.PolicyNatRule_FIREWALL_MATCH_MATCH_EXTERNAL_ADDRESS, model.PolicyNatRule_POLICY_BASED_VPN_MODE_BYPASS)
}
35 changes: 19 additions & 16 deletions website/docs/r/policy_nat_rule.html.markdown
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,14 +15,15 @@ This resource is applicable to NSX Global Manager, NSX Policy Manager and VMC.

```hcl
resource "nsxt_policy_nat_rule" "dnat1" {
display_name = "dnat_rule1"
action = "DNAT"
source_networks = ["9.1.1.1", "9.2.1.1"]
destination_networks = ["11.1.1.1"]
translated_networks = ["10.1.1.1"]
gateway_path = nsxt_policy_tier1_gateway.t1gateway.path
logging = false
firewall_match = "MATCH_INTERNAL_ADDRESS"
display_name = "dnat_rule1"
action = "DNAT"
source_networks = ["9.1.1.1", "9.2.1.1"]
destination_networks = ["11.1.1.1"]
translated_networks = ["10.1.1.1"]
gateway_path = nsxt_policy_tier1_gateway.t1gateway.path
logging = false
firewall_match = "MATCH_INTERNAL_ADDRESS"
policy_based_vpn_mode = "BYPASS"
tag {
scope = "color"
Expand All @@ -42,14 +43,15 @@ resource "nsxt_policy_nat_rule" "dnat1" {
context {
project_id = data.nsxt_policy_project.demoproj.id
}
display_name = "dnat_rule1"
action = "DNAT"
source_networks = ["9.1.1.1", "9.2.1.1"]
destination_networks = ["11.1.1.1"]
translated_networks = ["10.1.1.1"]
gateway_path = nsxt_policy_tier1_gateway.t1gateway.path
logging = false
firewall_match = "MATCH_INTERNAL_ADDRESS"
display_name = "dnat_rule1"
action = "DNAT"
source_networks = ["9.1.1.1", "9.2.1.1"]
destination_networks = ["11.1.1.1"]
translated_networks = ["10.1.1.1"]
gateway_path = nsxt_policy_tier1_gateway.t1gateway.path
logging = false
firewall_match = "MATCH_INTERNAL_ADDRESS"
policy_based_vpn_mode = "BYPASS"
tag {
scope = "color"
Expand Down Expand Up @@ -80,6 +82,7 @@ The following arguments are supported:
* `translated_networks` - (Optional) A list of translated network IP addresses or CIDR.
* `translated_ports` - (Optional) Port number or port range. For use with `DNAT` action only.
* `scope` - (Optional) A list of paths to interfaces and/or labels where the NAT Rule is enforced.
* `policy_based_vpn_mode` - (Optional) Policy based VPN mode. One of `BYPASS`, `MATCH`

## Attributes Reference

Expand Down

0 comments on commit 4cbf619

Please sign in to comment.