anti-replay

Enable or disable anti-replay checking.

auth-cert

Select the HTTPS server certificate for policy authentication.

auth-path

Enable or disable authentication-based routing.

auth-redirect-addr

Select the HTTP-to-HTTPS redirect address for firewall authentication.

auto-asic-offload

Enable or disable policy traffic ASIC offloading.

block-notification

Enable or disable block notification.

cgn-eif

Enable or disable CGN endpoint independent filtering.

cgn-eim

Enable or disable CGN endpoint independent mapping.

cgn-log-server-grp

Select the NP log server group.

cgn-resource-quota

Set the allowed number of blocks assigned to a source IP address.

cgn-session-quota

Set the allowed concurrent sessions available for a source IP address.

custom-log-fields

Select custom fields to append to log messages for this policy.

delay-tcp-npu-session

Enable or disable TCP NPU session delay to guarantee packet order of 3-way handshake.

diffserv-copy

Enable or disable copying of the DSCP values from the original direction to the reply direction.

diffserv-forward

Enable or disable application of the differentiated services code point (DSCP) value to the DSCP field of forward (original) traffic. If enabled, also configure diffservcode-forward.

diffserv-reverse

Enable or disable application of the DSCP value to the DSCP field of reverse (reply) traffic. If enabled, also configure diffservcode-rev.

diffservcode-forward

Enter the DSCP value that the FortiGate unit will apply to the field of originating (forward) packets. The value is 6 bits binary. The valid range is 000000-111111.

diffservcode-rev

Enter the DSCP value that the FortiGate unit will apply to the field of reply (reverse) packets. The value is 6 bits binary. The valid range is 000000-111111.

dlp-profile

Select an existing data loss prevention (DLP) profile.

dsri

Enable to ignore HTTP server responses.

dstaddr-negate

Enable to negate the destination IP address.

dstaddr6-negate

Enable to negate the destination IPv6 address.

dynamic-shaping

Enable or disable dynamic RADIUS-defined traffic shaping.

email-collect

Enable or disable email collection.

fec

Enable or disable forward error correction (FEC) on traffic matching this policy on a FEC device.

firewall-session-dirty

Select how to handle sessions if the configuration of this firewall policy changes.

ffsso-agent-for-ntlm

Select the FSSO agent for NTLM authentication.

geoip-anycast

Enable or disable recognition of anycast IP addresses using the geography IP database.

geoip-match

Select whether to match the address based on the physical or registered location.

identity-based-route

Select the identity-based routing rule.

internet-service-negate

Enable to negate the internet service set in the policy.

internet-service-src-negate

Enable to negate the source internet service set in this policy.

internet-service6

Enable or disable the use of IPv6 internet services for this policy. If enabled, the destination address and service set in the policy are not used.

internet-service6-custom

Select a custom IPv6 internet service.

internet-service6-custom-group

Select a custom IPv6 internet service group.

internet-service6-group

Select an IPv6 internet service group.

internet-service6-name

Select an IPv6 internet service.

internet-service6-negate

Enable to negate the source IPv6 internet service set in this policy.

internet-service6-src

Enable or disable use of the IPv6 internet services in the source for this policy. If enabled, the source address is not used.

internet-service6-src-custom

Select the custom IPv6 internet service source.

internet-service6-src-custom-group

Select the custom IPv6 source group.

internet-service6-src-group

Select the IPv6 source group.

internet-service6-src-name

Select the IPv6 source.

internet-service6-src-negate

Enable to negate the value set in internet-service6-src.

match-vip

Enable or disable matching of packets that have had their destination address changed by a VIP.

match-vip-only

Enable or disable matching only those packets that have had their destination addresses change by a VIP.

natinbound

Enable or disable applying destination NAT to inbound traffic.

natip

Set the source NAT IP address for inbound traffic.

natoutbound

Enable or disable applying destination NAT to outbound traffic.

network-service-dynamic

Select a dynamic network service.

network-service-src-dynamic

Select a dynamic network service source.

np-acceleration

Enable or disable UTM network processor acceleration.

ntlm

Enable or disable NTLM authentication.

ntlm-enabled-browsers

Set the HTTP-User-Agent value of supported browsers.

ntlm-guest

Enable or disable NTLM guest user access.

outbound

Enable or disable application of the differentiated services code point (DSCP) value to the DSCP field of forward (original) traffic.

passive-wan-health-measurement

Enable or disable passive WAN health measurement. When enabled, auto-asic-offload is disabled.

permit-any-host

Enable or disable accepting UDP packets from any host.

permit-stun-host

Enable or disable accepting UDP packets from any session traversal utilities for NAT (STUN) host.

policy-expiry

Enable or disable policy expiry.

policy-expiry-date

If policy-expiry is enabled, set the policy expiry date.

policy-offload

Enable or disable hardware session setup for CGNAT.

radius-mac-auth-bypass

Enable or disable MAC authentication bypass. The bypassed MAC address must be received from the RADIUS server.

redirect-url

Set the URL to which users are redirected after seeing and accepting the disclaimer or authenticating.

reputation-direction

Set the destination of the initial traffic for reputation to take effect.

reputation-direction6

Set the destination of the initial traffic for IPv6 reputation to take effect.

reputation-minimum

Set the minimum reputation to take action.

reputation-minimum6

Set the minimum IPv6 reputation to take action.

rtp-addr

If this is an RTP NAT policy, set the address names.

rtp-nat

Enable or disable real time protocol (RTP) NAT.

schedule-timeout

Enable or disable ending current sessions when the schedule object times out. Disable allows sessions to end from inactivity.

sctp-filter-profile

Select an existing SCTP filter profile.

send-deny-packet

Enable or disable sending a reply when a session is denied or blocked by a firewall policy.

service-negate

Enable or disable negation of the service set in the policy.

session-ttl

Enter a value for the session time-to-live (TTL) from 300 to 604800, or type 0 for no limitation.

sgt

Enter security group tags (SGT).

sgt-check

Enable or disable SGT check.

src-vendor-mac

Select the vendor MAC source.

srcaddr-negate

Enable or disable negation of the source address.

srcaddr6-negate

Enable or disable negation of the source IPv6 address.

ssh-filter-profile

Select an SSH filter profile from the drop-down list.

ssh-policy-redirect

Enable or disable SSH policy redirect.

tcp-mss-receiver

Enter the receiver’s TCP maximum segment size (MSS).

tcp-mss-sender

Enter the sender’s TCP MSS.

tcp-session-without-syn

Enable or disable creation of a TCP session without the SYN flag.

tcp-timeout-pid

Select the TCP timeout profile.

timeout-send-rst

Enable or disable the sending of RST packets when TCP sessions expire

tos

Enter the type of service (TOS) value used for comparison.

tos-mask

Enter the bit mask for TOS. Non-zero bit positions are used for comparison while zero bit positions are ignored.

tos-negate

Enable or disable to negate the TOS match.

udp-timeout-pid

Select the UDP timeout profile.

uuid

Enter the universally unique identifier (UUID). This value is automatically assigned but can be manually reset.

vlan-cos-fwd

Select the VLAN forward direction user priority. The available values are:

• 255 (passthrough)

• 0 (lowest) - 7 (highest)

vlan-cos-rev

Select the VLAN reverse direction user priority. The available values are:

• 255 (passthrough)

• 0 (lowest) - 7 (highest)

vlan-filter

Set VLAN filters.

wanopt

Enable or disable WAN optimization (IPv4 only).

wanopt-detection

Select the WAN optimization as active, passive, or off.

wanopt-passive-opt

Select WAN optimization passive mode options. This option decides what IP address will be used to connect server (IPv4 only).

wanopt-peer

Select a WAN optimization peer (IPv4 only).

wanopt-profile

Select a WAN optimization profile (IPv4 only).

webcache

Enable or disable web cache (IPv4 only).

webcache-https

Enable or disable the web cache for HTTPS (IPv4 only).

webproxy-forward-server

Select the webproxy forward server (IPv4 only).