Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Fortimanager Provider
  3. API Docs
  4. PackagesPblockFirewallPolicy
fortimanager 1.13.0 published on Thursday, Mar 13, 2025 by fortinetdev
fortinetdev/terraform-provider-fortimanager

fortimanager.PackagesPblockFirewallPolicy

Explore with Pulumi AI

fortimanager logo
fortimanager 1.13.0 published on Thursday, Mar 13, 2025 by fortinetdev
fortinetdev/terraform-provider-fortimanager

    Configuring policy for a policy block.

    This resource is a sub resource for variable firewall_policy of resource fortimanager.PackagesPblock. Conflict and overwrite may occur if use both of them.

    Create PackagesPblockFirewallPolicy Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new PackagesPblockFirewallPolicy(name: string, args: PackagesPblockFirewallPolicyArgs, opts?: CustomResourceOptions);
    @overload
def PackagesPblockFirewallPolicy(resource_name: str,
                                 args: PackagesPblockFirewallPolicyArgs,
                                 opts: Optional[ResourceOptions] = None)

@overload
def PackagesPblockFirewallPolicy(resource_name: str,
                                 opts: Optional[ResourceOptions] = None,
                                 pblock: Optional[str] = None,
                                 _policy_block: Optional[float] = None,
                                 action: Optional[str] = None,
                                 adom: Optional[str] = None,
                                 anti_replay: Optional[str] = None,
                                 app_categories: Optional[Sequence[str]] = None,
                                 app_groups: Optional[Sequence[str]] = None,
                                 application_list: Optional[str] = None,
                                 applications: Optional[Sequence[float]] = None,
                                 auth_cert: Optional[str] = None,
                                 auth_path: Optional[str] = None,
                                 auth_redirect_addr: Optional[str] = None,
                                 auto_asic_offload: Optional[str] = None,
                                 av_profile: Optional[str] = None,
                                 best_route: Optional[str] = None,
                                 block_notification: Optional[str] = None,
                                 captive_portal_exempt: Optional[str] = None,
                                 capture_packet: Optional[str] = None,
                                 casb_profile: Optional[str] = None,
                                 cgn_eif: Optional[str] = None,
                                 cgn_eim: Optional[str] = None,
                                 cgn_log_server_grp: Optional[str] = None,
                                 cgn_resource_quota: Optional[float] = None,
                                 cgn_session_quota: Optional[float] = None,
                                 cgn_sw_eif_ctrl: Optional[str] = None,
                                 cifs_profile: Optional[str] = None,
                                 comments: Optional[str] = None,
                                 custom_log_fields: Optional[Sequence[str]] = None,
                                 decrypted_traffic_mirror: Optional[str] = None,
                                 delay_tcp_npu_session: Optional[str] = None,
                                 devices: Optional[Sequence[str]] = None,
                                 diameter_filter_profile: Optional[str] = None,
                                 diffserv_copy: Optional[str] = None,
                                 diffserv_forward: Optional[str] = None,
                                 diffserv_reverse: Optional[str] = None,
                                 diffservcode_forward: Optional[str] = None,
                                 diffservcode_rev: Optional[str] = None,
                                 disclaimer: Optional[str] = None,
                                 dlp_profile: Optional[str] = None,
                                 dlp_sensor: Optional[str] = None,
                                 dnsfilter_profile: Optional[str] = None,
                                 dscp_match: Optional[str] = None,
                                 dscp_negate: Optional[str] = None,
                                 dscp_value: Optional[str] = None,
                                 dsri: Optional[str] = None,
                                 dstaddr6_negate: Optional[str] = None,
                                 dstaddr6s: Optional[Sequence[str]] = None,
                                 dstaddr_negate: Optional[str] = None,
                                 dstaddrs: Optional[Sequence[str]] = None,
                                 dstintfs: Optional[Sequence[str]] = None,
                                 dynamic_shaping: Optional[str] = None,
                                 eif_check: Optional[str] = None,
                                 eif_learn: Optional[str] = None,
                                 email_collect: Optional[str] = None,
                                 emailfilter_profile: Optional[str] = None,
                                 fec: Optional[str] = None,
                                 file_filter_profile: Optional[str] = None,
                                 firewall_session_dirty: Optional[str] = None,
                                 fixedport: Optional[str] = None,
                                 fsso: Optional[str] = None,
                                 fsso_agent_for_ntlm: Optional[str] = None,
                                 fsso_groups: Optional[Sequence[str]] = None,
                                 geoip_anycast: Optional[str] = None,
                                 geoip_match: Optional[str] = None,
                                 global_label: Optional[str] = None,
                                 groups: Optional[Sequence[str]] = None,
                                 gtp_profile: Optional[str] = None,
                                 http_policy_redirect: Optional[str] = None,
                                 icap_profile: Optional[str] = None,
                                 identity_based_route: Optional[str] = None,
                                 inbound: Optional[str] = None,
                                 inspection_mode: Optional[str] = None,
                                 internet_service: Optional[str] = None,
                                 internet_service6: Optional[str] = None,
                                 internet_service6_custom_groups: Optional[Sequence[str]] = None,
                                 internet_service6_customs: Optional[Sequence[str]] = None,
                                 internet_service6_groups: Optional[Sequence[str]] = None,
                                 internet_service6_names: Optional[Sequence[str]] = None,
                                 internet_service6_negate: Optional[str] = None,
                                 internet_service6_src: Optional[str] = None,
                                 internet_service6_src_custom_groups: Optional[Sequence[str]] = None,
                                 internet_service6_src_customs: Optional[Sequence[str]] = None,
                                 internet_service6_src_groups: Optional[Sequence[str]] = None,
                                 internet_service6_src_names: Optional[Sequence[str]] = None,
                                 internet_service6_src_negate: Optional[str] = None,
                                 internet_service_custom_groups: Optional[Sequence[str]] = None,
                                 internet_service_customs: Optional[Sequence[str]] = None,
                                 internet_service_groups: Optional[Sequence[str]] = None,
                                 internet_service_ids: Optional[Sequence[str]] = None,
                                 internet_service_names: Optional[Sequence[str]] = None,
                                 internet_service_negate: Optional[str] = None,
                                 internet_service_src: Optional[str] = None,
                                 internet_service_src_custom_groups: Optional[Sequence[str]] = None,
                                 internet_service_src_customs: Optional[Sequence[str]] = None,
                                 internet_service_src_groups: Optional[Sequence[str]] = None,
                                 internet_service_src_ids: Optional[Sequence[str]] = None,
                                 internet_service_src_names: Optional[Sequence[str]] = None,
                                 internet_service_src_negate: Optional[str] = None,
                                 ip_version_type: Optional[str] = None,
                                 ippool: Optional[str] = None,
                                 ips_sensor: Optional[str] = None,
                                 ips_voip_filter: Optional[str] = None,
                                 label: Optional[str] = None,
                                 learning_mode: Optional[str] = None,
                                 log_http_transaction: Optional[str] = None,
                                 logtraffic: Optional[str] = None,
                                 logtraffic_start: Optional[str] = None,
                                 match_vip: Optional[str] = None,
                                 match_vip_only: Optional[str] = None,
                                 mms_profile: Optional[str] = None,
                                 name: Optional[str] = None,
                                 nat: Optional[str] = None,
                                 nat46: Optional[str] = None,
                                 nat64: Optional[str] = None,
                                 natinbound: Optional[str] = None,
                                 natips: Optional[Sequence[str]] = None,
                                 natoutbound: Optional[str] = None,
                                 network_service_dynamics: Optional[Sequence[str]] = None,
                                 network_service_src_dynamics: Optional[Sequence[str]] = None,
                                 np_acceleration: Optional[str] = None,
                                 ntlm: Optional[str] = None,
                                 ntlm_enabled_browsers: Optional[Sequence[str]] = None,
                                 ntlm_guest: Optional[str] = None,
                                 outbound: Optional[str] = None,
                                 packages_pblock_firewall_policy_id: Optional[str] = None,
                                 passive_wan_health_measurement: Optional[str] = None,
                                 pcp_inbound: Optional[str] = None,
                                 pcp_outbound: Optional[str] = None,
                                 pcp_poolnames: Optional[Sequence[str]] = None,
                                 per_ip_shaper: Optional[str] = None,
                                 permit_any_host: Optional[str] = None,
                                 permit_stun_host: Optional[str] = None,
                                 pfcp_profile: Optional[str] = None,
                                 policy_behaviour_type: Optional[str] = None,
                                 policy_expiry: Optional[str] = None,
                                 policy_expiry_date: Optional[str] = None,
                                 policy_expiry_date_utc: Optional[str] = None,
                                 policy_offload: Optional[str] = None,
                                 poolname6s: Optional[Sequence[str]] = None,
                                 poolnames: Optional[Sequence[str]] = None,
                                 port_preserve: Optional[str] = None,
                                 profile_group: Optional[str] = None,
                                 profile_protocol_options: Optional[str] = None,
                                 profile_type: Optional[str] = None,
                                 radius_ip_auth_bypass: Optional[str] = None,
                                 radius_mac_auth_bypass: Optional[str] = None,
                                 redirect_url: Optional[str] = None,
                                 replacemsg_override_group: Optional[str] = None,
                                 reputation_direction: Optional[str] = None,
                                 reputation_direction6: Optional[str] = None,
                                 reputation_minimum: Optional[float] = None,
                                 reputation_minimum6: Optional[float] = None,
                                 rsso: Optional[str] = None,
                                 rtp_addrs: Optional[Sequence[str]] = None,
                                 rtp_nat: Optional[str] = None,
                                 scan_botnet_connections: Optional[str] = None,
                                 schedule: Optional[str] = None,
                                 schedule_timeout: Optional[str] = None,
                                 scopetype: Optional[str] = None,
                                 sctp_filter_profile: Optional[str] = None,
                                 send_deny_packet: Optional[str] = None,
                                 service_negate: Optional[str] = None,
                                 services: Optional[Sequence[str]] = None,
                                 session_ttl: Optional[str] = None,
                                 sgt_check: Optional[str] = None,
                                 sgts: Optional[Sequence[float]] = None,
                                 spamfilter_profile: Optional[str] = None,
                                 src_vendor_macs: Optional[Sequence[str]] = None,
                                 srcaddr6_negate: Optional[str] = None,
                                 srcaddr6s: Optional[Sequence[str]] = None,
                                 srcaddr_negate: Optional[str] = None,
                                 srcaddrs: Optional[Sequence[str]] = None,
                                 srcintfs: Optional[Sequence[str]] = None,
                                 ssh_filter_profile: Optional[str] = None,
                                 ssh_policy_redirect: Optional[str] = None,
                                 ssl_mirror: Optional[str] = None,
                                 ssl_mirror_intfs: Optional[Sequence[str]] = None,
                                 ssl_ssh_profile: Optional[str] = None,
                                 status: Optional[str] = None,
                                 tcp_mss_receiver: Optional[float] = None,
                                 tcp_mss_sender: Optional[float] = None,
                                 tcp_session_without_syn: Optional[str] = None,
                                 tcp_timeout_pid: Optional[str] = None,
                                 timeout_send_rst: Optional[str] = None,
                                 tos: Optional[str] = None,
                                 tos_mask: Optional[str] = None,
                                 tos_negate: Optional[str] = None,
                                 traffic_shaper: Optional[str] = None,
                                 traffic_shaper_reverse: Optional[str] = None,
                                 udp_timeout_pid: Optional[str] = None,
                                 url_categories: Optional[Sequence[str]] = None,
                                 users: Optional[Sequence[str]] = None,
                                 utm_status: Optional[str] = None,
                                 uuid: Optional[str] = None,
                                 videofilter_profile: Optional[str] = None,
                                 virtual_patch_profile: Optional[str] = None,
                                 vlan_cos_fwd: Optional[float] = None,
                                 vlan_cos_rev: Optional[float] = None,
                                 vlan_filter: Optional[str] = None,
                                 voip_profile: Optional[str] = None,
                                 vpntunnel: Optional[str] = None,
                                 waf_profile: Optional[str] = None,
                                 wanopt: Optional[str] = None,
                                 wanopt_detection: Optional[str] = None,
                                 wanopt_passive_opt: Optional[str] = None,
                                 wanopt_peer: Optional[str] = None,
                                 wanopt_profile: Optional[str] = None,
                                 wccp: Optional[str] = None,
                                 webcache: Optional[str] = None,
                                 webcache_https: Optional[str] = None,
                                 webfilter_profile: Optional[str] = None,
                                 webproxy_forward_server: Optional[str] = None,
                                 webproxy_profile: Optional[str] = None,
                                 wsso: Optional[str] = None,
                                 ztna_device_ownership: Optional[str] = None,
                                 ztna_ems_tag_secondaries: Optional[Sequence[str]] = None,
                                 ztna_ems_tags: Optional[Sequence[str]] = None,
                                 ztna_geo_tags: Optional[Sequence[str]] = None,
                                 ztna_policy_redirect: Optional[str] = None,
                                 ztna_status: Optional[str] = None,
                                 ztna_tags_match_logic: Optional[str] = None)
    func NewPackagesPblockFirewallPolicy(ctx *Context, name string, args PackagesPblockFirewallPolicyArgs, opts ...ResourceOption) (*PackagesPblockFirewallPolicy, error)
    public PackagesPblockFirewallPolicy(string name, PackagesPblockFirewallPolicyArgs args, CustomResourceOptions? opts = null)
    public PackagesPblockFirewallPolicy(String name, PackagesPblockFirewallPolicyArgs args)
public PackagesPblockFirewallPolicy(String name, PackagesPblockFirewallPolicyArgs args, CustomResourceOptions options)

    type: fortimanager:PackagesPblockFirewallPolicy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args PackagesPblockFirewallPolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args PackagesPblockFirewallPolicyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args PackagesPblockFirewallPolicyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args PackagesPblockFirewallPolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args PackagesPblockFirewallPolicyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var packagesPblockFirewallPolicyResource = new Fortimanager.PackagesPblockFirewallPolicy("packagesPblockFirewallPolicyResource", new()
{
    Pblock = "string",
    _policyBlock = 0,
    Action = "string",
    Adom = "string",
    AntiReplay = "string",
    AppCategories = new[]
    {
        "string",
    },
    AppGroups = new[]
    {
        "string",
    },
    ApplicationList = "string",
    Applications = new[]
    {
        0,
    },
    AuthCert = "string",
    AuthPath = "string",
    AuthRedirectAddr = "string",
    AutoAsicOffload = "string",
    AvProfile = "string",
    BestRoute = "string",
    BlockNotification = "string",
    CaptivePortalExempt = "string",
    CapturePacket = "string",
    CasbProfile = "string",
    CgnEif = "string",
    CgnEim = "string",
    CgnLogServerGrp = "string",
    CgnResourceQuota = 0,
    CgnSessionQuota = 0,
    CgnSwEifCtrl = "string",
    CifsProfile = "string",
    Comments = "string",
    CustomLogFields = new[]
    {
        "string",
    },
    DecryptedTrafficMirror = "string",
    DelayTcpNpuSession = "string",
    Devices = new[]
    {
        "string",
    },
    DiameterFilterProfile = "string",
    DiffservCopy = "string",
    DiffservForward = "string",
    DiffservReverse = "string",
    DiffservcodeForward = "string",
    DiffservcodeRev = "string",
    Disclaimer = "string",
    DlpProfile = "string",
    DlpSensor = "string",
    DnsfilterProfile = "string",
    DscpMatch = "string",
    DscpNegate = "string",
    DscpValue = "string",
    Dsri = "string",
    Dstaddr6Negate = "string",
    Dstaddr6s = new[]
    {
        "string",
    },
    DstaddrNegate = "string",
    Dstaddrs = new[]
    {
        "string",
    },
    Dstintfs = new[]
    {
        "string",
    },
    DynamicShaping = "string",
    EifCheck = "string",
    EifLearn = "string",
    EmailCollect = "string",
    EmailfilterProfile = "string",
    Fec = "string",
    FileFilterProfile = "string",
    FirewallSessionDirty = "string",
    Fixedport = "string",
    Fsso = "string",
    FssoAgentForNtlm = "string",
    FssoGroups = new[]
    {
        "string",
    },
    GeoipAnycast = "string",
    GeoipMatch = "string",
    GlobalLabel = "string",
    Groups = new[]
    {
        "string",
    },
    GtpProfile = "string",
    HttpPolicyRedirect = "string",
    IcapProfile = "string",
    IdentityBasedRoute = "string",
    Inbound = "string",
    InspectionMode = "string",
    InternetService = "string",
    InternetService6 = "string",
    InternetService6CustomGroups = new[]
    {
        "string",
    },
    InternetService6Customs = new[]
    {
        "string",
    },
    InternetService6Groups = new[]
    {
        "string",
    },
    InternetService6Names = new[]
    {
        "string",
    },
    InternetService6Negate = "string",
    InternetService6Src = "string",
    InternetService6SrcCustomGroups = new[]
    {
        "string",
    },
    InternetService6SrcCustoms = new[]
    {
        "string",
    },
    InternetService6SrcGroups = new[]
    {
        "string",
    },
    InternetService6SrcNames = new[]
    {
        "string",
    },
    InternetService6SrcNegate = "string",
    InternetServiceCustomGroups = new[]
    {
        "string",
    },
    InternetServiceCustoms = new[]
    {
        "string",
    },
    InternetServiceGroups = new[]
    {
        "string",
    },
    InternetServiceIds = new[]
    {
        "string",
    },
    InternetServiceNames = new[]
    {
        "string",
    },
    InternetServiceNegate = "string",
    InternetServiceSrc = "string",
    InternetServiceSrcCustomGroups = new[]
    {
        "string",
    },
    InternetServiceSrcCustoms = new[]
    {
        "string",
    },
    InternetServiceSrcGroups = new[]
    {
        "string",
    },
    InternetServiceSrcIds = new[]
    {
        "string",
    },
    InternetServiceSrcNames = new[]
    {
        "string",
    },
    InternetServiceSrcNegate = "string",
    IpVersionType = "string",
    Ippool = "string",
    IpsSensor = "string",
    IpsVoipFilter = "string",
    Label = "string",
    LearningMode = "string",
    LogHttpTransaction = "string",
    Logtraffic = "string",
    LogtrafficStart = "string",
    MatchVip = "string",
    MatchVipOnly = "string",
    MmsProfile = "string",
    Name = "string",
    Nat = "string",
    Nat46 = "string",
    Nat64 = "string",
    Natinbound = "string",
    Natips = new[]
    {
        "string",
    },
    Natoutbound = "string",
    NetworkServiceDynamics = new[]
    {
        "string",
    },
    NetworkServiceSrcDynamics = new[]
    {
        "string",
    },
    NpAcceleration = "string",
    Ntlm = "string",
    NtlmEnabledBrowsers = new[]
    {
        "string",
    },
    NtlmGuest = "string",
    Outbound = "string",
    PackagesPblockFirewallPolicyId = "string",
    PassiveWanHealthMeasurement = "string",
    PcpInbound = "string",
    PcpOutbound = "string",
    PcpPoolnames = new[]
    {
        "string",
    },
    PerIpShaper = "string",
    PermitAnyHost = "string",
    PermitStunHost = "string",
    PfcpProfile = "string",
    PolicyBehaviourType = "string",
    PolicyExpiry = "string",
    PolicyExpiryDate = "string",
    PolicyExpiryDateUtc = "string",
    PolicyOffload = "string",
    Poolname6s = new[]
    {
        "string",
    },
    Poolnames = new[]
    {
        "string",
    },
    PortPreserve = "string",
    ProfileGroup = "string",
    ProfileProtocolOptions = "string",
    ProfileType = "string",
    RadiusIpAuthBypass = "string",
    RadiusMacAuthBypass = "string",
    RedirectUrl = "string",
    ReplacemsgOverrideGroup = "string",
    ReputationDirection = "string",
    ReputationDirection6 = "string",
    ReputationMinimum = 0,
    ReputationMinimum6 = 0,
    Rsso = "string",
    RtpAddrs = new[]
    {
        "string",
    },
    RtpNat = "string",
    ScanBotnetConnections = "string",
    Schedule = "string",
    ScheduleTimeout = "string",
    Scopetype = "string",
    SctpFilterProfile = "string",
    SendDenyPacket = "string",
    ServiceNegate = "string",
    Services = new[]
    {
        "string",
    },
    SessionTtl = "string",
    SgtCheck = "string",
    Sgts = new[]
    {
        0,
    },
    SpamfilterProfile = "string",
    SrcVendorMacs = new[]
    {
        "string",
    },
    Srcaddr6Negate = "string",
    Srcaddr6s = new[]
    {
        "string",
    },
    SrcaddrNegate = "string",
    Srcaddrs = new[]
    {
        "string",
    },
    Srcintfs = new[]
    {
        "string",
    },
    SshFilterProfile = "string",
    SshPolicyRedirect = "string",
    SslMirror = "string",
    SslMirrorIntfs = new[]
    {
        "string",
    },
    SslSshProfile = "string",
    Status = "string",
    TcpMssReceiver = 0,
    TcpMssSender = 0,
    TcpSessionWithoutSyn = "string",
    TcpTimeoutPid = "string",
    TimeoutSendRst = "string",
    Tos = "string",
    TosMask = "string",
    TosNegate = "string",
    TrafficShaper = "string",
    TrafficShaperReverse = "string",
    UdpTimeoutPid = "string",
    UrlCategories = new[]
    {
        "string",
    },
    Users = new[]
    {
        "string",
    },
    UtmStatus = "string",
    Uuid = "string",
    VideofilterProfile = "string",
    VirtualPatchProfile = "string",
    VlanCosFwd = 0,
    VlanCosRev = 0,
    VlanFilter = "string",
    VoipProfile = "string",
    Vpntunnel = "string",
    WafProfile = "string",
    Wanopt = "string",
    WanoptDetection = "string",
    WanoptPassiveOpt = "string",
    WanoptPeer = "string",
    WanoptProfile = "string",
    Wccp = "string",
    Webcache = "string",
    WebcacheHttps = "string",
    WebfilterProfile = "string",
    WebproxyForwardServer = "string",
    WebproxyProfile = "string",
    Wsso = "string",
    ZtnaDeviceOwnership = "string",
    ZtnaEmsTagSecondaries = new[]
    {
        "string",
    },
    ZtnaEmsTags = new[]
    {
        "string",
    },
    ZtnaGeoTags = new[]
    {
        "string",
    },
    ZtnaPolicyRedirect = "string",
    ZtnaStatus = "string",
    ZtnaTagsMatchLogic = "string",
});

    example, err := fortimanager.NewPackagesPblockFirewallPolicy(ctx, "packagesPblockFirewallPolicyResource", &fortimanager.PackagesPblockFirewallPolicyArgs{
Pblock: pulumi.String("string"),
_policyBlock: pulumi.Float64(0),
Action: pulumi.String("string"),
Adom: pulumi.String("string"),
AntiReplay: pulumi.String("string"),
AppCategories: pulumi.StringArray{
pulumi.String("string"),
},
AppGroups: pulumi.StringArray{
pulumi.String("string"),
},
ApplicationList: pulumi.String("string"),
Applications: pulumi.Float64Array{
pulumi.Float64(0),
},
AuthCert: pulumi.String("string"),
AuthPath: pulumi.String("string"),
AuthRedirectAddr: pulumi.String("string"),
AutoAsicOffload: pulumi.String("string"),
AvProfile: pulumi.String("string"),
BestRoute: pulumi.String("string"),
BlockNotification: pulumi.String("string"),
CaptivePortalExempt: pulumi.String("string"),
CapturePacket: pulumi.String("string"),
CasbProfile: pulumi.String("string"),
CgnEif: pulumi.String("string"),
CgnEim: pulumi.String("string"),
CgnLogServerGrp: pulumi.String("string"),
CgnResourceQuota: pulumi.Float64(0),
CgnSessionQuota: pulumi.Float64(0),
CgnSwEifCtrl: pulumi.String("string"),
CifsProfile: pulumi.String("string"),
Comments: pulumi.String("string"),
CustomLogFields: pulumi.StringArray{
pulumi.String("string"),
},
DecryptedTrafficMirror: pulumi.String("string"),
DelayTcpNpuSession: pulumi.String("string"),
Devices: pulumi.StringArray{
pulumi.String("string"),
},
DiameterFilterProfile: pulumi.String("string"),
DiffservCopy: pulumi.String("string"),
DiffservForward: pulumi.String("string"),
DiffservReverse: pulumi.String("string"),
DiffservcodeForward: pulumi.String("string"),
DiffservcodeRev: pulumi.String("string"),
Disclaimer: pulumi.String("string"),
DlpProfile: pulumi.String("string"),
DlpSensor: pulumi.String("string"),
DnsfilterProfile: pulumi.String("string"),
DscpMatch: pulumi.String("string"),
DscpNegate: pulumi.String("string"),
DscpValue: pulumi.String("string"),
Dsri: pulumi.String("string"),
Dstaddr6Negate: pulumi.String("string"),
Dstaddr6s: pulumi.StringArray{
pulumi.String("string"),
},
DstaddrNegate: pulumi.String("string"),
Dstaddrs: pulumi.StringArray{
pulumi.String("string"),
},
Dstintfs: pulumi.StringArray{
pulumi.String("string"),
},
DynamicShaping: pulumi.String("string"),
EifCheck: pulumi.String("string"),
EifLearn: pulumi.String("string"),
EmailCollect: pulumi.String("string"),
EmailfilterProfile: pulumi.String("string"),
Fec: pulumi.String("string"),
FileFilterProfile: pulumi.String("string"),
FirewallSessionDirty: pulumi.String("string"),
Fixedport: pulumi.String("string"),
Fsso: pulumi.String("string"),
FssoAgentForNtlm: pulumi.String("string"),
FssoGroups: pulumi.StringArray{
pulumi.String("string"),
},
GeoipAnycast: pulumi.String("string"),
GeoipMatch: pulumi.String("string"),
GlobalLabel: pulumi.String("string"),
Groups: pulumi.StringArray{
pulumi.String("string"),
},
GtpProfile: pulumi.String("string"),
HttpPolicyRedirect: pulumi.String("string"),
IcapProfile: pulumi.String("string"),
IdentityBasedRoute: pulumi.String("string"),
Inbound: pulumi.String("string"),
InspectionMode: pulumi.String("string"),
InternetService: pulumi.String("string"),
InternetService6: pulumi.String("string"),
InternetService6CustomGroups: pulumi.StringArray{
pulumi.String("string"),
},
InternetService6Customs: pulumi.StringArray{
pulumi.String("string"),
},
InternetService6Groups: pulumi.StringArray{
pulumi.String("string"),
},
InternetService6Names: pulumi.StringArray{
pulumi.String("string"),
},
InternetService6Negate: pulumi.String("string"),
InternetService6Src: pulumi.String("string"),
InternetService6SrcCustomGroups: pulumi.StringArray{
pulumi.String("string"),
},
InternetService6SrcCustoms: pulumi.StringArray{
pulumi.String("string"),
},
InternetService6SrcGroups: pulumi.StringArray{
pulumi.String("string"),
},
InternetService6SrcNames: pulumi.StringArray{
pulumi.String("string"),
},
InternetService6SrcNegate: pulumi.String("string"),
InternetServiceCustomGroups: pulumi.StringArray{
pulumi.String("string"),
},
InternetServiceCustoms: pulumi.StringArray{
pulumi.String("string"),
},
InternetServiceGroups: pulumi.StringArray{
pulumi.String("string"),
},
InternetServiceIds: pulumi.StringArray{
pulumi.String("string"),
},
InternetServiceNames: pulumi.StringArray{
pulumi.String("string"),
},
InternetServiceNegate: pulumi.String("string"),
InternetServiceSrc: pulumi.String("string"),
InternetServiceSrcCustomGroups: pulumi.StringArray{
pulumi.String("string"),
},
InternetServiceSrcCustoms: pulumi.StringArray{
pulumi.String("string"),
},
InternetServiceSrcGroups: pulumi.StringArray{
pulumi.String("string"),
},
InternetServiceSrcIds: pulumi.StringArray{
pulumi.String("string"),
},
InternetServiceSrcNames: pulumi.StringArray{
pulumi.String("string"),
},
InternetServiceSrcNegate: pulumi.String("string"),
IpVersionType: pulumi.String("string"),
Ippool: pulumi.String("string"),
IpsSensor: pulumi.String("string"),
IpsVoipFilter: pulumi.String("string"),
Label: pulumi.String("string"),
LearningMode: pulumi.String("string"),
LogHttpTransaction: pulumi.String("string"),
Logtraffic: pulumi.String("string"),
LogtrafficStart: pulumi.String("string"),
MatchVip: pulumi.String("string"),
MatchVipOnly: pulumi.String("string"),
MmsProfile: pulumi.String("string"),
Name: pulumi.String("string"),
Nat: pulumi.String("string"),
Nat46: pulumi.String("string"),
Nat64: pulumi.String("string"),
Natinbound: pulumi.String("string"),
Natips: pulumi.StringArray{
pulumi.String("string"),
},
Natoutbound: pulumi.String("string"),
NetworkServiceDynamics: pulumi.StringArray{
pulumi.String("string"),
},
NetworkServiceSrcDynamics: pulumi.StringArray{
pulumi.String("string"),
},
NpAcceleration: pulumi.String("string"),
Ntlm: pulumi.String("string"),
NtlmEnabledBrowsers: pulumi.StringArray{
pulumi.String("string"),
},
NtlmGuest: pulumi.String("string"),
Outbound: pulumi.String("string"),
PackagesPblockFirewallPolicyId: pulumi.String("string"),
PassiveWanHealthMeasurement: pulumi.String("string"),
PcpInbound: pulumi.String("string"),
PcpOutbound: pulumi.String("string"),
PcpPoolnames: pulumi.StringArray{
pulumi.String("string"),
},
PerIpShaper: pulumi.String("string"),
PermitAnyHost: pulumi.String("string"),
PermitStunHost: pulumi.String("string"),
PfcpProfile: pulumi.String("string"),
PolicyBehaviourType: pulumi.String("string"),
PolicyExpiry: pulumi.String("string"),
PolicyExpiryDate: pulumi.String("string"),
PolicyExpiryDateUtc: pulumi.String("string"),
PolicyOffload: pulumi.String("string"),
Poolname6s: pulumi.StringArray{
pulumi.String("string"),
},
Poolnames: pulumi.StringArray{
pulumi.String("string"),
},
PortPreserve: pulumi.String("string"),
ProfileGroup: pulumi.String("string"),
ProfileProtocolOptions: pulumi.String("string"),
ProfileType: pulumi.String("string"),
RadiusIpAuthBypass: pulumi.String("string"),
RadiusMacAuthBypass: pulumi.String("string"),
RedirectUrl: pulumi.String("string"),
ReplacemsgOverrideGroup: pulumi.String("string"),
ReputationDirection: pulumi.String("string"),
ReputationDirection6: pulumi.String("string"),
ReputationMinimum: pulumi.Float64(0),
ReputationMinimum6: pulumi.Float64(0),
Rsso: pulumi.String("string"),
RtpAddrs: pulumi.StringArray{
pulumi.String("string"),
},
RtpNat: pulumi.String("string"),
ScanBotnetConnections: pulumi.String("string"),
Schedule: pulumi.String("string"),
ScheduleTimeout: pulumi.String("string"),
Scopetype: pulumi.String("string"),
SctpFilterProfile: pulumi.String("string"),
SendDenyPacket: pulumi.String("string"),
ServiceNegate: pulumi.String("string"),
Services: pulumi.StringArray{
pulumi.String("string"),
},
SessionTtl: pulumi.String("string"),
SgtCheck: pulumi.String("string"),
Sgts: pulumi.Float64Array{
pulumi.Float64(0),
},
SpamfilterProfile: pulumi.String("string"),
SrcVendorMacs: pulumi.StringArray{
pulumi.String("string"),
},
Srcaddr6Negate: pulumi.String("string"),
Srcaddr6s: pulumi.StringArray{
pulumi.String("string"),
},
SrcaddrNegate: pulumi.String("string"),
Srcaddrs: pulumi.StringArray{
pulumi.String("string"),
},
Srcintfs: pulumi.StringArray{
pulumi.String("string"),
},
SshFilterProfile: pulumi.String("string"),
SshPolicyRedirect: pulumi.String("string"),
SslMirror: pulumi.String("string"),
SslMirrorIntfs: pulumi.StringArray{
pulumi.String("string"),
},
SslSshProfile: pulumi.String("string"),
Status: pulumi.String("string"),
TcpMssReceiver: pulumi.Float64(0),
TcpMssSender: pulumi.Float64(0),
TcpSessionWithoutSyn: pulumi.String("string"),
TcpTimeoutPid: pulumi.String("string"),
TimeoutSendRst: pulumi.String("string"),
Tos: pulumi.String("string"),
TosMask: pulumi.String("string"),
TosNegate: pulumi.String("string"),
TrafficShaper: pulumi.String("string"),
TrafficShaperReverse: pulumi.String("string"),
UdpTimeoutPid: pulumi.String("string"),
UrlCategories: pulumi.StringArray{
pulumi.String("string"),
},
Users: pulumi.StringArray{
pulumi.String("string"),
},
UtmStatus: pulumi.String("string"),
Uuid: pulumi.String("string"),
VideofilterProfile: pulumi.String("string"),
VirtualPatchProfile: pulumi.String("string"),
VlanCosFwd: pulumi.Float64(0),
VlanCosRev: pulumi.Float64(0),
VlanFilter: pulumi.String("string"),
VoipProfile: pulumi.String("string"),
Vpntunnel: pulumi.String("string"),
WafProfile: pulumi.String("string"),
Wanopt: pulumi.String("string"),
WanoptDetection: pulumi.String("string"),
WanoptPassiveOpt: pulumi.String("string"),
WanoptPeer: pulumi.String("string"),
WanoptProfile: pulumi.String("string"),
Wccp: pulumi.String("string"),
Webcache: pulumi.String("string"),
WebcacheHttps: pulumi.String("string"),
WebfilterProfile: pulumi.String("string"),
WebproxyForwardServer: pulumi.String("string"),
WebproxyProfile: pulumi.String("string"),
Wsso: pulumi.String("string"),
ZtnaDeviceOwnership: pulumi.String("string"),
ZtnaEmsTagSecondaries: pulumi.StringArray{
pulumi.String("string"),
},
ZtnaEmsTags: pulumi.StringArray{
pulumi.String("string"),
},
ZtnaGeoTags: pulumi.StringArray{
pulumi.String("string"),
},
ZtnaPolicyRedirect: pulumi.String("string"),
ZtnaStatus: pulumi.String("string"),
ZtnaTagsMatchLogic: pulumi.String("string"),
})

    var packagesPblockFirewallPolicyResource = new PackagesPblockFirewallPolicy("packagesPblockFirewallPolicyResource", PackagesPblockFirewallPolicyArgs.builder()
    .pblock("string")
    ._policyBlock(0)
    .action("string")
    .adom("string")
    .antiReplay("string")
    .appCategories("string")
    .appGroups("string")
    .applicationList("string")
    .applications(0)
    .authCert("string")
    .authPath("string")
    .authRedirectAddr("string")
    .autoAsicOffload("string")
    .avProfile("string")
    .bestRoute("string")
    .blockNotification("string")
    .captivePortalExempt("string")
    .capturePacket("string")
    .casbProfile("string")
    .cgnEif("string")
    .cgnEim("string")
    .cgnLogServerGrp("string")
    .cgnResourceQuota(0)
    .cgnSessionQuota(0)
    .cgnSwEifCtrl("string")
    .cifsProfile("string")
    .comments("string")
    .customLogFields("string")
    .decryptedTrafficMirror("string")
    .delayTcpNpuSession("string")
    .devices("string")
    .diameterFilterProfile("string")
    .diffservCopy("string")
    .diffservForward("string")
    .diffservReverse("string")
    .diffservcodeForward("string")
    .diffservcodeRev("string")
    .disclaimer("string")
    .dlpProfile("string")
    .dlpSensor("string")
    .dnsfilterProfile("string")
    .dscpMatch("string")
    .dscpNegate("string")
    .dscpValue("string")
    .dsri("string")
    .dstaddr6Negate("string")
    .dstaddr6s("string")
    .dstaddrNegate("string")
    .dstaddrs("string")
    .dstintfs("string")
    .dynamicShaping("string")
    .eifCheck("string")
    .eifLearn("string")
    .emailCollect("string")
    .emailfilterProfile("string")
    .fec("string")
    .fileFilterProfile("string")
    .firewallSessionDirty("string")
    .fixedport("string")
    .fsso("string")
    .fssoAgentForNtlm("string")
    .fssoGroups("string")
    .geoipAnycast("string")
    .geoipMatch("string")
    .globalLabel("string")
    .groups("string")
    .gtpProfile("string")
    .httpPolicyRedirect("string")
    .icapProfile("string")
    .identityBasedRoute("string")
    .inbound("string")
    .inspectionMode("string")
    .internetService("string")
    .internetService6("string")
    .internetService6CustomGroups("string")
    .internetService6Customs("string")
    .internetService6Groups("string")
    .internetService6Names("string")
    .internetService6Negate("string")
    .internetService6Src("string")
    .internetService6SrcCustomGroups("string")
    .internetService6SrcCustoms("string")
    .internetService6SrcGroups("string")
    .internetService6SrcNames("string")
    .internetService6SrcNegate("string")
    .internetServiceCustomGroups("string")
    .internetServiceCustoms("string")
    .internetServiceGroups("string")
    .internetServiceIds("string")
    .internetServiceNames("string")
    .internetServiceNegate("string")
    .internetServiceSrc("string")
    .internetServiceSrcCustomGroups("string")
    .internetServiceSrcCustoms("string")
    .internetServiceSrcGroups("string")
    .internetServiceSrcIds("string")
    .internetServiceSrcNames("string")
    .internetServiceSrcNegate("string")
    .ipVersionType("string")
    .ippool("string")
    .ipsSensor("string")
    .ipsVoipFilter("string")
    .label("string")
    .learningMode("string")
    .logHttpTransaction("string")
    .logtraffic("string")
    .logtrafficStart("string")
    .matchVip("string")
    .matchVipOnly("string")
    .mmsProfile("string")
    .name("string")
    .nat("string")
    .nat46("string")
    .nat64("string")
    .natinbound("string")
    .natips("string")
    .natoutbound("string")
    .networkServiceDynamics("string")
    .networkServiceSrcDynamics("string")
    .npAcceleration("string")
    .ntlm("string")
    .ntlmEnabledBrowsers("string")
    .ntlmGuest("string")
    .outbound("string")
    .packagesPblockFirewallPolicyId("string")
    .passiveWanHealthMeasurement("string")
    .pcpInbound("string")
    .pcpOutbound("string")
    .pcpPoolnames("string")
    .perIpShaper("string")
    .permitAnyHost("string")
    .permitStunHost("string")
    .pfcpProfile("string")
    .policyBehaviourType("string")
    .policyExpiry("string")
    .policyExpiryDate("string")
    .policyExpiryDateUtc("string")
    .policyOffload("string")
    .poolname6s("string")
    .poolnames("string")
    .portPreserve("string")
    .profileGroup("string")
    .profileProtocolOptions("string")
    .profileType("string")
    .radiusIpAuthBypass("string")
    .radiusMacAuthBypass("string")
    .redirectUrl("string")
    .replacemsgOverrideGroup("string")
    .reputationDirection("string")
    .reputationDirection6("string")
    .reputationMinimum(0)
    .reputationMinimum6(0)
    .rsso("string")
    .rtpAddrs("string")
    .rtpNat("string")
    .scanBotnetConnections("string")
    .schedule("string")
    .scheduleTimeout("string")
    .scopetype("string")
    .sctpFilterProfile("string")
    .sendDenyPacket("string")
    .serviceNegate("string")
    .services("string")
    .sessionTtl("string")
    .sgtCheck("string")
    .sgts(0)
    .spamfilterProfile("string")
    .srcVendorMacs("string")
    .srcaddr6Negate("string")
    .srcaddr6s("string")
    .srcaddrNegate("string")
    .srcaddrs("string")
    .srcintfs("string")
    .sshFilterProfile("string")
    .sshPolicyRedirect("string")
    .sslMirror("string")
    .sslMirrorIntfs("string")
    .sslSshProfile("string")
    .status("string")
    .tcpMssReceiver(0)
    .tcpMssSender(0)
    .tcpSessionWithoutSyn("string")
    .tcpTimeoutPid("string")
    .timeoutSendRst("string")
    .tos("string")
    .tosMask("string")
    .tosNegate("string")
    .trafficShaper("string")
    .trafficShaperReverse("string")
    .udpTimeoutPid("string")
    .urlCategories("string")
    .users("string")
    .utmStatus("string")
    .uuid("string")
    .videofilterProfile("string")
    .virtualPatchProfile("string")
    .vlanCosFwd(0)
    .vlanCosRev(0)
    .vlanFilter("string")
    .voipProfile("string")
    .vpntunnel("string")
    .wafProfile("string")
    .wanopt("string")
    .wanoptDetection("string")
    .wanoptPassiveOpt("string")
    .wanoptPeer("string")
    .wanoptProfile("string")
    .wccp("string")
    .webcache("string")
    .webcacheHttps("string")
    .webfilterProfile("string")
    .webproxyForwardServer("string")
    .webproxyProfile("string")
    .wsso("string")
    .ztnaDeviceOwnership("string")
    .ztnaEmsTagSecondaries("string")
    .ztnaEmsTags("string")
    .ztnaGeoTags("string")
    .ztnaPolicyRedirect("string")
    .ztnaStatus("string")
    .ztnaTagsMatchLogic("string")
    .build());

    packages_pblock_firewall_policy_resource = fortimanager.PackagesPblockFirewallPolicy("packagesPblockFirewallPolicyResource",
    pblock="string",
    _policy_block=0,
    action="string",
    adom="string",
    anti_replay="string",
    app_categories=["string"],
    app_groups=["string"],
    application_list="string",
    applications=[0],
    auth_cert="string",
    auth_path="string",
    auth_redirect_addr="string",
    auto_asic_offload="string",
    av_profile="string",
    best_route="string",
    block_notification="string",
    captive_portal_exempt="string",
    capture_packet="string",
    casb_profile="string",
    cgn_eif="string",
    cgn_eim="string",
    cgn_log_server_grp="string",
    cgn_resource_quota=0,
    cgn_session_quota=0,
    cgn_sw_eif_ctrl="string",
    cifs_profile="string",
    comments="string",
    custom_log_fields=["string"],
    decrypted_traffic_mirror="string",
    delay_tcp_npu_session="string",
    devices=["string"],
    diameter_filter_profile="string",
    diffserv_copy="string",
    diffserv_forward="string",
    diffserv_reverse="string",
    diffservcode_forward="string",
    diffservcode_rev="string",
    disclaimer="string",
    dlp_profile="string",
    dlp_sensor="string",
    dnsfilter_profile="string",
    dscp_match="string",
    dscp_negate="string",
    dscp_value="string",
    dsri="string",
    dstaddr6_negate="string",
    dstaddr6s=["string"],
    dstaddr_negate="string",
    dstaddrs=["string"],
    dstintfs=["string"],
    dynamic_shaping="string",
    eif_check="string",
    eif_learn="string",
    email_collect="string",
    emailfilter_profile="string",
    fec="string",
    file_filter_profile="string",
    firewall_session_dirty="string",
    fixedport="string",
    fsso="string",
    fsso_agent_for_ntlm="string",
    fsso_groups=["string"],
    geoip_anycast="string",
    geoip_match="string",
    global_label="string",
    groups=["string"],
    gtp_profile="string",
    http_policy_redirect="string",
    icap_profile="string",
    identity_based_route="string",
    inbound="string",
    inspection_mode="string",
    internet_service="string",
    internet_service6="string",
    internet_service6_custom_groups=["string"],
    internet_service6_customs=["string"],
    internet_service6_groups=["string"],
    internet_service6_names=["string"],
    internet_service6_negate="string",
    internet_service6_src="string",
    internet_service6_src_custom_groups=["string"],
    internet_service6_src_customs=["string"],
    internet_service6_src_groups=["string"],
    internet_service6_src_names=["string"],
    internet_service6_src_negate="string",
    internet_service_custom_groups=["string"],
    internet_service_customs=["string"],
    internet_service_groups=["string"],
    internet_service_ids=["string"],
    internet_service_names=["string"],
    internet_service_negate="string",
    internet_service_src="string",
    internet_service_src_custom_groups=["string"],
    internet_service_src_customs=["string"],
    internet_service_src_groups=["string"],
    internet_service_src_ids=["string"],
    internet_service_src_names=["string"],
    internet_service_src_negate="string",
    ip_version_type="string",
    ippool="string",
    ips_sensor="string",
    ips_voip_filter="string",
    label="string",
    learning_mode="string",
    log_http_transaction="string",
    logtraffic="string",
    logtraffic_start="string",
    match_vip="string",
    match_vip_only="string",
    mms_profile="string",
    name="string",
    nat="string",
    nat46="string",
    nat64="string",
    natinbound="string",
    natips=["string"],
    natoutbound="string",
    network_service_dynamics=["string"],
    network_service_src_dynamics=["string"],
    np_acceleration="string",
    ntlm="string",
    ntlm_enabled_browsers=["string"],
    ntlm_guest="string",
    outbound="string",
    packages_pblock_firewall_policy_id="string",
    passive_wan_health_measurement="string",
    pcp_inbound="string",
    pcp_outbound="string",
    pcp_poolnames=["string"],
    per_ip_shaper="string",
    permit_any_host="string",
    permit_stun_host="string",
    pfcp_profile="string",
    policy_behaviour_type="string",
    policy_expiry="string",
    policy_expiry_date="string",
    policy_expiry_date_utc="string",
    policy_offload="string",
    poolname6s=["string"],
    poolnames=["string"],
    port_preserve="string",
    profile_group="string",
    profile_protocol_options="string",
    profile_type="string",
    radius_ip_auth_bypass="string",
    radius_mac_auth_bypass="string",
    redirect_url="string",
    replacemsg_override_group="string",
    reputation_direction="string",
    reputation_direction6="string",
    reputation_minimum=0,
    reputation_minimum6=0,
    rsso="string",
    rtp_addrs=["string"],
    rtp_nat="string",
    scan_botnet_connections="string",
    schedule="string",
    schedule_timeout="string",
    scopetype="string",
    sctp_filter_profile="string",
    send_deny_packet="string",
    service_negate="string",
    services=["string"],
    session_ttl="string",
    sgt_check="string",
    sgts=[0],
    spamfilter_profile="string",
    src_vendor_macs=["string"],
    srcaddr6_negate="string",
    srcaddr6s=["string"],
    srcaddr_negate="string",
    srcaddrs=["string"],
    srcintfs=["string"],
    ssh_filter_profile="string",
    ssh_policy_redirect="string",
    ssl_mirror="string",
    ssl_mirror_intfs=["string"],
    ssl_ssh_profile="string",
    status="string",
    tcp_mss_receiver=0,
    tcp_mss_sender=0,
    tcp_session_without_syn="string",
    tcp_timeout_pid="string",
    timeout_send_rst="string",
    tos="string",
    tos_mask="string",
    tos_negate="string",
    traffic_shaper="string",
    traffic_shaper_reverse="string",
    udp_timeout_pid="string",
    url_categories=["string"],
    users=["string"],
    utm_status="string",
    uuid="string",
    videofilter_profile="string",
    virtual_patch_profile="string",
    vlan_cos_fwd=0,
    vlan_cos_rev=0,
    vlan_filter="string",
    voip_profile="string",
    vpntunnel="string",
    waf_profile="string",
    wanopt="string",
    wanopt_detection="string",
    wanopt_passive_opt="string",
    wanopt_peer="string",
    wanopt_profile="string",
    wccp="string",
    webcache="string",
    webcache_https="string",
    webfilter_profile="string",
    webproxy_forward_server="string",
    webproxy_profile="string",
    wsso="string",
    ztna_device_ownership="string",
    ztna_ems_tag_secondaries=["string"],
    ztna_ems_tags=["string"],
    ztna_geo_tags=["string"],
    ztna_policy_redirect="string",
    ztna_status="string",
    ztna_tags_match_logic="string")

    const packagesPblockFirewallPolicyResource = new fortimanager.PackagesPblockFirewallPolicy("packagesPblockFirewallPolicyResource", {
    pblock: "string",
    _policyBlock: 0,
    action: "string",
    adom: "string",
    antiReplay: "string",
    appCategories: ["string"],
    appGroups: ["string"],
    applicationList: "string",
    applications: [0],
    authCert: "string",
    authPath: "string",
    authRedirectAddr: "string",
    autoAsicOffload: "string",
    avProfile: "string",
    bestRoute: "string",
    blockNotification: "string",
    captivePortalExempt: "string",
    capturePacket: "string",
    casbProfile: "string",
    cgnEif: "string",
    cgnEim: "string",
    cgnLogServerGrp: "string",
    cgnResourceQuota: 0,
    cgnSessionQuota: 0,
    cgnSwEifCtrl: "string",
    cifsProfile: "string",
    comments: "string",
    customLogFields: ["string"],
    decryptedTrafficMirror: "string",
    delayTcpNpuSession: "string",
    devices: ["string"],
    diameterFilterProfile: "string",
    diffservCopy: "string",
    diffservForward: "string",
    diffservReverse: "string",
    diffservcodeForward: "string",
    diffservcodeRev: "string",
    disclaimer: "string",
    dlpProfile: "string",
    dlpSensor: "string",
    dnsfilterProfile: "string",
    dscpMatch: "string",
    dscpNegate: "string",
    dscpValue: "string",
    dsri: "string",
    dstaddr6Negate: "string",
    dstaddr6s: ["string"],
    dstaddrNegate: "string",
    dstaddrs: ["string"],
    dstintfs: ["string"],
    dynamicShaping: "string",
    eifCheck: "string",
    eifLearn: "string",
    emailCollect: "string",
    emailfilterProfile: "string",
    fec: "string",
    fileFilterProfile: "string",
    firewallSessionDirty: "string",
    fixedport: "string",
    fsso: "string",
    fssoAgentForNtlm: "string",
    fssoGroups: ["string"],
    geoipAnycast: "string",
    geoipMatch: "string",
    globalLabel: "string",
    groups: ["string"],
    gtpProfile: "string",
    httpPolicyRedirect: "string",
    icapProfile: "string",
    identityBasedRoute: "string",
    inbound: "string",
    inspectionMode: "string",
    internetService: "string",
    internetService6: "string",
    internetService6CustomGroups: ["string"],
    internetService6Customs: ["string"],
    internetService6Groups: ["string"],
    internetService6Names: ["string"],
    internetService6Negate: "string",
    internetService6Src: "string",
    internetService6SrcCustomGroups: ["string"],
    internetService6SrcCustoms: ["string"],
    internetService6SrcGroups: ["string"],
    internetService6SrcNames: ["string"],
    internetService6SrcNegate: "string",
    internetServiceCustomGroups: ["string"],
    internetServiceCustoms: ["string"],
    internetServiceGroups: ["string"],
    internetServiceIds: ["string"],
    internetServiceNames: ["string"],
    internetServiceNegate: "string",
    internetServiceSrc: "string",
    internetServiceSrcCustomGroups: ["string"],
    internetServiceSrcCustoms: ["string"],
    internetServiceSrcGroups: ["string"],
    internetServiceSrcIds: ["string"],
    internetServiceSrcNames: ["string"],
    internetServiceSrcNegate: "string",
    ipVersionType: "string",
    ippool: "string",
    ipsSensor: "string",
    ipsVoipFilter: "string",
    label: "string",
    learningMode: "string",
    logHttpTransaction: "string",
    logtraffic: "string",
    logtrafficStart: "string",
    matchVip: "string",
    matchVipOnly: "string",
    mmsProfile: "string",
    name: "string",
    nat: "string",
    nat46: "string",
    nat64: "string",
    natinbound: "string",
    natips: ["string"],
    natoutbound: "string",
    networkServiceDynamics: ["string"],
    networkServiceSrcDynamics: ["string"],
    npAcceleration: "string",
    ntlm: "string",
    ntlmEnabledBrowsers: ["string"],
    ntlmGuest: "string",
    outbound: "string",
    packagesPblockFirewallPolicyId: "string",
    passiveWanHealthMeasurement: "string",
    pcpInbound: "string",
    pcpOutbound: "string",
    pcpPoolnames: ["string"],
    perIpShaper: "string",
    permitAnyHost: "string",
    permitStunHost: "string",
    pfcpProfile: "string",
    policyBehaviourType: "string",
    policyExpiry: "string",
    policyExpiryDate: "string",
    policyExpiryDateUtc: "string",
    policyOffload: "string",
    poolname6s: ["string"],
    poolnames: ["string"],
    portPreserve: "string",
    profileGroup: "string",
    profileProtocolOptions: "string",
    profileType: "string",
    radiusIpAuthBypass: "string",
    radiusMacAuthBypass: "string",
    redirectUrl: "string",
    replacemsgOverrideGroup: "string",
    reputationDirection: "string",
    reputationDirection6: "string",
    reputationMinimum: 0,
    reputationMinimum6: 0,
    rsso: "string",
    rtpAddrs: ["string"],
    rtpNat: "string",
    scanBotnetConnections: "string",
    schedule: "string",
    scheduleTimeout: "string",
    scopetype: "string",
    sctpFilterProfile: "string",
    sendDenyPacket: "string",
    serviceNegate: "string",
    services: ["string"],
    sessionTtl: "string",
    sgtCheck: "string",
    sgts: [0],
    spamfilterProfile: "string",
    srcVendorMacs: ["string"],
    srcaddr6Negate: "string",
    srcaddr6s: ["string"],
    srcaddrNegate: "string",
    srcaddrs: ["string"],
    srcintfs: ["string"],
    sshFilterProfile: "string",
    sshPolicyRedirect: "string",
    sslMirror: "string",
    sslMirrorIntfs: ["string"],
    sslSshProfile: "string",
    status: "string",
    tcpMssReceiver: 0,
    tcpMssSender: 0,
    tcpSessionWithoutSyn: "string",
    tcpTimeoutPid: "string",
    timeoutSendRst: "string",
    tos: "string",
    tosMask: "string",
    tosNegate: "string",
    trafficShaper: "string",
    trafficShaperReverse: "string",
    udpTimeoutPid: "string",
    urlCategories: ["string"],
    users: ["string"],
    utmStatus: "string",
    uuid: "string",
    videofilterProfile: "string",
    virtualPatchProfile: "string",
    vlanCosFwd: 0,
    vlanCosRev: 0,
    vlanFilter: "string",
    voipProfile: "string",
    vpntunnel: "string",
    wafProfile: "string",
    wanopt: "string",
    wanoptDetection: "string",
    wanoptPassiveOpt: "string",
    wanoptPeer: "string",
    wanoptProfile: "string",
    wccp: "string",
    webcache: "string",
    webcacheHttps: "string",
    webfilterProfile: "string",
    webproxyForwardServer: "string",
    webproxyProfile: "string",
    wsso: "string",
    ztnaDeviceOwnership: "string",
    ztnaEmsTagSecondaries: ["string"],
    ztnaEmsTags: ["string"],
    ztnaGeoTags: ["string"],
    ztnaPolicyRedirect: "string",
    ztnaStatus: "string",
    ztnaTagsMatchLogic: "string",
});

    type: fortimanager:PackagesPblockFirewallPolicy
properties:
    _policyBlock: 0
    action: string
    adom: string
    antiReplay: string
    appCategories:
        - string
    appGroups:
        - string
    applicationList: string
    applications:
        - 0
    authCert: string
    authPath: string
    authRedirectAddr: string
    autoAsicOffload: string
    avProfile: string
    bestRoute: string
    blockNotification: string
    captivePortalExempt: string
    capturePacket: string
    casbProfile: string
    cgnEif: string
    cgnEim: string
    cgnLogServerGrp: string
    cgnResourceQuota: 0
    cgnSessionQuota: 0
    cgnSwEifCtrl: string
    cifsProfile: string
    comments: string
    customLogFields:
        - string
    decryptedTrafficMirror: string
    delayTcpNpuSession: string
    devices:
        - string
    diameterFilterProfile: string
    diffservCopy: string
    diffservForward: string
    diffservReverse: string
    diffservcodeForward: string
    diffservcodeRev: string
    disclaimer: string
    dlpProfile: string
    dlpSensor: string
    dnsfilterProfile: string
    dscpMatch: string
    dscpNegate: string
    dscpValue: string
    dsri: string
    dstaddr6Negate: string
    dstaddr6s:
        - string
    dstaddrNegate: string
    dstaddrs:
        - string
    dstintfs:
        - string
    dynamicShaping: string
    eifCheck: string
    eifLearn: string
    emailCollect: string
    emailfilterProfile: string
    fec: string
    fileFilterProfile: string
    firewallSessionDirty: string
    fixedport: string
    fsso: string
    fssoAgentForNtlm: string
    fssoGroups:
        - string
    geoipAnycast: string
    geoipMatch: string
    globalLabel: string
    groups:
        - string
    gtpProfile: string
    httpPolicyRedirect: string
    icapProfile: string
    identityBasedRoute: string
    inbound: string
    inspectionMode: string
    internetService: string
    internetService6: string
    internetService6CustomGroups:
        - string
    internetService6Customs:
        - string
    internetService6Groups:
        - string
    internetService6Names:
        - string
    internetService6Negate: string
    internetService6Src: string
    internetService6SrcCustomGroups:
        - string
    internetService6SrcCustoms:
        - string
    internetService6SrcGroups:
        - string
    internetService6SrcNames:
        - string
    internetService6SrcNegate: string
    internetServiceCustomGroups:
        - string
    internetServiceCustoms:
        - string
    internetServiceGroups:
        - string
    internetServiceIds:
        - string
    internetServiceNames:
        - string
    internetServiceNegate: string
    internetServiceSrc: string
    internetServiceSrcCustomGroups:
        - string
    internetServiceSrcCustoms:
        - string
    internetServiceSrcGroups:
        - string
    internetServiceSrcIds:
        - string
    internetServiceSrcNames:
        - string
    internetServiceSrcNegate: string
    ipVersionType: string
    ippool: string
    ipsSensor: string
    ipsVoipFilter: string
    label: string
    learningMode: string
    logHttpTransaction: string
    logtraffic: string
    logtrafficStart: string
    matchVip: string
    matchVipOnly: string
    mmsProfile: string
    name: string
    nat: string
    nat46: string
    nat64: string
    natinbound: string
    natips:
        - string
    natoutbound: string
    networkServiceDynamics:
        - string
    networkServiceSrcDynamics:
        - string
    npAcceleration: string
    ntlm: string
    ntlmEnabledBrowsers:
        - string
    ntlmGuest: string
    outbound: string
    packagesPblockFirewallPolicyId: string
    passiveWanHealthMeasurement: string
    pblock: string
    pcpInbound: string
    pcpOutbound: string
    pcpPoolnames:
        - string
    perIpShaper: string
    permitAnyHost: string
    permitStunHost: string
    pfcpProfile: string
    policyBehaviourType: string
    policyExpiry: string
    policyExpiryDate: string
    policyExpiryDateUtc: string
    policyOffload: string
    poolname6s:
        - string
    poolnames:
        - string
    portPreserve: string
    profileGroup: string
    profileProtocolOptions: string
    profileType: string
    radiusIpAuthBypass: string
    radiusMacAuthBypass: string
    redirectUrl: string
    replacemsgOverrideGroup: string
    reputationDirection: string
    reputationDirection6: string
    reputationMinimum: 0
    reputationMinimum6: 0
    rsso: string
    rtpAddrs:
        - string
    rtpNat: string
    scanBotnetConnections: string
    schedule: string
    scheduleTimeout: string
    scopetype: string
    sctpFilterProfile: string
    sendDenyPacket: string
    serviceNegate: string
    services:
        - string
    sessionTtl: string
    sgtCheck: string
    sgts:
        - 0
    spamfilterProfile: string
    srcVendorMacs:
        - string
    srcaddr6Negate: string
    srcaddr6s:
        - string
    srcaddrNegate: string
    srcaddrs:
        - string
    srcintfs:
        - string
    sshFilterProfile: string
    sshPolicyRedirect: string
    sslMirror: string
    sslMirrorIntfs:
        - string
    sslSshProfile: string
    status: string
    tcpMssReceiver: 0
    tcpMssSender: 0
    tcpSessionWithoutSyn: string
    tcpTimeoutPid: string
    timeoutSendRst: string
    tos: string
    tosMask: string
    tosNegate: string
    trafficShaper: string
    trafficShaperReverse: string
    udpTimeoutPid: string
    urlCategories:
        - string
    users:
        - string
    utmStatus: string
    uuid: string
    videofilterProfile: string
    virtualPatchProfile: string
    vlanCosFwd: 0
    vlanCosRev: 0
    vlanFilter: string
    voipProfile: string
    vpntunnel: string
    wafProfile: string
    wanopt: string
    wanoptDetection: string
    wanoptPassiveOpt: string
    wanoptPeer: string
    wanoptProfile: string
    wccp: string
    webcache: string
    webcacheHttps: string
    webfilterProfile: string
    webproxyForwardServer: string
    webproxyProfile: string
    wsso: string
    ztnaDeviceOwnership: string
    ztnaEmsTagSecondaries:
        - string
    ztnaEmsTags:
        - string
    ztnaGeoTags:
        - string
    ztnaPolicyRedirect: string
    ztnaStatus: string
    ztnaTagsMatchLogic: string

    PackagesPblockFirewallPolicy Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The PackagesPblockFirewallPolicy resource accepts the following input properties:

    Pblock string
    Pblock.
    Action string
    Policy action (accept/deny/ipsec). Valid values: deny, accept, ipsec, ssl-vpn, redirect, isolate.
    Adom string
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    AntiReplay string
    Enable/disable anti-replay check. Valid values: disable, enable.
    AppCategories List<string>
    Application category ID list.
    AppGroups List<string>
    Application group names.
    ApplicationList string
    Name of an existing Application list.
    Applications List<double>
    Application ID list.
    AuthCert string
    HTTPS server certificate for policy authentication.
    AuthPath string
    Enable/disable authentication-based routing. Valid values: disable, enable.
    AuthRedirectAddr string
    HTTP-to-HTTPS redirect address for firewall authentication.
    AutoAsicOffload string
    Enable/disable policy traffic ASIC offloading. Valid values: disable, enable.
    AvProfile string
    Name of an existing Antivirus profile.
    BestRoute string
    Best-Route. Valid values: disable, enable.
    BlockNotification string
    Enable/disable block notification. Valid values: disable, enable.
    CaptivePortalExempt string
    Enable to exempt some users from the captive portal. Valid values: disable, enable.
    CapturePacket string
    Enable/disable capture packets. Valid values: disable, enable.
    CasbProfile string
    Name of an existing CASB profile.
    CgnEif string
    Enable/Disable CGN endpoint independent filtering. Valid values: disable, enable.
    CgnEim string
    Enable/Disable CGN endpoint independent mapping Valid values: disable, enable.
    CgnLogServerGrp string
    NP log server group name
    CgnResourceQuota double
    resource quota
    CgnSessionQuota double
    session quota
    CgnSwEifCtrl string
    Enable/disable software endpoint independent filtering control. Valid values: disable, enable.
    CifsProfile string
    Name of an existing CIFS profile.
    Comments string
    Comment.
    CustomLogFields List<string>
    Custom fields to append to log messages for this policy.
    DecryptedTrafficMirror string
    Decrypted traffic mirror.
    DelayTcpNpuSession string
    Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: disable, enable.
    Devices List<string>
    Names of devices or device groups that can be matched by the policy.
    DiameterFilterProfile string
    Name of an existing Diameter filter profile.
    DiffservCopy string
    Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: disable, enable.
    DiffservForward string
    Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: disable, enable.
    DiffservReverse string
    Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: disable, enable.
    DiffservcodeForward string
    Change packet's DiffServ to this value.
    DiffservcodeRev string
    Change packet's reverse (reply) DiffServ to this value.
    Disclaimer string
    Enable/disable user authentication disclaimer. Valid values: disable, enable, user, domain, policy.
    DlpProfile string
    Name of an existing DLP profile.
    DlpSensor string
    Name of an existing DLP sensor.
    DnsfilterProfile string
    Name of an existing DNS filter profile.
    DscpMatch string
    Enable DSCP check. Valid values: disable, enable.
    DscpNegate string
    Enable negated DSCP match. Valid values: disable, enable.
    DscpValue string
    DSCP value.
    Dsri string
    Enable DSRI to ignore HTTP server responses. Valid values: disable, enable.
    Dstaddr6Negate string
    When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    Dstaddr6s List<string>
    Destination IPv6 address name and address group names.
    DstaddrNegate string
    When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    Dstaddrs List<string>
    Destination IPv4 address and address group names.
    Dstintfs List<string>
    Outgoing (egress) interface.
    DynamicShaping string
    Enable/disable dynamic RADIUS defined traffic shaping. Valid values: disable, enable.
    EifCheck string
    Enable/Disable check endpoint-independent-filtering pinhole. Valid values: disable, enable.
    EifLearn string
    Enable/Disable learning of end-point-independent filtering pinhole. Valid values: disable, enable.
    EmailCollect string
    Enable/disable email collection. Valid values: disable, enable.
    EmailfilterProfile string
    Name of an existing email filter profile.
    Fec string
    Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: disable, enable.
    FileFilterProfile string
    Name of an existing file-filter profile.
    FirewallSessionDirty string
    How to handle sessions if the configuration of this firewall policy changes. Valid values: check-all, check-new.
    Fixedport string
    Enable to prevent source NAT from changing a session's source port. Valid values: disable, enable.
    Fsso string
    Enable/disable Fortinet Single Sign-On. Valid values: disable, enable.
    FssoAgentForNtlm string
    FSSO agent to use for NTLM authentication.
    FssoGroups List<string>
    Names of FSSO groups.
    GeoipAnycast string
    Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: disable, enable.
    GeoipMatch string
    Match geography address based either on its physical location or registered location. Valid values: physical-location, registered-location.
    GlobalLabel string
    Label for the policy that appears when the GUI is in Global View mode.
    Groups List<string>
    Names of user groups that can authenticate with this policy.
    GtpProfile string
    GTP profile.
    HttpPolicyRedirect string
    Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: disable, enable.
    IcapProfile string
    Name of an existing ICAP profile.
    IdentityBasedRoute string
    Name of identity-based routing rule.
    Inbound string
    Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: disable, enable.
    InspectionMode string
    Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: proxy, flow.
    InternetService string
    Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    InternetService6 string
    Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    InternetService6CustomGroups List<string>
    Custom Internet Service6 group name.
    InternetService6Customs List<string>
    Custom IPv6 Internet Service name.
    InternetService6Groups List<string>
    Internet Service group name.
    InternetService6Names List<string>
    IPv6 Internet Service name.
    InternetService6Negate string
    When enabled internet-service6 specifies what the service must NOT be. Valid values: disable, enable.
    InternetService6Src string
    Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    InternetService6SrcCustomGroups List<string>
    Custom Internet Service6 source group name.
    InternetService6SrcCustoms List<string>
    Custom IPv6 Internet Service source name.
    InternetService6SrcGroups List<string>
    Internet Service6 source group name.
    InternetService6SrcNames List<string>
    IPv6 Internet Service source name.
    InternetService6SrcNegate string
    When enabled internet-service6-src specifies what the service must NOT be. Valid values: disable, enable.
    InternetServiceCustomGroups List<string>
    Custom Internet Service group name.
    InternetServiceCustoms List<string>
    Custom Internet Service name.
    InternetServiceGroups List<string>
    Internet Service group name.
    InternetServiceIds List<string>
    Internet Service ID.
    InternetServiceNames List<string>
    Internet Service name.
    InternetServiceNegate string
    When enabled internet-service specifies what the service must NOT be. Valid values: disable, enable.
    InternetServiceSrc string
    Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    InternetServiceSrcCustomGroups List<string>
    Custom Internet Service source group name.
    InternetServiceSrcCustoms List<string>
    Custom Internet Service source name.
    InternetServiceSrcGroups List<string>
    Internet Service source group name.
    InternetServiceSrcIds List<string>
    Internet Service source ID.
    InternetServiceSrcNames List<string>
    Internet Service source name.
    InternetServiceSrcNegate string
    When enabled internet-service-src specifies what the service must NOT be. Valid values: disable, enable.
    IpVersionType string
    IP version of the policy.
    Ippool string
    Enable to use IP Pools for source NAT. Valid values: disable, enable.
    IpsSensor string
    Name of an existing IPS sensor.
    IpsVoipFilter string
    Name of an existing VoIP (ips) profile.
    Label string
    Label for the policy that appears when the GUI is in Section View mode.
    LearningMode string
    Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: disable, enable.
    LogHttpTransaction string
    Enable/disable HTTP transaction log. Valid values: disable, enable, all, utm.
    Logtraffic string
    Enable or disable logging. Log all sessions or security profile sessions. Valid values: disable, enable, all, utm.
    LogtrafficStart string
    Record logs when a session starts. Valid values: disable, enable.
    MatchVip string
    Enable to match packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    MatchVipOnly string
    Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    MmsProfile string
    Name of an existing MMS profile.
    Name string
    Policy name.
    Nat string
    Enable/disable source NAT. Valid values: disable, enable.
    Nat46 string
    Enable/disable NAT46. Valid values: disable, enable.
    Nat64 string
    Enable/disable NAT64. Valid values: disable, enable.
    Natinbound string
    Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: disable, enable.
    Natips List<string>
    Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
    Natoutbound string
    Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: disable, enable.
    NetworkServiceDynamics List<string>
    Dynamic Network Service name.
    NetworkServiceSrcDynamics List<string>
    Dynamic Network Service source name.
    NpAcceleration string
    Enable/disable UTM Network Processor acceleration. Valid values: disable, enable.
    Ntlm string
    Enable/disable NTLM authentication. Valid values: disable, enable.
    NtlmEnabledBrowsers List<string>
    HTTP-User-Agent value of supported browsers.
    NtlmGuest string
    Enable/disable NTLM guest user access. Valid values: disable, enable.
    Outbound string
    Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: disable, enable.
    PackagesPblockFirewallPolicyId string
    an identifier for the resource with format {{policyid}}.
    PassiveWanHealthMeasurement string
    Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: disable, enable.
    PcpInbound string
    Enable/disable PCP inbound DNAT. Valid values: disable, enable.
    PcpOutbound string
    Enable/disable PCP outbound SNAT. Valid values: disable, enable.
    PcpPoolnames List<string>
    PCP pool names.
    PerIpShaper string
    Per-IP traffic shaper.
    PermitAnyHost string
    Accept UDP packets from any host. Valid values: disable, enable.
    PermitStunHost string
    Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: disable, enable.
    PfcpProfile string
    PFCP profile.
    PolicyBehaviourType string
    Behaviour of the policy.
    PolicyExpiry string
    Enable/disable policy expiry. Valid values: disable, enable.
    PolicyExpiryDate string
    Policy expiry date (YYYY-MM-DD HH:MM:SS).
    PolicyExpiryDateUtc string
    Policy expiry date and time, in epoch format.
    PolicyOffload string
    Enable/Disable hardware session setup for CGNAT. Valid values: disable, enable.
    Poolname6s List<string>
    IPv6 pool names.
    Poolnames List<string>
    IP Pool names.
    PortPreserve string
    Enable/disable preservation of the original source port from source NAT if it has not been used. Valid values: disable, enable.
    ProfileGroup string
    Name of profile group.
    ProfileProtocolOptions string
    Name of an existing Protocol options profile.
    ProfileType string
    Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: single, group.
    RadiusIpAuthBypass string
    Enable IP authentication bypass. The bypassed IP address must be received from RADIUS server. Valid values: disable, enable.
    RadiusMacAuthBypass string
    Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: disable, enable.
    RedirectUrl string
    URL users are directed to after seeing and accepting the disclaimer or authenticating.
    ReplacemsgOverrideGroup string
    Override the default replacement message group for this policy.
    ReputationDirection string
    Direction of the initial traffic for reputation to take effect. Valid values: source, destination.
    ReputationDirection6 string
    Direction of the initial traffic for IPv6 reputation to take effect. Valid values: source, destination.
    ReputationMinimum double
    Minimum Reputation to take action.
    ReputationMinimum6 double
    IPv6 Minimum Reputation to take action.
    Rsso string
    Enable/disable RADIUS single sign-on (RSSO). Valid values: disable, enable.
    RtpAddrs List<string>
    Address names if this is an RTP NAT policy.
    RtpNat string
    Enable Real Time Protocol (RTP) NAT. Valid values: disable, enable.
    ScanBotnetConnections string
    Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: disable, block, monitor.
    Schedule string
    Schedule name.
    ScheduleTimeout string
    Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: disable, enable.
    Scopetype string
    The scope of application of the resource. Valid values: inherit, adom. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    SctpFilterProfile string
    Name of an existing SCTP filter profile.
    SendDenyPacket string
    Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: disable, enable.
    ServiceNegate string
    When enabled service specifies what the service must NOT be. Valid values: disable, enable.
    Services List<string>
    Service and service group names.
    SessionTtl string
    TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
    SgtCheck string
    Enable/disable security group tags (SGT) check. Valid values: disable, enable.
    Sgts List<double>
    Security group tags.
    SpamfilterProfile string
    Name of an existing Spam filter profile.
    SrcVendorMacs List<string>
    Vendor MAC source ID.
    Srcaddr6Negate string
    When enabled srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    Srcaddr6s List<string>
    Source IPv6 address name and address group names.
    SrcaddrNegate string
    When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    Srcaddrs List<string>
    Source IPv4 address and address group names.
    Srcintfs List<string>
    Incoming (ingress) interface.
    SshFilterProfile string
    Name of an existing SSH filter profile.
    SshPolicyRedirect string
    Redirect SSH traffic to matching transparent proxy policy. Valid values: disable, enable.
    SslMirror string
    Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: disable, enable.
    SslMirrorIntfs List<string>
    SSL mirror interface name.
    SslSshProfile string
    Name of an existing SSL SSH profile.
    Status string
    Enable or disable this policy. Valid values: disable, enable.
    TcpMssReceiver double
    Receiver TCP maximum segment size (MSS).
    TcpMssSender double
    Sender TCP maximum segment size (MSS).
    TcpSessionWithoutSyn string
    Enable/disable creation of TCP session without SYN flag. Valid values: all, data-only, disable.
    TcpTimeoutPid string
    TCP timeout profile ID
    TimeoutSendRst string
    Enable/disable sending RST packets when TCP sessions expire. Valid values: disable, enable.
    Tos string
    ToS (Type of Service) value used for comparison.
    TosMask string
    Non-zero bit positions are used for comparison while zero bit positions are ignored.
    TosNegate string
    Enable negated TOS match. Valid values: disable, enable.
    TrafficShaper string
    Traffic shaper.
    TrafficShaperReverse string
    Reverse traffic shaper.
    UdpTimeoutPid string
    UDP timeout profile ID
    UrlCategories List<string>
    URL category ID list.
    Users List<string>
    Names of individual users that can authenticate with this policy.
    UtmStatus string
    Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: disable, enable.
    Uuid string
    Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
    VideofilterProfile string
    Name of an existing VideoFilter profile.
    VirtualPatchProfile string
    Name of an existing virtual-patch profile.
    VlanCosFwd double
    VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
    VlanCosRev double
    VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
    VlanFilter string
    Set VLAN filters.
    VoipProfile string
    Name of an existing VoIP profile.
    Vpntunnel string
    Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
    WafProfile string
    Name of an existing Web application firewall profile.
    Wanopt string
    Enable/disable WAN optimization. Valid values: disable, enable.
    WanoptDetection string
    WAN optimization auto-detection mode. Valid values: active, passive, off.
    WanoptPassiveOpt string
    WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: default, transparent, non-transparent.
    WanoptPeer string
    WAN optimization peer.
    WanoptProfile string
    WAN optimization profile.
    Wccp string
    Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: disable, enable.
    Webcache string
    Enable/disable web cache. Valid values: disable, enable.
    WebcacheHttps string
    Enable/disable web cache for HTTPS. Valid values: disable, ssl-server, any, enable.
    WebfilterProfile string
    Name of an existing Web filter profile.
    WebproxyForwardServer string
    Webproxy forward server name.
    WebproxyProfile string
    Webproxy profile name.
    Wsso string
    Enable/disable WiFi Single Sign On (WSSO). Valid values: disable, enable.
    ZtnaDeviceOwnership string
    Enable/disable zero trust device ownership. Valid values: disable, enable.
    ZtnaEmsTagSecondaries List<string>
    Source ztna-ems-tag-secondary names.
    ZtnaEmsTags List<string>
    Source ztna-ems-tag names.
    ZtnaGeoTags List<string>
    Source ztna-geo-tag names.
    ZtnaPolicyRedirect string
    Redirect ZTNA traffic to matching Access-Proxy proxy-policy. Valid values: disable, enable.
    ZtnaStatus string
    Enable/disable zero trust access. Valid values: disable, enable.
    ZtnaTagsMatchLogic string
    ZTNA tag matching logic. Valid values: or, and.
    _policyBlock double
    Assigned policy block. When this attribute is set, the policy represent a policy block, and all other attributes are ignored. This attribute is not available when configuring policy inside a policy block.
    Pblock string
    Pblock.
    Action string
    Policy action (accept/deny/ipsec). Valid values: deny, accept, ipsec, ssl-vpn, redirect, isolate.
    Adom string
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    AntiReplay string
    Enable/disable anti-replay check. Valid values: disable, enable.
    AppCategories []string
    Application category ID list.
    AppGroups []string
    Application group names.
    ApplicationList string
    Name of an existing Application list.
    Applications []float64
    Application ID list.
    AuthCert string
    HTTPS server certificate for policy authentication.
    AuthPath string
    Enable/disable authentication-based routing. Valid values: disable, enable.
    AuthRedirectAddr string
    HTTP-to-HTTPS redirect address for firewall authentication.
    AutoAsicOffload string
    Enable/disable policy traffic ASIC offloading. Valid values: disable, enable.
    AvProfile string
    Name of an existing Antivirus profile.
    BestRoute string
    Best-Route. Valid values: disable, enable.
    BlockNotification string
    Enable/disable block notification. Valid values: disable, enable.
    CaptivePortalExempt string
    Enable to exempt some users from the captive portal. Valid values: disable, enable.
    CapturePacket string
    Enable/disable capture packets. Valid values: disable, enable.
    CasbProfile string
    Name of an existing CASB profile.
    CgnEif string
    Enable/Disable CGN endpoint independent filtering. Valid values: disable, enable.
    CgnEim string
    Enable/Disable CGN endpoint independent mapping Valid values: disable, enable.
    CgnLogServerGrp string
    NP log server group name
    CgnResourceQuota float64
    resource quota
    CgnSessionQuota float64
    session quota
    CgnSwEifCtrl string
    Enable/disable software endpoint independent filtering control. Valid values: disable, enable.
    CifsProfile string
    Name of an existing CIFS profile.
    Comments string
    Comment.
    CustomLogFields []string
    Custom fields to append to log messages for this policy.
    DecryptedTrafficMirror string
    Decrypted traffic mirror.
    DelayTcpNpuSession string
    Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: disable, enable.
    Devices []string
    Names of devices or device groups that can be matched by the policy.
    DiameterFilterProfile string
    Name of an existing Diameter filter profile.
    DiffservCopy string
    Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: disable, enable.
    DiffservForward string
    Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: disable, enable.
    DiffservReverse string
    Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: disable, enable.
    DiffservcodeForward string
    Change packet's DiffServ to this value.
    DiffservcodeRev string
    Change packet's reverse (reply) DiffServ to this value.
    Disclaimer string
    Enable/disable user authentication disclaimer. Valid values: disable, enable, user, domain, policy.
    DlpProfile string
    Name of an existing DLP profile.
    DlpSensor string
    Name of an existing DLP sensor.
    DnsfilterProfile string
    Name of an existing DNS filter profile.
    DscpMatch string
    Enable DSCP check. Valid values: disable, enable.
    DscpNegate string
    Enable negated DSCP match. Valid values: disable, enable.
    DscpValue string
    DSCP value.
    Dsri string
    Enable DSRI to ignore HTTP server responses. Valid values: disable, enable.
    Dstaddr6Negate string
    When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    Dstaddr6s []string
    Destination IPv6 address name and address group names.
    DstaddrNegate string
    When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    Dstaddrs []string
    Destination IPv4 address and address group names.
    Dstintfs []string
    Outgoing (egress) interface.
    DynamicShaping string
    Enable/disable dynamic RADIUS defined traffic shaping. Valid values: disable, enable.
    EifCheck string
    Enable/Disable check endpoint-independent-filtering pinhole. Valid values: disable, enable.
    EifLearn string
    Enable/Disable learning of end-point-independent filtering pinhole. Valid values: disable, enable.
    EmailCollect string
    Enable/disable email collection. Valid values: disable, enable.
    EmailfilterProfile string
    Name of an existing email filter profile.
    Fec string
    Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: disable, enable.
    FileFilterProfile string
    Name of an existing file-filter profile.
    FirewallSessionDirty string
    How to handle sessions if the configuration of this firewall policy changes. Valid values: check-all, check-new.
    Fixedport string
    Enable to prevent source NAT from changing a session's source port. Valid values: disable, enable.
    Fsso string
    Enable/disable Fortinet Single Sign-On. Valid values: disable, enable.
    FssoAgentForNtlm string
    FSSO agent to use for NTLM authentication.
    FssoGroups []string
    Names of FSSO groups.
    GeoipAnycast string
    Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: disable, enable.
    GeoipMatch string
    Match geography address based either on its physical location or registered location. Valid values: physical-location, registered-location.
    GlobalLabel string
    Label for the policy that appears when the GUI is in Global View mode.
    Groups []string
    Names of user groups that can authenticate with this policy.
    GtpProfile string
    GTP profile.
    HttpPolicyRedirect string
    Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: disable, enable.
    IcapProfile string
    Name of an existing ICAP profile.
    IdentityBasedRoute string
    Name of identity-based routing rule.
    Inbound string
    Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: disable, enable.
    InspectionMode string
    Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: proxy, flow.
    InternetService string
    Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    InternetService6 string
    Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    InternetService6CustomGroups []string
    Custom Internet Service6 group name.
    InternetService6Customs []string
    Custom IPv6 Internet Service name.
    InternetService6Groups []string
    Internet Service group name.
    InternetService6Names []string
    IPv6 Internet Service name.
    InternetService6Negate string
    When enabled internet-service6 specifies what the service must NOT be. Valid values: disable, enable.
    InternetService6Src string
    Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    InternetService6SrcCustomGroups []string
    Custom Internet Service6 source group name.
    InternetService6SrcCustoms []string
    Custom IPv6 Internet Service source name.
    InternetService6SrcGroups []string
    Internet Service6 source group name.
    InternetService6SrcNames []string
    IPv6 Internet Service source name.
    InternetService6SrcNegate string
    When enabled internet-service6-src specifies what the service must NOT be. Valid values: disable, enable.
    InternetServiceCustomGroups []string
    Custom Internet Service group name.
    InternetServiceCustoms []string
    Custom Internet Service name.
    InternetServiceGroups []string
    Internet Service group name.
    InternetServiceIds []string
    Internet Service ID.
    InternetServiceNames []string
    Internet Service name.
    InternetServiceNegate string
    When enabled internet-service specifies what the service must NOT be. Valid values: disable, enable.
    InternetServiceSrc string
    Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    InternetServiceSrcCustomGroups []string
    Custom Internet Service source group name.
    InternetServiceSrcCustoms []string
    Custom Internet Service source name.
    InternetServiceSrcGroups []string
    Internet Service source group name.
    InternetServiceSrcIds []string
    Internet Service source ID.
    InternetServiceSrcNames []string
    Internet Service source name.
    InternetServiceSrcNegate string
    When enabled internet-service-src specifies what the service must NOT be. Valid values: disable, enable.
    IpVersionType string
    IP version of the policy.
    Ippool string
    Enable to use IP Pools for source NAT. Valid values: disable, enable.
    IpsSensor string
    Name of an existing IPS sensor.
    IpsVoipFilter string
    Name of an existing VoIP (ips) profile.
    Label string
    Label for the policy that appears when the GUI is in Section View mode.
    LearningMode string
    Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: disable, enable.
    LogHttpTransaction string
    Enable/disable HTTP transaction log. Valid values: disable, enable, all, utm.
    Logtraffic string
    Enable or disable logging. Log all sessions or security profile sessions. Valid values: disable, enable, all, utm.
    LogtrafficStart string
    Record logs when a session starts. Valid values: disable, enable.
    MatchVip string
    Enable to match packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    MatchVipOnly string
    Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    MmsProfile string
    Name of an existing MMS profile.
    Name string
    Policy name.
    Nat string
    Enable/disable source NAT. Valid values: disable, enable.
    Nat46 string
    Enable/disable NAT46. Valid values: disable, enable.
    Nat64 string
    Enable/disable NAT64. Valid values: disable, enable.
    Natinbound string
    Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: disable, enable.
    Natips []string
    Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
    Natoutbound string
    Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: disable, enable.
    NetworkServiceDynamics []string
    Dynamic Network Service name.
    NetworkServiceSrcDynamics []string
    Dynamic Network Service source name.
    NpAcceleration string
    Enable/disable UTM Network Processor acceleration. Valid values: disable, enable.
    Ntlm string
    Enable/disable NTLM authentication. Valid values: disable, enable.
    NtlmEnabledBrowsers []string
    HTTP-User-Agent value of supported browsers.
    NtlmGuest string
    Enable/disable NTLM guest user access. Valid values: disable, enable.
    Outbound string
    Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: disable, enable.
    PackagesPblockFirewallPolicyId string
    an identifier for the resource with format {{policyid}}.
    PassiveWanHealthMeasurement string
    Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: disable, enable.
    PcpInbound string
    Enable/disable PCP inbound DNAT. Valid values: disable, enable.
    PcpOutbound string
    Enable/disable PCP outbound SNAT. Valid values: disable, enable.
    PcpPoolnames []string
    PCP pool names.
    PerIpShaper string
    Per-IP traffic shaper.
    PermitAnyHost string
    Accept UDP packets from any host. Valid values: disable, enable.
    PermitStunHost string
    Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: disable, enable.
    PfcpProfile string
    PFCP profile.
    PolicyBehaviourType string
    Behaviour of the policy.
    PolicyExpiry string
    Enable/disable policy expiry. Valid values: disable, enable.
    PolicyExpiryDate string
    Policy expiry date (YYYY-MM-DD HH:MM:SS).
    PolicyExpiryDateUtc string
    Policy expiry date and time, in epoch format.
    PolicyOffload string
    Enable/Disable hardware session setup for CGNAT. Valid values: disable, enable.
    Poolname6s []string
    IPv6 pool names.
    Poolnames []string
    IP Pool names.
    PortPreserve string
    Enable/disable preservation of the original source port from source NAT if it has not been used. Valid values: disable, enable.
    ProfileGroup string
    Name of profile group.
    ProfileProtocolOptions string
    Name of an existing Protocol options profile.
    ProfileType string
    Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: single, group.
    RadiusIpAuthBypass string
    Enable IP authentication bypass. The bypassed IP address must be received from RADIUS server. Valid values: disable, enable.
    RadiusMacAuthBypass string
    Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: disable, enable.
    RedirectUrl string
    URL users are directed to after seeing and accepting the disclaimer or authenticating.
    ReplacemsgOverrideGroup string
    Override the default replacement message group for this policy.
    ReputationDirection string
    Direction of the initial traffic for reputation to take effect. Valid values: source, destination.
    ReputationDirection6 string
    Direction of the initial traffic for IPv6 reputation to take effect. Valid values: source, destination.
    ReputationMinimum float64
    Minimum Reputation to take action.
    ReputationMinimum6 float64
    IPv6 Minimum Reputation to take action.
    Rsso string
    Enable/disable RADIUS single sign-on (RSSO). Valid values: disable, enable.
    RtpAddrs []string
    Address names if this is an RTP NAT policy.
    RtpNat string
    Enable Real Time Protocol (RTP) NAT. Valid values: disable, enable.
    ScanBotnetConnections string
    Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: disable, block, monitor.
    Schedule string
    Schedule name.
    ScheduleTimeout string
    Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: disable, enable.
    Scopetype string
    The scope of application of the resource. Valid values: inherit, adom. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    SctpFilterProfile string
    Name of an existing SCTP filter profile.
    SendDenyPacket string
    Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: disable, enable.
    ServiceNegate string
    When enabled service specifies what the service must NOT be. Valid values: disable, enable.
    Services []string
    Service and service group names.
    SessionTtl string
    TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
    SgtCheck string
    Enable/disable security group tags (SGT) check. Valid values: disable, enable.
    Sgts []float64
    Security group tags.
    SpamfilterProfile string
    Name of an existing Spam filter profile.
    SrcVendorMacs []string
    Vendor MAC source ID.
    Srcaddr6Negate string
    When enabled srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    Srcaddr6s []string
    Source IPv6 address name and address group names.
    SrcaddrNegate string
    When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    Srcaddrs []string
    Source IPv4 address and address group names.
    Srcintfs []string
    Incoming (ingress) interface.
    SshFilterProfile string
    Name of an existing SSH filter profile.
    SshPolicyRedirect string
    Redirect SSH traffic to matching transparent proxy policy. Valid values: disable, enable.
    SslMirror string
    Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: disable, enable.
    SslMirrorIntfs []string
    SSL mirror interface name.
    SslSshProfile string
    Name of an existing SSL SSH profile.
    Status string
    Enable or disable this policy. Valid values: disable, enable.
    TcpMssReceiver float64
    Receiver TCP maximum segment size (MSS).
    TcpMssSender float64
    Sender TCP maximum segment size (MSS).
    TcpSessionWithoutSyn string
    Enable/disable creation of TCP session without SYN flag. Valid values: all, data-only, disable.
    TcpTimeoutPid string
    TCP timeout profile ID
    TimeoutSendRst string
    Enable/disable sending RST packets when TCP sessions expire. Valid values: disable, enable.
    Tos string
    ToS (Type of Service) value used for comparison.
    TosMask string
    Non-zero bit positions are used for comparison while zero bit positions are ignored.
    TosNegate string
    Enable negated TOS match. Valid values: disable, enable.
    TrafficShaper string
    Traffic shaper.
    TrafficShaperReverse string
    Reverse traffic shaper.
    UdpTimeoutPid string
    UDP timeout profile ID
    UrlCategories []string
    URL category ID list.
    Users []string
    Names of individual users that can authenticate with this policy.
    UtmStatus string
    Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: disable, enable.
    Uuid string
    Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
    VideofilterProfile string
    Name of an existing VideoFilter profile.
    VirtualPatchProfile string
    Name of an existing virtual-patch profile.
    VlanCosFwd float64
    VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
    VlanCosRev float64
    VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
    VlanFilter string
    Set VLAN filters.
    VoipProfile string
    Name of an existing VoIP profile.
    Vpntunnel string
    Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
    WafProfile string
    Name of an existing Web application firewall profile.
    Wanopt string
    Enable/disable WAN optimization. Valid values: disable, enable.
    WanoptDetection string
    WAN optimization auto-detection mode. Valid values: active, passive, off.
    WanoptPassiveOpt string
    WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: default, transparent, non-transparent.
    WanoptPeer string
    WAN optimization peer.
    WanoptProfile string
    WAN optimization profile.
    Wccp string
    Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: disable, enable.
    Webcache string
    Enable/disable web cache. Valid values: disable, enable.
    WebcacheHttps string
    Enable/disable web cache for HTTPS. Valid values: disable, ssl-server, any, enable.
    WebfilterProfile string
    Name of an existing Web filter profile.
    WebproxyForwardServer string
    Webproxy forward server name.
    WebproxyProfile string
    Webproxy profile name.
    Wsso string
    Enable/disable WiFi Single Sign On (WSSO). Valid values: disable, enable.
    ZtnaDeviceOwnership string
    Enable/disable zero trust device ownership. Valid values: disable, enable.
    ZtnaEmsTagSecondaries []string
    Source ztna-ems-tag-secondary names.
    ZtnaEmsTags []string
    Source ztna-ems-tag names.
    ZtnaGeoTags []string
    Source ztna-geo-tag names.
    ZtnaPolicyRedirect string
    Redirect ZTNA traffic to matching Access-Proxy proxy-policy. Valid values: disable, enable.
    ZtnaStatus string
    Enable/disable zero trust access. Valid values: disable, enable.
    ZtnaTagsMatchLogic string
    ZTNA tag matching logic. Valid values: or, and.
    _policyBlock float64
    Assigned policy block. When this attribute is set, the policy represent a policy block, and all other attributes are ignored. This attribute is not available when configuring policy inside a policy block.
    pblock String
    Pblock.
    _policyBlock Double
    Assigned policy block. When this attribute is set, the policy represent a policy block, and all other attributes are ignored. This attribute is not available when configuring policy inside a policy block.
    action String
    Policy action (accept/deny/ipsec). Valid values: deny, accept, ipsec, ssl-vpn, redirect, isolate.
    adom String
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    antiReplay String
    Enable/disable anti-replay check. Valid values: disable, enable.
    appCategories List<String>
    Application category ID list.
    appGroups List<String>
    Application group names.
    applicationList String
    Name of an existing Application list.
    applications List<Double>
    Application ID list.
    authCert String
    HTTPS server certificate for policy authentication.
    authPath String
    Enable/disable authentication-based routing. Valid values: disable, enable.
    authRedirectAddr String
    HTTP-to-HTTPS redirect address for firewall authentication.
    autoAsicOffload String
    Enable/disable policy traffic ASIC offloading. Valid values: disable, enable.
    avProfile String
    Name of an existing Antivirus profile.
    bestRoute String
    Best-Route. Valid values: disable, enable.
    blockNotification String
    Enable/disable block notification. Valid values: disable, enable.
    captivePortalExempt String
    Enable to exempt some users from the captive portal. Valid values: disable, enable.
    capturePacket String
    Enable/disable capture packets. Valid values: disable, enable.
    casbProfile String
    Name of an existing CASB profile.
    cgnEif String
    Enable/Disable CGN endpoint independent filtering. Valid values: disable, enable.
    cgnEim String
    Enable/Disable CGN endpoint independent mapping Valid values: disable, enable.
    cgnLogServerGrp String
    NP log server group name
    cgnResourceQuota Double
    resource quota
    cgnSessionQuota Double
    session quota
    cgnSwEifCtrl String
    Enable/disable software endpoint independent filtering control. Valid values: disable, enable.
    cifsProfile String
    Name of an existing CIFS profile.
    comments String
    Comment.
    customLogFields List<String>
    Custom fields to append to log messages for this policy.
    decryptedTrafficMirror String
    Decrypted traffic mirror.
    delayTcpNpuSession String
    Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: disable, enable.
    devices List<String>
    Names of devices or device groups that can be matched by the policy.
    diameterFilterProfile String
    Name of an existing Diameter filter profile.
    diffservCopy String
    Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: disable, enable.
    diffservForward String
    Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: disable, enable.
    diffservReverse String
    Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: disable, enable.
    diffservcodeForward String
    Change packet's DiffServ to this value.
    diffservcodeRev String
    Change packet's reverse (reply) DiffServ to this value.
    disclaimer String
    Enable/disable user authentication disclaimer. Valid values: disable, enable, user, domain, policy.
    dlpProfile String
    Name of an existing DLP profile.
    dlpSensor String
    Name of an existing DLP sensor.
    dnsfilterProfile String
    Name of an existing DNS filter profile.
    dscpMatch String
    Enable DSCP check. Valid values: disable, enable.
    dscpNegate String
    Enable negated DSCP match. Valid values: disable, enable.
    dscpValue String
    DSCP value.
    dsri String
    Enable DSRI to ignore HTTP server responses. Valid values: disable, enable.
    dstaddr6Negate String
    When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddr6s List<String>
    Destination IPv6 address name and address group names.
    dstaddrNegate String
    When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddrs List<String>
    Destination IPv4 address and address group names.
    dstintfs List<String>
    Outgoing (egress) interface.
    dynamicShaping String
    Enable/disable dynamic RADIUS defined traffic shaping. Valid values: disable, enable.
    eifCheck String
    Enable/Disable check endpoint-independent-filtering pinhole. Valid values: disable, enable.
    eifLearn String
    Enable/Disable learning of end-point-independent filtering pinhole. Valid values: disable, enable.
    emailCollect String
    Enable/disable email collection. Valid values: disable, enable.
    emailfilterProfile String
    Name of an existing email filter profile.
    fec String
    Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: disable, enable.
    fileFilterProfile String
    Name of an existing file-filter profile.
    firewallSessionDirty String
    How to handle sessions if the configuration of this firewall policy changes. Valid values: check-all, check-new.
    fixedport String
    Enable to prevent source NAT from changing a session's source port. Valid values: disable, enable.
    fsso String
    Enable/disable Fortinet Single Sign-On. Valid values: disable, enable.
    fssoAgentForNtlm String
    FSSO agent to use for NTLM authentication.
    fssoGroups List<String>
    Names of FSSO groups.
    geoipAnycast String
    Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: disable, enable.
    geoipMatch String
    Match geography address based either on its physical location or registered location. Valid values: physical-location, registered-location.
    globalLabel String
    Label for the policy that appears when the GUI is in Global View mode.
    groups List<String>
    Names of user groups that can authenticate with this policy.
    gtpProfile String
    GTP profile.
    httpPolicyRedirect String
    Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: disable, enable.
    icapProfile String
    Name of an existing ICAP profile.
    identityBasedRoute String
    Name of identity-based routing rule.
    inbound String
    Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: disable, enable.
    inspectionMode String
    Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: proxy, flow.
    internetService String
    Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internetService6 String
    Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internetService6CustomGroups List<String>
    Custom Internet Service6 group name.
    internetService6Customs List<String>
    Custom IPv6 Internet Service name.
    internetService6Groups List<String>
    Internet Service group name.
    internetService6Names List<String>
    IPv6 Internet Service name.
    internetService6Negate String
    When enabled internet-service6 specifies what the service must NOT be. Valid values: disable, enable.
    internetService6Src String
    Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internetService6SrcCustomGroups List<String>
    Custom Internet Service6 source group name.
    internetService6SrcCustoms List<String>
    Custom IPv6 Internet Service source name.
    internetService6SrcGroups List<String>
    Internet Service6 source group name.
    internetService6SrcNames List<String>
    IPv6 Internet Service source name.
    internetService6SrcNegate String
    When enabled internet-service6-src specifies what the service must NOT be. Valid values: disable, enable.
    internetServiceCustomGroups List<String>
    Custom Internet Service group name.
    internetServiceCustoms List<String>
    Custom Internet Service name.
    internetServiceGroups List<String>
    Internet Service group name.
    internetServiceIds List<String>
    Internet Service ID.
    internetServiceNames List<String>
    Internet Service name.
    internetServiceNegate String
    When enabled internet-service specifies what the service must NOT be. Valid values: disable, enable.
    internetServiceSrc String
    Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internetServiceSrcCustomGroups List<String>
    Custom Internet Service source group name.
    internetServiceSrcCustoms List<String>
    Custom Internet Service source name.
    internetServiceSrcGroups List<String>
    Internet Service source group name.
    internetServiceSrcIds List<String>
    Internet Service source ID.
    internetServiceSrcNames List<String>
    Internet Service source name.
    internetServiceSrcNegate String
    When enabled internet-service-src specifies what the service must NOT be. Valid values: disable, enable.
    ipVersionType String
    IP version of the policy.
    ippool String
    Enable to use IP Pools for source NAT. Valid values: disable, enable.
    ipsSensor String
    Name of an existing IPS sensor.
    ipsVoipFilter String
    Name of an existing VoIP (ips) profile.
    label String
    Label for the policy that appears when the GUI is in Section View mode.
    learningMode String
    Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: disable, enable.
    logHttpTransaction String
    Enable/disable HTTP transaction log. Valid values: disable, enable, all, utm.
    logtraffic String
    Enable or disable logging. Log all sessions or security profile sessions. Valid values: disable, enable, all, utm.
    logtrafficStart String
    Record logs when a session starts. Valid values: disable, enable.
    matchVip String
    Enable to match packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    matchVipOnly String
    Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    mmsProfile String
    Name of an existing MMS profile.
    name String
    Policy name.
    nat String
    Enable/disable source NAT. Valid values: disable, enable.
    nat46 String
    Enable/disable NAT46. Valid values: disable, enable.
    nat64 String
    Enable/disable NAT64. Valid values: disable, enable.
    natinbound String
    Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: disable, enable.
    natips List<String>
    Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
    natoutbound String
    Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: disable, enable.
    networkServiceDynamics List<String>
    Dynamic Network Service name.
    networkServiceSrcDynamics List<String>
    Dynamic Network Service source name.
    npAcceleration String
    Enable/disable UTM Network Processor acceleration. Valid values: disable, enable.
    ntlm String
    Enable/disable NTLM authentication. Valid values: disable, enable.
    ntlmEnabledBrowsers List<String>
    HTTP-User-Agent value of supported browsers.
    ntlmGuest String
    Enable/disable NTLM guest user access. Valid values: disable, enable.
    outbound String
    Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: disable, enable.
    packagesPblockFirewallPolicyId String
    an identifier for the resource with format {{policyid}}.
    passiveWanHealthMeasurement String
    Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: disable, enable.
    pcpInbound String
    Enable/disable PCP inbound DNAT. Valid values: disable, enable.
    pcpOutbound String
    Enable/disable PCP outbound SNAT. Valid values: disable, enable.
    pcpPoolnames List<String>
    PCP pool names.
    perIpShaper String
    Per-IP traffic shaper.
    permitAnyHost String
    Accept UDP packets from any host. Valid values: disable, enable.
    permitStunHost String
    Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: disable, enable.
    pfcpProfile String
    PFCP profile.
    policyBehaviourType String
    Behaviour of the policy.
    policyExpiry String
    Enable/disable policy expiry. Valid values: disable, enable.
    policyExpiryDate String
    Policy expiry date (YYYY-MM-DD HH:MM:SS).
    policyExpiryDateUtc String
    Policy expiry date and time, in epoch format.
    policyOffload String
    Enable/Disable hardware session setup for CGNAT. Valid values: disable, enable.
    poolname6s List<String>
    IPv6 pool names.
    poolnames List<String>
    IP Pool names.
    portPreserve String
    Enable/disable preservation of the original source port from source NAT if it has not been used. Valid values: disable, enable.
    profileGroup String
    Name of profile group.
    profileProtocolOptions String
    Name of an existing Protocol options profile.
    profileType String
    Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: single, group.
    radiusIpAuthBypass String
    Enable IP authentication bypass. The bypassed IP address must be received from RADIUS server. Valid values: disable, enable.
    radiusMacAuthBypass String
    Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: disable, enable.
    redirectUrl String
    URL users are directed to after seeing and accepting the disclaimer or authenticating.
    replacemsgOverrideGroup String
    Override the default replacement message group for this policy.
    reputationDirection String
    Direction of the initial traffic for reputation to take effect. Valid values: source, destination.
    reputationDirection6 String
    Direction of the initial traffic for IPv6 reputation to take effect. Valid values: source, destination.
    reputationMinimum Double
    Minimum Reputation to take action.
    reputationMinimum6 Double
    IPv6 Minimum Reputation to take action.
    rsso String
    Enable/disable RADIUS single sign-on (RSSO). Valid values: disable, enable.
    rtpAddrs List<String>
    Address names if this is an RTP NAT policy.
    rtpNat String
    Enable Real Time Protocol (RTP) NAT. Valid values: disable, enable.
    scanBotnetConnections String
    Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: disable, block, monitor.
    schedule String
    Schedule name.
    scheduleTimeout String
    Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: disable, enable.
    scopetype String
    The scope of application of the resource. Valid values: inherit, adom. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    sctpFilterProfile String
    Name of an existing SCTP filter profile.
    sendDenyPacket String
    Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: disable, enable.
    serviceNegate String
    When enabled service specifies what the service must NOT be. Valid values: disable, enable.
    services List<String>
    Service and service group names.
    sessionTtl String
    TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
    sgtCheck String
    Enable/disable security group tags (SGT) check. Valid values: disable, enable.
    sgts List<Double>
    Security group tags.
    spamfilterProfile String
    Name of an existing Spam filter profile.
    srcVendorMacs List<String>
    Vendor MAC source ID.
    srcaddr6Negate String
    When enabled srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddr6s List<String>
    Source IPv6 address name and address group names.
    srcaddrNegate String
    When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddrs List<String>
    Source IPv4 address and address group names.
    srcintfs List<String>
    Incoming (ingress) interface.
    sshFilterProfile String
    Name of an existing SSH filter profile.
    sshPolicyRedirect String
    Redirect SSH traffic to matching transparent proxy policy. Valid values: disable, enable.
    sslMirror String
    Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: disable, enable.
    sslMirrorIntfs List<String>
    SSL mirror interface name.
    sslSshProfile String
    Name of an existing SSL SSH profile.
    status String
    Enable or disable this policy. Valid values: disable, enable.
    tcpMssReceiver Double
    Receiver TCP maximum segment size (MSS).
    tcpMssSender Double
    Sender TCP maximum segment size (MSS).
    tcpSessionWithoutSyn String
    Enable/disable creation of TCP session without SYN flag. Valid values: all, data-only, disable.
    tcpTimeoutPid String
    TCP timeout profile ID
    timeoutSendRst String
    Enable/disable sending RST packets when TCP sessions expire. Valid values: disable, enable.
    tos String
    ToS (Type of Service) value used for comparison.
    tosMask String
    Non-zero bit positions are used for comparison while zero bit positions are ignored.
    tosNegate String
    Enable negated TOS match. Valid values: disable, enable.
    trafficShaper String
    Traffic shaper.
    trafficShaperReverse String
    Reverse traffic shaper.
    udpTimeoutPid String
    UDP timeout profile ID
    urlCategories List<String>
    URL category ID list.
    users List<String>
    Names of individual users that can authenticate with this policy.
    utmStatus String
    Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: disable, enable.
    uuid String
    Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
    videofilterProfile String
    Name of an existing VideoFilter profile.
    virtualPatchProfile String
    Name of an existing virtual-patch profile.
    vlanCosFwd Double
    VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlanCosRev Double
    VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlanFilter String
    Set VLAN filters.
    voipProfile String
    Name of an existing VoIP profile.
    vpntunnel String
    Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
    wafProfile String
    Name of an existing Web application firewall profile.
    wanopt String
    Enable/disable WAN optimization. Valid values: disable, enable.
    wanoptDetection String
    WAN optimization auto-detection mode. Valid values: active, passive, off.
    wanoptPassiveOpt String
    WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: default, transparent, non-transparent.
    wanoptPeer String
    WAN optimization peer.
    wanoptProfile String
    WAN optimization profile.
    wccp String
    Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: disable, enable.
    webcache String
    Enable/disable web cache. Valid values: disable, enable.
    webcacheHttps String
    Enable/disable web cache for HTTPS. Valid values: disable, ssl-server, any, enable.
    webfilterProfile String
    Name of an existing Web filter profile.
    webproxyForwardServer String
    Webproxy forward server name.
    webproxyProfile String
    Webproxy profile name.
    wsso String
    Enable/disable WiFi Single Sign On (WSSO). Valid values: disable, enable.
    ztnaDeviceOwnership String
    Enable/disable zero trust device ownership. Valid values: disable, enable.
    ztnaEmsTagSecondaries List<String>
    Source ztna-ems-tag-secondary names.
    ztnaEmsTags List<String>
    Source ztna-ems-tag names.
    ztnaGeoTags List<String>
    Source ztna-geo-tag names.
    ztnaPolicyRedirect String
    Redirect ZTNA traffic to matching Access-Proxy proxy-policy. Valid values: disable, enable.
    ztnaStatus String
    Enable/disable zero trust access. Valid values: disable, enable.
    ztnaTagsMatchLogic String
    ZTNA tag matching logic. Valid values: or, and.
    pblock string
    Pblock.
    _policyBlock number
    Assigned policy block. When this attribute is set, the policy represent a policy block, and all other attributes are ignored. This attribute is not available when configuring policy inside a policy block.
    action string
    Policy action (accept/deny/ipsec). Valid values: deny, accept, ipsec, ssl-vpn, redirect, isolate.
    adom string
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    antiReplay string
    Enable/disable anti-replay check. Valid values: disable, enable.
    appCategories string[]
    Application category ID list.
    appGroups string[]
    Application group names.
    applicationList string
    Name of an existing Application list.
    applications number[]
    Application ID list.
    authCert string
    HTTPS server certificate for policy authentication.
    authPath string
    Enable/disable authentication-based routing. Valid values: disable, enable.
    authRedirectAddr string
    HTTP-to-HTTPS redirect address for firewall authentication.
    autoAsicOffload string
    Enable/disable policy traffic ASIC offloading. Valid values: disable, enable.
    avProfile string
    Name of an existing Antivirus profile.
    bestRoute string
    Best-Route. Valid values: disable, enable.
    blockNotification string
    Enable/disable block notification. Valid values: disable, enable.
    captivePortalExempt string
    Enable to exempt some users from the captive portal. Valid values: disable, enable.
    capturePacket string
    Enable/disable capture packets. Valid values: disable, enable.
    casbProfile string
    Name of an existing CASB profile.
    cgnEif string
    Enable/Disable CGN endpoint independent filtering. Valid values: disable, enable.
    cgnEim string
    Enable/Disable CGN endpoint independent mapping Valid values: disable, enable.
    cgnLogServerGrp string
    NP log server group name
    cgnResourceQuota number
    resource quota
    cgnSessionQuota number
    session quota
    cgnSwEifCtrl string
    Enable/disable software endpoint independent filtering control. Valid values: disable, enable.
    cifsProfile string
    Name of an existing CIFS profile.
    comments string
    Comment.
    customLogFields string[]
    Custom fields to append to log messages for this policy.
    decryptedTrafficMirror string
    Decrypted traffic mirror.
    delayTcpNpuSession string
    Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: disable, enable.
    devices string[]
    Names of devices or device groups that can be matched by the policy.
    diameterFilterProfile string
    Name of an existing Diameter filter profile.
    diffservCopy string
    Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: disable, enable.
    diffservForward string
    Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: disable, enable.
    diffservReverse string
    Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: disable, enable.
    diffservcodeForward string
    Change packet's DiffServ to this value.
    diffservcodeRev string
    Change packet's reverse (reply) DiffServ to this value.
    disclaimer string
    Enable/disable user authentication disclaimer. Valid values: disable, enable, user, domain, policy.
    dlpProfile string
    Name of an existing DLP profile.
    dlpSensor string
    Name of an existing DLP sensor.
    dnsfilterProfile string
    Name of an existing DNS filter profile.
    dscpMatch string
    Enable DSCP check. Valid values: disable, enable.
    dscpNegate string
    Enable negated DSCP match. Valid values: disable, enable.
    dscpValue string
    DSCP value.
    dsri string
    Enable DSRI to ignore HTTP server responses. Valid values: disable, enable.
    dstaddr6Negate string
    When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddr6s string[]
    Destination IPv6 address name and address group names.
    dstaddrNegate string
    When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddrs string[]
    Destination IPv4 address and address group names.
    dstintfs string[]
    Outgoing (egress) interface.
    dynamicShaping string
    Enable/disable dynamic RADIUS defined traffic shaping. Valid values: disable, enable.
    eifCheck string
    Enable/Disable check endpoint-independent-filtering pinhole. Valid values: disable, enable.
    eifLearn string
    Enable/Disable learning of end-point-independent filtering pinhole. Valid values: disable, enable.
    emailCollect string
    Enable/disable email collection. Valid values: disable, enable.
    emailfilterProfile string
    Name of an existing email filter profile.
    fec string
    Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: disable, enable.
    fileFilterProfile string
    Name of an existing file-filter profile.
    firewallSessionDirty string
    How to handle sessions if the configuration of this firewall policy changes. Valid values: check-all, check-new.
    fixedport string
    Enable to prevent source NAT from changing a session's source port. Valid values: disable, enable.
    fsso string
    Enable/disable Fortinet Single Sign-On. Valid values: disable, enable.
    fssoAgentForNtlm string
    FSSO agent to use for NTLM authentication.
    fssoGroups string[]
    Names of FSSO groups.
    geoipAnycast string
    Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: disable, enable.
    geoipMatch string
    Match geography address based either on its physical location or registered location. Valid values: physical-location, registered-location.
    globalLabel string
    Label for the policy that appears when the GUI is in Global View mode.
    groups string[]
    Names of user groups that can authenticate with this policy.
    gtpProfile string
    GTP profile.
    httpPolicyRedirect string
    Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: disable, enable.
    icapProfile string
    Name of an existing ICAP profile.
    identityBasedRoute string
    Name of identity-based routing rule.
    inbound string
    Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: disable, enable.
    inspectionMode string
    Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: proxy, flow.
    internetService string
    Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internetService6 string
    Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internetService6CustomGroups string[]
    Custom Internet Service6 group name.
    internetService6Customs string[]
    Custom IPv6 Internet Service name.
    internetService6Groups string[]
    Internet Service group name.
    internetService6Names string[]
    IPv6 Internet Service name.
    internetService6Negate string
    When enabled internet-service6 specifies what the service must NOT be. Valid values: disable, enable.
    internetService6Src string
    Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internetService6SrcCustomGroups string[]
    Custom Internet Service6 source group name.
    internetService6SrcCustoms string[]
    Custom IPv6 Internet Service source name.
    internetService6SrcGroups string[]
    Internet Service6 source group name.
    internetService6SrcNames string[]
    IPv6 Internet Service source name.
    internetService6SrcNegate string
    When enabled internet-service6-src specifies what the service must NOT be. Valid values: disable, enable.
    internetServiceCustomGroups string[]
    Custom Internet Service group name.
    internetServiceCustoms string[]
    Custom Internet Service name.
    internetServiceGroups string[]
    Internet Service group name.
    internetServiceIds string[]
    Internet Service ID.
    internetServiceNames string[]
    Internet Service name.
    internetServiceNegate string
    When enabled internet-service specifies what the service must NOT be. Valid values: disable, enable.
    internetServiceSrc string
    Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internetServiceSrcCustomGroups string[]
    Custom Internet Service source group name.
    internetServiceSrcCustoms string[]
    Custom Internet Service source name.
    internetServiceSrcGroups string[]
    Internet Service source group name.
    internetServiceSrcIds string[]
    Internet Service source ID.
    internetServiceSrcNames string[]
    Internet Service source name.
    internetServiceSrcNegate string
    When enabled internet-service-src specifies what the service must NOT be. Valid values: disable, enable.
    ipVersionType string
    IP version of the policy.
    ippool string
    Enable to use IP Pools for source NAT. Valid values: disable, enable.
    ipsSensor string
    Name of an existing IPS sensor.
    ipsVoipFilter string
    Name of an existing VoIP (ips) profile.
    label string
    Label for the policy that appears when the GUI is in Section View mode.
    learningMode string
    Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: disable, enable.
    logHttpTransaction string
    Enable/disable HTTP transaction log. Valid values: disable, enable, all, utm.
    logtraffic string
    Enable or disable logging. Log all sessions or security profile sessions. Valid values: disable, enable, all, utm.
    logtrafficStart string
    Record logs when a session starts. Valid values: disable, enable.
    matchVip string
    Enable to match packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    matchVipOnly string
    Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    mmsProfile string
    Name of an existing MMS profile.
    name string
    Policy name.
    nat string
    Enable/disable source NAT. Valid values: disable, enable.
    nat46 string
    Enable/disable NAT46. Valid values: disable, enable.
    nat64 string
    Enable/disable NAT64. Valid values: disable, enable.
    natinbound string
    Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: disable, enable.
    natips string[]
    Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
    natoutbound string
    Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: disable, enable.
    networkServiceDynamics string[]
    Dynamic Network Service name.
    networkServiceSrcDynamics string[]
    Dynamic Network Service source name.
    npAcceleration string
    Enable/disable UTM Network Processor acceleration. Valid values: disable, enable.
    ntlm string
    Enable/disable NTLM authentication. Valid values: disable, enable.
    ntlmEnabledBrowsers string[]
    HTTP-User-Agent value of supported browsers.
    ntlmGuest string
    Enable/disable NTLM guest user access. Valid values: disable, enable.
    outbound string
    Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: disable, enable.
    packagesPblockFirewallPolicyId string
    an identifier for the resource with format {{policyid}}.
    passiveWanHealthMeasurement string
    Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: disable, enable.
    pcpInbound string
    Enable/disable PCP inbound DNAT. Valid values: disable, enable.
    pcpOutbound string
    Enable/disable PCP outbound SNAT. Valid values: disable, enable.
    pcpPoolnames string[]
    PCP pool names.
    perIpShaper string
    Per-IP traffic shaper.
    permitAnyHost string
    Accept UDP packets from any host. Valid values: disable, enable.
    permitStunHost string
    Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: disable, enable.
    pfcpProfile string
    PFCP profile.
    policyBehaviourType string
    Behaviour of the policy.
    policyExpiry string
    Enable/disable policy expiry. Valid values: disable, enable.
    policyExpiryDate string
    Policy expiry date (YYYY-MM-DD HH:MM:SS).
    policyExpiryDateUtc string
    Policy expiry date and time, in epoch format.
    policyOffload string
    Enable/Disable hardware session setup for CGNAT. Valid values: disable, enable.
    poolname6s string[]
    IPv6 pool names.
    poolnames string[]
    IP Pool names.
    portPreserve string
    Enable/disable preservation of the original source port from source NAT if it has not been used. Valid values: disable, enable.
    profileGroup string
    Name of profile group.
    profileProtocolOptions string
    Name of an existing Protocol options profile.
    profileType string
    Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: single, group.
    radiusIpAuthBypass string
    Enable IP authentication bypass. The bypassed IP address must be received from RADIUS server. Valid values: disable, enable.
    radiusMacAuthBypass string
    Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: disable, enable.
    redirectUrl string
    URL users are directed to after seeing and accepting the disclaimer or authenticating.
    replacemsgOverrideGroup string
    Override the default replacement message group for this policy.
    reputationDirection string
    Direction of the initial traffic for reputation to take effect. Valid values: source, destination.
    reputationDirection6 string
    Direction of the initial traffic for IPv6 reputation to take effect. Valid values: source, destination.
    reputationMinimum number
    Minimum Reputation to take action.
    reputationMinimum6 number
    IPv6 Minimum Reputation to take action.
    rsso string
    Enable/disable RADIUS single sign-on (RSSO). Valid values: disable, enable.
    rtpAddrs string[]
    Address names if this is an RTP NAT policy.
    rtpNat string
    Enable Real Time Protocol (RTP) NAT. Valid values: disable, enable.
    scanBotnetConnections string
    Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: disable, block, monitor.
    schedule string
    Schedule name.
    scheduleTimeout string
    Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: disable, enable.
    scopetype string
    The scope of application of the resource. Valid values: inherit, adom. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    sctpFilterProfile string
    Name of an existing SCTP filter profile.
    sendDenyPacket string
    Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: disable, enable.
    serviceNegate string
    When enabled service specifies what the service must NOT be. Valid values: disable, enable.
    services string[]
    Service and service group names.
    sessionTtl string
    TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
    sgtCheck string
    Enable/disable security group tags (SGT) check. Valid values: disable, enable.
    sgts number[]
    Security group tags.
    spamfilterProfile string
    Name of an existing Spam filter profile.
    srcVendorMacs string[]
    Vendor MAC source ID.
    srcaddr6Negate string
    When enabled srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddr6s string[]
    Source IPv6 address name and address group names.
    srcaddrNegate string
    When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddrs string[]
    Source IPv4 address and address group names.
    srcintfs string[]
    Incoming (ingress) interface.
    sshFilterProfile string
    Name of an existing SSH filter profile.
    sshPolicyRedirect string
    Redirect SSH traffic to matching transparent proxy policy. Valid values: disable, enable.
    sslMirror string
    Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: disable, enable.
    sslMirrorIntfs string[]
    SSL mirror interface name.
    sslSshProfile string
    Name of an existing SSL SSH profile.
    status string
    Enable or disable this policy. Valid values: disable, enable.
    tcpMssReceiver number
    Receiver TCP maximum segment size (MSS).
    tcpMssSender number
    Sender TCP maximum segment size (MSS).
    tcpSessionWithoutSyn string
    Enable/disable creation of TCP session without SYN flag. Valid values: all, data-only, disable.
    tcpTimeoutPid string
    TCP timeout profile ID
    timeoutSendRst string
    Enable/disable sending RST packets when TCP sessions expire. Valid values: disable, enable.
    tos string
    ToS (Type of Service) value used for comparison.
    tosMask string
    Non-zero bit positions are used for comparison while zero bit positions are ignored.
    tosNegate string
    Enable negated TOS match. Valid values: disable, enable.
    trafficShaper string
    Traffic shaper.
    trafficShaperReverse string
    Reverse traffic shaper.
    udpTimeoutPid string
    UDP timeout profile ID
    urlCategories string[]
    URL category ID list.
    users string[]
    Names of individual users that can authenticate with this policy.
    utmStatus string
    Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: disable, enable.
    uuid string
    Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
    videofilterProfile string
    Name of an existing VideoFilter profile.
    virtualPatchProfile string
    Name of an existing virtual-patch profile.
    vlanCosFwd number
    VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlanCosRev number
    VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlanFilter string
    Set VLAN filters.
    voipProfile string
    Name of an existing VoIP profile.
    vpntunnel string
    Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
    wafProfile string
    Name of an existing Web application firewall profile.
    wanopt string
    Enable/disable WAN optimization. Valid values: disable, enable.
    wanoptDetection string
    WAN optimization auto-detection mode. Valid values: active, passive, off.
    wanoptPassiveOpt string
    WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: default, transparent, non-transparent.
    wanoptPeer string
    WAN optimization peer.
    wanoptProfile string
    WAN optimization profile.
    wccp string
    Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: disable, enable.
    webcache string
    Enable/disable web cache. Valid values: disable, enable.
    webcacheHttps string
    Enable/disable web cache for HTTPS. Valid values: disable, ssl-server, any, enable.
    webfilterProfile string
    Name of an existing Web filter profile.
    webproxyForwardServer string
    Webproxy forward server name.
    webproxyProfile string
    Webproxy profile name.
    wsso string
    Enable/disable WiFi Single Sign On (WSSO). Valid values: disable, enable.
    ztnaDeviceOwnership string
    Enable/disable zero trust device ownership. Valid values: disable, enable.
    ztnaEmsTagSecondaries string[]
    Source ztna-ems-tag-secondary names.
    ztnaEmsTags string[]
    Source ztna-ems-tag names.
    ztnaGeoTags string[]
    Source ztna-geo-tag names.
    ztnaPolicyRedirect string
    Redirect ZTNA traffic to matching Access-Proxy proxy-policy. Valid values: disable, enable.
    ztnaStatus string
    Enable/disable zero trust access. Valid values: disable, enable.
    ztnaTagsMatchLogic string
    ZTNA tag matching logic. Valid values: or, and.
    pblock str
    Pblock.
    _policy_block float
    Assigned policy block. When this attribute is set, the policy represent a policy block, and all other attributes are ignored. This attribute is not available when configuring policy inside a policy block.
    action str
    Policy action (accept/deny/ipsec). Valid values: deny, accept, ipsec, ssl-vpn, redirect, isolate.
    adom str
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    anti_replay str
    Enable/disable anti-replay check. Valid values: disable, enable.
    app_categories Sequence[str]
    Application category ID list.
    app_groups Sequence[str]
    Application group names.
    application_list str
    Name of an existing Application list.
    applications Sequence[float]
    Application ID list.
    auth_cert str
    HTTPS server certificate for policy authentication.
    auth_path str
    Enable/disable authentication-based routing. Valid values: disable, enable.
    auth_redirect_addr str
    HTTP-to-HTTPS redirect address for firewall authentication.
    auto_asic_offload str
    Enable/disable policy traffic ASIC offloading. Valid values: disable, enable.
    av_profile str
    Name of an existing Antivirus profile.
    best_route str
    Best-Route. Valid values: disable, enable.
    block_notification str
    Enable/disable block notification. Valid values: disable, enable.
    captive_portal_exempt str
    Enable to exempt some users from the captive portal. Valid values: disable, enable.
    capture_packet str
    Enable/disable capture packets. Valid values: disable, enable.
    casb_profile str
    Name of an existing CASB profile.
    cgn_eif str
    Enable/Disable CGN endpoint independent filtering. Valid values: disable, enable.
    cgn_eim str
    Enable/Disable CGN endpoint independent mapping Valid values: disable, enable.
    cgn_log_server_grp str
    NP log server group name
    cgn_resource_quota float
    resource quota
    cgn_session_quota float
    session quota
    cgn_sw_eif_ctrl str
    Enable/disable software endpoint independent filtering control. Valid values: disable, enable.
    cifs_profile str
    Name of an existing CIFS profile.
    comments str
    Comment.
    custom_log_fields Sequence[str]
    Custom fields to append to log messages for this policy.
    decrypted_traffic_mirror str
    Decrypted traffic mirror.
    delay_tcp_npu_session str
    Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: disable, enable.
    devices Sequence[str]
    Names of devices or device groups that can be matched by the policy.
    diameter_filter_profile str
    Name of an existing Diameter filter profile.
    diffserv_copy str
    Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: disable, enable.
    diffserv_forward str
    Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: disable, enable.
    diffserv_reverse str
    Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: disable, enable.
    diffservcode_forward str
    Change packet's DiffServ to this value.
    diffservcode_rev str
    Change packet's reverse (reply) DiffServ to this value.
    disclaimer str
    Enable/disable user authentication disclaimer. Valid values: disable, enable, user, domain, policy.
    dlp_profile str
    Name of an existing DLP profile.
    dlp_sensor str
    Name of an existing DLP sensor.
    dnsfilter_profile str
    Name of an existing DNS filter profile.
    dscp_match str
    Enable DSCP check. Valid values: disable, enable.
    dscp_negate str
    Enable negated DSCP match. Valid values: disable, enable.
    dscp_value str
    DSCP value.
    dsri str
    Enable DSRI to ignore HTTP server responses. Valid values: disable, enable.
    dstaddr6_negate str
    When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddr6s Sequence[str]
    Destination IPv6 address name and address group names.
    dstaddr_negate str
    When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddrs Sequence[str]
    Destination IPv4 address and address group names.
    dstintfs Sequence[str]
    Outgoing (egress) interface.
    dynamic_shaping str
    Enable/disable dynamic RADIUS defined traffic shaping. Valid values: disable, enable.
    eif_check str
    Enable/Disable check endpoint-independent-filtering pinhole. Valid values: disable, enable.
    eif_learn str
    Enable/Disable learning of end-point-independent filtering pinhole. Valid values: disable, enable.
    email_collect str
    Enable/disable email collection. Valid values: disable, enable.
    emailfilter_profile str
    Name of an existing email filter profile.
    fec str
    Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: disable, enable.
    file_filter_profile str
    Name of an existing file-filter profile.
    firewall_session_dirty str
    How to handle sessions if the configuration of this firewall policy changes. Valid values: check-all, check-new.
    fixedport str
    Enable to prevent source NAT from changing a session's source port. Valid values: disable, enable.
    fsso str
    Enable/disable Fortinet Single Sign-On. Valid values: disable, enable.
    fsso_agent_for_ntlm str
    FSSO agent to use for NTLM authentication.
    fsso_groups Sequence[str]
    Names of FSSO groups.
    geoip_anycast str
    Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: disable, enable.
    geoip_match str
    Match geography address based either on its physical location or registered location. Valid values: physical-location, registered-location.
    global_label str
    Label for the policy that appears when the GUI is in Global View mode.
    groups Sequence[str]
    Names of user groups that can authenticate with this policy.
    gtp_profile str
    GTP profile.
    http_policy_redirect str
    Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: disable, enable.
    icap_profile str
    Name of an existing ICAP profile.
    identity_based_route str
    Name of identity-based routing rule.
    inbound str
    Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: disable, enable.
    inspection_mode str
    Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: proxy, flow.
    internet_service str
    Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internet_service6 str
    Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internet_service6_custom_groups Sequence[str]
    Custom Internet Service6 group name.
    internet_service6_customs Sequence[str]
    Custom IPv6 Internet Service name.
    internet_service6_groups Sequence[str]
    Internet Service group name.
    internet_service6_names Sequence[str]
    IPv6 Internet Service name.
    internet_service6_negate str
    When enabled internet-service6 specifies what the service must NOT be. Valid values: disable, enable.
    internet_service6_src str
    Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internet_service6_src_custom_groups Sequence[str]
    Custom Internet Service6 source group name.
    internet_service6_src_customs Sequence[str]
    Custom IPv6 Internet Service source name.
    internet_service6_src_groups Sequence[str]
    Internet Service6 source group name.
    internet_service6_src_names Sequence[str]
    IPv6 Internet Service source name.
    internet_service6_src_negate str
    When enabled internet-service6-src specifies what the service must NOT be. Valid values: disable, enable.
    internet_service_custom_groups Sequence[str]
    Custom Internet Service group name.
    internet_service_customs Sequence[str]
    Custom Internet Service name.
    internet_service_groups Sequence[str]
    Internet Service group name.
    internet_service_ids Sequence[str]
    Internet Service ID.
    internet_service_names Sequence[str]
    Internet Service name.
    internet_service_negate str
    When enabled internet-service specifies what the service must NOT be. Valid values: disable, enable.
    internet_service_src str
    Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internet_service_src_custom_groups Sequence[str]
    Custom Internet Service source group name.
    internet_service_src_customs Sequence[str]
    Custom Internet Service source name.
    internet_service_src_groups Sequence[str]
    Internet Service source group name.
    internet_service_src_ids Sequence[str]
    Internet Service source ID.
    internet_service_src_names Sequence[str]
    Internet Service source name.
    internet_service_src_negate str
    When enabled internet-service-src specifies what the service must NOT be. Valid values: disable, enable.
    ip_version_type str
    IP version of the policy.
    ippool str
    Enable to use IP Pools for source NAT. Valid values: disable, enable.
    ips_sensor str
    Name of an existing IPS sensor.
    ips_voip_filter str
    Name of an existing VoIP (ips) profile.
    label str
    Label for the policy that appears when the GUI is in Section View mode.
    learning_mode str
    Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: disable, enable.
    log_http_transaction str
    Enable/disable HTTP transaction log. Valid values: disable, enable, all, utm.
    logtraffic str
    Enable or disable logging. Log all sessions or security profile sessions. Valid values: disable, enable, all, utm.
    logtraffic_start str
    Record logs when a session starts. Valid values: disable, enable.
    match_vip str
    Enable to match packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    match_vip_only str
    Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    mms_profile str
    Name of an existing MMS profile.
    name str
    Policy name.
    nat str
    Enable/disable source NAT. Valid values: disable, enable.
    nat46 str
    Enable/disable NAT46. Valid values: disable, enable.
    nat64 str
    Enable/disable NAT64. Valid values: disable, enable.
    natinbound str
    Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: disable, enable.
    natips Sequence[str]
    Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
    natoutbound str
    Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: disable, enable.
    network_service_dynamics Sequence[str]
    Dynamic Network Service name.
    network_service_src_dynamics Sequence[str]
    Dynamic Network Service source name.
    np_acceleration str
    Enable/disable UTM Network Processor acceleration. Valid values: disable, enable.
    ntlm str
    Enable/disable NTLM authentication. Valid values: disable, enable.
    ntlm_enabled_browsers Sequence[str]
    HTTP-User-Agent value of supported browsers.
    ntlm_guest str
    Enable/disable NTLM guest user access. Valid values: disable, enable.
    outbound str
    Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: disable, enable.
    packages_pblock_firewall_policy_id str
    an identifier for the resource with format {{policyid}}.
    passive_wan_health_measurement str
    Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: disable, enable.
    pcp_inbound str
    Enable/disable PCP inbound DNAT. Valid values: disable, enable.
    pcp_outbound str
    Enable/disable PCP outbound SNAT. Valid values: disable, enable.
    pcp_poolnames Sequence[str]
    PCP pool names.
    per_ip_shaper str
    Per-IP traffic shaper.
    permit_any_host str
    Accept UDP packets from any host. Valid values: disable, enable.
    permit_stun_host str
    Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: disable, enable.
    pfcp_profile str
    PFCP profile.
    policy_behaviour_type str
    Behaviour of the policy.
    policy_expiry str
    Enable/disable policy expiry. Valid values: disable, enable.
    policy_expiry_date str
    Policy expiry date (YYYY-MM-DD HH:MM:SS).
    policy_expiry_date_utc str
    Policy expiry date and time, in epoch format.
    policy_offload str
    Enable/Disable hardware session setup for CGNAT. Valid values: disable, enable.
    poolname6s Sequence[str]
    IPv6 pool names.
    poolnames Sequence[str]
    IP Pool names.
    port_preserve str
    Enable/disable preservation of the original source port from source NAT if it has not been used. Valid values: disable, enable.
    profile_group str
    Name of profile group.
    profile_protocol_options str
    Name of an existing Protocol options profile.
    profile_type str
    Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: single, group.
    radius_ip_auth_bypass str
    Enable IP authentication bypass. The bypassed IP address must be received from RADIUS server. Valid values: disable, enable.
    radius_mac_auth_bypass str
    Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: disable, enable.
    redirect_url str
    URL users are directed to after seeing and accepting the disclaimer or authenticating.
    replacemsg_override_group str
    Override the default replacement message group for this policy.
    reputation_direction str
    Direction of the initial traffic for reputation to take effect. Valid values: source, destination.
    reputation_direction6 str
    Direction of the initial traffic for IPv6 reputation to take effect. Valid values: source, destination.
    reputation_minimum float
    Minimum Reputation to take action.
    reputation_minimum6 float
    IPv6 Minimum Reputation to take action.
    rsso str
    Enable/disable RADIUS single sign-on (RSSO). Valid values: disable, enable.
    rtp_addrs Sequence[str]
    Address names if this is an RTP NAT policy.
    rtp_nat str
    Enable Real Time Protocol (RTP) NAT. Valid values: disable, enable.
    scan_botnet_connections str
    Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: disable, block, monitor.
    schedule str
    Schedule name.
    schedule_timeout str
    Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: disable, enable.
    scopetype str
    The scope of application of the resource. Valid values: inherit, adom. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    sctp_filter_profile str
    Name of an existing SCTP filter profile.
    send_deny_packet str
    Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: disable, enable.
    service_negate str
    When enabled service specifies what the service must NOT be. Valid values: disable, enable.
    services Sequence[str]
    Service and service group names.
    session_ttl str
    TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
    sgt_check str
    Enable/disable security group tags (SGT) check. Valid values: disable, enable.
    sgts Sequence[float]
    Security group tags.
    spamfilter_profile str
    Name of an existing Spam filter profile.
    src_vendor_macs Sequence[str]
    Vendor MAC source ID.
    srcaddr6_negate str
    When enabled srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddr6s Sequence[str]
    Source IPv6 address name and address group names.
    srcaddr_negate str
    When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddrs Sequence[str]
    Source IPv4 address and address group names.
    srcintfs Sequence[str]
    Incoming (ingress) interface.
    ssh_filter_profile str
    Name of an existing SSH filter profile.
    ssh_policy_redirect str
    Redirect SSH traffic to matching transparent proxy policy. Valid values: disable, enable.
    ssl_mirror str
    Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: disable, enable.
    ssl_mirror_intfs Sequence[str]
    SSL mirror interface name.
    ssl_ssh_profile str
    Name of an existing SSL SSH profile.
    status str
    Enable or disable this policy. Valid values: disable, enable.
    tcp_mss_receiver float
    Receiver TCP maximum segment size (MSS).
    tcp_mss_sender float
    Sender TCP maximum segment size (MSS).
    tcp_session_without_syn str
    Enable/disable creation of TCP session without SYN flag. Valid values: all, data-only, disable.
    tcp_timeout_pid str
    TCP timeout profile ID
    timeout_send_rst str
    Enable/disable sending RST packets when TCP sessions expire. Valid values: disable, enable.
    tos str
    ToS (Type of Service) value used for comparison.
    tos_mask str
    Non-zero bit positions are used for comparison while zero bit positions are ignored.
    tos_negate str
    Enable negated TOS match. Valid values: disable, enable.
    traffic_shaper str
    Traffic shaper.
    traffic_shaper_reverse str
    Reverse traffic shaper.
    udp_timeout_pid str
    UDP timeout profile ID
    url_categories Sequence[str]
    URL category ID list.
    users Sequence[str]
    Names of individual users that can authenticate with this policy.
    utm_status str
    Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: disable, enable.
    uuid str
    Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
    videofilter_profile str
    Name of an existing VideoFilter profile.
    virtual_patch_profile str
    Name of an existing virtual-patch profile.
    vlan_cos_fwd float
    VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlan_cos_rev float
    VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlan_filter str
    Set VLAN filters.
    voip_profile str
    Name of an existing VoIP profile.
    vpntunnel str
    Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
    waf_profile str
    Name of an existing Web application firewall profile.
    wanopt str
    Enable/disable WAN optimization. Valid values: disable, enable.
    wanopt_detection str
    WAN optimization auto-detection mode. Valid values: active, passive, off.
    wanopt_passive_opt str
    WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: default, transparent, non-transparent.
    wanopt_peer str
    WAN optimization peer.
    wanopt_profile str
    WAN optimization profile.
    wccp str
    Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: disable, enable.
    webcache str
    Enable/disable web cache. Valid values: disable, enable.
    webcache_https str
    Enable/disable web cache for HTTPS. Valid values: disable, ssl-server, any, enable.
    webfilter_profile str
    Name of an existing Web filter profile.
    webproxy_forward_server str
    Webproxy forward server name.
    webproxy_profile str
    Webproxy profile name.
    wsso str
    Enable/disable WiFi Single Sign On (WSSO). Valid values: disable, enable.
    ztna_device_ownership str
    Enable/disable zero trust device ownership. Valid values: disable, enable.
    ztna_ems_tag_secondaries Sequence[str]
    Source ztna-ems-tag-secondary names.
    ztna_ems_tags Sequence[str]
    Source ztna-ems-tag names.
    ztna_geo_tags Sequence[str]
    Source ztna-geo-tag names.
    ztna_policy_redirect str
    Redirect ZTNA traffic to matching Access-Proxy proxy-policy. Valid values: disable, enable.
    ztna_status str
    Enable/disable zero trust access. Valid values: disable, enable.
    ztna_tags_match_logic str
    ZTNA tag matching logic. Valid values: or, and.
    pblock String
    Pblock.
    _policyBlock Number
    Assigned policy block. When this attribute is set, the policy represent a policy block, and all other attributes are ignored. This attribute is not available when configuring policy inside a policy block.
    action String
    Policy action (accept/deny/ipsec). Valid values: deny, accept, ipsec, ssl-vpn, redirect, isolate.
    adom String
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    antiReplay String
    Enable/disable anti-replay check. Valid values: disable, enable.
    appCategories List<String>
    Application category ID list.
    appGroups List<String>
    Application group names.
    applicationList String
    Name of an existing Application list.
    applications List<Number>
    Application ID list.
    authCert String
    HTTPS server certificate for policy authentication.
    authPath String
    Enable/disable authentication-based routing. Valid values: disable, enable.
    authRedirectAddr String
    HTTP-to-HTTPS redirect address for firewall authentication.
    autoAsicOffload String
    Enable/disable policy traffic ASIC offloading. Valid values: disable, enable.
    avProfile String
    Name of an existing Antivirus profile.
    bestRoute String
    Best-Route. Valid values: disable, enable.
    blockNotification String
    Enable/disable block notification. Valid values: disable, enable.
    captivePortalExempt String
    Enable to exempt some users from the captive portal. Valid values: disable, enable.
    capturePacket String
    Enable/disable capture packets. Valid values: disable, enable.
    casbProfile String
    Name of an existing CASB profile.
    cgnEif String
    Enable/Disable CGN endpoint independent filtering. Valid values: disable, enable.
    cgnEim String
    Enable/Disable CGN endpoint independent mapping Valid values: disable, enable.
    cgnLogServerGrp String
    NP log server group name
    cgnResourceQuota Number
    resource quota
    cgnSessionQuota Number
    session quota
    cgnSwEifCtrl String
    Enable/disable software endpoint independent filtering control. Valid values: disable, enable.
    cifsProfile String
    Name of an existing CIFS profile.
    comments String
    Comment.
    customLogFields List<String>
    Custom fields to append to log messages for this policy.
    decryptedTrafficMirror String
    Decrypted traffic mirror.
    delayTcpNpuSession String
    Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: disable, enable.
    devices List<String>
    Names of devices or device groups that can be matched by the policy.
    diameterFilterProfile String
    Name of an existing Diameter filter profile.
    diffservCopy String
    Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: disable, enable.
    diffservForward String
    Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: disable, enable.
    diffservReverse String
    Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: disable, enable.
    diffservcodeForward String
    Change packet's DiffServ to this value.
    diffservcodeRev String
    Change packet's reverse (reply) DiffServ to this value.
    disclaimer String
    Enable/disable user authentication disclaimer. Valid values: disable, enable, user, domain, policy.
    dlpProfile String
    Name of an existing DLP profile.
    dlpSensor String
    Name of an existing DLP sensor.
    dnsfilterProfile String
    Name of an existing DNS filter profile.
    dscpMatch String
    Enable DSCP check. Valid values: disable, enable.
    dscpNegate String
    Enable negated DSCP match. Valid values: disable, enable.
    dscpValue String
    DSCP value.
    dsri String
    Enable DSRI to ignore HTTP server responses. Valid values: disable, enable.
    dstaddr6Negate String
    When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddr6s List<String>
    Destination IPv6 address name and address group names.
    dstaddrNegate String
    When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddrs List<String>
    Destination IPv4 address and address group names.
    dstintfs List<String>
    Outgoing (egress) interface.
    dynamicShaping String
    Enable/disable dynamic RADIUS defined traffic shaping. Valid values: disable, enable.
    eifCheck String
    Enable/Disable check endpoint-independent-filtering pinhole. Valid values: disable, enable.
    eifLearn String
    Enable/Disable learning of end-point-independent filtering pinhole. Valid values: disable, enable.
    emailCollect String
    Enable/disable email collection. Valid values: disable, enable.
    emailfilterProfile String
    Name of an existing email filter profile.
    fec String
    Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: disable, enable.
    fileFilterProfile String
    Name of an existing file-filter profile.
    firewallSessionDirty String
    How to handle sessions if the configuration of this firewall policy changes. Valid values: check-all, check-new.
    fixedport String
    Enable to prevent source NAT from changing a session's source port. Valid values: disable, enable.
    fsso String
    Enable/disable Fortinet Single Sign-On. Valid values: disable, enable.
    fssoAgentForNtlm String
    FSSO agent to use for NTLM authentication.
    fssoGroups List<String>
    Names of FSSO groups.
    geoipAnycast String
    Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: disable, enable.
    geoipMatch String
    Match geography address based either on its physical location or registered location. Valid values: physical-location, registered-location.
    globalLabel String
    Label for the policy that appears when the GUI is in Global View mode.
    groups List<String>
    Names of user groups that can authenticate with this policy.
    gtpProfile String
    GTP profile.
    httpPolicyRedirect String
    Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: disable, enable.
    icapProfile String
    Name of an existing ICAP profile.
    identityBasedRoute String
    Name of identity-based routing rule.
    inbound String
    Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: disable, enable.
    inspectionMode String
    Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: proxy, flow.
    internetService String
    Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internetService6 String
    Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internetService6CustomGroups List<String>
    Custom Internet Service6 group name.
    internetService6Customs List<String>
    Custom IPv6 Internet Service name.
    internetService6Groups List<String>
    Internet Service group name.
    internetService6Names List<String>
    IPv6 Internet Service name.
    internetService6Negate String
    When enabled internet-service6 specifies what the service must NOT be. Valid values: disable, enable.
    internetService6Src String
    Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internetService6SrcCustomGroups List<String>
    Custom Internet Service6 source group name.
    internetService6SrcCustoms List<String>
    Custom IPv6 Internet Service source name.
    internetService6SrcGroups List<String>
    Internet Service6 source group name.
    internetService6SrcNames List<String>
    IPv6 Internet Service source name.
    internetService6SrcNegate String
    When enabled internet-service6-src specifies what the service must NOT be. Valid values: disable, enable.
    internetServiceCustomGroups List<String>
    Custom Internet Service group name.
    internetServiceCustoms List<String>
    Custom Internet Service name.
    internetServiceGroups List<String>
    Internet Service group name.
    internetServiceIds List<String>
    Internet Service ID.
    internetServiceNames List<String>
    Internet Service name.
    internetServiceNegate String
    When enabled internet-service specifies what the service must NOT be. Valid values: disable, enable.
    internetServiceSrc String
    Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internetServiceSrcCustomGroups List<String>
    Custom Internet Service source group name.
    internetServiceSrcCustoms List<String>
    Custom Internet Service source name.
    internetServiceSrcGroups List<String>
    Internet Service source group name.
    internetServiceSrcIds List<String>
    Internet Service source ID.
    internetServiceSrcNames List<String>
    Internet Service source name.
    internetServiceSrcNegate String
    When enabled internet-service-src specifies what the service must NOT be. Valid values: disable, enable.
    ipVersionType String
    IP version of the policy.
    ippool String
    Enable to use IP Pools for source NAT. Valid values: disable, enable.
    ipsSensor String
    Name of an existing IPS sensor.
    ipsVoipFilter String
    Name of an existing VoIP (ips) profile.
    label String
    Label for the policy that appears when the GUI is in Section View mode.
    learningMode String
    Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: disable, enable.
    logHttpTransaction String
    Enable/disable HTTP transaction log. Valid values: disable, enable, all, utm.
    logtraffic String
    Enable or disable logging. Log all sessions or security profile sessions. Valid values: disable, enable, all, utm.
    logtrafficStart String
    Record logs when a session starts. Valid values: disable, enable.
    matchVip String
    Enable to match packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    matchVipOnly String
    Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    mmsProfile String
    Name of an existing MMS profile.
    name String
    Policy name.
    nat String
    Enable/disable source NAT. Valid values: disable, enable.
    nat46 String
    Enable/disable NAT46. Valid values: disable, enable.
    nat64 String
    Enable/disable NAT64. Valid values: disable, enable.
    natinbound String
    Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: disable, enable.
    natips List<String>
    Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
    natoutbound String
    Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: disable, enable.
    networkServiceDynamics List<String>
    Dynamic Network Service name.
    networkServiceSrcDynamics List<String>
    Dynamic Network Service source name.
    npAcceleration String
    Enable/disable UTM Network Processor acceleration. Valid values: disable, enable.
    ntlm String
    Enable/disable NTLM authentication. Valid values: disable, enable.
    ntlmEnabledBrowsers List<String>
    HTTP-User-Agent value of supported browsers.
    ntlmGuest String
    Enable/disable NTLM guest user access. Valid values: disable, enable.
    outbound String
    Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: disable, enable.
    packagesPblockFirewallPolicyId String
    an identifier for the resource with format {{policyid}}.
    passiveWanHealthMeasurement String
    Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: disable, enable.
    pcpInbound String
    Enable/disable PCP inbound DNAT. Valid values: disable, enable.
    pcpOutbound String
    Enable/disable PCP outbound SNAT. Valid values: disable, enable.
    pcpPoolnames List<String>
    PCP pool names.
    perIpShaper String
    Per-IP traffic shaper.
    permitAnyHost String
    Accept UDP packets from any host. Valid values: disable, enable.
    permitStunHost String
    Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: disable, enable.
    pfcpProfile String
    PFCP profile.
    policyBehaviourType String
    Behaviour of the policy.
    policyExpiry String
    Enable/disable policy expiry. Valid values: disable, enable.
    policyExpiryDate String
    Policy expiry date (YYYY-MM-DD HH:MM:SS).
    policyExpiryDateUtc String
    Policy expiry date and time, in epoch format.
    policyOffload String
    Enable/Disable hardware session setup for CGNAT. Valid values: disable, enable.
    poolname6s List<String>
    IPv6 pool names.
    poolnames List<String>
    IP Pool names.
    portPreserve String
    Enable/disable preservation of the original source port from source NAT if it has not been used. Valid values: disable, enable.
    profileGroup String
    Name of profile group.
    profileProtocolOptions String
    Name of an existing Protocol options profile.
    profileType String
    Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: single, group.
    radiusIpAuthBypass String
    Enable IP authentication bypass. The bypassed IP address must be received from RADIUS server. Valid values: disable, enable.
    radiusMacAuthBypass String
    Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: disable, enable.
    redirectUrl String
    URL users are directed to after seeing and accepting the disclaimer or authenticating.
    replacemsgOverrideGroup String
    Override the default replacement message group for this policy.
    reputationDirection String
    Direction of the initial traffic for reputation to take effect. Valid values: source, destination.
    reputationDirection6 String
    Direction of the initial traffic for IPv6 reputation to take effect. Valid values: source, destination.
    reputationMinimum Number
    Minimum Reputation to take action.
    reputationMinimum6 Number
    IPv6 Minimum Reputation to take action.
    rsso String
    Enable/disable RADIUS single sign-on (RSSO). Valid values: disable, enable.
    rtpAddrs List<String>
    Address names if this is an RTP NAT policy.
    rtpNat String
    Enable Real Time Protocol (RTP) NAT. Valid values: disable, enable.
    scanBotnetConnections String
    Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: disable, block, monitor.
    schedule String
    Schedule name.
    scheduleTimeout String
    Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: disable, enable.
    scopetype String
    The scope of application of the resource. Valid values: inherit, adom. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    sctpFilterProfile String
    Name of an existing SCTP filter profile.
    sendDenyPacket String
    Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: disable, enable.
    serviceNegate String
    When enabled service specifies what the service must NOT be. Valid values: disable, enable.
    services List<String>
    Service and service group names.
    sessionTtl String
    TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
    sgtCheck String
    Enable/disable security group tags (SGT) check. Valid values: disable, enable.
    sgts List<Number>
    Security group tags.
    spamfilterProfile String
    Name of an existing Spam filter profile.
    srcVendorMacs List<String>
    Vendor MAC source ID.
    srcaddr6Negate String
    When enabled srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddr6s List<String>
    Source IPv6 address name and address group names.
    srcaddrNegate String
    When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddrs List<String>
    Source IPv4 address and address group names.
    srcintfs List<String>
    Incoming (ingress) interface.
    sshFilterProfile String
    Name of an existing SSH filter profile.
    sshPolicyRedirect String
    Redirect SSH traffic to matching transparent proxy policy. Valid values: disable, enable.
    sslMirror String
    Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: disable, enable.
    sslMirrorIntfs List<String>
    SSL mirror interface name.
    sslSshProfile String
    Name of an existing SSL SSH profile.
    status String
    Enable or disable this policy. Valid values: disable, enable.
    tcpMssReceiver Number
    Receiver TCP maximum segment size (MSS).
    tcpMssSender Number
    Sender TCP maximum segment size (MSS).
    tcpSessionWithoutSyn String
    Enable/disable creation of TCP session without SYN flag. Valid values: all, data-only, disable.
    tcpTimeoutPid String
    TCP timeout profile ID
    timeoutSendRst String
    Enable/disable sending RST packets when TCP sessions expire. Valid values: disable, enable.
    tos String
    ToS (Type of Service) value used for comparison.
    tosMask String
    Non-zero bit positions are used for comparison while zero bit positions are ignored.
    tosNegate String
    Enable negated TOS match. Valid values: disable, enable.
    trafficShaper String
    Traffic shaper.
    trafficShaperReverse String
    Reverse traffic shaper.
    udpTimeoutPid String
    UDP timeout profile ID
    urlCategories List<String>
    URL category ID list.
    users List<String>
    Names of individual users that can authenticate with this policy.
    utmStatus String
    Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: disable, enable.
    uuid String
    Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
    videofilterProfile String
    Name of an existing VideoFilter profile.
    virtualPatchProfile String
    Name of an existing virtual-patch profile.
    vlanCosFwd Number
    VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlanCosRev Number
    VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlanFilter String
    Set VLAN filters.
    voipProfile String
    Name of an existing VoIP profile.
    vpntunnel String
    Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
    wafProfile String
    Name of an existing Web application firewall profile.
    wanopt String
    Enable/disable WAN optimization. Valid values: disable, enable.
    wanoptDetection String
    WAN optimization auto-detection mode. Valid values: active, passive, off.
    wanoptPassiveOpt String
    WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: default, transparent, non-transparent.
    wanoptPeer String
    WAN optimization peer.
    wanoptProfile String
    WAN optimization profile.
    wccp String
    Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: disable, enable.
    webcache String
    Enable/disable web cache. Valid values: disable, enable.
    webcacheHttps String
    Enable/disable web cache for HTTPS. Valid values: disable, ssl-server, any, enable.
    webfilterProfile String
    Name of an existing Web filter profile.
    webproxyForwardServer String
    Webproxy forward server name.
    webproxyProfile String
    Webproxy profile name.
    wsso String
    Enable/disable WiFi Single Sign On (WSSO). Valid values: disable, enable.
    ztnaDeviceOwnership String
    Enable/disable zero trust device ownership. Valid values: disable, enable.
    ztnaEmsTagSecondaries List<String>
    Source ztna-ems-tag-secondary names.
    ztnaEmsTags List<String>
    Source ztna-ems-tag names.
    ztnaGeoTags List<String>
    Source ztna-geo-tag names.
    ztnaPolicyRedirect String
    Redirect ZTNA traffic to matching Access-Proxy proxy-policy. Valid values: disable, enable.
    ztnaStatus String
    Enable/disable zero trust access. Valid values: disable, enable.
    ztnaTagsMatchLogic String
    ZTNA tag matching logic. Valid values: or, and.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the PackagesPblockFirewallPolicy resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing PackagesPblockFirewallPolicy Resource

    Get an existing PackagesPblockFirewallPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: PackagesPblockFirewallPolicyState, opts?: CustomResourceOptions): PackagesPblockFirewallPolicy
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        _policy_block: Optional[float] = None,
        action: Optional[str] = None,
        adom: Optional[str] = None,
        anti_replay: Optional[str] = None,
        app_categories: Optional[Sequence[str]] = None,
        app_groups: Optional[Sequence[str]] = None,
        application_list: Optional[str] = None,
        applications: Optional[Sequence[float]] = None,
        auth_cert: Optional[str] = None,
        auth_path: Optional[str] = None,
        auth_redirect_addr: Optional[str] = None,
        auto_asic_offload: Optional[str] = None,
        av_profile: Optional[str] = None,
        best_route: Optional[str] = None,
        block_notification: Optional[str] = None,
        captive_portal_exempt: Optional[str] = None,
        capture_packet: Optional[str] = None,
        casb_profile: Optional[str] = None,
        cgn_eif: Optional[str] = None,
        cgn_eim: Optional[str] = None,
        cgn_log_server_grp: Optional[str] = None,
        cgn_resource_quota: Optional[float] = None,
        cgn_session_quota: Optional[float] = None,
        cgn_sw_eif_ctrl: Optional[str] = None,
        cifs_profile: Optional[str] = None,
        comments: Optional[str] = None,
        custom_log_fields: Optional[Sequence[str]] = None,
        decrypted_traffic_mirror: Optional[str] = None,
        delay_tcp_npu_session: Optional[str] = None,
        devices: Optional[Sequence[str]] = None,
        diameter_filter_profile: Optional[str] = None,
        diffserv_copy: Optional[str] = None,
        diffserv_forward: Optional[str] = None,
        diffserv_reverse: Optional[str] = None,
        diffservcode_forward: Optional[str] = None,
        diffservcode_rev: Optional[str] = None,
        disclaimer: Optional[str] = None,
        dlp_profile: Optional[str] = None,
        dlp_sensor: Optional[str] = None,
        dnsfilter_profile: Optional[str] = None,
        dscp_match: Optional[str] = None,
        dscp_negate: Optional[str] = None,
        dscp_value: Optional[str] = None,
        dsri: Optional[str] = None,
        dstaddr6_negate: Optional[str] = None,
        dstaddr6s: Optional[Sequence[str]] = None,
        dstaddr_negate: Optional[str] = None,
        dstaddrs: Optional[Sequence[str]] = None,
        dstintfs: Optional[Sequence[str]] = None,
        dynamic_shaping: Optional[str] = None,
        eif_check: Optional[str] = None,
        eif_learn: Optional[str] = None,
        email_collect: Optional[str] = None,
        emailfilter_profile: Optional[str] = None,
        fec: Optional[str] = None,
        file_filter_profile: Optional[str] = None,
        firewall_session_dirty: Optional[str] = None,
        fixedport: Optional[str] = None,
        fsso: Optional[str] = None,
        fsso_agent_for_ntlm: Optional[str] = None,
        fsso_groups: Optional[Sequence[str]] = None,
        geoip_anycast: Optional[str] = None,
        geoip_match: Optional[str] = None,
        global_label: Optional[str] = None,
        groups: Optional[Sequence[str]] = None,
        gtp_profile: Optional[str] = None,
        http_policy_redirect: Optional[str] = None,
        icap_profile: Optional[str] = None,
        identity_based_route: Optional[str] = None,
        inbound: Optional[str] = None,
        inspection_mode: Optional[str] = None,
        internet_service: Optional[str] = None,
        internet_service6: Optional[str] = None,
        internet_service6_custom_groups: Optional[Sequence[str]] = None,
        internet_service6_customs: Optional[Sequence[str]] = None,
        internet_service6_groups: Optional[Sequence[str]] = None,
        internet_service6_names: Optional[Sequence[str]] = None,
        internet_service6_negate: Optional[str] = None,
        internet_service6_src: Optional[str] = None,
        internet_service6_src_custom_groups: Optional[Sequence[str]] = None,
        internet_service6_src_customs: Optional[Sequence[str]] = None,
        internet_service6_src_groups: Optional[Sequence[str]] = None,
        internet_service6_src_names: Optional[Sequence[str]] = None,
        internet_service6_src_negate: Optional[str] = None,
        internet_service_custom_groups: Optional[Sequence[str]] = None,
        internet_service_customs: Optional[Sequence[str]] = None,
        internet_service_groups: Optional[Sequence[str]] = None,
        internet_service_ids: Optional[Sequence[str]] = None,
        internet_service_names: Optional[Sequence[str]] = None,
        internet_service_negate: Optional[str] = None,
        internet_service_src: Optional[str] = None,
        internet_service_src_custom_groups: Optional[Sequence[str]] = None,
        internet_service_src_customs: Optional[Sequence[str]] = None,
        internet_service_src_groups: Optional[Sequence[str]] = None,
        internet_service_src_ids: Optional[Sequence[str]] = None,
        internet_service_src_names: Optional[Sequence[str]] = None,
        internet_service_src_negate: Optional[str] = None,
        ip_version_type: Optional[str] = None,
        ippool: Optional[str] = None,
        ips_sensor: Optional[str] = None,
        ips_voip_filter: Optional[str] = None,
        label: Optional[str] = None,
        learning_mode: Optional[str] = None,
        log_http_transaction: Optional[str] = None,
        logtraffic: Optional[str] = None,
        logtraffic_start: Optional[str] = None,
        match_vip: Optional[str] = None,
        match_vip_only: Optional[str] = None,
        mms_profile: Optional[str] = None,
        name: Optional[str] = None,
        nat: Optional[str] = None,
        nat46: Optional[str] = None,
        nat64: Optional[str] = None,
        natinbound: Optional[str] = None,
        natips: Optional[Sequence[str]] = None,
        natoutbound: Optional[str] = None,
        network_service_dynamics: Optional[Sequence[str]] = None,
        network_service_src_dynamics: Optional[Sequence[str]] = None,
        np_acceleration: Optional[str] = None,
        ntlm: Optional[str] = None,
        ntlm_enabled_browsers: Optional[Sequence[str]] = None,
        ntlm_guest: Optional[str] = None,
        outbound: Optional[str] = None,
        packages_pblock_firewall_policy_id: Optional[str] = None,
        passive_wan_health_measurement: Optional[str] = None,
        pblock: Optional[str] = None,
        pcp_inbound: Optional[str] = None,
        pcp_outbound: Optional[str] = None,
        pcp_poolnames: Optional[Sequence[str]] = None,
        per_ip_shaper: Optional[str] = None,
        permit_any_host: Optional[str] = None,
        permit_stun_host: Optional[str] = None,
        pfcp_profile: Optional[str] = None,
        policy_behaviour_type: Optional[str] = None,
        policy_expiry: Optional[str] = None,
        policy_expiry_date: Optional[str] = None,
        policy_expiry_date_utc: Optional[str] = None,
        policy_offload: Optional[str] = None,
        poolname6s: Optional[Sequence[str]] = None,
        poolnames: Optional[Sequence[str]] = None,
        port_preserve: Optional[str] = None,
        profile_group: Optional[str] = None,
        profile_protocol_options: Optional[str] = None,
        profile_type: Optional[str] = None,
        radius_ip_auth_bypass: Optional[str] = None,
        radius_mac_auth_bypass: Optional[str] = None,
        redirect_url: Optional[str] = None,
        replacemsg_override_group: Optional[str] = None,
        reputation_direction: Optional[str] = None,
        reputation_direction6: Optional[str] = None,
        reputation_minimum: Optional[float] = None,
        reputation_minimum6: Optional[float] = None,
        rsso: Optional[str] = None,
        rtp_addrs: Optional[Sequence[str]] = None,
        rtp_nat: Optional[str] = None,
        scan_botnet_connections: Optional[str] = None,
        schedule: Optional[str] = None,
        schedule_timeout: Optional[str] = None,
        scopetype: Optional[str] = None,
        sctp_filter_profile: Optional[str] = None,
        send_deny_packet: Optional[str] = None,
        service_negate: Optional[str] = None,
        services: Optional[Sequence[str]] = None,
        session_ttl: Optional[str] = None,
        sgt_check: Optional[str] = None,
        sgts: Optional[Sequence[float]] = None,
        spamfilter_profile: Optional[str] = None,
        src_vendor_macs: Optional[Sequence[str]] = None,
        srcaddr6_negate: Optional[str] = None,
        srcaddr6s: Optional[Sequence[str]] = None,
        srcaddr_negate: Optional[str] = None,
        srcaddrs: Optional[Sequence[str]] = None,
        srcintfs: Optional[Sequence[str]] = None,
        ssh_filter_profile: Optional[str] = None,
        ssh_policy_redirect: Optional[str] = None,
        ssl_mirror: Optional[str] = None,
        ssl_mirror_intfs: Optional[Sequence[str]] = None,
        ssl_ssh_profile: Optional[str] = None,
        status: Optional[str] = None,
        tcp_mss_receiver: Optional[float] = None,
        tcp_mss_sender: Optional[float] = None,
        tcp_session_without_syn: Optional[str] = None,
        tcp_timeout_pid: Optional[str] = None,
        timeout_send_rst: Optional[str] = None,
        tos: Optional[str] = None,
        tos_mask: Optional[str] = None,
        tos_negate: Optional[str] = None,
        traffic_shaper: Optional[str] = None,
        traffic_shaper_reverse: Optional[str] = None,
        udp_timeout_pid: Optional[str] = None,
        url_categories: Optional[Sequence[str]] = None,
        users: Optional[Sequence[str]] = None,
        utm_status: Optional[str] = None,
        uuid: Optional[str] = None,
        videofilter_profile: Optional[str] = None,
        virtual_patch_profile: Optional[str] = None,
        vlan_cos_fwd: Optional[float] = None,
        vlan_cos_rev: Optional[float] = None,
        vlan_filter: Optional[str] = None,
        voip_profile: Optional[str] = None,
        vpntunnel: Optional[str] = None,
        waf_profile: Optional[str] = None,
        wanopt: Optional[str] = None,
        wanopt_detection: Optional[str] = None,
        wanopt_passive_opt: Optional[str] = None,
        wanopt_peer: Optional[str] = None,
        wanopt_profile: Optional[str] = None,
        wccp: Optional[str] = None,
        webcache: Optional[str] = None,
        webcache_https: Optional[str] = None,
        webfilter_profile: Optional[str] = None,
        webproxy_forward_server: Optional[str] = None,
        webproxy_profile: Optional[str] = None,
        wsso: Optional[str] = None,
        ztna_device_ownership: Optional[str] = None,
        ztna_ems_tag_secondaries: Optional[Sequence[str]] = None,
        ztna_ems_tags: Optional[Sequence[str]] = None,
        ztna_geo_tags: Optional[Sequence[str]] = None,
        ztna_policy_redirect: Optional[str] = None,
        ztna_status: Optional[str] = None,
        ztna_tags_match_logic: Optional[str] = None) -> PackagesPblockFirewallPolicy
    func GetPackagesPblockFirewallPolicy(ctx *Context, name string, id IDInput, state *PackagesPblockFirewallPolicyState, opts ...ResourceOption) (*PackagesPblockFirewallPolicy, error)
    public static PackagesPblockFirewallPolicy Get(string name, Input<string> id, PackagesPblockFirewallPolicyState? state, CustomResourceOptions? opts = null)
    public static PackagesPblockFirewallPolicy get(String name, Output<String> id, PackagesPblockFirewallPolicyState state, CustomResourceOptions options)
    resources:  _:    type: fortimanager:PackagesPblockFirewallPolicy    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Action string
    Policy action (accept/deny/ipsec). Valid values: deny, accept, ipsec, ssl-vpn, redirect, isolate.
    Adom string
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    AntiReplay string
    Enable/disable anti-replay check. Valid values: disable, enable.
    AppCategories List<string>
    Application category ID list.
    AppGroups List<string>
    Application group names.
    ApplicationList string
    Name of an existing Application list.
    Applications List<double>
    Application ID list.
    AuthCert string
    HTTPS server certificate for policy authentication.
    AuthPath string
    Enable/disable authentication-based routing. Valid values: disable, enable.
    AuthRedirectAddr string
    HTTP-to-HTTPS redirect address for firewall authentication.
    AutoAsicOffload string
    Enable/disable policy traffic ASIC offloading. Valid values: disable, enable.
    AvProfile string
    Name of an existing Antivirus profile.
    BestRoute string
    Best-Route. Valid values: disable, enable.
    BlockNotification string
    Enable/disable block notification. Valid values: disable, enable.
    CaptivePortalExempt string
    Enable to exempt some users from the captive portal. Valid values: disable, enable.
    CapturePacket string
    Enable/disable capture packets. Valid values: disable, enable.
    CasbProfile string
    Name of an existing CASB profile.
    CgnEif string
    Enable/Disable CGN endpoint independent filtering. Valid values: disable, enable.
    CgnEim string
    Enable/Disable CGN endpoint independent mapping Valid values: disable, enable.
    CgnLogServerGrp string
    NP log server group name
    CgnResourceQuota double
    resource quota
    CgnSessionQuota double
    session quota
    CgnSwEifCtrl string
    Enable/disable software endpoint independent filtering control. Valid values: disable, enable.
    CifsProfile string
    Name of an existing CIFS profile.
    Comments string
    Comment.
    CustomLogFields List<string>
    Custom fields to append to log messages for this policy.
    DecryptedTrafficMirror string
    Decrypted traffic mirror.
    DelayTcpNpuSession string
    Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: disable, enable.
    Devices List<string>
    Names of devices or device groups that can be matched by the policy.
    DiameterFilterProfile string
    Name of an existing Diameter filter profile.
    DiffservCopy string
    Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: disable, enable.
    DiffservForward string
    Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: disable, enable.
    DiffservReverse string
    Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: disable, enable.
    DiffservcodeForward string
    Change packet's DiffServ to this value.
    DiffservcodeRev string
    Change packet's reverse (reply) DiffServ to this value.
    Disclaimer string
    Enable/disable user authentication disclaimer. Valid values: disable, enable, user, domain, policy.
    DlpProfile string
    Name of an existing DLP profile.
    DlpSensor string
    Name of an existing DLP sensor.
    DnsfilterProfile string
    Name of an existing DNS filter profile.
    DscpMatch string
    Enable DSCP check. Valid values: disable, enable.
    DscpNegate string
    Enable negated DSCP match. Valid values: disable, enable.
    DscpValue string
    DSCP value.
    Dsri string
    Enable DSRI to ignore HTTP server responses. Valid values: disable, enable.
    Dstaddr6Negate string
    When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    Dstaddr6s List<string>
    Destination IPv6 address name and address group names.
    DstaddrNegate string
    When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    Dstaddrs List<string>
    Destination IPv4 address and address group names.
    Dstintfs List<string>
    Outgoing (egress) interface.
    DynamicShaping string
    Enable/disable dynamic RADIUS defined traffic shaping. Valid values: disable, enable.
    EifCheck string
    Enable/Disable check endpoint-independent-filtering pinhole. Valid values: disable, enable.
    EifLearn string
    Enable/Disable learning of end-point-independent filtering pinhole. Valid values: disable, enable.
    EmailCollect string
    Enable/disable email collection. Valid values: disable, enable.
    EmailfilterProfile string
    Name of an existing email filter profile.
    Fec string
    Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: disable, enable.
    FileFilterProfile string
    Name of an existing file-filter profile.
    FirewallSessionDirty string
    How to handle sessions if the configuration of this firewall policy changes. Valid values: check-all, check-new.
    Fixedport string
    Enable to prevent source NAT from changing a session's source port. Valid values: disable, enable.
    Fsso string
    Enable/disable Fortinet Single Sign-On. Valid values: disable, enable.
    FssoAgentForNtlm string
    FSSO agent to use for NTLM authentication.
    FssoGroups List<string>
    Names of FSSO groups.
    GeoipAnycast string
    Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: disable, enable.
    GeoipMatch string
    Match geography address based either on its physical location or registered location. Valid values: physical-location, registered-location.
    GlobalLabel string
    Label for the policy that appears when the GUI is in Global View mode.
    Groups List<string>
    Names of user groups that can authenticate with this policy.
    GtpProfile string
    GTP profile.
    HttpPolicyRedirect string
    Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: disable, enable.
    IcapProfile string
    Name of an existing ICAP profile.
    IdentityBasedRoute string
    Name of identity-based routing rule.
    Inbound string
    Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: disable, enable.
    InspectionMode string
    Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: proxy, flow.
    InternetService string
    Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    InternetService6 string
    Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    InternetService6CustomGroups List<string>
    Custom Internet Service6 group name.
    InternetService6Customs List<string>
    Custom IPv6 Internet Service name.
    InternetService6Groups List<string>
    Internet Service group name.
    InternetService6Names List<string>
    IPv6 Internet Service name.
    InternetService6Negate string
    When enabled internet-service6 specifies what the service must NOT be. Valid values: disable, enable.
    InternetService6Src string
    Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    InternetService6SrcCustomGroups List<string>
    Custom Internet Service6 source group name.
    InternetService6SrcCustoms List<string>
    Custom IPv6 Internet Service source name.
    InternetService6SrcGroups List<string>
    Internet Service6 source group name.
    InternetService6SrcNames List<string>
    IPv6 Internet Service source name.
    InternetService6SrcNegate string
    When enabled internet-service6-src specifies what the service must NOT be. Valid values: disable, enable.
    InternetServiceCustomGroups List<string>
    Custom Internet Service group name.
    InternetServiceCustoms List<string>
    Custom Internet Service name.
    InternetServiceGroups List<string>
    Internet Service group name.
    InternetServiceIds List<string>
    Internet Service ID.
    InternetServiceNames List<string>
    Internet Service name.
    InternetServiceNegate string
    When enabled internet-service specifies what the service must NOT be. Valid values: disable, enable.
    InternetServiceSrc string
    Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    InternetServiceSrcCustomGroups List<string>
    Custom Internet Service source group name.
    InternetServiceSrcCustoms List<string>
    Custom Internet Service source name.
    InternetServiceSrcGroups List<string>
    Internet Service source group name.
    InternetServiceSrcIds List<string>
    Internet Service source ID.
    InternetServiceSrcNames List<string>
    Internet Service source name.
    InternetServiceSrcNegate string
    When enabled internet-service-src specifies what the service must NOT be. Valid values: disable, enable.
    IpVersionType string
    IP version of the policy.
    Ippool string
    Enable to use IP Pools for source NAT. Valid values: disable, enable.
    IpsSensor string
    Name of an existing IPS sensor.
    IpsVoipFilter string
    Name of an existing VoIP (ips) profile.
    Label string
    Label for the policy that appears when the GUI is in Section View mode.
    LearningMode string
    Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: disable, enable.
    LogHttpTransaction string
    Enable/disable HTTP transaction log. Valid values: disable, enable, all, utm.
    Logtraffic string
    Enable or disable logging. Log all sessions or security profile sessions. Valid values: disable, enable, all, utm.
    LogtrafficStart string
    Record logs when a session starts. Valid values: disable, enable.
    MatchVip string
    Enable to match packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    MatchVipOnly string
    Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    MmsProfile string
    Name of an existing MMS profile.
    Name string
    Policy name.
    Nat string
    Enable/disable source NAT. Valid values: disable, enable.
    Nat46 string
    Enable/disable NAT46. Valid values: disable, enable.
    Nat64 string
    Enable/disable NAT64. Valid values: disable, enable.
    Natinbound string
    Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: disable, enable.
    Natips List<string>
    Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
    Natoutbound string
    Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: disable, enable.
    NetworkServiceDynamics List<string>
    Dynamic Network Service name.
    NetworkServiceSrcDynamics List<string>
    Dynamic Network Service source name.
    NpAcceleration string
    Enable/disable UTM Network Processor acceleration. Valid values: disable, enable.
    Ntlm string
    Enable/disable NTLM authentication. Valid values: disable, enable.
    NtlmEnabledBrowsers List<string>
    HTTP-User-Agent value of supported browsers.
    NtlmGuest string
    Enable/disable NTLM guest user access. Valid values: disable, enable.
    Outbound string
    Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: disable, enable.
    PackagesPblockFirewallPolicyId string
    an identifier for the resource with format {{policyid}}.
    PassiveWanHealthMeasurement string
    Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: disable, enable.
    Pblock string
    Pblock.
    PcpInbound string
    Enable/disable PCP inbound DNAT. Valid values: disable, enable.
    PcpOutbound string
    Enable/disable PCP outbound SNAT. Valid values: disable, enable.
    PcpPoolnames List<string>
    PCP pool names.
    PerIpShaper string
    Per-IP traffic shaper.
    PermitAnyHost string
    Accept UDP packets from any host. Valid values: disable, enable.
    PermitStunHost string
    Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: disable, enable.
    PfcpProfile string
    PFCP profile.
    PolicyBehaviourType string
    Behaviour of the policy.
    PolicyExpiry string
    Enable/disable policy expiry. Valid values: disable, enable.
    PolicyExpiryDate string
    Policy expiry date (YYYY-MM-DD HH:MM:SS).
    PolicyExpiryDateUtc string
    Policy expiry date and time, in epoch format.
    PolicyOffload string
    Enable/Disable hardware session setup for CGNAT. Valid values: disable, enable.
    Poolname6s List<string>
    IPv6 pool names.
    Poolnames List<string>
    IP Pool names.
    PortPreserve string
    Enable/disable preservation of the original source port from source NAT if it has not been used. Valid values: disable, enable.
    ProfileGroup string
    Name of profile group.
    ProfileProtocolOptions string
    Name of an existing Protocol options profile.
    ProfileType string
    Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: single, group.
    RadiusIpAuthBypass string
    Enable IP authentication bypass. The bypassed IP address must be received from RADIUS server. Valid values: disable, enable.
    RadiusMacAuthBypass string
    Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: disable, enable.
    RedirectUrl string
    URL users are directed to after seeing and accepting the disclaimer or authenticating.
    ReplacemsgOverrideGroup string
    Override the default replacement message group for this policy.
    ReputationDirection string
    Direction of the initial traffic for reputation to take effect. Valid values: source, destination.
    ReputationDirection6 string
    Direction of the initial traffic for IPv6 reputation to take effect. Valid values: source, destination.
    ReputationMinimum double
    Minimum Reputation to take action.
    ReputationMinimum6 double
    IPv6 Minimum Reputation to take action.
    Rsso string
    Enable/disable RADIUS single sign-on (RSSO). Valid values: disable, enable.
    RtpAddrs List<string>
    Address names if this is an RTP NAT policy.
    RtpNat string
    Enable Real Time Protocol (RTP) NAT. Valid values: disable, enable.
    ScanBotnetConnections string
    Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: disable, block, monitor.
    Schedule string
    Schedule name.
    ScheduleTimeout string
    Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: disable, enable.
    Scopetype string
    The scope of application of the resource. Valid values: inherit, adom. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    SctpFilterProfile string
    Name of an existing SCTP filter profile.
    SendDenyPacket string
    Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: disable, enable.
    ServiceNegate string
    When enabled service specifies what the service must NOT be. Valid values: disable, enable.
    Services List<string>
    Service and service group names.
    SessionTtl string
    TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
    SgtCheck string
    Enable/disable security group tags (SGT) check. Valid values: disable, enable.
    Sgts List<double>
    Security group tags.
    SpamfilterProfile string
    Name of an existing Spam filter profile.
    SrcVendorMacs List<string>
    Vendor MAC source ID.
    Srcaddr6Negate string
    When enabled srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    Srcaddr6s List<string>
    Source IPv6 address name and address group names.
    SrcaddrNegate string
    When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    Srcaddrs List<string>
    Source IPv4 address and address group names.
    Srcintfs List<string>
    Incoming (ingress) interface.
    SshFilterProfile string
    Name of an existing SSH filter profile.
    SshPolicyRedirect string
    Redirect SSH traffic to matching transparent proxy policy. Valid values: disable, enable.
    SslMirror string
    Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: disable, enable.
    SslMirrorIntfs List<string>
    SSL mirror interface name.
    SslSshProfile string
    Name of an existing SSL SSH profile.
    Status string
    Enable or disable this policy. Valid values: disable, enable.
    TcpMssReceiver double
    Receiver TCP maximum segment size (MSS).
    TcpMssSender double
    Sender TCP maximum segment size (MSS).
    TcpSessionWithoutSyn string
    Enable/disable creation of TCP session without SYN flag. Valid values: all, data-only, disable.
    TcpTimeoutPid string
    TCP timeout profile ID
    TimeoutSendRst string
    Enable/disable sending RST packets when TCP sessions expire. Valid values: disable, enable.
    Tos string
    ToS (Type of Service) value used for comparison.
    TosMask string
    Non-zero bit positions are used for comparison while zero bit positions are ignored.
    TosNegate string
    Enable negated TOS match. Valid values: disable, enable.
    TrafficShaper string
    Traffic shaper.
    TrafficShaperReverse string
    Reverse traffic shaper.
    UdpTimeoutPid string
    UDP timeout profile ID
    UrlCategories List<string>
    URL category ID list.
    Users List<string>
    Names of individual users that can authenticate with this policy.
    UtmStatus string
    Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: disable, enable.
    Uuid string
    Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
    VideofilterProfile string
    Name of an existing VideoFilter profile.
    VirtualPatchProfile string
    Name of an existing virtual-patch profile.
    VlanCosFwd double
    VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
    VlanCosRev double
    VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
    VlanFilter string
    Set VLAN filters.
    VoipProfile string
    Name of an existing VoIP profile.
    Vpntunnel string
    Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
    WafProfile string
    Name of an existing Web application firewall profile.
    Wanopt string
    Enable/disable WAN optimization. Valid values: disable, enable.
    WanoptDetection string
    WAN optimization auto-detection mode. Valid values: active, passive, off.
    WanoptPassiveOpt string
    WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: default, transparent, non-transparent.
    WanoptPeer string
    WAN optimization peer.
    WanoptProfile string
    WAN optimization profile.
    Wccp string
    Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: disable, enable.
    Webcache string
    Enable/disable web cache. Valid values: disable, enable.
    WebcacheHttps string
    Enable/disable web cache for HTTPS. Valid values: disable, ssl-server, any, enable.
    WebfilterProfile string
    Name of an existing Web filter profile.
    WebproxyForwardServer string
    Webproxy forward server name.
    WebproxyProfile string
    Webproxy profile name.
    Wsso string
    Enable/disable WiFi Single Sign On (WSSO). Valid values: disable, enable.
    ZtnaDeviceOwnership string
    Enable/disable zero trust device ownership. Valid values: disable, enable.
    ZtnaEmsTagSecondaries List<string>
    Source ztna-ems-tag-secondary names.
    ZtnaEmsTags List<string>
    Source ztna-ems-tag names.
    ZtnaGeoTags List<string>
    Source ztna-geo-tag names.
    ZtnaPolicyRedirect string
    Redirect ZTNA traffic to matching Access-Proxy proxy-policy. Valid values: disable, enable.
    ZtnaStatus string
    Enable/disable zero trust access. Valid values: disable, enable.
    ZtnaTagsMatchLogic string
    ZTNA tag matching logic. Valid values: or, and.
    _policyBlock double
    Assigned policy block. When this attribute is set, the policy represent a policy block, and all other attributes are ignored. This attribute is not available when configuring policy inside a policy block.
    Action string
    Policy action (accept/deny/ipsec). Valid values: deny, accept, ipsec, ssl-vpn, redirect, isolate.
    Adom string
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    AntiReplay string
    Enable/disable anti-replay check. Valid values: disable, enable.
    AppCategories []string
    Application category ID list.
    AppGroups []string
    Application group names.
    ApplicationList string
    Name of an existing Application list.
    Applications []float64
    Application ID list.
    AuthCert string
    HTTPS server certificate for policy authentication.
    AuthPath string
    Enable/disable authentication-based routing. Valid values: disable, enable.
    AuthRedirectAddr string
    HTTP-to-HTTPS redirect address for firewall authentication.
    AutoAsicOffload string
    Enable/disable policy traffic ASIC offloading. Valid values: disable, enable.
    AvProfile string
    Name of an existing Antivirus profile.
    BestRoute string
    Best-Route. Valid values: disable, enable.
    BlockNotification string
    Enable/disable block notification. Valid values: disable, enable.
    CaptivePortalExempt string
    Enable to exempt some users from the captive portal. Valid values: disable, enable.
    CapturePacket string
    Enable/disable capture packets. Valid values: disable, enable.
    CasbProfile string
    Name of an existing CASB profile.
    CgnEif string
    Enable/Disable CGN endpoint independent filtering. Valid values: disable, enable.
    CgnEim string
    Enable/Disable CGN endpoint independent mapping Valid values: disable, enable.
    CgnLogServerGrp string
    NP log server group name
    CgnResourceQuota float64
    resource quota
    CgnSessionQuota float64
    session quota
    CgnSwEifCtrl string
    Enable/disable software endpoint independent filtering control. Valid values: disable, enable.
    CifsProfile string
    Name of an existing CIFS profile.
    Comments string
    Comment.
    CustomLogFields []string
    Custom fields to append to log messages for this policy.
    DecryptedTrafficMirror string
    Decrypted traffic mirror.
    DelayTcpNpuSession string
    Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: disable, enable.
    Devices []string
    Names of devices or device groups that can be matched by the policy.
    DiameterFilterProfile string
    Name of an existing Diameter filter profile.
    DiffservCopy string
    Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: disable, enable.
    DiffservForward string
    Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: disable, enable.
    DiffservReverse string
    Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: disable, enable.
    DiffservcodeForward string
    Change packet's DiffServ to this value.
    DiffservcodeRev string
    Change packet's reverse (reply) DiffServ to this value.
    Disclaimer string
    Enable/disable user authentication disclaimer. Valid values: disable, enable, user, domain, policy.
    DlpProfile string
    Name of an existing DLP profile.
    DlpSensor string
    Name of an existing DLP sensor.
    DnsfilterProfile string
    Name of an existing DNS filter profile.
    DscpMatch string
    Enable DSCP check. Valid values: disable, enable.
    DscpNegate string
    Enable negated DSCP match. Valid values: disable, enable.
    DscpValue string
    DSCP value.
    Dsri string
    Enable DSRI to ignore HTTP server responses. Valid values: disable, enable.
    Dstaddr6Negate string
    When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    Dstaddr6s []string
    Destination IPv6 address name and address group names.
    DstaddrNegate string
    When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    Dstaddrs []string
    Destination IPv4 address and address group names.
    Dstintfs []string
    Outgoing (egress) interface.
    DynamicShaping string
    Enable/disable dynamic RADIUS defined traffic shaping. Valid values: disable, enable.
    EifCheck string
    Enable/Disable check endpoint-independent-filtering pinhole. Valid values: disable, enable.
    EifLearn string
    Enable/Disable learning of end-point-independent filtering pinhole. Valid values: disable, enable.
    EmailCollect string
    Enable/disable email collection. Valid values: disable, enable.
    EmailfilterProfile string
    Name of an existing email filter profile.
    Fec string
    Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: disable, enable.
    FileFilterProfile string
    Name of an existing file-filter profile.
    FirewallSessionDirty string
    How to handle sessions if the configuration of this firewall policy changes. Valid values: check-all, check-new.
    Fixedport string
    Enable to prevent source NAT from changing a session's source port. Valid values: disable, enable.
    Fsso string
    Enable/disable Fortinet Single Sign-On. Valid values: disable, enable.
    FssoAgentForNtlm string
    FSSO agent to use for NTLM authentication.
    FssoGroups []string
    Names of FSSO groups.
    GeoipAnycast string
    Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: disable, enable.
    GeoipMatch string
    Match geography address based either on its physical location or registered location. Valid values: physical-location, registered-location.
    GlobalLabel string
    Label for the policy that appears when the GUI is in Global View mode.
    Groups []string
    Names of user groups that can authenticate with this policy.
    GtpProfile string
    GTP profile.
    HttpPolicyRedirect string
    Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: disable, enable.
    IcapProfile string
    Name of an existing ICAP profile.
    IdentityBasedRoute string
    Name of identity-based routing rule.
    Inbound string
    Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: disable, enable.
    InspectionMode string
    Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: proxy, flow.
    InternetService string
    Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    InternetService6 string
    Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    InternetService6CustomGroups []string
    Custom Internet Service6 group name.
    InternetService6Customs []string
    Custom IPv6 Internet Service name.
    InternetService6Groups []string
    Internet Service group name.
    InternetService6Names []string
    IPv6 Internet Service name.
    InternetService6Negate string
    When enabled internet-service6 specifies what the service must NOT be. Valid values: disable, enable.
    InternetService6Src string
    Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    InternetService6SrcCustomGroups []string
    Custom Internet Service6 source group name.
    InternetService6SrcCustoms []string
    Custom IPv6 Internet Service source name.
    InternetService6SrcGroups []string
    Internet Service6 source group name.
    InternetService6SrcNames []string
    IPv6 Internet Service source name.
    InternetService6SrcNegate string
    When enabled internet-service6-src specifies what the service must NOT be. Valid values: disable, enable.
    InternetServiceCustomGroups []string
    Custom Internet Service group name.
    InternetServiceCustoms []string
    Custom Internet Service name.
    InternetServiceGroups []string
    Internet Service group name.
    InternetServiceIds []string
    Internet Service ID.
    InternetServiceNames []string
    Internet Service name.
    InternetServiceNegate string
    When enabled internet-service specifies what the service must NOT be. Valid values: disable, enable.
    InternetServiceSrc string
    Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    InternetServiceSrcCustomGroups []string
    Custom Internet Service source group name.
    InternetServiceSrcCustoms []string
    Custom Internet Service source name.
    InternetServiceSrcGroups []string
    Internet Service source group name.
    InternetServiceSrcIds []string
    Internet Service source ID.
    InternetServiceSrcNames []string
    Internet Service source name.
    InternetServiceSrcNegate string
    When enabled internet-service-src specifies what the service must NOT be. Valid values: disable, enable.
    IpVersionType string
    IP version of the policy.
    Ippool string
    Enable to use IP Pools for source NAT. Valid values: disable, enable.
    IpsSensor string
    Name of an existing IPS sensor.
    IpsVoipFilter string
    Name of an existing VoIP (ips) profile.
    Label string
    Label for the policy that appears when the GUI is in Section View mode.
    LearningMode string
    Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: disable, enable.
    LogHttpTransaction string
    Enable/disable HTTP transaction log. Valid values: disable, enable, all, utm.
    Logtraffic string
    Enable or disable logging. Log all sessions or security profile sessions. Valid values: disable, enable, all, utm.
    LogtrafficStart string
    Record logs when a session starts. Valid values: disable, enable.
    MatchVip string
    Enable to match packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    MatchVipOnly string
    Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    MmsProfile string
    Name of an existing MMS profile.
    Name string
    Policy name.
    Nat string
    Enable/disable source NAT. Valid values: disable, enable.
    Nat46 string
    Enable/disable NAT46. Valid values: disable, enable.
    Nat64 string
    Enable/disable NAT64. Valid values: disable, enable.
    Natinbound string
    Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: disable, enable.
    Natips []string
    Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
    Natoutbound string
    Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: disable, enable.
    NetworkServiceDynamics []string
    Dynamic Network Service name.
    NetworkServiceSrcDynamics []string
    Dynamic Network Service source name.
    NpAcceleration string
    Enable/disable UTM Network Processor acceleration. Valid values: disable, enable.
    Ntlm string
    Enable/disable NTLM authentication. Valid values: disable, enable.
    NtlmEnabledBrowsers []string
    HTTP-User-Agent value of supported browsers.
    NtlmGuest string
    Enable/disable NTLM guest user access. Valid values: disable, enable.
    Outbound string
    Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: disable, enable.
    PackagesPblockFirewallPolicyId string
    an identifier for the resource with format {{policyid}}.
    PassiveWanHealthMeasurement string
    Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: disable, enable.
    Pblock string
    Pblock.
    PcpInbound string
    Enable/disable PCP inbound DNAT. Valid values: disable, enable.
    PcpOutbound string
    Enable/disable PCP outbound SNAT. Valid values: disable, enable.
    PcpPoolnames []string
    PCP pool names.
    PerIpShaper string
    Per-IP traffic shaper.
    PermitAnyHost string
    Accept UDP packets from any host. Valid values: disable, enable.
    PermitStunHost string
    Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: disable, enable.
    PfcpProfile string
    PFCP profile.
    PolicyBehaviourType string
    Behaviour of the policy.
    PolicyExpiry string
    Enable/disable policy expiry. Valid values: disable, enable.
    PolicyExpiryDate string
    Policy expiry date (YYYY-MM-DD HH:MM:SS).
    PolicyExpiryDateUtc string
    Policy expiry date and time, in epoch format.
    PolicyOffload string
    Enable/Disable hardware session setup for CGNAT. Valid values: disable, enable.
    Poolname6s []string
    IPv6 pool names.
    Poolnames []string
    IP Pool names.
    PortPreserve string
    Enable/disable preservation of the original source port from source NAT if it has not been used. Valid values: disable, enable.
    ProfileGroup string
    Name of profile group.
    ProfileProtocolOptions string
    Name of an existing Protocol options profile.
    ProfileType string
    Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: single, group.
    RadiusIpAuthBypass string
    Enable IP authentication bypass. The bypassed IP address must be received from RADIUS server. Valid values: disable, enable.
    RadiusMacAuthBypass string
    Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: disable, enable.
    RedirectUrl string
    URL users are directed to after seeing and accepting the disclaimer or authenticating.
    ReplacemsgOverrideGroup string
    Override the default replacement message group for this policy.
    ReputationDirection string
    Direction of the initial traffic for reputation to take effect. Valid values: source, destination.
    ReputationDirection6 string
    Direction of the initial traffic for IPv6 reputation to take effect. Valid values: source, destination.
    ReputationMinimum float64
    Minimum Reputation to take action.
    ReputationMinimum6 float64
    IPv6 Minimum Reputation to take action.
    Rsso string
    Enable/disable RADIUS single sign-on (RSSO). Valid values: disable, enable.
    RtpAddrs []string
    Address names if this is an RTP NAT policy.
    RtpNat string
    Enable Real Time Protocol (RTP) NAT. Valid values: disable, enable.
    ScanBotnetConnections string
    Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: disable, block, monitor.
    Schedule string
    Schedule name.
    ScheduleTimeout string
    Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: disable, enable.
    Scopetype string
    The scope of application of the resource. Valid values: inherit, adom. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    SctpFilterProfile string
    Name of an existing SCTP filter profile.
    SendDenyPacket string
    Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: disable, enable.
    ServiceNegate string
    When enabled service specifies what the service must NOT be. Valid values: disable, enable.
    Services []string
    Service and service group names.
    SessionTtl string
    TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
    SgtCheck string
    Enable/disable security group tags (SGT) check. Valid values: disable, enable.
    Sgts []float64
    Security group tags.
    SpamfilterProfile string
    Name of an existing Spam filter profile.
    SrcVendorMacs []string
    Vendor MAC source ID.
    Srcaddr6Negate string
    When enabled srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    Srcaddr6s []string
    Source IPv6 address name and address group names.
    SrcaddrNegate string
    When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    Srcaddrs []string
    Source IPv4 address and address group names.
    Srcintfs []string
    Incoming (ingress) interface.
    SshFilterProfile string
    Name of an existing SSH filter profile.
    SshPolicyRedirect string
    Redirect SSH traffic to matching transparent proxy policy. Valid values: disable, enable.
    SslMirror string
    Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: disable, enable.
    SslMirrorIntfs []string
    SSL mirror interface name.
    SslSshProfile string
    Name of an existing SSL SSH profile.
    Status string
    Enable or disable this policy. Valid values: disable, enable.
    TcpMssReceiver float64
    Receiver TCP maximum segment size (MSS).
    TcpMssSender float64
    Sender TCP maximum segment size (MSS).
    TcpSessionWithoutSyn string
    Enable/disable creation of TCP session without SYN flag. Valid values: all, data-only, disable.
    TcpTimeoutPid string
    TCP timeout profile ID
    TimeoutSendRst string
    Enable/disable sending RST packets when TCP sessions expire. Valid values: disable, enable.
    Tos string
    ToS (Type of Service) value used for comparison.
    TosMask string
    Non-zero bit positions are used for comparison while zero bit positions are ignored.
    TosNegate string
    Enable negated TOS match. Valid values: disable, enable.
    TrafficShaper string
    Traffic shaper.
    TrafficShaperReverse string
    Reverse traffic shaper.
    UdpTimeoutPid string
    UDP timeout profile ID
    UrlCategories []string
    URL category ID list.
    Users []string
    Names of individual users that can authenticate with this policy.
    UtmStatus string
    Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: disable, enable.
    Uuid string
    Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
    VideofilterProfile string
    Name of an existing VideoFilter profile.
    VirtualPatchProfile string
    Name of an existing virtual-patch profile.
    VlanCosFwd float64
    VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
    VlanCosRev float64
    VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
    VlanFilter string
    Set VLAN filters.
    VoipProfile string
    Name of an existing VoIP profile.
    Vpntunnel string
    Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
    WafProfile string
    Name of an existing Web application firewall profile.
    Wanopt string
    Enable/disable WAN optimization. Valid values: disable, enable.
    WanoptDetection string
    WAN optimization auto-detection mode. Valid values: active, passive, off.
    WanoptPassiveOpt string
    WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: default, transparent, non-transparent.
    WanoptPeer string
    WAN optimization peer.
    WanoptProfile string
    WAN optimization profile.
    Wccp string
    Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: disable, enable.
    Webcache string
    Enable/disable web cache. Valid values: disable, enable.
    WebcacheHttps string
    Enable/disable web cache for HTTPS. Valid values: disable, ssl-server, any, enable.
    WebfilterProfile string
    Name of an existing Web filter profile.
    WebproxyForwardServer string
    Webproxy forward server name.
    WebproxyProfile string
    Webproxy profile name.
    Wsso string
    Enable/disable WiFi Single Sign On (WSSO). Valid values: disable, enable.
    ZtnaDeviceOwnership string
    Enable/disable zero trust device ownership. Valid values: disable, enable.
    ZtnaEmsTagSecondaries []string
    Source ztna-ems-tag-secondary names.
    ZtnaEmsTags []string
    Source ztna-ems-tag names.
    ZtnaGeoTags []string
    Source ztna-geo-tag names.
    ZtnaPolicyRedirect string
    Redirect ZTNA traffic to matching Access-Proxy proxy-policy. Valid values: disable, enable.
    ZtnaStatus string
    Enable/disable zero trust access. Valid values: disable, enable.
    ZtnaTagsMatchLogic string
    ZTNA tag matching logic. Valid values: or, and.
    _policyBlock float64
    Assigned policy block. When this attribute is set, the policy represent a policy block, and all other attributes are ignored. This attribute is not available when configuring policy inside a policy block.
    _policyBlock Double
    Assigned policy block. When this attribute is set, the policy represent a policy block, and all other attributes are ignored. This attribute is not available when configuring policy inside a policy block.
    action String
    Policy action (accept/deny/ipsec). Valid values: deny, accept, ipsec, ssl-vpn, redirect, isolate.
    adom String
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    antiReplay String
    Enable/disable anti-replay check. Valid values: disable, enable.
    appCategories List<String>
    Application category ID list.
    appGroups List<String>
    Application group names.
    applicationList String
    Name of an existing Application list.
    applications List<Double>
    Application ID list.
    authCert String
    HTTPS server certificate for policy authentication.
    authPath String
    Enable/disable authentication-based routing. Valid values: disable, enable.
    authRedirectAddr String
    HTTP-to-HTTPS redirect address for firewall authentication.
    autoAsicOffload String
    Enable/disable policy traffic ASIC offloading. Valid values: disable, enable.
    avProfile String
    Name of an existing Antivirus profile.
    bestRoute String
    Best-Route. Valid values: disable, enable.
    blockNotification String
    Enable/disable block notification. Valid values: disable, enable.
    captivePortalExempt String
    Enable to exempt some users from the captive portal. Valid values: disable, enable.
    capturePacket String
    Enable/disable capture packets. Valid values: disable, enable.
    casbProfile String
    Name of an existing CASB profile.
    cgnEif String
    Enable/Disable CGN endpoint independent filtering. Valid values: disable, enable.
    cgnEim String
    Enable/Disable CGN endpoint independent mapping Valid values: disable, enable.
    cgnLogServerGrp String
    NP log server group name
    cgnResourceQuota Double
    resource quota
    cgnSessionQuota Double
    session quota
    cgnSwEifCtrl String
    Enable/disable software endpoint independent filtering control. Valid values: disable, enable.
    cifsProfile String
    Name of an existing CIFS profile.
    comments String
    Comment.
    customLogFields List<String>
    Custom fields to append to log messages for this policy.
    decryptedTrafficMirror String
    Decrypted traffic mirror.
    delayTcpNpuSession String
    Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: disable, enable.
    devices List<String>
    Names of devices or device groups that can be matched by the policy.
    diameterFilterProfile String
    Name of an existing Diameter filter profile.
    diffservCopy String
    Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: disable, enable.
    diffservForward String
    Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: disable, enable.
    diffservReverse String
    Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: disable, enable.
    diffservcodeForward String
    Change packet's DiffServ to this value.
    diffservcodeRev String
    Change packet's reverse (reply) DiffServ to this value.
    disclaimer String
    Enable/disable user authentication disclaimer. Valid values: disable, enable, user, domain, policy.
    dlpProfile String
    Name of an existing DLP profile.
    dlpSensor String
    Name of an existing DLP sensor.
    dnsfilterProfile String
    Name of an existing DNS filter profile.
    dscpMatch String
    Enable DSCP check. Valid values: disable, enable.
    dscpNegate String
    Enable negated DSCP match. Valid values: disable, enable.
    dscpValue String
    DSCP value.
    dsri String
    Enable DSRI to ignore HTTP server responses. Valid values: disable, enable.
    dstaddr6Negate String
    When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddr6s List<String>
    Destination IPv6 address name and address group names.
    dstaddrNegate String
    When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddrs List<String>
    Destination IPv4 address and address group names.
    dstintfs List<String>
    Outgoing (egress) interface.
    dynamicShaping String
    Enable/disable dynamic RADIUS defined traffic shaping. Valid values: disable, enable.
    eifCheck String
    Enable/Disable check endpoint-independent-filtering pinhole. Valid values: disable, enable.
    eifLearn String
    Enable/Disable learning of end-point-independent filtering pinhole. Valid values: disable, enable.
    emailCollect String
    Enable/disable email collection. Valid values: disable, enable.
    emailfilterProfile String
    Name of an existing email filter profile.
    fec String
    Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: disable, enable.
    fileFilterProfile String
    Name of an existing file-filter profile.
    firewallSessionDirty String
    How to handle sessions if the configuration of this firewall policy changes. Valid values: check-all, check-new.
    fixedport String
    Enable to prevent source NAT from changing a session's source port. Valid values: disable, enable.
    fsso String
    Enable/disable Fortinet Single Sign-On. Valid values: disable, enable.
    fssoAgentForNtlm String
    FSSO agent to use for NTLM authentication.
    fssoGroups List<String>
    Names of FSSO groups.
    geoipAnycast String
    Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: disable, enable.
    geoipMatch String
    Match geography address based either on its physical location or registered location. Valid values: physical-location, registered-location.
    globalLabel String
    Label for the policy that appears when the GUI is in Global View mode.
    groups List<String>
    Names of user groups that can authenticate with this policy.
    gtpProfile String
    GTP profile.
    httpPolicyRedirect String
    Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: disable, enable.
    icapProfile String
    Name of an existing ICAP profile.
    identityBasedRoute String
    Name of identity-based routing rule.
    inbound String
    Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: disable, enable.
    inspectionMode String
    Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: proxy, flow.
    internetService String
    Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internetService6 String
    Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internetService6CustomGroups List<String>
    Custom Internet Service6 group name.
    internetService6Customs List<String>
    Custom IPv6 Internet Service name.
    internetService6Groups List<String>
    Internet Service group name.
    internetService6Names List<String>
    IPv6 Internet Service name.
    internetService6Negate String
    When enabled internet-service6 specifies what the service must NOT be. Valid values: disable, enable.
    internetService6Src String
    Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internetService6SrcCustomGroups List<String>
    Custom Internet Service6 source group name.
    internetService6SrcCustoms List<String>
    Custom IPv6 Internet Service source name.
    internetService6SrcGroups List<String>
    Internet Service6 source group name.
    internetService6SrcNames List<String>
    IPv6 Internet Service source name.
    internetService6SrcNegate String
    When enabled internet-service6-src specifies what the service must NOT be. Valid values: disable, enable.
    internetServiceCustomGroups List<String>
    Custom Internet Service group name.
    internetServiceCustoms List<String>
    Custom Internet Service name.
    internetServiceGroups List<String>
    Internet Service group name.
    internetServiceIds List<String>
    Internet Service ID.
    internetServiceNames List<String>
    Internet Service name.
    internetServiceNegate String
    When enabled internet-service specifies what the service must NOT be. Valid values: disable, enable.
    internetServiceSrc String
    Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internetServiceSrcCustomGroups List<String>
    Custom Internet Service source group name.
    internetServiceSrcCustoms List<String>
    Custom Internet Service source name.
    internetServiceSrcGroups List<String>
    Internet Service source group name.
    internetServiceSrcIds List<String>
    Internet Service source ID.
    internetServiceSrcNames List<String>
    Internet Service source name.
    internetServiceSrcNegate String
    When enabled internet-service-src specifies what the service must NOT be. Valid values: disable, enable.
    ipVersionType String
    IP version of the policy.
    ippool String
    Enable to use IP Pools for source NAT. Valid values: disable, enable.
    ipsSensor String
    Name of an existing IPS sensor.
    ipsVoipFilter String
    Name of an existing VoIP (ips) profile.
    label String
    Label for the policy that appears when the GUI is in Section View mode.
    learningMode String
    Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: disable, enable.
    logHttpTransaction String
    Enable/disable HTTP transaction log. Valid values: disable, enable, all, utm.
    logtraffic String
    Enable or disable logging. Log all sessions or security profile sessions. Valid values: disable, enable, all, utm.
    logtrafficStart String
    Record logs when a session starts. Valid values: disable, enable.
    matchVip String
    Enable to match packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    matchVipOnly String
    Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    mmsProfile String
    Name of an existing MMS profile.
    name String
    Policy name.
    nat String
    Enable/disable source NAT. Valid values: disable, enable.
    nat46 String
    Enable/disable NAT46. Valid values: disable, enable.
    nat64 String
    Enable/disable NAT64. Valid values: disable, enable.
    natinbound String
    Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: disable, enable.
    natips List<String>
    Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
    natoutbound String
    Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: disable, enable.
    networkServiceDynamics List<String>
    Dynamic Network Service name.
    networkServiceSrcDynamics List<String>
    Dynamic Network Service source name.
    npAcceleration String
    Enable/disable UTM Network Processor acceleration. Valid values: disable, enable.
    ntlm String
    Enable/disable NTLM authentication. Valid values: disable, enable.
    ntlmEnabledBrowsers List<String>
    HTTP-User-Agent value of supported browsers.
    ntlmGuest String
    Enable/disable NTLM guest user access. Valid values: disable, enable.
    outbound String
    Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: disable, enable.
    packagesPblockFirewallPolicyId String
    an identifier for the resource with format {{policyid}}.
    passiveWanHealthMeasurement String
    Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: disable, enable.
    pblock String
    Pblock.
    pcpInbound String
    Enable/disable PCP inbound DNAT. Valid values: disable, enable.
    pcpOutbound String
    Enable/disable PCP outbound SNAT. Valid values: disable, enable.
    pcpPoolnames List<String>
    PCP pool names.
    perIpShaper String
    Per-IP traffic shaper.
    permitAnyHost String
    Accept UDP packets from any host. Valid values: disable, enable.
    permitStunHost String
    Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: disable, enable.
    pfcpProfile String
    PFCP profile.
    policyBehaviourType String
    Behaviour of the policy.
    policyExpiry String
    Enable/disable policy expiry. Valid values: disable, enable.
    policyExpiryDate String
    Policy expiry date (YYYY-MM-DD HH:MM:SS).
    policyExpiryDateUtc String
    Policy expiry date and time, in epoch format.
    policyOffload String
    Enable/Disable hardware session setup for CGNAT. Valid values: disable, enable.
    poolname6s List<String>
    IPv6 pool names.
    poolnames List<String>
    IP Pool names.
    portPreserve String
    Enable/disable preservation of the original source port from source NAT if it has not been used. Valid values: disable, enable.
    profileGroup String
    Name of profile group.
    profileProtocolOptions String
    Name of an existing Protocol options profile.
    profileType String
    Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: single, group.
    radiusIpAuthBypass String
    Enable IP authentication bypass. The bypassed IP address must be received from RADIUS server. Valid values: disable, enable.
    radiusMacAuthBypass String
    Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: disable, enable.
    redirectUrl String
    URL users are directed to after seeing and accepting the disclaimer or authenticating.
    replacemsgOverrideGroup String
    Override the default replacement message group for this policy.
    reputationDirection String
    Direction of the initial traffic for reputation to take effect. Valid values: source, destination.
    reputationDirection6 String
    Direction of the initial traffic for IPv6 reputation to take effect. Valid values: source, destination.
    reputationMinimum Double
    Minimum Reputation to take action.
    reputationMinimum6 Double
    IPv6 Minimum Reputation to take action.
    rsso String
    Enable/disable RADIUS single sign-on (RSSO). Valid values: disable, enable.
    rtpAddrs List<String>
    Address names if this is an RTP NAT policy.
    rtpNat String
    Enable Real Time Protocol (RTP) NAT. Valid values: disable, enable.
    scanBotnetConnections String
    Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: disable, block, monitor.
    schedule String
    Schedule name.
    scheduleTimeout String
    Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: disable, enable.
    scopetype String
    The scope of application of the resource. Valid values: inherit, adom. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    sctpFilterProfile String
    Name of an existing SCTP filter profile.
    sendDenyPacket String
    Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: disable, enable.
    serviceNegate String
    When enabled service specifies what the service must NOT be. Valid values: disable, enable.
    services List<String>
    Service and service group names.
    sessionTtl String
    TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
    sgtCheck String
    Enable/disable security group tags (SGT) check. Valid values: disable, enable.
    sgts List<Double>
    Security group tags.
    spamfilterProfile String
    Name of an existing Spam filter profile.
    srcVendorMacs List<String>
    Vendor MAC source ID.
    srcaddr6Negate String
    When enabled srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddr6s List<String>
    Source IPv6 address name and address group names.
    srcaddrNegate String
    When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddrs List<String>
    Source IPv4 address and address group names.
    srcintfs List<String>
    Incoming (ingress) interface.
    sshFilterProfile String
    Name of an existing SSH filter profile.
    sshPolicyRedirect String
    Redirect SSH traffic to matching transparent proxy policy. Valid values: disable, enable.
    sslMirror String
    Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: disable, enable.
    sslMirrorIntfs List<String>
    SSL mirror interface name.
    sslSshProfile String
    Name of an existing SSL SSH profile.
    status String
    Enable or disable this policy. Valid values: disable, enable.
    tcpMssReceiver Double
    Receiver TCP maximum segment size (MSS).
    tcpMssSender Double
    Sender TCP maximum segment size (MSS).
    tcpSessionWithoutSyn String
    Enable/disable creation of TCP session without SYN flag. Valid values: all, data-only, disable.
    tcpTimeoutPid String
    TCP timeout profile ID
    timeoutSendRst String
    Enable/disable sending RST packets when TCP sessions expire. Valid values: disable, enable.
    tos String
    ToS (Type of Service) value used for comparison.
    tosMask String
    Non-zero bit positions are used for comparison while zero bit positions are ignored.
    tosNegate String
    Enable negated TOS match. Valid values: disable, enable.
    trafficShaper String
    Traffic shaper.
    trafficShaperReverse String
    Reverse traffic shaper.
    udpTimeoutPid String
    UDP timeout profile ID
    urlCategories List<String>
    URL category ID list.
    users List<String>
    Names of individual users that can authenticate with this policy.
    utmStatus String
    Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: disable, enable.
    uuid String
    Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
    videofilterProfile String
    Name of an existing VideoFilter profile.
    virtualPatchProfile String
    Name of an existing virtual-patch profile.
    vlanCosFwd Double
    VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlanCosRev Double
    VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlanFilter String
    Set VLAN filters.
    voipProfile String
    Name of an existing VoIP profile.
    vpntunnel String
    Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
    wafProfile String
    Name of an existing Web application firewall profile.
    wanopt String
    Enable/disable WAN optimization. Valid values: disable, enable.
    wanoptDetection String
    WAN optimization auto-detection mode. Valid values: active, passive, off.
    wanoptPassiveOpt String
    WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: default, transparent, non-transparent.
    wanoptPeer String
    WAN optimization peer.
    wanoptProfile String
    WAN optimization profile.
    wccp String
    Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: disable, enable.
    webcache String
    Enable/disable web cache. Valid values: disable, enable.
    webcacheHttps String
    Enable/disable web cache for HTTPS. Valid values: disable, ssl-server, any, enable.
    webfilterProfile String
    Name of an existing Web filter profile.
    webproxyForwardServer String
    Webproxy forward server name.
    webproxyProfile String
    Webproxy profile name.
    wsso String
    Enable/disable WiFi Single Sign On (WSSO). Valid values: disable, enable.
    ztnaDeviceOwnership String
    Enable/disable zero trust device ownership. Valid values: disable, enable.
    ztnaEmsTagSecondaries List<String>
    Source ztna-ems-tag-secondary names.
    ztnaEmsTags List<String>
    Source ztna-ems-tag names.
    ztnaGeoTags List<String>
    Source ztna-geo-tag names.
    ztnaPolicyRedirect String
    Redirect ZTNA traffic to matching Access-Proxy proxy-policy. Valid values: disable, enable.
    ztnaStatus String
    Enable/disable zero trust access. Valid values: disable, enable.
    ztnaTagsMatchLogic String
    ZTNA tag matching logic. Valid values: or, and.
    _policyBlock number
    Assigned policy block. When this attribute is set, the policy represent a policy block, and all other attributes are ignored. This attribute is not available when configuring policy inside a policy block.
    action string
    Policy action (accept/deny/ipsec). Valid values: deny, accept, ipsec, ssl-vpn, redirect, isolate.
    adom string
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    antiReplay string
    Enable/disable anti-replay check. Valid values: disable, enable.
    appCategories string[]
    Application category ID list.
    appGroups string[]
    Application group names.
    applicationList string
    Name of an existing Application list.
    applications number[]
    Application ID list.
    authCert string
    HTTPS server certificate for policy authentication.
    authPath string
    Enable/disable authentication-based routing. Valid values: disable, enable.
    authRedirectAddr string
    HTTP-to-HTTPS redirect address for firewall authentication.
    autoAsicOffload string
    Enable/disable policy traffic ASIC offloading. Valid values: disable, enable.
    avProfile string
    Name of an existing Antivirus profile.
    bestRoute string
    Best-Route. Valid values: disable, enable.
    blockNotification string
    Enable/disable block notification. Valid values: disable, enable.
    captivePortalExempt string
    Enable to exempt some users from the captive portal. Valid values: disable, enable.
    capturePacket string
    Enable/disable capture packets. Valid values: disable, enable.
    casbProfile string
    Name of an existing CASB profile.
    cgnEif string
    Enable/Disable CGN endpoint independent filtering. Valid values: disable, enable.
    cgnEim string
    Enable/Disable CGN endpoint independent mapping Valid values: disable, enable.
    cgnLogServerGrp string
    NP log server group name
    cgnResourceQuota number
    resource quota
    cgnSessionQuota number
    session quota
    cgnSwEifCtrl string
    Enable/disable software endpoint independent filtering control. Valid values: disable, enable.
    cifsProfile string
    Name of an existing CIFS profile.
    comments string
    Comment.
    customLogFields string[]
    Custom fields to append to log messages for this policy.
    decryptedTrafficMirror string
    Decrypted traffic mirror.
    delayTcpNpuSession string
    Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: disable, enable.
    devices string[]
    Names of devices or device groups that can be matched by the policy.
    diameterFilterProfile string
    Name of an existing Diameter filter profile.
    diffservCopy string
    Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: disable, enable.
    diffservForward string
    Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: disable, enable.
    diffservReverse string
    Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: disable, enable.
    diffservcodeForward string
    Change packet's DiffServ to this value.
    diffservcodeRev string
    Change packet's reverse (reply) DiffServ to this value.
    disclaimer string
    Enable/disable user authentication disclaimer. Valid values: disable, enable, user, domain, policy.
    dlpProfile string
    Name of an existing DLP profile.
    dlpSensor string
    Name of an existing DLP sensor.
    dnsfilterProfile string
    Name of an existing DNS filter profile.
    dscpMatch string
    Enable DSCP check. Valid values: disable, enable.
    dscpNegate string
    Enable negated DSCP match. Valid values: disable, enable.
    dscpValue string
    DSCP value.
    dsri string
    Enable DSRI to ignore HTTP server responses. Valid values: disable, enable.
    dstaddr6Negate string
    When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddr6s string[]
    Destination IPv6 address name and address group names.
    dstaddrNegate string
    When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddrs string[]
    Destination IPv4 address and address group names.
    dstintfs string[]
    Outgoing (egress) interface.
    dynamicShaping string
    Enable/disable dynamic RADIUS defined traffic shaping. Valid values: disable, enable.
    eifCheck string
    Enable/Disable check endpoint-independent-filtering pinhole. Valid values: disable, enable.
    eifLearn string
    Enable/Disable learning of end-point-independent filtering pinhole. Valid values: disable, enable.
    emailCollect string
    Enable/disable email collection. Valid values: disable, enable.
    emailfilterProfile string
    Name of an existing email filter profile.
    fec string
    Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: disable, enable.
    fileFilterProfile string
    Name of an existing file-filter profile.
    firewallSessionDirty string
    How to handle sessions if the configuration of this firewall policy changes. Valid values: check-all, check-new.
    fixedport string
    Enable to prevent source NAT from changing a session's source port. Valid values: disable, enable.
    fsso string
    Enable/disable Fortinet Single Sign-On. Valid values: disable, enable.
    fssoAgentForNtlm string
    FSSO agent to use for NTLM authentication.
    fssoGroups string[]
    Names of FSSO groups.
    geoipAnycast string
    Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: disable, enable.
    geoipMatch string
    Match geography address based either on its physical location or registered location. Valid values: physical-location, registered-location.
    globalLabel string
    Label for the policy that appears when the GUI is in Global View mode.
    groups string[]
    Names of user groups that can authenticate with this policy.
    gtpProfile string
    GTP profile.
    httpPolicyRedirect string
    Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: disable, enable.
    icapProfile string
    Name of an existing ICAP profile.
    identityBasedRoute string
    Name of identity-based routing rule.
    inbound string
    Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: disable, enable.
    inspectionMode string
    Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: proxy, flow.
    internetService string
    Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internetService6 string
    Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internetService6CustomGroups string[]
    Custom Internet Service6 group name.
    internetService6Customs string[]
    Custom IPv6 Internet Service name.
    internetService6Groups string[]
    Internet Service group name.
    internetService6Names string[]
    IPv6 Internet Service name.
    internetService6Negate string
    When enabled internet-service6 specifies what the service must NOT be. Valid values: disable, enable.
    internetService6Src string
    Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internetService6SrcCustomGroups string[]
    Custom Internet Service6 source group name.
    internetService6SrcCustoms string[]
    Custom IPv6 Internet Service source name.
    internetService6SrcGroups string[]
    Internet Service6 source group name.
    internetService6SrcNames string[]
    IPv6 Internet Service source name.
    internetService6SrcNegate string
    When enabled internet-service6-src specifies what the service must NOT be. Valid values: disable, enable.
    internetServiceCustomGroups string[]
    Custom Internet Service group name.
    internetServiceCustoms string[]
    Custom Internet Service name.
    internetServiceGroups string[]
    Internet Service group name.
    internetServiceIds string[]
    Internet Service ID.
    internetServiceNames string[]
    Internet Service name.
    internetServiceNegate string
    When enabled internet-service specifies what the service must NOT be. Valid values: disable, enable.
    internetServiceSrc string
    Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internetServiceSrcCustomGroups string[]
    Custom Internet Service source group name.
    internetServiceSrcCustoms string[]
    Custom Internet Service source name.
    internetServiceSrcGroups string[]
    Internet Service source group name.
    internetServiceSrcIds string[]
    Internet Service source ID.
    internetServiceSrcNames string[]
    Internet Service source name.
    internetServiceSrcNegate string
    When enabled internet-service-src specifies what the service must NOT be. Valid values: disable, enable.
    ipVersionType string
    IP version of the policy.
    ippool string
    Enable to use IP Pools for source NAT. Valid values: disable, enable.
    ipsSensor string
    Name of an existing IPS sensor.
    ipsVoipFilter string
    Name of an existing VoIP (ips) profile.
    label string
    Label for the policy that appears when the GUI is in Section View mode.
    learningMode string
    Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: disable, enable.
    logHttpTransaction string
    Enable/disable HTTP transaction log. Valid values: disable, enable, all, utm.
    logtraffic string
    Enable or disable logging. Log all sessions or security profile sessions. Valid values: disable, enable, all, utm.
    logtrafficStart string
    Record logs when a session starts. Valid values: disable, enable.
    matchVip string
    Enable to match packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    matchVipOnly string
    Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    mmsProfile string
    Name of an existing MMS profile.
    name string
    Policy name.
    nat string
    Enable/disable source NAT. Valid values: disable, enable.
    nat46 string
    Enable/disable NAT46. Valid values: disable, enable.
    nat64 string
    Enable/disable NAT64. Valid values: disable, enable.
    natinbound string
    Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: disable, enable.
    natips string[]
    Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
    natoutbound string
    Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: disable, enable.
    networkServiceDynamics string[]
    Dynamic Network Service name.
    networkServiceSrcDynamics string[]
    Dynamic Network Service source name.
    npAcceleration string
    Enable/disable UTM Network Processor acceleration. Valid values: disable, enable.
    ntlm string
    Enable/disable NTLM authentication. Valid values: disable, enable.
    ntlmEnabledBrowsers string[]
    HTTP-User-Agent value of supported browsers.
    ntlmGuest string
    Enable/disable NTLM guest user access. Valid values: disable, enable.
    outbound string
    Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: disable, enable.
    packagesPblockFirewallPolicyId string
    an identifier for the resource with format {{policyid}}.
    passiveWanHealthMeasurement string
    Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: disable, enable.
    pblock string
    Pblock.
    pcpInbound string
    Enable/disable PCP inbound DNAT. Valid values: disable, enable.
    pcpOutbound string
    Enable/disable PCP outbound SNAT. Valid values: disable, enable.
    pcpPoolnames string[]
    PCP pool names.
    perIpShaper string
    Per-IP traffic shaper.
    permitAnyHost string
    Accept UDP packets from any host. Valid values: disable, enable.
    permitStunHost string
    Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: disable, enable.
    pfcpProfile string
    PFCP profile.
    policyBehaviourType string
    Behaviour of the policy.
    policyExpiry string
    Enable/disable policy expiry. Valid values: disable, enable.
    policyExpiryDate string
    Policy expiry date (YYYY-MM-DD HH:MM:SS).
    policyExpiryDateUtc string
    Policy expiry date and time, in epoch format.
    policyOffload string
    Enable/Disable hardware session setup for CGNAT. Valid values: disable, enable.
    poolname6s string[]
    IPv6 pool names.
    poolnames string[]
    IP Pool names.
    portPreserve string
    Enable/disable preservation of the original source port from source NAT if it has not been used. Valid values: disable, enable.
    profileGroup string
    Name of profile group.
    profileProtocolOptions string
    Name of an existing Protocol options profile.
    profileType string
    Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: single, group.
    radiusIpAuthBypass string
    Enable IP authentication bypass. The bypassed IP address must be received from RADIUS server. Valid values: disable, enable.
    radiusMacAuthBypass string
    Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: disable, enable.
    redirectUrl string
    URL users are directed to after seeing and accepting the disclaimer or authenticating.
    replacemsgOverrideGroup string
    Override the default replacement message group for this policy.
    reputationDirection string
    Direction of the initial traffic for reputation to take effect. Valid values: source, destination.
    reputationDirection6 string
    Direction of the initial traffic for IPv6 reputation to take effect. Valid values: source, destination.
    reputationMinimum number
    Minimum Reputation to take action.
    reputationMinimum6 number
    IPv6 Minimum Reputation to take action.
    rsso string
    Enable/disable RADIUS single sign-on (RSSO). Valid values: disable, enable.
    rtpAddrs string[]
    Address names if this is an RTP NAT policy.
    rtpNat string
    Enable Real Time Protocol (RTP) NAT. Valid values: disable, enable.
    scanBotnetConnections string
    Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: disable, block, monitor.
    schedule string
    Schedule name.
    scheduleTimeout string
    Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: disable, enable.
    scopetype string
    The scope of application of the resource. Valid values: inherit, adom. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    sctpFilterProfile string
    Name of an existing SCTP filter profile.
    sendDenyPacket string
    Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: disable, enable.
    serviceNegate string
    When enabled service specifies what the service must NOT be. Valid values: disable, enable.
    services string[]
    Service and service group names.
    sessionTtl string
    TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
    sgtCheck string
    Enable/disable security group tags (SGT) check. Valid values: disable, enable.
    sgts number[]
    Security group tags.
    spamfilterProfile string
    Name of an existing Spam filter profile.
    srcVendorMacs string[]
    Vendor MAC source ID.
    srcaddr6Negate string
    When enabled srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddr6s string[]
    Source IPv6 address name and address group names.
    srcaddrNegate string
    When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddrs string[]
    Source IPv4 address and address group names.
    srcintfs string[]
    Incoming (ingress) interface.
    sshFilterProfile string
    Name of an existing SSH filter profile.
    sshPolicyRedirect string
    Redirect SSH traffic to matching transparent proxy policy. Valid values: disable, enable.
    sslMirror string
    Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: disable, enable.
    sslMirrorIntfs string[]
    SSL mirror interface name.
    sslSshProfile string
    Name of an existing SSL SSH profile.
    status string
    Enable or disable this policy. Valid values: disable, enable.
    tcpMssReceiver number
    Receiver TCP maximum segment size (MSS).
    tcpMssSender number
    Sender TCP maximum segment size (MSS).
    tcpSessionWithoutSyn string
    Enable/disable creation of TCP session without SYN flag. Valid values: all, data-only, disable.
    tcpTimeoutPid string
    TCP timeout profile ID
    timeoutSendRst string
    Enable/disable sending RST packets when TCP sessions expire. Valid values: disable, enable.
    tos string
    ToS (Type of Service) value used for comparison.
    tosMask string
    Non-zero bit positions are used for comparison while zero bit positions are ignored.
    tosNegate string
    Enable negated TOS match. Valid values: disable, enable.
    trafficShaper string
    Traffic shaper.
    trafficShaperReverse string
    Reverse traffic shaper.
    udpTimeoutPid string
    UDP timeout profile ID
    urlCategories string[]
    URL category ID list.
    users string[]
    Names of individual users that can authenticate with this policy.
    utmStatus string
    Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: disable, enable.
    uuid string
    Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
    videofilterProfile string
    Name of an existing VideoFilter profile.
    virtualPatchProfile string
    Name of an existing virtual-patch profile.
    vlanCosFwd number
    VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlanCosRev number
    VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlanFilter string
    Set VLAN filters.
    voipProfile string
    Name of an existing VoIP profile.
    vpntunnel string
    Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
    wafProfile string
    Name of an existing Web application firewall profile.
    wanopt string
    Enable/disable WAN optimization. Valid values: disable, enable.
    wanoptDetection string
    WAN optimization auto-detection mode. Valid values: active, passive, off.
    wanoptPassiveOpt string
    WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: default, transparent, non-transparent.
    wanoptPeer string
    WAN optimization peer.
    wanoptProfile string
    WAN optimization profile.
    wccp string
    Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: disable, enable.
    webcache string
    Enable/disable web cache. Valid values: disable, enable.
    webcacheHttps string
    Enable/disable web cache for HTTPS. Valid values: disable, ssl-server, any, enable.
    webfilterProfile string
    Name of an existing Web filter profile.
    webproxyForwardServer string
    Webproxy forward server name.
    webproxyProfile string
    Webproxy profile name.
    wsso string
    Enable/disable WiFi Single Sign On (WSSO). Valid values: disable, enable.
    ztnaDeviceOwnership string
    Enable/disable zero trust device ownership. Valid values: disable, enable.
    ztnaEmsTagSecondaries string[]
    Source ztna-ems-tag-secondary names.
    ztnaEmsTags string[]
    Source ztna-ems-tag names.
    ztnaGeoTags string[]
    Source ztna-geo-tag names.
    ztnaPolicyRedirect string
    Redirect ZTNA traffic to matching Access-Proxy proxy-policy. Valid values: disable, enable.
    ztnaStatus string
    Enable/disable zero trust access. Valid values: disable, enable.
    ztnaTagsMatchLogic string
    ZTNA tag matching logic. Valid values: or, and.
    _policy_block float
    Assigned policy block. When this attribute is set, the policy represent a policy block, and all other attributes are ignored. This attribute is not available when configuring policy inside a policy block.
    action str
    Policy action (accept/deny/ipsec). Valid values: deny, accept, ipsec, ssl-vpn, redirect, isolate.
    adom str
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    anti_replay str
    Enable/disable anti-replay check. Valid values: disable, enable.
    app_categories Sequence[str]
    Application category ID list.
    app_groups Sequence[str]
    Application group names.
    application_list str
    Name of an existing Application list.
    applications Sequence[float]
    Application ID list.
    auth_cert str
    HTTPS server certificate for policy authentication.
    auth_path str
    Enable/disable authentication-based routing. Valid values: disable, enable.
    auth_redirect_addr str
    HTTP-to-HTTPS redirect address for firewall authentication.
    auto_asic_offload str
    Enable/disable policy traffic ASIC offloading. Valid values: disable, enable.
    av_profile str
    Name of an existing Antivirus profile.
    best_route str
    Best-Route. Valid values: disable, enable.
    block_notification str
    Enable/disable block notification. Valid values: disable, enable.
    captive_portal_exempt str
    Enable to exempt some users from the captive portal. Valid values: disable, enable.
    capture_packet str
    Enable/disable capture packets. Valid values: disable, enable.
    casb_profile str
    Name of an existing CASB profile.
    cgn_eif str
    Enable/Disable CGN endpoint independent filtering. Valid values: disable, enable.
    cgn_eim str
    Enable/Disable CGN endpoint independent mapping Valid values: disable, enable.
    cgn_log_server_grp str
    NP log server group name
    cgn_resource_quota float
    resource quota
    cgn_session_quota float
    session quota
    cgn_sw_eif_ctrl str
    Enable/disable software endpoint independent filtering control. Valid values: disable, enable.
    cifs_profile str
    Name of an existing CIFS profile.
    comments str
    Comment.
    custom_log_fields Sequence[str]
    Custom fields to append to log messages for this policy.
    decrypted_traffic_mirror str
    Decrypted traffic mirror.
    delay_tcp_npu_session str
    Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: disable, enable.
    devices Sequence[str]
    Names of devices or device groups that can be matched by the policy.
    diameter_filter_profile str
    Name of an existing Diameter filter profile.
    diffserv_copy str
    Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: disable, enable.
    diffserv_forward str
    Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: disable, enable.
    diffserv_reverse str
    Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: disable, enable.
    diffservcode_forward str
    Change packet's DiffServ to this value.
    diffservcode_rev str
    Change packet's reverse (reply) DiffServ to this value.
    disclaimer str
    Enable/disable user authentication disclaimer. Valid values: disable, enable, user, domain, policy.
    dlp_profile str
    Name of an existing DLP profile.
    dlp_sensor str
    Name of an existing DLP sensor.
    dnsfilter_profile str
    Name of an existing DNS filter profile.
    dscp_match str
    Enable DSCP check. Valid values: disable, enable.
    dscp_negate str
    Enable negated DSCP match. Valid values: disable, enable.
    dscp_value str
    DSCP value.
    dsri str
    Enable DSRI to ignore HTTP server responses. Valid values: disable, enable.
    dstaddr6_negate str
    When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddr6s Sequence[str]
    Destination IPv6 address name and address group names.
    dstaddr_negate str
    When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddrs Sequence[str]
    Destination IPv4 address and address group names.
    dstintfs Sequence[str]
    Outgoing (egress) interface.
    dynamic_shaping str
    Enable/disable dynamic RADIUS defined traffic shaping. Valid values: disable, enable.
    eif_check str
    Enable/Disable check endpoint-independent-filtering pinhole. Valid values: disable, enable.
    eif_learn str
    Enable/Disable learning of end-point-independent filtering pinhole. Valid values: disable, enable.
    email_collect str
    Enable/disable email collection. Valid values: disable, enable.
    emailfilter_profile str
    Name of an existing email filter profile.
    fec str
    Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: disable, enable.
    file_filter_profile str
    Name of an existing file-filter profile.
    firewall_session_dirty str
    How to handle sessions if the configuration of this firewall policy changes. Valid values: check-all, check-new.
    fixedport str
    Enable to prevent source NAT from changing a session's source port. Valid values: disable, enable.
    fsso str
    Enable/disable Fortinet Single Sign-On. Valid values: disable, enable.
    fsso_agent_for_ntlm str
    FSSO agent to use for NTLM authentication.
    fsso_groups Sequence[str]
    Names of FSSO groups.
    geoip_anycast str
    Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: disable, enable.
    geoip_match str
    Match geography address based either on its physical location or registered location. Valid values: physical-location, registered-location.
    global_label str
    Label for the policy that appears when the GUI is in Global View mode.
    groups Sequence[str]
    Names of user groups that can authenticate with this policy.
    gtp_profile str
    GTP profile.
    http_policy_redirect str
    Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: disable, enable.
    icap_profile str
    Name of an existing ICAP profile.
    identity_based_route str
    Name of identity-based routing rule.
    inbound str
    Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: disable, enable.
    inspection_mode str
    Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: proxy, flow.
    internet_service str
    Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internet_service6 str
    Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internet_service6_custom_groups Sequence[str]
    Custom Internet Service6 group name.
    internet_service6_customs Sequence[str]
    Custom IPv6 Internet Service name.
    internet_service6_groups Sequence[str]
    Internet Service group name.
    internet_service6_names Sequence[str]
    IPv6 Internet Service name.
    internet_service6_negate str
    When enabled internet-service6 specifies what the service must NOT be. Valid values: disable, enable.
    internet_service6_src str
    Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internet_service6_src_custom_groups Sequence[str]
    Custom Internet Service6 source group name.
    internet_service6_src_customs Sequence[str]
    Custom IPv6 Internet Service source name.
    internet_service6_src_groups Sequence[str]
    Internet Service6 source group name.
    internet_service6_src_names Sequence[str]
    IPv6 Internet Service source name.
    internet_service6_src_negate str
    When enabled internet-service6-src specifies what the service must NOT be. Valid values: disable, enable.
    internet_service_custom_groups Sequence[str]
    Custom Internet Service group name.
    internet_service_customs Sequence[str]
    Custom Internet Service name.
    internet_service_groups Sequence[str]
    Internet Service group name.
    internet_service_ids Sequence[str]
    Internet Service ID.
    internet_service_names Sequence[str]
    Internet Service name.
    internet_service_negate str
    When enabled internet-service specifies what the service must NOT be. Valid values: disable, enable.
    internet_service_src str
    Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internet_service_src_custom_groups Sequence[str]
    Custom Internet Service source group name.
    internet_service_src_customs Sequence[str]
    Custom Internet Service source name.
    internet_service_src_groups Sequence[str]
    Internet Service source group name.
    internet_service_src_ids Sequence[str]
    Internet Service source ID.
    internet_service_src_names Sequence[str]
    Internet Service source name.
    internet_service_src_negate str
    When enabled internet-service-src specifies what the service must NOT be. Valid values: disable, enable.
    ip_version_type str
    IP version of the policy.
    ippool str
    Enable to use IP Pools for source NAT. Valid values: disable, enable.
    ips_sensor str
    Name of an existing IPS sensor.
    ips_voip_filter str
    Name of an existing VoIP (ips) profile.
    label str
    Label for the policy that appears when the GUI is in Section View mode.
    learning_mode str
    Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: disable, enable.
    log_http_transaction str
    Enable/disable HTTP transaction log. Valid values: disable, enable, all, utm.
    logtraffic str
    Enable or disable logging. Log all sessions or security profile sessions. Valid values: disable, enable, all, utm.
    logtraffic_start str
    Record logs when a session starts. Valid values: disable, enable.
    match_vip str
    Enable to match packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    match_vip_only str
    Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    mms_profile str
    Name of an existing MMS profile.
    name str
    Policy name.
    nat str
    Enable/disable source NAT. Valid values: disable, enable.
    nat46 str
    Enable/disable NAT46. Valid values: disable, enable.
    nat64 str
    Enable/disable NAT64. Valid values: disable, enable.
    natinbound str
    Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: disable, enable.
    natips Sequence[str]
    Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
    natoutbound str
    Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: disable, enable.
    network_service_dynamics Sequence[str]
    Dynamic Network Service name.
    network_service_src_dynamics Sequence[str]
    Dynamic Network Service source name.
    np_acceleration str
    Enable/disable UTM Network Processor acceleration. Valid values: disable, enable.
    ntlm str
    Enable/disable NTLM authentication. Valid values: disable, enable.
    ntlm_enabled_browsers Sequence[str]
    HTTP-User-Agent value of supported browsers.
    ntlm_guest str
    Enable/disable NTLM guest user access. Valid values: disable, enable.
    outbound str
    Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: disable, enable.
    packages_pblock_firewall_policy_id str
    an identifier for the resource with format {{policyid}}.
    passive_wan_health_measurement str
    Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: disable, enable.
    pblock str
    Pblock.
    pcp_inbound str
    Enable/disable PCP inbound DNAT. Valid values: disable, enable.
    pcp_outbound str
    Enable/disable PCP outbound SNAT. Valid values: disable, enable.
    pcp_poolnames Sequence[str]
    PCP pool names.
    per_ip_shaper str
    Per-IP traffic shaper.
    permit_any_host str
    Accept UDP packets from any host. Valid values: disable, enable.
    permit_stun_host str
    Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: disable, enable.
    pfcp_profile str
    PFCP profile.
    policy_behaviour_type str
    Behaviour of the policy.
    policy_expiry str
    Enable/disable policy expiry. Valid values: disable, enable.
    policy_expiry_date str
    Policy expiry date (YYYY-MM-DD HH:MM:SS).
    policy_expiry_date_utc str
    Policy expiry date and time, in epoch format.
    policy_offload str
    Enable/Disable hardware session setup for CGNAT. Valid values: disable, enable.
    poolname6s Sequence[str]
    IPv6 pool names.
    poolnames Sequence[str]
    IP Pool names.
    port_preserve str
    Enable/disable preservation of the original source port from source NAT if it has not been used. Valid values: disable, enable.
    profile_group str
    Name of profile group.
    profile_protocol_options str
    Name of an existing Protocol options profile.
    profile_type str
    Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: single, group.
    radius_ip_auth_bypass str
    Enable IP authentication bypass. The bypassed IP address must be received from RADIUS server. Valid values: disable, enable.
    radius_mac_auth_bypass str
    Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: disable, enable.
    redirect_url str
    URL users are directed to after seeing and accepting the disclaimer or authenticating.
    replacemsg_override_group str
    Override the default replacement message group for this policy.
    reputation_direction str
    Direction of the initial traffic for reputation to take effect. Valid values: source, destination.
    reputation_direction6 str
    Direction of the initial traffic for IPv6 reputation to take effect. Valid values: source, destination.
    reputation_minimum float
    Minimum Reputation to take action.
    reputation_minimum6 float
    IPv6 Minimum Reputation to take action.
    rsso str
    Enable/disable RADIUS single sign-on (RSSO). Valid values: disable, enable.
    rtp_addrs Sequence[str]
    Address names if this is an RTP NAT policy.
    rtp_nat str
    Enable Real Time Protocol (RTP) NAT. Valid values: disable, enable.
    scan_botnet_connections str
    Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: disable, block, monitor.
    schedule str
    Schedule name.
    schedule_timeout str
    Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: disable, enable.
    scopetype str
    The scope of application of the resource. Valid values: inherit, adom. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    sctp_filter_profile str
    Name of an existing SCTP filter profile.
    send_deny_packet str
    Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: disable, enable.
    service_negate str
    When enabled service specifies what the service must NOT be. Valid values: disable, enable.
    services Sequence[str]
    Service and service group names.
    session_ttl str
    TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
    sgt_check str
    Enable/disable security group tags (SGT) check. Valid values: disable, enable.
    sgts Sequence[float]
    Security group tags.
    spamfilter_profile str
    Name of an existing Spam filter profile.
    src_vendor_macs Sequence[str]
    Vendor MAC source ID.
    srcaddr6_negate str
    When enabled srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddr6s Sequence[str]
    Source IPv6 address name and address group names.
    srcaddr_negate str
    When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddrs Sequence[str]
    Source IPv4 address and address group names.
    srcintfs Sequence[str]
    Incoming (ingress) interface.
    ssh_filter_profile str
    Name of an existing SSH filter profile.
    ssh_policy_redirect str
    Redirect SSH traffic to matching transparent proxy policy. Valid values: disable, enable.
    ssl_mirror str
    Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: disable, enable.
    ssl_mirror_intfs Sequence[str]
    SSL mirror interface name.
    ssl_ssh_profile str
    Name of an existing SSL SSH profile.
    status str
    Enable or disable this policy. Valid values: disable, enable.
    tcp_mss_receiver float
    Receiver TCP maximum segment size (MSS).
    tcp_mss_sender float
    Sender TCP maximum segment size (MSS).
    tcp_session_without_syn str
    Enable/disable creation of TCP session without SYN flag. Valid values: all, data-only, disable.
    tcp_timeout_pid str
    TCP timeout profile ID
    timeout_send_rst str
    Enable/disable sending RST packets when TCP sessions expire. Valid values: disable, enable.
    tos str
    ToS (Type of Service) value used for comparison.
    tos_mask str
    Non-zero bit positions are used for comparison while zero bit positions are ignored.
    tos_negate str
    Enable negated TOS match. Valid values: disable, enable.
    traffic_shaper str
    Traffic shaper.
    traffic_shaper_reverse str
    Reverse traffic shaper.
    udp_timeout_pid str
    UDP timeout profile ID
    url_categories Sequence[str]
    URL category ID list.
    users Sequence[str]
    Names of individual users that can authenticate with this policy.
    utm_status str
    Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: disable, enable.
    uuid str
    Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
    videofilter_profile str
    Name of an existing VideoFilter profile.
    virtual_patch_profile str
    Name of an existing virtual-patch profile.
    vlan_cos_fwd float
    VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlan_cos_rev float
    VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlan_filter str
    Set VLAN filters.
    voip_profile str
    Name of an existing VoIP profile.
    vpntunnel str
    Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
    waf_profile str
    Name of an existing Web application firewall profile.
    wanopt str
    Enable/disable WAN optimization. Valid values: disable, enable.
    wanopt_detection str
    WAN optimization auto-detection mode. Valid values: active, passive, off.
    wanopt_passive_opt str
    WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: default, transparent, non-transparent.
    wanopt_peer str
    WAN optimization peer.
    wanopt_profile str
    WAN optimization profile.
    wccp str
    Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: disable, enable.
    webcache str
    Enable/disable web cache. Valid values: disable, enable.
    webcache_https str
    Enable/disable web cache for HTTPS. Valid values: disable, ssl-server, any, enable.
    webfilter_profile str
    Name of an existing Web filter profile.
    webproxy_forward_server str
    Webproxy forward server name.
    webproxy_profile str
    Webproxy profile name.
    wsso str
    Enable/disable WiFi Single Sign On (WSSO). Valid values: disable, enable.
    ztna_device_ownership str
    Enable/disable zero trust device ownership. Valid values: disable, enable.
    ztna_ems_tag_secondaries Sequence[str]
    Source ztna-ems-tag-secondary names.
    ztna_ems_tags Sequence[str]
    Source ztna-ems-tag names.
    ztna_geo_tags Sequence[str]
    Source ztna-geo-tag names.
    ztna_policy_redirect str
    Redirect ZTNA traffic to matching Access-Proxy proxy-policy. Valid values: disable, enable.
    ztna_status str
    Enable/disable zero trust access. Valid values: disable, enable.
    ztna_tags_match_logic str
    ZTNA tag matching logic. Valid values: or, and.
    _policyBlock Number
    Assigned policy block. When this attribute is set, the policy represent a policy block, and all other attributes are ignored. This attribute is not available when configuring policy inside a policy block.
    action String
    Policy action (accept/deny/ipsec). Valid values: deny, accept, ipsec, ssl-vpn, redirect, isolate.
    adom String
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    antiReplay String
    Enable/disable anti-replay check. Valid values: disable, enable.
    appCategories List<String>
    Application category ID list.
    appGroups List<String>
    Application group names.
    applicationList String
    Name of an existing Application list.
    applications List<Number>
    Application ID list.
    authCert String
    HTTPS server certificate for policy authentication.
    authPath String
    Enable/disable authentication-based routing. Valid values: disable, enable.
    authRedirectAddr String
    HTTP-to-HTTPS redirect address for firewall authentication.
    autoAsicOffload String
    Enable/disable policy traffic ASIC offloading. Valid values: disable, enable.
    avProfile String
    Name of an existing Antivirus profile.
    bestRoute String
    Best-Route. Valid values: disable, enable.
    blockNotification String
    Enable/disable block notification. Valid values: disable, enable.
    captivePortalExempt String
    Enable to exempt some users from the captive portal. Valid values: disable, enable.
    capturePacket String
    Enable/disable capture packets. Valid values: disable, enable.
    casbProfile String
    Name of an existing CASB profile.
    cgnEif String
    Enable/Disable CGN endpoint independent filtering. Valid values: disable, enable.
    cgnEim String
    Enable/Disable CGN endpoint independent mapping Valid values: disable, enable.
    cgnLogServerGrp String
    NP log server group name
    cgnResourceQuota Number
    resource quota
    cgnSessionQuota Number
    session quota
    cgnSwEifCtrl String
    Enable/disable software endpoint independent filtering control. Valid values: disable, enable.
    cifsProfile String
    Name of an existing CIFS profile.
    comments String
    Comment.
    customLogFields List<String>
    Custom fields to append to log messages for this policy.
    decryptedTrafficMirror String
    Decrypted traffic mirror.
    delayTcpNpuSession String
    Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: disable, enable.
    devices List<String>
    Names of devices or device groups that can be matched by the policy.
    diameterFilterProfile String
    Name of an existing Diameter filter profile.
    diffservCopy String
    Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: disable, enable.
    diffservForward String
    Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: disable, enable.
    diffservReverse String
    Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: disable, enable.
    diffservcodeForward String
    Change packet's DiffServ to this value.
    diffservcodeRev String
    Change packet's reverse (reply) DiffServ to this value.
    disclaimer String
    Enable/disable user authentication disclaimer. Valid values: disable, enable, user, domain, policy.
    dlpProfile String
    Name of an existing DLP profile.
    dlpSensor String
    Name of an existing DLP sensor.
    dnsfilterProfile String
    Name of an existing DNS filter profile.
    dscpMatch String
    Enable DSCP check. Valid values: disable, enable.
    dscpNegate String
    Enable negated DSCP match. Valid values: disable, enable.
    dscpValue String
    DSCP value.
    dsri String
    Enable DSRI to ignore HTTP server responses. Valid values: disable, enable.
    dstaddr6Negate String
    When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddr6s List<String>
    Destination IPv6 address name and address group names.
    dstaddrNegate String
    When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: disable, enable.
    dstaddrs List<String>
    Destination IPv4 address and address group names.
    dstintfs List<String>
    Outgoing (egress) interface.
    dynamicShaping String
    Enable/disable dynamic RADIUS defined traffic shaping. Valid values: disable, enable.
    eifCheck String
    Enable/Disable check endpoint-independent-filtering pinhole. Valid values: disable, enable.
    eifLearn String
    Enable/Disable learning of end-point-independent filtering pinhole. Valid values: disable, enable.
    emailCollect String
    Enable/disable email collection. Valid values: disable, enable.
    emailfilterProfile String
    Name of an existing email filter profile.
    fec String
    Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: disable, enable.
    fileFilterProfile String
    Name of an existing file-filter profile.
    firewallSessionDirty String
    How to handle sessions if the configuration of this firewall policy changes. Valid values: check-all, check-new.
    fixedport String
    Enable to prevent source NAT from changing a session's source port. Valid values: disable, enable.
    fsso String
    Enable/disable Fortinet Single Sign-On. Valid values: disable, enable.
    fssoAgentForNtlm String
    FSSO agent to use for NTLM authentication.
    fssoGroups List<String>
    Names of FSSO groups.
    geoipAnycast String
    Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: disable, enable.
    geoipMatch String
    Match geography address based either on its physical location or registered location. Valid values: physical-location, registered-location.
    globalLabel String
    Label for the policy that appears when the GUI is in Global View mode.
    groups List<String>
    Names of user groups that can authenticate with this policy.
    gtpProfile String
    GTP profile.
    httpPolicyRedirect String
    Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: disable, enable.
    icapProfile String
    Name of an existing ICAP profile.
    identityBasedRoute String
    Name of identity-based routing rule.
    inbound String
    Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: disable, enable.
    inspectionMode String
    Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: proxy, flow.
    internetService String
    Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internetService6 String
    Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: disable, enable.
    internetService6CustomGroups List<String>
    Custom Internet Service6 group name.
    internetService6Customs List<String>
    Custom IPv6 Internet Service name.
    internetService6Groups List<String>
    Internet Service group name.
    internetService6Names List<String>
    IPv6 Internet Service name.
    internetService6Negate String
    When enabled internet-service6 specifies what the service must NOT be. Valid values: disable, enable.
    internetService6Src String
    Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internetService6SrcCustomGroups List<String>
    Custom Internet Service6 source group name.
    internetService6SrcCustoms List<String>
    Custom IPv6 Internet Service source name.
    internetService6SrcGroups List<String>
    Internet Service6 source group name.
    internetService6SrcNames List<String>
    IPv6 Internet Service source name.
    internetService6SrcNegate String
    When enabled internet-service6-src specifies what the service must NOT be. Valid values: disable, enable.
    internetServiceCustomGroups List<String>
    Custom Internet Service group name.
    internetServiceCustoms List<String>
    Custom Internet Service name.
    internetServiceGroups List<String>
    Internet Service group name.
    internetServiceIds List<String>
    Internet Service ID.
    internetServiceNames List<String>
    Internet Service name.
    internetServiceNegate String
    When enabled internet-service specifies what the service must NOT be. Valid values: disable, enable.
    internetServiceSrc String
    Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: disable, enable.
    internetServiceSrcCustomGroups List<String>
    Custom Internet Service source group name.
    internetServiceSrcCustoms List<String>
    Custom Internet Service source name.
    internetServiceSrcGroups List<String>
    Internet Service source group name.
    internetServiceSrcIds List<String>
    Internet Service source ID.
    internetServiceSrcNames List<String>
    Internet Service source name.
    internetServiceSrcNegate String
    When enabled internet-service-src specifies what the service must NOT be. Valid values: disable, enable.
    ipVersionType String
    IP version of the policy.
    ippool String
    Enable to use IP Pools for source NAT. Valid values: disable, enable.
    ipsSensor String
    Name of an existing IPS sensor.
    ipsVoipFilter String
    Name of an existing VoIP (ips) profile.
    label String
    Label for the policy that appears when the GUI is in Section View mode.
    learningMode String
    Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: disable, enable.
    logHttpTransaction String
    Enable/disable HTTP transaction log. Valid values: disable, enable, all, utm.
    logtraffic String
    Enable or disable logging. Log all sessions or security profile sessions. Valid values: disable, enable, all, utm.
    logtrafficStart String
    Record logs when a session starts. Valid values: disable, enable.
    matchVip String
    Enable to match packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    matchVipOnly String
    Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: disable, enable.
    mmsProfile String
    Name of an existing MMS profile.
    name String
    Policy name.
    nat String
    Enable/disable source NAT. Valid values: disable, enable.
    nat46 String
    Enable/disable NAT46. Valid values: disable, enable.
    nat64 String
    Enable/disable NAT64. Valid values: disable, enable.
    natinbound String
    Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: disable, enable.
    natips List<String>
    Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
    natoutbound String
    Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: disable, enable.
    networkServiceDynamics List<String>
    Dynamic Network Service name.
    networkServiceSrcDynamics List<String>
    Dynamic Network Service source name.
    npAcceleration String
    Enable/disable UTM Network Processor acceleration. Valid values: disable, enable.
    ntlm String
    Enable/disable NTLM authentication. Valid values: disable, enable.
    ntlmEnabledBrowsers List<String>
    HTTP-User-Agent value of supported browsers.
    ntlmGuest String
    Enable/disable NTLM guest user access. Valid values: disable, enable.
    outbound String
    Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: disable, enable.
    packagesPblockFirewallPolicyId String
    an identifier for the resource with format {{policyid}}.
    passiveWanHealthMeasurement String
    Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: disable, enable.
    pblock String
    Pblock.
    pcpInbound String
    Enable/disable PCP inbound DNAT. Valid values: disable, enable.
    pcpOutbound String
    Enable/disable PCP outbound SNAT. Valid values: disable, enable.
    pcpPoolnames List<String>
    PCP pool names.
    perIpShaper String
    Per-IP traffic shaper.
    permitAnyHost String
    Accept UDP packets from any host. Valid values: disable, enable.
    permitStunHost String
    Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: disable, enable.
    pfcpProfile String
    PFCP profile.
    policyBehaviourType String
    Behaviour of the policy.
    policyExpiry String
    Enable/disable policy expiry. Valid values: disable, enable.
    policyExpiryDate String
    Policy expiry date (YYYY-MM-DD HH:MM:SS).
    policyExpiryDateUtc String
    Policy expiry date and time, in epoch format.
    policyOffload String
    Enable/Disable hardware session setup for CGNAT. Valid values: disable, enable.
    poolname6s List<String>
    IPv6 pool names.
    poolnames List<String>
    IP Pool names.
    portPreserve String
    Enable/disable preservation of the original source port from source NAT if it has not been used. Valid values: disable, enable.
    profileGroup String
    Name of profile group.
    profileProtocolOptions String
    Name of an existing Protocol options profile.
    profileType String
    Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: single, group.
    radiusIpAuthBypass String
    Enable IP authentication bypass. The bypassed IP address must be received from RADIUS server. Valid values: disable, enable.
    radiusMacAuthBypass String
    Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: disable, enable.
    redirectUrl String
    URL users are directed to after seeing and accepting the disclaimer or authenticating.
    replacemsgOverrideGroup String
    Override the default replacement message group for this policy.
    reputationDirection String
    Direction of the initial traffic for reputation to take effect. Valid values: source, destination.
    reputationDirection6 String
    Direction of the initial traffic for IPv6 reputation to take effect. Valid values: source, destination.
    reputationMinimum Number
    Minimum Reputation to take action.
    reputationMinimum6 Number
    IPv6 Minimum Reputation to take action.
    rsso String
    Enable/disable RADIUS single sign-on (RSSO). Valid values: disable, enable.
    rtpAddrs List<String>
    Address names if this is an RTP NAT policy.
    rtpNat String
    Enable Real Time Protocol (RTP) NAT. Valid values: disable, enable.
    scanBotnetConnections String
    Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: disable, block, monitor.
    schedule String
    Schedule name.
    scheduleTimeout String
    Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: disable, enable.
    scopetype String
    The scope of application of the resource. Valid values: inherit, adom. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    sctpFilterProfile String
    Name of an existing SCTP filter profile.
    sendDenyPacket String
    Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: disable, enable.
    serviceNegate String
    When enabled service specifies what the service must NOT be. Valid values: disable, enable.
    services List<String>
    Service and service group names.
    sessionTtl String
    TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
    sgtCheck String
    Enable/disable security group tags (SGT) check. Valid values: disable, enable.
    sgts List<Number>
    Security group tags.
    spamfilterProfile String
    Name of an existing Spam filter profile.
    srcVendorMacs List<String>
    Vendor MAC source ID.
    srcaddr6Negate String
    When enabled srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddr6s List<String>
    Source IPv6 address name and address group names.
    srcaddrNegate String
    When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: disable, enable.
    srcaddrs List<String>
    Source IPv4 address and address group names.
    srcintfs List<String>
    Incoming (ingress) interface.
    sshFilterProfile String
    Name of an existing SSH filter profile.
    sshPolicyRedirect String
    Redirect SSH traffic to matching transparent proxy policy. Valid values: disable, enable.
    sslMirror String
    Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: disable, enable.
    sslMirrorIntfs List<String>
    SSL mirror interface name.
    sslSshProfile String
    Name of an existing SSL SSH profile.
    status String
    Enable or disable this policy. Valid values: disable, enable.
    tcpMssReceiver Number
    Receiver TCP maximum segment size (MSS).
    tcpMssSender Number
    Sender TCP maximum segment size (MSS).
    tcpSessionWithoutSyn String
    Enable/disable creation of TCP session without SYN flag. Valid values: all, data-only, disable.
    tcpTimeoutPid String
    TCP timeout profile ID
    timeoutSendRst String
    Enable/disable sending RST packets when TCP sessions expire. Valid values: disable, enable.
    tos String
    ToS (Type of Service) value used for comparison.
    tosMask String
    Non-zero bit positions are used for comparison while zero bit positions are ignored.
    tosNegate String
    Enable negated TOS match. Valid values: disable, enable.
    trafficShaper String
    Traffic shaper.
    trafficShaperReverse String
    Reverse traffic shaper.
    udpTimeoutPid String
    UDP timeout profile ID
    urlCategories List<String>
    URL category ID list.
    users List<String>
    Names of individual users that can authenticate with this policy.
    utmStatus String
    Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: disable, enable.
    uuid String
    Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
    videofilterProfile String
    Name of an existing VideoFilter profile.
    virtualPatchProfile String
    Name of an existing virtual-patch profile.
    vlanCosFwd Number
    VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlanCosRev Number
    VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
    vlanFilter String
    Set VLAN filters.
    voipProfile String
    Name of an existing VoIP profile.
    vpntunnel String
    Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
    wafProfile String
    Name of an existing Web application firewall profile.
    wanopt String
    Enable/disable WAN optimization. Valid values: disable, enable.
    wanoptDetection String
    WAN optimization auto-detection mode. Valid values: active, passive, off.
    wanoptPassiveOpt String
    WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: default, transparent, non-transparent.
    wanoptPeer String
    WAN optimization peer.
    wanoptProfile String
    WAN optimization profile.
    wccp String
    Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: disable, enable.
    webcache String
    Enable/disable web cache. Valid values: disable, enable.
    webcacheHttps String
    Enable/disable web cache for HTTPS. Valid values: disable, ssl-server, any, enable.
    webfilterProfile String
    Name of an existing Web filter profile.
    webproxyForwardServer String
    Webproxy forward server name.
    webproxyProfile String
    Webproxy profile name.
    wsso String
    Enable/disable WiFi Single Sign On (WSSO). Valid values: disable, enable.
    ztnaDeviceOwnership String
    Enable/disable zero trust device ownership. Valid values: disable, enable.
    ztnaEmsTagSecondaries List<String>
    Source ztna-ems-tag-secondary names.
    ztnaEmsTags List<String>
    Source ztna-ems-tag names.
    ztnaGeoTags List<String>
    Source ztna-geo-tag names.
    ztnaPolicyRedirect String
    Redirect ZTNA traffic to matching Access-Proxy proxy-policy. Valid values: disable, enable.
    ztnaStatus String
    Enable/disable zero trust access. Valid values: disable, enable.
    ztnaTagsMatchLogic String
    ZTNA tag matching logic. Valid values: or, and.

    Import

    Packages PblockFirewallPolicy can be imported using any of these accepted formats:

    Set import_options = [“pblock=YOUR_VALUE”] in the provider section.

    $ export “FORTIMANAGER_IMPORT_TABLE”=“true”

    $ pulumi import fortimanager:index/packagesPblockFirewallPolicy:PackagesPblockFirewallPolicy labelname {{policyid}}

    $ unset “FORTIMANAGER_IMPORT_TABLE”

    -> Hint: The scopetype and adom for import will directly inherit the scopetype and adom configuration of the provider.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    fortimanager fortinetdev/terraform-provider-fortimanager
    License
    Notes
    This Pulumi package is based on the fortimanager Terraform Provider.
    fortimanager logo
    fortimanager 1.13.0 published on Thursday, Mar 13, 2025 by fortinetdev
    fortinetdev/terraform-provider-fortimanager