Skip to content
Network as Code

NGFW Security Policy

Configure Next-Generation Firewall (NGFW) policies and profile-level security settings. Use this model to control traffic between zones, inspect selected flows with advanced inspection, and apply shared limits/logging behavior at profile scope.

Classes

Section titled “Classes”

sdwan

Section titled “sdwan”
NameTypeConstraintMandatoryDefault Value
feature_profilesClassfeature_profilesNo

feature_profiles (sdwan)

Section titled “feature_profiles (sdwan)”
NameTypeConstraintMandatoryDefault Value
ngfw_security_profilesListngfw_security_profilesNo

ngfw_security_profiles (sdwan.feature_profiles)

Section titled “ngfw_security_profiles (sdwan.feature_profiles)”
NameTypeConstraintMandatoryDefault Value
policiesListpoliciesNo
settingsClasssettingsNo

policies (sdwan.feature_profiles.ngfw_security_profiles)

Section titled “policies (sdwan.feature_profiles.ngfw_security_profiles)”
NameTypeConstraintMandatoryDefault Value
nameStringRegex: ^[^&<>! "]{1,128}$Yes
default_actionChoicepass, dropYes
sequencesListsequencesNo
source_zoneChoiceself, no_zone, untrustedYes
destination_zonesListChoice[self, no_zone, untrusted]Yes

settings (sdwan.feature_profiles.ngfw_security_profiles)

Section titled “settings (sdwan.feature_profiles.ngfw_security_profiles)”
NameTypeConstraintMandatoryDefault Value
advanced_inspection_profileStringRegex: ^[^&<>! "]{1,128}$No
app_hostingClassapp_hostingNo
audit_trailChoiceonNo
failure_modeChoiceopen, closeNo
high_speed_logging_serversListhigh_speed_logging_serversNo
icmp_unreachable_allowChoiceonNo
max_incomplete_icmp_limitIntegermin: 1, max: 4294967295No
max_incomplete_tcp_limitIntegermin: 1, max: 4294967295No
max_incomplete_udp_limitIntegermin: 1, max: 4294967295No
optimizedBooleantrue, falseNo
session_reclassify_allowChoiceonNo
syslog_server_source_interfaceStringRegex: (ATM|ATM-ACR|AppGigabitEthernet|AppNav-Compress|AppNav-UnCompress|Async|BD-VIF|BDI|CEM|CEM-ACR|Cellular|Dialer|Embedded-Service-Engine|Ethernet|Ethernet-Internal|FastEthernet|FiftyGigabitEthernet|FiveGigabitEthernet|FortyGigabitEthernet|FourHundredGigE|GMPLS|GigabitEthernet|Group-Async|HundredGigE|L2LISP|LISP|Loopback|MFR|Multilink|Port-channel|SM|Serial|Service-Engine|TenGigabitEthernet|Tunnel|TwentyFiveGigE|TwentyFiveGigabitEthernet|TwoGigabitEthernet|TwoHundredGigE|Vif|Virtual-PPP|Virtual-Template|VirtualPortGroup|Vlan|Wlan-GigabitEthernet|nat64|nat66|ntp|nve|ospfv3|overlay|pseudowire|ucse|vasileft|vasiright|vmi)(\w+)((\/\d+)*(\.\d+)?)?No
syslog_server_source_interface_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
tcp_syn_flood_limitIntegermin: 1, max: 4294967295No
unified_loggingChoiceonNo

settings (sdwan.feature_profiles.ngfw_security_profiles)

Section titled “settings (sdwan.feature_profiles.ngfw_security_profiles)”
NameTypeConstraintMandatoryDefault Value
advanced_inspection_profileStringRegex: ^[^&<>! "]{1,128}$No
app_hostingClassapp_hostingNo
audit_trailChoiceonNo
failure_modeChoiceopen, closeNo
icmp_unreachable_allowChoiceonNo
max_incomplete_icmp_limitIntegermin: 1, max: 4294967295No
max_incomplete_tcp_limitIntegermin: 1, max: 4294967295No
max_incomplete_udp_limitIntegermin: 1, max: 4294967295No
session_reclassify_allowChoiceonNo
tcp_syn_flood_limitIntegermin: 1, max: 4294967295No
unified_loggingChoiceonNo

sequences (sdwan.feature_profiles.ngfw_security_profiles.policies)

Section titled “sequences (sdwan.feature_profiles.ngfw_security_profiles.policies)”
NameTypeConstraintMandatoryDefault Value
actionsClassactionsNo
base_actionChoicepass, drop, inspectYes
disable_sequenceBooleantrue, falseNofalse
is_rule_setBooleantrue, falseNo
match_entriesClassmatch_entriesNo
sequence_commentStringNo
sequence_idIntegermin: 1, max: 65534Yes
sequence_ip_typeChoiceipv4, ipv6No
sequence_nameStringRegex: ^[^&<>! "]{1,128}$Yes
sequence_typeChoicengfirewallNongfirewall

sequences (sdwan.feature_profiles.ngfw_security_profiles.policies)

Section titled “sequences (sdwan.feature_profiles.ngfw_security_profiles.policies)”
NameTypeConstraintMandatoryDefault Value
actionsClassactionsNo
base_actionChoicepass, drop, inspectYes
disable_sequenceBooleantrue, falseNofalse
match_entriesClassmatch_entriesNo
sequence_idIntegermin: 1, max: 65534Yes
sequence_nameStringRegex: ^[^&<>! "]{1,128}$Yes
sequence_typeChoicengfirewallNongfirewall

app_hosting (sdwan.feature_profiles.ngfw_security_profiles.settings)

Section titled “app_hosting (sdwan.feature_profiles.ngfw_security_profiles.settings)”
NameTypeConstraintMandatoryDefault Value
download_url_database_on_deviceBooleantrue, falseNo
download_url_database_on_device_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
natBooleantrue, falseNo
nat_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
resource_profileChoicelow, medium, highNo
resource_profile_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No

high_speed_logging_servers (sdwan.feature_profiles.ngfw_security_profiles.settings)

Section titled “high_speed_logging_servers (sdwan.feature_profiles.ngfw_security_profiles.settings)”
NameTypeConstraintMandatoryDefault Value
nameChoiceserver1, server2, server3, server4Yes
source_interfaceStringRegex: (ATM|ATM-ACR|AppGigabitEthernet|AppNav-Compress|AppNav-UnCompress|Async|BD-VIF|BDI|CEM|CEM-ACR|Cellular|Dialer|Embedded-Service-Engine|Ethernet|Ethernet-Internal|FastEthernet|FiftyGigabitEthernet|FiveGigabitEthernet|FortyGigabitEthernet|FourHundredGigE|GMPLS|GigabitEthernet|Group-Async|HundredGigE|L2LISP|LISP|Loopback|MFR|Multilink|Port-channel|SM|Serial|Service-Engine|TenGigabitEthernet|Tunnel|TwentyFiveGigE|TwentyFiveGigabitEthernet|TwoGigabitEthernet|TwoHundredGigE|Vif|Virtual-PPP|Virtual-Template|VirtualPortGroup|Vlan|Wlan-GigabitEthernet|nat64|nat66|ntp|nve|ospfv3|overlay|pseudowire|ucse|vasileft|vasiright|vmi)(\w+)((\/\d+)*(\.\d+)?)?No
source_interface_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No

actions (sdwan.feature_profiles.ngfw_security_profiles.policies.sequences)

Section titled “actions (sdwan.feature_profiles.ngfw_security_profiles.policies.sequences)”
NameTypeConstraintMandatoryDefault Value
advanced_inspection_profileStringRegex: ^[^&<>! "]{1,128}$No
logBooleantrue, falseNo

match_entries (sdwan.feature_profiles.ngfw_security_profiles.policies.sequences)

Section titled “match_entries (sdwan.feature_profiles.ngfw_security_profiles.policies.sequences)”
NameTypeConstraintMandatoryDefault Value
application_listStringRegex: ^[^&<>! "]{1,128}$No
destination_data_ipv4_prefix_listsListString[Regex: ^[^&<>! "]{1,128}$]No
destination_data_ipv4_prefixesListIPNo
destination_data_ipv4_prefixes_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
destination_data_ipv6_prefix_listsListString[Regex: ^[^&<>! "]{1,128}$]No
destination_data_ipv6_prefixesListIPNo
destination_data_ipv6_prefixes_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
destination_fqdn_listsListString[Regex: ^[^&<>! "]{1,128}$]No
destination_fqdnsListString[Regex: ^(?=.{1,120}$)((\*|[a-zA-Z0-9-]{1,63})\.)+([a-zA-Z0-9-]{2,63})$]No
destination_fqdns_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
destination_geo_location_listsListString[Regex: ^[^&<>! "]{1,128}$]No
destination_geo_locationsListChoice[AF, AN, AS, EU, NA, OC, SA, AFG, ALB, ATA, DZA, ASM, AND, AGO, ATG, AZE, ARG, AUS, AUT, BHS, BHR, BGD, ARM, BRB, BEL, BMU, BTN, BOL, BIH, BWA, BVT, BRA, BLZ, IOT, SLB, VGB, BRN, BGR, MMR, BDI, BLR, KHM, CMR, CAN, CPV, CYM, CAF, LKA, TCD, CHL, CHN, TWN, CXR, CCK, COL, COM, MYT, COG, COD, COK, CRI, HRV, CUB, CYP, CZE, BEN, DNK, DMA, DOM, ECU, SLV, GNQ, ETH, ERI, EST, FRO, FLK, SGS, FJI, FIN, ALA, FRA, GUF, PYF, ATF, DJI, GAB, GEO, GMB, PSE, DEU, GHA, GIB, KIR, GRC, GRL, GRD, GLP, GUM, GTM, GIN, GUY, HTI, HMD, VAT, HND, HKG, HUN, ISL, IND, IDN, IRN, IRQ, IRL, ISR, ITA, CIV, JAM, JPN, KAZ, JOR, KEN, PRK, KOR, KWT, KGZ, LAO, LBN, LSO, LVA, LBR, LBY, LIE, LTU, LUX, MAC, MDG, MWI, MYS, MDV, MLI, MLT, MTQ, MRT, MUS, MEX, MCO, MNG, MDA, MNE, MSR, MAR, MOZ, OMN, NAM, NRU, NPL, NLD, ANT, CUW, ABW, SXM, BES, NCL, VUT, NZL, NIC, NER, NGA, NIU, NFK, NOR, MNP, UMI, FSM, MHL, PLW, PAK, PAN, PNG, PRY, PER, PHL, PCN, POL, PRT, GNB, TLS, PRI, QAT, REU, ROU, RUS, RWA, BLM, SHN, KNA, AIA, LCA, MAF, SPM, VCT, SMR, STP, SAU, SEN, SRB, SYC, SLE, SGP, SVK, VNM, SVN, SOM, ZAF, ZWE, ESP, SSD, ESH, SDN, SUR, SJM, SWZ, SWE, CHE, SYR, TJK, THA, TGO, TKL, TON, TTO, ARE, TUN, TUR, TKM, TCA, TUV, UGA, UKR, MKD, EGY, GBR, GGY, JEY, IMN, TZA, USA, VIR, BFA, URY, UZB, VEN, WLF, WSM, YEM, ZMB]No
destination_object_groupStringRegex: ^[^&<>! "]{1,128}$No
destination_port_listsListString[Regex: ^[^&<>! "]{1,128}$]No
destination_portsListInteger[min: 0, max: 65535]No
destination_ports_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
destination_scalable_group_tag_listsListString[Regex: ^[^&<>! "]{1,128}$]No
protocol_name_listsListString[Regex: ^[^&<>! "]{1,128}$]No
protocol_namesListStringNo
protocolsListInteger[min: 0, max: 255]No
rule_set_listsListString[Regex: ^[^&<>! "]{1,128}$]No
source_data_ipv4_prefix_listsListString[Regex: ^[^&<>! "]{1,128}$]No
source_data_ipv4_prefixesListIPNo
source_data_ipv4_prefixes_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
source_data_ipv6_prefix_listsListString[Regex: ^[^&<>! "]{1,128}$]No
source_data_ipv6_prefixesListIPNo
source_data_ipv6_prefixes_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
source_geo_location_listsListString[Regex: ^[^&<>! "]{1,128}$]No
source_geo_locationsListChoice[AF, AN, AS, EU, NA, OC, SA, AFG, ALB, ATA, DZA, ASM, AND, AGO, ATG, AZE, ARG, AUS, AUT, BHS, BHR, BGD, ARM, BRB, BEL, BMU, BTN, BOL, BIH, BWA, BVT, BRA, BLZ, IOT, SLB, VGB, BRN, BGR, MMR, BDI, BLR, KHM, CMR, CAN, CPV, CYM, CAF, LKA, TCD, CHL, CHN, TWN, CXR, CCK, COL, COM, MYT, COG, COD, COK, CRI, HRV, CUB, CYP, CZE, BEN, DNK, DMA, DOM, ECU, SLV, GNQ, ETH, ERI, EST, FRO, FLK, SGS, FJI, FIN, ALA, FRA, GUF, PYF, ATF, DJI, GAB, GEO, GMB, PSE, DEU, GHA, GIB, KIR, GRC, GRL, GRD, GLP, GUM, GTM, GIN, GUY, HTI, HMD, VAT, HND, HKG, HUN, ISL, IND, IDN, IRN, IRQ, IRL, ISR, ITA, CIV, JAM, JPN, KAZ, JOR, KEN, PRK, KOR, KWT, KGZ, LAO, LBN, LSO, LVA, LBR, LBY, LIE, LTU, LUX, MAC, MDG, MWI, MYS, MDV, MLI, MLT, MTQ, MRT, MUS, MEX, MCO, MNG, MDA, MNE, MSR, MAR, MOZ, OMN, NAM, NRU, NPL, NLD, ANT, CUW, ABW, SXM, BES, NCL, VUT, NZL, NIC, NER, NGA, NIU, NFK, NOR, MNP, UMI, FSM, MHL, PLW, PAK, PAN, PNG, PRY, PER, PHL, PCN, POL, PRT, GNB, TLS, PRI, QAT, REU, ROU, RUS, RWA, BLM, SHN, KNA, AIA, LCA, MAF, SPM, VCT, SMR, STP, SAU, SEN, SRB, SYC, SLE, SGP, SVK, VNM, SVN, SOM, ZAF, ZWE, ESP, SSD, ESH, SDN, SUR, SJM, SWZ, SWE, CHE, SYR, TJK, THA, TGO, TKL, TON, TTO, ARE, TUN, TUR, TKM, TCA, TUV, UGA, UKR, MKD, EGY, GBR, GGY, JEY, IMN, TZA, USA, VIR, BFA, URY, UZB, VEN, WLF, WSM, YEM, ZMB]No
source_identity_listsListString[Regex: ^[^&<>! "]{1,128}$]No
source_identity_usergroupsListString[Regex: ^.*[a-zA-Z0-9]+.*$]No
source_identity_usersListString[Regex: ^.*[a-zA-Z0-9]+.*$]No
source_object_groupStringRegex: ^[^&<>! "]{1,128}$No
source_port_listsListString[Regex: ^[^&<>! "]{1,128}$]No
source_portsListInteger[min: 0, max: 65535]No
source_ports_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
source_scalable_group_tag_listsListString[Regex: ^[^&<>! "]{1,128}$]No

match_entries (sdwan.feature_profiles.ngfw_security_profiles.policies.sequences)

Section titled “match_entries (sdwan.feature_profiles.ngfw_security_profiles.policies.sequences)”
NameTypeConstraintMandatoryDefault Value
application_listStringRegex: ^[^&<>! "]{1,128}$No
destination_data_ipv4_prefix_listsListString[Regex: ^[^&<>! "]{1,128}$]No
destination_data_ipv4_prefixesListIPNo
destination_data_ipv4_prefixes_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
destination_fqdn_listsListString[Regex: ^[^&<>! "]{1,128}$]No
destination_fqdnsListString[Regex: ^(?=.{1,120}$)((\*|[a-zA-Z0-9-]{1,63})\.)+([a-zA-Z0-9-]{2,63})$]No
destination_fqdns_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
destination_geo_location_listsListString[Regex: ^[^&<>! "]{1,128}$]No
destination_geo_locationsListChoice[AF, AN, AS, EU, NA, OC, SA, AFG, ALB, ATA, DZA, ASM, AND, AGO, ATG, AZE, ARG, AUS, AUT, BHS, BHR, BGD, ARM, BRB, BEL, BMU, BTN, BOL, BIH, BWA, BVT, BRA, BLZ, IOT, SLB, VGB, BRN, BGR, MMR, BDI, BLR, KHM, CMR, CAN, CPV, CYM, CAF, LKA, TCD, CHL, CHN, TWN, CXR, CCK, COL, COM, MYT, COG, COD, COK, CRI, HRV, CUB, CYP, CZE, BEN, DNK, DMA, DOM, ECU, SLV, GNQ, ETH, ERI, EST, FRO, FLK, SGS, FJI, FIN, ALA, FRA, GUF, PYF, ATF, DJI, GAB, GEO, GMB, PSE, DEU, GHA, GIB, KIR, GRC, GRL, GRD, GLP, GUM, GTM, GIN, GUY, HTI, HMD, VAT, HND, HKG, HUN, ISL, IND, IDN, IRN, IRQ, IRL, ISR, ITA, CIV, JAM, JPN, KAZ, JOR, KEN, PRK, KOR, KWT, KGZ, LAO, LBN, LSO, LVA, LBR, LBY, LIE, LTU, LUX, MAC, MDG, MWI, MYS, MDV, MLI, MLT, MTQ, MRT, MUS, MEX, MCO, MNG, MDA, MNE, MSR, MAR, MOZ, OMN, NAM, NRU, NPL, NLD, ANT, CUW, ABW, SXM, BES, NCL, VUT, NZL, NIC, NER, NGA, NIU, NFK, NOR, MNP, UMI, FSM, MHL, PLW, PAK, PAN, PNG, PRY, PER, PHL, PCN, POL, PRT, GNB, TLS, PRI, QAT, REU, ROU, RUS, RWA, BLM, SHN, KNA, AIA, LCA, MAF, SPM, VCT, SMR, STP, SAU, SEN, SRB, SYC, SLE, SGP, SVK, VNM, SVN, SOM, ZAF, ZWE, ESP, SSD, ESH, SDN, SUR, SJM, SWZ, SWE, CHE, SYR, TJK, THA, TGO, TKL, TON, TTO, ARE, TUN, TUR, TKM, TCA, TUV, UGA, UKR, MKD, EGY, GBR, GGY, JEY, IMN, TZA, USA, VIR, BFA, URY, UZB, VEN, WLF, WSM, YEM, ZMB]No
destination_port_listsListString[Regex: ^[^&<>! "]{1,128}$]No
destination_portsListInteger[min: 0, max: 65535]No
destination_ports_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
destination_scalable_group_tag_listsListString[Regex: ^[^&<>! "]{1,128}$]No
protocol_name_listsListString[Regex: ^[^&<>! "]{1,128}$]No
protocol_namesListStringNo
protocolsListInteger[min: 0, max: 255]No
source_data_ipv4_prefix_listsListString[Regex: ^[^&<>! "]{1,128}$]No
source_data_ipv4_prefixesListIPNo
source_data_ipv4_prefixes_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
source_geo_location_listsListString[Regex: ^[^&<>! "]{1,128}$]No
source_geo_locationsListChoice[AF, AN, AS, EU, NA, OC, SA, AFG, ALB, ATA, DZA, ASM, AND, AGO, ATG, AZE, ARG, AUS, AUT, BHS, BHR, BGD, ARM, BRB, BEL, BMU, BTN, BOL, BIH, BWA, BVT, BRA, BLZ, IOT, SLB, VGB, BRN, BGR, MMR, BDI, BLR, KHM, CMR, CAN, CPV, CYM, CAF, LKA, TCD, CHL, CHN, TWN, CXR, CCK, COL, COM, MYT, COG, COD, COK, CRI, HRV, CUB, CYP, CZE, BEN, DNK, DMA, DOM, ECU, SLV, GNQ, ETH, ERI, EST, FRO, FLK, SGS, FJI, FIN, ALA, FRA, GUF, PYF, ATF, DJI, GAB, GEO, GMB, PSE, DEU, GHA, GIB, KIR, GRC, GRL, GRD, GLP, GUM, GTM, GIN, GUY, HTI, HMD, VAT, HND, HKG, HUN, ISL, IND, IDN, IRN, IRQ, IRL, ISR, ITA, CIV, JAM, JPN, KAZ, JOR, KEN, PRK, KOR, KWT, KGZ, LAO, LBN, LSO, LVA, LBR, LBY, LIE, LTU, LUX, MAC, MDG, MWI, MYS, MDV, MLI, MLT, MTQ, MRT, MUS, MEX, MCO, MNG, MDA, MNE, MSR, MAR, MOZ, OMN, NAM, NRU, NPL, NLD, ANT, CUW, ABW, SXM, BES, NCL, VUT, NZL, NIC, NER, NGA, NIU, NFK, NOR, MNP, UMI, FSM, MHL, PLW, PAK, PAN, PNG, PRY, PER, PHL, PCN, POL, PRT, GNB, TLS, PRI, QAT, REU, ROU, RUS, RWA, BLM, SHN, KNA, AIA, LCA, MAF, SPM, VCT, SMR, STP, SAU, SEN, SRB, SYC, SLE, SGP, SVK, VNM, SVN, SOM, ZAF, ZWE, ESP, SSD, ESH, SDN, SUR, SJM, SWZ, SWE, CHE, SYR, TJK, THA, TGO, TKL, TON, TTO, ARE, TUN, TUR, TKM, TCA, TUV, UGA, UKR, MKD, EGY, GBR, GGY, JEY, IMN, TZA, USA, VIR, BFA, URY, UZB, VEN, WLF, WSM, YEM, ZMB]No
source_identity_listsListString[Regex: ^[^&<>! "]{1,128}$]No
source_identity_usergroupsListString[Regex: ^.*[a-zA-Z0-9]+.*$]No
source_identity_usersListString[Regex: ^.*[a-zA-Z0-9]+.*$]No
source_port_listsListString[Regex: ^[^&<>! "]{1,128}$]No
source_portsListInteger[min: 0, max: 65535]No
source_ports_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
source_scalable_group_tag_listsListString[Regex: ^[^&<>! "]{1,128}$]No

Examples

Section titled “Examples”

Example-1: Securing Guest Network with Internet-Only Access

A retail chain provides guest Wi-Fi at branch locations. Guests must have unrestricted internet access but must never reach the internal corporate network. Employee workstations at the same branch also break out to the internet and require deep inspection of all web and SaaS traffic. Three zones are used: Guest_WiFi (VPN 200), Corporate_LAN (VPN 300), and Internet (untrusted). Guest-to-corporate traffic is explicitly dropped by matching source 10.0.200.0/24 to destination 10.0.100.0/24. Guest internet access is allowed. Employee internet traffic is inspected with an advanced inspection profile that performs IPS on web and approved SaaS destinations. Profile-level settings enforce a SYN flood limit and configure failure mode to close so no traffic bypasses the inspection engine.

sdwan:
  feature_profiles:
    ngfw_security_profiles:
      - name: Branch-NGFW-Profile
        description: Guest isolation and employee internet inspection at branch sites
        policies:
          - name: Guest-To-Corporate-Block
            default_action: drop
            source_zone: Guest_WiFi
            destination_zones:
              - Corporate_LAN
            sequences:
              - sequence_id: 1
                sequence_name: Block-Corporate-Access
                match_entries:
                  source_data_ipv4_prefixes:
                    - 10.0.200.0/24
                  destination_data_ipv4_prefixes:
                    - 10.0.100.0/24
                base_action: drop
          - name: Guest-To-Internet
            default_action: drop
            source_zone: Guest_WiFi
            destination_zones:
              - untrusted
            sequences:
              - sequence_id: 1
                sequence_name: Allow-DNS
                sequence_type: ngfirewall
                match_entries:
                  protocol_names:
                    - dns
                  destination_ports:
                    - 53
                base_action: pass
                actions:
                  log: true
              - sequence_id: 2
                sequence_name: Allow-Internet-Access
                match_entries:
                  source_data_ipv4_prefixes:
                    - 10.0.200.0/24
                  protocols:
                    - 6
                  destination_ports:
                    - 80
                    - 443
                base_action: pass
                actions:
                  log: true


          - name: Employee-To-Internet
            default_action: drop
            source_zone: Corporate_LAN
            destination_zones:
              - untrusted
            sequences:
              - sequence_id: 1
                sequence_name: Allow-DNS
                sequence_type: ngfirewall
                match_entries:
                  protocol_names:
                    - dns
                  destination_ports:
                    - 53
                base_action: pass
                actions:
                  log: true
              - sequence_id: 2
                sequence_name: Inspect-Web-Traffic
                match_entries:
                  protocols:
                    - 6
                  destination_ports:
                    - 80
                    - 443
                base_action: inspect
                actions:
                  log: true
                  advanced_inspection_profile: Branch-AIP-Full
              - sequence_id: 3
                sequence_name: Inspect-SaaS-Apps
                match_entries:
                  application_list: Approved-SaaS-Apps
                  destination_fqdn_lists:
                    - Trusted-SaaS-Domains
                base_action: inspect
                actions:
                  log: true
                  advanced_inspection_profile: Branch-AIP-Full
        settings:
          advanced_inspection_profile: Branch-AIP-Full
          audit_trail: "on"
          failure_mode: close
          tcp_syn_flood_limit: 10000
          max_incomplete_tcp_limit: 1000
          max_incomplete_udp_limit: 500
          unified_logging: "on"
          app_hosting:
            nat: false
            download_url_database_on_device: false
            resource_profile: medium

The example above expects the following policy objects to exist:

sdwan:
  feature_profiles:
    service_profiles:
      - name: Branch-Service-Profile
        lan_vpns:
          - name: guest_wifi_vpn      # referenced by security zone Guest_WiFi
            vpn_id: 200
          - name: corporate_lan_vpn   # referenced by security zone Corporate_LAN
            vpn_id: 300
    policy_object_profile:
      security_zones:
        - name: Guest_WiFi
          vpns:
            - guest_wifi_vpn
        - name: Corporate_LAN
          vpns:
            - corporate_lan_vpn
      security_fqdn_lists:
        - name: Trusted-SaaS-Domains
          fqdns:
            - "*.office365.com"
            - "*.salesforce.com"
            - "*.okta.com"
      security_local_application_lists:
        - name: Approved-SaaS-Apps
          applications:
            - ms-office365
            - salesforce
      security_advanced_inspection_profiles:
        - name: Branch-AIP-Full
          tls_action: never_decrypt
          intrusion_prevention: Branch-IPS-Policy
      security_intrusion_prevention_profiles:
        - name: Branch-IPS-Policy
          inspection_mode: protection
          signature_set: balanced
          alert_log_level: emergency

Example-2: Restricting Remote Access Protocols and Mitigating DDoS Attacks

A large enterprise wants to enhance security by blocking SSH (port 22) and Telnet (port 23) traffic from the internet zone to the internal network (vpn110 → vpn120), as unauthorized access through these protocols poses significant risk. The same deployment is periodically targeted by SYN flood attacks on internet-facing HTTP/HTTPS applications. To address both concerns in a single NGFW profile, SSH and Telnet are explicitly dropped, HTTP/HTTPS traffic is permitted with a SYN flood connection limit, and high-speed logging captures real-time attack data. Profile-level tcp_syn_flood_limit restricts excessive SYN requests before they overwhelm network resources.

sdwan:
  feature_profiles:
    ngfw_security_profiles:
      - name: DDoS-Mitigation-NGFW-Profile
        description: Block remote access protocols and enforce SYN flood protection
        policies:
          - name: vpn110-To-vpn120
            default_action: drop
            source_zone: vpn110
            destination_zones:
              - vpn120
            sequences:
              - sequence_id: 1
                sequence_name: Block-SSH-Telnet
                match_entries:
                  protocols:
                    - 6
                  destination_ports:
                    - 22
                    - 23
                base_action: drop
              - sequence_id: 2
                sequence_name: Allow-HTTP-HTTPS
                match_entries:
                  protocols:
                    - 6
                  destination_ports:
                    - 80
                    - 443
                base_action: pass
                actions:
                  log: true
        settings:
          audit_trail: "on"
          failure_mode: open
          tcp_syn_flood_limit: 100000
          max_incomplete_tcp_limit: 2000
          max_incomplete_udp_limit: 1000
          unified_logging: "on"

The example above expects the following policy objects to exist:

sdwan:
  feature_profiles:
    service_profiles:
      - name: Branch-Service-Profile
        lan_vpns:
          - name: vpn110_lan   # referenced by security zone vpn110
            vpn_id: 110
          - name: vpn120_lan   # referenced by security zone vpn120
            vpn_id: 120
    policy_object_profile:
      security_zones:
        - name: vpn110
          vpns:
            - vpn110_lan
        - name: vpn120
          vpns:
            - vpn120_lan

Example-3: IPv6 Sequences and Logging Settings (SD-WAN Manager 20.18+)

A dual-stack branch needs to block IPv6 traffic from a lab subnet to the corporate IPv6 servers while still allowing IPv4 web traffic between the same zones. Security events must be exported through high-speed logging and syslog from specific source interfaces.

  • sequence_ip_type selects the IP family of a sequence (default ipv4). IPv4 match entries (*_data_ipv4_*) are only accepted in ipv4 sequences, IPv6 match entries (*_data_ipv6_*) only in ipv6 sequences.
  • sequence_comment, sequence_ip_type, the inline/variable IPv6 prefix match entries, as well as settings.high_speed_logging_servers, settings.syslog_server_source_interface and settings.optimized require manager_version 20.18 or higher.
  • source_data_ipv6_prefix_lists and destination_data_ipv6_prefix_lists require manager_version 20.18.2 or higher.
sdwan:
  manager_version: "20.18.2"
  feature_profiles:
    ngfw_security_profiles:
      - name: DualStack-NGFW-Profile
        description: IPv6 isolation and logging settings
        policies:
          - name: Lab-To-Corporate
            default_action: drop
            source_zone: Lab
            destination_zones:
              - Corporate_LAN
            sequences:
              - sequence_id: 1
                sequence_name: Block-Lab-IPv6
                sequence_comment: Lab IPv6 subnet must not reach corporate servers
                sequence_ip_type: ipv6
                match_entries:
                  source_data_ipv6_prefixes:
                    - 2001:db8:10::/48
                  destination_data_ipv6_prefix_lists:
                    - Corporate-IPv6-Servers
                base_action: drop
                actions:
                  log: true
              - sequence_id: 2
                sequence_name: Allow-Lab-Web-IPv4
                sequence_ip_type: ipv4
                match_entries:
                  source_data_ipv4_prefixes:
                    - 10.0.40.0/24
                  protocols:
                    - 6
                  destination_ports:
                    - 80
                    - 443
                base_action: pass
                actions:
                  log: true
        settings:
          failure_mode: close
          audit_trail: "on"
          unified_logging: "on"
          optimized: false
          syslog_server_source_interface: Loopback0
          high_speed_logging_servers:
            - name: server1
              source_interface: GigabitEthernet1
            - name: server2
              source_interface_variable: hsl_server2_source_interface

The example above expects the following policy objects to exist:

sdwan:
  feature_profiles:
    service_profiles:
      - name: Branch-Service-Profile
        lan_vpns:
          - name: lab_vpn             # referenced by security zone Lab
            vpn_id: 400
          - name: corporate_lan_vpn   # referenced by security zone Corporate_LAN
            vpn_id: 300
    policy_object_profile:
      security_zones:
        - name: Lab
          vpns:
            - lab_vpn
        - name: Corporate_LAN
          vpns:
            - corporate_lan_vpn
      security_data_ipv6_prefix_lists:
        - name: Corporate-IPv6-Servers
          prefixes:
            - 2001:db8:100::/48

Example-4: Reusing Security Object Groups and Rule Sets (SD-WAN Manager 20.18.2+)

Use Object Group names to match the source and destination. To reuse a Security Rule Set, set is_rule_set: true and provide its name under rule_set_lists. The referenced Object Groups and Rule Sets must exist in the same policy_object_profile.

sdwan:
  manager_version: "20.18.2"
  feature_profiles:
    ngfw_security_profiles:
      - name: Branch-NGFW-Profile
        policies:
          - name: Branch-Object-Group-and-Rule-Set-Policy
            default_action: drop
            source_zone: no_zone
            destination_zones:
              - untrusted
            sequences:
              - sequence_id: 1
                sequence_name: Allow-Selected-Groups
                sequence_ip_type: ipv4
                match_entries:
                  source_object_group: Branch-Clients
                  destination_object_group: Internal-Services
                base_action: pass
              - sequence_id: 2
                sequence_name: Allow-Reusable-HTTPS
                sequence_comment: Apply the reusable HTTPS rule set
                disable_sequence: false
                is_rule_set: true
                match_entries:
                  rule_set_lists:
                    - HTTPS-Rule-Set
                base_action: pass
                actions:
                  log: true
    policy_object_profile:
      name: Branch-Policy-Objects
      security_object_groups:
        - name: Branch-Clients
          ip_type: ipv4
          data_ipv4_prefixes:
            - 10.20.10.0/24
        - name: Internal-Services
          ip_type: ipv4
          data_ipv4_prefixes:
            - 10.30.0.0/24
      security_rule_sets:
        - name: HTTPS-Rule-Set
          rules:
            - sequence_id: 1
              ip_type: ipv4
              protocols:
                - 6
              destination_ports:
                - 443

Examples

Section titled “Examples”

Example-1: Securing Guest Network with Internet-Only Access

A retail chain provides guest Wi-Fi at branch locations. Guests must have unrestricted internet access but must never reach the internal corporate network. Employee workstations at the same branch also break out to the internet and require deep inspection of all web and SaaS traffic. Three zones are used: Guest_WiFi (VPN 200), Corporate_LAN (VPN 300), and Internet (untrusted). Guest-to-corporate traffic is explicitly dropped by matching source 10.0.200.0/24 to destination 10.0.100.0/24. Guest internet access is allowed. Employee internet traffic is inspected with an advanced inspection profile that performs IPS on web and approved SaaS destinations. Profile-level settings enforce a SYN flood limit and configure failure mode to close so no traffic bypasses the inspection engine.

sdwan:
  feature_profiles:
    ngfw_security_profiles:
      - name: Branch-NGFW-Profile
        description: Guest isolation and employee internet inspection at branch sites
        policies:
          - name: Guest-To-Corporate-Block
            default_action: drop
            source_zone: Guest_WiFi
            destination_zones:
              - Corporate_LAN
            sequences:
              - sequence_id: 1
                sequence_name: Block-Corporate-Access
                match_entries:
                  source_data_ipv4_prefixes:
                    - 10.0.200.0/24
                  destination_data_ipv4_prefixes:
                    - 10.0.100.0/24
                base_action: drop
          - name: Guest-To-Internet
            default_action: drop
            source_zone: Guest_WiFi
            destination_zones:
              - untrusted
            sequences:
              - sequence_id: 1
                sequence_name: Allow-DNS
                sequence_type: ngfirewall
                match_entries:
                  protocol_names:
                    - dns
                  destination_ports:
                    - 53
                base_action: pass
                actions:
                  log: true
              - sequence_id: 2
                sequence_name: Allow-Internet-Access
                match_entries:
                  source_data_ipv4_prefixes:
                    - 10.0.200.0/24
                  protocols:
                    - 6
                  destination_ports:
                    - 80
                    - 443
                base_action: pass
                actions:
                  log: true


          - name: Employee-To-Internet
            default_action: drop
            source_zone: Corporate_LAN
            destination_zones:
              - untrusted
            sequences:
              - sequence_id: 1
                sequence_name: Allow-DNS
                sequence_type: ngfirewall
                match_entries:
                  protocol_names:
                    - dns
                  destination_ports:
                    - 53
                base_action: pass
                actions:
                  log: true
              - sequence_id: 2
                sequence_name: Inspect-Web-Traffic
                match_entries:
                  protocols:
                    - 6
                  destination_ports:
                    - 80
                    - 443
                base_action: inspect
                actions:
                  log: true
                  advanced_inspection_profile: Branch-AIP-Full
              - sequence_id: 3
                sequence_name: Inspect-SaaS-Apps
                match_entries:
                  application_list: Approved-SaaS-Apps
                  destination_fqdn_lists:
                    - Trusted-SaaS-Domains
                base_action: inspect
                actions:
                  log: true
                  advanced_inspection_profile: Branch-AIP-Full
        settings:
          advanced_inspection_profile: Branch-AIP-Full
          audit_trail: "on"
          failure_mode: close
          tcp_syn_flood_limit: 10000
          max_incomplete_tcp_limit: 1000
          max_incomplete_udp_limit: 500
          unified_logging: "on"
          app_hosting:
            nat: false
            download_url_database_on_device: false
            resource_profile: medium

The example above expects the following policy objects to exist:

sdwan:
  feature_profiles:
    service_profiles:
      - name: Branch-Service-Profile
        lan_vpns:
          - name: guest_wifi_vpn      # referenced by security zone Guest_WiFi
            vpn_id: 200
          - name: corporate_lan_vpn   # referenced by security zone Corporate_LAN
            vpn_id: 300
    policy_object_profile:
      security_zones:
        - name: Guest_WiFi
          vpns:
            - guest_wifi_vpn
        - name: Corporate_LAN
          vpns:
            - corporate_lan_vpn
      security_fqdn_lists:
        - name: Trusted-SaaS-Domains
          fqdns:
            - "*.office365.com"
            - "*.salesforce.com"
            - "*.okta.com"
      security_local_application_lists:
        - name: Approved-SaaS-Apps
          applications:
            - ms-office365
            - salesforce
      security_advanced_inspection_profiles:
        - name: Branch-AIP-Full
          tls_action: never_decrypt
          intrusion_prevention: Branch-IPS-Policy
      security_intrusion_prevention_profiles:
        - name: Branch-IPS-Policy
          inspection_mode: protection
          signature_set: balanced
          alert_log_level: emergency

Example-2: Restricting Remote Access Protocols and Mitigating DDoS Attacks

A large enterprise wants to enhance security by blocking SSH (port 22) and Telnet (port 23) traffic from the internet zone to the internal network (vpn110 → vpn120), as unauthorized access through these protocols poses significant risk. The same deployment is periodically targeted by SYN flood attacks on internet-facing HTTP/HTTPS applications. To address both concerns in a single NGFW profile, SSH and Telnet are explicitly dropped, HTTP/HTTPS traffic is permitted with a SYN flood connection limit, and high-speed logging captures real-time attack data. Profile-level tcp_syn_flood_limit restricts excessive SYN requests before they overwhelm network resources.

sdwan:
  feature_profiles:
    ngfw_security_profiles:
      - name: DDoS-Mitigation-NGFW-Profile
        description: Block remote access protocols and enforce SYN flood protection
        policies:
          - name: vpn110-To-vpn120
            default_action: drop
            source_zone: vpn110
            destination_zones:
              - vpn120
            sequences:
              - sequence_id: 1
                sequence_name: Block-SSH-Telnet
                match_entries:
                  protocols:
                    - 6
                  destination_ports:
                    - 22
                    - 23
                base_action: drop
              - sequence_id: 2
                sequence_name: Allow-HTTP-HTTPS
                match_entries:
                  protocols:
                    - 6
                  destination_ports:
                    - 80
                    - 443
                base_action: pass
                actions:
                  log: true
        settings:
          audit_trail: "on"
          failure_mode: open
          tcp_syn_flood_limit: 100000
          max_incomplete_tcp_limit: 2000
          max_incomplete_udp_limit: 1000
          unified_logging: "on"

The example above expects the following policy objects to exist:

sdwan:
  feature_profiles:
    service_profiles:
      - name: Branch-Service-Profile
        lan_vpns:
          - name: vpn110_lan   # referenced by security zone vpn110
            vpn_id: 110
          - name: vpn120_lan   # referenced by security zone vpn120
            vpn_id: 120
    policy_object_profile:
      security_zones:
        - name: vpn110
          vpns:
            - vpn110_lan
        - name: vpn120
          vpns:
            - vpn120_lan