Hypershield

Hypershield (Service Acceleration) provides network-integrated security enforcement on NX-OS by redirecting traffic through DPU-based firewall processing. The configuration specifies a source interface, optional HTTPS proxy settings, and a firewall service that redirects traffic of selected VRFs for distributed security processing. Hypershield requires the service_acceleration feature to be enabled.

Hypershield (Service Acceleration) provides network-integrated security enforcement on NX-OS by redirecting traffic through DPU-based firewall processing. The configuration specifies a source interface, optional HTTPS proxy settings, and a firewall service that maps VRFs to DPU module affinity for distributed security processing. Hypershield requires the service_acceleration feature to be enabled.

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
system	Class	system	No

system (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
hypershield	Class	hypershield	No

hypershield (nxos.devices.configuration.system)

Name	Type	Constraint	Mandatory	Default Value
source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
source_interface_id	Any	String or Integer[min: 0]	No
https_proxy	String		No
https_proxy_port	Integer	min: 1, max: 65535	No
firewall_in_service	Boolean	true, false	No
firewall_vrfs	List	firewall_vrfs	No

firewall_vrfs (nxos.devices.configuration.system.hypershield)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes

Examples

Example 1: Basic Hypershield with HTTPS proxy

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          hypershield:
            source_interface_type: loopback
            source_interface_id: lo100
            https_proxy: proxy.example.com
            https_proxy_port: 80

Example 2: Hypershield with firewall VRF redirection

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          hypershield:
            source_interface_type: loopback
            source_interface_id: lo100
            https_proxy: proxy.example.com
            https_proxy_port: 80
            firewall_in_service: true
            firewall_vrfs:
              - name: red
              - name: green

Example 3: Hypershield firewall without HTTPS proxy

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          hypershield:
            source_interface_type: loopback
            source_interface_id: lo100
            firewall_in_service: true
            firewall_vrfs:
              - name: PROD
              - name: DEV

Examples

Example 1: Basic Hypershield with HTTPS proxy

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          hypershield:
            source_interface_type: loopback
            source_interface_id: lo100
            https_proxy: proxy.example.com
            https_proxy_port: 80

Example 2: Hypershield with firewall VRF redirection and dynamic module affinity

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          hypershield:
            source_interface_type: loopback
            source_interface_id: lo100
            https_proxy: proxy.example.com
            https_proxy_port: 80
            firewall_in_service: true
            firewall_vrfs:
              - name: red
                module_affinity: 0
              - name: green
                module_affinity: 3

Example 3: Hypershield with multiple VRFs and specific module affinity

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          hypershield:
            source_interface_type: loopback
            source_interface_id: lo100
            firewall_in_service: true
            firewall_vrfs:
              - name: PROD
                module_affinity: 1
              - name: DEV
                module_affinity: 2