Update firewall policy (safe)
fortigate_update_policyUpdate a firewall policy safely by reading current settings and using dry-run mode to verify changes before applying.
Instructions
Safely update a firewall policy. Reads the current policy first and defaults to dry_run=true.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| policyid | Yes | Existing firewall policy ID | |
| name | No | Optional new firewall policy name | |
| srcintf | No | ||
| dstintf | No | ||
| srcaddr | No | ||
| dstaddr | No | ||
| service | No | ||
| status | No | Defaults to enable on create. | |
| action | No | Defaults to accept on create. | |
| schedule | No | Defaults to always on create. | |
| comments | No | Optional FortiGate comment | |
| nat | No | Defaults to enable on create. | |
| utm-status | No | Enable or disable UTM profiles. | |
| logtraffic | No | Defaults to all on create. | |
| logtraffic-start | No | ||
| internet-service | No | Enable FortiGuard Internet Service destination matching. | |
| internet-service-name | No | Internet Service names when internet-service is enabled | |
| internet-service-group | No | Internet Service group names when internet-service is enabled | |
| ssl-ssh-profile | No | Optional SSL/SSH inspection profile | |
| av-profile | No | Optional antivirus profile | |
| webfilter-profile | No | Optional web filter profile | |
| dnsfilter-profile | No | Optional DNS filter profile | |
| ips-sensor | No | Optional IPS sensor | |
| application-list | No | Optional application control list | |
| profile-protocol-options | No | Optional protocol options profile | |
| dry_run | No | Defaults to true (plan only). Set false to apply a real change. | |
| confirm | No | Required only when dry_run=false; must equal exactly 'APPLY FORTIGATE CHANGE'. |