policyid

Policy ID.

integer

Minimum value: 0 Maximum value: 4294967294

type

Type of policy.

option

-

status

Enable or disable this policy.

option

-

name

Policy name.

string

Maximum length: 35

uuid

Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

uuid

Not Specified

force-proxy

Force proxy.

option

-

implicit-proxy-detection

Implicit proxy detection.

option

-

dynamic-bypass

Dynamic bypass.

option

-

srcintf <name>

Incoming (ingress) interface.

Interface name.

string

Maximum length: 79

dstintf <name>

Outgoing (egress) interface.

Interface name.

string

Maximum length: 79

ztna-device-ownership

Enable/disable zero trust device ownership.

option

-

srcaddr <name>

Source address and address group names.

Address name.

string

Maximum length: 79

dstaddr <name>

Destination address and address group names.

Address name.

string

Maximum length: 79

srcaddr6 <name>

IPv6 source address (web proxy and ftp proxy only).

Address name.

string

Maximum length: 79

dstaddr6 <name>

IPv6 destination address (web proxy and ftp proxy only).

Address name.

string

Maximum length: 79

action

Policy action (allow/deny).

option

-

schedule

Schedule name.

string

Maximum length: 35

policy-expiry

Enable/disable policy expiry.

option

-

policy-expiry-date

Policy expiry date (YYYY-MM-DD HH:MM:SS).

datetime

Not Specified

service <name>

Service and service group names.

Service and service group names.

string

Maximum length: 79

explicit-web-proxy <name>

Explicit web proxy.

Explicit Web proxy name.

string

Maximum length: 79

transparent

set webproxy to use original client address.

option

-

access-proxy <name>

Access Proxy.

Access Proxy name.

string

Maximum length: 79

ztna-proxy <name>

ZTNA Traffic Forward Proxy.

ZTNA Traffic Forward Proxy name.

string

Maximum length: 79

ztna-ems-tag <name>

Source ztna-ems-tag names.

Address name.

string

Maximum length: 79

ztna-ems-tag-secondary <name>

Source ztna-ems-tag-secondary names.

Address name.

string

Maximum length: 79

ztna-tags-match-logic

ZTNA tag matching logic.

option

-

device-ownership

When enabled, the ownership enforcement will be done at policy level.

option

-

pass-through

Enable/disable policy matching pass through

option

-

url-category <id>

URL category ID list.

URL category ID.

integer

Minimum value: 0 Maximum value: 4294967295

url-risk <name>

URL risk level name.

Risk level name.

string

Maximum length: 79

internet-service

Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used.

option

-

internet-service-name <name>

Internet Service name.

Internet Service name.

string

Maximum length: 79

internet-service-group <name>

Internet Service group name.

Internet Service group name.

string

Maximum length: 79

internet-service-custom <name>

Custom Internet Service Name.

Custom Internet Service name.

string

Maximum length: 79

internet-service6

Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used.

option

-

internet-service6-name <name>

IPv6 Internet Service name.

IPv6 Internet Service name.

string

Maximum length: 79

internet-service6-group <name>

Internet Service group name.

Internet Service group name.

string

Maximum length: 79

internet-service6-custom <name>

Custom IPv6 Internet Service name.

Custom Internet Service name.

string

Maximum length: 79

internet-service6-custom-group <name>

Custom Internet Service6 group name.

Custom Internet Service6 group name.

string

Maximum length: 79

internet-service-custom-group <name>

Custom Internet Service group name.

Custom Internet Service group name.

string

Maximum length: 79

utm-status

Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy.

option

-

ztna-policy-redirect

Redirect ZTNA traffic to matching Access-Proxy proxy-policy.

option

-

webproxy-profile

Web proxy profile using when none matched policy.

string

Maximum length: 63

logtraffic

Enable or disable logging. Log all sessions or security profile sessions.

option

-

logtraffic-start

Record logs when a session starts and ends.

option

-

log-http-transaction

Enable/disable http transaction log.

option

-

extended-log

Enable/disable extended log for http transaction.

option

-

wanopt

Enable/disable WAN optimization.

option

-

wanopt-detection

WAN optimization auto-detection mode.

option

-

wanopt-passive-opt

WAN optimization passive mode options. This option decides what IP address will be used to connect server.

option

-

wanopt-profile

WAN optimization profile.

string

Maximum length: 35

wanopt-peer

WAN optimization peer.

string

Maximum length: 35

webcache

Enable/disable web cache.

option

-

webcache-https

Enable/disable web cache for HTTPS.

option

-

reverse-cache

Enable/disable reverse cache servers.

option

-

http-tunnel-auth

Enable/disable HTTP tunnel authentication.

option

-

ssh-policy-check

Enable/disable SSH policy check.

option

-

webproxy-forward-server

Webproxy forward server name.

string

Maximum length: 63

isolator-server

isolator server name.

string

Maximum length: 63

poolname <name>

Name of IP pool object.

IP pool name.

string

Maximum length: 79

groups <name>

Names of user groups that can authenticate with this policy.

Group name.

string

Maximum length: 79

users <name>

Names of individual users that can authenticate with this policy.

Names of individual users that can authenticate with this policy.

string

Maximum length: 79

disclaimer

Web proxy disclaimer setting: by domain, policy, or user.

option

-

comments

Comment.

var-string

Maximum length: 1023

redirect-url

Redirect URL for further web proxy processing.

var-string

Maximum length: 1023

custom-log-fields <field-id>

Custom fields to append to log messages for this policy.

Custom log field.

string

Maximum length: 35

replacemsg-override-group

Override the default replacement message group for this policy.

string

Maximum length: 35

srcaddr-negate

When enabled srcaddr specifies what the source address must NOT be.

option

-

dstaddr-negate

When enabled dstaddr specifies what the destination address must NOT be.

option

-

service-negate

When enabled service specifies what the service must NOT be.

option

-

internet-service-negate

When enabled internet-service specifies what the service must NOT be.

option

-

internet-service6-negate

When enabled internet-service6 specifies what the service must not be.

option

-

application <id>

Application ID list.

Application IDs.

integer

Minimum value: 0 Maximum value: 4294967295

app-category <id>

Application category ID list.

Category IDs.

integer

Minimum value: 0 Maximum value: 4294967295

app-group <name>

One or more application group names.

Application group name.

string

Maximum length: 79

https-sub-category

Enable/disable HTTPS sub-category policy matching.

option

-

decrypted-traffic-mirror

Decrypted traffic mirror.

string

Maximum length: 35

max-session-per-user

Max UTM sessions per user.

integer

Minimum value: 0 Maximum value: 4294967295

profile-type

Determine whether the firewall policy allows security profile groups or single profiles only.

option

-

profile-group

Name of profile group.

string

Maximum length: 35

profile-protocol-options

Name of an existing Protocol options profile.

string

Maximum length: 35

ssl-ssh-profile

Name of an existing SSL SSH profile.

string

Maximum length: 35

av-profile

Name of an existing Antivirus profile.

string

Maximum length: 35

ia-profile

Image analyzer profile.

string

Maximum length: 35

webfilter-profile

Name of an existing Web filter profile.

string

Maximum length: 35

dnsfilter-profile

Name of an existing DNS filter profile.

string

Maximum length: 35

emailfilter-profile

Name of an existing email filter profile.

string

Maximum length: 35

dlp-profile

Name of an existing DLP profile.

string

Maximum length: 35

file-filter-profile

Name of an existing file-filter profile.

string

Maximum length: 35

ips-sensor

Name of an existing IPS sensor.

string

Maximum length: 35

application-list

Name of an existing Application list.

string

Maximum length: 35

icap-profile

Name of an existing ICAP profile.

string

Maximum length: 35

cifs-profile

Name of an existing CIFS profile.

string

Maximum length: 35

videofilter-profile

Name of an existing VideoFilter profile.

string

Maximum length: 35

isolator-profile

Name of an existing isolator profile.

string

Maximum length: 35

redirect-profile

Name of an existing URL Redirect profile.

string

Maximum length: 35

ssh-filter-profile

Name of an existing SSH filter profile.

string

Maximum length: 35

casb-profile

Name of an existing CASB profile.

string

Maximum length: 35

llm-profile

Name of an existing LLM profile.

string

Maximum length: 35

detect-https-in-http-request

Enable/disable detection of HTTPS in HTTP request.

option

-