config firewall policy

    edit <policy-id>                     # Policy entry ID

        set name "<Policy Name>"         # Policy name for identification

        set srcintf "<Ingress Interface>"# Incoming interface

        set dstintf "<Egress Interface>" # Outgoing interface

        set srcaddr "<Source Address>"   # Source address object

        set dstaddr "<Destination Address>" # Destination address object

        set service "<Service Object>"   # Service (port/protocol) object

        set action {accept|deny|ipsec}   # Policy action: allow, deny, or VPN

        set schedule "<Schedule>"        # Time schedule for the rule

        set logtraffic {all|utm|disable} # Logging options

        set ips-sensor "<IPS Profile>"   # IPS policy applied

        set application-list "<App Profile>" # Application control policy

        set ssl-ssh-profile "<SSL Profile>"  # SSL/SSH inspection policy

    next

end