config firewall proxy-policy
Configure proxy policies.
config firewall proxy-policy
Description: Configure proxy policies.
edit <policyid>
set uuid {uuid}
set name {string}
set proxy [explicit-web|transparent-web|...]
set srcintf <name1>, <name2>, ...
set dstintf <name1>, <name2>, ...
set srcaddr <name1>, <name2>, ...
set poolname <name1>, <name2>, ...
set dstaddr <name1>, <name2>, ...
set internet-service [enable|disable]
set internet-service-negate [enable|disable]
set internet-service-name <name1>, <name2>, ...
set internet-service-group <name1>, <name2>, ...
set internet-service-custom <name1>, <name2>, ...
set internet-service-custom-group <name1>, <name2>, ...
set service <name1>, <name2>, ...
set srcaddr-negate [enable|disable]
set dstaddr-negate [enable|disable]
set service-negate [enable|disable]
set action [accept|deny|...]
set status [enable|disable]
set schedule {string}
set logtraffic [all|utm|...]
set session-ttl {integer}
set srcaddr6 <name1>, <name2>, ...
set dstaddr6 <name1>, <name2>, ...
set groups <name1>, <name2>, ...
set users <name1>, <name2>, ...
set http-tunnel-auth [enable|disable]
set ssh-policy-redirect [enable|disable]
set webproxy-forward-server {string}
set webproxy-profile {string}
set transparent [enable|disable]
set disclaimer [disable|domain|...]
set utm-status [enable|disable]
set profile-type [single|group]
set profile-group {string}
set profile-protocol-options {string}
set ssl-ssh-profile {string}
set av-profile {string}
set webfilter-profile {string}
set emailfilter-profile {string}
set dlp-sensor {string}
set file-filter-profile {string}
set ips-sensor {string}
set application-list {string}
set icap-profile {string}
set cifs-profile {string}
set waf-profile {string}
set ssh-filter-profile {string}
set replacemsg-override-group {string}
set logtraffic-start [enable|disable]
set comments {var-string}
set redirect-url {var-string}
set decrypted-traffic-mirror {string}
next
end
config firewall proxy-policy
Parameter |
Description |
Type |
Size |
Default |
||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
uuid |
Universally Unique Identifier (UUID; automatically assigned but can be manually reset). |
uuid |
Not Specified |
00000000-0000-0000-0000-000000000000 |
||||||||||||
name |
Policy name. |
string |
Not Specified |
|
||||||||||||
proxy |
Type of explicit proxy. |
option |
- |
|
||||||||||||
|
|
|||||||||||||||
srcintf |
Source interface names. Interface name. |
string |
Maximum length: 79 |
|
||||||||||||
dstintf |
Destination interface names. Interface name. |
string |
Maximum length: 79 |
|
||||||||||||
srcaddr |
Source address objects. Address name. |
string |
Maximum length: 79 |
|
||||||||||||
poolname |
Name of IP pool object. IP pool name. |
string |
Maximum length: 79 |
|
||||||||||||
dstaddr |
Destination address objects. Address name. |
string |
Maximum length: 79 |
|
||||||||||||
internet-service |
Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. |
option |
- |
disable |
||||||||||||
|
|
|||||||||||||||
internet-service-negate |
When enabled, Internet Services match against any internet service EXCEPT the selected Internet Service. |
option |
- |
disable |
||||||||||||
|
|
|||||||||||||||
internet-service-name |
Internet Service name. Internet Service name. |
string |
Maximum length: 79 |
|
||||||||||||
internet-service-group |
Internet Service group name. Internet Service group name. |
string |
Maximum length: 79 |
|
||||||||||||
internet-service-custom |
Custom Internet Service name. Custom Internet Service name. |
string |
Maximum length: 79 |
|
||||||||||||
internet-service-custom-group |
Custom Internet Service group name. Custom Internet Service group name. |
string |
Maximum length: 79 |
|
||||||||||||
service |
Name of service objects. Service name. |
string |
Maximum length: 79 |
|
||||||||||||
srcaddr-negate |
When enabled, source addresses match against any address EXCEPT the specified source addresses. |
option |
- |
disable |
||||||||||||
|
|
|||||||||||||||
dstaddr-negate |
When enabled, destination addresses match against any address EXCEPT the specified destination addresses. |
option |
- |
disable |
||||||||||||
|
|
|||||||||||||||
service-negate |
When enabled, services match against any service EXCEPT the specified destination services. |
option |
- |
disable |
||||||||||||
|
|
|||||||||||||||
action |
Accept or deny traffic matching the policy parameters. |
option |
- |
deny |
||||||||||||
|
|
|||||||||||||||
status |
Enable/disable the active status of the policy. |
option |
- |
enable |
||||||||||||
|
|
|||||||||||||||
schedule |
Name of schedule object. |
string |
Not Specified |
|
||||||||||||
logtraffic |
Enable/disable logging traffic through the policy. |
option |
- |
utm |
||||||||||||
|
|
|||||||||||||||
session-ttl |
TTL in seconds for sessions accepted by this policy . |
integer |
Minimum value: 300 Maximum value: 2764800 |
0 |
||||||||||||
srcaddr6 |
IPv6 source address objects. Address name. |
string |
Maximum length: 79 |
|
||||||||||||
dstaddr6 |
IPv6 destination address objects. Address name. |
string |
Maximum length: 79 |
|
||||||||||||
groups |
Names of group objects. Group name. |
string |
Maximum length: 79 |
|
||||||||||||
users |
Names of user objects. Group name. |
string |
Maximum length: 79 |
|
||||||||||||
http-tunnel-auth |
Enable/disable HTTP tunnel authentication. |
option |
- |
disable |
||||||||||||
|
|
|||||||||||||||
ssh-policy-redirect |
Redirect SSH traffic to matching transparent proxy policy. |
option |
- |
disable |
||||||||||||
|
|
|||||||||||||||
webproxy-forward-server |
Web proxy forward server name. |
string |
Not Specified |
|
||||||||||||
webproxy-profile |
Name of web proxy profile. |
string |
Not Specified |
|
||||||||||||
transparent |
Enable to use the IP address of the client to connect to the server. |
option |
- |
disable |
||||||||||||
|
|
|||||||||||||||
disclaimer |
Web proxy disclaimer setting: by domain, policy, or user. |
option |
- |
disable |
||||||||||||
|
|
|||||||||||||||
utm-status |
Enable the use of UTM profiles/sensors/lists. |
option |
- |
disable |
||||||||||||
|
|
|||||||||||||||
profile-type |
Determine whether the firewall policy allows security profile groups or single profiles only. |
option |
- |
single |
||||||||||||
|
|
|||||||||||||||
profile-group |
Name of profile group. |
string |
Not Specified |
|
||||||||||||
profile-protocol-options |
Name of an existing Protocol options profile. |
string |
Not Specified |
default |
||||||||||||
ssl-ssh-profile |
Name of an existing SSL SSH profile. |
string |
Not Specified |
no-inspection |
||||||||||||
av-profile |
Name of an existing Antivirus profile. |
string |
Not Specified |
|
||||||||||||
webfilter-profile |
Name of an existing Web filter profile. |
string |
Not Specified |
|
||||||||||||
emailfilter-profile |
Name of an existing email filter profile. |
string |
Not Specified |
|
||||||||||||
dlp-sensor |
Name of an existing DLP sensor. |
string |
Not Specified |
|
||||||||||||
file-filter-profile |
Name of an existing file-filter profile. |
string |
Not Specified |
|
||||||||||||
ips-sensor |
Name of an existing IPS sensor. |
string |
Not Specified |
|
||||||||||||
application-list |
Name of an existing Application list. |
string |
Not Specified |
|
||||||||||||
icap-profile |
Name of an existing ICAP profile. |
string |
Not Specified |
|
||||||||||||
cifs-profile |
Name of an existing CIFS profile. |
string |
Not Specified |
|
||||||||||||
waf-profile |
Name of an existing Web application firewall profile. |
string |
Not Specified |
|
||||||||||||
ssh-filter-profile |
Name of an existing SSH filter profile. |
string |
Not Specified |
|
||||||||||||
replacemsg-override-group |
Authentication replacement message override group. |
string |
Not Specified |
|
||||||||||||
logtraffic-start |
Enable/disable policy log traffic start. |
option |
- |
disable |
||||||||||||
|
|
|||||||||||||||
comments |
Optional comments. |
var-string |
Not Specified |
|
||||||||||||
redirect-url |
Redirect URL for further explicit web proxy processing. |
var-string |
Not Specified |
|
||||||||||||
decrypted-traffic-mirror |
Decrypted traffic mirror. |
string |
Not Specified |
|