config firewall proxy-policy

Configure proxy policies.

config firewall proxy-policy
    Description: Configure proxy policies.
    edit <policyid>
        set action [accept|deny|...]
        set application-list {string}
        set av-profile {string}
        set cifs-profile {string}
        set comments {var-string}
        set decrypted-traffic-mirror {string}
        set disclaimer [disable|domain|...]
        set dlp-sensor {string}
        set dstaddr <name1>, <name2>, ...
        set dstaddr-negate [enable|disable]
        set dstaddr6 <name1>, <name2>, ...
        set dstintf <name1>, <name2>, ...
        set emailfilter-profile {string}
        set file-filter-profile {string}
        set groups <name1>, <name2>, ...
        set http-tunnel-auth [enable|disable]
        set icap-profile {string}
        set internet-service [enable|disable]
        set internet-service-custom <name1>, <name2>, ...
        set internet-service-custom-group <name1>, <name2>, ...
        set internet-service-group <name1>, <name2>, ...
        set internet-service-name <name1>, <name2>, ...
        set internet-service-negate [enable|disable]
        set ips-sensor {string}
        set logtraffic [all|utm|...]
        set logtraffic-start [enable|disable]
        set name {string}
        set policyid {integer}
        set poolname <name1>, <name2>, ...
        set profile-group {string}
        set profile-protocol-options {string}
        set profile-type [single|group]
        set proxy [explicit-web|transparent-web|...]
        set redirect-url {var-string}
        set replacemsg-override-group {string}
        set schedule {string}
        set service <name1>, <name2>, ...
        set service-negate [enable|disable]
        set session-ttl {integer}
        set srcaddr <name1>, <name2>, ...
        set srcaddr-negate [enable|disable]
        set srcaddr6 <name1>, <name2>, ...
        set srcintf <name1>, <name2>, ...
        set ssh-filter-profile {string}
        set ssh-policy-redirect [enable|disable]
        set ssl-ssh-profile {string}
        set status [enable|disable]
        set transparent [enable|disable]
        set users <name1>, <name2>, ...
        set utm-status [enable|disable]
        set uuid {uuid}
        set waf-profile {string}
        set webcache [enable|disable]
        set webcache-https [disable|enable]
        set webfilter-profile {string}
        set webproxy-forward-server {string}
        set webproxy-profile {string}
    next
end

config firewall proxy-policy

Parameter

Description

Type

Size

Default

action

Accept or deny traffic matching the policy parameters.

option

deny

Option	Description
accept	Action accept.
deny	Action deny.
redirect	Action redirect.

application-list

Name of an existing Application list.

string

Not Specified

av-profile

Name of an existing Antivirus profile.

string

Not Specified

cifs-profile

Name of an existing CIFS profile.

string

Not Specified

comments

Optional comments.

var-string

Not Specified

decrypted-traffic-mirror

Decrypted traffic mirror.

string

Not Specified

disclaimer

Web proxy disclaimer setting: by domain, policy, or user.

option

disable

Option	Description
disable	Disable disclaimer.
domain	Display disclaimer for domain
policy	Display disclaimer for policy
user	Display disclaimer for current user

dlp-sensor

Name of an existing DLP sensor.

string

Not Specified

dstaddr <name>

Destination address objects.

Address name.

string

Maximum length: 79

dstaddr-negate

When enabled, destination addresses match against any address EXCEPT the specified destination addresses.

option

disable

Option	Description
enable	Enable source address negate.
disable	Disable destination address negate.

dstaddr6 <name>

IPv6 destination address objects.

Address name.

string

Maximum length: 79

dstintf <name>

Destination interface names.

Interface name.

string

Maximum length: 79

emailfilter-profile

Name of an existing email filter profile.

string

Not Specified

file-filter-profile

Name of an existing file-filter profile.

string

Not Specified

groups <name>

Names of group objects.

Group name.

string

Maximum length: 79

http-tunnel-auth

Enable/disable HTTP tunnel authentication.

option

disable

Option	Description
enable	Enable setting.
disable	Disable setting.

icap-profile

Name of an existing ICAP profile.

string

Not Specified

internet-service

Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used.

option

disable

Option	Description
enable	Enable use of Internet Services in policy.
disable	Disable use of Internet Services in policy.

internet-service-custom <name>

Custom Internet Service name.

string

Maximum length: 79

internet-service-custom-group <name>

Custom Internet Service group name.

string

Maximum length: 79

internet-service-group <name>

Internet Service group name.

string

Maximum length: 79

internet-service-name <name>

Internet Service name.

string

Maximum length: 79

internet-service-negate

When enabled, Internet Services match against any internet service EXCEPT the selected Internet Service.

option

disable

Option	Description
enable	Enable negated Internet Service match.
disable	Disable negated Internet Service match.

ips-sensor

Name of an existing IPS sensor.

string

Not Specified

logtraffic

Enable/disable logging traffic through the policy.

option

utm

Option	Description
all	Log all sessions.
utm	UTM event and matched application traffic log.
disable	Disable traffic and application log.

logtraffic-start

Enable/disable policy log traffic start.

option

disable

Option	Description
enable	Enable setting.
disable	Disable setting.

name

Policy name.

string

Not Specified

policyid

Policy ID.

integer

Minimum value: 0 Maximum value: 4294967295

poolname <name>

Name of IP pool object.

IP pool name.

string

Maximum length: 79

profile-group

Name of profile group.

string

Not Specified

profile-protocol-options

Name of an existing Protocol options profile.

string

Not Specified

default

profile-type

Determine whether the firewall policy allows security profile groups or single profiles only.

option

single

Option	Description
single	Do not allow security profile groups.
group	Allow security profile groups.

proxy

Type of explicit proxy.

option

Option	Description
explicit-web	Explicit Web Proxy
transparent-web	Transparent Web Proxy
ftp	Explicit FTP Proxy
ssh	SSH Proxy
ssh-tunnel	SSH Tunnel
wanopt	WANopt Tunnel

redirect-url

Redirect URL for further explicit web proxy processing.

var-string

Not Specified

replacemsg-override-group

Authentication replacement message override group.

string

Not Specified

schedule

Name of schedule object.

string

Not Specified

service <name>

Name of service objects.

Service name.

string

Maximum length: 79

service-negate

When enabled, services match against any service EXCEPT the specified destination services.

option

disable

Option	Description
enable	Enable negated service match.
disable	Disable negated service match.

session-ttl

TTL in seconds for sessions accepted by this policy.

integer

Minimum value: 300 Maximum value: 2764800

srcaddr <name>

Source address objects.

Address name.

string

Maximum length: 79

srcaddr-negate

When enabled, source addresses match against any address EXCEPT the specified source addresses.

option

disable

Option	Description
enable	Enable source address negate.
disable	Disable destination address negate.

srcaddr6 <name>

IPv6 source address objects.

Address name.

string

Maximum length: 79

srcintf <name>

Source interface names.

Interface name.

string

Maximum length: 79

ssh-filter-profile

Name of an existing SSH filter profile.

string

Not Specified

ssh-policy-redirect

Redirect SSH traffic to matching transparent proxy policy.

option

disable

Option	Description
enable	Enable SSH policy redirect.
disable	Disable SSH policy redirect.

ssl-ssh-profile

Name of an existing SSL SSH profile.

string

Not Specified

no-inspection

status

Enable/disable the active status of the policy.

option

enable

Option	Description
enable	Enable setting.
disable	Disable setting.

transparent

Enable to use the IP address of the client to connect to the server.

option

disable

Option	Description
enable	Enable use of IP address of client to connect to server.
disable	Disable use of IP address of client to connect to server.

users <name>

Names of user objects.

Group name.

string

Maximum length: 79

utm-status

Enable the use of UTM profiles/sensors/lists.

option

disable

Option	Description
enable	Enable setting.
disable	Disable setting.

uuid

Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

uuid

Not Specified

00000000-0000-0000-0000-000000000000

waf-profile

Name of an existing Web application firewall profile.

string

Not Specified

webcache *

Enable/disable web caching.

option

disable

Option	Description
enable	Enable setting.
disable	Disable setting.

webcache-https *

Enable/disable web caching for HTTPS (Requires deep-inspection enabled in ssl-ssh-profile).

option

disable

Option	Description
disable	Disable web cache for HTTPS.
enable	Enable web cache for HTTPS.

webfilter-profile

Name of an existing Web filter profile.

string

Not Specified

webproxy-forward-server

Web proxy forward server name.

string

Not Specified

webproxy-profile

Name of web proxy profile.

string

Not Specified

* This parameter may not exist in some models.

config firewall proxy-policy

Configure proxy policies.

config firewall proxy-policy
    Description: Configure proxy policies.
    edit <policyid>
        set action [accept|deny|...]
        set application-list {string}
        set av-profile {string}
        set cifs-profile {string}
        set comments {var-string}
        set decrypted-traffic-mirror {string}
        set disclaimer [disable|domain|...]
        set dlp-sensor {string}
        set dstaddr <name1>, <name2>, ...
        set dstaddr-negate [enable|disable]
        set dstaddr6 <name1>, <name2>, ...
        set dstintf <name1>, <name2>, ...
        set emailfilter-profile {string}
        set file-filter-profile {string}
        set groups <name1>, <name2>, ...
        set http-tunnel-auth [enable|disable]
        set icap-profile {string}
        set internet-service [enable|disable]
        set internet-service-custom <name1>, <name2>, ...
        set internet-service-custom-group <name1>, <name2>, ...
        set internet-service-group <name1>, <name2>, ...
        set internet-service-name <name1>, <name2>, ...
        set internet-service-negate [enable|disable]
        set ips-sensor {string}
        set logtraffic [all|utm|...]
        set logtraffic-start [enable|disable]
        set name {string}
        set policyid {integer}
        set poolname <name1>, <name2>, ...
        set profile-group {string}
        set profile-protocol-options {string}
        set profile-type [single|group]
        set proxy [explicit-web|transparent-web|...]
        set redirect-url {var-string}
        set replacemsg-override-group {string}
        set schedule {string}
        set service <name1>, <name2>, ...
        set service-negate [enable|disable]
        set session-ttl {integer}
        set srcaddr <name1>, <name2>, ...
        set srcaddr-negate [enable|disable]
        set srcaddr6 <name1>, <name2>, ...
        set srcintf <name1>, <name2>, ...
        set ssh-filter-profile {string}
        set ssh-policy-redirect [enable|disable]
        set ssl-ssh-profile {string}
        set status [enable|disable]
        set transparent [enable|disable]
        set users <name1>, <name2>, ...
        set utm-status [enable|disable]
        set uuid {uuid}
        set waf-profile {string}
        set webcache [enable|disable]
        set webcache-https [disable|enable]
        set webfilter-profile {string}
        set webproxy-forward-server {string}
        set webproxy-profile {string}
    next
end

config firewall proxy-policy

Parameter

Description

Type

Size

Default

action

Accept or deny traffic matching the policy parameters.

option

deny

Option	Description
accept	Action accept.
deny	Action deny.
redirect	Action redirect.

application-list

Name of an existing Application list.

string

Not Specified

av-profile

Name of an existing Antivirus profile.

string

Not Specified

cifs-profile

Name of an existing CIFS profile.

string

Not Specified

comments

Optional comments.

var-string

Not Specified

decrypted-traffic-mirror

Decrypted traffic mirror.

string

Not Specified

disclaimer

Web proxy disclaimer setting: by domain, policy, or user.

option

disable

Option	Description
disable	Disable disclaimer.
domain	Display disclaimer for domain
policy	Display disclaimer for policy
user	Display disclaimer for current user

dlp-sensor

Name of an existing DLP sensor.

string

Not Specified

dstaddr <name>

Destination address objects.

Address name.

string

Maximum length: 79

dstaddr-negate

When enabled, destination addresses match against any address EXCEPT the specified destination addresses.

option

disable

Option	Description
enable	Enable source address negate.
disable	Disable destination address negate.

dstaddr6 <name>

IPv6 destination address objects.

Address name.

string

Maximum length: 79

dstintf <name>

Destination interface names.

Interface name.

string

Maximum length: 79

emailfilter-profile

Name of an existing email filter profile.

string

Not Specified

file-filter-profile

Name of an existing file-filter profile.

string

Not Specified

groups <name>

Names of group objects.

Group name.

string

Maximum length: 79

http-tunnel-auth

Enable/disable HTTP tunnel authentication.

option

disable

Option	Description
enable	Enable setting.
disable	Disable setting.

icap-profile

Name of an existing ICAP profile.

string

Not Specified

internet-service

Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used.

option

disable

Option	Description
enable	Enable use of Internet Services in policy.
disable	Disable use of Internet Services in policy.

internet-service-custom <name>

Custom Internet Service name.

string

Maximum length: 79

internet-service-custom-group <name>

Custom Internet Service group name.

string

Maximum length: 79

internet-service-group <name>

Internet Service group name.

string

Maximum length: 79

internet-service-name <name>

Internet Service name.

string

Maximum length: 79

internet-service-negate

When enabled, Internet Services match against any internet service EXCEPT the selected Internet Service.

option

disable

Option	Description
enable	Enable negated Internet Service match.
disable	Disable negated Internet Service match.

ips-sensor

Name of an existing IPS sensor.

string

Not Specified

logtraffic

Enable/disable logging traffic through the policy.

option

utm

Option	Description
all	Log all sessions.
utm	UTM event and matched application traffic log.
disable	Disable traffic and application log.

logtraffic-start

Enable/disable policy log traffic start.

option

disable

Option	Description
enable	Enable setting.
disable	Disable setting.

name

Policy name.

string

Not Specified

policyid

Policy ID.

integer

Minimum value: 0 Maximum value: 4294967295

poolname <name>

Name of IP pool object.

IP pool name.

string

Maximum length: 79

profile-group

Name of profile group.

string

Not Specified

profile-protocol-options

Name of an existing Protocol options profile.

string

Not Specified

default

profile-type

Determine whether the firewall policy allows security profile groups or single profiles only.

option

single

Option	Description
single	Do not allow security profile groups.
group	Allow security profile groups.

proxy

Type of explicit proxy.

option

Option	Description
explicit-web	Explicit Web Proxy
transparent-web	Transparent Web Proxy
ftp	Explicit FTP Proxy
ssh	SSH Proxy
ssh-tunnel	SSH Tunnel
wanopt	WANopt Tunnel

redirect-url

Redirect URL for further explicit web proxy processing.

var-string

Not Specified

replacemsg-override-group

Authentication replacement message override group.

string

Not Specified

schedule

Name of schedule object.

string

Not Specified

service <name>

Name of service objects.

Service name.

string

Maximum length: 79

service-negate

When enabled, services match against any service EXCEPT the specified destination services.

option

disable

Option	Description
enable	Enable negated service match.
disable	Disable negated service match.

session-ttl

TTL in seconds for sessions accepted by this policy.

integer

Minimum value: 300 Maximum value: 2764800

srcaddr <name>

Source address objects.

Address name.

string

Maximum length: 79

srcaddr-negate

When enabled, source addresses match against any address EXCEPT the specified source addresses.

option

disable

Option	Description
enable	Enable source address negate.
disable	Disable destination address negate.

srcaddr6 <name>

IPv6 source address objects.

Address name.

string

Maximum length: 79

srcintf <name>

Source interface names.

Interface name.

string

Maximum length: 79

ssh-filter-profile

Name of an existing SSH filter profile.

string

Not Specified

ssh-policy-redirect

Redirect SSH traffic to matching transparent proxy policy.

option

disable

Option	Description
enable	Enable SSH policy redirect.
disable	Disable SSH policy redirect.

ssl-ssh-profile

Name of an existing SSL SSH profile.

string

Not Specified

no-inspection

status

Enable/disable the active status of the policy.

option

enable

Option	Description
enable	Enable setting.
disable	Disable setting.

transparent

Enable to use the IP address of the client to connect to the server.

option

disable

Option	Description
enable	Enable use of IP address of client to connect to server.
disable	Disable use of IP address of client to connect to server.

users <name>

Names of user objects.

Group name.

string

Maximum length: 79

utm-status

Enable the use of UTM profiles/sensors/lists.

option

disable

Option	Description
enable	Enable setting.
disable	Disable setting.

uuid

Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

uuid

Not Specified

00000000-0000-0000-0000-000000000000

waf-profile

Name of an existing Web application firewall profile.

string

Not Specified

webcache *

Enable/disable web caching.

option

disable

Option	Description
enable	Enable setting.
disable	Disable setting.

webcache-https *

Enable/disable web caching for HTTPS (Requires deep-inspection enabled in ssl-ssh-profile).

option

disable

Option	Description
disable	Disable web cache for HTTPS.
enable	Enable web cache for HTTPS.

webfilter-profile

Name of an existing Web filter profile.

string

Not Specified

webproxy-forward-server

Web proxy forward server name.

string

Not Specified

webproxy-profile

Name of web proxy profile.

string

Not Specified

* This parameter may not exist in some models.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

CLI Reference

config firewall proxy-policy

config firewall proxy-policy

config firewall proxy-policy

config firewall proxy-policy

config firewall proxy-policy

config firewall proxy-policy