module Cisco-IOS-XE-fw-oper {

    yang-version 1;

    namespace
      "http://cisco.com/ns/yang/Cisco-IOS-XE-fw-oper";

    prefix fw-ios-xe-oper;

    import cisco-semver {
      prefix cisco-semver;
    }

    organization "Cisco Systems, Inc.";

    contact
      "Cisco Systems, Inc.
     Customer Service

     Postal: 170 W Tasman Drive
     San Jose, CA 95134

     Tel: +1 1800 553-NETS

     E-mail: cs-yang@cisco.com";

    description
      "This module contains a collection of YANG definitions
     for ZBFW operational data.
     Copyright (c) 2018-2020 by Cisco Systems, Inc.
     All rights reserved.";

    revision "2020-11-01" {
      description
        "Added missing drop causes";
      reference
        "2.2.0";

    }

    revision "2019-05-01" {
      description "Added semantic version";
      reference
        "2.1.0";

    }

    revision "2018-10-29" {
      description
        "- Added Policy AVC Action Drop
       - Cleaned up spelling errors in descriptions.
       - Added network configurations.
       - Renamed top level container from fw-oper-data to zbfw.";
      reference
        "2.0.0";

    }

    revision "2018-02-22" {
      description "Initial revision";
      reference
        "1.0.0";

    }

    cisco-semver:module-version "2.2.0";
    cisco-semver:module-version "2.1.0";
    cisco-semver:module-version "2.0.0";
    cisco-semver:module-version "1.0.0";

    container zbfw {
      config false;
      description
        "Operational state of ZBFW";
      container drop-statistics {
        presence "fw-drop-stats";
        description
          "Firewall Drop Statistics";
        leaf catch-all {
          type uint64;
          description
            "Total packet drops seen since bring up";
        }

        leaf l4-max-halfsession {
          type uint64;
          description
            "Packet drops due to maximum L4 half-open sessions reached";
        }

        leaf l4-too-many-pkts {
          type uint64;
          description
            "Packet drops due to exceeding the maximum number of inspectable packets allowed per flow";
        }

        leaf l4-session-limit {
          type uint64;
          description
            "Packet drops for session initiators after exceeding maximum session limit";
        }

        leaf l4-invalid-hdr {
          type uint64;
          description
            "Packet drops due to invalid header/packet length";
        }

        leaf l4-internal-err-undefined-dir {
          type uint64;
          description
            "Packet drops due to a failure in determining direction";
        }

        leaf l4-scb-close {
          type uint64;
          description
            "Packet drops due to session in internal close state";
        }

        leaf l4-tcp-invalid-ack-flag {
          type uint64;
          description
            "Packet drops due to invalid TCP ACK flags";
        }

        leaf l4-tcp-invalid-ack-num {
          type uint64;
          description
            "Packet drops due to invalid ACK number";
        }

        leaf l4-tcp-invalid-tcp-initiator {
          type uint64;
          description
            "Packet drops due to non-SYN packets received without valid session";
        }

        leaf l4-tcp-syn-with-data {
          type uint64;
          description
            "Packet drops due to SYN packets having data";
        }

        leaf l4-tcp-invalid-win-scale-option {
          type uint64;
          description
            "Packet drops due to invalid TCP window scale option";
        }

        leaf l4-tcp-invalid-seg-synsent-state {
          type uint64;
          description
            "Packet drops due to invalid packets received in SYNSENT state";
        }

        leaf l4-tcp-invalid-seg-synrcvd-state {
          type uint64;
          description
            "Packet drops due to invalid packets received in SYNRCVD state";
        }

        leaf l4-tcp-invalid-seg-pkt-too-old {
          type uint64;
          description
            "Packet drops due to packets being too old/out of window";
        }

        leaf l4-tcp-invalid-seg-pkt-win-overflow {
          type uint64;
          description
            "Packet drops due to receiver window overflow (except when vTCP is enabled)";
        }

        leaf l4-tcp-invalid-seg-pyld-after-fin-send {
          type uint64;
          description
            "Packet drops due to payload received after FIN is sent";
        }

        leaf l4-tcp-invalid-flags {
          type uint64;
          description
            "Packet drops due to invalid/unexpected TCP flags";
        }

        leaf l4-tcp-invalid-seq {
          type uint64;
          description
            "Packet drops due to invalid sequence number";
        }

        leaf l4-tcp-retrans-invalid-flags {
          type uint64;
          description
            "Packet drops due to invalid flags in TCP retransmitted packet";
        }

        leaf l4-tcp-l7-ooo-seg {
          type uint64;
          description
            "Packet drops due to L7 not accepting out-of-order TCP segments";
        }

        leaf l4-tcp-syn-flood-drop {
          type uint64;
          description
            "Packet drops during SYN flood attack";
        }

        leaf l4-tcp-internal-err-synflood-alloc-hostdb-fail {
          type uint64;
          description
            "Packet drops due to failure of hostdb allocation during a SYN flood attack";
        }

        leaf l4-tcp-synflood-blackout-drop {
          type uint64;
          description
            "Packet drops due to blackout drop time when exceeding configured half-open connections";
        }

        leaf l4-tcp-unexpect-tcp-payload {
          type uint64;
          description
            "Packet drops due to receiving TCP packet with payload when a response is expected for SYN";
        }

        leaf l4-tcp-syn-in-win {
          type uint64;
          description
            "Packet drops due to receiving SYN in an established connection";
        }

        leaf l4-tcp-rst-in-win {
          type uint64;
          description
            "Packet drops due to receiving RST in an established connection";
        }

        leaf l4-tcp-stray-seg {
          type uint64;
          description
            "Packet drops due to unexpected/stray TCP segments";
        }

        leaf l4-tcp-rst-to-resp {
          type uint64;
          description
            "RST sent to responder in SYNSENT state when ACK sequence is invalid";
        }

        leaf insp-pam-lookup-fail {
          type uint64;
          description
            "Packet drops when policy exists in zone-pair but PAM lookup fails";
        }

        leaf insp-internal-err-get-stat-blk-fail {
          type uint64;
          description
            "Packet drops due to failure to get statistics block";
        }

        leaf insp-dstaddr-lookup-fail {
          type uint64;
          description
            "Packet drops due to destination address lookup failure";
        }

        leaf insp-policy-not-present {
          type uint64;
          description
            "Packet drops due to inspection policy not present in zone-pair";
        }

        leaf insp-sess-miss-policy-not-present {
          type uint64;
          description
            "Packet drops due to session lookup failure and no matching policy present";
        }

        leaf insp-classification-fail {
          type uint64;
          description
            "Packet drops due to protocol classification failure";
        }

        leaf insp-class-action-drop {
          type uint64;
          description
            "Packet drops due to a drop classification action";
        }

        leaf insp-policy-misconfigure {
          type uint64;
          description
            "Packet drops due to failed classification because of misconfigured security policy";
        }

        leaf l4-icmp-too-many-err-pkts {
          type uint64;
          description
            "Packet drops after exceeding the maximum number of ICMP error packets allowed per flow";
        }

        leaf l4-icmp-internal-err-no-nat {
          type uint64;
          description
            "Packet drops when ICMP is network address translated without internal NAT info";
        }

        leaf l4-icmp-internal-err-alloc-fail {
          type uint64;
          description
            "Packet drops when ICMP failed to get error packets";
        }

        leaf l4-icmp-internal-err-get-stat-blk-fail {
          type uint64;
          description
            "Packet drops due to a failure to get statistics block";
        }

        leaf l4-icmp-internal-err-dir-not-identified {
          type uint64;
          description
            "Packet drops due to unidentified ICMP packet direction";
        }

        leaf l4-icmp-scb-close {
          type uint64;
          description
            "Packet drops due to receiving ICMP packets when session is in internal close state";
        }

        leaf l4-icmp-pkt-no-ip-hdr {
          type uint64;
          description
            "Packet drops due to missing IP header in ICMP packets";
        }

        leaf l4-icmp-pkt-too-short {
          type uint64;
          description
            "Packet drops due to ICMP error where packets are too short";
        }

        leaf l4-icmp-err-no-ip-no-icmp {
          type uint64;
          description
            "Packet drops due to packets not identified as IP or ICMP";
        }

        leaf l4-icmp-err-pkts-burst {
          type uint64;
          description
            "Packet drops due to ICMP error where packet bursts exceed a limit of 10";
        }

        leaf l4-icmp-err-multiple-unreach {
          type uint64;
          description
            "Packet drops due to receiving multiple unreachable packets; only 1 is allowed";
        }

        leaf l4-icmp-err-l4-invalid-seq {
          type uint64;
          description
            "Packet drops when inner TCP sequence number of packet does not match that of packet originating the ICMP error";
        }

        leaf l4-icmp-err-l4-invalid-ack {
          type uint64;
          description
            "Packet drops due to inner TCP header invalid ACK";
        }

        leaf l4-icmp-err-policy-not-present {
          type uint64;
          description
            "Packet drops due to missing policy on zone-pair for ICMP";
        }

        leaf l4-icmp-err-classification-fail {
          type uint64;
          description
            "Packet drops due to a miss when doing reverse path flow check";
        }

        leaf syncookie-max-dst {
          type uint64;
          description
            "SYNcookie Packet drops when we've reached maximum number of SYN destinations per zone";
        }

        leaf syncookie-internal-err-alloc-fail {
          type uint64;
          description
            "SYNcookie Packet drops due to a failure in allocating memory in the destination table";
        }

        leaf syncookie-trigger {
          type uint64;
          description
            "Packet drops due to a SYNcookie trigger";
        }

        leaf policy-fragment-drop {
          type uint64;
          description
            "Packet drops due to dropping fragmented packet when first fragment drops";
        }

        leaf policy-action-drop {
          type uint64;
          description
            "Packet drops when policy action is drop";
        }

        leaf policy-icmp-action-drop {
          type uint64;
          description
            "Packet drops when policy action for the ICMP packet is to drop";
        }

        leaf l7-type-drop {
          type uint64;
          description
            "Packet drops when L7 inspection returns drop as the action";
        }

        leaf l7-no-seg {
          type uint64;
          description
            "Packet drops due to receiving segmented packets when ALG does not honor them";
        }

        leaf l7-no-frag {
          type uint64;
          description
            "Packet drops due to receiving fragmented packets when ALG does not honor them";
        }

        leaf l7-unknown-proto {
          type uint64;
          description
            "Packet drops due to unrecognized L7 protocol type";
        }

        leaf l7-alg-ret-drop {
          type uint64;
          description
            "Packet drops due to L7 (ALG) deciding to drop the packet";
        }

        leaf l7-promote-fail-no-zone-pair {
          type uint64;
          description
            "Packet drops due to L7 sub-channel promotion failure due to no zone pair configured for the sub-channel";
        }

        leaf l7-promote-fail-no-policy {
          type uint64;
          description
            "Packet drops due to L7 sub-channel promotion failure due to no policy configured for the sub-channel";
        }

        leaf no-session {
          type uint64;
          description
            "Packet drops due to session creation failure";
        }

        leaf no-new-session {
          type uint64;
          description
            "Packet drops due to internal state not allowing new session creation";
        }

        leaf not-initiator {
          type uint64;
          description
            "Packet drops due to receiving a non-initiator packet for a session";
        }

        leaf invalid-zone {
          type uint64;
          description
            "Packet drops due to a zone not configured for interface";
        }

        leaf ha-ar-standby {
          type uint64;
          description
            "Packet drops due to asymmetric routing not configured and box not in active state";
        }

        leaf no-forwarding-zone {
          type uint64;
          description
            "Packet drops when Firewall is uninitialized";
        }

        leaf backpressure {
          type uint64;
          description
            "Packet drops due to backpressure by log mechanism";
        }

        leaf zone-mismatch {
          type uint64;
          description
            "Packet drops due to zone mismatch";
        }

        leaf fdb-err {
          type uint64;
          description
            "Packet drops due to a failure to register flow with flow database";
        }

        leaf lisp-header-restore-fail {
          type uint64;
          description
            "Packet drops due to LISP header restoration failure";
        }

        leaf lisp-inner-pkt-insane {
          type uint64;
          description
            "Packet drops due to LISP inner packet sanity check failure";
        }

        leaf lisp-inner-ipv4-insane {
          type uint64;
          description
            "Packet drops due to LISP inner packet IPV4 sanity check failure";
        }

        leaf lisp-inner-ipv6-insane {
          type uint64;
          description
            "Packet drops due to LISP inner packet IPV6 sanity check failure";
        }

        leaf policy-avc-action-drop {
          type uint64;
          description
            "Packet drops when AVC policy action is drop";
        }

        leaf l4-icmp-invalid-seq {
          type uint64;
          description
            "Packet drops due to invalid ICMP sequence number";
        }

        leaf l4-udp-max-halfsession {
          type uint64;
          description
            "Packet drops due to UDP half-open session limit exceed";
        }

        leaf l4-icmp-max-halfsession {
          type uint64;
          description
            "Packet drops due to ICMP half-open session limit exceed";
        }

        leaf no-zone-pair-present {
          type uint64;
          description
            "Packet drops due to no zone-pair found";
        }
      }  // container drop-statistics

      list zonepair-statistics {
        key "zonepair-name";
        description
          "Firewall Zone pair list entries";
        leaf zonepair-name {
          type string;
          description
            "Name of the zone pair";
        }

        leaf src-zone-name {
          type string;
          description
            "Name of the source zone";
        }

        leaf dst-zone-name {
          type string;
          description
            "Name of the destination zone";
        }

        leaf policy-name {
          type string;
          description
            "Name of the policy applied for this zone pair";
        }

        list fw-traffic-class-entry {
          key "class-name";
          description
            "Firewall Traffic class list entries";
          leaf class-name {
            type string;
            description
              "Name of the traffic class";
          }

          leaf zonepair-name {
            type string;
            description "Zone pair name";
          }

          leaf class-action {
            type string;
            description
              "Action for the traffic class";
          }

          leaf pkts-counter {
            type uint64;
            description "Total Packets";
          }

          leaf bytes-counter {
            type uint64;
            description "Total bytes";
          }

          leaf attempted-conn {
            type uint64;
            description
              "Total number for the attempted connections matching this traffic class";
          }

          leaf current-active-conn {
            type uint64;
            description
              "Current number of active connections matching this traffic class";
          }

          leaf max-active-conn {
            type uint64;
            description
              "Maximum number of active connections seen for this traffic class";
          }

          leaf current-halfopen-conn {
            type uint64;
            description
              "Current number of half-open connections seen for this traffic class";
          }

          leaf max-halfopen-conn {
            type uint64;
            description
              "Maximum number of half-open connections seen for this traffic class";
          }

          leaf current-terminating-conn {
            type uint64;
            description
              "Current number of terminating connections seen for this traffic class";
          }

          leaf max-terminating-conn {
            type uint64;
            description
              "Maximum number of terminating connections seen for this traffic class";
          }

          leaf time-since-last-session-create {
            type uint64;
            description
              "Seconds since last session creation";
          }

          list fw-tc-match-entry {
            key "match-name match-type-id";
            description
              "List of match conditions";
            leaf match-name {
              type string;
              description "Match Name";
            }

            leaf match-type-id {
              type uint8;
              description
                "Match Type Identifier";
            }

            leaf match-type {
              type string;
              description "Match Type";
            }
          }  // list fw-tc-match-entry

          list fw-tc-proto-entry {
            key "proto-id";
            description
              "Firewall Traffic class protocol list entries";
            leaf proto-id {
              type uint16;
              description "Protocol ID";
            }

            leaf protocol-name {
              type string;
              description "Protocol Name";
            }

            leaf byte-counters {
              type uint64;
              description
                "Number of bytes matching this protocol";
            }

            leaf pkt-counters {
              type uint64;
              description
                "Number of packets matching this protocol";
            }
          }  // list fw-tc-proto-entry

          leaf l7-policy-name {
            type string;
            description
              "Name of the L7 policy applied for this zone pair";
          }

          list fw-l7-traffic-class-entry {
            key "child-class-name";
            description
              "Firewall L7 Traffic class list entries";
            leaf child-class-name {
              type string;
              description
                "Name of the L7 traffic class";
            }

            leaf parent-class-name {
              type string;
              description
                "Name of the traffic class";
            }

            leaf child-class-action {
              type string;
              description
                "Action for the L7 traffic class";
            }

            leaf pkts-counter {
              type uint64;
              description "Total Packets";
            }

            leaf bytes-counter {
              type uint64;
              description "Total bytes";
            }

            leaf attempted-conn {
              type uint64;
              description
                "Total number for the attempted connections matching this traffic class";
            }

            leaf current-active-conn {
              type uint64;
              description
                "Current number of active connections matching this traffic class";
            }

            leaf max-active-conn {
              type uint64;
              description
                "Maximum number of active connections seen for this traffic class";
            }

            leaf current-halfopen-conn {
              type uint64;
              description
                "Current number of half-open connections seen for this traffic class";
            }

            leaf max-halfopen-conn {
              type uint64;
              description
                "Maximum number of half-open connections seen for this traffic class";
            }

            leaf current-terminating-conn {
              type uint64;
              description
                "Current number of terminating connections seen for this traffic class";
            }

            leaf max-terminating-conn {
              type uint64;
              description
                "Maximum number of terminating connections seen for this traffic class";
            }

            leaf time-since-last-session-create {
              type uint64;
              description
                "seconds since last session creation";
            }

            list fw-l7-tc-match-app-entry {
              key "l7-match-app-name";
              description
                "Firewall L7 Traffic class application list entries";
              leaf l7-match-app-name {
                type string;
                description
                  "Layer 7 Application Name";
              }

              leaf byte-counters {
                type uint64;
                description
                  "Number of bytes matching this application";
              }

              leaf pkt-counters {
                type uint64;
                description
                  "Number of packets matching this application";
              }
            }  // list fw-l7-tc-match-app-entry
          }  // list fw-l7-traffic-class-entry
        }  // list fw-traffic-class-entry
      }  // list zonepair-statistics
    }  // container zbfw
  }  // module Cisco-IOS-XE-fw-oper