17.5.1 Rule Editor Guidelines and Compatibility

Overview

NGFW Version 17.5.1 introduces a new user interface in the rule editor. The new user interface includes some differences from the previous user interface. This article describes the differences and provides guidance and other considerations when upgrading to this and newer release versions. 

General rule inputs

• Import compatibility: Rules exported from the previous editor are not directly compatible with import in the new editor. 
• A rule description is required. When editing an existing rule, correct any values flagged as invalid before saving.
• Rules can still have no conditions; such rules match all traffic reaching them. Omit an address or port condition when you intend to match any address or port.

Condition inputs

• Addresses: Use IPv4 addresses, CIDR notation, strictly ascending address ranges, or comma-separated lists. Replace dotted subnet masks with CIDR notation and equal-ended ranges with a single address. The literal any is no longer accepted in address fields.
• Ports: Use ports from 1–65535, ranges in increasing or equal order, or comma-separated lists. Replace comparisons such as >1024 with 1025-65535. The literal any is no longer accepted in port fields.
• Interfaces and protocols: Select at least one value.
• is NOT with multiple values: For Port Forward, NAT, Bypass, Filter, Access, Shield, and QoS rules, use one protocol or one specific interface with is NOT. Inverted lists are unsupported by the firewall generator. This is an existing backend limitation; ExtJS displayed a warning for Filter/Access, while the Vue editor does not display that warning. Interface groups can also expand to multiple interfaces and encounter this limitation.

Destined Local

The editor offers Yes/No instead of a fixed True value and an is/is NOT selector. Existing conditions retain their original operator, although it is hidden.

Unchanged conditions retain their matching behavior. Older conditions with a blank stored value may show neither radio selected; their original operator still determines the match.

In Port Forward and QoS, remove and re-add Destined Local if you want the new Yes/No behavior. Choose Yes for local traffic or No for nonlocal traffic before saving. Existing Access conditions cannot be added again; use the original operator and the table above when editing them.

Action inputs

• Translation addresses: Enter a single IPv4 address for Port Forward destinations and custom NAT sources. IPv6 translation is not implemented for these NGFW actions. Custom NAT now requires a source address and rejects 0.0.0.0.
• Port Forward translated port: This remains optional and no longer defaults to 80. Enter 80 explicitly if required. Leaving the field blank preserves the original destination port.

Other rule editor compatibility limitations

• The static-route network and BGP-neighbor target address fields accept IPv4 only. The previous editors accepted IPv4 and IPv6.
• Lease duration for IPv6 on interface screen is no longer mandatory.
• The vrrpPriority field now accepts a maximum value of 254.
• All tabs are validated when the Save button is clicked.
• The dhcpRelayAddress field validates the IP address.