show security policies

Name of the source zone.

Name of the destination zone.

Name of the applicable policy.

Description of the applicable policy.

Status of the policy:

• enabled: The policy can be used in the policy lookup process, which determines access rights for a packet and the action taken in regard to it.

• disabled: The policy cannot be used in the policy lookup process, and therefore it is not available for access control.

Internal number associated with the policy.

Number of the policy within a given context. For example, three policies that are applicable in a from-zoneA-to-zoneB context might be ordered with sequence numbers 1, 2, 3. Also, in a from-zoneC-to-zoneD context, four policies might have sequence numbers 1, 2, 3, 4.

For standard display mode, the names of the source addresses for a policy. Address sets are resolved to their individual names.

For detail display mode, the names and corresponding IP addresses of the source addresses for a policy. Address sets are resolved to their individual address name-IP address pairs.

Name of the destination address (or address set) as it was entered in the destination zone’s address book. A packet’s destination address must match this value for the policy to apply to it.

Name of the device identity profile (referred to as end-user-profile in the CLI) that contains attributes, or characteristics of a device. Specification of the device identity profile in the source-end-user-profile field is part of the device identity feature. If a device matches the attributes specified in the profile and other security policy parameters, then the security policy’s action is applied to traffic issuing from the device.

Name of the source address excluded from the policy.

Name of the destination address excluded from the policy.

One or more user roles specified for a policy.

Name of a preconfigured or custom application whose type the packet matches, as specified at configuration time.

• IP protocol: The Internet protocol used by the application—for example, TCP, UDP, ICMP.

• ALG: If an ALG is explicitly associated with the policy, the name of the ALG is displayed. If application-protocol ignore is configured, ignore is displayed. Otherwise, 0 is displayed.

  However, even if this command shows ALG: 0, ALGs might be triggered for packets destined to well-known ports on which ALGs are listening, unless ALGs are explicitly disabled or when application-protocol ignore is not configured for custom applications.

• Inactivity timeout: Elapsed time without activity after which the application is terminated.

• Source port range: The low-high source port range for the session application.

Name of a source identity (user name) added as match criteria

Name of a destination identity (user name) added as match criteria

Application identification-based Layer 7 dynamic applications.

Status of the destination address translation traffic:

• drop translated—Drop the packets with translated destination addresses.

• drop untranslated—Drop the packets without translated destination addresses.

An application firewall includes the following:

• Rule-set—Name of the rule set.

• Rule—Name of the rule.

  • Dynamic applications—Name of the applications.

  • Dynamic application groups—Name of the application groups.

  • Action—The action taken with respect to a packet that matches the application firewall rule set. Actions include the following:

    • permit

    • deny

• Default rule—The default rule applied when the identified application is not specified in any rules of the rule set.

• The action taken for a packet that matches the policy’s tuples. Actions include the following:

  • permit

  • feed

  • firewall-authentication

  • tunnel ipsec-vpn vpn-name

  • pair-policy pair-policy-name

  • source-nat pool pool-name

  • pool-set pool-set-name

  • interface

  • destination-nat name

  • deny

  • reject

  • services-offload

Session log entry that indicates whether the at-create and at-close flags were set at configuration time to log session information.

Name of a preconfigured scheduler whose schedule determines when the policy is active and can be used as a possible match for traffic.

• Input bytes—The total number of bytes presented for processing by the device.

  • Initial direction—The number of bytes presented for processing by the device from the initial direction.

  • Reply direction—The number of bytes presented for processing by the device from the reply direction.

• Output bytes—The total number of bytes actually processed by the device.

  • Initial direction—The number of bytes from the initial direction actually processed by the device.

  • Reply direction—The number of bytes from the reply direction actually processed by the device.

• Input packets—The total number of packets presented for processing by the device.

  • Initial direction—The number of packets presented for processing by the device from the initial direction.

  • Reply direction—The number of packets presented for processing by the device from the reply direction.

• Output packets—The total number of packets actually processed by the device.

  • Initial direction—The number of packets actually processed by the device from the initial direction.

  • Reply direction—The number of packets actually processed by the device from the reply direction.

• Session rate—The total number of active and deleted sessions.

• Active sessions—The number of sessions currently present because of access control lookups that used this policy.

• Session deletions—The number of sessions deleted since system startup.

• Policy lookups—The number of times the policy was accessed to check for a match.

Displays unified policy redirect profile. See profile(dynamic-application).

Configured syn and sequence checks, and the configured TCP MSS value for the initial direction, the reverse direction or, both.

Feeds details added in the security policy. The supported feeds are:

• add-source-ip-to-feed
• add-destination-ip-to-feed
• add-source-identity-to-feed
• add-destination-identity-to-feed