config firewall policy

CautionEdit firewall policies

config firewall policy → edit <id> → set ...

Creates/edits policies from the CLI — for GUI outages and bulk work. Always re-show the policy afterwards.

Examples

config firewall policy edit 12 set status disable next endTemporarily disable a policy
show firewall policy 12Show policy 12
config firewall policy move 12 before 5 endChange the policy order
diagnose debug flow filter addr 192.168.1.50 diagnose debug flow trace start 10 diagnose debug enableTrace which policy a flow hits

Syntax

config firewall policy → edit <id> → set srcintf/dstintf/srcaddr/dstaddr/service/action → next → end

Key points

Policies are evaluated top down and the first match wins. New policies go to the bottom, so use move to place them.
Set logtraffic all to keep traffic logs for the policy.
Changes take effect immediately. Check the impact before editing during business hours.

When it does not work

Denied by forward policy check (policy 0) in debug flow means no policy matched and the implicit deny dropped it.
Stop the trace with diagnose debug disable.

Before you run it

Mistakes hit traffic instantly.

Related commands

show firewall policyFirewall policies
execute log displayQuery on-box logs

You can carry a laptop to the rack. Signal will not follow.

Check syntax standing in front of the hardware, with no connection at all. The app keeps 1,510 commands and 120 fix flows on your device. Free to install, no ads (some content is a one-time purchase).

Get it free on the App Store