<gh_stars>0// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Threading.Tasks;
using Pulumi.Serialization;
using Pulumi;

namespace Pulumiverse.Fortios
{
    /// <summary>
    /// Configure Virtual Access Points (VAPs).
    /// 
    /// ## Import
    /// 
    /// WirelessController Vap can be imported using any of these accepted formats
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/wirelesscontrollerVap:WirelesscontrollerVap labelname {{name}}
    /// ```
    /// 
    ///  If you do not want to import arguments of block$ export "FORTIOS_IMPORT_TABLE"="false"
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/wirelesscontrollerVap:WirelesscontrollerVap labelname {{name}}
    /// ```
    /// 
    ///  $ unset "FORTIOS_IMPORT_TABLE"
    /// </summary>
    [FortiosResourceType("fortios:index/wirelesscontrollerVap:WirelesscontrollerVap")]
    public partial class WirelesscontrollerVap : global::Pulumi.CustomResource
    {
        /// <summary>
        /// access-control-list profile name.
        /// </summary>
        [Output("accessControlList")]
        public Output<string> AccessControlList { get; private set; } = null!;

        /// <summary>
        /// WiFi RADIUS accounting interim interval (60 - 86400 sec, default = 0).
        /// </summary>
        [Output("acctInterimInterval")]
        public Output<int> AcctInterimInterval { get; private set; } = null!;

        /// <summary>
        /// Additional AKMs. Valid values: `akm6`.
        /// </summary>
        [Output("additionalAkms")]
        public Output<string> AdditionalAkms { get; private set; } = null!;

        /// <summary>
        /// Address group ID.
        /// </summary>
        [Output("addressGroup")]
        public Output<string> AddressGroup { get; private set; } = null!;

        /// <summary>
        /// Configure MAC address filtering policy for MAC addresses that are in the address-group. Valid values: `disable`, `allow`, `deny`.
        /// </summary>
        [Output("addressGroupPolicy")]
        public Output<string> AddressGroupPolicy { get; private set; } = null!;

        /// <summary>
        /// Alias.
        /// </summary>
        [Output("alias")]
        public Output<string> Alias { get; private set; } = null!;

        /// <summary>
        /// AntiVirus profile name.
        /// </summary>
        [Output("antivirusProfile")]
        public Output<string> AntivirusProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable application detection engine (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("applicationDetectionEngine")]
        public Output<string> ApplicationDetectionEngine { get; private set; } = null!;

        /// <summary>
        /// Enable/disable application attribute based DSCP marking (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("applicationDscpMarking")]
        public Output<string> ApplicationDscpMarking { get; private set; } = null!;

        /// <summary>
        /// Application control list name.
        /// </summary>
        [Output("applicationList")]
        public Output<string> ApplicationList { get; private set; } = null!;

        /// <summary>
        /// Application report interval (30 - 864000 sec, default = 120).
        /// </summary>
        [Output("applicationReportIntv")]
        public Output<int> ApplicationReportIntv { get; private set; } = null!;

        /// <summary>
        /// Airtime weight in percentage (default = 20).
        /// </summary>
        [Output("atfWeight")]
        public Output<int> AtfWeight { get; private set; } = null!;

        /// <summary>
        /// Authentication protocol. Valid values: `psk`, `radius`, `usergroup`.
        /// </summary>
        [Output("auth")]
        public Output<string> Auth { get; private set; } = null!;

        /// <summary>
        /// HTTPS server certificate.
        /// </summary>
        [Output("authCert")]
        public Output<string> AuthCert { get; private set; } = null!;

        /// <summary>
        /// Address of captive portal.
        /// </summary>
        [Output("authPortalAddr")]
        public Output<string> AuthPortalAddr { get; private set; } = null!;

        /// <summary>
        /// Fortinet beacon advertising IE data   (default = empty). Valid values: `name`, `model`, `serial-number`.
        /// </summary>
        [Output("beaconAdvertising")]
        public Output<string> BeaconAdvertising { get; private set; } = null!;

        /// <summary>
        /// Enable/disable broadcasting the SSID (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("broadcastSsid")]
        public Output<string> BroadcastSsid { get; private set; } = null!;

        /// <summary>
        /// Optional suppression of broadcast messages. For example, you can keep DHCP messages, ARP broadcasts, and so on off of the wireless network.
        /// </summary>
        [Output("broadcastSuppression")]
        public Output<string> BroadcastSuppression { get; private set; } = null!;

        /// <summary>
        /// Enable/disable 802.11ax partial BSS color (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("bssColorPartial")]
        public Output<string> BssColorPartial { get; private set; } = null!;

        /// <summary>
        /// Enable/disable forcing of disassociation after the BSTM request timer has been reached (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("bstmDisassociationImminent")]
        public Output<string> BstmDisassociationImminent { get; private set; } = null!;

        /// <summary>
        /// Time interval for client to voluntarily leave AP before forcing a disassociation due to AP load-balancing (0 to 30, default = 10).
        /// </summary>
        [Output("bstmLoadBalancingDisassocTimer")]
        public Output<int> BstmLoadBalancingDisassocTimer { get; private set; } = null!;

        /// <summary>
        /// Time interval for client to voluntarily leave AP before forcing a disassociation due to low RSSI (0 to 2000, default = 200).
        /// </summary>
        [Output("bstmRssiDisassocTimer")]
        public Output<int> BstmRssiDisassocTimer { get; private set; } = null!;

        /// <summary>
        /// Local-bridging captive portal ac-name.
        /// </summary>
        [Output("captivePortalAcName")]
        public Output<string> CaptivePortalAcName { get; private set; } = null!;

        /// <summary>
        /// Hard timeout - AP will always clear the session after timeout regardless of traffic (0 - 864000 sec, default = 0).
        /// </summary>
        [Output("captivePortalAuthTimeout")]
        public Output<int> CaptivePortalAuthTimeout { get; private set; } = null!;

        /// <summary>
        /// Secret key to access the macauth RADIUS server.
        /// </summary>
        [Output("captivePortalMacauthRadiusSecret")]
        public Output<string?> CaptivePortalMacauthRadiusSecret { get; private set; } = null!;

        /// <summary>
        /// Captive portal external RADIUS server domain name or IP address.
        /// </summary>
        [Output("captivePortalMacauthRadiusServer")]
        public Output<string> CaptivePortalMacauthRadiusServer { get; private set; } = null!;

        /// <summary>
        /// Secret key to access the RADIUS server.
        /// </summary>
        [Output("captivePortalRadiusSecret")]
        public Output<string?> CaptivePortalRadiusSecret { get; private set; } = null!;

        /// <summary>
        /// Captive portal RADIUS server domain name or IP address.
        /// </summary>
        [Output("captivePortalRadiusServer")]
        public Output<string> CaptivePortalRadiusServer { get; private set; } = null!;

        /// <summary>
        /// Session timeout interval (0 - 864000 sec, default = 0).
        /// </summary>
        [Output("captivePortalSessionTimeoutInterval")]
        public Output<int> CaptivePortalSessionTimeoutInterval { get; private set; } = null!;

        /// <summary>
        /// Enable/disable DHCP address enforcement (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dhcpAddressEnforcement")]
        public Output<string> DhcpAddressEnforcement { get; private set; } = null!;

        /// <summary>
        /// DHCP lease time in seconds for NAT IP address.
        /// </summary>
        [Output("dhcpLeaseTime")]
        public Output<int> DhcpLeaseTime { get; private set; } = null!;

        /// <summary>
        /// Enable/disable insertion of DHCP option 43 (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dhcpOption43Insertion")]
        public Output<string> DhcpOption43Insertion { get; private set; } = null!;

        /// <summary>
        /// Enable/disable DHCP option 82 circuit-id insert (default = disable).
        /// </summary>
        [Output("dhcpOption82CircuitIdInsertion")]
        public Output<string> DhcpOption82CircuitIdInsertion { get; private set; } = null!;

        /// <summary>
        /// Enable/disable DHCP option 82 insert (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dhcpOption82Insertion")]
        public Output<string> DhcpOption82Insertion { get; private set; } = null!;

        /// <summary>
        /// Enable/disable DHCP option 82 remote-id insert (default = disable). Valid values: `style-1`, `disable`.
        /// </summary>
        [Output("dhcpOption82RemoteIdInsertion")]
        public Output<string> DhcpOption82RemoteIdInsertion { get; private set; } = null!;

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Output("dynamicSortSubtable")]
        public Output<string?> DynamicSortSubtable { get; private set; } = null!;

        /// <summary>
        /// Enable/disable dynamic VLAN assignment. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dynamicVlan")]
        public Output<string> DynamicVlan { get; private set; } = null!;

        /// <summary>
        /// Enable/disable EAP re-authentication for WPA-Enterprise security. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("eapReauth")]
        public Output<string> EapReauth { get; private set; } = null!;

        /// <summary>
        /// EAP re-authentication interval (1800 - 864000 sec, default = 86400).
        /// </summary>
        [Output("eapReauthIntv")]
        public Output<int> EapReauthIntv { get; private set; } = null!;

        /// <summary>
        /// Enable/disable retransmission of EAPOL-Key frames (message 3/4 and group message 1/2) (default = enable). Valid values: `disable`, `enable`.
        /// </summary>
        [Output("eapolKeyRetries")]
        public Output<string> EapolKeyRetries { get; private set; } = null!;

        /// <summary>
        /// Encryption protocol to use (only available when security is set to a WPA type). Valid values: `TKIP`, `AES`, `TKIP-AES`.
        /// </summary>
        [Output("encrypt")]
        public Output<string> Encrypt { get; private set; } = null!;

        /// <summary>
        /// Enable/disable fast roaming or pre-authentication with external APs not managed by the FortiGate (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("externalFastRoaming")]
        public Output<string> ExternalFastRoaming { get; private set; } = null!;

        /// <summary>
        /// URL of external authentication logout server.
        /// </summary>
        [Output("externalLogout")]
        public Output<string> ExternalLogout { get; private set; } = null!;

        /// <summary>
        /// URL of external authentication web server.
        /// </summary>
        [Output("externalWeb")]
        public Output<string> ExternalWeb { get; private set; } = null!;

        /// <summary>
        /// URL query parameter detection (default = auto-detect). Valid values: `auto-detect`, `no-query-string`, `partial-query-string`.
        /// </summary>
        [Output("externalWebFormat")]
        public Output<string> ExternalWebFormat { get; private set; } = null!;

        /// <summary>
        /// Enable/disable 802.11r Fast BSS Transition (FT) (default = disable). Valid values: `disable`, `enable`.
        /// </summary>
        [Output("fastBssTransition")]
        public Output<string> FastBssTransition { get; private set; } = null!;

        /// <summary>
        /// Enable/disable fast-roaming, or pre-authentication, where supported by clients (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("fastRoaming")]
        public Output<string> FastRoaming { get; private set; } = null!;

        /// <summary>
        /// Mobility domain identifier in FT (1 - 65535, default = 1000).
        /// </summary>
        [Output("ftMobilityDomain")]
        public Output<int> FtMobilityDomain { get; private set; } = null!;

        /// <summary>
        /// Enable/disable FT over the Distribution System (DS). Valid values: `disable`, `enable`.
        /// </summary>
        [Output("ftOverDs")]
        public Output<string> FtOverDs { get; private set; } = null!;

        /// <summary>
        /// Lifetime of the PMK-R0 key in FT, 1-65535 minutes.
        /// </summary>
        [Output("ftR0KeyLifetime")]
        public Output<int> FtR0KeyLifetime { get; private set; } = null!;

        /// <summary>
        /// GAS comeback delay (0 or 100 - 10000 milliseconds, default = 500).
        /// </summary>
        [Output("gasComebackDelay")]
        public Output<int> GasComebackDelay { get; private set; } = null!;

        /// <summary>
        /// GAS fragmentation limit (512 - 4096, default = 1024).
        /// </summary>
        [Output("gasFragmentationLimit")]
        public Output<int> GasFragmentationLimit { get; private set; } = null!;

        /// <summary>
        /// Enable/disable GTK rekey for WPA security. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("gtkRekey")]
        public Output<string> GtkRekey { get; private set; } = null!;

        /// <summary>
        /// GTK rekey interval (1800 - 864000 sec, default = 86400).
        /// </summary>
        [Output("gtkRekeyIntv")]
        public Output<int> GtkRekeyIntv { get; private set; } = null!;

        /// <summary>
        /// Enable/disable 802.11ax high efficiency (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("highEfficiency")]
        public Output<string> HighEfficiency { get; private set; } = null!;

        /// <summary>
        /// Hotspot 2.0 profile name.
        /// </summary>
        [Output("hotspot20Profile")]
        public Output<string> Hotspot20Profile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable IGMP snooping. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("igmpSnooping")]
        public Output<string> IgmpSnooping { get; private set; } = null!;

        /// <summary>
        /// Enable/disable blocking communication between clients on the same SSID (called intra-SSID privacy) (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("intraVapPrivacy")]
        public Output<string> IntraVapPrivacy { get; private set; } = null!;

        /// <summary>
        /// IP address and subnet mask for the local standalone NAT subnet.
        /// </summary>
        [Output("ip")]
        public Output<string> Ip { get; private set; } = null!;

        /// <summary>
        /// IPS sensor name.
        /// </summary>
        [Output("ipsSensor")]
        public Output<string> IpsSensor { get; private set; } = null!;

        /// <summary>
        /// Optional rules of IPv6 packets. For example, you can keep RA, RS and so on off of the wireless network. Valid values: `drop-icmp6ra`, `drop-icmp6rs`, `drop-llmnr6`, `drop-icmp6mld2`, `drop-dhcp6s`, `drop-dhcp6c`, `ndp-proxy`, `drop-ns-dad`, `drop-ns-nondad`.
        /// </summary>
        [Output("ipv6Rules")]
        public Output<string> Ipv6Rules { get; private set; } = null!;

        /// <summary>
        /// WEP Key.
        /// </summary>
        [Output("key")]
        public Output<string?> Key { get; private set; } = null!;

        /// <summary>
        /// WEP key index (1 - 4).
        /// </summary>
        [Output("keyindex")]
        public Output<int> Keyindex { get; private set; } = null!;

        /// <summary>
        /// Enable/disable layer 3 roaming (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("l3Roaming")]
        public Output<string> L3Roaming { get; private set; } = null!;

        /// <summary>
        /// Select the way that layer 3 roaming traffic is passed (default = direct). Valid values: `direct`, `indirect`.
        /// </summary>
        [Output("l3RoamingMode")]
        public Output<string> L3RoamingMode { get; private set; } = null!;

        /// <summary>
        /// VAP low-density parity-check (LDPC) coding configuration. Valid values: `disable`, `rx`, `tx`, `rxtx`.
        /// </summary>
        [Output("ldpc")]
        public Output<string> Ldpc { get; private set; } = null!;

        /// <summary>
        /// Enable/disable AP local authentication. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("localAuthentication")]
        public Output<string> LocalAuthentication { get; private set; } = null!;

        /// <summary>
        /// Enable/disable bridging of wireless and Ethernet interfaces on the FortiAP (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("localBridging")]
        public Output<string> LocalBridging { get; private set; } = null!;

        /// <summary>
        /// Allow/deny traffic destined for a Class A, B, or C private IP address (default = allow). Valid values: `allow`, `deny`.
        /// </summary>
        [Output("localLan")]
        public Output<string> LocalLan { get; private set; } = null!;

        /// <summary>
        /// Enable/disable AP local standalone (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("localStandalone")]
        public Output<string> LocalStandalone { get; private set; } = null!;

        /// <summary>
        /// Enable/disable AP local standalone DNS. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("localStandaloneDns")]
        public Output<string> LocalStandaloneDns { get; private set; } = null!;

        /// <summary>
        /// IPv4 addresses for the local standalone DNS.
        /// </summary>
        [Output("localStandaloneDnsIp")]
        public Output<string> LocalStandaloneDnsIp { get; private set; } = null!;

        /// <summary>
        /// Enable/disable AP local standalone NAT mode. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("localStandaloneNat")]
        public Output<string> LocalStandaloneNat { get; private set; } = null!;

        /// <summary>
        /// Enable/disable MAC authentication bypass. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("macAuthBypass")]
        public Output<string> MacAuthBypass { get; private set; } = null!;

        /// <summary>
        /// MAC called station delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Output("macCalledStationDelimiter")]
        public Output<string> MacCalledStationDelimiter { get; private set; } = null!;

        /// <summary>
        /// MAC calling station delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Output("macCallingStationDelimiter")]
        public Output<string> MacCallingStationDelimiter { get; private set; } = null!;

        /// <summary>
        /// MAC case (default = uppercase). Valid values: `uppercase`, `lowercase`.
        /// </summary>
        [Output("macCase")]
        public Output<string> MacCase { get; private set; } = null!;

        /// <summary>
        /// Enable/disable MAC filtering to block wireless clients by mac address. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("macFilter")]
        public Output<string> MacFilter { get; private set; } = null!;

        /// <summary>
        /// Create a list of MAC addresses for MAC address filtering. The structure of `mac_filter_list` block is documented below.
        /// </summary>
        [Output("macFilterLists")]
        public Output<ImmutableArray<Outputs.WirelesscontrollerVapMacFilterList>> MacFilterLists { get; private set; } = null!;

        /// <summary>
        /// Allow or block clients with MAC addresses that are not in the filter list. Valid values: `allow`, `deny`.
        /// </summary>
        [Output("macFilterPolicyOther")]
        public Output<string> MacFilterPolicyOther { get; private set; } = null!;

        /// <summary>
        /// MAC authentication password delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Output("macPasswordDelimiter")]
        public Output<string> MacPasswordDelimiter { get; private set; } = null!;

        /// <summary>
        /// MAC authentication username delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Output("macUsernameDelimiter")]
        public Output<string> MacUsernameDelimiter { get; private set; } = null!;

        /// <summary>
        /// Maximum number of clients that can connect simultaneously to the VAP (default = 0, meaning no limitation).
        /// </summary>
        [Output("maxClients")]
        public Output<int> MaxClients { get; private set; } = null!;

        /// <summary>
        /// Maximum number of clients that can connect simultaneously to each radio (default = 0, meaning no limitation).
        /// </summary>
        [Output("maxClientsAp")]
        public Output<int> MaxClientsAp { get; private set; } = null!;

        /// <summary>
        /// Enable/disable Multiband Operation (default = disable). Valid values: `disable`, `enable`.
        /// </summary>
        [Output("mbo")]
        public Output<string> Mbo { get; private set; } = null!;

        /// <summary>
        /// MBO cell data connection preference (0, 1, or 255, default = 1). Valid values: `excluded`, `prefer-not`, `prefer-use`.
        /// </summary>
        [Output("mboCellDataConnPref")]
        public Output<string> MboCellDataConnPref { get; private set; } = null!;

        /// <summary>
        /// Disable multicast enhancement when this many clients are receiving multicast traffic.
        /// </summary>
        [Output("meDisableThresh")]
        public Output<int> MeDisableThresh { get; private set; } = null!;

        /// <summary>
        /// Enable/disable using this VAP as a WiFi mesh backhaul (default = disable). This entry is only available when security is set to a WPA type or open. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("meshBackhaul")]
        public Output<string> MeshBackhaul { get; private set; } = null!;

        /// <summary>
        /// Enable/disable multiple pre-shared keys (PSKs.) Valid values: `enable`, `disable`.
        /// </summary>
        [Output("mpsk")]
        public Output<string> Mpsk { get; private set; } = null!;

        /// <summary>
        /// Number of pre-shared keys (PSKs) to allow if multiple pre-shared keys are enabled.
        /// </summary>
        [Output("mpskConcurrentClients")]
        public Output<int> MpskConcurrentClients { get; private set; } = null!;

        /// <summary>
        /// Pre-shared keys that can be used to connect to this virtual access point. The structure of `mpsk_key` block is documented below.
        /// </summary>
        [Output("mpskKeys")]
        public Output<ImmutableArray<Outputs.WirelesscontrollerVapMpskKey>> MpskKeys { get; private set; } = null!;

        /// <summary>
        /// MPSK profile name.
        /// </summary>
        [Output("mpskProfile")]
        public Output<string> MpskProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable Multi-user MIMO (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("muMimo")]
        public Output<string> MuMimo { get; private set; } = null!;

        /// <summary>
        /// Enable/disable converting multicast to unicast to improve performance (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("multicastEnhance")]
        public Output<string> MulticastEnhance { get; private set; } = null!;

        /// <summary>
        /// Multicast rate (0, 6000, 12000, or 24000 kbps, default = 0). Valid values: `0`, `6000`, `12000`, `24000`.
        /// </summary>
        [Output("multicastRate")]
        public Output<string> MulticastRate { get; private set; } = null!;

        /// <summary>
        /// Enable/disable network access control. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("nac")]
        public Output<string> Nac { get; private set; } = null!;

        /// <summary>
        /// NAC profile name.
        /// </summary>
        [Output("nacProfile")]
        public Output<string> NacProfile { get; private set; } = null!;

        /// <summary>
        /// Virtual AP name.
        /// </summary>
        [Output("name")]
        public Output<string> Name { get; private set; } = null!;

        /// <summary>
        /// Enable/disable dual-band neighbor report (default = disable). Valid values: `disable`, `enable`.
        /// </summary>
        [Output("neighborReportDualBand")]
        public Output<string> NeighborReportDualBand { get; private set; } = null!;

        /// <summary>
        /// Enable/disable Opportunistic Key Caching (OKC) (default = enable). Valid values: `disable`, `enable`.
        /// </summary>
        [Output("okc")]
        public Output<string> Okc { get; private set; } = null!;

        /// <summary>
        /// Enable/disable OSEN as part of key management (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("osen")]
        public Output<string> Osen { get; private set; } = null!;

        /// <summary>
        /// OWE-Groups. Valid values: `19`, `20`, `21`.
        /// </summary>
        [Output("oweGroups")]
        public Output<string> OweGroups { get; private set; } = null!;

        /// <summary>
        /// Enable/disable OWE transition mode support. Valid values: `disable`, `enable`.
        /// </summary>
        [Output("oweTransition")]
        public Output<string> OweTransition { get; private set; } = null!;

        /// <summary>
        /// OWE transition mode peer SSID.
        /// </summary>
        [Output("oweTransitionSsid")]
        public Output<string> OweTransitionSsid { get; private set; } = null!;

        /// <summary>
        /// WPA pre-shard key (PSK) to be used to authenticate WiFi users.
        /// </summary>
        [Output("passphrase")]
        public Output<string?> Passphrase { get; private set; } = null!;

        /// <summary>
        /// Protected Management Frames (PMF) support (default = disable). Valid values: `disable`, `enable`, `optional`.
        /// </summary>
        [Output("pmf")]
        public Output<string> Pmf { get; private set; } = null!;

        /// <summary>
        /// Protected Management Frames (PMF) comeback maximum timeout (1-20 sec).
        /// </summary>
        [Output("pmfAssocComebackTimeout")]
        public Output<int> PmfAssocComebackTimeout { get; private set; } = null!;

        /// <summary>
        /// Protected Management Frames (PMF) SA query retry timeout interval (1 - 5 100s of msec).
        /// </summary>
        [Output("pmfSaQueryRetryTimeout")]
        public Output<int> PmfSaQueryRetryTimeout { get; private set; } = null!;

        /// <summary>
        /// Enable/disable LAN port MAC authentication (default = disable). Valid values: `disable`, `radius`, `address-group`.
        /// </summary>
        [Output("portMacauth")]
        public Output<string> PortMacauth { get; private set; } = null!;

        /// <summary>
        /// LAN port MAC authentication re-authentication timeout value (default = 7200 sec).
        /// </summary>
        [Output("portMacauthReauthTimeout")]
        public Output<int> PortMacauthReauthTimeout { get; private set; } = null!;

        /// <summary>
        /// LAN port MAC authentication idle timeout value (default = 600 sec).
        /// </summary>
        [Output("portMacauthTimeout")]
        public Output<int> PortMacauthTimeout { get; private set; } = null!;

        /// <summary>
        /// Replacement message group for this VAP (only available when security is set to a captive portal type).
        /// </summary>
        [Output("portalMessageOverrideGroup")]
        public Output<string> PortalMessageOverrideGroup { get; private set; } = null!;

        /// <summary>
        /// Individual message overrides. The structure of `portal_message_overrides` block is documented below.
        /// </summary>
        [Output("portalMessageOverrides")]
        public Output<Outputs.WirelesscontrollerVapPortalMessageOverrides> PortalMessageOverrides { get; private set; } = null!;

        /// <summary>
        /// Captive portal functionality. Configure how the captive portal authenticates users and whether it includes a disclaimer.
        /// </summary>
        [Output("portalType")]
        public Output<string> PortalType { get; private set; } = null!;

        /// <summary>
        /// Primary wireless access gateway profile name.
        /// </summary>
        [Output("primaryWagProfile")]
        public Output<string> PrimaryWagProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable probe response suppression (to ignore weak signals) (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("probeRespSuppression")]
        public Output<string> ProbeRespSuppression { get; private set; } = null!;

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the AP response to probe requests (-95 to -20, default = -80).
        /// </summary>
        [Output("probeRespThreshold")]
        public Output<string> ProbeRespThreshold { get; private set; } = null!;

        /// <summary>
        /// Enable/disable PTK rekey for WPA-Enterprise security. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("ptkRekey")]
        public Output<string> PtkRekey { get; private set; } = null!;

        /// <summary>
        /// PTK rekey interval (1800 - 864000 sec, default = 86400).
        /// </summary>
        [Output("ptkRekeyIntv")]
        public Output<int> PtkRekeyIntv { get; private set; } = null!;

        /// <summary>
        /// Quality of service profile name.
        /// </summary>
        [Output("qosProfile")]
        public Output<string> QosProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable station quarantine (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("quarantine")]
        public Output<string> Quarantine { get; private set; } = null!;

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the AP response to receive a packet in 2.4G band (-95 to -20, default = -79).
        /// </summary>
        [Output("radio2gThreshold")]
        public Output<string> Radio2gThreshold { get; private set; } = null!;

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the AP response to receive a packet in 5G band(-95 to -20, default = -76).
        /// </summary>
        [Output("radio5gThreshold")]
        public Output<string> Radio5gThreshold { get; private set; } = null!;

        /// <summary>
        /// Enable/disable software radio sensitivity (to ignore weak signals) (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("radioSensitivity")]
        public Output<string> RadioSensitivity { get; private set; } = null!;

        /// <summary>
        /// Enable/disable RADIUS-based MAC authentication of clients (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("radiusMacAuth")]
        public Output<string> RadiusMacAuth { get; private set; } = null!;

        /// <summary>
        /// RADIUS-based MAC authentication server.
        /// </summary>
        [Output("radiusMacAuthServer")]
        public Output<string> RadiusMacAuthServer { get; private set; } = null!;

        /// <summary>
        /// Selective user groups that are permitted for RADIUS mac authentication. The structure of `radius_mac_auth_usergroups` block is documented below.
        /// </summary>
        [Output("radiusMacAuthUsergroups")]
        public Output<ImmutableArray<Outputs.WirelesscontrollerVapRadiusMacAuthUsergroup>> RadiusMacAuthUsergroups { get; private set; } = null!;

        /// <summary>
        /// Enable/disable RADIUS-based MAC authentication of clients for MPSK authentication (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("radiusMacMpskAuth")]
        public Output<string> RadiusMacMpskAuth { get; private set; } = null!;

        /// <summary>
        /// RADIUS MAC MPSK cache timeout interval (1800 - 864000, default = 86400).
        /// </summary>
        [Output("radiusMacMpskTimeout")]
        public Output<int> RadiusMacMpskTimeout { get; private set; } = null!;

        /// <summary>
        /// RADIUS server to be used to authenticate WiFi users.
        /// </summary>
        [Output("radiusServer")]
        public Output<string> RadiusServer { get; private set; } = null!;

        /// <summary>
        /// Allowed data rates for 802.11a. Valid values: `1`, `1-basic`, `2`, `2-basic`, `5.5`, `5.5-basic`, `11`, `11-basic`, `6`, `6-basic`, `9`, `9-basic`, `12`, `12-basic`, `18`, `18-basic`, `24`, `24-basic`, `36`, `36-basic`, `48`, `48-basic`, `54`, `54-basic`.
        /// </summary>
        [Output("rates11a")]
        public Output<string> Rates11a { get; private set; } = null!;

        /// <summary>
        /// Comma separated list of max supported VHT MCS for spatial streams 1 through 8.
        /// </summary>
        [Output("rates11acMcsMap")]
        public Output<string> Rates11acMcsMap { get; private set; } = null!;

        /// <summary>
        /// Allowed data rates for 802.11ac with 1 or 2 spatial streams. Valid values: `mcs0/1`, `mcs1/1`, `mcs2/1`, `mcs3/1`, `mcs4/1`, `mcs5/1`, `mcs6/1`, `mcs7/1`, `mcs8/1`, `mcs9/1`, `mcs10/1`, `mcs11/1`, `mcs0/2`, `mcs1/2`, `mcs2/2`, `mcs3/2`, `mcs4/2`, `mcs5/2`, `mcs6/2`, `mcs7/2`, `mcs8/2`, `mcs9/2`, `mcs10/2`, `mcs11/2`.
        /// </summary>
        [Output("rates11acSs12")]
        public Output<string> Rates11acSs12 { get; private set; } = null!;

        /// <summary>
        /// Allowed data rates for 802.11ac with 3 or 4 spatial streams. Valid values: `mcs0/3`, `mcs1/3`, `mcs2/3`, `mcs3/3`, `mcs4/3`, `mcs5/3`, `mcs6/3`, `mcs7/3`, `mcs8/3`, `mcs9/3`, `mcs10/3`, `mcs11/3`, `mcs0/4`, `mcs1/4`, `mcs2/4`, `mcs3/4`, `mcs4/4`, `mcs5/4`, `mcs6/4`, `mcs7/4`, `mcs8/4`, `mcs9/4`, `mcs10/4`, `mcs11/4`.
        /// </summary>
        [Output("rates11acSs34")]
        public Output<string> Rates11acSs34 { get; private set; } = null!;

        /// <summary>
        /// Comma separated list of max supported HE MCS for spatial streams 1 through 8.
        /// </summary>
        [Output("rates11axMcsMap")]
        public Output<string> Rates11axMcsMap { get; private set; } = null!;

        /// <summary>
        /// Allowed data rates for 802.11ax with 1 or 2 spatial streams. Valid values: `mcs0/1`, `mcs1/1`, `mcs2/1`, `mcs3/1`, `mcs4/1`, `mcs5/1`, `mcs6/1`, `mcs7/1`, `mcs8/1`, `mcs9/1`, `mcs10/1`, `mcs11/1`, `mcs0/2`, `mcs1/2`, `mcs2/2`, `mcs3/2`, `mcs4/2`, `mcs5/2`, `mcs6/2`, `mcs7/2`, `mcs8/2`, `mcs9/2`, `mcs10/2`, `mcs11/2`.
        /// </summary>
        [Output("rates11axSs12")]
        public Output<string> Rates11axSs12 { get; private set; } = null!;

        /// <summary>
        /// Allowed data rates for 802.11ax with 3 or 4 spatial streams. Valid values: `mcs0/3`, `mcs1/3`, `mcs2/3`, `mcs3/3`, `mcs4/3`, `mcs5/3`, `mcs6/3`, `mcs7/3`, `mcs8/3`, `mcs9/3`, `mcs10/3`, `mcs11/3`, `mcs0/4`, `mcs1/4`, `mcs2/4`, `mcs3/4`, `mcs4/4`, `mcs5/4`, `mcs6/4`, `mcs7/4`, `mcs8/4`, `mcs9/4`, `mcs10/4`, `mcs11/4`.
        /// </summary>
        [Output("rates11axSs34")]
        public Output<string> Rates11axSs34 { get; private set; } = null!;

        /// <summary>
        /// Allowed data rates for 802.11b/g. Valid values: `1`, `1-basic`, `2`, `2-basic`, `5.5`, `5.5-basic`, `11`, `11-basic`, `6`, `6-basic`, `9`, `9-basic`, `12`, `12-basic`, `18`, `18-basic`, `24`, `24-basic`, `36`, `36-basic`, `48`, `48-basic`, `54`, `54-basic`.
        /// </summary>
        [Output("rates11bg")]
        public Output<string> Rates11bg { get; private set; } = null!;

        /// <summary>
        /// Allowed data rates for 802.11n with 1 or 2 spatial streams. Valid values: `mcs0/1`, `mcs1/1`, `mcs2/1`, `mcs3/1`, `mcs4/1`, `mcs5/1`, `mcs6/1`, `mcs7/1`, `mcs8/2`, `mcs9/2`, `mcs10/2`, `mcs11/2`, `mcs12/2`, `mcs13/2`, `mcs14/2`, `mcs15/2`.
        /// </summary>
        [Output("rates11nSs12")]
        public Output<string> Rates11nSs12 { get; private set; } = null!;

        /// <summary>
        /// Allowed data rates for 802.11n with 3 or 4 spatial streams. Valid values: `mcs16/3`, `mcs17/3`, `mcs18/3`, `mcs19/3`, `mcs20/3`, `mcs21/3`, `mcs22/3`, `mcs23/3`, `mcs24/4`, `mcs25/4`, `mcs26/4`, `mcs27/4`, `mcs28/4`, `mcs29/4`, `mcs30/4`, `mcs31/4`.
        /// </summary>
        [Output("rates11nSs34")]
        public Output<string> Rates11nSs34 { get; private set; } = null!;

        /// <summary>
        /// SAE-Groups. Valid values: `19`, `20`, `21`.
        /// </summary>
        [Output("saeGroups")]
        public Output<string> SaeGroups { get; private set; } = null!;

        /// <summary>
        /// Use hash-to-element-only mechanism for PWE derivation (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("saeH2eOnly")]
        public Output<string> SaeH2eOnly { get; private set; } = null!;

        /// <summary>
        /// WPA3 SAE password to be used to authenticate WiFi users.
        /// </summary>
        [Output("saePassword")]
        public Output<string?> SaePassword { get; private set; } = null!;

        /// <summary>
        /// Enable/disable WPA3 SAE-PK (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("saePk")]
        public Output<string> SaePk { get; private set; } = null!;

        /// <summary>
        /// Private key used for WPA3 SAE-PK authentication.
        /// </summary>
        [Output("saePrivateKey")]
        public Output<string> SaePrivateKey { get; private set; } = null!;

        /// <summary>
        /// Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: `disable`, `monitor`, `block`.
        /// </summary>
        [Output("scanBotnetConnections")]
        public Output<string> ScanBotnetConnections { get; private set; } = null!;

        /// <summary>
        /// VAP schedule name.
        /// </summary>
        [Output("schedule")]
        public Output<string> Schedule { get; private set; } = null!;

        /// <summary>
        /// Secondary wireless access gateway profile name.
        /// </summary>
        [Output("secondaryWagProfile")]
        public Output<string> SecondaryWagProfile { get; private set; } = null!;

        /// <summary>
        /// Security mode for the wireless interface (default = wpa2-only-personal).
        /// </summary>
        [Output("security")]
        public Output<string> Security { get; private set; } = null!;

        /// <summary>
        /// Optional security exempt list for captive portal authentication.
        /// </summary>
        [Output("securityExemptList")]
        public Output<string> SecurityExemptList { get; private set; } = null!;

        /// <summary>
        /// Enable/disable obsolete security options. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("securityObsoleteOption")]
        public Output<string> SecurityObsoleteOption { get; private set; } = null!;

        /// <summary>
        /// Optional URL for redirecting users after they pass captive portal authentication.
        /// </summary>
        [Output("securityRedirectUrl")]
        public Output<string> SecurityRedirectUrl { get; private set; } = null!;

        /// <summary>
        /// Selective user groups that are permitted to authenticate. The structure of `selected_usergroups` block is documented below.
        /// </summary>
        [Output("selectedUsergroups")]
        public Output<ImmutableArray<Outputs.WirelesscontrollerVapSelectedUsergroup>> SelectedUsergroups { get; private set; } = null!;

        /// <summary>
        /// Enable/disable split tunneling (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("splitTunneling")]
        public Output<string> SplitTunneling { get; private set; } = null!;

        /// <summary>
        /// IEEE 802.11 service set identifier (SSID) for the wireless interface. Users who wish to use the wireless network must configure their computers to access this SSID name.
        /// </summary>
        [Output("ssid")]
        public Output<string> Ssid { get; private set; } = null!;

        /// <summary>
        /// Enable/disable sticky client remove to maintain good signal level clients in SSID. (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("stickyClientRemove")]
        public Output<string> StickyClientRemove { get; private set; } = null!;

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the 2G client to be serviced by the AP (-95 to -20, default = -79).
        /// </summary>
        [Output("stickyClientThreshold2g")]
        public Output<string> StickyClientThreshold2g { get; private set; } = null!;

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the 5G client to be serviced by the AP (-95 to -20, default = -76).
        /// </summary>
        [Output("stickyClientThreshold5g")]
        public Output<string> StickyClientThreshold5g { get; private set; } = null!;

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the 6G client to be serviced by the AP (-95 to -20, default = -76).
        /// </summary>
        [Output("stickyClientThreshold6g")]
        public Output<string> StickyClientThreshold6g { get; private set; } = null!;

        /// <summary>
        /// Enable/disable 802.11ax target wake time (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("targetWakeTime")]
        public Output<string> TargetWakeTime { get; private set; } = null!;

        /// <summary>
        /// Enable/disable TKIP counter measure. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("tkipCounterMeasure")]
        public Output<string> TkipCounterMeasure { get; private set; } = null!;

        /// <summary>
        /// The time interval to send echo to both primary and secondary tunnel peers (1 - 65535 sec, default = 300).
        /// </summary>
        [Output("tunnelEchoInterval")]
        public Output<int> TunnelEchoInterval { get; private set; } = null!;

        /// <summary>
        /// The time interval for secondary tunnel to fall back to primary tunnel (0 - 65535 sec, default = 7200).
        /// </summary>
        [Output("tunnelFallbackInterval")]
        public Output<int> TunnelFallbackInterval { get; private set; } = null!;

        /// <summary>
        /// Firewall user group to be used to authenticate WiFi users. The structure of `usergroup` block is documented below.
        /// </summary>
        [Output("usergroups")]
        public Output<ImmutableArray<Outputs.WirelesscontrollerVapUsergroup>> Usergroups { get; private set; } = null!;

        /// <summary>
        /// Enable/disable UTM logging. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("utmLog")]
        public Output<string> UtmLog { get; private set; } = null!;

        /// <summary>
        /// UTM profile name.
        /// </summary>
        [Output("utmProfile")]
        public Output<string> UtmProfile { get; private set; } = null!;

        /// <summary>
        /// Enable to add one or more security profiles (AV, IPS, etc.) to the VAP. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("utmStatus")]
        public Output<string> UtmStatus { get; private set; } = null!;

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Output("vdomparam")]
        public Output<string?> Vdomparam { get; private set; } = null!;

        /// <summary>
        /// Enable/disable automatic management of SSID VLAN interface. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("vlanAuto")]
        public Output<string> VlanAuto { get; private set; } = null!;

        /// <summary>
        /// Table for mapping VLAN name to VLAN ID. The structure of `vlan_name` block is documented below.
        /// </summary>
        [Output("vlanNames")]
        public Output<ImmutableArray<Outputs.WirelesscontrollerVapVlanName>> VlanNames { get; private set; } = null!;

        /// <summary>
        /// Enable/disable VLAN pooling, to allow grouping of multiple wireless controller VLANs into VLAN pools (default = disable). When set to wtp-group, VLAN pooling occurs with VLAN assignment by wtp-group. Valid values: `wtp-group`, `round-robin`, `hash`, `disable`.
        /// </summary>
        [Output("vlanPooling")]
        public Output<string> VlanPooling { get; private set; } = null!;

        /// <summary>
        /// VLAN pool. The structure of `vlan_pool` block is documented below.
        /// </summary>
        [Output("vlanPools")]
        public Output<ImmutableArray<Outputs.WirelesscontrollerVapVlanPool>> VlanPools { get; private set; } = null!;

        /// <summary>
        /// Optional VLAN ID.
        /// </summary>
        [Output("vlanid")]
        public Output<int> Vlanid { get; private set; } = null!;

        /// <summary>
        /// Enable/disable 802.11k and 802.11v assisted Voice-Enterprise roaming (default = disable). Valid values: `disable`, `enable`.
        /// </summary>
        [Output("voiceEnterprise")]
        public Output<string> VoiceEnterprise { get; private set; } = null!;

        /// <summary>
        /// WebFilter profile name.
        /// </summary>
        [Output("webfilterProfile")]
        public Output<string> WebfilterProfile { get; private set; } = null!;


        /// <summary>
        /// Create a WirelesscontrollerVap resource with the given unique name, arguments, and options.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resource</param>
        /// <param name="args">The arguments used to populate this resource's properties</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public WirelesscontrollerVap(string name, WirelesscontrollerVapArgs? args = null, CustomResourceOptions? options = null)
            : base("fortios:index/wirelesscontrollerVap:WirelesscontrollerVap", name, args ?? new WirelesscontrollerVapArgs(), MakeResourceOptions(options, ""))
        {
        }

        private WirelesscontrollerVap(string name, Input<string> id, WirelesscontrollerVapState? state = null, CustomResourceOptions? options = null)
            : base("fortios:index/wirelesscontrollerVap:WirelesscontrollerVap", name, state, MakeResourceOptions(options, id))
        {
        }

        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
        {
            var defaultOptions = new CustomResourceOptions
            {
                Version = Utilities.Version,
                PluginDownloadURL = "github://api.github.com/pulumiverse/pulumi-fortios",
                AdditionalSecretOutputs =
                {
                    "captivePortalMacauthRadiusSecret",
                    "captivePortalRadiusSecret",
                    "key",
                    "passphrase",
                    "saePassword",
                },
            };
            var merged = CustomResourceOptions.Merge(defaultOptions, options);
            // Override the ID if one was specified for consistency with other language SDKs.
            merged.Id = id ?? merged.Id;
            return merged;
        }
        /// <summary>
        /// Get an existing WirelesscontrollerVap resource's state with the given name, ID, and optional extra
        /// properties used to qualify the lookup.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resulting resource.</param>
        /// <param name="id">The unique provider ID of the resource to lookup.</param>
        /// <param name="state">Any extra arguments used during the lookup.</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public static WirelesscontrollerVap Get(string name, Input<string> id, WirelesscontrollerVapState? state = null, CustomResourceOptions? options = null)
        {
            return new WirelesscontrollerVap(name, id, state, options);
        }
    }

    public sealed class WirelesscontrollerVapArgs : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// access-control-list profile name.
        /// </summary>
        [Input("accessControlList")]
        public Input<string>? AccessControlList { get; set; }

        /// <summary>
        /// WiFi RADIUS accounting interim interval (60 - 86400 sec, default = 0).
        /// </summary>
        [Input("acctInterimInterval")]
        public Input<int>? AcctInterimInterval { get; set; }

        /// <summary>
        /// Additional AKMs. Valid values: `akm6`.
        /// </summary>
        [Input("additionalAkms")]
        public Input<string>? AdditionalAkms { get; set; }

        /// <summary>
        /// Address group ID.
        /// </summary>
        [Input("addressGroup")]
        public Input<string>? AddressGroup { get; set; }

        /// <summary>
        /// Configure MAC address filtering policy for MAC addresses that are in the address-group. Valid values: `disable`, `allow`, `deny`.
        /// </summary>
        [Input("addressGroupPolicy")]
        public Input<string>? AddressGroupPolicy { get; set; }

        /// <summary>
        /// Alias.
        /// </summary>
        [Input("alias")]
        public Input<string>? Alias { get; set; }

        /// <summary>
        /// AntiVirus profile name.
        /// </summary>
        [Input("antivirusProfile")]
        public Input<string>? AntivirusProfile { get; set; }

        /// <summary>
        /// Enable/disable application detection engine (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("applicationDetectionEngine")]
        public Input<string>? ApplicationDetectionEngine { get; set; }

        /// <summary>
        /// Enable/disable application attribute based DSCP marking (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("applicationDscpMarking")]
        public Input<string>? ApplicationDscpMarking { get; set; }

        /// <summary>
        /// Application control list name.
        /// </summary>
        [Input("applicationList")]
        public Input<string>? ApplicationList { get; set; }

        /// <summary>
        /// Application report interval (30 - 864000 sec, default = 120).
        /// </summary>
        [Input("applicationReportIntv")]
        public Input<int>? ApplicationReportIntv { get; set; }

        /// <summary>
        /// Airtime weight in percentage (default = 20).
        /// </summary>
        [Input("atfWeight")]
        public Input<int>? AtfWeight { get; set; }

        /// <summary>
        /// Authentication protocol. Valid values: `psk`, `radius`, `usergroup`.
        /// </summary>
        [Input("auth")]
        public Input<string>? Auth { get; set; }

        /// <summary>
        /// HTTPS server certificate.
        /// </summary>
        [Input("authCert")]
        public Input<string>? AuthCert { get; set; }

        /// <summary>
        /// Address of captive portal.
        /// </summary>
        [Input("authPortalAddr")]
        public Input<string>? AuthPortalAddr { get; set; }

        /// <summary>
        /// Fortinet beacon advertising IE data   (default = empty). Valid values: `name`, `model`, `serial-number`.
        /// </summary>
        [Input("beaconAdvertising")]
        public Input<string>? BeaconAdvertising { get; set; }

        /// <summary>
        /// Enable/disable broadcasting the SSID (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("broadcastSsid")]
        public Input<string>? BroadcastSsid { get; set; }

        /// <summary>
        /// Optional suppression of broadcast messages. For example, you can keep DHCP messages, ARP broadcasts, and so on off of the wireless network.
        /// </summary>
        [Input("broadcastSuppression")]
        public Input<string>? BroadcastSuppression { get; set; }

        /// <summary>
        /// Enable/disable 802.11ax partial BSS color (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("bssColorPartial")]
        public Input<string>? BssColorPartial { get; set; }

        /// <summary>
        /// Enable/disable forcing of disassociation after the BSTM request timer has been reached (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("bstmDisassociationImminent")]
        public Input<string>? BstmDisassociationImminent { get; set; }

        /// <summary>
        /// Time interval for client to voluntarily leave AP before forcing a disassociation due to AP load-balancing (0 to 30, default = 10).
        /// </summary>
        [Input("bstmLoadBalancingDisassocTimer")]
        public Input<int>? BstmLoadBalancingDisassocTimer { get; set; }

        /// <summary>
        /// Time interval for client to voluntarily leave AP before forcing a disassociation due to low RSSI (0 to 2000, default = 200).
        /// </summary>
        [Input("bstmRssiDisassocTimer")]
        public Input<int>? BstmRssiDisassocTimer { get; set; }

        /// <summary>
        /// Local-bridging captive portal ac-name.
        /// </summary>
        [Input("captivePortalAcName")]
        public Input<string>? CaptivePortalAcName { get; set; }

        /// <summary>
        /// Hard timeout - AP will always clear the session after timeout regardless of traffic (0 - 864000 sec, default = 0).
        /// </summary>
        [Input("captivePortalAuthTimeout")]
        public Input<int>? CaptivePortalAuthTimeout { get; set; }

        [Input("captivePortalMacauthRadiusSecret")]
        private Input<string>? _captivePortalMacauthRadiusSecret;

        /// <summary>
        /// Secret key to access the macauth RADIUS server.
        /// </summary>
        public Input<string>? CaptivePortalMacauthRadiusSecret
        {
            get => _captivePortalMacauthRadiusSecret;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _captivePortalMacauthRadiusSecret = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// Captive portal external RADIUS server domain name or IP address.
        /// </summary>
        [Input("captivePortalMacauthRadiusServer")]
        public Input<string>? CaptivePortalMacauthRadiusServer { get; set; }

        [Input("captivePortalRadiusSecret")]
        private Input<string>? _captivePortalRadiusSecret;

        /// <summary>
        /// Secret key to access the RADIUS server.
        /// </summary>
        public Input<string>? CaptivePortalRadiusSecret
        {
            get => _captivePortalRadiusSecret;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _captivePortalRadiusSecret = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// Captive portal RADIUS server domain name or IP address.
        /// </summary>
        [Input("captivePortalRadiusServer")]
        public Input<string>? CaptivePortalRadiusServer { get; set; }

        /// <summary>
        /// Session timeout interval (0 - 864000 sec, default = 0).
        /// </summary>
        [Input("captivePortalSessionTimeoutInterval")]
        public Input<int>? CaptivePortalSessionTimeoutInterval { get; set; }

        /// <summary>
        /// Enable/disable DHCP address enforcement (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dhcpAddressEnforcement")]
        public Input<string>? DhcpAddressEnforcement { get; set; }

        /// <summary>
        /// DHCP lease time in seconds for NAT IP address.
        /// </summary>
        [Input("dhcpLeaseTime")]
        public Input<int>? DhcpLeaseTime { get; set; }

        /// <summary>
        /// Enable/disable insertion of DHCP option 43 (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dhcpOption43Insertion")]
        public Input<string>? DhcpOption43Insertion { get; set; }

        /// <summary>
        /// Enable/disable DHCP option 82 circuit-id insert (default = disable).
        /// </summary>
        [Input("dhcpOption82CircuitIdInsertion")]
        public Input<string>? DhcpOption82CircuitIdInsertion { get; set; }

        /// <summary>
        /// Enable/disable DHCP option 82 insert (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dhcpOption82Insertion")]
        public Input<string>? DhcpOption82Insertion { get; set; }

        /// <summary>
        /// Enable/disable DHCP option 82 remote-id insert (default = disable). Valid values: `style-1`, `disable`.
        /// </summary>
        [Input("dhcpOption82RemoteIdInsertion")]
        public Input<string>? DhcpOption82RemoteIdInsertion { get; set; }

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Input("dynamicSortSubtable")]
        public Input<string>? DynamicSortSubtable { get; set; }

        /// <summary>
        /// Enable/disable dynamic VLAN assignment. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dynamicVlan")]
        public Input<string>? DynamicVlan { get; set; }

        /// <summary>
        /// Enable/disable EAP re-authentication for WPA-Enterprise security. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("eapReauth")]
        public Input<string>? EapReauth { get; set; }

        /// <summary>
        /// EAP re-authentication interval (1800 - 864000 sec, default = 86400).
        /// </summary>
        [Input("eapReauthIntv")]
        public Input<int>? EapReauthIntv { get; set; }

        /// <summary>
        /// Enable/disable retransmission of EAPOL-Key frames (message 3/4 and group message 1/2) (default = enable). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("eapolKeyRetries")]
        public Input<string>? EapolKeyRetries { get; set; }

        /// <summary>
        /// Encryption protocol to use (only available when security is set to a WPA type). Valid values: `TKIP`, `AES`, `TKIP-AES`.
        /// </summary>
        [Input("encrypt")]
        public Input<string>? Encrypt { get; set; }

        /// <summary>
        /// Enable/disable fast roaming or pre-authentication with external APs not managed by the FortiGate (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("externalFastRoaming")]
        public Input<string>? ExternalFastRoaming { get; set; }

        /// <summary>
        /// URL of external authentication logout server.
        /// </summary>
        [Input("externalLogout")]
        public Input<string>? ExternalLogout { get; set; }

        /// <summary>
        /// URL of external authentication web server.
        /// </summary>
        [Input("externalWeb")]
        public Input<string>? ExternalWeb { get; set; }

        /// <summary>
        /// URL query parameter detection (default = auto-detect). Valid values: `auto-detect`, `no-query-string`, `partial-query-string`.
        /// </summary>
        [Input("externalWebFormat")]
        public Input<string>? ExternalWebFormat { get; set; }

        /// <summary>
        /// Enable/disable 802.11r Fast BSS Transition (FT) (default = disable). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("fastBssTransition")]
        public Input<string>? FastBssTransition { get; set; }

        /// <summary>
        /// Enable/disable fast-roaming, or pre-authentication, where supported by clients (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("fastRoaming")]
        public Input<string>? FastRoaming { get; set; }

        /// <summary>
        /// Mobility domain identifier in FT (1 - 65535, default = 1000).
        /// </summary>
        [Input("ftMobilityDomain")]
        public Input<int>? FtMobilityDomain { get; set; }

        /// <summary>
        /// Enable/disable FT over the Distribution System (DS). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("ftOverDs")]
        public Input<string>? FtOverDs { get; set; }

        /// <summary>
        /// Lifetime of the PMK-R0 key in FT, 1-65535 minutes.
        /// </summary>
        [Input("ftR0KeyLifetime")]
        public Input<int>? FtR0KeyLifetime { get; set; }

        /// <summary>
        /// GAS comeback delay (0 or 100 - 10000 milliseconds, default = 500).
        /// </summary>
        [Input("gasComebackDelay")]
        public Input<int>? GasComebackDelay { get; set; }

        /// <summary>
        /// GAS fragmentation limit (512 - 4096, default = 1024).
        /// </summary>
        [Input("gasFragmentationLimit")]
        public Input<int>? GasFragmentationLimit { get; set; }

        /// <summary>
        /// Enable/disable GTK rekey for WPA security. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("gtkRekey")]
        public Input<string>? GtkRekey { get; set; }

        /// <summary>
        /// GTK rekey interval (1800 - 864000 sec, default = 86400).
        /// </summary>
        [Input("gtkRekeyIntv")]
        public Input<int>? GtkRekeyIntv { get; set; }

        /// <summary>
        /// Enable/disable 802.11ax high efficiency (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("highEfficiency")]
        public Input<string>? HighEfficiency { get; set; }

        /// <summary>
        /// Hotspot 2.0 profile name.
        /// </summary>
        [Input("hotspot20Profile")]
        public Input<string>? Hotspot20Profile { get; set; }

        /// <summary>
        /// Enable/disable IGMP snooping. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("igmpSnooping")]
        public Input<string>? IgmpSnooping { get; set; }

        /// <summary>
        /// Enable/disable blocking communication between clients on the same SSID (called intra-SSID privacy) (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("intraVapPrivacy")]
        public Input<string>? IntraVapPrivacy { get; set; }

        /// <summary>
        /// IP address and subnet mask for the local standalone NAT subnet.
        /// </summary>
        [Input("ip")]
        public Input<string>? Ip { get; set; }

        /// <summary>
        /// IPS sensor name.
        /// </summary>
        [Input("ipsSensor")]
        public Input<string>? IpsSensor { get; set; }

        /// <summary>
        /// Optional rules of IPv6 packets. For example, you can keep RA, RS and so on off of the wireless network. Valid values: `drop-icmp6ra`, `drop-icmp6rs`, `drop-llmnr6`, `drop-icmp6mld2`, `drop-dhcp6s`, `drop-dhcp6c`, `ndp-proxy`, `drop-ns-dad`, `drop-ns-nondad`.
        /// </summary>
        [Input("ipv6Rules")]
        public Input<string>? Ipv6Rules { get; set; }

        [Input("key")]
        private Input<string>? _key;

        /// <summary>
        /// WEP Key.
        /// </summary>
        public Input<string>? Key
        {
            get => _key;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _key = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// WEP key index (1 - 4).
        /// </summary>
        [Input("keyindex")]
        public Input<int>? Keyindex { get; set; }

        /// <summary>
        /// Enable/disable layer 3 roaming (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("l3Roaming")]
        public Input<string>? L3Roaming { get; set; }

        /// <summary>
        /// Select the way that layer 3 roaming traffic is passed (default = direct). Valid values: `direct`, `indirect`.
        /// </summary>
        [Input("l3RoamingMode")]
        public Input<string>? L3RoamingMode { get; set; }

        /// <summary>
        /// VAP low-density parity-check (LDPC) coding configuration. Valid values: `disable`, `rx`, `tx`, `rxtx`.
        /// </summary>
        [Input("ldpc")]
        public Input<string>? Ldpc { get; set; }

        /// <summary>
        /// Enable/disable AP local authentication. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("localAuthentication")]
        public Input<string>? LocalAuthentication { get; set; }

        /// <summary>
        /// Enable/disable bridging of wireless and Ethernet interfaces on the FortiAP (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("localBridging")]
        public Input<string>? LocalBridging { get; set; }

        /// <summary>
        /// Allow/deny traffic destined for a Class A, B, or C private IP address (default = allow). Valid values: `allow`, `deny`.
        /// </summary>
        [Input("localLan")]
        public Input<string>? LocalLan { get; set; }

        /// <summary>
        /// Enable/disable AP local standalone (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("localStandalone")]
        public Input<string>? LocalStandalone { get; set; }

        /// <summary>
        /// Enable/disable AP local standalone DNS. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("localStandaloneDns")]
        public Input<string>? LocalStandaloneDns { get; set; }

        /// <summary>
        /// IPv4 addresses for the local standalone DNS.
        /// </summary>
        [Input("localStandaloneDnsIp")]
        public Input<string>? LocalStandaloneDnsIp { get; set; }

        /// <summary>
        /// Enable/disable AP local standalone NAT mode. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("localStandaloneNat")]
        public Input<string>? LocalStandaloneNat { get; set; }

        /// <summary>
        /// Enable/disable MAC authentication bypass. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("macAuthBypass")]
        public Input<string>? MacAuthBypass { get; set; }

        /// <summary>
        /// MAC called station delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Input("macCalledStationDelimiter")]
        public Input<string>? MacCalledStationDelimiter { get; set; }

        /// <summary>
        /// MAC calling station delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Input("macCallingStationDelimiter")]
        public Input<string>? MacCallingStationDelimiter { get; set; }

        /// <summary>
        /// MAC case (default = uppercase). Valid values: `uppercase`, `lowercase`.
        /// </summary>
        [Input("macCase")]
        public Input<string>? MacCase { get; set; }

        /// <summary>
        /// Enable/disable MAC filtering to block wireless clients by mac address. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("macFilter")]
        public Input<string>? MacFilter { get; set; }

        [Input("macFilterLists")]
        private InputList<Inputs.WirelesscontrollerVapMacFilterListArgs>? _macFilterLists;

        /// <summary>
        /// Create a list of MAC addresses for MAC address filtering. The structure of `mac_filter_list` block is documented below.
        /// </summary>
        public InputList<Inputs.WirelesscontrollerVapMacFilterListArgs> MacFilterLists
        {
            get => _macFilterLists ?? (_macFilterLists = new InputList<Inputs.WirelesscontrollerVapMacFilterListArgs>());
            set => _macFilterLists = value;
        }

        /// <summary>
        /// Allow or block clients with MAC addresses that are not in the filter list. Valid values: `allow`, `deny`.
        /// </summary>
        [Input("macFilterPolicyOther")]
        public Input<string>? MacFilterPolicyOther { get; set; }

        /// <summary>
        /// MAC authentication password delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Input("macPasswordDelimiter")]
        public Input<string>? MacPasswordDelimiter { get; set; }

        /// <summary>
        /// MAC authentication username delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Input("macUsernameDelimiter")]
        public Input<string>? MacUsernameDelimiter { get; set; }

        /// <summary>
        /// Maximum number of clients that can connect simultaneously to the VAP (default = 0, meaning no limitation).
        /// </summary>
        [Input("maxClients")]
        public Input<int>? MaxClients { get; set; }

        /// <summary>
        /// Maximum number of clients that can connect simultaneously to each radio (default = 0, meaning no limitation).
        /// </summary>
        [Input("maxClientsAp")]
        public Input<int>? MaxClientsAp { get; set; }

        /// <summary>
        /// Enable/disable Multiband Operation (default = disable). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("mbo")]
        public Input<string>? Mbo { get; set; }

        /// <summary>
        /// MBO cell data connection preference (0, 1, or 255, default = 1). Valid values: `excluded`, `prefer-not`, `prefer-use`.
        /// </summary>
        [Input("mboCellDataConnPref")]
        public Input<string>? MboCellDataConnPref { get; set; }

        /// <summary>
        /// Disable multicast enhancement when this many clients are receiving multicast traffic.
        /// </summary>
        [Input("meDisableThresh")]
        public Input<int>? MeDisableThresh { get; set; }

        /// <summary>
        /// Enable/disable using this VAP as a WiFi mesh backhaul (default = disable). This entry is only available when security is set to a WPA type or open. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("meshBackhaul")]
        public Input<string>? MeshBackhaul { get; set; }

        /// <summary>
        /// Enable/disable multiple pre-shared keys (PSKs.) Valid values: `enable`, `disable`.
        /// </summary>
        [Input("mpsk")]
        public Input<string>? Mpsk { get; set; }

        /// <summary>
        /// Number of pre-shared keys (PSKs) to allow if multiple pre-shared keys are enabled.
        /// </summary>
        [Input("mpskConcurrentClients")]
        public Input<int>? MpskConcurrentClients { get; set; }

        [Input("mpskKeys")]
        private InputList<Inputs.WirelesscontrollerVapMpskKeyArgs>? _mpskKeys;

        /// <summary>
        /// Pre-shared keys that can be used to connect to this virtual access point. The structure of `mpsk_key` block is documented below.
        /// </summary>
        public InputList<Inputs.WirelesscontrollerVapMpskKeyArgs> MpskKeys
        {
            get => _mpskKeys ?? (_mpskKeys = new InputList<Inputs.WirelesscontrollerVapMpskKeyArgs>());
            set => _mpskKeys = value;
        }

        /// <summary>
        /// MPSK profile name.
        /// </summary>
        [Input("mpskProfile")]
        public Input<string>? MpskProfile { get; set; }

        /// <summary>
        /// Enable/disable Multi-user MIMO (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("muMimo")]
        public Input<string>? MuMimo { get; set; }

        /// <summary>
        /// Enable/disable converting multicast to unicast to improve performance (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("multicastEnhance")]
        public Input<string>? MulticastEnhance { get; set; }

        /// <summary>
        /// Multicast rate (0, 6000, 12000, or 24000 kbps, default = 0). Valid values: `0`, `6000`, `12000`, `24000`.
        /// </summary>
        [Input("multicastRate")]
        public Input<string>? MulticastRate { get; set; }

        /// <summary>
        /// Enable/disable network access control. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("nac")]
        public Input<string>? Nac { get; set; }

        /// <summary>
        /// NAC profile name.
        /// </summary>
        [Input("nacProfile")]
        public Input<string>? NacProfile { get; set; }

        /// <summary>
        /// Virtual AP name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// Enable/disable dual-band neighbor report (default = disable). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("neighborReportDualBand")]
        public Input<string>? NeighborReportDualBand { get; set; }

        /// <summary>
        /// Enable/disable Opportunistic Key Caching (OKC) (default = enable). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("okc")]
        public Input<string>? Okc { get; set; }

        /// <summary>
        /// Enable/disable OSEN as part of key management (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("osen")]
        public Input<string>? Osen { get; set; }

        /// <summary>
        /// OWE-Groups. Valid values: `19`, `20`, `21`.
        /// </summary>
        [Input("oweGroups")]
        public Input<string>? OweGroups { get; set; }

        /// <summary>
        /// Enable/disable OWE transition mode support. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("oweTransition")]
        public Input<string>? OweTransition { get; set; }

        /// <summary>
        /// OWE transition mode peer SSID.
        /// </summary>
        [Input("oweTransitionSsid")]
        public Input<string>? OweTransitionSsid { get; set; }

        [Input("passphrase")]
        private Input<string>? _passphrase;

        /// <summary>
        /// WPA pre-shard key (PSK) to be used to authenticate WiFi users.
        /// </summary>
        public Input<string>? Passphrase
        {
            get => _passphrase;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _passphrase = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// Protected Management Frames (PMF) support (default = disable). Valid values: `disable`, `enable`, `optional`.
        /// </summary>
        [Input("pmf")]
        public Input<string>? Pmf { get; set; }

        /// <summary>
        /// Protected Management Frames (PMF) comeback maximum timeout (1-20 sec).
        /// </summary>
        [Input("pmfAssocComebackTimeout")]
        public Input<int>? PmfAssocComebackTimeout { get; set; }

        /// <summary>
        /// Protected Management Frames (PMF) SA query retry timeout interval (1 - 5 100s of msec).
        /// </summary>
        [Input("pmfSaQueryRetryTimeout")]
        public Input<int>? PmfSaQueryRetryTimeout { get; set; }

        /// <summary>
        /// Enable/disable LAN port MAC authentication (default = disable). Valid values: `disable`, `radius`, `address-group`.
        /// </summary>
        [Input("portMacauth")]
        public Input<string>? PortMacauth { get; set; }

        /// <summary>
        /// LAN port MAC authentication re-authentication timeout value (default = 7200 sec).
        /// </summary>
        [Input("portMacauthReauthTimeout")]
        public Input<int>? PortMacauthReauthTimeout { get; set; }

        /// <summary>
        /// LAN port MAC authentication idle timeout value (default = 600 sec).
        /// </summary>
        [Input("portMacauthTimeout")]
        public Input<int>? PortMacauthTimeout { get; set; }

        /// <summary>
        /// Replacement message group for this VAP (only available when security is set to a captive portal type).
        /// </summary>
        [Input("portalMessageOverrideGroup")]
        public Input<string>? PortalMessageOverrideGroup { get; set; }

        /// <summary>
        /// Individual message overrides. The structure of `portal_message_overrides` block is documented below.
        /// </summary>
        [Input("portalMessageOverrides")]
        public Input<Inputs.WirelesscontrollerVapPortalMessageOverridesArgs>? PortalMessageOverrides { get; set; }

        /// <summary>
        /// Captive portal functionality. Configure how the captive portal authenticates users and whether it includes a disclaimer.
        /// </summary>
        [Input("portalType")]
        public Input<string>? PortalType { get; set; }

        /// <summary>
        /// Primary wireless access gateway profile name.
        /// </summary>
        [Input("primaryWagProfile")]
        public Input<string>? PrimaryWagProfile { get; set; }

        /// <summary>
        /// Enable/disable probe response suppression (to ignore weak signals) (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("probeRespSuppression")]
        public Input<string>? ProbeRespSuppression { get; set; }

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the AP response to probe requests (-95 to -20, default = -80).
        /// </summary>
        [Input("probeRespThreshold")]
        public Input<string>? ProbeRespThreshold { get; set; }

        /// <summary>
        /// Enable/disable PTK rekey for WPA-Enterprise security. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ptkRekey")]
        public Input<string>? PtkRekey { get; set; }

        /// <summary>
        /// PTK rekey interval (1800 - 864000 sec, default = 86400).
        /// </summary>
        [Input("ptkRekeyIntv")]
        public Input<int>? PtkRekeyIntv { get; set; }

        /// <summary>
        /// Quality of service profile name.
        /// </summary>
        [Input("qosProfile")]
        public Input<string>? QosProfile { get; set; }

        /// <summary>
        /// Enable/disable station quarantine (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("quarantine")]
        public Input<string>? Quarantine { get; set; }

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the AP response to receive a packet in 2.4G band (-95 to -20, default = -79).
        /// </summary>
        [Input("radio2gThreshold")]
        public Input<string>? Radio2gThreshold { get; set; }

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the AP response to receive a packet in 5G band(-95 to -20, default = -76).
        /// </summary>
        [Input("radio5gThreshold")]
        public Input<string>? Radio5gThreshold { get; set; }

        /// <summary>
        /// Enable/disable software radio sensitivity (to ignore weak signals) (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("radioSensitivity")]
        public Input<string>? RadioSensitivity { get; set; }

        /// <summary>
        /// Enable/disable RADIUS-based MAC authentication of clients (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("radiusMacAuth")]
        public Input<string>? RadiusMacAuth { get; set; }

        /// <summary>
        /// RADIUS-based MAC authentication server.
        /// </summary>
        [Input("radiusMacAuthServer")]
        public Input<string>? RadiusMacAuthServer { get; set; }

        [Input("radiusMacAuthUsergroups")]
        private InputList<Inputs.WirelesscontrollerVapRadiusMacAuthUsergroupArgs>? _radiusMacAuthUsergroups;

        /// <summary>
        /// Selective user groups that are permitted for RADIUS mac authentication. The structure of `radius_mac_auth_usergroups` block is documented below.
        /// </summary>
        public InputList<Inputs.WirelesscontrollerVapRadiusMacAuthUsergroupArgs> RadiusMacAuthUsergroups
        {
            get => _radiusMacAuthUsergroups ?? (_radiusMacAuthUsergroups = new InputList<Inputs.WirelesscontrollerVapRadiusMacAuthUsergroupArgs>());
            set => _radiusMacAuthUsergroups = value;
        }

        /// <summary>
        /// Enable/disable RADIUS-based MAC authentication of clients for MPSK authentication (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("radiusMacMpskAuth")]
        public Input<string>? RadiusMacMpskAuth { get; set; }

        /// <summary>
        /// RADIUS MAC MPSK cache timeout interval (1800 - 864000, default = 86400).
        /// </summary>
        [Input("radiusMacMpskTimeout")]
        public Input<int>? RadiusMacMpskTimeout { get; set; }

        /// <summary>
        /// RADIUS server to be used to authenticate WiFi users.
        /// </summary>
        [Input("radiusServer")]
        public Input<string>? RadiusServer { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11a. Valid values: `1`, `1-basic`, `2`, `2-basic`, `5.5`, `5.5-basic`, `11`, `11-basic`, `6`, `6-basic`, `9`, `9-basic`, `12`, `12-basic`, `18`, `18-basic`, `24`, `24-basic`, `36`, `36-basic`, `48`, `48-basic`, `54`, `54-basic`.
        /// </summary>
        [Input("rates11a")]
        public Input<string>? Rates11a { get; set; }

        /// <summary>
        /// Comma separated list of max supported VHT MCS for spatial streams 1 through 8.
        /// </summary>
        [Input("rates11acMcsMap")]
        public Input<string>? Rates11acMcsMap { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11ac with 1 or 2 spatial streams. Valid values: `mcs0/1`, `mcs1/1`, `mcs2/1`, `mcs3/1`, `mcs4/1`, `mcs5/1`, `mcs6/1`, `mcs7/1`, `mcs8/1`, `mcs9/1`, `mcs10/1`, `mcs11/1`, `mcs0/2`, `mcs1/2`, `mcs2/2`, `mcs3/2`, `mcs4/2`, `mcs5/2`, `mcs6/2`, `mcs7/2`, `mcs8/2`, `mcs9/2`, `mcs10/2`, `mcs11/2`.
        /// </summary>
        [Input("rates11acSs12")]
        public Input<string>? Rates11acSs12 { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11ac with 3 or 4 spatial streams. Valid values: `mcs0/3`, `mcs1/3`, `mcs2/3`, `mcs3/3`, `mcs4/3`, `mcs5/3`, `mcs6/3`, `mcs7/3`, `mcs8/3`, `mcs9/3`, `mcs10/3`, `mcs11/3`, `mcs0/4`, `mcs1/4`, `mcs2/4`, `mcs3/4`, `mcs4/4`, `mcs5/4`, `mcs6/4`, `mcs7/4`, `mcs8/4`, `mcs9/4`, `mcs10/4`, `mcs11/4`.
        /// </summary>
        [Input("rates11acSs34")]
        public Input<string>? Rates11acSs34 { get; set; }

        /// <summary>
        /// Comma separated list of max supported HE MCS for spatial streams 1 through 8.
        /// </summary>
        [Input("rates11axMcsMap")]
        public Input<string>? Rates11axMcsMap { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11ax with 1 or 2 spatial streams. Valid values: `mcs0/1`, `mcs1/1`, `mcs2/1`, `mcs3/1`, `mcs4/1`, `mcs5/1`, `mcs6/1`, `mcs7/1`, `mcs8/1`, `mcs9/1`, `mcs10/1`, `mcs11/1`, `mcs0/2`, `mcs1/2`, `mcs2/2`, `mcs3/2`, `mcs4/2`, `mcs5/2`, `mcs6/2`, `mcs7/2`, `mcs8/2`, `mcs9/2`, `mcs10/2`, `mcs11/2`.
        /// </summary>
        [Input("rates11axSs12")]
        public Input<string>? Rates11axSs12 { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11ax with 3 or 4 spatial streams. Valid values: `mcs0/3`, `mcs1/3`, `mcs2/3`, `mcs3/3`, `mcs4/3`, `mcs5/3`, `mcs6/3`, `mcs7/3`, `mcs8/3`, `mcs9/3`, `mcs10/3`, `mcs11/3`, `mcs0/4`, `mcs1/4`, `mcs2/4`, `mcs3/4`, `mcs4/4`, `mcs5/4`, `mcs6/4`, `mcs7/4`, `mcs8/4`, `mcs9/4`, `mcs10/4`, `mcs11/4`.
        /// </summary>
        [Input("rates11axSs34")]
        public Input<string>? Rates11axSs34 { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11b/g. Valid values: `1`, `1-basic`, `2`, `2-basic`, `5.5`, `5.5-basic`, `11`, `11-basic`, `6`, `6-basic`, `9`, `9-basic`, `12`, `12-basic`, `18`, `18-basic`, `24`, `24-basic`, `36`, `36-basic`, `48`, `48-basic`, `54`, `54-basic`.
        /// </summary>
        [Input("rates11bg")]
        public Input<string>? Rates11bg { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11n with 1 or 2 spatial streams. Valid values: `mcs0/1`, `mcs1/1`, `mcs2/1`, `mcs3/1`, `mcs4/1`, `mcs5/1`, `mcs6/1`, `mcs7/1`, `mcs8/2`, `mcs9/2`, `mcs10/2`, `mcs11/2`, `mcs12/2`, `mcs13/2`, `mcs14/2`, `mcs15/2`.
        /// </summary>
        [Input("rates11nSs12")]
        public Input<string>? Rates11nSs12 { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11n with 3 or 4 spatial streams. Valid values: `mcs16/3`, `mcs17/3`, `mcs18/3`, `mcs19/3`, `mcs20/3`, `mcs21/3`, `mcs22/3`, `mcs23/3`, `mcs24/4`, `mcs25/4`, `mcs26/4`, `mcs27/4`, `mcs28/4`, `mcs29/4`, `mcs30/4`, `mcs31/4`.
        /// </summary>
        [Input("rates11nSs34")]
        public Input<string>? Rates11nSs34 { get; set; }

        /// <summary>
        /// SAE-Groups. Valid values: `19`, `20`, `21`.
        /// </summary>
        [Input("saeGroups")]
        public Input<string>? SaeGroups { get; set; }

        /// <summary>
        /// Use hash-to-element-only mechanism for PWE derivation (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("saeH2eOnly")]
        public Input<string>? SaeH2eOnly { get; set; }

        [Input("saePassword")]
        private Input<string>? _saePassword;

        /// <summary>
        /// WPA3 SAE password to be used to authenticate WiFi users.
        /// </summary>
        public Input<string>? SaePassword
        {
            get => _saePassword;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _saePassword = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// Enable/disable WPA3 SAE-PK (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("saePk")]
        public Input<string>? SaePk { get; set; }

        /// <summary>
        /// Private key used for WPA3 SAE-PK authentication.
        /// </summary>
        [Input("saePrivateKey")]
        public Input<string>? SaePrivateKey { get; set; }

        /// <summary>
        /// Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: `disable`, `monitor`, `block`.
        /// </summary>
        [Input("scanBotnetConnections")]
        public Input<string>? ScanBotnetConnections { get; set; }

        /// <summary>
        /// VAP schedule name.
        /// </summary>
        [Input("schedule")]
        public Input<string>? Schedule { get; set; }

        /// <summary>
        /// Secondary wireless access gateway profile name.
        /// </summary>
        [Input("secondaryWagProfile")]
        public Input<string>? SecondaryWagProfile { get; set; }

        /// <summary>
        /// Security mode for the wireless interface (default = wpa2-only-personal).
        /// </summary>
        [Input("security")]
        public Input<string>? Security { get; set; }

        /// <summary>
        /// Optional security exempt list for captive portal authentication.
        /// </summary>
        [Input("securityExemptList")]
        public Input<string>? SecurityExemptList { get; set; }

        /// <summary>
        /// Enable/disable obsolete security options. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("securityObsoleteOption")]
        public Input<string>? SecurityObsoleteOption { get; set; }

        /// <summary>
        /// Optional URL for redirecting users after they pass captive portal authentication.
        /// </summary>
        [Input("securityRedirectUrl")]
        public Input<string>? SecurityRedirectUrl { get; set; }

        [Input("selectedUsergroups")]
        private InputList<Inputs.WirelesscontrollerVapSelectedUsergroupArgs>? _selectedUsergroups;

        /// <summary>
        /// Selective user groups that are permitted to authenticate. The structure of `selected_usergroups` block is documented below.
        /// </summary>
        public InputList<Inputs.WirelesscontrollerVapSelectedUsergroupArgs> SelectedUsergroups
        {
            get => _selectedUsergroups ?? (_selectedUsergroups = new InputList<Inputs.WirelesscontrollerVapSelectedUsergroupArgs>());
            set => _selectedUsergroups = value;
        }

        /// <summary>
        /// Enable/disable split tunneling (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("splitTunneling")]
        public Input<string>? SplitTunneling { get; set; }

        /// <summary>
        /// IEEE 802.11 service set identifier (SSID) for the wireless interface. Users who wish to use the wireless network must configure their computers to access this SSID name.
        /// </summary>
        [Input("ssid")]
        public Input<string>? Ssid { get; set; }

        /// <summary>
        /// Enable/disable sticky client remove to maintain good signal level clients in SSID. (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("stickyClientRemove")]
        public Input<string>? StickyClientRemove { get; set; }

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the 2G client to be serviced by the AP (-95 to -20, default = -79).
        /// </summary>
        [Input("stickyClientThreshold2g")]
        public Input<string>? StickyClientThreshold2g { get; set; }

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the 5G client to be serviced by the AP (-95 to -20, default = -76).
        /// </summary>
        [Input("stickyClientThreshold5g")]
        public Input<string>? StickyClientThreshold5g { get; set; }

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the 6G client to be serviced by the AP (-95 to -20, default = -76).
        /// </summary>
        [Input("stickyClientThreshold6g")]
        public Input<string>? StickyClientThreshold6g { get; set; }

        /// <summary>
        /// Enable/disable 802.11ax target wake time (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("targetWakeTime")]
        public Input<string>? TargetWakeTime { get; set; }

        /// <summary>
        /// Enable/disable TKIP counter measure. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tkipCounterMeasure")]
        public Input<string>? TkipCounterMeasure { get; set; }

        /// <summary>
        /// The time interval to send echo to both primary and secondary tunnel peers (1 - 65535 sec, default = 300).
        /// </summary>
        [Input("tunnelEchoInterval")]
        public Input<int>? TunnelEchoInterval { get; set; }

        /// <summary>
        /// The time interval for secondary tunnel to fall back to primary tunnel (0 - 65535 sec, default = 7200).
        /// </summary>
        [Input("tunnelFallbackInterval")]
        public Input<int>? TunnelFallbackInterval { get; set; }

        [Input("usergroups")]
        private InputList<Inputs.WirelesscontrollerVapUsergroupArgs>? _usergroups;

        /// <summary>
        /// Firewall user group to be used to authenticate WiFi users. The structure of `usergroup` block is documented below.
        /// </summary>
        public InputList<Inputs.WirelesscontrollerVapUsergroupArgs> Usergroups
        {
            get => _usergroups ?? (_usergroups = new InputList<Inputs.WirelesscontrollerVapUsergroupArgs>());
            set => _usergroups = value;
        }

        /// <summary>
        /// Enable/disable UTM logging. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("utmLog")]
        public Input<string>? UtmLog { get; set; }

        /// <summary>
        /// UTM profile name.
        /// </summary>
        [Input("utmProfile")]
        public Input<string>? UtmProfile { get; set; }

        /// <summary>
        /// Enable to add one or more security profiles (AV, IPS, etc.) to the VAP. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("utmStatus")]
        public Input<string>? UtmStatus { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        /// <summary>
        /// Enable/disable automatic management of SSID VLAN interface. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("vlanAuto")]
        public Input<string>? VlanAuto { get; set; }

        [Input("vlanNames")]
        private InputList<Inputs.WirelesscontrollerVapVlanNameArgs>? _vlanNames;

        /// <summary>
        /// Table for mapping VLAN name to VLAN ID. The structure of `vlan_name` block is documented below.
        /// </summary>
        public InputList<Inputs.WirelesscontrollerVapVlanNameArgs> VlanNames
        {
            get => _vlanNames ?? (_vlanNames = new InputList<Inputs.WirelesscontrollerVapVlanNameArgs>());
            set => _vlanNames = value;
        }

        /// <summary>
        /// Enable/disable VLAN pooling, to allow grouping of multiple wireless controller VLANs into VLAN pools (default = disable). When set to wtp-group, VLAN pooling occurs with VLAN assignment by wtp-group. Valid values: `wtp-group`, `round-robin`, `hash`, `disable`.
        /// </summary>
        [Input("vlanPooling")]
        public Input<string>? VlanPooling { get; set; }

        [Input("vlanPools")]
        private InputList<Inputs.WirelesscontrollerVapVlanPoolArgs>? _vlanPools;

        /// <summary>
        /// VLAN pool. The structure of `vlan_pool` block is documented below.
        /// </summary>
        public InputList<Inputs.WirelesscontrollerVapVlanPoolArgs> VlanPools
        {
            get => _vlanPools ?? (_vlanPools = new InputList<Inputs.WirelesscontrollerVapVlanPoolArgs>());
            set => _vlanPools = value;
        }

        /// <summary>
        /// Optional VLAN ID.
        /// </summary>
        [Input("vlanid")]
        public Input<int>? Vlanid { get; set; }

        /// <summary>
        /// Enable/disable 802.11k and 802.11v assisted Voice-Enterprise roaming (default = disable). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("voiceEnterprise")]
        public Input<string>? VoiceEnterprise { get; set; }

        /// <summary>
        /// WebFilter profile name.
        /// </summary>
        [Input("webfilterProfile")]
        public Input<string>? WebfilterProfile { get; set; }

        public WirelesscontrollerVapArgs()
        {
        }
        public static new WirelesscontrollerVapArgs Empty => new WirelesscontrollerVapArgs();
    }

    public sealed class WirelesscontrollerVapState : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// access-control-list profile name.
        /// </summary>
        [Input("accessControlList")]
        public Input<string>? AccessControlList { get; set; }

        /// <summary>
        /// WiFi RADIUS accounting interim interval (60 - 86400 sec, default = 0).
        /// </summary>
        [Input("acctInterimInterval")]
        public Input<int>? AcctInterimInterval { get; set; }

        /// <summary>
        /// Additional AKMs. Valid values: `akm6`.
        /// </summary>
        [Input("additionalAkms")]
        public Input<string>? AdditionalAkms { get; set; }

        /// <summary>
        /// Address group ID.
        /// </summary>
        [Input("addressGroup")]
        public Input<string>? AddressGroup { get; set; }

        /// <summary>
        /// Configure MAC address filtering policy for MAC addresses that are in the address-group. Valid values: `disable`, `allow`, `deny`.
        /// </summary>
        [Input("addressGroupPolicy")]
        public Input<string>? AddressGroupPolicy { get; set; }

        /// <summary>
        /// Alias.
        /// </summary>
        [Input("alias")]
        public Input<string>? Alias { get; set; }

        /// <summary>
        /// AntiVirus profile name.
        /// </summary>
        [Input("antivirusProfile")]
        public Input<string>? AntivirusProfile { get; set; }

        /// <summary>
        /// Enable/disable application detection engine (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("applicationDetectionEngine")]
        public Input<string>? ApplicationDetectionEngine { get; set; }

        /// <summary>
        /// Enable/disable application attribute based DSCP marking (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("applicationDscpMarking")]
        public Input<string>? ApplicationDscpMarking { get; set; }

        /// <summary>
        /// Application control list name.
        /// </summary>
        [Input("applicationList")]
        public Input<string>? ApplicationList { get; set; }

        /// <summary>
        /// Application report interval (30 - 864000 sec, default = 120).
        /// </summary>
        [Input("applicationReportIntv")]
        public Input<int>? ApplicationReportIntv { get; set; }

        /// <summary>
        /// Airtime weight in percentage (default = 20).
        /// </summary>
        [Input("atfWeight")]
        public Input<int>? AtfWeight { get; set; }

        /// <summary>
        /// Authentication protocol. Valid values: `psk`, `radius`, `usergroup`.
        /// </summary>
        [Input("auth")]
        public Input<string>? Auth { get; set; }

        /// <summary>
        /// HTTPS server certificate.
        /// </summary>
        [Input("authCert")]
        public Input<string>? AuthCert { get; set; }

        /// <summary>
        /// Address of captive portal.
        /// </summary>
        [Input("authPortalAddr")]
        public Input<string>? AuthPortalAddr { get; set; }

        /// <summary>
        /// Fortinet beacon advertising IE data   (default = empty). Valid values: `name`, `model`, `serial-number`.
        /// </summary>
        [Input("beaconAdvertising")]
        public Input<string>? BeaconAdvertising { get; set; }

        /// <summary>
        /// Enable/disable broadcasting the SSID (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("broadcastSsid")]
        public Input<string>? BroadcastSsid { get; set; }

        /// <summary>
        /// Optional suppression of broadcast messages. For example, you can keep DHCP messages, ARP broadcasts, and so on off of the wireless network.
        /// </summary>
        [Input("broadcastSuppression")]
        public Input<string>? BroadcastSuppression { get; set; }

        /// <summary>
        /// Enable/disable 802.11ax partial BSS color (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("bssColorPartial")]
        public Input<string>? BssColorPartial { get; set; }

        /// <summary>
        /// Enable/disable forcing of disassociation after the BSTM request timer has been reached (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("bstmDisassociationImminent")]
        public Input<string>? BstmDisassociationImminent { get; set; }

        /// <summary>
        /// Time interval for client to voluntarily leave AP before forcing a disassociation due to AP load-balancing (0 to 30, default = 10).
        /// </summary>
        [Input("bstmLoadBalancingDisassocTimer")]
        public Input<int>? BstmLoadBalancingDisassocTimer { get; set; }

        /// <summary>
        /// Time interval for client to voluntarily leave AP before forcing a disassociation due to low RSSI (0 to 2000, default = 200).
        /// </summary>
        [Input("bstmRssiDisassocTimer")]
        public Input<int>? BstmRssiDisassocTimer { get; set; }

        /// <summary>
        /// Local-bridging captive portal ac-name.
        /// </summary>
        [Input("captivePortalAcName")]
        public Input<string>? CaptivePortalAcName { get; set; }

        /// <summary>
        /// Hard timeout - AP will always clear the session after timeout regardless of traffic (0 - 864000 sec, default = 0).
        /// </summary>
        [Input("captivePortalAuthTimeout")]
        public Input<int>? CaptivePortalAuthTimeout { get; set; }

        [Input("captivePortalMacauthRadiusSecret")]
        private Input<string>? _captivePortalMacauthRadiusSecret;

        /// <summary>
        /// Secret key to access the macauth RADIUS server.
        /// </summary>
        public Input<string>? CaptivePortalMacauthRadiusSecret
        {
            get => _captivePortalMacauthRadiusSecret;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _captivePortalMacauthRadiusSecret = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// Captive portal external RADIUS server domain name or IP address.
        /// </summary>
        [Input("captivePortalMacauthRadiusServer")]
        public Input<string>? CaptivePortalMacauthRadiusServer { get; set; }

        [Input("captivePortalRadiusSecret")]
        private Input<string>? _captivePortalRadiusSecret;

        /// <summary>
        /// Secret key to access the RADIUS server.
        /// </summary>
        public Input<string>? CaptivePortalRadiusSecret
        {
            get => _captivePortalRadiusSecret;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _captivePortalRadiusSecret = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// Captive portal RADIUS server domain name or IP address.
        /// </summary>
        [Input("captivePortalRadiusServer")]
        public Input<string>? CaptivePortalRadiusServer { get; set; }

        /// <summary>
        /// Session timeout interval (0 - 864000 sec, default = 0).
        /// </summary>
        [Input("captivePortalSessionTimeoutInterval")]
        public Input<int>? CaptivePortalSessionTimeoutInterval { get; set; }

        /// <summary>
        /// Enable/disable DHCP address enforcement (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dhcpAddressEnforcement")]
        public Input<string>? DhcpAddressEnforcement { get; set; }

        /// <summary>
        /// DHCP lease time in seconds for NAT IP address.
        /// </summary>
        [Input("dhcpLeaseTime")]
        public Input<int>? DhcpLeaseTime { get; set; }

        /// <summary>
        /// Enable/disable insertion of DHCP option 43 (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dhcpOption43Insertion")]
        public Input<string>? DhcpOption43Insertion { get; set; }

        /// <summary>
        /// Enable/disable DHCP option 82 circuit-id insert (default = disable).
        /// </summary>
        [Input("dhcpOption82CircuitIdInsertion")]
        public Input<string>? DhcpOption82CircuitIdInsertion { get; set; }

        /// <summary>
        /// Enable/disable DHCP option 82 insert (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dhcpOption82Insertion")]
        public Input<string>? DhcpOption82Insertion { get; set; }

        /// <summary>
        /// Enable/disable DHCP option 82 remote-id insert (default = disable). Valid values: `style-1`, `disable`.
        /// </summary>
        [Input("dhcpOption82RemoteIdInsertion")]
        public Input<string>? DhcpOption82RemoteIdInsertion { get; set; }

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Input("dynamicSortSubtable")]
        public Input<string>? DynamicSortSubtable { get; set; }

        /// <summary>
        /// Enable/disable dynamic VLAN assignment. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dynamicVlan")]
        public Input<string>? DynamicVlan { get; set; }

        /// <summary>
        /// Enable/disable EAP re-authentication for WPA-Enterprise security. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("eapReauth")]
        public Input<string>? EapReauth { get; set; }

        /// <summary>
        /// EAP re-authentication interval (1800 - 864000 sec, default = 86400).
        /// </summary>
        [Input("eapReauthIntv")]
        public Input<int>? EapReauthIntv { get; set; }

        /// <summary>
        /// Enable/disable retransmission of EAPOL-Key frames (message 3/4 and group message 1/2) (default = enable). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("eapolKeyRetries")]
        public Input<string>? EapolKeyRetries { get; set; }

        /// <summary>
        /// Encryption protocol to use (only available when security is set to a WPA type). Valid values: `TKIP`, `AES`, `TKIP-AES`.
        /// </summary>
        [Input("encrypt")]
        public Input<string>? Encrypt { get; set; }

        /// <summary>
        /// Enable/disable fast roaming or pre-authentication with external APs not managed by the FortiGate (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("externalFastRoaming")]
        public Input<string>? ExternalFastRoaming { get; set; }

        /// <summary>
        /// URL of external authentication logout server.
        /// </summary>
        [Input("externalLogout")]
        public Input<string>? ExternalLogout { get; set; }

        /// <summary>
        /// URL of external authentication web server.
        /// </summary>
        [Input("externalWeb")]
        public Input<string>? ExternalWeb { get; set; }

        /// <summary>
        /// URL query parameter detection (default = auto-detect). Valid values: `auto-detect`, `no-query-string`, `partial-query-string`.
        /// </summary>
        [Input("externalWebFormat")]
        public Input<string>? ExternalWebFormat { get; set; }

        /// <summary>
        /// Enable/disable 802.11r Fast BSS Transition (FT) (default = disable). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("fastBssTransition")]
        public Input<string>? FastBssTransition { get; set; }

        /// <summary>
        /// Enable/disable fast-roaming, or pre-authentication, where supported by clients (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("fastRoaming")]
        public Input<string>? FastRoaming { get; set; }

        /// <summary>
        /// Mobility domain identifier in FT (1 - 65535, default = 1000).
        /// </summary>
        [Input("ftMobilityDomain")]
        public Input<int>? FtMobilityDomain { get; set; }

        /// <summary>
        /// Enable/disable FT over the Distribution System (DS). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("ftOverDs")]
        public Input<string>? FtOverDs { get; set; }

        /// <summary>
        /// Lifetime of the PMK-R0 key in FT, 1-65535 minutes.
        /// </summary>
        [Input("ftR0KeyLifetime")]
        public Input<int>? FtR0KeyLifetime { get; set; }

        /// <summary>
        /// GAS comeback delay (0 or 100 - 10000 milliseconds, default = 500).
        /// </summary>
        [Input("gasComebackDelay")]
        public Input<int>? GasComebackDelay { get; set; }

        /// <summary>
        /// GAS fragmentation limit (512 - 4096, default = 1024).
        /// </summary>
        [Input("gasFragmentationLimit")]
        public Input<int>? GasFragmentationLimit { get; set; }

        /// <summary>
        /// Enable/disable GTK rekey for WPA security. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("gtkRekey")]
        public Input<string>? GtkRekey { get; set; }

        /// <summary>
        /// GTK rekey interval (1800 - 864000 sec, default = 86400).
        /// </summary>
        [Input("gtkRekeyIntv")]
        public Input<int>? GtkRekeyIntv { get; set; }

        /// <summary>
        /// Enable/disable 802.11ax high efficiency (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("highEfficiency")]
        public Input<string>? HighEfficiency { get; set; }

        /// <summary>
        /// Hotspot 2.0 profile name.
        /// </summary>
        [Input("hotspot20Profile")]
        public Input<string>? Hotspot20Profile { get; set; }

        /// <summary>
        /// Enable/disable IGMP snooping. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("igmpSnooping")]
        public Input<string>? IgmpSnooping { get; set; }

        /// <summary>
        /// Enable/disable blocking communication between clients on the same SSID (called intra-SSID privacy) (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("intraVapPrivacy")]
        public Input<string>? IntraVapPrivacy { get; set; }

        /// <summary>
        /// IP address and subnet mask for the local standalone NAT subnet.
        /// </summary>
        [Input("ip")]
        public Input<string>? Ip { get; set; }

        /// <summary>
        /// IPS sensor name.
        /// </summary>
        [Input("ipsSensor")]
        public Input<string>? IpsSensor { get; set; }

        /// <summary>
        /// Optional rules of IPv6 packets. For example, you can keep RA, RS and so on off of the wireless network. Valid values: `drop-icmp6ra`, `drop-icmp6rs`, `drop-llmnr6`, `drop-icmp6mld2`, `drop-dhcp6s`, `drop-dhcp6c`, `ndp-proxy`, `drop-ns-dad`, `drop-ns-nondad`.
        /// </summary>
        [Input("ipv6Rules")]
        public Input<string>? Ipv6Rules { get; set; }

        [Input("key")]
        private Input<string>? _key;

        /// <summary>
        /// WEP Key.
        /// </summary>
        public Input<string>? Key
        {
            get => _key;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _key = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// WEP key index (1 - 4).
        /// </summary>
        [Input("keyindex")]
        public Input<int>? Keyindex { get; set; }

        /// <summary>
        /// Enable/disable layer 3 roaming (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("l3Roaming")]
        public Input<string>? L3Roaming { get; set; }

        /// <summary>
        /// Select the way that layer 3 roaming traffic is passed (default = direct). Valid values: `direct`, `indirect`.
        /// </summary>
        [Input("l3RoamingMode")]
        public Input<string>? L3RoamingMode { get; set; }

        /// <summary>
        /// VAP low-density parity-check (LDPC) coding configuration. Valid values: `disable`, `rx`, `tx`, `rxtx`.
        /// </summary>
        [Input("ldpc")]
        public Input<string>? Ldpc { get; set; }

        /// <summary>
        /// Enable/disable AP local authentication. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("localAuthentication")]
        public Input<string>? LocalAuthentication { get; set; }

        /// <summary>
        /// Enable/disable bridging of wireless and Ethernet interfaces on the FortiAP (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("localBridging")]
        public Input<string>? LocalBridging { get; set; }

        /// <summary>
        /// Allow/deny traffic destined for a Class A, B, or C private IP address (default = allow). Valid values: `allow`, `deny`.
        /// </summary>
        [Input("localLan")]
        public Input<string>? LocalLan { get; set; }

        /// <summary>
        /// Enable/disable AP local standalone (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("localStandalone")]
        public Input<string>? LocalStandalone { get; set; }

        /// <summary>
        /// Enable/disable AP local standalone DNS. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("localStandaloneDns")]
        public Input<string>? LocalStandaloneDns { get; set; }

        /// <summary>
        /// IPv4 addresses for the local standalone DNS.
        /// </summary>
        [Input("localStandaloneDnsIp")]
        public Input<string>? LocalStandaloneDnsIp { get; set; }

        /// <summary>
        /// Enable/disable AP local standalone NAT mode. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("localStandaloneNat")]
        public Input<string>? LocalStandaloneNat { get; set; }

        /// <summary>
        /// Enable/disable MAC authentication bypass. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("macAuthBypass")]
        public Input<string>? MacAuthBypass { get; set; }

        /// <summary>
        /// MAC called station delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Input("macCalledStationDelimiter")]
        public Input<string>? MacCalledStationDelimiter { get; set; }

        /// <summary>
        /// MAC calling station delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Input("macCallingStationDelimiter")]
        public Input<string>? MacCallingStationDelimiter { get; set; }

        /// <summary>
        /// MAC case (default = uppercase). Valid values: `uppercase`, `lowercase`.
        /// </summary>
        [Input("macCase")]
        public Input<string>? MacCase { get; set; }

        /// <summary>
        /// Enable/disable MAC filtering to block wireless clients by mac address. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("macFilter")]
        public Input<string>? MacFilter { get; set; }

        [Input("macFilterLists")]
        private InputList<Inputs.WirelesscontrollerVapMacFilterListGetArgs>? _macFilterLists;

        /// <summary>
        /// Create a list of MAC addresses for MAC address filtering. The structure of `mac_filter_list` block is documented below.
        /// </summary>
        public InputList<Inputs.WirelesscontrollerVapMacFilterListGetArgs> MacFilterLists
        {
            get => _macFilterLists ?? (_macFilterLists = new InputList<Inputs.WirelesscontrollerVapMacFilterListGetArgs>());
            set => _macFilterLists = value;
        }

        /// <summary>
        /// Allow or block clients with MAC addresses that are not in the filter list. Valid values: `allow`, `deny`.
        /// </summary>
        [Input("macFilterPolicyOther")]
        public Input<string>? MacFilterPolicyOther { get; set; }

        /// <summary>
        /// MAC authentication password delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Input("macPasswordDelimiter")]
        public Input<string>? MacPasswordDelimiter { get; set; }

        /// <summary>
        /// MAC authentication username delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Input("macUsernameDelimiter")]
        public Input<string>? MacUsernameDelimiter { get; set; }

        /// <summary>
        /// Maximum number of clients that can connect simultaneously to the VAP (default = 0, meaning no limitation).
        /// </summary>
        [Input("maxClients")]
        public Input<int>? MaxClients { get; set; }

        /// <summary>
        /// Maximum number of clients that can connect simultaneously to each radio (default = 0, meaning no limitation).
        /// </summary>
        [Input("maxClientsAp")]
        public Input<int>? MaxClientsAp { get; set; }

        /// <summary>
        /// Enable/disable Multiband Operation (default = disable). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("mbo")]
        public Input<string>? Mbo { get; set; }

        /// <summary>
        /// MBO cell data connection preference (0, 1, or 255, default = 1). Valid values: `excluded`, `prefer-not`, `prefer-use`.
        /// </summary>
        [Input("mboCellDataConnPref")]
        public Input<string>? MboCellDataConnPref { get; set; }

        /// <summary>
        /// Disable multicast enhancement when this many clients are receiving multicast traffic.
        /// </summary>
        [Input("meDisableThresh")]
        public Input<int>? MeDisableThresh { get; set; }

        /// <summary>
        /// Enable/disable using this VAP as a WiFi mesh backhaul (default = disable). This entry is only available when security is set to a WPA type or open. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("meshBackhaul")]
        public Input<string>? MeshBackhaul { get; set; }

        /// <summary>
        /// Enable/disable multiple pre-shared keys (PSKs.) Valid values: `enable`, `disable`.
        /// </summary>
        [Input("mpsk")]
        public Input<string>? Mpsk { get; set; }

        /// <summary>
        /// Number of pre-shared keys (PSKs) to allow if multiple pre-shared keys are enabled.
        /// </summary>
        [Input("mpskConcurrentClients")]
        public Input<int>? MpskConcurrentClients { get; set; }

        [Input("mpskKeys")]
        private InputList<Inputs.WirelesscontrollerVapMpskKeyGetArgs>? _mpskKeys;

        /// <summary>
        /// Pre-shared keys that can be used to connect to this virtual access point. The structure of `mpsk_key` block is documented below.
        /// </summary>
        public InputList<Inputs.WirelesscontrollerVapMpskKeyGetArgs> MpskKeys
        {
            get => _mpskKeys ?? (_mpskKeys = new InputList<Inputs.WirelesscontrollerVapMpskKeyGetArgs>());
            set => _mpskKeys = value;
        }

        /// <summary>
        /// MPSK profile name.
        /// </summary>
        [Input("mpskProfile")]
        public Input<string>? MpskProfile { get; set; }

        /// <summary>
        /// Enable/disable Multi-user MIMO (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("muMimo")]
        public Input<string>? MuMimo { get; set; }

        /// <summary>
        /// Enable/disable converting multicast to unicast to improve performance (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("multicastEnhance")]
        public Input<string>? MulticastEnhance { get; set; }

        /// <summary>
        /// Multicast rate (0, 6000, 12000, or 24000 kbps, default = 0). Valid values: `0`, `6000`, `12000`, `24000`.
        /// </summary>
        [Input("multicastRate")]
        public Input<string>? MulticastRate { get; set; }

        /// <summary>
        /// Enable/disable network access control. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("nac")]
        public Input<string>? Nac { get; set; }

        /// <summary>
        /// NAC profile name.
        /// </summary>
        [Input("nacProfile")]
        public Input<string>? NacProfile { get; set; }

        /// <summary>
        /// Virtual AP name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// Enable/disable dual-band neighbor report (default = disable). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("neighborReportDualBand")]
        public Input<string>? NeighborReportDualBand { get; set; }

        /// <summary>
        /// Enable/disable Opportunistic Key Caching (OKC) (default = enable). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("okc")]
        public Input<string>? Okc { get; set; }

        /// <summary>
        /// Enable/disable OSEN as part of key management (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("osen")]
        public Input<string>? Osen { get; set; }

        /// <summary>
        /// OWE-Groups. Valid values: `19`, `20`, `21`.
        /// </summary>
        [Input("oweGroups")]
        public Input<string>? OweGroups { get; set; }

        /// <summary>
        /// Enable/disable OWE transition mode support. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("oweTransition")]
        public Input<string>? OweTransition { get; set; }

        /// <summary>
        /// OWE transition mode peer SSID.
        /// </summary>
        [Input("oweTransitionSsid")]
        public Input<string>? OweTransitionSsid { get; set; }

        [Input("passphrase")]
        private Input<string>? _passphrase;

        /// <summary>
        /// WPA pre-shard key (PSK) to be used to authenticate WiFi users.
        /// </summary>
        public Input<string>? Passphrase
        {
            get => _passphrase;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _passphrase = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// Protected Management Frames (PMF) support (default = disable). Valid values: `disable`, `enable`, `optional`.
        /// </summary>
        [Input("pmf")]
        public Input<string>? Pmf { get; set; }

        /// <summary>
        /// Protected Management Frames (PMF) comeback maximum timeout (1-20 sec).
        /// </summary>
        [Input("pmfAssocComebackTimeout")]
        public Input<int>? PmfAssocComebackTimeout { get; set; }

        /// <summary>
        /// Protected Management Frames (PMF) SA query retry timeout interval (1 - 5 100s of msec).
        /// </summary>
        [Input("pmfSaQueryRetryTimeout")]
        public Input<int>? PmfSaQueryRetryTimeout { get; set; }

        /// <summary>
        /// Enable/disable LAN port MAC authentication (default = disable). Valid values: `disable`, `radius`, `address-group`.
        /// </summary>
        [Input("portMacauth")]
        public Input<string>? PortMacauth { get; set; }

        /// <summary>
        /// LAN port MAC authentication re-authentication timeout value (default = 7200 sec).
        /// </summary>
        [Input("portMacauthReauthTimeout")]
        public Input<int>? PortMacauthReauthTimeout { get; set; }

        /// <summary>
        /// LAN port MAC authentication idle timeout value (default = 600 sec).
        /// </summary>
        [Input("portMacauthTimeout")]
        public Input<int>? PortMacauthTimeout { get; set; }

        /// <summary>
        /// Replacement message group for this VAP (only available when security is set to a captive portal type).
        /// </summary>
        [Input("portalMessageOverrideGroup")]
        public Input<string>? PortalMessageOverrideGroup { get; set; }

        /// <summary>
        /// Individual message overrides. The structure of `portal_message_overrides` block is documented below.
        /// </summary>
        [Input("portalMessageOverrides")]
        public Input<Inputs.WirelesscontrollerVapPortalMessageOverridesGetArgs>? PortalMessageOverrides { get; set; }

        /// <summary>
        /// Captive portal functionality. Configure how the captive portal authenticates users and whether it includes a disclaimer.
        /// </summary>
        [Input("portalType")]
        public Input<string>? PortalType { get; set; }

        /// <summary>
        /// Primary wireless access gateway profile name.
        /// </summary>
        [Input("primaryWagProfile")]
        public Input<string>? PrimaryWagProfile { get; set; }

        /// <summary>
        /// Enable/disable probe response suppression (to ignore weak signals) (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("probeRespSuppression")]
        public Input<string>? ProbeRespSuppression { get; set; }

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the AP response to probe requests (-95 to -20, default = -80).
        /// </summary>
        [Input("probeRespThreshold")]
        public Input<string>? ProbeRespThreshold { get; set; }

        /// <summary>
        /// Enable/disable PTK rekey for WPA-Enterprise security. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ptkRekey")]
        public Input<string>? PtkRekey { get; set; }

        /// <summary>
        /// PTK rekey interval (1800 - 864000 sec, default = 86400).
        /// </summary>
        [Input("ptkRekeyIntv")]
        public Input<int>? PtkRekeyIntv { get; set; }

        /// <summary>
        /// Quality of service profile name.
        /// </summary>
        [Input("qosProfile")]
        public Input<string>? QosProfile { get; set; }

        /// <summary>
        /// Enable/disable station quarantine (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("quarantine")]
        public Input<string>? Quarantine { get; set; }

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the AP response to receive a packet in 2.4G band (-95 to -20, default = -79).
        /// </summary>
        [Input("radio2gThreshold")]
        public Input<string>? Radio2gThreshold { get; set; }

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the AP response to receive a packet in 5G band(-95 to -20, default = -76).
        /// </summary>
        [Input("radio5gThreshold")]
        public Input<string>? Radio5gThreshold { get; set; }

        /// <summary>
        /// Enable/disable software radio sensitivity (to ignore weak signals) (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("radioSensitivity")]
        public Input<string>? RadioSensitivity { get; set; }

        /// <summary>
        /// Enable/disable RADIUS-based MAC authentication of clients (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("radiusMacAuth")]
        public Input<string>? RadiusMacAuth { get; set; }

        /// <summary>
        /// RADIUS-based MAC authentication server.
        /// </summary>
        [Input("radiusMacAuthServer")]
        public Input<string>? RadiusMacAuthServer { get; set; }

        [Input("radiusMacAuthUsergroups")]
        private InputList<Inputs.WirelesscontrollerVapRadiusMacAuthUsergroupGetArgs>? _radiusMacAuthUsergroups;

        /// <summary>
        /// Selective user groups that are permitted for RADIUS mac authentication. The structure of `radius_mac_auth_usergroups` block is documented below.
        /// </summary>
        public InputList<Inputs.WirelesscontrollerVapRadiusMacAuthUsergroupGetArgs> RadiusMacAuthUsergroups
        {
            get => _radiusMacAuthUsergroups ?? (_radiusMacAuthUsergroups = new InputList<Inputs.WirelesscontrollerVapRadiusMacAuthUsergroupGetArgs>());
            set => _radiusMacAuthUsergroups = value;
        }

        /// <summary>
        /// Enable/disable RADIUS-based MAC authentication of clients for MPSK authentication (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("radiusMacMpskAuth")]
        public Input<string>? RadiusMacMpskAuth { get; set; }

        /// <summary>
        /// RADIUS MAC MPSK cache timeout interval (1800 - 864000, default = 86400).
        /// </summary>
        [Input("radiusMacMpskTimeout")]
        public Input<int>? RadiusMacMpskTimeout { get; set; }

        /// <summary>
        /// RADIUS server to be used to authenticate WiFi users.
        /// </summary>
        [Input("radiusServer")]
        public Input<string>? RadiusServer { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11a. Valid values: `1`, `1-basic`, `2`, `2-basic`, `5.5`, `5.5-basic`, `11`, `11-basic`, `6`, `6-basic`, `9`, `9-basic`, `12`, `12-basic`, `18`, `18-basic`, `24`, `24-basic`, `36`, `36-basic`, `48`, `48-basic`, `54`, `54-basic`.
        /// </summary>
        [Input("rates11a")]
        public Input<string>? Rates11a { get; set; }

        /// <summary>
        /// Comma separated list of max supported VHT MCS for spatial streams 1 through 8.
        /// </summary>
        [Input("rates11acMcsMap")]
        public Input<string>? Rates11acMcsMap { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11ac with 1 or 2 spatial streams. Valid values: `mcs0/1`, `mcs1/1`, `mcs2/1`, `mcs3/1`, `mcs4/1`, `mcs5/1`, `mcs6/1`, `mcs7/1`, `mcs8/1`, `mcs9/1`, `mcs10/1`, `mcs11/1`, `mcs0/2`, `mcs1/2`, `mcs2/2`, `mcs3/2`, `mcs4/2`, `mcs5/2`, `mcs6/2`, `mcs7/2`, `mcs8/2`, `mcs9/2`, `mcs10/2`, `mcs11/2`.
        /// </summary>
        [Input("rates11acSs12")]
        public Input<string>? Rates11acSs12 { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11ac with 3 or 4 spatial streams. Valid values: `mcs0/3`, `mcs1/3`, `mcs2/3`, `mcs3/3`, `mcs4/3`, `mcs5/3`, `mcs6/3`, `mcs7/3`, `mcs8/3`, `mcs9/3`, `mcs10/3`, `mcs11/3`, `mcs0/4`, `mcs1/4`, `mcs2/4`, `mcs3/4`, `mcs4/4`, `mcs5/4`, `mcs6/4`, `mcs7/4`, `mcs8/4`, `mcs9/4`, `mcs10/4`, `mcs11/4`.
        /// </summary>
        [Input("rates11acSs34")]
        public Input<string>? Rates11acSs34 { get; set; }

        /// <summary>
        /// Comma separated list of max supported HE MCS for spatial streams 1 through 8.
        /// </summary>
        [Input("rates11axMcsMap")]
        public Input<string>? Rates11axMcsMap { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11ax with 1 or 2 spatial streams. Valid values: `mcs0/1`, `mcs1/1`, `mcs2/1`, `mcs3/1`, `mcs4/1`, `mcs5/1`, `mcs6/1`, `mcs7/1`, `mcs8/1`, `mcs9/1`, `mcs10/1`, `mcs11/1`, `mcs0/2`, `mcs1/2`, `mcs2/2`, `mcs3/2`, `mcs4/2`, `mcs5/2`, `mcs6/2`, `mcs7/2`, `mcs8/2`, `mcs9/2`, `mcs10/2`, `mcs11/2`.
        /// </summary>
        [Input("rates11axSs12")]
        public Input<string>? Rates11axSs12 { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11ax with 3 or 4 spatial streams. Valid values: `mcs0/3`, `mcs1/3`, `mcs2/3`, `mcs3/3`, `mcs4/3`, `mcs5/3`, `mcs6/3`, `mcs7/3`, `mcs8/3`, `mcs9/3`, `mcs10/3`, `mcs11/3`, `mcs0/4`, `mcs1/4`, `mcs2/4`, `mcs3/4`, `mcs4/4`, `mcs5/4`, `mcs6/4`, `mcs7/4`, `mcs8/4`, `mcs9/4`, `mcs10/4`, `mcs11/4`.
        /// </summary>
        [Input("rates11axSs34")]
        public Input<string>? Rates11axSs34 { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11b/g. Valid values: `1`, `1-basic`, `2`, `2-basic`, `5.5`, `5.5-basic`, `11`, `11-basic`, `6`, `6-basic`, `9`, `9-basic`, `12`, `12-basic`, `18`, `18-basic`, `24`, `24-basic`, `36`, `36-basic`, `48`, `48-basic`, `54`, `54-basic`.
        /// </summary>
        [Input("rates11bg")]
        public Input<string>? Rates11bg { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11n with 1 or 2 spatial streams. Valid values: `mcs0/1`, `mcs1/1`, `mcs2/1`, `mcs3/1`, `mcs4/1`, `mcs5/1`, `mcs6/1`, `mcs7/1`, `mcs8/2`, `mcs9/2`, `mcs10/2`, `mcs11/2`, `mcs12/2`, `mcs13/2`, `mcs14/2`, `mcs15/2`.
        /// </summary>
        [Input("rates11nSs12")]
        public Input<string>? Rates11nSs12 { get; set; }

        /// <summary>
        /// Allowed data rates for 802.11n with 3 or 4 spatial streams. Valid values: `mcs16/3`, `mcs17/3`, `mcs18/3`, `mcs19/3`, `mcs20/3`, `mcs21/3`, `mcs22/3`, `mcs23/3`, `mcs24/4`, `mcs25/4`, `mcs26/4`, `mcs27/4`, `mcs28/4`, `mcs29/4`, `mcs30/4`, `mcs31/4`.
        /// </summary>
        [Input("rates11nSs34")]
        public Input<string>? Rates11nSs34 { get; set; }

        /// <summary>
        /// SAE-Groups. Valid values: `19`, `20`, `21`.
        /// </summary>
        [Input("saeGroups")]
        public Input<string>? SaeGroups { get; set; }

        /// <summary>
        /// Use hash-to-element-only mechanism for PWE derivation (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("saeH2eOnly")]
        public Input<string>? SaeH2eOnly { get; set; }

        [Input("saePassword")]
        private Input<string>? _saePassword;

        /// <summary>
        /// WPA3 SAE password to be used to authenticate WiFi users.
        /// </summary>
        public Input<string>? SaePassword
        {
            get => _saePassword;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _saePassword = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// Enable/disable WPA3 SAE-PK (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("saePk")]
        public Input<string>? SaePk { get; set; }

        /// <summary>
        /// Private key used for WPA3 SAE-PK authentication.
        /// </summary>
        [Input("saePrivateKey")]
        public Input<string>? SaePrivateKey { get; set; }

        /// <summary>
        /// Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: `disable`, `monitor`, `block`.
        /// </summary>
        [Input("scanBotnetConnections")]
        public Input<string>? ScanBotnetConnections { get; set; }

        /// <summary>
        /// VAP schedule name.
        /// </summary>
        [Input("schedule")]
        public Input<string>? Schedule { get; set; }

        /// <summary>
        /// Secondary wireless access gateway profile name.
        /// </summary>
        [Input("secondaryWagProfile")]
        public Input<string>? SecondaryWagProfile { get; set; }

        /// <summary>
        /// Security mode for the wireless interface (default = wpa2-only-personal).
        /// </summary>
        [Input("security")]
        public Input<string>? Security { get; set; }

        /// <summary>
        /// Optional security exempt list for captive portal authentication.
        /// </summary>
        [Input("securityExemptList")]
        public Input<string>? SecurityExemptList { get; set; }

        /// <summary>
        /// Enable/disable obsolete security options. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("securityObsoleteOption")]
        public Input<string>? SecurityObsoleteOption { get; set; }

        /// <summary>
        /// Optional URL for redirecting users after they pass captive portal authentication.
        /// </summary>
        [Input("securityRedirectUrl")]
        public Input<string>? SecurityRedirectUrl { get; set; }

        [Input("selectedUsergroups")]
        private InputList<Inputs.WirelesscontrollerVapSelectedUsergroupGetArgs>? _selectedUsergroups;

        /// <summary>
        /// Selective user groups that are permitted to authenticate. The structure of `selected_usergroups` block is documented below.
        /// </summary>
        public InputList<Inputs.WirelesscontrollerVapSelectedUsergroupGetArgs> SelectedUsergroups
        {
            get => _selectedUsergroups ?? (_selectedUsergroups = new InputList<Inputs.WirelesscontrollerVapSelectedUsergroupGetArgs>());
            set => _selectedUsergroups = value;
        }

        /// <summary>
        /// Enable/disable split tunneling (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("splitTunneling")]
        public Input<string>? SplitTunneling { get; set; }

        /// <summary>
        /// IEEE 802.11 service set identifier (SSID) for the wireless interface. Users who wish to use the wireless network must configure their computers to access this SSID name.
        /// </summary>
        [Input("ssid")]
        public Input<string>? Ssid { get; set; }

        /// <summary>
        /// Enable/disable sticky client remove to maintain good signal level clients in SSID. (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("stickyClientRemove")]
        public Input<string>? StickyClientRemove { get; set; }

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the 2G client to be serviced by the AP (-95 to -20, default = -79).
        /// </summary>
        [Input("stickyClientThreshold2g")]
        public Input<string>? StickyClientThreshold2g { get; set; }

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the 5G client to be serviced by the AP (-95 to -20, default = -76).
        /// </summary>
        [Input("stickyClientThreshold5g")]
        public Input<string>? StickyClientThreshold5g { get; set; }

        /// <summary>
        /// Minimum signal level/threshold in dBm required for the 6G client to be serviced by the AP (-95 to -20, default = -76).
        /// </summary>
        [Input("stickyClientThreshold6g")]
        public Input<string>? StickyClientThreshold6g { get; set; }

        /// <summary>
        /// Enable/disable 802.11ax target wake time (default = enable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("targetWakeTime")]
        public Input<string>? TargetWakeTime { get; set; }

        /// <summary>
        /// Enable/disable TKIP counter measure. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tkipCounterMeasure")]
        public Input<string>? TkipCounterMeasure { get; set; }

        /// <summary>
        /// The time interval to send echo to both primary and secondary tunnel peers (1 - 65535 sec, default = 300).
        /// </summary>
        [Input("tunnelEchoInterval")]
        public Input<int>? TunnelEchoInterval { get; set; }

        /// <summary>
        /// The time interval for secondary tunnel to fall back to primary tunnel (0 - 65535 sec, default = 7200).
        /// </summary>
        [Input("tunnelFallbackInterval")]
        public Input<int>? TunnelFallbackInterval { get; set; }

        [Input("usergroups")]
        private InputList<Inputs.WirelesscontrollerVapUsergroupGetArgs>? _usergroups;

        /// <summary>
        /// Firewall user group to be used to authenticate WiFi users. The structure of `usergroup` block is documented below.
        /// </summary>
        public InputList<Inputs.WirelesscontrollerVapUsergroupGetArgs> Usergroups
        {
            get => _usergroups ?? (_usergroups = new InputList<Inputs.WirelesscontrollerVapUsergroupGetArgs>());
            set => _usergroups = value;
        }

        /// <summary>
        /// Enable/disable UTM logging. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("utmLog")]
        public Input<string>? UtmLog { get; set; }

        /// <summary>
        /// UTM profile name.
        /// </summary>
        [Input("utmProfile")]
        public Input<string>? UtmProfile { get; set; }

        /// <summary>
        /// Enable to add one or more security profiles (AV, IPS, etc.) to the VAP. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("utmStatus")]
        public Input<string>? UtmStatus { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        /// <summary>
        /// Enable/disable automatic management of SSID VLAN interface. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("vlanAuto")]
        public Input<string>? VlanAuto { get; set; }

        [Input("vlanNames")]
        private InputList<Inputs.WirelesscontrollerVapVlanNameGetArgs>? _vlanNames;

        /// <summary>
        /// Table for mapping VLAN name to VLAN ID. The structure of `vlan_name` block is documented below.
        /// </summary>
        public InputList<Inputs.WirelesscontrollerVapVlanNameGetArgs> VlanNames
        {
            get => _vlanNames ?? (_vlanNames = new InputList<Inputs.WirelesscontrollerVapVlanNameGetArgs>());
            set => _vlanNames = value;
        }

        /// <summary>
        /// Enable/disable VLAN pooling, to allow grouping of multiple wireless controller VLANs into VLAN pools (default = disable). When set to wtp-group, VLAN pooling occurs with VLAN assignment by wtp-group. Valid values: `wtp-group`, `round-robin`, `hash`, `disable`.
        /// </summary>
        [Input("vlanPooling")]
        public Input<string>? VlanPooling { get; set; }

        [Input("vlanPools")]
        private InputList<Inputs.WirelesscontrollerVapVlanPoolGetArgs>? _vlanPools;

        /// <summary>
        /// VLAN pool. The structure of `vlan_pool` block is documented below.
        /// </summary>
        public InputList<Inputs.WirelesscontrollerVapVlanPoolGetArgs> VlanPools
        {
            get => _vlanPools ?? (_vlanPools = new InputList<Inputs.WirelesscontrollerVapVlanPoolGetArgs>());
            set => _vlanPools = value;
        }

        /// <summary>
        /// Optional VLAN ID.
        /// </summary>
        [Input("vlanid")]
        public Input<int>? Vlanid { get; set; }

        /// <summary>
        /// Enable/disable 802.11k and 802.11v assisted Voice-Enterprise roaming (default = disable). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("voiceEnterprise")]
        public Input<string>? VoiceEnterprise { get; set; }

        /// <summary>
        /// WebFilter profile name.
        /// </summary>
        [Input("webfilterProfile")]
        public Input<string>? WebfilterProfile { get; set; }

        public WirelesscontrollerVapState()
        {
        }
        public static new WirelesscontrollerVapState Empty => new WirelesscontrollerVapState();
    }
}
