Skip to content

cluster / sdn ​

78 operations.

GET /cluster/sdn ​

ts
proxmox.cluster.sdn.$get()

Directory index.

Returns an array of object.

PUT /cluster/sdn ​

ts
proxmox.cluster.sdn.$put()

Apply sdn controller changes && reload.

Returns string.

ParameterTypeRequiredNotes
lock-tokenstringthe token for unlocking the global SDN configuration
release-lockbooleanWhen lock-token has been provided and configuration successfully committed, release the lock automatically afterwards — default 1

GET /cluster/sdn/controllers ​

ts
proxmox.cluster.sdn.controllers.$get()

SDN controllers index.

Returns an array of object.

ParameterTypeRequiredNotes
pendingbooleanDisplay pending config.
runningbooleanDisplay running config.
typebgp | evpn | faucet | isisOnly list sdn controllers of specific type

POST /cluster/sdn/controllers ​

ts
proxmox.cluster.sdn.controllers.$post()

Create a new sdn controller object.

Returns nothing.

ParameterTypeRequiredNotes
asnnumberautonomous system number — min 0, max 4294967295
bgp-modeauto | external | internalWhether to use eBGP or iBGP. Auto mode chooses depending on BGP controller or falls back to iBGP. — default "auto"
bgp-multipath-as-path-relaxbooleanConsider different AS paths of equal length for multipath computation.
controllerstringyesThe SDN controller object identifier. — ≤ 64 chars
ebgpbooleanEnable eBGP (remote-as external).
ebgp-multihopnumberSet maximum amount of hops for eBGP peers.
fabricstringSDN fabric to use as underlay for this EVPN controller. — format pve-sdn-fabric-id
isis-domainstringName of the IS-IS domain.
isis-ifacesstringComma-separated list of interfaces where IS-IS should be active. — format pve-iface-list
isis-netstringNetwork Entity title for this node in the IS-IS network. — format pve-sdn-isis-net, ≤ 50 chars
lock-tokenstringthe token for unlocking the global SDN configuration
loopbackstringName of the loopback/dummy interface that provides the Router-IP.
nodestringThe cluster node name. — format pve-node
nodesstringList of cluster node names. — format pve-node-list
peer-group-namestringName of the peer group for this EVPN controller — format pve-configid, default "VTEP"
peersstringpeers address list. — format ip-list
route-map-instringRoute Map that should be applied for incoming routes — format pve-sdn-route-map-id
route-map-outstringRoute Map that should be applied for outgoing routes — format pve-sdn-route-map-id
typebgp | evpn | faucet | isisyesPlugin type. — format pve-configid

GET /cluster/sdn/controllers/{controller} ​

ts
proxmox.cluster.sdn.controllers.$(controller).$get()

Read sdn controller configuration.

Returns any.

ParameterTypeRequiredNotes
controllerstringyesThe SDN controller object identifier. — ≤ 64 chars
pendingbooleanDisplay pending config.
runningbooleanDisplay running config.

PUT /cluster/sdn/controllers/{controller} ​

ts
proxmox.cluster.sdn.controllers.$(controller).$put()

Update sdn controller object configuration.

Returns nothing.

ParameterTypeRequiredNotes
asnnumberautonomous system number — min 0, max 4294967295
bgp-modeauto | external | internalWhether to use eBGP or iBGP. Auto mode chooses depending on BGP controller or falls back to iBGP. — default "auto"
bgp-multipath-as-path-relaxbooleanConsider different AS paths of equal length for multipath computation.
controllerstringyesThe SDN controller object identifier. — ≤ 64 chars
deletestringA list of settings you want to delete. — format pve-configid-list, ≤ 4096 chars
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
ebgpbooleanEnable eBGP (remote-as external).
ebgp-multihopnumberSet maximum amount of hops for eBGP peers.
fabricstringSDN fabric to use as underlay for this EVPN controller. — format pve-sdn-fabric-id
isis-domainstringName of the IS-IS domain.
isis-ifacesstringComma-separated list of interfaces where IS-IS should be active. — format pve-iface-list
isis-netstringNetwork Entity title for this node in the IS-IS network. — format pve-sdn-isis-net, ≤ 50 chars
lock-tokenstringthe token for unlocking the global SDN configuration
loopbackstringName of the loopback/dummy interface that provides the Router-IP.
nodestringThe cluster node name. — format pve-node
nodesstringList of cluster node names. — format pve-node-list
peer-group-namestringName of the peer group for this EVPN controller — format pve-configid, default "VTEP"
peersstringpeers address list. — format ip-list
route-map-instringRoute Map that should be applied for incoming routes — format pve-sdn-route-map-id
route-map-outstringRoute Map that should be applied for outgoing routes — format pve-sdn-route-map-id

DELETE /cluster/sdn/controllers/{controller} ​

ts
proxmox.cluster.sdn.controllers.$(controller).$delete()

Delete sdn controller object configuration.

Returns nothing.

ParameterTypeRequiredNotes
controllerstringyesThe SDN controller object identifier. — ≤ 64 chars
lock-tokenstringthe token for unlocking the global SDN configuration

GET /cluster/sdn/dns ​

ts
proxmox.cluster.sdn.dns.$get()

SDN dns index.

Returns an array of object.

ParameterTypeRequiredNotes
typepowerdnsOnly list sdn dns of specific type

POST /cluster/sdn/dns ​

ts
proxmox.cluster.sdn.dns.$post()

Create a new sdn dns object.

Returns nothing.

ParameterTypeRequiredNotes
dnsstringyesThe SDN dns object identifier.
fingerprintstringCertificate SHA 256 fingerprint.
keystringyes
lock-tokenstringthe token for unlocking the global SDN configuration
reversemaskv6number
reversev6masknumber
ttlnumber
typepowerdnsyesPlugin type. — format pve-configid
urlstringyes

GET /cluster/sdn/dns/{dns} ​

ts
proxmox.cluster.sdn.dns.$(dns).$get()

Read sdn dns configuration.

Returns object.

ParameterTypeRequiredNotes
dnsstringyesThe SDN dns object identifier.

PUT /cluster/sdn/dns/{dns} ​

ts
proxmox.cluster.sdn.dns.$(dns).$put()

Update sdn dns object configuration.

Returns nothing.

ParameterTypeRequiredNotes
deletestringA list of settings you want to delete. — format pve-configid-list, ≤ 4096 chars
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
dnsstringyesThe SDN dns object identifier.
fingerprintstringCertificate SHA 256 fingerprint.
keystring
lock-tokenstringthe token for unlocking the global SDN configuration
reversemaskv6number
ttlnumber
urlstring

DELETE /cluster/sdn/dns/{dns} ​

ts
proxmox.cluster.sdn.dns.$(dns).$delete()

Delete sdn dns object configuration.

Returns nothing.

ParameterTypeRequiredNotes
dnsstringyesThe SDN dns object identifier.
lock-tokenstringthe token for unlocking the global SDN configuration

GET /cluster/sdn/dry-run ​

ts
proxmox.cluster.sdn["dry-run"].$get()

Dry-run the SDN apply action and return the difference between the current configuration and the pending configuration

Returns object.

ParameterTypeRequiredNotes
nodestringyesThe cluster node name. — format pve-node

GET /cluster/sdn/fabrics ​

ts
proxmox.cluster.sdn.fabrics.$get()

SDN Fabrics Index

Returns an array of object.

GET /cluster/sdn/fabrics/all ​

ts
proxmox.cluster.sdn.fabrics.all.$get()

SDN Fabrics Index

Returns object.

ParameterTypeRequiredNotes
pendingbooleanDisplay pending config.
runningbooleanDisplay running config.

GET /cluster/sdn/fabrics/fabric ​

ts
proxmox.cluster.sdn.fabrics.fabric.$get()

SDN Fabrics Index

Returns an array of object.

ParameterTypeRequiredNotes
pendingbooleanDisplay pending config.
runningbooleanDisplay running config.

POST /cluster/sdn/fabrics/fabric ​

ts
proxmox.cluster.sdn.fabrics.fabric.$post()

Add a fabric

Returns nothing.

ParameterTypeRequiredNotes
areastringOSPF area. Either a IPv4 address or a 32-bit number. Gets validated in rust.
csnp_intervalnumberThe csnp_interval property for Openfabric — min 1, max 600
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
hello_intervalnumberThe hello_interval property for Openfabric — min 1, max 600
idstringyesIdentifier for SDN fabrics — format pve-sdn-fabric-id, ≤ 8 chars
ip6_prefixstringThe IP prefix for Node IPs — format CIDR
ip_prefixstringThe IP prefix for Node IPs — format CIDR
lock-tokenstringthe token for unlocking the global SDN configuration
persistent_keepalivenumberA seconds interval, between 1 and 65535 inclusive, of how often to send an authenticated empty packet to the peer for the purpose of keeping a stateful firewall or NAT mapping valid persistently. For example, if the interface very rarely sends traffic, but it might at anytime receive traffic from another node, and it is behind NAT, the interface might benefit from having a persistent keepalive interval of 25 seconds. If unset or set to 0, it is turned off — min 0, max 65535
protocolopenfabric | ospf | wireguard | bgpyesType of configuration entry in an SDN Fabric section config
redistributeany[]yes
route_filterstringA prefix list that should be used for filtering routes that are to be installed into the kernel routing table — format pve-sdn-prefix-list-id

GET /cluster/sdn/fabrics/fabric/{id} ​

ts
proxmox.cluster.sdn.fabrics.fabric.$(id).$get()

Update a fabric

Returns object.

ParameterTypeRequiredNotes
idstringyesIdentifier for SDN fabrics — format pve-sdn-fabric-id, ≤ 8 chars

PUT /cluster/sdn/fabrics/fabric/{id} ​

ts
proxmox.cluster.sdn.fabrics.fabric.$(id).$put()

Update a fabric

Returns nothing.

ParameterTypeRequiredNotes
areastringOSPF area. Either a IPv4 address or a 32-bit number. Gets validated in rust.
csnp_intervalnumberThe csnp_interval property for Openfabric — min 1, max 600
deleteany[]yes
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
hello_intervalnumberThe hello_interval property for Openfabric — min 1, max 600
idstringyesIdentifier for SDN fabrics — format pve-sdn-fabric-id, ≤ 8 chars
ip6_prefixstringThe IP prefix for Node IPs — format CIDR
ip_prefixstringThe IP prefix for Node IPs — format CIDR
lock-tokenstringthe token for unlocking the global SDN configuration
persistent_keepalivenumberA seconds interval, between 1 and 65535 inclusive, of how often to send an authenticated empty packet to the peer for the purpose of keeping a stateful firewall or NAT mapping valid persistently. For example, if the interface very rarely sends traffic, but it might at anytime receive traffic from another node, and it is behind NAT, the interface might benefit from having a persistent keepalive interval of 25 seconds. If unset or set to 0, it is turned off — min 0, max 65535
protocolopenfabric | ospf | wireguard | bgpyesType of configuration entry in an SDN Fabric section config
redistributeany[]yes
route_filterstringA prefix list that should be used for filtering routes that are to be installed into the kernel routing table — format pve-sdn-prefix-list-id

DELETE /cluster/sdn/fabrics/fabric/{id} ​

ts
proxmox.cluster.sdn.fabrics.fabric.$(id).$delete()

Add a fabric

Returns nothing.

ParameterTypeRequiredNotes
idstringyesIdentifier for SDN fabrics — format pve-sdn-fabric-id, ≤ 8 chars

GET /cluster/sdn/fabrics/node ​

ts
proxmox.cluster.sdn.fabrics.node.$get()

SDN Fabrics Index

Returns an array of object.

ParameterTypeRequiredNotes
pendingbooleanDisplay pending config.
runningbooleanDisplay running config.

GET /cluster/sdn/fabrics/node/{fabric_id} ​

ts
proxmox.cluster.sdn.fabrics.node.$(fabricId).$get()

SDN Fabrics Index

Returns an array of object.

ParameterTypeRequiredNotes
fabric_idstringyesIdentifier for SDN fabrics — format pve-sdn-fabric-id, ≤ 8 chars
pendingbooleanDisplay pending config.
runningbooleanDisplay running config.

POST /cluster/sdn/fabrics/node/{fabric_id} ​

ts
proxmox.cluster.sdn.fabrics.node.$(fabricId).$post()

Add a node

Returns nothing.

ParameterTypeRequiredNotes
allowed_ipsstring[]A list of IPs that are routable via this node in the WireGuard fabric.
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
endpointstringThe endpoint used for connecting to this node.
fabric_idstringyesIdentifier for SDN fabrics — format pve-sdn-fabric-id, ≤ 8 chars
interfacesany[]yes
ipstringIPv4 address for this node — format ipv4
ip6stringIPv6 address for this node — format ipv6
lock-tokenstringthe token for unlocking the global SDN configuration
node_idstringyesIdentifier for nodes in an SDN fabric — format pve-node
peersstring[]
protocolopenfabric | ospf | wireguard | bgpyesType of configuration entry in an SDN Fabric section config
public_keystringThe public key for the external node.
roleinternal | externalThe role of this node in the WireGuard fabric.

GET /cluster/sdn/fabrics/node/{fabric_id}/{node_id} ​

ts
proxmox.cluster.sdn.fabrics.node.$(fabricId).$(nodeId).$get()

Get a node

Returns any.

ParameterTypeRequiredNotes
fabric_idstringyesIdentifier for SDN fabrics — format pve-sdn-fabric-id, ≤ 8 chars
node_idstringyesIdentifier for nodes in an SDN fabric — format pve-node

PUT /cluster/sdn/fabrics/node/{fabric_id}/{node_id} ​

ts
proxmox.cluster.sdn.fabrics.node.$(fabricId).$(nodeId).$put()

Update a node

Returns nothing.

ParameterTypeRequiredNotes
allowed_ipsstring[]A list of IPs that are routable via this node in the WireGuard fabric.
deleteany[]yes
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
endpointstringThe endpoint used for connecting to this node.
fabric_idstringyesIdentifier for SDN fabrics — format pve-sdn-fabric-id, ≤ 8 chars
interfacesany[]yes
ipstringIPv4 address for this node — format ipv4
ip6stringIPv6 address for this node — format ipv6
lock-tokenstringthe token for unlocking the global SDN configuration
node_idstringyesIdentifier for nodes in an SDN fabric — format pve-node
peersstring[]
protocolopenfabric | ospf | wireguard | bgpyesType of configuration entry in an SDN Fabric section config
public_keystringThe public key for the external node.
roleinternal | externalThe role of this node in the WireGuard fabric.

DELETE /cluster/sdn/fabrics/node/{fabric_id}/{node_id} ​

ts
proxmox.cluster.sdn.fabrics.node.$(fabricId).$(nodeId).$delete()

Add a node

Returns nothing.

ParameterTypeRequiredNotes
fabric_idstringyesIdentifier for SDN fabrics — format pve-sdn-fabric-id, ≤ 8 chars
node_idstringyesIdentifier for nodes in an SDN fabric — format pve-node

GET /cluster/sdn/ipams ​

ts
proxmox.cluster.sdn.ipams.$get()

SDN ipams index.

Returns an array of object.

ParameterTypeRequiredNotes
typenetbox | phpipam | pveOnly list sdn ipams of specific type

POST /cluster/sdn/ipams ​

ts
proxmox.cluster.sdn.ipams.$post()

Create a new sdn ipam object.

Returns nothing.

ParameterTypeRequiredNotes
fingerprintstringCertificate SHA 256 fingerprint.
ipamstringyesThe SDN ipam object identifier.
lock-tokenstringthe token for unlocking the global SDN configuration
sectionnumber
tokenstring
typenetbox | phpipam | pveyesPlugin type. — format pve-configid
urlstring

GET /cluster/sdn/ipams/{ipam} ​

ts
proxmox.cluster.sdn.ipams.$(ipam).$get()

Read sdn ipam configuration.

Returns object.

ParameterTypeRequiredNotes
ipamstringyesThe SDN ipam object identifier.

PUT /cluster/sdn/ipams/{ipam} ​

ts
proxmox.cluster.sdn.ipams.$(ipam).$put()

Update sdn ipam object configuration.

Returns nothing.

ParameterTypeRequiredNotes
deletestringA list of settings you want to delete. — format pve-configid-list, ≤ 4096 chars
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
fingerprintstringCertificate SHA 256 fingerprint.
ipamstringyesThe SDN ipam object identifier.
lock-tokenstringthe token for unlocking the global SDN configuration
sectionnumber
tokenstring
urlstring

DELETE /cluster/sdn/ipams/{ipam} ​

ts
proxmox.cluster.sdn.ipams.$(ipam).$delete()

Delete sdn ipam object configuration.

Returns nothing.

ParameterTypeRequiredNotes
ipamstringyesThe SDN ipam object identifier.
lock-tokenstringthe token for unlocking the global SDN configuration

GET /cluster/sdn/ipams/{ipam}/status ​

ts
proxmox.cluster.sdn.ipams.$(ipam).status.$get()

List PVE IPAM Entries

Returns an array of any.

ParameterTypeRequiredNotes
ipamstringyesThe SDN ipam object identifier.

POST /cluster/sdn/lock ​

ts
proxmox.cluster.sdn.lock.$post()

Acquire global lock for SDN configuration

Returns string.

ParameterTypeRequiredNotes
allow-pendingbooleanif true, allow acquiring lock even though there are pending changes — default 0

DELETE /cluster/sdn/lock ​

ts
proxmox.cluster.sdn.lock.$delete()

Release global lock for SDN configuration

Returns nothing.

ParameterTypeRequiredNotes
forcebooleanif true, allow releasing lock without providing the token — default 0
lock-tokenstringthe token for unlocking the global SDN configuration

GET /cluster/sdn/prefix-lists ​

ts
proxmox.cluster.sdn["prefix-lists"].$get()

List Prefix Lists

Returns an array of object.

ParameterTypeRequiredNotes
pendingbooleanDisplay pending config.
runningbooleanDisplay running config.
verbosebooleanIf 0, only returns id - otherwise returns all properties.

POST /cluster/sdn/prefix-lists ​

ts
proxmox.cluster.sdn["prefix-lists"].$post()

Create Prefix List

Returns nothing.

ParameterTypeRequiredNotes
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
entriesstring[]
idstringyesThe SDN prefix list identifier — format pve-sdn-prefix-list-id
lock-tokenstringthe token for unlocking the global SDN configuration

GET /cluster/sdn/prefix-lists/{id} ​

ts
proxmox.cluster.sdn["prefix-lists"].$(id).$get()

Get Prefix List

Returns object.

ParameterTypeRequiredNotes
idstringyesThe SDN prefix list identifier — format pve-sdn-prefix-list-id

PUT /cluster/sdn/prefix-lists/{id} ​

ts
proxmox.cluster.sdn["prefix-lists"].$(id).$put()

Update Prefix List

Returns nothing.

ParameterTypeRequiredNotes
deleteentries[]
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
entriesstring[]
idstringyesThe SDN prefix list identifier — format pve-sdn-prefix-list-id
lock-tokenstringthe token for unlocking the global SDN configuration

DELETE /cluster/sdn/prefix-lists/{id} ​

ts
proxmox.cluster.sdn["prefix-lists"].$(id).$delete()

Delete Prefix List

Returns nothing.

ParameterTypeRequiredNotes
idstringyesThe SDN prefix list identifier — format pve-sdn-prefix-list-id
lock-tokenstringthe token for unlocking the global SDN configuration

GET /cluster/sdn/prefix-lists/{id}/entries ​

ts
proxmox.cluster.sdn["prefix-lists"].$(id).entries.$get()

List Prefix List Entries

Returns an array of object.

ParameterTypeRequiredNotes
idstringyesThe SDN prefix list identifier — format pve-sdn-prefix-list-id

POST /cluster/sdn/prefix-lists/{id}/entries ​

ts
proxmox.cluster.sdn["prefix-lists"].$(id).entries.$post()

Create Prefix List Entry

Returns nothing.

ParameterTypeRequiredNotes
actionpermit | denyyes
genumbermin 0, max 128
idstringyesThe SDN prefix list identifier — format pve-sdn-prefix-list-id
lenumbermin 0, max 128
lock-tokenstringthe token for unlocking the global SDN configuration
prefixstringyesformat FullRangeCIDR
seqnumbermin 1, max 4294967295

GET /cluster/sdn/prefix-lists/{id}/entries/{url_seq} ​

ts
proxmox.cluster.sdn["prefix-lists"].$(id).entries.$(urlSeq).$get()

Get Prefix List Entry

Returns object.

ParameterTypeRequiredNotes
idstringyesThe SDN prefix list identifier — format pve-sdn-prefix-list-id

PUT /cluster/sdn/prefix-lists/{id}/entries/{url_seq} ​

ts
proxmox.cluster.sdn["prefix-lists"].$(id).entries.$(urlSeq).$put()

Update Prefix List Entry

Returns nothing.

ParameterTypeRequiredNotes
actionpermit | deny
deletele | ge | seq[]
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
genumbermin 0, max 128
lenumbermin 0, max 128
lock-tokenstringthe token for unlocking the global SDN configuration
prefixstringformat FullRangeCIDR
seqnumbermin 1, max 4294967295

DELETE /cluster/sdn/prefix-lists/{id}/entries/{url_seq} ​

ts
proxmox.cluster.sdn["prefix-lists"].$(id).entries.$(urlSeq).$delete()

Delete Prefix List Entry

Returns nothing.

ParameterTypeRequiredNotes
idstringyesThe SDN prefix list identifier — format pve-sdn-prefix-list-id
lock-tokenstringthe token for unlocking the global SDN configuration

POST /cluster/sdn/rollback ​

ts
proxmox.cluster.sdn.rollback.$post()

Rollback pending changes to SDN configuration

Returns nothing.

ParameterTypeRequiredNotes
lock-tokenstringthe token for unlocking the global SDN configuration
release-lockbooleanWhen lock-token has been provided and configuration successfully rollbacked, release the lock automatically afterwards — default 1

GET /cluster/sdn/route-maps ​

ts
proxmox.cluster.sdn["route-maps"].$get()

List Route Maps

Returns an array of object.

ParameterTypeRequiredNotes
runningbooleanDisplay running config.

GET /cluster/sdn/route-maps/entries ​

ts
proxmox.cluster.sdn["route-maps"].entries.$get()

Lists all route map entries.

Returns an array of object.

ParameterTypeRequiredNotes
pendingbooleanDisplay pending config.
runningbooleanDisplay running config.

POST /cluster/sdn/route-maps/entries ​

ts
proxmox.cluster.sdn["route-maps"].entries.$post()

Create Route Map entry

Returns nothing.

ParameterTypeRequiredNotes
actionpermit | denyyesMatching policy of a route map entry.
callstringThe SDN route map identifier — format pve-sdn-route-map-id
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
exit-actionstring
lock-tokenstringthe token for unlocking the global SDN configuration
matchstring[]
ordernumberyesThe index of this route map entry — min 0, max 65535
route-map-idstringyesThe SDN route map identifier — format pve-sdn-route-map-id
setstring[]

GET /cluster/sdn/route-maps/entries/{route-map-id} ​

ts
proxmox.cluster.sdn["route-maps"].entries.$(routeMapId).$get()

List all entries for a given Route Map

Returns an array of object.

ParameterTypeRequiredNotes
pendingbooleanDisplay pending config.
route-map-idstringyesThe SDN route map identifier — format pve-sdn-route-map-id
runningbooleanDisplay running config.

GET /cluster/sdn/route-maps/entries/{route-map-id}/entry/{order} ​

ts
proxmox.cluster.sdn["route-maps"].entries.$(routeMapId).entry.$(order).$get()

Get Route Map Entry

Returns object.

ParameterTypeRequiredNotes
ordernumberyesThe index of this route map entry — min 0, max 65535
route-map-idstringyesThe SDN route map identifier — format pve-sdn-route-map-id

PUT /cluster/sdn/route-maps/entries/{route-map-id}/entry/{order} ​

ts
proxmox.cluster.sdn["route-maps"].entries.$(routeMapId).entry.$(order).$put()

Update Route Map Entry

Returns nothing.

ParameterTypeRequiredNotes
actionpermit | denyMatching policy of a route map entry.
callstringThe SDN route map identifier — format pve-sdn-route-map-id
deleteset | match | call | exit-action[]
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
exit-actionstring
lock-tokenstringthe token for unlocking the global SDN configuration
matchstring[]
ordernumberyesThe index of this route map entry — min 0, max 65535
route-map-idstringyesThe SDN route map identifier — format pve-sdn-route-map-id
setstring[]

DELETE /cluster/sdn/route-maps/entries/{route-map-id}/entry/{order} ​

ts
proxmox.cluster.sdn["route-maps"].entries.$(routeMapId).entry.$(order).$delete()

Delete Route Map Entry

Returns nothing.

ParameterTypeRequiredNotes
lock-tokenstringthe token for unlocking the global SDN configuration
ordernumberyesThe index of this route map entry — min 0, max 65535
route-map-idstringyesThe SDN route map identifier — format pve-sdn-route-map-id

GET /cluster/sdn/vnets ​

ts
proxmox.cluster.sdn.vnets.$get()

SDN vnets index.

Returns an array of object.

ParameterTypeRequiredNotes
pendingbooleanDisplay pending config.
runningbooleanDisplay running config.

POST /cluster/sdn/vnets ​

ts
proxmox.cluster.sdn.vnets.$post()

Create a new sdn vnet object.

Returns nothing.

ParameterTypeRequiredNotes
aliasstringAlias name of the VNet. — ≤ 256 chars
isolate-portsbooleanIf true, sets the isolated property for all interfaces on the bridge of this VNet.
lock-tokenstringthe token for unlocking the global SDN configuration
tagnumberVLAN Tag (for VLAN or QinQ zones) or VXLAN VNI (for VXLAN or EVPN zones). — min 1, max 16777215
typevnetType of the VNet.
vlanawarebooleanAllow VLANs to pass through this vnet.
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars
zonestringyesName of the zone this VNet belongs to.

GET /cluster/sdn/vnets/{vnet} ​

ts
proxmox.cluster.sdn.vnets.$(vnet).$get()

Read sdn vnet configuration.

Returns any.

ParameterTypeRequiredNotes
pendingbooleanDisplay pending config.
runningbooleanDisplay running config.
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars

PUT /cluster/sdn/vnets/{vnet} ​

ts
proxmox.cluster.sdn.vnets.$(vnet).$put()

Update sdn vnet object configuration.

Returns nothing.

ParameterTypeRequiredNotes
aliasstringAlias name of the VNet. — ≤ 256 chars
deletestringA list of settings you want to delete. — format pve-configid-list, ≤ 4096 chars
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
isolate-portsbooleanIf true, sets the isolated property for all interfaces on the bridge of this VNet.
lock-tokenstringthe token for unlocking the global SDN configuration
tagnumberVLAN Tag (for VLAN or QinQ zones) or VXLAN VNI (for VXLAN or EVPN zones). — min 1, max 16777215
vlanawarebooleanAllow VLANs to pass through this vnet.
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars
zonestringName of the zone this VNet belongs to.

DELETE /cluster/sdn/vnets/{vnet} ​

ts
proxmox.cluster.sdn.vnets.$(vnet).$delete()

Delete sdn vnet object configuration.

Returns nothing.

ParameterTypeRequiredNotes
lock-tokenstringthe token for unlocking the global SDN configuration
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars

GET /cluster/sdn/vnets/{vnet}/firewall ​

ts
proxmox.cluster.sdn.vnets.$(vnet).firewall.$get()

Directory index.

Returns an array of object.

ParameterTypeRequiredNotes
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars

GET /cluster/sdn/vnets/{vnet}/firewall/options ​

ts
proxmox.cluster.sdn.vnets.$(vnet).firewall.options.$get()

Get vnet firewall options.

Returns object.

ParameterTypeRequiredNotes
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars

PUT /cluster/sdn/vnets/{vnet}/firewall/options ​

ts
proxmox.cluster.sdn.vnets.$(vnet).firewall.options.$put()

Set Firewall options.

Returns nothing.

ParameterTypeRequiredNotes
deletestringA list of settings you want to delete. — format pve-configid-list
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
enablebooleanEnable/disable firewall rules. — default 0
log_level_forwardemerg | alert | crit | err | warning | notice | info | debug | … (1 more)Log level for forwarded traffic.
policy_forwardACCEPT | DROPForward policy.
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars

GET /cluster/sdn/vnets/{vnet}/firewall/rules ​

ts
proxmox.cluster.sdn.vnets.$(vnet).firewall.rules.$get()

List rules.

Returns an array of object.

ParameterTypeRequiredNotes
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars

POST /cluster/sdn/vnets/{vnet}/firewall/rules ​

ts
proxmox.cluster.sdn.vnets.$(vnet).firewall.rules.$post()

Create new rule.

Returns nothing.

ParameterTypeRequiredNotes
actionstringyesRule action ('ACCEPT', 'DROP', 'REJECT') or security group name. — ≤ 20 chars
commentstringDescriptive comment. — format pve-fw-comment-spec
deststringRestrict packet destination address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
dportstringRestrict TCP/UDP destination port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-dport-spec
enablenumberFlag to enable/disable a rule. — min 0
icmp-typestringSpecify icmp-type. Only valid if proto equals 'icmp' or 'icmpv6'/'ipv6-icmp'. — format pve-fw-icmp-type-spec
ifacestringNetwork interface name. You have to use network configuration key names for VMs and containers ('net\d+'). Host related rules can use arbitrary strings. — format pve-iface, ≤ 20 chars
logemerg | alert | crit | err | warning | notice | info | debug | … (1 more)Log level for firewall rule.
macrostringUse predefined standard macro. — ≤ 128 chars
posnumberUpdate rule at position <pos>. — min 0
protostringIP protocol. You can use protocol names ('tcp'/'udp') or simple numbers, as defined in '/etc/protocols'. — format pve-fw-protocol-spec
sourcestringRestrict packet source address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars
sportstringRestrict TCP/UDP source port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-sport-spec
typein | out | forward | groupyesRule type.
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars

GET /cluster/sdn/vnets/{vnet}/firewall/rules/{pos} ​

ts
proxmox.cluster.sdn.vnets.$(vnet).firewall.rules.$(pos).$get()

Get single rule data.

Returns object.

ParameterTypeRequiredNotes
posnumberUpdate rule at position <pos>. — min 0
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars

PUT /cluster/sdn/vnets/{vnet}/firewall/rules/{pos} ​

ts
proxmox.cluster.sdn.vnets.$(vnet).firewall.rules.$(pos).$put()

Modify rule data.

Returns nothing.

ParameterTypeRequiredNotes
actionstringRule action ('ACCEPT', 'DROP', 'REJECT') or security group name. — ≤ 20 chars
commentstringDescriptive comment. — format pve-fw-comment-spec
deletestringA list of settings you want to delete. — format pve-configid-list
deststringRestrict packet destination address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
dportstringRestrict TCP/UDP destination port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-dport-spec
enablenumberFlag to enable/disable a rule. — min 0
icmp-typestringSpecify icmp-type. Only valid if proto equals 'icmp' or 'icmpv6'/'ipv6-icmp'. — format pve-fw-icmp-type-spec
ifacestringNetwork interface name. You have to use network configuration key names for VMs and containers ('net\d+'). Host related rules can use arbitrary strings. — format pve-iface, ≤ 20 chars
logemerg | alert | crit | err | warning | notice | info | debug | … (1 more)Log level for firewall rule.
macrostringUse predefined standard macro. — ≤ 128 chars
movetonumberMove rule to new position <moveto>. Other arguments are ignored. — min 0
posnumberUpdate rule at position <pos>. — min 0
protostringIP protocol. You can use protocol names ('tcp'/'udp') or simple numbers, as defined in '/etc/protocols'. — format pve-fw-protocol-spec
sourcestringRestrict packet source address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars
sportstringRestrict TCP/UDP source port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-sport-spec
typein | out | forward | groupRule type.
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars

DELETE /cluster/sdn/vnets/{vnet}/firewall/rules/{pos} ​

ts
proxmox.cluster.sdn.vnets.$(vnet).firewall.rules.$(pos).$delete()

Delete rule.

Returns nothing.

ParameterTypeRequiredNotes
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
posnumberUpdate rule at position <pos>. — min 0
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars

POST /cluster/sdn/vnets/{vnet}/ips ​

ts
proxmox.cluster.sdn.vnets.$(vnet).ips.$post()

Create IP Mapping in a VNet

Returns nothing.

ParameterTypeRequiredNotes
ipstringyesThe IP address to associate with the given MAC address — format ip
macstringUnicast MAC address. — format mac-addr
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars
zonestringyesThe SDN zone object identifier. — ≤ 8 chars

PUT /cluster/sdn/vnets/{vnet}/ips ​

ts
proxmox.cluster.sdn.vnets.$(vnet).ips.$put()

Update IP Mapping in a VNet

Returns nothing.

ParameterTypeRequiredNotes
ipstringyesThe IP address to associate with the given MAC address — format ip
macstringUnicast MAC address. — format mac-addr
vmidnumberThe (unique) ID of the VM. — format pve-vmid, min 100, max 999999999
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars
zonestringyesThe SDN zone object identifier. — ≤ 8 chars

DELETE /cluster/sdn/vnets/{vnet}/ips ​

ts
proxmox.cluster.sdn.vnets.$(vnet).ips.$delete()

Delete IP Mappings in a VNet

Returns nothing.

ParameterTypeRequiredNotes
ipstringyesThe IP address to delete — format ip
macstringUnicast MAC address. — format mac-addr
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars
zonestringyesThe SDN zone object identifier. — ≤ 8 chars

GET /cluster/sdn/vnets/{vnet}/subnets ​

ts
proxmox.cluster.sdn.vnets.$(vnet).subnets.$get()

SDN subnets index.

Returns an array of object.

ParameterTypeRequiredNotes
pendingbooleanDisplay pending config.
runningbooleanDisplay running config.
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars

POST /cluster/sdn/vnets/{vnet}/subnets ​

ts
proxmox.cluster.sdn.vnets.$(vnet).subnets.$post()

Create a new sdn subnet object.

Returns nothing.

ParameterTypeRequiredNotes
dhcp-dns-serverstringIP address for the DNS server — format ip
dhcp-rangestring[]A list of DHCP ranges for this subnet
dnszoneprefixstringdns domain zone prefix ex: 'adm' -> <hostname>.adm.mydomain.com — format dns-name
gatewaystringSubnet Gateway: Will be assign on vnet for layer3 zones — format ip
lock-tokenstringthe token for unlocking the global SDN configuration
snatbooleanenable masquerade for this subnet if pve-firewall
subnetstringyesThe SDN subnet object identifier. — format pve-sdn-subnet-id
typesubnetyes
vnetstringyesassociated vnet

GET /cluster/sdn/vnets/{vnet}/subnets/{subnet} ​

ts
proxmox.cluster.sdn.vnets.$(vnet).subnets.$(subnet).$get()

Read sdn subnet configuration.

Returns object.

ParameterTypeRequiredNotes
pendingbooleanDisplay pending config.
runningbooleanDisplay running config.
subnetstringyesThe SDN subnet object identifier. — format pve-sdn-subnet-id
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars

PUT /cluster/sdn/vnets/{vnet}/subnets/{subnet} ​

ts
proxmox.cluster.sdn.vnets.$(vnet).subnets.$(subnet).$put()

Update sdn subnet object configuration.

Returns nothing.

ParameterTypeRequiredNotes
deletestringA list of settings you want to delete. — format pve-configid-list, ≤ 4096 chars
dhcp-dns-serverstringIP address for the DNS server — format ip
dhcp-rangestring[]A list of DHCP ranges for this subnet
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
dnszoneprefixstringdns domain zone prefix ex: 'adm' -> <hostname>.adm.mydomain.com — format dns-name
gatewaystringSubnet Gateway: Will be assign on vnet for layer3 zones — format ip
lock-tokenstringthe token for unlocking the global SDN configuration
snatbooleanenable masquerade for this subnet if pve-firewall
subnetstringyesThe SDN subnet object identifier. — format pve-sdn-subnet-id
vnetstringassociated vnet

DELETE /cluster/sdn/vnets/{vnet}/subnets/{subnet} ​

ts
proxmox.cluster.sdn.vnets.$(vnet).subnets.$(subnet).$delete()

Delete sdn subnet object configuration.

Returns nothing.

ParameterTypeRequiredNotes
lock-tokenstringthe token for unlocking the global SDN configuration
subnetstringyesThe SDN subnet object identifier. — format pve-sdn-subnet-id
vnetstringyesThe SDN vnet object identifier. — ≤ 8 chars

GET /cluster/sdn/zones ​

ts
proxmox.cluster.sdn.zones.$get()

SDN zones index.

Returns an array of object.

ParameterTypeRequiredNotes
pendingbooleanDisplay pending config.
runningbooleanDisplay running config.
typeevpn | faucet | qinq | simple | vlan | vxlanOnly list SDN zones of specific type

POST /cluster/sdn/zones ​

ts
proxmox.cluster.sdn.zones.$post()

Create a new sdn zone object.

Returns nothing.

ParameterTypeRequiredNotes
advertise-subnetsbooleanAdvertise IP prefixes (Type-5 routes) instead of MAC/IP pairs (Type-2 routes).
bridgestringThe bridge for which VLANs should be managed.
bridge-disable-mac-learningbooleanDisable auto mac learning.
controllerstringController for this zone.
dhcpdnsmasqType of the DHCP backend for this zone
disable-arp-nd-suppressionbooleanSuppress IPv4 ARP && IPv6 Neighbour Discovery messages.
dnsstringdns api server
dnszonestringdns domain zone ex: mydomain.com — format dns-name
dp-idnumberFaucet dataplane id
exitnodesstringList of cluster node names. — format pve-node-list
exitnodes-local-routingbooleanAllow exitnodes to connect to EVPN guests.
exitnodes-primarystringForce traffic through this exitnode first. — format pve-node
fabricstringSDN fabric to use as underlay for this VXLAN zone. — format pve-sdn-fabric-id
ipamstringuse a specific ipam
lock-tokenstringthe token for unlocking the global SDN configuration
macstringAnycast logical router mac address. — format mac-addr
mtunumberMTU of the zone, will be used for the created VNet bridges.
nodesstringList of cluster node names. — format pve-node-list
peersstringComma-separated list of peers, that are part of the VXLAN zone. Usually the IPs of the nodes. — format ip-list
reversednsstringreverse dns api server
rt-importstringList of Route Targets that should be imported into the VRF of the zone. — format pve-sdn-bgp-rt-list
secondary-controllersstring[]Additional controllers.
tagnumberService-VLAN Tag (outer VLAN) — min 0
typeevpn | faucet | qinq | simple | vlan | vxlanyesPlugin type. — format pve-configid
vlan-protocol802.1q | 802.1adWhich VLAN protocol should be used for the creation of the QinQ zone. — default "802.1q"
vrf-vxlannumberVNI for the zone VRF. — min 1, max 16777215
vxlan-portnumberUDP port that should be used for the VXLAN tunnel (default 4789). — min 1, max 65536, default 4789
zonestringyesThe SDN zone object identifier. — ≤ 8 chars

GET /cluster/sdn/zones/{zone} ​

ts
proxmox.cluster.sdn.zones.$(zone).$get()

Read sdn zone configuration.

Returns any.

ParameterTypeRequiredNotes
pendingbooleanDisplay pending config.
runningbooleanDisplay running config.
zonestringyesThe SDN zone object identifier. — ≤ 8 chars

PUT /cluster/sdn/zones/{zone} ​

ts
proxmox.cluster.sdn.zones.$(zone).$put()

Update sdn zone object configuration.

Returns nothing.

ParameterTypeRequiredNotes
advertise-subnetsbooleanAdvertise IP prefixes (Type-5 routes) instead of MAC/IP pairs (Type-2 routes).
bridgestringThe bridge for which VLANs should be managed.
bridge-disable-mac-learningbooleanDisable auto mac learning.
controllerstringController for this zone.
deletestringA list of settings you want to delete. — format pve-configid-list, ≤ 4096 chars
dhcpdnsmasqType of the DHCP backend for this zone
digeststringPrevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
disable-arp-nd-suppressionbooleanSuppress IPv4 ARP && IPv6 Neighbour Discovery messages.
dnsstringdns api server
dnszonestringdns domain zone ex: mydomain.com — format dns-name
dp-idnumberFaucet dataplane id
exitnodesstringList of cluster node names. — format pve-node-list
exitnodes-local-routingbooleanAllow exitnodes to connect to EVPN guests.
exitnodes-primarystringForce traffic through this exitnode first. — format pve-node
fabricstringSDN fabric to use as underlay for this VXLAN zone. — format pve-sdn-fabric-id
ipamstringuse a specific ipam
lock-tokenstringthe token for unlocking the global SDN configuration
macstringAnycast logical router mac address. — format mac-addr
mtunumberMTU of the zone, will be used for the created VNet bridges.
nodesstringList of cluster node names. — format pve-node-list
peersstringComma-separated list of peers, that are part of the VXLAN zone. Usually the IPs of the nodes. — format ip-list
reversednsstringreverse dns api server
rt-importstringList of Route Targets that should be imported into the VRF of the zone. — format pve-sdn-bgp-rt-list
secondary-controllersstring[]Additional controllers.
tagnumberService-VLAN Tag (outer VLAN) — min 0
vlan-protocol802.1q | 802.1adWhich VLAN protocol should be used for the creation of the QinQ zone. — default "802.1q"
vrf-vxlannumberVNI for the zone VRF. — min 1, max 16777215
vxlan-portnumberUDP port that should be used for the VXLAN tunnel (default 4789). — min 1, max 65536, default 4789
zonestringyesThe SDN zone object identifier. — ≤ 8 chars

DELETE /cluster/sdn/zones/{zone} ​

ts
proxmox.cluster.sdn.zones.$(zone).$delete()

Delete sdn zone object configuration.

Returns nothing.

ParameterTypeRequiredNotes
lock-tokenstringthe token for unlocking the global SDN configuration
zonestringyesThe SDN zone object identifier. — ≤ 8 chars