create_dfw_rule
Create a new distributed firewall rule in an existing security policy. Define action, sources, destinations, services, and priority to control network traffic.
Instructions
[WRITE] Create a firewall rule under an existing DFW security policy.
Returns the created rule dict (id, path, action, ...), else {"error", "hint"}; a bad action/direction/ip_protocol lists the valid values. PUT semantics: reusing a rule_id overwrites that rule, enforced immediately unless disabled=True. Pick policy_id with list_dfw_policies first; prefer update_dfw_rule to edit one and delete_dfw_rule to remove one.
Args: policy_id: Parent policy id, from list_dfw_policies. rule_id: Unique rule id within that policy. display_name: Human-readable name. action: ALLOW, DROP, REJECT or JUMP_TO_APPLICATION (default ALLOW); JUMP_TO_APPLICATION needs an Environment policy. sources: Source group paths like ['/infra/domains/default/groups/web']; omit for any. destinations: Destination group paths; omit for any. services: Service paths; omit for all. scope: Applied-to group/segment paths; omit for the whole DFW. direction: IN, OUT or IN_OUT (default IN_OUT). ip_protocol: IPV4, IPV6 or IPV4_IPV6 (default IPV4_IPV6). logged: Log matched traffic (default False). disabled: Create the rule unenforced (default False). sequence_number: Priority; lower matches first (default 10). description: Optional free text. target: Target name from config; default if omitted.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | ||
| action | No | ALLOW | |
| logged | No | ||
| target | No | ||
| rule_id | Yes | ||
| sources | No | ||
| disabled | No | ||
| services | No | ||
| direction | No | IN_OUT | |
| policy_id | Yes | ||
| description | No | ||
| ip_protocol | No | IPV4_IPV6 | |
| destinations | No | ||
| display_name | Yes | ||
| sequence_number | No |