// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Threading.Tasks;
using Pulumi.Serialization;
using Pulumi;

namespace Pulumiverse.Fortios
{
    /// <summary>
    /// Configure NGFW IPv4/IPv6 application policies. Applies to FortiOS Version `&gt;= 6.2.4`.
    /// 
    /// ## Example Usage
    /// 
    /// ```csharp
    /// using System.Collections.Generic;
    /// using System.Linq;
    /// using Pulumi;
    /// using Fortios = Pulumiverse.Fortios;
    /// 
    /// return await Deployment.RunAsync(() =&gt; 
    /// {
    ///     var trname = new Fortios.FirewallSecuritypolicy("trname", new()
    ///     {
    ///         Action = "accept",
    ///         Dstaddrs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallSecuritypolicyDstaddrArgs
    ///             {
    ///                 Name = "all",
    ///             },
    ///         },
    ///         Dstintfs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallSecuritypolicyDstintfArgs
    ///             {
    ///                 Name = "port4",
    ///             },
    ///         },
    ///         Logtraffic = "utm",
    ///         Policyid = 1,
    ///         ProfileProtocolOptions = "default",
    ///         ProfileType = "single",
    ///         Schedule = "always",
    ///         Srcaddrs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallSecuritypolicySrcaddrArgs
    ///             {
    ///                 Name = "all",
    ///             },
    ///         },
    ///         Srcintfs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallSecuritypolicySrcintfArgs
    ///             {
    ///                 Name = "port2",
    ///             },
    ///         },
    ///         Status = "enable",
    ///     });
    /// 
    /// });
    /// ```
    /// 
    /// ## Import
    /// 
    /// Firewall SecurityPolicy can be imported using any of these accepted formats
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/firewallSecuritypolicy:FirewallSecuritypolicy labelname {{policyid}}
    /// ```
    /// 
    ///  If you do not want to import arguments of block$ export "FORTIOS_IMPORT_TABLE"="false"
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/firewallSecuritypolicy:FirewallSecuritypolicy labelname {{policyid}}
    /// ```
    /// 
    ///  $ unset "FORTIOS_IMPORT_TABLE"
    /// </summary>
    [FortiosResourceType("fortios:index/firewallSecuritypolicy:FirewallSecuritypolicy")]
    public partial class FirewallSecuritypolicy : global::Pulumi.CustomResource
    {
        /// <summary>
        /// Policy action (accept/deny). Valid values: `accept`, `deny`.
        /// </summary>
        [Output("action")]
        public Output<string> Action { get; private set; } = null!;

        /// <summary>
        /// Application category ID list. The structure of `app_category` block is documented below.
        /// </summary>
        [Output("appCategories")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyAppCategory>> AppCategories { get; private set; } = null!;

        /// <summary>
        /// Application group names. The structure of `app_group` block is documented below.
        /// </summary>
        [Output("appGroups")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyAppGroup>> AppGroups { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Application list.
        /// </summary>
        [Output("applicationList")]
        public Output<string> ApplicationList { get; private set; } = null!;

        /// <summary>
        /// Application ID list. The structure of `application` block is documented below.
        /// </summary>
        [Output("applications")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyApplication>> Applications { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Antivirus profile.
        /// </summary>
        [Output("avProfile")]
        public Output<string> AvProfile { get; private set; } = null!;

        /// <summary>
        /// Name of an existing CIFS profile.
        /// </summary>
        [Output("cifsProfile")]
        public Output<string> CifsProfile { get; private set; } = null!;

        /// <summary>
        /// Comment.
        /// </summary>
        [Output("comments")]
        public Output<string?> Comments { get; private set; } = null!;

        /// <summary>
        /// Name of an existing DLP profile.
        /// </summary>
        [Output("dlpProfile")]
        public Output<string> DlpProfile { get; private set; } = null!;

        /// <summary>
        /// Name of an existing DLP sensor.
        /// </summary>
        [Output("dlpSensor")]
        public Output<string> DlpSensor { get; private set; } = null!;

        /// <summary>
        /// Name of an existing DNS filter profile.
        /// </summary>
        [Output("dnsfilterProfile")]
        public Output<string> DnsfilterProfile { get; private set; } = null!;

        /// <summary>
        /// Destination IPv4 address name and address group names. The structure of `dstaddr4` block is documented below.
        /// </summary>
        [Output("dstaddr4s")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyDstaddr4>> Dstaddr4s { get; private set; } = null!;

        /// <summary>
        /// Destination IPv6 address name and address group names. The structure of `dstaddr6` block is documented below.
        /// </summary>
        [Output("dstaddr6s")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyDstaddr6>> Dstaddr6s { get; private set; } = null!;

        /// <summary>
        /// When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dstaddrNegate")]
        public Output<string> DstaddrNegate { get; private set; } = null!;

        /// <summary>
        /// Destination IPv4 address name and address group names. The structure of `dstaddr` block is documented below.
        /// </summary>
        [Output("dstaddrs")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyDstaddr>> Dstaddrs { get; private set; } = null!;

        /// <summary>
        /// Outgoing (egress) interface. The structure of `dstintf` block is documented below.
        /// </summary>
        [Output("dstintfs")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyDstintf>> Dstintfs { get; private set; } = null!;

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Output("dynamicSortSubtable")]
        public Output<string?> DynamicSortSubtable { get; private set; } = null!;

        /// <summary>
        /// Name of an existing email filter profile.
        /// </summary>
        [Output("emailfilterProfile")]
        public Output<string> EmailfilterProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable default application port enforcement for allowed applications. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("enforceDefaultAppPort")]
        public Output<string> EnforceDefaultAppPort { get; private set; } = null!;

        /// <summary>
        /// Name of an existing file-filter profile.
        /// </summary>
        [Output("fileFilterProfile")]
        public Output<string> FileFilterProfile { get; private set; } = null!;

        /// <summary>
        /// Names of FSSO groups. The structure of `fsso_groups` block is documented below.
        /// </summary>
        [Output("fssoGroups")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyFssoGroup>> FssoGroups { get; private set; } = null!;

        /// <summary>
        /// Names of user groups that can authenticate with this policy. The structure of `groups` block is documented below.
        /// </summary>
        [Output("groups")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyGroup>> Groups { get; private set; } = null!;

        /// <summary>
        /// Name of an existing ICAP profile.
        /// </summary>
        [Output("icapProfile")]
        public Output<string> IcapProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetService")]
        public Output<string> InternetService { get; private set; } = null!;

        /// <summary>
        /// Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address, service and default application port enforcement are not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetService6")]
        public Output<string> InternetService6 { get; private set; } = null!;

        /// <summary>
        /// Custom IPv6 Internet Service group name. The structure of `internet_service6_custom_group` block is documented below.
        /// </summary>
        [Output("internetService6CustomGroups")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetService6CustomGroup>> InternetService6CustomGroups { get; private set; } = null!;

        /// <summary>
        /// Custom IPv6 Internet Service name. The structure of `internet_service6_custom` block is documented below.
        /// </summary>
        [Output("internetService6Customs")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetService6Custom>> InternetService6Customs { get; private set; } = null!;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service6_group` block is documented below.
        /// </summary>
        [Output("internetService6Groups")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetService6Group>> InternetService6Groups { get; private set; } = null!;

        /// <summary>
        /// IPv6 Internet Service name. The structure of `internet_service6_name` block is documented below.
        /// </summary>
        [Output("internetService6Names")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetService6Name>> InternetService6Names { get; private set; } = null!;

        /// <summary>
        /// When enabled internet-service6 specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetService6Negate")]
        public Output<string> InternetService6Negate { get; private set; } = null!;

        /// <summary>
        /// Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetService6Src")]
        public Output<string> InternetService6Src { get; private set; } = null!;

        /// <summary>
        /// Custom Internet Service6 source group name. The structure of `internet_service6_src_custom_group` block is documented below.
        /// </summary>
        [Output("internetService6SrcCustomGroups")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetService6SrcCustomGroup>> InternetService6SrcCustomGroups { get; private set; } = null!;

        /// <summary>
        /// Custom IPv6 Internet Service source name. The structure of `internet_service6_src_custom` block is documented below.
        /// </summary>
        [Output("internetService6SrcCustoms")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetService6SrcCustom>> InternetService6SrcCustoms { get; private set; } = null!;

        /// <summary>
        /// Internet Service6 source group name. The structure of `internet_service6_src_group` block is documented below.
        /// </summary>
        [Output("internetService6SrcGroups")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetService6SrcGroup>> InternetService6SrcGroups { get; private set; } = null!;

        /// <summary>
        /// IPv6 Internet Service source name. The structure of `internet_service6_src_name` block is documented below.
        /// </summary>
        [Output("internetService6SrcNames")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetService6SrcName>> InternetService6SrcNames { get; private set; } = null!;

        /// <summary>
        /// When enabled internet-service6-src specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetService6SrcNegate")]
        public Output<string> InternetService6SrcNegate { get; private set; } = null!;

        /// <summary>
        /// Custom Internet Service group name. The structure of `internet_service_custom_group` block is documented below.
        /// </summary>
        [Output("internetServiceCustomGroups")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetServiceCustomGroup>> InternetServiceCustomGroups { get; private set; } = null!;

        /// <summary>
        /// Custom Internet Service name. The structure of `internet_service_custom` block is documented below.
        /// </summary>
        [Output("internetServiceCustoms")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetServiceCustom>> InternetServiceCustoms { get; private set; } = null!;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service_group` block is documented below.
        /// </summary>
        [Output("internetServiceGroups")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetServiceGroup>> InternetServiceGroups { get; private set; } = null!;

        /// <summary>
        /// Internet Service ID. The structure of `internet_service_id` block is documented below.
        /// </summary>
        [Output("internetServiceIds")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetServiceId>> InternetServiceIds { get; private set; } = null!;

        /// <summary>
        /// Internet Service name. The structure of `internet_service_name` block is documented below.
        /// </summary>
        [Output("internetServiceNames")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetServiceName>> InternetServiceNames { get; private set; } = null!;

        /// <summary>
        /// When enabled internet-service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetServiceNegate")]
        public Output<string> InternetServiceNegate { get; private set; } = null!;

        /// <summary>
        /// Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetServiceSrc")]
        public Output<string> InternetServiceSrc { get; private set; } = null!;

        /// <summary>
        /// Custom Internet Service source group name. The structure of `internet_service_src_custom_group` block is documented below.
        /// </summary>
        [Output("internetServiceSrcCustomGroups")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetServiceSrcCustomGroup>> InternetServiceSrcCustomGroups { get; private set; } = null!;

        /// <summary>
        /// Custom Internet Service source name. The structure of `internet_service_src_custom` block is documented below.
        /// </summary>
        [Output("internetServiceSrcCustoms")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetServiceSrcCustom>> InternetServiceSrcCustoms { get; private set; } = null!;

        /// <summary>
        /// Internet Service source group name. The structure of `internet_service_src_group` block is documented below.
        /// </summary>
        [Output("internetServiceSrcGroups")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetServiceSrcGroup>> InternetServiceSrcGroups { get; private set; } = null!;

        /// <summary>
        /// Internet Service source ID. The structure of `internet_service_src_id` block is documented below.
        /// </summary>
        [Output("internetServiceSrcIds")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetServiceSrcId>> InternetServiceSrcIds { get; private set; } = null!;

        /// <summary>
        /// Internet Service source name. The structure of `internet_service_src_name` block is documented below.
        /// </summary>
        [Output("internetServiceSrcNames")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyInternetServiceSrcName>> InternetServiceSrcNames { get; private set; } = null!;

        /// <summary>
        /// When enabled internet-service-src specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetServiceSrcNegate")]
        public Output<string> InternetServiceSrcNegate { get; private set; } = null!;

        /// <summary>
        /// Name of an existing IPS sensor.
        /// </summary>
        [Output("ipsSensor")]
        public Output<string> IpsSensor { get; private set; } = null!;

        /// <summary>
        /// Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("learningMode")]
        public Output<string> LearningMode { get; private set; } = null!;

        /// <summary>
        /// Enable or disable logging. Log all sessions or security profile sessions. Valid values: `all`, `utm`, `disable`.
        /// </summary>
        [Output("logtraffic")]
        public Output<string> Logtraffic { get; private set; } = null!;

        /// <summary>
        /// Record logs when a session starts. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("logtrafficStart")]
        public Output<string> LogtrafficStart { get; private set; } = null!;

        /// <summary>
        /// Policy name.
        /// </summary>
        [Output("name")]
        public Output<string> Name { get; private set; } = null!;

        /// <summary>
        /// Enable/disable NAT46. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("nat46")]
        public Output<string> Nat46 { get; private set; } = null!;

        /// <summary>
        /// Enable/disable NAT64. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("nat64")]
        public Output<string> Nat64 { get; private set; } = null!;

        /// <summary>
        /// Policy ID.
        /// </summary>
        [Output("policyid")]
        public Output<int> Policyid { get; private set; } = null!;

        /// <summary>
        /// Name of profile group.
        /// </summary>
        [Output("profileGroup")]
        public Output<string> ProfileGroup { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Protocol options profile.
        /// </summary>
        [Output("profileProtocolOptions")]
        public Output<string> ProfileProtocolOptions { get; private set; } = null!;

        /// <summary>
        /// Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: `single`, `group`.
        /// </summary>
        [Output("profileType")]
        public Output<string> ProfileType { get; private set; } = null!;

        /// <summary>
        /// Schedule name.
        /// </summary>
        [Output("schedule")]
        public Output<string> Schedule { get; private set; } = null!;

        /// <summary>
        /// Name of an existing SCTP filter profile.
        /// </summary>
        [Output("sctpFilterProfile")]
        public Output<string> SctpFilterProfile { get; private set; } = null!;

        /// <summary>
        /// Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: `disable`, `enable`.
        /// </summary>
        [Output("sendDenyPacket")]
        public Output<string> SendDenyPacket { get; private set; } = null!;

        /// <summary>
        /// When enabled service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("serviceNegate")]
        public Output<string> ServiceNegate { get; private set; } = null!;

        /// <summary>
        /// Service and service group names. The structure of `service` block is documented below.
        /// </summary>
        [Output("services")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyService>> Services { get; private set; } = null!;

        /// <summary>
        /// Source IPv4 address name and address group names. The structure of `srcaddr4` block is documented below.
        /// </summary>
        [Output("srcaddr4s")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicySrcaddr4>> Srcaddr4s { get; private set; } = null!;

        /// <summary>
        /// Source IPv6 address name and address group names. The structure of `srcaddr6` block is documented below.
        /// </summary>
        [Output("srcaddr6s")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicySrcaddr6>> Srcaddr6s { get; private set; } = null!;

        /// <summary>
        /// When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("srcaddrNegate")]
        public Output<string> SrcaddrNegate { get; private set; } = null!;

        /// <summary>
        /// Source IPv4 address name and address group names. The structure of `srcaddr` block is documented below.
        /// </summary>
        [Output("srcaddrs")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicySrcaddr>> Srcaddrs { get; private set; } = null!;

        /// <summary>
        /// Incoming (ingress) interface. The structure of `srcintf` block is documented below.
        /// </summary>
        [Output("srcintfs")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicySrcintf>> Srcintfs { get; private set; } = null!;

        /// <summary>
        /// Name of an existing SSH filter profile.
        /// </summary>
        [Output("sshFilterProfile")]
        public Output<string> SshFilterProfile { get; private set; } = null!;

        /// <summary>
        /// Name of an existing SSL SSH profile.
        /// </summary>
        [Output("sslSshProfile")]
        public Output<string> SslSshProfile { get; private set; } = null!;

        /// <summary>
        /// Enable or disable this policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("status")]
        public Output<string> Status { get; private set; } = null!;

        /// <summary>
        /// URL category ID list. The structure of `url_category` block is documented below.
        /// </summary>
        [Output("urlCategories")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyUrlCategory>> UrlCategories { get; private set; } = null!;

        /// <summary>
        /// Names of individual users that can authenticate with this policy. The structure of `users` block is documented below.
        /// </summary>
        [Output("users")]
        public Output<ImmutableArray<Outputs.FirewallSecuritypolicyUser>> Users { get; private set; } = null!;

        /// <summary>
        /// Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
        /// </summary>
        [Output("uuid")]
        public Output<string> Uuid { get; private set; } = null!;

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Output("vdomparam")]
        public Output<string?> Vdomparam { get; private set; } = null!;

        /// <summary>
        /// Name of an existing VideoFilter profile.
        /// </summary>
        [Output("videofilterProfile")]
        public Output<string> VideofilterProfile { get; private set; } = null!;

        /// <summary>
        /// Name of an existing VoIP profile.
        /// </summary>
        [Output("voipProfile")]
        public Output<string> VoipProfile { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Web filter profile.
        /// </summary>
        [Output("webfilterProfile")]
        public Output<string> WebfilterProfile { get; private set; } = null!;


        /// <summary>
        /// Create a FirewallSecuritypolicy resource with the given unique name, arguments, and options.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resource</param>
        /// <param name="args">The arguments used to populate this resource's properties</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public FirewallSecuritypolicy(string name, FirewallSecuritypolicyArgs? args = null, CustomResourceOptions? options = null)
            : base("fortios:index/firewallSecuritypolicy:FirewallSecuritypolicy", name, args ?? new FirewallSecuritypolicyArgs(), MakeResourceOptions(options, ""))
        {
        }

        private FirewallSecuritypolicy(string name, Input<string> id, FirewallSecuritypolicyState? state = null, CustomResourceOptions? options = null)
            : base("fortios:index/firewallSecuritypolicy:FirewallSecuritypolicy", name, state, MakeResourceOptions(options, id))
        {
        }

        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
        {
            var defaultOptions = new CustomResourceOptions
            {
                Version = Utilities.Version,
                PluginDownloadURL = "github://api.github.com/pulumiverse/pulumi-fortios",
            };
            var merged = CustomResourceOptions.Merge(defaultOptions, options);
            // Override the ID if one was specified for consistency with other language SDKs.
            merged.Id = id ?? merged.Id;
            return merged;
        }
        /// <summary>
        /// Get an existing FirewallSecuritypolicy resource's state with the given name, ID, and optional extra
        /// properties used to qualify the lookup.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resulting resource.</param>
        /// <param name="id">The unique provider ID of the resource to lookup.</param>
        /// <param name="state">Any extra arguments used during the lookup.</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public static FirewallSecuritypolicy Get(string name, Input<string> id, FirewallSecuritypolicyState? state = null, CustomResourceOptions? options = null)
        {
            return new FirewallSecuritypolicy(name, id, state, options);
        }
    }

    public sealed class FirewallSecuritypolicyArgs : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// Policy action (accept/deny). Valid values: `accept`, `deny`.
        /// </summary>
        [Input("action")]
        public Input<string>? Action { get; set; }

        [Input("appCategories")]
        private InputList<Inputs.FirewallSecuritypolicyAppCategoryArgs>? _appCategories;

        /// <summary>
        /// Application category ID list. The structure of `app_category` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyAppCategoryArgs> AppCategories
        {
            get => _appCategories ?? (_appCategories = new InputList<Inputs.FirewallSecuritypolicyAppCategoryArgs>());
            set => _appCategories = value;
        }

        [Input("appGroups")]
        private InputList<Inputs.FirewallSecuritypolicyAppGroupArgs>? _appGroups;

        /// <summary>
        /// Application group names. The structure of `app_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyAppGroupArgs> AppGroups
        {
            get => _appGroups ?? (_appGroups = new InputList<Inputs.FirewallSecuritypolicyAppGroupArgs>());
            set => _appGroups = value;
        }

        /// <summary>
        /// Name of an existing Application list.
        /// </summary>
        [Input("applicationList")]
        public Input<string>? ApplicationList { get; set; }

        [Input("applications")]
        private InputList<Inputs.FirewallSecuritypolicyApplicationArgs>? _applications;

        /// <summary>
        /// Application ID list. The structure of `application` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyApplicationArgs> Applications
        {
            get => _applications ?? (_applications = new InputList<Inputs.FirewallSecuritypolicyApplicationArgs>());
            set => _applications = value;
        }

        /// <summary>
        /// Name of an existing Antivirus profile.
        /// </summary>
        [Input("avProfile")]
        public Input<string>? AvProfile { get; set; }

        /// <summary>
        /// Name of an existing CIFS profile.
        /// </summary>
        [Input("cifsProfile")]
        public Input<string>? CifsProfile { get; set; }

        /// <summary>
        /// Comment.
        /// </summary>
        [Input("comments")]
        public Input<string>? Comments { get; set; }

        /// <summary>
        /// Name of an existing DLP profile.
        /// </summary>
        [Input("dlpProfile")]
        public Input<string>? DlpProfile { get; set; }

        /// <summary>
        /// Name of an existing DLP sensor.
        /// </summary>
        [Input("dlpSensor")]
        public Input<string>? DlpSensor { get; set; }

        /// <summary>
        /// Name of an existing DNS filter profile.
        /// </summary>
        [Input("dnsfilterProfile")]
        public Input<string>? DnsfilterProfile { get; set; }

        [Input("dstaddr4s")]
        private InputList<Inputs.FirewallSecuritypolicyDstaddr4Args>? _dstaddr4s;

        /// <summary>
        /// Destination IPv4 address name and address group names. The structure of `dstaddr4` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyDstaddr4Args> Dstaddr4s
        {
            get => _dstaddr4s ?? (_dstaddr4s = new InputList<Inputs.FirewallSecuritypolicyDstaddr4Args>());
            set => _dstaddr4s = value;
        }

        [Input("dstaddr6s")]
        private InputList<Inputs.FirewallSecuritypolicyDstaddr6Args>? _dstaddr6s;

        /// <summary>
        /// Destination IPv6 address name and address group names. The structure of `dstaddr6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyDstaddr6Args> Dstaddr6s
        {
            get => _dstaddr6s ?? (_dstaddr6s = new InputList<Inputs.FirewallSecuritypolicyDstaddr6Args>());
            set => _dstaddr6s = value;
        }

        /// <summary>
        /// When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dstaddrNegate")]
        public Input<string>? DstaddrNegate { get; set; }

        [Input("dstaddrs")]
        private InputList<Inputs.FirewallSecuritypolicyDstaddrArgs>? _dstaddrs;

        /// <summary>
        /// Destination IPv4 address name and address group names. The structure of `dstaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyDstaddrArgs> Dstaddrs
        {
            get => _dstaddrs ?? (_dstaddrs = new InputList<Inputs.FirewallSecuritypolicyDstaddrArgs>());
            set => _dstaddrs = value;
        }

        [Input("dstintfs")]
        private InputList<Inputs.FirewallSecuritypolicyDstintfArgs>? _dstintfs;

        /// <summary>
        /// Outgoing (egress) interface. The structure of `dstintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyDstintfArgs> Dstintfs
        {
            get => _dstintfs ?? (_dstintfs = new InputList<Inputs.FirewallSecuritypolicyDstintfArgs>());
            set => _dstintfs = value;
        }

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Input("dynamicSortSubtable")]
        public Input<string>? DynamicSortSubtable { get; set; }

        /// <summary>
        /// Name of an existing email filter profile.
        /// </summary>
        [Input("emailfilterProfile")]
        public Input<string>? EmailfilterProfile { get; set; }

        /// <summary>
        /// Enable/disable default application port enforcement for allowed applications. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("enforceDefaultAppPort")]
        public Input<string>? EnforceDefaultAppPort { get; set; }

        /// <summary>
        /// Name of an existing file-filter profile.
        /// </summary>
        [Input("fileFilterProfile")]
        public Input<string>? FileFilterProfile { get; set; }

        [Input("fssoGroups")]
        private InputList<Inputs.FirewallSecuritypolicyFssoGroupArgs>? _fssoGroups;

        /// <summary>
        /// Names of FSSO groups. The structure of `fsso_groups` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyFssoGroupArgs> FssoGroups
        {
            get => _fssoGroups ?? (_fssoGroups = new InputList<Inputs.FirewallSecuritypolicyFssoGroupArgs>());
            set => _fssoGroups = value;
        }

        [Input("groups")]
        private InputList<Inputs.FirewallSecuritypolicyGroupArgs>? _groups;

        /// <summary>
        /// Names of user groups that can authenticate with this policy. The structure of `groups` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyGroupArgs> Groups
        {
            get => _groups ?? (_groups = new InputList<Inputs.FirewallSecuritypolicyGroupArgs>());
            set => _groups = value;
        }

        /// <summary>
        /// Name of an existing ICAP profile.
        /// </summary>
        [Input("icapProfile")]
        public Input<string>? IcapProfile { get; set; }

        /// <summary>
        /// Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService")]
        public Input<string>? InternetService { get; set; }

        /// <summary>
        /// Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address, service and default application port enforcement are not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6")]
        public Input<string>? InternetService6 { get; set; }

        [Input("internetService6CustomGroups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6CustomGroupArgs>? _internetService6CustomGroups;

        /// <summary>
        /// Custom IPv6 Internet Service group name. The structure of `internet_service6_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6CustomGroupArgs> InternetService6CustomGroups
        {
            get => _internetService6CustomGroups ?? (_internetService6CustomGroups = new InputList<Inputs.FirewallSecuritypolicyInternetService6CustomGroupArgs>());
            set => _internetService6CustomGroups = value;
        }

        [Input("internetService6Customs")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6CustomArgs>? _internetService6Customs;

        /// <summary>
        /// Custom IPv6 Internet Service name. The structure of `internet_service6_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6CustomArgs> InternetService6Customs
        {
            get => _internetService6Customs ?? (_internetService6Customs = new InputList<Inputs.FirewallSecuritypolicyInternetService6CustomArgs>());
            set => _internetService6Customs = value;
        }

        [Input("internetService6Groups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6GroupArgs>? _internetService6Groups;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service6_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6GroupArgs> InternetService6Groups
        {
            get => _internetService6Groups ?? (_internetService6Groups = new InputList<Inputs.FirewallSecuritypolicyInternetService6GroupArgs>());
            set => _internetService6Groups = value;
        }

        [Input("internetService6Names")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6NameArgs>? _internetService6Names;

        /// <summary>
        /// IPv6 Internet Service name. The structure of `internet_service6_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6NameArgs> InternetService6Names
        {
            get => _internetService6Names ?? (_internetService6Names = new InputList<Inputs.FirewallSecuritypolicyInternetService6NameArgs>());
            set => _internetService6Names = value;
        }

        /// <summary>
        /// When enabled internet-service6 specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6Negate")]
        public Input<string>? InternetService6Negate { get; set; }

        /// <summary>
        /// Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6Src")]
        public Input<string>? InternetService6Src { get; set; }

        [Input("internetService6SrcCustomGroups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6SrcCustomGroupArgs>? _internetService6SrcCustomGroups;

        /// <summary>
        /// Custom Internet Service6 source group name. The structure of `internet_service6_src_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6SrcCustomGroupArgs> InternetService6SrcCustomGroups
        {
            get => _internetService6SrcCustomGroups ?? (_internetService6SrcCustomGroups = new InputList<Inputs.FirewallSecuritypolicyInternetService6SrcCustomGroupArgs>());
            set => _internetService6SrcCustomGroups = value;
        }

        [Input("internetService6SrcCustoms")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6SrcCustomArgs>? _internetService6SrcCustoms;

        /// <summary>
        /// Custom IPv6 Internet Service source name. The structure of `internet_service6_src_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6SrcCustomArgs> InternetService6SrcCustoms
        {
            get => _internetService6SrcCustoms ?? (_internetService6SrcCustoms = new InputList<Inputs.FirewallSecuritypolicyInternetService6SrcCustomArgs>());
            set => _internetService6SrcCustoms = value;
        }

        [Input("internetService6SrcGroups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6SrcGroupArgs>? _internetService6SrcGroups;

        /// <summary>
        /// Internet Service6 source group name. The structure of `internet_service6_src_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6SrcGroupArgs> InternetService6SrcGroups
        {
            get => _internetService6SrcGroups ?? (_internetService6SrcGroups = new InputList<Inputs.FirewallSecuritypolicyInternetService6SrcGroupArgs>());
            set => _internetService6SrcGroups = value;
        }

        [Input("internetService6SrcNames")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6SrcNameArgs>? _internetService6SrcNames;

        /// <summary>
        /// IPv6 Internet Service source name. The structure of `internet_service6_src_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6SrcNameArgs> InternetService6SrcNames
        {
            get => _internetService6SrcNames ?? (_internetService6SrcNames = new InputList<Inputs.FirewallSecuritypolicyInternetService6SrcNameArgs>());
            set => _internetService6SrcNames = value;
        }

        /// <summary>
        /// When enabled internet-service6-src specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6SrcNegate")]
        public Input<string>? InternetService6SrcNegate { get; set; }

        [Input("internetServiceCustomGroups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceCustomGroupArgs>? _internetServiceCustomGroups;

        /// <summary>
        /// Custom Internet Service group name. The structure of `internet_service_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceCustomGroupArgs> InternetServiceCustomGroups
        {
            get => _internetServiceCustomGroups ?? (_internetServiceCustomGroups = new InputList<Inputs.FirewallSecuritypolicyInternetServiceCustomGroupArgs>());
            set => _internetServiceCustomGroups = value;
        }

        [Input("internetServiceCustoms")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceCustomArgs>? _internetServiceCustoms;

        /// <summary>
        /// Custom Internet Service name. The structure of `internet_service_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceCustomArgs> InternetServiceCustoms
        {
            get => _internetServiceCustoms ?? (_internetServiceCustoms = new InputList<Inputs.FirewallSecuritypolicyInternetServiceCustomArgs>());
            set => _internetServiceCustoms = value;
        }

        [Input("internetServiceGroups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceGroupArgs>? _internetServiceGroups;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceGroupArgs> InternetServiceGroups
        {
            get => _internetServiceGroups ?? (_internetServiceGroups = new InputList<Inputs.FirewallSecuritypolicyInternetServiceGroupArgs>());
            set => _internetServiceGroups = value;
        }

        [Input("internetServiceIds")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceIdArgs>? _internetServiceIds;

        /// <summary>
        /// Internet Service ID. The structure of `internet_service_id` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceIdArgs> InternetServiceIds
        {
            get => _internetServiceIds ?? (_internetServiceIds = new InputList<Inputs.FirewallSecuritypolicyInternetServiceIdArgs>());
            set => _internetServiceIds = value;
        }

        [Input("internetServiceNames")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceNameArgs>? _internetServiceNames;

        /// <summary>
        /// Internet Service name. The structure of `internet_service_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceNameArgs> InternetServiceNames
        {
            get => _internetServiceNames ?? (_internetServiceNames = new InputList<Inputs.FirewallSecuritypolicyInternetServiceNameArgs>());
            set => _internetServiceNames = value;
        }

        /// <summary>
        /// When enabled internet-service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetServiceNegate")]
        public Input<string>? InternetServiceNegate { get; set; }

        /// <summary>
        /// Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetServiceSrc")]
        public Input<string>? InternetServiceSrc { get; set; }

        [Input("internetServiceSrcCustomGroups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcCustomGroupArgs>? _internetServiceSrcCustomGroups;

        /// <summary>
        /// Custom Internet Service source group name. The structure of `internet_service_src_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcCustomGroupArgs> InternetServiceSrcCustomGroups
        {
            get => _internetServiceSrcCustomGroups ?? (_internetServiceSrcCustomGroups = new InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcCustomGroupArgs>());
            set => _internetServiceSrcCustomGroups = value;
        }

        [Input("internetServiceSrcCustoms")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcCustomArgs>? _internetServiceSrcCustoms;

        /// <summary>
        /// Custom Internet Service source name. The structure of `internet_service_src_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcCustomArgs> InternetServiceSrcCustoms
        {
            get => _internetServiceSrcCustoms ?? (_internetServiceSrcCustoms = new InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcCustomArgs>());
            set => _internetServiceSrcCustoms = value;
        }

        [Input("internetServiceSrcGroups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcGroupArgs>? _internetServiceSrcGroups;

        /// <summary>
        /// Internet Service source group name. The structure of `internet_service_src_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcGroupArgs> InternetServiceSrcGroups
        {
            get => _internetServiceSrcGroups ?? (_internetServiceSrcGroups = new InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcGroupArgs>());
            set => _internetServiceSrcGroups = value;
        }

        [Input("internetServiceSrcIds")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcIdArgs>? _internetServiceSrcIds;

        /// <summary>
        /// Internet Service source ID. The structure of `internet_service_src_id` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcIdArgs> InternetServiceSrcIds
        {
            get => _internetServiceSrcIds ?? (_internetServiceSrcIds = new InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcIdArgs>());
            set => _internetServiceSrcIds = value;
        }

        [Input("internetServiceSrcNames")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcNameArgs>? _internetServiceSrcNames;

        /// <summary>
        /// Internet Service source name. The structure of `internet_service_src_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcNameArgs> InternetServiceSrcNames
        {
            get => _internetServiceSrcNames ?? (_internetServiceSrcNames = new InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcNameArgs>());
            set => _internetServiceSrcNames = value;
        }

        /// <summary>
        /// When enabled internet-service-src specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetServiceSrcNegate")]
        public Input<string>? InternetServiceSrcNegate { get; set; }

        /// <summary>
        /// Name of an existing IPS sensor.
        /// </summary>
        [Input("ipsSensor")]
        public Input<string>? IpsSensor { get; set; }

        /// <summary>
        /// Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("learningMode")]
        public Input<string>? LearningMode { get; set; }

        /// <summary>
        /// Enable or disable logging. Log all sessions or security profile sessions. Valid values: `all`, `utm`, `disable`.
        /// </summary>
        [Input("logtraffic")]
        public Input<string>? Logtraffic { get; set; }

        /// <summary>
        /// Record logs when a session starts. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("logtrafficStart")]
        public Input<string>? LogtrafficStart { get; set; }

        /// <summary>
        /// Policy name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// Enable/disable NAT46. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("nat46")]
        public Input<string>? Nat46 { get; set; }

        /// <summary>
        /// Enable/disable NAT64. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("nat64")]
        public Input<string>? Nat64 { get; set; }

        /// <summary>
        /// Policy ID.
        /// </summary>
        [Input("policyid")]
        public Input<int>? Policyid { get; set; }

        /// <summary>
        /// Name of profile group.
        /// </summary>
        [Input("profileGroup")]
        public Input<string>? ProfileGroup { get; set; }

        /// <summary>
        /// Name of an existing Protocol options profile.
        /// </summary>
        [Input("profileProtocolOptions")]
        public Input<string>? ProfileProtocolOptions { get; set; }

        /// <summary>
        /// Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: `single`, `group`.
        /// </summary>
        [Input("profileType")]
        public Input<string>? ProfileType { get; set; }

        /// <summary>
        /// Schedule name.
        /// </summary>
        [Input("schedule")]
        public Input<string>? Schedule { get; set; }

        /// <summary>
        /// Name of an existing SCTP filter profile.
        /// </summary>
        [Input("sctpFilterProfile")]
        public Input<string>? SctpFilterProfile { get; set; }

        /// <summary>
        /// Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("sendDenyPacket")]
        public Input<string>? SendDenyPacket { get; set; }

        /// <summary>
        /// When enabled service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("serviceNegate")]
        public Input<string>? ServiceNegate { get; set; }

        [Input("services")]
        private InputList<Inputs.FirewallSecuritypolicyServiceArgs>? _services;

        /// <summary>
        /// Service and service group names. The structure of `service` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyServiceArgs> Services
        {
            get => _services ?? (_services = new InputList<Inputs.FirewallSecuritypolicyServiceArgs>());
            set => _services = value;
        }

        [Input("srcaddr4s")]
        private InputList<Inputs.FirewallSecuritypolicySrcaddr4Args>? _srcaddr4s;

        /// <summary>
        /// Source IPv4 address name and address group names. The structure of `srcaddr4` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicySrcaddr4Args> Srcaddr4s
        {
            get => _srcaddr4s ?? (_srcaddr4s = new InputList<Inputs.FirewallSecuritypolicySrcaddr4Args>());
            set => _srcaddr4s = value;
        }

        [Input("srcaddr6s")]
        private InputList<Inputs.FirewallSecuritypolicySrcaddr6Args>? _srcaddr6s;

        /// <summary>
        /// Source IPv6 address name and address group names. The structure of `srcaddr6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicySrcaddr6Args> Srcaddr6s
        {
            get => _srcaddr6s ?? (_srcaddr6s = new InputList<Inputs.FirewallSecuritypolicySrcaddr6Args>());
            set => _srcaddr6s = value;
        }

        /// <summary>
        /// When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("srcaddrNegate")]
        public Input<string>? SrcaddrNegate { get; set; }

        [Input("srcaddrs")]
        private InputList<Inputs.FirewallSecuritypolicySrcaddrArgs>? _srcaddrs;

        /// <summary>
        /// Source IPv4 address name and address group names. The structure of `srcaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicySrcaddrArgs> Srcaddrs
        {
            get => _srcaddrs ?? (_srcaddrs = new InputList<Inputs.FirewallSecuritypolicySrcaddrArgs>());
            set => _srcaddrs = value;
        }

        [Input("srcintfs")]
        private InputList<Inputs.FirewallSecuritypolicySrcintfArgs>? _srcintfs;

        /// <summary>
        /// Incoming (ingress) interface. The structure of `srcintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicySrcintfArgs> Srcintfs
        {
            get => _srcintfs ?? (_srcintfs = new InputList<Inputs.FirewallSecuritypolicySrcintfArgs>());
            set => _srcintfs = value;
        }

        /// <summary>
        /// Name of an existing SSH filter profile.
        /// </summary>
        [Input("sshFilterProfile")]
        public Input<string>? SshFilterProfile { get; set; }

        /// <summary>
        /// Name of an existing SSL SSH profile.
        /// </summary>
        [Input("sslSshProfile")]
        public Input<string>? SslSshProfile { get; set; }

        /// <summary>
        /// Enable or disable this policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("status")]
        public Input<string>? Status { get; set; }

        [Input("urlCategories")]
        private InputList<Inputs.FirewallSecuritypolicyUrlCategoryArgs>? _urlCategories;

        /// <summary>
        /// URL category ID list. The structure of `url_category` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyUrlCategoryArgs> UrlCategories
        {
            get => _urlCategories ?? (_urlCategories = new InputList<Inputs.FirewallSecuritypolicyUrlCategoryArgs>());
            set => _urlCategories = value;
        }

        [Input("users")]
        private InputList<Inputs.FirewallSecuritypolicyUserArgs>? _users;

        /// <summary>
        /// Names of individual users that can authenticate with this policy. The structure of `users` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyUserArgs> Users
        {
            get => _users ?? (_users = new InputList<Inputs.FirewallSecuritypolicyUserArgs>());
            set => _users = value;
        }

        /// <summary>
        /// Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
        /// </summary>
        [Input("uuid")]
        public Input<string>? Uuid { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        /// <summary>
        /// Name of an existing VideoFilter profile.
        /// </summary>
        [Input("videofilterProfile")]
        public Input<string>? VideofilterProfile { get; set; }

        /// <summary>
        /// Name of an existing VoIP profile.
        /// </summary>
        [Input("voipProfile")]
        public Input<string>? VoipProfile { get; set; }

        /// <summary>
        /// Name of an existing Web filter profile.
        /// </summary>
        [Input("webfilterProfile")]
        public Input<string>? WebfilterProfile { get; set; }

        public FirewallSecuritypolicyArgs()
        {
        }
        public static new FirewallSecuritypolicyArgs Empty => new FirewallSecuritypolicyArgs();
    }

    public sealed class FirewallSecuritypolicyState : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// Policy action (accept/deny). Valid values: `accept`, `deny`.
        /// </summary>
        [Input("action")]
        public Input<string>? Action { get; set; }

        [Input("appCategories")]
        private InputList<Inputs.FirewallSecuritypolicyAppCategoryGetArgs>? _appCategories;

        /// <summary>
        /// Application category ID list. The structure of `app_category` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyAppCategoryGetArgs> AppCategories
        {
            get => _appCategories ?? (_appCategories = new InputList<Inputs.FirewallSecuritypolicyAppCategoryGetArgs>());
            set => _appCategories = value;
        }

        [Input("appGroups")]
        private InputList<Inputs.FirewallSecuritypolicyAppGroupGetArgs>? _appGroups;

        /// <summary>
        /// Application group names. The structure of `app_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyAppGroupGetArgs> AppGroups
        {
            get => _appGroups ?? (_appGroups = new InputList<Inputs.FirewallSecuritypolicyAppGroupGetArgs>());
            set => _appGroups = value;
        }

        /// <summary>
        /// Name of an existing Application list.
        /// </summary>
        [Input("applicationList")]
        public Input<string>? ApplicationList { get; set; }

        [Input("applications")]
        private InputList<Inputs.FirewallSecuritypolicyApplicationGetArgs>? _applications;

        /// <summary>
        /// Application ID list. The structure of `application` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyApplicationGetArgs> Applications
        {
            get => _applications ?? (_applications = new InputList<Inputs.FirewallSecuritypolicyApplicationGetArgs>());
            set => _applications = value;
        }

        /// <summary>
        /// Name of an existing Antivirus profile.
        /// </summary>
        [Input("avProfile")]
        public Input<string>? AvProfile { get; set; }

        /// <summary>
        /// Name of an existing CIFS profile.
        /// </summary>
        [Input("cifsProfile")]
        public Input<string>? CifsProfile { get; set; }

        /// <summary>
        /// Comment.
        /// </summary>
        [Input("comments")]
        public Input<string>? Comments { get; set; }

        /// <summary>
        /// Name of an existing DLP profile.
        /// </summary>
        [Input("dlpProfile")]
        public Input<string>? DlpProfile { get; set; }

        /// <summary>
        /// Name of an existing DLP sensor.
        /// </summary>
        [Input("dlpSensor")]
        public Input<string>? DlpSensor { get; set; }

        /// <summary>
        /// Name of an existing DNS filter profile.
        /// </summary>
        [Input("dnsfilterProfile")]
        public Input<string>? DnsfilterProfile { get; set; }

        [Input("dstaddr4s")]
        private InputList<Inputs.FirewallSecuritypolicyDstaddr4GetArgs>? _dstaddr4s;

        /// <summary>
        /// Destination IPv4 address name and address group names. The structure of `dstaddr4` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyDstaddr4GetArgs> Dstaddr4s
        {
            get => _dstaddr4s ?? (_dstaddr4s = new InputList<Inputs.FirewallSecuritypolicyDstaddr4GetArgs>());
            set => _dstaddr4s = value;
        }

        [Input("dstaddr6s")]
        private InputList<Inputs.FirewallSecuritypolicyDstaddr6GetArgs>? _dstaddr6s;

        /// <summary>
        /// Destination IPv6 address name and address group names. The structure of `dstaddr6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyDstaddr6GetArgs> Dstaddr6s
        {
            get => _dstaddr6s ?? (_dstaddr6s = new InputList<Inputs.FirewallSecuritypolicyDstaddr6GetArgs>());
            set => _dstaddr6s = value;
        }

        /// <summary>
        /// When enabled dstaddr/dstaddr6 specifies what the destination address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dstaddrNegate")]
        public Input<string>? DstaddrNegate { get; set; }

        [Input("dstaddrs")]
        private InputList<Inputs.FirewallSecuritypolicyDstaddrGetArgs>? _dstaddrs;

        /// <summary>
        /// Destination IPv4 address name and address group names. The structure of `dstaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyDstaddrGetArgs> Dstaddrs
        {
            get => _dstaddrs ?? (_dstaddrs = new InputList<Inputs.FirewallSecuritypolicyDstaddrGetArgs>());
            set => _dstaddrs = value;
        }

        [Input("dstintfs")]
        private InputList<Inputs.FirewallSecuritypolicyDstintfGetArgs>? _dstintfs;

        /// <summary>
        /// Outgoing (egress) interface. The structure of `dstintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyDstintfGetArgs> Dstintfs
        {
            get => _dstintfs ?? (_dstintfs = new InputList<Inputs.FirewallSecuritypolicyDstintfGetArgs>());
            set => _dstintfs = value;
        }

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Input("dynamicSortSubtable")]
        public Input<string>? DynamicSortSubtable { get; set; }

        /// <summary>
        /// Name of an existing email filter profile.
        /// </summary>
        [Input("emailfilterProfile")]
        public Input<string>? EmailfilterProfile { get; set; }

        /// <summary>
        /// Enable/disable default application port enforcement for allowed applications. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("enforceDefaultAppPort")]
        public Input<string>? EnforceDefaultAppPort { get; set; }

        /// <summary>
        /// Name of an existing file-filter profile.
        /// </summary>
        [Input("fileFilterProfile")]
        public Input<string>? FileFilterProfile { get; set; }

        [Input("fssoGroups")]
        private InputList<Inputs.FirewallSecuritypolicyFssoGroupGetArgs>? _fssoGroups;

        /// <summary>
        /// Names of FSSO groups. The structure of `fsso_groups` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyFssoGroupGetArgs> FssoGroups
        {
            get => _fssoGroups ?? (_fssoGroups = new InputList<Inputs.FirewallSecuritypolicyFssoGroupGetArgs>());
            set => _fssoGroups = value;
        }

        [Input("groups")]
        private InputList<Inputs.FirewallSecuritypolicyGroupGetArgs>? _groups;

        /// <summary>
        /// Names of user groups that can authenticate with this policy. The structure of `groups` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyGroupGetArgs> Groups
        {
            get => _groups ?? (_groups = new InputList<Inputs.FirewallSecuritypolicyGroupGetArgs>());
            set => _groups = value;
        }

        /// <summary>
        /// Name of an existing ICAP profile.
        /// </summary>
        [Input("icapProfile")]
        public Input<string>? IcapProfile { get; set; }

        /// <summary>
        /// Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService")]
        public Input<string>? InternetService { get; set; }

        /// <summary>
        /// Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address, service and default application port enforcement are not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6")]
        public Input<string>? InternetService6 { get; set; }

        [Input("internetService6CustomGroups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6CustomGroupGetArgs>? _internetService6CustomGroups;

        /// <summary>
        /// Custom IPv6 Internet Service group name. The structure of `internet_service6_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6CustomGroupGetArgs> InternetService6CustomGroups
        {
            get => _internetService6CustomGroups ?? (_internetService6CustomGroups = new InputList<Inputs.FirewallSecuritypolicyInternetService6CustomGroupGetArgs>());
            set => _internetService6CustomGroups = value;
        }

        [Input("internetService6Customs")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6CustomGetArgs>? _internetService6Customs;

        /// <summary>
        /// Custom IPv6 Internet Service name. The structure of `internet_service6_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6CustomGetArgs> InternetService6Customs
        {
            get => _internetService6Customs ?? (_internetService6Customs = new InputList<Inputs.FirewallSecuritypolicyInternetService6CustomGetArgs>());
            set => _internetService6Customs = value;
        }

        [Input("internetService6Groups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6GroupGetArgs>? _internetService6Groups;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service6_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6GroupGetArgs> InternetService6Groups
        {
            get => _internetService6Groups ?? (_internetService6Groups = new InputList<Inputs.FirewallSecuritypolicyInternetService6GroupGetArgs>());
            set => _internetService6Groups = value;
        }

        [Input("internetService6Names")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6NameGetArgs>? _internetService6Names;

        /// <summary>
        /// IPv6 Internet Service name. The structure of `internet_service6_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6NameGetArgs> InternetService6Names
        {
            get => _internetService6Names ?? (_internetService6Names = new InputList<Inputs.FirewallSecuritypolicyInternetService6NameGetArgs>());
            set => _internetService6Names = value;
        }

        /// <summary>
        /// When enabled internet-service6 specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6Negate")]
        public Input<string>? InternetService6Negate { get; set; }

        /// <summary>
        /// Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6Src")]
        public Input<string>? InternetService6Src { get; set; }

        [Input("internetService6SrcCustomGroups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6SrcCustomGroupGetArgs>? _internetService6SrcCustomGroups;

        /// <summary>
        /// Custom Internet Service6 source group name. The structure of `internet_service6_src_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6SrcCustomGroupGetArgs> InternetService6SrcCustomGroups
        {
            get => _internetService6SrcCustomGroups ?? (_internetService6SrcCustomGroups = new InputList<Inputs.FirewallSecuritypolicyInternetService6SrcCustomGroupGetArgs>());
            set => _internetService6SrcCustomGroups = value;
        }

        [Input("internetService6SrcCustoms")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6SrcCustomGetArgs>? _internetService6SrcCustoms;

        /// <summary>
        /// Custom IPv6 Internet Service source name. The structure of `internet_service6_src_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6SrcCustomGetArgs> InternetService6SrcCustoms
        {
            get => _internetService6SrcCustoms ?? (_internetService6SrcCustoms = new InputList<Inputs.FirewallSecuritypolicyInternetService6SrcCustomGetArgs>());
            set => _internetService6SrcCustoms = value;
        }

        [Input("internetService6SrcGroups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6SrcGroupGetArgs>? _internetService6SrcGroups;

        /// <summary>
        /// Internet Service6 source group name. The structure of `internet_service6_src_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6SrcGroupGetArgs> InternetService6SrcGroups
        {
            get => _internetService6SrcGroups ?? (_internetService6SrcGroups = new InputList<Inputs.FirewallSecuritypolicyInternetService6SrcGroupGetArgs>());
            set => _internetService6SrcGroups = value;
        }

        [Input("internetService6SrcNames")]
        private InputList<Inputs.FirewallSecuritypolicyInternetService6SrcNameGetArgs>? _internetService6SrcNames;

        /// <summary>
        /// IPv6 Internet Service source name. The structure of `internet_service6_src_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetService6SrcNameGetArgs> InternetService6SrcNames
        {
            get => _internetService6SrcNames ?? (_internetService6SrcNames = new InputList<Inputs.FirewallSecuritypolicyInternetService6SrcNameGetArgs>());
            set => _internetService6SrcNames = value;
        }

        /// <summary>
        /// When enabled internet-service6-src specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6SrcNegate")]
        public Input<string>? InternetService6SrcNegate { get; set; }

        [Input("internetServiceCustomGroups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceCustomGroupGetArgs>? _internetServiceCustomGroups;

        /// <summary>
        /// Custom Internet Service group name. The structure of `internet_service_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceCustomGroupGetArgs> InternetServiceCustomGroups
        {
            get => _internetServiceCustomGroups ?? (_internetServiceCustomGroups = new InputList<Inputs.FirewallSecuritypolicyInternetServiceCustomGroupGetArgs>());
            set => _internetServiceCustomGroups = value;
        }

        [Input("internetServiceCustoms")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceCustomGetArgs>? _internetServiceCustoms;

        /// <summary>
        /// Custom Internet Service name. The structure of `internet_service_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceCustomGetArgs> InternetServiceCustoms
        {
            get => _internetServiceCustoms ?? (_internetServiceCustoms = new InputList<Inputs.FirewallSecuritypolicyInternetServiceCustomGetArgs>());
            set => _internetServiceCustoms = value;
        }

        [Input("internetServiceGroups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceGroupGetArgs>? _internetServiceGroups;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceGroupGetArgs> InternetServiceGroups
        {
            get => _internetServiceGroups ?? (_internetServiceGroups = new InputList<Inputs.FirewallSecuritypolicyInternetServiceGroupGetArgs>());
            set => _internetServiceGroups = value;
        }

        [Input("internetServiceIds")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceIdGetArgs>? _internetServiceIds;

        /// <summary>
        /// Internet Service ID. The structure of `internet_service_id` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceIdGetArgs> InternetServiceIds
        {
            get => _internetServiceIds ?? (_internetServiceIds = new InputList<Inputs.FirewallSecuritypolicyInternetServiceIdGetArgs>());
            set => _internetServiceIds = value;
        }

        [Input("internetServiceNames")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceNameGetArgs>? _internetServiceNames;

        /// <summary>
        /// Internet Service name. The structure of `internet_service_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceNameGetArgs> InternetServiceNames
        {
            get => _internetServiceNames ?? (_internetServiceNames = new InputList<Inputs.FirewallSecuritypolicyInternetServiceNameGetArgs>());
            set => _internetServiceNames = value;
        }

        /// <summary>
        /// When enabled internet-service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetServiceNegate")]
        public Input<string>? InternetServiceNegate { get; set; }

        /// <summary>
        /// Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetServiceSrc")]
        public Input<string>? InternetServiceSrc { get; set; }

        [Input("internetServiceSrcCustomGroups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcCustomGroupGetArgs>? _internetServiceSrcCustomGroups;

        /// <summary>
        /// Custom Internet Service source group name. The structure of `internet_service_src_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcCustomGroupGetArgs> InternetServiceSrcCustomGroups
        {
            get => _internetServiceSrcCustomGroups ?? (_internetServiceSrcCustomGroups = new InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcCustomGroupGetArgs>());
            set => _internetServiceSrcCustomGroups = value;
        }

        [Input("internetServiceSrcCustoms")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcCustomGetArgs>? _internetServiceSrcCustoms;

        /// <summary>
        /// Custom Internet Service source name. The structure of `internet_service_src_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcCustomGetArgs> InternetServiceSrcCustoms
        {
            get => _internetServiceSrcCustoms ?? (_internetServiceSrcCustoms = new InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcCustomGetArgs>());
            set => _internetServiceSrcCustoms = value;
        }

        [Input("internetServiceSrcGroups")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcGroupGetArgs>? _internetServiceSrcGroups;

        /// <summary>
        /// Internet Service source group name. The structure of `internet_service_src_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcGroupGetArgs> InternetServiceSrcGroups
        {
            get => _internetServiceSrcGroups ?? (_internetServiceSrcGroups = new InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcGroupGetArgs>());
            set => _internetServiceSrcGroups = value;
        }

        [Input("internetServiceSrcIds")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcIdGetArgs>? _internetServiceSrcIds;

        /// <summary>
        /// Internet Service source ID. The structure of `internet_service_src_id` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcIdGetArgs> InternetServiceSrcIds
        {
            get => _internetServiceSrcIds ?? (_internetServiceSrcIds = new InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcIdGetArgs>());
            set => _internetServiceSrcIds = value;
        }

        [Input("internetServiceSrcNames")]
        private InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcNameGetArgs>? _internetServiceSrcNames;

        /// <summary>
        /// Internet Service source name. The structure of `internet_service_src_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcNameGetArgs> InternetServiceSrcNames
        {
            get => _internetServiceSrcNames ?? (_internetServiceSrcNames = new InputList<Inputs.FirewallSecuritypolicyInternetServiceSrcNameGetArgs>());
            set => _internetServiceSrcNames = value;
        }

        /// <summary>
        /// When enabled internet-service-src specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetServiceSrcNegate")]
        public Input<string>? InternetServiceSrcNegate { get; set; }

        /// <summary>
        /// Name of an existing IPS sensor.
        /// </summary>
        [Input("ipsSensor")]
        public Input<string>? IpsSensor { get; set; }

        /// <summary>
        /// Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("learningMode")]
        public Input<string>? LearningMode { get; set; }

        /// <summary>
        /// Enable or disable logging. Log all sessions or security profile sessions. Valid values: `all`, `utm`, `disable`.
        /// </summary>
        [Input("logtraffic")]
        public Input<string>? Logtraffic { get; set; }

        /// <summary>
        /// Record logs when a session starts. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("logtrafficStart")]
        public Input<string>? LogtrafficStart { get; set; }

        /// <summary>
        /// Policy name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// Enable/disable NAT46. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("nat46")]
        public Input<string>? Nat46 { get; set; }

        /// <summary>
        /// Enable/disable NAT64. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("nat64")]
        public Input<string>? Nat64 { get; set; }

        /// <summary>
        /// Policy ID.
        /// </summary>
        [Input("policyid")]
        public Input<int>? Policyid { get; set; }

        /// <summary>
        /// Name of profile group.
        /// </summary>
        [Input("profileGroup")]
        public Input<string>? ProfileGroup { get; set; }

        /// <summary>
        /// Name of an existing Protocol options profile.
        /// </summary>
        [Input("profileProtocolOptions")]
        public Input<string>? ProfileProtocolOptions { get; set; }

        /// <summary>
        /// Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: `single`, `group`.
        /// </summary>
        [Input("profileType")]
        public Input<string>? ProfileType { get; set; }

        /// <summary>
        /// Schedule name.
        /// </summary>
        [Input("schedule")]
        public Input<string>? Schedule { get; set; }

        /// <summary>
        /// Name of an existing SCTP filter profile.
        /// </summary>
        [Input("sctpFilterProfile")]
        public Input<string>? SctpFilterProfile { get; set; }

        /// <summary>
        /// Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("sendDenyPacket")]
        public Input<string>? SendDenyPacket { get; set; }

        /// <summary>
        /// When enabled service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("serviceNegate")]
        public Input<string>? ServiceNegate { get; set; }

        [Input("services")]
        private InputList<Inputs.FirewallSecuritypolicyServiceGetArgs>? _services;

        /// <summary>
        /// Service and service group names. The structure of `service` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyServiceGetArgs> Services
        {
            get => _services ?? (_services = new InputList<Inputs.FirewallSecuritypolicyServiceGetArgs>());
            set => _services = value;
        }

        [Input("srcaddr4s")]
        private InputList<Inputs.FirewallSecuritypolicySrcaddr4GetArgs>? _srcaddr4s;

        /// <summary>
        /// Source IPv4 address name and address group names. The structure of `srcaddr4` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicySrcaddr4GetArgs> Srcaddr4s
        {
            get => _srcaddr4s ?? (_srcaddr4s = new InputList<Inputs.FirewallSecuritypolicySrcaddr4GetArgs>());
            set => _srcaddr4s = value;
        }

        [Input("srcaddr6s")]
        private InputList<Inputs.FirewallSecuritypolicySrcaddr6GetArgs>? _srcaddr6s;

        /// <summary>
        /// Source IPv6 address name and address group names. The structure of `srcaddr6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicySrcaddr6GetArgs> Srcaddr6s
        {
            get => _srcaddr6s ?? (_srcaddr6s = new InputList<Inputs.FirewallSecuritypolicySrcaddr6GetArgs>());
            set => _srcaddr6s = value;
        }

        /// <summary>
        /// When enabled srcaddr/srcaddr6 specifies what the source address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("srcaddrNegate")]
        public Input<string>? SrcaddrNegate { get; set; }

        [Input("srcaddrs")]
        private InputList<Inputs.FirewallSecuritypolicySrcaddrGetArgs>? _srcaddrs;

        /// <summary>
        /// Source IPv4 address name and address group names. The structure of `srcaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicySrcaddrGetArgs> Srcaddrs
        {
            get => _srcaddrs ?? (_srcaddrs = new InputList<Inputs.FirewallSecuritypolicySrcaddrGetArgs>());
            set => _srcaddrs = value;
        }

        [Input("srcintfs")]
        private InputList<Inputs.FirewallSecuritypolicySrcintfGetArgs>? _srcintfs;

        /// <summary>
        /// Incoming (ingress) interface. The structure of `srcintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicySrcintfGetArgs> Srcintfs
        {
            get => _srcintfs ?? (_srcintfs = new InputList<Inputs.FirewallSecuritypolicySrcintfGetArgs>());
            set => _srcintfs = value;
        }

        /// <summary>
        /// Name of an existing SSH filter profile.
        /// </summary>
        [Input("sshFilterProfile")]
        public Input<string>? SshFilterProfile { get; set; }

        /// <summary>
        /// Name of an existing SSL SSH profile.
        /// </summary>
        [Input("sslSshProfile")]
        public Input<string>? SslSshProfile { get; set; }

        /// <summary>
        /// Enable or disable this policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("status")]
        public Input<string>? Status { get; set; }

        [Input("urlCategories")]
        private InputList<Inputs.FirewallSecuritypolicyUrlCategoryGetArgs>? _urlCategories;

        /// <summary>
        /// URL category ID list. The structure of `url_category` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyUrlCategoryGetArgs> UrlCategories
        {
            get => _urlCategories ?? (_urlCategories = new InputList<Inputs.FirewallSecuritypolicyUrlCategoryGetArgs>());
            set => _urlCategories = value;
        }

        [Input("users")]
        private InputList<Inputs.FirewallSecuritypolicyUserGetArgs>? _users;

        /// <summary>
        /// Names of individual users that can authenticate with this policy. The structure of `users` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallSecuritypolicyUserGetArgs> Users
        {
            get => _users ?? (_users = new InputList<Inputs.FirewallSecuritypolicyUserGetArgs>());
            set => _users = value;
        }

        /// <summary>
        /// Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
        /// </summary>
        [Input("uuid")]
        public Input<string>? Uuid { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        /// <summary>
        /// Name of an existing VideoFilter profile.
        /// </summary>
        [Input("videofilterProfile")]
        public Input<string>? VideofilterProfile { get; set; }

        /// <summary>
        /// Name of an existing VoIP profile.
        /// </summary>
        [Input("voipProfile")]
        public Input<string>? VoipProfile { get; set; }

        /// <summary>
        /// Name of an existing Web filter profile.
        /// </summary>
        [Input("webfilterProfile")]
        public Input<string>? WebfilterProfile { get; set; }

        public FirewallSecuritypolicyState()
        {
        }
        public static new FirewallSecuritypolicyState Empty => new FirewallSecuritypolicyState();
    }
}
