action

Policy action (accept/deny/ipsec).

option

-

anti-replay

Enable/disable anti-replay check.

option

-

app-monitor

Enable/disable application TCP metrics in session logs.When enabled, auto-asic-offload is disabled.

option

-

application-list

Name of an existing Application list.

string

Maximum length: 47

auth-cert

HTTPS server certificate for policy authentication.

string

Maximum length: 35

auth-path

Enable/disable authentication-based routing.

option

-

auth-redirect-addr

HTTP-to-HTTPS redirect address for firewall authentication.

string

Maximum length: 63

auto-asic-offload

Enable/disable policy traffic ASIC offloading.

option

-

av-profile

Name of an existing Antivirus profile.

string

Maximum length: 47

block-notification

Enable/disable block notification.

option

-

captive-portal-exempt

Enable to exempt some users from the captive portal.

option

-

capture-packet *

Enable/disable capture packets.

option

-

casb-profile

Name of an existing CASB profile.

string

Maximum length: 47

comments

Comment.

var-string

Maximum length: 1023

custom-log-fields <field-id>

Custom fields to append to log messages for this policy.

Custom log field.

string

Maximum length: 35

decrypted-traffic-mirror

Decrypted traffic mirror.

string

Maximum length: 35

delay-tcp-npu-session

Enable TCP NPU session delay to guarantee packet order of 3-way handshake.

option

-

diameter-filter-profile

Name of an existing Diameter filter profile.

string

Maximum length: 47

diffserv-copy

Enable to copy packet's DiffServ values from session's original direction to its reply direction.

option

-

diffserv-forward

Enable to change packet's DiffServ values to the specified diffservcode-forward value.

option

-

diffserv-reverse

Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value.

option

-

diffservcode-forward

Change packet's DiffServ to this value.

user

Not Specified

diffservcode-rev

Change packet's reverse (reply) DiffServ to this value.

user

Not Specified

disclaimer

Enable/disable user authentication disclaimer.

option

-

dlp-profile

Name of an existing DLP profile.

string

Maximum length: 47

dnsfilter-profile

Name of an existing DNS filter profile.

string

Maximum length: 47

dsri

Enable DSRI to ignore HTTP server responses.

option

-

dstaddr <name>

Destination IPv4 address and address group names.

Address name.

string

Maximum length: 79

dstaddr-negate

When enabled dstaddr specifies what the destination address must NOT be.

option

-

dstaddr6 <name>

Destination IPv6 address name and address group names.

Address name.

string

Maximum length: 79

dstaddr6-negate

When enabled dstaddr6 specifies what the destination address must NOT be.

option

-

dstintf <name>

Outgoing (egress) interface.

Interface name.

string

Maximum length: 79

dynamic-shaping

Enable/disable dynamic RADIUS defined traffic shaping.

option

-

email-collect

Enable/disable email collection.

option

-

emailfilter-profile

Name of an existing email filter profile.

string

Maximum length: 47

fec

Enable/disable Forward Error Correction on traffic matching this policy on a FEC device.

option

-

file-filter-profile

Name of an existing file-filter profile.

string

Maximum length: 47

firewall-session-dirty

How to handle sessions if the configuration of this firewall policy changes.

option

-

fixedport

Enable to prevent source NAT from changing a session's source port.

option

-

fsso-agent-for-ntlm

FSSO agent to use for NTLM authentication.

string

Maximum length: 35

fsso-groups <name>

Names of FSSO groups.

Names of FSSO groups.

string

Maximum length: 511

geoip-anycast

Enable/disable recognition of anycast IP addresses using the geography IP database.

option

-

geoip-match

Match geography address based either on its physical location or registered location.

option

-

groups <name>

Names of user groups that can authenticate with this policy.

Group name.

string

Maximum length: 79

http-policy-redirect

Redirect HTTP(S) traffic to matching transparent web proxy policy.

option

-

icap-profile

Name of an existing ICAP profile.

string

Maximum length: 47

identity-based-route

Name of identity-based routing rule.

string

Maximum length: 35

inbound

Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN.

option

-

inspection-mode

Policy inspection mode (Flow/proxy). Default is Flow mode.

option

-

internet-service

Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used.

option

-

internet-service-custom <name>

Custom Internet Service name.

Custom Internet Service name.

string

Maximum length: 79

internet-service-custom-group <name>

Custom Internet Service group name.

Custom Internet Service group name.

string

Maximum length: 79

internet-service-group <name>

Internet Service group name.

Internet Service group name.

string

Maximum length: 79

internet-service-name <name>

Internet Service name.

Internet Service name.

string

Maximum length: 79

internet-service-negate

When enabled internet-service specifies what the service must NOT be.

option

-

internet-service-src

Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used.

option

-

internet-service-src-custom <name>

Custom Internet Service source name.

Custom Internet Service name.

string

Maximum length: 79

internet-service-src-custom-group <name>

Custom Internet Service source group name.

Custom Internet Service group name.

string

Maximum length: 79

internet-service-src-group <name>

Internet Service source group name.

Internet Service group name.

string

Maximum length: 79

internet-service-src-name <name>

Internet Service source name.

Internet Service name.

string

Maximum length: 79

internet-service-src-negate

When enabled internet-service-src specifies what the service must NOT be.

option

-

internet-service6

Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used.

option

-

internet-service6-custom <name>

Custom IPv6 Internet Service name.

Custom Internet Service name.

string

Maximum length: 79

internet-service6-custom-group <name>

Custom Internet Service6 group name.

Custom Internet Service6 group name.

string

Maximum length: 79

internet-service6-group <name>

Internet Service group name.

Internet Service group name.

string

Maximum length: 79

internet-service6-name <name>

IPv6 Internet Service name.

IPv6 Internet Service name.

string

Maximum length: 79

internet-service6-negate

When enabled internet-service6 specifies what the service must NOT be.

option

-

internet-service6-src

Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used.

option

-

internet-service6-src-custom <name>

Custom IPv6 Internet Service source name.

Custom Internet Service name.

string

Maximum length: 79

internet-service6-src-custom-group <name>

Custom Internet Service6 source group name.

Custom Internet Service6 group name.

string

Maximum length: 79

internet-service6-src-group <name>

Internet Service6 source group name.

Internet Service group name.

string

Maximum length: 79

internet-service6-src-name <name>

IPv6 Internet Service source name.

Internet Service name.

string

Maximum length: 79

internet-service6-src-negate

When enabled internet-service6-src specifies what the service must NOT be.

option

-

ippool

Enable to use IP Pools for source NAT.

option

-

ips-sensor

Name of an existing IPS sensor.

string

Maximum length: 47

ips-voip-filter

Name of an existing VoIP (ips) profile.

string

Maximum length: 47

log-http-transaction

Enable/disable HTTP transaction log.

option

-

logtraffic

Enable or disable logging. Log all sessions or security profile sessions.

option

-

logtraffic-start

Record logs when a session starts.

option

-

match-vip

Enable to match packets that have had their destination addresses changed by a VIP.

option

-

match-vip-only

Enable/disable matching of only those packets that have had their destination addresses changed by a VIP.

option

-

name

Policy name.

string

Maximum length: 35

nat

Enable/disable source NAT.

option

-

nat46

Enable/disable NAT46.

option

-

nat64

Enable/disable NAT64.

option

-

natinbound

Policy-based IPsec VPN: apply destination NAT to inbound traffic.

option

-

natip

Policy-based IPsec VPN: source NAT IP address for outgoing traffic.

ipv4-classnet

Not Specified

natoutbound

Policy-based IPsec VPN: apply source NAT to outbound traffic.

option

-

network-service-dynamic <name>

Dynamic Network Service name.

Dynamic Network Service name.

string

Maximum length: 79

network-service-src-dynamic <name>

Dynamic Network Service source name.

Dynamic Network Service name.

string

Maximum length: 79

np-acceleration *

Enable/disable UTM Network Processor acceleration.

option

-

ntlm

Enable/disable NTLM authentication.

option

-

ntlm-enabled-browsers <user-agent-string>

HTTP-User-Agent value of supported browsers.

User agent string.

string

Maximum length: 79

ntlm-guest

Enable/disable NTLM guest user access.

option

-

outbound

Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN.

option

-

passive-wan-health-measurement

Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled.

option

-

pcp-inbound

Enable/disable PCP inbound DNAT.

option

-

pcp-outbound

Enable/disable PCP outbound SNAT.

option

-

pcp-poolname <name>

PCP pool names.

PCP pool name.

string

Maximum length: 79

per-ip-shaper

Per-IP traffic shaper.

string

Maximum length: 35

permit-any-host

Accept UDP packets from any host.

option

-

permit-stun-host

Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host.

option

-

policy-expiry

Enable/disable policy expiry.

option

-

policy-expiry-date

Policy expiry date (YYYY-MM-DD HH:MM:SS).

datetime

Not Specified

policy-expiry-date-utc

Policy expiry date and time, in epoch format.

user

Not Specified

policyid

Policy ID (0 - 4294967294).

integer

Minimum value: 0 Maximum value: 4294967294

poolname <name>

IP Pool names.

IP pool name.

string

Maximum length: 79

poolname6 <name>

IPv6 pool names.

IPv6 pool name.

string

Maximum length: 79

port-preserve

Enable/disable preservation of the original source port from source NAT if it has not been used.

option

-

port-random

Enable/disable random source port selection for source NAT.

option

-

profile-group

Name of profile group.

string

Maximum length: 47

profile-protocol-options

Name of an existing Protocol options profile.

string

Maximum length: 47

profile-type

Determine whether the firewall policy allows security profile groups or single profiles only.

option

-

radius-ip-auth-bypass

Enable IP authentication bypass. The bypassed IP address must be received from RADIUS server.

option

-

radius-mac-auth-bypass

Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server.

option

-

redirect-url

URL users are directed to after seeing and accepting the disclaimer or authenticating.

var-string

Maximum length: 1023

replacemsg-override-group

Override the default replacement message group for this policy.

string

Maximum length: 35

reputation-direction

Direction of the initial traffic for reputation to take effect.

option

-

reputation-direction6

Direction of the initial traffic for IPv6 reputation to take effect.

option

-

reputation-minimum

Minimum Reputation to take action.

integer

Minimum value: 0 Maximum value: 4294967295

reputation-minimum6

IPv6 Minimum Reputation to take action.

integer

Minimum value: 0 Maximum value: 4294967295

rtp-addr <name>

Address names if this is an RTP NAT policy.

Address name.

string

Maximum length: 79

rtp-nat

Enable Real Time Protocol (RTP) NAT.

option

-

schedule

Schedule name.

string

Maximum length: 35

schedule-timeout

Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity.

option

-

sctp-filter-profile

Name of an existing SCTP filter profile.

string

Maximum length: 47

send-deny-packet

Enable to send a reply when a session is denied or blocked by a firewall policy.

option

-

service <name>

Service and service group names.

Service and service group names.

string

Maximum length: 79

service-negate

When enabled service specifies what the service must NOT be.

option

-

session-ttl

TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).

user

Not Specified

sgt <id>

Security group tags.

Security group tag (1 - 65535).

integer

Minimum value: 1 Maximum value: 65535

sgt-check

Enable/disable security group tags (SGT) check.

option

-

src-vendor-mac <id>

Vendor MAC source ID.

Vendor MAC ID.

integer

Minimum value: 0 Maximum value: 4294967295

srcaddr <name>

Source IPv4 address and address group names.

Address name.

string

Maximum length: 79

srcaddr-negate

When enabled srcaddr specifies what the source address must NOT be.

option

-

srcaddr6 <name>

Source IPv6 address name and address group names.

Address name.

string

Maximum length: 79

srcaddr6-negate

When enabled srcaddr6 specifies what the source address must NOT be.

option

-

srcintf <name>

Incoming (ingress) interface.

Interface name.

string

Maximum length: 79

ssh-filter-profile

Name of an existing SSH filter profile.

string

Maximum length: 47

ssh-policy-redirect

Redirect SSH traffic to matching transparent proxy policy.

option

-

ssl-ssh-profile

Name of an existing SSL SSH profile.

string

Maximum length: 47

status

Enable or disable this policy.

option

-

tcp-mss-receiver

Receiver TCP maximum segment size (MSS).

integer

Minimum value: 0 Maximum value: 65535

tcp-mss-sender

Sender TCP maximum segment size (MSS).

integer

Minimum value: 0 Maximum value: 65535

tcp-session-without-syn

Enable/disable creation of TCP session without SYN flag.

option

-

telemetry-profile *

Name of an existing telemetry profile.

string

Maximum length: 47

timeout-send-rst

Enable/disable sending RST packets when TCP sessions expire.

option

-

tos

ToS (Type of Service) value used for comparison.

user

Not Specified

tos-mask

Non-zero bit positions are used for comparison while zero bit positions are ignored.

user

Not Specified

tos-negate

Enable negated TOS match.

option

-

traffic-shaper

Traffic shaper.

string

Maximum length: 35

traffic-shaper-reverse

Reverse traffic shaper.

string

Maximum length: 35

users <name>

Names of individual users that can authenticate with this policy.

Names of individual users that can authenticate with this policy.

string

Maximum length: 79

utm-status

Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy.

option

-

uuid

Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

uuid

Not Specified

videofilter-profile

Name of an existing VideoFilter profile.

string

Maximum length: 47

virtual-patch-profile

Name of an existing virtual-patch profile.

string

Maximum length: 47

vlan-cos-fwd

VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.

integer

Minimum value: 0 Maximum value: 7

vlan-cos-rev

VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.

integer

Minimum value: 0 Maximum value: 7

vlan-filter

VLAN ranges to allow

user

Not Specified

voip-profile

Name of an existing VoIP (voipd) profile.

string

Maximum length: 47

vpntunnel

Policy-based IPsec VPN: name of the IPsec VPN Phase 1.

string

Maximum length: 35

waf-profile

Name of an existing Web application firewall profile.

string

Maximum length: 47

wanopt *

Enable/disable WAN optimization.

option

-

wanopt-detection *

WAN optimization auto-detection mode.

option

-

wanopt-passive-opt *

WAN optimization passive mode options. This option decides what IP address will be used to connect server.

option

-

wanopt-peer *

WAN optimization peer.

string

Maximum length: 35

wanopt-profile *

WAN optimization profile.

string

Maximum length: 35

wccp

Enable/disable forwarding traffic matching this policy to a configured WCCP server.

option

-

webcache *

Enable/disable web cache.

option

-

webcache-https *

Enable/disable web cache for HTTPS.

option

-

webfilter-profile

Name of an existing Web filter profile.

string

Maximum length: 47

webproxy-forward-server

Webproxy forward server name.

string

Maximum length: 63

webproxy-profile

Webproxy profile name.

string

Maximum length: 63

ztna-device-ownership

Enable/disable zero trust device ownership.

option

-

ztna-ems-tag <name>

Source ztna-ems-tag names.

Address name.

string

Maximum length: 79

ztna-ems-tag-negate

When enabled ztna-ems-tag specifies what the tags must NOT be.

option

-

ztna-ems-tag-secondary <name>

Source ztna-ems-tag-secondary names.

Address name.

string

Maximum length: 79

ztna-geo-tag <name>

Source ztna-geo-tag names.

Address name.

string

Maximum length: 79

ztna-policy-redirect

Redirect ZTNA traffic to matching Access-Proxy proxy-policy.

option

-

ztna-status

Enable/disable zero trust access.

option

-

ztna-tags-match-logic

ZTNA tag matching logic.

option

-