policy.yml

security_policies:
- name: "allow dns from apps"
  tags:
    - infra
  source_zones:
    - app
  source_addresses:
    - 10.0.0.0/8
  destination_zones:
    - dmz
  destination_addresses:
    - 8.8.8.4
  applications:
    - dns
  action: "allow"
- name: "allow internet from bizdev x"
  tags:
    - internet
  source_zones:
    - bizdev
  source_addresses:
    - 192.168.11.0/24
  destination_zones:
    - untrust
  applications:
    - ssl
    - web-browsing
  action: "allow"
# - name: "new rule"
#   tags:
#     - internet
#   source_zones:
#     - untrust
#   source_addresses:
#     - 10.0.0.0/8
#   destination_zones:
#     - trust
#   applications:
#     - ssl
#   action: "deny"
# - name: "bad rule"
#   tags:
#     - infra
#   source_zones:
#     - any
#   source_addresses:
#     - 10.0.0.0/8
#   destination_zones:
#     - any
#   destination_addresses:
#     - 8.8.8.4
#   applications:
#     - ms-ds-smb
#   action: "allow"