config firewall policy

Configure IPv4/IPv6 policies.

config firewall policy

Description: Configure IPv4/IPv6 policies.

edit <policyid>

set status [enable|disable]

set name {string}

set uuid {uuid}

set srcintf <name1>, <name2>, ...

set dstintf <name1>, <name2>, ...

set action [accept|deny|...]

set nat64 [enable|disable]

set nat46 [enable|disable]

set ztna-status [enable|disable]

set srcaddr <name1>, <name2>, ...

set dstaddr <name1>, <name2>, ...

set srcaddr6 <name1>, <name2>, ...

set dstaddr6 <name1>, <name2>, ...

set ztna-ems-tag <name1>, <name2>, ...

set ztna-geo-tag <name1>, <name2>, ...

set internet-service [enable|disable]

set internet-service-name <name1>, <name2>, ...

set internet-service-group <name1>, <name2>, ...

set internet-service-custom <name1>, <name2>, ...

set internet-service-custom-group <name1>, <name2>, ...

set internet-service-src [enable|disable]

set internet-service-src-name <name1>, <name2>, ...

set internet-service-src-group <name1>, <name2>, ...

set internet-service-src-custom <name1>, <name2>, ...

set internet-service-src-custom-group <name1>, <name2>, ...

set reputation-minimum {integer}

set reputation-direction [source|destination]

set src-vendor-mac <id1>, <id2>, ...

set rtp-nat [disable|enable]

set rtp-addr <name1>, <name2>, ...

set send-deny-packet [disable|enable]

set firewall-session-dirty [check-all|check-new]

set schedule {string}

set schedule-timeout [enable|disable]

set policy-expiry [enable|disable]

set policy-expiry-date {datetime}

set service <name1>, <name2>, ...

set tos {user}

set tos-mask {user}

set tos-negate [enable|disable]

set anti-replay [enable|disable]

set tcp-session-without-syn [all|data-only|...]

set geoip-anycast [enable|disable]

set geoip-match [physical-location|registered-location]

set dynamic-shaping [enable|disable]

set passive-wan-health-measurement [enable|disable]

set utm-status [enable|disable]

set inspection-mode [proxy|flow]

set http-policy-redirect [enable|disable]

set ssh-policy-redirect [enable|disable]

set webproxy-profile {string}

set profile-type [single|group]

set profile-group {string}

set profile-protocol-options {string}

set ssl-ssh-profile {string}

set av-profile {string}

set webfilter-profile {string}

set dnsfilter-profile {string}

set emailfilter-profile {string}

set dlp-profile {string}

set file-filter-profile {string}

set ips-sensor {string}

set application-list {string}

set voip-profile {string}

set sctp-filter-profile {string}

set icap-profile {string}

set cifs-profile {string}

set videofilter-profile {string}

set waf-profile {string}

set ssh-filter-profile {string}

set logtraffic [all|utm|...]

set logtraffic-start [enable|disable]

set auto-asic-offload [enable|disable]

set np-acceleration [enable|disable]

set webproxy-forward-server {string}

set traffic-shaper {string}

set traffic-shaper-reverse {string}

set per-ip-shaper {string}

set nat [enable|disable]

set permit-any-host [enable|disable]

set permit-stun-host [enable|disable]

set fixedport [enable|disable]

set ippool [enable|disable]

set poolname <name1>, <name2>, ...

set poolname6 <name1>, <name2>, ...

set session-ttl {user}

set vlan-cos-fwd {integer}

set vlan-cos-rev {integer}

set inbound [enable|disable]

set outbound [enable|disable]

set natinbound [enable|disable]

set natoutbound [enable|disable]

set fec [enable|disable]

set wccp [enable|disable]

set ntlm [enable|disable]

set ntlm-guest [enable|disable]

set ntlm-enabled-browsers <user-agent-string1>, <user-agent-string2>, ...

set fsso-agent-for-ntlm {string}

set groups <name1>, <name2>, ...

set users <name1>, <name2>, ...

set fsso-groups <name1>, <name2>, ...

set auth-path [enable|disable]

set disclaimer [enable|disable]

set email-collect [enable|disable]

set vpntunnel {string}

set natip {ipv4-classnet}

set match-vip [enable|disable]

set match-vip-only [enable|disable]

set diffserv-forward [enable|disable]

set diffserv-reverse [enable|disable]

set diffservcode-forward {user}

set diffservcode-rev {user}

set tcp-mss-sender {integer}

set tcp-mss-receiver {integer}

set comments {var-string}

set auth-cert {string}

set auth-redirect-addr {string}

set redirect-url {var-string}

set identity-based-route {string}

set block-notification [enable|disable]

set custom-log-fields <field-id1>, <field-id2>, ...

set replacemsg-override-group {string}

set srcaddr-negate [enable|disable]

set dstaddr-negate [enable|disable]

set service-negate [enable|disable]

set internet-service-negate [enable|disable]

set internet-service-src-negate [enable|disable]

set timeout-send-rst [enable|disable]

set captive-portal-exempt [enable|disable]

set decrypted-traffic-mirror {string}

set dsri [enable|disable]

set radius-mac-auth-bypass [enable|disable]

set delay-tcp-npu-session [enable|disable]

set vlan-filter {user}

set sgt-check [enable|disable]

set sgt <id1>, <id2>, ...

next

end

config firewall policy

Parameter	Description	Type	Size	Default
status	Enable or disable this policy.	option	-	enable
	Option Description enable Enable setting. disable Disable setting.
name	Policy name.	string	Maximum length: 35
uuid	Universally Unique Identifier (UUID; automatically assigned but can be manually reset).	uuid	Not Specified	00000000-0000-0000-0000-000000000000
srcintf <name>	Incoming (ingress) interface. Interface name.	string	Maximum length: 79
dstintf <name>	Outgoing (egress) interface. Interface name.	string	Maximum length: 79
action	Policy action (accept/deny/ipsec).	option	-	deny
	Option Description accept Allows session that match the firewall policy. deny Blocks sessions that match the firewall policy. ipsec Firewall policy becomes a policy-based IPsec VPN policy.
nat64	Enable/disable NAT64.	option	-	disable
	Option Description enable Enable NAT64. disable Disable NAT64.
nat46	Enable/disable NAT46.	option	-	disable
	Option Description enable Enable NAT46. disable Disable NAT46.
ztna-status	Enable/disable zero trust access.	option	-	disable
	Option Description enable Enable zero trust network access. disable Disable zero trust network access.
srcaddr <name>	Source IPv4 address and address group names. Address name.	string	Maximum length: 79
dstaddr <name>	Destination IPv4 address and address group names. Address name.	string	Maximum length: 79
srcaddr6 <name>	Source IPv6 address name and address group names. Address name.	string	Maximum length: 79
dstaddr6 <name>	Destination IPv6 address name and address group names. Address name.	string	Maximum length: 79
ztna-ems-tag <name>	Source ztna-ems-tag names. Address name.	string	Maximum length: 79
ztna-geo-tag <name>	Source ztna-geo-tag names. Address name.	string	Maximum length: 79
internet-service	Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used.	option	-	disable
	Option Description enable Enable use of Internet Services in policy. disable Disable use of Internet Services in policy.
internet-service-name <name>	Internet Service name. Internet Service name.	string	Maximum length: 79
internet-service-group <name>	Internet Service group name. Internet Service group name.	string	Maximum length: 79
internet-service-custom <name>	Custom Internet Service name. Custom Internet Service name.	string	Maximum length: 79
internet-service-custom-group <name>	Custom Internet Service group name. Custom Internet Service group name.	string	Maximum length: 79
internet-service-src	Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used.	option	-	disable
	Option Description enable Enable use of Internet Services source in policy. disable Disable use of Internet Services source in policy.
internet-service-src-name <name>	Internet Service source name. Internet Service name.	string	Maximum length: 79
internet-service-src-group <name>	Internet Service source group name. Internet Service group name.	string	Maximum length: 79
internet-service-src-custom <name>	Custom Internet Service source name. Custom Internet Service name.	string	Maximum length: 79
internet-service-src-custom-group <name>	Custom Internet Service source group name. Custom Internet Service group name.	string	Maximum length: 79
reputation-minimum	Minimum Reputation to take action.	integer	Minimum value: 0 Maximum value: 4294967295	0
reputation-direction	Direction of the initial traffic for reputation to take effect.	option	-	destination
	Option Description source Check reputation for source address. destination Check reputation for destination address.
src-vendor-mac <id>	Vendor MAC source ID. Vendor MAC ID.	integer	Minimum value: 0 Maximum value: 4294967295
rtp-nat	Enable Real Time Protocol (RTP) NAT.	option	-	disable
	Option Description disable Disable setting. enable Enable setting.
rtp-addr <name>	Address names if this is an RTP NAT policy. Address name.	string	Maximum length: 79
send-deny-packet	Enable to send a reply when a session is denied or blocked by a firewall policy.	option	-	disable
	Option Description disable Disable deny-packet sending. enable Enable deny-packet sending.
firewall-session-dirty	How to handle sessions if the configuration of this firewall policy changes.	option	-	check-all
	Option Description check-all Flush all current sessions accepted by this policy. These sessions must be started and re-matched with policies. check-new Continue to allow sessions already accepted by this policy.
schedule	Schedule name.	string	Maximum length: 35
schedule-timeout	Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity.	option	-	disable
	Option Description enable Enable schedule timeout. disable Disable schedule timeout.
policy-expiry	Enable/disable policy expiry.	option	-	disable
	Option Description enable Enable policy expiry. disable Disable polcy expiry.
policy-expiry-date	Policy expiry date (YYYY-MM-DD HH:MM:SS).	datetime	Not Specified	0000-00-00 00:00:00
service <name>	Service and service group names. Service and service group names.	string	Maximum length: 79
tos	ToS (Type of Service) value used for comparison.	user	Not Specified
tos-mask	Non-zero bit positions are used for comparison while zero bit positions are ignored.	user	Not Specified
tos-negate	Enable negated TOS match.	option	-	disable
	Option Description enable Enable TOS match negate. disable Disable TOS match negate.
anti-replay	Enable/disable anti-replay check.	option	-	enable
	Option Description enable Enable anti-replay check. disable Disable anti-replay check.
tcp-session-without-syn	Enable/disable creation of TCP session without SYN flag.	option	-	disable
	Option Description all Enable TCP session without SYN. data-only Enable TCP session data only. disable Disable TCP session without SYN.
geoip-anycast	Enable/disable recognition of anycast IP addresses using the geography IP database.	option	-	disable
	Option Description enable Enable recognition of anycast IP addresses using the geography IP database. disable Disable recognition of anycast IP addresses using the geography IP database.
geoip-match	Match geography address based either on its physical location or registered location.	option	-	physical-location
	Option Description physical-location Match geography address to its physical location using the geography IP database. registered-location Match geography address to its registered location using the geography IP database.
dynamic-shaping	Enable/disable dynamic RADIUS defined traffic shaping.	option	-	disable
	Option Description enable Enable dynamic RADIUS defined traffic shaping. disable Disable dynamic RADIUS defined traffic shaping.
passive-wan-health-measurement	Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled.	option	-	disable
	Option Description enable Enable Passive WAN health measurement. disable Disable Passive WAN health measurement.
utm-status	Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy.	option	-	disable
	Option Description enable Enable setting. disable Disable setting.
inspection-mode	Policy inspection mode (Flow/proxy). Default is Flow mode.	option	-	flow
	Option Description proxy Proxy based inspection. flow Flow based inspection.
http-policy-redirect	Redirect HTTP(S) traffic to matching transparent web proxy policy.	option	-	disable
	Option Description enable Enable HTTP(S) policy redirect. disable Disable HTTP(S) policy redirect.
ssh-policy-redirect	Redirect SSH traffic to matching transparent proxy policy.	option	-	disable
	Option Description enable Enable SSH policy redirect. disable Disable SSH policy redirect.
webproxy-profile	Webproxy profile name.	string	Maximum length: 63
profile-type	Determine whether the firewall policy allows security profile groups or single profiles only.	option	-	single
	Option Description single Do not allow security profile groups. group Allow security profile groups.
profile-group	Name of profile group.	string	Maximum length: 35
profile-protocol-options	Name of an existing Protocol options profile.	string	Maximum length: 35	default
ssl-ssh-profile	Name of an existing SSL SSH profile.	string	Maximum length: 35	no-inspection
av-profile	Name of an existing Antivirus profile.	string	Maximum length: 35
webfilter-profile	Name of an existing Web filter profile.	string	Maximum length: 35
dnsfilter-profile	Name of an existing DNS filter profile.	string	Maximum length: 35
emailfilter-profile	Name of an existing email filter profile.	string	Maximum length: 35
dlp-profile	Name of an existing DLP profile.	string	Maximum length: 35
file-filter-profile	Name of an existing file-filter profile.	string	Maximum length: 35
ips-sensor	Name of an existing IPS sensor.	string	Maximum length: 35
application-list	Name of an existing Application list.	string	Maximum length: 35
voip-profile	Name of an existing VoIP profile.	string	Maximum length: 35
sctp-filter-profile	Name of an existing SCTP filter profile.	string	Maximum length: 35
icap-profile	Name of an existing ICAP profile.	string