config firewall security-policy
Configure NGFW IPv4/IPv6 application policies.
config firewall security-policy
Description: Configure NGFW IPv4/IPv6 application policies.
edit <policyid>
set uuid {uuid}
set name {string}
set comments {var-string}
set srcintf <name1>, <name2>, ...
set dstintf <name1>, <name2>, ...
set srcaddr4 <name1>, <name2>, ...
set dstaddr4 <name1>, <name2>, ...
set srcaddr6 <name1>, <name2>, ...
set dstaddr6 <name1>, <name2>, ...
set internet-service [enable|disable]
set internet-service-id <id1>, <id2>, ...
set internet-service-negate [enable|disable]
set internet-service-group <name1>, <name2>, ...
set internet-service-custom <name1>, <name2>, ...
set internet-service-custom-group <name1>, <name2>, ...
set internet-service-src [enable|disable]
set internet-service-src-id <id1>, <id2>, ...
set internet-service-src-negate [enable|disable]
set internet-service-src-group <name1>, <name2>, ...
set internet-service-src-custom <name1>, <name2>, ...
set internet-service-src-custom-group <name1>, <name2>, ...
set enforce-default-app-port [enable|disable]
set service <name1>, <name2>, ...
set service-negate [enable|disable]
set action [accept|deny]
set send-deny-packet [disable|enable]
set schedule {string}
set status [enable|disable]
set logtraffic [all|utm|...]
set logtraffic-start [enable|disable]
set profile-type [single|group]
set profile-group {string}
set profile-protocol-options {string}
set ssl-ssh-profile {string}
set av-profile {string}
set webfilter-profile {string}
set dnsfilter-profile {string}
set emailfilter-profile {string}
set dlp-sensor {string}
set ips-sensor {string}
set application-list {string}
set voip-profile {string}
set icap-profile {string}
set cifs-profile {string}
set ssh-filter-profile {string}
set application <id1>, <id2>, ...
set app-category <id1>, <id2>, ...
set url-category <id1>, <id2>, ...
set app-group <name1>, <name2>, ...
set groups <name1>, <name2>, ...
set users <name1>, <name2>, ...
set fsso-groups <name1>, <name2>, ...
next
end
config firewall security-policy
Parameter |
Description |
Type |
Size |
|||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
uuid |
Universally Unique Identifier (UUID; automatically assigned but can be manually reset). |
uuid |
Not Specified |
|||||||||
name |
Policy name. |
string |
Not Specified |
|||||||||
comments |
Comment. |
var-string |
Not Specified |
|||||||||
srcintf |
Incoming (ingress) interface. Interface name. |
string |
Maximum length: 79 |
|||||||||
dstintf |
Outgoing (egress) interface. Interface name. |
string |
Maximum length: 79 |
|||||||||
srcaddr4 |
Source IPv4 address name and address group names. Address name. |
string |
Maximum length: 79 |
|||||||||
dstaddr4 |
Destination IPv4 address name and address group names. Address name. |
string |
Maximum length: 79 |
|||||||||
srcaddr6 |
Source IPv6 address name and address group names. Address name. |
string |
Maximum length: 79 |
|||||||||
dstaddr6 |
Destination IPv6 address name and address group names. Address name. |
string |
Maximum length: 79 |
|||||||||
internet-service |
Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. |
option |
- |
|||||||||
|
|
|||||||||||
internet-service-id |
Internet Service ID. Internet Service ID. |
integer |
Minimum value: 0 Maximum value: 4294967295 |
|||||||||
internet-service-negate |
When enabled internet-service specifies what the service must NOT be. |
option |
- |
|||||||||
|
|
|||||||||||
internet-service-group |
Internet Service group name. Internet Service group name. |
string |
Maximum length: 79 |
|||||||||
internet-service-custom |
Custom Internet Service name. Custom Internet Service name. |
string |
Maximum length: 79 |
|||||||||
internet-service-custom-group |
Custom Internet Service group name. Custom Internet Service group name. |
string |
Maximum length: 79 |
|||||||||
internet-service-src |
Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. |
option |
- |
|||||||||
|
|
|||||||||||
internet-service-src-id |
Internet Service source ID. Internet Service ID. |
integer |
Minimum value: 0 Maximum value: 4294967295 |
|||||||||
internet-service-src-negate |
When enabled internet-service-src specifies what the service must NOT be. |
option |
- |
|||||||||
|
|
|||||||||||
internet-service-src-group |
Internet Service source group name. Internet Service group name. |
string |
Maximum length: 79 |
|||||||||
internet-service-src-custom |
Custom Internet Service source name. Custom Internet Service name. |
string |
Maximum length: 79 |
|||||||||
internet-service-src-custom-group |
Custom Internet Service source group name. Custom Internet Service group name. |
string |
Maximum length: 79 |
|||||||||
enforce-default-app-port |
Enable/disable default application port enforcement for allowed applications. |
option |
- |
|||||||||
|
|
|||||||||||
service |
Service and service group names. Service name. |
string |
Maximum length: 79 |
|||||||||
service-negate |
When enabled service specifies what the service must NOT be. |
option |
- |
|||||||||
|
|
|||||||||||
action |
Policy action (accept/deny). |
option |
- |
|||||||||
|
|
|||||||||||
send-deny-packet |
Enable to send a reply when a session is denied or blocked by a firewall policy. |
option |
- |
|||||||||
|
|
|||||||||||
schedule |
Schedule name. |
string |
Not Specified |
|||||||||
status |
Enable or disable this policy. |
option |
- |
|||||||||
|
|
|||||||||||
logtraffic |
Enable or disable logging. Log all sessions or security profile sessions. |
option |
- |
|||||||||
|
|
|||||||||||
logtraffic-start |
Record logs when a session starts. |
option |
- |
|||||||||
|
|
|||||||||||
profile-type |
Determine whether the firewall policy allows security profile groups or single profiles only. |
option |
- |
|||||||||
|
|
|||||||||||
profile-group |
Name of profile group. |
string |
Not Specified |
|||||||||
profile-protocol-options |
Name of an existing Protocol options profile. |
string |
Not Specified |
|||||||||
ssl-ssh-profile |
Name of an existing SSL SSH profile. |
string |
Not Specified |
|||||||||
av-profile |
Name of an existing Antivirus profile. |
string |
Not Specified |
|||||||||
webfilter-profile |
Name of an existing Web filter profile. |
string |
Not Specified |
|||||||||
dnsfilter-profile |
Name of an existing DNS filter profile. |
string |
Not Specified |
|||||||||
emailfilter-profile |
Name of an existing email filter profile. |
string |
Not Specified |
|||||||||
dlp-sensor |
Name of an existing DLP sensor. |
string |
Not Specified |
|||||||||
ips-sensor |
Name of an existing IPS sensor. |
string |
Not Specified |
|||||||||
application-list |
Name of an existing Application list. |
string |
Not Specified |
|||||||||
voip-profile |
Name of an existing VoIP profile. |
string |
Not Specified |
|||||||||
icap-profile |
Name of an existing ICAP profile. |
string |
Not Specified |
|||||||||
cifs-profile |
Name of an existing CIFS profile. |
string |
Not Specified |
|||||||||
ssh-filter-profile |
Name of an existing SSH filter profile. |
string |
Not Specified |
|||||||||
application |
Application ID list. Application IDs. |
integer |
Minimum value: 0 Maximum value: 4294967295 |
|||||||||
app-category |
Application category ID list. Category IDs. |
integer |
Minimum value: 0 Maximum value: 4294967295 |
|||||||||
url-category |
URL category ID list. URL category ID. |
integer |
Minimum value: 0 Maximum value: 4294967295 |
|||||||||
app-group |
Application group names. Application group names. |
string |
Maximum length: 79 |
|||||||||
groups |
Names of user groups that can authenticate with this policy. User group name. |
string |
Maximum length: 79 |
|||||||||
users |
Names of individual users that can authenticate with this policy. User name. |
string |
Maximum length: 79 |
|||||||||
fsso-groups |
Names of FSSO groups. Names of FSSO groups. |
string |
Maximum length: 511 |