fm appgw
Reference for the fm appgw command group (auto-generated from fm appgw --help).
fm appgw
text
Manage Application Gateways: one Public IP fronting many services in your VPC,
routed by host and URL path, with TLS termination and a Web Application Firewall.
Nothing you author is live until you apply it:
fm appgw listener create ... # authored
fm appgw route create ... # authored
fm appgw apply <gateway> # NOW it is serving
That separation is deliberate. A gateway carries a whole policy -- routes,
backends, firewall and WAF -- and applying it half-written would take a site
down. "configGeneration" is what you have authored; "configRevision" is what
the appliance acknowledged. When they differ there is a change not yet live.
Backends are refused unless they lie inside the gateway's own VPC, and a
backend is not reachable until its security group is authorized:
fm appgw backend authorize --gateway g --pool p --backend b --security-group sg-1
Examples:
fm appgw flavors
fm appgw create --name edge --flavor agw.co1.medium --vpc vpc-1 --subnet sub-1
fm appgw list
fm appgw get edge-id
fm appgw apply edge-id
fm appgw delete edge-id
Usage:
fm appgw [command]
Aliases:
appgw, application-gateway, app-gateway
Available Commands:
apply Apply the gateway's authored configuration
audit Show who opened or closed a path to your backends
authorization Inspect and revoke open paths to your backends
backend Manage backends
certificate Manage TLS certificates
create Create an Application Gateway
delete Delete an Application Gateway
flavor Show one Application Gateway size
flavors List Application Gateway sizes
get Show an Application Gateway
health-check Manage a pool's health check
list List Application Gateways
listener Manage listeners
pool Manage backend pools
route Manage routes
tags Read and replace a Application Gateway's resource tags
update Rename an Application Gateway
waf Manage the Web Application Firewall
Flags:
-h, --help help for appgw
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw [command] --help" for more information about a command.fm appgw apply
text
Render everything you have authored -- listeners, routes, pools, backends and
the ACTIVE WAF version -- and hand it to the appliance.
The appliance validates the configuration, swaps it in, reloads and answers its
own loopback probe. If any step fails it restores what it was serving before
and reports why: the gateway is left unchanged, never half-configured.
A published WAF version that has never been applied is not protecting anything.
Usage:
fm appgw apply <gateway-id> [flags]
Flags:
-h, --help help for apply
--no-wait Return as soon as the request is accepted
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw audit
text
Show the gateway's backend-authorization history.
It outlives the authorizations themselves: a revoke deletes the authorization,
and the record of who opened it must survive that.
Usage:
fm appgw audit [flags]
Flags:
--gateway string Gateway id (required)
-h, --help help for audit
--limit int Maximum entries to return (the server caps this)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw authorization
text
Inspect and revoke open paths to your backends
Usage:
fm appgw authorization [command]
Aliases:
authorization, authorizations, authz
Available Commands:
list List open paths from the gateway to your security groups
revoke Close one open path
tags Read and replace a backend authorization's resource tags
Flags:
--gateway string Gateway id (required)
-h, --help help for authorization
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw authorization [command] --help" for more information about a command.fm appgw authorization list
text
List open paths from the gateway to your security groups
Usage:
fm appgw authorization list [flags]
Aliases:
list, ls
Flags:
-h, --help help for list
--tag strings only authorizations with this tag, key=value (repeatable; every one must match; key= matches an empty value)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw authorization revoke
text
Close one open path from the gateway to a security group.
Addressed by AUTHORIZATION id rather than by backend: two backends behind the
same security group and port share one rule, so "revoke a backend" would be
ambiguous about whether the other one keeps working.
Usage:
fm appgw authorization revoke <authorization-id> [flags]
Flags:
--force Skip the confirmation prompt
-h, --help help for revoke
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw authorization tags
text
Read and replace a backend authorization's resource tags
Usage:
fm appgw authorization tags [command]
Aliases:
tags, tag
Available Commands:
get Show a backend authorization's resource tags
set Replace a backend authorization's resource tags
Flags:
-h, --help help for tags
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw authorization tags [command] --help" for more information about a command.fm appgw authorization tags get
text
Show a backend authorization's resource tags
Usage:
fm appgw authorization tags get <authorization-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw authorization tags set
text
Replace a backend authorization's resource tags in place with exactly the given set
(replace semantics — any tag not listed is removed). Resource tags are your own
metadata for search and filtering: nothing else about the backend authorization changes, and the
running service is not touched.
The set you pass IS the resulting set. To ADD one tag without disturbing the
others, read the current ones first with 'fm appgw authorization tags get' and pass them all
back. Use --clear to remove every tag. The tenant's default tags are not
re-applied.
A tag change is not configuration: it needs no 'fm appgw apply' and reaches no appliance.
Keys beginning frostmoln_ or frostmoln- (any letter case) are reserved and
refused. At most 32 tags; a key is 1-64 bytes, a value at most 256 bytes.
Examples:
fm appgw authorization tags set auth-123 --gateway gw-1 --tag env=prod --tag owner=team-a
fm appgw authorization tags set auth-123 --gateway gw-1 --clear
Usage:
fm appgw authorization tags set <authorization-id> --tag <key=value> [--tag <key=value> ...] [flags]
Flags:
--clear remove ALL tags (mutually exclusive with --tag)
-h, --help help for set
--tag strings tag in key=value format (repeatable; replace semantics)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw backend
text
A backend is one destination inside your VPC.
Two things gate a backend, both deliberately:
1. The address must lie inside the gateway's OWN VPC range. Anything else is
refused -- without that check the gateway would be an open proxy.
2. Adding a backend does not open the path to it. The platform never edits
your security groups behind your back; run "backend authorize" to add the
one ingress rule, and it is audited.
Usage:
fm appgw backend [command]
Aliases:
backend, backends
Available Commands:
add Add a backend to a pool
authorize Open the path from the gateway to a backend's security group
delete Remove a backend from a pool
list List a pool's backends
tags Read and replace a backend's resource tags
Flags:
--gateway string Gateway id (required)
-h, --help help for backend
--pool string Backend pool id (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw backend [command] --help" for more information about a command.fm appgw backend add
text
Add a backend to a pool.
A backend is an IP address inside the gateway's own VPC, and a port. An address
outside that VPC is refused server-side — without that rule the gateway would
forward anywhere it was pointed.
--source-kind address (default) --address is an IP in your VPC
Naming a backend by instance id or load balancer id and letting the platform
resolve the address is not available yet; the server refuses those values today,
so this command refuses them -- and --source-id, which only they use -- here,
rather than sending a request it knows will fail.
Examples:
fm appgw backend add --gateway g --pool p --address 10.0.1.10 --port 8080
Usage:
fm appgw backend add [flags]
Flags:
--address string IP address inside the gateway's VPC
-h, --help help for add
--port int Backend port (required)
--source-id string Reserved for instance / load balancer backends, which are not available yet
--source-kind string address (the only kind available yet)
--tag strings resource tag in key=value format (repeatable). The tenant's default tags are merged in; a key you set wins
--weight int Relative weight
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--pool string Backend pool id (required)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw backend authorize
text
Add one ingress rule to a security group you own, allowing the gateway's
appliance to reach it.
🔴 The rule is per (security group, protocol, port) -- NOT per backend. Two
backends behind the same security group and port SHARE one authorization, so
removing one backend does not close the path for the other. Revoke by
authorization id, which is what "authorization list" shows.
Every authorize and revoke is recorded: fm appgw audit --gateway <id>
Usage:
fm appgw backend authorize [flags]
Flags:
--backend string Backend id (required)
-h, --help help for authorize
--security-group string Security group to open (required)
--tag strings resource tag in key=value format (repeatable). The tenant's default tags are merged in; a key you set wins
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--pool string Backend pool id (required)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw backend delete
text
Remove a backend from a pool
Usage:
fm appgw backend delete <backend-id> [flags]
Flags:
--force Skip the confirmation prompt
-h, --help help for delete
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--pool string Backend pool id (required)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw backend list
text
List a pool's backends
Usage:
fm appgw backend list [flags]
Aliases:
list, ls
Flags:
-h, --help help for list
--tag strings only backends with this tag, key=value (repeatable; every one must match; key= matches an empty value)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--pool string Backend pool id (required)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw backend tags
text
Read and replace a backend's resource tags
Usage:
fm appgw backend tags [command]
Aliases:
tags, tag
Available Commands:
get Show a backend's resource tags
set Replace a backend's resource tags
Flags:
-h, --help help for tags
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--pool string Backend pool id (required)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw backend tags [command] --help" for more information about a command.fm appgw backend tags get
text
Show a backend's resource tags
Usage:
fm appgw backend tags get <backend-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--pool string Backend pool id (required)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw backend tags set
text
Replace a backend's resource tags in place with exactly the given set
(replace semantics — any tag not listed is removed). Resource tags are your own
metadata for search and filtering: nothing else about the backend changes, and the
running service is not touched.
The set you pass IS the resulting set. To ADD one tag without disturbing the
others, read the current ones first with 'fm appgw backend tags get' and pass them all
back. Use --clear to remove every tag. The tenant's default tags are not
re-applied.
A tag change is not configuration: it needs no 'fm appgw apply' and reaches no appliance.
Keys beginning frostmoln_ or frostmoln- (any letter case) are reserved and
refused. At most 32 tags; a key is 1-64 bytes, a value at most 256 bytes.
Examples:
fm appgw backend tags set be-123 --gateway gw-1 --pool pool-1 --tag env=prod --tag owner=team-a
fm appgw backend tags set be-123 --gateway gw-1 --pool pool-1 --clear
Usage:
fm appgw backend tags set <backend-id> --tag <key=value> [--tag <key=value> ...] [flags]
Flags:
--clear remove ALL tags (mutually exclusive with --tag)
-h, --help help for set
--tag strings tag in key=value format (repeatable; replace semantics)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--pool string Backend pool id (required)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw certificate
text
Manage a gateway's TLS material.
A private key is write-only. It is never returned by any endpoint, never
printed, and is not a field on anything this CLI can dump -- so a --output json
of a certificate cannot leak one.
Usage:
fm appgw certificate [command]
Aliases:
certificate, certificates, cert
Available Commands:
delete Delete a certificate
get Show a certificate
list List certificates
tags Read and replace a certificate's resource tags
upload Upload a certificate and its private key
Flags:
--gateway string Gateway id (required)
-h, --help help for certificate
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw certificate [command] --help" for more information about a command.fm appgw certificate delete
text
Delete a certificate
Usage:
fm appgw certificate delete <certificate-id> [flags]
Flags:
--force Skip the confirmation prompt
-h, --help help for delete
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw certificate get
text
Show a certificate
Usage:
fm appgw certificate get <certificate-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw certificate list
text
List certificates
Usage:
fm appgw certificate list [flags]
Aliases:
list, ls
Flags:
-h, --help help for list
--tag strings only certificates with this tag, key=value (repeatable; every one must match; key= matches an empty value)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw certificate tags
text
Read and replace a certificate's resource tags
Usage:
fm appgw certificate tags [command]
Aliases:
tags, tag
Available Commands:
get Show a certificate's resource tags
set Replace a certificate's resource tags
Flags:
-h, --help help for tags
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw certificate tags [command] --help" for more information about a command.fm appgw certificate tags get
text
Show a certificate's resource tags
Usage:
fm appgw certificate tags get <certificate-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw certificate tags set
text
Replace a certificate's resource tags in place with exactly the given set
(replace semantics — any tag not listed is removed). Resource tags are your own
metadata for search and filtering: nothing else about the certificate changes, and the
running service is not touched.
The set you pass IS the resulting set. To ADD one tag without disturbing the
others, read the current ones first with 'fm appgw certificate tags get' and pass them all
back. Use --clear to remove every tag. The tenant's default tags are not
re-applied.
A tag change is not configuration: it needs no 'fm appgw apply' and reaches no appliance.
Keys beginning frostmoln_ or frostmoln- (any letter case) are reserved and
refused. At most 32 tags; a key is 1-64 bytes, a value at most 256 bytes.
Examples:
fm appgw certificate tags set cert-123 --gateway gw-1 --tag env=prod --tag owner=team-a
fm appgw certificate tags set cert-123 --gateway gw-1 --clear
Usage:
fm appgw certificate tags set <certificate-id> --tag <key=value> [--tag <key=value> ...] [flags]
Flags:
--clear remove ALL tags (mutually exclusive with --tag)
-h, --help help for set
--tag strings tag in key=value format (repeatable; replace semantics)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw certificate upload
text
Upload a certificate chain and its private key.
--chain and --private-key each take either a path to a PEM file or the PEM text
itself.
Example:
fm appgw certificate upload --gateway g --name www \
--chain ./fullchain.pem --private-key ./privkey.pem
Usage:
fm appgw certificate upload [flags]
Flags:
--chain string Certificate chain: PEM text or a path (required)
-h, --help help for upload
--name string Certificate name (required)
--private-key string Private key: a path, or - for stdin (required). Passing the key text directly puts it in your shell history and in this process's command line.
--tag strings resource tag in key=value format (repeatable). The tenant's default tags are merged in; a key you set wins
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw create
text
Create an Application Gateway in one of your VPCs.
Public IP:
--public-ip-mode allocated (default) the platform draws an address from the
pool and RELEASES it when the gateway is deleted.
--public-ip-mode selected use an address you already hold, named by
--public-ip. It is used as-is and is NEVER
released when the gateway is deleted.
Provisioning is asynchronous and takes a few minutes. The command waits by
default, reporting progress as it goes, and fails if provisioning fails.
--no-wait returns as soon as the create is accepted and prints the OPERATION
alongside the gateway id. The operation is the half that survives: a create
that fails before anything is built discards the gateway row, so its id then
reads as no such gateway and the operation is what carries the reason.
Examples:
fm appgw create --name edge --flavor agw.co1.medium --vpc vpc-1 --subnet sub-1
fm appgw create --name edge --flavor agw.co1.large --vpc vpc-1 --subnet sub-1 \
--public-ip-mode selected --public-ip pip-abc
Usage:
fm appgw create [flags]
Flags:
--flavor string Flavor id, e.g. agw.co1.medium (required)
-h, --help help for create
--name string Gateway name (required)
--no-wait Return as soon as the request is accepted
--public-ip string Your own Public IP id (with --public-ip-mode selected)
--public-ip-mode string allocated | selected (default "allocated")
--subnet string Subnet id (required)
--tag strings resource tag in key=value format (repeatable). The tenant's default tags are merged in; a key you set wins
--vpc string VPC id (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw delete
text
Delete an Application Gateway and everything it fronts.
Whether your Public IP survives depends on how the gateway got it. The
confirmation prompt says which, read from the gateway itself rather than
guessed:
publicIpMode = allocated the address is RELEASED with the gateway.
publicIpMode = selected the address is yours and is left untouched.
Usage:
fm appgw delete <gateway-id> [flags]
Flags:
--force Skip the confirmation prompt
-h, --help help for delete
--no-wait Return as soon as the request is accepted
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw flavor
text
List the Application Gateway size catalog.
A size is described by what the appliance carries, not by the machine it runs
on. LISTENERS, ROUTES, BACKENDS and WAF RULES are structural caps, not advice:
exceeding one is refused. CONNECTIONS is the connection ceiling the size is rated
for; a listener's own --max-connections may raise the appliance above it.
REQ/S is a rating rather than a guarantee -- nothing enforces it, and real
throughput depends on your rules, TLS settings and backends.
Usage:
fm appgw flavors [flags]
Aliases:
flavors, flavor
Flags:
-h, --help help for flavors
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw flavors
text
List the Application Gateway size catalog.
A size is described by what the appliance carries, not by the machine it runs
on. LISTENERS, ROUTES, BACKENDS and WAF RULES are structural caps, not advice:
exceeding one is refused. CONNECTIONS is the connection ceiling the size is rated
for; a listener's own --max-connections may raise the appliance above it.
REQ/S is a rating rather than a guarantee -- nothing enforces it, and real
throughput depends on your rules, TLS settings and backends.
Usage:
fm appgw flavors [flags]
Aliases:
flavors, flavor
Flags:
-h, --help help for flavors
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw get
text
Show an Application Gateway
Usage:
fm appgw get <gateway-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw health-check
text
Manage a pool's health check
Usage:
fm appgw health-check [command]
Aliases:
health-check, healthcheck, hc
Available Commands:
delete Remove a pool's health check
get Show a pool's health check
set Replace a pool's health check
Flags:
--gateway string Gateway id (required)
-h, --help help for health-check
--pool string Backend pool id (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw health-check [command] --help" for more information about a command.fm appgw health-check delete
text
Leave the pool with NO health check.
From the next apply the gateway stops probing this pool's backends and treats
every enabled one as available. Use it when the backends decide their own
availability -- a supervised service, or one behind its own load balancer -- and
a probe from the gateway would only add a second opinion.
⚠ For everything else, keep a check: without one, a backend that has stopped
answering still receives its share of traffic.
A pool that already has no health check is not an error -- the command says so
and exits 0, so running it twice, or from a script that cannot know, is safe.
Example:
fm appgw health-check delete --gateway g --pool p
Usage:
fm appgw health-check delete [flags]
Flags:
--force Skip the confirmation prompt
-h, --help help for delete
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--pool string Backend pool id (required)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw health-check get
text
Show a pool's health check
Usage:
fm appgw health-check get [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--pool string Backend pool id (required)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw health-check set
text
Replace a pool's health check.
This is a REPLACE, not a merge: fields you do not pass go back to the server's
default -- including --port, which reverts to probing each backend's own port,
and --proxy-protocol, which reverts to OFF. --timeout must be strictly less
than --interval.
--port probes somewhere other than the backend's own port: a mail server
answering SMTP on 25 with a health endpoint on 8080. It is REQUIRED for a pool
behind a ranged tcp listener, whose backends are forwarded to on whatever port
the client used and so have no fixed port to probe.
--proxy-protocol sends the PROXY protocol v2 header on the PROBE connection, as
the pool's own --proxy-protocol does on the connections carrying traffic. It
means something only together with --port, and OFF does NOT mean "no header on
the probes": a probe with no --port of its own dials the backend's own address
and port, so it inherits the pool's connection settings and already carries the
header whenever the pool sends one. --port opts the probe out of those settings
and takes the header with it; this flag is how you put it back. The pool's own
--proxy-protocol must already be on, or the server refuses this.
🔴 LEAVING --proxy-protocol OUT TURNS IT OFF, the same way leaving --port out
reverts the probe port. Retuning --interval on a probe that had it means
passing --proxy-protocol again in the same command -- otherwise the probes stop
sending the header at the next apply, and a port that REQUIRES it then fails
every probe and marks every backend in the pool unhealthy.
--protocol tcp opens a connection and closes it, so --path and
--expected-status do not apply to it and are refused.
To have no health check at all, use "health-check delete" -- not an empty set.
Example:
fm appgw health-check set --gateway g --pool p \
--protocol http --path /healthz --expected-status 200 --interval 10 --timeout 3
fm appgw health-check set --gateway g --pool p --protocol http --path /healthz --port 8080
fm appgw health-check set --gateway g --pool p --protocol tcp --port 8080 --proxy-protocol
Usage:
fm appgw health-check set [flags]
Flags:
--expected-status string Expected status, e.g. 200 or 200-299 (http/https only)
--healthy-threshold int Successes before a backend is healthy
-h, --help help for set
--interval int Seconds between probes
--path string Path to probe (http/https only)
--port int Probe THIS port instead of each backend's own. Required for a pool behind a RANGED tcp listener, whose backends have no fixed port to probe
--protocol string http | https | tcp
--proxy-protocol Send a PROXY protocol v2 header on the PROBE connection. Meaningful only with --port, and OFF whenever it is left out -- a set that omits it stops the probes sending the header at the next apply. Requires the pool's own --proxy-protocol
--timeout int Probe timeout in seconds (must be < interval)
--unhealthy-threshold int Failures before a backend is unhealthy
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--pool string Backend pool id (required)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw list
text
List Application Gateways
Usage:
fm appgw list [flags]
Aliases:
list, ls
Flags:
-h, --help help for list
--tag strings only gateways with this tag, key=value (repeatable; every one must match; key= matches an empty value)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw listener
text
A listener is one bound port on the gateway -- or, on a tcp listener, a range
of them. Routes hang off a listener, not off the gateway, which is what lets a
tcp listener -- which cannot honour host or path routing -- be additive rather
than a redesign.
http, https inspected, routed by host and path, TLS-terminated on https,
and covered by the Web Application Firewall.
tcp bytes forwarded at layer 4 to ONE backend pool. No TLS
termination (TLS stays end to end), no routes, no WAF -- the
source-CIDR, geo, rate-limit and connection controls still
apply.
Creating a listener OPENS its port on the gateway's public ingress and deleting
one closes it, without waiting for an apply. Its ROUTING still takes effect on
apply, as everything else here does.
Usage:
fm appgw listener [command]
Aliases:
listener, listeners
Available Commands:
create Create a listener
delete Delete a listener
get Show a listener
list List listeners
tags Read and replace a listener's resource tags
Flags:
--gateway string Gateway id (required)
-h, --help help for listener
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw listener [command] --help" for more information about a command.fm appgw listener create
text
Create a listener on a gateway.
--protocol http | https one port, routed by host and path.
--protocol tcp bytes forwarded at layer 4 to the pool named by
--backend-pool. A tcp listener has no routes, so it
names its pool here; it terminates no TLS and is not
inspected by the WAF.
Certificates, --tls-min-version, --tls-cipher-profile and --redirect-to-https
may only be set on an https listener, and are refused on a tcp one. Geo blocking
needs at least one country when the mode is allow or deny.
--port-range-end makes a tcp listener bind a RANGE, first to last inclusive.
Each connection is forwarded to the SAME port on the backend that the client
connected to, so 8000-8100 reaches 8000-8100 on your servers -- which is why
the pool's health check must then set a --port of its own: those backends have
no fixed port to probe.
🔴 --rate-limit-rps AND --rate-limit-burst COUNT CONNECTIONS ON A tcp LISTENER,
not requests -- there is no request to count at layer 4. For SMTP, IMAP or MQTT,
where one connection carries a whole session, an HTTP figure reused here is a
limit orders of magnitude tighter than it looks.
Examples:
fm appgw listener create --gateway g --name http --protocol http --port 80 --redirect-to-https
fm appgw listener create --gateway g --name https --protocol https --port 443 \
--certificate cert-1 --tls-min-version 1.2 --allowed-cidr 0.0.0.0/0
fm appgw listener create --gateway g --name smtp --protocol tcp --port 25 \
--backend-pool pool-mail
fm appgw listener create --gateway g --name passive-ftp --protocol tcp \
--port 30000 --port-range-end 30100 --backend-pool pool-ftp
Usage:
fm appgw listener create [flags]
Flags:
--allowed-cidr strings Allow only these source CIDRs (repeatable)
--backend-pool string Backend pool this listener forwards to (tcp only, and required there: a tcp listener has no routes)
--certificate string Default certificate id (https only)
--denied-cidr strings Deny these source CIDRs (repeatable)
--geo-block-mode string off | allow | deny
--geo-country strings ISO country code (repeatable; required with allow/deny)
-h, --help help for create
--max-connections int Maximum concurrent connections
--name string Listener name (required)
--port int Port to bind, or the FIRST port of a range (required)
--port-range-end int Last port of a range, INCLUSIVE (tcp only; must be greater than --port). Each connection reaches the same port on the backend, so the pool's health check needs its own --port
--protocol string http | https | tcp (required)
--rate-limit-burst int Ceiling inside any one second, same unit as --rate-limit-rps
--rate-limit-rps int Sustained rate per source: REQUESTS per second on http/https, CONNECTIONS per second on tcp
--redirect-to-https Redirect http to https
--sni-certificate strings Additional certificate id for SNI (repeatable, https only)
--tag strings resource tag in key=value format (repeatable). The tenant's default tags are merged in; a key you set wins
--tls-cipher-profile string modern | intermediate
--tls-min-version string 1.2 | 1.3
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw listener delete
text
Delete a listener
Usage:
fm appgw listener delete <listener-id> [flags]
Flags:
--force Skip the confirmation prompt
-h, --help help for delete
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw listener get
text
Show a listener
Usage:
fm appgw listener get <listener-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw listener list
text
List listeners
Usage:
fm appgw listener list [flags]
Aliases:
list, ls
Flags:
-h, --help help for list
--tag strings only listeners with this tag, key=value (repeatable; every one must match; key= matches an empty value)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw listener tags
text
Read and replace a listener's resource tags
Usage:
fm appgw listener tags [command]
Aliases:
tags, tag
Available Commands:
get Show a listener's resource tags
set Replace a listener's resource tags
Flags:
-h, --help help for tags
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw listener tags [command] --help" for more information about a command.fm appgw listener tags get
text
Show a listener's resource tags
Usage:
fm appgw listener tags get <listener-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw listener tags set
text
Replace a listener's resource tags in place with exactly the given set
(replace semantics — any tag not listed is removed). Resource tags are your own
metadata for search and filtering: nothing else about the listener changes, and the
running service is not touched.
The set you pass IS the resulting set. To ADD one tag without disturbing the
others, read the current ones first with 'fm appgw listener tags get' and pass them all
back. Use --clear to remove every tag. The tenant's default tags are not
re-applied.
A tag change is not configuration: it needs no 'fm appgw apply' and reaches no appliance.
Keys beginning frostmoln_ or frostmoln- (any letter case) are reserved and
refused. At most 32 tags; a key is 1-64 bytes, a value at most 256 bytes.
Examples:
fm appgw listener tags set lsn-123 --gateway gw-1 --tag env=prod --tag owner=team-a
fm appgw listener tags set lsn-123 --gateway gw-1 --clear
Usage:
fm appgw listener tags set <listener-id> --tag <key=value> [--tag <key=value> ...] [flags]
Flags:
--clear remove ALL tags (mutually exclusive with --tag)
-h, --help help for set
--tag strings tag in key=value format (repeatable; replace semantics)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw pool
text
Manage backend pools
Usage:
fm appgw pool [command]
Aliases:
pool, pools, backend-pool
Available Commands:
create Create a backend pool
delete Delete a backend pool
get Show a backend pool
list List backend pools
tags Read and replace a backend pool's resource tags
update Change a backend pool's settings
Flags:
--gateway string Gateway id (required)
-h, --help help for pool
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw pool [command] --help" for more information about a command.fm appgw pool create
text
Create a backend pool.
Re-encrypt to the backends by setting --protocol https. --tls-verify-backend
then decides whether the backend's certificate is checked; leaving it unset
keeps the server's default rather than silently turning verification off.
--proxy-protocol makes the gateway prepend a PROXY protocol v2 header to every
connection, so the backends see the real client address instead of the
gateway's. It is off unless asked for, and the backend must be configured to
read the header FIRST -- one that is not expecting it reads the header as the
first bytes of your protocol and every connection fails. Use "pool update" to
turn it on once the backend is ready.
Examples:
fm appgw pool create --gateway g --name web --protocol http --algorithm round_robin
fm appgw pool create --gateway g --name api --protocol https \
--tls-verify-backend --tls-server-name api.internal --tls-ca-certificate ./ca.pem
fm appgw pool create --gateway g --name mail --proxy-protocol
Usage:
fm appgw pool create [flags]
Flags:
--algorithm string round_robin | least_connections | source_ip
-h, --help help for create
--name string Pool name (required)
--protocol string http | https
--proxy-protocol Prepend a PROXY protocol v2 header so backends see the real client address. THE BACKEND MUST BE CONFIGURED TO READ IT FIRST -- one that is not expecting the header reads it as the first bytes of your protocol and every connection fails
--session-affinity string none | cookie | source_ip
--session-cookie string Cookie name (required with --session-affinity cookie)
--tag strings resource tag in key=value format (repeatable). The tenant's default tags are merged in; a key you set wins
--timeout-connect-ms int Connect timeout in milliseconds
--timeout-response-ms int Response timeout in milliseconds
--tls-ca-certificate string CA to verify backends against: PEM text or a path
--tls-server-name string Server name to present to the backend
--tls-verify-backend Verify the backend's certificate
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw pool delete
text
Delete a backend pool
Usage:
fm appgw pool delete <pool-id> [flags]
Flags:
--force Skip the confirmation prompt
-h, --help help for delete
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw pool get
text
Show a backend pool
Usage:
fm appgw pool get <pool-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw pool list
text
List backend pools
Usage:
fm appgw pool list [flags]
Aliases:
list, ls
Flags:
-h, --help help for list
--tag strings only pools with this tag, key=value (repeatable; every one must match; key= matches an empty value)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw pool tags
text
Read and replace a backend pool's resource tags
Usage:
fm appgw pool tags [command]
Aliases:
tags, tag
Available Commands:
get Show a backend pool's resource tags
set Replace a backend pool's resource tags
Flags:
-h, --help help for tags
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw pool tags [command] --help" for more information about a command.fm appgw pool tags get
text
Show a backend pool's resource tags
Usage:
fm appgw pool tags get <pool-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw pool tags set
text
Replace a backend pool's resource tags in place with exactly the given set
(replace semantics — any tag not listed is removed). Resource tags are your own
metadata for search and filtering: nothing else about the backend pool changes, and the
running service is not touched.
The set you pass IS the resulting set. To ADD one tag without disturbing the
others, read the current ones first with 'fm appgw pool tags get' and pass them all
back. Use --clear to remove every tag. The tenant's default tags are not
re-applied.
A tag change is not configuration: it needs no 'fm appgw apply' and reaches no appliance.
Keys beginning frostmoln_ or frostmoln- (any letter case) are reserved and
refused. At most 32 tags; a key is 1-64 bytes, a value at most 256 bytes.
Examples:
fm appgw pool tags set pool-123 --gateway gw-1 --tag env=prod --tag owner=team-a
fm appgw pool tags set pool-123 --gateway gw-1 --clear
Usage:
fm appgw pool tags set <pool-id> --tag <key=value> [--tag <key=value> ...] [flags]
Flags:
--clear remove ALL tags (mutually exclusive with --tag)
-h, --help help for set
--tag strings tag in key=value format (repeatable; replace semantics)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw pool update
text
Change the settings of a pool that already exists.
Only the flags you pass are sent; everything else is left exactly as it is. The
pool's NAME cannot be changed here, and neither can its backends or its health
check -- those have their own commands.
This is how --proxy-protocol is turned on for a live pool. Without it the only
way was to delete the pool, which first means deleting the tcp listener holding
it -- closing its public port that instant -- and building both again: an outage
to change one setting.
🔴 TURNING --proxy-protocol ON OR OFF CHANGES THE BYTES THE BACKEND RECEIVES.
Configure the backend to parse the header first (Postfix
smtpd_upstream_proxy_protocol=haproxy, Dovecot haproxy_trusted_networks, nginx
"proxy_protocol" on the listen line), THEN set this, then apply. A backend that
is not expecting the header reads it as the first bytes of your protocol and
every connection fails. Turning it off is the same change in reverse.
The three free-text settings accept an empty string and it CLEARS them:
--session-cookie "", --tls-ca-certificate "", --tls-server-name "".
Examples:
fm appgw pool update p-1 --gateway g --proxy-protocol
fm appgw pool update p-1 --gateway g --algorithm least_connections --timeout-response-ms 30000
fm appgw pool update p-1 --gateway g --tls-server-name ""
Usage:
fm appgw pool update <pool-id> [flags]
Flags:
--algorithm string round_robin | least_connections | source_ip
-h, --help help for update
--protocol string http | https
--proxy-protocol Prepend a PROXY protocol v2 header so backends see the real client address. THE BACKEND MUST BE CONFIGURED TO READ IT FIRST -- one that is not expecting the header reads it as the first bytes of your protocol and every connection fails
--session-affinity string none | cookie | source_ip
--session-cookie string Cookie name (required with --session-affinity cookie)
--timeout-connect-ms int Connect timeout in milliseconds
--timeout-response-ms int Response timeout in milliseconds
--tls-ca-certificate string CA to verify backends against: PEM text or a path
--tls-server-name string Server name to present to the backend
--tls-verify-backend Verify the backend's certificate
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw route
text
A route matches a request on a listener by host and path, and forwards it to a
backend pool.
Priority is EXPLICIT and lower wins. There is no implicit longest-prefix rule,
because that would make one route's effect depend on another route's contents:
adding a route would silently reorder the others while a plan showed no change.
Omitting --priority puts the new route LAST.
Usage:
fm appgw route [command]
Aliases:
route, routes
Available Commands:
create Create a route
delete Delete a route
get Show a route
list List routes, in evaluation order
reorder Reassign route priorities atomically
tags Read and replace a route's resource tags
Flags:
--gateway string Gateway id (required)
-h, --help help for route
--listener string Listener id (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw route [command] --help" for more information about a command.fm appgw route create
text
Create a route on a listener.
--match-type prefix (default) path is a prefix
--match-type exact path must match exactly
--match-type regex path is an RE2 regular expression
Header values set with --set-header and --set-response-header are treated as
secrets: fm never prints one back. "route get" shows each header's name with
"(value hidden)", and -o json / -o yaml carry the names only. A route cannot
be edited, so changing a value means deleting the route and creating it again.
Examples:
fm appgw route create --gateway g --listener l --name api \
--host api.example.com --path /v1 --pool pool-1
fm appgw route create --gateway g --listener l --name spa \
--path / --pool pool-2 --priority 900
Usage:
fm appgw route create [flags]
Flags:
-h, --help help for create
--host string Host to match, e.g. api.example.com or *.example.com
--match-type string prefix | exact | regex
--name string Route name (required)
--path string Path to match
--pool string Backend pool id to forward to (required)
--priority int Evaluation priority, lower wins (default: last)
--remove-header strings Remove a request header (repeatable)
--rewrite-path-prefix string Replace the matched prefix before forwarding
--set-header stringArray Set a request header, name=value (repeatable)
--set-response-header stringArray Set a response header, name=value (repeatable)
--tag strings resource tag in key=value format (repeatable). The tenant's default tags are merged in; a key you set wins
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--listener string Listener id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw route delete
text
Delete a route
Usage:
fm appgw route delete <route-id> [flags]
Flags:
--force Skip the confirmation prompt
-h, --help help for delete
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--listener string Listener id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw route get
text
Show a route
Usage:
fm appgw route get <route-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--listener string Listener id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw route list
text
List routes, in evaluation order
Usage:
fm appgw route list [flags]
Aliases:
list, ls
Flags:
-h, --help help for list
--tag strings only routes with this tag, key=value (repeatable; every one must match; key= matches an empty value)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--listener string Listener id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw route reorder
text
Reassign route priorities in one call.
Pass --route <route-id>=<priority> once per route. The server refuses a
duplicate id or a duplicate priority, so a half-applied reorder -- two routes
briefly sharing a priority -- is not expressible.
Example:
fm appgw route reorder --gateway g --listener l \
--route rt-api=100 --route rt-static=200 --route rt-spa=900
Usage:
fm appgw route reorder [flags]
Flags:
-h, --help help for reorder
--route stringArray <route-id>=<priority> (repeatable, required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--listener string Listener id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw route tags
text
Read and replace a route's resource tags
Usage:
fm appgw route tags [command]
Aliases:
tags, tag
Available Commands:
get Show a route's resource tags
set Replace a route's resource tags
Flags:
-h, --help help for tags
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--listener string Listener id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw route tags [command] --help" for more information about a command.fm appgw route tags get
text
Show a route's resource tags
Usage:
fm appgw route tags get <route-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--listener string Listener id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw route tags set
text
Replace a route's resource tags in place with exactly the given set
(replace semantics — any tag not listed is removed). Resource tags are your own
metadata for search and filtering: nothing else about the route changes, and the
running service is not touched.
The set you pass IS the resulting set. To ADD one tag without disturbing the
others, read the current ones first with 'fm appgw route tags get' and pass them all
back. Use --clear to remove every tag. The tenant's default tags are not
re-applied.
A tag change is not configuration: it needs no 'fm appgw apply' and reaches no appliance.
Keys beginning frostmoln_ or frostmoln- (any letter case) are reserved and
refused. At most 32 tags; a key is 1-64 bytes, a value at most 256 bytes.
Examples:
fm appgw route tags set rt-123 --gateway gw-1 --listener lsn-1 --tag env=prod --tag owner=team-a
fm appgw route tags set rt-123 --gateway gw-1 --listener lsn-1 --clear
Usage:
fm appgw route tags set <route-id> --tag <key=value> [--tag <key=value> ...] [flags]
Flags:
--clear remove ALL tags (mutually exclusive with --tag)
-h, --help help for set
--tag strings tag in key=value format (repeatable; replace semantics)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--listener string Listener id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw tags
text
Read and replace a Application Gateway's resource tags
Usage:
fm appgw tags [command]
Aliases:
tags, tag
Available Commands:
get Show a Application Gateway's resource tags
set Replace a Application Gateway's resource tags
Flags:
-h, --help help for tags
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw tags [command] --help" for more information about a command.fm appgw tags get
text
Show a Application Gateway's resource tags
Usage:
fm appgw tags get <gateway-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw tags set
text
Replace a Application Gateway's resource tags in place with exactly the given set
(replace semantics — any tag not listed is removed). Resource tags are your own
metadata for search and filtering: nothing else about the Application Gateway changes, and the
running service is not touched.
The set you pass IS the resulting set. To ADD one tag without disturbing the
others, read the current ones first with 'fm appgw tags get' and pass them all
back. Use --clear to remove every tag. The tenant's default tags are not
re-applied.
A tag change is not configuration: it needs no 'fm appgw apply' and reaches no appliance.
Keys beginning frostmoln_ or frostmoln- (any letter case) are reserved and
refused. At most 32 tags; a key is 1-64 bytes, a value at most 256 bytes.
Examples:
fm appgw tags set gw-123 --tag env=prod --tag owner=team-a
fm appgw tags set gw-123 --clear
Usage:
fm appgw tags set <gateway-id> --tag <key=value> [--tag <key=value> ...] [flags]
Flags:
--clear remove ALL tags (mutually exclusive with --tag)
-h, --help help for set
--tag strings tag in key=value format (repeatable; replace semantics)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw update
text
Rename an Application Gateway
Usage:
fm appgw update <gateway-id> [flags]
Flags:
-h, --help help for update
--name string New name (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf
text
Author and publish a gateway's Web Application Firewall ruleset.
Four ideas, and everything else follows from them:
THE FIREWALL IS COMPOSED, NOT SINGULAR. A GATEWAY-scoped policy carries the
managed ruleset for the whole gateway. An OVERLAY-scoped policy adds your own
rules to ONE listener or ONE route, and carries no managed ruleset -- so the
managed-ruleset dials (paranoia level, anomaly threshold, ruleset version)
belong to the gateway policy alone. "create --scope" decides which you are
making, and it cannot be changed afterwards.
AN OVERLAY INHERITS ITS MODE. An overlay policy defaults to mode "inherit":
if the gateway policy blocks, the overlay blocks. So an overlay whose mode
reads "inherit" may be refusing requests right now, and everything fm prints
says so -- "block (inherited)", never a bare "detect".
DRAFT vs ACTIVE. Rule and exclusion writes land on the DRAFT and change
nothing a request sees. "publish" freezes the draft and makes it active.
DRY RUN IS A GATE, NOT ADVICE. Publishing is REFUSED until a completed
dry-run exists for exactly what you are about to publish. The dry-run
replays recent traffic and reports what would NEWLY be blocked, and it runs
under a time budget, so it also refuses a ruleset too expensive to evaluate.
Editing anything -- including a setting like paranoia level -- invalidates
the dry-run automatically.
PUBLISHED IS NOT LIVE. A published version reaches the appliance on the next
"fm appgw apply".
Rules you did not write:
Some rules are platform-owned. You cannot edit or delete them. Where the
platform allows it you may opt out, and "rule opt-out" is the only write you
may make to one.
Examples:
fm appgw waf get --gateway g
fm appgw waf rule set --gateway g --key block-admin --kind raw --file ./rule.conf
fm appgw waf dry-run --gateway g
fm appgw waf publish --gateway g
fm appgw apply g
Usage:
fm appgw waf [command]
Available Commands:
attach Attach a WAF policy to the gateway, a listener or a route
audit Show who changed this policy, and when
create Create a WAF policy
delete Delete the WAF policy
detach Remove a WAF policy attachment
diff Compare two rulesets, rule by rule
draft Show what is being edited
dry-run Replay recent traffic against the draft
dry-runs List past dry-runs
exclusion Create, replace or delete an exclusion
exclusions List the exclusions being edited, or an earlier version's
export Write the ruleset as a portable document
get Show the WAF policy
import Apply a portable ruleset document to the draft
list List WAF policies
mode Switch the WAF between detect, block and inherit
publish Freeze the draft and make it the enforced version
rollback Go back to an earlier published version
rule Create, replace, delete or opt out of a rule
rules List the rules being edited, or an earlier version's
set Change the WAF policy's settings
tags Read and replace a WAF policy's resource tags
versions Show the policy's version history
Flags:
--gateway string Gateway id (required)
-h, --help help for waf
--policy string WAF policy id (only needed when the gateway has more than one)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw waf [command] --help" for more information about a command.fm appgw waf attach
text
Attach a WAF policy at one of the three levels.
(no flags) the GATEWAY. Takes a gateway-scoped policy: the
managed ruleset for everything the gateway serves.
--listener <id> one LISTENER. Takes an overlay-scoped policy.
--listener <id> --route <id>
one ROUTE. Takes an overlay-scoped policy.
Attaching is separate from authoring: a policy exists, is published and is
rolled back without being attached to anything, and detaching does not delete
it.
The scope has to match the level, and fm checks before sending -- attaching a
gateway policy to a listener would compile the managed ruleset into an overlay,
which the server refuses.
Examples:
fm appgw waf attach --gateway g --policy wp-gateway
fm appgw waf attach --gateway g --policy wp-api --listener l-1
fm appgw waf attach --gateway g --policy wp-admin --listener l-1 --route r-7
Usage:
fm appgw waf attach [flags]
Flags:
-h, --help help for attach
--listener string Attach at this listener instead of the gateway
--route string Attach at this route (needs --listener)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf audit
text
Show the policy's administrative history: who published a version, who rolled
back, who opted out of a platform rule.
This is NOT a record of what the firewall did to a request.
Usage:
fm appgw waf audit [flags]
Flags:
-h, --help help for audit
--limit int Maximum entries to return (the server caps this)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf create
text
Create a WAF policy on a gateway.
--scope gateway (default) the gateway's policy. It carries the MANAGED
ruleset and the dials that tune it -- paranoia level,
anomaly threshold, managed ruleset version. Attach it with
"waf attach".
--scope overlay your own rules on ONE listener or ONE route. It carries NO
managed ruleset, so none of those dials apply, and its
default mode is "inherit": it blocks when the gateway
policy blocks. Attach it with "waf attach --listener" or
"--route".
Scope is fixed at create. There is no move.
A gateway policy's default mode is DETECT: the ruleset runs and records what it
would have done, and blocks nothing. That is deliberate -- adopt blocking after
you have seen what detect mode matched, not before.
Examples:
fm appgw waf create --gateway g --name default
fm appgw waf create --gateway g --name api-rules --scope overlay
Usage:
fm appgw waf create [flags]
Flags:
--allowed-methods strings HTTP methods the managed ruleset accepts, e.g. GET,HEAD,PROPFIND. OMIT to leave the current setting alone; pass an EMPTY value (--allowed-methods "") to clear the override and go back to the platform default, which is kept current for you. Anything outside the list is refused with 403 regardless of --anomaly-threshold. TRACE, TRACK, CONNECT and DEBUG may never be listed. Gateway-scoped policies only
--allowed-request-content-types strings Request Content-Type values the managed ruleset accepts, e.g. application/json,application/vnd.acme.v2+json. OMIT to leave the current setting alone; pass an EMPTY value (--allowed-request-content-types "") to clear the override and go back to the platform default, which is kept current for you and has been widened three times. That default is not "everything": a vendor type such as application/vnd.acme.v2+json can never be in it, and adding one is the commonest reason to set this flag. Lowercase type/subtype, no parameters. Gateway-scoped policies only
--anomaly-threshold int Anomaly score at which a request is refused (1-1000). Gateway-scoped policies only
--crs-version fm appgw waf get Managed ruleset version. Gateway-scoped policies only; the server accepts only the version this build ships, see fm appgw waf get
--fail-mode string open | closed -- what to do if the engine is unavailable
-h, --help help for create
--mode string detect | block | inherit (inherit: overlay policies only)
--name string Policy name (required)
--paranoia-level int Managed-ruleset paranoia level (1-4; higher catches more and false-positives more). Gateway-scoped policies only
--request-body-limit int Largest request body the gateway ACCEPTS, in bytes (4096-1048576). A larger body is refused 413, not served uninspected, so lowering this lowers the maximum request size your application receives. The gateway's flavor may bound it below this range
--scope string gateway (default) | overlay -- fixed at create; an overlay carries no managed ruleset and attaches to a listener or a route
--tag strings resource tag in key=value format (repeatable). The tenant's default tags are merged in; a key you set wins
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf delete
text
Delete the WAF policy
Usage:
fm appgw waf delete [flags]
Flags:
--force Skip the confirmation prompt
-h, --help help for delete
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf detach
text
Remove the WAF policy attachment at one of the three levels.
(no flags) the GATEWAY's policy.
--listener <id> one LISTENER's overlay.
--listener <id> --route <id>
one ROUTE's overlay.
The policy itself is untouched: its rules, versions and history all survive, and
it can be attached again.
A detach removes only the policy you were shown. fm first reads which policy is
attached, names it, and then asks the server to detach THAT policy -- so if
someone attaches a different one in between, nothing is detached and fm says
what is attached now (exit 1). If nothing is attached there, fm says so and
exits 0 without changing anything.
--policy <id> names the policy you expect to be attached instead of reading it.
The detach happens only if that exact policy is attached; if another one is, or
nothing is, it is refused (exit 1) and nothing changes.
🔴 Detaching the GATEWAY policy changes what every INHERITING overlay does.
An overlay in "inherit" resolves against the gateway policy's mode; with no
gateway policy there is nothing blocking to inherit, so those overlays fall back
to detect and stop refusing anything.
Examples:
fm appgw waf detach --gateway g
fm appgw waf detach --gateway g --listener l-1
fm appgw waf detach --gateway g --listener l-1 --route r-7
fm appgw waf detach --gateway g --policy 3d5e7f90-1a2b-4c3d-8e4f-5a6b7c8d9e0f
Usage:
fm appgw waf detach [flags]
Flags:
--force Skip the confirmation prompt
-h, --help help for detach
--listener string Attach at this listener instead of the gateway
--route string Attach at this route (needs --listener)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf diff
text
Compare two rulesets and print what actually differs.
--from and --to each take: draft | active | a version number | a file path.
Defaults are --from active --to draft, which answers the question you have
right before publishing: what am I about to change?
The comparison is keyed on rule KEY, never on position, so inserting one rule
does not report every rule after it as changed.
Examples:
fm appgw waf diff --gateway g
fm appgw waf diff --gateway g --from 3 --to 4
fm appgw waf diff --gateway g --from ./waf.json --to draft
Usage:
fm appgw waf diff [flags]
Flags:
--from string draft | active | <version> | <file> (default "active")
-h, --help help for diff
--to string draft | active | <version> | <file> (default "draft")
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf draft
text
Show what is being edited
Usage:
fm appgw waf draft [flags]
Flags:
-h, --help help for draft
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf dry-run
text
Replay recent traffic against the draft and report what would change.
This is REQUIRED before publishing. It is not advice:
* publish is refused with 409 unless a completed dry-run matches exactly
what you are about to publish, settings included;
* the replay runs under a time budget, so a ruleset too expensive to
evaluate is refused here rather than slowing every real request.
The replay runs ON THE APPLIANCE against request SIGNATURES -- method, host,
path, header names, body size. Your users' request bodies are never stored and
never leave your VPC; only counts and a would-be-blocked sample come back.
Read "newly blocked" before you publish. It is the number that says whether
this change breaks someone.
Usage:
fm appgw waf dry-run [flags]
Flags:
-h, --help help for dry-run
--tag strings resource tag in key=value format (repeatable). The tenant's default tags are merged in; a key you set wins
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf dry-runs
text
List past dry-runs
Usage:
fm appgw waf dry-runs [flags]
fm appgw waf dry-runs [command]
Available Commands:
tags Read and replace a WAF dry run's resource tags
Flags:
-h, --help help for dry-runs
--tag strings only dry runs with this tag, key=value (repeatable; every one must match; key= matches an empty value)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw waf dry-runs [command] --help" for more information about a command.fm appgw waf dry-runs tags
text
Read and replace a WAF dry run's resource tags
Usage:
fm appgw waf dry-runs tags [command]
Aliases:
tags, tag
Available Commands:
get Show a WAF dry run's resource tags
set Replace a WAF dry run's resource tags
Flags:
-h, --help help for tags
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw waf dry-runs tags [command] --help" for more information about a command.fm appgw waf dry-runs tags get
text
Show a WAF dry run's resource tags
Usage:
fm appgw waf dry-runs tags get <dry-run-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf dry-runs tags set
text
Replace a WAF dry run's resource tags in place with exactly the given set
(replace semantics — any tag not listed is removed). Resource tags are your own
metadata for search and filtering: nothing else about the WAF dry run changes, and the
running service is not touched.
The set you pass IS the resulting set. To ADD one tag without disturbing the
others, read the current ones first with 'fm appgw waf dry-runs tags get' and pass them all
back. Use --clear to remove every tag. The tenant's default tags are not
re-applied.
A tag change is not configuration: it needs no 'fm appgw apply' and reaches no appliance.
Keys beginning frostmoln_ or frostmoln- (any letter case) are reserved and
refused. At most 32 tags; a key is 1-64 bytes, a value at most 256 bytes.
Examples:
fm appgw waf dry-runs tags set dr-123 --gateway gw-1 --tag env=prod --tag owner=team-a
fm appgw waf dry-runs tags set dr-123 --gateway gw-1 --clear
Usage:
fm appgw waf dry-runs tags set <dry-run-id> --tag <key=value> [--tag <key=value> ...] [flags]
Flags:
--clear remove ALL tags (mutually exclusive with --tag)
-h, --help help for set
--tag strings tag in key=value format (repeatable; replace semantics)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf exclusion
text
An exclusion narrows a rule so it stops matching a request shape you know is
good -- a field that legitimately contains SQL, an upload endpoint, an API that
posts XML.
Target exactly one of --target-secrule-id or --target-tag.
Usage:
fm appgw waf exclusion [command]
Available Commands:
delete Remove an exclusion from the draft
set Create or replace an exclusion in the draft
Flags:
-h, --help help for exclusion
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw waf exclusion [command] --help" for more information about a command.fm appgw waf exclusion delete
text
Remove an exclusion from the draft
Usage:
fm appgw waf exclusion delete [flags]
Flags:
--force Skip the confirmation prompt
-h, --help help for delete
--key string Exclusion key (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf exclusion set
text
Create or replace an exclusion, keyed on --key.
Example:
fm appgw waf exclusion set --gateway g --key allow-query-in-search \
--target-secrule-id 942100 --variable ARGS --selector q --path-pattern '^/search'
Usage:
fm appgw waf exclusion set [flags]
Flags:
--description string Why this exclusion exists
-h, --help help for set
--key string Exclusion key (required)
--ordinal int Evaluation order
--path-pattern string Limit the exclusion to matching paths
--selector string Specific field within the variable, e.g. a parameter name
--target-secrule-id int Rule to narrow, by SecRule id
--target-tag string Rules to narrow, by tag
--variable string Variable to exclude, e.g. ARGS (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf exclusions
text
List the exclusions being edited, or an earlier version's
Usage:
fm appgw waf exclusions [flags]
Flags:
--active Read the version being enforced instead of the draft
-h, --help help for exclusions
--version int Read a specific published version
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf export
text
Write the ruleset you own as a JSON document on stdout.
The output is canonical -- sorted, with server-assigned ids and timestamps
stripped -- so this is meaningful:
fm appgw waf export --gateway g > waf.json
git diff waf.json
What is included is exactly what YOU can author: your rules, your exclusions,
your settings, and your opt-out decisions about platform rules. Platform rules
themselves are not, because you cannot import one back.
The document records the policy's SCOPE, and an overlay's mode of "inherit",
because those decide what the rest of it means. Neither is importable -- scope
is fixed at create -- so import checks them and refuses a document written for
the other kind of policy.
By default this exports the DRAFT. Use --active or --version N for a published
version.
Usage:
fm appgw waf export [flags]
Flags:
--active Read the version being enforced instead of the draft
--file string Write to a file instead of stdout
-h, --help help for export
--version int Read a specific published version
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf get
text
Show the WAF policy
Usage:
fm appgw waf get [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf import
text
Read a document written by "export" and write it to the DRAFT.
Nothing is published and nothing is applied: run a dry-run, publish, then
"fm appgw apply".
By default this is ADDITIVE -- rules in the document are written, rules already
in the draft and absent from the document are left alone. Pass --prune to make
the draft match the document exactly, deleting what the document does not
contain. Prune is not the default because the common case is importing one
team's rules into a policy that also holds another's, and a silent delete there
is the worst possible outcome.
fm appgw waf import --gateway g --file waf.json
fm appgw waf import --gateway g --file waf.json --prune
Usage:
fm appgw waf import [flags]
Flags:
--file string Read from a file, or - for stdin (default "-")
-h, --help help for import
--prune Delete draft rules and exclusions the document does not contain
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf list
text
List WAF policies
Usage:
fm appgw waf list [flags]
Aliases:
list, ls
Flags:
-h, --help help for list
--tag strings only policies with this tag, key=value (repeatable; every one must match; key= matches an empty value)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf mode
text
Switch the WAF between detect, block and inherit.
detect the ruleset runs and records what it WOULD have done. Nothing is
blocked. This is the safe place to start and the safe place to
return to.
block matching requests are refused.
inherit take the mode from the GATEWAY policy: block if it blocks, detect
otherwise. OVERLAY policies only -- a gateway policy has nothing to
inherit from -- and it is what an overlay defaults to.
Going to block is a real change to what your users experience. Run a dry-run
first and read what it says would be newly blocked.
So is going to inherit, when the gateway policy blocks. It is not the cautious
option: it means "whatever the gateway does", and fm tells you which that is.
Usage:
fm appgw waf mode <detect|block|inherit> [flags]
Flags:
-h, --help help for mode
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf publish
text
Freeze the draft and make it the policy's active version.
Refused with 409 if no completed dry-run matches the draft exactly. Run
"fm appgw waf dry-run" first.
Publishing an UNCHANGED draft does nothing and says so, rather than creating an
identical version -- which is what keeps a repeated deploy from versioning on
every run.
Publishing does not make the ruleset live. It reaches the appliance on the next
"fm appgw apply".
Usage:
fm appgw waf publish [flags]
Flags:
-h, --help help for publish
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf rollback
text
Copy an earlier version's rules into the draft and publish it.
History is never rewritten: this produces a NEW version whose compiled ruleset
is byte-identical to the one you rolled back to, and which records where it
came from.
fm appgw waf rollback --gateway g --to-version 3
fm appgw apply g
Usage:
fm appgw waf rollback [flags]
Flags:
-h, --help help for rollback
--to-version int Version to roll back to (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf rule
text
Create, replace, delete or opt out of a rule
Usage:
fm appgw waf rule [command]
Available Commands:
delete Remove a rule from the draft
opt-out Turn a platform rule off (or back on) for this gateway
set Create or replace a rule in the draft
Flags:
-h, --help help for rule
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw waf rule [command] --help" for more information about a command.fm appgw waf rule delete
text
Remove a rule from the draft
Usage:
fm appgw waf rule delete [flags]
Flags:
--force Skip the confirmation prompt
-h, --help help for delete
--key string Rule key (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf rule opt-out
text
Turn a platform-owned rule off, or back on.
This is the ONLY write you may make to a rule you do not own, and only where
the rule allows it. Gateway self-protection rules do not, and refuse.
Use it when an emergency virtual patch is a false positive for your traffic.
Your version history records exactly when you did it.
fm appgw waf rule opt-out --gateway g --key platform-cve-2026-1234
fm appgw waf rule opt-out --gateway g --key platform-cve-2026-1234 --opted-out=false
Usage:
fm appgw waf rule opt-out [flags]
Flags:
-h, --help help for opt-out
--key string Platform rule key (required)
--opted-out true to turn it off, false to turn it back on (default true)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf rule set
text
Create or replace a rule, keyed on --key.
The key IS the rule's identity: it is the diff anchor, the Terraform address
and what a report points at. Sending the same key again replaces the rule, so
this is safe to run repeatedly from a script.
Three kinds, exactly one payload each:
--kind builder a structured rule, from --file (JSON)
--kind raw SecLang text, from --raw or --file
--kind managedOverride change a platform-managed rule:
--managed-secrule-id N --managed-action disable
--managed-action updateTarget --managed-target ...
Raw rules are checked at write time -- parsed, directive-allow-listed and size
capped -- so a mistake is a 400 naming the line, not a surprise at publish.
A BUILDER FILE holds the builder object alone -- conditions, action, phase:
{
"phase": 1,
"conditions": [
{ "variable": "REQUEST_HEADERS", "selector": "User-Agent",
"operator": "@rx", "value": "(?i)sqlmap|nikto" }
],
"action": { "type": "deny", "status": 403, "message": "known scanner" }
}
Conditions are ANDed: every one must match. An OR is two rules.
"type": "deny" refuse the request with "status" (403 when unset)
"type": "log" record the match and change nothing else
"type": "allow" do not refuse this request
ALLOW EXEMPTS FAR LESS THAN THE WORD SUGGESTS. What it skips is the managed
ruleset's anomaly-score decision -- the one that refuses a request for
accumulating enough suspicion, and the one that produces false positives. Use it
for traffic you know is safe and that the managed rules keep scoring: an uptime
checker, a webhook sender, a payload shape that looks like an attack and is not.
Everything else still refuses. The policy's allowedMethods and
allowedRequestContentTypes lists, a request body the gateway could not parse,
your own deny rules and any rule Frostmoln placed on the policy all still apply,
because the rule runs after them. And EVERY CONDITION MUST MATCH: an allow with
two conditions exempts a request only when both are true, the same as a deny --
"this path AND my signed sender" is not "this path, for anyone".
An allowed request is also not scored, so it carries no anomaly-score line in
the inspection record.
"allow" requires "phase": 2 and is REFUSED at phase 1 rather than moved: at
phase 1 it would also skip the gateway's own method and content-type refusals,
which are not exemptable. A rule that only reads headers still works at phase 2.
{
"phase": 2,
"conditions": [
{ "variable": "REQUEST_URI", "operator": "@beginsWith", "value": "/health" },
{ "variable": "REQUEST_HEADERS", "selector": "X-Uptime-Token",
"operator": "@streq", "value": "s3cret" }
],
"action": { "type": "allow", "message": "uptime checker" }
}
"status" is the response code for a deny and is ignored otherwise. "message" is
recorded whatever the action is -- it is how you tell your own rules apart in
the log, including which allow rule exempted a request.
"allow" is not available to --kind raw.
Examples:
fm appgw waf rule set --gateway g --key block-admin --kind raw --file ./rule.conf
fm appgw waf rule set --gateway g --key block-scanners --kind builder --file ./deny.json
fm appgw waf rule set --gateway g --key allow-health --kind builder --file ./allow.json
fm appgw waf rule set --gateway g --key quiet-942100 --kind managedOverride \
--managed-secrule-id 942100 --managed-action disable
Usage:
fm appgw waf rule set [flags]
Flags:
--description string What this rule is for
--enabled Whether the rule is evaluated (default true)
--file string Read the rule body from a file, or - for stdin
-h, --help help for set
--key string Rule key: your stable name for this rule (required)
--kind string builder | raw | managedOverride (required)
--managed-action string disable | updateTarget
--managed-secrule-id int Managed rule to override (--kind managedOverride)
--managed-target string New target (--managed-action updateTarget)
--ordinal int Evaluation order within the policy
--raw string SecLang rule text (--kind raw)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf rules
text
List rules.
By default this shows the DRAFT -- what you are editing. Use --active for what
is being enforced right now, or --version N for a frozen version.
Usage:
fm appgw waf rules [flags]
Aliases:
rules, rule-list
Flags:
--active Read the version being enforced instead of the draft
-h, --help help for rules
--version int Read a specific published version
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf set
text
Change a WAF policy's settings.
Only the flags you pass are changed; the rest are left alone.
🔴 Settings are part of what a dry-run is taken against, so changing one
invalidates the current dry-run and the next publish is refused until you run
another. That is the point: the dry-run must describe the ruleset that is about
to go live, settings included.
Usage:
fm appgw waf set [flags]
Flags:
--allowed-methods strings HTTP methods the managed ruleset accepts, e.g. GET,HEAD,PROPFIND. OMIT to leave the current setting alone; pass an EMPTY value (--allowed-methods "") to clear the override and go back to the platform default, which is kept current for you. Anything outside the list is refused with 403 regardless of --anomaly-threshold. TRACE, TRACK, CONNECT and DEBUG may never be listed. Gateway-scoped policies only
--allowed-request-content-types strings Request Content-Type values the managed ruleset accepts, e.g. application/json,application/vnd.acme.v2+json. OMIT to leave the current setting alone; pass an EMPTY value (--allowed-request-content-types "") to clear the override and go back to the platform default, which is kept current for you and has been widened three times. That default is not "everything": a vendor type such as application/vnd.acme.v2+json can never be in it, and adding one is the commonest reason to set this flag. Lowercase type/subtype, no parameters. Gateway-scoped policies only
--anomaly-threshold int Anomaly score at which a request is refused (1-1000). Gateway-scoped policies only
--crs-version fm appgw waf get Managed ruleset version. Gateway-scoped policies only; the server accepts only the version this build ships, see fm appgw waf get
--fail-mode string open | closed -- what to do if the engine is unavailable
-h, --help help for set
--mode string detect | block | inherit (inherit: overlay policies only)
--paranoia-level int Managed-ruleset paranoia level (1-4; higher catches more and false-positives more). Gateway-scoped policies only
--request-body-limit int Largest request body the gateway ACCEPTS, in bytes (4096-1048576). A larger body is refused 413, not served uninspected, so lowering this lowers the maximum request size your application receives. The gateway's flavor may bound it below this range
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf tags
text
Read and replace a WAF policy's resource tags
Usage:
fm appgw waf tags [command]
Aliases:
tags, tag
Available Commands:
get Show a WAF policy's resource tags
set Replace a WAF policy's resource tags
Flags:
-h, --help help for tags
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw waf tags [command] --help" for more information about a command.fm appgw waf tags get
text
Show a WAF policy's resource tags
Usage:
fm appgw waf tags get [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf tags set
text
Replace a WAF policy's resource tags in place with exactly the given set
(replace semantics — any tag not listed is removed). Resource tags are your own
metadata for search and filtering: nothing else about the WAF policy changes, and the
running service is not touched.
The set you pass IS the resulting set. To ADD one tag without disturbing the
others, read the current ones first with 'fm appgw waf tags get' and pass them all
back. Use --clear to remove every tag. The tenant's default tags are not
re-applied.
A tag change is not configuration: it needs no 'fm appgw apply' and reaches no appliance.
Keys beginning frostmoln_ or frostmoln- (any letter case) are reserved and
refused. At most 32 tags; a key is 1-64 bytes, a value at most 256 bytes.
Examples:
fm appgw waf tags set --gateway gw-1 --policy pol-1 --tag env=prod --tag owner=team-a
fm appgw waf tags set --gateway gw-1 --policy pol-1 --clear
Usage:
fm appgw waf tags set --tag <key=value> [--tag <key=value> ...] [flags]
Flags:
--clear remove ALL tags (mutually exclusive with --tag)
-h, --help help for set
--tag strings tag in key=value format (repeatable; replace semantics)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf versions
text
Show every frozen version of this policy, newest first.
History is never mutated. A rollback does not erase anything -- it produces a
NEW version whose compiled ruleset is identical to the one rolled back to, and
says which one it came from.
Usage:
fm appgw waf versions [flags]
fm appgw waf versions [command]
Available Commands:
tags Read and replace a WAF policy version's resource tags
Flags:
-h, --help help for versions
--tag strings only versions with this tag, key=value (repeatable; every one must match; key= matches an empty value)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw waf versions [command] --help" for more information about a command.fm appgw waf versions tags
text
Read and replace a WAF policy version's resource tags
Usage:
fm appgw waf versions tags [command]
Aliases:
tags, tag
Available Commands:
get Show a WAF policy version's resource tags
set Replace a WAF policy version's resource tags
Flags:
-h, --help help for tags
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm appgw waf versions tags [command] --help" for more information about a command.fm appgw waf versions tags get
text
Show a WAF policy version's resource tags
Usage:
fm appgw waf versions tags get <version> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm appgw waf versions tags set
text
Replace a WAF policy version's resource tags in place with exactly the given set
(replace semantics — any tag not listed is removed). Resource tags are your own
metadata for search and filtering: nothing else about the WAF policy version changes, and the
running service is not touched.
The set you pass IS the resulting set. To ADD one tag without disturbing the
others, read the current ones first with 'fm appgw waf versions tags get' and pass them all
back. Use --clear to remove every tag. The tenant's default tags are not
re-applied.
A tag change is not configuration: it needs no 'fm appgw apply' and reaches no appliance.
Keys beginning frostmoln_ or frostmoln- (any letter case) are reserved and
refused. At most 32 tags; a key is 1-64 bytes, a value at most 256 bytes.
Examples:
fm appgw waf versions tags set 3 --gateway gw-1 --tag env=prod --tag owner=team-a
fm appgw waf versions tags set 3 --gateway gw-1 --clear
Usage:
fm appgw waf versions tags set <version> --tag <key=value> [--tag <key=value> ...] [flags]
Flags:
--clear remove ALL tags (mutually exclusive with --tag)
-h, --help help for set
--tag strings tag in key=value format (repeatable; replace semantics)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--gateway string Gateway id (required)
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
--policy string WAF policy id (only needed when the gateway has more than one)
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)