Hypershield

Hypershield (Service Acceleration) provides network-integrated security enforcement on NX-OS by redirecting traffic through DPU-based firewall processing. The configuration specifies a source interface, optional HTTPS proxy settings, and a firewall service that maps VRFs to DPU module affinity for distributed security processing. Hypershield requires the service_acceleration feature to be enabled.

Diagram

Diagram

Classes

system (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
hypershield	Class	[hypershield]	No

hypershield (nxos.devices.configuration.system)

Name	Type	Constraint	Mandatory	Default Value
source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
source_interface_id	Any	String or Integer[min: 0]	No
https_proxy	String		No
https_proxy_port	Integer	min: 1, max: 65535	No
firewall_in_service	Boolean	true, false	No
firewall_vrfs	List	[firewall_vrfs]	No

hypershield (nxos.devices.configuration.system)

Name	Type	Constraint	Mandatory	Default Value
source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
source_interface_id	String		No
https_proxy	String		No
https_proxy_port	Integer	min: 1, max: 65535	No
firewall_in_service	Boolean	true, false	No
firewall_vrfs	List	[firewall_vrfs]	No

firewall_vrfs (nxos.devices.configuration.system.hypershield)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes

firewall_vrfs (nxos.devices.configuration.system.hypershield)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
module_affinity	Integer	min: 0, max: 16	No

Examples

Example 1: Basic Hypershield with HTTPS proxy

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          hypershield:
            source_interface_type: loopback
            source_interface_id: lo100
            https_proxy: proxy.example.com
            https_proxy_port: 80

Example 2: Hypershield with firewall VRF redirection and dynamic module affinity

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          hypershield:
            source_interface_type: loopback
            source_interface_id: lo100
            https_proxy: proxy.example.com
            https_proxy_port: 80
            firewall_in_service: true
            firewall_vrfs:
              - name: red
                module_affinity: 0
              - name: green
                module_affinity: 3

Example 3: Hypershield with multiple VRFs and specific module affinity

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          hypershield:
            source_interface_type: loopback
            source_interface_id: lo100
            firewall_in_service: true
            firewall_vrfs:
              - name: PROD
                module_affinity: 1
              - name: DEV
                module_affinity: 2