status

Enable or disable this policy.

option

name

Policy name.

string

uuid

Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

uuid

srcintf <name>

Incoming (ingress) interface.

Interface name.

string

dstintf <name>

Outgoing (egress) interface.

Interface name.

string

srcaddr4 <name>

Source IPv4 address name and address group names.

Address name.

string

dstaddr4 <name>

Destination IPv4 address name and address group names.

Address name.

string

srcaddr6 <name>

Source IPv6 address name and address group names.

Address name.

string

dstaddr6 <name>

Destination IPv6 address name and address group names.

Address name.

string

srcaddr-negate

When enabled srcaddr specifies what the source address must NOT be.

option

dstaddr-negate

When enabled dstaddr specifies what the destination address must NOT be.

option

service-negate

When enabled service specifies what the service must NOT be.

option

internet-service

Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used.

option

internet-service-id <id>

Internet Service ID.

Internet Service ID.

integer

internet-service-group <name>

Internet Service group name.

Internet Service group name.

string

internet-service-custom <name>

Custom Internet Service name.

Custom Internet Service name.

string

internet-service-custom-group <name>

Custom Internet Service group name.

Custom Internet Service group name.

string

internet-service-src

Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used.

option

internet-service-src-id <id>

Internet Service source ID.

Internet Service ID.

integer

internet-service-src-group <name>

Internet Service source group name.

Internet Service group name.

string

internet-service-src-custom <name>

Custom Internet Service source name.

Custom Internet Service name.

string

internet-service-src-custom-group <name>

Custom Internet Service source group name.

Custom Internet Service group name.

string

internet-service-negate

When enabled internet-service specifies what the service must NOT be.

option

internet-service-src-negate

When enabled internet-service-src specifies what the service must NOT be.

option

action

Policy action (allow/deny/ipsec).

option

schedule

Schedule name.

string

service <name>

Service and service group names.

Service name.

string

utm-status

Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy.

option

inspection-mode

Policy inspection mode (Flow/proxy). Default is Flow mode.

option

http-policy-redirect

Redirect HTTP(S) traffic to matching transparent web proxy policy.

option

ssh-policy-redirect

Redirect SSH traffic to matching transparent proxy policy.

option

webproxy-profile

Webproxy profile name.

string

profile-type

Determine whether the firewall policy allows security profile groups or single profiles only.

option

profile-group

Name of profile group.

string

profile-protocol-options

Name of an existing Protocol options profile.

string

ssl-ssh-profile

Name of an existing SSL SSH profile.

string

av-profile

Name of an existing Antivirus profile.

string

webfilter-profile

Name of an existing Web filter profile.

string

dnsfilter-profile

Name of an existing DNS filter profile.

string

emailfilter-profile

Name of an existing email filter profile.

string

dlp-sensor

Name of an existing DLP sensor.

string

ips-sensor

Name of an existing IPS sensor.

string

application-list

Name of an existing Application list.

string

voip-profile

Name of an existing VoIP profile.

string

icap-profile

Name of an existing ICAP profile.

string

cifs-profile

Name of an existing CIFS profile.

string

waf-profile

Name of an existing Web application firewall profile.

string

ssh-filter-profile

Name of an existing SSH filter profile.

string

logtraffic

Enable or disable logging. Log all sessions or security profile sessions.

option

logtraffic-start

Record logs when a session starts.

option

auto-asic-offload

Enable/disable policy traffic ASIC offloading.

option

groups <name>

Names of user groups that can authenticate with this policy.

Group name.

string

users <name>

Names of individual users that can authenticate with this policy.

User name.

string

diffserv-forward

Enable to change packet's DiffServ values to the specified diffservcode-forward value.

option

diffserv-reverse

Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value.

option

diffservcode-forward

Change packet's DiffServ to this value.

user

diffservcode-rev

Change packet's reverse (reply) DiffServ to this value.

user

tcp-mss-sender

Sender TCP maximum segment size (MSS).

integer

tcp-mss-receiver

Receiver TCP maximum segment size (MSS).

integer

webproxy-forward-server

Webproxy forward server name.

string

traffic-shaper

Traffic shaper.

string

traffic-shaper-reverse

Reverse traffic shaper.

string

per-ip-shaper

Per-IP traffic shaper.

string

nat

Enable/disable source NAT.

option

fixedport

Enable to prevent source NAT from changing a session's source port.

option

ippool

Enable to use IP Pools for source NAT.

option

poolname4 <name>

IPv4 pool names.

IPv4 pool name.

string

poolname6 <name>

IPv6 pool names.

IPv6 pool name.

string

session-ttl

TTL in seconds for sessions accepted by this policy .

integer

comments

Comment.

var-string

vpntunnel

Policy-based IPsec VPN: name of the IPsec VPN Phase 1.

string

inbound

Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN.

option

outbound

Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN.

option

captive-portal-exempt

Enable exemption of some users from the captive portal.

option