Skip to content
Network as Code

Access Policy

Location in GUI: Policies » Access Control

This resource covers Access Control Policy, Access Control Policy Rules and Access Control Policy Categories.

Diagram

Diagram

Classes

policies (fmc.domains)

NameTypeConstraintMandatoryDefault Value
access_policiesList[access_policies]No

access_policies (fmc.domains.policies)

NameTypeConstraintMandatoryDefault Value
nameStringRegex: ^[a-zA-Z0-9_ -]{1,64}$Yes
default_actionChoiceBLOCK, TRUST, PERMIT, NETWORK_DISCOVERY, INHERIT_FROM_PARENTYesBLOCK
prefilter_policyStringNo
base_intrusion_policyStringNo
log_beginBooleantrue, falseNofalse
log_endBooleantrue, falseNofalse
send_events_to_fmcBooleantrue, falseNofalse
enable_syslogBooleantrue, falseNofalse
snmp_alertStringNo
syslog_alertStringNo
syslog_severityChoiceALERT, CRIT, DEBUG, EMERG, ERR, INFO, NOTICE, WARNINGNo
descriptionStringmax: 255No
categoriesList[categories]No
access_rulesList[access_rules]No

categories (fmc.domains.policies.access_policies)

NameTypeConstraintMandatoryDefault Value
nameStringRegex: ^[a-zA-Z0-9_ -]{1,50}$Yes
sectionChoicemandatory, defaultNo

access_rules (fmc.domains.policies.access_policies)

NameTypeConstraintMandatoryDefault Value
nameStringRegex: ^[a-zA-Z0-9_ -]{1,50}$Yes
actionChoiceALLOW, TRUST, BLOCK, MONITOR, BLOCK_RESET, BLOCK_INTERACTIVE, BLOCK_RESET_INTERACTIVEYes
categoryStringNo
descriptionStringmax: 255No
destination_dynamic_objectsListStringNo
destination_network_literalsListStringNo
destination_network_objectsListStringNo
destination_port_literalsList[destination_port_literals]No
destination_port_objectsListStringNo
destination_zonesListStringNo
enabledBooleantrue, falseNotrue
file_policyStringNo
intrusion_policyStringNo
log_connection_beginBooleantrue, falseNo
log_connection_endBooleantrue, falseNo
log_filesBooleantrue, falseNo
sectionChoicemandatory, defaultNo
send_events_to_fmcBooleantrue, falseNo
enable_syslogBooleantrue, falseNofalse
snmp_alertStringNo
source_dynamic_objectsListStringNo
source_network_literalsListStringNo
source_network_objectsListStringNo
source_port_literalsList[source_port_literals]No
source_port_objectsListStringNo
source_sgtsListStringNo
source_zonesListStringNo
syslog_alertStringNo
syslog_severityChoiceALERT, CRIT, DEBUG, EMERG, ERR, INFO, NOTICE, WARNINGNo
url_categoriesList[url_categories]No
url_objectsListStringNo
url_literalsListStringNo
variable_setStringNo
time_rangeStringNo
vlan_tag_objectsListStringNo
vlan_tag_literalsListInteger[min: 1, max: 4095]No

destination_port_literals (fmc.domains.policies.access_policies.access_rules)

NameTypeConstraintMandatoryDefault Value
protocolChoiceTCP, UDP, ICMPYes
portIntegermin: 1, max: 65535No
icmp_typeIntegermin: 0, max: 255No
icmp_codeIntegermin: 0, max: 255No

url_categories (fmc.domains.policies.access_policies.access_rules)

NameTypeConstraintMandatoryDefault Value
categoryChoiceName of categoriesNo
reputationChoiceANY_EXCEPT_UNKNOWN, TRUSTED, FAVORABLE, NEUTRAL, QUESTIONABLE, UNTRUSTED, ANY_AND_UNKNOWN, TRUSTED_AND_UNKNOWN, FAVORABLE_AND_UNKNOWN, NEUTRAL_AND_UNKNOWN, QUESTIONABLE_AND_UNKNOWN, UNTRUSTED_AND_UNKNOWNNo

Examples

Prerequisites:

existing:
  fmc:
    domains:
      - name: Global
        objects:
          file_types:
            - name: PDF
          file_categories:
            - name: PDF files
        policies:
          intrusion_policies:
            - name: Balanced Security and Connectivity
fmc:
  domains:
    - name: Global
      objects:
        hosts:
          - name: MyHostName1
            ip: 10.10.10.10
        networks:
          - name: MyNetworkName1
            prefix: 10.10.10.0/24
        ranges:
          - name: MyRangeName1
            ip_range: 1.1.1.1-1.1.1.2
        network_groups:
          - name: MyNetworkGroupName1
            objects:
              - MyNetworkName1
              - MyHostName1
              - MyRangeName1
        ports:
          - name: MyPortName1
            port: 8080
            protocol: TCP
        icmpv4s:
          - name: MyICMPv4Name1
            icmp_type: 8
        port_groups:
          - name: MyPortGroupName1
            objects:
              - MyPortName1
              - MyICMPv4Name1
        security_zones:
          - name: MySecurityZoneName1
          - name: MySecurityZoneName2
        time_ranges:
          - name: MyTimeRangeName1
            start_time:  "2025-02-13T10:00"
            end_time:  "2025-02-21T20:00"
            recurrences:
              - recurrence_type: DAILY_INTERVAL
                daily_days: [ "MON", "THU" ]
                daily_start_time: "11:00"
                daily_end_time: "13:00"
      policies:
        file_policies:
          - name: MyFilePolicyName1
            file_rules:
              - action: DETECT
                application_protocol: HTTP
                direction_of_transfer: DOWNLOAD
                file_categories:
                  - PDF files
              - action: DETECT
                application_protocol: HTTP
                direction_of_transfer: UPLOAD
                file_types:
                  - PDF
        intrusion_policies:
          - name: MyIntrusionPolicyName1
            inspection_mode: DETECTION
            base_policy: Balanced Security and Connectivity

Access Policy:

fmc:
  domains:
    - name: Global
      policies:
        access_policies:
          - name: MyAccessPolicyName1
            default_action: BLOCK
            prefilter_policy: MyPrefilterPolicyName1
            categories:
              - name: MyCategoryName1
                section: mandatory
            access_rules:
              - name: MyAccessRuleName1
                action: ALLOW
                category: MyCategoryName1
                source_zones:
                  - MySecurityZoneName1
                destination_zones:
                  - MySecurityZoneName2
                source_network_objects:
                  - MyNetworkName1
                destination_network_objects:
                  - MyHostName1
                destination_port_objects:
                  - MyPortName1
                intrusion_policy: Balanced Security and Connectivity
                log_connection_begin: true
                log_connection_end: true
                log_files: false
                send_events_to_fmc: true
                time_range: MyTimeRangeName1
              - name: MyAccessRuleName2
                action: ALLOW
                category: MyCategoryName1
                source_zones:
                  - MySecurityZoneName1
                destination_zones:
                  - MySecurityZoneName1
                source_network_objects:
                  - MyNetworkGroupName1
                destination_network_literals:
                  - 10.20.30.0/24
                destination_port_objects:
                  - MyPortGroupName1
                intrusion_policy: MyIntrusionPolicyName1
                file_policy: MyFilePolicyName1
                log_connection_begin: true
                log_connection_end: true
                log_files: false
                send_events_to_fmc: true