diff --git a/doc/userguide/firewall/firewall-unsupported-keywords.rst b/doc/userguide/firewall/firewall-unsupported-keywords.rst
new file mode 100644
index 0000000000..0f26fc4235
--- /dev/null
+++ b/doc/userguide/firewall/firewall-unsupported-keywords.rst
@@ -0,0 +1,28 @@
+Firewall Mode Unsupported Keywords
+==================================
+
+Certain rule keywords are not supported in firewall mode, either completely or
+based on rulesets.
+
+A keyword may be unsupported in firewall rules, in threat detection rules, or in
+firewall mode altogether.
+
+This is done when there is a chance that the keyword would lead to the firewall
+verdict being skipped, contradicted, or when there could happen inconsistent
+states from interactions between firewall and threat detection rules matching.
+
+.. note:: Future releases may add support for such keywords where it makes sense.
+
+Unsupported Keywords
+--------------------
+
+Firewall Mode
+~~~~~~~~~~~~~
+
+* Bypass
+* Replace
+
+Threat Detection Rules
+~~~~~~~~~~~~~~~~~~~~~~
+
+* Config (both the ``config`` keyword and the ``config`` action)
diff --git a/doc/userguide/firewall/index.rst b/doc/userguide/firewall/index.rst
index 6b0d097c94..41ea6bea57 100644
--- a/doc/userguide/firewall/index.rst
+++ b/doc/userguide/firewall/index.rst
@@ -8,3 +8,4 @@ Firewall Mode
    firewall-stats
    tls-state-migration
    ssh-state-migration
+   firewall-unsupported-keywords