<reponame>pulumiverse/pulumi-fortios// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Threading.Tasks;
using Pulumi.Serialization;
using Pulumi;

namespace Pulumiverse.Fortios
{
    /// <summary>
    /// Configure IPv4 policies.
    /// 
    /// ## Example Usage
    /// 
    /// ```csharp
    /// using System.Collections.Generic;
    /// using System.Linq;
    /// using Pulumi;
    /// using Fortios = Pulumiverse.Fortios;
    /// 
    /// return await Deployment.RunAsync(() =&gt; 
    /// {
    ///     var trname = new Fortios.FirewallPolicy("trname", new()
    ///     {
    ///         Action = "accept",
    ///         Dstaddrs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallPolicyDstaddrArgs
    ///             {
    ///                 Name = "all",
    ///             },
    ///         },
    ///         Dstintfs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallPolicyDstintfArgs
    ///             {
    ///                 Name = "port4",
    ///             },
    ///         },
    ///         Logtraffic = "utm",
    ///         Policyid = 1,
    ///         Schedule = "always",
    ///         Services = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallPolicyServiceArgs
    ///             {
    ///                 Name = "HTTP",
    ///             },
    ///         },
    ///         Srcaddrs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallPolicySrcaddrArgs
    ///             {
    ///                 Name = "all",
    ///             },
    ///         },
    ///         Srcintfs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallPolicySrcintfArgs
    ///             {
    ///                 Name = "port3",
    ///             },
    ///         },
    ///         Wanopt = "disable",
    ///         WanoptDetection = "active",
    ///         WanoptPassiveOpt = "default",
    ///         Wccp = "disable",
    ///         Webcache = "disable",
    ///         WebcacheHttps = "disable",
    ///         Wsso = "enable",
    ///     });
    /// 
    ///     var myrule = new Fortios.FirewallPolicy("myrule", new()
    ///     {
    ///         Action = "accept",
    ///         AntiReplay = "enable",
    ///         AuthPath = "disable",
    ///         AutoAsicOffload = "enable",
    ///         AvProfile = "wifi-default",
    ///         Dstintfs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallPolicyDstintfArgs
    ///             {
    ///                 Name = "port1",
    ///             },
    ///         },
    ///         InspectionMode = "flow",
    ///         InternetService = "enable",
    ///         InternetServiceNames = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallPolicyInternetServiceNameArgs
    ///             {
    ///                 Name = "Amazon-AWS",
    ///             },
    ///             new Fortios.Inputs.FirewallPolicyInternetServiceNameArgs
    ///             {
    ///                 Name = "GitHub-GitHub",
    ///             },
    ///         },
    ///         IpsSensor = "protect_email_server",
    ///         Logtraffic = "utm",
    ///         Policyid = 2,
    ///         Schedule = "always",
    ///         Srcaddrs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallPolicySrcaddrArgs
    ///             {
    ///                 Name = "FABRIC_DEVICE",
    ///             },
    ///         },
    ///         Srcintfs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallPolicySrcintfArgs
    ///             {
    ///                 Name = "port2",
    ///             },
    ///         },
    ///         SslSshProfile = "certificate-inspection",
    ///         Status = "enable",
    ///         UtmStatus = "enable",
    ///     });
    /// 
    /// });
    /// ```
    /// 
    /// ## Import
    /// 
    /// Firewall Policy can be imported using any of these accepted formats
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/firewallPolicy:FirewallPolicy labelname {{policyid}}
    /// ```
    /// 
    ///  If you do not want to import arguments of block$ export "FORTIOS_IMPORT_TABLE"="false"
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/firewallPolicy:FirewallPolicy labelname {{policyid}}
    /// ```
    /// 
    ///  $ unset "FORTIOS_IMPORT_TABLE"
    /// </summary>
    [FortiosResourceType("fortios:index/firewallPolicy:FirewallPolicy")]
    public partial class FirewallPolicy : global::Pulumi.CustomResource
    {
        /// <summary>
        /// Policy action (allow/deny/ipsec). Valid values: `accept`, `deny`, `ipsec`.
        /// </summary>
        [Output("action")]
        public Output<string> Action { get; private set; } = null!;

        /// <summary>
        /// Enable/disable anti-replay check. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("antiReplay")]
        public Output<string> AntiReplay { get; private set; } = null!;

        /// <summary>
        /// Application category ID list. The structure of `app_category` block is documented below.
        /// </summary>
        [Output("appCategories")]
        public Output<ImmutableArray<Outputs.FirewallPolicyAppCategory>> AppCategories { get; private set; } = null!;

        /// <summary>
        /// Application group names. The structure of `app_group` block is documented below.
        /// </summary>
        [Output("appGroups")]
        public Output<ImmutableArray<Outputs.FirewallPolicyAppGroup>> AppGroups { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Application list.
        /// </summary>
        [Output("applicationList")]
        public Output<string?> ApplicationList { get; private set; } = null!;

        /// <summary>
        /// Application ID list. The structure of `application` block is documented below.
        /// </summary>
        [Output("applications")]
        public Output<ImmutableArray<Outputs.FirewallPolicyApplication>> Applications { get; private set; } = null!;

        /// <summary>
        /// HTTPS server certificate for policy authentication.
        /// </summary>
        [Output("authCert")]
        public Output<string?> AuthCert { get; private set; } = null!;

        /// <summary>
        /// Enable/disable authentication-based routing. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("authPath")]
        public Output<string> AuthPath { get; private set; } = null!;

        /// <summary>
        /// HTTP-to-HTTPS redirect address for firewall authentication.
        /// </summary>
        [Output("authRedirectAddr")]
        public Output<string?> AuthRedirectAddr { get; private set; } = null!;

        /// <summary>
        /// Enable/disable policy traffic ASIC offloading. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("autoAsicOffload")]
        public Output<string> AutoAsicOffload { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Antivirus profile.
        /// </summary>
        [Output("avProfile")]
        public Output<string?> AvProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable block notification. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("blockNotification")]
        public Output<string> BlockNotification { get; private set; } = null!;

        /// <summary>
        /// Enable to exempt some users from the captive portal. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("captivePortalExempt")]
        public Output<string> CaptivePortalExempt { get; private set; } = null!;

        /// <summary>
        /// Enable/disable capture packets. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("capturePacket")]
        public Output<string> CapturePacket { get; private set; } = null!;

        /// <summary>
        /// Name of an existing CIFS profile.
        /// </summary>
        [Output("cifsProfile")]
        public Output<string?> CifsProfile { get; private set; } = null!;

        /// <summary>
        /// Comment.
        /// </summary>
        [Output("comments")]
        public Output<string?> Comments { get; private set; } = null!;

        /// <summary>
        /// Custom fields to append to log messages for this policy. The structure of `custom_log_fields` block is documented below.
        /// </summary>
        [Output("customLogFields")]
        public Output<ImmutableArray<Outputs.FirewallPolicyCustomLogField>> CustomLogFields { get; private set; } = null!;

        /// <summary>
        /// Decrypted traffic mirror.
        /// </summary>
        [Output("decryptedTrafficMirror")]
        public Output<string?> DecryptedTrafficMirror { get; private set; } = null!;

        /// <summary>
        /// Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("delayTcpNpuSession")]
        public Output<string> DelayTcpNpuSession { get; private set; } = null!;

        /// <summary>
        /// Names of devices or device groups that can be matched by the policy. The structure of `devices` block is documented below.
        /// </summary>
        [Output("devices")]
        public Output<ImmutableArray<Outputs.FirewallPolicyDevice>> Devices { get; private set; } = null!;

        /// <summary>
        /// Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("diffservCopy")]
        public Output<string> DiffservCopy { get; private set; } = null!;

        /// <summary>
        /// Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("diffservForward")]
        public Output<string> DiffservForward { get; private set; } = null!;

        /// <summary>
        /// Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("diffservReverse")]
        public Output<string> DiffservReverse { get; private set; } = null!;

        /// <summary>
        /// Change packet's DiffServ to this value.
        /// </summary>
        [Output("diffservcodeForward")]
        public Output<string> DiffservcodeForward { get; private set; } = null!;

        /// <summary>
        /// Change packet's reverse (reply) DiffServ to this value.
        /// </summary>
        [Output("diffservcodeRev")]
        public Output<string> DiffservcodeRev { get; private set; } = null!;

        /// <summary>
        /// Enable/disable user authentication disclaimer. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("disclaimer")]
        public Output<string> Disclaimer { get; private set; } = null!;

        /// <summary>
        /// Name of an existing DLP profile.
        /// </summary>
        [Output("dlpProfile")]
        public Output<string?> DlpProfile { get; private set; } = null!;

        /// <summary>
        /// Name of an existing DLP sensor.
        /// </summary>
        [Output("dlpSensor")]
        public Output<string?> DlpSensor { get; private set; } = null!;

        /// <summary>
        /// Name of an existing DNS filter profile.
        /// </summary>
        [Output("dnsfilterProfile")]
        public Output<string?> DnsfilterProfile { get; private set; } = null!;

        /// <summary>
        /// Enable DSRI to ignore HTTP server responses. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dsri")]
        public Output<string> Dsri { get; private set; } = null!;

        /// <summary>
        /// When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dstaddr6Negate")]
        public Output<string> Dstaddr6Negate { get; private set; } = null!;

        /// <summary>
        /// Destination IPv6 address name and address group names. The structure of `dstaddr6` block is documented below.
        /// </summary>
        [Output("dstaddr6s")]
        public Output<ImmutableArray<Outputs.FirewallPolicyDstaddr6>> Dstaddr6s { get; private set; } = null!;

        /// <summary>
        /// When enabled dstaddr specifies what the destination address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dstaddrNegate")]
        public Output<string> DstaddrNegate { get; private set; } = null!;

        /// <summary>
        /// Destination address and address group names. The structure of `dstaddr` block is documented below.
        /// </summary>
        [Output("dstaddrs")]
        public Output<ImmutableArray<Outputs.FirewallPolicyDstaddr>> Dstaddrs { get; private set; } = null!;

        /// <summary>
        /// Outgoing (egress) interface. The structure of `dstintf` block is documented below.
        /// </summary>
        [Output("dstintfs")]
        public Output<ImmutableArray<Outputs.FirewallPolicyDstintf>> Dstintfs { get; private set; } = null!;

        /// <summary>
        /// Enable/disable dynamic RADIUS defined traffic shaping. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dynamicShaping")]
        public Output<string> DynamicShaping { get; private set; } = null!;

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Output("dynamicSortSubtable")]
        public Output<string?> DynamicSortSubtable { get; private set; } = null!;

        /// <summary>
        /// Enable/disable email collection. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("emailCollect")]
        public Output<string> EmailCollect { get; private set; } = null!;

        /// <summary>
        /// Name of an existing email filter profile.
        /// </summary>
        [Output("emailfilterProfile")]
        public Output<string?> EmailfilterProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("fec")]
        public Output<string> Fec { get; private set; } = null!;

        /// <summary>
        /// Name of an existing file-filter profile.
        /// </summary>
        [Output("fileFilterProfile")]
        public Output<string?> FileFilterProfile { get; private set; } = null!;

        /// <summary>
        /// How to handle sessions if the configuration of this firewall policy changes. Valid values: `check-all`, `check-new`.
        /// </summary>
        [Output("firewallSessionDirty")]
        public Output<string> FirewallSessionDirty { get; private set; } = null!;

        /// <summary>
        /// Enable to prevent source NAT from changing a session's source port. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("fixedport")]
        public Output<string> Fixedport { get; private set; } = null!;

        /// <summary>
        /// Enable/disable Fortinet Single Sign-On. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("fsso")]
        public Output<string?> Fsso { get; private set; } = null!;

        /// <summary>
        /// FSSO agent to use for NTLM authentication.
        /// </summary>
        [Output("fssoAgentForNtlm")]
        public Output<string?> FssoAgentForNtlm { get; private set; } = null!;

        /// <summary>
        /// Names of FSSO groups. The structure of `fsso_groups` block is documented below.
        /// </summary>
        [Output("fssoGroups")]
        public Output<ImmutableArray<Outputs.FirewallPolicyFssoGroup>> FssoGroups { get; private set; } = null!;

        /// <summary>
        /// Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("geoipAnycast")]
        public Output<string> GeoipAnycast { get; private set; } = null!;

        /// <summary>
        /// Match geography address based either on its physical location or registered location. Valid values: `physical-location`, `registered-location`.
        /// </summary>
        [Output("geoipMatch")]
        public Output<string> GeoipMatch { get; private set; } = null!;

        /// <summary>
        /// Label for the policy that appears when the GUI is in Global View mode.
        /// </summary>
        [Output("globalLabel")]
        public Output<string?> GlobalLabel { get; private set; } = null!;

        /// <summary>
        /// Names of user groups that can authenticate with this policy. The structure of `groups` block is documented below.
        /// </summary>
        [Output("groups")]
        public Output<ImmutableArray<Outputs.FirewallPolicyGroup>> Groups { get; private set; } = null!;

        /// <summary>
        /// Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("httpPolicyRedirect")]
        public Output<string> HttpPolicyRedirect { get; private set; } = null!;

        /// <summary>
        /// Name of an existing ICAP profile.
        /// </summary>
        [Output("icapProfile")]
        public Output<string?> IcapProfile { get; private set; } = null!;

        /// <summary>
        /// Name of identity-based routing rule.
        /// </summary>
        [Output("identityBasedRoute")]
        public Output<string?> IdentityBasedRoute { get; private set; } = null!;

        /// <summary>
        /// Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("inbound")]
        public Output<string> Inbound { get; private set; } = null!;

        /// <summary>
        /// Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: `proxy`, `flow`.
        /// </summary>
        [Output("inspectionMode")]
        public Output<string> InspectionMode { get; private set; } = null!;

        /// <summary>
        /// Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used.  Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetService")]
        public Output<string> InternetService { get; private set; } = null!;

        /// <summary>
        /// Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetService6")]
        public Output<string> InternetService6 { get; private set; } = null!;

        /// <summary>
        /// Custom Internet Service6 group name. The structure of `internet_service6_custom_group` block is documented below.
        /// </summary>
        [Output("internetService6CustomGroups")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetService6CustomGroup>> InternetService6CustomGroups { get; private set; } = null!;

        /// <summary>
        /// Custom IPv6 Internet Service name. The structure of `internet_service6_custom` block is documented below.
        /// </summary>
        [Output("internetService6Customs")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetService6Custom>> InternetService6Customs { get; private set; } = null!;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service6_group` block is documented below.
        /// </summary>
        [Output("internetService6Groups")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetService6Group>> InternetService6Groups { get; private set; } = null!;

        /// <summary>
        /// IPv6 Internet Service name. The structure of `internet_service6_name` block is documented below.
        /// </summary>
        [Output("internetService6Names")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetService6Name>> InternetService6Names { get; private set; } = null!;

        /// <summary>
        /// When enabled internet-service6 specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetService6Negate")]
        public Output<string> InternetService6Negate { get; private set; } = null!;

        /// <summary>
        /// Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetService6Src")]
        public Output<string> InternetService6Src { get; private set; } = null!;

        /// <summary>
        /// Custom Internet Service6 source group name. The structure of `internet_service6_src_custom_group` block is documented below.
        /// </summary>
        [Output("internetService6SrcCustomGroups")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetService6SrcCustomGroup>> InternetService6SrcCustomGroups { get; private set; } = null!;

        /// <summary>
        /// Custom IPv6 Internet Service source name. The structure of `internet_service6_src_custom` block is documented below.
        /// </summary>
        [Output("internetService6SrcCustoms")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetService6SrcCustom>> InternetService6SrcCustoms { get; private set; } = null!;

        /// <summary>
        /// Internet Service6 source group name. The structure of `internet_service6_src_group` block is documented below.
        /// </summary>
        [Output("internetService6SrcGroups")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetService6SrcGroup>> InternetService6SrcGroups { get; private set; } = null!;

        /// <summary>
        /// IPv6 Internet Service source name. The structure of `internet_service6_src_name` block is documented below.
        /// </summary>
        [Output("internetService6SrcNames")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetService6SrcName>> InternetService6SrcNames { get; private set; } = null!;

        /// <summary>
        /// When enabled internet-service6-src specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetService6SrcNegate")]
        public Output<string> InternetService6SrcNegate { get; private set; } = null!;

        /// <summary>
        /// Custom Internet Service group name. The structure of `internet_service_custom_group` block is documented below.
        /// </summary>
        [Output("internetServiceCustomGroups")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetServiceCustomGroup>> InternetServiceCustomGroups { get; private set; } = null!;

        /// <summary>
        /// Custom Internet Service name. The structure of `internet_service_custom` block is documented below.
        /// </summary>
        [Output("internetServiceCustoms")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetServiceCustom>> InternetServiceCustoms { get; private set; } = null!;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service_group` block is documented below.
        /// </summary>
        [Output("internetServiceGroups")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetServiceGroup>> InternetServiceGroups { get; private set; } = null!;

        /// <summary>
        /// Internet Service ID. The structure of `internet_service_id` block is documented below.
        /// </summary>
        [Output("internetServiceIds")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetServiceId>> InternetServiceIds { get; private set; } = null!;

        /// <summary>
        /// Internet Service name. The structure of `internet_service_name` block is documented below.
        /// </summary>
        [Output("internetServiceNames")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetServiceName>> InternetServiceNames { get; private set; } = null!;

        /// <summary>
        /// When enabled internet-service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetServiceNegate")]
        public Output<string> InternetServiceNegate { get; private set; } = null!;

        /// <summary>
        /// Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used.  Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetServiceSrc")]
        public Output<string> InternetServiceSrc { get; private set; } = null!;

        /// <summary>
        /// Custom Internet Service source group name. The structure of `internet_service_src_custom_group` block is documented below.
        /// </summary>
        [Output("internetServiceSrcCustomGroups")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetServiceSrcCustomGroup>> InternetServiceSrcCustomGroups { get; private set; } = null!;

        /// <summary>
        /// Custom Internet Service source name. The structure of `internet_service_src_custom` block is documented below.
        /// </summary>
        [Output("internetServiceSrcCustoms")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetServiceSrcCustom>> InternetServiceSrcCustoms { get; private set; } = null!;

        /// <summary>
        /// Internet Service source group name. The structure of `internet_service_src_group` block is documented below.
        /// </summary>
        [Output("internetServiceSrcGroups")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetServiceSrcGroup>> InternetServiceSrcGroups { get; private set; } = null!;

        /// <summary>
        /// Internet Service source ID. The structure of `internet_service_src_id` block is documented below.
        /// </summary>
        [Output("internetServiceSrcIds")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetServiceSrcId>> InternetServiceSrcIds { get; private set; } = null!;

        /// <summary>
        /// Internet Service source name. The structure of `internet_service_src_name` block is documented below.
        /// </summary>
        [Output("internetServiceSrcNames")]
        public Output<ImmutableArray<Outputs.FirewallPolicyInternetServiceSrcName>> InternetServiceSrcNames { get; private set; } = null!;

        /// <summary>
        /// When enabled internet-service-src specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetServiceSrcNegate")]
        public Output<string> InternetServiceSrcNegate { get; private set; } = null!;

        /// <summary>
        /// Enable to use IP Pools for source NAT. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("ippool")]
        public Output<string> Ippool { get; private set; } = null!;

        /// <summary>
        /// Name of an existing IPS sensor.
        /// </summary>
        [Output("ipsSensor")]
        public Output<string?> IpsSensor { get; private set; } = null!;

        /// <summary>
        /// Label for the policy that appears when the GUI is in Section View mode.
        /// </summary>
        [Output("label")]
        public Output<string?> Label { get; private set; } = null!;

        /// <summary>
        /// Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("learningMode")]
        public Output<string?> LearningMode { get; private set; } = null!;

        /// <summary>
        /// Enable or disable logging. Log all sessions or security profile sessions. Valid values: `all`, `utm`, `disable`.
        /// </summary>
        [Output("logtraffic")]
        public Output<string> Logtraffic { get; private set; } = null!;

        /// <summary>
        /// Record logs when a session starts. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("logtrafficStart")]
        public Output<string> LogtrafficStart { get; private set; } = null!;

        /// <summary>
        /// Enable to match packets that have had their destination addresses changed by a VIP. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("matchVip")]
        public Output<string> MatchVip { get; private set; } = null!;

        /// <summary>
        /// Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("matchVipOnly")]
        public Output<string> MatchVipOnly { get; private set; } = null!;

        /// <summary>
        /// Policy name.
        /// </summary>
        [Output("name")]
        public Output<string> Name { get; private set; } = null!;

        /// <summary>
        /// Enable/disable source NAT. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("nat")]
        public Output<string> Nat { get; private set; } = null!;

        /// <summary>
        /// Enable/disable NAT46. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("nat46")]
        public Output<string> Nat46 { get; private set; } = null!;

        /// <summary>
        /// Enable/disable NAT64. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("nat64")]
        public Output<string> Nat64 { get; private set; } = null!;

        /// <summary>
        /// Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("natinbound")]
        public Output<string> Natinbound { get; private set; } = null!;

        /// <summary>
        /// Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
        /// </summary>
        [Output("natip")]
        public Output<string> Natip { get; private set; } = null!;

        /// <summary>
        /// Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("natoutbound")]
        public Output<string> Natoutbound { get; private set; } = null!;

        /// <summary>
        /// Dynamic Network Service name. The structure of `network_service_dynamic` block is documented below.
        /// </summary>
        [Output("networkServiceDynamics")]
        public Output<ImmutableArray<Outputs.FirewallPolicyNetworkServiceDynamic>> NetworkServiceDynamics { get; private set; } = null!;

        /// <summary>
        /// Dynamic Network Service source name. The structure of `network_service_src_dynamic` block is documented below.
        /// </summary>
        [Output("networkServiceSrcDynamics")]
        public Output<ImmutableArray<Outputs.FirewallPolicyNetworkServiceSrcDynamic>> NetworkServiceSrcDynamics { get; private set; } = null!;

        /// <summary>
        /// Enable/disable UTM Network Processor acceleration. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("npAcceleration")]
        public Output<string> NpAcceleration { get; private set; } = null!;

        /// <summary>
        /// Enable/disable NTLM authentication. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("ntlm")]
        public Output<string> Ntlm { get; private set; } = null!;

        /// <summary>
        /// HTTP-User-Agent value of supported browsers. The structure of `ntlm_enabled_browsers` block is documented below.
        /// </summary>
        [Output("ntlmEnabledBrowsers")]
        public Output<ImmutableArray<Outputs.FirewallPolicyNtlmEnabledBrowser>> NtlmEnabledBrowsers { get; private set; } = null!;

        /// <summary>
        /// Enable/disable NTLM guest user access. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("ntlmGuest")]
        public Output<string> NtlmGuest { get; private set; } = null!;

        /// <summary>
        /// Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("outbound")]
        public Output<string> Outbound { get; private set; } = null!;

        /// <summary>
        /// Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("passiveWanHealthMeasurement")]
        public Output<string> PassiveWanHealthMeasurement { get; private set; } = null!;

        /// <summary>
        /// Per-IP traffic shaper.
        /// </summary>
        [Output("perIpShaper")]
        public Output<string?> PerIpShaper { get; private set; } = null!;

        /// <summary>
        /// Accept UDP packets from any host. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("permitAnyHost")]
        public Output<string> PermitAnyHost { get; private set; } = null!;

        /// <summary>
        /// Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("permitStunHost")]
        public Output<string> PermitStunHost { get; private set; } = null!;

        /// <summary>
        /// Enable/disable policy expiry. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("policyExpiry")]
        public Output<string> PolicyExpiry { get; private set; } = null!;

        /// <summary>
        /// Policy expiry date (YYYY-MM-DD HH:MM:SS).
        /// </summary>
        [Output("policyExpiryDate")]
        public Output<string> PolicyExpiryDate { get; private set; } = null!;

        /// <summary>
        /// Policy ID.
        /// </summary>
        [Output("policyid")]
        public Output<int> Policyid { get; private set; } = null!;

        /// <summary>
        /// IPv6 pool names. The structure of `poolname6` block is documented below.
        /// </summary>
        [Output("poolname6s")]
        public Output<ImmutableArray<Outputs.FirewallPolicyPoolname6>> Poolname6s { get; private set; } = null!;

        /// <summary>
        /// IP Pool names. The structure of `poolname` block is documented below.
        /// </summary>
        [Output("poolnames")]
        public Output<ImmutableArray<Outputs.FirewallPolicyPoolname>> Poolnames { get; private set; } = null!;

        /// <summary>
        /// Name of profile group.
        /// </summary>
        [Output("profileGroup")]
        public Output<string?> ProfileGroup { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Protocol options profile.
        /// </summary>
        [Output("profileProtocolOptions")]
        public Output<string> ProfileProtocolOptions { get; private set; } = null!;

        /// <summary>
        /// Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: `single`, `group`.
        /// </summary>
        [Output("profileType")]
        public Output<string> ProfileType { get; private set; } = null!;

        /// <summary>
        /// Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("radiusMacAuthBypass")]
        public Output<string> RadiusMacAuthBypass { get; private set; } = null!;

        /// <summary>
        /// URL users are directed to after seeing and accepting the disclaimer or authenticating.
        /// </summary>
        [Output("redirectUrl")]
        public Output<string?> RedirectUrl { get; private set; } = null!;

        /// <summary>
        /// Override the default replacement message group for this policy.
        /// </summary>
        [Output("replacemsgOverrideGroup")]
        public Output<string?> ReplacemsgOverrideGroup { get; private set; } = null!;

        /// <summary>
        /// Direction of the initial traffic for reputation to take effect. Valid values: `source`, `destination`.
        /// </summary>
        [Output("reputationDirection")]
        public Output<string> ReputationDirection { get; private set; } = null!;

        /// <summary>
        /// Direction of the initial traffic for IPv6 reputation to take effect. Valid values: `source`, `destination`.
        /// </summary>
        [Output("reputationDirection6")]
        public Output<string> ReputationDirection6 { get; private set; } = null!;

        /// <summary>
        /// Minimum Reputation to take action.
        /// </summary>
        [Output("reputationMinimum")]
        public Output<int?> ReputationMinimum { get; private set; } = null!;

        /// <summary>
        /// IPv6 Minimum Reputation to take action.
        /// </summary>
        [Output("reputationMinimum6")]
        public Output<int?> ReputationMinimum6 { get; private set; } = null!;

        /// <summary>
        /// Enable/disable RADIUS single sign-on (RSSO). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("rsso")]
        public Output<string?> Rsso { get; private set; } = null!;

        /// <summary>
        /// Address names if this is an RTP NAT policy. The structure of `rtp_addr` block is documented below.
        /// </summary>
        [Output("rtpAddrs")]
        public Output<ImmutableArray<Outputs.FirewallPolicyRtpAddr>> RtpAddrs { get; private set; } = null!;

        /// <summary>
        /// Enable Real Time Protocol (RTP) NAT. Valid values: `disable`, `enable`.
        /// </summary>
        [Output("rtpNat")]
        public Output<string> RtpNat { get; private set; } = null!;

        /// <summary>
        /// Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: `disable`, `block`, `monitor`.
        /// </summary>
        [Output("scanBotnetConnections")]
        public Output<string?> ScanBotnetConnections { get; private set; } = null!;

        /// <summary>
        /// Schedule name.(Default is `always`)
        /// </summary>
        [Output("schedule")]
        public Output<string?> Schedule { get; private set; } = null!;

        /// <summary>
        /// Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("scheduleTimeout")]
        public Output<string> ScheduleTimeout { get; private set; } = null!;

        /// <summary>
        /// Name of an existing SCTP filter profile.
        /// </summary>
        [Output("sctpFilterProfile")]
        public Output<string?> SctpFilterProfile { get; private set; } = null!;

        /// <summary>
        /// Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: `disable`, `enable`.
        /// </summary>
        [Output("sendDenyPacket")]
        public Output<string> SendDenyPacket { get; private set; } = null!;

        /// <summary>
        /// When enabled service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("serviceNegate")]
        public Output<string> ServiceNegate { get; private set; } = null!;

        /// <summary>
        /// Service and service group names. The structure of `service` block is documented below.
        /// </summary>
        [Output("services")]
        public Output<ImmutableArray<Outputs.FirewallPolicyService>> Services { get; private set; } = null!;

        /// <summary>
        /// TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
        /// </summary>
        [Output("sessionTtl")]
        public Output<int?> SessionTtl { get; private set; } = null!;

        /// <summary>
        /// Enable/disable security group tags (SGT) check. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("sgtCheck")]
        public Output<string> SgtCheck { get; private set; } = null!;

        /// <summary>
        /// Security group tags. The structure of `sgt` block is documented below.
        /// </summary>
        [Output("sgts")]
        public Output<ImmutableArray<Outputs.FirewallPolicySgt>> Sgts { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Spam filter profile.
        /// </summary>
        [Output("spamfilterProfile")]
        public Output<string?> SpamfilterProfile { get; private set; } = null!;

        /// <summary>
        /// Vendor MAC source ID. The structure of `src_vendor_mac` block is documented below.
        /// </summary>
        [Output("srcVendorMacs")]
        public Output<ImmutableArray<Outputs.FirewallPolicySrcVendorMac>> SrcVendorMacs { get; private set; } = null!;

        /// <summary>
        /// When enabled srcaddr6 specifies what the source address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("srcaddr6Negate")]
        public Output<string> Srcaddr6Negate { get; private set; } = null!;

        /// <summary>
        /// Source IPv6 address name and address group names. The structure of `srcaddr6` block is documented below.
        /// </summary>
        [Output("srcaddr6s")]
        public Output<ImmutableArray<Outputs.FirewallPolicySrcaddr6>> Srcaddr6s { get; private set; } = null!;

        /// <summary>
        /// When enabled srcaddr specifies what the source address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("srcaddrNegate")]
        public Output<string> SrcaddrNegate { get; private set; } = null!;

        /// <summary>
        /// Source address and address group names. The structure of `srcaddr` block is documented below.
        /// </summary>
        [Output("srcaddrs")]
        public Output<ImmutableArray<Outputs.FirewallPolicySrcaddr>> Srcaddrs { get; private set; } = null!;

        /// <summary>
        /// Incoming (ingress) interface. The structure of `srcintf` block is documented below.
        /// </summary>
        [Output("srcintfs")]
        public Output<ImmutableArray<Outputs.FirewallPolicySrcintf>> Srcintfs { get; private set; } = null!;

        /// <summary>
        /// Name of an existing SSH filter profile.
        /// </summary>
        [Output("sshFilterProfile")]
        public Output<string?> SshFilterProfile { get; private set; } = null!;

        /// <summary>
        /// Redirect SSH traffic to matching transparent proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("sshPolicyRedirect")]
        public Output<string> SshPolicyRedirect { get; private set; } = null!;

        /// <summary>
        /// Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("sslMirror")]
        public Output<string?> SslMirror { get; private set; } = null!;

        /// <summary>
        /// SSL mirror interface name. The structure of `ssl_mirror_intf` block is documented below.
        /// </summary>
        [Output("sslMirrorIntfs")]
        public Output<ImmutableArray<Outputs.FirewallPolicySslMirrorIntf>> SslMirrorIntfs { get; private set; } = null!;

        /// <summary>
        /// Name of an existing SSL SSH profile.
        /// </summary>
        [Output("sslSshProfile")]
        public Output<string> SslSshProfile { get; private set; } = null!;

        /// <summary>
        /// Enable or disable this policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("status")]
        public Output<string> Status { get; private set; } = null!;

        /// <summary>
        /// Receiver TCP maximum segment size (MSS).
        /// </summary>
        [Output("tcpMssReceiver")]
        public Output<int?> TcpMssReceiver { get; private set; } = null!;

        /// <summary>
        /// Sender TCP maximum segment size (MSS).
        /// </summary>
        [Output("tcpMssSender")]
        public Output<int?> TcpMssSender { get; private set; } = null!;

        /// <summary>
        /// Enable/disable creation of TCP session without SYN flag. Valid values: `all`, `data-only`, `disable`.
        /// </summary>
        [Output("tcpSessionWithoutSyn")]
        public Output<string> TcpSessionWithoutSyn { get; private set; } = null!;

        /// <summary>
        /// Enable/disable sending RST packets when TCP sessions expire. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("timeoutSendRst")]
        public Output<string> TimeoutSendRst { get; private set; } = null!;

        /// <summary>
        /// ToS (Type of Service) value used for comparison.
        /// </summary>
        [Output("tos")]
        public Output<string> Tos { get; private set; } = null!;

        /// <summary>
        /// Non-zero bit positions are used for comparison while zero bit positions are ignored.
        /// </summary>
        [Output("tosMask")]
        public Output<string> TosMask { get; private set; } = null!;

        /// <summary>
        /// Enable negated TOS match. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("tosNegate")]
        public Output<string> TosNegate { get; private set; } = null!;

        /// <summary>
        /// Traffic shaper.
        /// </summary>
        [Output("trafficShaper")]
        public Output<string?> TrafficShaper { get; private set; } = null!;

        /// <summary>
        /// Reverse traffic shaper.
        /// </summary>
        [Output("trafficShaperReverse")]
        public Output<string?> TrafficShaperReverse { get; private set; } = null!;

        /// <summary>
        /// URL category ID list. The structure of `url_category` block is documented below.
        /// </summary>
        [Output("urlCategories")]
        public Output<ImmutableArray<Outputs.FirewallPolicyUrlCategory>> UrlCategories { get; private set; } = null!;

        /// <summary>
        /// Names of individual users that can authenticate with this policy. The structure of `users` block is documented below.
        /// </summary>
        [Output("users")]
        public Output<ImmutableArray<Outputs.FirewallPolicyUser>> Users { get; private set; } = null!;

        /// <summary>
        /// Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("utmStatus")]
        public Output<string> UtmStatus { get; private set; } = null!;

        /// <summary>
        /// Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
        /// </summary>
        [Output("uuid")]
        public Output<string> Uuid { get; private set; } = null!;

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Output("vdomparam")]
        public Output<string?> Vdomparam { get; private set; } = null!;

        /// <summary>
        /// Name of an existing VideoFilter profile.
        /// </summary>
        [Output("videofilterProfile")]
        public Output<string?> VideofilterProfile { get; private set; } = null!;

        /// <summary>
        /// VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
        /// </summary>
        [Output("vlanCosFwd")]
        public Output<int> VlanCosFwd { get; private set; } = null!;

        /// <summary>
        /// VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
        /// </summary>
        [Output("vlanCosRev")]
        public Output<int> VlanCosRev { get; private set; } = null!;

        /// <summary>
        /// Set VLAN filters.
        /// </summary>
        [Output("vlanFilter")]
        public Output<string?> VlanFilter { get; private set; } = null!;

        /// <summary>
        /// Name of an existing VoIP profile.
        /// </summary>
        [Output("voipProfile")]
        public Output<string?> VoipProfile { get; private set; } = null!;

        /// <summary>
        /// Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
        /// </summary>
        [Output("vpntunnel")]
        public Output<string?> Vpntunnel { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Web application firewall profile.
        /// </summary>
        [Output("wafProfile")]
        public Output<string?> WafProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable WAN optimization. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("wanopt")]
        public Output<string> Wanopt { get; private set; } = null!;

        /// <summary>
        /// WAN optimization auto-detection mode. Valid values: `active`, `passive`, `off`.
        /// </summary>
        [Output("wanoptDetection")]
        public Output<string> WanoptDetection { get; private set; } = null!;

        /// <summary>
        /// WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: `default`, `transparent`, `non-transparent`.
        /// </summary>
        [Output("wanoptPassiveOpt")]
        public Output<string> WanoptPassiveOpt { get; private set; } = null!;

        /// <summary>
        /// WAN optimization peer.
        /// </summary>
        [Output("wanoptPeer")]
        public Output<string?> WanoptPeer { get; private set; } = null!;

        /// <summary>
        /// WAN optimization profile.
        /// </summary>
        [Output("wanoptProfile")]
        public Output<string?> WanoptProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("wccp")]
        public Output<string> Wccp { get; private set; } = null!;

        /// <summary>
        /// Enable/disable web cache. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("webcache")]
        public Output<string> Webcache { get; private set; } = null!;

        /// <summary>
        /// Enable/disable web cache for HTTPS. Valid values: `disable`, `enable`.
        /// </summary>
        [Output("webcacheHttps")]
        public Output<string> WebcacheHttps { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Web filter profile.
        /// </summary>
        [Output("webfilterProfile")]
        public Output<string?> WebfilterProfile { get; private set; } = null!;

        /// <summary>
        /// Web proxy forward server name.
        /// </summary>
        [Output("webproxyForwardServer")]
        public Output<string?> WebproxyForwardServer { get; private set; } = null!;

        /// <summary>
        /// Webproxy profile name.
        /// </summary>
        [Output("webproxyProfile")]
        public Output<string?> WebproxyProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable WiFi Single Sign On (WSSO). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("wsso")]
        public Output<string?> Wsso { get; private set; } = null!;

        /// <summary>
        /// Source ztna-ems-tag names. The structure of `ztna_ems_tag` block is documented below.
        /// </summary>
        [Output("ztnaEmsTags")]
        public Output<ImmutableArray<Outputs.FirewallPolicyZtnaEmsTag>> ZtnaEmsTags { get; private set; } = null!;

        /// <summary>
        /// Source ztna-geo-tag names. The structure of `ztna_geo_tag` block is documented below.
        /// </summary>
        [Output("ztnaGeoTags")]
        public Output<ImmutableArray<Outputs.FirewallPolicyZtnaGeoTag>> ZtnaGeoTags { get; private set; } = null!;

        /// <summary>
        /// Enable/disable zero trust access. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("ztnaStatus")]
        public Output<string> ZtnaStatus { get; private set; } = null!;


        /// <summary>
        /// Create a FirewallPolicy resource with the given unique name, arguments, and options.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resource</param>
        /// <param name="args">The arguments used to populate this resource's properties</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public FirewallPolicy(string name, FirewallPolicyArgs args, CustomResourceOptions? options = null)
            : base("fortios:index/firewallPolicy:FirewallPolicy", name, args ?? new FirewallPolicyArgs(), MakeResourceOptions(options, ""))
        {
        }

        private FirewallPolicy(string name, Input<string> id, FirewallPolicyState? state = null, CustomResourceOptions? options = null)
            : base("fortios:index/firewallPolicy:FirewallPolicy", name, state, MakeResourceOptions(options, id))
        {
        }

        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
        {
            var defaultOptions = new CustomResourceOptions
            {
                Version = Utilities.Version,
                PluginDownloadURL = "github://api.github.com/pulumiverse/pulumi-fortios",
            };
            var merged = CustomResourceOptions.Merge(defaultOptions, options);
            // Override the ID if one was specified for consistency with other language SDKs.
            merged.Id = id ?? merged.Id;
            return merged;
        }
        /// <summary>
        /// Get an existing FirewallPolicy resource's state with the given name, ID, and optional extra
        /// properties used to qualify the lookup.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resulting resource.</param>
        /// <param name="id">The unique provider ID of the resource to lookup.</param>
        /// <param name="state">Any extra arguments used during the lookup.</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public static FirewallPolicy Get(string name, Input<string> id, FirewallPolicyState? state = null, CustomResourceOptions? options = null)
        {
            return new FirewallPolicy(name, id, state, options);
        }
    }

    public sealed class FirewallPolicyArgs : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// Policy action (allow/deny/ipsec). Valid values: `accept`, `deny`, `ipsec`.
        /// </summary>
        [Input("action")]
        public Input<string>? Action { get; set; }

        /// <summary>
        /// Enable/disable anti-replay check. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("antiReplay")]
        public Input<string>? AntiReplay { get; set; }

        [Input("appCategories")]
        private InputList<Inputs.FirewallPolicyAppCategoryArgs>? _appCategories;

        /// <summary>
        /// Application category ID list. The structure of `app_category` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyAppCategoryArgs> AppCategories
        {
            get => _appCategories ?? (_appCategories = new InputList<Inputs.FirewallPolicyAppCategoryArgs>());
            set => _appCategories = value;
        }

        [Input("appGroups")]
        private InputList<Inputs.FirewallPolicyAppGroupArgs>? _appGroups;

        /// <summary>
        /// Application group names. The structure of `app_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyAppGroupArgs> AppGroups
        {
            get => _appGroups ?? (_appGroups = new InputList<Inputs.FirewallPolicyAppGroupArgs>());
            set => _appGroups = value;
        }

        /// <summary>
        /// Name of an existing Application list.
        /// </summary>
        [Input("applicationList")]
        public Input<string>? ApplicationList { get; set; }

        [Input("applications")]
        private InputList<Inputs.FirewallPolicyApplicationArgs>? _applications;

        /// <summary>
        /// Application ID list. The structure of `application` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyApplicationArgs> Applications
        {
            get => _applications ?? (_applications = new InputList<Inputs.FirewallPolicyApplicationArgs>());
            set => _applications = value;
        }

        /// <summary>
        /// HTTPS server certificate for policy authentication.
        /// </summary>
        [Input("authCert")]
        public Input<string>? AuthCert { get; set; }

        /// <summary>
        /// Enable/disable authentication-based routing. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("authPath")]
        public Input<string>? AuthPath { get; set; }

        /// <summary>
        /// HTTP-to-HTTPS redirect address for firewall authentication.
        /// </summary>
        [Input("authRedirectAddr")]
        public Input<string>? AuthRedirectAddr { get; set; }

        /// <summary>
        /// Enable/disable policy traffic ASIC offloading. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("autoAsicOffload")]
        public Input<string>? AutoAsicOffload { get; set; }

        /// <summary>
        /// Name of an existing Antivirus profile.
        /// </summary>
        [Input("avProfile")]
        public Input<string>? AvProfile { get; set; }

        /// <summary>
        /// Enable/disable block notification. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("blockNotification")]
        public Input<string>? BlockNotification { get; set; }

        /// <summary>
        /// Enable to exempt some users from the captive portal. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("captivePortalExempt")]
        public Input<string>? CaptivePortalExempt { get; set; }

        /// <summary>
        /// Enable/disable capture packets. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("capturePacket")]
        public Input<string>? CapturePacket { get; set; }

        /// <summary>
        /// Name of an existing CIFS profile.
        /// </summary>
        [Input("cifsProfile")]
        public Input<string>? CifsProfile { get; set; }

        /// <summary>
        /// Comment.
        /// </summary>
        [Input("comments")]
        public Input<string>? Comments { get; set; }

        [Input("customLogFields")]
        private InputList<Inputs.FirewallPolicyCustomLogFieldArgs>? _customLogFields;

        /// <summary>
        /// Custom fields to append to log messages for this policy. The structure of `custom_log_fields` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyCustomLogFieldArgs> CustomLogFields
        {
            get => _customLogFields ?? (_customLogFields = new InputList<Inputs.FirewallPolicyCustomLogFieldArgs>());
            set => _customLogFields = value;
        }

        /// <summary>
        /// Decrypted traffic mirror.
        /// </summary>
        [Input("decryptedTrafficMirror")]
        public Input<string>? DecryptedTrafficMirror { get; set; }

        /// <summary>
        /// Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("delayTcpNpuSession")]
        public Input<string>? DelayTcpNpuSession { get; set; }

        [Input("devices")]
        private InputList<Inputs.FirewallPolicyDeviceArgs>? _devices;

        /// <summary>
        /// Names of devices or device groups that can be matched by the policy. The structure of `devices` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyDeviceArgs> Devices
        {
            get => _devices ?? (_devices = new InputList<Inputs.FirewallPolicyDeviceArgs>());
            set => _devices = value;
        }

        /// <summary>
        /// Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("diffservCopy")]
        public Input<string>? DiffservCopy { get; set; }

        /// <summary>
        /// Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("diffservForward")]
        public Input<string>? DiffservForward { get; set; }

        /// <summary>
        /// Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("diffservReverse")]
        public Input<string>? DiffservReverse { get; set; }

        /// <summary>
        /// Change packet's DiffServ to this value.
        /// </summary>
        [Input("diffservcodeForward")]
        public Input<string>? DiffservcodeForward { get; set; }

        /// <summary>
        /// Change packet's reverse (reply) DiffServ to this value.
        /// </summary>
        [Input("diffservcodeRev")]
        public Input<string>? DiffservcodeRev { get; set; }

        /// <summary>
        /// Enable/disable user authentication disclaimer. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("disclaimer")]
        public Input<string>? Disclaimer { get; set; }

        /// <summary>
        /// Name of an existing DLP profile.
        /// </summary>
        [Input("dlpProfile")]
        public Input<string>? DlpProfile { get; set; }

        /// <summary>
        /// Name of an existing DLP sensor.
        /// </summary>
        [Input("dlpSensor")]
        public Input<string>? DlpSensor { get; set; }

        /// <summary>
        /// Name of an existing DNS filter profile.
        /// </summary>
        [Input("dnsfilterProfile")]
        public Input<string>? DnsfilterProfile { get; set; }

        /// <summary>
        /// Enable DSRI to ignore HTTP server responses. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dsri")]
        public Input<string>? Dsri { get; set; }

        /// <summary>
        /// When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dstaddr6Negate")]
        public Input<string>? Dstaddr6Negate { get; set; }

        [Input("dstaddr6s")]
        private InputList<Inputs.FirewallPolicyDstaddr6Args>? _dstaddr6s;

        /// <summary>
        /// Destination IPv6 address name and address group names. The structure of `dstaddr6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyDstaddr6Args> Dstaddr6s
        {
            get => _dstaddr6s ?? (_dstaddr6s = new InputList<Inputs.FirewallPolicyDstaddr6Args>());
            set => _dstaddr6s = value;
        }

        /// <summary>
        /// When enabled dstaddr specifies what the destination address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dstaddrNegate")]
        public Input<string>? DstaddrNegate { get; set; }

        [Input("dstaddrs")]
        private InputList<Inputs.FirewallPolicyDstaddrArgs>? _dstaddrs;

        /// <summary>
        /// Destination address and address group names. The structure of `dstaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyDstaddrArgs> Dstaddrs
        {
            get => _dstaddrs ?? (_dstaddrs = new InputList<Inputs.FirewallPolicyDstaddrArgs>());
            set => _dstaddrs = value;
        }

        [Input("dstintfs", required: true)]
        private InputList<Inputs.FirewallPolicyDstintfArgs>? _dstintfs;

        /// <summary>
        /// Outgoing (egress) interface. The structure of `dstintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyDstintfArgs> Dstintfs
        {
            get => _dstintfs ?? (_dstintfs = new InputList<Inputs.FirewallPolicyDstintfArgs>());
            set => _dstintfs = value;
        }

        /// <summary>
        /// Enable/disable dynamic RADIUS defined traffic shaping. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dynamicShaping")]
        public Input<string>? DynamicShaping { get; set; }

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Input("dynamicSortSubtable")]
        public Input<string>? DynamicSortSubtable { get; set; }

        /// <summary>
        /// Enable/disable email collection. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("emailCollect")]
        public Input<string>? EmailCollect { get; set; }

        /// <summary>
        /// Name of an existing email filter profile.
        /// </summary>
        [Input("emailfilterProfile")]
        public Input<string>? EmailfilterProfile { get; set; }

        /// <summary>
        /// Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("fec")]
        public Input<string>? Fec { get; set; }

        /// <summary>
        /// Name of an existing file-filter profile.
        /// </summary>
        [Input("fileFilterProfile")]
        public Input<string>? FileFilterProfile { get; set; }

        /// <summary>
        /// How to handle sessions if the configuration of this firewall policy changes. Valid values: `check-all`, `check-new`.
        /// </summary>
        [Input("firewallSessionDirty")]
        public Input<string>? FirewallSessionDirty { get; set; }

        /// <summary>
        /// Enable to prevent source NAT from changing a session's source port. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("fixedport")]
        public Input<string>? Fixedport { get; set; }

        /// <summary>
        /// Enable/disable Fortinet Single Sign-On. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("fsso")]
        public Input<string>? Fsso { get; set; }

        /// <summary>
        /// FSSO agent to use for NTLM authentication.
        /// </summary>
        [Input("fssoAgentForNtlm")]
        public Input<string>? FssoAgentForNtlm { get; set; }

        [Input("fssoGroups")]
        private InputList<Inputs.FirewallPolicyFssoGroupArgs>? _fssoGroups;

        /// <summary>
        /// Names of FSSO groups. The structure of `fsso_groups` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyFssoGroupArgs> FssoGroups
        {
            get => _fssoGroups ?? (_fssoGroups = new InputList<Inputs.FirewallPolicyFssoGroupArgs>());
            set => _fssoGroups = value;
        }

        /// <summary>
        /// Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("geoipAnycast")]
        public Input<string>? GeoipAnycast { get; set; }

        /// <summary>
        /// Match geography address based either on its physical location or registered location. Valid values: `physical-location`, `registered-location`.
        /// </summary>
        [Input("geoipMatch")]
        public Input<string>? GeoipMatch { get; set; }

        /// <summary>
        /// Label for the policy that appears when the GUI is in Global View mode.
        /// </summary>
        [Input("globalLabel")]
        public Input<string>? GlobalLabel { get; set; }

        [Input("groups")]
        private InputList<Inputs.FirewallPolicyGroupArgs>? _groups;

        /// <summary>
        /// Names of user groups that can authenticate with this policy. The structure of `groups` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyGroupArgs> Groups
        {
            get => _groups ?? (_groups = new InputList<Inputs.FirewallPolicyGroupArgs>());
            set => _groups = value;
        }

        /// <summary>
        /// Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("httpPolicyRedirect")]
        public Input<string>? HttpPolicyRedirect { get; set; }

        /// <summary>
        /// Name of an existing ICAP profile.
        /// </summary>
        [Input("icapProfile")]
        public Input<string>? IcapProfile { get; set; }

        /// <summary>
        /// Name of identity-based routing rule.
        /// </summary>
        [Input("identityBasedRoute")]
        public Input<string>? IdentityBasedRoute { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("inbound")]
        public Input<string>? Inbound { get; set; }

        /// <summary>
        /// Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: `proxy`, `flow`.
        /// </summary>
        [Input("inspectionMode")]
        public Input<string>? InspectionMode { get; set; }

        /// <summary>
        /// Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used.  Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService")]
        public Input<string>? InternetService { get; set; }

        /// <summary>
        /// Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6")]
        public Input<string>? InternetService6 { get; set; }

        [Input("internetService6CustomGroups")]
        private InputList<Inputs.FirewallPolicyInternetService6CustomGroupArgs>? _internetService6CustomGroups;

        /// <summary>
        /// Custom Internet Service6 group name. The structure of `internet_service6_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6CustomGroupArgs> InternetService6CustomGroups
        {
            get => _internetService6CustomGroups ?? (_internetService6CustomGroups = new InputList<Inputs.FirewallPolicyInternetService6CustomGroupArgs>());
            set => _internetService6CustomGroups = value;
        }

        [Input("internetService6Customs")]
        private InputList<Inputs.FirewallPolicyInternetService6CustomArgs>? _internetService6Customs;

        /// <summary>
        /// Custom IPv6 Internet Service name. The structure of `internet_service6_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6CustomArgs> InternetService6Customs
        {
            get => _internetService6Customs ?? (_internetService6Customs = new InputList<Inputs.FirewallPolicyInternetService6CustomArgs>());
            set => _internetService6Customs = value;
        }

        [Input("internetService6Groups")]
        private InputList<Inputs.FirewallPolicyInternetService6GroupArgs>? _internetService6Groups;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service6_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6GroupArgs> InternetService6Groups
        {
            get => _internetService6Groups ?? (_internetService6Groups = new InputList<Inputs.FirewallPolicyInternetService6GroupArgs>());
            set => _internetService6Groups = value;
        }

        [Input("internetService6Names")]
        private InputList<Inputs.FirewallPolicyInternetService6NameArgs>? _internetService6Names;

        /// <summary>
        /// IPv6 Internet Service name. The structure of `internet_service6_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6NameArgs> InternetService6Names
        {
            get => _internetService6Names ?? (_internetService6Names = new InputList<Inputs.FirewallPolicyInternetService6NameArgs>());
            set => _internetService6Names = value;
        }

        /// <summary>
        /// When enabled internet-service6 specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6Negate")]
        public Input<string>? InternetService6Negate { get; set; }

        /// <summary>
        /// Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6Src")]
        public Input<string>? InternetService6Src { get; set; }

        [Input("internetService6SrcCustomGroups")]
        private InputList<Inputs.FirewallPolicyInternetService6SrcCustomGroupArgs>? _internetService6SrcCustomGroups;

        /// <summary>
        /// Custom Internet Service6 source group name. The structure of `internet_service6_src_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6SrcCustomGroupArgs> InternetService6SrcCustomGroups
        {
            get => _internetService6SrcCustomGroups ?? (_internetService6SrcCustomGroups = new InputList<Inputs.FirewallPolicyInternetService6SrcCustomGroupArgs>());
            set => _internetService6SrcCustomGroups = value;
        }

        [Input("internetService6SrcCustoms")]
        private InputList<Inputs.FirewallPolicyInternetService6SrcCustomArgs>? _internetService6SrcCustoms;

        /// <summary>
        /// Custom IPv6 Internet Service source name. The structure of `internet_service6_src_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6SrcCustomArgs> InternetService6SrcCustoms
        {
            get => _internetService6SrcCustoms ?? (_internetService6SrcCustoms = new InputList<Inputs.FirewallPolicyInternetService6SrcCustomArgs>());
            set => _internetService6SrcCustoms = value;
        }

        [Input("internetService6SrcGroups")]
        private InputList<Inputs.FirewallPolicyInternetService6SrcGroupArgs>? _internetService6SrcGroups;

        /// <summary>
        /// Internet Service6 source group name. The structure of `internet_service6_src_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6SrcGroupArgs> InternetService6SrcGroups
        {
            get => _internetService6SrcGroups ?? (_internetService6SrcGroups = new InputList<Inputs.FirewallPolicyInternetService6SrcGroupArgs>());
            set => _internetService6SrcGroups = value;
        }

        [Input("internetService6SrcNames")]
        private InputList<Inputs.FirewallPolicyInternetService6SrcNameArgs>? _internetService6SrcNames;

        /// <summary>
        /// IPv6 Internet Service source name. The structure of `internet_service6_src_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6SrcNameArgs> InternetService6SrcNames
        {
            get => _internetService6SrcNames ?? (_internetService6SrcNames = new InputList<Inputs.FirewallPolicyInternetService6SrcNameArgs>());
            set => _internetService6SrcNames = value;
        }

        /// <summary>
        /// When enabled internet-service6-src specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6SrcNegate")]
        public Input<string>? InternetService6SrcNegate { get; set; }

        [Input("internetServiceCustomGroups")]
        private InputList<Inputs.FirewallPolicyInternetServiceCustomGroupArgs>? _internetServiceCustomGroups;

        /// <summary>
        /// Custom Internet Service group name. The structure of `internet_service_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceCustomGroupArgs> InternetServiceCustomGroups
        {
            get => _internetServiceCustomGroups ?? (_internetServiceCustomGroups = new InputList<Inputs.FirewallPolicyInternetServiceCustomGroupArgs>());
            set => _internetServiceCustomGroups = value;
        }

        [Input("internetServiceCustoms")]
        private InputList<Inputs.FirewallPolicyInternetServiceCustomArgs>? _internetServiceCustoms;

        /// <summary>
        /// Custom Internet Service name. The structure of `internet_service_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceCustomArgs> InternetServiceCustoms
        {
            get => _internetServiceCustoms ?? (_internetServiceCustoms = new InputList<Inputs.FirewallPolicyInternetServiceCustomArgs>());
            set => _internetServiceCustoms = value;
        }

        [Input("internetServiceGroups")]
        private InputList<Inputs.FirewallPolicyInternetServiceGroupArgs>? _internetServiceGroups;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceGroupArgs> InternetServiceGroups
        {
            get => _internetServiceGroups ?? (_internetServiceGroups = new InputList<Inputs.FirewallPolicyInternetServiceGroupArgs>());
            set => _internetServiceGroups = value;
        }

        [Input("internetServiceIds")]
        private InputList<Inputs.FirewallPolicyInternetServiceIdArgs>? _internetServiceIds;

        /// <summary>
        /// Internet Service ID. The structure of `internet_service_id` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceIdArgs> InternetServiceIds
        {
            get => _internetServiceIds ?? (_internetServiceIds = new InputList<Inputs.FirewallPolicyInternetServiceIdArgs>());
            set => _internetServiceIds = value;
        }

        [Input("internetServiceNames")]
        private InputList<Inputs.FirewallPolicyInternetServiceNameArgs>? _internetServiceNames;

        /// <summary>
        /// Internet Service name. The structure of `internet_service_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceNameArgs> InternetServiceNames
        {
            get => _internetServiceNames ?? (_internetServiceNames = new InputList<Inputs.FirewallPolicyInternetServiceNameArgs>());
            set => _internetServiceNames = value;
        }

        /// <summary>
        /// When enabled internet-service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetServiceNegate")]
        public Input<string>? InternetServiceNegate { get; set; }

        /// <summary>
        /// Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used.  Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetServiceSrc")]
        public Input<string>? InternetServiceSrc { get; set; }

        [Input("internetServiceSrcCustomGroups")]
        private InputList<Inputs.FirewallPolicyInternetServiceSrcCustomGroupArgs>? _internetServiceSrcCustomGroups;

        /// <summary>
        /// Custom Internet Service source group name. The structure of `internet_service_src_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceSrcCustomGroupArgs> InternetServiceSrcCustomGroups
        {
            get => _internetServiceSrcCustomGroups ?? (_internetServiceSrcCustomGroups = new InputList<Inputs.FirewallPolicyInternetServiceSrcCustomGroupArgs>());
            set => _internetServiceSrcCustomGroups = value;
        }

        [Input("internetServiceSrcCustoms")]
        private InputList<Inputs.FirewallPolicyInternetServiceSrcCustomArgs>? _internetServiceSrcCustoms;

        /// <summary>
        /// Custom Internet Service source name. The structure of `internet_service_src_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceSrcCustomArgs> InternetServiceSrcCustoms
        {
            get => _internetServiceSrcCustoms ?? (_internetServiceSrcCustoms = new InputList<Inputs.FirewallPolicyInternetServiceSrcCustomArgs>());
            set => _internetServiceSrcCustoms = value;
        }

        [Input("internetServiceSrcGroups")]
        private InputList<Inputs.FirewallPolicyInternetServiceSrcGroupArgs>? _internetServiceSrcGroups;

        /// <summary>
        /// Internet Service source group name. The structure of `internet_service_src_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceSrcGroupArgs> InternetServiceSrcGroups
        {
            get => _internetServiceSrcGroups ?? (_internetServiceSrcGroups = new InputList<Inputs.FirewallPolicyInternetServiceSrcGroupArgs>());
            set => _internetServiceSrcGroups = value;
        }

        [Input("internetServiceSrcIds")]
        private InputList<Inputs.FirewallPolicyInternetServiceSrcIdArgs>? _internetServiceSrcIds;

        /// <summary>
        /// Internet Service source ID. The structure of `internet_service_src_id` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceSrcIdArgs> InternetServiceSrcIds
        {
            get => _internetServiceSrcIds ?? (_internetServiceSrcIds = new InputList<Inputs.FirewallPolicyInternetServiceSrcIdArgs>());
            set => _internetServiceSrcIds = value;
        }

        [Input("internetServiceSrcNames")]
        private InputList<Inputs.FirewallPolicyInternetServiceSrcNameArgs>? _internetServiceSrcNames;

        /// <summary>
        /// Internet Service source name. The structure of `internet_service_src_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceSrcNameArgs> InternetServiceSrcNames
        {
            get => _internetServiceSrcNames ?? (_internetServiceSrcNames = new InputList<Inputs.FirewallPolicyInternetServiceSrcNameArgs>());
            set => _internetServiceSrcNames = value;
        }

        /// <summary>
        /// When enabled internet-service-src specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetServiceSrcNegate")]
        public Input<string>? InternetServiceSrcNegate { get; set; }

        /// <summary>
        /// Enable to use IP Pools for source NAT. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ippool")]
        public Input<string>? Ippool { get; set; }

        /// <summary>
        /// Name of an existing IPS sensor.
        /// </summary>
        [Input("ipsSensor")]
        public Input<string>? IpsSensor { get; set; }

        /// <summary>
        /// Label for the policy that appears when the GUI is in Section View mode.
        /// </summary>
        [Input("label")]
        public Input<string>? Label { get; set; }

        /// <summary>
        /// Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("learningMode")]
        public Input<string>? LearningMode { get; set; }

        /// <summary>
        /// Enable or disable logging. Log all sessions or security profile sessions. Valid values: `all`, `utm`, `disable`.
        /// </summary>
        [Input("logtraffic")]
        public Input<string>? Logtraffic { get; set; }

        /// <summary>
        /// Record logs when a session starts. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("logtrafficStart")]
        public Input<string>? LogtrafficStart { get; set; }

        /// <summary>
        /// Enable to match packets that have had their destination addresses changed by a VIP. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("matchVip")]
        public Input<string>? MatchVip { get; set; }

        /// <summary>
        /// Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("matchVipOnly")]
        public Input<string>? MatchVipOnly { get; set; }

        /// <summary>
        /// Policy name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// Enable/disable source NAT. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("nat")]
        public Input<string>? Nat { get; set; }

        /// <summary>
        /// Enable/disable NAT46. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("nat46")]
        public Input<string>? Nat46 { get; set; }

        /// <summary>
        /// Enable/disable NAT64. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("nat64")]
        public Input<string>? Nat64 { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("natinbound")]
        public Input<string>? Natinbound { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
        /// </summary>
        [Input("natip")]
        public Input<string>? Natip { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("natoutbound")]
        public Input<string>? Natoutbound { get; set; }

        [Input("networkServiceDynamics")]
        private InputList<Inputs.FirewallPolicyNetworkServiceDynamicArgs>? _networkServiceDynamics;

        /// <summary>
        /// Dynamic Network Service name. The structure of `network_service_dynamic` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyNetworkServiceDynamicArgs> NetworkServiceDynamics
        {
            get => _networkServiceDynamics ?? (_networkServiceDynamics = new InputList<Inputs.FirewallPolicyNetworkServiceDynamicArgs>());
            set => _networkServiceDynamics = value;
        }

        [Input("networkServiceSrcDynamics")]
        private InputList<Inputs.FirewallPolicyNetworkServiceSrcDynamicArgs>? _networkServiceSrcDynamics;

        /// <summary>
        /// Dynamic Network Service source name. The structure of `network_service_src_dynamic` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyNetworkServiceSrcDynamicArgs> NetworkServiceSrcDynamics
        {
            get => _networkServiceSrcDynamics ?? (_networkServiceSrcDynamics = new InputList<Inputs.FirewallPolicyNetworkServiceSrcDynamicArgs>());
            set => _networkServiceSrcDynamics = value;
        }

        /// <summary>
        /// Enable/disable UTM Network Processor acceleration. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("npAcceleration")]
        public Input<string>? NpAcceleration { get; set; }

        /// <summary>
        /// Enable/disable NTLM authentication. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ntlm")]
        public Input<string>? Ntlm { get; set; }

        [Input("ntlmEnabledBrowsers")]
        private InputList<Inputs.FirewallPolicyNtlmEnabledBrowserArgs>? _ntlmEnabledBrowsers;

        /// <summary>
        /// HTTP-User-Agent value of supported browsers. The structure of `ntlm_enabled_browsers` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyNtlmEnabledBrowserArgs> NtlmEnabledBrowsers
        {
            get => _ntlmEnabledBrowsers ?? (_ntlmEnabledBrowsers = new InputList<Inputs.FirewallPolicyNtlmEnabledBrowserArgs>());
            set => _ntlmEnabledBrowsers = value;
        }

        /// <summary>
        /// Enable/disable NTLM guest user access. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ntlmGuest")]
        public Input<string>? NtlmGuest { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("outbound")]
        public Input<string>? Outbound { get; set; }

        /// <summary>
        /// Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("passiveWanHealthMeasurement")]
        public Input<string>? PassiveWanHealthMeasurement { get; set; }

        /// <summary>
        /// Per-IP traffic shaper.
        /// </summary>
        [Input("perIpShaper")]
        public Input<string>? PerIpShaper { get; set; }

        /// <summary>
        /// Accept UDP packets from any host. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("permitAnyHost")]
        public Input<string>? PermitAnyHost { get; set; }

        /// <summary>
        /// Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("permitStunHost")]
        public Input<string>? PermitStunHost { get; set; }

        /// <summary>
        /// Enable/disable policy expiry. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("policyExpiry")]
        public Input<string>? PolicyExpiry { get; set; }

        /// <summary>
        /// Policy expiry date (YYYY-MM-DD HH:MM:SS).
        /// </summary>
        [Input("policyExpiryDate")]
        public Input<string>? PolicyExpiryDate { get; set; }

        /// <summary>
        /// Policy ID.
        /// </summary>
        [Input("policyid")]
        public Input<int>? Policyid { get; set; }

        [Input("poolname6s")]
        private InputList<Inputs.FirewallPolicyPoolname6Args>? _poolname6s;

        /// <summary>
        /// IPv6 pool names. The structure of `poolname6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyPoolname6Args> Poolname6s
        {
            get => _poolname6s ?? (_poolname6s = new InputList<Inputs.FirewallPolicyPoolname6Args>());
            set => _poolname6s = value;
        }

        [Input("poolnames")]
        private InputList<Inputs.FirewallPolicyPoolnameArgs>? _poolnames;

        /// <summary>
        /// IP Pool names. The structure of `poolname` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyPoolnameArgs> Poolnames
        {
            get => _poolnames ?? (_poolnames = new InputList<Inputs.FirewallPolicyPoolnameArgs>());
            set => _poolnames = value;
        }

        /// <summary>
        /// Name of profile group.
        /// </summary>
        [Input("profileGroup")]
        public Input<string>? ProfileGroup { get; set; }

        /// <summary>
        /// Name of an existing Protocol options profile.
        /// </summary>
        [Input("profileProtocolOptions")]
        public Input<string>? ProfileProtocolOptions { get; set; }

        /// <summary>
        /// Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: `single`, `group`.
        /// </summary>
        [Input("profileType")]
        public Input<string>? ProfileType { get; set; }

        /// <summary>
        /// Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("radiusMacAuthBypass")]
        public Input<string>? RadiusMacAuthBypass { get; set; }

        /// <summary>
        /// URL users are directed to after seeing and accepting the disclaimer or authenticating.
        /// </summary>
        [Input("redirectUrl")]
        public Input<string>? RedirectUrl { get; set; }

        /// <summary>
        /// Override the default replacement message group for this policy.
        /// </summary>
        [Input("replacemsgOverrideGroup")]
        public Input<string>? ReplacemsgOverrideGroup { get; set; }

        /// <summary>
        /// Direction of the initial traffic for reputation to take effect. Valid values: `source`, `destination`.
        /// </summary>
        [Input("reputationDirection")]
        public Input<string>? ReputationDirection { get; set; }

        /// <summary>
        /// Direction of the initial traffic for IPv6 reputation to take effect. Valid values: `source`, `destination`.
        /// </summary>
        [Input("reputationDirection6")]
        public Input<string>? ReputationDirection6 { get; set; }

        /// <summary>
        /// Minimum Reputation to take action.
        /// </summary>
        [Input("reputationMinimum")]
        public Input<int>? ReputationMinimum { get; set; }

        /// <summary>
        /// IPv6 Minimum Reputation to take action.
        /// </summary>
        [Input("reputationMinimum6")]
        public Input<int>? ReputationMinimum6 { get; set; }

        /// <summary>
        /// Enable/disable RADIUS single sign-on (RSSO). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("rsso")]
        public Input<string>? Rsso { get; set; }

        [Input("rtpAddrs")]
        private InputList<Inputs.FirewallPolicyRtpAddrArgs>? _rtpAddrs;

        /// <summary>
        /// Address names if this is an RTP NAT policy. The structure of `rtp_addr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyRtpAddrArgs> RtpAddrs
        {
            get => _rtpAddrs ?? (_rtpAddrs = new InputList<Inputs.FirewallPolicyRtpAddrArgs>());
            set => _rtpAddrs = value;
        }

        /// <summary>
        /// Enable Real Time Protocol (RTP) NAT. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("rtpNat")]
        public Input<string>? RtpNat { get; set; }

        /// <summary>
        /// Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: `disable`, `block`, `monitor`.
        /// </summary>
        [Input("scanBotnetConnections")]
        public Input<string>? ScanBotnetConnections { get; set; }

        /// <summary>
        /// Schedule name.(Default is `always`)
        /// </summary>
        [Input("schedule")]
        public Input<string>? Schedule { get; set; }

        /// <summary>
        /// Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("scheduleTimeout")]
        public Input<string>? ScheduleTimeout { get; set; }

        /// <summary>
        /// Name of an existing SCTP filter profile.
        /// </summary>
        [Input("sctpFilterProfile")]
        public Input<string>? SctpFilterProfile { get; set; }

        /// <summary>
        /// Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("sendDenyPacket")]
        public Input<string>? SendDenyPacket { get; set; }

        /// <summary>
        /// When enabled service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("serviceNegate")]
        public Input<string>? ServiceNegate { get; set; }

        [Input("services")]
        private InputList<Inputs.FirewallPolicyServiceArgs>? _services;

        /// <summary>
        /// Service and service group names. The structure of `service` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyServiceArgs> Services
        {
            get => _services ?? (_services = new InputList<Inputs.FirewallPolicyServiceArgs>());
            set => _services = value;
        }

        /// <summary>
        /// TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
        /// </summary>
        [Input("sessionTtl")]
        public Input<int>? SessionTtl { get; set; }

        /// <summary>
        /// Enable/disable security group tags (SGT) check. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sgtCheck")]
        public Input<string>? SgtCheck { get; set; }

        [Input("sgts")]
        private InputList<Inputs.FirewallPolicySgtArgs>? _sgts;

        /// <summary>
        /// Security group tags. The structure of `sgt` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicySgtArgs> Sgts
        {
            get => _sgts ?? (_sgts = new InputList<Inputs.FirewallPolicySgtArgs>());
            set => _sgts = value;
        }

        /// <summary>
        /// Name of an existing Spam filter profile.
        /// </summary>
        [Input("spamfilterProfile")]
        public Input<string>? SpamfilterProfile { get; set; }

        [Input("srcVendorMacs")]
        private InputList<Inputs.FirewallPolicySrcVendorMacArgs>? _srcVendorMacs;

        /// <summary>
        /// Vendor MAC source ID. The structure of `src_vendor_mac` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicySrcVendorMacArgs> SrcVendorMacs
        {
            get => _srcVendorMacs ?? (_srcVendorMacs = new InputList<Inputs.FirewallPolicySrcVendorMacArgs>());
            set => _srcVendorMacs = value;
        }

        /// <summary>
        /// When enabled srcaddr6 specifies what the source address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("srcaddr6Negate")]
        public Input<string>? Srcaddr6Negate { get; set; }

        [Input("srcaddr6s")]
        private InputList<Inputs.FirewallPolicySrcaddr6Args>? _srcaddr6s;

        /// <summary>
        /// Source IPv6 address name and address group names. The structure of `srcaddr6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicySrcaddr6Args> Srcaddr6s
        {
            get => _srcaddr6s ?? (_srcaddr6s = new InputList<Inputs.FirewallPolicySrcaddr6Args>());
            set => _srcaddr6s = value;
        }

        /// <summary>
        /// When enabled srcaddr specifies what the source address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("srcaddrNegate")]
        public Input<string>? SrcaddrNegate { get; set; }

        [Input("srcaddrs")]
        private InputList<Inputs.FirewallPolicySrcaddrArgs>? _srcaddrs;

        /// <summary>
        /// Source address and address group names. The structure of `srcaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicySrcaddrArgs> Srcaddrs
        {
            get => _srcaddrs ?? (_srcaddrs = new InputList<Inputs.FirewallPolicySrcaddrArgs>());
            set => _srcaddrs = value;
        }

        [Input("srcintfs", required: true)]
        private InputList<Inputs.FirewallPolicySrcintfArgs>? _srcintfs;

        /// <summary>
        /// Incoming (ingress) interface. The structure of `srcintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicySrcintfArgs> Srcintfs
        {
            get => _srcintfs ?? (_srcintfs = new InputList<Inputs.FirewallPolicySrcintfArgs>());
            set => _srcintfs = value;
        }

        /// <summary>
        /// Name of an existing SSH filter profile.
        /// </summary>
        [Input("sshFilterProfile")]
        public Input<string>? SshFilterProfile { get; set; }

        /// <summary>
        /// Redirect SSH traffic to matching transparent proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sshPolicyRedirect")]
        public Input<string>? SshPolicyRedirect { get; set; }

        /// <summary>
        /// Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sslMirror")]
        public Input<string>? SslMirror { get; set; }

        [Input("sslMirrorIntfs")]
        private InputList<Inputs.FirewallPolicySslMirrorIntfArgs>? _sslMirrorIntfs;

        /// <summary>
        /// SSL mirror interface name. The structure of `ssl_mirror_intf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicySslMirrorIntfArgs> SslMirrorIntfs
        {
            get => _sslMirrorIntfs ?? (_sslMirrorIntfs = new InputList<Inputs.FirewallPolicySslMirrorIntfArgs>());
            set => _sslMirrorIntfs = value;
        }

        /// <summary>
        /// Name of an existing SSL SSH profile.
        /// </summary>
        [Input("sslSshProfile")]
        public Input<string>? SslSshProfile { get; set; }

        /// <summary>
        /// Enable or disable this policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("status")]
        public Input<string>? Status { get; set; }

        /// <summary>
        /// Receiver TCP maximum segment size (MSS).
        /// </summary>
        [Input("tcpMssReceiver")]
        public Input<int>? TcpMssReceiver { get; set; }

        /// <summary>
        /// Sender TCP maximum segment size (MSS).
        /// </summary>
        [Input("tcpMssSender")]
        public Input<int>? TcpMssSender { get; set; }

        /// <summary>
        /// Enable/disable creation of TCP session without SYN flag. Valid values: `all`, `data-only`, `disable`.
        /// </summary>
        [Input("tcpSessionWithoutSyn")]
        public Input<string>? TcpSessionWithoutSyn { get; set; }

        /// <summary>
        /// Enable/disable sending RST packets when TCP sessions expire. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("timeoutSendRst")]
        public Input<string>? TimeoutSendRst { get; set; }

        /// <summary>
        /// ToS (Type of Service) value used for comparison.
        /// </summary>
        [Input("tos")]
        public Input<string>? Tos { get; set; }

        /// <summary>
        /// Non-zero bit positions are used for comparison while zero bit positions are ignored.
        /// </summary>
        [Input("tosMask")]
        public Input<string>? TosMask { get; set; }

        /// <summary>
        /// Enable negated TOS match. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tosNegate")]
        public Input<string>? TosNegate { get; set; }

        /// <summary>
        /// Traffic shaper.
        /// </summary>
        [Input("trafficShaper")]
        public Input<string>? TrafficShaper { get; set; }

        /// <summary>
        /// Reverse traffic shaper.
        /// </summary>
        [Input("trafficShaperReverse")]
        public Input<string>? TrafficShaperReverse { get; set; }

        [Input("urlCategories")]
        private InputList<Inputs.FirewallPolicyUrlCategoryArgs>? _urlCategories;

        /// <summary>
        /// URL category ID list. The structure of `url_category` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyUrlCategoryArgs> UrlCategories
        {
            get => _urlCategories ?? (_urlCategories = new InputList<Inputs.FirewallPolicyUrlCategoryArgs>());
            set => _urlCategories = value;
        }

        [Input("users")]
        private InputList<Inputs.FirewallPolicyUserArgs>? _users;

        /// <summary>
        /// Names of individual users that can authenticate with this policy. The structure of `users` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyUserArgs> Users
        {
            get => _users ?? (_users = new InputList<Inputs.FirewallPolicyUserArgs>());
            set => _users = value;
        }

        /// <summary>
        /// Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("utmStatus")]
        public Input<string>? UtmStatus { get; set; }

        /// <summary>
        /// Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
        /// </summary>
        [Input("uuid")]
        public Input<string>? Uuid { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        /// <summary>
        /// Name of an existing VideoFilter profile.
        /// </summary>
        [Input("videofilterProfile")]
        public Input<string>? VideofilterProfile { get; set; }

        /// <summary>
        /// VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
        /// </summary>
        [Input("vlanCosFwd")]
        public Input<int>? VlanCosFwd { get; set; }

        /// <summary>
        /// VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
        /// </summary>
        [Input("vlanCosRev")]
        public Input<int>? VlanCosRev { get; set; }

        /// <summary>
        /// Set VLAN filters.
        /// </summary>
        [Input("vlanFilter")]
        public Input<string>? VlanFilter { get; set; }

        /// <summary>
        /// Name of an existing VoIP profile.
        /// </summary>
        [Input("voipProfile")]
        public Input<string>? VoipProfile { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
        /// </summary>
        [Input("vpntunnel")]
        public Input<string>? Vpntunnel { get; set; }

        /// <summary>
        /// Name of an existing Web application firewall profile.
        /// </summary>
        [Input("wafProfile")]
        public Input<string>? WafProfile { get; set; }

        /// <summary>
        /// Enable/disable WAN optimization. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("wanopt")]
        public Input<string>? Wanopt { get; set; }

        /// <summary>
        /// WAN optimization auto-detection mode. Valid values: `active`, `passive`, `off`.
        /// </summary>
        [Input("wanoptDetection")]
        public Input<string>? WanoptDetection { get; set; }

        /// <summary>
        /// WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: `default`, `transparent`, `non-transparent`.
        /// </summary>
        [Input("wanoptPassiveOpt")]
        public Input<string>? WanoptPassiveOpt { get; set; }

        /// <summary>
        /// WAN optimization peer.
        /// </summary>
        [Input("wanoptPeer")]
        public Input<string>? WanoptPeer { get; set; }

        /// <summary>
        /// WAN optimization profile.
        /// </summary>
        [Input("wanoptProfile")]
        public Input<string>? WanoptProfile { get; set; }

        /// <summary>
        /// Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("wccp")]
        public Input<string>? Wccp { get; set; }

        /// <summary>
        /// Enable/disable web cache. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("webcache")]
        public Input<string>? Webcache { get; set; }

        /// <summary>
        /// Enable/disable web cache for HTTPS. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("webcacheHttps")]
        public Input<string>? WebcacheHttps { get; set; }

        /// <summary>
        /// Name of an existing Web filter profile.
        /// </summary>
        [Input("webfilterProfile")]
        public Input<string>? WebfilterProfile { get; set; }

        /// <summary>
        /// Web proxy forward server name.
        /// </summary>
        [Input("webproxyForwardServer")]
        public Input<string>? WebproxyForwardServer { get; set; }

        /// <summary>
        /// Webproxy profile name.
        /// </summary>
        [Input("webproxyProfile")]
        public Input<string>? WebproxyProfile { get; set; }

        /// <summary>
        /// Enable/disable WiFi Single Sign On (WSSO). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("wsso")]
        public Input<string>? Wsso { get; set; }

        [Input("ztnaEmsTags")]
        private InputList<Inputs.FirewallPolicyZtnaEmsTagArgs>? _ztnaEmsTags;

        /// <summary>
        /// Source ztna-ems-tag names. The structure of `ztna_ems_tag` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyZtnaEmsTagArgs> ZtnaEmsTags
        {
            get => _ztnaEmsTags ?? (_ztnaEmsTags = new InputList<Inputs.FirewallPolicyZtnaEmsTagArgs>());
            set => _ztnaEmsTags = value;
        }

        [Input("ztnaGeoTags")]
        private InputList<Inputs.FirewallPolicyZtnaGeoTagArgs>? _ztnaGeoTags;

        /// <summary>
        /// Source ztna-geo-tag names. The structure of `ztna_geo_tag` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyZtnaGeoTagArgs> ZtnaGeoTags
        {
            get => _ztnaGeoTags ?? (_ztnaGeoTags = new InputList<Inputs.FirewallPolicyZtnaGeoTagArgs>());
            set => _ztnaGeoTags = value;
        }

        /// <summary>
        /// Enable/disable zero trust access. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ztnaStatus")]
        public Input<string>? ZtnaStatus { get; set; }

        public FirewallPolicyArgs()
        {
        }
        public static new FirewallPolicyArgs Empty => new FirewallPolicyArgs();
    }

    public sealed class FirewallPolicyState : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// Policy action (allow/deny/ipsec). Valid values: `accept`, `deny`, `ipsec`.
        /// </summary>
        [Input("action")]
        public Input<string>? Action { get; set; }

        /// <summary>
        /// Enable/disable anti-replay check. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("antiReplay")]
        public Input<string>? AntiReplay { get; set; }

        [Input("appCategories")]
        private InputList<Inputs.FirewallPolicyAppCategoryGetArgs>? _appCategories;

        /// <summary>
        /// Application category ID list. The structure of `app_category` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyAppCategoryGetArgs> AppCategories
        {
            get => _appCategories ?? (_appCategories = new InputList<Inputs.FirewallPolicyAppCategoryGetArgs>());
            set => _appCategories = value;
        }

        [Input("appGroups")]
        private InputList<Inputs.FirewallPolicyAppGroupGetArgs>? _appGroups;

        /// <summary>
        /// Application group names. The structure of `app_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyAppGroupGetArgs> AppGroups
        {
            get => _appGroups ?? (_appGroups = new InputList<Inputs.FirewallPolicyAppGroupGetArgs>());
            set => _appGroups = value;
        }

        /// <summary>
        /// Name of an existing Application list.
        /// </summary>
        [Input("applicationList")]
        public Input<string>? ApplicationList { get; set; }

        [Input("applications")]
        private InputList<Inputs.FirewallPolicyApplicationGetArgs>? _applications;

        /// <summary>
        /// Application ID list. The structure of `application` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyApplicationGetArgs> Applications
        {
            get => _applications ?? (_applications = new InputList<Inputs.FirewallPolicyApplicationGetArgs>());
            set => _applications = value;
        }

        /// <summary>
        /// HTTPS server certificate for policy authentication.
        /// </summary>
        [Input("authCert")]
        public Input<string>? AuthCert { get; set; }

        /// <summary>
        /// Enable/disable authentication-based routing. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("authPath")]
        public Input<string>? AuthPath { get; set; }

        /// <summary>
        /// HTTP-to-HTTPS redirect address for firewall authentication.
        /// </summary>
        [Input("authRedirectAddr")]
        public Input<string>? AuthRedirectAddr { get; set; }

        /// <summary>
        /// Enable/disable policy traffic ASIC offloading. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("autoAsicOffload")]
        public Input<string>? AutoAsicOffload { get; set; }

        /// <summary>
        /// Name of an existing Antivirus profile.
        /// </summary>
        [Input("avProfile")]
        public Input<string>? AvProfile { get; set; }

        /// <summary>
        /// Enable/disable block notification. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("blockNotification")]
        public Input<string>? BlockNotification { get; set; }

        /// <summary>
        /// Enable to exempt some users from the captive portal. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("captivePortalExempt")]
        public Input<string>? CaptivePortalExempt { get; set; }

        /// <summary>
        /// Enable/disable capture packets. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("capturePacket")]
        public Input<string>? CapturePacket { get; set; }

        /// <summary>
        /// Name of an existing CIFS profile.
        /// </summary>
        [Input("cifsProfile")]
        public Input<string>? CifsProfile { get; set; }

        /// <summary>
        /// Comment.
        /// </summary>
        [Input("comments")]
        public Input<string>? Comments { get; set; }

        [Input("customLogFields")]
        private InputList<Inputs.FirewallPolicyCustomLogFieldGetArgs>? _customLogFields;

        /// <summary>
        /// Custom fields to append to log messages for this policy. The structure of `custom_log_fields` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyCustomLogFieldGetArgs> CustomLogFields
        {
            get => _customLogFields ?? (_customLogFields = new InputList<Inputs.FirewallPolicyCustomLogFieldGetArgs>());
            set => _customLogFields = value;
        }

        /// <summary>
        /// Decrypted traffic mirror.
        /// </summary>
        [Input("decryptedTrafficMirror")]
        public Input<string>? DecryptedTrafficMirror { get; set; }

        /// <summary>
        /// Enable TCP NPU session delay to guarantee packet order of 3-way handshake. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("delayTcpNpuSession")]
        public Input<string>? DelayTcpNpuSession { get; set; }

        [Input("devices")]
        private InputList<Inputs.FirewallPolicyDeviceGetArgs>? _devices;

        /// <summary>
        /// Names of devices or device groups that can be matched by the policy. The structure of `devices` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyDeviceGetArgs> Devices
        {
            get => _devices ?? (_devices = new InputList<Inputs.FirewallPolicyDeviceGetArgs>());
            set => _devices = value;
        }

        /// <summary>
        /// Enable to copy packet's DiffServ values from session's original direction to its reply direction. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("diffservCopy")]
        public Input<string>? DiffservCopy { get; set; }

        /// <summary>
        /// Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("diffservForward")]
        public Input<string>? DiffservForward { get; set; }

        /// <summary>
        /// Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("diffservReverse")]
        public Input<string>? DiffservReverse { get; set; }

        /// <summary>
        /// Change packet's DiffServ to this value.
        /// </summary>
        [Input("diffservcodeForward")]
        public Input<string>? DiffservcodeForward { get; set; }

        /// <summary>
        /// Change packet's reverse (reply) DiffServ to this value.
        /// </summary>
        [Input("diffservcodeRev")]
        public Input<string>? DiffservcodeRev { get; set; }

        /// <summary>
        /// Enable/disable user authentication disclaimer. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("disclaimer")]
        public Input<string>? Disclaimer { get; set; }

        /// <summary>
        /// Name of an existing DLP profile.
        /// </summary>
        [Input("dlpProfile")]
        public Input<string>? DlpProfile { get; set; }

        /// <summary>
        /// Name of an existing DLP sensor.
        /// </summary>
        [Input("dlpSensor")]
        public Input<string>? DlpSensor { get; set; }

        /// <summary>
        /// Name of an existing DNS filter profile.
        /// </summary>
        [Input("dnsfilterProfile")]
        public Input<string>? DnsfilterProfile { get; set; }

        /// <summary>
        /// Enable DSRI to ignore HTTP server responses. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dsri")]
        public Input<string>? Dsri { get; set; }

        /// <summary>
        /// When enabled dstaddr6 specifies what the destination address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dstaddr6Negate")]
        public Input<string>? Dstaddr6Negate { get; set; }

        [Input("dstaddr6s")]
        private InputList<Inputs.FirewallPolicyDstaddr6GetArgs>? _dstaddr6s;

        /// <summary>
        /// Destination IPv6 address name and address group names. The structure of `dstaddr6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyDstaddr6GetArgs> Dstaddr6s
        {
            get => _dstaddr6s ?? (_dstaddr6s = new InputList<Inputs.FirewallPolicyDstaddr6GetArgs>());
            set => _dstaddr6s = value;
        }

        /// <summary>
        /// When enabled dstaddr specifies what the destination address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dstaddrNegate")]
        public Input<string>? DstaddrNegate { get; set; }

        [Input("dstaddrs")]
        private InputList<Inputs.FirewallPolicyDstaddrGetArgs>? _dstaddrs;

        /// <summary>
        /// Destination address and address group names. The structure of `dstaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyDstaddrGetArgs> Dstaddrs
        {
            get => _dstaddrs ?? (_dstaddrs = new InputList<Inputs.FirewallPolicyDstaddrGetArgs>());
            set => _dstaddrs = value;
        }

        [Input("dstintfs")]
        private InputList<Inputs.FirewallPolicyDstintfGetArgs>? _dstintfs;

        /// <summary>
        /// Outgoing (egress) interface. The structure of `dstintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyDstintfGetArgs> Dstintfs
        {
            get => _dstintfs ?? (_dstintfs = new InputList<Inputs.FirewallPolicyDstintfGetArgs>());
            set => _dstintfs = value;
        }

        /// <summary>
        /// Enable/disable dynamic RADIUS defined traffic shaping. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dynamicShaping")]
        public Input<string>? DynamicShaping { get; set; }

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Input("dynamicSortSubtable")]
        public Input<string>? DynamicSortSubtable { get; set; }

        /// <summary>
        /// Enable/disable email collection. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("emailCollect")]
        public Input<string>? EmailCollect { get; set; }

        /// <summary>
        /// Name of an existing email filter profile.
        /// </summary>
        [Input("emailfilterProfile")]
        public Input<string>? EmailfilterProfile { get; set; }

        /// <summary>
        /// Enable/disable Forward Error Correction on traffic matching this policy on a FEC device. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("fec")]
        public Input<string>? Fec { get; set; }

        /// <summary>
        /// Name of an existing file-filter profile.
        /// </summary>
        [Input("fileFilterProfile")]
        public Input<string>? FileFilterProfile { get; set; }

        /// <summary>
        /// How to handle sessions if the configuration of this firewall policy changes. Valid values: `check-all`, `check-new`.
        /// </summary>
        [Input("firewallSessionDirty")]
        public Input<string>? FirewallSessionDirty { get; set; }

        /// <summary>
        /// Enable to prevent source NAT from changing a session's source port. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("fixedport")]
        public Input<string>? Fixedport { get; set; }

        /// <summary>
        /// Enable/disable Fortinet Single Sign-On. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("fsso")]
        public Input<string>? Fsso { get; set; }

        /// <summary>
        /// FSSO agent to use for NTLM authentication.
        /// </summary>
        [Input("fssoAgentForNtlm")]
        public Input<string>? FssoAgentForNtlm { get; set; }

        [Input("fssoGroups")]
        private InputList<Inputs.FirewallPolicyFssoGroupGetArgs>? _fssoGroups;

        /// <summary>
        /// Names of FSSO groups. The structure of `fsso_groups` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyFssoGroupGetArgs> FssoGroups
        {
            get => _fssoGroups ?? (_fssoGroups = new InputList<Inputs.FirewallPolicyFssoGroupGetArgs>());
            set => _fssoGroups = value;
        }

        /// <summary>
        /// Enable/disable recognition of anycast IP addresses using the geography IP database. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("geoipAnycast")]
        public Input<string>? GeoipAnycast { get; set; }

        /// <summary>
        /// Match geography address based either on its physical location or registered location. Valid values: `physical-location`, `registered-location`.
        /// </summary>
        [Input("geoipMatch")]
        public Input<string>? GeoipMatch { get; set; }

        /// <summary>
        /// Label for the policy that appears when the GUI is in Global View mode.
        /// </summary>
        [Input("globalLabel")]
        public Input<string>? GlobalLabel { get; set; }

        [Input("groups")]
        private InputList<Inputs.FirewallPolicyGroupGetArgs>? _groups;

        /// <summary>
        /// Names of user groups that can authenticate with this policy. The structure of `groups` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyGroupGetArgs> Groups
        {
            get => _groups ?? (_groups = new InputList<Inputs.FirewallPolicyGroupGetArgs>());
            set => _groups = value;
        }

        /// <summary>
        /// Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("httpPolicyRedirect")]
        public Input<string>? HttpPolicyRedirect { get; set; }

        /// <summary>
        /// Name of an existing ICAP profile.
        /// </summary>
        [Input("icapProfile")]
        public Input<string>? IcapProfile { get; set; }

        /// <summary>
        /// Name of identity-based routing rule.
        /// </summary>
        [Input("identityBasedRoute")]
        public Input<string>? IdentityBasedRoute { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("inbound")]
        public Input<string>? Inbound { get; set; }

        /// <summary>
        /// Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: `proxy`, `flow`.
        /// </summary>
        [Input("inspectionMode")]
        public Input<string>? InspectionMode { get; set; }

        /// <summary>
        /// Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used.  Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService")]
        public Input<string>? InternetService { get; set; }

        /// <summary>
        /// Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6")]
        public Input<string>? InternetService6 { get; set; }

        [Input("internetService6CustomGroups")]
        private InputList<Inputs.FirewallPolicyInternetService6CustomGroupGetArgs>? _internetService6CustomGroups;

        /// <summary>
        /// Custom Internet Service6 group name. The structure of `internet_service6_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6CustomGroupGetArgs> InternetService6CustomGroups
        {
            get => _internetService6CustomGroups ?? (_internetService6CustomGroups = new InputList<Inputs.FirewallPolicyInternetService6CustomGroupGetArgs>());
            set => _internetService6CustomGroups = value;
        }

        [Input("internetService6Customs")]
        private InputList<Inputs.FirewallPolicyInternetService6CustomGetArgs>? _internetService6Customs;

        /// <summary>
        /// Custom IPv6 Internet Service name. The structure of `internet_service6_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6CustomGetArgs> InternetService6Customs
        {
            get => _internetService6Customs ?? (_internetService6Customs = new InputList<Inputs.FirewallPolicyInternetService6CustomGetArgs>());
            set => _internetService6Customs = value;
        }

        [Input("internetService6Groups")]
        private InputList<Inputs.FirewallPolicyInternetService6GroupGetArgs>? _internetService6Groups;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service6_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6GroupGetArgs> InternetService6Groups
        {
            get => _internetService6Groups ?? (_internetService6Groups = new InputList<Inputs.FirewallPolicyInternetService6GroupGetArgs>());
            set => _internetService6Groups = value;
        }

        [Input("internetService6Names")]
        private InputList<Inputs.FirewallPolicyInternetService6NameGetArgs>? _internetService6Names;

        /// <summary>
        /// IPv6 Internet Service name. The structure of `internet_service6_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6NameGetArgs> InternetService6Names
        {
            get => _internetService6Names ?? (_internetService6Names = new InputList<Inputs.FirewallPolicyInternetService6NameGetArgs>());
            set => _internetService6Names = value;
        }

        /// <summary>
        /// When enabled internet-service6 specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6Negate")]
        public Input<string>? InternetService6Negate { get; set; }

        /// <summary>
        /// Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6Src")]
        public Input<string>? InternetService6Src { get; set; }

        [Input("internetService6SrcCustomGroups")]
        private InputList<Inputs.FirewallPolicyInternetService6SrcCustomGroupGetArgs>? _internetService6SrcCustomGroups;

        /// <summary>
        /// Custom Internet Service6 source group name. The structure of `internet_service6_src_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6SrcCustomGroupGetArgs> InternetService6SrcCustomGroups
        {
            get => _internetService6SrcCustomGroups ?? (_internetService6SrcCustomGroups = new InputList<Inputs.FirewallPolicyInternetService6SrcCustomGroupGetArgs>());
            set => _internetService6SrcCustomGroups = value;
        }

        [Input("internetService6SrcCustoms")]
        private InputList<Inputs.FirewallPolicyInternetService6SrcCustomGetArgs>? _internetService6SrcCustoms;

        /// <summary>
        /// Custom IPv6 Internet Service source name. The structure of `internet_service6_src_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6SrcCustomGetArgs> InternetService6SrcCustoms
        {
            get => _internetService6SrcCustoms ?? (_internetService6SrcCustoms = new InputList<Inputs.FirewallPolicyInternetService6SrcCustomGetArgs>());
            set => _internetService6SrcCustoms = value;
        }

        [Input("internetService6SrcGroups")]
        private InputList<Inputs.FirewallPolicyInternetService6SrcGroupGetArgs>? _internetService6SrcGroups;

        /// <summary>
        /// Internet Service6 source group name. The structure of `internet_service6_src_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6SrcGroupGetArgs> InternetService6SrcGroups
        {
            get => _internetService6SrcGroups ?? (_internetService6SrcGroups = new InputList<Inputs.FirewallPolicyInternetService6SrcGroupGetArgs>());
            set => _internetService6SrcGroups = value;
        }

        [Input("internetService6SrcNames")]
        private InputList<Inputs.FirewallPolicyInternetService6SrcNameGetArgs>? _internetService6SrcNames;

        /// <summary>
        /// IPv6 Internet Service source name. The structure of `internet_service6_src_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetService6SrcNameGetArgs> InternetService6SrcNames
        {
            get => _internetService6SrcNames ?? (_internetService6SrcNames = new InputList<Inputs.FirewallPolicyInternetService6SrcNameGetArgs>());
            set => _internetService6SrcNames = value;
        }

        /// <summary>
        /// When enabled internet-service6-src specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService6SrcNegate")]
        public Input<string>? InternetService6SrcNegate { get; set; }

        [Input("internetServiceCustomGroups")]
        private InputList<Inputs.FirewallPolicyInternetServiceCustomGroupGetArgs>? _internetServiceCustomGroups;

        /// <summary>
        /// Custom Internet Service group name. The structure of `internet_service_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceCustomGroupGetArgs> InternetServiceCustomGroups
        {
            get => _internetServiceCustomGroups ?? (_internetServiceCustomGroups = new InputList<Inputs.FirewallPolicyInternetServiceCustomGroupGetArgs>());
            set => _internetServiceCustomGroups = value;
        }

        [Input("internetServiceCustoms")]
        private InputList<Inputs.FirewallPolicyInternetServiceCustomGetArgs>? _internetServiceCustoms;

        /// <summary>
        /// Custom Internet Service name. The structure of `internet_service_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceCustomGetArgs> InternetServiceCustoms
        {
            get => _internetServiceCustoms ?? (_internetServiceCustoms = new InputList<Inputs.FirewallPolicyInternetServiceCustomGetArgs>());
            set => _internetServiceCustoms = value;
        }

        [Input("internetServiceGroups")]
        private InputList<Inputs.FirewallPolicyInternetServiceGroupGetArgs>? _internetServiceGroups;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceGroupGetArgs> InternetServiceGroups
        {
            get => _internetServiceGroups ?? (_internetServiceGroups = new InputList<Inputs.FirewallPolicyInternetServiceGroupGetArgs>());
            set => _internetServiceGroups = value;
        }

        [Input("internetServiceIds")]
        private InputList<Inputs.FirewallPolicyInternetServiceIdGetArgs>? _internetServiceIds;

        /// <summary>
        /// Internet Service ID. The structure of `internet_service_id` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceIdGetArgs> InternetServiceIds
        {
            get => _internetServiceIds ?? (_internetServiceIds = new InputList<Inputs.FirewallPolicyInternetServiceIdGetArgs>());
            set => _internetServiceIds = value;
        }

        [Input("internetServiceNames")]
        private InputList<Inputs.FirewallPolicyInternetServiceNameGetArgs>? _internetServiceNames;

        /// <summary>
        /// Internet Service name. The structure of `internet_service_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceNameGetArgs> InternetServiceNames
        {
            get => _internetServiceNames ?? (_internetServiceNames = new InputList<Inputs.FirewallPolicyInternetServiceNameGetArgs>());
            set => _internetServiceNames = value;
        }

        /// <summary>
        /// When enabled internet-service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetServiceNegate")]
        public Input<string>? InternetServiceNegate { get; set; }

        /// <summary>
        /// Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used.  Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetServiceSrc")]
        public Input<string>? InternetServiceSrc { get; set; }

        [Input("internetServiceSrcCustomGroups")]
        private InputList<Inputs.FirewallPolicyInternetServiceSrcCustomGroupGetArgs>? _internetServiceSrcCustomGroups;

        /// <summary>
        /// Custom Internet Service source group name. The structure of `internet_service_src_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceSrcCustomGroupGetArgs> InternetServiceSrcCustomGroups
        {
            get => _internetServiceSrcCustomGroups ?? (_internetServiceSrcCustomGroups = new InputList<Inputs.FirewallPolicyInternetServiceSrcCustomGroupGetArgs>());
            set => _internetServiceSrcCustomGroups = value;
        }

        [Input("internetServiceSrcCustoms")]
        private InputList<Inputs.FirewallPolicyInternetServiceSrcCustomGetArgs>? _internetServiceSrcCustoms;

        /// <summary>
        /// Custom Internet Service source name. The structure of `internet_service_src_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceSrcCustomGetArgs> InternetServiceSrcCustoms
        {
            get => _internetServiceSrcCustoms ?? (_internetServiceSrcCustoms = new InputList<Inputs.FirewallPolicyInternetServiceSrcCustomGetArgs>());
            set => _internetServiceSrcCustoms = value;
        }

        [Input("internetServiceSrcGroups")]
        private InputList<Inputs.FirewallPolicyInternetServiceSrcGroupGetArgs>? _internetServiceSrcGroups;

        /// <summary>
        /// Internet Service source group name. The structure of `internet_service_src_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceSrcGroupGetArgs> InternetServiceSrcGroups
        {
            get => _internetServiceSrcGroups ?? (_internetServiceSrcGroups = new InputList<Inputs.FirewallPolicyInternetServiceSrcGroupGetArgs>());
            set => _internetServiceSrcGroups = value;
        }

        [Input("internetServiceSrcIds")]
        private InputList<Inputs.FirewallPolicyInternetServiceSrcIdGetArgs>? _internetServiceSrcIds;

        /// <summary>
        /// Internet Service source ID. The structure of `internet_service_src_id` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceSrcIdGetArgs> InternetServiceSrcIds
        {
            get => _internetServiceSrcIds ?? (_internetServiceSrcIds = new InputList<Inputs.FirewallPolicyInternetServiceSrcIdGetArgs>());
            set => _internetServiceSrcIds = value;
        }

        [Input("internetServiceSrcNames")]
        private InputList<Inputs.FirewallPolicyInternetServiceSrcNameGetArgs>? _internetServiceSrcNames;

        /// <summary>
        /// Internet Service source name. The structure of `internet_service_src_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyInternetServiceSrcNameGetArgs> InternetServiceSrcNames
        {
            get => _internetServiceSrcNames ?? (_internetServiceSrcNames = new InputList<Inputs.FirewallPolicyInternetServiceSrcNameGetArgs>());
            set => _internetServiceSrcNames = value;
        }

        /// <summary>
        /// When enabled internet-service-src specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetServiceSrcNegate")]
        public Input<string>? InternetServiceSrcNegate { get; set; }

        /// <summary>
        /// Enable to use IP Pools for source NAT. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ippool")]
        public Input<string>? Ippool { get; set; }

        /// <summary>
        /// Name of an existing IPS sensor.
        /// </summary>
        [Input("ipsSensor")]
        public Input<string>? IpsSensor { get; set; }

        /// <summary>
        /// Label for the policy that appears when the GUI is in Section View mode.
        /// </summary>
        [Input("label")]
        public Input<string>? Label { get; set; }

        /// <summary>
        /// Enable to allow everything, but log all of the meaningful data for security information gathering. A learning report will be generated. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("learningMode")]
        public Input<string>? LearningMode { get; set; }

        /// <summary>
        /// Enable or disable logging. Log all sessions or security profile sessions. Valid values: `all`, `utm`, `disable`.
        /// </summary>
        [Input("logtraffic")]
        public Input<string>? Logtraffic { get; set; }

        /// <summary>
        /// Record logs when a session starts. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("logtrafficStart")]
        public Input<string>? LogtrafficStart { get; set; }

        /// <summary>
        /// Enable to match packets that have had their destination addresses changed by a VIP. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("matchVip")]
        public Input<string>? MatchVip { get; set; }

        /// <summary>
        /// Enable/disable matching of only those packets that have had their destination addresses changed by a VIP. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("matchVipOnly")]
        public Input<string>? MatchVipOnly { get; set; }

        /// <summary>
        /// Policy name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// Enable/disable source NAT. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("nat")]
        public Input<string>? Nat { get; set; }

        /// <summary>
        /// Enable/disable NAT46. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("nat46")]
        public Input<string>? Nat46 { get; set; }

        /// <summary>
        /// Enable/disable NAT64. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("nat64")]
        public Input<string>? Nat64 { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("natinbound")]
        public Input<string>? Natinbound { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: source NAT IP address for outgoing traffic.
        /// </summary>
        [Input("natip")]
        public Input<string>? Natip { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("natoutbound")]
        public Input<string>? Natoutbound { get; set; }

        [Input("networkServiceDynamics")]
        private InputList<Inputs.FirewallPolicyNetworkServiceDynamicGetArgs>? _networkServiceDynamics;

        /// <summary>
        /// Dynamic Network Service name. The structure of `network_service_dynamic` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyNetworkServiceDynamicGetArgs> NetworkServiceDynamics
        {
            get => _networkServiceDynamics ?? (_networkServiceDynamics = new InputList<Inputs.FirewallPolicyNetworkServiceDynamicGetArgs>());
            set => _networkServiceDynamics = value;
        }

        [Input("networkServiceSrcDynamics")]
        private InputList<Inputs.FirewallPolicyNetworkServiceSrcDynamicGetArgs>? _networkServiceSrcDynamics;

        /// <summary>
        /// Dynamic Network Service source name. The structure of `network_service_src_dynamic` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyNetworkServiceSrcDynamicGetArgs> NetworkServiceSrcDynamics
        {
            get => _networkServiceSrcDynamics ?? (_networkServiceSrcDynamics = new InputList<Inputs.FirewallPolicyNetworkServiceSrcDynamicGetArgs>());
            set => _networkServiceSrcDynamics = value;
        }

        /// <summary>
        /// Enable/disable UTM Network Processor acceleration. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("npAcceleration")]
        public Input<string>? NpAcceleration { get; set; }

        /// <summary>
        /// Enable/disable NTLM authentication. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ntlm")]
        public Input<string>? Ntlm { get; set; }

        [Input("ntlmEnabledBrowsers")]
        private InputList<Inputs.FirewallPolicyNtlmEnabledBrowserGetArgs>? _ntlmEnabledBrowsers;

        /// <summary>
        /// HTTP-User-Agent value of supported browsers. The structure of `ntlm_enabled_browsers` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyNtlmEnabledBrowserGetArgs> NtlmEnabledBrowsers
        {
            get => _ntlmEnabledBrowsers ?? (_ntlmEnabledBrowsers = new InputList<Inputs.FirewallPolicyNtlmEnabledBrowserGetArgs>());
            set => _ntlmEnabledBrowsers = value;
        }

        /// <summary>
        /// Enable/disable NTLM guest user access. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ntlmGuest")]
        public Input<string>? NtlmGuest { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("outbound")]
        public Input<string>? Outbound { get; set; }

        /// <summary>
        /// Enable/disable passive WAN health measurement. When enabled, auto-asic-offload is disabled. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("passiveWanHealthMeasurement")]
        public Input<string>? PassiveWanHealthMeasurement { get; set; }

        /// <summary>
        /// Per-IP traffic shaper.
        /// </summary>
        [Input("perIpShaper")]
        public Input<string>? PerIpShaper { get; set; }

        /// <summary>
        /// Accept UDP packets from any host. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("permitAnyHost")]
        public Input<string>? PermitAnyHost { get; set; }

        /// <summary>
        /// Accept UDP packets from any Session Traversal Utilities for NAT (STUN) host. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("permitStunHost")]
        public Input<string>? PermitStunHost { get; set; }

        /// <summary>
        /// Enable/disable policy expiry. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("policyExpiry")]
        public Input<string>? PolicyExpiry { get; set; }

        /// <summary>
        /// Policy expiry date (YYYY-MM-DD HH:MM:SS).
        /// </summary>
        [Input("policyExpiryDate")]
        public Input<string>? PolicyExpiryDate { get; set; }

        /// <summary>
        /// Policy ID.
        /// </summary>
        [Input("policyid")]
        public Input<int>? Policyid { get; set; }

        [Input("poolname6s")]
        private InputList<Inputs.FirewallPolicyPoolname6GetArgs>? _poolname6s;

        /// <summary>
        /// IPv6 pool names. The structure of `poolname6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyPoolname6GetArgs> Poolname6s
        {
            get => _poolname6s ?? (_poolname6s = new InputList<Inputs.FirewallPolicyPoolname6GetArgs>());
            set => _poolname6s = value;
        }

        [Input("poolnames")]
        private InputList<Inputs.FirewallPolicyPoolnameGetArgs>? _poolnames;

        /// <summary>
        /// IP Pool names. The structure of `poolname` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyPoolnameGetArgs> Poolnames
        {
            get => _poolnames ?? (_poolnames = new InputList<Inputs.FirewallPolicyPoolnameGetArgs>());
            set => _poolnames = value;
        }

        /// <summary>
        /// Name of profile group.
        /// </summary>
        [Input("profileGroup")]
        public Input<string>? ProfileGroup { get; set; }

        /// <summary>
        /// Name of an existing Protocol options profile.
        /// </summary>
        [Input("profileProtocolOptions")]
        public Input<string>? ProfileProtocolOptions { get; set; }

        /// <summary>
        /// Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: `single`, `group`.
        /// </summary>
        [Input("profileType")]
        public Input<string>? ProfileType { get; set; }

        /// <summary>
        /// Enable MAC authentication bypass. The bypassed MAC address must be received from RADIUS server. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("radiusMacAuthBypass")]
        public Input<string>? RadiusMacAuthBypass { get; set; }

        /// <summary>
        /// URL users are directed to after seeing and accepting the disclaimer or authenticating.
        /// </summary>
        [Input("redirectUrl")]
        public Input<string>? RedirectUrl { get; set; }

        /// <summary>
        /// Override the default replacement message group for this policy.
        /// </summary>
        [Input("replacemsgOverrideGroup")]
        public Input<string>? ReplacemsgOverrideGroup { get; set; }

        /// <summary>
        /// Direction of the initial traffic for reputation to take effect. Valid values: `source`, `destination`.
        /// </summary>
        [Input("reputationDirection")]
        public Input<string>? ReputationDirection { get; set; }

        /// <summary>
        /// Direction of the initial traffic for IPv6 reputation to take effect. Valid values: `source`, `destination`.
        /// </summary>
        [Input("reputationDirection6")]
        public Input<string>? ReputationDirection6 { get; set; }

        /// <summary>
        /// Minimum Reputation to take action.
        /// </summary>
        [Input("reputationMinimum")]
        public Input<int>? ReputationMinimum { get; set; }

        /// <summary>
        /// IPv6 Minimum Reputation to take action.
        /// </summary>
        [Input("reputationMinimum6")]
        public Input<int>? ReputationMinimum6 { get; set; }

        /// <summary>
        /// Enable/disable RADIUS single sign-on (RSSO). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("rsso")]
        public Input<string>? Rsso { get; set; }

        [Input("rtpAddrs")]
        private InputList<Inputs.FirewallPolicyRtpAddrGetArgs>? _rtpAddrs;

        /// <summary>
        /// Address names if this is an RTP NAT policy. The structure of `rtp_addr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyRtpAddrGetArgs> RtpAddrs
        {
            get => _rtpAddrs ?? (_rtpAddrs = new InputList<Inputs.FirewallPolicyRtpAddrGetArgs>());
            set => _rtpAddrs = value;
        }

        /// <summary>
        /// Enable Real Time Protocol (RTP) NAT. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("rtpNat")]
        public Input<string>? RtpNat { get; set; }

        /// <summary>
        /// Block or monitor connections to Botnet servers or disable Botnet scanning. Valid values: `disable`, `block`, `monitor`.
        /// </summary>
        [Input("scanBotnetConnections")]
        public Input<string>? ScanBotnetConnections { get; set; }

        /// <summary>
        /// Schedule name.(Default is `always`)
        /// </summary>
        [Input("schedule")]
        public Input<string>? Schedule { get; set; }

        /// <summary>
        /// Enable to force current sessions to end when the schedule object times out. Disable allows them to end from inactivity. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("scheduleTimeout")]
        public Input<string>? ScheduleTimeout { get; set; }

        /// <summary>
        /// Name of an existing SCTP filter profile.
        /// </summary>
        [Input("sctpFilterProfile")]
        public Input<string>? SctpFilterProfile { get; set; }

        /// <summary>
        /// Enable to send a reply when a session is denied or blocked by a firewall policy. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("sendDenyPacket")]
        public Input<string>? SendDenyPacket { get; set; }

        /// <summary>
        /// When enabled service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("serviceNegate")]
        public Input<string>? ServiceNegate { get; set; }

        [Input("services")]
        private InputList<Inputs.FirewallPolicyServiceGetArgs>? _services;

        /// <summary>
        /// Service and service group names. The structure of `service` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyServiceGetArgs> Services
        {
            get => _services ?? (_services = new InputList<Inputs.FirewallPolicyServiceGetArgs>());
            set => _services = value;
        }

        /// <summary>
        /// TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
        /// </summary>
        [Input("sessionTtl")]
        public Input<int>? SessionTtl { get; set; }

        /// <summary>
        /// Enable/disable security group tags (SGT) check. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sgtCheck")]
        public Input<string>? SgtCheck { get; set; }

        [Input("sgts")]
        private InputList<Inputs.FirewallPolicySgtGetArgs>? _sgts;

        /// <summary>
        /// Security group tags. The structure of `sgt` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicySgtGetArgs> Sgts
        {
            get => _sgts ?? (_sgts = new InputList<Inputs.FirewallPolicySgtGetArgs>());
            set => _sgts = value;
        }

        /// <summary>
        /// Name of an existing Spam filter profile.
        /// </summary>
        [Input("spamfilterProfile")]
        public Input<string>? SpamfilterProfile { get; set; }

        [Input("srcVendorMacs")]
        private InputList<Inputs.FirewallPolicySrcVendorMacGetArgs>? _srcVendorMacs;

        /// <summary>
        /// Vendor MAC source ID. The structure of `src_vendor_mac` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicySrcVendorMacGetArgs> SrcVendorMacs
        {
            get => _srcVendorMacs ?? (_srcVendorMacs = new InputList<Inputs.FirewallPolicySrcVendorMacGetArgs>());
            set => _srcVendorMacs = value;
        }

        /// <summary>
        /// When enabled srcaddr6 specifies what the source address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("srcaddr6Negate")]
        public Input<string>? Srcaddr6Negate { get; set; }

        [Input("srcaddr6s")]
        private InputList<Inputs.FirewallPolicySrcaddr6GetArgs>? _srcaddr6s;

        /// <summary>
        /// Source IPv6 address name and address group names. The structure of `srcaddr6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicySrcaddr6GetArgs> Srcaddr6s
        {
            get => _srcaddr6s ?? (_srcaddr6s = new InputList<Inputs.FirewallPolicySrcaddr6GetArgs>());
            set => _srcaddr6s = value;
        }

        /// <summary>
        /// When enabled srcaddr specifies what the source address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("srcaddrNegate")]
        public Input<string>? SrcaddrNegate { get; set; }

        [Input("srcaddrs")]
        private InputList<Inputs.FirewallPolicySrcaddrGetArgs>? _srcaddrs;

        /// <summary>
        /// Source address and address group names. The structure of `srcaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicySrcaddrGetArgs> Srcaddrs
        {
            get => _srcaddrs ?? (_srcaddrs = new InputList<Inputs.FirewallPolicySrcaddrGetArgs>());
            set => _srcaddrs = value;
        }

        [Input("srcintfs")]
        private InputList<Inputs.FirewallPolicySrcintfGetArgs>? _srcintfs;

        /// <summary>
        /// Incoming (ingress) interface. The structure of `srcintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicySrcintfGetArgs> Srcintfs
        {
            get => _srcintfs ?? (_srcintfs = new InputList<Inputs.FirewallPolicySrcintfGetArgs>());
            set => _srcintfs = value;
        }

        /// <summary>
        /// Name of an existing SSH filter profile.
        /// </summary>
        [Input("sshFilterProfile")]
        public Input<string>? SshFilterProfile { get; set; }

        /// <summary>
        /// Redirect SSH traffic to matching transparent proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sshPolicyRedirect")]
        public Input<string>? SshPolicyRedirect { get; set; }

        /// <summary>
        /// Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sslMirror")]
        public Input<string>? SslMirror { get; set; }

        [Input("sslMirrorIntfs")]
        private InputList<Inputs.FirewallPolicySslMirrorIntfGetArgs>? _sslMirrorIntfs;

        /// <summary>
        /// SSL mirror interface name. The structure of `ssl_mirror_intf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicySslMirrorIntfGetArgs> SslMirrorIntfs
        {
            get => _sslMirrorIntfs ?? (_sslMirrorIntfs = new InputList<Inputs.FirewallPolicySslMirrorIntfGetArgs>());
            set => _sslMirrorIntfs = value;
        }

        /// <summary>
        /// Name of an existing SSL SSH profile.
        /// </summary>
        [Input("sslSshProfile")]
        public Input<string>? SslSshProfile { get; set; }

        /// <summary>
        /// Enable or disable this policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("status")]
        public Input<string>? Status { get; set; }

        /// <summary>
        /// Receiver TCP maximum segment size (MSS).
        /// </summary>
        [Input("tcpMssReceiver")]
        public Input<int>? TcpMssReceiver { get; set; }

        /// <summary>
        /// Sender TCP maximum segment size (MSS).
        /// </summary>
        [Input("tcpMssSender")]
        public Input<int>? TcpMssSender { get; set; }

        /// <summary>
        /// Enable/disable creation of TCP session without SYN flag. Valid values: `all`, `data-only`, `disable`.
        /// </summary>
        [Input("tcpSessionWithoutSyn")]
        public Input<string>? TcpSessionWithoutSyn { get; set; }

        /// <summary>
        /// Enable/disable sending RST packets when TCP sessions expire. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("timeoutSendRst")]
        public Input<string>? TimeoutSendRst { get; set; }

        /// <summary>
        /// ToS (Type of Service) value used for comparison.
        /// </summary>
        [Input("tos")]
        public Input<string>? Tos { get; set; }

        /// <summary>
        /// Non-zero bit positions are used for comparison while zero bit positions are ignored.
        /// </summary>
        [Input("tosMask")]
        public Input<string>? TosMask { get; set; }

        /// <summary>
        /// Enable negated TOS match. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tosNegate")]
        public Input<string>? TosNegate { get; set; }

        /// <summary>
        /// Traffic shaper.
        /// </summary>
        [Input("trafficShaper")]
        public Input<string>? TrafficShaper { get; set; }

        /// <summary>
        /// Reverse traffic shaper.
        /// </summary>
        [Input("trafficShaperReverse")]
        public Input<string>? TrafficShaperReverse { get; set; }

        [Input("urlCategories")]
        private InputList<Inputs.FirewallPolicyUrlCategoryGetArgs>? _urlCategories;

        /// <summary>
        /// URL category ID list. The structure of `url_category` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyUrlCategoryGetArgs> UrlCategories
        {
            get => _urlCategories ?? (_urlCategories = new InputList<Inputs.FirewallPolicyUrlCategoryGetArgs>());
            set => _urlCategories = value;
        }

        [Input("users")]
        private InputList<Inputs.FirewallPolicyUserGetArgs>? _users;

        /// <summary>
        /// Names of individual users that can authenticate with this policy. The structure of `users` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyUserGetArgs> Users
        {
            get => _users ?? (_users = new InputList<Inputs.FirewallPolicyUserGetArgs>());
            set => _users = value;
        }

        /// <summary>
        /// Enable to add one or more security profiles (AV, IPS, etc.) to the firewall policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("utmStatus")]
        public Input<string>? UtmStatus { get; set; }

        /// <summary>
        /// Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
        /// </summary>
        [Input("uuid")]
        public Input<string>? Uuid { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        /// <summary>
        /// Name of an existing VideoFilter profile.
        /// </summary>
        [Input("videofilterProfile")]
        public Input<string>? VideofilterProfile { get; set; }

        /// <summary>
        /// VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest.
        /// </summary>
        [Input("vlanCosFwd")]
        public Input<int>? VlanCosFwd { get; set; }

        /// <summary>
        /// VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest.
        /// </summary>
        [Input("vlanCosRev")]
        public Input<int>? VlanCosRev { get; set; }

        /// <summary>
        /// Set VLAN filters.
        /// </summary>
        [Input("vlanFilter")]
        public Input<string>? VlanFilter { get; set; }

        /// <summary>
        /// Name of an existing VoIP profile.
        /// </summary>
        [Input("voipProfile")]
        public Input<string>? VoipProfile { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
        /// </summary>
        [Input("vpntunnel")]
        public Input<string>? Vpntunnel { get; set; }

        /// <summary>
        /// Name of an existing Web application firewall profile.
        /// </summary>
        [Input("wafProfile")]
        public Input<string>? WafProfile { get; set; }

        /// <summary>
        /// Enable/disable WAN optimization. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("wanopt")]
        public Input<string>? Wanopt { get; set; }

        /// <summary>
        /// WAN optimization auto-detection mode. Valid values: `active`, `passive`, `off`.
        /// </summary>
        [Input("wanoptDetection")]
        public Input<string>? WanoptDetection { get; set; }

        /// <summary>
        /// WAN optimization passive mode options. This option decides what IP address will be used to connect server. Valid values: `default`, `transparent`, `non-transparent`.
        /// </summary>
        [Input("wanoptPassiveOpt")]
        public Input<string>? WanoptPassiveOpt { get; set; }

        /// <summary>
        /// WAN optimization peer.
        /// </summary>
        [Input("wanoptPeer")]
        public Input<string>? WanoptPeer { get; set; }

        /// <summary>
        /// WAN optimization profile.
        /// </summary>
        [Input("wanoptProfile")]
        public Input<string>? WanoptProfile { get; set; }

        /// <summary>
        /// Enable/disable forwarding traffic matching this policy to a configured WCCP server. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("wccp")]
        public Input<string>? Wccp { get; set; }

        /// <summary>
        /// Enable/disable web cache. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("webcache")]
        public Input<string>? Webcache { get; set; }

        /// <summary>
        /// Enable/disable web cache for HTTPS. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("webcacheHttps")]
        public Input<string>? WebcacheHttps { get; set; }

        /// <summary>
        /// Name of an existing Web filter profile.
        /// </summary>
        [Input("webfilterProfile")]
        public Input<string>? WebfilterProfile { get; set; }

        /// <summary>
        /// Web proxy forward server name.
        /// </summary>
        [Input("webproxyForwardServer")]
        public Input<string>? WebproxyForwardServer { get; set; }

        /// <summary>
        /// Webproxy profile name.
        /// </summary>
        [Input("webproxyProfile")]
        public Input<string>? WebproxyProfile { get; set; }

        /// <summary>
        /// Enable/disable WiFi Single Sign On (WSSO). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("wsso")]
        public Input<string>? Wsso { get; set; }

        [Input("ztnaEmsTags")]
        private InputList<Inputs.FirewallPolicyZtnaEmsTagGetArgs>? _ztnaEmsTags;

        /// <summary>
        /// Source ztna-ems-tag names. The structure of `ztna_ems_tag` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyZtnaEmsTagGetArgs> ZtnaEmsTags
        {
            get => _ztnaEmsTags ?? (_ztnaEmsTags = new InputList<Inputs.FirewallPolicyZtnaEmsTagGetArgs>());
            set => _ztnaEmsTags = value;
        }

        [Input("ztnaGeoTags")]
        private InputList<Inputs.FirewallPolicyZtnaGeoTagGetArgs>? _ztnaGeoTags;

        /// <summary>
        /// Source ztna-geo-tag names. The structure of `ztna_geo_tag` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicyZtnaGeoTagGetArgs> ZtnaGeoTags
        {
            get => _ztnaGeoTags ?? (_ztnaGeoTags = new InputList<Inputs.FirewallPolicyZtnaGeoTagGetArgs>());
            set => _ztnaGeoTags = value;
        }

        /// <summary>
        /// Enable/disable zero trust access. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ztnaStatus")]
        public Input<string>? ZtnaStatus { get; set; }

        public FirewallPolicyState()
        {
        }
        public static new FirewallPolicyState Empty => new FirewallPolicyState();
    }
}
