---
title: "Create IP Firewall policy"
method: POST
path: "/ip-firewall-policies"
tags: ["Configuration - Policy"]
---

# Create IP Firewall policy

`POST /ip-firewall-policies`

Create a new IP Firewall policy.

## Request body

- XiqIpFirewallPolicyRequest — The IP Firewall policy.
  - `name` string — The IP firewall policy name
  - `description` string — The IP firewall policy description.
  - `rules` XiqIpFirewallRuleRequest[] — List of IP Firewall Rules.....
    - `action` 'PERMIT' | 'DENY' | 'TRAFFIC_DROP' | 'NAT' | 'REDIRECT' — The IP Firewall Action.
    - `service_id` integer — Application or Network Service ID for IP Firewall Rule.
    - `source_ip_id` integer — Source IP for IP Firewall Rule.
    - `destination_ip_id` integer — Destination IP for IP Firewall Rule.
    - `logging_type` 'OFF' | 'DROPPED_PACKETS' | 'SESSION_INITIATION' | 'SESSION_TERMINATION' | 'BOTH' — The logging Type for MAC Firewall Rule.

## Response `201`

Created

- XiqIpFirewall — IP Firewall policy.
  - `id` integer, required — The unique identifier
  - `create_time` string, date-time, required — The create time in UTC (ISO 8601 format)
  - `update_time` string, date-time, required — The last update time in UTC (ISO 8601 format)
  - `org_id` integer — The organization identifier, valid when enabling HIQ feature
  - `name` string — The IP Firewall policy name
  - `description` string — The IP Firewall policy description.
  - `rules` XiqIpFirewallRule[] — List of IP Firewall Rules.
    - `id` integer, required — The unique identifier
    - `create_time` string, date-time, required — The create time in UTC (ISO 8601 format)
    - `update_time` string, date-time, required — The last update time in UTC (ISO 8601 format)
    - `org_id` integer — The organization identifier, valid when enabling HIQ feature
    - `action` 'PERMIT' | 'DENY' | 'TRAFFIC_DROP' | 'NAT' | 'REDIRECT' — The IP Firewall Action.
    - `network_service` XiqNetworkService — The IP Firewall Action.
      - `id` integer, required — The unique identifier
      - `create_time` string, date-time, required — The create time in UTC (ISO 8601 format)
      - `update_time` string, date-time, required — The last update time in UTC (ISO 8601 format)
      - `org_id` integer — The organization identifier, valid when enabling HIQ feature
      - `name` string — The Network Service name
      - `description` string — The Network Service description
      - `ip_protocol` 'TCP' | 'UDP' | 'SVP' | 'CUSTOM' — IP Protocol, only for custom Application.
      - `protocol_number` integer — The Network Protocol Number
      - `port_number` integer — The Network Port Number
      - `alg_type` 'NONE' | 'FTP' | 'TFTP' | 'SIP' | 'DNS' | 'HTTP' — Application Layer Gateway (ALG) type, only for custom Application.
      - `service_type` 'NETWORK' | 'APPLICATION', required — The Service Type.
    - `application_service` XiqApplicationService — Application service
      - `application` XiqApplication — The Application Model
        - `id` integer, required — The unique identifier
        - `create_time` string, date-time, required — The create time in UTC (ISO 8601 format)
        - `update_time` string, date-time, required — The last update time in UTC (ISO 8601 format)
        - `org_id` integer — The organization identifier, valid when enabling HIQ feature
        - `name` string — The application name
        - `description` string — The application description
        - `predefined` boolean — Flag to describle whether the application is predefined or customized
        - `category_id` integer — The category ID of application
        - `category_name` string — The category name of application
        - `detection_rules` XiqApplicationDetectionRule[] — The application detection rules
          - `value` string — The value of detection rule type
          - `protocol` 'HTTP' | 'HTTPS' — The protocol of detection rule
          - `type` 'HOST_NAME' | 'SERVER_IP_ADDRESS' | 'PORT_NUMBER' — The type of detection rule
      - `service_type` 'NETWORK' | 'APPLICATION' — Service Type.
    - `source_ip` XiqL3AddressProfile — Destination IP for IP Firewall Rule.
      - `id` integer, required — The unique identifier
      - `create_time` string, date-time, required — The create time in UTC (ISO 8601 format)
      - `update_time` string, date-time, required — The last update time in UTC (ISO 8601 format)
      - `org_id` integer — The organization identifier, valid when enabling HIQ feature
      - `predefined` boolean — Flag to describe whether the application is predefined or customised
      - `name` string, required — Address profile name
      - `description` string — Address profile description
      - `value` string — Address profile value
      - `enable_classification` boolean — The flag to enable classification on L3 address profile
      - `address_type` 'IP_ADDRESS' | 'IP_SUBNET' | 'IP_RANGE' | 'HOST_NAME' | 'WILDCARD_HOST_NAME' | 'WILDCARD', required — Address type
      - `classified_entries` XiqAddressProfileClassifiedEntry[] — The address profile classified entries
        - `class_asgn_id` integer — The classification assignment id value.
        - `value` string — The classified entry value.
        - `description` string — The classified entry description.
        - `netmask` string — The classified entry netmask
        - `ip_address_end` string — The classified entry IP address end.
        - `wildcard_mask` string — The classified entry wildcard mask.
    - `destination_ip` XiqL3AddressProfile — Destination IP for IP Firewall Rule.
      - `id` integer, required — The unique identifier
      - `create_time` string, date-time, required — The create time in UTC (ISO 8601 format)
      - `update_time` string, date-time, required — The last update time in UTC (ISO 8601 format)
      - `org_id` integer — The organization identifier, valid when enabling HIQ feature
      - `predefined` boolean — Flag to describe whether the application is predefined or customised
      - `name` string, required — Address profile name
      - `description` string — Address profile description
      - `value` string — Address profile value
      - `enable_classification` boolean — The flag to enable classification on L3 address profile
      - `address_type` 'IP_ADDRESS' | 'IP_SUBNET' | 'IP_RANGE' | 'HOST_NAME' | 'WILDCARD_HOST_NAME' | 'WILDCARD', required — Address type
      - `classified_entries` XiqAddressProfileClassifiedEntry[] — The address profile classified entries
        - `class_asgn_id` integer — The classification assignment id value.
        - `value` string — The classified entry value.
        - `description` string — The classified entry description.
        - `netmask` string — The classified entry netmask
        - `ip_address_end` string — The classified entry IP address end.
        - `wildcard_mask` string — The classified entry wildcard mask.
    - `logging_type` 'OFF' | 'DROPPED_PACKETS' | 'SESSION_INITIATION' | 'SESSION_TERMINATION' | 'BOTH' — The logging Type for MAC Firewall Rule.
  - `predefined` boolean — Flag to describe whether the application is predefined or customized.

---

[API](https://skmtc.net/extremecloudiq/apis/extremecloud-iq-api.md) · [All operations](https://skmtc.net/extremecloudiq/apis/extremecloud-iq-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/extremecloudiq/extremecloud-iq-api/versions/5ff7ab84e8e8/schema)