show security policies

From zone

Name of the source zone.

To zone

Name of the destination zone.

Policy

Name of the applicable Policy.

Sequence number

Number of the policy within a given context. For example, three policies that are applicable in a from-zoneA to-zoneB context might be ordered with sequence numbers 1, 2, and 3. Also, in a from-zoneC to-zoneD context, four policies might have sequence numbers 1, 2, 3, and 4.

State

Status of the policy:

• enabled: The policy can be used in the policy lookup process which determines access rights for a packet and the action taken in regard to it.
• disabled: The policy cannot be used in the policy lookup process, and therefore it is not available for access control.

Source addresses

For standard display mode, the names of the source addresses for a policy. Address sets are resolved to their individual names. (In this case, only the names are given, not their IP addresses.)

For detail display mode, the names and corresponding IP addresses of the source addresses for a policy. Address sets are resolved to their individual address name-IP address pairs.

Destination addresses

Name of the destination address (or address set) as it was entered in the destination zone’s address book. A packet’s destination address must match this value for the policy to apply to it.

Applications

Name of a preconfigured or custom application whose type the packet matches, as specified at configuration time.

• IP protocol: The IP protocol used by the application—for example, TCP, UDP, ICMP.
• ALG: If an ALG is associated with the session, the name of the ALG. Otherwise, 0.
• Inactivity timeout: Elapse time without activity after which the application is terminated.
• Source port range: The low-high source port range for the session application.

Destination Address Translation

Status of the destination address translation traffic:

• drop translated— Drop the packets with translated destination address.
• drop untranslated—Drop the packets without translated destination address.

Action or Action-type

• The action taken in regard to a packet that matches the policy's tuples. Actions include the following:
  • permit
  • firewall-authentication
  • tunnel ipsec-vpn vpn-name
  • pair-policy pair-policy-name
  • source-nat pool pool-name
  • pool-set pool-set-name
  • interface
  • destination-nat name
  • deny
  • reject

Index

An internal number associated with the policy.

Session log

Session log entry that indicates whether the at-create and at-close flags were set at configuration time to log session information.

Scheduler name

Name of a preconfigured scheduler whose schedule determines when the policy is active (or inactive) to check an incoming packet to determine how to treat the packet.

Policy statistics

Policy statistics include the following:

• Input bytes—The number of bytes presented for processing by the device.
• Output bytes—The number of bytes actually processed by the device.
• Input packets—The number of packets presented for processing by the device.
• Active sessions—The number of sessions currently present because of access control lookups that used this policy.
• Session deletions—The number of sessions deleted since system startup.
• Policy lookups—Number of times the policy was accessed to check for a match.