def create_flow_classifier_precommit(self, context):
        """Validate the flow classifier data before committing the transaction

        The NSX-v redirect rules does not support:
        - logical ports
        - l7 parameters
        - source ports range / destination port range with more than 15 ports
        """
        flow_classifier = context.current

        # Logical source port
        logical_source_port = flow_classifier['logical_source_port']
        if logical_source_port is not None:
            msg = _('The NSXv driver does not support setting '
                    'logical source port in FlowClassifier')
            raise exc.FlowClassifierBadRequest(message=msg)

        # Logical destination port
        logical_destination_port = flow_classifier['logical_destination_port']
        if logical_destination_port is not None:
            msg = _('The NSXv driver does not support setting '
                    'logical destination port in FlowClassifier')
            raise exc.FlowClassifierBadRequest(message=msg)

        # L7 parameters
        l7_params = flow_classifier['l7_parameters']
        if l7_params is not None and len(l7_params.keys()) > 0:
            msg = _('The NSXv driver does not support setting '
                    'L7 parameters in FlowClassifier')
            raise exc.FlowClassifierBadRequest(message=msg)

    def _extract_external_gw(self, context, router, is_extract=True):
        r = router['router']
        gw_info = constants.ATTR_NOT_SPECIFIED
        # First extract the gateway info in case of updating
        # gateway before edge is deployed.
        if 'external_gateway_info' in r:
            gw_info = r.get('external_gateway_info', {})
            if is_extract:
                del r['external_gateway_info']
            network_id = (gw_info.get('network_id') if gw_info
                          else None)
            if network_id:
                ext_net = self._get_network(context, network_id)
                if not ext_net.external:
                    msg = (_("Network '%s' is not a valid external network") %
                           network_id)
                    raise n_exc.BadRequest(resource='router', msg=msg)

                subnets = self._get_subnets_by_network(context.elevated(),
                                                       network_id)
                if not subnets:
                    msg = _("Cannot update gateway on Network '%s' "
                            "with no subnet") % network_id
                    raise n_exc.BadRequest(resource='router', msg=msg)
        return gw_info

    def __init__(self, az_conf, az_class, default_availability_zones=None):
        self.availability_zones = {}

        # Add the configured availability zones
        for az in az_conf:
            obj = az_class(az)
            self.availability_zones[obj.name] = obj

        # add a default entry
        obj = az_class(None, default_name=self.default_name)
        self.availability_zones[obj.name] = obj

        # validate the default az:
        if default_availability_zones:
            # we support only 1 default az
            if len(default_availability_zones) > 1:
                raise nsx_exc.NsxInvalidConfiguration(
                    opt_name="default_availability_zones",
                    opt_value=default_availability_zones,
                    reason=_("The NSX plugin supports only 1 default AZ"))
            default_az_name = default_availability_zones[0]
            if (default_az_name not in self.availability_zones):
                raise nsx_exc.NsxInvalidConfiguration(
                    opt_name="default_availability_zones",
                    opt_value=default_availability_zones,
                    reason=_("The default AZ is not defined in the NSX "
                             "plugin"))
            else:
                self._default_az = self.availability_zones[default_az_name]
        else:
            self._default_az = self.availability_zones[self.default_name]

    def validate(self, context, network_id):
        """Validate and return subnet's dhcp info for migration."""
        network = self.plugin.get_network(context, network_id)

        if self.manager.lsn_exists(context, network_id):
            reason = _("LSN already exist")
            raise p_exc.LsnMigrationConflict(net_id=network_id, reason=reason)

        if network[external_net.EXTERNAL]:
            reason = _("Cannot migrate an external network")
            raise n_exc.BadRequest(resource='network', msg=reason)

        filters = {'network_id': [network_id]}
        subnets = self.plugin.get_subnets(context, filters=filters)
        count = len(subnets)
        if count == 0:
            return None
        elif count == 1 and subnets[0]['cidr'] == rpc.METADATA_SUBNET_CIDR:
            reason = _("Cannot migrate a 'metadata' network")
            raise n_exc.BadRequest(resource='network', msg=reason)
        elif count > 1:
            reason = _("Unable to support multiple subnets per network")
            raise p_exc.LsnMigrationConflict(net_id=network_id, reason=reason)
        else:
            return subnets[0]

def _validate_device_list(data, valid_values=None):
    """Validate the list of service definitions."""
    if not data:
        # Devices must be provided
        msg = _("Cannot create a gateway with an empty device list")
        return msg
    try:
        for device in data:
            key_specs = {DEVICE_ID_ATTR:
                         {'type:regex': attributes.UUID_PATTERN,
                          'required': True},
                         IFACE_NAME_ATTR:
                         {'type:string': None,
                          'required': False}}
            err_msg = attributes._validate_dict(
                device, key_specs=key_specs)
            if err_msg:
                return err_msg
            unexpected_keys = [key for key in device if key not in key_specs]
            if unexpected_keys:
                err_msg = (_("Unexpected keys found in device description:%s")
                           % ",".join(unexpected_keys))
                return err_msg
    except TypeError:
        return (_("%s: provided data are not iterable") %
                _validate_device_list.__name__)

def validate_session_persistence(pool, listener, completor, old_pool=None):
    sp = pool.get('session_persistence')
    if not listener or not sp:
        # safety first!
        return
    # L4 listeners only allow source IP persistence
    if (listener['protocol'] == lb_const.LB_PROTOCOL_TCP and
            sp['type'] != lb_const.LB_SESSION_PERSISTENCE_SOURCE_IP):
        completor(success=False)
        msg = (_("Invalid session persistence type %(sp_type)s for "
                 "pool on listener %(lst_id)s with %(proto)s protocol") %
               {'sp_type': sp['type'],
                'lst_id': listener['id'],
                'proto': listener['protocol']})
        raise n_exc.BadRequest(resource='lbaas-pool', msg=msg)
    # Cannot switch (yet) on update from source IP to cookie based, and
    # vice versa
    cookie_pers_types = (lb_const.LB_SESSION_PERSISTENCE_HTTP_COOKIE,
                         lb_const.LB_SESSION_PERSISTENCE_APP_COOKIE)
    if old_pool:
        oldsp = old_pool.get('session_persistence')
        if not oldsp:
            return
        if ((sp['type'] == lb_const.LB_SESSION_PERSISTENCE_SOURCE_IP and
             oldsp['type'] in cookie_pers_types) or
                (sp['type'] in cookie_pers_types and
                 oldsp['type'] == lb_const.LB_SESSION_PERSISTENCE_SOURCE_IP)):
            completor(success=False)
            msg = (_("Cannot update session persistence type to "
                     "%(sp_type)s for pool on listener %(lst_id)s "
                     "from %(old_sp_type)s") %
                   {'sp_type': sp['type'],
                    'lst_id': listener['id'],
                    'old_sp_type': oldsp['type']})
            raise n_exc.BadRequest(resource='lbaas-pool', msg=msg)

 def _validate_network(self, context, net_data):
     network_type = net_data.get(pnet.NETWORK_TYPE)
     segmentation_id = net_data.get(pnet.SEGMENTATION_ID)
     segmentation_id_set = attr.is_attr_set(segmentation_id)
     if not context.is_admin:
         err_msg = _("Only and admin can create a DVS provider "
                     "network")
         raise n_exc.InvalidInput(error_message=err_msg)
     err_msg = None
     if network_type == c_utils.NetworkTypes.FLAT:
         if segmentation_id_set:
             err_msg = _("Segmentation ID cannot be specified with "
                         "flat network type")
     elif network_type == c_utils.NetworkTypes.VLAN:
         if not segmentation_id_set:
             err_msg = _("Segmentation ID must be specified with "
                         "vlan network type")
         elif (segmentation_id_set and
               not utils.is_valid_vlan_tag(segmentation_id)):
             err_msg = (_("%(segmentation_id)s out of range "
                          "(%(min_id)s through %(max_id)s)") %
                        {'segmentation_id': segmentation_id,
                         'min_id': constants.MIN_VLAN_TAG,
                         'max_id': constants.MAX_VLAN_TAG})
     else:
         err_msg = (_("%(net_type_param)s %(net_type_value)s not "
                      "supported") %
                    {'net_type_param': pnet.NETWORK_TYPE,
                     'net_type_value': network_type})
     if err_msg:
         raise n_exc.InvalidInput(error_message=err_msg)

 def _validate_device_list(self, devices, check_backend=True):
     # In NSXv3, one L2 gateway is mapped to one bridge endpoint profle.
     # So we expect only one device to be configured as part of
     # a L2 gateway resource. The name of the device must be the bridge
     # endpoint profile UUID.
     if len(devices) != 1:
         msg = _("Only a single device is supported by the NSX L2"
                 "gateway driver")
         raise n_exc.InvalidInput(error_message=msg)
     dev_name = devices[0]['device_name']
     if not uuidutils.is_uuid_like(dev_name):
         msg = _("Device name must be configured with a UUID")
         raise n_exc.InvalidInput(error_message=msg)
     # Ensure the L2GW device is a valid bridge endpoint profile in NSX
     if check_backend:
         try:
             self._core_plugin.nsxlib.bridge_endpoint_profile.get(
                 dev_name)
         except nsxlib_exc.ResourceNotFound:
             msg = _("Could not find Bridge Endpoint Profile for L2 "
                     "gateway device %s on NSX backend") % dev_name
             LOG.error(msg)
             raise n_exc.InvalidInput(error_message=msg)
     # One L2 gateway must have only one interface defined.
     interfaces = devices[0].get(l2gw_const.IFACE_NAME_ATTR)
     if len(interfaces) > 1:
         msg = _("Maximum of one interface is supported by the NSX L2 "
                 "gateway driver")
         raise n_exc.InvalidInput(error_message=msg)

 def validate_tier0(self, tier0_groups_dict, tier0_uuid):
     err_msg = None
     try:
         lrouter = self._router_client.get(tier0_uuid)
     except nsx_exc.ResourceNotFound:
         err_msg = (_("Tier0 router %s not found at the backend. Either a "
                      "valid UUID must be specified or a default tier0 "
                      "router UUID must be configured in nsx.ini") %
                    tier0_uuid)
     else:
         edge_cluster_uuid = lrouter.get('edge_cluster_id')
         if not edge_cluster_uuid:
             err_msg = _("Failed to get edge cluster uuid from tier0 "
                         "router %s at the backend") % lrouter
         else:
             edge_cluster = nsxlib.get_edge_cluster(edge_cluster_uuid)
             member_index_list = [member['member_index']
                                  for member in edge_cluster['members']]
             if len(member_index_list) < MIN_EDGE_NODE_NUM:
                 err_msg = _("%(act_num)s edge members found in "
                             "edge_cluster %(cluster_id)s, however we "
                             "require at least %(exp_num)s edge nodes "
                             "in edge cluster for use.") % {
                     'act_num': len(member_index_list),
                     'exp_num': MIN_EDGE_NODE_NUM,
                     'cluster_id': edge_cluster_uuid}
     if err_msg:
         raise n_exc.InvalidInput(error_message=err_msg)
     else:
         tier0_groups_dict[tier0_uuid] = {
             'edge_cluster_uuid': edge_cluster_uuid,
             'member_index_list': member_index_list}

    def delete_ipsec_site_connection(self, context, ipsec_site_conn):
        LOG.debug('Deleting ipsec site connection %(site)s.',
                  {"site": ipsec_site_conn})
        ipsec_id = ipsec_site_conn['id']
        edge_id = self._get_router_edge_id(context,
                                           ipsec_site_conn['vpnservice_id'])[1]
        with locking.LockManager.get_lock(edge_id):
            del_site, vse_sites = self._find_vse_site(context, edge_id,
                                                      ipsec_site_conn)
            if not del_site:
                LOG.error("Failed to find ipsec_site_connection "
                          "%(ipsec_site_conn)s with %(edge_id)s.",
                          {'ipsec_site_conn': ipsec_site_conn,
                           'edge_id': edge_id})
                raise nsxv_exc.NsxIPsecVpnMappingNotFound(conn=ipsec_id)

            vse_sites.remove(del_site)
            enabled = True if vse_sites else False
            try:
                self._update_ipsec_config(edge_id, vse_sites, enabled)
            except vcns_exc.VcnsApiException:
                msg = (_("Failed to delete ipsec site connection "
                         "configuration with edge_id: %(edge_id)s.") %
                       {'egde_id': edge_id})
                raise nsxv_exc.NsxPluginException(err_msg=msg)
            try:
                self._update_firewall_rules(context,
                                            ipsec_site_conn['vpnservice_id'])
            except vcns_exc.VcnsApiException:
                msg = _("Failed to update firewall rule for ipsec vpn with "
                        "%(edge_id)s.") % {'edge_id': edge_id}
                raise nsxv_exc.NsxPluginException(err_msg=msg)

def update_lrouter_port_ips(cluster, lrouter_id, lport_id,
                            ips_to_add, ips_to_remove):
    uri = nsxlib._build_uri_path(LROUTERPORT_RESOURCE, lport_id, lrouter_id)
    try:
        port = nsxlib.do_request(HTTP_GET, uri, cluster=cluster)
        # TODO(salvatore-orlando): Enforce ips_to_add intersection with
        # ips_to_remove is empty
        ip_address_set = set(port['ip_addresses'])
        ip_address_set = ip_address_set - set(ips_to_remove)
        ip_address_set = ip_address_set | set(ips_to_add)
        # Set is not JSON serializable - convert to list
        port['ip_addresses'] = list(ip_address_set)
        nsxlib.do_request(HTTP_PUT, uri, jsonutils.dumps(port),
                          cluster=cluster)
    except exception.NotFound:
        # FIXME(salv-orlando):avoid raising different exception
        data = {'lport_id': lport_id, 'lrouter_id': lrouter_id}
        msg = (_("Router Port %(lport_id)s not found on router "
                 "%(lrouter_id)s") % data)
        LOG.exception(msg)
        raise nsx_exc.NsxPluginException(err_msg=msg)
    except api_exc.NsxApiException as e:
        msg = _("An exception occurred while updating IP addresses on a "
                "router logical port:%s") % e
        LOG.exception(msg)
        raise nsx_exc.NsxPluginException(err_msg=msg)

    def get_details(self):
        """Return subnet data as a SpecificSubnetRequest"""
        # get the pool from the backend
        try:
            pool_details = self.nsxlib_ipam.get(self._nsx_pool_id)
        except Exception as e:
            msg = _('Failed to get details for nsx pool: %(id)s: '
                    '%(e)s') % {'id': self._nsx_pool_id, 'e': e}
            raise ipam_exc.IpamValueInvalid(message=msg)

        first_range = pool_details.get('subnets', [None])[0]
        if not first_range:
            msg = _('Failed to get details for nsx pool: %(id)s') % {
                'id': self._nsx_pool_id}
            raise ipam_exc.IpamValueInvalid(message=msg)

        cidr = first_range.get('cidr')
        gateway_ip = first_range.get('gateway_ip')
        pools = []
        for subnet in pool_details.get('subnets', []):
            for ip_range in subnet.get('allocation_ranges', []):
                pools.append(netaddr.IPRange(ip_range.get('start'),
                                             ip_range.get('end')))
        return ipam_req.SpecificSubnetRequest(
            self._tenant_id, self._subnet_id,
            cidr, gateway_ip=gateway_ip, allocation_pools=pools)

 def update_backend_pool(self, nsx_pool_id, subnet_request):
     update_args = {
         'cidr': self._get_cidr_from_request(subnet_request),
         'allocation_ranges': self._get_ranges_from_request(subnet_request),
         'gateway_ip': subnet_request.gateway_ip}
     try:
         self.nsxlib_ipam.update(
             nsx_pool_id, **update_args)
     except nsx_lib_exc.ManagerError as e:
         LOG.error("NSX IPAM failed to update pool %(id)s: "
                   " %(e)s; code %(code)s",
                   {'e': e,
                    'id': nsx_pool_id,
                    'code': e.error_code})
         if (e.error_code == error.ERR_CODE_IPAM_RANGE_MODIFY or
             e.error_code == error.ERR_CODE_IPAM_RANGE_DELETE or
             e.error_code == error.ERR_CODE_IPAM_RANGE_SHRUNK):
             # The change is not allowed: already allocated IPs out of
             # the new range
             raise ipam_exc.InvalidSubnetRequest(
                 reason=_("Already allocated IPs outside of the updated "
                          "pools"))
     except Exception as e:
         # unexpected error
         msg = _('Failed to update subnet IPAM: %s') % e
         raise ipam_exc.IpamValueInvalid(message=msg)

def add_nsx_extensions_to_parser(parser, client_manager, is_create=True):
    allowed_extensions = utils.get_extensions(client_manager)
    # Provider security group (only for create action)
    if (is_create and
        'provider-security-group' in allowed_extensions):
        parser.add_argument(
            '--provider-security-group',
            metavar='<provider-security-group>',
            action='append',
            dest='provider_security_groups',
            help=_("Provider Security group to associate with this port "
                   "(name or ID) "
                   "(repeat option to set multiple security groups)")
        )
    if 'vnic-index' in allowed_extensions:
        # vnic index
        parser.add_argument(
            '--vnic-index',
            type=int,
            metavar='<vnic-index>',
            help=_("Vnic index")
        )
    if 'mac-learning' in allowed_extensions:
        # mac-learning-enabled
        mac_learning_group = parser.add_mutually_exclusive_group()
        mac_learning_group.add_argument(
            '--enable-mac-learning',
            action='store_true',
            help=_("Enable MAC learning")
        )
        mac_learning_group.add_argument(
            '--disable-mac-learning',
            action='store_true',
            help=_("Disable MAC learning (Default")
        )

def _validate_dns_format(data):
    if not data:
        return
    try:
        # Allow values ending in period '.'
        trimmed = data if not data.endswith('.') else data[:-1]
        names = trimmed.split('.')
        for name in names:
            if not name:
                raise TypeError(_("Encountered an empty component"))
            if name.endswith('-') or name[0] == '-':
                raise TypeError(
                    _("Name '%s' must not start or end with a hyphen") % name)
            if not re.match(DNS_LABEL_REGEX, name):
                raise TypeError(
                    _("Name '%s' must be 1-63 characters long, each of "
                      "which can only be alphanumeric or a hyphen") % name)
        # RFC 1123 hints that a TLD can't be all numeric. last is a TLD if
        # it's an FQDN.
        if len(names) > 1 and re.match("^[0-9]+$", names[-1]):
            raise TypeError(_("TLD '%s' must not be all numeric") % names[-1])
    except TypeError as e:
        msg = _("'%(data)s' not a valid DNS search domain. Reason: "
                "%(reason)s") % {'data': data, 'reason': str(e)}
        return msg

 def _create_ssl_cert(self, edge_id=None):
     # Create a self signed certificate in the backend if both Cert details
     # and private key are not supplied in nsx.ini
     if (not cfg.CONF.nsxv.metadata_nova_client_cert and
         not cfg.CONF.nsxv.metadata_nova_client_priv_key):
         h = self.nsxv_plugin.nsx_v.vcns.create_csr(edge_id)[0]
         # Extract the CSR ID from header
         csr_id = lbaas_common.extract_resource_id(h['location'])
         # Create a self signed certificate
         cert = self.nsxv_plugin.nsx_v.vcns.create_csr_cert(csr_id)[1]
         cert_id = cert['objectId']
     else:
         # Raise an error if either the Cert path or the private key is not
         # configured
         error = None
         if not cfg.CONF.nsxv.metadata_nova_client_cert:
             error = _('Metadata certificate path not configured')
         elif not cfg.CONF.nsxv.metadata_nova_client_priv_key:
             error = _('Metadata client private key not configured')
         if error:
             raise nsxv_exc.NsxPluginException(err_msg=error)
         pem_encoding = utils.read_file(
             cfg.CONF.nsxv.metadata_nova_client_cert)
         priv_key = utils.read_file(
             cfg.CONF.nsxv.metadata_nova_client_priv_key)
         request = {
             'pemEncoding': pem_encoding,
             'privateKey': priv_key}
         cert = self.nsxv_plugin.nsx_v.vcns.upload_edge_certificate(
             edge_id, request)[1]
         cert_id = cert.get('certificates')[0]['objectId']
     return cert_id

 def _validate_network_mapping_info(self, network_mapping_info):
     self._set_mapping_info_defaults(network_mapping_info)
     network_id = network_mapping_info.get(NETWORK_ID)
     if not network_id:
         raise exceptions.InvalidInput(
             error_message=_("A network identifier must be specified "
                             "when connecting a network to a network "
                             "gateway. Unable to complete operation"))
     connection_attrs = set(network_mapping_info.keys())
     if not connection_attrs.issubset(ALLOWED_CONNECTION_ATTRIBUTES):
         raise exceptions.InvalidInput(
             error_message=(_("Invalid keys found among the ones provided "
                              "in request body: %(connection_attrs)s."),
                            connection_attrs))
     seg_type = network_mapping_info.get(SEGMENTATION_TYPE)
     seg_id = network_mapping_info.get(SEGMENTATION_ID)
     # It is important to validate that the segmentation ID is actually an
     # integer value
     try:
         seg_id = int(seg_id)
     except ValueError:
         msg = _("An invalid segmentation ID was specified. The "
                 "segmentation ID must be a positive integer number")
         raise exceptions.InvalidInput(error_message=msg)
     # The NSX plugin accepts 0 as a valid vlan tag
     seg_id_valid = seg_id == 0 or utils.is_valid_vlan_tag(seg_id)
     if seg_type.lower() == 'flat' and seg_id:
         msg = _("Cannot specify a segmentation id when "
                 "the segmentation type is flat")
         raise exceptions.InvalidInput(error_message=msg)
     elif (seg_type.lower() == 'vlan' and not seg_id_valid):
         msg = _("Invalid segmentation id (%s) for "
                 "vlan segmentation type") % seg_id
         raise exceptions.InvalidInput(error_message=msg)
     return network_id

    def create_ipsec_site_connection(self, context, ipsec_site_connection):
        LOG.debug('Creating ipsec site connection %(conn_info)s.',
                  {"conn_info": ipsec_site_connection})
        new_ipsec = self._convert_ipsec_conn(context, ipsec_site_connection)
        vpnservice_id = ipsec_site_connection['vpnservice_id']
        edge_id = self._get_router_edge_id(context, vpnservice_id)[1]
        with locking.LockManager.get_lock(edge_id):
            vse_sites = self._generate_new_sites(edge_id, new_ipsec)
            ipsec_id = ipsec_site_connection["id"]
            try:
                LOG.debug('Updating ipsec vpn configuration %(vse_sites)s.',
                          {'vse_sites': vse_sites})
                self._update_ipsec_config(edge_id, vse_sites, enabled=True)
            except vcns_exc.VcnsApiException:
                self._update_status(context, vpnservice_id, ipsec_id,
                                    "ERROR")
                msg = (_("Failed to create ipsec site connection "
                         "configuration with %(edge_id)s.") %
                       {'edge_id': edge_id})
                raise nsxv_exc.NsxPluginException(err_msg=msg)

            LOG.debug('Updating ipsec vpn firewall')
            try:
                self._update_firewall_rules(context, vpnservice_id)
            except vcns_exc.VcnsApiException:
                self._update_status(context, vpnservice_id, ipsec_id, "ERROR")
                msg = (_("Failed to update firewall rule for ipsec vpn "
                         "with %(edge_id)s.") % {'edge_id': edge_id})
                raise nsxv_exc.NsxPluginException(err_msg=msg)
            self._update_status(context, vpnservice_id, ipsec_id, "ACTIVE")

    def _check_lb_service_on_router(self, resource, event, trigger,
                                    payload=None):
        """Prevent removing a router GW or deleting a router used by LB"""
        router_id = payload.resource_id
        context = payload.context
        nsx_router_id = nsx_db.get_nsx_router_id(context.session,
                                                 router_id)
        if not nsx_router_id:
            # Skip non-v3 routers (could be a V router in case of TVD plugin)
            return
        nsxlib = self.loadbalancer.core_plugin.nsxlib
        service_client = nsxlib.load_balancer.service
        # Check if there is any lb service on nsx router
        lb_service = service_client.get_router_lb_service(nsx_router_id)
        if lb_service:
            msg = _('Cannot delete a %s as it still has lb service '
                    'attachment') % resource
            raise n_exc.BadRequest(resource='lbaas-lb', msg=msg)

        # Also check if there are any loadbalancers attached to this router
        # subnets
        router_subnets = self.loadbalancer.core_plugin._find_router_subnets(
            context.elevated(), router_id)
        subnet_ids = [subnet['id'] for subnet in router_subnets]
        if subnet_ids and self._get_lb_ports(context.elevated(), subnet_ids):
            msg = (_('Cannot delete a %s as it used by a loadbalancer') %
                   resource)
            raise n_exc.BadRequest(resource='lbaas-lb', msg=msg)

 def _validate_interface_list(self, interfaces):
     # In NSXv, interface is mapped to a vDS VLAN port group.
     # Since HA is not supported, only one interface is expected
     if len(interfaces) != 1:
         msg = _("Only a single interface is supported for one L2 gateway")
         raise n_exc.InvalidInput(error_message=msg)
     if not self._nsxv.vcns.validate_network(interfaces[0]['name']):
         msg = _("Configured interface not found")
         raise n_exc.InvalidInput(error_message=msg)