# set firewall name Foo rule 10 action 
Possible completions:
   drop         Rule action to drop
   reject       Rule action to reject
   accept       Rule action to accept
   inspect      Rule action to inspect

The inspect action was for the IPS/IDS (Snort), which is long gone. It's confusing at best, and possibly network breaking because it looks benign, but its real effect in the current system is "drop all traffic".
Until we figure out how to get the IPS functionality back, it should not be there.