config firewall policy

Configure policies.

Syntax

config firewall policy
    edit <policyid>
        set action [accept|deny]
        set application-list {string}
        set av-profile {string}
        set comments {var-string}
        set custom-log-fields <field-id1>, <field-id2>, ...
        set dstaddr <name1>, <name2>, ...
        set dstintf <name1>, <name2>, ...
        set ips-sensor {string}
        set logtraffic [all|utm|...]
        set name {string}
        set nat [enable|disable]
        set profile-group {string}
        set profile-protocol-options {string}
        set profile-type [single|group]
        set service <name1>, <name2>, ...
        set srcaddr <name1>, <name2>, ...
        set srcintf <name1>, <name2>, ...
        set ssl-ssh-profile {string}
        set status [enable|disable]
        set utm-status [enable|disable]
        set webfilter-profile {string}
    next
end

Parameters

Parameter

Description

Type

Size

Default

action

Policy action (accept/deny).

option

Option	Description
accept	Allows session that match the firewall policy.
deny	Blocks sessions that match the firewall policy.

application-list

Name of an existing Application list.

string

Maximum length: 35

av-profile

Name of an existing Antivirus profile.

string

Maximum length: 35

comments

Comment.

var-string

Maximum length: 1023

custom-log-fields <field-id>

Custom fields to append to log messages for this policy.

Custom log field.

string

Maximum length: 35

dstaddr <name>

Destination IPv4 address and address group names.

Address name.

string

Maximum length: 79

dstintf <name>

Outgoing (egress) interface.

Interface name.

string

Maximum length: 79

ips-sensor

Name of an existing IPS sensor.

string

Maximum length: 35

logtraffic

Enable or disable logging. Log all sessions or security profile sessions.

option

utm

Option	Description
all	Log all sessions accepted or denied by this policy.
utm	Log traffic that has a security profile applied to it.
disable	Disable all logging for this policy.

name

Policy name.

string

Maximum length: 35

nat

Enable/disable source NAT.

option

disable

Option	Description
enable	Enable setting.
disable	Disable setting.

policyid

Policy ID.

integer

Minimum value: 1 Maximum value: 65535

profile-group

Name of profile group.

string

Maximum length: 35

profile-protocol-options

Name of an existing Protocol options profile.

string

Maximum length: 35

default

profile-type

Determine whether the firewall policy allows security profile groups or single profiles only.

option

single

Option	Description
single	Do not allow security profile groups.
group	Allow security profile groups.

service <name>

Service and service group names.

string

Maximum length: 79

srcaddr <name>

Source IPv4 address and address group names.

Address name.

string

Maximum length: 79

srcintf <name>

Incoming (ingress) interface.

Interface name.

string

Maximum length: 79

ssl-ssh-profile

Name of an existing SSL SSH profile.

string

Maximum length: 35

no-inspection

status

Enable or disable this policy.

option

enable

Option	Description
enable	Enable setting.
disable	Disable setting.

utm-status

Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy.

option

disable

Option	Description
enable	Enable setting.
disable	Disable setting.

webfilter-profile

Name of an existing Web filter profile.

string

Maximum length: 35

config firewall policy

Configure policies.

Syntax

config firewall policy
    edit <policyid>
        set action [accept|deny]
        set application-list {string}
        set av-profile {string}
        set comments {var-string}
        set custom-log-fields <field-id1>, <field-id2>, ...
        set dstaddr <name1>, <name2>, ...
        set dstintf <name1>, <name2>, ...
        set ips-sensor {string}
        set logtraffic [all|utm|...]
        set name {string}
        set nat [enable|disable]
        set profile-group {string}
        set profile-protocol-options {string}
        set profile-type [single|group]
        set service <name1>, <name2>, ...
        set srcaddr <name1>, <name2>, ...
        set srcintf <name1>, <name2>, ...
        set ssl-ssh-profile {string}
        set status [enable|disable]
        set utm-status [enable|disable]
        set webfilter-profile {string}
    next
end

Parameters

Parameter

Description

Type

Size

Default

action

Policy action (accept/deny).

option

Option	Description
accept	Allows session that match the firewall policy.
deny	Blocks sessions that match the firewall policy.

application-list

Name of an existing Application list.

string

Maximum length: 35

av-profile

Name of an existing Antivirus profile.

string

Maximum length: 35

comments

Comment.

var-string

Maximum length: 1023

custom-log-fields <field-id>

Custom fields to append to log messages for this policy.

Custom log field.

string

Maximum length: 35

dstaddr <name>

Destination IPv4 address and address group names.

Address name.

string

Maximum length: 79

dstintf <name>

Outgoing (egress) interface.

Interface name.

string

Maximum length: 79

ips-sensor

Name of an existing IPS sensor.

string

Maximum length: 35

logtraffic

Enable or disable logging. Log all sessions or security profile sessions.

option

utm

Option	Description
all	Log all sessions accepted or denied by this policy.
utm	Log traffic that has a security profile applied to it.
disable	Disable all logging for this policy.

name

Policy name.

string

Maximum length: 35

nat

Enable/disable source NAT.

option

disable

Option	Description
enable	Enable setting.
disable	Disable setting.

policyid

Policy ID.

integer

Minimum value: 1 Maximum value: 65535

profile-group

Name of profile group.

string

Maximum length: 35

profile-protocol-options

Name of an existing Protocol options profile.

string

Maximum length: 35

default

profile-type

Determine whether the firewall policy allows security profile groups or single profiles only.

option

single

Option	Description
single	Do not allow security profile groups.
group	Allow security profile groups.

service <name>

Service and service group names.

string

Maximum length: 79

srcaddr <name>

Source IPv4 address and address group names.

Address name.

string

Maximum length: 79

srcintf <name>

Incoming (ingress) interface.

Interface name.

string

Maximum length: 79

ssl-ssh-profile

Name of an existing SSL SSH profile.

string

Maximum length: 35

no-inspection

status

Enable or disable this policy.

option

enable

Option	Description
enable	Enable setting.
disable	Disable setting.

utm-status

Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy.

option

disable

Option	Description
enable	Enable setting.
disable	Disable setting.

webfilter-profile

Name of an existing Web filter profile.

string

Maximum length: 35

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

Web Application / API Protection

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

All Products

CLI Reference

config firewall policy

config firewall policy

Syntax

Parameters

config firewall policy

config firewall policy

Syntax

Parameters