// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Threading.Tasks;
using Pulumi.Serialization;
using Pulumi;

namespace Pulumiverse.Fortios
{
    /// <summary>
    /// Configure IPv6 policies. Applies to FortiOS Version `&lt;= 6.4.0`.
    /// 
    /// ## Example Usage
    /// 
    /// ```csharp
    /// using System.Collections.Generic;
    /// using System.Linq;
    /// using Pulumi;
    /// using Fortios = Pulumiverse.Fortios;
    /// 
    /// return await Deployment.RunAsync(() =&gt; 
    /// {
    ///     var trname = new Fortios.FirewallPolicy6("trname", new()
    ///     {
    ///         Action = "deny",
    ///         DiffservForward = "disable",
    ///         DiffservReverse = "disable",
    ///         DiffservcodeForward = "000000",
    ///         DiffservcodeRev = "000000",
    ///         Dsri = "disable",
    ///         Dstaddrs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallPolicy6DstaddrArgs
    ///             {
    ///                 Name = "all",
    ///             },
    ///         },
    ///         DstaddrNegate = "disable",
    ///         Dstintfs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallPolicy6DstintfArgs
    ///             {
    ///                 Name = "port3",
    ///             },
    ///         },
    ///         FirewallSessionDirty = "check-all",
    ///         Fixedport = "disable",
    ///         Inbound = "disable",
    ///         Ippool = "disable",
    ///         Logtraffic = "disable",
    ///         LogtrafficStart = "disable",
    ///         Nat = "disable",
    ///         Natinbound = "disable",
    ///         Natoutbound = "disable",
    ///         Outbound = "disable",
    ///         Policyid = 1,
    ///         ProfileProtocolOptions = "default",
    ///         ProfileType = "single",
    ///         Rsso = "disable",
    ///         Schedule = "always",
    ///         SendDenyPacket = "disable",
    ///         Services = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallPolicy6ServiceArgs
    ///             {
    ///                 Name = "ALL",
    ///             },
    ///         },
    ///         ServiceNegate = "disable",
    ///         Srcaddrs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallPolicy6SrcaddrArgs
    ///             {
    ///                 Name = "all",
    ///             },
    ///         },
    ///         SrcaddrNegate = "disable",
    ///         Srcintfs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallPolicy6SrcintfArgs
    ///             {
    ///                 Name = "port4",
    ///             },
    ///         },
    ///         SslMirror = "disable",
    ///         Status = "enable",
    ///         TcpMssReceiver = 0,
    ///         TcpMssSender = 0,
    ///         TcpSessionWithoutSyn = "disable",
    ///         TimeoutSendRst = "disable",
    ///         Tos = "0x00",
    ///         TosMask = "0x00",
    ///         TosNegate = "disable",
    ///         UtmStatus = "disable",
    ///     });
    /// 
    /// });
    /// ```
    /// 
    /// ## Import
    /// 
    /// Firewall Policy6 can be imported using any of these accepted formats
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/firewallPolicy6:FirewallPolicy6 labelname {{policyid}}
    /// ```
    /// 
    ///  If you do not want to import arguments of block$ export "FORTIOS_IMPORT_TABLE"="false"
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/firewallPolicy6:FirewallPolicy6 labelname {{policyid}}
    /// ```
    /// 
    ///  $ unset "FORTIOS_IMPORT_TABLE"
    /// </summary>
    [FortiosResourceType("fortios:index/firewallPolicy6:FirewallPolicy6")]
    public partial class FirewallPolicy6 : global::Pulumi.CustomResource
    {
        /// <summary>
        /// Policy action (allow/deny/ipsec). Valid values: `accept`, `deny`, `ipsec`.
        /// </summary>
        [Output("action")]
        public Output<string> Action { get; private set; } = null!;

        /// <summary>
        /// Enable/disable anti-replay check. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("antiReplay")]
        public Output<string> AntiReplay { get; private set; } = null!;

        /// <summary>
        /// Application category ID list. The structure of `app_category` block is documented below.
        /// </summary>
        [Output("appCategories")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6AppCategory>> AppCategories { get; private set; } = null!;

        /// <summary>
        /// Application group names. The structure of `app_group` block is documented below.
        /// </summary>
        [Output("appGroups")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6AppGroup>> AppGroups { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Application list.
        /// </summary>
        [Output("applicationList")]
        public Output<string> ApplicationList { get; private set; } = null!;

        /// <summary>
        /// Application ID list. The structure of `application` block is documented below.
        /// </summary>
        [Output("applications")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6Application>> Applications { get; private set; } = null!;

        /// <summary>
        /// Enable/disable policy traffic ASIC offloading. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("autoAsicOffload")]
        public Output<string> AutoAsicOffload { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Antivirus profile.
        /// </summary>
        [Output("avProfile")]
        public Output<string> AvProfile { get; private set; } = null!;

        /// <summary>
        /// Name of an existing CIFS profile.
        /// </summary>
        [Output("cifsProfile")]
        public Output<string> CifsProfile { get; private set; } = null!;

        /// <summary>
        /// Comment.
        /// </summary>
        [Output("comments")]
        public Output<string?> Comments { get; private set; } = null!;

        /// <summary>
        /// Log field index numbers to append custom log fields to log messages for this policy. The structure of `custom_log_fields` block is documented below.
        /// </summary>
        [Output("customLogFields")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6CustomLogField>> CustomLogFields { get; private set; } = null!;

        /// <summary>
        /// Decrypted traffic mirror.
        /// </summary>
        [Output("decryptedTrafficMirror")]
        public Output<string> DecryptedTrafficMirror { get; private set; } = null!;

        /// <summary>
        /// Names of devices or device groups that can be matched by the policy. The structure of `devices` block is documented below.
        /// </summary>
        [Output("devices")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6Device>> Devices { get; private set; } = null!;

        /// <summary>
        /// Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("diffservForward")]
        public Output<string> DiffservForward { get; private set; } = null!;

        /// <summary>
        /// Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("diffservReverse")]
        public Output<string> DiffservReverse { get; private set; } = null!;

        /// <summary>
        /// Change packet's DiffServ to this value.
        /// </summary>
        [Output("diffservcodeForward")]
        public Output<string> DiffservcodeForward { get; private set; } = null!;

        /// <summary>
        /// Change packet's reverse (reply) DiffServ to this value.
        /// </summary>
        [Output("diffservcodeRev")]
        public Output<string> DiffservcodeRev { get; private set; } = null!;

        /// <summary>
        /// Name of an existing DLP sensor.
        /// </summary>
        [Output("dlpSensor")]
        public Output<string> DlpSensor { get; private set; } = null!;

        /// <summary>
        /// Name of an existing DNS filter profile.
        /// </summary>
        [Output("dnsfilterProfile")]
        public Output<string> DnsfilterProfile { get; private set; } = null!;

        /// <summary>
        /// Enable DSRI to ignore HTTP server responses. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dsri")]
        public Output<string> Dsri { get; private set; } = null!;

        /// <summary>
        /// When enabled dstaddr specifies what the destination address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dstaddrNegate")]
        public Output<string> DstaddrNegate { get; private set; } = null!;

        /// <summary>
        /// Destination address and address group names. The structure of `dstaddr` block is documented below.
        /// </summary>
        [Output("dstaddrs")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6Dstaddr>> Dstaddrs { get; private set; } = null!;

        /// <summary>
        /// Outgoing (egress) interface. The structure of `dstintf` block is documented below.
        /// </summary>
        [Output("dstintfs")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6Dstintf>> Dstintfs { get; private set; } = null!;

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Output("dynamicSortSubtable")]
        public Output<string?> DynamicSortSubtable { get; private set; } = null!;

        /// <summary>
        /// Name of an existing email filter profile.
        /// </summary>
        [Output("emailfilterProfile")]
        public Output<string> EmailfilterProfile { get; private set; } = null!;

        /// <summary>
        /// How to handle sessions if the configuration of this firewall policy changes. Valid values: `check-all`, `check-new`.
        /// </summary>
        [Output("firewallSessionDirty")]
        public Output<string> FirewallSessionDirty { get; private set; } = null!;

        /// <summary>
        /// Enable to prevent source NAT from changing a session's source port. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("fixedport")]
        public Output<string> Fixedport { get; private set; } = null!;

        /// <summary>
        /// Names of FSSO groups. The structure of `fsso_groups` block is documented below.
        /// </summary>
        [Output("fssoGroups")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6FssoGroup>> FssoGroups { get; private set; } = null!;

        /// <summary>
        /// Label for the policy that appears when the GUI is in Global View mode.
        /// </summary>
        [Output("globalLabel")]
        public Output<string> GlobalLabel { get; private set; } = null!;

        /// <summary>
        /// Names of user groups that can authenticate with this policy. The structure of `groups` block is documented below.
        /// </summary>
        [Output("groups")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6Group>> Groups { get; private set; } = null!;

        /// <summary>
        /// Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("httpPolicyRedirect")]
        public Output<string> HttpPolicyRedirect { get; private set; } = null!;

        /// <summary>
        /// Name of an existing ICAP profile.
        /// </summary>
        [Output("icapProfile")]
        public Output<string> IcapProfile { get; private set; } = null!;

        /// <summary>
        /// Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("inbound")]
        public Output<string> Inbound { get; private set; } = null!;

        /// <summary>
        /// Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: `proxy`, `flow`.
        /// </summary>
        [Output("inspectionMode")]
        public Output<string> InspectionMode { get; private set; } = null!;

        /// <summary>
        /// Enable to use IP Pools for source NAT. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("ippool")]
        public Output<string> Ippool { get; private set; } = null!;

        /// <summary>
        /// Name of an existing IPS sensor.
        /// </summary>
        [Output("ipsSensor")]
        public Output<string> IpsSensor { get; private set; } = null!;

        /// <summary>
        /// Label for the policy that appears when the GUI is in Section View mode.
        /// </summary>
        [Output("label")]
        public Output<string> Label { get; private set; } = null!;

        /// <summary>
        /// Enable or disable logging. Log all sessions or security profile sessions. Valid values: `all`, `utm`, `disable`.
        /// </summary>
        [Output("logtraffic")]
        public Output<string> Logtraffic { get; private set; } = null!;

        /// <summary>
        /// Record logs when a session starts. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("logtrafficStart")]
        public Output<string> LogtrafficStart { get; private set; } = null!;

        /// <summary>
        /// Policy name.
        /// </summary>
        [Output("name")]
        public Output<string> Name { get; private set; } = null!;

        /// <summary>
        /// Enable/disable source NAT. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("nat")]
        public Output<string> Nat { get; private set; } = null!;

        /// <summary>
        /// Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("natinbound")]
        public Output<string> Natinbound { get; private set; } = null!;

        /// <summary>
        /// Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("natoutbound")]
        public Output<string> Natoutbound { get; private set; } = null!;

        /// <summary>
        /// Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("outbound")]
        public Output<string> Outbound { get; private set; } = null!;

        /// <summary>
        /// Per-IP traffic shaper.
        /// </summary>
        [Output("perIpShaper")]
        public Output<string> PerIpShaper { get; private set; } = null!;

        /// <summary>
        /// Policy ID.
        /// </summary>
        [Output("policyid")]
        public Output<int> Policyid { get; private set; } = null!;

        /// <summary>
        /// IP Pool names. The structure of `poolname` block is documented below.
        /// </summary>
        [Output("poolnames")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6Poolname>> Poolnames { get; private set; } = null!;

        /// <summary>
        /// Name of profile group.
        /// </summary>
        [Output("profileGroup")]
        public Output<string> ProfileGroup { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Protocol options profile.
        /// </summary>
        [Output("profileProtocolOptions")]
        public Output<string> ProfileProtocolOptions { get; private set; } = null!;

        /// <summary>
        /// Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: `single`, `group`.
        /// </summary>
        [Output("profileType")]
        public Output<string> ProfileType { get; private set; } = null!;

        /// <summary>
        /// Override the default replacement message group for this policy.
        /// </summary>
        [Output("replacemsgOverrideGroup")]
        public Output<string> ReplacemsgOverrideGroup { get; private set; } = null!;

        /// <summary>
        /// Enable/disable RADIUS single sign-on (RSSO). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("rsso")]
        public Output<string> Rsso { get; private set; } = null!;

        /// <summary>
        /// Schedule name.
        /// </summary>
        [Output("schedule")]
        public Output<string> Schedule { get; private set; } = null!;

        /// <summary>
        /// Enable/disable return of deny-packet. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("sendDenyPacket")]
        public Output<string> SendDenyPacket { get; private set; } = null!;

        /// <summary>
        /// When enabled service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("serviceNegate")]
        public Output<string> ServiceNegate { get; private set; } = null!;

        /// <summary>
        /// Service and service group names. The structure of `service` block is documented below.
        /// </summary>
        [Output("services")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6Service>> Services { get; private set; } = null!;

        /// <summary>
        /// Session TTL in seconds for sessions accepted by this policy. 0 means use the system default session TTL.
        /// </summary>
        [Output("sessionTtl")]
        public Output<int> SessionTtl { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Spam filter profile.
        /// </summary>
        [Output("spamfilterProfile")]
        public Output<string> SpamfilterProfile { get; private set; } = null!;

        /// <summary>
        /// When enabled srcaddr specifies what the source address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("srcaddrNegate")]
        public Output<string> SrcaddrNegate { get; private set; } = null!;

        /// <summary>
        /// Source address and address group names. The structure of `srcaddr` block is documented below.
        /// </summary>
        [Output("srcaddrs")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6Srcaddr>> Srcaddrs { get; private set; } = null!;

        /// <summary>
        /// Incoming (ingress) interface. The structure of `srcintf` block is documented below.
        /// </summary>
        [Output("srcintfs")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6Srcintf>> Srcintfs { get; private set; } = null!;

        /// <summary>
        /// Name of an existing SSH filter profile.
        /// </summary>
        [Output("sshFilterProfile")]
        public Output<string> SshFilterProfile { get; private set; } = null!;

        /// <summary>
        /// Redirect SSH traffic to matching transparent proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("sshPolicyRedirect")]
        public Output<string> SshPolicyRedirect { get; private set; } = null!;

        /// <summary>
        /// Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("sslMirror")]
        public Output<string> SslMirror { get; private set; } = null!;

        /// <summary>
        /// SSL mirror interface name. The structure of `ssl_mirror_intf` block is documented below.
        /// </summary>
        [Output("sslMirrorIntfs")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6SslMirrorIntf>> SslMirrorIntfs { get; private set; } = null!;

        /// <summary>
        /// Name of an existing SSL SSH profile.
        /// </summary>
        [Output("sslSshProfile")]
        public Output<string> SslSshProfile { get; private set; } = null!;

        /// <summary>
        /// Enable or disable this policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("status")]
        public Output<string> Status { get; private set; } = null!;

        /// <summary>
        /// Receiver TCP maximum segment size (MSS).
        /// </summary>
        [Output("tcpMssReceiver")]
        public Output<int> TcpMssReceiver { get; private set; } = null!;

        /// <summary>
        /// Sender TCP maximum segment size (MSS).
        /// </summary>
        [Output("tcpMssSender")]
        public Output<int> TcpMssSender { get; private set; } = null!;

        /// <summary>
        /// Enable/disable creation of TCP session without SYN flag. Valid values: `all`, `data-only`, `disable`.
        /// </summary>
        [Output("tcpSessionWithoutSyn")]
        public Output<string> TcpSessionWithoutSyn { get; private set; } = null!;

        /// <summary>
        /// Enable/disable sending RST packets when TCP sessions expire. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("timeoutSendRst")]
        public Output<string> TimeoutSendRst { get; private set; } = null!;

        /// <summary>
        /// ToS (Type of Service) value used for comparison.
        /// </summary>
        [Output("tos")]
        public Output<string> Tos { get; private set; } = null!;

        /// <summary>
        /// Non-zero bit positions are used for comparison while zero bit positions are ignored.
        /// </summary>
        [Output("tosMask")]
        public Output<string> TosMask { get; private set; } = null!;

        /// <summary>
        /// Enable negated TOS match. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("tosNegate")]
        public Output<string> TosNegate { get; private set; } = null!;

        /// <summary>
        /// Reverse traffic shaper.
        /// </summary>
        [Output("trafficShaper")]
        public Output<string> TrafficShaper { get; private set; } = null!;

        /// <summary>
        /// Reverse traffic shaper.
        /// </summary>
        [Output("trafficShaperReverse")]
        public Output<string> TrafficShaperReverse { get; private set; } = null!;

        /// <summary>
        /// URL category ID list. The structure of `url_category` block is documented below.
        /// </summary>
        [Output("urlCategories")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6UrlCategory>> UrlCategories { get; private set; } = null!;

        /// <summary>
        /// Names of individual users that can authenticate with this policy. The structure of `users` block is documented below.
        /// </summary>
        [Output("users")]
        public Output<ImmutableArray<Outputs.FirewallPolicy6User>> Users { get; private set; } = null!;

        /// <summary>
        /// Enable AV/web/ips protection profile. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("utmStatus")]
        public Output<string> UtmStatus { get; private set; } = null!;

        /// <summary>
        /// Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
        /// </summary>
        [Output("uuid")]
        public Output<string> Uuid { get; private set; } = null!;

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Output("vdomparam")]
        public Output<string?> Vdomparam { get; private set; } = null!;

        /// <summary>
        /// VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest
        /// </summary>
        [Output("vlanCosFwd")]
        public Output<int> VlanCosFwd { get; private set; } = null!;

        /// <summary>
        /// VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest
        /// </summary>
        [Output("vlanCosRev")]
        public Output<int> VlanCosRev { get; private set; } = null!;

        /// <summary>
        /// Set VLAN filters.
        /// </summary>
        [Output("vlanFilter")]
        public Output<string> VlanFilter { get; private set; } = null!;

        /// <summary>
        /// Name of an existing VoIP profile.
        /// </summary>
        [Output("voipProfile")]
        public Output<string> VoipProfile { get; private set; } = null!;

        /// <summary>
        /// Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
        /// </summary>
        [Output("vpntunnel")]
        public Output<string> Vpntunnel { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Web application firewall profile.
        /// </summary>
        [Output("wafProfile")]
        public Output<string> WafProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable web cache. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("webcache")]
        public Output<string> Webcache { get; private set; } = null!;

        /// <summary>
        /// Enable/disable web cache for HTTPS. Valid values: `disable`, `enable`.
        /// </summary>
        [Output("webcacheHttps")]
        public Output<string> WebcacheHttps { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Web filter profile.
        /// </summary>
        [Output("webfilterProfile")]
        public Output<string> WebfilterProfile { get; private set; } = null!;

        /// <summary>
        /// Web proxy forward server name.
        /// </summary>
        [Output("webproxyForwardServer")]
        public Output<string> WebproxyForwardServer { get; private set; } = null!;

        /// <summary>
        /// Webproxy profile name.
        /// </summary>
        [Output("webproxyProfile")]
        public Output<string> WebproxyProfile { get; private set; } = null!;


        /// <summary>
        /// Create a FirewallPolicy6 resource with the given unique name, arguments, and options.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resource</param>
        /// <param name="args">The arguments used to populate this resource's properties</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public FirewallPolicy6(string name, FirewallPolicy6Args args, CustomResourceOptions? options = null)
            : base("fortios:index/firewallPolicy6:FirewallPolicy6", name, args ?? new FirewallPolicy6Args(), MakeResourceOptions(options, ""))
        {
        }

        private FirewallPolicy6(string name, Input<string> id, FirewallPolicy6State? state = null, CustomResourceOptions? options = null)
            : base("fortios:index/firewallPolicy6:FirewallPolicy6", name, state, MakeResourceOptions(options, id))
        {
        }

        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
        {
            var defaultOptions = new CustomResourceOptions
            {
                Version = Utilities.Version,
                PluginDownloadURL = "github://api.github.com/pulumiverse/pulumi-fortios",
            };
            var merged = CustomResourceOptions.Merge(defaultOptions, options);
            // Override the ID if one was specified for consistency with other language SDKs.
            merged.Id = id ?? merged.Id;
            return merged;
        }
        /// <summary>
        /// Get an existing FirewallPolicy6 resource's state with the given name, ID, and optional extra
        /// properties used to qualify the lookup.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resulting resource.</param>
        /// <param name="id">The unique provider ID of the resource to lookup.</param>
        /// <param name="state">Any extra arguments used during the lookup.</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public static FirewallPolicy6 Get(string name, Input<string> id, FirewallPolicy6State? state = null, CustomResourceOptions? options = null)
        {
            return new FirewallPolicy6(name, id, state, options);
        }
    }

    public sealed class FirewallPolicy6Args : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// Policy action (allow/deny/ipsec). Valid values: `accept`, `deny`, `ipsec`.
        /// </summary>
        [Input("action")]
        public Input<string>? Action { get; set; }

        /// <summary>
        /// Enable/disable anti-replay check. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("antiReplay")]
        public Input<string>? AntiReplay { get; set; }

        [Input("appCategories")]
        private InputList<Inputs.FirewallPolicy6AppCategoryArgs>? _appCategories;

        /// <summary>
        /// Application category ID list. The structure of `app_category` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6AppCategoryArgs> AppCategories
        {
            get => _appCategories ?? (_appCategories = new InputList<Inputs.FirewallPolicy6AppCategoryArgs>());
            set => _appCategories = value;
        }

        [Input("appGroups")]
        private InputList<Inputs.FirewallPolicy6AppGroupArgs>? _appGroups;

        /// <summary>
        /// Application group names. The structure of `app_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6AppGroupArgs> AppGroups
        {
            get => _appGroups ?? (_appGroups = new InputList<Inputs.FirewallPolicy6AppGroupArgs>());
            set => _appGroups = value;
        }

        /// <summary>
        /// Name of an existing Application list.
        /// </summary>
        [Input("applicationList")]
        public Input<string>? ApplicationList { get; set; }

        [Input("applications")]
        private InputList<Inputs.FirewallPolicy6ApplicationArgs>? _applications;

        /// <summary>
        /// Application ID list. The structure of `application` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6ApplicationArgs> Applications
        {
            get => _applications ?? (_applications = new InputList<Inputs.FirewallPolicy6ApplicationArgs>());
            set => _applications = value;
        }

        /// <summary>
        /// Enable/disable policy traffic ASIC offloading. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("autoAsicOffload")]
        public Input<string>? AutoAsicOffload { get; set; }

        /// <summary>
        /// Name of an existing Antivirus profile.
        /// </summary>
        [Input("avProfile")]
        public Input<string>? AvProfile { get; set; }

        /// <summary>
        /// Name of an existing CIFS profile.
        /// </summary>
        [Input("cifsProfile")]
        public Input<string>? CifsProfile { get; set; }

        /// <summary>
        /// Comment.
        /// </summary>
        [Input("comments")]
        public Input<string>? Comments { get; set; }

        [Input("customLogFields")]
        private InputList<Inputs.FirewallPolicy6CustomLogFieldArgs>? _customLogFields;

        /// <summary>
        /// Log field index numbers to append custom log fields to log messages for this policy. The structure of `custom_log_fields` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6CustomLogFieldArgs> CustomLogFields
        {
            get => _customLogFields ?? (_customLogFields = new InputList<Inputs.FirewallPolicy6CustomLogFieldArgs>());
            set => _customLogFields = value;
        }

        /// <summary>
        /// Decrypted traffic mirror.
        /// </summary>
        [Input("decryptedTrafficMirror")]
        public Input<string>? DecryptedTrafficMirror { get; set; }

        [Input("devices")]
        private InputList<Inputs.FirewallPolicy6DeviceArgs>? _devices;

        /// <summary>
        /// Names of devices or device groups that can be matched by the policy. The structure of `devices` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6DeviceArgs> Devices
        {
            get => _devices ?? (_devices = new InputList<Inputs.FirewallPolicy6DeviceArgs>());
            set => _devices = value;
        }

        /// <summary>
        /// Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("diffservForward")]
        public Input<string>? DiffservForward { get; set; }

        /// <summary>
        /// Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("diffservReverse")]
        public Input<string>? DiffservReverse { get; set; }

        /// <summary>
        /// Change packet's DiffServ to this value.
        /// </summary>
        [Input("diffservcodeForward")]
        public Input<string>? DiffservcodeForward { get; set; }

        /// <summary>
        /// Change packet's reverse (reply) DiffServ to this value.
        /// </summary>
        [Input("diffservcodeRev")]
        public Input<string>? DiffservcodeRev { get; set; }

        /// <summary>
        /// Name of an existing DLP sensor.
        /// </summary>
        [Input("dlpSensor")]
        public Input<string>? DlpSensor { get; set; }

        /// <summary>
        /// Name of an existing DNS filter profile.
        /// </summary>
        [Input("dnsfilterProfile")]
        public Input<string>? DnsfilterProfile { get; set; }

        /// <summary>
        /// Enable DSRI to ignore HTTP server responses. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dsri")]
        public Input<string>? Dsri { get; set; }

        /// <summary>
        /// When enabled dstaddr specifies what the destination address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dstaddrNegate")]
        public Input<string>? DstaddrNegate { get; set; }

        [Input("dstaddrs", required: true)]
        private InputList<Inputs.FirewallPolicy6DstaddrArgs>? _dstaddrs;

        /// <summary>
        /// Destination address and address group names. The structure of `dstaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6DstaddrArgs> Dstaddrs
        {
            get => _dstaddrs ?? (_dstaddrs = new InputList<Inputs.FirewallPolicy6DstaddrArgs>());
            set => _dstaddrs = value;
        }

        [Input("dstintfs", required: true)]
        private InputList<Inputs.FirewallPolicy6DstintfArgs>? _dstintfs;

        /// <summary>
        /// Outgoing (egress) interface. The structure of `dstintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6DstintfArgs> Dstintfs
        {
            get => _dstintfs ?? (_dstintfs = new InputList<Inputs.FirewallPolicy6DstintfArgs>());
            set => _dstintfs = value;
        }

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Input("dynamicSortSubtable")]
        public Input<string>? DynamicSortSubtable { get; set; }

        /// <summary>
        /// Name of an existing email filter profile.
        /// </summary>
        [Input("emailfilterProfile")]
        public Input<string>? EmailfilterProfile { get; set; }

        /// <summary>
        /// How to handle sessions if the configuration of this firewall policy changes. Valid values: `check-all`, `check-new`.
        /// </summary>
        [Input("firewallSessionDirty")]
        public Input<string>? FirewallSessionDirty { get; set; }

        /// <summary>
        /// Enable to prevent source NAT from changing a session's source port. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("fixedport")]
        public Input<string>? Fixedport { get; set; }

        [Input("fssoGroups")]
        private InputList<Inputs.FirewallPolicy6FssoGroupArgs>? _fssoGroups;

        /// <summary>
        /// Names of FSSO groups. The structure of `fsso_groups` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6FssoGroupArgs> FssoGroups
        {
            get => _fssoGroups ?? (_fssoGroups = new InputList<Inputs.FirewallPolicy6FssoGroupArgs>());
            set => _fssoGroups = value;
        }

        /// <summary>
        /// Label for the policy that appears when the GUI is in Global View mode.
        /// </summary>
        [Input("globalLabel")]
        public Input<string>? GlobalLabel { get; set; }

        [Input("groups")]
        private InputList<Inputs.FirewallPolicy6GroupArgs>? _groups;

        /// <summary>
        /// Names of user groups that can authenticate with this policy. The structure of `groups` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6GroupArgs> Groups
        {
            get => _groups ?? (_groups = new InputList<Inputs.FirewallPolicy6GroupArgs>());
            set => _groups = value;
        }

        /// <summary>
        /// Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("httpPolicyRedirect")]
        public Input<string>? HttpPolicyRedirect { get; set; }

        /// <summary>
        /// Name of an existing ICAP profile.
        /// </summary>
        [Input("icapProfile")]
        public Input<string>? IcapProfile { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("inbound")]
        public Input<string>? Inbound { get; set; }

        /// <summary>
        /// Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: `proxy`, `flow`.
        /// </summary>
        [Input("inspectionMode")]
        public Input<string>? InspectionMode { get; set; }

        /// <summary>
        /// Enable to use IP Pools for source NAT. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ippool")]
        public Input<string>? Ippool { get; set; }

        /// <summary>
        /// Name of an existing IPS sensor.
        /// </summary>
        [Input("ipsSensor")]
        public Input<string>? IpsSensor { get; set; }

        /// <summary>
        /// Label for the policy that appears when the GUI is in Section View mode.
        /// </summary>
        [Input("label")]
        public Input<string>? Label { get; set; }

        /// <summary>
        /// Enable or disable logging. Log all sessions or security profile sessions. Valid values: `all`, `utm`, `disable`.
        /// </summary>
        [Input("logtraffic")]
        public Input<string>? Logtraffic { get; set; }

        /// <summary>
        /// Record logs when a session starts. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("logtrafficStart")]
        public Input<string>? LogtrafficStart { get; set; }

        /// <summary>
        /// Policy name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// Enable/disable source NAT. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("nat")]
        public Input<string>? Nat { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("natinbound")]
        public Input<string>? Natinbound { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("natoutbound")]
        public Input<string>? Natoutbound { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("outbound")]
        public Input<string>? Outbound { get; set; }

        /// <summary>
        /// Per-IP traffic shaper.
        /// </summary>
        [Input("perIpShaper")]
        public Input<string>? PerIpShaper { get; set; }

        /// <summary>
        /// Policy ID.
        /// </summary>
        [Input("policyid")]
        public Input<int>? Policyid { get; set; }

        [Input("poolnames")]
        private InputList<Inputs.FirewallPolicy6PoolnameArgs>? _poolnames;

        /// <summary>
        /// IP Pool names. The structure of `poolname` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6PoolnameArgs> Poolnames
        {
            get => _poolnames ?? (_poolnames = new InputList<Inputs.FirewallPolicy6PoolnameArgs>());
            set => _poolnames = value;
        }

        /// <summary>
        /// Name of profile group.
        /// </summary>
        [Input("profileGroup")]
        public Input<string>? ProfileGroup { get; set; }

        /// <summary>
        /// Name of an existing Protocol options profile.
        /// </summary>
        [Input("profileProtocolOptions")]
        public Input<string>? ProfileProtocolOptions { get; set; }

        /// <summary>
        /// Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: `single`, `group`.
        /// </summary>
        [Input("profileType")]
        public Input<string>? ProfileType { get; set; }

        /// <summary>
        /// Override the default replacement message group for this policy.
        /// </summary>
        [Input("replacemsgOverrideGroup")]
        public Input<string>? ReplacemsgOverrideGroup { get; set; }

        /// <summary>
        /// Enable/disable RADIUS single sign-on (RSSO). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("rsso")]
        public Input<string>? Rsso { get; set; }

        /// <summary>
        /// Schedule name.
        /// </summary>
        [Input("schedule", required: true)]
        public Input<string> Schedule { get; set; } = null!;

        /// <summary>
        /// Enable/disable return of deny-packet. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sendDenyPacket")]
        public Input<string>? SendDenyPacket { get; set; }

        /// <summary>
        /// When enabled service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("serviceNegate")]
        public Input<string>? ServiceNegate { get; set; }

        [Input("services")]
        private InputList<Inputs.FirewallPolicy6ServiceArgs>? _services;

        /// <summary>
        /// Service and service group names. The structure of `service` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6ServiceArgs> Services
        {
            get => _services ?? (_services = new InputList<Inputs.FirewallPolicy6ServiceArgs>());
            set => _services = value;
        }

        /// <summary>
        /// Session TTL in seconds for sessions accepted by this policy. 0 means use the system default session TTL.
        /// </summary>
        [Input("sessionTtl")]
        public Input<int>? SessionTtl { get; set; }

        /// <summary>
        /// Name of an existing Spam filter profile.
        /// </summary>
        [Input("spamfilterProfile")]
        public Input<string>? SpamfilterProfile { get; set; }

        /// <summary>
        /// When enabled srcaddr specifies what the source address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("srcaddrNegate")]
        public Input<string>? SrcaddrNegate { get; set; }

        [Input("srcaddrs", required: true)]
        private InputList<Inputs.FirewallPolicy6SrcaddrArgs>? _srcaddrs;

        /// <summary>
        /// Source address and address group names. The structure of `srcaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6SrcaddrArgs> Srcaddrs
        {
            get => _srcaddrs ?? (_srcaddrs = new InputList<Inputs.FirewallPolicy6SrcaddrArgs>());
            set => _srcaddrs = value;
        }

        [Input("srcintfs", required: true)]
        private InputList<Inputs.FirewallPolicy6SrcintfArgs>? _srcintfs;

        /// <summary>
        /// Incoming (ingress) interface. The structure of `srcintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6SrcintfArgs> Srcintfs
        {
            get => _srcintfs ?? (_srcintfs = new InputList<Inputs.FirewallPolicy6SrcintfArgs>());
            set => _srcintfs = value;
        }

        /// <summary>
        /// Name of an existing SSH filter profile.
        /// </summary>
        [Input("sshFilterProfile")]
        public Input<string>? SshFilterProfile { get; set; }

        /// <summary>
        /// Redirect SSH traffic to matching transparent proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sshPolicyRedirect")]
        public Input<string>? SshPolicyRedirect { get; set; }

        /// <summary>
        /// Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sslMirror")]
        public Input<string>? SslMirror { get; set; }

        [Input("sslMirrorIntfs")]
        private InputList<Inputs.FirewallPolicy6SslMirrorIntfArgs>? _sslMirrorIntfs;

        /// <summary>
        /// SSL mirror interface name. The structure of `ssl_mirror_intf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6SslMirrorIntfArgs> SslMirrorIntfs
        {
            get => _sslMirrorIntfs ?? (_sslMirrorIntfs = new InputList<Inputs.FirewallPolicy6SslMirrorIntfArgs>());
            set => _sslMirrorIntfs = value;
        }

        /// <summary>
        /// Name of an existing SSL SSH profile.
        /// </summary>
        [Input("sslSshProfile")]
        public Input<string>? SslSshProfile { get; set; }

        /// <summary>
        /// Enable or disable this policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("status")]
        public Input<string>? Status { get; set; }

        /// <summary>
        /// Receiver TCP maximum segment size (MSS).
        /// </summary>
        [Input("tcpMssReceiver")]
        public Input<int>? TcpMssReceiver { get; set; }

        /// <summary>
        /// Sender TCP maximum segment size (MSS).
        /// </summary>
        [Input("tcpMssSender")]
        public Input<int>? TcpMssSender { get; set; }

        /// <summary>
        /// Enable/disable creation of TCP session without SYN flag. Valid values: `all`, `data-only`, `disable`.
        /// </summary>
        [Input("tcpSessionWithoutSyn")]
        public Input<string>? TcpSessionWithoutSyn { get; set; }

        /// <summary>
        /// Enable/disable sending RST packets when TCP sessions expire. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("timeoutSendRst")]
        public Input<string>? TimeoutSendRst { get; set; }

        /// <summary>
        /// ToS (Type of Service) value used for comparison.
        /// </summary>
        [Input("tos")]
        public Input<string>? Tos { get; set; }

        /// <summary>
        /// Non-zero bit positions are used for comparison while zero bit positions are ignored.
        /// </summary>
        [Input("tosMask")]
        public Input<string>? TosMask { get; set; }

        /// <summary>
        /// Enable negated TOS match. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tosNegate")]
        public Input<string>? TosNegate { get; set; }

        /// <summary>
        /// Reverse traffic shaper.
        /// </summary>
        [Input("trafficShaper")]
        public Input<string>? TrafficShaper { get; set; }

        /// <summary>
        /// Reverse traffic shaper.
        /// </summary>
        [Input("trafficShaperReverse")]
        public Input<string>? TrafficShaperReverse { get; set; }

        [Input("urlCategories")]
        private InputList<Inputs.FirewallPolicy6UrlCategoryArgs>? _urlCategories;

        /// <summary>
        /// URL category ID list. The structure of `url_category` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6UrlCategoryArgs> UrlCategories
        {
            get => _urlCategories ?? (_urlCategories = new InputList<Inputs.FirewallPolicy6UrlCategoryArgs>());
            set => _urlCategories = value;
        }

        [Input("users")]
        private InputList<Inputs.FirewallPolicy6UserArgs>? _users;

        /// <summary>
        /// Names of individual users that can authenticate with this policy. The structure of `users` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6UserArgs> Users
        {
            get => _users ?? (_users = new InputList<Inputs.FirewallPolicy6UserArgs>());
            set => _users = value;
        }

        /// <summary>
        /// Enable AV/web/ips protection profile. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("utmStatus")]
        public Input<string>? UtmStatus { get; set; }

        /// <summary>
        /// Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
        /// </summary>
        [Input("uuid")]
        public Input<string>? Uuid { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        /// <summary>
        /// VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest
        /// </summary>
        [Input("vlanCosFwd")]
        public Input<int>? VlanCosFwd { get; set; }

        /// <summary>
        /// VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest
        /// </summary>
        [Input("vlanCosRev")]
        public Input<int>? VlanCosRev { get; set; }

        /// <summary>
        /// Set VLAN filters.
        /// </summary>
        [Input("vlanFilter")]
        public Input<string>? VlanFilter { get; set; }

        /// <summary>
        /// Name of an existing VoIP profile.
        /// </summary>
        [Input("voipProfile")]
        public Input<string>? VoipProfile { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
        /// </summary>
        [Input("vpntunnel")]
        public Input<string>? Vpntunnel { get; set; }

        /// <summary>
        /// Name of an existing Web application firewall profile.
        /// </summary>
        [Input("wafProfile")]
        public Input<string>? WafProfile { get; set; }

        /// <summary>
        /// Enable/disable web cache. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("webcache")]
        public Input<string>? Webcache { get; set; }

        /// <summary>
        /// Enable/disable web cache for HTTPS. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("webcacheHttps")]
        public Input<string>? WebcacheHttps { get; set; }

        /// <summary>
        /// Name of an existing Web filter profile.
        /// </summary>
        [Input("webfilterProfile")]
        public Input<string>? WebfilterProfile { get; set; }

        /// <summary>
        /// Web proxy forward server name.
        /// </summary>
        [Input("webproxyForwardServer")]
        public Input<string>? WebproxyForwardServer { get; set; }

        /// <summary>
        /// Webproxy profile name.
        /// </summary>
        [Input("webproxyProfile")]
        public Input<string>? WebproxyProfile { get; set; }

        public FirewallPolicy6Args()
        {
        }
        public static new FirewallPolicy6Args Empty => new FirewallPolicy6Args();
    }

    public sealed class FirewallPolicy6State : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// Policy action (allow/deny/ipsec). Valid values: `accept`, `deny`, `ipsec`.
        /// </summary>
        [Input("action")]
        public Input<string>? Action { get; set; }

        /// <summary>
        /// Enable/disable anti-replay check. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("antiReplay")]
        public Input<string>? AntiReplay { get; set; }

        [Input("appCategories")]
        private InputList<Inputs.FirewallPolicy6AppCategoryGetArgs>? _appCategories;

        /// <summary>
        /// Application category ID list. The structure of `app_category` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6AppCategoryGetArgs> AppCategories
        {
            get => _appCategories ?? (_appCategories = new InputList<Inputs.FirewallPolicy6AppCategoryGetArgs>());
            set => _appCategories = value;
        }

        [Input("appGroups")]
        private InputList<Inputs.FirewallPolicy6AppGroupGetArgs>? _appGroups;

        /// <summary>
        /// Application group names. The structure of `app_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6AppGroupGetArgs> AppGroups
        {
            get => _appGroups ?? (_appGroups = new InputList<Inputs.FirewallPolicy6AppGroupGetArgs>());
            set => _appGroups = value;
        }

        /// <summary>
        /// Name of an existing Application list.
        /// </summary>
        [Input("applicationList")]
        public Input<string>? ApplicationList { get; set; }

        [Input("applications")]
        private InputList<Inputs.FirewallPolicy6ApplicationGetArgs>? _applications;

        /// <summary>
        /// Application ID list. The structure of `application` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6ApplicationGetArgs> Applications
        {
            get => _applications ?? (_applications = new InputList<Inputs.FirewallPolicy6ApplicationGetArgs>());
            set => _applications = value;
        }

        /// <summary>
        /// Enable/disable policy traffic ASIC offloading. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("autoAsicOffload")]
        public Input<string>? AutoAsicOffload { get; set; }

        /// <summary>
        /// Name of an existing Antivirus profile.
        /// </summary>
        [Input("avProfile")]
        public Input<string>? AvProfile { get; set; }

        /// <summary>
        /// Name of an existing CIFS profile.
        /// </summary>
        [Input("cifsProfile")]
        public Input<string>? CifsProfile { get; set; }

        /// <summary>
        /// Comment.
        /// </summary>
        [Input("comments")]
        public Input<string>? Comments { get; set; }

        [Input("customLogFields")]
        private InputList<Inputs.FirewallPolicy6CustomLogFieldGetArgs>? _customLogFields;

        /// <summary>
        /// Log field index numbers to append custom log fields to log messages for this policy. The structure of `custom_log_fields` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6CustomLogFieldGetArgs> CustomLogFields
        {
            get => _customLogFields ?? (_customLogFields = new InputList<Inputs.FirewallPolicy6CustomLogFieldGetArgs>());
            set => _customLogFields = value;
        }

        /// <summary>
        /// Decrypted traffic mirror.
        /// </summary>
        [Input("decryptedTrafficMirror")]
        public Input<string>? DecryptedTrafficMirror { get; set; }

        [Input("devices")]
        private InputList<Inputs.FirewallPolicy6DeviceGetArgs>? _devices;

        /// <summary>
        /// Names of devices or device groups that can be matched by the policy. The structure of `devices` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6DeviceGetArgs> Devices
        {
            get => _devices ?? (_devices = new InputList<Inputs.FirewallPolicy6DeviceGetArgs>());
            set => _devices = value;
        }

        /// <summary>
        /// Enable to change packet's DiffServ values to the specified diffservcode-forward value. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("diffservForward")]
        public Input<string>? DiffservForward { get; set; }

        /// <summary>
        /// Enable to change packet's reverse (reply) DiffServ values to the specified diffservcode-rev value. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("diffservReverse")]
        public Input<string>? DiffservReverse { get; set; }

        /// <summary>
        /// Change packet's DiffServ to this value.
        /// </summary>
        [Input("diffservcodeForward")]
        public Input<string>? DiffservcodeForward { get; set; }

        /// <summary>
        /// Change packet's reverse (reply) DiffServ to this value.
        /// </summary>
        [Input("diffservcodeRev")]
        public Input<string>? DiffservcodeRev { get; set; }

        /// <summary>
        /// Name of an existing DLP sensor.
        /// </summary>
        [Input("dlpSensor")]
        public Input<string>? DlpSensor { get; set; }

        /// <summary>
        /// Name of an existing DNS filter profile.
        /// </summary>
        [Input("dnsfilterProfile")]
        public Input<string>? DnsfilterProfile { get; set; }

        /// <summary>
        /// Enable DSRI to ignore HTTP server responses. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dsri")]
        public Input<string>? Dsri { get; set; }

        /// <summary>
        /// When enabled dstaddr specifies what the destination address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dstaddrNegate")]
        public Input<string>? DstaddrNegate { get; set; }

        [Input("dstaddrs")]
        private InputList<Inputs.FirewallPolicy6DstaddrGetArgs>? _dstaddrs;

        /// <summary>
        /// Destination address and address group names. The structure of `dstaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6DstaddrGetArgs> Dstaddrs
        {
            get => _dstaddrs ?? (_dstaddrs = new InputList<Inputs.FirewallPolicy6DstaddrGetArgs>());
            set => _dstaddrs = value;
        }

        [Input("dstintfs")]
        private InputList<Inputs.FirewallPolicy6DstintfGetArgs>? _dstintfs;

        /// <summary>
        /// Outgoing (egress) interface. The structure of `dstintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6DstintfGetArgs> Dstintfs
        {
            get => _dstintfs ?? (_dstintfs = new InputList<Inputs.FirewallPolicy6DstintfGetArgs>());
            set => _dstintfs = value;
        }

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Input("dynamicSortSubtable")]
        public Input<string>? DynamicSortSubtable { get; set; }

        /// <summary>
        /// Name of an existing email filter profile.
        /// </summary>
        [Input("emailfilterProfile")]
        public Input<string>? EmailfilterProfile { get; set; }

        /// <summary>
        /// How to handle sessions if the configuration of this firewall policy changes. Valid values: `check-all`, `check-new`.
        /// </summary>
        [Input("firewallSessionDirty")]
        public Input<string>? FirewallSessionDirty { get; set; }

        /// <summary>
        /// Enable to prevent source NAT from changing a session's source port. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("fixedport")]
        public Input<string>? Fixedport { get; set; }

        [Input("fssoGroups")]
        private InputList<Inputs.FirewallPolicy6FssoGroupGetArgs>? _fssoGroups;

        /// <summary>
        /// Names of FSSO groups. The structure of `fsso_groups` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6FssoGroupGetArgs> FssoGroups
        {
            get => _fssoGroups ?? (_fssoGroups = new InputList<Inputs.FirewallPolicy6FssoGroupGetArgs>());
            set => _fssoGroups = value;
        }

        /// <summary>
        /// Label for the policy that appears when the GUI is in Global View mode.
        /// </summary>
        [Input("globalLabel")]
        public Input<string>? GlobalLabel { get; set; }

        [Input("groups")]
        private InputList<Inputs.FirewallPolicy6GroupGetArgs>? _groups;

        /// <summary>
        /// Names of user groups that can authenticate with this policy. The structure of `groups` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6GroupGetArgs> Groups
        {
            get => _groups ?? (_groups = new InputList<Inputs.FirewallPolicy6GroupGetArgs>());
            set => _groups = value;
        }

        /// <summary>
        /// Redirect HTTP(S) traffic to matching transparent web proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("httpPolicyRedirect")]
        public Input<string>? HttpPolicyRedirect { get; set; }

        /// <summary>
        /// Name of an existing ICAP profile.
        /// </summary>
        [Input("icapProfile")]
        public Input<string>? IcapProfile { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: only traffic from the remote network can initiate a VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("inbound")]
        public Input<string>? Inbound { get; set; }

        /// <summary>
        /// Policy inspection mode (Flow/proxy). Default is Flow mode. Valid values: `proxy`, `flow`.
        /// </summary>
        [Input("inspectionMode")]
        public Input<string>? InspectionMode { get; set; }

        /// <summary>
        /// Enable to use IP Pools for source NAT. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ippool")]
        public Input<string>? Ippool { get; set; }

        /// <summary>
        /// Name of an existing IPS sensor.
        /// </summary>
        [Input("ipsSensor")]
        public Input<string>? IpsSensor { get; set; }

        /// <summary>
        /// Label for the policy that appears when the GUI is in Section View mode.
        /// </summary>
        [Input("label")]
        public Input<string>? Label { get; set; }

        /// <summary>
        /// Enable or disable logging. Log all sessions or security profile sessions. Valid values: `all`, `utm`, `disable`.
        /// </summary>
        [Input("logtraffic")]
        public Input<string>? Logtraffic { get; set; }

        /// <summary>
        /// Record logs when a session starts. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("logtrafficStart")]
        public Input<string>? LogtrafficStart { get; set; }

        /// <summary>
        /// Policy name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// Enable/disable source NAT. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("nat")]
        public Input<string>? Nat { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: apply destination NAT to inbound traffic. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("natinbound")]
        public Input<string>? Natinbound { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: apply source NAT to outbound traffic. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("natoutbound")]
        public Input<string>? Natoutbound { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: only traffic from the internal network can initiate a VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("outbound")]
        public Input<string>? Outbound { get; set; }

        /// <summary>
        /// Per-IP traffic shaper.
        /// </summary>
        [Input("perIpShaper")]
        public Input<string>? PerIpShaper { get; set; }

        /// <summary>
        /// Policy ID.
        /// </summary>
        [Input("policyid")]
        public Input<int>? Policyid { get; set; }

        [Input("poolnames")]
        private InputList<Inputs.FirewallPolicy6PoolnameGetArgs>? _poolnames;

        /// <summary>
        /// IP Pool names. The structure of `poolname` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6PoolnameGetArgs> Poolnames
        {
            get => _poolnames ?? (_poolnames = new InputList<Inputs.FirewallPolicy6PoolnameGetArgs>());
            set => _poolnames = value;
        }

        /// <summary>
        /// Name of profile group.
        /// </summary>
        [Input("profileGroup")]
        public Input<string>? ProfileGroup { get; set; }

        /// <summary>
        /// Name of an existing Protocol options profile.
        /// </summary>
        [Input("profileProtocolOptions")]
        public Input<string>? ProfileProtocolOptions { get; set; }

        /// <summary>
        /// Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: `single`, `group`.
        /// </summary>
        [Input("profileType")]
        public Input<string>? ProfileType { get; set; }

        /// <summary>
        /// Override the default replacement message group for this policy.
        /// </summary>
        [Input("replacemsgOverrideGroup")]
        public Input<string>? ReplacemsgOverrideGroup { get; set; }

        /// <summary>
        /// Enable/disable RADIUS single sign-on (RSSO). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("rsso")]
        public Input<string>? Rsso { get; set; }

        /// <summary>
        /// Schedule name.
        /// </summary>
        [Input("schedule")]
        public Input<string>? Schedule { get; set; }

        /// <summary>
        /// Enable/disable return of deny-packet. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sendDenyPacket")]
        public Input<string>? SendDenyPacket { get; set; }

        /// <summary>
        /// When enabled service specifies what the service must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("serviceNegate")]
        public Input<string>? ServiceNegate { get; set; }

        [Input("services")]
        private InputList<Inputs.FirewallPolicy6ServiceGetArgs>? _services;

        /// <summary>
        /// Service and service group names. The structure of `service` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6ServiceGetArgs> Services
        {
            get => _services ?? (_services = new InputList<Inputs.FirewallPolicy6ServiceGetArgs>());
            set => _services = value;
        }

        /// <summary>
        /// Session TTL in seconds for sessions accepted by this policy. 0 means use the system default session TTL.
        /// </summary>
        [Input("sessionTtl")]
        public Input<int>? SessionTtl { get; set; }

        /// <summary>
        /// Name of an existing Spam filter profile.
        /// </summary>
        [Input("spamfilterProfile")]
        public Input<string>? SpamfilterProfile { get; set; }

        /// <summary>
        /// When enabled srcaddr specifies what the source address must NOT be. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("srcaddrNegate")]
        public Input<string>? SrcaddrNegate { get; set; }

        [Input("srcaddrs")]
        private InputList<Inputs.FirewallPolicy6SrcaddrGetArgs>? _srcaddrs;

        /// <summary>
        /// Source address and address group names. The structure of `srcaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6SrcaddrGetArgs> Srcaddrs
        {
            get => _srcaddrs ?? (_srcaddrs = new InputList<Inputs.FirewallPolicy6SrcaddrGetArgs>());
            set => _srcaddrs = value;
        }

        [Input("srcintfs")]
        private InputList<Inputs.FirewallPolicy6SrcintfGetArgs>? _srcintfs;

        /// <summary>
        /// Incoming (ingress) interface. The structure of `srcintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6SrcintfGetArgs> Srcintfs
        {
            get => _srcintfs ?? (_srcintfs = new InputList<Inputs.FirewallPolicy6SrcintfGetArgs>());
            set => _srcintfs = value;
        }

        /// <summary>
        /// Name of an existing SSH filter profile.
        /// </summary>
        [Input("sshFilterProfile")]
        public Input<string>? SshFilterProfile { get; set; }

        /// <summary>
        /// Redirect SSH traffic to matching transparent proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sshPolicyRedirect")]
        public Input<string>? SshPolicyRedirect { get; set; }

        /// <summary>
        /// Enable to copy decrypted SSL traffic to a FortiGate interface (called SSL mirroring). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sslMirror")]
        public Input<string>? SslMirror { get; set; }

        [Input("sslMirrorIntfs")]
        private InputList<Inputs.FirewallPolicy6SslMirrorIntfGetArgs>? _sslMirrorIntfs;

        /// <summary>
        /// SSL mirror interface name. The structure of `ssl_mirror_intf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6SslMirrorIntfGetArgs> SslMirrorIntfs
        {
            get => _sslMirrorIntfs ?? (_sslMirrorIntfs = new InputList<Inputs.FirewallPolicy6SslMirrorIntfGetArgs>());
            set => _sslMirrorIntfs = value;
        }

        /// <summary>
        /// Name of an existing SSL SSH profile.
        /// </summary>
        [Input("sslSshProfile")]
        public Input<string>? SslSshProfile { get; set; }

        /// <summary>
        /// Enable or disable this policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("status")]
        public Input<string>? Status { get; set; }

        /// <summary>
        /// Receiver TCP maximum segment size (MSS).
        /// </summary>
        [Input("tcpMssReceiver")]
        public Input<int>? TcpMssReceiver { get; set; }

        /// <summary>
        /// Sender TCP maximum segment size (MSS).
        /// </summary>
        [Input("tcpMssSender")]
        public Input<int>? TcpMssSender { get; set; }

        /// <summary>
        /// Enable/disable creation of TCP session without SYN flag. Valid values: `all`, `data-only`, `disable`.
        /// </summary>
        [Input("tcpSessionWithoutSyn")]
        public Input<string>? TcpSessionWithoutSyn { get; set; }

        /// <summary>
        /// Enable/disable sending RST packets when TCP sessions expire. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("timeoutSendRst")]
        public Input<string>? TimeoutSendRst { get; set; }

        /// <summary>
        /// ToS (Type of Service) value used for comparison.
        /// </summary>
        [Input("tos")]
        public Input<string>? Tos { get; set; }

        /// <summary>
        /// Non-zero bit positions are used for comparison while zero bit positions are ignored.
        /// </summary>
        [Input("tosMask")]
        public Input<string>? TosMask { get; set; }

        /// <summary>
        /// Enable negated TOS match. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tosNegate")]
        public Input<string>? TosNegate { get; set; }

        /// <summary>
        /// Reverse traffic shaper.
        /// </summary>
        [Input("trafficShaper")]
        public Input<string>? TrafficShaper { get; set; }

        /// <summary>
        /// Reverse traffic shaper.
        /// </summary>
        [Input("trafficShaperReverse")]
        public Input<string>? TrafficShaperReverse { get; set; }

        [Input("urlCategories")]
        private InputList<Inputs.FirewallPolicy6UrlCategoryGetArgs>? _urlCategories;

        /// <summary>
        /// URL category ID list. The structure of `url_category` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6UrlCategoryGetArgs> UrlCategories
        {
            get => _urlCategories ?? (_urlCategories = new InputList<Inputs.FirewallPolicy6UrlCategoryGetArgs>());
            set => _urlCategories = value;
        }

        [Input("users")]
        private InputList<Inputs.FirewallPolicy6UserGetArgs>? _users;

        /// <summary>
        /// Names of individual users that can authenticate with this policy. The structure of `users` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallPolicy6UserGetArgs> Users
        {
            get => _users ?? (_users = new InputList<Inputs.FirewallPolicy6UserGetArgs>());
            set => _users = value;
        }

        /// <summary>
        /// Enable AV/web/ips protection profile. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("utmStatus")]
        public Input<string>? UtmStatus { get; set; }

        /// <summary>
        /// Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
        /// </summary>
        [Input("uuid")]
        public Input<string>? Uuid { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        /// <summary>
        /// VLAN forward direction user priority: 255 passthrough, 0 lowest, 7 highest
        /// </summary>
        [Input("vlanCosFwd")]
        public Input<int>? VlanCosFwd { get; set; }

        /// <summary>
        /// VLAN reverse direction user priority: 255 passthrough, 0 lowest, 7 highest
        /// </summary>
        [Input("vlanCosRev")]
        public Input<int>? VlanCosRev { get; set; }

        /// <summary>
        /// Set VLAN filters.
        /// </summary>
        [Input("vlanFilter")]
        public Input<string>? VlanFilter { get; set; }

        /// <summary>
        /// Name of an existing VoIP profile.
        /// </summary>
        [Input("voipProfile")]
        public Input<string>? VoipProfile { get; set; }

        /// <summary>
        /// Policy-based IPsec VPN: name of the IPsec VPN Phase 1.
        /// </summary>
        [Input("vpntunnel")]
        public Input<string>? Vpntunnel { get; set; }

        /// <summary>
        /// Name of an existing Web application firewall profile.
        /// </summary>
        [Input("wafProfile")]
        public Input<string>? WafProfile { get; set; }

        /// <summary>
        /// Enable/disable web cache. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("webcache")]
        public Input<string>? Webcache { get; set; }

        /// <summary>
        /// Enable/disable web cache for HTTPS. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("webcacheHttps")]
        public Input<string>? WebcacheHttps { get; set; }

        /// <summary>
        /// Name of an existing Web filter profile.
        /// </summary>
        [Input("webfilterProfile")]
        public Input<string>? WebfilterProfile { get; set; }

        /// <summary>
        /// Web proxy forward server name.
        /// </summary>
        [Input("webproxyForwardServer")]
        public Input<string>? WebproxyForwardServer { get; set; }

        /// <summary>
        /// Webproxy profile name.
        /// </summary>
        [Input("webproxyProfile")]
        public Input<string>? WebproxyProfile { get; set; }

        public FirewallPolicy6State()
        {
        }
        public static new FirewallPolicy6State Empty => new FirewallPolicy6State();
    }
}
