<filename>sdk/dotnet/FirewallProxypolicy.cs// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Threading.Tasks;
using Pulumi.Serialization;
using Pulumi;

namespace Pulumiverse.Fortios
{
    /// <summary>
    /// Configure proxy policies.
    /// 
    /// ## Example Usage
    /// 
    /// ```csharp
    /// using System.Collections.Generic;
    /// using System.Linq;
    /// using Pulumi;
    /// using Fortios = Pulumiverse.Fortios;
    /// 
    /// return await Deployment.RunAsync(() =&gt; 
    /// {
    ///     var trname = new Fortios.FirewallProxypolicy("trname", new()
    ///     {
    ///         Action = "deny",
    ///         Disclaimer = "disable",
    ///         Dstaddrs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallProxypolicyDstaddrArgs
    ///             {
    ///                 Name = "all",
    ///             },
    ///         },
    ///         DstaddrNegate = "disable",
    ///         Dstintfs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallProxypolicyDstintfArgs
    ///             {
    ///                 Name = "port4",
    ///             },
    ///         },
    ///         HttpTunnelAuth = "disable",
    ///         InternetService = "disable",
    ///         InternetServiceNegate = "disable",
    ///         Logtraffic = "disable",
    ///         LogtrafficStart = "disable",
    ///         Policyid = 1,
    ///         ProfileProtocolOptions = "default",
    ///         ProfileType = "single",
    ///         Proxy = "transparent-web",
    ///         ScanBotnetConnections = "disable",
    ///         Schedule = "always",
    ///         Services = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallProxypolicyServiceArgs
    ///             {
    ///                 Name = "webproxy",
    ///             },
    ///         },
    ///         ServiceNegate = "disable",
    ///         Srcaddrs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallProxypolicySrcaddrArgs
    ///             {
    ///                 Name = "all",
    ///             },
    ///         },
    ///         SrcaddrNegate = "disable",
    ///         Srcintfs = new[]
    ///         {
    ///             new Fortios.Inputs.FirewallProxypolicySrcintfArgs
    ///             {
    ///                 Name = "port3",
    ///             },
    ///         },
    ///         Status = "enable",
    ///         Transparent = "disable",
    ///         UtmStatus = "disable",
    ///         Webcache = "disable",
    ///         WebcacheHttps = "disable",
    ///     });
    /// 
    /// });
    /// ```
    /// 
    /// ## Import
    /// 
    /// Firewall ProxyPolicy can be imported using any of these accepted formats
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/firewallProxypolicy:FirewallProxypolicy labelname {{policyid}}
    /// ```
    /// 
    ///  If you do not want to import arguments of block$ export "FORTIOS_IMPORT_TABLE"="false"
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/firewallProxypolicy:FirewallProxypolicy labelname {{policyid}}
    /// ```
    /// 
    ///  $ unset "FORTIOS_IMPORT_TABLE"
    /// </summary>
    [FortiosResourceType("fortios:index/firewallProxypolicy:FirewallProxypolicy")]
    public partial class FirewallProxypolicy : global::Pulumi.CustomResource
    {
        /// <summary>
        /// IPv4 access proxy. The structure of `access_proxy` block is documented below.
        /// </summary>
        [Output("accessProxies")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyAccessProxy>> AccessProxies { get; private set; } = null!;

        /// <summary>
        /// IPv6 access proxy. The structure of `access_proxy6` block is documented below.
        /// </summary>
        [Output("accessProxy6s")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyAccessProxy6>> AccessProxy6s { get; private set; } = null!;

        /// <summary>
        /// Accept or deny traffic matching the policy parameters. Valid values: `accept`, `deny`, `redirect`.
        /// </summary>
        [Output("action")]
        public Output<string> Action { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Application list.
        /// </summary>
        [Output("applicationList")]
        public Output<string> ApplicationList { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Antivirus profile.
        /// </summary>
        [Output("avProfile")]
        public Output<string> AvProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable block notification. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("blockNotification")]
        public Output<string> BlockNotification { get; private set; } = null!;

        /// <summary>
        /// Name of an existing CIFS profile.
        /// </summary>
        [Output("cifsProfile")]
        public Output<string> CifsProfile { get; private set; } = null!;

        /// <summary>
        /// Optional comments.
        /// </summary>
        [Output("comments")]
        public Output<string?> Comments { get; private set; } = null!;

        /// <summary>
        /// Decrypted traffic mirror.
        /// </summary>
        [Output("decryptedTrafficMirror")]
        public Output<string> DecryptedTrafficMirror { get; private set; } = null!;

        /// <summary>
        /// When enabled, the ownership enforcement will be done at policy level. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("deviceOwnership")]
        public Output<string> DeviceOwnership { get; private set; } = null!;

        /// <summary>
        /// Web proxy disclaimer setting: by domain, policy, or user. Valid values: `disable`, `domain`, `policy`, `user`.
        /// </summary>
        [Output("disclaimer")]
        public Output<string> Disclaimer { get; private set; } = null!;

        /// <summary>
        /// Name of an existing DLP profile.
        /// </summary>
        [Output("dlpProfile")]
        public Output<string> DlpProfile { get; private set; } = null!;

        /// <summary>
        /// Name of an existing DLP sensor.
        /// </summary>
        [Output("dlpSensor")]
        public Output<string> DlpSensor { get; private set; } = null!;

        /// <summary>
        /// IPv6 destination address objects. The structure of `dstaddr6` block is documented below.
        /// </summary>
        [Output("dstaddr6s")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyDstaddr6>> Dstaddr6s { get; private set; } = null!;

        /// <summary>
        /// When enabled, destination addresses match against any address EXCEPT the specified destination addresses. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dstaddrNegate")]
        public Output<string> DstaddrNegate { get; private set; } = null!;

        /// <summary>
        /// Destination address objects. The structure of `dstaddr` block is documented below.
        /// </summary>
        [Output("dstaddrs")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyDstaddr>> Dstaddrs { get; private set; } = null!;

        /// <summary>
        /// Destination interface names. The structure of `dstintf` block is documented below.
        /// </summary>
        [Output("dstintfs")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyDstintf>> Dstintfs { get; private set; } = null!;

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Output("dynamicSortSubtable")]
        public Output<string?> DynamicSortSubtable { get; private set; } = null!;

        /// <summary>
        /// Name of an existing email filter profile.
        /// </summary>
        [Output("emailfilterProfile")]
        public Output<string> EmailfilterProfile { get; private set; } = null!;

        /// <summary>
        /// Name of an existing file-filter profile.
        /// </summary>
        [Output("fileFilterProfile")]
        public Output<string> FileFilterProfile { get; private set; } = null!;

        /// <summary>
        /// Global web-based manager visible label.
        /// </summary>
        [Output("globalLabel")]
        public Output<string> GlobalLabel { get; private set; } = null!;

        /// <summary>
        /// Names of group objects. The structure of `groups` block is documented below.
        /// </summary>
        [Output("groups")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyGroup>> Groups { get; private set; } = null!;

        /// <summary>
        /// Enable/disable HTTP tunnel authentication. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("httpTunnelAuth")]
        public Output<string> HttpTunnelAuth { get; private set; } = null!;

        /// <summary>
        /// Name of an existing ICAP profile.
        /// </summary>
        [Output("icapProfile")]
        public Output<string> IcapProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetService")]
        public Output<string> InternetService { get; private set; } = null!;

        /// <summary>
        /// Custom Internet Service group name. The structure of `internet_service_custom_group` block is documented below.
        /// </summary>
        [Output("internetServiceCustomGroups")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyInternetServiceCustomGroup>> InternetServiceCustomGroups { get; private set; } = null!;

        /// <summary>
        /// Custom Internet Service name. The structure of `internet_service_custom` block is documented below.
        /// </summary>
        [Output("internetServiceCustoms")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyInternetServiceCustom>> InternetServiceCustoms { get; private set; } = null!;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service_group` block is documented below.
        /// </summary>
        [Output("internetServiceGroups")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyInternetServiceGroup>> InternetServiceGroups { get; private set; } = null!;

        /// <summary>
        /// Internet Service ID. The structure of `internet_service_id` block is documented below.
        /// </summary>
        [Output("internetServiceIds")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyInternetServiceId>> InternetServiceIds { get; private set; } = null!;

        /// <summary>
        /// Internet Service name. The structure of `internet_service_name` block is documented below.
        /// </summary>
        [Output("internetServiceNames")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyInternetServiceName>> InternetServiceNames { get; private set; } = null!;

        /// <summary>
        /// When enabled, Internet Services match against any internet service EXCEPT the selected Internet Service. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("internetServiceNegate")]
        public Output<string> InternetServiceNegate { get; private set; } = null!;

        /// <summary>
        /// Name of an existing IPS sensor.
        /// </summary>
        [Output("ipsSensor")]
        public Output<string> IpsSensor { get; private set; } = null!;

        /// <summary>
        /// VDOM-specific GUI visible label.
        /// </summary>
        [Output("label")]
        public Output<string> Label { get; private set; } = null!;

        /// <summary>
        /// Enable/disable logging traffic through the policy. Valid values: `all`, `utm`, `disable`.
        /// </summary>
        [Output("logtraffic")]
        public Output<string> Logtraffic { get; private set; } = null!;

        /// <summary>
        /// Enable/disable policy log traffic start. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("logtrafficStart")]
        public Output<string> LogtrafficStart { get; private set; } = null!;

        /// <summary>
        /// Policy name.
        /// </summary>
        [Output("name")]
        public Output<string> Name { get; private set; } = null!;

        /// <summary>
        /// Policy ID.
        /// </summary>
        [Output("policyid")]
        public Output<int> Policyid { get; private set; } = null!;

        /// <summary>
        /// Name of IP pool object. The structure of `poolname` block is documented below.
        /// </summary>
        [Output("poolnames")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyPoolname>> Poolnames { get; private set; } = null!;

        /// <summary>
        /// Name of profile group.
        /// </summary>
        [Output("profileGroup")]
        public Output<string> ProfileGroup { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Protocol options profile.
        /// </summary>
        [Output("profileProtocolOptions")]
        public Output<string> ProfileProtocolOptions { get; private set; } = null!;

        /// <summary>
        /// Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: `single`, `group`.
        /// </summary>
        [Output("profileType")]
        public Output<string> ProfileType { get; private set; } = null!;

        /// <summary>
        /// Type of explicit proxy.
        /// </summary>
        [Output("proxy")]
        public Output<string> Proxy { get; private set; } = null!;

        /// <summary>
        /// Redirect URL for further explicit web proxy processing.
        /// </summary>
        [Output("redirectUrl")]
        public Output<string?> RedirectUrl { get; private set; } = null!;

        /// <summary>
        /// Authentication replacement message override group.
        /// </summary>
        [Output("replacemsgOverrideGroup")]
        public Output<string> ReplacemsgOverrideGroup { get; private set; } = null!;

        /// <summary>
        /// Enable/disable scanning of connections to Botnet servers. Valid values: `disable`, `block`, `monitor`.
        /// </summary>
        [Output("scanBotnetConnections")]
        public Output<string> ScanBotnetConnections { get; private set; } = null!;

        /// <summary>
        /// Name of schedule object.
        /// </summary>
        [Output("schedule")]
        public Output<string> Schedule { get; private set; } = null!;

        /// <summary>
        /// Name of an existing SCTP filter profile.
        /// </summary>
        [Output("sctpFilterProfile")]
        public Output<string> SctpFilterProfile { get; private set; } = null!;

        /// <summary>
        /// When enabled, services match against any service EXCEPT the specified destination services. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("serviceNegate")]
        public Output<string> ServiceNegate { get; private set; } = null!;

        /// <summary>
        /// Name of service objects. The structure of `service` block is documented below.
        /// </summary>
        [Output("services")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyService>> Services { get; private set; } = null!;

        /// <summary>
        /// TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
        /// </summary>
        [Output("sessionTtl")]
        public Output<int> SessionTtl { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Spam filter profile.
        /// </summary>
        [Output("spamfilterProfile")]
        public Output<string> SpamfilterProfile { get; private set; } = null!;

        /// <summary>
        /// IPv6 source address objects. The structure of `srcaddr6` block is documented below.
        /// </summary>
        [Output("srcaddr6s")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicySrcaddr6>> Srcaddr6s { get; private set; } = null!;

        /// <summary>
        /// When enabled, source addresses match against any address EXCEPT the specified source addresses. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("srcaddrNegate")]
        public Output<string> SrcaddrNegate { get; private set; } = null!;

        /// <summary>
        /// Source address objects. The structure of `srcaddr` block is documented below.
        /// </summary>
        [Output("srcaddrs")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicySrcaddr>> Srcaddrs { get; private set; } = null!;

        /// <summary>
        /// Source interface names. The structure of `srcintf` block is documented below.
        /// </summary>
        [Output("srcintfs")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicySrcintf>> Srcintfs { get; private set; } = null!;

        /// <summary>
        /// Name of an existing SSH filter profile.
        /// </summary>
        [Output("sshFilterProfile")]
        public Output<string> SshFilterProfile { get; private set; } = null!;

        /// <summary>
        /// Redirect SSH traffic to matching transparent proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("sshPolicyRedirect")]
        public Output<string> SshPolicyRedirect { get; private set; } = null!;

        /// <summary>
        /// Name of an existing SSL SSH profile.
        /// </summary>
        [Output("sslSshProfile")]
        public Output<string> SslSshProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable the active status of the policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("status")]
        public Output<string> Status { get; private set; } = null!;

        /// <summary>
        /// Enable to use the IP address of the client to connect to the server. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("transparent")]
        public Output<string> Transparent { get; private set; } = null!;

        /// <summary>
        /// Names of user objects. The structure of `users` block is documented below.
        /// </summary>
        [Output("users")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyUser>> Users { get; private set; } = null!;

        /// <summary>
        /// Enable the use of UTM profiles/sensors/lists. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("utmStatus")]
        public Output<string> UtmStatus { get; private set; } = null!;

        /// <summary>
        /// Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
        /// </summary>
        [Output("uuid")]
        public Output<string> Uuid { get; private set; } = null!;

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Output("vdomparam")]
        public Output<string?> Vdomparam { get; private set; } = null!;

        /// <summary>
        /// Name of an existing VideoFilter profile.
        /// </summary>
        [Output("videofilterProfile")]
        public Output<string> VideofilterProfile { get; private set; } = null!;

        /// <summary>
        /// Name of an existing VoIP profile.
        /// </summary>
        [Output("voipProfile")]
        public Output<string> VoipProfile { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Web application firewall profile.
        /// </summary>
        [Output("wafProfile")]
        public Output<string> WafProfile { get; private set; } = null!;

        /// <summary>
        /// Enable/disable web caching. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("webcache")]
        public Output<string> Webcache { get; private set; } = null!;

        /// <summary>
        /// Enable/disable web caching for HTTPS (Requires deep-inspection enabled in ssl-ssh-profile). Valid values: `disable`, `enable`.
        /// </summary>
        [Output("webcacheHttps")]
        public Output<string> WebcacheHttps { get; private set; } = null!;

        /// <summary>
        /// Name of an existing Web filter profile.
        /// </summary>
        [Output("webfilterProfile")]
        public Output<string> WebfilterProfile { get; private set; } = null!;

        /// <summary>
        /// Web proxy forward server name.
        /// </summary>
        [Output("webproxyForwardServer")]
        public Output<string> WebproxyForwardServer { get; private set; } = null!;

        /// <summary>
        /// Name of web proxy profile.
        /// </summary>
        [Output("webproxyProfile")]
        public Output<string> WebproxyProfile { get; private set; } = null!;

        /// <summary>
        /// ZTNA EMS Tag names. The structure of `ztna_ems_tag` block is documented below.
        /// </summary>
        [Output("ztnaEmsTags")]
        public Output<ImmutableArray<Outputs.FirewallProxypolicyZtnaEmsTag>> ZtnaEmsTags { get; private set; } = null!;

        /// <summary>
        /// ZTNA tag matching logic. Valid values: `or`, `and`.
        /// </summary>
        [Output("ztnaTagsMatchLogic")]
        public Output<string> ZtnaTagsMatchLogic { get; private set; } = null!;


        /// <summary>
        /// Create a FirewallProxypolicy resource with the given unique name, arguments, and options.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resource</param>
        /// <param name="args">The arguments used to populate this resource's properties</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public FirewallProxypolicy(string name, FirewallProxypolicyArgs args, CustomResourceOptions? options = null)
            : base("fortios:index/firewallProxypolicy:FirewallProxypolicy", name, args ?? new FirewallProxypolicyArgs(), MakeResourceOptions(options, ""))
        {
        }

        private FirewallProxypolicy(string name, Input<string> id, FirewallProxypolicyState? state = null, CustomResourceOptions? options = null)
            : base("fortios:index/firewallProxypolicy:FirewallProxypolicy", name, state, MakeResourceOptions(options, id))
        {
        }

        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
        {
            var defaultOptions = new CustomResourceOptions
            {
                Version = Utilities.Version,
                PluginDownloadURL = "github://api.github.com/pulumiverse/pulumi-fortios",
            };
            var merged = CustomResourceOptions.Merge(defaultOptions, options);
            // Override the ID if one was specified for consistency with other language SDKs.
            merged.Id = id ?? merged.Id;
            return merged;
        }
        /// <summary>
        /// Get an existing FirewallProxypolicy resource's state with the given name, ID, and optional extra
        /// properties used to qualify the lookup.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resulting resource.</param>
        /// <param name="id">The unique provider ID of the resource to lookup.</param>
        /// <param name="state">Any extra arguments used during the lookup.</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public static FirewallProxypolicy Get(string name, Input<string> id, FirewallProxypolicyState? state = null, CustomResourceOptions? options = null)
        {
            return new FirewallProxypolicy(name, id, state, options);
        }
    }

    public sealed class FirewallProxypolicyArgs : global::Pulumi.ResourceArgs
    {
        [Input("accessProxies")]
        private InputList<Inputs.FirewallProxypolicyAccessProxyArgs>? _accessProxies;

        /// <summary>
        /// IPv4 access proxy. The structure of `access_proxy` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyAccessProxyArgs> AccessProxies
        {
            get => _accessProxies ?? (_accessProxies = new InputList<Inputs.FirewallProxypolicyAccessProxyArgs>());
            set => _accessProxies = value;
        }

        [Input("accessProxy6s")]
        private InputList<Inputs.FirewallProxypolicyAccessProxy6Args>? _accessProxy6s;

        /// <summary>
        /// IPv6 access proxy. The structure of `access_proxy6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyAccessProxy6Args> AccessProxy6s
        {
            get => _accessProxy6s ?? (_accessProxy6s = new InputList<Inputs.FirewallProxypolicyAccessProxy6Args>());
            set => _accessProxy6s = value;
        }

        /// <summary>
        /// Accept or deny traffic matching the policy parameters. Valid values: `accept`, `deny`, `redirect`.
        /// </summary>
        [Input("action")]
        public Input<string>? Action { get; set; }

        /// <summary>
        /// Name of an existing Application list.
        /// </summary>
        [Input("applicationList")]
        public Input<string>? ApplicationList { get; set; }

        /// <summary>
        /// Name of an existing Antivirus profile.
        /// </summary>
        [Input("avProfile")]
        public Input<string>? AvProfile { get; set; }

        /// <summary>
        /// Enable/disable block notification. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("blockNotification")]
        public Input<string>? BlockNotification { get; set; }

        /// <summary>
        /// Name of an existing CIFS profile.
        /// </summary>
        [Input("cifsProfile")]
        public Input<string>? CifsProfile { get; set; }

        /// <summary>
        /// Optional comments.
        /// </summary>
        [Input("comments")]
        public Input<string>? Comments { get; set; }

        /// <summary>
        /// Decrypted traffic mirror.
        /// </summary>
        [Input("decryptedTrafficMirror")]
        public Input<string>? DecryptedTrafficMirror { get; set; }

        /// <summary>
        /// When enabled, the ownership enforcement will be done at policy level. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("deviceOwnership")]
        public Input<string>? DeviceOwnership { get; set; }

        /// <summary>
        /// Web proxy disclaimer setting: by domain, policy, or user. Valid values: `disable`, `domain`, `policy`, `user`.
        /// </summary>
        [Input("disclaimer")]
        public Input<string>? Disclaimer { get; set; }

        /// <summary>
        /// Name of an existing DLP profile.
        /// </summary>
        [Input("dlpProfile")]
        public Input<string>? DlpProfile { get; set; }

        /// <summary>
        /// Name of an existing DLP sensor.
        /// </summary>
        [Input("dlpSensor")]
        public Input<string>? DlpSensor { get; set; }

        [Input("dstaddr6s")]
        private InputList<Inputs.FirewallProxypolicyDstaddr6Args>? _dstaddr6s;

        /// <summary>
        /// IPv6 destination address objects. The structure of `dstaddr6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyDstaddr6Args> Dstaddr6s
        {
            get => _dstaddr6s ?? (_dstaddr6s = new InputList<Inputs.FirewallProxypolicyDstaddr6Args>());
            set => _dstaddr6s = value;
        }

        /// <summary>
        /// When enabled, destination addresses match against any address EXCEPT the specified destination addresses. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dstaddrNegate")]
        public Input<string>? DstaddrNegate { get; set; }

        [Input("dstaddrs")]
        private InputList<Inputs.FirewallProxypolicyDstaddrArgs>? _dstaddrs;

        /// <summary>
        /// Destination address objects. The structure of `dstaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyDstaddrArgs> Dstaddrs
        {
            get => _dstaddrs ?? (_dstaddrs = new InputList<Inputs.FirewallProxypolicyDstaddrArgs>());
            set => _dstaddrs = value;
        }

        [Input("dstintfs", required: true)]
        private InputList<Inputs.FirewallProxypolicyDstintfArgs>? _dstintfs;

        /// <summary>
        /// Destination interface names. The structure of `dstintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyDstintfArgs> Dstintfs
        {
            get => _dstintfs ?? (_dstintfs = new InputList<Inputs.FirewallProxypolicyDstintfArgs>());
            set => _dstintfs = value;
        }

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Input("dynamicSortSubtable")]
        public Input<string>? DynamicSortSubtable { get; set; }

        /// <summary>
        /// Name of an existing email filter profile.
        /// </summary>
        [Input("emailfilterProfile")]
        public Input<string>? EmailfilterProfile { get; set; }

        /// <summary>
        /// Name of an existing file-filter profile.
        /// </summary>
        [Input("fileFilterProfile")]
        public Input<string>? FileFilterProfile { get; set; }

        /// <summary>
        /// Global web-based manager visible label.
        /// </summary>
        [Input("globalLabel")]
        public Input<string>? GlobalLabel { get; set; }

        [Input("groups")]
        private InputList<Inputs.FirewallProxypolicyGroupArgs>? _groups;

        /// <summary>
        /// Names of group objects. The structure of `groups` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyGroupArgs> Groups
        {
            get => _groups ?? (_groups = new InputList<Inputs.FirewallProxypolicyGroupArgs>());
            set => _groups = value;
        }

        /// <summary>
        /// Enable/disable HTTP tunnel authentication. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("httpTunnelAuth")]
        public Input<string>? HttpTunnelAuth { get; set; }

        /// <summary>
        /// Name of an existing ICAP profile.
        /// </summary>
        [Input("icapProfile")]
        public Input<string>? IcapProfile { get; set; }

        /// <summary>
        /// Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService")]
        public Input<string>? InternetService { get; set; }

        [Input("internetServiceCustomGroups")]
        private InputList<Inputs.FirewallProxypolicyInternetServiceCustomGroupArgs>? _internetServiceCustomGroups;

        /// <summary>
        /// Custom Internet Service group name. The structure of `internet_service_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyInternetServiceCustomGroupArgs> InternetServiceCustomGroups
        {
            get => _internetServiceCustomGroups ?? (_internetServiceCustomGroups = new InputList<Inputs.FirewallProxypolicyInternetServiceCustomGroupArgs>());
            set => _internetServiceCustomGroups = value;
        }

        [Input("internetServiceCustoms")]
        private InputList<Inputs.FirewallProxypolicyInternetServiceCustomArgs>? _internetServiceCustoms;

        /// <summary>
        /// Custom Internet Service name. The structure of `internet_service_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyInternetServiceCustomArgs> InternetServiceCustoms
        {
            get => _internetServiceCustoms ?? (_internetServiceCustoms = new InputList<Inputs.FirewallProxypolicyInternetServiceCustomArgs>());
            set => _internetServiceCustoms = value;
        }

        [Input("internetServiceGroups")]
        private InputList<Inputs.FirewallProxypolicyInternetServiceGroupArgs>? _internetServiceGroups;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyInternetServiceGroupArgs> InternetServiceGroups
        {
            get => _internetServiceGroups ?? (_internetServiceGroups = new InputList<Inputs.FirewallProxypolicyInternetServiceGroupArgs>());
            set => _internetServiceGroups = value;
        }

        [Input("internetServiceIds")]
        private InputList<Inputs.FirewallProxypolicyInternetServiceIdArgs>? _internetServiceIds;

        /// <summary>
        /// Internet Service ID. The structure of `internet_service_id` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyInternetServiceIdArgs> InternetServiceIds
        {
            get => _internetServiceIds ?? (_internetServiceIds = new InputList<Inputs.FirewallProxypolicyInternetServiceIdArgs>());
            set => _internetServiceIds = value;
        }

        [Input("internetServiceNames")]
        private InputList<Inputs.FirewallProxypolicyInternetServiceNameArgs>? _internetServiceNames;

        /// <summary>
        /// Internet Service name. The structure of `internet_service_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyInternetServiceNameArgs> InternetServiceNames
        {
            get => _internetServiceNames ?? (_internetServiceNames = new InputList<Inputs.FirewallProxypolicyInternetServiceNameArgs>());
            set => _internetServiceNames = value;
        }

        /// <summary>
        /// When enabled, Internet Services match against any internet service EXCEPT the selected Internet Service. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetServiceNegate")]
        public Input<string>? InternetServiceNegate { get; set; }

        /// <summary>
        /// Name of an existing IPS sensor.
        /// </summary>
        [Input("ipsSensor")]
        public Input<string>? IpsSensor { get; set; }

        /// <summary>
        /// VDOM-specific GUI visible label.
        /// </summary>
        [Input("label")]
        public Input<string>? Label { get; set; }

        /// <summary>
        /// Enable/disable logging traffic through the policy. Valid values: `all`, `utm`, `disable`.
        /// </summary>
        [Input("logtraffic")]
        public Input<string>? Logtraffic { get; set; }

        /// <summary>
        /// Enable/disable policy log traffic start. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("logtrafficStart")]
        public Input<string>? LogtrafficStart { get; set; }

        /// <summary>
        /// Policy name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// Policy ID.
        /// </summary>
        [Input("policyid")]
        public Input<int>? Policyid { get; set; }

        [Input("poolnames")]
        private InputList<Inputs.FirewallProxypolicyPoolnameArgs>? _poolnames;

        /// <summary>
        /// Name of IP pool object. The structure of `poolname` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyPoolnameArgs> Poolnames
        {
            get => _poolnames ?? (_poolnames = new InputList<Inputs.FirewallProxypolicyPoolnameArgs>());
            set => _poolnames = value;
        }

        /// <summary>
        /// Name of profile group.
        /// </summary>
        [Input("profileGroup")]
        public Input<string>? ProfileGroup { get; set; }

        /// <summary>
        /// Name of an existing Protocol options profile.
        /// </summary>
        [Input("profileProtocolOptions")]
        public Input<string>? ProfileProtocolOptions { get; set; }

        /// <summary>
        /// Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: `single`, `group`.
        /// </summary>
        [Input("profileType")]
        public Input<string>? ProfileType { get; set; }

        /// <summary>
        /// Type of explicit proxy.
        /// </summary>
        [Input("proxy", required: true)]
        public Input<string> Proxy { get; set; } = null!;

        /// <summary>
        /// Redirect URL for further explicit web proxy processing.
        /// </summary>
        [Input("redirectUrl")]
        public Input<string>? RedirectUrl { get; set; }

        /// <summary>
        /// Authentication replacement message override group.
        /// </summary>
        [Input("replacemsgOverrideGroup")]
        public Input<string>? ReplacemsgOverrideGroup { get; set; }

        /// <summary>
        /// Enable/disable scanning of connections to Botnet servers. Valid values: `disable`, `block`, `monitor`.
        /// </summary>
        [Input("scanBotnetConnections")]
        public Input<string>? ScanBotnetConnections { get; set; }

        /// <summary>
        /// Name of schedule object.
        /// </summary>
        [Input("schedule", required: true)]
        public Input<string> Schedule { get; set; } = null!;

        /// <summary>
        /// Name of an existing SCTP filter profile.
        /// </summary>
        [Input("sctpFilterProfile")]
        public Input<string>? SctpFilterProfile { get; set; }

        /// <summary>
        /// When enabled, services match against any service EXCEPT the specified destination services. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("serviceNegate")]
        public Input<string>? ServiceNegate { get; set; }

        [Input("services")]
        private InputList<Inputs.FirewallProxypolicyServiceArgs>? _services;

        /// <summary>
        /// Name of service objects. The structure of `service` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyServiceArgs> Services
        {
            get => _services ?? (_services = new InputList<Inputs.FirewallProxypolicyServiceArgs>());
            set => _services = value;
        }

        /// <summary>
        /// TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
        /// </summary>
        [Input("sessionTtl")]
        public Input<int>? SessionTtl { get; set; }

        /// <summary>
        /// Name of an existing Spam filter profile.
        /// </summary>
        [Input("spamfilterProfile")]
        public Input<string>? SpamfilterProfile { get; set; }

        [Input("srcaddr6s")]
        private InputList<Inputs.FirewallProxypolicySrcaddr6Args>? _srcaddr6s;

        /// <summary>
        /// IPv6 source address objects. The structure of `srcaddr6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicySrcaddr6Args> Srcaddr6s
        {
            get => _srcaddr6s ?? (_srcaddr6s = new InputList<Inputs.FirewallProxypolicySrcaddr6Args>());
            set => _srcaddr6s = value;
        }

        /// <summary>
        /// When enabled, source addresses match against any address EXCEPT the specified source addresses. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("srcaddrNegate")]
        public Input<string>? SrcaddrNegate { get; set; }

        [Input("srcaddrs")]
        private InputList<Inputs.FirewallProxypolicySrcaddrArgs>? _srcaddrs;

        /// <summary>
        /// Source address objects. The structure of `srcaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicySrcaddrArgs> Srcaddrs
        {
            get => _srcaddrs ?? (_srcaddrs = new InputList<Inputs.FirewallProxypolicySrcaddrArgs>());
            set => _srcaddrs = value;
        }

        [Input("srcintfs")]
        private InputList<Inputs.FirewallProxypolicySrcintfArgs>? _srcintfs;

        /// <summary>
        /// Source interface names. The structure of `srcintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicySrcintfArgs> Srcintfs
        {
            get => _srcintfs ?? (_srcintfs = new InputList<Inputs.FirewallProxypolicySrcintfArgs>());
            set => _srcintfs = value;
        }

        /// <summary>
        /// Name of an existing SSH filter profile.
        /// </summary>
        [Input("sshFilterProfile")]
        public Input<string>? SshFilterProfile { get; set; }

        /// <summary>
        /// Redirect SSH traffic to matching transparent proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sshPolicyRedirect")]
        public Input<string>? SshPolicyRedirect { get; set; }

        /// <summary>
        /// Name of an existing SSL SSH profile.
        /// </summary>
        [Input("sslSshProfile")]
        public Input<string>? SslSshProfile { get; set; }

        /// <summary>
        /// Enable/disable the active status of the policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("status")]
        public Input<string>? Status { get; set; }

        /// <summary>
        /// Enable to use the IP address of the client to connect to the server. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("transparent")]
        public Input<string>? Transparent { get; set; }

        [Input("users")]
        private InputList<Inputs.FirewallProxypolicyUserArgs>? _users;

        /// <summary>
        /// Names of user objects. The structure of `users` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyUserArgs> Users
        {
            get => _users ?? (_users = new InputList<Inputs.FirewallProxypolicyUserArgs>());
            set => _users = value;
        }

        /// <summary>
        /// Enable the use of UTM profiles/sensors/lists. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("utmStatus")]
        public Input<string>? UtmStatus { get; set; }

        /// <summary>
        /// Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
        /// </summary>
        [Input("uuid")]
        public Input<string>? Uuid { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        /// <summary>
        /// Name of an existing VideoFilter profile.
        /// </summary>
        [Input("videofilterProfile")]
        public Input<string>? VideofilterProfile { get; set; }

        /// <summary>
        /// Name of an existing VoIP profile.
        /// </summary>
        [Input("voipProfile")]
        public Input<string>? VoipProfile { get; set; }

        /// <summary>
        /// Name of an existing Web application firewall profile.
        /// </summary>
        [Input("wafProfile")]
        public Input<string>? WafProfile { get; set; }

        /// <summary>
        /// Enable/disable web caching. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("webcache")]
        public Input<string>? Webcache { get; set; }

        /// <summary>
        /// Enable/disable web caching for HTTPS (Requires deep-inspection enabled in ssl-ssh-profile). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("webcacheHttps")]
        public Input<string>? WebcacheHttps { get; set; }

        /// <summary>
        /// Name of an existing Web filter profile.
        /// </summary>
        [Input("webfilterProfile")]
        public Input<string>? WebfilterProfile { get; set; }

        /// <summary>
        /// Web proxy forward server name.
        /// </summary>
        [Input("webproxyForwardServer")]
        public Input<string>? WebproxyForwardServer { get; set; }

        /// <summary>
        /// Name of web proxy profile.
        /// </summary>
        [Input("webproxyProfile")]
        public Input<string>? WebproxyProfile { get; set; }

        [Input("ztnaEmsTags")]
        private InputList<Inputs.FirewallProxypolicyZtnaEmsTagArgs>? _ztnaEmsTags;

        /// <summary>
        /// ZTNA EMS Tag names. The structure of `ztna_ems_tag` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyZtnaEmsTagArgs> ZtnaEmsTags
        {
            get => _ztnaEmsTags ?? (_ztnaEmsTags = new InputList<Inputs.FirewallProxypolicyZtnaEmsTagArgs>());
            set => _ztnaEmsTags = value;
        }

        /// <summary>
        /// ZTNA tag matching logic. Valid values: `or`, `and`.
        /// </summary>
        [Input("ztnaTagsMatchLogic")]
        public Input<string>? ZtnaTagsMatchLogic { get; set; }

        public FirewallProxypolicyArgs()
        {
        }
        public static new FirewallProxypolicyArgs Empty => new FirewallProxypolicyArgs();
    }

    public sealed class FirewallProxypolicyState : global::Pulumi.ResourceArgs
    {
        [Input("accessProxies")]
        private InputList<Inputs.FirewallProxypolicyAccessProxyGetArgs>? _accessProxies;

        /// <summary>
        /// IPv4 access proxy. The structure of `access_proxy` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyAccessProxyGetArgs> AccessProxies
        {
            get => _accessProxies ?? (_accessProxies = new InputList<Inputs.FirewallProxypolicyAccessProxyGetArgs>());
            set => _accessProxies = value;
        }

        [Input("accessProxy6s")]
        private InputList<Inputs.FirewallProxypolicyAccessProxy6GetArgs>? _accessProxy6s;

        /// <summary>
        /// IPv6 access proxy. The structure of `access_proxy6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyAccessProxy6GetArgs> AccessProxy6s
        {
            get => _accessProxy6s ?? (_accessProxy6s = new InputList<Inputs.FirewallProxypolicyAccessProxy6GetArgs>());
            set => _accessProxy6s = value;
        }

        /// <summary>
        /// Accept or deny traffic matching the policy parameters. Valid values: `accept`, `deny`, `redirect`.
        /// </summary>
        [Input("action")]
        public Input<string>? Action { get; set; }

        /// <summary>
        /// Name of an existing Application list.
        /// </summary>
        [Input("applicationList")]
        public Input<string>? ApplicationList { get; set; }

        /// <summary>
        /// Name of an existing Antivirus profile.
        /// </summary>
        [Input("avProfile")]
        public Input<string>? AvProfile { get; set; }

        /// <summary>
        /// Enable/disable block notification. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("blockNotification")]
        public Input<string>? BlockNotification { get; set; }

        /// <summary>
        /// Name of an existing CIFS profile.
        /// </summary>
        [Input("cifsProfile")]
        public Input<string>? CifsProfile { get; set; }

        /// <summary>
        /// Optional comments.
        /// </summary>
        [Input("comments")]
        public Input<string>? Comments { get; set; }

        /// <summary>
        /// Decrypted traffic mirror.
        /// </summary>
        [Input("decryptedTrafficMirror")]
        public Input<string>? DecryptedTrafficMirror { get; set; }

        /// <summary>
        /// When enabled, the ownership enforcement will be done at policy level. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("deviceOwnership")]
        public Input<string>? DeviceOwnership { get; set; }

        /// <summary>
        /// Web proxy disclaimer setting: by domain, policy, or user. Valid values: `disable`, `domain`, `policy`, `user`.
        /// </summary>
        [Input("disclaimer")]
        public Input<string>? Disclaimer { get; set; }

        /// <summary>
        /// Name of an existing DLP profile.
        /// </summary>
        [Input("dlpProfile")]
        public Input<string>? DlpProfile { get; set; }

        /// <summary>
        /// Name of an existing DLP sensor.
        /// </summary>
        [Input("dlpSensor")]
        public Input<string>? DlpSensor { get; set; }

        [Input("dstaddr6s")]
        private InputList<Inputs.FirewallProxypolicyDstaddr6GetArgs>? _dstaddr6s;

        /// <summary>
        /// IPv6 destination address objects. The structure of `dstaddr6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyDstaddr6GetArgs> Dstaddr6s
        {
            get => _dstaddr6s ?? (_dstaddr6s = new InputList<Inputs.FirewallProxypolicyDstaddr6GetArgs>());
            set => _dstaddr6s = value;
        }

        /// <summary>
        /// When enabled, destination addresses match against any address EXCEPT the specified destination addresses. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dstaddrNegate")]
        public Input<string>? DstaddrNegate { get; set; }

        [Input("dstaddrs")]
        private InputList<Inputs.FirewallProxypolicyDstaddrGetArgs>? _dstaddrs;

        /// <summary>
        /// Destination address objects. The structure of `dstaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyDstaddrGetArgs> Dstaddrs
        {
            get => _dstaddrs ?? (_dstaddrs = new InputList<Inputs.FirewallProxypolicyDstaddrGetArgs>());
            set => _dstaddrs = value;
        }

        [Input("dstintfs")]
        private InputList<Inputs.FirewallProxypolicyDstintfGetArgs>? _dstintfs;

        /// <summary>
        /// Destination interface names. The structure of `dstintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyDstintfGetArgs> Dstintfs
        {
            get => _dstintfs ?? (_dstintfs = new InputList<Inputs.FirewallProxypolicyDstintfGetArgs>());
            set => _dstintfs = value;
        }

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Input("dynamicSortSubtable")]
        public Input<string>? DynamicSortSubtable { get; set; }

        /// <summary>
        /// Name of an existing email filter profile.
        /// </summary>
        [Input("emailfilterProfile")]
        public Input<string>? EmailfilterProfile { get; set; }

        /// <summary>
        /// Name of an existing file-filter profile.
        /// </summary>
        [Input("fileFilterProfile")]
        public Input<string>? FileFilterProfile { get; set; }

        /// <summary>
        /// Global web-based manager visible label.
        /// </summary>
        [Input("globalLabel")]
        public Input<string>? GlobalLabel { get; set; }

        [Input("groups")]
        private InputList<Inputs.FirewallProxypolicyGroupGetArgs>? _groups;

        /// <summary>
        /// Names of group objects. The structure of `groups` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyGroupGetArgs> Groups
        {
            get => _groups ?? (_groups = new InputList<Inputs.FirewallProxypolicyGroupGetArgs>());
            set => _groups = value;
        }

        /// <summary>
        /// Enable/disable HTTP tunnel authentication. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("httpTunnelAuth")]
        public Input<string>? HttpTunnelAuth { get; set; }

        /// <summary>
        /// Name of an existing ICAP profile.
        /// </summary>
        [Input("icapProfile")]
        public Input<string>? IcapProfile { get; set; }

        /// <summary>
        /// Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetService")]
        public Input<string>? InternetService { get; set; }

        [Input("internetServiceCustomGroups")]
        private InputList<Inputs.FirewallProxypolicyInternetServiceCustomGroupGetArgs>? _internetServiceCustomGroups;

        /// <summary>
        /// Custom Internet Service group name. The structure of `internet_service_custom_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyInternetServiceCustomGroupGetArgs> InternetServiceCustomGroups
        {
            get => _internetServiceCustomGroups ?? (_internetServiceCustomGroups = new InputList<Inputs.FirewallProxypolicyInternetServiceCustomGroupGetArgs>());
            set => _internetServiceCustomGroups = value;
        }

        [Input("internetServiceCustoms")]
        private InputList<Inputs.FirewallProxypolicyInternetServiceCustomGetArgs>? _internetServiceCustoms;

        /// <summary>
        /// Custom Internet Service name. The structure of `internet_service_custom` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyInternetServiceCustomGetArgs> InternetServiceCustoms
        {
            get => _internetServiceCustoms ?? (_internetServiceCustoms = new InputList<Inputs.FirewallProxypolicyInternetServiceCustomGetArgs>());
            set => _internetServiceCustoms = value;
        }

        [Input("internetServiceGroups")]
        private InputList<Inputs.FirewallProxypolicyInternetServiceGroupGetArgs>? _internetServiceGroups;

        /// <summary>
        /// Internet Service group name. The structure of `internet_service_group` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyInternetServiceGroupGetArgs> InternetServiceGroups
        {
            get => _internetServiceGroups ?? (_internetServiceGroups = new InputList<Inputs.FirewallProxypolicyInternetServiceGroupGetArgs>());
            set => _internetServiceGroups = value;
        }

        [Input("internetServiceIds")]
        private InputList<Inputs.FirewallProxypolicyInternetServiceIdGetArgs>? _internetServiceIds;

        /// <summary>
        /// Internet Service ID. The structure of `internet_service_id` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyInternetServiceIdGetArgs> InternetServiceIds
        {
            get => _internetServiceIds ?? (_internetServiceIds = new InputList<Inputs.FirewallProxypolicyInternetServiceIdGetArgs>());
            set => _internetServiceIds = value;
        }

        [Input("internetServiceNames")]
        private InputList<Inputs.FirewallProxypolicyInternetServiceNameGetArgs>? _internetServiceNames;

        /// <summary>
        /// Internet Service name. The structure of `internet_service_name` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyInternetServiceNameGetArgs> InternetServiceNames
        {
            get => _internetServiceNames ?? (_internetServiceNames = new InputList<Inputs.FirewallProxypolicyInternetServiceNameGetArgs>());
            set => _internetServiceNames = value;
        }

        /// <summary>
        /// When enabled, Internet Services match against any internet service EXCEPT the selected Internet Service. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("internetServiceNegate")]
        public Input<string>? InternetServiceNegate { get; set; }

        /// <summary>
        /// Name of an existing IPS sensor.
        /// </summary>
        [Input("ipsSensor")]
        public Input<string>? IpsSensor { get; set; }

        /// <summary>
        /// VDOM-specific GUI visible label.
        /// </summary>
        [Input("label")]
        public Input<string>? Label { get; set; }

        /// <summary>
        /// Enable/disable logging traffic through the policy. Valid values: `all`, `utm`, `disable`.
        /// </summary>
        [Input("logtraffic")]
        public Input<string>? Logtraffic { get; set; }

        /// <summary>
        /// Enable/disable policy log traffic start. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("logtrafficStart")]
        public Input<string>? LogtrafficStart { get; set; }

        /// <summary>
        /// Policy name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// Policy ID.
        /// </summary>
        [Input("policyid")]
        public Input<int>? Policyid { get; set; }

        [Input("poolnames")]
        private InputList<Inputs.FirewallProxypolicyPoolnameGetArgs>? _poolnames;

        /// <summary>
        /// Name of IP pool object. The structure of `poolname` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyPoolnameGetArgs> Poolnames
        {
            get => _poolnames ?? (_poolnames = new InputList<Inputs.FirewallProxypolicyPoolnameGetArgs>());
            set => _poolnames = value;
        }

        /// <summary>
        /// Name of profile group.
        /// </summary>
        [Input("profileGroup")]
        public Input<string>? ProfileGroup { get; set; }

        /// <summary>
        /// Name of an existing Protocol options profile.
        /// </summary>
        [Input("profileProtocolOptions")]
        public Input<string>? ProfileProtocolOptions { get; set; }

        /// <summary>
        /// Determine whether the firewall policy allows security profile groups or single profiles only. Valid values: `single`, `group`.
        /// </summary>
        [Input("profileType")]
        public Input<string>? ProfileType { get; set; }

        /// <summary>
        /// Type of explicit proxy.
        /// </summary>
        [Input("proxy")]
        public Input<string>? Proxy { get; set; }

        /// <summary>
        /// Redirect URL for further explicit web proxy processing.
        /// </summary>
        [Input("redirectUrl")]
        public Input<string>? RedirectUrl { get; set; }

        /// <summary>
        /// Authentication replacement message override group.
        /// </summary>
        [Input("replacemsgOverrideGroup")]
        public Input<string>? ReplacemsgOverrideGroup { get; set; }

        /// <summary>
        /// Enable/disable scanning of connections to Botnet servers. Valid values: `disable`, `block`, `monitor`.
        /// </summary>
        [Input("scanBotnetConnections")]
        public Input<string>? ScanBotnetConnections { get; set; }

        /// <summary>
        /// Name of schedule object.
        /// </summary>
        [Input("schedule")]
        public Input<string>? Schedule { get; set; }

        /// <summary>
        /// Name of an existing SCTP filter profile.
        /// </summary>
        [Input("sctpFilterProfile")]
        public Input<string>? SctpFilterProfile { get; set; }

        /// <summary>
        /// When enabled, services match against any service EXCEPT the specified destination services. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("serviceNegate")]
        public Input<string>? ServiceNegate { get; set; }

        [Input("services")]
        private InputList<Inputs.FirewallProxypolicyServiceGetArgs>? _services;

        /// <summary>
        /// Name of service objects. The structure of `service` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyServiceGetArgs> Services
        {
            get => _services ?? (_services = new InputList<Inputs.FirewallProxypolicyServiceGetArgs>());
            set => _services = value;
        }

        /// <summary>
        /// TTL in seconds for sessions accepted by this policy (0 means use the system default session TTL).
        /// </summary>
        [Input("sessionTtl")]
        public Input<int>? SessionTtl { get; set; }

        /// <summary>
        /// Name of an existing Spam filter profile.
        /// </summary>
        [Input("spamfilterProfile")]
        public Input<string>? SpamfilterProfile { get; set; }

        [Input("srcaddr6s")]
        private InputList<Inputs.FirewallProxypolicySrcaddr6GetArgs>? _srcaddr6s;

        /// <summary>
        /// IPv6 source address objects. The structure of `srcaddr6` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicySrcaddr6GetArgs> Srcaddr6s
        {
            get => _srcaddr6s ?? (_srcaddr6s = new InputList<Inputs.FirewallProxypolicySrcaddr6GetArgs>());
            set => _srcaddr6s = value;
        }

        /// <summary>
        /// When enabled, source addresses match against any address EXCEPT the specified source addresses. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("srcaddrNegate")]
        public Input<string>? SrcaddrNegate { get; set; }

        [Input("srcaddrs")]
        private InputList<Inputs.FirewallProxypolicySrcaddrGetArgs>? _srcaddrs;

        /// <summary>
        /// Source address objects. The structure of `srcaddr` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicySrcaddrGetArgs> Srcaddrs
        {
            get => _srcaddrs ?? (_srcaddrs = new InputList<Inputs.FirewallProxypolicySrcaddrGetArgs>());
            set => _srcaddrs = value;
        }

        [Input("srcintfs")]
        private InputList<Inputs.FirewallProxypolicySrcintfGetArgs>? _srcintfs;

        /// <summary>
        /// Source interface names. The structure of `srcintf` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicySrcintfGetArgs> Srcintfs
        {
            get => _srcintfs ?? (_srcintfs = new InputList<Inputs.FirewallProxypolicySrcintfGetArgs>());
            set => _srcintfs = value;
        }

        /// <summary>
        /// Name of an existing SSH filter profile.
        /// </summary>
        [Input("sshFilterProfile")]
        public Input<string>? SshFilterProfile { get; set; }

        /// <summary>
        /// Redirect SSH traffic to matching transparent proxy policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sshPolicyRedirect")]
        public Input<string>? SshPolicyRedirect { get; set; }

        /// <summary>
        /// Name of an existing SSL SSH profile.
        /// </summary>
        [Input("sslSshProfile")]
        public Input<string>? SslSshProfile { get; set; }

        /// <summary>
        /// Enable/disable the active status of the policy. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("status")]
        public Input<string>? Status { get; set; }

        /// <summary>
        /// Enable to use the IP address of the client to connect to the server. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("transparent")]
        public Input<string>? Transparent { get; set; }

        [Input("users")]
        private InputList<Inputs.FirewallProxypolicyUserGetArgs>? _users;

        /// <summary>
        /// Names of user objects. The structure of `users` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyUserGetArgs> Users
        {
            get => _users ?? (_users = new InputList<Inputs.FirewallProxypolicyUserGetArgs>());
            set => _users = value;
        }

        /// <summary>
        /// Enable the use of UTM profiles/sensors/lists. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("utmStatus")]
        public Input<string>? UtmStatus { get; set; }

        /// <summary>
        /// Universally Unique Identifier (UUID; automatically assigned but can be manually reset).
        /// </summary>
        [Input("uuid")]
        public Input<string>? Uuid { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        /// <summary>
        /// Name of an existing VideoFilter profile.
        /// </summary>
        [Input("videofilterProfile")]
        public Input<string>? VideofilterProfile { get; set; }

        /// <summary>
        /// Name of an existing VoIP profile.
        /// </summary>
        [Input("voipProfile")]
        public Input<string>? VoipProfile { get; set; }

        /// <summary>
        /// Name of an existing Web application firewall profile.
        /// </summary>
        [Input("wafProfile")]
        public Input<string>? WafProfile { get; set; }

        /// <summary>
        /// Enable/disable web caching. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("webcache")]
        public Input<string>? Webcache { get; set; }

        /// <summary>
        /// Enable/disable web caching for HTTPS (Requires deep-inspection enabled in ssl-ssh-profile). Valid values: `disable`, `enable`.
        /// </summary>
        [Input("webcacheHttps")]
        public Input<string>? WebcacheHttps { get; set; }

        /// <summary>
        /// Name of an existing Web filter profile.
        /// </summary>
        [Input("webfilterProfile")]
        public Input<string>? WebfilterProfile { get; set; }

        /// <summary>
        /// Web proxy forward server name.
        /// </summary>
        [Input("webproxyForwardServer")]
        public Input<string>? WebproxyForwardServer { get; set; }

        /// <summary>
        /// Name of web proxy profile.
        /// </summary>
        [Input("webproxyProfile")]
        public Input<string>? WebproxyProfile { get; set; }

        [Input("ztnaEmsTags")]
        private InputList<Inputs.FirewallProxypolicyZtnaEmsTagGetArgs>? _ztnaEmsTags;

        /// <summary>
        /// ZTNA EMS Tag names. The structure of `ztna_ems_tag` block is documented below.
        /// </summary>
        public InputList<Inputs.FirewallProxypolicyZtnaEmsTagGetArgs> ZtnaEmsTags
        {
            get => _ztnaEmsTags ?? (_ztnaEmsTags = new InputList<Inputs.FirewallProxypolicyZtnaEmsTagGetArgs>());
            set => _ztnaEmsTags = value;
        }

        /// <summary>
        /// ZTNA tag matching logic. Valid values: `or`, `and`.
        /// </summary>
        [Input("ztnaTagsMatchLogic")]
        public Input<string>? ZtnaTagsMatchLogic { get; set; }

        public FirewallProxypolicyState()
        {
        }
        public static new FirewallProxypolicyState Empty => new FirewallProxypolicyState();
    }
}
