module Cisco-IOS-XE-wireless-general-cfg {

    yang-version 1;

    namespace
      "http://cisco.com/ns/yang/Cisco-IOS-XE-wireless-general-cfg";

    prefix wireless-general-cfg;

    import Cisco-IOS-XE-wireless-enum-types {
      prefix wireless-enum-types;
    }
    import Cisco-IOS-XE-wireless-types {
      prefix wireless-types;
    }
    import ietf-inet-types {
      prefix inet;
    }
    import ietf-yang-types {
      prefix yang;
    }
    import cisco-semver {
      prefix cisco-semver;
    }

    organization "Cisco Systems, Inc.";

    contact
      "Cisco Systems, Inc.
     Customer Service

     Postal: 170 W Tasman Drive
     San Jose, CA 95134

     Tel: +1 1800 553-NETS

     E-mail: cs-yang@cisco.com";

    description
      "Model for managing misc WLC configurations
     Copyright (c) 2016-2021 by Cisco Systems, Inc.
     All rights reserved.";

    revision "2021-07-01" {
      description
        "- Added support for threshold warning
       - Added option to enable wireless multicast link-local packets forwarding in downstream direction
       - Added Adaptive WIPS syslog configuration
       - Added EWC image download configuration";
      reference
        "8.1.0";

    }

    revision "2021-03-01" {
      description
        "- Added support for AP certificate policy configurations
       - Added support for DTLS ciphersuite priority
       - Deprecated old DTLS ciphersuite configuration
       - Relaxed must-constraint for feature-usage and EWC platform";
      reference
        "8.0.0";

    }

    revision "2020-11-01" {
      description
        "- Added AWIPS file download config
       - Added support for Wireless Feature Usage monitoring configuration
       - Allow network-assurance and Cisco-DNA GRPC to coexist
       - Modified the error message for Cisco-DNA GRPC and ICAP Port Configuration";
      reference
        "7.2.0";

    }

    revision "2020-07-01" {
      description
        "- Added Cisco-DNA gRPC token
       - Added client IPv6 config parameters
       - Added config validation for DTLS version and cipher-suite configurations
       - Modified the error message for Cisco-DNA GRPC and WSA configurations
       - Added config validation for Cisco-DNA GRPC and ICAP Port Configuration";
      reference
        "7.1.0";

    }

    revision "2020-03-01" {
      description
        "- Added support for client event config from AP
       - Added support for management certificate and authorization configuration
       - Added config validation for Cisco-DNA gRPC token and WSA enable
       - Remove presence statement for wsa-config and ap-dna-global-config";
      reference
        "7.0.0";

    }

    revision "2019-11-01" {
      description
        "- Changed Mobility Express references to Embedded Wireless Controller.
       - Added port for server port configuration
       - Added support for IOx app hosting on APs
       - Added support for Cisco DNA token configuration";
      reference
        "6.1.0";

    }

    revision "2019-09-20" {
      description
        "- Added obsolete status for Lawful Interception";
      reference
        "6.0.0";

    }

    revision "2019-09-05" {
      description
        "- Add support for Embedded Wireless Controller configuration.
       - Default for public-ip-discovery changed to false.
       - Added semantic version";
      reference
        "5.0.0";

    }

    revision "2019-02-08" {
      description
        "- Remove unused leaf test-ip-address from sim-l3-interface-cache-data
       - Cleaned up spelling errors in descriptions.
       - Added VRF to download DNAC certificate
       - Add mobility discovery threshold under CAC config
       - Add remove-presence annotation to NA certificate configuration
       - Added constraints for WSA dataplane statistics
       - Multicast related leaves name change
       - Restrict password type options available for na server certificate
         download
       - Add MFP config container
       - Corrected DTLS default configuration";
      reference
        "4.0.0";

    }

    revision "2018-08-16" {
      description
        "- Rename mcast/bcast to multicast/broadcast
       - Add support for Lawful Interception.
       - Rename icap-port to airsense-port";
      reference
        "3.0.0";

    }

    revision "2018-03-22" {
      description
        "Add container for AP upgrade";
      reference
        "2.1.0";

    }

    revision "2018-01-24" {
      description
        "The first generally available version";
      reference
        "2.0.0";

    }

    revision "2017-05-05" {
      description "Initial revision";
      reference
        "1.0.0";

    }

    cisco-semver:module-version "8.1.0";
    cisco-semver:module-version "8.0.0";
    cisco-semver:module-version "7.2.0";
    cisco-semver:module-version "7.1.0";
    cisco-semver:module-version "7.0.0";
    cisco-semver:module-version "6.1.0";
    cisco-semver:module-version "6.0.0";
    cisco-semver:module-version "5.0.0";
    cisco-semver:module-version "4.0.0";
    cisco-semver:module-version "3.0.0";
    cisco-semver:module-version "2.1.0";
    cisco-semver:module-version "2.0.0";
    cisco-semver:module-version "1.0.0";

    container general-cfg-data {
      description
        "General wireless configuration";
      container mewlc-config {
        presence "mewlc-config";
        description
          "Embedded Wireless Controller Configuration";
        leaf mewlc-platform {
          type boolean;
          default "false";
          description
            "Embedded Wireless Controller Platform";
        }

        leaf mewlc-vrrp-vrid {
          when
            "(../mewlc-platform = 'true')";
          type uint8 {
            range "1 .. 255";
          }
          default "1";
          description
            "Embedded Wireless Controller VRRP Virtual Router Identifier";
        }

        leaf preferred-master-name {
          when
            "(../mewlc-platform = 'true')";
          type string;
          default "";
          description
            "Preferred Master AP Name";
        }

        leaf p-img-dwnld {
          when
            "(../mewlc-platform = 'true')";
          type boolean;
          default "false";
          description
            "Download AP image in parallel on Image Master APs from external image server";
        }
      }  // container mewlc-config

      container cac-config {
        presence "cacconfig";
        description
          "CAC Resources values configuration";
        leaf iplearnq-high-threshold {
          type uint32 {
            range "1000 .. 1600";
          }
          default "1300";
          description
            "High Threshold Value for IplearnQ";
        }

        leaf aaa-high-threshold {
          type uint32 {
            range "300 .. 700";
          }
          default "500";
          description
            "High Threshold Value for AAA Outstanding request queue";
        }

        leaf ipc-high-threshold {
          type uint32 {
            range "80 .. 95";
          }
          must
            "../ipc-low-threshold < ../ipc-high-threshold" {
            error-message
              "ipc-high-threshold must be greater than ipc-low-threshold";
            error-app-tag "must-violation";
          }
          default "85";
          description
            "High Threshold Value for IPC resources";
        }

        leaf ipc-low-threshold {
          type uint32 {
            range "70 .. 80";
          }
          default "75";
          description
            "Low Threshold Value for IPC resources";
        }

        leaf cpu-high-threshold {
          type uint32 {
            range "85 .. 95";
          }
          default "90";
          description
            "High Threshold Value for cpu resource";
        }

        leaf mobility-discovery-threshold-high {
          type uint32 {
            range "80 .. 3000";
          }
          default "400";
          description
            "High Threshold Value for for allowed clients in mobility discovery";
        }
      }  // container cac-config

      container mfp {
        presence "mfp";
        description "MFP config";
        leaf global-mfp-state {
          type boolean;
          default "false";
          description
            "Global MFP enabled status";
        }

        leaf ap-impersonation-detection {
          type boolean;
          default "false";
          description
            "AP impersonation detection status";
        }

        leaf mfp-key-refresh-interval {
          type uint8 {
            range "1 .. 24";
          }
          default "24";
          description
            "Key refresh interval, in hours";
        }
      }  // container mfp

      container fips-cfg {
        presence "fips-cfg";
        description
          "DTLS for AP join configurations";
        leaf dtls-version {
          type wireless-types:enm-dtls-version;
          default "dtls-all";
          description
            "DTLS version used for AP join";
        }

        leaf dtls-ciphersuite {
          type wireless-types:enm-ciphersuite;
          default "tls-null-with-null-null";
          status deprecated;
          description
            "Configure DTLS ciphersuite";
        }
      }  // container fips-cfg

      container awips-file-dwnld {
        presence "awips-file-dwnld";
        description
          "Adaptive WIPS signature file download configuration";
        leaf url {
          type string {
            pattern
              "https://[\\]A-Za-z0-9!%&()+,\\-./:=^?@\\[']+";
          }
          description "URL information";
        }

        leaf wlc-version {
          type string;
          description
            "WLC version information";
        }

        leaf max-file-ver {
          type uint32;
          description
            "Maximum supported file version information";
        }

        leaf file-version {
          type uint32;
          description
            "File version information";
        }

        leaf trustpoint {
          type string;
          description
            "Trustpoint to be used";
        }

        leaf file-sha256 {
          type string;
          description
            "File SHA-256 hash value";
        }
      }  // container awips-file-dwnld

      container awips-syslog-cfg {
        presence "awips-syslog-cfg";
        description
          "Adaptive WIPS syslog throttle interval configuration";
        leaf syslog-timeout {
          type uint32 {
            range "30 .. 600";
          }
          units "seconds";
          default "60";
          description
            "Throttle interval in seconds";
        }
      }  // container awips-syslog-cfg

      container exclusion-list-file-records {
        description "Exclusion list records";
        list exclusion-list-file-record {
          key "mac-addr";
          description
            "exclusion list record";
          leaf mac-addr {
            type yang:mac-address;
            description
              "Mac address of the controller";
          }

          leaf description {
            type string;
            default "";
            description
              "Reason for exclusion";
          }
        }  // list exclusion-list-file-record
      }  // container exclusion-list-file-records

      container wsa-config {
        description "WSA configuration";
        leaf enable {
          type boolean;
          default "false";
          description
            "Flag to enable or disable WSA";
        }

        leaf url {
          type string;
          default "";
          description
            "URL for the WSA server";
        }

        leaf token {
          type string;
          default "";
          description
            "ID-token for the WSA server";
        }

        leaf enable-dataplane-statistics {
          type boolean;
          default "false";
          description
            "Flag to enable dataplane statistics";
        }

        leaf interval-dataplane-statistics {
          type uint16;
          must
            "(../enable-dataplane-statistics = 'true' and ../interval-dataplane-statistics != 0) or (../enable-dataplane-statistics = 'false')" {
            error-message
              "Dataplane statistics interval must be non-zero when dataplane statistics collection is enabled";
            error-app-tag "must-violation";
          }
          default "0";
          description
            "Interval for dataplane statistics collection";
        }

        leaf icap-port {
          type uint16;
          default "0";
          description "ICap port number";
        }
      }  // container wsa-config

      container na-server-cert {
        description
          "tesseract server details";
        leaf protocol {
          type wireless-types:download-protocol;
          default "protocol-none";
          description
            "Protocol to be used for tesseract server";
        }

        leaf server-ip {
          type inet:ip-address;
          default "0.0.0.0";
          description
            "Server IP of the tesseract server";
        }

        leaf path {
          type string;
          default "";
          description
            "Path where certificate is placed";
        }

        leaf filename {
          type string;
          default "";
          description
            "Filename of the certificate";
        }

        leaf encrypted {
          type boolean;
          default "false";
          description
            "Flag to enable or disable encryption";
        }

        leaf username {
          type string;
          description
            "Username to be used for tesseract server";
        }

        leaf password {
          type string;
          default "";
          description
            "Password to be used for tesseract server";
        }

        leaf password-type {
          type wireless-enum-types:crypt-type;
          must
            "((current() = 'clear') or (current() = 'aes'))" {
            error-message
              "Password type should be either clear text or AES encrypted";
            error-app-tag "must-violation";
          }
          default "clear";
          description
            "Password encrypted or in clear";
        }

        leaf vrf {
          type string {
            length "0..32";
          }
          description "VRF name instance";
        }
      }  // container na-server-cert

      container wsa-ap-client-event {
        presence "wsa-ap-client-event";
        description
          "Client event config parameters for AP";
        leaf frequency {
          type uint32;
          must
            "(../frequency >= 5 and ../frequency <= 90)" {
            error-message
              "Frequency must be in range of 5..90 seconds";
            error-app-tag "must-violation";
          }
          default "30";
          description
            "Frequency in seconds, at which events from AP are to be sent to WLC";
        }
      }  // container wsa-ap-client-event

      container ap-dna-global-config {
        description
          "Cisco DNA global configuration for access points";
        leaf token {
          type string;
          must
            "(../../wsa-config/icap-port != 0 and string-length(../token) = 0) or (../../wsa-config/icap-port = 0)" {
            error-message
              "DNA Spaces IOT Services and DNAC gRPC cannot be active at the same time";
            error-app-tag "must-violation";
          }
          default "";
          description "Cisco DNA token";
        }

        leaf token-type {
          type wireless-enum-types:crypt-type;
          must
            "((current() = 'clear') or (current() = 'aes'))" {
            error-message
              "Token encryption type should be either clear text or AES encryption";
            error-app-tag "must-violation";
          }
          default "clear";
          description
            "Cisco DNA token type, can be clear or encrypted";
        }

        leaf clear-token {
          type string;
          must
            "(../../wsa-config/icap-port != 0 and string-length(../clear-token) = 0) or (../../wsa-config/icap-port = 0)" {
            error-message
              "DNA Spaces IOT Services and DNAC gRPC cannot be active at the same time";
            error-app-tag "must-violation";
          }
          default "";
          description "Cisco DNA token";
        }
      }  // container ap-dna-global-config

      container ipv6-cfg {
        description
          "Wireless client IPv6 configurations";
        leaf disable-client-ipv6 {
          type boolean;
          default "false";
          description
            "Disable IPv6 traffic for incoming wireless clients";
        }
      }  // container ipv6-cfg

      container sim-l3-interface-cache-data {
        presence "simL3InterfaceCacheData-t";
        description
          "wireless management interface data";
        leaf interface-name {
          type string;
          default "";
          description
            "Wireless management interface name";
        }

        leaf nat-ip-address {
          type inet:ip-address;
          default "0.0.0.0";
          description "NAT IP Address";
        }

        leaf nat-enable {
          type boolean;
          default "false";
          description
            "NAT IP Address is enabled or disabled";
        }

        leaf private-ip-discovery {
          type boolean;
          default "true";
          description
            "Discovery Response from Private IP is enabled or disabled";
        }

        leaf public-ip-discovery {
          type boolean;
          default "false";
          description
            "Discovery Response from Public IP is enabled or disabled";
        }
      }  // container sim-l3-interface-cache-data

      container wlc-management-data {
        presence "mgmtData-t";
        description
          "WLC management certificate and authorization configuration";
        leaf pki-trustpoint-name {
          type string;
          default "";
          description
            "Wireless management trustpoint name";
        }

        leaf ssc-auth-token {
          type string;
          default "";
          description
            "SSC authorization token";
        }

        leaf ssc-auth-token-type {
          type wireless-enum-types:crypt-type;
          default "clear";
          description
            "SSC authorization token encryption type";
        }

        container ssc-trust-hash-list {
          description
            "Trusted SSC fingerprint list";
          list ssc-trust-hash {
            key "ssc-fingerprint";
            description
              "Trusted SSC fingerprint";
            leaf ssc-fingerprint {
              type string;
              description
                "Trusted SSC SHA1 fingerprint";
            }
          }  // list ssc-trust-hash
        }  // container ssc-trust-hash-list

        container allow-mic-ap {
          description
            "Allow MIC AP policy configurations";
          leaf allow-policy {
            type boolean;
            default "false";
            description
              "Allow MIC AP policy status";
          }

          leaf tp-name {
            type string;
            must
              " not((current() = 'CISCO_IDEVID_SUDI') or (current() = 'CISCO_IDEVID_SUDI_LEGACY')) " {
              error-message
                "Default Cisco SUDI trustpoint name is not allowed";
              error-app-tag "must-violation";
            }
            default "";
            description
              "Trustpoint name of WLC certificate chain used for MIC AP join";
          }
        }  // container allow-mic-ap
      }  // container wlc-management-data

      container ap-cert-policy-by-macs {
        description
          "AP certificate policy by MAC";
        list ap-cert-policy-by-mac {
          key "eth-mac";
          description
            "AP certificate policy by APs MAC";
          leaf eth-mac {
            type yang:mac-address;
            description "AP ethernet MAC";
          }

          leaf policy-type {
            type wireless-types:enm-ap-cert-policy;
            description "Policy type";
          }
        }  // list ap-cert-policy-by-mac
      }  // container ap-cert-policy-by-macs

      container ap-cert-policy-by-sns {
        description
          "AP certificate policy by serial number";
        list ap-cert-policy-by-sn {
          key "ta-serial-num";
          description
            "AP certificate policy by APs serial number";
          leaf ta-serial-num {
            type string {
              length "11";
              pattern '[A-Z0-9]+';
            }
            description
              "AP top assembly serial number";
          }

          leaf policy-type {
            type wireless-types:enm-ap-cert-policy;
            description
              "Policy type by serial number";
          }
        }  // list ap-cert-policy-by-sn
      }  // container ap-cert-policy-by-sns

      container laginfo {
        presence "laginfo";
        description "AP lag info";
        leaf enabled {
          type boolean;
          default "false";
          description "Global lag status";
        }
      }  // container laginfo

      container multicast-config {
        presence "bcastCfg";
        description
          "Broadcast/Multicast config";
        leaf multicast-over-multicast-ipv4-addr {
          type inet:ipv4-address;
          default "0.0.0.0";
          description
            "IPv4 Multicast group address for CAPWAP used by APs";
        }

        leaf multicast-over-multicast-ipv6-addr {
          type inet:ipv6-address;
          default "0:0:0:0:0:0:0:0";
          description
            "IPv6 Multicast group address for CAPWAP used by APs";
        }

        leaf is-mcast-enabled {
          type boolean;
          default "false";
          description
            "Multicast enable/disable";
        }

        leaf is-non-ip-multicast-enabled {
          type boolean;
          default "false";
          description
            "Non-ip multicast enable/disable";
        }

        leaf is-mdns-enabled {
          type boolean;
          description
            "Flag to enable or disable mdns";
        }

        leaf multicast-mode {
          type boolean;
          default "false";
          description
            "V4 Multicast over multicast enabled";
        }

        leaf multicast-v6-mode {
          type boolean;
          default "false";
          description
            "V6 Multicast over multicast enabled";
        }

        leaf is-broadcast-enabled {
          type boolean;
          default "false";
          description
            "Broadcast enable/disable";
        }

        leaf linklocal-enabled {
          type boolean;
          default "true";
          description
            "Link-local multicast frame forwarding enable/disable";
        }
      }  // container multicast-config

      container multicast-non-ip-config {
        description
          "Non-IP Multicast configuration";
        list multicast-non-ip-vlan-config {
          key "vlan-id";
          description
            "Non-IP Multicast vlan configuration";
          leaf vlan-id {
            type uint32 {
              range "1 .. 4094";
            }
            description
              "Non-IP multicast vlan Id";
          }
        }  // list multicast-non-ip-vlan-config
      }  // container multicast-non-ip-config

      container broadcast-config {
        description
          "Wireless Broadcast configuration";
        list broadcast-vlan-config {
          key "vlan-id";
          description
            "Wireless Broadcast vlan configuration";
          leaf vlan-id {
            type uint32 {
              range "1 .. 4094";
            }
            description
              "Wireless Broadcast vlan Id";
          }
        }  // list broadcast-vlan-config
      }  // container broadcast-config

      container ap-upgrade-config {
        description
          "AP Upgrade Configurations";
        leaf percentage {
          type wireless-types:enum-ewlc-ap-upgrade-config;
          default
            "ap-staggered-upgrade-percent-15";
          description
            "Percentage AP per iteration";
        }
      }  // container ap-upgrade-config

      container li-global-config {
        presence "li-global-config";
        status obsolete;
        description
          "LI server IP address configuration";
        leaf li-host-ip-address {
          type inet:ip-address;
          must
            "(../li-host-ip-address != '255.255.255.0') and (../li-host-ip-address != '255.255.0.0') and (../li-host-ip-address != '255.0.0.0')" {
            error-message
              "Invalid IPv4 host address provided";
            error-app-tag "must-violation";
          }
          must
            "../li-host-ip-address != '255.255.255.255'" {
            error-message
              "Broadcast IPv4 address is invalid";
            error-app-tag "must-violation";
          }
          must
            "not(starts-with(../li-host-ip-address, '127.'))" {
            error-message
              "Loopback IPv4 address is invalid";
            error-app-tag "must-violation";
          }
          must
            "not(starts-with(../li-host-ip-address, '224.')) and not(starts-with(../li-host-ip-address, '225.')) and not(starts-with(../li-host-ip-address, '226.')) and not(starts-with(../li-host-ip-address, '227.')) and not(starts-with(../li-host-ip-address, '228.')) and not(starts-with(../li-host-ip-address, '229.')) and not(starts-with(../li-host-ip-address, '230.')) and not(starts-with(../li-host-ip-address, '231.')) and not(starts-with(../li-host-ip-address, '232.')) and not(starts-with(../li-host-ip-address, '233.')) and not(starts-with(../li-host-ip-address, '234.')) and not(starts-with(../li-host-ip-address, '235.')) and not(starts-with(../li-host-ip-address, '236.')) and not(starts-with(../li-host-ip-address, '237.')) and not(starts-with(../li-host-ip-address, '238.')) and not(starts-with(../li-host-ip-address, '239.'))" {
            error-message
              "Multicast IPv4 address is invalid";
            error-app-tag "must-violation";
          }
          must
            "not(contains(substring(../li-host-ip-address, 1, 4), 'fe80'))" {
            error-message
              "Link-local IPv6 address is invalid";
            error-app-tag "must-violation";
          }
          must
            "not(contains(substring(../li-host-ip-address, 1, 4), 'fec0'))" {
            error-message
              "Site-local IPv6 address is invalid";
            error-app-tag "must-violation";
          }
          must
            "not(contains(substring(../li-host-ip-address, 1, 4), 'ff00'))" {
            error-message
              "Multicast IPv6 address is invalid";
            error-app-tag "must-violation";
          }
          default "0.0.0.0";
          description
            "Lawful-interception server IP address";
        }
      }  // container li-global-config

      container feature-usage-cfg {
        presence "feature-usage-cfg";
        description
          "Wireless feature usage monitoring configuration";
        leaf enable {
          type boolean;
          must
            "(current() = 'false') or (../../mewlc-config/mewlc-platform = 'false')" {
            error-message
              "Wireless feature usage is not supported on EWC platform";
            error-app-tag "must-violation";
          }
          default "false";
          description
            "Enable wireless feature usage monitoring";
        }
      }  // container feature-usage-cfg

      container ap-dtls-ciphersuites {
        description
          "DTLS cipher suite priority configuration";
        list ap-dtls-ciphersuite {
          key "priority";
          description
            "DTLS cipher suite priority order";
          leaf priority {
            type uint16 {
              range "0 .. 6";
            }
            description
              "DTLS ciphersuite priority";
          }

          leaf csuite {
            type wireless-types:enm-ciphersuite;
            must
              " (/general-cfg-data/fips-cfg/dtls-version != 'dtls-10' or ( ../csuite != 'tls-dhe-rsa-aes256-cbc-sha' and ../csuite != 'tls-dhe-rsa-aes256-cbc-sha256' and ../csuite != 'tls-ecdhe-ecdsa-aes128-gcm-sha256' and ../csuite != 'tls-ecdhe-ecdsa-aes256-gcm-sha384' and  ../csuite != 'tls-ecdhe-rsa-aes128-gcm-sha256' and (../csuite = 'tls-rsa-aes128-cbc-sha' or ../csuite = 'tls-dhe-rsa-aes128-cbc-sha')))" {
              error-message
                "Cipher suite is not compatible with DTLS version 1.0";
              error-app-tag "must-violation";
            }
            must
              "../csuite != 'tls-null-with-null-null'" {
              error-message
                "Invalid cipher suite";
              error-app-tag "must-violation";
            }
            must
              "../csuite != 'tls-rsa-aes256-gcm-sha384'" {
              error-message
                "Cipher suite is not yet supported";
              error-app-tag "must-violation";
            }
            default
              "tls-null-with-null-null";
            description
              "Configure DTLS ciphersuite";
          }
        }  // list ap-dtls-ciphersuite
      }  // container ap-dtls-ciphersuites

      container threshold-warn-cfg {
        presence "threshold-warn-cfg";
        description
          "Threshold warnings configuration";
        leaf threshold-warning {
          type boolean;
          default "true";
          description
            "Enable or disable the threshold warning functionality";
        }

        leaf clients-threshold {
          type uint8 {
            range "50 .. 100";
          }
          units "percent";
          default "75";
          description
            "Configure clients threshold";
        }

        leaf warning-period {
          type uint8 {
            range "1 .. 60";
          }
          units "minutes";
          default "5";
          description
            "Configure warning check periodicity ";
        }
      }  // container threshold-warn-cfg
    }  // container general-cfg-data
  }  // module Cisco-IOS-XE-wireless-general-cfg