Fortinet FortiWeb 5.7 Web Application Firewall CLI Reference Guide
Below you will find brief information for Web Application Firewall FortiWeb 5.7. Web Application Firewall FortiWeb 5.7 is a dedicated appliance that protects web applications from common attacks such as SQL injection, cross-site scripting, and brute-force attacks. It also includes features such as WAF rule management, user tracking, and traffic log analysis. FortiWeb 5.7 can be used to protect web services and web applications from unauthorized access and security threats.
Advertisement
Advertisement
W
EB
A
PPLICATION
F
IREWALL
FortiWeb CLI Reference
VERSION 5.7
FORTINET DOCUMENT LIBRARY
http://docs.fortinet.com
FORTINET VIDEO GUIDE
http://video.fortinet.com
FORTINET BLOG
https://blog.fortinet.com
CUSTOMER SERVICE & SUPPORT
https://support.fortinet.com http://cookbook.fortinet.com/how-to-work-with-fortinet-support/
FORTIGATE COOKBOOK
http://cookbook.fortinet.com
FORTINET TRAINING SERVICES
http://www.fortinet.com/training
FORTIGUARD CENTER
http://www.fortiguard.com
END USER LICENSE AGREEMENT
http://www.fortinet.com/doc/legal/EULA.pdf
FEEDBACK
Email: [email protected]
February 17, 2017
FortiWeb 5.7 CLI Reference
1st Edition
TABLE OF CONTENTS
Introduction
What’s new
Using the CLI
29
67
Connecting to the CLI using a local console 67
Enabling access to the CLI through the network (SSH or Telnet or CLI Console widget) 68
Connecting to the CLI using SSH 70
Connecting to the CLI using Telnet
Language support & regular expressions
Editing the configuration file in a text editor
Administrative domains (ADOMs)
26
Assigning administrators to an ADOM
config
Related topics log custom-sensitive-rule
Related topics log forti-analyzer
Related topics log fortianalyzer-policy
95
Related topics log siem-message-policy
Related topics log traffic-log
Related topics log trigger-policy
Related topics server-policy allow-hosts
server-policy custom-application application-policy
Related topics server-policy custom-application url-replacer
Related topics server-policy http-content-routing-policy
Related topics server-policy pattern custom-data-type
Related topics server-policy pattern custom-global-white-list-group
Related topics server-policy pattern custom-susp-url
Related topics server-policy pattern custom-susp-url-rule
Related topics server-policy pattern data-type-group
Related topics server-policy pattern suspicious-url-rule
Related topics server-policy persistence-policy
Related topics server-policy policy
Related topics server-policy service custom
Related topics server-policy service predefined
Related topics server-policy vserver
Related topics system accprofile
Related topics system admin-certificate ca
Example system admin-certificate local
Related topics system antivirus
Related topics system autoupdate schedule
Related topics system autoupdate tunneling
Related topics system certificate ca
Related topics system certificate ca-group
Related topics system certificate intermediate-certificate
Related topics system certificate intermediate-certificate-group
Related topics system certificate local
Related topics system certificate verify
Related topics system conf-sync
Related topics system eventhub
Related topics system fail-open
Related topics system fips-cc system firewall address
Related topics system firewall service
Related topics system firewall firewall-policy
Related topics system fortigate-integration
Related topics system fortisandbox
Related topics system hsm info
Related topics system interface
Related topics system ip-detection
Related topics system network-option
Related topics system replacemsg
Related topics system settings
Related topics system snmp sysinfo
Related topics system snmp user
Related topics user admin-usergrp
Related topics user local-user
Related topics wad file-filter
Related topics waf allow-method-exceptions
Related topics waf allow-method-policy
Related topics waf application-layer-dos-prevention
Related topics waf base-signature-disable
Related topics waf brute-force-login
Related topics waf cookie-security
Related topics waf custom-access rule
Related topics waf custom-protection-group
Related topics waf custom-protection-rule
Related topics waf exclude-url
Related topics waf file-compress-rule
Related topics waf file-uncompress-rule
Related topics waf file-upload-restriction-policy
waf file-upload-restriction-rule
Related topics waf geo-block-list
Related topics waf geo-ip-except
Related topics waf hidden-fields-protection
Related topics waf hidden-fields-rule
Related topics waf http-authen http-authen-policy
Related topics waf http-authen http-authen-rule
Related topics waf http-connection-flood-check-rule
Related topics waf http-constraints-exceptions
waf http-protocol-parameter-restriction
Related topics waf http-request-flood-prevention-rule
Related topics waf ip-intelligence
Related topics waf ip-intelligence-exception
Related topics waf layer4-access-limit-rule
Related topics waf layer4-connection-flood-check-rule
Related topics waf padding-oracle
Related topics waf page-access-rule
Related topics waf parameter-validation-rule
Related topics waf site-publish-helper authentication-server-pool
Related topics waf site-publish-helper keytab_file waf site-publish-helper policy
Related topics waf start-pages
Related topics waf url-access url-access-policy
Related topics waf url-access url-access-rule
Related topics waf url-rewrite url-rewrite-policy
Related topics waf url-rewrite url-rewrite-rule
Related topics waf user-tracking policy
Related topics waf web-protection-profile autolearning-profile
Related topics waf web-protection-profile inline-protection
waf web-protection-profile offline-protection
Related topics waf x-forwarded-for
diagnose
Related topics debug application dssl
Related topics debug application fds
Related topics debug application hasync
Related topics debug application http
Related topics debug application miglogd
Related topics debug application mulpattern
Related topics debug application proxy
551
Related topics debug application ssl
Related topics debug application sysmon
Related topics debug application ustack
debug application waf-fds-update
Related topics debug console timestamp
Related topics debug flow filter module-detail
Related topics debug flow reset
Related topics debug flow trace
Related topics hardware fail-open hardware harddisk
Related topics hardware interrupts
Related topics hardware logdisk info
Related topics hardware raid list
Related topics network sniffer
Related topics network udp list
Related topics system ha file-stat
Related topics system ha sync-stat
Related topics system update info
execute
Related topics backup full-config
Related topics certificate crl
Related topics certificate inter-ca
Related topics certificate local
Related topics create-raid level
Related topics create-raid rebuild
618
Related topics restore secondary-image
Related topics restore vmlicense
get
Related topics system fortisandbox-statistics
Related topics system performance
Related topics waf signature-rules
show
659
652
Scope
Introduction
Introduction
Welcome, and thank you for selecting Fortinet products for your network protection.
Scope
This document describes how to use the command line interface (CLI) of the FortiWeb appliance. It assumes that you have already successfully installed the FortiWeb appliance and completed basic setup by following the instructions in the
FortiWeb Administration Guide
.
At this stage: l l l l l l l l
You have administrative access to the web UI and/or CLI.
The FortiWeb appliance is integrated into your network.
You have completed firmware updates, if applicable.
The system time, DNS settings, administrator password, and network interfaces are configured.
You have set the operation mode.
You have configured basic logging.
You have created at least one server policy.
You have completed at least one phase of auto-learning to jump-start your configuration.
Once that basic installation is complete, you can use this document. This document explains how to use the CLI to: l l l l
Update the FortiWeb appliance.
Reconfigure features.
Use advanced features, such as XML protection and reporting.
Diagnose problems.
This document does
not cover the web UI nor first-time setup. For that information, see the
FortiWeb
Administration Guide
.
26 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Conventions
Conventions
This document uses the conventions described in this section.
IP addresses
To avoid IP conflicts that would occur if you used examples in this document with public IP addresses that belong to a real organization, the IP addresses used in this document are fictional. They belong to the private IP address ranges defined by these RFCs.
RFC 1918: Address Allocation for Private Internets http://ietf.org/rfc/rfc1918.txt?number-1918
RFC 5737: IPv4 Address Blocks Reserved for Documentation http://tools.ietf.org/html/rfc5737
RFC 3849: IPv6 Address Prefix Reserved for Documentation http://tools.ietf.org/html/rfc3849
For example, even though a real network’s Internet-facing IP address would be routable on the public Internet, in this document’s examples, the IP address would be shown as a non-Internet-routable IP such as 10.0.0.1,
192.168.0.1, or 172.16.0.1.
Cautions, notes, & tips
This document uses the following guidance and styles for notes, tips and cautions.
Warns you about procedures or feature behaviors that could have unexpected or undesirable results including loss of data or damage to equipment.
Highlights important, possibly unexpected but non-destructive, details about a feature’s behavior.
Presents best practices, troubleshooting, performance tips, or alternative methods.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
27
Conventions
Typographic conventions
Convention
Button, menu, text box, field, or check box label
Example
From
Minimum log level
, select
Notification
.
CLI input
CLI output
Emphasis
File content
Hyperlink
Keyboard entry
Navigation
Publication
config system dns set primary <address_ipv4> end
FortiWeb# diagnose hardware logdisk info disk number: 1 disk[0] size: 31.46GB
raid level: no raid exists partition number: 1 mount status: read-write
HTTP connections are
not secure and can be intercepted by a third party.
<HTML><HEAD><TITLE>Firewall Authentication</TITLE></HEAD>
<BODY><H4>You must authenticate to use this service.</H4> https://support.fortinet.com
Type a name for the remote VPN peer or client, such as Central_
Office_1
.
Go to
VPN
>
IPSEC
>
Auto Key (IKE)
.
For details, see the
FortiWeb Administration Guide
.
Command syntax
The CLI requires that you use valid syntax, and conform to expected input constraints. It will reject invalid commands.
For command syntax conventions such as braces, brackets, and command constraints such as <address_ ipv4>
, see
28 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
What’s new
The tables below list commands which have changed in FortiWeb 5.4 and later, including new commands, syntax changes, and new setting options.
FortiWeb 5.7
Command Change
config server-policy server-pool
edit
config pserver-list edit
set
New. Enable/disable HTTP/2 communication between FortiWeb and back-end web servers for
HTTP/2 security inspection in Reverse Proxy mode; or enable/disable the HTTP/2 security inspection in
True Transparent Proxy mode.
edit
set
New. Enable/disable FortiWeb to recognize
HTTP/2 traffic coming from clients in Reverse
Proxy mode. Note that HTTP content routing is not supported when HTTP/2 is enabled.
edit
config siem-server-list edit
set
type <arcsightcef | qradarleef | azurecef>
config waf http-constraints-exceptions
edit
config http_constraintsexception-list edit
set
set
config waf custom-protection-rule
Changed. an option qradar-leef is added so that log messages can be sent in QRadar Log
Event Extended Format (LEEF) to IBM QRadar servers.
New. HTTP constraint exceptions can be applied to the packets with specified source IP addresses.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
29
Command
edit
<custom-protection rule_ name>
set
waf http-protocol-parameter-restriction
Change
Changed. A new action "Erase, no Alert" (only_ erase
) is added (in the response direction) for
FortiWeb to react when information disclosure is detected. Note that this action is not available for offline protection mode.
What’s new
30 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command Change
New. Seventeen new HTTP protocol constraints are added. Eight of them are added to govern the specific HTTP/2 header fields, they are: edit
set
set
set
set
max-setting-currentstreams-num <limit_int>
set
set
max-setting-header-listsize <limit_int>
set
max-setting-headertable-size <limit_int>
set
max-setting-initialwindow-size <limit_int>
set
set
set
set
set
set
illegal-byte-in-urlcheck {enable | disable}
set
set
set
l l l l l l l l
Illegal Connection Preface (Illegal-magiccheck
)
Illegal Frame Type (Illegal-frame-typecheck
)
Illegal Frame Flags (Illegal-frame-flagcheck
)
Initial Window Size (max-setting-initialwindow-size
)
Header Compression Table Size (maxsetting-header-table-size
)
Header List Size (max-setting-headerlist-size
)
Frame Size (max-setting-frame-size)
Number of Concurrent Streams (maxsetting-current-streams-num
) l l l l l l l l l
, and the others are as followings:
Redundant HTTP Headers (redundantheader-check
)
Maximum URL Parameter Name Length (maxurl-param-name-len
)
Maximum URL Parameter Value Length (maxurl-param-value-len
)
Illegal Character in Parameter Name (urlparam-name-check
)
Illegal Character in Parameter Value (urlparam-value-check
)
NULL Character in URL (null-byte-inurl-check
)
Illegal Character in URL (illegal-byte-inurl-check
)
Malformed URL (malformed-url-check)
Illegal Chunk Size (chunk-size-check)
config waf http-constraints-exceptions
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
31
32
What’s new
Command Change
edit
config http_constraintsexception-list edit
set
max-url-paramname-len {enable | disable}
set
max-url-paramvalue-len {enable
set
redundant-headercheck {enable | disable}
set
url-param-namecheck {enable | disable}
set
url-param-valuecheck {enable | disable}
New. Constraint exceptions are added correspondingly for the five new HTTP constraints: l l l l l
Redundant HTTP Headers (redundantheader-check
)
Maximum URL Parameter Name Length (maxurl-param-name-len
)
Maximum URL Parameter Value Length (maxurl-param-value-len
)
Illegal Character in Parameter Name (urlparam-name-check
)
Illegal Character in Parameter Value (urlparam-value-check
)
edit
set
set
cookie-replayprotection-type {no |
Changed. For configure a cookie security policy, cookie-replay-protection-type available only if security-mode is set to encrypted
.
is set
mode {active-passive | active-active | standalone}
set
schedule {ip | leastconnection | roundrobin}
set
set
set
New. Multiple FortiWebs (up to eight units) can be deployed as an Active- Active HA cluster in Reverse
Proxy or True Transparent Proxy modes. The master unit in the cluster can distribute incoming traffic over the cluster members according to the specified load balancing algorithm.
edit
set
New. IPv6 addressing through DHCP is supported on FortiWeb's physical network interfaces, VLAN subnetwork interface and link aggregation interfaces.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command Change
edit
config members edit
set
set
New. SNI can match domains to certificates using either simple string or regular expression.
config waf site-publish-helper rule
edit
set
New. Site publishing supports Android clients to access to Microsoft Exchange servers through
Exchange ActiveSync.
config system admin-certificate local
edit
set
set
set
set
New. You can create comment and related information to the imported certificates used for the accesses to the FortiWeb's management interface through HTTPS.
config system admin-certificate ca
No set operations are defined
New. You can check the imported CA certificates used for FortiWeb's certificate-based Web UI login.
edit
set
set
New. You can create a PKI user used for
FortiWeb's certificate-based Web UI login.
edit
config members edit
set
New. You can add PKI users to admin groups used for FortiWeb's certificate-based Web UI login.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
33
34
Command Change
set
https-cert-login {enable | disable}
set
New. Support l l
Certificate-based authentication for FortiWeb's
Web UI login
Ability to replace the certificate that FortiWeb uses for secure accesses (HTTPS) to its management interface.
config server-policy server-pool
edit
config pserver-list edit
set
New. The following cipher suits are added to support ECDSA certificate:
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-SHA38
ECDHE-ECDSA-AES256-SHA
ECDH-ECDSA-AES256-GCM-SHA384
ECDH-ECDSA-AES256-SHA384
ECDH-ECDSA-AES256-SHA
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-SHA256
ECDHE-ECDSA-AES128-SHA
ECDH-ECDSA-AES128-GCM-SHA256
ECDH-ECDSA-AES128-SHA256
ECDH-ECDSA-AES128-SHA
ECDHE-ECDSA-RC4-SHA
ECDH-ECDSA-RC4-SHA
edit
set
New. The following cipher suits are added to support ECDSA certificate:
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-SHA38
ECDHE-ECDSA-AES256-SHA
ECDH-ECDSA-AES256-GCM-SHA384
ECDH-ECDSA-AES256-SHA384
ECDH-ECDSA-AES256-SHA
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-SHA256
ECDHE-ECDSA-AES128-SHA
ECDH-ECDSA-AES128-GCM-SHA256
ECDH-ECDSA-AES128-SHA256
ECDH-ECDSA-AES128-SHA
ECDHE-ECDSA-RC4-SHA
ECDH-ECDSA-RC4-SHA
What’s new
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command Change
edit
config signature-class
set
New. Signature class ID 120000000 is added for support Syntax-based SQL injection detection.
edit
config main_class_list edit
config sub_class_disable_ list edit
New. Signature class ID 120000000 is added for support Syntax-based SQL injection detection.
config waf url-rewrite url-rewrite-rule
edit
set
set
header-status {enable | disable}
set
header-value <headervalue_str>
New. Specified fields and values can be inserted to
HTTP headers of requests by URL Rewriting.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
35
36
What’s new
Command
set
max-multipart-buffsizeper-arg <buffersize_int>
Change
New. You can adjust parsing buffer size (kB) for each of the arguments in multipart/form-data
HTTP messages.
FortiWeb 5.6
Command
edit
config siem-server-list edit
set
type <arcsightcef | qradarleef | azurecef>
Change
Changed. When FortiWeb-VM is deployed on
Azure, you can now configure a SIEM policy that connects to Azure Security Center.
New. When FortiWeb-VM is deployed on Azure, you can now configure the FortiWeb appliance to send log messages to Azure Security Center (ASC).
set set set set set set
status {enable | disable} appliance_id
config system firewall address
New. You can configure IP addresses and address ranges that FortiWeb's built-in stateful firewall uses.
edit
set
set set
<firewall-address_ ipv4mask> ip-address-value
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command
config system firewall firewallpolicy
Change
New. You can configure FortiWeb's built-in stateful firewall to allow and deny TCP, UDP, and
ICMP traffic.
set edit
default-action {deny | accept}
set set
<incoming_ interface_ name> out-interface
set set
<firewall-address_ name> dest-address
set set
service <firewallservice_name> action {deny | accept}
config system firewall service
New. You can configure the ports and protocols that FortiWeb's built-in stateful firewall uses edit
set
set
set set set
New. You can now configure FortiWeb to scan partial TCP connections.
set
anypktstream {enable | disable}
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
37
38
What’s new
Command Change
set set set
allowaccess {http https ping snmp ssh telnet FWB-manager}
ip6-allowaccess {http https ping snmp ssh telnet FWB-manager}
Changed. You now configure access to a FortiWeb appliance from FortiWeb Manager using a specific
FortiWeb Manager administrative access option.
New. You can now configure FortiWeb features that prevent cookie-based attacks as a policy you apply using a web protection profile.
edit
set
set
action {alert |alert_ deny | remove_cookie}
set
block-period <blockperiod_int>
set
set
set
cookie-replayprotection-type {no |
set
set
set
set
allow-suspiciouscookies(Never |Always
set
config cookie-securityexception-list edit
set
set
set
end end next
config waf site-publish-helper authentication-server-pool
New. Site publishing rules now authenticate clients using a member of a pool of authentication servers.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command Change
edit
<authentication-serverpool_name>
edit
set
set
set
set
end end next
config waf site-publish-helper policy
New. You can now configure FortiWeb to prevent users from making further attempts to log in after a specified number of failed login attempts.
edit
set
set
set
set
edit
set
New. You can enable/disable the compression
(.zip) to attached event logs and alerts for an alert email policy.
FortiWeb 5.5 Patch 4
Command
Change
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
39
40
What’s new
Command Change
set
| illegal-filesize | csrfdetection | user-trackingdetection | accountlockout-detection}
New. You can now configure FortiWeb to keep the packet payloads associated with additional detected attack types or validation failures.
config server-policy http-contentrouting-policy
edit
config content-routing-matchlist edit
set
match-object {httphost | http-request
| url-parameter | http-referer | http-cookie | httpheader | source-ip
set
Changed. The HTTP content routing policy settings that match X509 certificate content now allow you to match values found in either in the client certificate's extension field or subject field.
edit
set
client-real-ip {enable | disable}
New. By default, when the operation mode is reverse proxy, the source IP for connections between FortiWeb and back-end servers is the address of a FortiWeb network interface. You can now configure FortiWeb to use the source IP address of the client that originated the request when it connects to a back-end server on behalf of that client.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command
set
Change
New. You can now enter how long FortiWeb waits before it clears the hash table entry for an uploaded file that was evaluated by
FortiSandbox.
edit
set
New. You can now specify the names of network interfaces that are members of the bridge and send and transmit traffic using the MAC address of their corresponding FortiWeb network interface.
New. You can now configure FortiWeb to protect against cross-site request forgery (CSRF)
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
41
What’s new
42
Command
edit
set
action {alert | alert_deny | blockperiod}
set set
<seconds_int> severity {High |
set
config csrf-url-list edit
set
set
set set
{enable | disable} request-type
set set set set
{enable | disable} parameter-name
<parameter-name_ str> parameter-valuetype
{plain | regular} parameter-value
end next config csrf-url-list edit
set set set set
host <host_name> request-url <url_ str> host-status
{enable | disable} request-type
set set set set
{enable | disable} parameter-name
<parameter-name_ str> parameter-valuetype
{plain | regular} parameter-value
Change
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command
Change
edit
config source-ip-filter edit
set
end config user-filter edit
set
set
New. In advanced access custom rules, you can now specify the IP address to match using a range of addresses and filter requests using a user name.
config waf file-upload-restrictionpolicy
edit
<file-upload-restrictionpolicy_name>
set
New. A file upload restriction policy can now scan for Trojans.
config waf http-protocol-parameterrestriction
edit
set
web-socket-protocolcheck {enable | disable}
New. A HTTP protocol constraint can now detect traffic that uses the WebSocket TCP-based protocol.
config waf user-tracking policy
New. You can now configure FortiWeb to track sessions by user and capture a username to reference in traffic and attack log messages.
edit
config input-rule-list edit
set
<input-rule_name> config waf user-tracking rule
New. You can now configure FortiWeb to track sessions by user and capture a username to reference in traffic and attack log messages. You can also use this feature to prevent a session fixation attack and set a period of time during which FortiWeb blocks requests with a session ID from a timed-out session.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
43
What’s new
44
Command
edit
set
set set
<username_str> password-parameter
set set set set set set
<timeout_int> session-frozen-time
set set set set set
{ High | Medium | Low} session-frozen-trigger
<trigger-policy_name> default-action { failed
config match-condition edit
set
authenticationresult-type { failed | success}
set set set
{ return-code | response-body | redirect-url} value-type { plain | regular} value <value-str>
config waf web-protection-profile inline-protection
Change
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command Change
edit
<inline-protectionprofile_name>
set
json-protocoldetection {enable | disable}
set set set set
{enable | disable} malformed-json-checkaction {alert | alert_deny | blockperiod}
malformed-json-blockperiod <block-period_ int> malformed-json-checkseverity {High |
set set set
malformed-json-checktrigger <triggerpolicy_name> csrf-protection
New. An inline protection profile can now scan for matches with attack and data leak signatures in
JSON data submitted by clients in HTTP requests with Content-Type: values application/json or text/json. In addition, you can use the profile to apply a CSRF protection rule and user tracking policy.
config waf web-protection-profile offline-protection
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
45
46
What’s new
Command Change
edit
<offline-protectionprofile_name>
set
json-protocoldetection {enable | disable}
set set
malformed-json-checkaction {alert | alert_deny | blockperiod}
set set
malformed-jsonblock-period <block-
set
period_int> malformed-json-checkseverity {High |
set
malformed-json-checktrigger <triggerpolicy_name>
set set
waf web-protectionprofile offlineprotection
New. An offline protection profile can now scan for matches with attack and data leak signatures in JSON data submitted by clients in HTTP requests with Content-Type: values application/json or text/json. In addition, you can use the profile to apply a CSRF protection rule and user tracking policy.
New. This command allows you to immediately clean up all sessions
FortiWeb 5.5 Patch 3
Command
Change
set
New. You can now configure FortiWeb to upload files to FortiSandbox Cloud for evaluation (requires
FortiWeb FortiGuard Sandbox Cloud Service subscription).
set set
New. You can now specify a network interface that provides administrative access to an appliance when it is a member of an HA cluster.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command
set set set set set
config waf http-constraintsexceptions
edit
config http_constraintsexception-list edit
set
config waf http-protocol-parameterrestriction
config waf http-protocolparameter-restriction edit
set
max-http-requestfilename-length
Change
New. You can now set a global MTU for v-zones when the operation mode is true transparent proxy and configure how FortiWeb handles clients that keep a connection with FortiWeb open without sending data.
New. You can now create an exception to the HTTP protocol constraint that specifies the maximum acceptable length in bytes of the HTTP request filename.
New. You can now create an HTTP protocol constraint that specifies the maximum acceptable length in bytes of the HTTP request filename.
Changed. You can now use execute ha manage to log into another appliance in the same
HA group via the HA link.
FortiWeb 5.5 Patch 2
Command
Change
set
New. You can configure FortiWeb to generate an alert when its log disk usage exceeds a percentage you specify.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
47
48
What’s new
Command
edit
set
Change
New. You can now configure the maximum transmission unit (MTU) for network interfaces. This configuration allows the network interfaces to support Ethernet frames with more than 1500 bytes of payload.
edit
set set
monitor {enable | disable} mtu <mtu_int>
New. You can specify whether FortiWeb automatically brings down all members of this v-zone if one member goes down.
Also, you can now configure the maximum transmission unit (MTU) for the v-zone. This configuration allows the bridge to support
Ethernet frames with more than 1500 bytes of payload.
edit
config hosts edit
set
Changed. You can now use an IPv6 address to specify the SNMP manager that can receive traps from and query the FortiWeb appliance.
FortiWeb 5.5 Patch 1
Command
set
show-all-log {enable | disable}
config server-policy server-pool
Change
New. You can specify whether all signature violations that contributed to a threat scoring attack log message are displayed as individual entries in the attack log.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command Change
edit
set
Changed. Five new load balancing algorithms determine how to distribute new TCP connections using a hash. FortiWeb generates the hash based on the HTTP request (for example, the URI or host name).
set
uncomp-size-limit <limit_ int>
Changed. The maximum size that you can specify for the memory buffer that FortiWeb uses to temporarily undo the compression that a client or web server has applied to traffic is now 30720 kilobytes (30 MB).
set
maintainer-user {enable | disable}
New. The maintainer-user option enables or disables the maintainer administrator account.
This account is enabled by default and allows you to reset the password for the admin account using a console connection.
set
fast-forward {enable | disable}
New. Specifies whether FortiWeb activity is restricted to load balancing.
edit
set
Changed. The WCCP configuration now allows you to select Layer 2 (L2) as the cache engine method. L2 redirection overwrites the original
MAC header of the IP packets and replaces it with the MAC header for the WCCP client.
config waf custom-protection-rule
edit
<custom-protection rule_ name>
set
config waf file-upload-restrictionrule
Changed. You can now configure FortiWeb to block and reply to clients that violate a signature rule with an HTTP error message (attack block page) instead of resetting the connection.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
49
What’s new
Command Change
edit
waf file-uploadrestriction-rule
[set
Changed. The maximum size that you can specify for a file upload limit is now 30720 kilobytes (30
MB).
50 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command Change
edit
set
set set
Security} scoring-scope {HTTP-
set set
scoring-action {alert | alert_deny | redirect | block-period | send_ http_response}
set
| Medium | Low} scoring-trigger
set config main_class_list edit
set set
{alert |alert_ deny | block-period |only_ erase | send_http_ response | alert_ erase | redirect}
config scoring_override_ disable_list edit
<scoring-overridedisable-list_ signature-id_str>
end next config score_grade_list edit
<score-grade-list_ signature-id_str>
set
end next
Changed. You can configure your signature policy to take action based on multiple signature violations by a client, instead of a single signature violation.
Also, you can now configure FortiWeb to block and reply to clients that violate a signature rule with an HTTP error message
(attack block page) instead of resetting the connection.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
51
52
What’s new
Command
Change
New. Allows you to display the DNS cache that stores the results of resolving all fully qualified domain names in the server pools.
FortiWeb 5.5
Command
Change
New. You can now configure a connection to a FTP or TFTP server. FortiWeb can use this connection to transmit reports to the server.
edit
set
set set
server <ftp-server_ ipv4> ftp_auth {enable | disable}
set set set
ftp_user <ftp-user_ str> ftp_passwd <ftp_pswd> ftp-dir <ftp-dir_str> config log reports
edit
set
output_ftp {html pdf rtf txt mht}
set
Changed. Report configuration now allows you to automatically send reports to a specified FTP or
TFTP server.
config log fortianalyzer-policy
edit
config fortianalyzer-serverlist edit
set set
<forti-analyzer_ ipv4> enc-algorithm
Changed. You can now specify connections to multiple FortiAnalyzer instances in a single policy.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command Change
edit
config siem-server-list edit
set type cef set
set
Changed. You can now specify connections to multiple ArcSight SIEM servers in a single
SIEM policy.
edit
configure health-list edit
set
type {icmp | tcp | http | https | tcp-ssl | tcp-half-open}
Changed. The two new methods for checking the health of a server in a pool are TCP Half Open and
TCP SSL.
config server-policy http-contentrouting-policy
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
53
54
What’s new
Command Change
edit
set
config content-routingmatch-list edit
set
{http-host | http-request | url-parameter | http-referer |
set
http-cookie | http-header | source-ip | x509certificate-
{match-begin | match-end | match-sub | match-domain | match-dir | match-reg | iprange | ip-range6
set set set set set set set set
<matchexpression_str> name <name_str> name-matchcondition {matchbegin | match-end
| match-sub | match-reg | equal} value <value_str>
value-matchcondition {matchbegin | match-end
| match-sub | match-reg | equal} start-ip <start_ ip> end-ip <end_ip> concatenate { and
Changed. You can now route traffic by URL, HTTP parameter, HTTP header, source IP address (single or a range), or an X.509 certificate field. You can also concatenate the routing rules. For example, you can require traffic to match multiple rules or only one rule among many.
config server-policy persistencepolicy
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command Change
edit
set
| url-parameter | rewrite-cookie | embedded-cookie | ssl-session-id }
set set set set
timeout <timeout_int> ipv4-netmask <v4mask>
set
<v6mask> http-header <httpheader_str>
set set set
url-parameter <urlparameter_str> cookie-path <cookiepath_str> cookie-domain
Changed. You can now configure session persistence based on source IP, HTTP header, URL parameter, SSL session ID or additional cookiebased options.
edit
set
{server-pool | httpcontent-routing | offline-protection | transparent-servers | wccp-servers}
set
set set
Changed. You can now configure a server policy to use when FortiWeb is acting as a WCCP client.
In addition to selecting a medium or highsecurity configuration, you can now select a custom set of cipher suites for a server policy or server pool member.
You can add support for the ChaCha-Poly1305 cipher suite.
Also, the default setting for http-pipeline is enable.
config server-policy server-pool
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
55
56
What’s new
Command Change
edit
set
config pserver-list edit
set
set
set set
set set set
recover <recover_ int> warm-up <warmup_int>
New. You can configure a server pool to use when the operation mode is WCCP.
You can now specify the maximum number of
TCP connections that FortiWeb forwards to a pool member.
In addition to selecting a medium or highsecurity configuration, you can now select a custom set of cipher suites for a server policy or server pool member.
You can add support for the ChaCha-Poly1305 cipher suite.
Also, you can specify how long to wait before sending traffic to a pool member that was recently unavailable, and the rate at which
FortiWeb resumes sending traffic.
config system fortigate-integration
set set set set set set set
<schedule-frequency_int> flag {enable | disable}
New. You can now specify a FortiGate appliance that transmits its list of quarantined source IPs to
FortiWeb at regular intervals.
set
New. You can specify whether the configuration settings that integrate FortiWeb with an HSM
(hardware security module) are displayed in the web
UI.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command
set set set set set
New. You can now edit the configuration that allows
FortiWeb to work with SafeNet Luna SA HSM
(hardware security module).
edit
set
Change
New. You can now edit the configuration that allows
FortiWeb to work with SafeNet Luna SA HSM
(hardware security module). This configuration allows FortiWeb to retrieve a per-connection, SSL session key from the HSM instead of loading a local private key and certificate.
edit
set
Changed. You can now specify the interfaces that
FortiWeb uses to communicate with a FortiGate unit configured as a WCCP server.
set
opmode {offlineprotection | reverseproxy | transparent | transparent-inspection | wccp}
Changed. The new WCCP operation mode allows you to configure FortiWeb as a WCCP client that receives and inspects specified traffic from a
FortiGate unit.
New. You can create an SNMP v3 community instead of in addition to SNMP v1 and v2c communities.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
57
58
What’s new
Command Change
edit
set
set
security-level { noauthnopriv | authnopriv | authpriv
set set set set set set set set
{enable | disable} query-port <port_int> trap-status {enable | disable} trapport-local <port_ int>
set set
config hosts edit
set set
New. You can now configure FortiWeb as a WCCP client that receives and inspects specified traffic from a FortiGate unit or other device acting as a WCCP server.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command
edit
set
set set
router-list <routerlist_ipv4> group-address <groupaddress_ipv4>
set set set set set
{enable | disable} password <passwd_str> cache-engine-method
set set set
| dst-ip | src-port | dst-port} priority <priority_ int> protocol <priority_ int> assignment-weight
set set
assignment-bucketformat {cisoimplementation | wccp-v2}
Change
edit
set
auto {disable | restore | acknowledge}
config waf custom-protection-rule
Changed. The web anti-defacement settings now allow you to configure FortiWeb to automatically acknowledge (accept) any changes that it detects.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
59
60
What’s new
Command Change
edit
config meet-condition edit
set
set set set set set
<threshold_int> case-sensitive
Changed. You can now specify a value to match for each meet condition rule in a custom signature. The value can be either a regular expression to match or a value to compare to the target's value (greater than, less than, and so on).
config waf http-constraintsexceptions
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command
edit
waf http-constraintsexceptions
config http_constraintsexception-list edit
set
set set set set
set set set set
set set set
{enable | disable} parameter-namecheck {enable | disable} parameter-valuecheck {enable | disable}
config waf http-protocol-parameterrestriction
Change
Changed. New exceptions for use with HTTP protocol constraints are now available.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
61
62
What’s new
Command Change
edit
set
set set
Illegal-content-typecheck {enable | disable}
Illegal-header-namecheck {enable | disable}
set set set
Illegal-header-valuecheck {enable | disable}
Illegal-responsecode-check {enable | disable} max-http-header-namelength <limit_int>
set set set set set
max-http-headervalue-length <limit_ int>
{enable | disable} parameter-value-check
Post-request-ctypecheck {enable | disable}
waf http-protocolparameter-restriction
Changed. Additional HTTP protocol constraints are now available.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command Change
edit
config main_class_list edit
set
config fpm_disable_list edit
<fpm-disable-list_ signature-id_str>
config filter_list edit
set
set
set set
EXCLUDE} http-method {get post head options trace connect delete put others}
set set set set set
<ipv6>} name {name_str | name_pattern] value-check
{enable | disable} value {value_str
Changed. To reduce false positives, FortiWeb can now perform additional lexical and syntax analysis after a SQL injection signature matches a request.
You can disable this feature for one or both of the
SQL injection signature categories, or disable it for individual signatures within the categories.
Also, you can now use additional criteria to specify which requests FortiWeb does not scan, including elements such as HTTP methods, client IP, and cookie name. You can create a signature exemption using any of the criteria either individually or in combination.
config waf web-protection-profile inline-protection
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
63
64
What’s new
Command
edit
<inline-protectionprofile_name>
set
{enable | disable} set quarantined-ipaction {alert | alert_deny}
set
quarantined-ipseverity {High |
set
quarantined-iptrigger <triggerpolicy_name>
execute erase-disk { flash | disk }
Change
New. You can now detect quarantined source IPs using a list that a FortiGate appliance transmits to
FortiWeb at regular intervals.
New. Erases the hard disk or flash memory.
Requires a console connection to the appliance.
Available only when Federal Information Processing
Standards (FIPS) and Common Criteria (CC) compliant mode is enabled (see
).
FortiWeb 5.4
Command
Change
set
Changed. FortiWeb can preserve packet payloads associated with attack log messages generated by information from FortiSandbox.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
What’s new
Command
edit
config log-server-list edit
set
set set
port <port_int> server <syslog_ ipv4>
Change
New. Each Syslog policy can now specify connections to up to 3 Syslog servers.
edit
set
New. You can now specify a priority value for a policy route. When packets match more than one policy route, FortiWeb directs traffic to the route with the lowest value.
edit
configure health-list edit
set
edit
config pserver-list edit
set
New. Server health checks now allow you to test the availability of a specific host on the server pool member.
edit
config http-content-routinglist edit
set
New. When you configure a server policy, instead of assigning web protection profiles to each HTTP content routing policy, you can now configure the routing policies to inherit the profile that the server policy uses.
config server-policy server-pool
New. You can now specify one or more server pool members to which FortiWeb directs traffic only when all other members are unavailable.
New. You can now configure a connection to
FortiSandbox that FortiWeb uses to send and receive information about uploaded files.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
65
What’s new
Command
config system fortisandbox set
set set
ssl {enable | disable} email <email_str>
set
config waf file-upload-restrictionpolicy
Change
New. You can now configure FortiWeb to submit all files that match your upload restriction rules to FortiSandbox.
config waf site-publish-helper rule
edit
[set
]
[set
]
New. In a site publish rule, you can now specify the optional value Published-Server-Logoff-
Path value.
using a regular expression instead of a literal
66 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Using the CLI
Using the CLI
Connecting to the CLI
The command line interface (CLI) is an alternative to the web UI.
You can use either interface or both to configure the FortiWeb appliance. In the web UI, you use buttons, icons, and forms, while, in the CLI, you either type text commands or upload batches of commands from a text file, like a configuration script.
If you are new to Fortinet products, or if you are new to the CLI, this section can help you to become familiar.
Connecting to the CLI
You can access the CLI in two ways: l l
Locally — Connect your computer, terminal server, or console directly to the FortiWeb appliance’s console port.
Through the network — Connect your computer through any network attached to one of the FortiWeb appliance’s network ports. To connect using an Secure Shell (SSH) or Telnet client, enable the network interface for Telnet or
SSH administrative access. Enable HTTP/HTTPS administrative access to connect using the CLI Console widget in the web UI.
Local access is required in some cases.
l l
If you are installing your FortiWeb appliance for the first time and it is not yet configured to connect to your network, unless you reconfigure your computer’s network settings for a peer connection, you may only be able to connect to the CLI using a local console connection. See the
FortiWeb Administration Guide
.
Restoring the firmware utilizes a boot interrupt. Network access to the CLI is not available until after the boot process completes, and therefore local CLI access is the only viable option.
Before you can access the CLI through the network, you usually must enable SSH and/or HTTP/HTTPS and/or
Telnet on the network interface through which you will access the CLI.
Connecting to the CLI using a local console
Local console connections to the CLI are formed by directly connecting your management computer or console to the FortiWeb appliance, using its DB-9 console port.
Requirements
l l l a computer with an available serial communications (COM) port the RJ-45-to-DB-9 or null modem cable included in your FortiWeb package terminal emulation software such as
PuTTY
The following procedure describes connection using PuTTY software; steps may vary with other terminal emulators.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
67
Connecting to the CLI Using the CLI
To connect to the CLI using a local console connection
1. Using the null modem or RJ-45-to-DB-9 cable, connect the FortiWeb appliance’s console port to the serial communications (COM) port on your management computer.
2. On your management computer, start PuTTY .
3. In the Category tree on the left, go to Connection > Serial and configure the following:
Serial line to connect to
COM1 (or, if your computer has multiple serial ports, the name of the connected serial port)
Speed (baud)
Data bits
Stop bits
9600
8
1
Parity
Flow control
None
None
4. In the Category tree on the left, go to Session (not the sub-node, Logging) and from Connection type, select
Serial.
5. Click Open.
6. Press the Enter key to initiate a connection.
The login prompt appears.
7. Type a valid administrator account name (such as admin) then press Enter.
8. Type the password for that administrator account and press Enter. (In its default state, there is no password for the admin account.)
The CLI displays the following text, followed by a command line prompt:
Welcome!
You can now enter CLI commands, including configuring access to the CLI through SSH or Telnet. For details, see
Enabling access to the CLI through the network (SSH or Telnet or CLI Console widget) on page
.
Enabling access to the CLI through the network
(SSH or Telnet or CLI Console widget)
SSH, Telnet, or CLI Console widget (via the web UI) access to the CLI requires connecting your computer to the
FortiWeb appliance using one of its RJ-45 network ports. You can either connect directly, using a peer connection between the two, or through any intermediary network.
If you do not want to use an SSH/Telnet client and you have access to the web UI, you can alternatively access the CLI through the network using the
CLI Console widget in the web UI. For details, see the
FortiWeb Administration Guide
.
68 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Using the CLI Connecting to the CLI
You must enable SSH and/or Telnet on the network interface associated with that physical network port. If your computer is not connected directly or through a switch, you must also configure the FortiWeb appliance with a static route to a router that can forward packets from the FortiWeb appliance to your computer (see
You can do this using either: l l a local console connection (see the following procedure) the web UI (see the
FortiWeb Administration Guide
)
Requirements
l l l l l a computer with an available serial communications (COM) port and RJ-45 port terminal emulation software such as PuTTY the RJ-45-to-DB-9 or null modem cable included in your FortiWeb package a crossover Ethernet cable (if connecting directly) or straight-through Ethernet cable (if connecting through a switch or router) prior configuration of the operating mode, network interface, and static route (for details, see the
FortiWeb
Administration Guide
.
To enable SSH or Telnet access to the CLI using a local console connection
1. Using the network cable, connect the FortiWeb appliance’s network port either directly to your computer’s network port, or to a network through which your computer can reach the FortiWeb appliance.
2. Note the number of the physical network port.
3. Using a local console connection, connect and log into the CLI. For details, see
Connecting to the CLI using a local console on page 67
.
4. Enter the following commands: config system interface edit <interface_name> set allowaccess {http https ping snmp ssh telnet} end where: l
<interface_name> is the name of the network interface associated with the physical network port, such as port1 l
{http https ping snmp ssh telnet} is the complete, space-delimited list of permitted administrative access protocols, such as https ssh telnet; omit protocols that you do not want to permit
For example, to exclude HTTP, SNMP, and Telnet, and allow only HTTPS, ICMP ECHO (ping), and SSH administrative access on port1: config system interface edit "port1" set allowaccess ping https ssh end next
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
69
Connecting to the CLI Using the CLI
Telnet is not a secure access method. SSH should be used to access the CLI from the
Internet or any other untrusted network.
5. To confirm the configuration, enter the command to view the access settings for the interface.
show system interface <interface_name>
The CLI displays the settings, including the management access settings, for the interface.
6. If you will be connecting indirectly, through one or more routers or firewalls, configure the appliance with at least one static route so that replies from the CLI can reach your client. See
To connect to the CLI through the network interface, see
Connecting to the CLI using SSH on page 70
or
Connecting to the CLI using Telnet on page 71 .
Connecting to the CLI using SSH
Once you configure the FortiWeb appliance to accept SSH connections, you can use an SSH client on your management computer to connect to the CLI.
Secure Shell (SSH) provides both secure authentication and secure communications to the CLI. Supported SSH protocol versions, ciphers, and bit strengths vary by whether or not you have enabled FIPS-CC mode or are using a low encryption (LENC) version, but generally include SSH version 2 with AES-128, 3DES, Blowfish, and SHA-1.
Requirements
l l l l a computer with an RJ-45 Ethernet port a crossover Ethernet cable a FortiWeb network interface configured to accept SSH connections (see
Enabling access to the CLI through the network (SSH or Telnet or CLI Console widget) on page 68
) an SSH client such as PuTTY
To connect to the CLI using SSH
1. On your management computer, start PuTTY .
Initially, the Session category of settings is displayed.
2. In Host Name (or IP Address), type the IP address of a network interface on which you have enabled SSH administrative access.
3. In Port, type 22.
4. From Connection type, select SSH.
5. Click Open.
The SSH client connects to the FortiWeb appliance.
The SSH client may display a warning if this is the first time you are connecting to the FortiWeb appliance and its SSH key is not yet recognized by your SSH client, or if you have previously connected to the FortiWeb appliance but it used a different IP address or SSH key. If your management computer is directly connected to the FortiWeb appliance with no network hosts between them, this is normal.
70 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Using the CLI Connecting to the CLI
6. Click Yes to verify the fingerprint and accept the FortiWeb appliance’s SSH key. You will not be able to log in until you have accepted the key.
The CLI displays a login prompt.
7. Type a valid administrator account name (such as admin) and press Enter.
Alternatively, you can log in using an SSH key. For details, see
8. Type the password for this administrator account and press Enter.
If three incorrect login or password attempts occur in a row, you will be disconnected.
Wait one minute, then reconnect to attempt the login again.
The FortiWeb appliance displays a command prompt (its host name followed by a #). You can now enter CLI commands.
Connecting to the CLI using Telnet
Once the FortiWeb appliance is configured to accept Telnet connections, you can use a Telnet client on your management computer to connect to the CLI.
Telnet is not a secure access method. SSH should be used to access the CLI from the
Internet or any other untrusted network.
Requirements
l l l l a computer with an RJ-45 Ethernet port a crossover Ethernet cable a FortiWeb network interface configured to accept Telnet connections (see
Enabling access to the CLI through the network (SSH or Telnet or CLI Console widget) on page 68
) terminal emulation software such as PuTTY
To connect to the CLI using Telnet
1. On your management computer, start PuTTY .
2. In Host Name (or IP Address), type the IP address of a network interface on which you have enabled
Telnet administrative access.
3. In Port, type 23.
4. From Connection type, select Telnet.
5. Click Open.
6. Type a valid administrator account name (such as admin) and press Enter.
7. Type the password for this administrator account and press Enter.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
71
Command syntax Using the CLI
If three incorrect login or password attempts occur in a row, you will be disconnected.
Wait one minute, then reconnect to attempt the login again.
The CLI displays a command line prompt (by default, its host name followed by a #). You can now enter CLI commands.
Command syntax
When entering a command, the CLI requires that you use valid syntax and conform to expected input constraints.
It will reject invalid commands.
For example, if you do not type the entire object that will receive the action of a command operator such as config
, the CLI will return an error message such as:
Command fail. CLI parsing error
Fortinet documentation uses the following conventions to describe valid command syntax.
Terminology
Each command line consists of a command word followed by words for the configuration data or other specific item that the command uses or affects, for example: get system admin
Fortinet documentation uses the following terms to describe the function of each word in the command line.
Command syntax terminology
72 l
command — A word that begins the command line and indicates an action that the FortiWeb appliance should perform on a part of the configuration or host on the network, such as config or execute. Together with other words, such as fields or values, that you terminate by pressing the Enter key, it forms a command line. Exceptions include multi-line command lines, which can be entered using an escape sequence. (See
Shortcuts & key commands on page 84 .)
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Using the CLI Command syntax
Valid command lines must be unambiguous if abbreviated. (See
Command abbreviation on page 85
.)
Optional words or other command line permutations are indicated by syntax notation. (See
This CLI Reference Guide is organized alphabetically by object for the config command, and by the name of the command for remaining top-level commands.
If you do not enter a known command, the CLI will return an error message such as:
Unknown action 0 l
subcommand — A kind of command that is available only when nested within the scope of another command. After entering a command, its applicable subcommands are available to you until you exit the scope of the command, or until you descend an additional level into another subcommand. Indentation is used to indicate levels of nested commands. (See
.)
Not all top-level commands have subcommands. Available subcommands vary by their containing scope. (See
.) l l l l l
object — A part of the configuration that contains tables and/or fields. Valid command lines must be specific enough to indicate an individual object.
table — A set of fields that is one of possibly multiple similar sets that each have a name or number, such as an administrator account, policy, or network interface. These named or numbered sets are sometimes referenced by other parts of the configuration that use them. (See
field — The name of a setting, such as ip or hostname. Fields in some tables must be configured with values.
Failure to configure a required field will result in an invalid object configuration error message, and the FortiWeb appliance will discard the invalid table.
value — A number, letter, IP address, or other type of input that is usually the configuration setting held by a field.
Some commands, however, require multiple input values which may not be named but are simply entered in sequential order in the same command line. Valid input types are indicated by constraint notation. (See
.)
option — A kind of value that must be one or more words from a fixed set of options. (See
Indentation
Indentation indicates levels of nested commands, which indicate what other subcommands are available from within the scope.
For example, the edit subcommand is available only within a command that affects tables, and the next subcommand is available only from within the edit subcommand: config system interface edit port1 end set status up next
For information about available subcommands, see
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
73
Command syntax Using the CLI
Notation
Brackets, braces, and pipes are used to denote valid permutations of the syntax. Constraint notations, such as
<address_ipv4>
, indicate which data types or string patterns are acceptable value input.
If you do not use the expected data type, the CLI returns an error message such as: object set operator error, -4003 discard the setting
The request URL must start with "/" and without domain name.
or: invalid unsigned integer value :-: value parse error before '-'
Input value is invalid.
and may either reject or discard your settings instead of saving them when you type end.
Command syntax notation
Convention
Square brackets [ ]
Curly braces { }
Description
A non-required (optional) word or words. For example:
[verbose {1 | 2 | 3}] indicates that you may either omit or type both the verbose word and its accompanying option, such as: verbose 3
A word or series of words that is constrained to a set of options delimited by either vertical bars or spaces.
You must enter at least one of the options, unless the set of options is surrounded by square brackets [ ].
74 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Using the CLI Command syntax
Convention
Options delimited by vertical bars |
Options delimited by spaces
Description
Mutually exclusive options. For example:
{enable | disable} indicates that you must enter either enable or disable, but must not enter both.
Non-mutually exclusive options. For example:
{http https ping snmp ssh telnet} indicates that you may enter all or a subset of those options, in any order, in a space-delimited list, such as: ping https ssh
Note: To change the options, you must re-type the entire list. For example, to add snmp to the previous example, you would type: ping https snmp ssh
If the option adds to or subtracts from the existing list of options, instead of replacing it, or if the list is comma-delimited, the exception will be noted.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
75
Command syntax
Convention
Angle brackets < >
Using the CLI
Description
A word constrained by data type.
To define acceptable input, the angled brackets contain a descriptive name followed by an underscore ( _ ) and suffix that indicates the valid data type. For example:
<retries_int> indicates that you should enter a number of retries, such as 5.
Data types include: l
<xxx_name>
— A name referring to another part of the configuration, such as policy_A.
l
<xxx_index>
— An index number referring to another part of the configuration, such as 0 for the first static route.
l
<xxx_pattern>
— A regular expression or word with wild cards that matches possible variations, such as *@example.com to match all email addresses ending in @example.com.
l
<xxx_fqdn>
— A fully qualified domain name (FQDN), such as mail.example.com
.
l
<xxx_email>
— An email address, such as [email protected]
.
l
<xxx_url>
— A uniform resource locator (URL) and its associated protocol and host name prefix, which together form a uniform resource identifier (URI), such as http://www.fortinet.com/.
l
<xxx_ipv4>
— An IPv4 address, such as 192.168.1.99.
l
<xxx_v4mask>
— A dotted decimal IPv4 netmask, such as
255.255.255.0
.
l
<xxx_ipv4mask>
— A dotted decimal IPv4 address and netmask separated by a space, such as 192.168.1.99 255.255.255.0.
l
<xxx_ipv4/mask>
— A dotted decimal IPv4 address and CIDRnotation netmask separated by a slash, such as such as
192.168.1.99/24
.
l
<xxx_ipv6>
— A colon( : )-delimited hexadecimal IPv6 address, such as 3f2e:6a8b:78a3:0d82:1725:6a2f:0370:6234.
l
<xxx_v6mask>
— An IPv6 netmask, such as /96.
l
<xxx_ipv6mask>
— An IPv6 address and netmask separated by a space.
l
<xxx_str>
— A string of characters that is not another data type, such as P@ssw0rd. Strings containing spaces or special characters must be surrounded in quotes or use escape sequences. See
Special characters on page 85 .
l
<xxx_int>
— An integer number that is
not another data type, such as
15 for the number of minutes.
76 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Using the CLI Subcommands
Subcommands
Once you connect to the CLI, you can enter commands.
Each command line consists of a command word that is usually followed by words for the configuration data or other specific item that the command uses or affects, for example: get system admin
Subcommands are available from within the scope of some commands.When you enter a subcommand level, the command prompt changes to indicate the name of the current command scope. For example, after entering: config system admin the command prompt becomes:
(admin)#
Applicable subcommands are available to you until you exit the scope of the command, or until you descend an additional level into another subcommand.
For example, the edit subcommand is available only within a command that affects tables; the next subcommand is available only from within the edit subcommand: config system interface
edit port1 end set status up
next
Available subcommands vary by command. From a command prompt within config, two types of subcommands might become available: l l commands that affect fields (see
commands that affect tables (see
Subcommand scope is indicated in this CLI Reference by indentation. See
.
Syntax examples for each top-level command in this CLI Reference do not show all available subcommands. However, when nested scope is demonstrated, you
.
should assume that subcommands applicable for that level of scope are available
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
77
Subcommands
Table commands delete <table_name> edit <table_name> end get
Using the CLI
Remove a table from the current object.
For example, in config system admin, you could delete an administrator account named newadmin by typing delete newadmin and pressing Enter. This deletes newadmin and all its fields, such as newadmin’s first-name and email-address.
delete is only available within objects containing tables.
Create or edit a table in the current object.
For example, in config system admin: l edit the settings for the default admin administrator account by typing edit admin
.
l add a new administrator account with the name newadmin and edit newadmin
‘s settings by typing edit newadmin.
edit is an interactive subcommand: further subcommands are available from within edit.
edit changes the prompt to reflect the table you are currently editing.
edit is only available within objects containing tables.
Save the changes to the current object and exit the config command.
This returns you to the top-level command prompt.
List the configuration of the current object or table.
l
In objects, get lists the table names (if present), or fields and their values.
l
In a table, get lists the fields and their values.
For more information on get commands, see
.
78 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Using the CLI Subcommands
purge show
Remove all tables in the current object.
For example, in config user local-user, you could type get to see the list of all local user names, then type purge and then y to confirm that you want to delete all users.
purge is only available for objects containing tables.
Caution: Back up the FortiWeb appliance before performing a purge because it cannot be undone. To restore purged tables, the configuration must be restored from a backup. For details, see
Caution: Do not purge system interface or system admin tables. This can result in being unable to connect or log in, requiring the FortiWeb appliance to be formatted and restored.
Display changes to the default configuration. Changes are listed in the form of configuration commands.
For more information on show commands, see
.
Example of table commands
From within the system admin object, you might enter: edit admin_1
The CLI acknowledges the new table, and changes the command prompt to show that you are now within the admin_1 table: new entry 'admin_1' added
(admin_1)#
Field commands abort end get
Exit both the edit and/or config commands without saving the fields.
Save the changes made to the current table or object fields, and exit the config command. (To exit without saving, use abort instead.)
List the configuration of the current object or table.
l
In objects, get lists the table names (if present), or fields and their values.
l
In a table, get lists the fields and their values.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
79
Permissions Using the CLI
next set <field_name> <value> show unset <field_name>
Save the changes you have made in the current table’s fields, and exit the edit command to the object prompt. (To save and exit completely to the root prompt, use end instead.) next is useful when you want to create or edit several tables in the same object, without leaving and re-entering the config command each time.
next is only available from a table prompt; it is not available from an object prompt.
Set a field’s value.
For example, in config system admin, after typing edit admin
, you could type set password newpass to change the password of the admin administrator to newpass.
Note: When using set to change a field containing a space-delimited list, type the whole new list. For example, set <field>
<new-value> will replace the list with the <new-value> rather than appending <new-value> to the list.
Display changes to the default configuration. Changes are listed in the form of configuration commands.
Reset the table or object’s fields to default values.
For example, in config system admin, after typing edit admin
, typing unset password resets the password of the admin administrator account to the default (in this case, no password).
Example of field commands
From within the admin_1 table, you might enter: set password my1stExamplePassword to assign the value my1stExamplePassword to the password field. You might then enter the next command to save the changes and edit the next administrator’s table.
Permissions
Depending on the account that you use to log in to the FortiWeb appliance, you may not have complete access to all CLI commands or areas of the web UI.
Access profiles control which commands and areas an administrator account can access. Access profiles assign either: l l
Read (view access)
Write (change and execute access)
80 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Using the CLI l l both Read and Write no access to each area of the FortiWeb software. For more information on configuring the access profile for an administrator account to use, see
.
Areas of control in access profiles
Access profile setting
Admin Users
admingrp
Grants access to
*
System > Admin ... except Settings config system admin config system accprofile
Auth Users
User ...
authusergrp
Autolearn
Configuration
config user ...
Auto Learn > Auto Learn Profile > Auto Learn Profile
learngrp
Log & Report
loggrp config server-policy custom-application ...
config waf web-protection-profile autolearning-profile
Note: Because generating an auto-learning profile also generates its required components, this area also confers
Write permission to those components in the Web
Protection Configuration/wafgrp area.
Log&Report ...
config log ...
execute formatlogdisk
Maintenance
mntgrp
Network
Configuration
System > Maintenance except System Time tab diagnose system ...
execute backup ...
execute factoryreset execute reboot execute restore ...
execute shutdown diagnose system flash ...
System > Network ...
Web UI
CLI
Web UI
CLI
Web UI
CLI
Web UI
CLI
Web UI
CLI
Web UI
Permissions
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
81
Permissions
Access profile setting
netgrp
System
Configuration
sysgrp
Server Policy
Configuration
traroutegrp
Grants access to *
config router ...
config system interface config system dns config system v-zone diagnose network ...
except
sniffer ...
System ... except Network, Admin, and Maintenance tabs config system
except accprofile, admin, dns, interface
, and v-zone diagnose hardware ...
diagnose network sniffer ...
diagnose system ...
except flash ...
execute date ...
execute ha ...
execute ping ...
execute ping-option ...
execute traceroute ...
execute time ...
Policy > Server Policy ...
Server Objects ...
Application Delivery ...
config server-policy ...
except customapplication ...
config waf file-compress-rule config waf file-uncompress-rule config waf http-authen ...
config waf url-rewrite ...
diagnose policy ...
Web Anti-Defacement ...
Web Anti-
Defacement
Management
wadgrp
Web Protection
Configuration
config wad ...
Policy > Web Protection ...
Web Protection ...
DoS Protection ...
CLI
Web UI
CLI
Web UI
CLI
Web UI
CLI
Web UI
Using the CLI
82 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Using the CLI Tips & tricks
Access profile setting
Grants access to *
wafgrp config system dos-prevention config waf
except: l config waf file-compress-rule l config waf file-uncompress-rule l config waf http-authen ...
l config waf url-rewrite ...
l config waf web-custom-robot l config waf web-protection-profile autolearning-profile l config waf web-robot l config waf x-forwarded-for
CLI
Web Vulnerability
Scan Configuration
Web Vulnerability Scan ...
Web UI wvsgrp config wvs ...
* For each config command, there is an equivalent get/show command, unless otherwise noted.
config access requires write permission.
get
/show access requires read permission.
CLI
Unlike other administrator accounts, the administrator account named admin exists by default and cannot be deleted. The admin administrator account is similar to a root administrator account. This administrator account always has full permission to view and change all FortiWeb configuration options, including viewing and changing
all other administrator accounts. Its name and permissions cannot be changed. It is the only administrator account that can reset another administrator’s password without being required to enter that administrator’s existing password.
Set a strong password for the admin administrator account, and change the password regularly. By default, this administrator account has no password. Failure to maintain the password of the admin administrator account could compromise the security of your FortiWeb appliance.
For complete access to all commands, you must log in with the administrator account named admin.
Tips & tricks
Basic features and characteristics of the CLI environment provide support and ease of use for many CLI tasks.
This section includes:
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
83
Tips & tricks Using the CLI l l l l l l l l
Language support & regular expressions
Editing the configuration file in a text editor
Help
To display brief help during command entry, press the question mark (?) key.
l l l
Press the question mark (?) key at the command prompt to display a list of the commands available and a description of each.
Press the question mark (?) key after a command keyword to display a list of the objects available with that command and a description of each.
Type a word or part of a word, then press the question mark (?) key to display a list of valid word completions or subsequent words, and to display a description of each.
Shortcuts & key commands
Action
List valid word completions or subsequent words.
If multiple words could complete your entry, display all possible completions with helpful descriptions of each.
Complete the word with the next available match.
Press the key multiple times to cycle through available matches.
Recall the previous command.
Command memory is limited to the current session.
Keys
?
Tab
Recall the next command.
Move the cursor left or right within the command line.
Move the cursor to the beginning of the command line.
Move the cursor to the end of the command line.
Move the cursor backwards one word.
Up arrow, or
Ctrl + P
Down arrow, or
Ctrl + N
Left or Right arrow
Ctrl + A
Ctrl + E
Ctrl + B
84 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Using the CLI
Action
Move the cursor forwards one word.
Delete the current character.
Abort current interactive commands, such as when entering multiple lines.
If you are not currently within an interactive command such as config or edit, this closes the CLI connection.
Continue typing a command on the next line for a multi-line command.
For each line that you want to continue, terminate it with a backslash ( \ ). To complete the command line, terminate it by pressing the spacebar and then the
Enter key, without an immediately preceding backslash.
Keys
Ctrl + F
Ctrl + D
Ctrl + C
\ then Enter
Tips & tricks
Command abbreviation
You can abbreviate words in the command line to their smallest number of non-ambiguous characters. For example, the command get system status could be abbreviated to: g sy st
If you enter an ambiguous command, the CLI returns an error message such as: ambiguous command before 's'
Value conflicts with system settings.
Special characters
Special characters <, >, (,), #, ', and
" are usually not permitted in CLI. If you use them, the CLI will often return an error message such as:
The string contains XSS vulnerability characters value parse error before '%^@'
Input not as expected.
Some may be enclosed in quotes or preceded with a backslash ( \ ) character.
Entering special characters
Character
?
Tab
Key
Ctrl + V then ?
Ctrl + V then Tab
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
85
Tips & tricks Using the CLI
Character
Space
(to be interpreted as part of a string value, not to end the string)
Key
Enclose the string in quotation marks: “Security
Administrator
”.
Enclose the string in single quotes: 'Security
Administrator'
.
Precede the space with a backslash: Security\
Administrator
.
'
(to be interpreted as part of a string value, not to end the string)
\
"
(to be interpreted as part of a string value, not to end the string)
\'
\"
\\
Language support & regular expressions
Languages currently supported by the CLI interface include: l l l l
English
Japanese simplified Chinese traditional Chinese
Characters such as ñ, é, symbols, and ideographs are sometimes acceptable input. Support varies by the nature of the item being configured. CLI commands, objects, field names, and options must use their exact ASCII characters, but some items with arbitrary names or values may be input using your language of choice.
For example, the host name must not contain special characters, and so the web UI and CLI will not accept most symbols and other non-ASCII encoded characters as input when configuring the host name. This means that languages other than English often are not supported. However, some configuration items, such as names and comments, may be able to use the language of your choice.
To use other languages in those cases, you must use the correct encoding.
The FortiWeb appliance stores the input using Unicode UTF-8 encoding, but it is not normalized from other encodings into UTF-8 before stored. If your input method encodes some characters differently than in UTF-8, your configured items may not display or operate as expected.
Regular expressions are especially impacted. Matching uses the UTF-8 character values. If you enter a regular expression using another encoding, or if an HTTP client sends a request in an encoding other than UTF-8, matches may not be what you expect.
86 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Using the CLI Tips & tricks
For example, with Shift-JIS, backslashes ( \ ) could be inadvertently interpreted as yen symbols ( ¥ ) and vice versa. A regular expression intended to match HTTP requests containing money values with a yen symbol therefore may not work it if the symbol is entered using the wrong encoding.
For best results, you should: l l l use UTF-8 encoding, or use only the characters whose numerically encoded values are the same in UTF-8, such as the US-ASCII characters that are also encoded using the same values in ISO 8859-1, Windows code page 1252, Shift-JIS and other encodings, or for regular expressions that must match HTTP requests, use the same encoding as your HTTP clients
HTTP clients may send requests in encodings other than UTF-8. Encodings usually vary by the client’s operating system or input language. If you cannot predict the client’s encoding, you may only be able to match any parts of the request that are in
English, because regardless of the encoding, the values for English characters tend to be encoded identically. For example, English words may be legible regardless of interpreting a web page as either ISO 8859-1 or as GB2312, whereas simplified
Chinese characters might only be legible if the page is interpreted as GB2312.
To configure your FortiWeb appliance using other encodings, you may need to switch language settings on your management computer, including for your web browser or Telnet or SSH client. For instructions on how to configure your management computer’s operating system language, locale, or input method, see its documentation.
If you choose to configure parts of the FortiWeb appliance using non-ASCII characters, verify that all systems interacting with the FortiWeb appliance also support the same encodings. You should also use the same encoding throughout the configuration if possible in order to avoid needing to switch the language settings of your web browser or Telnet or SSH client while you work.
Similarly to input, your web browser or CLI client should usually interpret display output as encoded using UTF-8.
If it does not, your configured items may not display correctly in the web UI or CLI. Exceptions include items such as regular expressions that you may have configured using other encodings in order to match the encoding of
HTTP requests that the FortiWeb appliance receives.
To enter non-ASCII characters in the CLI Console widget
1. On your management computer, start your web browser and go to the URL for the FortiWeb appliance’s web
UI.
2. Configure your web browser to interpret the page as UTF-8 encoded.
3. Log in to the FortiWeb appliance.
4. Go to System > Status > Status.
5. In title bar of the CLI Console widget, click the Edit icon.
The
Console Preferences dialog appears in a pop-up window.
6. Enable Use external command input box.
7. Click OK.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
87
Tips & tricks
The Command field appears below the usual input and display area of the CLI Console widget.
8. In Command, type a command.
CLI Console widget
Using the CLI
9. Press Enter.
In the display area, the CLI Console widget displays your previous command interpreted into its character code equivalent, such as: edit \743\601\613\743\601\652 and the command’s output.
To enter non-ASCII characters in a Telnet or SSH client
1. On your management computer, start your Telnet or SSH client.
2. Configure your Telnet or SSH client to send and receive characters using UTF-8 encoding the encoding.
Support for sending and receiving international characters varies by each Telnet or SSH client. Consult the documentation for your Telnet or SSH client.
3. Log in to the FortiWeb appliance.
4. At the command prompt, type your command and press Enter.
Entering encoded characters (PuTTY)
88
You may need to surround words that use encoded characters with single quotes ( ' ).
Depending on your Telnet or SSH client’s support for your language’s input methods and for sending international characters, you may need to interpret them into character codes before pressing Enter.
For example, you might need to enter: edit '\743\601\613\743\601\652'
5. The CLI displays your previous command and its output.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Using the CLI Tips & tricks
Screen paging
When output spans multiple pages, you can configure the CLI to pause after each page. When the display pauses, the last line displays --More--. You can then either: l l
Press the spacebar to display the next page.
Type Q to truncate the output and return to the command prompt.
This may be useful when displaying lengthy output, such as the list of possible matching commands for command completion, or a long list of settings. Rather than scrolling through or possibly exceeding the buffer of your terminal emulator, you can simply display one page at a time.
To configure the CLI display to pause after each full screen: config system console set output more end
For more information, see
.
Baud rate
You can change the default baud rate of the local console connection. For more information, see
Editing the configuration file in a text editor
Editing the configuration file with a plain text editor can be time-saving if: l l l you have many changes to make, are not sure where the setting is in the CLI, and/or own several FortiWeb appliances
This is true especially if your plain text editor provides advanced features such as regular expressions for find-andreplace, or batch changes across multiple files. Several free text editors are available with these features, such as
Text Wrangler and Notepad++ .
Do
not use a rich text editor such as Microsoft Word. Rich text editors insert special characters into the file in order to apply formatting, which may corrupt the configuration file.
To edit the configuration on your computer
1. Use
or
to download the configuration file to a TFTP server, such as your management computer.
2. Edit the configuration file using a plain text editor that supports Unix-style line endings.
Do not edit the first line. The first lines of the configuration file (preceded by a # character) contains information about the firmware version and FortiWeb model. If you change the model number, the FortiWeb appliance will reject the configuration file when you attempt to restore it.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
89
Administrative domains (ADOMs) Using the CLI
3. Use
to upload the modified configuration file back to the FortiWeb appliance.
The FortiWeb appliance downloads the configuration file and checks that the model information is correct. If it is, the FortiWeb appliance loads the configuration file and checks each command for errors. If a command is invalid, the FortiWeb appliance ignores the command. If the configuration file is valid, the FortiWeb appliance restarts and loads the new configuration.
Administrative domains (ADOMs)
Administrative domains (ADOMs) enable the admin administrator to constrain other FortiWeb administrators’ access privileges to a subset of policies and protected host names. This can be useful for large enterprises and multi-tenant deployments such as web hosting.
ADOMs are
not enabled by default. Enabling and configuring administrative domains can only be performed by the admin administrator.
Enabling ADOMs alters the structure of and the available functions in the GUI and CLI, according to whether or not you are logging in as the admin administrator, and, if you are not logging in as the admin administrator, the administrator account’s assigned access profile.
Differences between administrator accounts when ADOMs are enabled admin administrator account
Yes
Access to config global
Can create administrator accounts
Can create & enter all ADOMs
Yes
Yes
Other administrators
No
No
No l
If ADOMs are enabled and you log in as admin, a superset of the typical CLI commands appear, allowing unrestricted access and ADOM configuration.
config global contains settings used by the FortiWeb itself and settings shared by ADOMs, such as RAID and administrator accounts. It does not include ADOM-specific settings or data, such as logs and reports.
When configuring other administrator accounts, an additional option appears allowing you to restrict other administrators to an ADOM.
l
If ADOMs are enabled and you log in as any other administrator, you enter the ADOM assigned to your account. A subset of the typical menus or CLI commands appear, allowing access only to only logs, reports, policies, servers, and LDAP queries specific to your ADOM. You cannot access global configuration settings, or enter other ADOMs.
By default, administrator accounts other than the admin account are assigned to the root ADOM, which includes all policies and servers. By creating ADOMs that contain a subset of policies and servers, and assigning them to administrator accounts, you can restrict other administrator accounts to a subset of the
FortiWeb’s total protected servers.
90 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Using the CLI Administrative domains (ADOMs)
The admin administrator account cannot be restricted to an ADOM. Other administrators are restricted to their ADOM, and cannot configure ADOMs or global settings.
To enable ADOMs
1. Log in with the admin account.
Other administrators do not have permissions to configure ADOMs.
Back up your configuration. Enabling ADOMs changes the structure of your configuration, and moves non-global settings to the root ADOM. For information on how to back up the configuration, see
.
2. Enter the following commands: config system global set adom-admin enable end
FortiWeb terminates your administrative session.
3. Log in again.
When ADOMs are enabled, and if you log in as admin, the top level of the shell changes: the two top level items are config global and config vdom.
l l config global contains settings that only admin or other accounts with the prof_admin access profile can change.
config vdom contains each ADOM and its respective settings.
This menu and CLI structure change is not visible to non-global accounts; ADOM administrators’ navigation menus continue to appear similar to when ADOMs are disabled, except that global settings such as network interfaces, HA, and other global settings do not appear.
4. Continue by defining ADOMs (
).
To disable ADOMs
1. Delete all ADOM administrator accounts.
Back up your configuration. Disabling ADOMs changes the structure of your configuration, and deletes most ADOM-related settings. It keeps settings from the root
ADOM only. For information on how to back up the configuration, see
2. Enter the following commands: config system global set adom-admin disable end
FortiWeb terminates your administrative session.
3. Continue by reconfiguring the appliance (see the
FortiWeb Administration Guide
).
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
91
Administrative domains (ADOMs) Using the CLI
See also
l l l l
Assigning administrators to an ADOM
l
Defining ADOMs
Some settings can only be configured by the admin account — they are global. Global settings apply to the appliance overall regardless of ADOM, such as: l l l l l l l l l l l l l l operation mode network interfaces system time backups administrator accounts access profiles
FortiGuard connectivity settings
HA and configuration sync
SNMP
RAID
X.509 certificates
TCP SYN flood anti-DoS setting vulnerability scans exec ping and other global operations that exist only in the CLI
Only the admin account can configure global settings.
In the current release, some settings, such as user accounts for HTTP authentication, anti-defacement, and logging destinations are read-only for ADOM administrators.
Future releases will allow ADOM administrators to configure these settings separately for their ADOM.
Other settings can be configured separately for each ADOM. They essentially define each ADOM. For example, the policies of adom-A are separate from adom-B.
Initially, only the root ADOM exists, and it contains settings such as policies that were global before ADOMs were enabled. Typically, you will create additional ADOMs, and few if any administrators will be assigned to the root
ADOM.
After ADOMs are created, the admin account usually assigns other administrator accounts to configure their
ADOM-specific settings. However, as the root account, the admin administrator does have permission to configure all settings, including those within ADOMs.
To create an ADOM
1. Log in with the admin account.
92 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Using the CLI Administrative domains (ADOMs)
Other administrators do not have permissions to configure ADOMs.
2. Enter the following commands: config vdom edit <adom_name> where <adom_name> is the name of your new ADOM. (Alternatively, to configure the default root ADOM, type root.)
The maximum number of ADOMs you can add varies by your FortiWeb model. The number of ADOMs is limited by available physical memory (RAM), and therefore also limits the maximum number of policies and sessions per ADOM. See the
FortiWeb
Administration Guide
.
The new ADOM exists, but its settings are not yet configured.
3. Either: l l assign another administrator account to configure the ADOM (continue with
Assigning administrators to an
configure the ADOM yourself by entering commands such as: config log...
config server-policy...
config system...
config waf...
See also
l l l l
Assigning administrators to an ADOM
Administrative domains (ADOMs)
l
Assigning administrators to an ADOM
The admin administrator can create other administrators and assign their account to an ADOM, constraining them to that ADOM’s configurations and data.
To assign an administrator to an ADOM
1. If you have not yet created any administrator access profiles, create at least one. See
.
2. In the administrator account’s
accprofile <access-profile_name>
setting, select the new access profile.
(Administrators assigned to the
prof_admin access profile will have global access. They cannot be restricted to an ADOM.)
3. In the administrator account’s
setting, select the account’s assigned ADOM.
Currently, in this version of FortiWeb, administrators cannot be assigned to more than one ADOM.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
93
Administrative domains (ADOMs)
See also
l l
l
l
Using the CLI
94 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
config
The config commands configure your FortiWeb appliance’s feature settings.
This chapter describes the following commands:
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
95
96
server-policy customapplication application-policy
server-policy customapplication url-replacer
server-policy http-contentrouting-policy server-policy http-contentrouting-policy
server-policy pattern customdata-type
server-policy pattern customglobal-white-list-group
server-policy pattern customsusp-url
server-policy pattern customsusp-url-rule
server-policy pattern datatype-group
server-policy pattern suspicious-url-rule
server-policy persistencepolicy
system admin-certificate ca system admin-certificate local
system certificate ca system certificate ca-group
system certificate crl system certificate intermediate-certificate
system certificate intermediate-certificategroup
system certificate verify system conf-sync
system fips-cc system firewall address
system firewall firewall-policy
config
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
system hsm partition system interface
system ip-detection system network-option
system replacemsg-image system settings
waf application-layer-dosprevention
waf file-upload-restrictionpolicy
waf file-upload-restrictionrule
waf http-authen http-authenpolicy
waf http-authen http-authenrule
waf http-connection-floodcheck-rule
waf http-constraintsexceptions
waf http-protocol-parameterrestriction
waf http-request-floodprevention-rule
waf layer4-connection-floodcheck-rule
waf site-publish-helper authentication-server-pool
waf site-publish-helper keytab_file waf site-publish-helper policy
waf url-access url-accesspolicy
waf url-access url-access-rule
waf url-rewrite url-rewritepolicy
waf url-rewrite url-rewrite-rule
waf web-protection-profile autolearning-profile
waf web-protection-profile inline-protection
waf web-protection-profile offline-protection
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
97
log alertemail config
Although not usually explicitly shown in each config command’s “Syntax” section, for all config commands, there are related
and
commands which display that part of the configuration, either in the form of a list of settings and values, or commands that are required to achieve that configuration from the firmware’s default state, respectively. get and show commands use the same syntax as their related config command, unless otherwise mentioned.
log alertemail
Use this command to enable or disable alert emails, and to choose which email policy to use with them. Alert emails notify administrators or other personnel when an alert condition occurs, such as a system failure or network attack.
The email address information and the alert message intervals are configured separately for each email policy.
For information on the severity levels of log messages associated with an email policy, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For more information, see
Syntax
config log alertemail set set
status {enable | disable} email-policy <policy_name>
end
Variable
status {enable | disable} email-policy <policy_ name>
Description Default
Enable to generate an alert email when the FortiWeb appliance records a log message, if that log message meets or exceeds the severity level configured in
enable
Type the name of a previously configured email policy. The maximum length is 35 characters.
To display a list of the existing email policies, type: set email-policy ?
No default.
Example
This example enables alert email when either a system event or attack log message is logged. The alert email is sent using the recipients configured in emailpolicy1.
config log alertemail set status enable end set email-policy emailpolicy1
98 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config log attack-log
Related topics
l
log attack-log
Use this command to configure recording of attack log messages on the local FortiWeb disk.
You must enable disk log storage and select log severity levels using the
command before any attack logs can be stored on disk.
Also use this command to define specific packet payloads to retain when storing attack logs.
Packet payloads can be retained for specific attack types or validation failures detected by the FortiWeb appliance. Packet payloads supplement the log message by providing the actual data that triggered the attack log, which may help you to fine-tune your regular expressions to prevent false positives. You can also examine changes to attack behavior for subsequent forensic analysis. (Alternatively, for more extensive packet logging, you can run a packet trace. See
If the offending HTTP request exceeds 4 kilobytes (KB), the FortiWeb appliance retains only 4 KB’ of the part of the payload that triggered the log message.
You can view attack log packet payloads from the Packet Log column using the web UI. For details, see the
FortiWeb Administration Guide
.
Packet payloads can contain sensitive information. You can prevent sensitive data from display in the packet payload by applying sensitivity rules that detect and obscure sensitive information. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For more information, see
Syntax
config log attack-log set set
status {enable | disable} http-parse-error-output {enable | disable}
set
end set set
no-ssl-error {enable | disable} show-all-log {enable | disable}
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
99
log attack-log
Variable
status {enable | disable}
Description
Enable to record attack log messages on the disk.
To record attack logs, disk log storage must be enabled, and the severity levels selected using the
command.
Default
enable http-parse-error-output
{enable | disable}
Enable while debugging only, to log errors of the HTTP protocol parser.
disable packet-log {anti-virusdetection | cookiesecurity | customaccess | customprotection-rule | fsadetection | hiddenfields-failed | httpprotocol-constraints | illegal-file-type | illegal-xml-format | ip-intelligence | padding-oracle | parameter-rule-failed | signature-detection | illegal-json-format | trojan-detection | illegal-filesize | csrf-detection | usertracking-detection | account-lockoutdetection}
Select one or more detected attack types or validation failures. FortiWeb keeps packet payloads from its HTTP parser buffer with their associated attack log message.
Separate each attack type with a space. To add or remove a packet payload type, re-type the entire space-delimited list with the new option included or omitted.
Some options have historical names. Correlations with current feature names are: l custom-protection-rule
— Custom signature detection (not predefined)
To empty this list and keep no packet payloads, effectively disabling the feature, type unset packet-log.
No default.
no-ssl-error {enable | disable} show-all-log {enable | disable}
Enable to stop FortiWeb from logging SSL errors.
This setting is useful when you use high-level security settings, which generate a high volume of these types of errors.
Specifies whether all signature violations that contributed to a threat scoring attack log message are displayed as individual entries in the attack log. In addition, messages for signature violations that generated a threat score but did not exceed the threat scoring threshold are displayed.
If the value of this setting is disable (the default), a single attack log message is displayed for the signature violations that contributed to a combined threat score that exceeded the maximum. However, all the signature violations that contributed to the score are displayed in the message details. (Double-click the message to display its details.) disable disable config
100 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config log custom-sensitive-rule
Example
This example enables log storage on the hard disk and sets information as the minimum severity level that a log message must meet in order for the log to be stored. It also enables retention of packet payloads that triggered custom protection rules along with their correlating attack logs. (Conversely, it disables any other packet payload retention that may have been enabled before, because it completely replaces the list each time it is configured.) config log disk set status enable end set severity information config log attack-log set status enable end set packet-log custom-protection-rule
Related topics
l
l
config log custom-sensitive-rule
l
l
l
diagnose debug application miglogd
l
log custom-sensitive-rule
Use this command to configure custom rules to obscure sensitive information that is not obscured in log message packet payloads by the predefined sensitivity rules.
Use this command in conjunction with
.
If enabled to do so, a FortiWeb appliance will obscure predefined data types, including user names and passwords in log message packet payloads. If other sensitive data in the packet payload is not obscured by the predefined data types, you can create your own data type sensitivity rules, such as ages or other identifying numbers.
Sensitive data definitions are
not retroactive. They will hide strings in subsequent log messages, but will not affect existing log messages.
This command is relevant only if you have enabled the FortiWeb appliance to keep packet payloads along with their associated log messages, and have selected to obscure logs according to custom data types. For details, see
and
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For more information, see
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
101
log custom-sensitive-rule
Syntax
config log custom-sensitive-rule edit
set
expression "<sensitive-type_pattern>"
end set set set next
field-name "<parameter-name_pattern>"
field-value "<parameter-value_pattern>"
type {field-mask-rule | general-mask-rule}
Variable
<custom-sensitive-rule_ name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Default
No default.
expression "<sensitivetype_pattern>"
Type a regular expression that matches all and only the strings or numbers that you want to obscure in the packet payloads.
For example, to hide a parameter that contains the age of users under 13, you could enter: age\=[1-13]
Expressions must not start with an asterisk ( * ). The maximum length is 255 characters.
type {field-mask-rule | general-mask-rule}
Select either general-mask-rule (a regular expression that will match any substring in the packet payload) or field-mask-rule (a regular expression that will match only the value of a specific form input).
If you select general-mask-rule, configure
expression "<sensitive-type_pattern>" .
If you select field-mask-rule, configure
and
No default.
generalmaskrule field-name "<parametername_pattern>"
Type a regular expression that matches all and only the input names whose values you want to obscure. (The input name itself will not be obscured. If you wish to do this, use general-mask-rule instead.) The maximum length is
255 characters.
No default.
config
102 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable Description
field-value "<parametervalue_pattern>"
Type a regular expression that matches all and only the input values that you want to obscure. The maximum length is 255 characters.
For example, to hide a parameter that contains the age of users under 13, for
field-name "<parameter-name_ pattern>" , enter age, and for
field-value "<parametervalue_pattern>"
, enter [1-13].
Valid expressions must not start with an asterisk ( * ).
Caution: Field masks using asterisks are greedy: a match for the parameter’s value will obscure it, but will
also obscure the rest of the parameters in the line. To avoid this, enter an expression whose match terminates with, but does not consume, the parameter separator.
For example, if parameters are separated with an ampersand ( & ), and you want to obscure the value of the field name username but not any of the parameters that follow it, you could enter the field value:
.*?(?=\&)
This would result in: username****&age=13&origurl=%2Flogin log custom-sensitive-rule
Default
No default.
Example
This example enables the FortiWeb appliance to keep all types of packet payloads with their associated log messages. It also enables and defines a custom sensitive data type (applies to age 13 or less) that will be obscured in logs.
config log attack-log set status enable set packet-log anti-virus-detection cookie-poison custom-access custom-protection-rule hidden-fields-failed http-protocol-constraints illegal-file-type illegal-xml-format ip-intelligence padding-oracle parameter-rule-failed signature-detection end config log sensitive end set type custom-rule config log custom-sensitive-rule edit rule1 set type general-mask-rule set expression "age\\=[1-13]*$" end next
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
103
log disk config
Related topics
l
l
l
log disk
Use this command to enable and configure recording of log messages to the local hard disk.
Logging must be enabled for each individual log type before log messages are recorded to disk. See
and
for details.
You can use SNMP traps to notify you when disk space usage exceeds 80%. For details, see
You can generate reports based on log messages that you save to the local hard disk. For details, see
Syntax
config log disk set
set end set
severity {alert | critical | debug | emergency | error | information | notification | warning}
Variable
status {enable | disable}
Description
Enable to store log messages on the local hard disk. Log messages are stored only if logging is enabled for the individual log types using the
,
, and
commands. Also configure severity, diskfull and max-log-file-size.
Default
enable
104 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
diskfull {nolog | overwrite} severity {alert | critical | debug | emergency | error | information | notification | warning}
Description
Type what the FortiWeb does when the local disk is full and a new log message is caused, either: l l nolog
— Discard the new log message.
overwrite
— Delete the oldest log file in order to free disk space, then store the new log message.
This field is available only if status is enable.
Default
overwrite
Select the severity level that a log message must meet or exceed in order to cause the FortiWeb appliance to record it.
information log disk
Example
This example enables logging of event and attack logs and recording of the log messages to the local hard disk.
Only the log messages with a severity of notification or higher are recorded. If all free space on the hard disk is consumed and a new log message is generated, the diskfull option determines that the FortiWeb will overwrite the oldest log message. The log messages are saved to a separated log file for each message type.
Once the log file size reaches the 100 MB specified by max-log-file-size, the FortiWeb appliance saves the log file with a sequentially-numbered name and starts a new log.
config log event-log set status enable end config log attack-log end set status enable config log disk set status enable end set severity notification set diskfull overwrite
Related topics
l
l
l
l
l
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
105
log email-policy config
log email-policy
Use this command to create an email policy. An email policy identifies email recipients, email address, email connection requirements and authentication information, if required.
You can configure multiple email policies and apply those policies as required in different situations. The
FortiWeb appliance can be configured to send email for different situations, such as to alert administrators when certain system events or rule violations occur, or when log reports are available for distribution.
To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For more information, see
Syntax
config log email-policy edit
set
set set set set
mailto2 <recipient_email> mailto3 <recipient_email> smtp-server {<smtp_ipv4> | <smtpfqdn>}
set set
smtp-port <smtp-port_int> smtp-auth {enable | disable}
set set set
end set set
connection-security {NONE | STARTTLS | SSL/TLS}
set
attach-compression {enable | disable}
next
Variable
<email-policy_name>
Description
Type the name of an email policy. The maximum length is 35 characters.
Default
No default.
mailfrom <address_str>
Type the sender email address, such as
, that the FortiWeb appliance will use when sending email. The maximum length is 63 characters.
No default.
mailto1 <recipient_ email>
Type the email address of the first recipient, such as [email protected]
, to which the FortiWeb appliance will send email. You must enter one email address for alert email to function. The maximum length is 63 characters.
No default.
106 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config log email-policy
Variable
mailto2 <recipient_ email> mailto3 <recipient_ email>
Description
Type the email address of the second recipient, if any, to which the FortiWeb appliance will send alert email. The maximum length is 63 characters.
Type the email address of the third recipient, if any, to which the FortiWeb appliance will send alert email. The maximum length is 63 characters.
Default
No default.
No default.
smtp-server {<smtp_ ipv4> | <smtpfqdn>}
Type the IP address or fully qualified domain name (FQDN) of the SMTP server, such as mail.example.com, that the
FortiWeb appliance can use to send email. The maximum length is 63 characters.
No default.
smtp-port <smtp-port_ int>
Enter the port on the SMTP server that listens for alerts and generated reports from FortiWeb.
Valid values are from 1 to 65535.
25 smtp-auth {enable | disable} smtp-username <auth_ str>
Enable if the SMTP server requires authentication. Also enable if authentication is not required but is available and you want the FortiWeb appliance to authenticate.
disable
No default.
If you enable
smtp-auth {enable | disable} , type the user
name that the FortiWeb appliance will use to authenticate itself with the SMTP relay. The maximum length is 63 characters.
This field is available only if you enable
smtp-password
<password_str> severity {alert | critical | debug | emergency | error | information | notification | warning}
If you enable
smtp-auth {enable | disable} , type the
password that corresponds with the user name.
This field is available only if you enable
No default.
Select the severity threshold that log messages must meet or exceed in order to cause an email alert.
emergency interval <interval_ int>
Enter the number of minutes FortiWeb waits to send an additional alert if an alert condition of the specified severity level continues to occur after the initial alert.
Valid values are from 1 to 2147483647.
1
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
107
log email-policy
Variable
connection-security
{NONE | STARTTLS |
SSL/TLS}
Description
Select one of the following options: l l l
NONE
— FortiWeb applies no security protocol to email.
STARTTLS
— Encrypts the connection to the SMTP server using STARTTLS.
SSL/TLS
— Encrypts the connection to the SMTP server using SSL/TLS.
Default
NONE attach-compression {enable
| disable}
Enable or disable the compression for an alert email policy.
With the compression function being enabled, event logs and alerts will be attached to the emails in ZIP format, otherwise they will be attached in TXT format.
disable config
Example
This example creates email policy for use in multiple situations. When the email policy is attached to rule violations or log reports, FortiWeb sends an email from [email protected], to [email protected] and [email protected]
, using an SMTP server mail.example.com. The
SMTP server requires authentication. The FortiWeb appliance authenticates as fortiweb when connecting to the SMTP server.
FortiWeb logs messages more severe than a notification. As long as events continue to trigger notification-level log messages, FortiWeb sends an alert email every 10 minutes. (Log messages of other severity levels trigger alert email at their default intervals.) All the related log messages will be attached to the emails in ZIP format.
When the configuration is complete, log in to the web UI to send a sample alert email to test the configuration and the email system.
config log email-policy edit Email_Policy1 set mailfrom [email protected]
set mailto1 [email protected]
set mailto2 [email protected]
set smtp-server mail.example.com
set smtp-auth enable set smtp-username fortiweb set smtp-password fortiWebPassworD2 set severity notification set interval 10 set attach-compression enable end next
Related topics
l
l
l
l
108 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config log event-log
log event-log
Use this command to configure recording of event log messages, and then use other commands to store those messages on the local FortiWeb disk, in local FortiWeb memory, or both. Use other commands to configure a traffic log and attack log.
You must enable disk and/or memory log storage and select log severity levels before
FortiWeb will store any event logs.
Syntax
config log event-log set set
analyzer-policy <fortianalyzer-policy_name>
end set set set set
cpu-high <percentage_int> mem-high <percentage_int> logdisk-high <percentage_int>
trigger-policy <trigger-policy_name>
Variable
status {enable | disable} threshold {50 | 60 |
70 | 80 | 90} cpu-high <percentage_ int> mem-high <percentage_ int> logdisk-high
<percentage_int>
Description
Enable to record event log messages.
To select the destination and the severity threshold of the stored log messages, used either the
or the command.
Default
enable
Select a threshold level as a percentage that will trigger an event log when the actual number of persistent server sessions reaches the defined percentage of the total number of persistent server sessions allowed for the FortiWeb appliance.
50
Type a threshold level as a percentage beyond which CPU usage triggers an event log entry.
The valid range is from 60 to 99 percent.
60
Type a threshold level as a percentage beyond which memory usage triggers an event log entry.
The valid range is from 60 to 99 percent.
Type a threshold level as a percentage beyond which log disk usage triggers an event log entry.
The valid range is from 60 to 99 percent.
60
60
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
109
log forti-analyzer
Variable Description
trigger-policy <triggerpolicy_name>
Type the name of the trigger to apply when the CPU, memory, log disk usage, or number of sessions meets or exceeds the threshold (see
). The maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
Default
No default.
config
Example
This example enables recording of event logs, enables disk log storage and memory log storage, and sets alert as the minimum severity level that a log message must achieve for storage.
config log disk set status enable set severity alert end config log memory set status enable set severity alert end config log event-log end set status enable
Related topics
l
l l
l
l
diagnose debug application miglogd
l
log forti-analyzer
Use this command to configure the FortiWeb appliance to send its log messages to a remote FortiAnalyzer appliance.
You must first define one or more FortiAnalyzer policies using
config log fortianalyzer-policy
Logs sent to FortiAnalyzer are controlled by FortiAnalyzer policies and trigger actions that you configure on the
FortiWeb appliance, and are associated with various types of violations.
110 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config log forti-analyzer
Usually, you should set trigger actions for specific types of violations. Failure to do so will result in the FortiWeb appliance logging every occurrence, which could result in high log volume and reduced system performance. Excessive logging for an extended period of time may cause premature hard disk failure.
Logs stored remotely cannot be viewed from the web UI, and cannot be used by FortiWeb to build reports. If you require these features, record logs locally as well as remotely.
Syntax
config log forti-analyzer set
analyzer-policy <fortianalyzer-policy_name>
end set set
analyzer-policy <fortianalyzer-policy_name> analyzer-policy <fortianalyzer-policy_name>
Variable
fortianalyzer-policy
<policy_name> status {enable | disable} severity {alert | critical | debug | emergency | error | information | notification | warning}
Description
Type the name of an existing FortiAnalyzer policy to use when storing log information remotely. The maximum length is 35 characters.
To view a list of the existing FortiAnalyzer policies, type: set fortianalyzer-policy ?
Enable to record event log messages to FortiAnalyzer if it meets or exceeds the severity level configured in severity
.
Select the severity level that a log message must meet or exceed in order to cause the FortiWeb appliance to save it to FortiAnalyzer.
Default
No default.
disable information
Example
This example enables FortiAnalyzer logging and recording of the log messages. Only the log messages with a severity of error or higher are recorded.
config log forti-analyzer set status enable end set severity error
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
111
log fortianalyzer-policy config
Related topics
l
config log fortianalyzer-policy
log fortianalyzer-policy
Use this command to create policies for use by protection rules to store log messages remotely on a FortiAnalyzer appliance. For example, once you create a FortiAnalyzer policy, you can include it in a trigger policy, which in turn can be applied to a trigger action in a protection rule.
You need to create a FortiAnalyzer policy if you also plan to send log messages to a FortiAnalyzer appliance.
To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For more information, see
Syntax
config log fortianalyzer-policy edit
config fortianalyzer-server-list edit
end next set set
ip-address <forti-analyzer_ipv4> enc-algorithm {disable | default}
end
Variable
<policy_name>
Description
Type the name of the new or existing FortiAnalyzer policy.
The maximum length is 35 characters.
To display a list of the existing policies, type: edit ?
Default
No default.
<entry_index>
Enter the index number of the individual entry in the table.
No default.
ip-address <fortianalyzer_ipv4>
Type the IP address of the remote FortiAnalyzer appliance.
No default.
enc-algorithm {disable | default}
Specifies whether FortiWeb transmits logs to the FortiAnalyzer appliance using SSL.
disable
112 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config log ftp-policy
Example
This example creates a policy entry and assigns an IP address, then enables FortiAnalyzer logging for log messages with a severity of error or higher config log fortianalyzer-policy edit fa-policy1 config fortianalyzer-policy edit 1 end next set ip-address 192.0.2.0
end config log forti-analyzer set fortianalyzer-policy fa-policy1 set status enable end set severity error
Related topics
l
log ftp-policy
Use this command to configure a connection to an FTP or TFTP server. The config log reports configuration uses this policy to specify a server that FortiWeb sends reports to.
To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For more information, see
Syntax
config log ftp-policy edit
set set set set set set
end
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
113
log reports config
Variable
<policy_name>
Description
Type the name of a new or existing FTP/TFTP policy.
The maximum length is 35 characters.
To display the list of existing policies, type: edit ?
Default
No default.
type {ftp | tftp}
Specify whether the server is FTP or TFTP.
server <ftp-server_ipv4> The IP address of the FTP or TFTP server.
ftp_auth {enable | disable} ftp
No default.
Specify whether the server requires a user name and password for authentication, rather than allowing anonymous connections.
disable
Available only if type is ftp.
ftp_user <ftp-user_str> ftp_passwd <ftp_pswd> ftp-dir <ftp-dir_str>
Enter the user name that FortiWeb uses to authenticate with the server.
Available only if ftp_auth is enable.
No default.
Enter the password for the specified username.
Available only if ftp_auth is enable
No default.
Enter the location on the server where FortiWeb stores reports.
No default.
Related topics
l
log reports
Use this command to configure report profiles.
When generating a report, FortiWeb appliances collate information collected from their log files and present the information in tabular and graphical format.
In addition to log files, your FortiWeb appliance requires a report profile to generate a report. A report profile is a group of settings that contains the report name, file format, subject matter, and other aspects that the FortiWeb appliance considers when generating the report.
FortiWeb appliances can generate reports automatically, according to the schedule that you configure in the report profile, or manually in the web UI when you click the Run now icon in the report profile list. You may want to create one report profile for each type of report that you will generate on demand or periodically, by schedule.
114 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config log reports
Generating reports can be resource intensive. To avoid email processing performance impacts, you may want to generate reports during times with low traffic volume, such as at night.
The number of results in a section’s table or graph varies by the report type.
Ranked reports (top x, or top y of top x) can include a different number of results per cross-section, then combine remaining results under “Others.” For example, in “Top Attack Severity by Hour of Day,” the report includes the top x hours, and their top y attacks, then groups the remaining results.
l l
and
To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For more information, see
Creating a report profile is considerably easier in the web UI. Go to
Log&Report > Report Config.
Syntax
config log reports edit
set
set
custom_footer_options {custom | report-title}
set
analyzer-policy <fortianalyzer-policy_name>
set set
custom_header <header_str> custom_header_logo <filename_hex>
set set set set set set set set set set set set set set set set set
period_end <time_str> <date_str> period_last_n <n_int> period_start <time_str> <date_str>
set set
report_desc "<comment_str>" report_title <title_str>
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
115
log reports config set set set set set set set set set set set set end next
analyzer-policy <fortianalyzer-policy_name>
Variable
<report_name> custom_company "<org_ str>"
Description
Type the name of a new or existing report profile. The maximum length is 63 characters.
The profile name will be included in the report header.
To display the list of existing report names, type: edit ?
Type the name of your department, company, or other organization, if any, that you want to include in the report summary. If the text is more than one word or contains special characters, enclose it in double quotes ( " ). The maximum length is 191 characters.
For information on enabling the summary, see
scope_ include_summary {yes | no}
.
Default
No default.
No default.
116 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config log reports
Variable Description
custom_footer_options
{custom | report-title}
Select either: l l report-title
— Use
as the footer text.
custom
— Provide separate footer text in
analyzerpolicy <fortianalyzer-policy_name> .
Default
reporttitle custom_footer "<footer_ str>"
Type the text, if any, that you want to include at the bottom of each report page. If the text is more than one word or contains special characters, enclose it in double quotes ( " ). The maximum length is 127 characters.
This setting is available only if custom_footer_ options is custom.
custom_header <header_ str>
Type the text, if any, that you want to include at the top of each report page. If the text is more than one word or contains special characters, enclose it in double quotes ( " ). The maximum length is 127 characters.
No default.
No default.
custom_header_logo
<filename_hex> custom_title_logo
<filename_hex> email_attachment_ compress {enable | disable}
Type the file name of a custom logo that you have previously uploaded to the FortiWeb appliance. The logo image will be included in the report header. The maximum length is 255 characters.
Type the file name of a custom logo that you have previously uploaded to the FortiWeb appliance. The logo image will be included in the report title. The maximum length is 255 characters.
Enable to enclose the generated report formats in a compressed archive attached to the email.
This field is required if you have enabled email output by enabling one or more of the file formats for email output in
output_email {html mht pdf rtf txt} .
No default.
No default.
disable email_attachment_name
"<filename_str>"
No default.
Type the file name that will be used for the reports attached to the email. The maximum length is 63 characters.
This field is required if you have enabled email output by enabling one or more of the file formats for email output in
output_email {html mht pdf rtf txt} .
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
117
log reports
Variable
email_body "<message_ str>" email_subject
"<subject_str>"
Description
Type the message body of the email. The maximum length is 383 characters.
This field is required if you have enabled email output by enabling one or more of the file formats for email output in
output_email {html mht pdf rtf txt} .
Type the subject line of the email. The maximum length is
191 characters.
This field is required if you have enabled email output by enabling one or more of the file formats for email output in
output_email {html mht pdf rtf txt} .
filter_string "<logfilter_str>"
Type a log message filter string that includes or excludes log messages based upon matching log field values. The maximum length is 1,023 characters.
For example syntax, see
include_nodata {yes | no} on_demand {enable | disable}
Select whether to include (yes) or hide (no) reports which are empty because there is no matching log data.
Enable to run the report one time only. After the FortiWeb appliance completes the report, it removes the report profile from its hard disk.
Type disable to schedule a time to run the report, and to keep the report profile for subsequent use.
output_email {html mht pdf rtf txt} output_email_policy
<policy_name>
Select one or more file types for the report when mailing generated reports.
If you set a value for output_email, type the name of the email policy that contains settings for sending the report by email. The maximum length is 35 characters.
For more information on email policies, see
.
output_file {html mht pdf rtf txt} output_ftp {html pdf rtf txt mht}
Select one or more file types for the report when saving to the
FortiWeb hard disk.
Select one or more file types for the report when FortiWeb sends reports to an FTP or TFTP server.
output_ftp_policy <ftppolicy_name>
Enter the policy that defines a connection to the appropriate server. See
.
Default
No default.
No default.
No default.
no disable
No default.
No default.
html
No default.
No default.
config
118 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
period_end <time_str>
<date_str>
Description
Enter the time and date that define the
end of the span of time whose log messages you want to use when generating the report.
The time format is hh:mm and the date format is yyyy/mm/dd
, where: l hh is the hour according to a 24-hour clock l mm is the minute l yyyy is the year l mm is the month l dd is the day
This setting appears only when you select a period_ type of other.
period_last_n <n_int>
Enter the number that defines n if the period_type contains that variable. The valid range is from 1 to
2,147,483,647.
This setting appears only when you select a period_ type of last-n-days, last-n-hours, or last-nweeks
.
period_start <time_str>
<date_str>
Enter the time and date that defines the beginning of the span of time whose log messages you want to use when generating the report.
The time format is hh:mm and the date format is yyyy/mm/dd
, where: l l l l l hh is the hour according to a 24-hour clock mm is the minute yyyy is the year mm is the month dd is the day
This setting appears only when you select a period_ type of other.
log reports
Default
No default.
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
119
log reports
Variable Description
period_type
{last-14-days | last-2-weeks | last-30days | last-7-days | lastmonth | last-n-days | last-n-hours | last-nweeks | last-quarter | last-week | other | this-month | this-quarter | this-week | this-year | today | yesterday}
Select the span of time whose log messages you want to use when generating the report.
If you select last-n-days, last-n-hours, or lastnweeks
, you must also define n by entering
If you select other, you must also define the start and end of the report’s time range by entering period_start and period_end.
The span of time will be included in the summary, if enabled. For information on enabling the summary, see
scope_include_summary {yes | no}
.
report_desc "<comment_ str>" report_title <title_ str>
Type a description of the report, if any, that you want to include in the report summary. If the text is more than one word or contains special characters, surround it with double quotes ( " ). The maximum length is 63 characters.
For information on enabling the summary, see
scope_ include_summary {yes | no}
.
Type a title, if any, that you want to include in the report summary. If the text is more than one word or contains special characters, enclose it in double quotes ( " ). The maximum length is 127 characters.
For information on enabling the summary, see
scope_ include_summary {yes | no}
.
Default
last-7days
No default.
No default.
config
120 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable Description
Report_attack_activity
{attacks-type attacks-url attacks-date-type attacks-month-type attacks-day-type attacks-hour-type attacks-type-dev attacks-dst-type attacks-dst-ip attacks-type-ip attacks-method-type attacks-cat attacks-policy attacks-day attacks-ts attacks-td attacks-proto attacks-date-severity attacks-month-severity attacks-day-severity attacks-hour-severity attacks-sessionid attacks-signature-id attacks-srccounty attacks-type-signatureid attacks-fortisandbox attacks-httphost attacks-username}
Type zero or more options to indicate which charts based upon attack logs to include in the report.
For example, to include “Attacks By Policy,” enter a list of charts that includes attacks-policy. To include “Top
Attacked HTTP Methods by Type,” enter a list of charts that includes attacks-method-type.
Report_event_activity
{ev-all ev-all-cat ev-all-type ev-crit-hour ev-crit-day ev-warn-hour ev-warn-day ev-info-hour ev-info-day ev-emer-hour ev-emer-day ev-aler-hour ev-aler-day ev-err-hour ev-err-day ev-noti-hour ev-noti-day ev-hour ev-hour-cat ev-day ev-day-cat ev-stat}
Type zero or more options to indicate which charts based upon event logs to include in the report.
For example, to include “Top Event Categories by Status”, enter a list of charts that includes ev-status.
log reports
Default
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
121
log reports
Variable Description
Report_traffic_activity
{net-pol net-srv net-src net-dst net-src-dst net-dst-src net-date-dst net-hour-dst net-day-dst net-month-dst net-date-src net-hour-src net-day-src net-month-src netsrccountry net-httphost net-username}
Type zero or more options to indicate which charts based upon traffic logs to include in the report.
For example, to include “Top Sources By Day of Week”, enter a list of charts that includes net-day-src.
Default
No default.
Report_pci_activity
{pci-attacks-date-type pci-attacks-day-type pci-attacks-hour-type pci-attacks-month-type}
Type zero or more options to indicate which charts based upon
PCI attack logs to include in the report.
No default.
schedule_type {daily | dates | days | none}
Select when the FortiWeb appliance will automatically run the report. If you reboot the FortiWeb appliance while the report is being generated, report generation resumes after the boot process is complete.
If schedule_type is daily, dates or days, specify the schedule_time, schedule_days, or schedule_dates when the report will be generated.
If schedule_type is none, the report will be generated only when you manually initiate it.
none schedule_days {sun | mon | tue | wed | thu | fri | sat}
If schedule_type is days, select the day of the week when the report should be generated.
No default.
schedule_dates <dates_ str> schedule_time <time_ str>
If schedule_type is dates, select the specific date of the month, from 1 to 31, when the report should be generated.
Separate multiple dates with spaces.
If schedule_type is not none, select the time of day when the report should be run.
The time format is hh:mm, where: l hh is the hour according to a 24-hour clock l mm is the minute
No default.
00:00 config
122 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config log reports
Variable
scope_include_summary
{yes | no}
Description Default
Enter yes to include a summary section at the beginning of the report. The summary includes: l l l l l
<report_name> custom_company "<org_str>"
the date and time when the report was generated using this profile the span of time whose log messages were used to generate the report, according to period_type yes scope_include_table_of_ content {yes | no}
Enter yes to include a table of contents at the beginning of the report. The table of contents includes links to each chart in the report.
yes scope_top1 <topX_int>
Enter
x number of items (up to 30) to include in the first cross-section of ranked reports.
For some report types, you can set the top ranked items for the report. These reports have “Top” in their name, and will always show only the top
x entries. Reports that do not include “Top” in their name show all information.
Changing the values for top field will not affect these reports.
6 scope_top2 <topY_int>
3 Enter y number of items (up to 30) to include in the second cross-section of ranked reports.
For some report types, you can set the number of ranked items to include in the report. These reports have “Top” in their name, and will always show only the top
x entries.
Some report types have two levels of ranking: the top
y
sub-entries for each top x entry.
Reports that do not include “Top” in their name show all information. Changing the values for top field will not affect these reports.
Example
This example configures a report to be generated every Saturday at 1 PM. The report, whose title is “Report 1”, includes all available charts, and covers the last 14 days’ worth of event, traffic, and attack logs. However, it only uses logs where the source IP address was 172.16.1.20. Each time it is generated, it will be saved to the hard disk in both HTML and PDF file formats and will be sent by email in PDF format to recipients defined within the
“Log report analysis” email policy.
config log reports edit "Report_1" set Report_attack_activity attacks-type attacks-url attacks-date-type attacks-monthtype attacks-day-type attacks-hour-type attacks-type-dev attacks-dst-type
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
123
log sensitive config attacks-dst-ip attacks-type-ip attacks-method-type attacks-cat attacks-policy attacks-day attacks-ts attacks-td attacks-proto attacks-date-severity attacksmonth-severity attacks-day-severity attacks-hour-severity attacks-sessionid attacks-signature-id attacks-srccounty attacks-type-signature-id set Report_event_activity ev-all ev-all-cat ev-all-type ev-crit-hour ev-crit-day evwarn-hour ev-warn-day ev-info-hour ev-info-day ev-emer-hour ev-emer-day ev-alerhour ev-aler-day ev-err-hour ev-err-day ev-noti-hour ev-noti-day ev-hour evhour-cat ev-day ev-day-cat ev-stat set Report_traffic_activity net-pol net-srv net-src net-dst net-src-dst net-dst-src net-date-dst net-hour-dst net-day-dst net-month-dst net-date-src net-hour-src net-day-src net-month-src set custom_company "Example, Inc." set custom_footer_options custom set custom_header "A fictitious corporation." set custom_title_logo "titlelogo.jpg" set filter_string "(and src==\'172.16.1.10\')" set include_nodata yes set output_file html pdf set output_email html set output_email_policy log_report_analysis set period_type last-n-days set report_desc "A sample report." set report_title "Report 1" set schedule_type days set custom_footer "Weekly report for Example, Inc." set period_last_n 14 set schedule_days sat end set schedule_time 01:00 next
Related topics
l
l
l
l
log sensitive
Use this command to configure whether the FortiWeb appliance will obscure sensitive information, such as user names and passwords, in log messages for which packet payloads are enabled. Each packet payload has predefined sensitivity rules based on the payload data type. If needed, you can also create custom sensitivity rules to obscure other payload data types using
config log custom-sensitive-rule
This command is relevant only if you have enabled the FortiWeb appliance to keep packet payloads along with their associated log messages. For details, see
and
To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For more information, see
124 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config log siem-message-policy
Syntax
config log sensitive set
type {custom-rule | pre-defined-rule}
end
Variable Description
type {custom-rule | predefined-rule}
Select whether the FortiWeb appliance will obscure packet payloads according to predefined data types and/or custom data types.
See
config log custom-sensitive-rule
Default
No default.
Example
This example enables the FortiWeb appliance to use a custom sensitive rule to obscure packet payload information that displays information about users that are age 13 and under.
config log sensitive set type custom-rule end config log custom-sensitive-rule edit custom-sensitive-rule1 set type general-mask-rule end set expression "age\\=[1-13]*$" next
Related topics
l
config log custom-sensitive-rule
l
l
log siem-message-policy
Use this command to configure the FortiWeb appliance to send its log messages to one or more a remote
ArcSight SIEM (security information and event management) servers.
You must first define one or more SIEM policies using
.
Logs sent to the ArcSight server are controlled by SIEM policies and trigger actions that you configure on the
FortiWeb appliance, and are associated with various types of violations.
Usually, you should set trigger actions for specific types of violations. Failure to do so will result in the FortiWeb appliance logging every occurrence, which could result in high log volume and reduced system performance. Excessive logging for an extended period of time may cause premature hard disk failure.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
125
log siem-message-policy config
Logs stored remotely cannot be viewed from the web UI, and cannot be used by
FortiWeb to build reports. If you require these features, record logs locally as well as remotely.
Syntax
config log siem-message-policy set set
end set
analyzer-policy <fortianalyzer-policy_name>
Variable
siem-policy <policy_ name>
Description
Type the name of an existing SIEM policy to use when storing log information remotely. The maximum length is 35 characters.
To view a list of the existing SIEM policies, type: set siem-policy ?
severity {alert | critical | debug | emergency | error | information | notification | warning} status {enable | disable}
Select the severity level that a log message must meet or exceed in order to cause the FortiWeb appliance to save it to the ArcSight server.
Enable to record event log messages to the ArcSight server if it meets or exceeds the severity level specified by severity
.
Default
No default.
information disable
Example
This example enables ArcSight SIEM logging and recording of the log messages. Only the log messages with a severity of error or higher are recorded.
config log siem-message-policy set status enable end set severity error set siem-policy SIEM_Policy1
Related topics
l
126 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config log siem-policy
log siem-policy
Use this command to configure a connection to one or more ArcSight SIEM (security information and event management) servers, IBM QRadar servers or Azure Security Center (if your FortiWeb-VM is deployed on
Microsoft Azure).The policy is used by the log syslogd configuration to define the specific ArcSight server,
QRadar server or Azure Event Hub on which log messages are stored. For more information, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For more information, see
Syntax
config log siem-policy edit
config siem-server-list edit
end set next set set
type <arcsight-cef | qradar-leef | azure-cef> port <port_int> server <siem_ipv4>
end
Variable
<policy_name>
<entry_index> type <arcsight-cef | qradar-leef | azurecef> port <port_int> server <siem_ipv4>
Description
Type the name of a new or existing SIEM policy. The maximum length is 35 characters.
To display the list of existing policies, type: edit ?
Default
No default.
Enter the index number of the individual entry in the table.
The port where the ArcSight or QRadar server listens for log output.
No default.
Select whether this configuration connects to an ArcSight server, QRadar server or, if your appliance is deployed on
Azure, Azure Event Hub.
The Azure CEF policy type requires you to complete Azure event hub settings using the
CLI command.
arcsightcef
514
The IP address of the ArcSight or QRadar server.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
127
log syslogd config
Example
This example creates SIEM_Policy1. FortiWeb contacts the ArcSight server using its IP address,
192.168.1.10
. Communications occur over the standard port number for ArcSight, UDP port 514. The
FortiWeb appliance sends log messages to the server in CEF format.
config log siem-policy edit SIEM_Policy1 config siem-server-list edit 1 set type arcsight-cef set port 514 end set server 192.168.1.10
next end
Related topics
l
l
l
log syslogd
Use this command to configure the FortiWeb appliance to send log messages to a Syslog server defined by the
command.
For improved performance, unless necessary, avoid logging highly frequent log types.
While logs sent to your Syslog server do not persist in FortiWeb’s local RAM, FortiWeb still must use bandwidth and processing resources while sending the log message.
To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For more information, see
Syntax
config log syslogd set
set
set
end set
128 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config log syslog-policy
Variable
status {enable | disable}
Description
Enable to send log messages to the Syslog server defined by
. Also configure facility
, policy and severity.
facility {alert | audit | auth | authpriv | clock | cron | daemon | ftp | kernel | local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7 | mail | ntp | user}
Type the facility identifier that the FortiWeb appliance will use to identify itself when sending log messages to the first Syslog server.
To easily identify log messages from the FortiWeb appliance when they are stored on the Syslog server, enter a unique facility identifier, and verify that no other network devices use the same facility identifier.
severity {alert | critical | debug | emergency | error | information | notification | warning}
Select the severity level that a log message must meet or exceed in order to cause the FortiWeb appliance to send it to the first Syslog server.
policy <syslogdpolicy_name>
If logging to a Syslog server is enabled, type the name of a Syslog policy which describes the Syslog server to which the log message will be sent. The maximum length is 35 characters.
For more information on Syslog policies, see
.
Default
disable local7 information
No default.
Example
This example enables storage of log messages with the notification severity level and higher on the Syslog server. The network connections to the Syslog server are defined in Syslog_Policy1. The FortiWeb appliance uses the facility identifier local7 when sending log messages to the Syslog server to differentiate its own log messages from those of other network devices using the same Syslog server.
config log syslogd set status enable set severity notification set facility local7 end set policy Syslog_Policy1
log syslog-policy
Use this command to configure a connection to one or more Syslog servers. Each policy can specify connections for up to three Syslog servers. The log syslogd configuration uses the policy to define the specific Syslog server or servers on which log messages are stored. For more information, see
.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
129
log syslog-policy config
To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For more information, see
Syntax
config log syslog-policy edit
config log-server-list edit
set set
csv {enable | disable} port <port_int>
set
end end next
Variable
<policy_name>
<entry_index> csv {enable | disable} port <port_int> server <syslog_ipv4>
Description
Type the name of a new or existing Syslog policy. The maximum length is 35 characters.
The name of the report profile will be included in the report header.
To display the list of existing policies, type: edit ?
Default
No default.
Enter the index number of the individual entry in the table.
You can create up to 3 connections.
No default.
Enable if the Syslog server requires the FortiWeb appliance to send log messages in comma-separated value (CSV) format, instead of the standard Syslog format.
disable
Type the port number on which the Syslog server listens. The valid range is from 1 to 65,535.
Type the IP address of the Syslog server.
514
No default.
Example
This example creates Syslog_Policy1. The Syslog server is contacted by its IP address, 192.168.1.10.
Communications occur over the standard port number for Syslog, UDP port 514. The FortiWeb appliance sends log messages to the Syslog server in CSV format.
config log syslog-policy edit Syslog_Policy1 config log-server-list edit 1 set server 192.168.1.10
set port 514
130 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config end set csv enable end next
Related topics
l
l
l
log traffic-log
log traffic-log
Use this command to have the FortiWeb appliance record traffic log messages on its local disk. This command also lets you save packet payloads with the traffic logs.
You must enable disk log storage and select log severity levels using the
command before any traffic logs are stored on disk.
Packet payloads supplement the log message by providing the actual data associated with the traffic log, which may help you to analyze traffic patterns.
You can view packet payloads in the
Packet Log column when viewing a traffic logs using the web UI. For details, see the
FortiWeb Administration Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For more information, see
Syntax
config log traffic-log set set
packet-log {enable | disable} status {enable | disable}
end
Variable
status {enable | disable} packet-log {enable | disable}
Description
Enable to record traffic log messages if disk log storage is enabled, and the logs meet or exceed the severity levels selected using
Enable to keep packet payloads stored with their associated traffic log message.
For information on obscuring sensitive information in packet payloads, see
message-event {enable | disable}
Default
disable disable disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
131
log trigger-policy config
Example
This example enables disk log storage, sets information as the minimum severity level that a log message must achieve for storage, enables recording of traffic logs and retention of all packet payloads along with the traffic logs.
config log disk set status enable end set severity information config log traffic-log set status enable end set packet-log enable
Related topics
l
l
l
l
l
diagnose debug application miglogd
l
log trigger-policy
Use this command to configure a trigger policy for use in the notification process.
You apply trigger policies to individual conditions that have an associated action and severity, such as attacks and rule violations. A trigger policy has the following components: l l l an email policy (contains the details associated with the recipient email account) a Syslog policy (contains details required to communicate with the Syslog server) a FortiAnalyzer policy (contains the IP address of the remote FortiAnalyzer appliance)
The trigger policy determines whether an email is sent to administrators when a certain condition occurs and whether the log messages associated with the condition are stored on a Syslog server or FortiAnalyzer.
You define the email, Syslog, and FortiAnalyzer policies before you apply the trigger policy to an individual condition. For more information, see
, and
config log fortianalyzer-policy
To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For more information, see
Syntax
config log trigger-policy edit
set
email-policy <email-policy_name>
set
syslog-policy <syslog-policy_name>
132 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config end next
Variable
set set
analyzer-policy <fortianalyzer-policy_name> siem-policy <siem-policy_name>
Description
<trigger-policy_name>
Type the name of a new or existing trigger policy. The maximum length is 35 characters.
email-policy <emailpolicy_name>
Type the name of the email policy to be used with the trigger policy. The maximum length is 35 characters.
If the conditions associated with the trigger policy occur, the email policy determines the recipients of the notification email messages associated with the condition.
For more information, see
syslog-policy <syslogpolicy_name> analyzer-policy
<fortianalyzer-policy_ name>
Type the name of the Syslog policy to be used with the trigger policy. The maximum length is 35 characters.
If the conditions associated with the trigger policy occur, the Syslog policy determines which Syslog server the messages are sent to.
For more information, see
Type the name of an existing FortiAnalyzer policy to be used with the trigger policy. The maximum length is 35 characters.
See
config log fortianalyzer-policy
siem-policy <siempolicy_name>
Type the name of an existing SIEM policy to be used with the trigger policy. The maximum length is 35 characters.
See
log trigger-policy
Default
No default.
No default.
No default.
No default.
No default.
Example
This example creates Trigger_policy1, which uses emailpolicy1 to send email notifications about the condition to specific recipients, and Syslog_Policy1 to submit the log messages to a specific Syslog server.
config log trigger-policy edit Trigger_policy1 set syslog-policy Syslog_Policy1 set email-policy emailpolicy1 end next
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
133
router policy
Related topics
l
l
l
config log fortianalyzer-policy
l
l
config waf http-protocol-parameter-restriction
l
router policy
Use this command to configure policy routes that redirect traffic away from a static route.
For example, you can divert traffic for intrusion protection scanning (IPS). It is also useful if your FortiWeb protects web servers for different customers (for example, the clients of a Managed Security Service Provider).
Policy routes can direct traffic to a specific network interface and gateway based on the packet’s source and destination IP address.
Syntax
config router policy edit
set iif set
<incoming_interface_name> src <source_ip>
set
set oif
set set end next
gateway <router_ip> priority <priorty_int>
Variable
<policy_index>
<incoming_interface_ name> src <source_ip>
Description
Enter the index number of the policy route.
The valid range is from 1 to 4,294,967,295.
Enter the name of the interface, such as port1, on which
FortiWeb receives packets it applies this routing policy to.
Enter the source IP address and netmask to match, separated with a space.
FortiWeb routes matching traffic through the specified interface and gateway.
Default
No default.
No default.
0.0.0.0
0.0.0.0
config
134 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config router setting
Variable
dst <destination_ip>
<outgoing_interface_ name> gateway <router_ip> priority <priorty_int>
Description
Enter the destination IP address and netmask to match, separated with a space.
FortiWeb routes matching traffic through the specified interface and gateway.
Enter the name of the interface, such as port2, through which FortiWeb routes packets that match the specified IP address information.
Enter the IP address of a next-hop router.
A gateway address is not required for the particular routing policies used as static routes in an one-arm topology, see
Notice for using policy route in an one-arm
topology in
FortiWeb Administration Guide
. Please leave this blank for one-arm topology.
Enter a value between 1 and 200 that specifies the priority of the route.
When packets match more than one policy route, FortiWeb directs traffic to the route with the lowest value.
Default
0.0.0.0
0.0.0.0
No default.
0.0.0.0
200
Related topics
l
l
router setting
Use this command to change how FortiWeb handles non-HTTP/HTTPS traffic (for example, SSH and FTP) when it is operating in reverse proxy mode.
When this setting is disabled (the default) and FortiWeb is operating in reverse proxy mode, the appliance drops any non-HTTP/HTTPS traffic.
When this setting is enabled and FortiWeb is operating in reverse proxy mode, the appliance handles non-
HTTP/HTTPS protocols in the following ways: l l
Any non-HTTP/HTTPS traffic destined for a virtual server on the appliance is dropped.
For any non-HTTP/HTTPS traffic destined for another destination (for example, a back-end server), FortiWeb acts as a router and forwards it based in its destination address.
This command has no effect when FortiWeb is operating in transparent modes, which allow and forward non-
HTTP/HTTPS packets by default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
135
router setting config
Use this setting only if necessary. For security and performance reasons, if you have a FortiGate with an Internet/public address virtual IP (VIP) that forwards traffic to your FortiWeb, and your FortiWeb is on the same subnet as your web servers, do not use this setting. Instead, configure the VIP to forward: l only HTTP/HTTPS to FortiWeb, which forwards it to your servers l specific traffic such as SSH or SFTP directly to your servers
This avoids latency related to an extra hop. It also avoids accidentally forwarding unscanned protocols.
Routing is best effort. Not all protocols may be supported, such as Citrix Receiver
(formerly ICA).
FortiWeb appliances are designed to provide in-depth protection specifically for the HTTP and HTTPS protocols.
Because of this, when in reverse proxy mode, by default, FortiWeb does not forward non-HTTP/HTTPS
protocols to your protected web servers. (That is, IP-based forwarding is disabled. Traffic is only forwarded if picked up and scanned by the HTTP reverse proxy.) This provides a secure default configuration by blocking traffic to services that might have been unintentionally left open and should not be accessible to the general public.
In some cases, however, a web server provides more services, not just HTTP or HTTPS. A typical exception is a server that also allows SFTP and SSH access. In these cases, enable routing to allow FortiWeb to route the non-
HTTP/HTTPS traffic to the server using the server’s IP address. For HTTP/HTTPS services, direct traffic to the IP address of the FortiWeb virtual server, which forwards requests to the back-end server after inspection.
This command has no equivalent in the web UI.
Use the following commands to retrieve information about current static route values: config router setting get route static end
Use the following commands to view the current value of ip-forward: config router setting get route setting end
To use this command, your administrator account’s access control profile must have either w or rw permission to the netgrp area. For more information, see
Syntax
config router setting set
set
ip6-forward {enable | disable}
end
Variable
ip-forward {enable | disable}
Description
Enable to forward non-HTTP/HTTPS traffic if its IPv4 IP address matches a static route.
Default
disable
136 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
ip6-forward {enable | disable}
Description
Enable to forward non-HTTP/HTTPS traffic if its IPv6 IP address matches a static route.
router static
Default
disable
Example
This example enables forwarding of non-HTTP/HTTPS traffic, based upon whether the IP address matches a route for the web servers’ subnet, and regardless of HTTP proxy pickup.
config router setting end set ip-forward enable
Related topics
l
l
l
router static
Use this command to configure static routes, including the default gateway.
Static routes direct traffic existing the FortiWeb appliance — you can specify through which network interface a packet will leave, and the IP address of a next-hop router that is reachable from that network interface. The router is aware of which IP addresses are reachable through various network pathways, and can forward those packets along pathways capable of reaching the packets’ ultimate destinations.
A default route is a special type of static route. A default route matches all packets, and defines a gateway router that can receive and route packets if no more specific static route is defined for the packet’s destination IP address.
During installation and setup, you should have configured at least one static route, a default route, that points to your gateway. You may configure additional static routes if you have multiple gateway routers, each of which should receive packets destined for a different subset of IP addresses.
For example, if a web server is directly attached to one of the network interfaces, but all other destinations, such as connecting clients, are located on distant networks such as the Internet, you might need to add only one route: a default route for the gateway router through which the FortiWeb appliance connects to the Internet.
The FortiWeb appliance examines the packet’s destination IP address and compares it to those of the static routes. If more than one route matches the packet, the FortiWeb appliance applies the route with the smallest index number. For this reason, you should give more specific routes a smaller index number than the default route.
To use this command, your administrator account’s access control profile must have either w or rw permission to the netgrp area. For more information, see
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
137
router static config
Syntax
config router static edit
set
set set end next
dst <destination_ip> gateway <router_ip>
Variable
<route_index> device <interface_name> dst <destination_ip> gateway <router_ip>
Description
Type the index number of the static route. If multiple routes match a packet, the one with the smallest index number is applied. The valid range is from 1 to 4,294,967,295.
Type the name of the network interface device, such as port1
, through which traffic subject to this route will be outbound. The maximum length is 35 characters.
Enter the destination IP address and netmask of traffic that will be subject to this route, separated with a space.
To indicate all traffic regardless of IP address and netmask (that is, to configure a route to the default gateway), enter 0.0.0.0 0.0.0.0. or ::/0.
Enter the IP address of a next-hop router.
Caution: The gateway IP address must be in the same subnet as the interface’s IP address. If you change the interface’s IP address later, the new IP address must also be in the same subnet as the interface’s default gateway address. Otherwise, all static routes and the default gateway will be lost.
Default
No default.
No default.
0.0.0.0
0.0.0.0
0.0.0.0
Example
This example configures a default route that forwards all packets to the gateway router 192.168.1.1, through the network interface named port1.
config router static edit 0 set dst 0.0.0.0 0.0.0.0
set gateway 192.168.1.1
end set device port1 next
138 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy allow-hosts
Related topics
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
server-policy allow-hosts
Use this command to configure protected host groups.
A protected host group contains one or more IP addresses and/or fully qualified domain names (FQDNs). Each entry in the protected host group defines a virtual or real web host, according to the Host: field in the HTTP header of requests from clients, that you want the FortiWeb appliance to protect.
For example, if your web servers receive requests with HTTP headers such as:
GET /index.php HTTP/1.1
Host: www.example.com
you might define a protected host group with an entry of www.example.com and select it in the policy. This would reject requests that are not for that host.
A protected hosts group is usually not the same as a physical server.
Unlike a physical server, which is a single IP at the network layer, a protected host group should contain
all
network IPs, virtual IPs, and domain names that clients use to access the web server at the application (HTTP) layer.
For example, clients often access a web server via a public network such as the Internet. Therefore the protected host group contains domain names, public IP addresses, and public virtual IPs on a network edge router or firewall that are routable from that public network. But the physical server is only the IP address that the
FortiWeb appliance uses to forward traffic to the server and, therefore, is often a
private network address (unless the FortiWeb appliance operates in offline protection or either of the transparent modes).
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
139
server-policy allow-hosts config
Protected host groups can be used by: l l l l l l l l l l policies input rules server protection exceptions start page rules page access rules
URL access rules allowed method exceptions
HTTP authentication rules hidden fields rules many others
Rules can use protected host definitions to apply rules only to requests for a protected host. If you do not specify a protected host group in the rule, the rule will be applied based upon other criteria such as the URL, but regardless of the Host: field.
Policies can use protected host definitions to block connections that are not destined for a protected host. If you do not select a protected host group in a policy, connections will be accepted or blocked regardless of the Host: field.
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy allow-hosts edit
set
config host-list edit
set set end next end next
action {allow | deny} host {<host_ipv4> | <host_fqdn> | <host_ipv6>}
Variable
<protected-hosts_name> default-action {allow | deny}
Description
Type the name of a new or existing group of protected hosts.The maximum length is 35 characters.
To display the list of existing groups, type: edit ?
Default
No default.
Select whether to accept or deny HTTP requests whose Host: field does
not match any of the host definitions that you will add to this protected hosts group.
allow
140 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy allow-hosts
Variable
<protected-host_index> action {allow | deny} host {<host_ipv4> |
<host_fqdn> | <host_ ipv6>}
Description Default
Type the index number of a protected host within its group. The valid range is from 1 to 9,223,372,036,854,775,807. Each hostlist can contain up to 64 IP addresses and/or fully qualified domain names (FQDNs).
No default.
Select whether to accept or deny HTTP requests whose Host: field matches the host definition in
host {<host_ipv4> | <host_ fqdn> | <host_ipv6>} .
allow
Type the IP address or FQDN of a virtual or real web host, as it appears in the Host: field of HTTP headers, such as www.example.com
. The maximum length is 255 characters.
If clients connect to your web servers through the IP address of a virtual server on the FortiWeb appliance, this should be the IP address of that virtual server or any domain name to which it resolves, not the actual IP address of the web server.
For example, if a virtual server 10.0.0.1/24 forwards traffic to the physical server 192.168.1.1, for protected hosts, you would enter: l
10.0.0.1
, the address of the virtual server l www.example.com
, the domain name that resolves to the virtual server
No default.
Example
This example configures a protected hosts group named example_com_hosts that contains a web site’s domain names and its IP address in order to match HTTP requests regardless of which form they use to identify the host.
config server-policy allow-hosts set default-action deny edit example_com_hosts config host-list edit 0 set host example.com
next edit 1 set host www.example.com
next edit 2 end end next set host 10.0.0.1
next
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
141
server-policy custom-application application-policy config
Related topics
l
l
config waf allow-method-exceptions
l
config server-policy custom-application application-policy
l
l
l
l
l
server-policy custom-application application-policy
Some web applications build URLs differently than expected by FortiWeb, which causes FortiWeb to create incorrect auto-learning data.
To solve this kind of problem, FortiWeb uses application policy plug-ins that recognize the non-standard application URLs so that the auto-learning profile can work properly.
First create a URL interpreter (see
config server-policy custom-application url-replacer
and then use this command to create an application policy to use it.
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy custom-application application-policy edit
analyzer-policy <fortianalyzer-policy_name>
config rule-list edit
set set end next end next
Variable
<policy_name>
Description
Type the name of a new or existing application policy.
The maximum length is 35 characters.
To display the list of existing policies, type: edit ?
Default
No default.
142 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy custom-application url-replacer
Variable
<entry_index> plugin-name <urlreplacer_name> type {URL_Replacer}
Description
Type the index number of the individual rule in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
Default
No default.
Type the name of an existing URL interpreter. The maximum length is 35 characters.
No default.
Type the name of the plug-in type. (Currently, only the URL_
Replacer option is supported.)
URL_
Replacer
Example
This example adds two existing URL replacer plug-ins to an application policy.
config server-policy custom-application application-policy edit replacer-policy1 config rule-list edit 1 set plugin-name url-replacer1 next edit 2 set plugin-name url-replacer2 end next end next
Related topics
l
config server-policy custom-application application-policy
l
config waf web-protection-profile autolearning-profile
server-policy custom-application url-replacer
When web applications have dynamic URLs or unusual parameter styles, you
must adapt auto-learning to recognize them.
By default, auto-learning assumes that your web applications use the most common URL structure:
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
143
server-policy custom-application url-replacer config l l l
All parameters follow a question mark ( ? ). They do not follow a hash ( # ) or other separator character.
If there are multiple name-value pairs, each pair is separated by an
ampersand ( & ). They are not separated by a semi-colon ( ; ) or other separator character.
All paths before the question mark ( ? ) are static — they do not change based upon input, blending the path with parameters (sometimes called a dynamic URL).
For example, the page at:
/app/main always has that same path. After a person logs in, the page’s URL
doesn’t become:
/app/marco/main or
/app#deepa
For another example, the URL does
not dynamically reflect inventory, such as:
/app/sprockets/widget1024894
Some web applications, however, embed parameters within the path structure of the URL, or use unusual or nonuniform parameter separator characters.
If you do not configure URL replacers for such applications, it
can cause your FortiWeb appliance to gather auto-learning data incorrectly. This can cause the following symptoms: l l l l
Auto-learning reports do not contain a correct URL structure.
URL or parameter learning is endless.
When you generate a protection profile from auto-learning, it contains many more URLs than actually exist, because auto-learning cannot predict that the URL is actually dynamic.
Parameter data is not complete, despite the face that the FortiWeb appliance has seen traffic containing the parameter.
For example, with Microsoft Outlook Web App (OWA), the user’s login name could be embedded within the path structure of the URL, such as:
/owa/ tom/index.html
/owa/ mary/index.html
instead of suffixed as a parameter, such as:
/owa/index.html
?username=tom
/owa/index.html
?username=mary
Auto-learning would continue to create new URLs as new users are added to OWA. Auto-learning would also expend extra resources learning about URLs and parameters that are actually the same. Additionally, autolearning may not be able to fully learn the application structure, as each user may not request the same URLs.
To solve this, you would use this command and
config server-policy custom-application application-policy
to apply a URL replacer that recognizes the user name within the OWA URL as if it were a standard, suffixed parameter value so that auto-learning can function properly.
For example, if the URL is:
/application/value and the URL replacer settings are:
144 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy custom-application url-replacer
Setting name
type {pre-defined | custom-defined} url "<original-url_str>"
new-url <new-url_str> param <value_str> new-param <replaced-param_name>
Value
custom-defined
(/application/)([^/]+\\.[^/]+)
$0
$1 setting then the URL will be interpreted by auto-learning as:
/application?setting=value
To apply interpret non-standard URLs:
1. Create the custom URL replacer.
2. Add the URL replacer to a custom application policy see
config server-policy customapplication application-policy
).
4. Finally, apply the auto-learning profiles in a server policy (see
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy custom-application url-replacer edit
server-policy custom-application url-replacer
set
type {pre-defined | custom-defined}
set
set
set set
new-url <new-url_str> param <value_str> new-param <replaced-param_name>
end set next
Variable
<interpreter_name>
Description
Type the name of a new or existing URL interpreter. The maximum length is 35 characters.
To display the list of existing URL interpreter, type: edit ?
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
145
server-policy custom-application url-replacer
Variable
type {pre-defined | custom-defined}
Description
Select either: l pre-defined
— Use one of the predefined URL replacers for well-known web applications, which you select in
l custom-defined
— Define your own URL replacer by configuring
,
,
, and
Default
predefined app-type {jsp | owa-
2003}
If type is pre-defined, select which predefined URL interpreter to use, either: l jsp
— Use the URL replacer designed for Java server pages (JSP) web applications, where parameters are often separated by semi-colons ( ; ).
l owa-2003
— User the URL replacer designed for
Microsoft Outlook Web App (OWA) 2003, where user name and directory parameters are often embedded in the URL.
jsp url "<original-url_str>"
Type a regular expression, such as ^/(.*)/(.*)$, matching
all and only the URLs to which the URL replacer should apply.
The pattern does not require a backslash ( / ). However, it must at least match URLs that begin with a slash as they appear in the HTTP header, such as /index.html. Do not include the domain name, such as www.example.com
.
This setting is used only if type is custom-defined.
The maximum length is 255 characters.
Note: Auto-learning consider URLs up to approximately
180 characters long (assuming single-byte character encoding, after FortiWeb has decoded any nested hexadecimal or other URL encoding — therefore, the limit is somewhat dynamic). If the URL is greater than that buffer size, auto-learning will not be able to learn it, and so will ignore it. No event log will be created in this case.
Note: If this URL replacer will be used sequentially in its set of URL replacers, instead of being mutually exclusive, this regular expression should match the URL produced by the previous interpreter,
not the original URL from the request.
No default.
config
146 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
new-url <new-url_str> param <value_str> new-param <replacedparam_name>
Description
server-policy custom-application url-replacer
Default
No default.
Type either a literal URL, such as /index.html, or a regular expression with a back-reference (such as /$1) defining how the URL will be interpreted.
This setting is used only if type is custom-defined.
The maximum length is 255 characters.
Note: Back-references can only refer to capture groups
(parts of the expression surrounded with parentheses) within the same URL replacer. Back-references
cannot
refer to capture groups in other URL replacers.
Type either the parameter’s literal value, such as user1
, or a back-reference (such as /$0) defining how the value will be interpreted.
This setting is used only if type is customdefined
. The maximum length is 255 characters.
Type either the parameter’s literal name, such as username
, or a back-reference (such as $2) defining how the parameter’s name will be interpreted in the auto-learning report.
This setting is used only if type is customdefined
. The maximum length is 255 characters.
Note: Back-references can only refer to capture groups (parts of the expression surrounded with parentheses) within the same URL replacer. Backreferences
cannot refer to capture groups in other
URL replacers.
No default.
No default.
Example
This example assumes the HTTP request URL from a client is /mary/login.asp. The URL replacer interprets the URL to be /login.asp?username=mary.
config server-policy custom-application url-replacer edit url-replacer1 set type custom-defined set url ^/(.*)/(.*)$ set new-url /$1 set param $0 set new-param username end next
Related topics
l
config server-policy custom-application application-policy
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
147
server-policy health config
server-policy health
Use this command to configure server health checks.
Tests for server responsiveness (called “server health checks” in the web UI) poll web servers that are members of a server pool to determine their availability before forwarding traffic. Server health checks can use TCP,
HTTP/HTTPS, ICMP ECHO_REQUEST (ping), TCP SSL, or TCP half-open.
The FortiWeb appliance polls the server at the frequency set in the
option. If the appliance does not receive a reply within the timeout period, and you have configured the health check to retry, it attempts a health check again; otherwise, the server is deemed unresponsive. The FortiWeb appliance reacts to unresponsive servers by disabling traffic to that server until it becomes responsive.
If a back-end server will be unavailable for a long period, such as when a server is undergoing hardware repair, it is experiencing extended downtime, or when you have removed a server from the server pool, you can improve the performance of your
FortiWeb appliance by disabling the back-end server, rather than allowing the server health check to continue to check for responsiveness. For details, see
config server-policy server-pool
To apply server health checks, select them in a server pool configuration. For details, see
config serverpolicy server-pool
To use this command, your administrator account’s access control profile requires either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy health edit
set set
trigger-policy <trigger-policy_name> relationship {and |or}
configure health-list edit
set
type {icmp | tcp | http | https | tcp-ssl | tcp-half-open}
set set
set set set set set set set next
response-code {response-code_int} match-content {match-content_str}
end
148 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy health
Variable
<health-check_name>
Description
Type the name of the server health check. The maximum length is 35 characters.
To display the list of existing server health checks, type: edit ?
Default
No default.
trigger-policy
<trigger-policy_name> relationship {and |or} l and
— FortiWeb considers the server to be responsive when it passes all the tests in the list.
l or
— FortiWeb considers the server to be responsive when it passes at least one of the tests in the list.
and
<entry_index>
Type the name of the trigger to apply when the health check detects a failed server (see
). The maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
Type the index number of the individual rule in the table. The valid range is from 1 to 16.
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
149
server-policy health
Variable Description Default
type {icmp | tcp | http | https | tcp-ssl
| tcp-half-open} l icmp
— Send ICMP type 8 (ECHO_REQUEST) and listen for either ICMP type 0 (ECHO_RESPONSE) indicating responsiveness, or timeout indicating that the host is not responsive.
l tcp
— Send TCP SYN and listen for either TCP SYN
ACK indicating responsiveness, or timeout indicating that the host is not responsive.
l http
— Send an HTTP request and listen for the code specified by response-code, the page content specified by match-content, or both the code and the content, or timeout indicating that the host is not responsive.
ping
Apply to server pool members only if the SSL setting for the member is disabled.
l https
— Send an HTTPS request and listen for the code specified by response-code, the page content specified by match-content, or both the code and the content, or timeout indicating that the host is not responsive.
Apply to server pool members only if the
SSL setting for the member is enabled.
l tcp-ssl
— Send an HTTPS request. FortiWeb considers the host to be responsive if the SSL handshake is successful, and closes the connection once the handshake is complete. This type of health check requires fewer resources than http or https
.
timeout <seconds_int>
Apply to server pool members only if the SSL setting for the member is enabled.
l tcp-half-open
— Send TCP SYN and listen for either TCP SYN ACK indicating responsiveness, or timeout indicating that the host is not responsive. If the response is SYN ACK, send TCP RST to terminate the connection. This type of health check requires fewer resources from the pool member than tcp
.
Type the number of seconds which must pass after the server health check to indicate a failed health check.
The valid range is from 1 to 10 seconds.
3 config
150 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy health
Variable
retry-times <retries_ int>
Description
Type the number of times, if any, a failed health check will be retried before the server is determined to be unresponsive. The valid range is from 1 to 10 retries.
Default
3 interval <seconds_int>
Type the number of seconds between each server health check. The valid range is from 1 to 10 seconds.
10 url-path <request_str>
Type the URL, such as /index.html, that
FortiWeb uses in the HTTP/HTTPS request to verify the responsiveness of the server.
If the web server successfully returns this URL, and its content matches the expression specified by match-content, FortiWeb considers it to be responsive.
Available when type is http or https.
No default.
method {get | head | post}
Specify whether the health check uses the HEAD,
GET, or POST method.
Available when type is http or https.
get host <host_str>
Optionally, enter the HTTP host header name of a specific host.
This is useful if the pool member hosts multiple web sites (virtual hosting environment).
Available when type is http or https.
match-type {responsecode | match-content | all} l response-code
— If the web server successfully returns the URL specified by url-path and the code specified by response-code, FortiWeb considers the server to be responsive.
l match-content
— If the web server successfully returns the URL specified by url-path and its content matches the match-content value,
FortiWeb considers the server to be responsive.
l all
— If the web server successfully returns the
URL specified by url-path and its content matches the match-content value, and the code specified by response-code, FortiWeb considers the server to be responsive.
Available when type is http or https.
No default.
matchcontent
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
151
server-policy http-content-routing-policy config
Variable
response-code
{response-code_int} match-content {matchcontent_str}
Description
Enter the response code that you require the server to return to confirm that it is available, if match-type is response-code or all.
Available when type is http or https.
Enter a regular expression that matches the content that must be present in the HTTP reply to indicate proper server connectivity, if match-type is match-content or all. Available when type is http or https.
Default
200
No default.
Example
This example configures a server health check that periodically requests the main page of the web site, /index.
If a physical server does not successfully return that page (which contains the word “About”) every 10 seconds (the default), and fails the check at least three times in a row, FortiWeb considers it unresponsive and forwards subsequent HTTP requests to other physical servers in the server farm.
config server-policy health edit status_check1 set trigger-policy "notification-servers1" configure health-list edit 1 set type http set retry-times 3 set url-path "/index" set method get set match-type match-content set regular "About" end next
Related topics
l
config server-policy server-pool
l
l
server-policy http-content-routing-policy
Use this command to configure HTTP header-based routing.
Instead of dynamically routing requests to a server pool simply based upon load or connection distribution at the
TCP/IP layers, as basic load balancing does, you can forward them based on headers in the HTTP layer.
HTTP header-based routes define how FortiWeb routes requests to server pools. They are based on one or more of the following HTTP header elements:
152 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy http-content-routing-policy l l l l l l l l
Host
URL
Parameter
Referer cookie
Header
Source IP
X.509 certificate
This type of routing can be useful if, for example, a specific web server or group of servers on the back end support specific web applications, functions, or host names. That is, your web servers or server pools are not identical, but specialized. For example: l l l
192.168.0.1 — Hosts the web site and blog
192.168.0.2 and 192.168.0.3 — Host movie clips and multimedia
192.168.0.4 and 192.168.0.5 — Host the shopping cart
If you have configured request rewriting, configure HTTP content-based routing using the original request URL and/or Host: name, as it appears before FortiWeb has rewritten it. For more information on rewriting, see
config waf url-rewrite url-rewrite-policy
To apply your HTTP-based routes, select them when you configure the server policy (see
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy http-content-routing-policy edit
set
server-pool <server-pool_name>
config content-routing-match-list edit
set
set set set set set
set set end end next set set set next
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
153
server-policy http-content-routing-policy
Variable
<routing-policy_name>
Description
Type the name of the HTTP content routing policy. The maximum length is 63 characters.
To display the list of existing policies, type: edit ?
Default
No default.
server-pool <serverpool_name>
Type the name of the server pool to which FortiWeb forwards traffic when the traffic matches rules in this policy.
For more information, see
config server-policy server-pool
Type the index number of the individual rule in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
<entry_index> No default.
match-object {http-host
| http-request | urlparameter | http-referer
| http-cookie | httpheader | source-ip | x509-certificate-Subject
| x509-certificate-
Extension}
Type the type of object that FortiWeb examines for matching values: l http-host
— Host: field l http-request
— A URL l url-parameter
— A URL parameter and value l http-referer
— Referer: field l http-cookie
— A cookie name and value l http-header
— A header name and value l source-ip
— An IPv4 address or address range or IPv6 address or address range l x509-certificate-Subject
— A specified Relative
Distinguished Name (RDN) in the X509 certificate Subject field. Also specify x509-subject-name.
l x509-certificate-Extension
— Additional fields that the extensions field adds to the X509 certificate
No default.
config
154 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy http-content-routing-policy
Variable
match-condition {matchbegin | match-end | match-sub | matchdomain | match-dir | match-reg | ip-range | ip-range6 | equal}
Description
Type the type of value to match. Values can be a literal value that appears in the object or a regular expression.
The value of match-object determines which content types you can specify.
If match-object is http-host, http-request, http-referer
, or x509-certificate-
Extension
: l match-begin
— The object to match begins with the specified string.
l match-end
— The object to match ends with the specified string.
l match-sub
— The object to match contains the specified string.
l equal
— The object to match is the specified string.
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
155
server-policy http-content-routing-policy
Variable Description
If match-object is http-host only: l match-domain
— The object to match contains the specified string between the periods in a domain name.
For example, if match-expression is abc, the condition matches the following hostnames: dname1.abc.com
dname1.dname2.abc.com
However, the same Match Simple String value does not match the following hostnames:
Default
abc.com
dname.abc
If match-object is http-request : l match-dir
— The object to match contains the specified string between delimiting characters (slash) in a domain name.
For example, if match-expression is abc, the condition matches the following hostnames: test.com/abc/ test.com/dir1/abc/
However, the same match-string value does not match the following hostnames: test.com/abc test.abc.com
If match-object is source-ip : l ip-range
— The source IP to match is an IPv4 IP address or within a range of IPv4 IP addresses.
l ip-range6
— The source IP to match is an IPv6 IP address or within a range of IPv6 IP addresses.
If match-object is http-host, http-request, http-referer
, source-ip, or x509certificate-Extension
: l match-reg
— The object to match has a value that matches the specified regular expression.
No default.
config
156 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy http-content-routing-policy
Variable
x509-subject-name {E |
CN | OU | O | L | ST |
C}
Description
Enter the attribute type to match.
Available when match-object is x509-certificate-
Subject
.
Default
No default.
Specifies a value to match in the object element specified by match-object and match-condition.
Examples: match-expression <matchexpression_str> l
A literal URL, such as /index.php, that a matching HTTP request contains.
l
An expression, such as ^/*.php, that matches a URL.
Tip: When you enter a regular expression using the web
UI, you can validate its syntax.
name <name_str>
Type the name of the object to match. The value can be a literal value or a regular expression.
For example, the name of a cookie embedded by traffic controller software on one of the servers.
Available if match-object is url-parameter, http-cookie
, or http-header.
No default.
No default.
name-match-condition
{match-begin | match-end
| match-sub | match-reg
| equal}
Type the type of value to match. The value is specified by name and can be a literal value that appears in the object or a regular expression.
l match-begin
— The name to match begins with the specified string.
l match-end
— The name to match ends with the specified string.
l match-sub
— The name to match contains the specified string.
l equal
— The name to match is the specified string.
l match-reg
— The name to match matches the specified regular expression.
value <value_str>
Type the object value to match. The value can be a literal value or a regular expression.
Available if match-object is url-parameter, http-cookie
, or http-header.
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
157
server-policy http-content-routing-policy
Variable Description
value-match-condition
{match-begin | match-end
| match-sub | match-reg
| equal}
Type the type of value to match. The value is specified by value and can be a literal value or a regular expression.
l match-begin
— The value to match begins with the specified string.
l match-end
— The value to match ends with the specified string.
l match-sub
— The value to match contains the specified string.
l equal
— The value to match is the specified string.
l match-reg
— The value to match matches the specified regular expression.
start-ip <start_ip>
Type the first IP address in a range of IP addresses.
Available if match-condition is ip-range or ip-range6
.
Default
No default.
No default.
end-ip <end_ip>
Type the last IP address in a range of IP addresses.
Available if match-object is source-ip concatenate { and | or } l and
— A matching request matches this entry in addition to other entries in the HTTP content routing list.
l or
—A matching request matches this entry or other entries in the list.
No default.
and config
Example
This HTTP content routing policy routes requests for www.example.com/school to the server pool schoolsite
.
The content routing has three rules: one matches the host (www.example.com), a second matches the sessid cookie, and a third matches the /school URL. In combination, the first and third rules match the request for www.example.com/school.
config server-policy http-content-routing-policy edit "content_routing_policy1" set server-pool school-site config content-routing-match-list edit 1 set match-condition match-reg set match-expression www.example.com
next edit 2 set match-object http-cookie set name sessid set value hash[a-fA-F0-7]* set name-match-condition match-reg set value-match-condition match-reg next
158 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config end end next edit 3 set match-object http-request set match-expression /school next
Related topics
l
config server-policy server-pool
l
l
config waf url-rewrite url-rewrite-policy
server-policy pattern custom-data-type
server-policy pattern custom-data-type
Use this command to configure custom data types to augment the predefined data types. You can add custom data types to input rules to define the data type of an input, and to auto-learning profiles to detect valid input parameters.
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy pattern custom-data-type edit
<custom-data-type_name> expression <regex_pattern>
end set next
Variable
<custom-data-type_name> expression <regex_ pattern>
Description
Type the name of the custom data type. The maximum length is 35 characters.
To display the list of existing types, type: edit ?
Type a regular expression that defines the data type. It should match all data of that type, but nothing else. The maximum length is 2,071 characters.
Default
No default.
No default.
Example
This example configures two custom data types.
config server-policy pattern custom-data-type edit "Level 3 Password-custom" set expression "^aaa"
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
159
server-policy pattern custom-global-white-list-group end next edit "Custom Data Type 1" set expression "^555" next
Related topics
l
config server-policy pattern data-type-group
config
server-policy pattern custom-global-white-list-group
Use this command to configure objects that will be exempt from scans.
When enabled, whitelisted items are
not flagged as potential problems, nor incorporated into auto-learning data.
This feature reduces false positives and improves performance.
To include white list items during policy enforcement and auto-learning reports, you must first disable them in the global white list.
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy pattern custom-global-white-list-group edit
set
set
type {Cookie | Parameter | URL}
set
set set
name <name_str> path <url_str>
set set end next
request-type {plain | regular}
Variable
<entry_index>
Description
Type the index number of the individual rule in the table. The valid range is from 1 to 9,223,372,036,854,775,807.
status {enable | disable} type {Cookie |
Parameter | URL}
Enable to exempt this object from all scans.
Indicate the type of the object. Depending on your selection, the remaining settings vary.
URL
Default
No default.
enable
160 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy pattern custom-global-white-list-group
Variable
domain <cookie_fqdn> name <name_str> path <url_str> request-type {plain | regular}
Description
Type the partial or complete domain name or IP address as it appears in the cookie, such as: www.example.com
.google.com
10.0.2.50
If clients sometimes access the host via IP address instead of DNS, create white list objects for both.
This setting is available if type is set to Cookie.
Caution: Do not whitelist untrusted subdomains that use vulnerable cookies. It could compromise the security of that domain and its network.
Depending on your selection in
l type the name of the cookie as it appears in the HTTP request, such as NID.
l type the name of the parameter as it appears in the HTTP
URL or body, such as rememberme.
This setting is available if type is set to Cookie or
Parameter
.
Type the path as it appears in the cookie, such as / or
/blog/folder
.
This setting is available if type is set to Cookie.
Indicate whether the
field contains a literal URL (plain), or a regular expression designed to match multiple URLs (regular).
This setting is available if type is set to URL.
Default
No default.
No default.
No default.
plain
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
161
server-policy pattern custom-susp-url
Variable
request-file <url_str>
Description
Depending on your selection in the
request-type {plain | regular}
field, enter either: l the literal URL, such as /robots.txt, that the HTTP request must contain in order to match the rule. The URL must begin with a backslash ( / ).
l a regular expression, such as ^/*.html, matching all and only the URLs to which the rule should apply. The pattern does not require a slash ( / ); however, it must at match URLs that begin with a backslash, such as /index.html.
Do not include the domain name, such as www.example.com
.
This setting is available if type is set to URL.
Default
config
Example
This example exempts requests for robots.txt from most scans.
config server-policy pattern custom-global-white-list-group edit 1 end set request-file /robots.txt
next
Related topics
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile autolearning-profile
server-policy pattern custom-susp-url
Use this command to configure custom suspicious URL requests to augment the list of predefined suspicious
URL requests. You can add custom suspicious URLs to a custom suspicious URL rule.
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy pattern custom-susp-url edit
<custom-susp-url_name> expression <url_pattern>
end set next
162 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy pattern custom-susp-url-rule
Variable
<custom-susp-url_name>
Description
Type the name of the custom URL. The maximum length is 35 characters.
To display the list of existing URLs, type: edit ?
Default
No default.
expression <url_pattern>
Type either a simple string or a regular expression to defines the custom URL request to check for. The maximum length is 2,071 characters.
No default.
Example
This example configures a custom suspicious URL named Suspicious-URL 1 and defines the custom expression associated with that suspicious URL.
config server-policy pattern custom-susp-url edit "Suspicious URL 1" end set expression "^/schema.xml$" next
Related topics
l
config server-policy pattern suspicious-url-rule
server-policy pattern custom-susp-url-rule
Use this command to add one or more existing custom suspicious URLs to a custom suspicious URL rule.
Custom suspicious URL rules can augment the predefined suspicious URL rules. You can add custom suspicious
URL rules to input rules.
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy pattern custom-susp-url-rule edit
config type-list edit
set
custom-susp-url <suspicious-url_name>
end end next next
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
163
server-policy pattern data-type-group
Variable
<rule_name>
<entry_index> custom-susp-url
<suspicious-url_name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
Type the name of an existing custom URL already defined using
config server-policy pattern customsusp-url
. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Default
No default.
No default.
No default.
config
Example
This example configures a custom suspicious URL rule using an existing custom suspicious URL.
config server-policy pattern custom-susp-url-rule edit "Suspicious Rule 1" config type-list edit 1 end end next set custom-susp-url "Suspicious URL 1" next
Related topics
l
config server-policy pattern custom-susp-url
server-policy pattern data-type-group
Use this command to configure data type groups.
A data type group selects a subset of one or more predefined data types. Each of those entries in the data type group defines a type of input that the FortiWeb appliance should attempt to recognize and track in HTTP sessions when gathering data for an auto-learning profile.
For example, if you include the Email data type in the data type group, auto-learning profiles that use the data type group might discover that your web applications use a parameter named username whose value is an email address.
164 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy pattern data-type-group
If you know that your network’s HTTP sessions do not include a specific data type, omit it from the data type group to improve performance. The FortiWeb appliance will not expend resources scanning traffic for that data type.
Data type groups are used by auto-learning profiles. For details, see
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy pattern data-type-group edit
config type-list edit
set
data-type {Address | Canadian_Post_code | Canadian_Province_
Name | Canadian_SIN | China_Post_Code | Country_Name | Credit_
Card_Number | Danmark_Postalcode | Dates_and_Times | Email |
Code | Microsoft_product_key | NINO | Netherlands_Postcode |
Num | personal_name | Phone | Quebec_Postal_Code | String |
Swedish_personal_number | Swedish_Postalcode | UAE_land_phone |
UK_Bank_code | UK_postcode | US_SSN | US_State_Name | US_Street_
Address | US_Zip_Code | Unix_device_name | Uri | Windows_file_ name}
end next end next
Variable
<data-type-group_ name>
<entry_index>
Description
Type the name of the data type group. The maximum length is
35 characters.
To display the list of existing groups, type: edit ?
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
Default
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
165
server-policy pattern data-type-group
Variable Description Default
data-type
{Address |
Canadian_Post_ code | Canadian_
Province_Name |
Canadian_SIN |
China_Post_Code |
Country_Name |
Credit_Card_
Number | Danmark_
Postalcode | Dates_ and_Times | Email |
GPA | GUID | ip_ address | Indian_
Vehicle_Number |
Italian_mobile_ phone |
Kuwait_
Civil_ID | L1_
Password | L2_
Password | Markup_ or_Code |
Microsoft_product_ key | NINO |
Netherlands_
Postcode | Num | personal_name |
Phone | Quebec_
Postal_Code |
String | Swedish_ personal_number |
Swedish_
Postalcode | UAE_ land_phone | UK_
Bank_code | UK_ postcode | US_SSN |
US_State_Name | US_
Street_Address |
US_Zip_Code | Unix_ device_name | Uri |
Windows_file_name}
For each data-type entry, enter one of the following predefined data types exactly as shown (available options may vary due to FortiGuard updates): l
Address
— Canadian postal codes and United States ZIP code and ZIP + 4 codes.
l
Canadian_Post_code
— Canadian postal codes such as
K2H 7B8 or k2h7b8. Does not match hyphenations such as K2H-
7B8.
l
Canadian_Province_Name
— Modern and older names and abbreviations of Canadian provinces in English, as well as some abbreviations in French, such as Quebec, IPE, Sask, and Nunavut.
Does not detect province names in French, such as Québec.
l
Canadian_SIN
— Canadian Social Insurance Numbers (SIN) such as 123-456-789.
l
China_Post_Code
— Chinese postal codes such as 610000.
l
Country_Name
— Country names, codes, and abbreviations in
English characters, such as CA, Cote d’Ivoire, Brazil, Russian
Federation, Brunei, and Dar el Salam.
l
Credit_Card_Number
— American Express, Carte Blanche,
Diners Club, enRoute, Japan Credit Bureau (JCB), Master Card,
Novus, and Visa credit card numbers.
l
Danmark_Postalcode
— Danish postal code (“postnumre”) such as DK-1499 and dk-1000. Does not match codes that are not prefixed by “DK-”, nor numbers that do not belong to the range of valid codes, such as 123456 or dk 12.
l
Dates_and_Times
— Dates and times in various formats such as
+13:45 for time zone offsets, 1:01 AM, 1am, 23:01:01, and
01.01.30 AM for times, and 31.01.2009, 31/01/2009, 01/31/2000,
2009-01-3, 31-01-2009, 1-31-2009, 01 Jan 2009, 01 JAN 2009, 20-
Jan-2009 and February 29, 2009 for dates.
l
— Email addresses such as [email protected]
l
GPA
— A student’s grade point average, such as 3.5, based upon the 0.0-to-4.0 point system, where an “A” is worth 4 points and an
“F” is worth 0 points. Does not match GPAs weighted on the 5 point scale for honors, IB, or AP courses, such as 4.1. The exception is
5.5, which it will match.
l
GUID
— A globally unique identifier used to identify partition types in the hard disk’s master boot record (MBR), such as BFDB4D31-
3E35-4DAB-AFCA-5E6E5C8F61EA. Partition types are relevant on computers which boot via EFI, using the MBR, instead of an olderstyle BIOS.
No default.
config
166 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
server-policy pattern data-type-group
Description
l ip_address
— A public or private IPv4 address, such as 10.0.0.1.
Does not match IPv6 addresses.
l
Indian_Vehicle_Number
— An Indian Vehicle Registration
Number, such as mh 12 bj 1780.
l
Italian_mobile_phone
— Italian mobile phone numbers with the prefix for international calls, such as +393471234567, or without, such as 3381234567. Does not match numbers with a dash or space after the area code, nor VoIP or land lines.
l
Kuwait_Civil_ID
— Personal identification number for Kuwait, such as 273032401586. Must begin with 1, 2, or 3, and follow all other number patterns for valid civil IDs.
l
L1_Password
— A string of at least 6 characters, with one or more each of lower-case characters, upper-case characters, and digits, such as aBc123. Level 1 passwords are “weak” passwords, generally easier to crack than level 2 passwords.
l
L2_Password
— A strong password — string of at least 8 characters, with one or more each of lower-case characters, uppercase characters, digits, and special characters, such as aBc123$%.
l
Markup_or_Code
— HTML comments, wiki code, hexadecimal
HTML color codes, quoted strings in VBScript and ANSI SQL, SQL statements, and RTF bookmarks such as:
• #00ccff, <!--A comment.-->
•
[link url="http://example.com/url?var=A&var2=
B"]
• SELECT * FROM TABLE
• {\*\bkmkstart TagAmountText}
Does
not match ANSI escape codes, which are instead detected as strings.
l
Microsoft_product_key
— An alphanumeric key for activation of Microsoft software, such as ABC12-34DEF-GH567-IJK89-
LM0NP. Does not match keys which are non-hyphenated, nor where letters are not capitalized.
l
Netherlands_Postcode
— Netherlands postal codes
(“postcodes”) such as 3000 AA or 3000AA. Does not match postal codes written in lower-case letters, such as 3000aa.
l
NINO
— A United Kingdom National Insurance Number (NINO), such as AB123456D. Does
not match NINOs written in lower-case letters, such as ab123456d.
Default
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
167
server-policy pattern data-type-group
Variable Description
l
Num
— Numbers in various monetary, decimal, comma-separated value (CSV) and other formats such as 123, +1.23, $1,234,567.89,
1'235.140, and -123.45e-6. Does not detect hexadecimal numbers, which are instead detected as strings or code, and Social Security
Numbers, which are instead detected as strings.
l personal_name
— A person’s full or abbreviated name in
English. It can contain punctuation, such as A.J. Schwartz,
Jean-Pierre Ferko, or Jane O’Donnell. Does not match names written in other languages with accented Latinate characters, hanzu, kanji, or hangul, such as Renée Wächter or 林 美 .
l
Phone
— Australian, United States, and Indian phone numbers in various formats such as (123)456-7890, 1.123.456.7890,
0732105432, and +919847444225.
l
Quebec_Postal_Code
— Postal codes written in the style sometimes used by Quebecers, with hyphens between the two parts, such as h2j-3c4 or H2J-3C4.
l
String
— Character strings such as alphanumeric words, credit card numbers, United States Social Security Numbers (SSN), UK vehicle registration numbers, ANSI escape codes, and hexadecimal numbers in formats such as user1, 123-45-6789, ABC 123 A,
4125632152365, [32mHello, and 8ECCA04F.
l
Swedish_Postalcode
— Postal codes (“postnummer”) for
Sweden, with or without spaces or hyphens, such as S 751 70, s75170, or S-751-70. Requires the initial S or s letter. Does not match invalid postal codes such as ones that begin with a 0, or ones that do not begin with the letter S or s.
l
Swedish_personal_number
— Personal identification number
(“personnummer”) for Sweden, such as 19811116-7845. Must be hyphenated. Does
not match PINs for persons whose age is 100 or greater.
l
UAE_land_phone
— Telephone number for the United Arab
Emirates, such as 04 - 3452499 or 04 3452499. Does not match phone numbers beginning with 01 or 08.
l
UK_Bank_code
— Bank sort codes for the United Kingdom, such as 09-01-29. Must be hyphenated.
l
UK_postcode
— Postal codes for the United Kingdom, with or without spaces, such as SW1A 2AA or SW1A2AA.
l
Unix_device_name
— Standard Linux or UNIX non-loopback wired Ethernet network interface names, such as eth0. Does
not
match names for any other type of device, such as lo, hdda, or ppp.
Default
config
168 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy pattern data-type-group
Variable Description
l
Uri
— Uniform resource identifiers (URI) such as: http://www.example.com
ftp://ftp.example.com
mailto:[email protected]
l
US_SSN
— United States Social Security Numbers (SSN) such as
123-45-6789.
l
US_State_Name
— United States state names and modern postal abbreviations such as HI and Wyoming. Does
not detect older postal abbreviations such as Fl. or Wyo.
l
US_Street_Address
— United States city and street address, possibly including an apartment or suite number. City and street may be either separated with a space or written on two lines according to US postal conventions, such as:
123 Main Street Suite #101
Honolulu, HI 10001
Does
not match: l
ZIP + 4 codes that include spaces, or do not have a hyphen (e.g.
“10001 - 1111” or “10001 1111”) l city abbreviations of 2 characters (e.g. “NY” instead of “NYC”) l
Washington D.C. addresses l multiline addresses on Mac OS X, Linux or Unix computers l unabbreviated state names (e.g. “Delaware”) l addresses ending with the country (e.g. “USA”) l addresses beginning with numbers written as words (e.g. “Seven
Main Street” instead of “7 Main Street”) l
US_Zip_Code
— United States ZIP code and ZIP + 4 codes such as 34285-3210.
l
Windows_file_name
— A valid windows file name, such as
Untitled.txt. Does not match file extensions, or file names without their extensions.
To display available options, type: set data-type ?
Note: The web UI displays the regular expressions that define each predefined data type. For details, see the
FortiWeb
Administration Guide
.
Default
Example
This example configures a data type group named data-type-group1 that detects addresses and phone numbers when an auto-learning profile uses it.
config server-policy pattern data-type-group edit data-type-group1 config type-list edit 1
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
169
server-policy pattern suspicious-url-rule set data-type Address next edit 2 set data-type Phone end end next next
Related topics
l
config waf web-protection-profile autolearning-profile
config
server-policy pattern suspicious-url-rule
Use this command to add one or more predefined suspicious URL rules to a suspicious URL rule group.
Each entry in a suspicious URL group defines a type of URL that the FortiWeb appliance considers to be possibly malicious when gathering data for an auto-learning profile.
HTTP requests for URLs typically associated with administrative access to your web applications or web server, for example, may be malicious if they originate from the Internet instead of your management LAN. You may want to discover such requests for the purpose of designing blacklist page rules to protect your web server.
If you know that your network’s web servers are not vulnerable to a specific type of suspicious URL, such as if the
URL is associated with attacks on Microsoft IIS web servers but all of your web servers are Apache web servers, omit it from the suspicious URL group to improve performance. The FortiWeb appliance will not expend resources scanning traffic for that type of suspicious URLs.
To see the regular expressions used in the predefined suspicious URL rules, in the web UI, go to
Auto Learn >
Predefined Pattern > URL Pattern.
Suspicious URL groups are used by auto-learning profiles. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy pattern suspicious-url-rule edit
config type-list edit
set
server-type { Abyss | Apache | Appweb | BadBlue | Blazix |
Cherokee | ColdFusion | IIS | JBoss | Jetty | Jeus_WebContainer |
LotusDomino | Tomcat | WebLogic | WebSEAL | WebSiphon | Xerver |
next end set custom-susp-url-rule next
170 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy pattern suspicious-url-rule end end next
Variable
<rule-group_name>
Description
Type the name of the suspicious URL rule group. The maximum length is 35 characters.
To display the list of existing groups, type: edit ?
<entry_index>
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
server-type { Abyss |
Apache | Appweb |
BadBlue | Blazix |
Cherokee | ColdFusion |
IIS | JBoss | Jetty |
Jeus_WebContainer |
LotusDomino | Tomcat |
WebLogic | WebSEAL |
WebSiphon | Xerver |
ZendServer | aolserver
| ghttpd | lighttpd | lilhttpd | localweb2000 | mywebserver | ngnix | omnihttpd | samba | squid | svn | webshare | xeneo | xitami | zeus | zope}
For each rule index, select the type of the web server, application, or servlet. FortiWeb will detect attempts to access
URLs that are usually sensitive for that software.
<rule_name>
Type the name of a custom suspicious URL rule (see
config server-policy pattern custom-susp-url-rule
Default
No default.
No default.
No default.
Example
This example configures a suspicious URL rule group named suspicious-url-group1 that detects HTTP requests for administratively sensitive URLs for some common web servers that could represent attack attempts and includes a custom suspicious URL rule.
config server-policy pattern suspicious-url-rule edit suspicious-url-group1 config type-list edit 1 set server-type Apache next edit 2 set server-type Apache next edit 3 set server-type Tomcat next
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
171
server-policy persistence-policy end edit 4 set server-type WebLogic end next set custom-susp-url-rule "Suspicious URL 1" next
Related topics
l
config waf web-protection-profile autolearning-profile
l
config server-policy pattern custom-susp-url
config
server-policy persistence-policy
Use this command to configure a persistence method and timeout that you can apply to server pools. The persistence policy applies to all members of the server pool.
After FortiWeb has forwarded the first packet from a client to a pool member, some protocols require that subsequent packets also be forwarded to the same back-end server until a period of time passes or the client indicates that it has finished transmission.
To apply a persistence policy, select it when you configure a server pool. For details, see
config serverpolicy server-pool
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy persistence-policy edit
set
set set set set set set set set end next
172 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable Description
<persistence-policy_ name>
Type the name of the persistence policy. The maximum length is 63 characters.
To display the list of existing persistence policies, type: edit ?
server-policy persistence-policy
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
173
server-policy persistence-policy
Variable
type { source-ip | persistent-cookie | asp-sessionid | phpsessionid | jspsessionid | insertcookie | http-header
| url-parameter | rewrite-cookie | embedded-cookie | ssl-session-id }
Description Default
l l l l l l l source-ip
— Forwards subsequent requests with the same client IP address and subnet as the initial request to the same pool member. To define how FortiWeb derives the appropriate subnet from the IP address, configure ipv4netmask and ipv6-mask-length.
persistent-cookie
— If an initial request contains a cookie whose name matches the cookie-name value, FortiWeb forwards subsequent requests that contain the same cookie value to the same pool member as the initial request.
asp-sessionid
— If a cookie in the initial request contains an ASP .NET session ID value,
FortiWeb forwards subsequent requests with the same session ID value to the same pool member as the initial request. (FortiWeb preserves the original cookie name.) php-sessionid
— If a cookie in the initial request contains a PHP session ID value,
FortiWeb forwards subsequent requests with the same session ID value to the same pool member as the initial request. (FortiWeb preserves the original cookie name.) jsp_sessionid
— FortiWeb forwards subsequent requests with the same JSP session
ID as the inital request to the same pool member. (FortiWeb preserves the original cookie name.) insert-cookie
— FortiWeb inserts a cookie with the name specified by cookie-name to the initial request and forwards all subsequent requests with this cookie to the same pool member. FortiWeb uses this cookie for persistence only and does not forward it to the pool member. Also specify cookie-path and cookie-domain.
http-header
— Forwards subsequent requests with the same value for an HTTP header as the initial request to the same pool member. Also configure http-header.
source-ip config
174 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy persistence-policy
Variable Description
l l l l url-parameter
— Forwards subsequent requests with the same value for a URL parameter as the initial request to the same pool member. Also configure urlparameter
.
rewrite-cookie
— If the HTTP response has a Set-Cookie: value that matches the value specified by cookie-name, FortiWeb replaces the value with a randomly generated cookie value. FortiWeb forwards all subsequent requests with this generated cookie value to the same pool member.
embedded-cookie
— If the HTTP response contains a cookie with the name specified by cookie-name
, FortiWeb preserves the original cookie value and adds a randomly generated cookie value and a ~(tilde) as a prefix. FortiWeb forwards all subsequent requests with this cookie and prefix to the same pool member.
ssl-session-id
— If a cookie in the initial request contains an SSL session ID value,
FortiWeb forwards subsequent requests with the same session ID value to the same pool member as the initial request. (FortiWeb preserves the original cookie name.)
For persistence types that use cookies, you can use the sessioncookie-enforce setting to maintain persistence for transactions within a session. See
config config serverpolicy policy
.
Default
cookie-name <cookiename_str>
Type a value to match or the name of the cookie that FortiWeb inserts.
Available only when the persistence type uses a cookie.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
175
server-policy persistence-policy config
Variable
timeout <timeout_ int>
Description
Type the maximum amount of time between requests that FortiWeb maintains persistence, in seconds.
FortiWeb stops forwarding requests according to the established persistence after this amount of time has elapsed since it last received a request from the client with the associated property (for example, an IP address or cookie). Instead, it again selects a pool member using the load balancing method specified in the server pool configuration.
Type the IPv4 subnet used for session persistence.
Default
300 ipv4-netmask
<v4mask> ipv6-mask-length
<v6mask>
For example, if IPv4 Netmask is 255.255.255.255,
FortiWeb can forward requests from IP addresses
192.168.1.1 and 192.168.1.2 to different server pool members.
If IPv4 Netmask is 255.255.255.0, FortiWeb forwards requests from IP addresses 192.168.1.1
and 192.168.1.2 to the same pool member.
Type the IPv6 network prefix used for session persistence.
255.255.255.255
128 http-header <httpheader_str>
Type the name of the HTTP header that the persistence feature uses to route requests.
No default.
url-parameter <urlparameter_str>
Type the name of the URL parameter that the persistence feature uses to route requests.
No default.
cookie-path <cookiepath_str>
Type a path attribute for the cookie that FortiWeb inserts, if type is insert-cookie.
No default.
cookie-domain
<cookie-domain_str>
Specifies a domain attribute for the cookie that
FortiWeb inserts, if type is insert-cookie.
No default.
Example
This example creates the persistence policy ip-persistence. When this policy is applied to a server pool,
FortiWeb forwards initial requests from an IP address using the load-balancing algorithm configured for the pool.
It forwards any subsequent requests with the same client IP address as the initial request to the same pool member. After FortiWeb has not received a request from the IP address for 400 seconds, it forwards any subsequent initial requests from the IP address using the load-balancing algorithm.
config server-policy persistence-policy edit ip-persistence
176 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config set type source-ip set timeout 400 end next
Related topics
l
config server-policy server-pool
server-policy policy
server-policy policy
Use this command to configure server policies.
The FortiWeb appliance applies only one server policy to each connection.
FortiWeb does not use a policy when it is disabled, as indicated by
.
Policy behavior varies by the operation mode. For details, see the
FortiWeb Administration Guide
.
When you switch the operation mode, FortiWeb deletes server policies from the configuration file if they are not applicable in the current operation mode.
Before you can configure a server policy, you must first configure several policies and profiles: l l l l l l l l
Configure a virtual server and server pool.
To route traffic based on headers in the HTTP layer, configure one or more HTTP content routing policies.
To restrict traffic based upon which hosts you want to protect, configure a group of protected host names.
If you want the FortiWeb appliance to gather auto-learning data, generate or configure an auto-learning profile and its required components.
If you plan to authenticate users, you need to configure users, user groups, and authentication rules and policy, and include the policy in an inline web protection profile.
To apply a web protection profile to a server policy, you must first configure them.
If you want to use the FortiWeb appliance to apply SSL to connections instead of using physical servers, you must also import a server certificate or create a Server Name Indication (SNI) configuration
If you want the FortiWeb appliance to verify the certificate provided by an HTTP client to authenticate themselves, you must also define a certificate verification rule. If you want to specify whether a client is required to present a personal certificate or not based on the request URL, create a URL-based client certificate group.
For details, see: l
config server-policy allow-hosts
l l
, config server-policy server-pool
config server-policy http-content-routing-policy
l
config server-policy customapplication application-policy
config waf http-authen http-authen-rule
config waf http-authen http-authenpolicy
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
177
server-policy policy config l
config waf web-protection-profile inline-protection
(reverse proxy mode or either of the transparent modes), or
config waf web-protection-profile offline-protection
(offline protection mode) l l l
config waf web-protection-profile autolearning-profile
config system certificate local
config system certificate verify
config system certificate urlcert
You can use SNMP traps to notify you of policy status changes, or when a policy enforces your network usage policy. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy policy edit
set
set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set
client-real-ip {enable | disable} allow-hosts <hosts_name> block-port <port_int>
set
hsts-header {enable | disable}
set
set
certificate <certificate_name>
set set
intermediate-certificate-group <CA-group_name>
ssl-client-verify <verifier_name>
urlcert {enable | disable} urlcert-group <urlcert-group_name> urlcert-hlen
tls-v12 {enable | disable} ssl-pfs {enable | disable} ssl-cipher {medium | high | custom}
ssl-custom-cipher {<cipher_1> <cipher2> <cipher3> ...}
ssl-rc4-first {enable | disable} ssl-chacha-cipher {enable | disable}
ssl-noreg {enable | disable} http-to-https {enable | disable}
178 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy policy set set set set set set set set set
web-protection-profile <profile_name> waf-autolearning-profile <profile_name>
http-pipeline {enable | disable} sessioncookie-enforce {enable | disable}
config http-content-routing-list edit
set
content-routing-policy-name <content-routing_name>
set set
profile-inherit {enable | disable}
web-protection-profile <profile_name>
end end next set next
Variable
<policy_name>
Description
Type the name of the policy. The maximum length is 63 characters.
To display the list of existing policies, type: edit ?
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
179
server-policy policy
Variable
vserver <vserver_name>
Description Default
deployment-mode {serverpool | http-contentrouting | offlineprotection | transparent-servers | wccp-servers}
Specify the distribution method that FortiWeb uses when it forwards connections accepted by this policy.
l l l l l server-pool
— Forwards connections to a server pool. Depending on the pool configuration, FortiWeb either forwards connections to a single physical server or domain server or distributes the connection among the pool members. Also configure
server-pool <serverpool_name> . This option is available only if the
operating mode is reverse proxy mode.
http-content-routing
— Use HTTP content routing to route HTTP requests to a specific server pool. This option is available only if the FortiWeb appliance is operating in reverse proxy mode.
offline-detection
— Allows connections to pass through the FortiWeb appliance and applies an offline protection profile. Also configure
server-pool <serverpool_name> . This is the only option available if
operating mode is offline protection.
transparent-servers
— Allows connections to pass through the FortiWeb appliance and applies a protection profile. Also configure
server-pool <serverpool_name> . This is the only option available when
the operating mode is either true transparent proxy or transparent inspection.
wccp-servers
— FortiWeb is a Web Cache
Communication Protocol (WCCP) client that receives traffic from a FortiGate configured as a WCCP server.
Also configure server-pool. This is the only option available when the operation mode is WCCP.
No default.
No default.
Type the name of a virtual server that provides the IP address and network interface of incoming traffic that
FortiWeb routes and to which the policy applies a protection profile. The maximum length is 35 characters.
To display the list of existing virtual servers, type: edit ?
Available only if the operating mode is reverse proxy.
config
180 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
v-zone <bridge_name>
Description
Type the name of the bridge that specifies the network interface of the incoming traffic that the policy applies a protection profile to. The maximum length is 15 characters.
To display the list of existing bridges, type: edit ?
Available only if the operating mode is true transparent proxy or transparent inspection.
data-capture-port <port_ int>
Type the network interface of incoming traffic that the policy attempts to apply a profile to. The IP address is ignored.
Available only if the operating mode is offline inspection.
prefer-current-session
{enable |disable}
Enable to forward subsequent requests from an identified client connection to the same server pool as the initial connection from the client.
This option allows FortiWeb to improve its performance by skipping the process of matching HTTP header content to content routing policies for connections it has already evaluated and routed.
Available only when deployment-mode is httpcontent-routing
.
server-pool <serverpool_name>
Type the name of the server pool whose members receive the connections.
To display the list of existing servers, type: edit ?
This field is applicable only if deployment-mode is server-pool
, offline-protection or transparent-servers.
Caution: Multiple virtual servers/policies can forward traffic to the same server pool. If you do this, consider the total maximum load of connections that all virtual servers forward to your server pool. This configuration can multiply traffic forwarded to your server pool, which can overload it and cause dropped connections.
server-policy policy
Default
No default.
disable
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
181
server-policy policy
Variable Description
Type the name of a protected hosts group to allow or reject connections based upon whether the Host: field in the HTTP header is empty or does or does not match the protected hosts group. The maximum length is 35 characters.
To display the list of existing groups, type: edit ?
allow-hosts <hosts_name> If you do not select a protected hosts group, FortiWeb accepts pr blocks requests based upon other criteria in the policy or protection profile, but regardless of the
Host: field in the HTTP header.
Note: Unlike HTTP 1.1, HTTP 1.0 does not require the
Host: field. The FortiWeb appliance does not block
HTTP 1.0 requests because they do not have this field, regardless of whether or not you have selected a protected hosts group.
client-real-ip {enable | disable}
Enter enable to configure FortiWeb to use the source IP address of the client that originated the request when it connects to a back-end server on behalf of that client.
By default, when the operation mode is reverse proxy, the source IP for connections between FortiWeb and back-end servers is the address of a FortiWeb network interface.
Note: To ensure FortiWeb receives the server's response, configure FortiWeb as the server’s gateway.
Available only if the operating mode is reverse proxy.
block-port <port_int>
Type the number of the physical network interface port that FortiWeb uses to send TCP RST (reset) packets when a request violates the policy. The valid range varies by the number of physical ports on the NIC.
For example, to send TCP RST from port1, type: set block-port port1
Available only when the operating mode is offline protection.
Default
No default.
disable
No default.
config
182 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
syncookie {enable | disable} half-open-threshold
<packets_int> service <service_name>
Description
Enable to detect TCP SYN flood attacks.
For more information, see the
FortiWeb Administration
Guide
.
Available only when the operating mode is reverse proxy or true transparent proxy.
Enter the maximum number of TCP SYN packets, including retransmission, that FortiWeb allows to be sent per second to a destination address. If this threshold is exceeded, the FortiWeb appliance treats the traffic as a
DoS attack and ignores additional traffic from that source address.
The valid range is from 10 to 10,000 packets.
Available only when the operating mode is reverse proxy or true transparent proxy and syncookie is enabled.
Type the custom or predefined service that defines the port number on which the virtual server receives HTTP traffic. The maximum length is 35 characters.
To display the list of existing services, type: edit ?
Available only when the operating mode is reverse proxy.
https-service <service_ name>
Type the custom or predefined service that defines the port number on which the virtual server receives HTTPS traffic. The maximum length is 35 characters.
To display the list of existing services, type: edit ?
Available only when the operating mode is reverse proxy.
(For other operation modes, use the server pool configuration to enable SSL inspection instead.) server-policy policy
Default
disable
8192
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
183
server-policy policy
Variable
http2 {enable|disable} hsts-header {enable | disable}
Description
FortiWeb's HTTP/2 security inspection is only supported for Revers Proxy mode and True Transparent Proxy mode. This option enables FortiWeb operating in
Reverse Proxy mode (see
opmode {offline-protection | reverse-proxy | transparent | transparent-inspection | wccp}
in
HTTP/2 with clients via SSL ALPN (Application-Layer
Protocol Negotiation) during the SSL handshake if the client's browser supports HTTP/2 protocol. With the
HTTP/2 being enabled, FortiWebcan recognize HTTP/2 traffic and apply the security services to it. To enable
HTTP/2 communication between the FortiWeb and backend web servers for HTTP/2 inspections in Reverse Proxy mode, see
http2 {enable|disable} in server-policy serverpool
Available only when opmode is set to reverse-proxy, deployment-mode is set to server-pool and https-service is set correctly. FortiWeb supports
HTTP/2 only for HTTPS connections and HTTP Content
Routing is not supported for HTTP/2.
When opmode is set to transparent and deployment-mode is set to transparentservers
, this is not available. It only requires
{enable|disable} in server-policy server-pool
to enable the HTTP/2 security inspections in
True Transparent
Proxy mode; this option here is not required. See
FortiWeb Administration Guide
for more details about
HTTP/2 support.
Enable to combat MITM attacks on HTTP by injecting the
RFC 6797 strict transport security header into the reply, such as:
Strict-Transport-Security: maxage=31536000; includeSubDomains
This header forces the client to use HTTPS for subsequent visits to this domain. If the certificate does not validate, it also causes a fatal connection error: the client’s web browser does not display any dialog that allows the user to override the certificate mismatch error and continue.
Available only if
is configured.
Default
disable disable config
184 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
hsts-max-age <timeout_ int> certificate
<certificate_name> intermediatecertificate-group <CAgroup_name>
Description
Type the time to live in seconds for the HSTS header.
Available only if
hsts-header {enable | disable}
is enabled.
The valid range is from 3600 to 31,536,000.
Type the name of the certificate that FortiWeb uses to encrypt or decrypt SSL-secured connections. The maximum length is 35 characters.
To display the list of existing certificates, type: edit ?
If sni is enable, FortiWeb uses a Server Name
Indication (SNI) configuration instead of or in addition to this server certificate. For more information, see
.
This option is used only if
is configured.
Type the name of an intermediate certificate authority
(CA) group, if any, that FortiWeb uses to validate the CA signing chain in a client’s certificate. The maximum length is 35 characters.
To display the list of existing groups, type: edit ?
Available only if
is configured.
server-policy policy
Default
7776000
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
185
server-policy policy
Variable
ssl-client-verify
<verifier_name>
Description Default
Type the name of a certificate verifier, if any, to use when an HTTP client presents their personal certificate. (If you do not select one, the client is not required to present a personal certificate.)
If the client presents an invalid certificate, the FortiWeb appliance does not allow the connection.
To be valid, a client certificate must: l
Not be expired l
Not be revoked by either the certificate revocation list (CRL)
(see
config system certificate verify
) l
Be signed by a certificate authority (CA) whose certificate you have imported into the FortiWeb appliance (see the
FortiWeb Administration Guide
); if the certificate has been signed by a chain of intermediate CAs, those certificates must be included in an intermediate CA group (see
intermediate-certificate-group <CA-group_name>
) l
Contain a CA field whose value matches the CA certificate l
Contain an Issuer field whose value matches the
Subject field in the CA certificate
Personal certificates, sometimes also called user certificates, establish the identity of the person connecting to the web site.
You can require that clients present a certificate alternatively or in addition to HTTP authentication. For more information, see the
FortiWeb Administration
Guide
.
No default.
The maximum length is 35 characters.
To display the list of existing verifiers, type: edit ?
This option is used only if
is configured.
The client must support SSL 3.0, TLS 1.0, TLS 1.1, or
TLS 1.2.
config
186 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable Description
Note: If the connection fails when you have selected a certificate verifier, verify that the certificate meets the web browser’s requirements. Web browsers may have their own certificate validation requirements in addition to
FortiWeb requirements. For example, personal certificates for client authentication may be required to either: l not be restricted in usage/purpose by the CA, or l contain a Key Usage field that contains Digital
Signature or have a ExtendedKeyUsage or
EnhancedKeyUsage field whose value contains
Client Authentication
If the certificate does
not satisfy browser requirements, although it may be installed in the browser, when the
FortiWeb appliance requests the client’s certificate, the browser may not display a certificate selection dialog to the user, or the dialog may not contain that certificate. In that case, verification fails. For browser requirements, see your web browser’s documentation.
urlcert {enable | disable}
Specifies whether FortiWeb uses a URL-based client certificate group to determine whether a client is required to present a personal certificate.
Available only if
is configured.
urlcert-group <urlcertgroup_name> urlcert-hlen
Specifies the URL-based client certificate group that determines whether a client is required to present a personal certificate.
If the URL the client requests does not match an entry in the group, the client is not required to present a personal certificate.
For information on creating a group, see
config system certificate urlcert
Specifies the maximum allowed length for an HTTP request with a URL that matches an entry in the URLbased client certificate group, in kilobytes.
FortiWeb blocks any matching requests that exceed the specified size.
This setting prevents a request from exceeding the maximum buffer size.
Valid values are from 16 to 128.
server-policy policy
Default
disable
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
187
server-policy policy
Variable
client-certificateforwarding {enable | disable} sni {enable | disable} sni-strict {enable | disable}
Description
Enable to include the X.509 personal certificate presented by the client during the SSL/TLS handshake, if any, in an X-Client-Cert: HTTP header when forwarding the traffic to the protected web server.
FortiWeb still validates the client certificate itself, but this can be useful if the web server requires the client certificate for the purpose of server-side identity-based functionality.
Default
disable
Enable to use a Server Name Indication (SNI) configuration instead of or in addition to the server certificate specified by
certificate <certificate_name>
.
The SNI configuration enables FortiWeb to determine which certificate to present on behalf of the members of a pool based on the domain in the client request. See
If you specify both a SNI configuration and a certificate,
FortiWeb uses the certificate specified by
when the requested domain does not match a value in the SNI configuration.
If you enable
, FortiWeb always ignores the value of
certificate <certificate_name>
.
Available only if
is configured.
disable
Select to configure FortiWeb to ignore the value of
when it determines which certificate to present on behalf of server pool members, even if the domain in a client request does not match a value in the specified SNI configuration.
disable config
188 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
sni-certificate <sni_ name> server-side-sni
{enable | disable} ssl-v3 {enable | disable} tls-v10 {enable | disable} tls-v11 {enable | disable}
Description
Type the name of the Server Name Indication (SNI) configuration that specifies which certificate FortiWeb uses when encrypting or decrypting SSL-secured connections for a specified domain.
The SNI configuration enables FortiWeb to present different certificates on behalf of the members of a pool according to the requested domain.
If only one certificate is required to encrypt and decrypt traffic that this policy applies to, specify
instead.
Available only if
is configured.
Specifies whether FortiWeb supports Server Name
Indication (SNI) for back-end servers that it applies this policy to.
Enable this feature when the operating mode is reverse proxy, end-to-end encryption is required, and the backend web server itself requires SNI support.
When the operating mode is true transparent proxy, you enable server-side SNI support using server pool configuration.
Specifies whether clients can connect securely to
FortiWeb using the SSL 3.0 cryptographic protocol.
This must be set to disable if http2 is set to enable.
Available only if
is configured.
Specifies whether clients can connect securely to
FortiWeb using the TLS 1.0 cryptographic protocol.
This must be set to disable if http2 is set to enable.
Available only if
is configured.
Specifies whether clients can connect securely to
FortiWeb using the TLS 1.1 cryptographic protocol.
This must be set to disable if http2 is set to enable.
Available only if
is configured.
server-policy policy
Default
No default.
disable enable enable enable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
189
server-policy policy
Variable
tls-v12 {enable | disable} ssl-pfs {enable | disable} ssl-cipher {medium | high | custom}
Description
Specifies whether clients can connect securely to
FortiWeb using the TLS 1.2 cryptographic protocol.
Available only if
is configured.
Specifies whether FortiWeb generates a new publicprivate key pair when it establishes a secure session with a Diffie–Hellman key exchange.
Perfect forward secrecy (PFS) improves security by ensuring that the key pair for a current session is unrelated to the key for any future sessions.
Available only if
is configured.
Specify whether the set of cipher suites that FortiWeb allows creates a medium-security, high-security, or custom configuration.
If custom, also specify ssl-custom-cipher.
This is not allowed to set to custom if http2 is set to enable
.
For details, see “Supported cipher suites & protocol versions” in the
FortiWeb Administration Guide
.
Available only if
is configured.
Default
enable disable medium config
190 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
ssl-custom-cipher
{<cipher_1> <cipher2>
<cipher3> ...}
Description
Specify one or more cipher suites that FortiWeb allows.
Separate the name of each cipher with a space. To remove from or add to the list of ciphers, retype the entire list.
Valid values are:
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-SHA384
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES256-SHA
ECDHE-ECDSA-AES256-SHA
DHE-DSS-AES256-GCM-SHA384
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DHE-DSS-AES256-SHA256
DHE-RSA-AES256-SHA
DHE-DSS-AES256-SHA
DHE-RSA-CAMELLIA256-SHA
DHE-DSS-CAMELLIA256-SHA
ECDH-RSA-AES256-GCM-SHA384
ECDH-ECDSA-AES256-GCM-SHA384
ECDH-RSA-AES256-SHA384
ECDH-ECDSA-AES256-SHA384
ECDH-RSA-AES256-SHA
ECDH-ECDSA-AES256-SHA
AES256-GCM-SHA384
AES256-SHA256
AES256-SHA
CAMELLIA256-SHA
ECDHE-RSA-DES-CBC3-SHA
ECDHE-ECDSA-DES-CBC3-SHA
EDH-RSA-DES-CBC3-SHA
EDH-DSS-DES-CBC3-SHA
ECDH-RSA-DES-CBC3-SHA
ECDH-ECDSA-DES-CBC3-SHA
DES-CBC3-SHA
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES128-SHA
ECDHE-ECDSA-AES128-SHA
DHE-DSS-AES128-GCM-SHA256
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DHE-DSS-AES128-SHA256
DHE-RSA-AES128-SHA
(continues) server-policy policy
Default
DHE-RSA-
SEED-SHA
DHE-
DSS-
SEED-SHA
SEED-
SHA
ECDHE-
RSA-RC4-
SHA
ECDHE-
ECDSA-
RC4-SHA
ECDH-
RSA-RC4-
SHA
ECDH-
ECDSA-
RC4-SHA
RC4-SHA
RC4-MD5
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
191
server-policy policy
Variable Description
DHE-DSS-AES128-SHA
DHE-RSA-CAMELLIA128-SHA
DHE-DSS-CAMELLIA128-SHA
ECDH-RSA-AES128-GCM-SHA256
ECDH-ECDSA-AES128-GCM-SHA256
ECDH-RSA-AES128-SHA256
ECDH-ECDSA-AES128-SHA256
ECDH-RSA-AES128-SHA
ECDH-ECDSA-AES128-SHA
AES128-GCM-SHA256
AES128-SHA256
AES128-SHA
CAMELLIA128-SHA
DHE-RSA-SEED-SHA
DHE-DSS-SEED-SHA
SEED-SHA
ECDHE-RSA-RC4-SHA
ECDHE-ECDSA-RC4-SHA
ECDH-RSA-RC4-SHA
ECDH-ECDSA-RC4-SHA
RC4-SHA RC4-MD5
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-SHA38
ECDHE-ECDSA-AES256-SHA
ECDH-ECDSA-AES256-GCM-SHA384
ECDH-ECDSA-AES256-SHA384
ECDH-ECDSA-AES256-SHA
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-SHA256
ECDHE-ECDSA-AES128-SHA
ECDH-ECDSA-AES128-GCM-SHA256
ECDH-ECDSA-AES128-SHA256
ECDH-ECDSA-AES128-SHA
ECDHE-ECDSA-RC4-SHA
ECDH-ECDSA-RC4-SHA ssl-rc4-first {enable | disable} ssl-chacha-cipher
{enable | disable}
Specifies whether FortiWeb uses the RC4 cipher when it first attempts to create a secure connection with a client.
This option protects against a BEAST (Browser Exploit
Against SSL/TLS) attack, a TLS 1.0 vulnerability.
Enable only when
is enabled and
ssl-cipher {medium | high | custom}
is medium.
Available only if
is configured.
Specifies whether this policy supports the ChaCha-Poly1305 cipher suite.
Default
enable disable config
192 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy policy
Variable
ssl-noreg {enable | disable}
Description
Specifies whether FortiWeb ignores requests from clients to renegotiate TLS or SSL.
Protects against denial-of-service (DoS) attacks that use
TLS/SSL renegotiation to overburden the server.
Available only if
is configured.
http-to-https {enable | disable}
Specify enable to automatically redirect all HTTP requests to the HTTPS service with the same URL and parameters.
Also configure https-service and ensure service uses port
443 (the default).
FortiWeb does not apply the protection profile for this policy (specified by web-protection-profile) to the redirected traffic.
Available only when the operation mode is reverse proxy.
web-protection-profile
<profile_name>
Type the name of the web protection or detection profile to apply to connections that this policy accepts. The maximum length is 35 characters.
To display the list of existing profiles, type: edit ?
waf-autolearning-profile
<profile_name>
Type the name of the auto-learning profile, if any, to use to discover attacks, URLs, and parameters in your web servers’ HTTP sessions. The maximum length is 35 characters.
To display the list of existing profiles, type: edit ?
You can view data gathered using an auto-learning profile in an auto-learning report and use it to generate inline or offline protection profiles. For details, see the
FortiWeb
Administration Guide
.
This option appears only if deployment-mode is offline-detection
.
Default
enable disable
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
193
server-policy policy
Variable Description
case-sensitive {enable | disable}
Enable to differentiate uniform resource locators (URLs) according to upper case and lower case letters for features that act upon the URLs in the headers of HTTP requests, such as start page rules, black list rules, white list rules, and page access rules.
For example, when enabled, an HTTP request involving http://www.
Example.com/ would not match protection profile features that specify http://www.
example.com (difference highlighted in bold).
comment "<comment_str>" status {enable | disable}
Default
No default.
Type a description or other comment. If the comment is more than one word or contains special characters, surround the comment with double quotes ( " ). The maximum length is 999 characters.
No default.
Enable to allow the policy to be used when evaluating traffic for a matching policy.
Note: You can use SNMP traps to notify you of changes to the policy’s status. For details, see
No default.
monitor-mode {enable | disable} disable Enable to override deny and redirect actions defined in the server protection rules for the selected policy. This setting enables FortiWeb to log attacks without performing the deny or redirect action, and to collect more information to build an auto learning profile for the attack.
Disable to allow FortiWeb to perform attack deny/redirect actions as defined by the server protection rules.
noparse {enable | disable}
Enable this option to apply the server policy as a pure proxy, without parsing the content. In this case, the policy allows all traffic to pass through the FortiWeb appliance without applying any protection rules. See also
diagnose debug application http
and
This option applies to server policy only when the
FortiWeb appliance operates in reverse proxy or true transparent proxy mode.
Caution: Use this only during debugging and for as brief a period as possible. This feature disables many protection features. See also
in
.
disable config
194 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy policy
Variable
http-pipeline {enable | disable}
Description
Specifies whether FortiWeb accelerates transactions by bundling them inside the same TCP connection, instead of waiting for a response before sending/receiving the next request. This can increase performance when pages containing many images, scripts, and other auxiliary files are all hosted on the same domain, and therefore logically could use the same connection.
When FortiWeb is operating in reverse proxy or true transparent proxy mode, it can automatically use HTTP pipelining for requests with the following characteristics: l
HTTP version is 1.1
l
The Connection general-header field does not include the
"close" option (for example, Connection: close) l
The HTTP method is GET or HEAD
Default
enable sessioncookie-enforce
{enable | disable}
<entry_index> l enable
— When FortiWeb maintains session persistence using cookies, it inserts a cookie in subsequent transactions in a session if the transaction does not contain a control cookie.
This option is useful if your environment uses TCP multiplexing, which combines HTTP requests from multiple clients in a single session for load balancing or other purposes.
l disable
— When FortiWeb maintains session persistence using cookies, it tracks or inserts the cookie for the first transaction of a session only. It does not track or insert a cookie in subsequent transactions in the session, even if the transaction does not contain a control cookie.
For more information on configuring session persistence, see
config server-policy persistencepolicy
disable
Type the index number of the individual entry in the table.
No default.
content-routing-policyname <content-routing_ name> profile-inherit
{enable | disable}
Type the name of a HTTP content routing policy that this server policy uses.
To display the list of existing error pages, type: edit ?
Enter enable to specify that FortiWeb applies the web protection profile for the server policy to connections that match the routing policy.
No default.
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
195
server-policy policy
Variable
is-default {yes | no}
Description Default
Type yes to specify that FortiWeb applies the protection profile to any traffic that does not match conditions specified in the HTTP content routing policies.
No default.
config
Example
This example configures a web protection server policy. FortiWeb forwards HTTPS connections received by the virtual server named virtual_ip1 to a server pool named apache1, which contains a single physical server.
FortiWeb uses the certificate named certificate1 during SSL negotiations with the client, then forwards traffic to the server pool.
config server-policy policy edit "https-policy" set deployment-mode server-pool set vserver virtual_ip1 set server-pool apache1 set web-protection-profile inline-protection1 set https-service HTTPS set certificate certificate1 set ssl-client-verify set case-sensitive disable set status enable end next
Related topics
l
config server-policy allow-hosts
l
config system certificate local
l
config server-policy http-content-routing-policy
l
config server-policy server-pool
l
config server-policy service custom
l
l
l
l
l
config waf web-protection-profile autolearning-profile
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile offline-protection
l
diagnose debug application dssl
l
diagnose debug application http
l
diagnose debug application ssl
l
diagnose debug application ustack
l
l
196 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy server-pool
server-policy server-pool
Use this command to configure server pools.
Server pools define a group of one or more physical or domain servers (web servers) that FortiWeb distributes connections among, or where the connections pass through to, depending on the operating mode. (Reverse proxy mode actively distributes connections; offline protection and either of the transparent modes do not.)
To apply the server pool configuration, do one of the following: l l
Select it in a server policy directly.
Select it in an HTTP content writing policy that you can, in turn, select in a server policy.
See
and
config server-policy http-content-routingpolicy
Syntax
config server-policy server-pool edit
set
set set set
server-balance {enable | disable}
set set
persistence <persistence-policy_name> comment "<comment_str>"
config pserver-list edit
set
status {disable |enable | maintain}
set
analyzer-policy <fortianalyzer-policy_name>
set
ip {address_ipv4 |address_ipv6}
set set
domain <server_fqdn> port <port_int>
set set set set set set set set set set set set set set
conn-limit <conn-limit_int> weight <weight_int> health-check-inherit {enable | disable}
health <health-check_name> backup-server {enable | disable}
set
set set
ssl {enable | disable} certificate <certificate_name>
intermediate-certificate-group <CA-group_name> client-certificate <client-certificate_name>
hsts-header {enable | disable} hsts-max-age <timeout_int>
certificate-verify <verifier_name> url-cert {enable | disable}
urlcert-group <urlcert-group_name> urlcert-hlen sni {enable | disable}
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
197
server-policy server-pool set set end next end next set set set set set set set set set set set set set set
sni-strict {enable | disable} sni-certificate <sni_name> ssl-v3 {enable | disable}
tls-v10 {enable | disable} tls-v11 {enable | disable} tls-v12 {enable | disable}
ssl-cipher {medium | high | custom}
ssl-custom-cipher {<cipher_1> <cipher2> <cipher3> ...}
recover <recover_int> warm-up <warm-up_int>
Variable
<server-pool_name> type {offlineprotection | reverseproxy | transparentservers-for-ti | transparent-serversfor-tp | transparentservers-for-wccp} server-balance
{enable | disable}
Description
Type the name of the server farm. The maximum length is 63 characters.
To display the list of existing servers, type: edit ?
Select the current operation mode of the appliance to display the corresponding pool options.
For full information on the operating modes, see “How to choose the operation mode” on page 69.
For details, see
opmode {offline-protection | reverseproxy | transparent | transparent-inspection | wccp}
in
.
Specifies whether the pool contains a single server or multiple members.
If the value is enabled, FortiWeb uses the specified load-balancing algorithm to distribute TCP connections among the members. If a member is unresponsive to the specified server health check, FortiWeb forwards subsequent connections to another member of the pool.
Available only when type is reverse-proxy.
Default
No default.
reverseproxy disable config
198 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy server-pool
Variable
health <health-check_ name>
Description
Type the name of a server health check FortiWeb uses to determine the responsiveness of server pool members. The maximum length is 35 characters.
When you specify a health check for the pool, by default, all pool members use that health check. To select a different health check for a pool member, in the pool member configuration, specify disable for health-check-inherit and the health check to use for health.
To display the list of existing health checks, type: edit ?
Available only if type is reverse-proxy and server-balance is enable.
Note: If a pool member is unresponsive, wait until the server becomes responsive again before disabling its server health check. Server health checks record the up or down status of the server. If you deactivate the server health check while the server is unresponsive, the server health check cannot update the recorded status, and
FortiWeb continues to regard the physical server as if it were unresponsive. You can determine the physical server’s connectivity status using the
Service Status
widget (see the
FortiWeb Administration Guide
) or an
SNMP trap (see
).
Default
No default.
backup-server {enable | disable}
Enter enable to configure this pool member as a backup server.
FortiWeb only routes connections for the pool to a backup server when all the other members of the server pool fail their server health check.
The backup server mechanism does not work if you do not specify server health checks for the pool members.
If you select this option for more than one pool member,
FortiWeb uses the load balancing algorithm to determine which member to use.
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
199
server-policy server-pool
Variable Description Default
lb-algo {leastconnections | roundrobin | weighted-roundrobin | uri-hash | full-uri-hash | hosthash | host-domain-hash
| src-ip-hash}
Select the load-balancing algorithms that FortiWeb uses when it distributes new connections among server pool members.
l l l l l l l l least-connections
— Distributes new connections to the member with the fewest number of existing, fully-formed connections.
round-robin
— Distributes new connections to the next member of the server pool, regardless of weight, response time, traffic load, or number of existing connections. Unresponsive servers are avoided.
weighted-round-robin
— Distributes new connections using the round robin method, except that members with a higher weight value receive a larger percentage of connections.
uri-hash
— Distributes new TCP connections using a hash algorithm based on the URI found in the
HTTP header, excluding hostname.
full-uri-hash
— Distributes new TCP connections using a hash algorithm based on the full
URI string found in the HTTP header. The full URI string includes the hostname and path.
host-hash
— Distributes new TCP connections using a hash algorithm based on the hostname in the
HTTP Request header Host field.
host-domain-hash
— Distributes new TCP connections using a hash algorithm based on the domain name in the HTTP Request header Host field.
src-ip-hash
— Distributes new TCP connections using a hash algorithm based on the source IP address of the request.
For hash-based methods, if you specify a value for persistence
, after an initial client request, FortiWeb routes any subsequent requests according to the persistence method. Otherwise, it routes subsequent requests according to the hash-based algorithm.
Available only if type is reverse-proxy and server-balance is enable.
roundrobin config
200 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy server-pool
Variable
persistence
<persistence-policy_ name>
Description
Type the name of the persistence policy that specifies a session persistence method and timeout to apply to the pool.
For more information, see
config server-policy persistence-policy
.
Default
No default.
comment "<comment_str>" Type a description or other comment. If the comment is more than one word or contains special characters, surround the comment with double quotes ( " ). The maximum length is
199 characters.
No default.
<entry_index> No default.
Type the index number of the member entry within the server pool. The valid range is from 1 to
9,223,372,036,854,775,807.
For round robin-style load-balancing, the index number indicates the order in which FortiWeb distributes connections.
status
{disable |enable | maintain}
To specify the status of the pool member, type one of the following values: l enable
— Specifies that this pool member can receive new sessions from FortiWeb.
l disable
— Specifies that this pool member does not receive new sessions from FortiWeb and FortiWeb closes any current sessions as soon as possible.
l maintain
— Specifies that this pool member does not receive new sessions from FortiWeb but FortiWeb maintains any current connections.
server-type {physical | domain}
Specify whether to specify the pool member by IP address or domain.
ip {address_ ipv4 |address_ipv6}
Type the IP address of the web server to include in the pool.
Warning: Server policies do not apply to features that do not yet support IPv6 to servers specified using IPv6 addresses.
Available only if server-type is physical.
enable physical
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
201
server-policy server-pool
Variable
domain <server_fqdn> health-check-inherit
{enable | disable}
Description
Type the fully-qualified domain name of the web server to include in the pool, such as www.example.com.
Warning: Server policies do not apply features that do not yet support IPv6 to domain servers whose DNS names resolve to IPv6 addresses.
Tip: For domain servers, FortiWeb queries a DNS server to query and resolve each web server’s domain name to an IP address. For improved performance, do one of the following: l l use physical servers instead ensure highly reliable, low-latency service to a DNS server on your local network
Available only if server-type is domain.
Default
No default.
conn-limit <conn-limit_ int>
Specifies the maximum number of TCP connections that
FortiWeb forwards to this pool member.
For no limit, specify 0 (the default value).
The valid range is from 0 to 1,048,576.
port <port_int> weight <weight_int>
0
Type the TCP port number where the pool member listens for connections. The valid range is from 1 to 65,535.
80
If the server pool uses the weighted round robin loadbalancing algorithm, type the numerical weight of the pool member. Members with a greater weight receive a greater proportion of connections.
The valid range is from 1 to 9,999.
0 l l enable
— Use the health check specified by health in the server pool configuration.
disable
— Use the health check specified by health in this pool member configuration.
enable config
202 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
http2 {enable | disable}
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
server-policy server-pool
Description Default
Enable to allow HTTP/2 communication between the
FortiWeb and this back-end web server for HTTP/2 security inspections in Reverse Proxy mode; or enable
HTTP/2 security inspections in True Transparent Proxy mode.
When HTTP/2 security inspection is enabled in
Reverse
Proxy mode (See
):
1. enable — Make sure the traffic is transferred in HTTP/2 between FortiWeb and this web server, if this web server supports HTTP/2.
Note: Make sure that this back web server really supports
HTTP/2 before you enable this, or connections will go failed.
2. disable — Make FortiWeb to converse HTTP/2 to
HTTP/1.x for this web server, or converse HTTP/1.x to
HTTP/2 for the clients, if this web server does not support
HTTP/2.
When FortiWeb operates in
True Transparent Proxy
mode( see
opmode {offline-protection | reverse-proxy | transparent | transparent-inspection | wccp}
in
.):
1. enable — Enable HTTP/2 security inspection. It only requires this option to be enabled and the SSL be wellconfigured to enable the HTTP/2 security inspection.No
HTTP/2 configuration is required in
. When HTTP/2 inspection is enabled
in True Transparent Proxy mode, FortiWeb performs no protocol conversions between HTTP/1.x and HTTP/2, which means HTTP/2 connections will not be established between clients and back-end web servers if the web servers do not support HTTP/2.
2. disable — Disable HTTP/2 security inspection.
Note:
1. This option is available only if type is set to reverseproxy
or transparent-servers-for-tp; and when type is transparent-servers-for-tp, this option is available only if ssl is enable.
2. Please confirm your FortiWeb operation mode and the
HTTP versions your back-end web servers are running first to make appropriate configuration here, so that HTTP/2 inspection can work correctly with your web servers.
3. See
FortiWeb Administration Guide
for more details about HTTP/2 support.
disable
203
server-policy server-pool
Variable
ssl {enable | disable} certificate
<certificate_name>
Description
For reverse proxy, offline protection, and transparent inspection modes, specifies whether connections between FortiWeb and the pool member use SSL/TLS.
For true transparent proxy and WCCP modes, specifies whether FortiWeb performs SSL/TLS processing for the pool members and connections between FortiWeb and the pool member use SSL/TLS.
For offline protection and transparent modes, also configure
certificate <certificate_name> . FortiWeb uses
the certificate to decrypt and scan connections before passing the encrypted traffic through to the pool members (SSL inspection).
For true transparent proxy, also configure
and additional SSL settings as required. FortiWeb handles SSL negotiations and encryption and decryption, instead of the pool member
(SSL offloading).
(For reverse proxy mode, you can configure SSL offloading for all members of a pool using a server policy. See
.)
Note: When this option is enabled, the pool member must be configured to apply SSL.
Note: Ephemeral (temporary key) Diffie-Hellman exchanges are not supported if the FortiWeb appliance is operating in transparent inspection or offline protection mode.
Type the name of the certificate that FortiWeb uses to decrypt SSL-secured connections.
Available only if ssl is enable. The maximum length is 35 characters.
To display the list of existing certificates, type: edit ?
Default
No default.
No default.
config
204 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy server-pool
Variable
intermediatecertificate-group <CAgroup_name> client-certificate
<client-certificate_ name>
Description
Select the name of a group of intermediate certificate authority (CA) certificates, if any, that FortiWeb presents to clients to complete the signing chain for them and validate the server certificate’s CA signature.
If clients receive certificate warnings that the server certificate configured in
certificate <certificate_name>
has been signed by an intermediary CA, rather than directly by a root CA or other CA currently trusted by the client, configure this option.
Alternatively, include the entire signing chain in the server certificate itself before uploading it to the
FortiWeb appliance, thereby completing the chain of trust with a CA already known to the client. See the
FortiWeb Administration Guide
.
Available only if type is transparentservers-for-tp and ssl is enable. (For reverse proxy mode, configure this setting in the server policy instead. See
intermediate-certificate-group <CAgroup_name>
in
.)
Specifies the client certificate that FortiWeb uses to connect to this server pool member.
Used when connections to this pool member require a valid client certificate.
Available only if type is reverse-proxy or transparent-servers-for-tp and ssl is enable
.
To upload a client certificate for FortiWeb, see the
FortiWeb Administration Guide
.
Default
No default.
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
205
server-policy server-pool
Variable
hsts-header {enable | disable} hsts-max-age <timeout_ int>
Description
Enable to combat MITM attacks on HTTP by injecting the RFC 6797 strict transport security header into the reply, such as:
Strict-Transport-Security: maxage=31536000; includeSubDomains
This header forces the client to use HTTPS for subsequent visits to this domain. If the certificate does not validate, it also causes a fatal connection error: the client’s web browser does not display a dialog that allows the user to override the certificate mismatch error and continue.
Available only if type is transparent-serversfor-tp and ssl is enable.
Type the time to live in seconds for the HSTS header.
This setting applies only if hsts-header is enable
.
Default
disable
7776000 config
206 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
certificate-verify
<verifier_name> url-cert {enable | disable}
Description
Type the name of a certificate verifier, if any, to use when an HTTP client presents their personal certificate.
(If you do not specify one, the client is not required to present a personal certificate.)
However, if sni is enable and the domain in the client request matches an entry in the specified SNI policy, FortiWeb uses the SNI configuration to determine which certificate verifier to use.
Personal certificates, sometimes also called user certificates, establish the identity of the person connecting to the web site. For information on how the client’s certificate is verified, see
in
.
You can require that clients present a certificate alternatively or in addition to HTTP authentication (see
config waf http-authen http-authenrule
).
Available only if type is transparent-serversfor-tp and ssl is enable. (For reverse proxy mode, configure this setting in the server policy instead.
See
ssl-client-verify <verifier_name>
in
.)
The maximum length is 35 characters.
To display the list of existing verifiers, type: edit ?
Note: The client must support SSL 3.0, TLS 1.0, TLS
1.1, or TLS 1.2.
Specifies whether FortiWeb uses a URL-based client certificate group to determine whether a client is required to present a personal certificate.
Available only if
is configured.
server-policy server-pool
Default
No default.
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
207
server-policy server-pool
Variable Description
urlcert-group <urlcertgroup_name>
Specifies the URL-based client certificate group that determines whether a client is required to present a personal certificate.
If the URL the client requests does not match an entry in the group, the client is not required to present a personal certificate.
For information on creating a group, see
config system certificate urlcert
.
urlcert-hlen
Specifies the maximum allowed length for an HTTP request with a URL that matches an entry in the URLbased client certificate group, in kilobytes.
FortiWeb blocks any matching requests that exceed the specified size.
This setting prevents a request from exceeding the maximum buffer size.
Valid values are from 16 to 128.
client-certificateforwarding {enable | disable}
Enter enable to configure FortiWeb to include any
X.509 personal certificates presented by clients during the SSL/TLS handshake with the traffic it forwards to the pool member.
Available only if type is transparent-serversfor-tp and ssl is enable.
sni {enable | disable}
Enable to use a Server Name Indication (SNI) configuration instead of or in addition to the server certificate specified by
certificate <certificate_name> .
The SNI configuration enables FortiWeb to determine which certificate to present on behalf of the members of a pool based on the domain in the client request. See
.
If you specify both a SNI configuration and a certificate,
FortiWeb uses the certificate specified by
when the requested domain does not match a value in the SNI configuration.
If you enable
sni-strict {enable | disable} , FortiWeb
always ignores the value of
certificate <certificate_ name>
.
Available only if type is transparent-serversfor-tp and ssl is enable.
Default
No default.
No default.
disable disable config
208 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
sni-strict {enable | disable} sni-certificate <sni_ name> ssl-v3 {enable | disable}
Description
Select to configure FortiWeb to ignore the value of
certificate <certificate_name>
when it determines which certificate to present on behalf of server pool members, even if the domain in a client request does not match a value in the specified SNI configuration.
Type the name of the Server Name Indication (SNI) configuration that specifies which certificate FortiWeb uses when encrypting or decrypting SSL-secured connections for a specified domain.
The SNI configuration enables FortiWeb to present different certificates on behalf of the members of a pool according to the requested domain.
If only one certificate is required to encrypt and decrypt traffic that this policy applies to, specify
instead.
Available only if
is enabled.
For reverse proxy mode, specifies whether secure connections between FortiWeb and the server pool member can use the SSL 3.0 cryptographic protocol.
For true transparent proxy and WCCP modes, specifies whether secure connections between clients and
FortiWeb and between FortiWeb and the server pool member can use the SSL 3.0 cryptographic protocol.
This must be set to disable if http2 is set to enable
.
Available only if type is reverse-proxy, transparent-servers-for-tp
, or transparent-servers-for-wccp
, and ssl is enable
.
server-policy server-pool
Default
disable
No default.
enable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
209
server-policy server-pool
Variable
tls-v10 {enable | disable} tls-v11 {enable | disable} tls-v12 {enable | disable}
Description
For reverse proxy mode, specifies whether secure connections between FortiWeb and the server pool member can use the TLS 1.0 cryptographic protocol.
For true transparent proxy and WCCP modes, specifies whether secure connections between clients and
FortiWeb and between FortiWeb and the server pool member can use the TLS 1.0 cryptographic protocol.
This must be set to disable if http2 is set to enable
.
Available only if type is reverse-proxy, transparent-servers-for-tp
, or transparent-servers-for-wccp
, and ssl is enable
.
For reverse proxy mode, specifies whether secure connections between FortiWeb and the server pool member can use the TLS 1.1 cryptographic protocol.
For true transparent proxy and WCCP modes, specifies whether secure connections between clients and
FortiWeb and between FortiWeb and the server pool member can use the TLS 1.1 cryptographic protocol.
This must be set to disable if http2 is set to enable
.
Available only if type is reverse-proxy, transparent-servers-for-tp
, or transparent-servers-for-wccp
, and ssl is enable
.
For reverse proxy mode, specifies whether secure connections between FortiWeb and the server pool member can use the TLS 1.2 cryptographic protocol.
For true transparent proxy and WCCP modes, specifies whether secure connections between clients and
FortiWeb and between FortiWeb and the server pool member can use the TLS 1.2 cryptographic protocol.
Available only if type is reverse-proxy, transparent-servers-for-tp
, or transparent-servers-for-wccp
, and ssl is enable
.
Default
enable enable enable config
210 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
ssl-cipher {medium | high | custom}
Description
For reverse proxy mode, specifies whether secure connections between FortiWeb and the server pool member use a medium-security, high-security, or custom set of cipher suites.
For true transparent proxy and WCCP modes, specifies whether secure connections between clients and
FortiWeb and between FortiWeb and the server pool member use a medium-security, high-security, or custom set of cipher suites.
If custom, also specify ssl-custom-cipher.
This is not allowed to set to custom if http2 is set to enable
.
For details, see “Supported cipher suites & protocol versions” in the
FortiWeb Administration Guide
.
Available only if type is reverse-proxy, transparent-servers-for-tp
, or transparent-servers-for-wccp
, and ssl is enable
.
server-policy server-pool
Default
medium
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
211
server-policy server-pool
Variable
ssl-custom-cipher
{<cipher_1> <cipher2>
<cipher3> ...}
Description
Specify one or more cipher suites that FortiWeb allows.
Separate the name of each cipher with a space. To remove from or add to the list of ciphers, retype the entire list.
Valid values are:
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-SHA384
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES256-SHA
ECDHE-ECDSA-AES256-SHA
DHE-DSS-AES256-GCM-SHA384
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DHE-DSS-AES256-SHA256
DHE-RSA-AES256-SHA
DHE-DSS-AES256-SHA
DHE-RSA-CAMELLIA256-SHA
DHE-DSS-CAMELLIA256-SHA
ECDH-RSA-AES256-GCM-SHA384
ECDH-ECDSA-AES256-GCM-SHA384
ECDH-RSA-AES256-SHA384
ECDH-ECDSA-AES256-SHA384
ECDH-RSA-AES256-SHA
ECDH-ECDSA-AES256-SHA
AES256-GCM-SHA384
AES256-SHA256
AES256-SHA
CAMELLIA256-SHA
ECDHE-RSA-DES-CBC3-SHA
ECDHE-ECDSA-DES-CBC3-SHA
EDH-RSA-DES-CBC3-SHA
EDH-DSS-DES-CBC3-SHA
ECDH-RSA-DES-CBC3-SHA
ECDH-ECDSA-DES-CBC3-SHA
DES-CBC3-SHA
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES128-SHA
ECDHE-ECDSA-AES128-SHA
DHE-DSS-AES128-GCM-SHA256
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DHE-DSS-AES128-SHA256
DHE-RSA-AES128-SHA
(continues)
Default
DHE-RSA-
SEED-SHA
DHE-DSS-
SEED-SHA
SEED-SHA
ECDHE-
RSA-RC4-
SHA
ECDHE-
ECDSA-
RC4-SHA
ECDH-RSA-
RC4-SHA
ECDH-
ECDSA-
RC4-SHA
RC4-SHA
RC4-MD5 config
212 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
ssl-pfs {enable | disable} server-policy server-pool
Description
DHE-DSS-AES128-SHA
DHE-RSA-CAMELLIA128-SHA
DHE-DSS-CAMELLIA128-SHA
ECDH-RSA-AES128-GCM-SHA256
ECDH-ECDSA-AES128-GCM-SHA256
ECDH-RSA-AES128-SHA256
ECDH-ECDSA-AES128-SHA256
ECDH-RSA-AES128-SHA
ECDH-ECDSA-AES128-SHA
AES128-GCM-SHA256
AES128-SHA256
AES128-SHA
CAMELLIA128-SHA
DHE-RSA-SEED-SHA
DHE-DSS-SEED-SHA
SEED-SHA
ECDHE-RSA-RC4-SHA
ECDHE-ECDSA-RC4-SHA
ECDH-RSA-RC4-SHA
ECDH-ECDSA-RC4-SHA
RC4-SHA RC4-MD5
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-SHA38
ECDHE-ECDSA-AES256-SHA
ECDH-ECDSA-AES256-GCM-SHA384
ECDH-ECDSA-AES256-SHA384
ECDH-ECDSA-AES256-SHA
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-SHA256
ECDHE-ECDSA-AES128-SHA
ECDH-ECDSA-AES128-GCM-SHA256
ECDH-ECDSA-AES128-SHA256
ECDH-ECDSA-AES128-SHA
ECDHE-ECDSA-RC4-SHA
ECDH-ECDSA-RC4-SHA
Enable to configure FortiWeb to generate a new publicprivate key pair when it establishes a secure session with a Diffie–Hellman key exchange.
Perfect forward secrecy (PFS) improves security by ensuring that the key pair for a current session is unrelated to the key for any future sessions.
Available only if type is transparent-serversfor-tp and ssl is enable.
Default
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
213
server-policy server-pool
Variable Description
ssl-rc4-first {enable | disable}
Enable to configure FortiWeb to use the RC4 cipher when it first attempts to create a secure connection with a client.
This option protects against a BEAST (Browser Exploit
Against SSL/TLS) attack, a TLS 1.0 vulnerability.
Enable only when
is enabled and
ssl-cipher {medium | high | custom}
is medium.
ssl-chacha-cipher
{enable | disable} ssl-noreg {enable | disable}
Specifies whether this pool member supports the ChaCha-
Poly1305 cipher suite.
Select to configure FortiWeb to ignore requests from clients to renegotiate TLS or SSL.
Protects against denial-of-service (DoS) attacks that use
TLS/SSL renegotiation to overburden the server.
Available only if type is transparent-serversfor-tp and ssl is enable.
server-side-sni
{enable | disable}
Specifies whether FortiWeb supports Server Name
Indication (SNI) for back-end servers that it applies this policy to.
Enable this feature when the operating mode is transparent proxy, end-to-end encryption is required, and the back-end web server itself requires SNI support.
When the operating mode is reverse proxy, you enable server-side SNI support using the server policy.
Default
enable disable enable disable config
214 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy server-pool
Variable
recover <recover_int> warm-up <warm-up_int>
Description Default
Specifies the number of seconds that FortiWeb waits before it forwards traffic to this pool member after a health check indicates that this server is available again.
The default is 0 (disabled).
The valid range is 0 to 86,400 seconds.
After the recovery period elapses, FortiWeb assigns connections at the rate specified by warm-rate.
Examples of when the server experiences a recovery and warm-up period: l
A server is coming back online after the health check monitor detected it was down.
l
A network service is brought up before other daemons have finished initializing and therefore the server is using more
CPU and memory resources than when startup is complete.
To avoid connection problems, specify the separate warm-up rate, recovery rate, or both.
Tip: During scheduled maintenance, you can also manually apply these limits by setting status to maintain
.
0
Specifies for how long FortiWeb forwards traffic at a reduced rate after a health check indicates that this pool member is available again but it cannot yet handle a full connection load.
For example, when the pool member begins to respond but startup is not fully complete.
The default is 0 (disabled).
The valid range is 0 to 86,400 seconds.
0
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
215
server-policy server-pool
Variable
warm-rate <warm-rate_ int>
Description Default
Specifies the maximum connection rate while the pool member is starting up.
The default is 10 connections per second. The valid range is 1 to 86,400 connections per second.
The warm up calibration is useful with servers that bring up the network service before other daemons are initialized. As these types of servers come online, CPU and memory are more utilized than they are during normal operation. For these servers, you define separate rates based on warm-up and recovery behavior.
For example, if warm-up is 5 and warm-rate is
2
, the maximum number of new connections increases at the following rate: l
1st second — Total of 2 new connections allowed (0+2).
l
2nd second — 2 new connections added for a total of 4 new connections allowed (2+2).
l
3rd second — 2 new connections added for a total of 6 new connections allowed (4+2).
l
4th second — 2 new connections added for a total of 8 new connections allowed (6+2).
l
5th second — 2 new connections added for a total of 10 new connections allowed (8+2).
10 config
Example
This example configures a server pool named server-pool1. It consists of two physical servers:
172.16.1.10
and 172.16.1.11.
When both servers are available, FortiWeb forwards connections to the server with the smallest number of connections.
config server-policy server-pool edit "server-pool1" set type reverse-proxy set server-balance enable set lb-algo least-connections config pserver-list edit 1 set status enable set server-type physical set ip
172.16.1.10
set ssl disable set port 8081 next edit 2 set status enable
216 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config set server-type physical set ip
172.16.1.11
set ssl disable set port 8082 end end next next
Related topics
l
l
config server-policy http-content-routing-policy
l
config system certificate local
l
l
config server-policy persistence-policy
server-policy service custom
server-policy service custom
Use this command to configure a custom service.
You can add a custom services to a policy to define the protocol and listening port of a virtual server. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy service custom edit
set
set protocol TCP end next
Variable
<service_name> port <port_int>
Description
Type the name of the new or existing custom network service, such as SOAP1. The maximum length is 63 characters.
To display the list of existing services, type: edit ?
Type the port number on which a virtual server will receive
TCP/IP connections for HTTP or HTTPS requests. The valid range is from 1 to 65,535.
Default
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
217
server-policy service predefined config
Example
This example configures a service definition named SOAP1.
config server-policy service custom edit "SOAP1" set port 8081 set protocol TCP end next
Related topics
l
l
l
config server-policy custom-application application-policy
server-policy service predefined
Use this command to view a predefined service.
This command only displays predefined services. It
cannot be used to modify them. If you attempt to edit the port number and protocol, the appliance will discard your settings.
Predefined Internet services can be selected in a policy in order to define the protocol and listening port of a virtual server. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy service predefined edit
analyzer-policy <fortianalyzer-policy_name>
end show next
Variable
<service_name>
Description
Type the name of a predefined network service, such as HTTP or HTTPS. The maximum length is 35 characters.
To display the list of existing services, type: edit ?
Default
No default.
218 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config server-policy vserver
Example
This example shows the default settings for all of the predefined services.
config server-policy service predefined show
Output: config server-policy service predefined edit "HTTP" set port 80 set protocol TCP next edit "HTTPS" set port 443 set protocol TCP end next
Related topics
l
l
l
config server-policy service custom
server-policy vserver
Use this command to configure virtual servers.
Before you can create a policy, you must first configure a virtual server which defines the network interface or bridge and IP address on which traffic destined for an individual physical server or server farm will arrive.
When the FortiWeb appliance receives traffic destined for a virtual server, it can then forward the traffic to a physical server or a server farm. The FortiWeb appliance identifies traffic as being destined for a specific virtual server if: l l the traffic arrives on the network interface or bridge associated with the virtual server for reverse proxy mode, the destination address is the IP address of a virtual server (the destination IP address is ignored in other operation modes, except that it must not be identical with the physical server’s IP address)
Virtual servers can be on the same subnet as physical servers. This configuration creates a one-arm HTTP proxy. For example, the virtual server
10.0.0.1/24 could forward to the physical server 10.0.0.2.
However, this is
not recommended. Unless your network’s routing configuration prevents it, it could allow attackers that are aware of the physical server’s IP address to bypass FortiWeb by accessing the physical server directly.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
219
server-policy vserver config
To apply virtual servers, select them within a server policy. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see
Syntax
config server-policy vserver edit
set
set set
interface <interface_name> vip <virtual-ip_ipv4mask>
[set set
]
use-interface-ip {enable | disable}
end next
Variable Description
<virtual-server_name> Type the name of the new or existing virtual server. The maximum length is 63 characters.
To display the list of existing servers, type: edit ?
status {enable | disable} interface <interface_ name>
Enable to accept traffic destined for this virtual server.
Type the name of the network interface or bridge, such as port1 or bridge1, to which the virtual server is bound, and on which traffic destined for the virtual server will arrive. The maximum length is 35 characters.
To display the list of existing interfaces, type: edit ?
vip <virtual-ip_ ipv4mask> vip6 <virtual-ip_ ipv6mask>
Type the IPv4 address and subnet of the virtual server.
Type the IPv6 address and subnet of the virtual server.
use-interface-ip
{enable | disable}
For FortiWeb-VM on Microsoft Azure, specify whether the virtual server uses the IP address of the specified interface, instead of an IP specified by vip or vip6.
Default
disable
No default.
No default.
0.0.0.0
0.0.0.0
::/0 disable
Example
This example configures a virtual server named inline_vip1 on the network interface named port1.
220 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system accprofile
The port number on which the virtual server will receive traffic is defined separately, in the policies that use this virtual server definition.
config server-policy vserver edit "inline_vip1" set status enable set interface port1 end set vip 10.0.0.1 255.255.255.0
next
Related topics
l
l
l
config server-policy service custom
l
l
system accprofile
Use this command to configure access control profiles for administrators.
If you have configured RADIUS queries for authenticating administrators, you can override the locally-selected access profile by using a RADIUS VSA.
See
Access profiles determine administrator accounts’ permissions.
When an administrator has only read access to a feature, the administrator can access the web UI page for that feature, and can use the get and show CLI command for that feature, but cannot make changes to the configuration. There are no
Create or Apply buttons, or config CLI commands. Lists display only the View icon instead of icons for Edit, Delete or other modification commands. Write access is required for modification of any kind.
In larger companies where multiple administrators divide the share of work, access profiles often reflect the specific job that each administrator does (“role”), such as user account creation or log auditing. Access profiles can limit each administrator account to their assigned role. This is sometimes called role-based access control
(RBAC).
The prof_admin access profile, a special access profile assigned to the admin administrator account and required by it, does not appear in the list of access profiles. It exists by default and cannot be changed or deleted, and consists of essentially UNIX root-like permissions.
Even if you assign the prof_admin access profile to other administrators, they will
not have all of the same permissions as the admin account. The admin account has some special permissions, such as the ability to reset administrator passwords, that are inherent in that account only. Other accounts should not be considered a complete substitute.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
221
system accprofile config
If you create more administrator accounts, whether to harden security or simply to prevent accidental modification, create other access profiles with the minimal degrees and areas of access that each role requires.
Then assign each administrator account the appropriate role-based access profile.
For example, for a person whose only role is to audit the log messages, you might make an access profile named auditor that only has
Read permissions to the Log & Report area.
For information on how each access control area correlates to which CLI commands that administrators can access, see
To use this command, your administrator account’s access control profile must have both r and w permissions to items in the admingrp category.
Syntax
config system accprofile edit
set set set set set set set set set set end set next
admingrp {none | r | rw | w} authusergrp {none | r | rw | w}
webgrp {none | r | rw | w} wvsgrp {none | r | rw | w}
Variable Description
<access-profile_name>
Type the name of the access profile. The maximum length is 35 characters.
To display the list of existing profiles, type: edit ?
admingrp {none | r | rw | w} authusergrp {none | r | rw | w}
Type the degree of access that administrator accounts using this access profile will have to the system administrator configuration.
Available only when administrative domains (ADOMs) are disabled. See
in
Type the degree of access that administrator accounts using this access profile will have to the HTTP authentication user configuration.
Default
No default.
none none
222 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system accprofile
Variable
learngrp {none | r | rw | w} loggrp {none | r | rw | w} mntgrp {none | r | rw | w} netgrp {none | r | rw | w} sysgrp {none | r | rw | w} traroutegrp {none | r | rw | w} wadgrp {none | r | rw | w} webgrp {none | r | rw | w} wvsgrp {none | r | rw | w}
Description
Type the degree of access that administrator accounts using this access profile will have to the auto-learning profiles and their resulting auto-learning reports.
Type the degree of access that administrator accounts using this access profile will have to the logging and alert email configuration.
Type the degree of access that administrator accounts using this access profile will have to maintenance commands.
Unlike the other rows, whose scope is an area of the configuration, the maintenance access control area does not affect the configuration. Instead, it indicates whether the administrator can perform special system operations such as changing the firmware.
Default
none none none
Type the degree of access that administrator accounts using this access profile will have to the network interface and routing configuration.
none
Type the degree of access that administrator accounts using this access profile will have to the basic system configuration
(except for areas included in other access control areas such as admingrp
).
none
Type the degree of access that administrator accounts using this access profile will have to the server policy (formerly called traffic routing) configuration.
Type the degree of access that administrator accounts using this access profile will have to the web anti-defacement configuration.
Type the degree of access that administrator accounts using this access profile will have to the web protection profile configuration.
Type the degree of access that administrator accounts using this access profile will have to the web vulnerability scanner.
none none none none
Example
This example configures an administrator access profile named full_access, which permits both read and write access to all special operations and parts of the configuration.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
223
system admin config
Even though this access profile configures full access, administrator accounts using this access profile will not be fully equivalent to the admin administrator. The admin administrator has some special privileges that are inherent in that account and cannot be granted through an access profile, such as the ability to reset other administrators’ passwords without knowing their current password. Other accounts should therefore not be considered a substitute, even if they are granted full access.
config system accprofile edit "full_access" set admingrp rw set authusergrp rw set learngrp rw set loggrp rw set mntgrp rw set netgrp rw set sysgrp rw set traroutegrp rw set wadgrp rw set webgrp rw set wvsgrp rw end next
Related topics
l
l
config server-policy custom-application application-policy
l
system admin
Use this command to configure FortiWeb administrator accounts. In its factory default configuration, a FortiWeb appliance has one administrator account, named admin. That administrator has permissions that grant full access to the FortiWeb configuration and firmware. After connecting to the web UI or the CLI using the admin administrator account, you can configure additional administrator accounts with various levels of access to different parts of the FortiWeb configuration.
Administrators can access the web UI and the CLI through the network, depending on administrator account’s trusted hosts, ADOMs, and the administrative access protocols enabled for each of the FortiWeb appliance’s
network interfaces. For details, see
and
Connecting to the CLI on page 67 .
To see which administrators are logged in, use the CLI command
.
To prevent multiple administrators from logging in simultaneously, which could allow them to inadvertently overwrite each other’s changes, enable
config singleadmin-mode {enable | disable}
224 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system admin
To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For more information, see
Syntax
config system admin edit
set
accprofile <access-profile_name>
set
accprofile-override {enable | disable}
set set
domains <adom_name> password <password_str>
set set set set set set set end next set set set set set set set set
admin-usergroup <remote-auth-group_name> wildcard {enable | disable} sshkey <sshkey_str>
Variable Description
<administrator_name>
Type the name of the administrator account, such as admin1 or [email protected], that can be referenced in other parts of the configuration.
Do not use spaces or special characters except the ‘at’ symbol ( @ ). The maximum length is 35 characters.
To display the list of existing accounts, type: edit ?
Note: This is the user name that the administrator must provide when logging in to the CLI or web UI. If using an external authentication server such as RADIUS or Active
Directory, this name will be passed to the server via the remote authentication query.
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
225
system admin
Variable
accprofile <accessprofile_name> accprofile-override
{enable | disable}
Description
Type the name of an access profile that gives the permissions for this administrator account. See also
is 35 characters.
You can select
prof_admin, a special access profile used by the admin administrator account. However, selecting this access profile will
not confer all of the same permissions of the admin administrator. For example, the new administrator would not be able to reset lost administrator passwords.
To display the list of existing profiles, type: edit ?
Tip: Alternatively, if your administrator accounts authenticate via a RADIUS query, you can assign their access profile through the RADIUS server using RFC
2548 Microsoft Vendor-specific RADIUS Attributes.
On the RADIUS server, create an attribute named:
CLI, use accprofile-override {enable | disable}
to enable the override.
If none is assigned on the RADIUS server, or if it does not match the name of an existing access profile on
FortiWeb, FortiWeb will fail back to use the one locally assigned by this setting.
Enable to use the access profile indicated by the RADIUS query response, and ignore
accprofile <access-profile_ name> .
This setting applies only if
admin-usergroup <remoteauth-group_name>
is configured to use a RADIUS query to authenticate this account.
This setting applies only if ADOMs are enabled. See
in
Default
No default.
disable config
226 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system admin
Variable
domains <adom_name>
Description
Type the name of an administrative domain (ADOM) to assign and restrict this administrative account to it.
This setting applies only if ADOMs are enabled. See
in
Default
No default.
password <password_str>
Type a password for the administrator account. The maximum length is 32 characters. The minimum length is
1 character.
For improved security, the password should be at least 8 characters long, be sufficiently complex, and be changed regularly.
This setting applies only when type is local-user.
For accounts defined on a remote authentication server, the FortiWeb appliance will instead query the server to verify whether the password given during a login attempt matches the account’s definition.
No default.
email-address <contact_ email> first-name <name_str>
Type an email address that can be used to contact this administrator. The maximum length is 35 characters.
No default.
Type the first name of the administrator. The maximum length is 35 characters.
No default.
last-name <surname_str> mobile-number
<cell-phone_str>
Type the surname of the administrator. The maximum length is 35 characters.
Type a cell phone number that can be used to contact this administrator. The maximum length is 35 characters.
phone-number <phone_str>
Type a phone number that can be used to contact this administrator. The maximum length is 35 characters.
No default.
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
227
system admin
Variable
trusthost1 <managementcomputer_ipv4mask> trusthost2 <managementcomputer_ipv4mask> trusthost3 <managementcomputer_ipv4mask>
Description
Type the IP address and netmask of a management computer or management LAN from which the administrator is allowed to log in to the FortiWeb appliance. You can specify up to three trusted hosts.
To allow login attempts from any IP address, enter
0.0.0.0/0.0.0.0
. If you allow administrators to log in from any IP address, consider choosing a longer and more complex password, and limiting administrative access to secure protocols to minimize the security risk.
For information on administrative access protocols, see
Note: For improved security, restrict all three trusted host addresses to the IP addresses of computers from which only this administrator will log in.
Type a second IP address and netmask of a management computer or management LAN from which the administrator is allowed to log in to the FortiWeb appliance.
To allow login attempts from any IP address, enter
0.0.0.0/0.0.0.0
.
Type a third IP address and netmask of a management computer or management LAN from which the administrator is allowed to log in to the FortiWeb appliance.
To allow login attempts from any IP address, enter
0.0.0.0/0.0.0.0
.
Default
0.0.0.0
0.0.0.0
0.0.0.0
0.0.0.0
0.0.0.0
0.0.0.0
config
228 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system admin
Variable
ip6trusthost1
<management-computer_ ipv6mask> ip6trusthost2
<management-computer_ ipv6mask> ip6trusthost3
<management-computer_ ipv6mask> type {local-user | remote-user}
Description
Type the IP address and netmask of a management computer or management LAN from which the administrator is allowed to log in to the FortiWeb appliance. You can specify up to three trusted hosts.
To allow login attempts from any IP address, enter ::/0.
Caution: If you allow logins from any IP address, consider choosing a longer and more complex password, and limiting administrative access to secure protocols to minimize the security risk. Unlike IPv4, IPv6 does
not
isolate public from private networks via NAT, and therefore can increase availability of your FortiWeb’s web
UI/CLI to IPv6 attackers unless you have carefully configured your firewall/FortiGate and routers. For information on administrative access protocols, see
Note: For improved security, restrict all three trusted host addresses to the IP addresses of computers from which only this administrator will log in.
Type a second IP address and netmask of a management computer or management LAN from which the administrator is allowed to log in to the FortiWeb appliance.
To allow login attempts from any IP address, enter ::/0.
Type a third IP address and netmask of a management computer or management LAN from which the administrator is allowed to log in to the FortiWeb appliance.
To allow login attempts from any IP address, enter ::/0.
Select either: l local-user
— Authenticate this account locally, with the
FortiWeb appliance itself.
l remote-user
— Authenticate this account via a remote server such as an LDAP or RADIUS server. Also configure
admin-usergroup <remote-auth-group_name> .
Default
::/0
::/0
::/0
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
229
system admin
Variable Description
admin-usergroup <remoteauth-group_name>
Type the name of the remote authentication group whose settings the FortiWeb appliance will use to connect to a remote authentication server when authenticating login attempts for this account. The maximum length is 35 characters.
To display the list of existing groups, type: edit ?
For details on configuring remote authentication groups, see
wildcard {enable | disable} sshkey <sshkey_str>
Used when administrator accounts authenticate via a
RADIUS query.
This setting applies only if the value of type is remote-user
.
The public key used for connecting to the CLI using a public-private key pair.
For more information on connecting to the CLI using a public-private key pair, see “Connecting to the CLI” in the
FortiWeb Administration Guide
.
Default
No default.
No default.
No default.
config
Example
This example configures an administrator account with an access profile that grants only permission to read logs.
This account can log in only from an IP address on the management LAN (172.16.2.0/24), or from one of two specific IP addresses (172.16.3.15 and 192.168.1.50).
config system admin edit "log-auditor" set accprofile "log_read_access" set password P@ssw0rd set email-address [email protected]
end set trusthost1 172.16.2.0 255.255.255.0
set trusthost2 172.16.3.15 255.255.255.255
set trusthost3 192.168.1.50 255.255.255.255
next
To display all dashboard status and widget settings, enter: config system admin show
230 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system admin-certificate ca
Related topics
l
l
l
system admin-certificate ca
When FortiWeb's certificate-based Web UI login is applied. Besides the administrators' certificates information, the corresponding certificate authority (CA) certificates are required to be stored on the FortiWeb appliance.
Certificate authorities validate and sign other certificates in order to indicate to third parties that those other certificates are authentic and can be trusted. FortiWeb authorizes the administrator's login by verifying its certificate with the corresponding CA.
Use this command to show the names of the CA certificates that are relative to the administrators' certificates.
You use the web UI to upload these certificates.
CA certificates are not used directly here (no set operations are defined), but they are required when you create a
PKI user (an administrator that FortiWeb authorizes base on his certificate) on the FortiWeb, see
.
For information about certificate-based Web UI login, see the
FortiWeb Administration Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For more information, see
Syntax
show system admin-certificate ca
Example
config system admin-certificate ca edit "CA_Cert_1" next end edit "CA_Cert_2" next
system admin-certificate local
The FortiWeb appliance presents its own HTTPS server certificate for secure connections (HTTPS) to its Web UI.
By default, A Fortinet factory certificate is used as the certificate, which is named defaultcert in FortiWeb system. You can also import other certifications to FortiWeb and replace the defaultcert with any of them for secure Web UI connections.
Use this command to edit the comment associated with the these FortiWeb's administration certificates that are stored locally on the FortiWeb appliance.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
231
system admin-certificate local config
To replace the certificate that FortiWeb uses for the secure accesses to its Web UI, see
.
For information on how to upload a certificate file to change FortiWeb's default certificate, see the
FortiWeb
Administration Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For more information, see
Syntax
config system admin-certificate local edit
set
set
set
set
end next
Variable
<certificate_name> comment "<comment_str>" flag {0 | 1}
Description
Type the name of a certificate file. The maximum length is 35 characters.
Type a description or other comment. If the comment contains more than one word or contains an apostrophe, surround the comment in double quotes ( " ). The maximum length is 127 characters.
No default.
Indicates if a password was saved. This is used by FortiWeb for backwards compatibility.
No default.
status {na | ok | pending}
Indicates the status of an imported certificate: l na indicates that the certificate was successfully imported, and is currently selected for use by the FortiWeb appliance.
l ok indicates that the certificate was successfully imported but is not selected as the certificate currently in use. To use the certificate, see
in
l pending indicates that the certificate request was generated, but must be downloaded, signed, and imported before it can be used as a local certificate.
type {certificate | csr} Indicates whether the file is a certificate or a certificate signing request (CSR).
Default
No default.
No default.
No default.
Example
This example adds a comment to the certificate named certificate1.
config system admin-certificate local edit certificate1
232 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system advanced set comment "This is a certificate that FortiWeb uses for secure Web UI connections." end next
system advanced
Use this command to configure several system-wide options that determine how FortiWeb scans traffic.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system advanced set set
circulate-url-decode {enable | disable}
set set set set
max-http-header-length {8k-cache | 12k-cache}
end set
max-multipart-buffsize-per-arg <buffersize_int>
set
set
Variable
circulate-url-decode
{enable | disable}
Default
disable
Description
Enable to detect URL-embedded attacks that are obfuscated using recursive URL encoding (that is, multiple levels’ worth of URL encoding).
Encoded URLs can be legitimately used for non-English
URLs, but can also be used to avoid detection of attacks that use special characters. Encoded URLs can now be decoded to scan for these types of attacks. Several encoding types are supported.
For example, you could detect the character A that is encoded as either %41, %x41, %u0041, or \t41.
Disable to decode only one level’s worth of the URL, if encoded.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
233
system advanced
Variable
max-cache-size <cache_ int>
Description
Type the maximum size in kilobytes (KB) of the body of the HTTP response from the web server that FortiWeb will cache per URL.
Responses are cached to improve performance on compression, decompression, and rewriting on oftenrequested URLs.
Valid values range from 32 to 1,024. The default value is
64.
Increasing the body cache may decrease performance.
max-dlp-cache-size
<percentage_int> max-dos-alert-interval
<seconds_int>
Type the maximum percentage of
— the body of the HTTP response from the web server — that FortiWeb buffers and scans.
Responses are cached to improve performance on compression, decompression, and rewriting on oftenrequested URLs.
Type the maximum amount of time that FortiWeb will converge into a single log message during a DoS attack or padding oracle attack.
max-http-argbuf-length
{8k-cache | 12k-cache |
32k-cache | 64k-cache}
Select the maximum buffer size in kilobytes (KB) for each parameter in the HTTP request. The buffer applies regardless of HTTP method, and whether the parameters are in the URL or body.
Caution: Fortinet strongly recommends that you configure FortiWeb to block requests larger than
this buffer. FortiWeb cannot scan parameters that exceed this buffer size and allows them to pass through.
To prevent oversize attacks, configure FortiWeb to block oversized parameters using
and
.
Some web applications require very large requests or parameters, and will not work if oversized parameters are blocked. To be sure that hardening the configuration will not disrupt normal traffic, first configure
<parameter_ name>-action {alert | alert_deny | block-period}
to be alert
. If no problems occur, switch it to alert_deny.
Tip: Increasing the buffer size increases memory consumption slightly, and may decrease performance.
Only increase this value if necessary.
Default
64
12
180
8kcache config
234 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system advanced
Variable
max-http-header-length
{8k-cache | 12k-cache}
Description
Select the maximum buffer size in kilobytes (KB) for the
Cookie:
, User-Agent:, Host:, Referer:, and other headers in the HTTP request.
Caution: Fortinet strongly recommends that you configure FortiWeb to block requests if those
headers are larger than this buffer. FortiWeb cannot scan headers that exceed this buffer size and allows them to pass through. To prevent oversized attacks, configure
FortiWeb to block oversized headers using
waf httpprotocol-parameter-restriction
.
Some web applications require very large requests, cookies, or parameters, and will not work if oversized parameters or cookies are blocked. To be sure that hardening the configuration will not disrupt normal traffic, first configure
<parameter_name>-action {alert | alert_ deny | block-period}
to be alert. If no problems occur, switch it to alert_deny.
Tip: Increasing the buffer size increases memory consumption slightly, and may decrease performance.
Only increase this value if necessary.
max-multipart-buffsizeper-arg <buffersize_int>
Adjust parsing buffer size (kB) for each of the arguments in multipart/form-data HTTP messages. Message that exceeds the limitation will be bypassed by FortiWeb's security inspection.
Valid values range from 1 to 32.
This is only for multipart/form-data messages.
share-ip {enable | disable}
Enable to analyze the ID field of IP headers in order to attempt to detect when multiple clients share the same source IP address. To configure the difference between packets’ ID fields that FortiWeb will treat as a shared IP, use
.
Enabling this option is required for features that have a separate threshold for shared IP addresses, such as brute force login prevention. If you disable the option, those features will behave as if there is only a single threshold, regardless of whether the source IP is shared by many clients.
upfile-count {8 | 16}
Default
8kcache
8 disable
Select the maximum number of uploaded files that FortiWeb antivirus will scan before deciding to pass or block the request.
8
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
235
system antivirus config
Related topics
l
l
config system certificate local
l
l
l
l
config waf application-layer-dos-prevention
l
config waf http-protocol-parameter-restriction
system antivirus
Use this command to configure system-wide FortiGuard Antivirus scan settings.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system antivirus set set
default-db {basic | extended} scan-bzip2 {enable | disable}
set
set
end
Variable
default-db {basic | extended} scan-bzip2 {enable | disable}
Description Default
Select which of the antivirus signature databases to use when scanning HTTP POST requests for trojans, either: l l basic
— Select to use only the signatures of viruses and greyware that have been detected by FortiGuard’s networks to be recently spreading in the wild.
extended
— Select to use all signatures, regardless of whether the viruses or greyware are currently spreading.
basic
Enable to scan archives that are compressed using the
BZIP2 algorithm.
Tip: Scanning BZIP2 archives can be very CPU-intensive.
To improve performance, block the BZIP2 file type, then disable this option.
enable
236 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system autoupdate override
Variable
uncomp-size-limit
<limit_int> uncomp-nest-limit
<limit_int>
Description
Type the maximum size in kilobytes (KB) of the memory buffer that FortiWeb will use to temporarily undo the compression that a client or web server has applied to traffic, in order to inspect and/or modify it. See
config waf file-uncompress-rule
Caution: Unless you configure otherwise, compressed requests that are too large for this buffer will pass through
FortiWeb
without scanning or rewriting. This could
allow malware to reach your web servers, and cause
HTTP body rewriting to fail. If you prefer to block requests greater than this buffer size, configure
max-httpbody-length <limit_int> . To be sure that it will not disrupt
normal traffic, first configure action to be alert. If no problems occur, switch it to alert_deny.
The valid range is from 1 to 30720 KB (30 MB).
Type the maximum number of allowed levels of compression
(“nesting”) that FortiWeb will attempt to decompress.
Default
5000
12
Related topics
l
system autoupdate override
Use this command to override the default Fortiguard Distribution Server (FDS).
If you cannot connect to the FortiGuard Distribution Network (FDN) or if your organization provides updates using their own FortiGuard server, you can override the FDS server setting so that the FortiWeb appliance connects to this server instead of the default server on Fortinet’s public FDN.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
config system autoupdate override set
end set set
address {<fds_fqdn> | <fds_ipv4>} fail-over {enable | disable}
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
237
system autoupdate schedule config
Variable
status {enable | disable} address {<fds_fqdn> |
<fds_ipv4>} fail-over {enable | disable}
Description
Enable to override the default list of FDN servers, and connect to a specific server.
Default
disable
Type either the IP address or fully qualified domain name
(FQDN) of the FDS override.
No default.
Enable to fail over to one of the public FDN servers if FortiWeb cannot reach the server specified in your FDS override.
enable
Related topics
l
config system autoupdate schedule
system autoupdate schedule
Use this command to configure how the FortiWeb appliance will access the Fortinet Distribution Network (FDN) to retrieve updates. The FDN is a world-wide network that delivers FortiGuard service updates of predefined robots, data types, suspicious URLS, IP address reputations, and attack signatures used to detect attacks such as: l l l cross-site scripting (XSS)
SQL injection common exploits
Alternatively, you can manually upload update packages. For details, see the
FortiWeb Administration Guide
.
FortiWeb appliances connect to the FDN by connecting to the Fortinet Distribution Server (FDS) nearest to the
FortiWeb appliance based on its configured time zone.
In addition to manual update requests, FortiWeb appliances support an automatic scheduled updates, by which the FortiWeb appliance periodically polls the FDN to determine if there are any available updates.
If you want to connect to a specific FDS, you must configure
config system autoupdate override
your FortiWeb appliance must connect through a web proxy, you must also configure
config system autoupdate tunneling
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
config system autoupdate schedule set
set set
frequency {daily | every | weekly} time <time_str>
238 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system autoupdate tunneling end set
day {Sunday | Monday | Tuesday | Wednesday | Thursday | Friday |
Variable
status {enable | disable} frequency {daily | every | weekly} time <time_str>
Description Default
Enable to periodically request signature updates from the FDN.
disable
Select the frequency with which the FortiWeb appliance will request signature updates.
Type the time at which the FortiWeb appliance will request signature updates.
The time format is hh:mm, where: l l hh is the hour according to a 24-hour clock mm is the minute every
00:00 day {Sunday | Monday |
Tuesday | Wednesday |
Thursday | Friday |
Saturday}
Select which day of the week that the FortiWeb appliance will request signature updates. This option applies only if frequency is weekly.
Monday
Example
This example configures weekly signature update requests on Sunday at 2:00 PM.
config system autoupdate schedule set status enable end set frequency weekly set day Sunday set time 14:00
Related topics
l
config system autoupdate override
l
config system autoupdate tunneling
l
system autoupdate tunneling
Use this command to configure the FortiWeb appliance to use a proxy server to connect to the Fortinet
Distribution Network (FDN).
The FortiWeb appliance will connect to the proxy using the HTTP CONNECT method, as described in RFC 2616 .
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
239
system autoupdate tunneling
Syntax
config system autoupdate tunneling set set
status {enable | disable} address {<proxy_fqdn> | <proxy_ipv4>}
set set end set
port <port_int> username <proxy-user_str> password <proxy-password_str>
Variable
status {enable | disable}
Description
Enable to connect to the FDN through a web proxy.
address {<proxy_fqdn> |
<proxy_ipv4>}
Type either the IP address or fully qualified domain name
(FQDN) of the web proxy. The maximum length is 63 characters.
port <port_int> username <proxy-user_ str> password <proxypassword_str>
Default
disable
No default.
Type the port number on which the web proxy listens for connections. The valid range is from 0 to 65,535.
0
If the proxy requires authentication, type the FortiWeb appliance’s login name on the web proxy.The maximum length is 49 characters.
No default.
If the proxy requires authentication, type the password for the
FortiWeb appliance’s login name on the web proxy. The maximum length is 49 characters.
No default.
Example
This example configures the FortiWeb appliance to connect through a web proxy that requires authentication.
config system autoupdate tunneling set status enable set address 192.168.1.10
set port 1443 end set username fortiweb set password myPassword1
Related topics
l
config system autoupdate schedule
config
240 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system backup
system backup
Use this command to configure automatic backups of the system configuration to an FTP or SFTP server. You can either run the backup immediately or schedule it to run periodically.
The backup can include all uploaded files such as error pages, WSDL files, certificates, and private keys. Fortinet recommends that if you have many such files, that you include them in the backup. This saves you valuable time if you need to restore the configuration in an emergency.
Fortinet strongly recommends that you password-encrypt this backup, and store it in a secure location. This backup method includes sensitive data such as your HTTPS certificates’ private keys. Unauthorized access to private keys compromises the security of all HTTPS requests using those certificates.
To restore a backup, see
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
.
Syntax
config system backup edit
set set
config-type {full-config |cli-config | waf-config} encryption {enable | disable}
set set set set set set set set set set end next
Variable Description
<backup_name>
Type the name of the backup configuration. The maximum length is 59 characters.
To display the list of existing backups, type: edit ?
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
241
system backup
Variable
config-type {fullconfig |cli-config | waf-config} encryption {enable | disable} encryption-passwd
<password_str> ftp-auth {enable | disable} ftp-user <user_str> ftp-passwd <password_ str> ftp-dir "<directorypath_str>"
Description
Select either: l l l full-config
— Include both the configuration file and other uploaded files, such a certificate and error page files, in the backup.
cli-config
— Include only the configuration file in the backup.
waf-config
— Include only the web protection profiles in the backup.
Default
cliconfig
Enable to encrypt the backup file using 128-bit AES and a password.
Caution: Unlike when downloading a backup from the web UI to your computer, this does include all certificates and private keys. Fortinet strongly recommends that you password-encrypt this backup, and store it in a secure location.
Type the password that will be used to encrypt the backup file.
This field appears only if you enable
.
disable disable Enable if the server requires that you provide a user name and password for authentication, rather than allowing anonymous connections. When enabled, you must also configure
and
.
Disable for FTP servers that allow anonymous uploads.
Type the user name that the FortiWeb appliance will use to authenticate with the server. The maximum length is
127 characters.
This variable is not available unless ftp-auth is enable
.
No default.
No default.
Type the password corresponding to the account specified in
ftp-user <user_str> . The maximum length is
127 characters.
This variable is not available unless ftp-auth is enable
.
Type the directory path on the server where you want to store the backup file. The maximum length is 127 characters.
No default.
config
242 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system backup
Variable
ftp-server {<server_ ipv4> | <server_fqdn>}
Description Default
Type either the IP address or fully qualified domain name
(FQDN) of the server. The maximum length is 127 characters.
No default.
protocol-type {ftp | sftp} schedule_type {now | days}
Select whether to connect to the server using FTP or SFTP.
ftp
Select one of the schedule types: l now
— Use this to initiate the FTP backup immediately upon ending the command sequence.
l days
— Enter this to allow you to set days and a time to run the backup automatically. You must also configure schedule_days and schedule_time.
now schedule_days {sun mon tue wed thu fri sat}
Select one or more days of the week when you want to run a periodic backup. Separate each day with a blank space.
For example, to back up the configuration on Monday and
Friday, type: set schedule_days mon,fri
This command is available only if schedule_type is days
.
schedule_time <time_str> Type the time of day to run the backup.
The time format is hh:mm, where: l hh is the hour according to a 24-hour clock l mm is the minute
This command is available only if schedule_type is days
.
No default.
00:00
Example
This example configures a scheduled, full configuration backup every Sunday and Friday at 1:15 AM. The
FortiWeb appliance authenticates with the FTP server using an account named fortiweb1 and its password,
P@ssword1
. It does not encrypt the backup file.
config system backup edit "Scheduled_Backup" set config-type full-config set protocol-type ftp set ftp-auth enable set ftp-user fortiweb1 set ftp-passwd P@ssword1 set ftp-server 172.20.120.01
set ftp-dir "/config-backups" set schedule_type days set schedule_days sun,fri
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
243
system certificate ca end set schedule_time 01:15 next
Related topics
l
l
config
system certificate ca
Use this command to show the names of certificates for a certificate authority (CA). You use the web UI to upload these certificates.
Certificate authorities validate and sign other certificates in order to indicate to third parties that those other certificates are authentic and can be trusted
CA certificates are not used directly, but must first be grouped in order to be selected in a certificate verification rule. For details, see
config system certificate ca-group
.
For information on how to upload a certificate file, see the
FortiWeb Administration Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For more information, see
Syntax
show system certificate ca
Example
config system certificate ca edit "CA_Cert_1" next edit "CA_Cert_2" end next
Related topics
l
config system certificate ca-group
l
config system certificate verify
system certificate ca-group
Use this command to group certificate authorities (CA).
CAs must belong to a group in order to be selected in a certificate verification rule.
244 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system certificate ca-group
To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For more information, see
Syntax
config system certificate ca-group edit
config members edit
set
end next end next
Variable
<ca-group_name>
<ca_index> name <ca_name>
Description
Type the name of a certificate authority (CA) group. The maximum length is 35 characters.
Default
No default.
Type the index number of a CA within its group. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
Type the name of a previously uploaded CA certificate. The maximum length is 35 characters.
No default.
Example
This example groups two CA certificates into a CA group named caVEndors1.
config system certificate ca-group edit "caVendors1" config members edit 1 end end next set name "CA_Cert_1" next edit 2 set name "CA_Cert_2" next
Related topics
l
l
config system certificate local
l
config system certificate verify
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
245
system certificate crl config
system certificate crl
Use this command to edit the URL associated with a previously uploaded certificate revocation list (CRL).
To ensure that your FortiWeb appliance validates only certificates that have not been revoked, you should periodically upload a current certificate revocation list, which may be provided by certificate authorities (CA).
For information on how to upload a CRL, see the
FortiWeb Administration Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For more information, see
Syntax
config system certificate crl edit
set
end next
Variable
<crl_name> url <crl_str>
Description
Type the name of a CRL. The maximum length is 35 characters.
Default
No default.
If you did not upload a CRL file, but instead will query for it from an HTTP or OCSP server, enter the URL of the CRL. The maximum length is 127 characters.
No default.
Related topics
l
l
config system certificate local
l
config system certificate verify
system certificate intermediate-certificate
Use this command to show the names of uploaded intermediate CA certificate. You upload these certificates using the web UI.
For information on how to upload an intermediate certificate file, see the
FortiWeb Administration Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For more information, see
Syntax
show system certificate intermediate-certificate
246 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system certificate intermediate-certificate-group
Example
config system certificate intermediate-certificate edit "Inter_Cert_1" next edit "Inter_Cert_2" next edit "Inter_Cert_3" end next
Related topics
l
l
config system certificate intermediate-certificate-group
l
system certificate intermediate-certificate-group
Use this command to group intermediate CA certificates.
Intermediate CAs must belong to a group in order to be selected in a certificate verification rule.
To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For more information, see
Syntax
config system certificate intermediate-certificate-group edit
config members edit
set
end next end next
Variable
<intermediate-ca-group_ name>
<intermediate-ca_index> name <ca_name>
Description
Type the name of an intermediate certificate authority (CA) group. The maximum length is 35 characters.
Type the index number of an intermediate CA within its group.
The valid range is from 1 to 9,999,999,999,999,999,999.
Type the name of a previously uploaded intermediate CA certificate. The maximum length is 35 characters.
Default
No default.
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
247
system certificate local config
Related topics
l
l
config system certificate intermediate-certificate
l
system certificate local
Use this command to edit the comment associated with a server certificate that is stored locally on the FortiWeb appliance.
You can also configure settings for a certificate that works with an HSM (hardware security module). For more information on HSM integration, see
and the
FortiWeb Administration Guide
.
FortiWeb appliances require these certificates to present when clients request secure connections, including when: l l l administrators connect to the web UI (HTTPS connections only) web clients use SSL or TLS to connect to a virtual server, if you have enabled SSL off-loading in the policy (HTTPS connections and reverse proxy mode) web clients use SSL or TLS to connect to a physical server (HTTPS connections and true transparent mode)
FortiWeb appliances also require certificates in order to decrypt and scan HTTPS connections travelling through it if operating in offline protection or transparent inspection modes.
Which certificate will be used, and how, depends on the purpose.
l
For connections to the web UI, the FortiWeb appliance presents its default certificate.
The FortiWeb appliance’s default certificate does not appear in the list of local certificates. It is used only for connections to the web UI and cannot be removed.
l
For SSL off-loading or SSL decryption, upload certificates that do
not belong to the FortiWeb appliance, but instead belong to the protected hosts. Then, select which one the FortiWeb appliance will use when configuring the SSL option in a policy or server farm.
For information on how to upload a certificate file, see the
FortiWeb Administration Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For more information, see
Syntax
config system certificate local edit
set set set set set set
248 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system certificate local end next
Variable
<certificate_name> comment "<comment_str>" status {na | ok | pending}
Description
Type the name of a certificate file. The maximum length is 35 characters.
Type a description or other comment. If the comment contains more than one word or contains an apostrophe, surround the comment in double quotes ( " ). The maximum length is 127 characters.
Indicates the status of an imported certificate: l na indicates that the certificate was successfully imported, and is currently selected for use by the FortiWeb appliance.
l ok indicates that the certificate was successfully imported but is not selected as the certificate currently in use. To use the certificate, select it in a policy or server farm.
l pending indicates that the certificate request was generated, but must be downloaded, signed, and imported before it can be used as a local certificate.
Default
No default.
No default.
No default.
type {certificate | csr}
Indicates whether the file is a certificate or a certificate signing request (CSR).
flag {0 | 1} Indicates if a password was saved. This is used by FortiWeb for backwards compatibility.
No default.
No default.
is-hsm {no | yes}
Specifies whether you configured the CSR for this certificate to work with an integrated HSM.
no partition-number
<partition_name>
Enter the name of the HSM partition you selected when you created the CSR for this certificate.
No default.
Example
This example adds a comment to the certificate named certificate1.
config system certificate local edit certificate1 end set comment "This is a certificate for the host www.example.com." next
Related topics
l
l
l
config server-policy server-pool
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
249
system certificate sni config
system certificate sni
In some cases, the members of a server pool or a single pool member host multiple secure websites that use different certificates. Use this command to create a Server Name Indication (SNI) configuration that identifies the certificate to use by domain.
You can select a SNI configuration in a server policy only when the operating mode is reverse proxy mode and an
HTTPS configuration is applied to the policy.
Not all web browsers support SNI. Go to the following location for a list of web browsers that support SNI: http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers_with_support_for_TLS_server_name_ indication.5B10.5D
To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For more information, see
Syntax
config system certificate sni edit
config members edit
set
set
set set
end set next end
Variable
<sni_name>
<entry_index> domain-type {plain | regular} domain <server_fqdn>
Description
Type the name of an Server Name Indication (SNI) configuration.
Default
No default.
Type the index number of an SNI configuration entry. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
Specifies plain to match a domain to certificates using a literal domain specified in domain; or specifies regular to match multiple domains to certificates using a regular expression specified in domain.
Type the domain of the secure website (HTTPS) that uses the certificate specified by
local-cert <local-cert_ name> .
Enter a literal domain if domain-type is set to plain; or enter a regular expression if domain-type is set to regular
.
plain
No default.
250 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system certificate sni
Variable
local-cert <local-cert_ name>
Description
Type the name of the server certificate that FortiWeb uses to encrypt or decrypt SSL-secured connections for the website specified by
.
inter-group
<intermediate-cagroup_ name> verify <certificate_ verificator_name>
Type the name of a group of intermediate certificate authority (CA) certificates, if any, that FortiWeb presents to validate the CA signature of the certificate specified by
.
If clients receive certificate warnings that an intermediary
CA has signed the server certificate configured in localcert
, rather than by a root CA or other CA currently trusted by the client directly, configure this option.
Alternatively, include the entire signing chain in the server certificate itself before uploading it to the FortiWeb appliance, thereby completing the chain of trust with a CA already known to the client. See the
FortiWeb
Administration Guide
.
Type the name of a certificate verifier, if any, that
FortiWeb uses when an HTTP client presents its personal certificate. (If you do not select one, the client is not required to present a personal certificate.)
Personal certificates, sometimes also called user certificates, establish the identity of the person connecting to the web site (PKI authentication).
You can require that clients present a certificate alternatively or in addition to HTTP authentication (see
config waf http-authen http-authen-rule
To display the list of existing verifiers, type: edit ?
Note: The client must support SSL 3.0 or TLS 1.0.
Default
Related topics
l
config system certificate local
l
config system certificate intermediate-certificate-group
l
config system certificate verify
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
251
system certificate urlcert config
system certificate urlcert
Use this command to configure the URL-based client certificate feature for a server policy or server pool. This feature allows you to require a certificate for some requests and not for others. Whether a client is required to present a personal certificate or not is based on the requested URL and the rules you specify in the URL-based client certificate group.
A URL-based client certificate group specifies the URLs to match and whether the matched request is required to present a certificate or exempt from presenting a certificate.
When the URL-based client certificate feature is enabled, clients are not required to present a certificate if the request URL is specified as exempt in the URL-based client certificate group rule or URL of the request does not match a rule.
Syntax
config system certificate urlcert edit
config list edit
set
url <url_str> require {enable | disable}
end set next end
Variable
<url-cert-group_name>
<entry_index> url <url_str> require {enable | disable}
Description
Enter the name for the URL-based client certificate group.
Default
No default.
Type the index number of an URL-based client certificate group entry.
No default.
Enter a URL to match.
When the URL of a client request matches this value and the value of require is enable, FortiWeb requires the client to present a private certificate.
No default.
Specifies whether client requests with the URL specified by url are required to present a personal certificate.
When you select disable, FortiWeb does not require client requests with the specified URL to present a personal certificate.
No default.
252 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system certificate verify
Related topics
l
l
config server-policy server-pool
system certificate verify
Use this command to configure how the FortiWeb appliance will verify certificates presented by HTTP clients.
To apply a certificate verification rule, select it in a policy. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For more information, see
Syntax
config system certificate verify edit
<certificate_verificator_name>
set
set
end next
Variable
<certificate_ verificator_name> ca <ca-group_name> crl <crl_name>
Description
Type the name of a certificate verifier. The maximum length is
35 characters.
Default
No default.
Type the name of a CA group, if any, that you want to use to authenticate client certificates. The maximum length is 35 characters.
Type the name of a certificate revocation list, if any, to use to verify the revocation status of client certificates. The maximum length is 35 characters.
No default.
No default.
Related topics
l
config system certificate ca-group
l
l
l
config server-policy server-pool
system conf-sync
Use this command to configure non-HA configuration synchronization settings.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
253
system conf-sync config
This command configures, but does not execute, the synchronization. To do this, use the web UI.
This command works only when administrative domains (ADOMs) are disabled.
This type of synchronization is used between FortiWeb appliances that are not part of a native FortiWeb high availability (HA) pair, such as when you need to clone the configuration once, or when HA is provided by an external device.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system conf-sync set
set set
sync-type {full-sync | partial-sync}
end set
Variable
ip <remote-fortiweb_ ipv4>
Description
Type the IP address of the remote FortiWeb appliance that you want to synchronize with the local FortiWeb appliance.
password <password_str>
Type the administrator password for the remote FortiWeb appliance. The maximum length is 63 characters.
Default
0.0.0.0
No default.
254 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system conf-sync
Variable
sync-type {full-sync | partial-sync}
Description
Select one of the synchronization types.
For all operation modes except WCCP, full-sync updates the entire configuration of the peer FortiWeb appliance except for the following items: l
Network interface used for synchronization (prevents sync from accidentally breaking connectivity with future syncs) l
Administrator accounts l
Access profiles l
HA settings
For the WCCP operation mode, full-sync updates the entire configuration except for the following items: l config system interface l config route static l config route policy l config system wccp l
Administrator accounts l
Access profiles l
HA settings
For all operation modes, partial-sync updates the configuration of the peer FortiWeb appliance,
except
for the following items: router ...
server-policy health server-policy http-content-routing-policy server-policy persistence-policy server-policy policy server-policy server-pool server-policy service custom server-policy service predefined server-policy vserver system ...
Default
partialsync server-port <port_int>
Type the port number of the remote (peer) FortiWeb appliance that is used to connect to the local appliance for configuration synchronization. The valid range is from 1 to 65,535.
Caution: The port number used with this command must be different than the port number used with
command or the submitting operation will fail.
955
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
255
system console config
Related topics
l
l
system console
Use this command to configure the management console settings. Usually this is set during the early stages of installation and needs no adjustment.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system console set
baudrate {9600 | 19200 | 38400 | 57600 | 115200}
set set
mode {batch | line} output {more | standard}
end set
Variable Description Default
baudrate {9600 |
19200 | 38400 | 57600 |
115200}
Select the baud rate of the console connection. The rate should conform to the specifications of your specific FortiWeb appliance.
9600 mode {batch | line} output {more | standard} shell [cli | sh}
Select the console input mode: either batch or line.
Select either: l cli
— Command-line shell.
l sh
— Busybox shell.
line
Select either: l l more
— When displaying multiple pages’ worth of output, pause after displaying each page’s worth of text. When the display pauses, the last line displays
--More--
. You can then either:
• Press the spacebar to display the next page.
• Type Q to truncate the output and return to the command prompt.
standard
— Do not pause between pages’ worth of output, and do not offer to truncate output.
standard cli
256 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system dns
Example
This example configures the local console connection to operate at 9,600 baud, and to show long output in a paged format.
config system console set baudrate 9600 end set output more
Related topics
l
system dns
Use this command to configure the FortiWeb appliance with its local domain name, and the IP addresses of the domain name system (DNS) servers that the FortiWeb appliance will query to resolve domain names such as www.example.com into IP addresses.
FortiWeb appliances require connectivity to DNS servers for DNS lookups. Use either the DNS servers supplied by your Internet service provider (ISP) or the IP addresses of your own DNS servers. You must provide unicast, nonlocal addresses for your DNS servers. Local host and broadcast addresses will not be accepted.
For improved performance, use DNS servers on your local network.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system dns set
set
set
end
Variable
primary <dns_ipv4> secondary <dns_ipv4>
Description
Type the IP address of the primary DNS server.
Type the IP address of the secondary DNS server.
Default
8.8.8.8
0.0.0.0
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
257
system eventhub
Variable
domain <local-domain_ str>
Description
Type the name of the local domain to which the FortiWeb appliance belongs, if any. The maximum length is 127 characters.
This field is optional. It will not appear in the Host: field of HTTP headers for client connections to protected web servers.
Note: You can also configure the host name. For details, see
.
Default
No default.
config
Example
This example configures the FortiWeb appliance with the name of the local domain to which it belongs, example.com. It also configures its host name, fortiweb. Together, this configures the FortiWeb appliance with its own fully qualified domain name (FQDN), fortiweb.example.com.
config system global set hostname "fortiweb" end config system dns end set domain example.com
Related topics
l
l
l
l
l
system eventhub
When FortiWeb-VM is deployed on Azure, use this command to manually configure the FortiWeb appliance to send log messages to Azure Event Hubs.
Alternatively, you can create the configuration automatically using a PowerShell script. For more information, see the
FortiWeb-VM for Azure Install Guide.
When the event hub configuration is complete, FortiWeb sends health logs to Azure Event Hub.
If you also create a corresponding Azure CEF SIEM policy (see
), FortiWeb also sends security logs to Azure Event Hubs.
This command is available for FortiWeb-VM running on Microsoft Azure only.
You can use the Azure classic portal to obtain the values that the config system eventhub settings require. For detailed instructions, see the
FortiWeb-VM for Azure Install Guide.
258 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system fail-open
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system eventhub set
set
appliance_id <subscription_str>
set
policy_saskey <primary-key_str>
set set
policy_name <policy-name_str> eventhub_name <ehub-name_str>
end set
servicebus_namespace <servicebus-namespace_str>
Variable
status {enable | disable}
Description Default
Enter enable to activate the Azure event hub configuration.
disable appliance_id
<subscription_str>
Enter the subscription (ID) that has the access to the Azure
Event Hub policy_saskey <primarykey_str>
Enter the primary shared access key that the specified policy (by policy_name <policy-name_str>) uses for Shared Access Signature authentication on the Azure
Event Hub.
policy_name <policyname_str> eventhub_name <ehubname_str>
Enter the name of the Shared Access policy created for the Azure Event Hub.
Enter the name of the Azure Event Hub that is associated with the specified service bus (by servicebus_ namespace <servicebus-namespace_str>
).
servicebus_namespace
<servicebus-namespace_ str>
Enter the Service Bus Namespace that the Event Hub is created at.
No default.
No default.
No default.
No default.
No default.
Related topics
l
l
system fail-open
If your appliance’s hardware model, network cabling, and configuration supports it, you can configure fail-towire/bypass behavior. This allows traffic to pass through unfiltered between 2 ports (a link pair) while the
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
259
system fail-open
FortiWeb appliance is shut down, rebooting, or has unexpectedly lost power such as due to being accidentally unplugged or PSU failure.
Fail-open is supported
only: l in true transparent proxy mode or transparent inspection operation mode l in standalone mode ( not HA) l for a bridge (V-zone) between ports wired to a CP7 processor or other hardware which provides support for fail-to-wire l
FortiWeb port3 + port4 l
FortiWeb port3 + port4 and port5 + port6 l
FortiWeb port5 + port6 l
FortiWeb 3000E/4000E: port9 + port10, port11 + port12, port13 + port14, or port15 + port16 l
FortiWeb port5 + port6 and port7 + port8 l
FortiWeb port5 + port6 and port7 + port8 l
FortiWeb port5 + port6
FortiWeb 400B/400C, FortiWeb HA clusters, and ports not wired to a CP7/failopen chip do
not support fail-to-wire.
config
In the case of HA, don’t use fail-open — instead, use a standby HA appliance to provide full fault tolerance.
Bypass results in degraded security while FortiWeb is shut down, and therefore
HA is usually a better solution: it ensures that degraded security does not occur if one of the appliances is shut down. If it is possible that
both of your HA FortiWeb appliance could simultaneously lose power, you can add an external bypass device such as
FortiBridge
.
Fail-to-wire may be useful if you are required by contract to provide uninterrupted connectivity, or if you consider connectivity interruption to be a greater risk than being open to attack during the power interruption.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system fail-open set
port3-port4 {poweroff-bypass | poweroff-cutoff}
end
260 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
port3-port4
{poweroff-bypass | poweroff-cutoff} system fips-cc
Description
Select either: l poweroff-bypass
— Behave like a wire when powered off, allowing connections to pass directly through from one port to the other, bypassing policy and profile filtering.
l poweroff-keep
— Interrupt connectivity when powered off.
Note: The name of this setting varies by which ports are wired together for bypass in your specific hardware model.
Default
poweroffbypass
Related topics
l
system fips-cc
Use this command to enable and configure Federal Information Processing Standards (FIPS) and Common
Criteria (CC) compliant mode.
When the FIPS-CC certification process is complete, a separate document will provide detailed information about this command.
system firewall address
Use this command to configure IP addresses and address ranges that FortiWeb's built-in stateful firewall uses.
You use the address configuration in a firewall policy (see
config system firewall firewallpolicy
Syntax
config system firewall address edit
set
set set
ip-netmask <firewall-address_ipv4mask> ip-address-value <firewall-address_ipv4>
end
Variable
<firewall-address_name>
Description Default
Enter a name that identifies this firewall address configuration.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
261
system firewall service config
Variable
type {ip-netmask | iprange} ip-netmask <firewalladdress_ipv4mask> ip-address-value
<firewall-address_ipv4>
Description
Enter an IPv4 address and subnet mask, separated by a forward slash ( / ). For example, 192.0.2.2/24.
Default
Select how this configuration specifies a firewall address or addresses: l ip-netmask
— A single IP address and netmask.
l ip-range
— A single IP address or a range of IP addresses.
iprange
No default.
Available when type is ip-netmask.
Enter a single IP address or a range of addresses. For example,
172.22.14.1
, or 172.22.14.1-172.22.14.255.
No default.
Available when type is ip-range.
Related topics
l
config system firewall firewall-policy
l
config system firewall service
system firewall service
Use this command to configure the protocols and ports that FortiWeb's built-in stateful firewall uses. You use the service configuration in a firewall policy (see
config system firewall firewall-policy
Syntax
config system firewall service edit
set
set set set set
end
Variable
<firewall-service_name>
Description
Enter a name that identifies this firewall service configuration.
protocol {TCP | UDP |
ICMP}
Select the protocol for this firewall service configuration.
Default
No default.
TCP
262 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system firewall firewall-policy
Variable Description
source-port-min <sourceport-min_int>
Enter the start port in the range of source ports for this firewall service.
source-port-max <sourceport-max_int>
Enter the end port in the range of source ports for this firewall service destination-port-min
<source-port-min_int>
Enter the start port in the range of destination ports for this firewall service.
destination-port-max
<source-port-max_int>
Enter the end port in the range of destination ports for this firewall service
Default
0
65535
0
65535
Related topics
l
config system firewall address
l
config system firewall firewall-policy
system firewall firewall-policy
Use this command to configure the policies that FortiWeb's built-in stateful firewall uses to determine which traffic to allow and deny.
The firewall policy uses address and service configurations that you create separately (see
config system firewall address
and
config system firewall service
.)
Syntax
config system firewall firewall-policy set edit
default-action {deny | accept}
set
in-interface <incoming_interface_ name>
set
out-interface <outgoing_interface_ name>
set set
src-address <firewall-address_name> dest-address <firewall-address_name>
set set
service <firewall-service_name> action {deny | accept}
end
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
263
system firewall firewall-policy
Variable
default-action {deny | accept}
<entry_index> in-interface <incoming_ interface_ name>
Description
Enter the index number of the policy rule in the table.
Default
l deny
— Firewall blocks traffic that does not match a policy rule. However, administrative access is still allowed on network interfaces for which it has been configured.
l accept
— Firewall allows traffic that does not match a policy rule.
accept
No default.
Enter the name of the interface (for example, port1) on which FortiWeb receives packets it applies this firewall policy rule to.
No default.
out-interface <outgoing_ interface_ name>
Enter the name of the interface (for example, port2) through which FortiWeb routes packets it applies this firewall policy rule to.
src-address <firewalladdress_name>
No default.
Enter the name of the firewall address configuration that specifies the source IP address or addresses to which this policy applies.
No default.
For information on creating firewall address configurations, see
config system firewall address
dest-address <firewalladdress_name> service <firewallservice_name> action {deny | accept}
Enter the name of the firewall address configuration that specifies the source IP address or addresses to which this policy rule applies.
No default.
For information on creating firewall address configurations, see
config system firewall address
Enter the name of the firewall service configuration that specifies the protocols and ports to which this policy rule applies.
For information on creating firewall service configurations, see
config system firewall service
No default.
l deny
— Firewall blocks traffic that matches this policy rule.
However, administrative access is still allowed on network interfaces for which it has been configured.
l accept
— Firewall allows traffic that matches this policy rule.
deny config
Example
This example configures a firewall policy to deny any HTTP services but coming from specified sources.
config system firewall address edit "alloowed_source"
264 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config set type ip-range set ip-address-value 172.22.203.100-172.22.203.115
end config system firewall address edit "site1" set type ip-netmask set ip-netmask 206.11.0.2/24 end config system firewall service edit "http" set protocol TCP set destination-port-min 80 set destination-port-max 80 end config system firewall firewall-policy end set default-action deny edit "http_allowed" set in-interface port1 set out-interface port2 set src-address allowed_source set dest-address site1 set service http set action accept
Related topics
l
config system firewall address
l
config system firewall service
system fortigate-integration
system fortigate-integration
FortiGate appliances can maintain a list of source IPs that it prevents from interacting with the network and protected systems. You can configure FortiWeb to receive this list of IP addresses at intervals you specify. Then, you configure an inline protection profile to detect the IP addresses in the list and take an appropriate action.
This feature is available only if the operating mode is reverse proxy or true transparent proxy.
This command configures a FortiGate appliance that provides banned source IPs. To configure FortiWeb to detect the quarantined IP addresses and take the appropriate action, configure the FortiGate Quarantined IPs settings in an inline protection profile. (See
config waf web-protection-profile inlineprotection
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system fortigate-integration set set
address <address_ipv4> port <port_int>
set set
protocol {HTTP | HTTPS} username <username_str>
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
265
system fortisandbox set set end set
password <password_str> schedule-frequency <schedule-frequency_int> flag {enable | disable}
Variable
address <address_ipv4> port <port_int>
Description
Enter the FortiGate IP address that is used for administrative access.
Specify the port that the FortiGate uses for administrative access via HTTPs.
In most cases, this is port 443.
protocol {HTTP | HTTPS}
Specify whether the FortiGate and FortiWeb communicate securely using HTTPS.
username <username_str>
Enter the name of the administrator account that
FortiWeb uses to connect to the FortiGate.
password <password_str>
Enter the password for the FortiGate administrator account that FortiWeb uses.
schedule-frequency
<schedule-frequency_int>
Enter how often FortiWeb checks the FortiGate for an updated list of banned source IP addresses, in hours.
The valid range is 1 to 5.
Default
No default.
80
HTTP
No default.
No default.
1 flag {enable | disable} Enables or disables the transmission of quarantined source IP address information from the specified FortiGate.
disable config
Related topics
l
config waf file-upload-restriction-policy
l
l
get system fortisandbox-statistics
system fortisandbox
Use this command to configure FortiWeb to submit all files that match your upload restriction rules to
FortiSandbox.
FortiSandbox evaluates whether the file poses a threat and returns the result to FortiWeb. If FortiSandbox determines that the file is malicious, FortiWeb performs the following tasks: l l
Generates an attack log message that contains the result.
For 10 minutes after it receives the FortiSandbox results, takes the action specified by the file upload restriction policy. During this time, it does not re-submit the file to FortiSandbox.
266 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system fortisandbox
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system fortisandbox set
set
set
set set
cache-timeout <timeout_int> email <email_str>
end set
Variable
type {fsa | cloud} server <server_ipv4> ssl {enable | disable}
Description
Specifies whether FortiWeb submits files that match the upload restriction rules to a FortiSandbox physical appliance (or FortiSandbox-VM) or to FortiSandbox
Cloud.
The FortiSandbox Cloud option requires you to register your FortiWeb and a FortiWeb FortiGuard Sandbox
Cloud Service subscription.
Enter the IP address of the FortiSandbox to send files to.
Available only when type is fsa.
Enter enable to communicate with the specified
FortiSandbox using SSL.
cache-timeout <timeout_ int> email <email_str>
Enter how long FortiWeb waits before it clears the hash table entry for an uploaded file that was evaluated by
FortiSandbox, in hours.
Valid values are from 1 to 168.
FortiWeb stores file evaluation results from FortiSandbox in a hash table. Whenever a client uploads a file,
FortiWeb looks for a table entry that matches it. If there is a matching entry, FortiWeb takes action based on the stored result. If there is no matching entry, FortiWeb sends the file to FortiSandbox for evaluation.
Enter the email address that FortiSandbox sends weekly reports and notifications to.
interval <interval_int>
Enter a number that specifies how often FortiWeb retrieves statistics from FortiSandbox, in minutes.
Default
fsa
No default.
disable
72
No default.
5
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
267
system global config
Example
This example creates a connection to a FortiSandbox at 192.0.2.2 that retrieves statistics at the default interval
(5 minutes) and sends a weekly report to [email protected].
config system fortisandbox set server 192.0.2.2
end set ssl enable set email [email protected]
Related topics
l
config waf file-upload-restriction-policy
l
l
get system fortisandbox-statistics
system global
Use this command to configure system-wide settings such as language, display refresh rate and listening ports of the web UI, the time zone and host name of the FortiWeb appliance, and NTP time synchronization.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system global set
set set set set set set set set
admin-sport <port_int> admintimeout <minutes_int> adom-admin {enable | disable}
anypktstream {enable | disable} auth-timeout <milliseconds_int> cli-signature {enable | disable}
confsync-port <port_int> dh-params {1024 | 1536 | 2048 | 3072 | 4096 | 6144 | 8192}
set set set set set set set set set set set
dst {enable | disable} high-compatibility-mode {enable | disable}
hostname <host_name> hsm {enable | disable}
set
https-cert-login {enable | disable}
set
https-certificate <certificate_name>
set set
ie6workaround {enable | disable}
language {english |japanese | simch | trach}
pre-login-banner {enable | disable} refresh <seconds_int>
single-admin-mode {enable | disable}
268 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system global set set set set end set
Variable
admin-port <port_int> admin-sport <port_int> admintimeout <minutes_int> adom-admin {enable | disable}
Description
Type the port number on which the
FortiWeb appliance listens for HTTP access to the web UI. The valid range is from 1 to 65,535.
Type the port number on which the
FortiWeb appliance listens for HTTPS
(SSL-secured) access to the web UI. The valid range is from 1 to 65,535.
Default
80
443
Type the amount of time in minutes after which an idle administrative session with the web UI or CLI will be automatically logged out. The valid range is from 1 to 480 minutes (8 hours).
To improve security, do not increase the idle timeout.
Enable to be able to restrict administrator accounts to specific administrative domains. See also
in
Note: After you type end, if this setting is enabled, the CLI will terminate your session and restructure the configuration to use
ADOMs. Global settings will remain in the global configuration scope, but objects that are configurable separately per ADOM such as services are moved to the root
ADOM. To continue by configuring additional ADOMs, log in again, then go to
5 disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
269
system global
Variable
anypktstream {enable | disable} auth-timeout <milliseconds_int> cli-signature {enable | disable}
Description
Enable to configure FortiWeb to scan partial TCP connections.
In some cases, FortiWeb is deployed after a client has already created a connection with a back-end server. If this option is disabled, FortiWeb ignores any traffic that is part of a pre-existing session.
Default
disable
Type the number of milliseconds that
FortiWeb will wait for the remote authentication server to respond to its query. The valid range is from 1 to
60,000 (60 seconds).
If administrator logins often time out, and FortiWeb is configured to query an external RADIUS or LDAP server, increasing this value may help.
This setting only affects remote authentication queries for
administrator accounts. To configure the query connection timeout for end-user accounts, use
in the
HTTP authentication policy instead.
Enable to be able to enter custom attack signatures via the CLI.
Typically, attack signatures should be entered using the web UI, where you can verify syntax and test matching of your regular expression.
If you are sure that your expression is correct, you can enable this option to enter your custom signature via the
CLI.
2000 disable config
270 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system global
Variable
confsync-port <port_int> dh-params {1024 | 1536 | 2048 |
3072 | 4096 | 6144 | 8192} dst {enable | disable} high-compatibility-mode {enable | disable}
Description
Type the port number the local
FortiWeb uses to listen for a remote
(peer) FortiWeb.
Used when you have configured
FortiWeb to synchronize its configuration. The valid range is from
1 to 65,535.
Caution: The port number must be different than the port number set using
config server-policy custom-application application-policy
Default
8333
Specifies the key length that FortiWeb presents in Diffie-Hellman exchanges.
Most web browsers require a key length of at least 2048.
2048
Enable to automatically adjust the
FortiWeb appliance’s clock for daylight savings time (DST).
Enable to accelerate SSL transport.
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
271
system global
Variable
hostname <host_name> hsm {enable | disable}
Description Default
Type the host name of this FortiWeb appliance. Host names may include
US-ASCII letters, numbers, hyphens, and underscores. The maximum length is 35 characters. Spaces and special characters are not allowed.
The host name of the FortiWeb appliance is used in several places.
l l l
It appears in the
System
Information widget on the
Status tab of the web UI, and in the
CLI command.
It is used in the command prompt of the CLI.
It is used as the SNMP system name. For information about
SNMP, see
.
The System Information widget and the
CLI command will display the full host name. However, if the host name is longer than 16 characters, the CLI and other places display the host name in a truncated form ending with a tilde ( ~ ) to indicate that additional characters exist, but are not displayed.
For example, if the host name is
FortiWeb1234567890, the CLI prompt would be
FortiWeb123456789~#
.
Note: You can also configure the local domain name. For details, see
FortiWeb
Specifies whether the settings you use to integrate FortiWeb with an HSM
(hardware security module) are displayed in the web UI.
disable config
272 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system global
Variable Description
https-cert-login {enable | disable}
Enable to use the certificate-based
Web UI login.
Before enabling this, please make sure the related configurations are set correctly, see
and
.
https-certificate <certificate_ name> ie6workaround {enable | disable}
Default
disable
Specifies the certificate that FortiWeb uses for the accesses to its Web UI through HTTPS. This must be one of the certificates stored locally on the FortiWeb for administration, see
defaultcert
Enable to use the work around for a navigation bar freeze issue caused by using the web UI with Microsoft
Internet Explorer 6.
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
273
system global
Variable
language {english |japanese | simch | trach}
274 config
Description
Select which language to use when displaying the web UI.
The display’s web pages will use
UTF-8 encoding, regardless of which language you choose. UTF-8 supports multiple languages, and allows all of them to be displayed correctly, even when multiple languages are used on the same web page.
For example, your organization could have web sites in both English and simplified Chinese. Your FortiWeb administrators prefer to work in the
English version of the web UI. They could use the web UI in English while writing rules to match content in both
English and simplified Chinese
without changing this setting. Both the rules and the web UI will display correctly, as long as all rules were input using UTF-8.
Usually, your text input method or your management computer’s operating system should match the display, and also use UTF-8. If they do not, you may not be able to correctly display both your input and the web UI at the same time.
For example, your web browser’s or operating system’s default encoding for simplified Chinese input may be
GB2312. However, you
usually
should switch it to be UTF-8 when using the web UI,
unless you are writing regular expressions that must match HTTP client’s requests, and those requests use GB2312 encoding.
For more information on language support in the web UI and CLI, see
Language support & regular expressions on page 86
.
Note: This setting does not affect the display of the CLI.
Default
english
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system global
Variable
maintainer-user {enable | disable} no-sslv3 {enable | disable}
Description
Specifies whether the maintainer administrator account is enabled.
The maintainer account is enabled by default and allows you to reset the password for the admin account using a console connection
Default
enable
Enable to disable support for SSL 3.0
connections to the web UI.
Protects against a POODLE (Padding
Oracle On Downgraded Legacy
Encryption) attack.
To disable access to back-end servers via
SSL 3.0, use
or
config server-policy server-pool
enable ntpserver {<ntp_fqdn> | <ntp_ipv4>}
Type the IP address or fully qualified domain name (FQDN) of a Network
Time Protocol (NTP) server or pool, such as pool.ntp.org, to query in order to synchronize the FortiWeb appliance’s clock. The maximum length is 63 characters.
For more information about NTP and to find the IP address of an NTP server that you can use, see: http://www.ntp.org/ ntpsync {enable | disable}
No default.
Enable to automatically update the system date and time by connecting to a
NTP server. Also configure
and
timezone <time-zonecode_str> .
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
275
system global
Variable Description
pre-login-banner {enable | disable} Enable to add a login disclaimer message for administrators logging in to FortiWeb.
Default
This disclaimer is a statement that a user accepts or declines. It is useful for environments such as corporations that are governed by strict usage policies for forensics and legal reasons.
disable
For information on modifying the disclaimer, see
refresh <seconds_int>
80 Type the automatic refresh interval, in seconds, for the web UI’s
System
Status Monitor widget.
The valid range is from 0 to
9,223,372,036,854,775,807 seconds. To disable automatic refreshes, type 0.
config
276 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
single-admin-mode {enable | disable} system global
Description
Enable to allow only one administrator account to be logged in at any given time.
This option may be useful to prevent administrators from inadvertently overwriting each other’s changes.
When multiple administrators simultaneously modify the same part of the configuration, they each edit a copy of the current, saved state of the configuration item. As each administrator makes changes,
FortiWeb does
not update the other administrators’ working copies. Each administrator may therefore make conflicting changes without being aware of the other. The FortiWeb appliance will only use whichever administrator’s configuration is saved last.
If only one administrator can be logged in at a time, this problem cannot occur.
Disable to allow multiple administrators to be logged in. In this case, administrators should communicate with each other to avoid overwriting each other’s changes.
Default
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
277
system global
Variable
strong-password {enable | disable} syncinterval <minutes_int> tftp {enable | disable} timezone <time-zone-code_str>
Description
Enable to enforce strong password rules for administrator accounts. If the password entered is not strong enough when a new administrator account is created, the FortiWeb appliance displays an error and prompts to enter a stronger password.
Strong passwords have the following characteristics: l l l l are between 8 and 16 characters in length contain at least one upper case and one lower case letter contain at least one numeric contain at least one nonalphanumeric character
Type how often, in minutes, the
FortiWeb appliance should synchronize its time with the Network
Time Protocol (NTP) server.
The valid range is from 1 to 1440 minutes. To disable time synchronization, type 0.
Specifies whether FortiWeb can perform backups, restoration, firmware updates and other tasks using TFTP.
Type the two-digit code for the time zone in which the FortiWeb appliance is located.
The valid range is from 00 to 74. To display a list of time zone codes, their associated the GMT time zone offset, and contained major cities, type set timezone ?.
Default
disable
60 enable
00 config
278 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
ssh-fips {enable | disable}
Description
A setting used with Federal Information
Processing Standards (FIPS) and
Common Criteria (CC) compliant mode.
When the FIPS-CC certification process is complete, a separate document will provide detailed information about this command.
Default
disable system ha
Example
This example configures time synchronization with a public NTP server pool. The FortiWeb appliance is located in the Pacific Time zone (code 04) and will synchronize its time with the NTP server pool every 60 minutes.
config system global set timezone 04 set ntpsync enable end set ntpserver pool.ntp.org
set syncinterval 60
For an example that includes a host name, see
Related topics
l
l
config system autoupdate schedule
l
l
l
l
l
l
l
system ha
Use this command to configure the FortiWeb appliance to act as a member of a high availability (HA) cluster in order to improve availability.
By default, FortiWeb appliances are each a single, standalone appliance. They operate independently.
If you have purchased more than one, however, you can configure the FortiWeb appliances to form an
active-
passive or active-active high availability (HA) FortiWeb cluster. This improves availability so that you can achieve your service level agreement (SLA) uptimes regardless of, for example, hardware failure or maintenance periods.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
279
system ha config
If you have multiple FortiWeb appliances but do not need failover, you can still synchronize the configuration. This can be useful for cloned network environments and externally load-balanced active-active HA. See
config server-policy custom-application application-policy
HA requirements
l l l
Two (for active-passive mode and active-active mode) or more (for active-active mode) identical physical FortiWeb appliances (i.e., the same hardware model and firmware version (for example, the appliances could be a
FortiWeb-3000C running FortiWeb ))
Redundant network topology: if the active appliance fails, physical network cabling and routes must redirect web traffic to the standby appliance
At least one physical port on both HA appliances connected directly, via crossover cables, or through switches
FortiWeb-VM now supports HA. However, if you do not wish to use the native HA, you can use your hypervisor or VM environment manager to install your virtual appliances over a hardware cluster to improve availability. For example, VMware clusters can use vMotion or VMware HA.
If the style of FortiWeb HA is
active-passive: one appliance is selected to be the active appliance (also called the primary, main, or master), applying the policies for all connections. The other is a passive standby (also called the secondary, standby, or slave), which assumes the role of the active appliance and begins processing connections
only if the active appliance fails.
If the style of FortiWeb HA is
active-active: all the cluster members are operating as an active appliances together to simultaneously handle the traffic between clients and the back web servers. In an active-active HA cluster, one of the member appliances will be selected as the master appliance to centrally receive traffic from clients and back web servers, and distribute the traffic to all the cluster members (including itself) according specified loadbalancing algorithm. The operation of active-active HA cluster requires heartbeat detection,
configuration and session synchronization between the cluster members. If the master appliance fails, one of the slaves will take it over. An active-active HA cluster can be created only in Reverse Proxy and True
Transparent Proxy modes, and at most eight FortiWeb appliances are allowed in the cluster.
For more information on HA, including troubleshooting, failover behavior, synchronized data, and network topology, see the
FortiWeb Administration Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system ha set
mode {active-passive | active-active | standalone}
set
[set set
set set
[set set
hbdev-backup <interface_name> ]
hb-interval <milliseconds_int>
set
hb-lost-threshold <seconds_int>
set
280 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system ha set
[set
monitor {<interface_name> ...}
set
set
ha-mgmt-status { enable | disable}
set
ha-mgmt-interface <interface_name>
end set
schedule {ip | leastconnection | round-robin}
set
session-sync-broadcast {enable | disable}
set
session-sync-dev {<interface_name> ...}
set
Variable
mode {active-passive | active-active | standalone} group-id <group_int> group-name <pair-name_ str>
Description
Select one of the following: l active-passive
— Form an HA group with another
FortiWeb appliance. The appliances operate together, with the standby assuming the role of the active appliance if it fails.
l active-active
— Form an HA group with other
FortiWeb appliances. All the appliances are active simultaneously to handle the receiving traffic together.
l standalone
— Operate each appliance independently.
Note: To avoid connectivity issues, do not use config system ha to remove an appliance from an HA cluster. Instead, use
which removes the appliance from the cluster and changes the HA mode to standalone.
Type a number that identifies the HA pair.
Both members of the HA pair must have the
same group ID. If you have more than one HA pair on the same network, each HA pair must have a different group ID.
Changing the group ID changes the cluster’s virtual
MAC address.
The valid range is 0 to 63.
Type a name to identify the HA pair if you have more than one.
This setting is optional, and does not affect HA function.
The maximum length is 35 characters.
Default
standalone
0
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
281
system ha
Variable
priority <level_int> override {enable | disable}
Description
Type the priority of the appliance when electing the primary appliance in the HA pair. (On standby devices, this setting can be reconfigured using the
CLI command
This setting is optional. The smaller the number, the higher the priority. The valid range is 0 to 9.
Note: By default, unless you enable
, uptime is more important than this setting. For details, see the
FortiWeb Administration
Guide
.
Default
5
Enable to make
a more important factor than uptime when selecting the primary appliance.
disable config
282 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
hbdev <interface_name>
Description
Select which port on this appliance that the main and standby appliances will use to send heartbeat signals and synchronization data between each other (i.e. the
HA heartbeat link). The maximum length is 15 characters.
Connect this port to the same port number on the other member of the HA cluster. (e.g., If you select port3 for the primary heartbeat link, connect port3 on this appliance to port3 on the other appliance.)
At least one heartbeat interface must be selected on each appliance in the HA cluster. Ports that currently have an IP address assigned for other purposes (that is, virtual servers or bridges) cannot be re-used as a heartbeat link.
At least one heartbeat interface must be selected on each appliance in the HA cluster. Ports that currently have an IP address assigned for other purposes (that is, virtual servers or bridges) cannot be re-used as a heartbeat link.
Tip: If enough ports are available, you can select both a primary heartbeat interface and a secondary
heartbeat interface ( hbdev-backup <interface_ name>
) on each appliance in the HA pair to provide heartbeat link redundancy. (You cannot use the same port as both the primary and secondary heartbeat interface on the same appliance, as this is incompatible with the purpose of link redundancy.)
Note: If a switch is used to connect the heartbeat interfaces, the heartbeat interfaces must be reachable by Layer 2 multicast.
Default
No default.
system ha
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
283
system ha
Variable Description
hbdev-backup <interface_ name>
Select a secondary, standby port on this appliance that the main and standby appliances will use to send heartbeat signals and synchronization data between each other (i.e. the HA heartbeat link).
It must
not be the same network interface as
. The maximum length is 15 characters.
Connect this port to the same port number on the other member of the HA cluster. (e.g., If you select port4 for the secondary heartbeat link, connect port4 on this appliance to port4 on the other appliance.)
Ports that currently have an IP address assigned for other purposes (that is, virtual servers or bridges) cannot be re-used as a heartbeat link.
Default
No default.
config
284 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
arps <arp_int>
Description Default
Type the number of times that the FortiWeb appliance will broadcast address resolution protocol
(ARP) packets when it takes on the main role. (Even though a new NIC has not actually been connected to the network, FortiWeb does this to notify the network that a different physical port has become associated with the IP address and virtual MAC of the HA pair.)
This is sometimes called “using gratuitous ARP packets to train the network,” and can occur when the main appliance is starting up, or during a failover.
Also configure
Normally, you do not need to change this setting.
Exceptions include: l
Increase the number of times the main appliance sends gratuitous ARP packets if your HA pair takes a long time to fail over or to train the network. Sending more gratuitous ARP packets may help the failover to happen faster.
l
Decrease the number of times the main appliance sends gratuitous ARP packets if your HA pair has a large number of VLAN interfaces and virtual domains. Because gratuitous ARP packets are broadcast, sending them may generate a large amount of network traffic. As long as the HA pair still fails over successfully, you could reduce the number of times gratuitous ARP packets are sent to reduce the amount of traffic produced by a failover.
The valid range is 1 to 16.
3 system ha
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
285
system ha
Variable
arp-interval <seconds_ int> hb-interval
<milliseconds_int>
Description Default
Type the number of seconds to wait between each broadcast of ARP packets.
Normally, you do not need to change this setting.
Exceptions include: l
Decrease the interval if your HA pair takes a long time to fail over or to train the network. Sending ARP packets more frequently may help the failover to happen faster.
l
Increase the interval if your HA pair has a large number of VLAN interfaces and virtual domains. Because gratuitous ARP packets are broadcast, sending them may generate a large amount of network traffic. As long as the HA pair still fails over successfully, you could increase the interval between when gratuitous ARP packets are sent to reduce the rate of traffic produced by a failover.
The valid range is from 1 to 20.
1
Type the number of 100-millisecond intervals to set the pause between each heartbeat packet that the one FortiWeb appliance sends to the other FortiWeb appliance in the HA pair. This is also the amount of time that a FortiWeb appliance waits before expecting to receive a heartbeat packet from the other appliance.
This part of the configuration is synchronized between the active appliance and standby appliance.
The valid range is 1 to 20 (that is, between 100 and
2,000 milliseconds).
Note: Although this setting is synchronized between the main and standby appliances, you should initially configure both appliances with the same
to prevent inadvertent failover from occurring before the initial synchronization.
1 config
286 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
hb-lost-threshold
<seconds_int>
Description Default
Type the number of times one of HA appliances retries the heartbeat and waits to receive HA heartbeat packets from the other HA appliance before assuming that the other appliance has failed.
This part of the configuration is synchronized between the main appliance and standby appliance.
Normally, you do not need to change this setting.
Exceptions include: l
Increase the failure detection threshold if a failure is detected when none has actually occurred. For example, during peak traffic times, if the main appliance is very busy, it might not respond to heartbeat packets in time, and the standby appliance may assume that the main appliance has failed.
l
Reduce the failure detection threshold or detection interval if administrators and HTTP clients have to wait too long before being able to connect through the main appliance, resulting in noticeable down time.
The valid range is from 1 to 60.
Note: Although this setting is synchronized between the main and standby appliances, you should initially configure both appliances with the same
hb-lostthreshold <seconds_int>
to prevent inadvertent failover from occurring before the initial synchronization.
Note: You can use SNMP traps to notify you when a failover is occurring. For details, see
.
3 system ha
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
287
system ha
Variable
monitor {<interface_ name> ...} boot-time <limit_int>
Description
Type the name of one or more network interfaces that each directly correlate with a physical link. These ports will be monitored for link failure.
Separate the name of each network interface with a space. To remove from or add to the list of monitored network interfaces, retype the entire list.
Port monitoring (also called interface monitoring) monitors physical network ports to verify that they are functioning properly and linked to their networks. If the physical port fails or the cable becomes disconnected, a failover occurs. You can monitor physical interfaces, but
not VLAN subinterfaces or 4port switches.
Note: To prevent an unintentional failover, do not configure port monitoring until you configure HA on both appliances in the HA pair, and have plugged in the cables to link the physical network ports that will be monitored.
Type the maximum number of seconds that a appliance will wait for a heartbeat or synchronization connection after the appliance returns online.
If this limit is exceeded, the appliance will assume that the other unit is unresponsive, and assume the role of the main appliance.
Due to the default heartbeat and synchronization intervals, as long as the HA pair are cabled directly together, the default value is usually sufficient. If the
HA heartbeat link passes through other devices, such as routers and switches, however, a larger value may be needed. You may notice this especially when updating the firmware.
The valid range is from 1 to 100 seconds.
Default
No default.
30 config
288 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable Description
ha-mgmt-status { enable
| disable}
Specifies whether the network interface you select provides administrative access to this appliance when it is a member of the HA cluster.
When this option is selected, you can access the configuration for this cluster member using the IP address of the specified network interface. The interface configuration, including administrative access and other settings, is not synchronized with other cluster members.
You cannot configure routing for the port you select.
To allow your management computer to connect with the web UI and CLI, ensure it is on the same subnet as the port. (Alternatively, you can configure a source
IP NAT on the router or firewall that modifies the management computer's source IP.)
You can configure up to 8 reserved management ports in each HA cluster.
Default
disable ha-mgmt-interface
<interface_name>
Specifies the network interface that provides administrative access to this appliance when it is a member of the HA cluster.
No default.
schedule {ip | leastconnection | roundrobin}
Specifies the load-balancing algorithm used by the master appliance (in an active-active HA cluster) to distribute received traffic over the available cluster members.
l l l ip
— consistently distribute the traffic coming from a source to the same cluster member.
leastconnection
— dynamically distribute traffic to a cluster member who has the fewest connections processing.
round-robin
— distribute traffic among the available members in a circular order.
Note that FortiWeb's Session Management is not supposed by the active-active HA deployment with the algorithm By connections or Round-robin being used for the load-balancing.
Available only when mode is active-active.
ip system ha
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
289
system ha
Variable
session-sync-broadcast
{enable | disable} session-sync-dev
{<interface_name> ...} session-warm-up
<seconds_int>
Description
Specifies whether the master appliance in an activeactive HA cluster synchronizes sessions to others in broadcast. By default, session information is synchronized in unicast. Broadcast will be recommended if a active-active HA cluster contains many appliances.
Available only when mode is active-active.
Default
disable
The master appliance use the heartbeat interface
(set hbdev <interface_name>) to synchronize its session table to other appliances in an active-active HA cluster by default. However, you can use extra interfaces (up to four interfaces) for the session synchronization when the HA cluster is in heavy traffic.
Specifies the network interface(s) of this FortiWeb appliance for session synchronizations. For example, typing set session-sync-dev port3 port4 port5 for using port3, port4 and port5 to synchronize session information.
Note:
l l l l
Only the master appliance in the active-active HA cluster is allowed to set session-sync-dev. The configuration here will be synchronized to all the slave appliance in the cluster by the master, and all the appliances send or receive session information with the same interface configuration.
The heartbeat interface will not participate in the session synchronization anymore if other interfaces are specified here.
It can not specify the heartbeat interface to sessionsync-dev
.
Available only when mode is active-active.
No default.
Specifies the active-active HA warm-up time that the master appliance will hold traffic distribution to wait for the active-active HA negotiation (determine the master and slave, and necessary synchronizations) completes (when every time the active-active HA starts).
Available only when mode is active-active.
10 config
290 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system hsm info
Example
This example configures a FortiWeb appliance as one appliance in an active-passive HA pair whose group ID is 1.
The primary heartbeat occurs over port3, and the secondary heartbeat link is over port4. Priority is more important than uptime when electing the main appliance. The appliance will wait 30 seconds after boot time for a heartbeat or synchronization before assuming that it should be that main appliance. Aside from the heartbeat link, failover can also be triggered by port monitoring of port1 and port2.
config system ha set mode active-passive set group-id 1 set priority 6 set override enable set hbdev port3 set hbdev-backup port4 set arps 3 set arp-interval 2 set hb-interval 1 set hb-lost-threshold 3 set monitor port1 port2 end set boot-time 30
Related topics
l
l
l
l
diagnose debug application hasync
l
diagnose debug application hatalk
l
l
l
l
l
l
system hsm info
Use this command to edit the configuration that allows FortiWeb to work with SafeNet Luna SA HSM (hardware security module). The HSM integration allows FortiWeb to retrieve a per-connection, SSL session key instead of loading the local private key and certificate.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
291
system hsm info
Because the HSM configuration requires you to upload a server certificate, you can create it using the web UI only. After you create the configuration in the web UI, this command allows you to edit it.
For detailed information on integrating HSM with FortiWeb, see the
FortiWeb
Administration Guide
.
Before you can show or edit HSM configuration in the CLI and access HSM settings in the web UI, use the following command to enable the HSM settings: config system global set hsm enable
Syntax
config system hsm info set
end set set set set
port <port_int> timeout <timeout_int> filename <filename_str> action {register | unregister}
Variable
ip <hsm_ipv4>
Description
Enter the IP address of the HSM.
Default
No default.
port <port_int>
Enter the port where FortiWeb establishes an NTLS connection with the HSM.
1792 timeout <timeout_int>
Enter a timeout value for the connection between HSM and FortiWeb.
No default.
config filename <filename_str>
Shows the name of the server certificate file from the
HSM. You cannot edit this option using the CLI.
action {register | unregister}
Enter register to register FortiWeb as a client of the
HSM.
Related topics
l
l
292
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config l
config system certificate local
system hsm partition
system hsm partition
Use this command to edit information about the partition that the FortiWeb HSM client is assigned to. The partition settings are part of the configuration that allows FortiWeb to work with SafeNet Luna SA HSM (hardware security module).
Before you can show or edit HSM configuration in the CLI and access HSM settings in the web UI, use the following command to enable the HSM settings: config system global set hsm enable
For additional HSM integration settings, see
For detailed information on integrating HSM with FortiWeb, see the
FortiWeb Administration Guide
.
Syntax
config system hsm partition edit
set
end
Variable
<partition_name>
Description
Enter the name of a partition that the FortiWeb HSM client is assigned to.
password <password_int>
Enter the partition password.
Default
No default.
No default.
Related topics
l
l
l
config system certificate local
system interface
Use this command to configure: l l the network interfaces associated with the physical network ports of the FortiWeb appliance,
VLAN subinterfaces or 802.3ad link aggregates associated with physical network interfaces
Both the network interfaces and VLAN subinterfaces can include administrative access.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
293
system interface
You can restrict which IP addresses are permitted to log in as a FortiWeb administrator through the network interfaces and VLAN subinterfaces. For details, see
config
When the FortiWeb appliance is operating in either of the transparent modes, VLANs do not support Cisco discovery protocol (CDP).
You can use SNMP traps to notify you when a network interface’s configuration changes, or when a link is brought down or brought up. For details, see
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the netgrp area. For more information, see
Syntax
config system interface edit
set
set
type {aggregate | physical | vlan}
set
algorithm {layer2 | layer2_3 | layer3_4}
set set
allowaccess {http https ping snmp ssh telnet FWB-manager}
ip6-allowaccess {http https ping snmp ssh telnet FWB-manager}
set set
wccp {enable | disable} description "<comment_str>"
set set
interface <interface_name> intf {<port_name> ...}
set
[set set
]
set
set
set set set
[config secondaryip] edit
set
ip {interface_ipv4mask | interface_ipv6mask}
end next end next
Variable
<interface_name>
Description Default
Type the name of a network interface. The maximum length is
15 characters.
No default.
294 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system interface
Variable
status {up | down} algorithm {layer2 | layer2_3 | layer3_4}
Description
Enable (select up) to bring up the network interface so that it is permitted to receive and/or transmit traffic.
Note: This administrative status from this command is
not the same as its detected physical link status.
For example, even though you have used
to configure port1 with set status up, if the cable is physically unplugged, diagnose hardware nic list port1 may indicate correctly that the link is down (Link detected: no).
Default
up
Select the connectivity layers that will be considered when distributing frames among the aggregated physical ports.
l
layer2 — Consider only the MAC address. This results in the most even distribution of frames, but may be disruptive to
TCP if packets frequently arrive out of order.
l
layer2_3 — Consider both the MAC address and IP session.
Queue frames involving the same session to the same port.
This results in slightly less even distribution, and still does not guarantee perfectly ordered TCP sessions, but does result in less jitter within the session.
l
layer3_4 — Consider both the IP session and TCP connection. Queue frames involving the same session and connection to the same port. Distribution is not even, but this does prevent TCP retransmissions associated with link aggregation.
layer2
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
295
system interface
Variable
allowaccess {http https ping snmp ssh telnet
FWB-manager}
Description Default
Type the IPv4 protocols that will be permitted for administrative connections to the network interface or
VLAN subinterface.
Separate each protocol with a space. To remove from or add to the list of permitted administrative access protocols, retype the entire list.
l ping
— Allow ICMP ping responses from this network interface.
l http
— Allow HTTP access to the web UI.
Caution: HTTP connections are not secure and can be intercepted by a third party. To reduce risk to the security of your FortiMail appliance, enable this option only on network interfaces connected directly to your management computer.
l https
— Allow secure HTTP (HTTPS) access to the web UI.
l snmp
— Allow SNMP access. For more information, see
Note: This setting only configures which network interface will receive SNMP queries. To configure which network interface will
send traffic, see
l ssh
— Allow SSH access to the CLI.
l telnet
— Allow Telnet access to the CLI.
Caution: Telnet connections are not secure.
l
FWB-manager
— Allow FortiWeb Manager to use this interface to administer this appliance.
Caution: Enable administrative access only on network interfaces or VLAN subinterfaces that are connected to trusted private networks or directly to your management computer. If possible, enable only secure administrative access protocols such as HTTPS or SSH. Failure to restrict administrative access could compromise the security of your FortiWeb appliance. Consider allowing ping only when troubleshooting.
ping https ssh config
296 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system interface
Variable
ip6-allowaccess {http https ping snmp ssh telnet FWB-manager}
Description Default
Type the IPv6 protocols that will be permitted for administrative connections to the network interface or
VLAN subinterface.
Separate each protocol with a space. To remove from or add to the list of permitted administrative access protocols, retype the entire list.
l ping
— Allow ICMP ping responses from this network interface.
l http
— Allow HTTP access to the web UI.
Caution: HTTP connections are not secure and can be intercepted by a third party. To reduce risk to the security of your FortiMail appliance, enable this option only on network interfaces connected directly to your management computer.
l https
— Allow secure HTTP (HTTPS) access to the web UI.
l snmp
— Allow SNMP access. For more information, see
Note: This setting only configures which network interface will receive SNMP queries. To configure which network interface will
send traffic, see
l ssh
— Allow SSH access to the CLI.
l telnet
— Allow Telnet access to the CLI.
Caution: Telnet connections are not secure.
l
FWB-manager
— Allow FortiWeb Manager to use this interface to administer this appliance.
Caution: Enable administrative access only on network interfaces or VLAN subinterfaces connected to trusted private networks or directly to your management computer. If possible, enable only secure administrative access protocols such as HTTPS or SSH. Failure to restrict administrative access could compromise the security of your FortiWeb appliance. Consider allowing ping only when troubleshooting.
ping wccp {enable | disable} Specify whether FortiWeb uses the interface to communicate with a FortiGate unit configured as a
WCCP server.
Available only when the operation mode is WCCP.
description "<comment_ str>"
Type a description or other comment. If the comment is more than one word or contains an apostrophe, surround the comment with double quotes ( " ). The maximum length is 63 characters.
disable
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
297
system interface
Variable
interface <interface_ name> mode {static | dhcp}
Description
Type the name of the network interface with which the
VLAN subinterface will be associated. The maximum length is 15 characters.
This field is available only if type is vlan.
Specify whether the interface obtains its IPv4 address and netmask using DHCP.
Default
No default.
intf {<port_name> ...}
Type the names of 2 physical network interfaces or more that will be combined into the aggregate link. Only physical network interfaces may be aggregated. The maximum length is 15 characters each.
This field is available only if type is vlan.
No default.
ip <interface_ipv4mask> Type the IPv4 address and netmask of the network interface, if any. The IP address must be on the same subnet as the network to which the interface connects. Two network interfaces cannot have IP addresses on the same subnet. The default setting for port1 is 192.168.
1.99 with a netmask of
255.255.255.0. Other ports have no default.
Varies by the interface.
ip6 <interface_ipv6mask> Type the IPv6 address and netmask of the network interface, if any. The IP address must be on the same subnet as the network to which the interface connects. Two network interfaces cannot have IP addresses on the same subnet.
::/0 lacp-speed {fast | slow}
Select the rate of transmission for the LACP frames
(LACPUs) between FortiWeb and the peer device at the other end of the trunking cables, either: l l
SLOW — Every 30 seconds.
FAST — Every 1 second.
Note: This must match the setting on the other device. If the rates do not match, FortiWeb or the other device could mistakenly believe that the other’s ports have failed, effectively disabling ports in the trunk.
slow type {aggregate | physical | vlan}
Indicates whether the interface is directly associated with a physical network port, or is instead a VLAN subinterface or link aggregate.
The default varies by whether you are editing a network interface associated with a physical port (physical) or creating a new subinterface/aggregate (vlan or aggregate
).
Varies by the interface.
static config
298 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system interface
Variable Description
ip6-mode {static | dhcp}
Specify whether the interface obtains its IPv6 address and netmask using DHCP.
vlanid <vlan-id_int>
Type the VLAN ID of packets that belong to this VLAN subinterface.
l l
If one physical network port (that is, a VLAN trunk) will handle multiple VLANs, create multiple VLAN subinterfaces on that port, one for each VLAN ID that will be received.
If multiple, different physical network ports will handle the same VLANs, on each of the ports, create VLAN subinterfaces that have the same VLAN IDs.
The VLAN ID is part of the tag that is inserted into each
Ethernet frame in order to identify traffic for a specific
VLAN. VLAN header addition is handled automatically, and does not require that you adjust the maximum transmission appliance (MTU). Depending on whether the device receiving a packet operates at Layer 2 or
Layer 3 of the network, this tag may be added, removed or rewritten before forwarding to other nodes on the network.
For example, a Layer 2 switch or FortiWeb appliance operating in either of the transparent modes would typically add or remove a tag when forwarding traffic among members of the VLAN, but would not route tagged traffic to a different VLAN ID. In contrast, a
FortiWeb appliance operating in reverse proxy mode, inspecting the traffic to make routing decisions based upon higher-level layers/protocols, might route traffic between different VLAN IDs (also known as inter-VLAN routing) if indicated by its policy, such as if it has been configured to do WSDL-based routing.
For the maximum number of interfaces, including VLAN subinterfaces, see the
FortiWeb Administration Guide
.
This field is available only when type is vlan. The valid range is between 1 and 4094 and must match the VLAN
ID added by the IEEE 802.1q
-compliant router or switch connected to the VLAN subinterface.
0
Default
static
<entry_index> Type the index number of the individual entry in the table.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
299
system interface
Variable Description
ip {interface_ipv4mask | interface_ipv6mask}
Type an additional IPv4 or IPv6 address and netmask for the network interface.
Available only when ip-src-balance or ip6src-balance is enabled. For more information, see
mtu <mtu_int> azure-endpoint
Default
No default.
Enter the maximum transmission unit (MTU) that the interface supports.
Valid values are 512 to 9216 (for IPv4) or 1280 to 9216
(for IPv6).
You cannot specify an MTU for a VLAN interface that is larger than the MTU of the corresponding physical interface.
1500
A setting related to FortiWeb-VM on the Microsoft Azure cloud computing platform. You cannot edit this setting.
No default.
config
Example
This example configures the network interface named port1, associated with the first physical network port, with the IP address and subnet mask 10.0.0.1/24. It also enables ICMP ECHO (ping) and HTTPS administrative access to that network interface, and enables it.
config system interface edit "port1" set ip 10.0.0.1 255.255.255.0
set allowaccess ping https set status up end next
Example
This example configures the network subinterface named vlan_100, associated with the physical network interface port1, with the IP address and subnet mask 10.0.1.1/24. It does not allow administrative access.
config system interface edit "vlan_100" set type vlan set ip 10.0.1.1 255.255.255.0
set status up set vlanid 100 set interface port1 end next
300 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system ip-detection
Related topics
l
l
l
l
l
l
l
l
l
l
l
system ip-detection
Use this command to configure how FortiWeb analyzes the identification (ID) field in IP packet headers in order to distinguish source IP addresses that are actually Internet connections shared by multiple clients, not single clients.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system ip-detection set
share-ip-detection-level {low | medium | high}
end
Variable Description
share-ip-detection-level
{low | medium | high}
Select how different packets’ ID fields can be before FortiWeb detects that the IP is shared by multiple clients.
Default
low
Related topics
l
system network-option
Use this command to configure system-wide TCP connection options.
To use this command, your administrator account’s access control profile must have either w or rw permission to the netgrp area. For more information, see
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
301
system network-option
Syntax
config system network-option set set
tcp-timestamp {enable | disable}
tcp-tw-recycle {enable | disable}
set set set set set set set set end set set
Variable
tcp-timestamp {enable | disable}
Description Default
Enable to both: l l verify whether clients’ TCP timestamps are sequential include TCP timestamps in packets from FortiWeb
Disabling this option can be useful when multiple clients are in front of a source NAT gateway such as a FortiGate.
If it applies source NAT but forwards packets to FortiWeb
without modifying the TCP timestamp, packets received from that source IP will appear to FortiWeb to have an unstable timestamp. FortiWeb will therefore drop out-ofsequence packets. Disabling therefore prevents packets dropped due to this cause, and can improve performance in that case.
Caution: Disabling this option affects FortiWeb’s dynamic calculation of TCP retransmission timeout
(RTO) and therefore round trip time (RTT). If you disable the timestamp when it is not necessary, this can result in decreased application performance.
enable config
302 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system network-option
Variable Description
tcp-tw-recycle {enable | disable}
Enable to quickly recycle sockets that are ready to close
(i.e. in the TIME_WAIT state per the TCP RFC).
This option can be useful in networks with both sustained high load and bursts of new connection requests. If all sockets are busy, new connection requests may be refused. Enabling this option frees sockets more quickly.
Caution: Enabling this option can cause issues with external load balancers and HA failover if they are not expecting the connection to close quickly. This can result in decreased application performance. Generally, it is safer to wait for sockets to safely close before they are reused.
ip-src-balance {enable | disable}
Enable to allow FortiWeb to connect to the back-end servers using more than one IPv4 address. FortiWeb uses a round-robin load-balancing algorithm to distribute the connections among the available IP addresses.
To specify the additional IP addresses, see
This option is useful for performance testing when the number of concurrent connections between FortiWeb and a back-end server exceeds the number of ports that a single IP can provide.
ip6-src-balance
{enable | disable} tcp-buffer {default | high | max} arp_ignore {enable | disable}
Default
disable disable
Enable to allow FortiWeb to connect to the back-end servers using more than one IPv6 address. FortiWeb uses a round-robin load-balancing algorithm to distribute the connections among the available IP addresses.
To specify the additional IP addresses, see
Specify high or max to increase the size of the TCP buffer.
This option is useful when amount of traffic between a server pool member and FortiWeb is significantly larger than traffic between FortiWeb and the client.
disable default
Specify how FortiWeb responds to ARP requests.
l disable
– Reply for any local target IP address, configured on any interface.
l enable
– Reply only if the target IP address is local address configured on the incoming interface.
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
303
system network-option config
Variable
loopback-mtu <loopbackmtu_int> tcp-usertimeout <tcpusertimeout_int>
Description
If the operation mode is true transparent proxy, specify a global MTU for v-zones.
Caution: If this value is smaller than a v-zone's MTU, this value replaces the larger value in the v-zone configuration.
Available only when the operation mode is true transparent proxy.
Enter how long FortiWeb waits before it closes the connection with a client that is not sending any data or responding with ACK to keepalive packets, in seconds.
tcp-keepcnt <tcpkeepcnt_int> tcp-keepidle <tcpkeepidle_int>
Used only if no value is specified for tcpusertimeout
. Fortinet recommends that you always specify a tcp-usertimeout value.
Enter how long FortiWeb waits before it sends a client or server that keeps a connection with FortiWeb open without sending data a keepalive packet, in seconds.
tcp-keepintvl <tcpkeepintvl_int>
Enter how often FortiWeb sends a keepalive packet to a client that keeps a connection open without sending data, in seconds.
loopback-tso-gso {enable
| disable}
Used for debugging.
Default
65536
120
3
60
20 disable
Example
This example assigns additional IP addresses to port1. FortiWeb uses a round-robin load-balancing algorithm to distribute connections to back-end servers among the available IP addresses.
config system network-option set ip-src-balance enable end config system interface edit "port1" set type physical set ip 192.168.183.71/24 set allowaccess https ping ssh snmp http telnet config secondaryip edit 1 set ip 192.168.183.72/24 next edit 2 set ip 192.168.183.73/24 end next
304 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config end next
Related topics
l
l
l
l
system raid
system raid
Use this command to configure the RAID level.
Currently, only RAID level 1 is supported, and only on the following models shipped with FortiWeb 4.0 MR1 or later: l l l l l l l l l
FortiWeb-1000B
FortiWeb-1000C
FortiWeb-1000D
FortiWeb-3000C
FortiWeb-3000D
FortiWeb-3000E
FortiWeb-4000C
FortiWeb-4000D
FortiWeb-4000E
On older appliances that have been upgraded to FortiWeb 4.0 MR1, RAID cannot be activated.
Back up the data regularly. RAID is not a substitute for regular backups. RAID 1
(mirroring) is designed to improve hardware fault tolerance, but cannot negate all risks.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system raid set
end
Variable
level {raid1}
Description Default
Type the RAID level. Currently, only RAID level 1 is supported.
raid1
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
305
system replacemsg config
Example
This example sets RAID level 1.
config system raid set level raid1 end
Related topics
l
l
l
system replacemsg
Use this command to customize the following FortiWeb HTML pages: l
Pages that FortiWeb presents to clients when it authenticates users.
FortiWeb uses these pages when you configure a site publishing configuration to use HTML form authentication for its client authentication method. For more information, see
config waf sitepublish-helper rule
l l
The error page FortiWeb uses to respond to an HTTP request that violates a policy that responds to violations with the action alert and deny or period block.
The “Server Unavailable!” page that FortiWeb returns to the client when none of the server pool members are available either because they are disabled or in maintenance more, or they have failed the configured health check.
When you specify the HTML code for the web pages using the buffer setting, you enter the complete HTML code with changes, even if you are only changing a word or fixing a typographical error. The web UI provides a more convenient editing method that allows you to see the effect of your changes as you edit.
FortiWeb uses these pages for all server policies. If you require a page content that is customized for a specific policy, create an ADOM that contains the custom pages for that policy.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system replacemsg edit
{url-block | server-inaccessible | login | token | rsa-login | rsachallenge | pre-login-disclaimer}
set set set set set
end
306 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system replacemsg
Variable
{url-block | serverinaccessible | login | token | rsa-login | rsachallenge | prelogin-disclaimer}
Description Default
Enter one of the following options to specify the page to modify: l url-block — Attack block page l server-inaccessible — Server unavailable message l login — Authentication login page l token — Token authentication page l rsa-login — RSA SecurID authentication page l rsa-challenge — RSA SecurID challenge page l pre-login-disclaimer — a login disclaimer message for administrators logging in to FortiWeb
No default buffer <buffer_ str> code <code_int>
Enter the HTML content for the page.
Because the code for an web page is usually more than one word and contains special characters, surround it with double quotes ( " ).
If you are editing the url-block item, specify the HTTP page return code as an integer.
You cannot edit this setting for other HTML pages.
set format {html | none | text}
Specifies the format of the replacement message.
Currently, all messages are HTML.
Cannot be changed from the default.
set group {alert | site-publish}
Specifies whether the replacement page is used for security features (blocking and server unavailable) or site publishing feature.
Cannot be changed from the default.
Preset HTML content
500 html alert block
(url-
, serverinaccessible) site-publish
(login, token, rsa-login
, rsachallenge) set header {8 bit
| HTTP | no header type}
Specifies the header type for the message.
Cannot be changed from the default.
HTTP
Related topics
l
config system replacemsg-image
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
307
system replacemsg-image config
system replacemsg-image
Use this command to add images that the FortiWeb HTML web pages can use. These pages are the ones that
FortiWeb uses for blocking, authentication, and unavailable servers.
You cannot edit the images that FortiWeb provides by default.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system replacemsgimage edit
set set
image-type {gif | jpg | png | tiff} image-base64 <image_code>
end
Variable
<image_name>
Description
Specify the name of the image to add.
image-type {gif | jpg | png | tiff} image-base64 <image_ code>
Specify the image file format of the image to add.
Specify the HTTP page return code as clear text, Base64encoded.
Ensure the value has the following properties: l
Its length is divisible by 4 (a rule of Base64 encoding) l
It begins with characters that identify its format (for example,
R0lGO for GIF, iVBORw0K for PNG) l
The format matches the value of image-type
Default
No default
No default
No default
Related topics
l
system settings
Use this command to configure the operation mode and gateway of the FortiWeb appliance.
You will usually set the operation mode once, during installation. Exceptions include if you install the FortiWeb appliance in offline protection mode for evaluation purposes, before deciding to switch to another mode for more feature support in a permanent deployment.
308 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system settings
Back up your configuration before changing the operation mode. Changing modes deletes any policies not applicable to the new mode, TCP SYN flood protection settings, all static routes, all V-zone (bridge) IPs, and all VLANs. You must re-cable your network topology to suit the operation mode, unless you are switching between the two transparent modes, which have similar network topology requirements.
The physical topology must match the operation mode. You may need to re-cable your deployment after changing this setting. For details, see the
FortiWeb Installation
Guide
.
There are four operation modes: l l
Reverse proxy — Requests are destined for a virtual server’s network interface and IP address on the FortiWeb appliance. The FortiWeb appliance applies the first applicable policy, then forwards permitted traffic to a real web server. The FortiWeb appliance logs, blocks, or modifies violations according to the matching policy and its protection profile.
Most features are supported.
Offline protection — Requests are destined for a real web server instead of the FortiWeb appliance; traffic is duplicated to the FortiWeb through a span port. The FortiWeb appliance monitors traffic received on the virtual server’s network interface (regardless of the IP address) and applies the first applicable policy. Because it is not inline with the destination, it does
not forward permitted traffic. The FortiWeb appliance logs or blocks violations according to the matching policy and its protection profile. If FortiWeb detects a malicious request, it sends a TCP
RST (reset) packet to the web server and client to attempt to terminate the connection. It does
not otherwise modify traffic. (It cannot, for example, apply SSL, load-balance connections, or support user authentication.)
Unlike in reverse proxy mode or true transparent proxy mode, actions other than
Alertcannot be guaranteed to be successful in offline protection mode. The FortiWeb appliance will attempt to block traffic that violates the policy by mimicking the client or server and requesting to reset the connection. However, the client or server may receive the reset request after it receives the other traffic due to possible differences in routing paths.
Most organizations do not permanently deploy their FortiWeb appliances in offline protection mode. Instead, they will use offline protection as a way to learn about their web servers’ protection requirements and to form some of the appropriate configuration during a transition period, after which they will switch to one of the operation modes that places the appliance inline between all clients and all web servers.
Switching out of offline protection mode when you are done with transition can prevent bypass problems that can arise as a result of misconfigured routing. It also offers you the ability to offer some protection features that cannot be supported in a span port topology used with offline detection.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
309
system settings config l l
True transparent proxy — Requests are destined for a real web server instead of the FortiWeb appliance. The
FortiWeb appliance transparently proxies the traffic arriving on a network port that belongs to a Layer 2 bridge, applies the first applicable policy, and lets permitted traffic pass through. The FortiWeb appliance logs, blocks, or modifies violations according to the matching policy and its protection profile.
No changes to the IP address
scheme of the network are required. This mode supports user authentication via HTTP but not HTTPS.
Transparent inspection — Requests are destined for a real web server instead of the FortiWeb appliance. The
FortiWeb appliance asynchronously inspects traffic arriving on a network port that belongs to a Layer 2 bridge, applies the first applicable policy, and lets permitted traffic pass through. The FortiWeb appliance logs or blocks traffic according to the matching policy and its protection profile, but does
not otherwise modify it. (It cannot, for example, apply SSL, load-balance connections, or support user authentication.
Unlike in reverse proxy mode or true transparent proxy mode, actions other than
Alertcannot be guaranteed to be successful in transparent inspection mode. The
FortiWeb appliance will attempt to block traffic that violates the policy. However, due to the nature of asynchronous inspection, the client or server may have already received the traffic that violated the policy.
The default operation mode is reverse proxy.
Feature support varies by operation mode. For details, see the
FortiWeb Administration Guide
.
You can use SNMP traps to notify you if the operation mode changes. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system settings set
end set set set set
310 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system settings
Variable
opmode {offlineprotection | reverseproxy | transparent | transparentinspection | wccp} gateway <router_ipv4> stop-guimonitor
{enable | disable} enable-cache-flush
{enable | disable} fast-forward {enable | disable}
Description
Select the operation mode of the FortiWeb appliance.
If you have not yet adjusted the physical topology to suit the new operation mode, see the
FortiWeb
Administration Guide
. You may also need to reconfigure
IP addresses, VLANs, static routes, bridges, policies,
TCP SYN flood prevention, and virtual servers, and on your web servers, enable or disable SSL.
Note: If you select offline-protection, you can configure the port from which TCP RST (reset) commands are sent to block traffic that violates a policy.
For details, see
Default
reverseproxy
Type the IPv4 address of the default gateway.
This setting is visible only if opmode is either transparent or transparent-inspection.
FortiWeb will use the gateway setting to create a corresponding static route under
with the first available index number. Packets will egress through port1
, the hard-coded management network interface for the transparent operation modes.
Enable to configure FortiWeb to stop checking whether the process that generates the web UI (httpsd) is defunct
(that is, a defunct or zombie process).
In some cases, a process that has completed execution can still have an entry in the process table, which can create a resource leak.
When this setting is disabled, FortiWeb checks the process and stops and reloads the web UI if it determines that the process is defunct.
none disable
Enable to configure FortiWeb to clear its cache memory every
45 minutes and generate an event log message for the action.
disable
Specifies whether FortiWeb activity is restricted to load balancing.
disable
Related topics
l
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
311
system snmp community config
system snmp community
Use this command to configure the FortiWeb appliance’s SNMP agent to belong to an SNMP version 1 or 2c community, and to select which events cause the FortiWeb appliance to generate SNMP traps.
To configure the SNMP agent as a member of a SNMP version 3 community, see
The FortiWeb appliance’s simple network management protocol (SNMP) agent allows queries for system information can send traps (alarms or event messages) to the computer that you designate as its SNMP manager. In this way you can use an SNMP manager to monitor the FortiWeb appliance. You can add the IP addresses of up to eight SNMP managers to each community, which designate the destination of traps and which
IP addresses are permitted to query the FortiWeb appliance.
An SNMP community is a grouping of equipment for network administration purposes. You must configure your
FortiWeb appliance to belong to at least one SNMP community so that community’s SNMP managers can query the FortiWeb appliance’s system information and receive SNMP traps from the FortiWeb appliance.
You can add up to three SNMP communities. Each community can have a different configuration for queries and traps, and the set of events which trigger a trap. Use SNMP traps to notify the SNMP manager of a wide variety of types of events. Event types range from basic system events, such as high usage of resources, to when an attack type is detected or a specific rule is enforced by a policy.
Before you can use SNMP, you must activate the FortiWeb appliance’s SNMP agent (see
) and add it as a member of at least one community. You must also enable SNMP access on the
network interface through which the SNMP manager will connect. (See
.)
On the SNMP manager, you must also verify that the SNMP manager is a member of the community to which the
FortiWeb appliance belongs, and compile the necessary Fortinet proprietary management information blocks
(MIBs) and Fortinet-supported standard MIBs. For information on MIBs, see the
FortiWeb Administration Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system snmp community edit
<community_index> status {enable | disable}
set set set
set set set set set set set set
trap-v1-status {enable | disable} trap-v2c-lport <port_int>
312 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system snmp community set set
trap-v2c-rport <port_int> trap-v2c-status {enable | disable}
config hosts edit
set
ip {manager_ipv4 | manager_ipv6>
end next end next
Variable
<community_index> status {enable | disable} name <community_str>
Description
Type the index number of a community to which the FortiWeb appliance belongs. The valid range is from 1 to
9,999,999,999,999,999,999.
Enable to activate the community.
This setting takes effect only if the SNMP agent is enabled. For details, see
.
Type the name of the SNMP community to which the
FortiWeb appliance and at least one SNMP manager belongs. The maximum length is 35 characters.
The FortiWeb appliance will not respond to SNMP managers whose query packets do not contain a matching community name. Similarly, trap packets from the
FortiWeb appliance will include community name, and an
SNMP manager may not accept the trap if its community name does not match.
Default
No default.
disable
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
313
system snmp community
Variable Description Default
events {cpu-high | intf-ip | log-full | mem-low | netlink-downstatus | netlink-upstatus | policy-start | policy-stop | pserverfailed | sys-hahbfail | sys-modechange | waf-accessattack | waf-amethodattack | waf-bloginattack |waf-hiddenfields | waf-pvalidattack | waf-signaturedetection | waf-urlaccess-attack | wafspage-attack}
Type one or more of the following SNMP event names in order to cause the FortiWeb appliance to send traps when those events occur. Traps will be sent to the SNMP managers in this community. Also enable traps.
l cpu-high
— CPU usage has exceeded 80%.
l intf-ip
— A network interface’s IP address has changed.
See
.
l log-full
— Local log disk space usage has exceeded 80%.
If the space is consumed and a new log message is triggered, the FortiWeb appliance will either drop it or overwrite the oldest log message, depending on your configuration. See
.
l mem-low
— Memory (RAM) usage has exceeded 80%.
l netlink-down-status
— A network interface has been brought down (disabled). This could be due to either an administrator changing the network interface’s settings, or due to HA executing a failover.
l netlink-up-status
— A network interface has been brought up (enabled).This could be due to either an administrator changing the network interface’s settings, or due to HA executing a failover.
l policy-start
— A policy was enabled. See
.
l policy-stop
— A policy was disabled. See
.
l pserver-failed
— A server health check has determined that a physical server that is a member of a server farm is now unavailable. See
.
l sys-ha-hbfail
— An HA failover is occurring. See
.
l sys-mode-change
— The operation mode was changed.
See
.
No default.
config
314 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system snmp community
Variable
query-v1-port <port_ int> query-v1-status
{enable | disable} query-v2c-port <port_ int> query-v2c-status
{enable | disable} trap-v1-lport <port_ int> trap-v1-rport <port_ int>
Description
l waf-access-attack
— FortiWeb enforced a page access rule. See
l waf-amethod-attack
— FortiWeb enforced an allowed methods restriction. See
config waf webprotection-profile inline-protection
,
config waf web-protection-profile offlineprotection
, and
config waf allow-methodexceptions
.
l waf-blogin-attack
— FortiWeb detected a brute force login attack. See
.
l waf-hidden-fields
— FortiWeb detected a hidden fields attack.
l waf-pvalid-attack
— FortiWeb enforced an input/parameter validation rule. See
config waf parameter-validation-rule
.
l waf-signature-detection
— FortiWeb enforced a signature rule. See
l waf-url-access-attack
— FortiWeb enforced a URL access rule. See
config waf url-access urlaccess-rule
.
l waf-spage-attack
— FortiWeb enforced a start page rule. See
Default
Type the port number on which the FortiWeb appliance will listen for SNMP v1 queries from the SNMP managers of the community. The valid range is from 1 to 65,535.
161
Enable to respond to queries using the SNMP v1 version of the
SNMP protocol.
enable
Type the port number on which the FortiWeb appliance will listen for SNMP v2c queries from the SNMP managers of the community. The valid range is from 1 to 65,535.
161
Enable to respond to queries using the SNMP v2c version of the
SNMP protocol.
enable
Type the port number that will be the source (also called local) port number for SNMP v1 trap packets. The valid range is from
1 to 65,535.
162
Type the port number that will be the destination (also called remote) port number for SNMP v1 trap packets. The valid range is from 1 to 65,535.
162
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
315
system snmp sysinfo
Variable
trap-v1-status
{enable | disable} trap-v2c-lport <port_ int> trap-v2c-rport <port_ int> trap-v2c-status
{enable | disable}
<snmp-manager_index> ip {manager_ipv4 | manager_ipv6>
Description
Enable to send traps using the SNMP v1 version of the SNMP protocol.
Default
enable
Type the port number that will be the source (also called local) port number for SNMP v2c trap packets. The valid range is from
1 to 65,535.
162
Type the port number that will be the destination (also called remote) port number for SNMP v2c trap packets. The valid range is from 1 to 65,535.
162
Enable to send traps using the SNMP v2c version of the SNMP protocol.
enable
Type the index number of an SNMP manager for the community. The valid range is from 1 to
9,999,999,999,999,999,999.
Type the IP address of the SNMP manager that, if traps and/or queries are enabled in this community: l will receive traps from the FortiWeb appliance l will be permitted to query the FortiWeb appliance
SNMP managers have read-only access.
To allow any IP address using this SNMP community name to query the FortiWeb appliance, enter 0.0.0.0.
Note: Entering 0.0.0.0 effectively disables traps if there are no other host IP entries, because there is no specific destination for trap packets. If you do not want to disable traps, you must add at least one other entry that specifies the IP address of an SNMP manager.
No default.
No default.
config
Example
For an example, see
.
Related topics
l
l
l
system snmp sysinfo
Use this command to enable and configure basic information for the FortiWeb appliance’s SNMP agent.
316 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system snmp sysinfo
Before you can use SNMP, you must activate the FortiWeb appliance’s SNMP agent and add it as a member of at least one community (see
). You must also enable SNMP access on the network interface through which the SNMP manager will connect. (See
.)
On the SNMP manager, you must also verify that the SNMP manager is a member of the community to which the
FortiWeb appliance belongs, and compile the necessary Fortinet proprietary management information blocks
(MIBs) and Fortinet-supported standard MIBs. For information on MIBs, see the
FortiWeb Administration Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config system snmp sysinfo
[set
[set
[set set
end
Variable
contact-info <contact_ str> description
<description_str>
Description Default
Type the contact information for the administrator or other person responsible for this FortiWeb appliance, such as a phone number or name. The contact information can contain only letters (a-z, A-Z), numbers, hyphens ( - ) and underscores
( _ ). The maximum length is 35 characters.
No default.
Type a description of the FortiWeb appliance. The string can contain only letters (a-z, A-Z), numbers, hyphens ( - ) and underscores ( _ ). The maximum length is 35 characters.
No default.
location <location_str> status {enable | disable}
Type the physical location of the FortiWeb appliance. The string can contain only letters (a-z, A-Z), numbers, hyphens ( - ) and underscores ( _ ). The maximum length is 35 characters.
No default.
Enable to activate the SNMP agent, enabling the
FortiWeb appliance to send traps and/or receive queries for the communities in which you have enabled queries and/or traps.
This setting enables queries only if SNMP administrative access is enabled on one or more network interfaces. For details, see
disable
Example
This example enables the SNMP agent, configures it to belong to a community named public whose SNMP manager is 172.168.1.20. The SNMP manager is not directly attached, but can be reached through the network interface named port3.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
317
system snmp user config
This example also configures the SNMP agent to send traps using SNMP v2c for high CPU or memory usage, and when the primary appliance fails; it also enables responses to SNMP v2c queries through the network interface named port3 (along with the previously enabled administrative access protocols, ICMP ping, HTTPS, and SSH).
config system snmp sysinfo set contact-info 'admin_example_com' set description 'FortiWeb-1000B' set location 'Rack_2' set status enable end config system snmp community edit 1 set status enable set name public set events {cpu-high mem-low sys-ha-hbfail} set query-v1-status disable set query-v2c-port 161 set query-v2c-status enable set trap-v1-status disable set trap-v2c-lport 162 set trap-v2c-rport 162 set trap-v2c-status enable config hosts edit 1 set interface port3 set ip 172.168.1.20
next end next end config system interface edit port3 set allowaccess ping https ssh snmp end next
Related topics
l
l
l
system snmp user
Use this command to configure the FortiWeb appliance’s SNMP agent to belong to an SNMP version 3 community, and to select which events cause the FortiWeb appliance to generate SNMP traps.
To configure the SNMP agent as a member of a SNMP version version 1 or 2c community and for more information on the SNMP agent, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
318 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system snmp user
Syntax
config system snmp user edit
set
set set set set set set set set set set set
config hosts edit
set
end next end next
Variable
name <community_str>
Default
No default.
status {enable | disable}
Description
Type the name of the SNMP community to which the
FortiWeb appliance and at least one SNMP manager belongs. The maximum length is 35 characters.
The FortiWeb appliance does not respond to SNMP managers whose query packets do not contain a matching community name. Similarly, trap packets from the
FortiWeb appliance include the community name, and an
SNMP manager may not accept the trap if its community name does not match.
Enable to activate the community.
This setting takes effect only if the SNMP agent is enabled. For details, see
.
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
319
system snmp user
Variable Description Default
security-level { noauthnopriv | authnopriv | authpriv >
Type the security level.
l noauthnopriv
— No additional authentication or encryption compared to SNMP v1 and v2.
l authnopriv
— The SNMP manager needs to provide the password specified in this community configuration. Also specify auth-proto and auth-pwd.
l authpriv
— Adds both authentication and encryption. Also specify auth-proto, auth-pwd, priv-proto, and priv-pwd
. Ensure that the SNMP manager and FortiWeb use the same protocols and passwords.
No default.
auth-proto {sha1 | md5}
If the security-level option includes authentication, specify the authentication protocol.
auth-pwd <authpassword_str>
If the security-level option includes authentication, specify the authentication password.
priv-proto {aes | des} priv-pwd <privpassword_str>
If the security-level option is authprivuser_ name
, specify the encryption protocol.
If the security-level option is authprivuser_ name
, specify the encryption password.
sha1
No default.
aes
No default.
query-status {enable | disable} query-port <port_int> trap-status {enable | disable} trapport-local <port_ int> trapport-remote <port_ int>
Enable to respond to queries using the SNMP v3 version of the
SNMP protocol.
enable
Type the port number on which the FortiWeb appliance listens for SNMP v3 queries from the SNMP managers of the community. The valid range is from 1 to 65,535.
Enable to send traps using the SNMP v3 version of the SNMP protocol.
161 enable
Type the port number that is the source (also called local) port number for SNMP v3 trap packets. The valid range is from 1 to
65,535.
162
Type the port number that is the destination (also called remote) port number for SNMP v3 trap packets. The valid range is from 1 to 65,535.
162 config
320 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system snmp user
Variable Description Default
trapevent {cpu-high | intf-ip | log-full | mem-low | netlink-downstatus | netlink-upstatus | policy-start | policy-stop | pserverfailed | sys-hahbfail | sys-modechange | waf-accessattack | waf-amethodattack | waf-bloginattack |waf-hiddenfields | waf-pvalidattack | waf-signaturedetection | waf-urlaccess-attack | wafspage-attack}
Type the name of one or more the SNMP events. When
FortiWeb detects the specified events, it sends traps to the SNMP managers in this community. Also enable trap-status
.
l cpu-high
— CPU usage has exceeded 80%.
l intf-ip
— A network interface’s IP address has changed.
See
.
l log-full
— Local log disk space usage has exceeded 80%.
If the space is consumed and a new log message is triggered, the FortiWeb appliance will either drop it or overwrite the oldest log message, depending on your configuration. See
.
l mem-low
— Memory (RAM) usage has exceeded 80%.
l netlink-down-status
— A network interface has been brought down (disabled). This could be due to either an administrator changing the network interface’s settings, or due to HA executing a failover.
l netlink-up-status
— A network interface has been brought up (enabled).This could be due to either an administrator changing the network interface’s settings, or due to HA executing a failover.
l policy-start
— A policy was enabled. See
.
l policy-stop
— A policy was disabled. See
.
l pserver-failed
— A server health check has determined that a physical server that is a member of a server farm is now unavailable. See
.
l sys-ha-hbfail
— An HA failover is occurring. See
.
l sys-mode-change
— The operation mode was changed.
See
.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
321
system snmp user
Variable
<snmp-user_index> ip <manager_ipv4>
Description
l waf-access-attack
— FortiWeb enforced a page access rule. See
l waf-amethod-attack
— FortiWeb enforced an allowed methods restriction. See
config waf webprotection-profile inline-protection
,
config waf web-protection-profile offlineprotection
, and
config waf allow-methodexceptions
.
l waf-blogin-attack
— FortiWeb detected a brute force login attack. See
.
l waf-hidden-fields
— FortiWeb detected a hidden fields attack.
l waf-pvalid-attack
— FortiWeb enforced an input/parameter validation rule. See
config waf parameter-validation-rule
.
l waf-signature-detection
— FortiWeb enforced a signature rule. See
l waf-url-access-attack
— FortiWeb enforced a URL access rule. See
config waf url-access urlaccess-rule
.
l waf-spage-attack
— FortiWeb enforced a start page rule. See
Default
No default.
Type the index number of an SNMP user for the community.
The valid range is from 1 to 9,999,999,999,999,999,999.
Type the IP address of the SNMP manager that can do the following when you enable traps, queries, or both in this community: l
Receive traps from the FortiWeb appliance l
Query the FortiWeb appliance
SNMP managers have read-only access.
To allow any IP address using this SNMP community name to query the FortiWeb appliance, enter 0.0.0.0.
Note: Entering 0.0.0.0 effectively disables traps if there are no other host IP entries, because there is no specific destination for trap packets. If you do not want to disable traps, add at least one other entry that specifies the IP address of an SNMP manager.
No default.
Example
For an example, see
.
config
322 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system v-zone
Related topics
l
l
l
system v-zone
Use this command to configure bridged network interfaces, also called v-zones.
Bridges allow network connections to travel through the FortiWeb appliance’s physical network ports
without
explicitly connecting to one of its IP addresses.
Bridges on the FortiWeb appliance support
IEEE 802.1d
spanning tree protocol (STP) by forwarding bridge protocol data unit (BPDU) packets, but do
not generate BPDU packets of their own. Therefore, in some cases, you might need to manually test the bridged network for Layer 2 loops. Also, you may prefer to manually design a tree that uses the minimum cost path to the root switch for design and performance reasons.
For FortiWeb-VM, you must create vSwitches before you can configure a bridge. See the
FortiWeb-VM Install Guide
for details.
To use this command, your administrator account’s access control profile must have either w or rw permission to the netgrp area. For more information, see
Syntax
config system v-zone edit
set
interfaces {<interface_name> <interface_name> ...}
set set
monitor {enable | disable} mtu <mtu_int> use-interface-macs {<interface_name> <interface_name> ...}
end set next
Variable
<bridge_name>
Description
Type the name of the bridge. The maximum length is 15 characters.
To display the list of existing bridges, type: edit ?
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
323
system v-zone config
Variable
interfaces {<interface_ name> <interface_name>
...} mtu <mtu_int>
Description Default
Type the names of two or more network interfaces that currently have no IP address of their own, nor are members of another bridge, and therefore could be members of this bridge.
Separate each name with a space. The maximum length is 35 characters.
No default.
Enter the maximum transmission unit (MTU) that the bridge supports.
When you specify the MTU for a bridge, FortiWeb automatically sets the MTU for the v-zone members to the same value.
Valid values are 512 to 9216 (for IPv4) or 1280 to 9216
(for IPv6).
1500 monitor {enable | disable} use-interface-macs
{<interface_name>
<interface_name> ...}
Specifies whether FortiWeb automatically brings down all members of this v-zone if one member goes down.
disable
Enter the names of network interfaces that are members of the bridge and send and transmit traffic using the MAC address of their corresponding FortiWeb network interface.
No default.
When the operation mode is true transparent proxy, by default, traffic to the back-end servers preserves the MAC address of the source. If you are using FortiWeb with front-end load balancers that are in a high availability cluster that uses multiple bridges, this mechanism can cause switching problems on failover. When the v-zone uses the MAC address of the FortiWeb network interface instead, a failover does not interrupt the flow of traffic.
Available only when the operation mode is true transparent proxy.
Example
This example configures a true bridge between port3 and port4. The bridge has no virtual network interface, and so it cannot respond to pings.
config system v-zone edit bridge1 end set interfaces port3 port4 next
Related topics
l
l
324 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system wccp
system wccp
Use this command to configure FortiWeb as a Web Cache Communication Protocol (WCCP) client. This configuration allows a FortiGate configured as a WCCP server to redirect HTTP and HTTPS traffic to FortiWeb for inspection.
If your WCCP configuration includes multiple WCCP clients, the WCCP server can balance the traffic load among the clients. In addition, it detects when a client fails and redirects sessions to clients that are still available.
WCCP was originally designed to provide web caching with load balancing and fault tolerance and is described by the Web Cache Communication Protocol Internet draft.
This feature requires the operation mode to be WCCP. See
.
For information on connecting and configuring your network devices for WCCP mode, see the
FortiWeb
Administration Guide
.
For detailed information on configuring FortiGate and other Fortinet devices to act as a WCCP service group, see the FortiGate WCCP topic in the
FortiOS Handbook
.
Syntax
config system wccp edit
set
set set set set set set set set end set set set set
Variable
service-id <serviceid_int>
Description
Enter the service ID of the WCCP service group that this WCCP client belongs to.
For HTTP traffic, the service ID is 0.
For other types of traffic (for example, HTTPS), the valid range is 51 to 255. (Do not use 1 to 50, which are reserved by the WCCP standard.)
Default
51
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
325
system wccp
Variable
cache-id <cache-id_ ipv4> router-list <routerlist_ipv4>
Description
Enter the IP address of the FortiWeb interface that communicates with the WCCP server.
Ensure that the WCCP protocol is enabled for the specified network interface. See
Default
No default.
Enter the IP addresses of the WCCP servers in the
WCCP service group.
You can specify up to 8 servers. To configure more than
8 WCCP servers, use Group Address instead.
No default.
Enter the IP addresses of the clients for multicast
WCCP configurations.
group-address <groupaddress_ipv4>
The multicast address allows you to configure a WCCP service group with more than 8 WCCP clients.
No default.
The valid range of multicast addresses is 224.0.0.0 to
239.255.255.255.
authentication {enable
| disable}
Specify whether communication between the WCCP server and client is encrypted using the MD5 cryptographic hash function.
disable
Enter the password used by the WCCP server and clients.
password <passwd_str>
All servers and clients in the group use the same password.
The maximum password length is 8 characters.
Available only when authentication is enabled
.
cache-engine-method
{GRE | L2}
No default.
Enter how the FortiGate unit transmits traffic to
FortiWeb.
l
GRE
– The WCCP server encapsulates redirected packets within a generic routing encapsulation (GRE) header. The packets also have a WCCP redirect header.
l
L2
– The WCCP server overwrites the original MAC header of the IP packets and replaces it with the MAC header for the WCCP client.
GRE config
326 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config system wccp
Variable
ports <ports_int>
Description
Enter the port numbers of the sessions that this client inspects. The valid range is 0 to 65535.
Enter 0 to specify all ports.
primary-hash [src-ip | dst-ip | src-port | dst-port}
Enter the hashing scheme that the WCCP server uses in combination with assignmentweight to direct traffic, when the WCCP service group has more than one WCCP client.
Specify one or more of the following values: l src-ip
– Source IP address l dst-ip
– Destination IP address l src-port
– Source port l dst-port
– Destination port return-to-sender
{enable | disable}
Specify whether FortiWeb routes traffic back to the client instead of the WCCP server.
Default
80 src-ip dst-ip priority <priority_ int> protocol <priority_ int>
Enter a value that specifies the priority that this service group has.
If more than one service group is available to scan the traffic specified by ports and protocol, the
WCCP server transmits all the traffic to the service group with the highest priority value.
0
Enter the protocol of the network traffic the WCCP service group transmits. For TCP sessions, enter 6.
Valid values are 0 to 255.
6 assignment-weight
<assignment-weight_ int>
Enter a value that the WCCP server uses in combination with primary-hash to direct traffic, when the WCCP service group has more than one
WCCP client. The valid range is 0 to 255.
assignment-bucketformat {cisoimplementation | wccpv2}
Enter the hash table bucket format for the WCCP cache engine.
l l cisco-implementation
– Source IP address wccp-v2
– Web Cache Communication
Protocol version 2
0 cisoimplementation disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
327
user admin-usergrp config
Example
This example configures FortiWeb as a WCCP client that belongs to the WCCP service group 52 and specifies the interface used for WCCP client functionality (172.22.80.100) and the WCCP server (172.22.80.1).
config system wccp edit service-id 52 set cache-id 172.22.80.100
set router-list 172.22.80.1
set ports 80 443 set primary-hash src-ip dst-ip
Related topics
l
l
user admin-usergrp
Use this command to configure LDAP/RADIUS/PKI remote authentication groups that can be used when configuring a FortiWeb administrator account.
Before you can add a remote authentication group, you must first define at least one query for either LDAP or
RADIUS accounts (see
or
config server-policy custom-application application-policy
For information about certificate-based Web UI login, see the
FortiWeb Administration Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the authusergrp area. For more information, see
Syntax
config user admin-usergrp edit
config members edit
end next end next set set set
type {ldap | radius | pki} ldap-name <query_name> radius-name <query_name>
set
Variable
<group_name>
Description
Type the name of the remote authentication group. The maximum length is 35 characters.
Default
No default.
328 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config user admin-usergrp
Variable
<entry_index> type {ldap | radius | pki}
Description
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
Default
No default.
Select the protocol used for the query, either LDAP, RADIUS or
PKI.
ldap ldap-name <query_name> radius-name <query_name>
Type the name of an existing RADIUS account query. The maximum length is 35 characters.
To display the list of existing queries, type: edit ?
pki-name <pki_name>
Type the name of an existing LDAP account query. The maximum length is 35 characters.
To display the list of existing queries, type: edit ?
Type the name of an existing PKI user. The maximum length is 35 characters.
To display the list of existing queries, type: edit ?
No default.
No default.
No default.
Example
This example creates a remote authentication group using an existing LDAP user query named LDAP Users 1.
Because remote authentication groups use LDAP queries by default, the LDAP query type is not explicitly configured.
config user admin-usergrp edit "Admin LDAP" config members edit 0 end end next set ldap-name "LDAP Users 1" next
Related topics
l
l
l
config server-policy custom-application application-policy
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
329
user kerberos-user config
user kerberos-user
Use this command to specify a Kerberos Key Distribution Center (KDC) that FortiWeb can use to obtain a
Kerberos service ticket for web applications on behalf of clients.
Because FortiWeb determines the KDC to use based on the realm of the web application, you do not have to specify the KDC in the site publish rule.
For more information, see
config waf site-publish-helper rule
and the
FortiWeb Administration
Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the authusergrp area. For more information, see
Syntax
config user kerberos-user edit
set
set set
server <kdc-server_ip> port <kdc-port_ip> status <kdc_status>
end set next
Variable
<kdc_name>
Description
Enter the name of the Key Distribution Center (KDC).
realm <realm_str> server <kdc-server_ip>
Enter the domain of the domain controller (DC) that the Key
Distribution Center (KDC) belongs to.
Enter the IP address of the KDC.
In most cases, the KDC is located on the same server as the DC.
port <kdc-port_ip> status <kdc_status>
Enter the port the KDC uses to listen for requests.
Specify whether the KDC configuration is enabled.
Default
No default.
No default.
No default.
No default.
enable
Related topics
l
config waf site-publish-helper rule
l
config waf site-publish-helper keytab_file
330 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config user ldap-user
user ldap-user
Use this command to configure queries that can be used for remote authentication of either FortiWeb administrators or end users via an LDAP server.
To apply LDAP queries to end users, select a query in a user group that is then selected within an authentication rule, which is in turn selected within an authentication policy, which is ultimately selected within an inline protection profile used for web protection. For details, see
.
To apply LDAP queries to administrators, select a query in an admin group and reference that group in a system administrator configuration. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the authusergrp area. For more information, see
Syntax
config user ldap-user edit
set
bind-type {anonymous | simple | regular}
set
common-name-id <cn-attribute_str>
set set
distinguished-name <search-dn_str> filter <query-filter_str>
set set set set set set set set end set next
group_authentication {enable | disable} group_dn <group-dn_str>
Variable
<ldap-query_name>
Description
Type the name of the LDAP user query. The maximum length is 35 characters.
To display the list of existing queries, type: edit ?
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
331
user ldap-user
Variable
bind-type {anonymous | simple | regular} common-name-id <cnattribute_str>
Description Default
Select one of the following LDAP query binding styles: l simple — Bind using the client-supplied password and a bind
DN assembled from the
common-name-id <cn-attribute_ str>
,
distinguished-name <search-dn_str> , and the client-
supplied user name.
l regular
— Bind using a bind DN and password that you configure in
and
l anonymous
— Do not provide a bind DN or password.
Instead, perform the query without authenticating. Select this option only if the LDAP directory supports anonymous queries.
simple
Type the identifier, often cn, for the common name (CN) attribute whose value is the user name. The maximum length is 63 characters.
Identifiers may vary by your LDAP directory’s schema.
No default.
distinguished-name
<search-dn_str> filter <query-filter_ str> group_authentication
{enable | disable} group_dn <group-dn_str>
Type the distinguished name (DN) such as ou=People,dc=example,dc=com
, that, when prefixed with the common name, forms the full path in the directory to user account objects. The maximum length is 255 characters.
No default.
No default.
Type an LDAP query filter string, if any, that will be used to filter out results from the query’s results based upon any attribute in the record set. The maximum length is
255 characters.
This option is valid only when bind-type is regular .
Enable to only include users that are members of an
LDAP group. Also configure
group-type {edirectory | open-ldap | windows-ad}
and
.
This option is valid only when bind-type is regular
.
enable
Type the distinguished name of the LDAP user group, such as ou=Groups,dc=example,dc=com. The maximum length is 255 characters.
This option is valid only when group_ authentication is enabled.
No default.
config
332 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config user ldap-user
Variable Description
group-type {edirectory | open-ldap | windows-ad}
Select the schema that matches your server’s LDAP directory.
Group membership attributes may have different names depending on an LDAP directory schemas. The FortiWeb appliance will use the group membership attribute that matches your directory’s schema when querying the group DN.
This option is valid only when group_ authentication is enabled.
password <bind-password_ str>
Type the password of the
. The maximum length is 63 characters.
This field may be optional if your LDAP server does not require the FortiWeb appliance to authenticate when performing queries, and does not appear if bind-type is anonymous or simple.
port <port_int> protocol {ldaps | starttls}
Type the port number where the LDAP server listens. The valid range is from 1 to 65,535.
The default port number varies by your selection in sslconnection
: port 389 is typically used for non-secure connections or for STARTTLS-secured connections, and port 636 is typically used for SSL-secured (LDAPS) connections.
Select whether to secure the LDAP query using LDAPS or
STARTTLS. You may need to reconfigure
to correspond to the change in protocol.
This field is applicable only if ssl-connection is enable
.
server <ldap_ipv4>
Type the IP address of the LDAP server.
ssl-connection {enable | disable}
Enable to connect to the LDAP servers using an encrypted connection, then select the style of the encryption in protocol
.
Default
openldap
No default.
389 ldaps
0.0.0.0
enable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
333
user local-user
Variable
username <bind-dn_str>
Description
Type the bind DN, such as cn=FortiWebA,dc=example,dc=com
, of an LDAP user account with permissions to query the
distinguishedname <search-dn_str>
. The maximum length is 255 characters.
This field may be optional if your LDAP server does not require the FortiWeb appliance to authenticate when performing queries, and does not appear if bind-type is anonymous or simple.
Default
No default.
config
Example
This example configures an LDAP user query to the server at 172.16.1.100 on port 389. SSL and TLS are disabled. To bind the query, the FortiWeb appliance will use the bind DN cn=Manager,dc=example,dc=com
, whose password is mySecretPassword. Once connected and bound, the query for search for user objects in ou=People,dc=example,dc=com, comparing the user name supplied by the HTTP client to the value of each object’s cn attribute. Group authentication is disabled.
config user ldap-user edit "ldap-user1" set server "172.16.1.100" set ssl-connection disable set port 389 set common-name-id "cn" set distinguished-name "ou=People,dc=example,dc=com" set bind-type regular end set username "cn=Manager,dc=example,dc=com" set password "mySecretPassword" set group-authentication disable next
Related topics
l
l
l
user local-user
Use this command to configure locally defined user accounts.
Local user accounts are used by the HTTP authentication feature to authorize HTTP requests. For details, see the
FortiWeb Administration Guide
.
To incorporate local user accounts, add them to a user group that is selected within an authentication rule, which is in turn selected within an authentication policy. For details, see
.
334 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config user local-user
To use this command, your administrator account’s access control profile must have either w or rw permission to the authusergrp area. For more information, see
Syntax
config user local-user edit
set
set
end next
Variable
<local-user_name> username <user_str> password <password_str>
Description
Type a name that can be referenced in other parts of the configuration.
To display the list of existing accounts, type: edit ?
Do not use spaces or special characters. The maximum length is 35 characters.
Note: This is not the user name that the person must provide when logging in to the CLI or web UI.
Type the user name that the client must provide when logging in, such as user1 or [email protected].
The maximum length is 63 characters.
Type the password for the local user account. The maximum length is 63 characters.
Default
No default.
No default.
No default.
Example
This example configures a local user account that can be used for HTTP authentication.
config user local-user edit "local-user1" set username "user1" set password "myPassword" end next
Related topics
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
335
user ntlm-user config
user ntlm-user
Use this command to configure user accounts that will authenticate with the FortiWeb appliance via an NT LAN
Manager (NTLM) server.
NTLM queries can be made to a Microsoft Windows or Active Directory server that has been configured for NTLM authentication. Both NTLM v1 and NTLM v2 versions of the protocol are supported.
NTLM user queries are used by the HTTP authentication feature to authorize HTTP requests. For details, see the
FortiWeb Administration Guide
.
To incorporate NTLM user account queries, add them to a user group that is selected within an authentication rule, which is in turn selected within an authentication policy. For details, see
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the authusergrp area. For more information, see
Syntax
config user ntlm-user edit
set set end next
port <port_int> server <ntlm_ipv4>
Variable
<ntlm-query_name> port <port_int> server <ntlm_ipv4>
Description
Type the name of the NTLM user query. The maximum length is 35 characters.
To display the list of existing queries, type: edit ?
Default
No default.
Type the port number where the NTLM server listens. The valid range is from 1 to 65,535.
445
Type the IP address of the NTLM server.
No default.
Example
This example configures an NTLM query connection to a server at 172.16.1.101 on port 445.
config user ntlm-user edit "ntlm-user1" set server "172.16.1.101" set port 445 end next
336 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config user pki-user
Related topics
l
user pki-user
In FortiWeb's certificate-based Web UI login, a PKI user is the administrator that FortiWeb will authorizes his
Web UI access based on his PKI certificate. With this command, you can create a PKI user for FortiWeb to verify and authorize the Web UI accesses from the user.
Before creating a PKI user, you must import the CA certificate (through FortiWeb Web UI) associated with the user to the FortiWeb, see
. After the PKI user being created, please add it
to an admin group through
, and enable https-cert-login through
For information about certificate-based Web UI login, see the
FortiWeb Administration Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For more information, see
Syntax
config user pki-user edit
set
set
end next
Variable
<pki-user_name> cacert <cacert_str> subject "<subject_str>"
Description
Type the name of a PKI user. The maximum length is 35 characters.
Specifies the CA certificate associated with the PKI user's certificate. It must be one of the CA certificates stored on the
FortiWeb for administration, see
Specifies the subject of the PKI user's certificate, such as C =
US, ST = Washington, O = yourorganization,
CN = yourname
.
Default
No default.
No default.
No default.
Example
This example adds a PKI user associated with the CA certificate CA_Cert_1.
config user pki-user edit pki_user1 set cacert CA_Cert_1
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
337
user radius-user end set subject "C = US, ST = Washington, O = oganization, CN = Bradley Avery" next config
user radius-user
Use this command to configure RADIUS queries used to authenticate end-users and/or administrators.
If you use a RADIUS query for administrators, separate it from the queries for regular users.
Do not combine administrator and user queries into a single entry.
Failure to separate queries will allow end-users to have administrative access the
FortiWeb web UI and CLI.
Remote Authentication and Dial-in User Service (RADIUS) servers provide authentication, authorization, and accounting functions. The FortiWeb authentication feature uses RADIUS user queries to authenticate and authorize HTTP requests. (The HTTP protocol does not support active logouts, and can only passively log out users when their connection times out. Therefore FortiWeb does not fully support RADIUS accounting.) RADIUS authentication with realms (i.e. the person logs in with an account such as [email protected]) are supported.
To authenticate a user, the FortiWeb appliance sends the user’s credentials to RADIUS for authentication. If
RADIUS authentication succeeds, the user is successfully authenticated with the FortiWeb appliance. If RADIUS authentication fails, the appliance refuses the connection. To override the default authentication scheme, select a specific authentication protocol or change the default RADIUS port.
To incorporate RADIUS users, they must be in a user group selected within an authentication rule, which is in turn selected within an authentication policy. For details, see
config server-policy custom-application application-policy
For access profiles, FortiWeb appliances support RFC 2548
Microsoft Vendor-specific
RADIUS Attributes. If you do not want to use them, you can configure them locally
instead. See
To use this command, your administrator account’s access control profile must have either w or rw permission to the authusergrp area. For more information, see
Syntax
config user radius-user edit
set set set set set set set set end next
338 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config user radius-user
Variable
<radius-query_name> secret <password_str> server <radius_ipv4> server-port <port_int> auth-type {default | chap | ms_chap | ms_ chap_v2 | pap}
Description
Type a unique name that can be referenced in other parts of the configuration.
Do not use spaces or special characters. The maximum length is 35 characters.
To display the list of existing queries, type: edit ?
Note: This is the name of the query only, not the administrator or end-user’s account name/login, which is defined by either
or
Default
No default.
Type the RADIUS server secret key for the primary RADIUS server. The primary server secret key should be a maximum of
16 characters in length, but is allowed to be up to 63 characters.
No default.
Type the IP address of the RADIUS server to query for users.
Type the port number where the RADIUS server listens. The valid range is from 1 to 65,535.
0.0.0.0
1812
Type the authentication method. The default option uses
PAP, MS-CHAP-V2, and CHAP, in that order.
default
nas-ip <nas_ipv4> secondary-secret
<password_str> secondary-server
<radius2-ipv4> secondary-server-port
Type the NAS IP address and called station ID (see
0.0.0.0
No default.
Type the IP address of the secondary RADIUS server.
No default.
Type the port number where the secondary RADIUS server listens. The valid range is from 1 to 65,535.
1812
l
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
339
user user-group config
user user-group
Use this command to configure user groups.
User groups are used by the HTTP authentication feature to authorize HTTP requests. A group can include a mixture of local user accounts, LDAP, RADIUS, and NTLM user queries.
Before you can configure a user group, you must first configure any local user accounts or user queries that you want to include. For details, see
,
,
config server-policy custom-application application-policy
.
To apply user groups, select them in within an authentication rule, which is in turn selected within an authentication policy, which is ultimately selected within an inline protection profile used for web protection. For details, see
config waf http-authen http-authen-rule
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the authusergrp area. For more information, see
Syntax
config user user-group edit
set
auth-type {basic | digest | NTLM}
config members edit
set
type {ldap | local | ntlm | radius}
set
set set
local-name <query_name> ntlm-name <query_name> radius-name <query_name>
end end next set next
Variable
<user-group_name>
Description
Type the name of the user group. The maximum length is
35 characters.
To display the list of existing groups, type: edit ?
Default
No default.
340 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config user user-group
Variable
auth-type {basic | digest | NTLM}
<entry_index> ldap-name <query_name> local-name <query_name>
Description Default
Select one of the following authentication types: l l l basic
— This is the original and most compatible authentication scheme for HTTP. However, it is also the least secure as it sends the user name and password unencrypted to the server.
digest
— Authentication encrypts the password and thus is more secure than the basic authentication.
NTLM
— Authentication uses a proprietary protocol of
Microsoft and is considered to be more secure than basic authentication.
basic
No default.
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
Select the name of a LDAP user query.
Available if the value of type is ldap.
The maximum length is 35 characters.
Select the name of a local user account.
Available if the value of type is local.
The maximum length is 35 characters.
No default.
No default.
ntlm-name <query_name> type {ldap | local | ntlm | radius}
Select the name of a NTLM user query.
Available if the value of type is ntlm.
The maximum length is 35 characters.
radius-name <query_name> Select the name of a RADIUS user query.
Available if the value of type is radius.
The maximum length is 35 characters.
Select which type of user or user query that you want to add to the group.
Note: You can mix all user types in the group. However, if the authentication rule’s authen-type does not support a given user type, all user accounts of that type will be ignored, effectively disabling them.
No default.
No default.
local
Example
For an example, see
config waf http-authen http-authen-policy
.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
341
wad file-filter config
Related topics
l
l
l
l
config waf http-authen http-authen-rule
wad file-filter
Use this command to specify the names of directories and files that you want to exclude from anti-defacement monitoring. Alternatively, you can specify the folders and files you want FortiWeb to monitor and it will exclude any others.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wadgrp area. For more information, see
Syntax
config wad file-filter edit
set
filter-type {black-file-list | white-file-list}
edit
set
file-type {directory | regular-file}
set next
end
Variable
<wad-file-filter_name>
Description
Type the name of the file filter you can reference in other parts of the configuration.
filter-type {black-filelist | white-file-list}
Specify the type of filter: l black-file-list
— A list of files or folders that the antidefacement feature does not monitor.
l white-file-list
— A list of files or folders that the antidefacement feature monitors. The feature ignores all other files and folders.
FortiWeb still applies criteria in the anti-defacement configuration to these items. For example, if the file size exceeds the maximum, FortiWeb does not monitor it.
<entry_index>
Type the index number of the individual entry in the table.
Default
No default.
No default.
No default.
342 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config wad website
Variable
file-type {directory | regular-file} file-name <file_str>
Description
Specify the type of item to add to the list: l directory
— A folder or directory path.
l regular-file
— A file.
Type the name of the folder or file to add to the list.
Ensure that the name exactly matches the folder or file that you want to specify. If file-type is directory, include the / (forward slash).
For example, if file-type is directory and you want to add a folder abc that is under the root folder of a web site, enter /abc.
You can restrict the filter condition to a specific file by including file path information in file-name
. For example, a web site contains many files with the name
123.txt
. To specify the instance located in the abc folder only, enter /abc/123.txt.
Default
No default.
No default.
Example
This example creates a filter video-folder that excludes the folder /abc from anti-defacement monitoring when it is applied to an anti-defacement monitoring configuration.
config wad file-filter edit video-folder set filter-type black-file-list edit 1 set file-type directory set file-name /abc end next
Related topics
l
wad website
Use this command to enable and configure web site defacement attack detection and automatic repair.
The FortiWeb appliance monitors the web site’s files for any changes and folder modifications at specified time intervals. If it detects a change that could indicate a defacement attack, the FortiWeb appliance notifies you, and can quickly react by automatically restoring the web site contents to the previous backup revision.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
343
wad website config
Optionally, you can specify a filter that either defines which files and folders FortiWeb does not scan when it looks for changes (blacklist) or the specific files and folders you want it to monitor (whitelist). (See
FortiWeb automatically backs up web site files and creates a revision in the following cases: l l
When the FortiWeb appliance initiates monitoring for the first time, the FortiWeb appliance downloads a backup copy of the web site’s files and stores it as the first revision.
If the FortiWeb appliance could not successfully connect during a monitor interval, it creates a new revision the next time it re-establishes the connection.
When you intentionally modify the web site, you must disable the monitor option; otherwise, the FortiWeb appliance sees your changes as a defacement attempt and undoes them.
Backup copies omit files exceeding the file size limit and/or matching the file extensions that you have configured the FortiWeb appliance to omit. See
and
backup-skip-ftype <extensions_str> .
To use this command, your administrator account’s access control profile must have either w or rw permission to the wadgrp area. For more information, see
Syntax
config wad website edit
set
alert-email <email-policy_name>
set set
auto {disable | restore | acknowledge} backup-max-fsize <limit_int>
set set set set set set set end next set set set set set set set set
backup-skip-ftype <extensions_str> connect-type {ftp | smb | ssh} description "<comment_str>"
344 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config wad website
Variable
<entry_index> alert-email <emailpolicy_name>
Description Default
Type the index number of the individual entry in the table. The valid range is from 1 to 16.
No default.
Type the name of the email policy that specifies the email address that FortiWeb sends an email to when it detects that the web site changed. (See
The maximum length is 35 characters.
No default.
auto {disable | restore
| acknowledge}
Type the action that FortiWeb takes when it detects that the web site has changed.
l l l disable
– FortiWeb takes no action. You can use the web UI to manually restore all or some of the changed files.
restore
– Restore the web site to the previous revision number.
acknowledge
– Accept changes to the web site.
Note: When you intentionally modify the web site, type acknowledge
. Otherwise, the FortiWeb appliance detects your changes as a defacement attempt and undoes them.
disable backup-max-fsize <limit_ int>
Type a file size limit in kilobytes (KB) to indicate which files will be included in the web site backup. Files exceeding this size will not be backed up. The valid range is from 1 to 1,048,576 kilobytes.
Note: Backing up large files can impact performance.
backup-skip-ftype
<extensions_str>
Type zero or more file extensions, such as iso,avi, to exclude from the web site backup. Separate each file extension with a comma. The maximum length is 512 characters.
Note: Backing up large files, such as video and audio, can impact performance.
connect-type {ftp | smb | ssh} description "<comment_ str>"
10240
No default.
Select which protocol to use when connecting to the web site in order to monitor its contents and download web site backups. For Microsoft Windows-style shares, enter smb.
ftp
Type a description or other comment. If the comment is more than one word or contains special characters, surround the comment with double quotes ( " ). The maximum length is 255 characters.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
345
wad website
Variable
hostname-ip {<host_ ipv4> | <host_fqdn>}
Description
Type the IP address or fully qualified domain name
(FQDN) of the physical server on which the web site is hosted.
This will be used when connecting by SSH or FTP to the web site to monitor its contents and download backup revisions, and therefore could be different from the real or virtual web host name that may appear in the Host: field of HTTP headers.
interval-other <seconds_ int>
Type the number of seconds between each monitoring connection from the FortiWeb appliance to the web server. During this connection, the FortiWeb appliance examines the web site’s subfolders to see if any files have been changed by comparing the files with the latest backup. The valid range is from 1 to 86,400 seconds.
If any file change is detected, the FortiWeb appliance will download a new backup revision. If you have enabled
auto {disable | restore | acknowledge}
, the FortiWeb appliance will revert the files to their previous version.
Default
No default.
600 interval-root <seconds_ int>
Type the number of seconds between each monitoring connection from the FortiWeb appliance to the web server. During this connection, the FortiWeb appliance examines
(but not its subfolders) to see if any files have been changed by comparing the files with the latest backup. The valid range is from 1 to
86,400 seconds.
If any file change is detected, the FortiWeb appliance will download a new backup revision. If you have enabled
auto {disable | restore | acknowledge}
, the FortiWeb appliance will revert the files to their previous version.
monitor {enable | disable} monitor-depth <folders_ int>
60
Enable to monitor the web site’s files for changes, and to download backup revisions that can be used to revert the web site to its previous revision if the FortiWeb appliance detects a change attempt.
enable
Type how many folder levels deep to monitor for changes to the web site’s files. Files in subfolders deeper than this level will not be backed up. The valid range is from 1 to 10 levels deep.
5 config
346 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config wad website
Variable
name <name_str> password <password_str> port <port_int>
Description
Type a name for the web site. The maximum length is 63 characters.
This name will not be used when monitoring the web site, nor will it be referenced in any other part of the configuration, and therefore can be any identifier that is useful to you. It does not need to be the web site’s FQDN or virtual host name.
Type the password for the user name you entered in
<user_str> . The maximum length is 63 characters.
Type the port number on which the web site’s physical server listens. The standard port number for FTP is 21; the standard port number for SSH is 22.
This is applicable only if connect-type is ftp or ssh.
share-name <share_str> user <user_str> web-folder <path_str> file-filter <wad-filefilter_name>
Default
No default.
No default.
21
Type the name of the shared folder on the web server.
The maximum length is 63 characters.
This variable appears only if connect-type is smb.
No default.
Type the user name that the FortiWeb appliance will use to log in to the web site’s physical server. The maximum length is 63 characters.
No default.
Type the path to the web site’s folder, such as public_ html
, on the physical server. The path is relative to the initial location when logging in with the user name that you specify in
. The maximum length is
1,023 characters.
Available only if the value of connect-type is ftp or ssh
.
Type the filter that specifies either the files and folders that
FortiWeb excludes from anti-defacement monitoring or the specific files and folders to monitor.
No default.
No default.
Example
config wad website edit 1 set alert-email email_policy_1 set connect-type ssh set hostname-ip "192.168.1.10" set monitor enable set name "www.example.com" set password P@ssword1 set port 22
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
347
waf allow-method-exceptions end set user "fortiweb" set web-folder "public_html" set file-filter "video-folder" next
Related topics
l
l
l
config
waf allow-method-exceptions
Use this command to configure the FortiWeb appliance with combinations of URLs and host names, which are exceptions to HTTP request methods that are generally allowed or denied according to the inline or offline protection profile.
While most URL and host name combinations controlled by a profile may require similar HTTP request methods, you may have some that require different methods. Instead of forming separate policies and profiles for those requests, you can configure allowed method exceptions. The exceptions define specific HTTP request methods that are allowed by specific URLs and hosts.
To apply allowed method exceptions, select them within an inline or offline protection profile. For details, see
config waf web-protection-profile inline-protection
or
config waf webprotection-profile offline-protection
Before you configure an allowed method exception, if you want to apply it only to HTTP requests for a specific real or virtual host, you must first define the web host in a protected hosts group. For details, see
config server-policy allow-hosts
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf allow-method-exceptions edit
config allow-method-exception-list edit
set
allow-request {connect delete get head options others post put trace}
end next end next set set set set
host <protected-hosts_name> host-status {enable | disable}
request-file <url_str> request-type {plain | regular}
348 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf allow-method-exceptions
Variable
<method-exception_name>
Description
Type the name of the allowed methods exception. The maximum length is 35 characters.
To display a list of the existing exceptions, type: edit ?
Default
No default.
<entry_index> allow-request {connect delete get head options others post put trace}
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
Select one or more of the allowed HTTP request methods that are an exception for that combination of URL and host.
Methods that you do not select will be denied.
The
OTHERS option includes methods not specifically named in the other options. It often may be required by
WebDAV (
RFC 2518
) applications such as
Microsoft
Exchange Server 2003 and Subversion , which may require HTTP methods not commonly used by web browsers, such as PROPFIND and BCOPY.
Note: If a WAF Auto Learning Profile will be selected in the policy with an offline protection profile that uses this allowed method exception, you must enable the
HTTP request methods that will be used by sessions that you want the FortiWeb appliance to learn about. If a method is disabled, the FortiWeb appliance will reset the connection, and therefore cannot learn about the session.
No default.
host <protected-hosts_ name> host-status {enable | disable}
Type the name of a protected host that the Host: field of an HTTP request must be in order to match the exception. The maximum length is 255 characters.
This setting is used only if host-status is enable.
Enable to require that the Host: field of the HTTP request match a protected hosts entry in order to match the allowed method exception. Also configure
.
No default.
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
349
waf allow-method-exceptions
Variable
request-file <url_str> request-type
{plain | regular}
Description Default
Depending on your selection in
l
Type the literal URL, such as /index.php, that is an exception to the generally allowed HTTP request methods.
The URL must begin with a slash ( / ).
l
Type a regular expression, such as ^/*.php, matching all and only the URLs which are exceptions to the generally allowed HTTP request methods. The pattern is not required to begin with a slash ( / ). However, it must at least match
URLs that begin with a slash, such as /index.cfm.
For example, if multiple URLs on a host have identical HTTP request method requirements, you would type a regular expression matching all of and only those URLs.
Do not include the name of the web host, such as www.example.com
, which is configured separately in
. The maximum length is
255 characters.
Note: Regular expressions beginning with an exclamation point ( ! ) are not supported. For information on language and regular expression matching, see the
FortiWeb Administration Guide
.
No default.
Indicate whether
is a literal URL (plain) or a regular expression (regular).
plain
Example
This example adds an exception to the list of allowed methods (post) that can be used in HTTP requests. In addition to the allowed methods already specified in protection profiles that use this exception, web hosts included in the protected hosts group named example_com_hosts (such as example.com, www.example.com, and 192.168.1.10) are allowed to receive POST requests to the Perl file that handles the guestbook.
config waf allow-method-exceptions edit "auto-learn-profile2" config allow-method-exception-list edit 1 set allow-request post set host "example_com_hosts" set host-status enable set request-file "/perl/guesbook.pl" end end next set request-type plain next config
350 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf allow-method-policy
Related topics
l
config server-policy allow-hosts
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile offline-protection
waf allow-method-policy
Use this command to allow only specific HTTP request methods.
To define specific exceptions to this policy, use
config waf allow-method-exceptions
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf allow-method-policy edit
allow-method {connect delete get head options others post put trace}
set set set set end next
severity {High | Medium | Low} triggered-action <trigger-policy_name>
[allow-method-exception <method-exception_name>]
Variable
<allowed-methods_name>
Description
Type the name of a new or existing allowed methods policy. This field cannot be modified if you are editing an existing allowed method exception. To modify the name, delete the entry, then recreate it using the new name. The maximum length is 35 characters.
To display a list of the existing policies, type: edit ?
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
351
waf allow-method-policy
Variable
allow-method {connect delete get head options others post put trace} severity {High |
Medium | Low} triggered-action
<trigger-policy_name>
Description
Select one or more HTTP request methods that you want to allow for this specific policy.
Methods that you do not select will be denied, unless specifically allowed for a host and/or URL in
analyzerpolicy <fortianalyzer-policy_name> .
The others option includes methods not specifically named in the other options. It often may be required by
WebDAV ( RFC 2518 ) applications such as Microsoft
Exchange Server 2003 and Subversion , which may require HTTP methods not commonly used by web browsers, such as PROPFIND and BCOPY.
Note: If a WAF Auto Learning Profile is used in the server policy where the HTTP request method is applied
(via the
Web Protection Profile), you must enable the
HTTP request methods that will be used by sessions that you want the FortiWeb appliance to learn about. If a method is disabled, the FortiWeb appliance will reset the connection, and therefore cannot learn about the session.
Select the severity level to use in logs and reports generated when a violation of the policy occurs.
Type the name of the trigger policy you want FortiWeb to apply when a violation of the HTTP request method policy occurs. Trigger policies determine who will be notified by email when the policy violation occurs, and whether the log message associated with the violation are recorded. The maximum length is 35 characters.
To display a list of the existing policies, type: set triggered-action ?
[allow-method-exception
<method-exception_name>]
Type the name of an existing HTTP request method exception, if any, to apply to it. The maximum length is 35 characters.
To display a list of the existing policy, type: set allow-method-exception ?
Default
No default.
High
No default.
No default.
config
Example
This example allows the HTTP GET and POST methods and rejects others, except according to the exceptions defined in MethodExceptions1.
config waf allow-method-policy edit "allowpolicy1" set allow-method get post
352 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config set triggered-action "TriggerActionPolicy1" set allow-method-exception "MethodExceptions1" end next
Related topics
l
config waf allow-method-exceptions
waf application-layer-dos-prevention
waf application-layer-dos-prevention
Use this command to create an HTTP-layer DoS protection policy. Once you create the policy, reference it in an inline protection profile that is used by a server policy.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf application-layer-dos-prevention edit
set
enable-http-session-based-prevention {enable | disable}
set set set set end set next
Variable
<app-dos-policy_name> enable-http-sessionbased-prevention
{enable | disable}
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Enable to use DoS protection based on session cookies. Also configure
http-connection-flood-check-rule <rule_name>
and
http-request-flood-prevention-rule <rule_name> .
Default
No default.
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
353
waf application-layer-dos-prevention
Variable
http-connection-floodcheck-rule <rule_name> http-request-floodprevention-rule <rule_ name>
Description
Type the name of an existing rule that sets the maximum number of HTTP requests per second to a specific URL.
The maximum length is 35 characters.
To display a list of the existing rules, type: set http-connection-flood-check-rule ?
This setting applies only if enable-http-sessionbased-prevention is enabled.
Type the name of an existing rule that limits TCP connections from the same client. The maximum length is 35 characters.
To display a list of the existing rules, type: set http-request-flood-prevention-rule ?
Default
No default.
No default.
enable-layer4-dosprevention {enable | disable}
This setting applies only if enable-http-sessionbased-prevention is enabled.
Enable to use D oS protection that is not based on session cookies. Also configure
layer4-access-limit-rule <rule_name>
and
layer4-connection-flood-check-rule <rule_name>
.
Type the name of a rule that limits the number of HTTP requests per second from any source IP address. The maximum length is 35 characters.
layer4-access-limit-rule
<rule_name>
To display a list of the existing rules, type: set layer4-access-limit-rule ?
This setting applies only if enable-layer4-dosprevention is enabled.
layer4-connection-floodcheck-rule <rule_name>
Type the name of an existing rule that limits the number of TCP connections from the same source IP address.
The maximum length is 35 characters.
To display a list of the existing rules, type: set layer4-connection-flood-check-rule ?
disable
No default.
No default.
This setting applies only if enable-layer4-dosprevention is enabled.
config
354 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf base-signature-disable
Example
This example shows the settings for a DoS protection policy that protects a web portal using existing DoS prevention rules.
config waf application-layer-dos-prevention edit "Web Portal DoS Policy" set enable-http-session-based-prevention enable set http-connection-flood-check-rule "Web Portal TCP Connect Limit" set http-request-flood-prevention-rule "Web Portal HTTP Request Limit" set enable-layer4-dos-prevention enable set layer4-access-limit-rule "Web Portal HTTP Request Limit" set layer4-connection-flood-check-rule "Web Portal Network Connect Limit" end next
Related topics
l
config waf http-connection-flood-check-rule
l
config waf http-request-flood-prevention-rule
l
config waf layer4-access-limit-rule
l
config waf layer4-connection-flood-check-rule
l
l
waf base-signature-disable
Use this command to disable individual or whole categories of data leak and attack signatures in every signature group that currently exists.
For example, if you disable a certain signature ID with this command, the signature ID in every signature group you have defined will be disabled.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf base-signature-disable edit
end next
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
355
waf brute-force-login
Variable
<signature-ID_name>
Description
Type the name of an individual signature or signature category ID. The maximum length is 35 characters.
For example, to disable the first cross-site scripting attack signature everywhere it is currently selected, you would type: edit 010000001
Default
No default.
config
Example
This example globally disables the XSS signature whose ID is 010000001.
config waf base-signature-disable edit "010000001" end next
Related topics
l
waf brute-force-login
Use this command to configure brute force login attack sensors.
Brute force attacks attempt to penetrate systems by the sheer number of clients, attempts, or computational power, rather than by intelligent insight. For example, in brute force attacks on authentication, multiple web clients may rapidly try one user name and password combination after another in an attempt to eventually guess a correct login and gain access to the system. In this way, behavior differs from web crawlers, which typically do not focus on a single URL.
Brute force login attack sensors track the rate at which each source IP address makes requests for specific URLs.
If the source IP address exceeds the threshold, the FortiWeb appliance penalizes the source IP address by blocking additional requests for the time period that you indicate in the sensor.
To apply a brute force login attack sensor, select it within an inline protection profile. For details, see
config waf web-protection-profile inline-protection
You can use SNMP traps to notify you when a brute force login attack is detected. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf brute-force-login edit
set
analyzer-policy <fortianalyzer-policy_name>
356 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf brute-force-login set
analyzer-policy <fortianalyzer-policy_name>
config login-page-list edit
set
access-limit-standalone-ip <rate_int>
set set
access-limit-share-ip <rate_int> block-period <seconds_int>
end end next set set set next
host <allowed-hosts_name> host-status {enable | disable}
Variable Description
<brute-force-login_name>
Type the name of a new or existing brute force login attack sensor. The maximum length is 35 characters.
To display a list of the existing sensor, type: edit ?
severity {High |
Medium | Low}
Select the severity level to use in logs and reports generated when a violation of the rule occurs.
trigger <trigger-policy_ name>
Type the name of the trigger to apply when this policy is violated (see
maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
access-limit-standaloneip <rate_int>
Type the rate threshold for source IP addresses that are single clients. Request rates exceeding the threshold will cause the FortiWeb appliance to block additional requests for the length of the time in
The valid range is from 0 to 9,999,999,999,999,999,999.
To disable the rate limit, type 0.
Default
No default.
High
No default.
1
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
357
waf brute-force-login
Variable
access-limit-share-ip
<rate_int> block-period <seconds_ int>
<entry_index> host <allowed-hosts_ name>
Description
Type the rate threshold for source IP addresses that are shared by multiple clients behind a network address translation (NAT) device such as a firewall or router.
Request rates exceeding the threshold will cause the
FortiWeb appliance to block additional requests for the length of the time in the
.
The valid range is from 0 to 9,999,999,999,999,999,999.
To disable the rate limit, type 0.
Note: Blocking a shared source IP address could block innocent clients that share the same source IP address with an offending client. In addition, the rate is a total rate for all clients that use the same source IP address. For these reasons, you should usually enter a greater value for this field than for
access-limit-share-ip <rate_int> .
Default
1
Type the length of time for which the FortiWeb appliance will block additional requests after a source IP address exceeds a rate threshold.
The block period is shared by all clients whose traffic originates from the source IP address. The valid range is from 1 to 10,000 seconds.
1
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
Type the name of a protected host that the Host: field of an HTTP request must be in order to match the sensor.
The maximum length is 255 characters.
No default.
This setting is applied only if host-status is enable.
host-status {enable | disable}
Enable to require that the Host: field of the HTTP request match a protected hosts entry in order to be included in the brute force login attack sensor’s rate calculations. Also configure
.
ip-port-enable {enable | disable}
Enable to apply the limit of login attempts specified by access-limit-standalone-ip or accesslimit-share-ip per TCP/IP session.
When the value is disable, the limit is applied per source IP.
Tip: If you need to cover both possibilities, create two members.
disable disable config
358 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
request-file <url_str>
Description
Type the literal URL, such as /login.php, that the
HTTP request must match to be included in the brute force login attack sensor’s rate calculations.
The URL must begin with a slash ( / ). Do not include the name of the web host, such as www.example.com, which is configured separately in
. The maximum length is 255 characters.
waf cookie-security
Default
No default.
Example
This example limits IP addresses of individual HTTP clients to 3 requests per second, and NAT IP addresses to
20 requests per second, when they request the file login.php on the host www.example.com on TCP port 8080.
config waf brute-force-login edit "brute_force_attack_sensor" set access-limit-share-ip 20 set access-limit-standalone-ip 3 set block-period 120 config login-page-list edit 1 end end next set host "www.example.com:8080" set host-status enable set request-file "/login.php" next
Related topics
l
config waf web-protection-profile inline-protection
l
l
config waf application-layer-dos-prevention
l
waf cookie-security
Use this command to configure FortiWeb features that prevent cookie-based attacks.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config waf cookie-security edit
set
security-mode {no |encrypted | signed}
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
359
waf cookie-security set
action {alert |alert_deny | remove_cookie}
set
block-period <block-period_int>
set
severity {High | Medium | Low}
set
set
cookie-replay-protection-type {no | IP}
set
set
secure-cookie {enable | disable}
set
set
allow-suspicious-cookies(Never | Always | Custom}
set
config cookie-security-exception-list edit
set
set
cookie-domain <cookie-domain_str>
set
end end next
Variable
<cookie-security_name>
Description
Set cookie security policy name.
security-mode {no
|encrypted | signed}
Set security mode for the cookie security policy l l l no
— FortiWeb does not apply cookie tampering protection or encrypt cookie values.
encrypted
— Encrypts cookie values the back-end web server sends to clients. Clients see encrypted cookies only. FortiWeb decrypts cookies submitted by clients before it sends them to the back-end server.
signed
— Prevents tampering (cookie poisoning) by tracking the cookie value. This option requires you to enable Session
Management in the protection policy (see the
waf webprotection-profile inline-protection
) and the client to support cookies.
When FortiWeb receives the first HTTP or HTTPS request from a client, it uses a cookie to track the session. When you select this option, the session-tracking cookie includes a hash value that FortiWeb uses to detect tampering with the cookie from the back-end server response. If FortiWeb determines the cookie from the client has changed, it takes the specified action (action
{alert |alert_deny | remove_cookie}).
no
Default
No default.
config
360 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf cookie-security
Variable Description
action {alert |alert_ deny | remove_cookie}
Select one of the following actions that the FortiWeb appliance will perform when it detects cookie poisoning: l l l l l alert
— Accept the request and generate an alert email and/or log message.
alert_deny
— Block the request (or reset the connection) and generate an alert email and/or log message.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
block-period
— Block subsequent requests from the client for a number of seconds. Also configure
.
Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you
must also define an X-header that indicates the original client’s IP (see
). Failure to do so may cause FortiWeb to block
all
connections when it detects a violation of this type.
remove_cookie
— Accept the request, but remove the poisoned cookie from the datagram before it reaches the web server, and generate an alert and/or log message.
Caution: This setting will be ignored if
is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See
and
Note: If you select an auto-learning profile with this rule, you should select alert. If the action is alert_deny, for example, the FortiWeb appliance will block the request or reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For more information on auto-learning requirements, see
config waf web-protection-profile autolearning-profile
.
block-period <blockperiod_int>
Type the number of seconds to block a connection when cookie-poison-action is set to block-period. The valid range is from 1 to 3,600 seconds.
severity {High |Medium |
Low}
Select the severity level to use in logs and reports generated when cookie poisoning is detected.
Default
alert
60
High
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
361
waf cookie-security
Variable Description
trigger <trigger-policy_ name>
Type the name of the trigger to apply when cookie poisoning is detected (see
). The maximum length is 35 characters. To display the list of existing trigger policies, type: set trigger ?
cookie-replayprotection-type {no |
IP} max-age <max-age_int>
Select whether FortiWeb uses the IP address of a request to determine the owner of the cookie.
Because the public IP of a client is not static in many environments, Fortinet recommends that you do not enable Cookie Replay.
Available only when security-mode is encrypted.
Set the cookie security attributes. Enter the maximum age, in minutes, permitted for cookies that do not have an
“Expires” or “Max-Age” attribute. To configure no expiry age for cookies, enter 0.
Default
No default.
no
0 secure-cookie {enable | disable} http-only {enable | disable}
Set the cookie security attributes. Enable to add the secure flag to cookies, which forces browsers to return the cookie only when the request is for an HTTPS page.
Set the cookie security attributes. Enable to add the HttpOnly flag to cookies, which prevents client-side scripts from accessing the cookie.
disable enable config
362 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf cookie-security
Variable Description
allow-suspicious-cookies
(Never |Always | Custom}
Select whether FortiWeb allows requests that contain cookies that it does not recognize or that are missing cookies.
l l
When security-mode is encrypted, suspicious cookies are cookies for which FortiWeb does not have a corresponding encrypted cookie value.
When cookie-replay-protection-type is IP, the suspicious cookie is a missing cookie that tracks the client IP address.
In many cases, when you first introduce the cookie security features, cookies that client browsers have cached earlier generate false positives. To avoid this problem, either select Never, or select Custom and enter an appropriate date on which to start taking the specified action against suspicious cookies.
l l l
Never
— FortiWeb does not take the action specified by action against suspicious cookies.
Always
— FortiWeb always takes the specified action against suspicious cookies.
Custom
— FortiWeb takes the specified action against suspicious cookies starting on the date specified by
. This feature is not available if security-mode is
signed
.
allow-time <time_str>
<entry_index>
Set the date on which FortiWeb starts to take the specified action against suspicious cookies if allow-suspiciouscookies is Custom.
Type the index number of a new or existing entry in the exception list of the cookie security policy.
cookie-name <cookiename_str> cookie-domain <cookiedomain_str> cookie-path <cookiepath_str>
Set the exception cookie entry name.
Default
Custom
No default.
No default.
No default.
Enter the partial or complete domain name or IP address as it appears in the cookie. For example: www.example.com,
.google.com
or 10.0.2.50.
Enter the path as it appears in the cookie, such as / or
/blog/folder
.
No default.
No default.
Related topics
l
config waf web-protection-profile inline-protection
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
363
waf csrf-protection config
waf csrf-protection
Use this command to protect against cross-site request forgery (CSRF). CSRF is an attack that exploits the trust that a site has in a user's browser to transmit unauthorized commands.
The CRSF protection feature is not supported when the operation mode is offline protection or transparent inspection.
To protect back-end servers from CSRF attacks, you create two lists of items: a list of web pages to protect against CSRF attacks, and a corresponding list of the URLs found in the requests that the pages generate. For more information on configuring CSRF protection, including troubleshooting and adding parameter filters, see the
FortiWeb Administration Guide
.
To apply a CSRF protection rule, you select it in an inline protection profile. For details, see
config waf webprotection-profile inline-protection
Before you configure a CSRF protection rule, if you want to apply it only to HTTP requests for a specific real or virtual host, you must first define the web host in a protected hosts group. For details, see
config serverpolicy allow-hosts
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf csrf-protection edit
set
action {alert | alert_deny | block-period}
set
set set
severity {High | Medium | Low} trigger <trigger-policy_name>
config csrf-page-list edit
host <host_name> request-url <url_str>
set set set set set set set set end next
config csrf-url-list edit
set set
host <host_name> request-url <url_str>
set set set set set set end next
364 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf csrf-protection end next
Variable
<csrf-rule_name> action {alert | alert_ deny | block-period} block-period <seconds_ int>
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
Note: Logging and alert email occur only if the corresponding settings are enabled and configured. See
and
alert
60 Enter the number of seconds that you want to block subsequent requests from the client after the FortiWeb appliance detects a CSRF attack.
The valid range is from 1 to 3,600 (1 hour).
This setting applies only if action is block-period.
severity {High |
Medium | Low}
Select the severity level to use in any logs and reports that
FortiWeb generates when a violation of this rule occurs.
trigger <trigger-policy_ name>
Enter the name of the trigger to apply when this rule is violated (see
maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
Low
No default.
<entry_index>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Enter the action that FortiWeb takes when it detects a missing or incorrect anti-CSRF parameter: l alert
— Accept the request and generate an alert email, a log message, or both.
l alert_deny
— Block the request (reset the connection) and generate an alert email, a log message, or both.
Default
No default.
Type the index number of the individual entry in the table.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
365
waf csrf-protection
Variable
host <host_name> request-url <url_str> host-status {enable | disable}
Description
Enter a protected host name (either a web host name or
IP address) that the Host: field of the HTTP request matches.
This setting applies only if host-status is enable.
Enter either a literal URL or regular expression, depending on the value of request-type.
Enter enable to apply this rule only to HTTP requests for specific web hosts. Also configure host.
Disable to match the rule based on the URL and any parameter filter only.
Default
No default.
No default.
disable request-type
{plain | regular}
Select whether request-url contains a literal URL
(plain), or a regular expression designed to match multiple
URLs (regular).
parameter-filter {enable
| disable}
Enter enable to specify a parameter name and value to match.
The parameter can be located in either the URL or the HTTP body of a request.
parameter-name
<parameter-name_str> parameter-value-type
{plain | regular} parameter-value
<parameter-value_str> plain disable
Enter the name of the parameter name to match.
No default.
Select whether parameter-value contains a literal value
(plain), or a regular expression designed to match multiple parameters (regular).
plain
Enter either a literal parameter or regular expression, depending on the value of parameter-value-type.
To match any parameter value, for parameter-valuetype
, enter regular, and for parameter-value, enter
*
(asterisk).
No default.
config
Example
The web page csrf_login.html contains the following HTML form:
<form name="do_some_action" id="form1" action="csrf_test2.php" method="GET">
<input type="text" name="username" value=""/>
<Input type="text" name="password" value=""/>
<input type="submit" value="do Action"/>
</form>
366 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf custom-access policy
This form generates the following request when the page is added to the list of pages protected by a
CSRF protection policy: http://target-site.com/csrf_ test2.php?username=test&password=123&tknfv=3DF5BDCCIG3DCXNTE3RUNCTKRS3E36AD
The CSRF protection feature adds the parameter tknfv with a value that matches the session ID.
To create this example, you add csrf_login.html to the list of pages and /csrf_check2.php to the list of URLs.
config waf csrf-protection edit "csrf_rule1" set action alert_deny config csrf-page-list edit 1 set request-url csrf_login.html
set request-type regular next end config csrf-url-list end end next edit 1 set request-url /csrf_check2.php
set request-type plain next
waf custom-access policy
Use this command to configure custom access policies.
Custom access policies group custom access rules.
To apply a custom access policy, select it within an inline protection profile or offline protection profile. For details, see
config waf web-protection-profile inline-protection
or
config waf webprotection-profile offline-protection
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf custom-access policy edit
config rule edit
set
rule-name "<custom-rule_name>"
end next end next
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
367
waf custom-access rule
Variable
<custom-policy_name>
Description
Type the name of a new or existing custom policy. The maximum length is 63 characters.
To display a list of the existing policies, type: edit ?
Default
No default.
<entry_index>
Type the index number of the individual entry in the table. The valid range is from 1 to 9,223,372,036,854,775,807.
rule-name "<custom-rule_ name>"
Type the name of the existing custom access rule to add to the policy. The maximum length is 63 characters.
No default.
No default.
config
Example
For an example, see
.
Related topics
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile offline-protection
l
waf custom-access rule
Use this command to configure custom access rules.
What if you want to allow a web crawler, but only if it is not too demanding, and comes from a source IP that is known to be legitimate for that crawler? What if you want to allow only a client that is a senior manager’s IP, and only if it hasn’t been infected by malware whose access rate is contributing to a DoS?
Advanced access control rules provide a degree of flexibility for these types of complex conditions. You can combine any or all of these criteria: l l l l l source IP user name rate limit
HTTP header such as X-Real-IP:
URL line in the HTTP header
In the rule, add all criteria that you require allowed traffic to match.
Before you can apply a custom access rule, you must first group it with any others that you want to apply in a custom access policy. For details, see
config waf custom-access policy
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
368 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf custom-access rule
Syntax
config waf custom-access rule edit
set
action {alert | alert_deny | block-period}
set set set set set
block-period <seconds_int> severity {High | Medium | Low} trigger <trigger-policy_name>
real-browser-enforcement {enable | disable} validation-timeout <timeout_int>
config access-limit-filter edit
set
end config http-header-filter edit
set
header-name-type {custom | predefined}
set
set set set set set set
cus-header-rev-match {enable | disable} header-value <value_str>
end config source-ip-filter edit
set
end config user-filter edit
set
set
end config url-filter edit
set set
end config http-transaction edit
set
http-transation-timeout <timeout_int>
end config response-code edit
set response-code-min set response-code-max
end config content-type edit
set content-type-set
{text/html text/plain text/xml application/xml application/soap+xml application/json}
end config packet-interval edit
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
369
waf custom-access rule config end set
packet-interval-timeout <timeout_int>
config signature-class edit
{010000000 | 020000000 | 030000000 | 040000000 | 050000000 |
060000000 | 090000000| 100000000 | 110000000 | 120000000}
end set
config custom-signature edit
set
custom-signature-enable {enable | disable}
set custom-signature-type
{custom-signature-group | custom-signature}
set custom-signature-name
end config occurrence edit
set occurrence-num set within
set
percentage-flag {enable | disable}
set percentage set traced-by
end end next
Variable Description
<custom-access_name>
Type the name of a new or existing custom access rule. The maximum length is 63 characters.
To display a list of the existing rule, type: edit ?
Default
No default.
370 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf custom-access rule
Variable
action {alert | alert_deny | blockperiod} block-period
<seconds_int> severity {High |
Medium | Low} trigger <triggerpolicy_name>
Description Default
Select the specific action to be taken when the request matches the signature.
l alert
— Accept the request and generate an alert email and/or log message.
Note: If type is data-leakage, does not cloak, except for removing sensitive headers. (Sensitive information in the body remains unaltered.) l alert_deny
— Block the request (or reset the connection) and generate an alert email and/or log message. This option is applicable only if type is signature-creation
.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb Administration Guide
or
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
alert
Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you must also define an X-header that indicates the original client’s
IP (see
).
Failure to do so may cause FortiWeb to block
all
connections when it detects a violation of this type.
Type the length of time for which the FortiWeb appliance will block additional requests after a source IP address violates this rule.
The block period is shared by all clients whose traffic originates from the source IP address. The valid range is from 1 to 3,600 seconds.
Select the severity level to use in logs and reports generated when a violation of the rule occurs.
Type the name of the trigger to apply when this policy is violated (see
). The maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
60
Low
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
371
waf custom-access rule
Variable Description
real-browserenforcement {enable | disable}
Enable to return a JavaScript to the client to test whether it is a web browser or automated tool when it violates the access rule.
If the client either fails the test or does not return results before the timeout specified by validation-timeout
, FortiWeb applies the specified action. If the client appears to be a web browser, FortiWeb allows the client to violate the rule.
Disable this option to apply the access rule regardless of whether the client is a web browser
(for example, Firefox) or an automated tool (for example, wget).
validation-timeout
<timeout_int>
<entry_index>
Specifies the maximum amount of time that FortiWeb waits for results from the web browser test.
Type the index number of the individual entry in the table. The valid range is from 1 to
9,999,999,999,999,999,999.
Default
disable
20
No default.
access-rate-limit
<rate_int>
Type the rate threshold for source IP addresses.
The valid range is from 1 to 65535. To disable the rate limit, type 0.
Note: Blocking a shared source IP address could block innocent clients that share the same source
IP address with an offending client.
1 header-name-type
{custom | predefined}
Select whether to define the HTTP header filter by selecting a predefined HTTP header name, or by typing the name of a custom HTTP header. Also configure
and, depending on which you indicate in this option, either: l
,
pre-header-type {plain | regular}
, and
pre-header-rev-match {enable | disable}
l
custom-header-name <key_str> , cus-header-type {plain | regular} , and
cus-header-rev-match {enable | disable}
predefined config
372 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf custom-access rule
Variable Description
predefined-header
{host | connection | authorization | x-pad
| cookie | referer | user-agent | X-
Forwarded-For |
Accept}
Select the name (key) of the HTTP header such as
Accept: that must be present in order for the request to be allowed.
This field appears only if header-name-type is predefined
.
pre-header-type
{plain | regular}
Indicate whether
is a literal header value (plain) or a regular expression that indicates multiple possible valid header values
(regular).
pre-header-rev-match
{enable | disable}
Indicate how to use
and
when determining whether or not this condition has been met.
l no
— If the regular expression does match the request object, the condition is met.
l yes
— If the regular expression does
not match the request object, the condition is met.
The effect is equivalent to preceding a regular expression with an exclamation point ( ! ).
If all conditions are met, the FortiWeb appliance will allow access.
custom-header-name
<key_str> cus-header-type
{plain | regular}
Type the name (key)
without the trailing colon
( : ), such as X-Real-IP, of the HTTP header that must be present in order for the request to be allowed.
This field appears only if header-name-type is custom
.
Indicate whether
is a literal header value (plain) or a regular expression that indicates multiple possible valid header values
(regular).
Default
host plain disable
No default.
plain
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
373
waf custom-access rule
Variable Description
cus-header-rev-match
{enable | disable}
Indicate how to use
and
when determining whether or not this condition has been met.
l no
— If the regular expression
does match the request object, the condition is met.
l yes
— If the regular expression does not match the request object, the condition is met.
The effect is equivalent to preceding a regular expression with an exclamation point ( ! ).
If all conditions are met, the FortiWeb appliance will allow access.
Default
disable header-value <value_ str>
Depending on your selection in
, either: l
Type the literal header value, such as 172.0.2.80, your specified HTTP header must contain in order to match the filter. Value matching is
case sensitive. (If you require a filter based upon more than one HTTP header, create multiple entries in the set, one for each HTTP header.).
l
Type a regular expression, such as 172\.0\.2\.*, matching all and only the header values which accepted HTTP header values must match.
For information on language and regular expression matching, see the
FortiWeb
Administration Guide
.
Tip: To prevent accidental matches, specify as much of the header’s value as possible. Do not use an ambiguous substring.
No default.
For example, entering the value 192.168.1.1
would
also match the IPs 192.168.10-19 and
192.168.100-199. This result is probably unintended. The better solution would be to configure either: l a regular expression such as ^192.168.1.1$ or l a source IP condition instead of an HTTP header condition config
374 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf custom-access rule
Variable Description
source-ip <ip_range>
Enter the IP address or IP address range that specifies the clients that FortiWeb allows.
For example: l
1.2.3.4
l
2001::1 l
1.2.3.4-1.2.3.40
l
2001::1-2001::100
Depending on your configuration of how FortiWeb will derive the client’s IP (see
that is indicated in an HTTP header rather than the IP header.
reverse-match {no | yes}
Indicate how to use user-name when determining whether or not this rule’s condition has been met.
l no
— If the regular expression does match the user name, the condition is met.
l yes
— If the regular expression does
not match the user name, the condition is met.
The effect is equivalent to preceding a regular expression with an exclamation point ( ! ).
user-name <user-name_ str>
Enter the user name to match.
request-file <url_ str>
Type a regular expression that defines either all matching or all non-matching URLs. Then, also configure reverse-match {yes | no}.
For example, for the URL access rule to match all
URLs that begin with /wordpress, you could enter ^/wordpress, then, in reverse-match
{yes | no}
, select no.
The pattern is not required to begin with a slash
( / ). The maximum length is 255 characters.
Note: Regular expressions beginning with an exclamation point ( ! ) are not supported. Instead, use reverse-match {yes | no}.
Default
No default.
no
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
375
waf custom-access rule
Variable
reverse-match {no | yes}
Description
Indicate how to use
when determining whether or not this rule’s condition has been met.
l no
— If the regular expression does match the request URL, the condition is met.
l yes
— If the regular expression does not match the request URL, the condition is met.
The effect is equivalent to preceding a regular expression with an exclamation point ( ! ).
http-transationtimeout <timeout_int>
Specifies a timeout value of 1 to 3600 seconds.
If the lifetime of a HTTP transaction exceeds this value, the transaction matches this condition.
<response-code_int>
Specifies the start and end code in a range of
HTTP response codes.
To specify a single code, enter the same value for the start and end codes (for example, 404-404 or 500-503).
If its HTTP response code is within this range, the
HTTP transaction matches this condition.
{text/html text/plain text/xml application/xml application/soap+xml application/json}
Specifies a file content type to match.
Use with occurrence to detect and control web scraping (content scraping) activity.
Default
no
5
No default.
application/soap+xml application/xml(or) text/xml text/html text/plain application/json packet-intervaltimeout <timeout_int>
Specifies the maximum number of seconds allowed between packets arriving from either the client or server (request or response packets), in seconds. Enter a value from 1 to 60.
If the interval exceeds this value, the HTTP transaction matches this condition.
{010000000 |
020000000 |
030000000 |
040000000 |
050000000 |
060000000 |
090000000| 100000000
| 110000000 |
120000000}
Specifies the ID of a signature class.
Ensure the signature is enabled in signature configuration before you use it in an advanced access control rule. See
1
No default.
config
376 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf custom-access rule
Variable
status {enable | disable} custom-signatureenable {enable | disable}
{custom-signaturegroup | customsignature}
<custom-signaturename_str>
<occurrence_int>
<within_int> percentage-flag
{enable | disable}
<percentage_int>
Description
Specifies whether the HTTP transaction matches this condition if it matches the specified signature.
Default
disable
Specifies whether the current custom signature filter is enabled.
disable
Specifies whether
specifies a custom signature group or an individual signature.
Specifies the custom signature group or individual signature to match.
Ensure the signature is enabled in signature configuration before you use it in an advanced access control rule. See
Specifies the maximum number of times a transaction can match other filter types in the current rule during the time period specified by within
. Enter a value between 1 and 100,000.
If the number of matches exceeds this threshold, the associated HTTP source client IP address or client matches this condition.
1
Specifies the time period during which FortiWeb counts the number of times transactions match other filter types in the current rule. Enter a value between 1 and
600.
1 customsignaturegroup
No default.
Specifies whether the current filter matches when the rate of matches with other filter types in the current rule exceeds the
value.
disable
The maximum rate of matches with other filter types in the current rule, expressed as percent of hits.
If
percentage-flag {enable | disable}
is enabled and the number of matches exceeds this threshold, the associated HTTP source client IP address or client matches this condition.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
377
waf custom-access rule
Variable
{Source-IP | User}
Description
Specifies whether FortiWeb determines the rate at which a transaction matches other filter types in the current rule by counting matches by source client IP address or by client.
To specify user, ensure that the value of http-session-management is enabled
(see
config waf web-protectionprofile inline-protection
Default
source-ip config
Example
This example allows access to URLs beginning with “/admin”, but only if they originate from 172.16.1.5, and only if the client does not exceed 5 requests per second.
Clients that violate this rule will be blocked for 60 seconds (the default duration). The violation will be logged in the attack log using severity_level=High, and all servers configured in notification-servers1 will be used to notify the network administrator.
config waf custom-access rule edit "combo-IP-rate-URL-rule1" set action block-period set severity High set trigger "notification-servers1" config access-limit-filter edit 1 set access-rate-limit 5 end next config source-ip-filter edit 1 set source-ip 172.16.1.5
next end config url-filter edit 1 set request-file "/admin*" end next end next config waf custom-access policy edit "combo-IP-rate-URL-policy1" config rule edit 1 set rule-name "combo-access-rate-rule1" next end end next
378 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf custom-protection-group
Related topics
l
config waf custom-access policy
l
l
waf custom-protection-group
Use this command to configure custom protection groups, creating sets of custom protection rules that can be used with attack signatures (“server protection rule”).
Before you can configure this command, you must first define your custom data leak and attack signatures. For details, see
config waf custom-protection-rule
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf custom-protection-group edit
<custom-protection group_name>
config type-list edit
<entry_index> custom-protection-rule <rule_name>
end end next set next
Variable
<custom-protection group_name>
<entry_index> custom-protection-rule
<rule_name>
Description
Type the name of a new or existing group. The maximum length is 35 characters.
To display the list of existing group, type: edit ?
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
Type the name of the custom protection rule to associate with the custom protection group. The maximum length is
35 characters.
To display a list of the existing rules, type: set custom-protection-rule ?
Default
No default.
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
379
waf custom-protection-rule config
Example
This example groups custom protection rule 1 and custom protection rule 3 together within
Custom Protection group 1.
config waf custom-protection-group edit "Custom Protection group 1" config type-list edit 1 set custom-protection-rule "custom protection rule 3" next edit 3 end set custom-protection-rule "custom protection rule 1" next end next
Related topics
l
l
config waf custom-protection-rule
waf custom-protection-rule
Use this command to configure custom data leak and attack signatures.
Before you enter custom signatures via the CLI, first enable
cli-signature {enable | disable}
in
.
To use your custom signatures, you must first group them so that they can be included in a rule. For details, see
config waf custom-protection-group
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf custom-protection-rule edit
set
set
set set set
block-period <seconds_int> severity {High | Medium | Low} trigger <trigger-policy_name>
config meet-condition edit
set
operator {RE | GT | LT | NE | EQ}
380 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf custom-protection-rule set set set set set end next end next
request-target {REQUEST_FILENAME REQUEST_URI REQUEST_HEADERS_
NAMES REQUEST_HEADERS REQUEST_COOKIES_NAMES REQUEST_COOKIES ARGS_
NAMES ARGS_VALUE REQUEST_RAW_URI REQUEST_BODY CONTENT_LENGTH
HEADER_LENGTH BODY_LENGTH RESPONSE_CODE} threshold <threshold_int> case-sensitive {enable | disable}
Default
No default.
Variable Description
<custom-protection rule_ name>
Type the name of the new or existing custom signature.
The maximum length is 35 characters.
To display a list of the existing rules, type: edit ?
type {request | response}
Specify the type of regular expression: l request
— The expression is an attack signature.
l data-leakage
— The expression is a server information disclosure signature.
request
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
381
waf custom-protection-rule config
382
Variable
action {alert | alert_ deny | alert_erase | redirect | blockperiod | send_http_ response | only_erase}
Description Default
Select the specific action to be taken when the request matches the this signature.
l alert
— Accept the request and generate an alert email and/or log message.
Note: If type is data-leakage, does not cloak, except for removing sensitive headers. (Sensitive information in the body remains unaltered.) l alert_deny
— Block the request (or reset the connection) and generate an alert email and/or log message. This option is applicable only if type is signature-creation.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
l alert_erase
— Hide replies with sensitive information
(sometimes called “cloaking”). Block the reply (or reset the connection) or remove the sensitive information, and generate an alert email and/or log message. This option is applicable only if type is data-leakage.
If the sensitive information is a status code, you can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb Administration
Guide
or
Note: This option is not fully supported in offline protection mode. Effects will be identical to alert; sensitive information will not be blocked or erased.
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you
must also define an X-header that indicates the original client’s IP (see
). Failure to do so may cause FortiWeb to block all connections when it detects a violation of this type.
l redirect
— Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message. Also configure
and
.
l send_http_response
— Block and reply to the client with an HTTP error message, and generate an alert email, a log message, or both.
l only_erase
— Hide replies with sensitive information
(sometimes called “cloaking”). Block the reply (or reset the connection) or remove the sensitive information without generating an alert email and/or log message. This option is applicable only if type is response; and this option is not supported in offline protection mode.
alert
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
Fortinet Technologies Inc.
config waf custom-protection-rule
Variable Description
Caution: This setting will be ignored if
is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See
and
.
Note: If an auto-learning profile will be selected in the policy with offline protection profiles that use this rule, you should select alert. If the action is alert_deny, the FortiWeb appliance will reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For more information on auto-learning requirements, see
config waf web-protection-profile autolearningprofile
.
block-period <seconds_ int>
If action is block-period, number of seconds that you want to block subsequent requests from the client after the FortiWeb appliance detects that the client has violated the rule. For information on viewing the list of currently blocked clients, see the
FortiWeb
Administration Guide
.
The valid range is from 1 to 3,600 (1 hour).
severity {High |
Medium | Low}
When rule violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level the FortiWeb appliance will use when it logs a violation of the rule.
trigger <trigger-policy_ name>
Select which trigger policy, if any, that the FortiWeb appliance will use when it logs and/or sends an alert email about a violation of the rule (see
). The maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
<entry_index>
Default
1
Medium
No default.
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
383
waf custom-protection-rule
Variable Description
operator {RE | GT | LT |
NE | EQ} l
RE
— The signature matches when the value of a selected target in the request or response matches the value of expression
.
l
GT
— The signature matches when specified target has a value greater than the value of threshold.
l
LT
— The signature matches when specified target has a value less than the value of threshold.
l
NE
— The signature matches when specified target has a different value than threshold.
l
EQ
— The signature matches when specified target has the same value as threshold.
Default
RE config request-target {REQUEST_
FILENAME REQUEST_URI
REQUEST_HEADERS_NAMES
REQUEST_HEADERS REQUEST_
COOKIES_NAMES REQUEST_
COOKIES ARGS_NAMES ARGS_
VALUE REQUEST_RAW_URI
REQUEST_BODY CONTENT_
LENGTH HEADER_LENGTH
BODY_LENGTH COOKIE_
NUMBER ARGS_NUMBER}
Type the name of one or more locations in the HTTP request to scan for a signature match.
For example, ARGS_NAMES for the names of parameters or REQUEST_COOKIES for strings in the HTTP Cookie: header.
No default.
response-target
{RESPONSE_BODY RESPONSE_
HEADER CONTENT_LENGTH
HEADER_LENGTH BODY_
LENGTH RESPONSE_CODE}
Type the name of one or more locations in the HTTP response to scan for a signature match.
No default.
threshold <threshold_int> Type the value that FortiWeb compares to the target value to determine if a request or response matches.
case-sensitive {enable | disable}
Enable to differentiate upper case and lower case letters when evaluating the web server’s response for data leaks according to
For example, when enabled, an HTTP reply containing the phrase Credit card would
not match an expression that looks for the phrase credit card
(difference highlighted in bold).
No default.
disable
384 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
expression <regex_ pattern> waf custom-protection-rule
Description
When operator is RE, type a regular expression that matches either an attack from a client or a data leak from the server.
If action is Alert & Erase, enclose the portion of the regular expression to erase in brackets.
For example, the following command erases the expression "webattack" from the response packet: config waf custom-protection-rule edit "test" set type response set action alert_erase config meet-condition edit 1 set response-target RESPONSE_
BODY end end next set expression "(webattack)" next
To prevent false positives, it should not match anything else. The maximum length is 2,071 characters.
Default
No default.
Example
This example configures a signature to detect and block an LFI attack that uses directory traversal through an unsanitized controller parameter in older versions of Joomla. Each time it detects an attack, the trigger policy named notification-servers1 sends an alert email and attack log messages whose severity level is
High
.
config waf custom-protection-rule edit "Joomla_controller_LFI" set type request set action alert_deny set severity High set trigger notification-servers1 config meet-condition edit 1 set request-target REQUEST_RAW_URI end end next set expression "^/index\.php\?option=com_ckforms\&controller=(\.\.\/)+?" next
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
385
waf exclude-url config
Related topics
l
config waf custom-protection-group
l
waf exclude-url
Use this command to configure URLs that are exempt from a file compression or file decompression rule.
To apply an exclusion, include it in a compression or decompression rule. See
or
config waf file-uncompress-rule
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf exclude-url edit
config exclude-rules edit
set set
host-status {enable | disable} request-file <url_str>
end end next set next
Variable
<rule_name>
<entry_index> host <protected-host_ name>
Description
Type the name of a new or existing exception. The maximum length is 35 characters.
To display a list of the existing exceptions, type: edit ?
Default
No default.
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
Type the name of a protected host that the Host: field of an HTTP request must be in order to match the exception. The maximum length is 255 characters.
This setting applies only if host-status is enable.
No default.
386 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf file-compress-rule
Variable
host-status {enable | disable} request-file <url_str>
Description
Enable to apply this exception only to HTTP requests for specific web hosts. Also configure
.
Disable to match the exception based upon the other criteria, such as the URL, but regardless of the Host: field.
Type the literal URL, such as /archives, to which the exception applies. The URL must begin with a slash ( / ). Do not include the name of the host, such as www.example.com
, which is configured separately using host
. The maximum length is 255 characters.
Default
disable
No default.
Example
This example configures two exclusion rules, one for compression and the other for decompression. Either rule can be referenced by name in a file compression or file decompression rule.
config waf exclude-url edit "Compression Exclusion" config exclude-rules edit 1 set host "192.168.1.2" set host-status enable set request-file "/archives" end next next edit "Decompression Exclusion" config exclude-rules edit 1 set host "www.example.com" set host-status enable end end next set request-file "/products.cfm" next
Related topics
l
l
config waf file-uncompress-rule
waf file-compress-rule
Use this command to compress specific file types in HTTP replies.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
387
waf file-compress-rule config
Compression can reduce bandwidth, which can reduce delivery time to end users. Modern browsers automatically decompress files before they display web pages.
You can configure most web servers to compress files when they respond to a request. However, if you do not want to configure each of your web servers separately, or if you want to offload compression for performance reasons, you can configure FortiWeb to do the compression.
By default, the maximum pre-compressed file size is 64 KB. FortiWeb transmits files larger than the maximum without compression. You can use the config system advanced command’s max-cache-size setting to adjust the maximum files size (see
).
To exclude specific URLs from compression, see
To apply a compression rule, select it in an inline protection profile. See
config waf web-protectionprofile inline-protection
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf file-compress-rule edit
config content-types edit
set
content-type <content-type_name>
end end next
[set next
exclude-url <exclusion-rule_name>
]
Variable
<rule_name>
<entry_index>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
Default
No default.
No default.
388 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf file-uncompress-rule
Variable
content-type <contenttype_name> exclude-url <exclusionrule_name>
Description
Type one of the following content types to compress it: l text/plain l text/html l application/xml(or)text/xml l application/soap+xml l application/x-javascript l text/css l application/javascript l text/javascript
To compress multiple file types, add each file type in a separate table entry with its own
. See
Type the name of an exclusion to use with the rule, if any. See
characters.
Default
No default.
No default.
Example
This example configures a file compression rule that compresses CSS and HTML files, unless they match one of the URLs in the exception named “Compression Exclusion 1”.
config waf file-compress-rule edit "Web Portal Compression Rule" config content-types edit 1 set content-type text/css next edit 2 set content-type text/html next end set exclude-url "Compression Exclusion 1" end next
Related topics
l
config waf file-uncompress-rule
l
waf file-uncompress-rule
Use this command to decompress a file that was already compressed by a protected web server.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
389
waf file-uncompress-rule
Since the FortiWeb appliance cannot scan compressed files in order to perform features such as data leak prevention, you can configure the FortiWeb appliance to decompress files based on the file type.
By default, the maximum file size that FortiWeb can decompress is 64 KB.
FortiWeb does not scan files larger than the maximum.
You can use the config system advanced command’s max-cachesize setting to adjust the maximum files size (see
config
All decompressed files are recompressed after being scanned. As such, unlike
, the effects of this command will not be
visible to end-users.
To exclude specific URLs, see
.
To apply a decompression rule, select it in an inline or offline protection profile. See
config waf webprotection-profile inline-protection
or
config waf web-protection-profile offline-protection
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf file-uncompress-rule edit
config content-types edit
set
content-type <content-type_name>
end next
[set
exclude-url <exclusion-rule_name>
] end next
Variable
<rule_name>
<entry_index>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
Default
No default.
No default.
390 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf file-upload-restriction-policy
Variable
content-type <contenttype_name> exclude-url <exclusionrule_name>
Description
Specify one of the following content types: l text/plain l text/html l application/xml(or)text/xml l application/soap+xml l application/x-javascript l text/css l application/javascript l text/javascript
To compress multiple file types, add each file type in a separate table entry with its own
. See
Type the name of an exclusion to use with the rule, if any. See
characters.
Default
No default.
No default.
Example
The following example creates a decompression rule with two content types and one exclusion rule.
config waf file-uncompress-rule edit "Online Store Uncompress Rule" config content-types edit 1 set content-type application/soap+xml next edit 2 set content-type application/xml(or)text/xml end next end set exclude-url "Uncompress Exclusion" next
Related topics
l
l
waf file-upload-restriction-policy
Use this command to set the file upload restriction policies that the FortiWeb appliance uses to limit the types of files that can be uploaded to your web servers.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
391
waf file-upload-restriction-policy config
The policies are composed of individual rules set using the
config server-policy customapplication application-policy
command. Each rule identifies the host and/or URL to which the restriction applies and the types of files allowed. To apply a file upload restriction policy, select it within an inline or offline protection profile.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf file-upload-restriction-policy edit
<file-upload-restriction-policy_name>
set
action {alert | alert_deny | block-period}
set set set set set set
severity {High | Medium | Low} trigger <trigger-policy_name>
trojan-detection {enable |disable} av-scan {enable |disable} fortisandbox-check {enable |disable}
config rule edit
<entry_index> file-upload-restriction-rule <rule_name>
end end next set next
Variable Description
<file-uploadrestriction-policy_name>
Type the name of an existing or new file upload restriction policy. The maximum length is 35 characters.
To display the list of existing policies, type: edit ?
Default
No default.
392 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf file-upload-restriction-policy
Variable
action {alert | alert_ deny | block-period} severity {High |
Medium | Low}
Description
Type the action you want FortiWeb to perform when the policy is violated: l alert
— Accept the request and generate an alert and/or log message.
l alert_deny
— Block the request (or reset the connection) and generate an alert email and/or log message.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
Default
Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you
must also define an X-header that indicates the original client’s IP (see
). Failure to do so may cause FortiWeb to
block
all connections when it detects a violation of this type.
Caution: This setting will be ignored if
is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See
and
Note: If an auto-learning profile will be selected in the policy with offline protection profiles that use this rule, you should select alert. If the action is alert_ deny
, the FortiWeb appliance will reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For more information on auto-learning requirements, see
config waf web-protection-profile autolearningprofile
alert
Select the severity level to use in logs and reports generated when a violation of the rule occurs.
Low trigger <trigger-policy_ name>
Type the name of the trigger to apply when this policy is violated (see
maximum length is 35 characters.
To display the list of existing triggers, type: set trigger ?
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
393
waf file-upload-restriction-policy
Variable
trojan-detection
{enable |disable} av-scan
{enable |disable}
Description
Enter enable to scan for Trojans.
Attackers may attempt to upload Trojan horse code (written in scripting languages such as PHP and ASP) to the back-end web servers. The Trojan then infects clients who access an infected web page.
Default
disable
Enter enable to scan for viruses, malware, and greyware.
disable fortisandbox-check
{enable |disable} block-period <seconds_ int>
<entry_index>
Specify enable to send matching files to FortiSandbox for evaluation.
Also specify the FortiSandbox settings for your FortiWeb. See
disable
FortiSandbox evaluates the file and returns the results to
FortiWeb.
If av-scan is enable and FortiWeb detects a virus, it does not send the file to FortiSandbox.
If action is block-period, type the number of seconds that violating requests will be blocked. The valid range is from
1 to 3,600 seconds.
1
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
file-upload-restrictionrule <rule_name>
Type the name of an upload restriction rule to use with the policy, if any. See
config server-policy custom-application application-policy
The maximum length is 35 characters.
To display the list of existing rules, type: set file-upload-restriction-rule ?
No default.
config
Related topics
l
config server-policy custom-application application-policy
l
l
394 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf file-upload-restriction-rule
waf file-upload-restriction-rule
Use this command to define the specific host and request URL for which file upload restrictions apply, and define the specific file types that can be uploaded to that host or URL.
To apply the rule, select it in a file upload restriction policy. See
config server-policy customapplication application-policy
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf file-upload-restriction-rule edit
waf file-upload-restriction-rule
set set set set
[set
host-status {enable | disable} host <protected-host_name>
request-file <url_pattern> request-type {regular | plain} file-size-limit <size_int>
] config file-types edit
waf file-upload-restriction-rule
set
file-type-id <id_str> file-type_name <file-type-extension_str>
end end next set next
Variable
<file-uploadrestriction-rule_name> host-status {enable | disable} host <protected-host_ name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Enable to apply this exception only to HTTP requests for specific web hosts. Also configure
.
Disable to match the exception based upon the other criteria, such as the URL, but regardless of the Host: field.
Type the name of a protected host that the Host: field of an HTTP request must be in order to match the rule.
The maximum length is 255 characters.
This setting applies only if host-status is enable.
Default
No default.
disable
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
395
waf file-upload-restriction-rule
Variable
request-file <url_ pattern> request-type {regular | plain} file-size-limit <size_ int>
<entry_index>
Description Default
Depending on your selection in
waf file-upload-restrictionrule
, type either: l l the literal URL, such as /fileupload, that the
HTTP request must contain in order to match the signature exception. The URL must begin with a slash
( / ).
a regular expression, such as ^/*.php, matching all and only the URLs to which the signature exception should apply. The pattern is not required to begin with a slash ( / ). However, it must at least match URLs that begin with a slash, such as /index.cfm.
Do not include the name of the web host, such as www.example.com
, which is configured separately in
analyzer-policy <fortianalyzer-policy_name>
. The maximum length is 255 characters.
Note: Regular expressions beginning with an exclamation point ( ! ) are not supported. For information on language and regular expression matching, see the
FortiWeb Administration Guide
.
No default.
Select whether
analyzer-policy <fortianalyzer-policy_name>
will contain a literal URL (plain), or a regular expression designed to match multiple URLs (regular).
Optionally, enter a number to represent the maximum size in kilobytes for any individual file. This places a size limit on allowed file types. The valid range is from 0 to 30720 KB
(30 MB).
plain
0
Type the index number of the individual entry in the table.
Each entry in the table can define one file type. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
config
396 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf file-upload-restriction-rule
Variable
file-type-id <id_str> file-type_name <filetype-extension_str>
Description
Select the numeric type ID that corresponds to the file type. Recognized IDs are updated by FortiGuard services and may vary. For a list of available IDs, select all file types in the GUI, then use the CLI to view their corresponding IDs. Common IDs include: l
00001 (GIF) l
00002 (JPG) l
00003 (PDF) l
00004 (XML) l
00005 (MP3) l
00006 (MIDI) l
00007 (WAVE) l
00008 (FLV for a Macromedia Flash Video) l
00009 (RAR) l
00010 (ZIP) l
00011 (BMP) l
00012 (RM for RealMedia) l
00013 (MPEG for MPEG v) l
00014 (3GPP)
Type the extension, such as MP3, of the file type to allow to be uploaded. Recognized file types are updated by
FortiGuard services and may vary. For a list of available names, use the GUI.
Note: Microsoft Office Open XML file types such as
.docx, xlsx, .pptx, and .vsdx are a type of ZIP-compressed
XML. If you specify restrictions for them, those signatures will take priority. However, if you do not select a MSOOX restriction but
do have an XML or ZIP restriction, the XML and ZIP restrictions will still apply, and the files will still be restricted.
Default
No default.
No default.
Example
This example allows both MPEG and FLV files uploaded to the URL /file-uploads on the host www.example.com
.
config waf file-upload-restriction-rule edit file-upload-rule1 set host-status enable set host www.example.com
set request-file /file-uploads config file-types edit 1 set file-type-id 00013
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
397
waf geo-block-list set file-type-name MPEG next edit 2 set file-type-id 00008 set file-type-name FLV end next end next
Related topics
l
config server-policy custom-application application-policy
config
waf geo-block-list
Use this command to define large sets of client IP addresses to block based upon their associated geographical location.
Because network mappings may change as networks grow and shrink, if you use this feature, be sure to periodically update the geography-to-IP mapping database. To download the file, go to the
Fortinet Technical Support web site
.
Optionally, you can also specify a list of IP addresses or IP address ranges that are exempt from this blacklist (see
Alternatively, you can block clients individually (see
config server-policy custom-application application-policy
) or based upon their reputation (see
).
To apply the rule, select it in a protection profile. See
config waf web-protection-profile inlineprotection
or
config waf web-protection-profile offline-protection
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf geo-block-list edit
set
severity {High | Medium | Low}
set set
trigger <trigger-policy_name> exception-rule <geo-ip-except_name>
config country-list edit
<entry_index> country-name "<region_name>"
end end next set next
398 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf geo-block-list
Variable
<geography-to-ip_name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
severity {High |
Medium | Low}
Select the severity level to use in logs and reports generated when a violation of the rule occurs.
trigger <trigger-policy_ name>
Type the name of the trigger to apply when this rule is violated (see
maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
exception-rule <geo-ipexcept_name>
<entry_index> country-name "<region_ name>"
Type the name of a list of exceptions to this blacklist.
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
Type the name of a region (Antarctica or Bouvet
Island
) or country (U.S.) as it is written in English.
Surround names with multiple words or apostrophes in double quotes.
The list of locations varies by the currently installed IP-togeography mapping package. For a current list of locations, use the web UI.
Default
No default.
Low
No default.
No default.
No default.
No default.
Example
This example creates a set of North American IP addresses that a server policy can use to block clients with IP addresses belonging to Belize and Canada. FortiWeb does not block the IP addresses specified by the allownorth-america exception list.
config waf geo-block-list edit "north-america" set trigger "notification-servers1" set exception rule "allow-north-america" set severity Low config country-list edit 1 set country-name "Belize" next edit 2 end set country-name "Canada" next
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
399
waf geo-ip-except end next
Related topics
l
l
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile offline-protection
l
config server-policy custom-application application-policy
l
l
config
waf geo-ip-except
Use this command to specify IP addresses or ranges of IP addresses that are exceptions to the list of client IP addresses that FortiWeb blocks based on their geographic location.
For information on creating the blacklist by country or region, see
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf geo-ip-except edit
edit
set
ip {address_ipv4 | ip_range_ipv4}
end next end next
Variable
<geo-ip-except_name>
<entry_index> ip {address_ipv4 | ip_ range_ipv4}
Description
Type the name of a new or existing list of exceptions.
To display the list of existing rules, type: edit ?
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
Type the IP address or IP address range that is exempt from blocking based on its geographic location.
Default
No default.
No default.
No default.
400 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf hidden-fields-protection
Example
This example adds the IP address range 192.0.2.0 to 192.0.2.5 to the geolocation blacklist exception list allow-north-america
.
config waf geo-ip-except edit "allow-north-america" set ip 192.0.2.0-192.0.2.5
end end next
Related topics
l
l
config server-policy custom-application application-policy
l
l
waf hidden-fields-protection
Use this command to configure groups of hidden field rules.
To apply hidden field rule groups, select them within an inline protection profile. For details, see
config waf web-protection-profile inline-protection
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf hidden-fields-protection edit
config hidden_fields_list edit
set
hidden-field-rule <hidden-field-rule_name>
end end next next
Variable
<hidden-field-group_ name>
Description
Type the name of a new or existing hidden field rule group.
The maximum length is 35 characters.
To display the list of existing groups, type: edit ?
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
401
waf hidden-fields-rule
Variable
<entry_index>
Description
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
hidden-field-rule
<hidden-field-rule_name>
Type the name of an existing hidden field rule to add to the group. The maximum length is 35 characters.
To display the list of existing rules, type: set hidden-field-rule ?
Default
No default.
No default.
config
Related topics
l
l
config waf web-protection-profile inline-protection
waf hidden-fields-rule
Use this command to configure hidden field rules.
Hidden form inputs, like other types of parameters and inputs, can be vulnerable to tampering and can be used as a vector for other attacks.
Unlike other inputs, they are often written into an HTML page by the web server when it serves that page to the client, and are not visible on the rendered web page. As such, they are difficult to for users to unintentionally modify, and are often incorrectly perceived as relatively safe by web site owners.
Like other inputs, however, they are accessible through the JavaScript document object model (DOM), and as inputs, can be used to inject invalid data into your databases or attempt to tamper with the session state.
Hidden field rules prevent such tampering. The FortiWeb appliance caches the values of a session’s hidden inputs as they pass to the HTTP client, and verifies that they remain unchanged when the HTTP client submits a form.
You apply hidden field constraints by first grouping them into a hidden field group. For details, see
config waf hidden-fields-protection
Before you configure a hidden field rule, if you want to apply it only to HTTP requests for a specific real or virtual host, you must first define the web host in a protected hosts group. For details, see
config server-policy allow-hosts
Alternatively, you can use the web UI to fetch the request URL from the server and scan it for hidden inputs, using the results to configure the hidden input rule. For details, see the
FortiWeb Administration Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
402 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf hidden-fields-rule
Syntax
config waf hidden-fields-rule edit
set
action {alert | alert_deny | redirect | block-period | send_403_ forbidden}
set set set set set set set set set set set set set set set set
analyzer-policy <fortianalyzer-policy_name> analyzer-policy <fortianalyzer-policy_name>
config hidden-field-name edit
set
end next end next
Variable Description
<hidden-field-rule_name>
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
403
waf hidden-fields-rule
Variable Description
Select one of the following actions that the FortiWeb appliance will perform when an HTTP request violates one of the hidden field rules in the entry: l alert
— Accept the request and generate an alert email and/or log message.
l alert_deny
— Block the request (or reset the connection) and generate an alert email and/or log message.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
Default
action {alert | alert_ deny | redirect | blockperiod | send_403_ forbidden}
Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you
must also define an X-header that indicates the original client’s IP (see
). Failure to do so may cause FortiWeb to
block all connections when it detects a violation of this type.
l redirect
— Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message. Also configure
and
.
l send_403_forbidden
— Reply to the client with an
HTTP 403 Access Forbidden error message and generate an alert email and/or log message.
Caution: This setting will be ignored if
is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See
and
Note: If you select an auto-learning profile with this rule, you should select alert. If the action is alert_ deny
, for example, the FortiWeb appliance will block the request or reset the connection when it detects an attack, resulting in incomplete session information for the autolearning feature. For more information on auto-learning requirements, see
config waf web-protectionprofile autolearning-profile
alert block-period <seconds_ int>
If action is block-period, type the number of seconds that the connection will be blocked. The valid range is from 1 to 3,600 seconds.
0 config
404 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf hidden-fields-rule
Variable
host <protected-hosts_ name> host-status {enable | disable} request-file <url_str>
Description
Type the name of a protected host that the Host: field of an HTTP request must be in order to match the rule.
The maximum length is 255 characters.
This setting applies only if host-status is enable.
Enable to apply this hidden field rule only to HTTP requests for specific web hosts. Also configure
.
Disable to match the input rule based upon the other criteria, such as the URL, but regardless of the Host: field.
Type the literal URL, such as /login.jsp, that contains the hidden form.
The URL must begin with a slash ( / ). Do not include the name of the web host, such as www.example.com, which is configured separately in
. Regular expressions are not supported. The maximum length is 255 characters.
Add up to 10 URLs that are valid to use with the HTTP POST method when the client submits the form containing the hidden fields in this rule.
Default
No default.
disable
No default.
No default.
action-url0 <url_str> action-url1 <url_str> action-url2 <url_str> action-url3 <url_str> action-url4 <url_str> action-url5 <url_str> action-url6 <url_str> action-url7 <url_str> action-url8 <url_str> action-url9 <url_str> severity {High |
Medium | Low}
Select the severity level to use in logs and reports generated when a violation of the rule occurs.
High
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
405
waf http-authen http-authen-policy
Variable Description
trigger <trigger-policy_ name>
Type the name of the trigger to apply when this rule is violated (see
maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
<entry_index> argument <hidden-field_ str>
Default
No default.
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
Type the name of the hidden form input, such as languagepref
. The maximum length is 35 characters.
No default.
config
Example
This example blocks and logs requests from search.jsp if its hidden form input, whose name is “languagepref”, is posted to any URL other than query.do.
config waf hidden-fields-rule edit "hidden_fields_rule1" set action alert_deny set request-file "/search.jsp" set action-url0 "/query.do" config hidden-field-name edit 1 set argument "languagepref" end next end next
Related topics
l
config server-policy allow-hosts
l
config waf hidden-fields-protection
l
waf http-authen http-authen-policy
Use this command to group HTTP authentication rules into HTTP authentication policies.
The FortiWeb appliance uses authentication policies with the HTTP authentication feature to authorize HTTP requests. For details, see the
FortiWeb Administration Guide
.
To apply HTTP authentication policies, select them in an inline protection profile. For details, see
config waf web-protection-profile inline-protection
406 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf http-authen http-authen-policy
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf http-authen http-authen-policy edit
set
set
analyzer-policy <fortianalyzer-policy_name>
set set
config rule edit
<entry_index> http-authen-rule <http-auth-rule_name>
end end next set next
Variable
<auth-policy_name>
Description
Type the name of a new or existing HTTP authentication policy.
The maximum length is 35 characters.
To display the list of existing policies, type: edit ?
cache {enable | disable}
Enable to cache client user names and passwords from remote authentication such as LDAP queries. Also configure
This can be used can improve performance by preventing frequent queries.
alert-type {none | fail | success | all}
Type the instances when alerts will be issued for HTTP authentication attempts: l none
— No alerts are issued for HTTP authentication.
l fail
— Alerts are issued only for HTTP authentication failures.
l success
— Alerts are issued for successful HTTP authentication.
l all
— Alerts are issued for all failed and successful HTTP authentication.
cache-timeout <timeout_ int>
Type the query cache timeout, in seconds. The valid range is from 0 to 3,600 seconds.
This option is available only when cache is enabled.
Default
No default.
No default.
none
300
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
407
waf http-authen http-authen-policy config
Variable
auth-timeout <timeout_ int>
Description
Type the connection timeout for the query to the FortiWeb’s query to the remote authentication server in milliseconds.
The valid range is from 0 to 60,000 milliseconds. If the authentication server does not answer queries quickly enough, to prevent dropped connections, increase this value.
<entry_index>
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
http-authen-rule <httpauth-rule_name>
Type the name of an existing HTTP authentication rule. The maximum length is 35 characters.
To display the list of existing rules, type: set http-authen-rule ?
Default
2000
No default.
No default.
Example
This example first configures a user group that contains both a local user account and an LDAP query.
config user user-group edit "user-group1" config members edit 1 set type local set local-name "user1" next edit 2 set ldap-name "user2" set type ldap end next end next
Second, it configures a rule that requires basic HTTP authentication when requesting the URL
/employees/holidays.html
on the host www.example.com. This URL will be identified as belonging to the realm named “Restricted Area”. Users belonging to user-group1 can authenticate.
config waf http-authen http-authen-rule edit "auth-rule1" set host-status enable set host "www.example.com" config rule edit 1 set request-url "/employees/holidays.html" set authen-type basic set user-group "user-group1" set user-realm "Restricted Area" end next next
408 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf http-authen http-authen-rule end
Third, it groups two HTTP authentication rules into an HTTP authentication policy that can be applied in an inline protection profile.
config waf http-authen http-authen-policy edit "http-auth-policy1" config rule edit 1 set http-authen-rule "http-auth-rule1" next edit 2 end end next set http-authen-rule "http-auth-rule2" next
Related topics
l
config waf http-authen http-authen-rule
l
config waf web-protection-profile inline-protection
waf http-authen http-authen-rule
Use this command to configure HTTP authentication rules.
Authentication rules are used by the HTTP authentication feature to define sets of request URLs that will be authorized for each user group.
You apply authentication rules by adding them to an authentication policy, which is ultimately selected within an inline protection profile for use in web protection. For details, see
config waf http-authen httpauthen-policy
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf http-authen http-authen-rule edit
set
set
host-status {enable | disable}
config rule edit
<entry_index> authen-type {basic | digest | ntlm}
end next end next set set set set
request-url <path_str> user-group <user-group_name>
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
409
waf http-authen http-authen-rule config
Variable
<auth-rule_name>
Description
Type the name of a new or existing rule. The maximum length is
35 characters.
To display the list of existing rules, type: edit ?
Default
No default.
host <protected-hosts_ name> host-status {enable | disable}
<entry_index> authen-type {basic | digest | ntlm}
Type the name of a protected host that the Host: field of an
HTTP request must be in order to match the HTTP authentication rule. The maximum length is 255 characters.
This setting applies only if host-status is enable.
Enable to apply this HTTP authentication rule only to HTTP requests for specific web hosts. Also configure
.
Disable to match the HTTP authentication rule based upon the other criteria, such as the URL, but regardless of the Host: field.
No default.
disable
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
Select which type of HTTP authentication to use, either: l basic
— Clear text, Base64-encoded user name and password.
Supports local user accounts, and RADIUS and LDAP user queries.
NTLM user queries are not supported.
l digest
— Hashed user name, realm, and password. RADIUS,
LDAP and NTLM user queries are not supported.
l ntlm
— Encrypted user name and password. Local user accounts and RADIUS and LDAP user queries are not supported.
No default.
basic request-url <path_str> user-group <user-group_ name>
Type the literal URL, such as /employees/holidays.html, that a request must match in order to trigger HTTP authentication. The maximum length is 255 characters.
No default.
Type the name of a user group that is authorized to use the URL in
To display the list of existing user groups, type: set user-group ?
. The maximum length is 35 characters.
No default.
410 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf http-connection-flood-check-rule
Variable user-realm <realm_str>
Description Default
Type the realm, such as Restricted Area, to which the
belongs. The maximum length is 35 characters.
Browsers often use the realm multiple times.
l
It may appear in the browser’s prompt for the user’s credentials.
Especially if a user has multiple logins, and only one login is valid for that specific realm, displaying the realm helps to indicate which user name and password should be supplied.
l
After authenticating once, the browser may cache the authentication credentials for the duration of the browser session. If the user requests another URL from the same realm, the browser often will automatically re-supply the cached user name and password, rather than asking the user to enter them again for each request.
The realm may be the same for multiple authentication rules, if all of those URLs permit the same user group to authenticate.
No default.
For example, the user group All_Employees could have access to the
URLs /wiki/Main and
/wiki/ToDo
. These URLs both belong to the realm named
Intranet Wiki
. Because they use the same realm name, users authenticating to reach /wiki/Main usually will not have to authenticate again to reach /wiki/ToDo, as long as both requests are within the same browser session.
This field does not appear if authen-type is ntlm, which does not support HTTP-style realms.
Example
For an example, see
config waf http-authen http-authen-policy
.
Related topics
l
l
config waf http-authen http-authen-policy
waf http-connection-flood-check-rule
Use this command to limit the number of TCP connections per HTTP session. This can prevent TCP connection floods from clients operating behind a shared IP with innocent clients.
Excessive numbers of TCP connections per session can occur if a web application or client is malfunctioning, or if an attacker is attempting to waste socket resources to produce a DoS.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
411
waf http-connection-flood-check-rule config
This feature is similar to
config waf layer4-connection-flood-check-rule
counts TCP connections per session cookie, while TCP flood prevention counts only TCP connections per IP address. Because it uses session cookies at the application layer instead of only TCP/IP connections at the network layer, this feature can differentiate multiple clients that may be behind the same source IP address, such as when the source IP address hides a subnet that uses network address translation (NAT). However, in order to work, the client must support cookies.
To apply this rule, include it in an application-layer DoS-prevention policy. See
config waf applicationlayer-dos-prevention
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf http-connection-flood-check-rule edit
set set set set set end next
Variable
<rule_name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Default
No default.
412 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf http-connection-flood-check-rule
Variable
action {alert | alert_ deny | block-period}
Description
Select one of the following actions that the FortiWeb appliance will perform when the count exceeds the rate limit: l alert
— Accept the connection and generate an alert email and/or log message.
l alert_deny
— Block the connection and generate an alert email and/or log message.
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
Caution: This setting will be ignored if
is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See
and
Note: If an auto-learning profile will be selected in the policy with offline protection profiles that use this rule, you should select alert. If the action is alert_deny, the
FortiWeb appliance will reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For more information on auto-learning requirements, see
config waf web-protection-profile autolearningprofile
block-period <seconds_ int> http-connectionthreshold <limit_int> severity {High |
Medium | Low}
Type the length of time for which the FortiWeb appliance will block additional requests after a client exceeds the rate threshold.
The valid range is from 1 to 3,600 seconds.
Type the maximum number of TCP connections allowed from the same client. The valid range is from 1 to 1,024.
Select the severity level to use in logs and reports generated when a violation of the rule occurs.
trigger-policy <triggerpolicy_name>
Type the name of the trigger to apply when this rule is violated (see
maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
Default
alert
1
1
Medium
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
413
waf http-constraints-exceptions config
Related topics
l
l
config waf application-layer-dos-prevention
waf http-constraints-exceptions
Use set statements under this command to configure exceptions to existing HTTP protocol parameter constraints for specific hosts.
Exceptions may be useful if you know that some HTTP protocol constraints, during normal use, will cause false positives by matching an attack signature. Exceptions define HTTP constraints that will not be subject to HTTP protocol constraint policy.
For example, if you enable max-http-header-length in a HTTP protocol constraint exception for a specific host, FortiWeb ignores the HTTP header length check when executing the web protection profile for that host.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf http-constraints-exceptions edit
config http_constraints-exception-list edit
<entry_index> request-file <url_pattern>
set set set set set set set set set set set set set set set set set set set set set set set
request-type {plain | regular} host-status {enable | disable}
block-malformed-request {enable | disable}
Illegal-content-length-check {enable | disable}
Illegal-content-type-check {enable | disable}
Illegal-header-name-check {enable | disable}
Illegal-header-value-check {enable | disable}
Illegal-host-name-check {enable | disable}
Illegal-http-request-method-check {enable | disable}
set
max-url-param-name-len {enable | disable}
set
max-url-param-value-len {enable | disable}
set set
max-url-parameter {enable | disable} max-url-parameter-length {enable | disable}
414 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf http-constraints-exceptions set set
number-of-ranges-in-range-header {enable | disable} parameter-name-check {enable | disable}
set
parameter-value-check {enable | disable}
set
redundant-header-check {enable | disable}
set
source-ip-status {enable|disable}
set
set
url-param-name-check {enable | disable}
end end next set
url-param-value-check {enable | disable}
next
Variable
<http-exception_name>
<entry_index> request-file <url_ pattern> request-type {plain | regular} host-status {enable | disable}
Description
Type the name of a new or existing HTTP protocol constraint exception. The maximum length is 35 characters.
To display the list of existing exceptions, type: edit ?
Default
No default.
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
Type either: l l the literal URL, such as /index.php, that the HTTP request must contain in order to match the input rule.
The URL must begin with a slash ( / ).
a regular expression, such as ^/*.php, matching all and only the URLs to which the input rule should apply.
The pattern is
not required to begin with a slash ( / ).
However, it must at least match URLs that begin with a slash, such as /index.cfm.
Do not include the name of the web host, such as www.example.com
, which is configured separately in host
. The maximum length is 255 characters.
No default.
No default.
Type either plain or regular (for a regular expression) to match the string entered in request-file.
Enable to apply this exception only to HTTP requests for specific web hosts. Also configure
.
Disable to match the exception based upon the other criteria, such as the URL, but regardless of the Host: field.
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
415
waf http-constraints-exceptions
Variable
block-malformed-request
{enable | disable}
Description
Enable to omit the constraint on syntax and FortiWeb parsing errors.
Caution: Some web applications require abnormal or very large HTTP POST requests. Since allowing such errors and excesses is generally bad practice and can lead to vulnerabilities, use this option to omit the malformed request scan only if absolutely necessary.
Default
Illegal-content-lengthcheck {enable | disable}
Enable to omit the constraint on the maximum acceptable size in bytes of the request body.
disable
Illegal-content-typecheck {enable | disable}
Enable to omit the constraint on whether the Content
Type: value uses the format <type>/<subtype>.
Illegal-header-namecheck {enable | disable}
Enable to omit the constraint on whether the HTTP header name contains illegal characters.
Illegal-header-valuecheck {enable | disable}
Enable to omit the constraint on whether the HTTP header value contains illegal characters.
Illegal-host-name-check
{enable | disable}
Enable to omit the constraint on host names with illegal characters.
disable disable disable disable
Illegal-http-requestmethod-check {enable | disable} max-cookie-in-request
{enable | disable} max-header-line-request
{enable | disable}
Enable to omit the constraint on illegal HTTP request methods.
Illegal-responese-codecheck {enable | disable}
Enable to omit the constraint on whether the HTTP response code is a 3-digit number.
Enable to omit the constraint on the maximum number of cookies per request.
Enable to omit the constraint on the maximum number of
HTTP header lines.
max-http-body-length
{enable | disable}
Enable to omit the constraint on the maximum HTTP body length.
disable disable disable disable disable max-http-body-parameterlength {enable | disable}
Enable to omit the constraint on the maximum acceptable size in bytes of all parameters in the HTTP body of HTTP POST requests.
disable max-http-content-length
{enable | disable} max-http-header-length
{enable | disable}
Enable to omit the constraint on the maximum HTTP content length.
Enable to omit the constraint on the maximum HTTP header length.
disable disable config
416 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf http-constraints-exceptions
Variable
max-http-header-linelength {enable | disable} max-http-header-namelength {enable | disable} max-http-header-valuelength {enable | disable} max-http-requestfilename-length
{enable | disable} max-http-parameterlength {enable | disable} max-http-request-length
{enable | disable}
Description
Enable to omit the constraint on the maximum HTTP header line length.
Enable to omit the constraint on the maximum acceptable size in bytes of a single HTTP header name.
Enable to omit the constraint on the maximum acceptable size in bytes of a single HTTP header value.
Enable to omit the constraint on the maximum HTTP request filename length.
Enable to omit the constraint on the maximum HTTP parameter length.
max-url-param-name-len
{enable | disable}
Enable to omit the constraint on the maximum HTTP request length.
Enable to omit the constraint on the maximum acceptable length in bytes of the parameter name.
max-url-param-value-len
{enable | disable} parameter-value-check
{enable | disable}
Enable to omit the constraint on the maximum acceptable length in bytes of the parameter value.
max-url-parameter
{enable | disable}
Enable to omit the constraint on the maximum number of parameters in the URL.
max-url-parameter-length
{enable | disable}
Enable to omit the constraint on the maximum length of parameters in the URL.
number-of-ranges-inrange-header {enable | disable}
Enable to omit the constraint on the maximum acceptable number of Range: fields of an HTTP header.
parameter-name-check
{enable | disable}
Enable to omit the constraint on null characters in parameter names.
Enable to omit the constraint on null characters in parameter values.
Post-request-ctype-check
{enable | disable}
Enable to omit the constraint on whether the Content-
Type: header is available.
redundant-header-check
{enable | disable}
Enable to omit the constraint on the redundant instances of
Content-Length fields.
, Content-Type and Host herder
Default
disable disable disable disable disable disable disable disable disable disable disable disable disable disable disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
417
waf http-constraints-exceptions
Variable
source-ip-status
{enable|disable} source-ip <ip_range> url-param-name-check
{enable | disable} url-param-value-check
{enable | disable}
Description
Enable to check requests for matching the HTTP constraint exceptions rule by their source IP addresses.
Enter the source IP of the protected requests to which this exception applies. Only a single IPv4/IPv6 address, or a
IPv4/IPv6 range is acceptable.
For example: l l l l
1.2.3.4
2001::1
1.2.3.4-1.2.3.40
2001::1-2001::100
Available only when source-ip-status is enable.
Enable to omit the constraint on illegal characters in the parameter name.
Enable to omit the constraint on illegal characters in the parameter value.
Default
disable
No default.
disable disable
Example
This example omits header length limits for HTTP requests to www.example.com and 10.0.0.1 for /login.asp.
config waf http-constraints-exceptions edit "exception1" config http_constraints-exception-list edit 1 set host "www.example.com" set host-status enable set max-http-header-length enable set request-file "/login.asp" next edit 2 set host "10.0.0.1" set host-status enable set max-http-body-length enable set request-file "/login.asp" end next end next
Related topics
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile offline-protection
config
418 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config l
l
config waf http-protocol-parameter-restriction
waf http-protocol-parameter-restriction
waf http-protocol-parameter-restriction
Use this command to configure HTTP protocol constraints.
HTTP constraints govern features such as the HTTP header fields in the protocol itself, as well as the length of the HTML, XML, or other documents or encapsulated protocols carried in the content payload.
Use protocol constraints to prevent attacks such as buffer overflows in web servers that do not restrict elements of the HTTP protocol to acceptable lengths, or mishandle malformed requests. Such errors can lead to security vulnerabilities.
You can also use protocol constraints to block requests that are too large for the memory size you have configured for FortiWeb’s scan buffers. If your web applications do not require large HTTP POST requests, configure
{enable | disable} on page 421
to harden your configuration. To configure the buffer size, see
max-http-argbuf-length {8k-cache | 12k-cache | 32k-cache | 64k-cache} on page 234
.
You can configure each protocol parameter independently with an action, severity and trigger that determines how an attack on that parameter is handled. For example, you can set the action for header constraints to alert, the severity to high, and a trigger set to deliver an email each time FortiWeb detects a violation of these protocol parameters.
To apply HTTP protocol constraints, select them in an inline or offline protection profile. For details, see
config waf web-protection-profile inline-protection
or
config waf web-protectionprofile offline-protection
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf http-protocol-parameter-restriction edit
set
block-malformed-request-check {enable | disable}
set
chunk-size-check {enable | disable}
set
illegal-byte-in-url-check {enable | disable}
set
Illegal-content-length-check {enable | disable}
set
Illegal-content-type-check {enable | disable}
set
Illegal-frame-flag-check {enable | disable}
set
Illegal-frame-type-check {enable | disable}
set
Illegal-header-name-check {enable | disable}
set
Illegal-header-value-check {enable | disable}
set set
Illegal-host-name-check {enable | disable}
Illegal-http-request-method-check {enable | disable}
set
Illegal-http-version-check {enable | disable}
set
Illegal-magic-check {enable | disable}
set
Illegal-response-code-check {enable | disable}
set
malformed-url-check {enable | disable}
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
419
waf http-protocol-parameter-restriction set set set set set set set set set set
set
max-setting-current-streams-num <limit_int>
set
max-setting-frame-size <limit_int>
set
max-setting-header-list-size <limit_int>
set
max-setting-header-table-size <limit_int>
set
max-setting-initial-window-size <limit_int>
set
max-url-param-name-len <limit_int>
set
max-url-param-value-len <limit_int>
set
set
max-url-parameter-length <limit_int>
set
null-byte-in-url-check {enable | disable}
set set
number-of-ranges-in-range-header <limit_int> parameter-name-check {enable | disable}
set set
parameter-value-check {enable | disable}
Post-request-ctype-check {enable | disable}
set
redundant-header-check {enable | disable}
set
url-param-name-check {enable | disable}
set
url-param-value-check {enable | disable}
set
web-socket-protocol-check {enable | disable}
set set
waf http-protocol-parameter-restriction
<parameter_name>-action {alert | alert_deny | block-period}
set set
<parameter_name>-severity {High | Medium | Low}
<parameter_name>-trigger <trigger-policy_name>
set
[set
<parameter_name>-block-period <seconds_int> exception_name <http-exception_name>
] end next
Variable
<http-constraint_name>
Description
Type the name of a new or existing HTTP protocol constraint. The maximum length is 35 characters.
To display the list of existing constraints, type: edit ?
Default
No default.
config
420 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf http-protocol-parameter-restriction
Variable Description Default
block-malformed-requestcheck {enable | disable}
Enable to block the request if either: l it has syntax errors l parsing errors occur while FortiWeb is scanning the request
(see
These can cause problems in web servers that do not handle them gracefully. Such problems can lead to security vulnerabilities.
Caution: Fortinet strongly recommends to enable this option unless large requests or parameters are required by the web application. If part of a request is too large for its scan buffer, FortiWeb cannot scan it for attacks.
Unless you enable this option to block oversized items, FortiWeb will allow oversized those requests to pass through without scanning.
This could allow attackers to craft large attacks to bypass your FortiWeb policies, and reach your web servers. If feasible, instead of disabling this option: enable l enlarge the scan buffers (see
max-http-argbuf-length {8kcache | 12k-cache | 32k-cache | 64k-cache} on page 234 )
l omit this only for URLs that require oversized parameters
(see
config server-policy customapplication application-policy
)
Note: Do not enable this option if requests normally contain: l parameters larger than the scan buffer (Buffer size is configurable — see
max-http-argbuf-length {8k-cache |
12k-cache | 32k-cache | 64k-cache} on page 234
.) l large numbers of parameters l more than 32 cookies
Requests like this will be flagged as potentially malformed by FortiWeb’s parser, causing FortiWeb to block normal requests.
chunk-size-check {enable
| disable}
Enable to check whether the size of each chunk is a hexadecimal value (if Transfer-Encoding: is chunked
). A violation will be detected if the value is presented in other numeral systems.
enable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
421
waf http-protocol-parameter-restriction
Variable Description Default
illegal-byte-in-urlcheck {enable | disable}
Enable to check whether the URL (or path for HTTP/2) in a request contains characters that are not allowed by the RFC.
These illegal characters are usually non-printable ASCII characters or other special characters (such as ASCII 0 - 31 and ASCII 127). This feature checks the part between the host prefix and parameters in the URL (if they exist), for example, the /index.php in GET http://www.server.com/index.php?name=value
HTTP 1.1
.
enable
Illegal-content-lengthcheck {enable | disable}
Enable to check whether the Content-Length: header includes numeric characters only.
disable
Illegal-content-typecheck {enable | disable}
Enable to check whether the Content Type: value has the format <type>/<subtype>.
disable
Illegal-frame-flag-check
{enable | disable}
Enable to check whether a HTTP2 request contains frame flags that are not defined in RFC7540. Any undefined frame flag will be treated as illegality.
enable
Illegal-frame-type-check
{enable | disable}
Enable to check whether a HTTP2 request contains frame types that are not defined in RFC7540. Any undefined frame type will be treated as illegality.
enable
Illegal-header-namecheck {enable | disable}
Enable to check whether the HTTP header name contains illegal characters.
Illegal-header-valuecheck {enable | disable}
Enable to check whether the HTTP header value contains illegal characters.
Illegal-host-name-check
{enable | disable}
Enable to check the Host: line of the HTTP header for illegal characters, such as null or encoded characters like
0x0 or %00*.
Illegal-http-requestmethod-check {enable | disable} disable disable enable
Enable to check for invalid HTTP request methods according to RFC 2616 or RFC 4918.
enable
FortiWeb considers any method that is not defined in these
RFCs to be illegal. Thus, illegal methods including misspellings like GETT and other HTTP extension methods
(for example, CalDAV) like MKCALENDAR.
Illegal-http-versioncheck {enable | disable}
Enable to check for illegal HTTP version numbers. If the
HTTP version is not “HTTP/1.0” or “HTTP/1.1”, it is considered illegal.
Illegal-magic-check
{enable | disable}
Enable to check whether a client connection preface start with the string PRI *
HTTP/2.0\r\n\r\nSM\r\n\r\n
.
enable enable config
422 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf http-protocol-parameter-restriction
Variable Description
Illegal-response-codecheck {enable | disable}
Enable to check whether the HTTP response code is a 3digit number.
malformed-url-check
{enable | disable}
Default
enable
Enable to check whether the URL (or path for HTTP/2) in a request conform the spec by beginning with a slash ("/") character or a slash character follows the protocol prefix and host prefix in the URL (e.g.
http://myserver.com/default.asp). If the slash characters are missing, it is typically a malicious access to other protocols
(e.g. SMTP) using the back-end web servers.
enable max-cookie-in-request
<limit_int> max-header-line-request
<limit_int> max-http-body-length
<limit_int>
Type the maximum acceptable number of cookies in an
HTTP request. The valid range is from 0 to 32.
16
Type the maximum acceptable number of lines in the HTTP header. The valid range is from 0 to 32.
32
Type the maximum acceptable length in kilobytes of the HTTP body.
The valid range is from 0 to 65536. To disable the limit, type 0.
0 max-http-body-parameterlength <limit_int>
Type the total maximum acceptable size in bytes of all the parameters in the HTTP body of HTTP POST requests.
8192 max-http-content-length
<limit_int> max-http-header-length
<limit_int> max-http-header-namelength <limit_int>
Question mark ( ? ), ampersand ( & ), and equal ( = ) characters are not included.
Type the maximum acceptable length in kilobytes of the request body. Length is determined by comparing this limit with the value of the Content-Length: field in the HTTP header.
The valid range is from 0 to 65536. To disable the limit, type 0.
Type the maximum acceptable length in bytes of the
HTTP header.
The valid range is from 0 to 12,288. To disable the limit, type 0.
Specifies the maximum acceptable size in bytes of a single HTTP header name (for example, Host:,
Content-Type:
, User-Agent:).
0
4096
50
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
423
waf http-protocol-parameter-restriction
Variable
max-http-header-valuelength <limit_int> max-http-parameterlength <limit_int> max-http-requestfilename-length <limit_ int> max-http-request-length
<limit_int> max-setting-currentstreams-num <limit_int> max-setting-frame-size
<limit_int>
Description
Specifies the maximum acceptable size of a single
HTTP header value, in bytes.
Type the total maximum total acceptable length in bytes of all parameters in the URL and/or, for HTTP
POST requests, the HTTP body.
Question mark ( ? ), ampersand ( & ), and equal ( = ) characters are not included.
The valid range is from 0 to 65,536. To disable the limit, type 0.
Specifies the maximum acceptable length in bytes of the HTTP request filename.
The valid range is from 0 to 65536. To disable the limit, type 0.
Type the maximum acceptable length in kilobytes of the HTTP request.
The valid range is from 0 to 65536. To disable the limit, type 0.
Specifies the maximum acceptable number of concurrent streams that the sender will allow the receiver to create. Enable max-setting-currentstreams-num-check to check whether value of parameter SETTINGS_MAX_CONCURRENT_
STREAMS in a HTTP/2 SETTINGS frame exceeds the limitation and react correspondingly.
The valid range is from 0 to 100000.
Specifies the maximum acceptable size in bytes of the frame payload that the sender is willing to receive.
Enable max-setting-frame-size-check to check whether value of parameter SETTINGS_MAX_
FRAME_SIZE in a HTTP/2 SETTINGS frame exceeds the limitation and react correspondingly.
The valid range is from 0 to 16777215.
Default
4096
6144
2048
67108864
1000
16384 config
424 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf http-protocol-parameter-restriction
Variable Description
max-setting-header-listsize <limit_int>
Specifies the maximum acceptable size in bytes of the header list that the sender is prepared to accept.
Enable max-setting-header-list-sizecheck to check whether value of parameter
SETTINGS_MAX_HEADER_LIST_SIZE in a HTTP/2
SETTINGS frame exceeds the limitation and react correspondingly.
The valid range is from 0 to 16777215.
max-setting-headertable-size <limit_int>
Specifies the maximum acceptable size in bytes of the header compression table used to decode header blocks. Enable max-setting-header-tablesize-check to check whether value of parameter
SETTINGS_HEADER_TABLE_SIZE in a HTTP/2
SETTINGS frame exceeds the limitation and react correspondingly.
The valid range is from 0 to 16777215.
max-setting-initialwindow-size <limit_int>
Specifies the maximum acceptable sender's initial window size in bytes for stream-level flow control.
Enable max-setting-initial-window-sizecheck to check whether value of parameter
SETTINGS_INITIAL_WINDOW_SIZE in a HTTP/2
SETTINGS frame exceeds the limitation and react correspondingly.
The valid range is from 0 to 2147483647.
max-url-param-name-len
<limit_int> max-url-param-value-len
<limit_int>
Specifies the maximum acceptable length in bytes of each URL parameter name in a request. Enable maxurl-param-name-len-check to check whether a parameter name exceeds the limitation. For example, user in the request GET
/index.php?user=test&sid=1234 is an illegal parameter name if you set the limitation as 3.
The valid range is from 0 to 12288.
Specifies the maximum acceptable length in bytes of each URL parameter value in a request. Enable maxurl-param-value-len-check to check whether a parameter value exceeds the limitation. For example,
1234 in the request GET
/index.php?user=test&sid=1234 is an illegal parameter value if you set the limitation as 3.
The valid range is from 0 to 12288.
Default
65536
65535
6291456
4096
4096
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
425
waf http-protocol-parameter-restriction
Variable
max-url-parameter
<limit_int>
Description
Type the maximum number of URL parameters.
The valid range is from 1 to 64.
max-url-parameter-length
<limit_int>
Type the total maximum acceptable length in bytes of all parameters, including their names and values, in the
URL. Parameters usually appear after a ?, such as:
/url?parameter=value
It does not include parameters in the HTTP body, which can occur with HTTP POST requests.
The valid range is from 0 to 12,288.
Default
16
2048 null-byte-in-url-check
{enable | disable} number-of-ranges-inrange-header <limit_int>
Type the maximum acceptable number of Range: fields of an HTTP header.
Tip: Some versions of Apache are vulnerable to a denial of service (DoS) attack on this header, where a malicious client floods the server with many Range: headers. The default value is appropriate for unpatched versions of Apache 2.0 and 2.1.
The valid range is from 0 to 64.
parameter-name-check
{enable | disable}
Enable to check whether the URL (or path for HTTP/2) in a request contains null characters (such as \0 or %00). This feature checks the part between the host prefix and parameters in the URL (if they exist), for example, the
/index.php
in GET http://www.server.com/index.php?name=value
HTTP 1.1
. Attackers might be embed NULL characters in
URL to evade detections.
enable
Enable to check for null characters in parameter names.
5 disable parameter-value-check
{enable | disable}
Enable to check for null characters in parameter values.
Post-request-ctype-check
{enable | disable}
Enable to check whether the Content-Type: header is available.
disable disable config
426 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf http-protocol-parameter-restriction
Variable
redundant-header-check
{enable | disable} url-param-name-check
{enable | disable}
Description
Enable to check whether a HTTP request contains multiple instances of Content-Length (only for HTTP/1.x),
Content- Type
(for both HTTP/1.x and HTTP/2) and
Host
(for both HTTP/1.x and HTTP/2) herder fields. These header fields are required to appear only once in a request by the RFC.Redundant HTTP headers are most probably involved in possible attacks.
Default
enable
Enable to check whether a URL parameter name contains the characters that are not allowed by the RFC. These illegal characters are usually non-printable ASCII characters or other special characters.
enable url-param-value-check
{enable | disable}
Enable to check whether a URL parameter value contains the characters that are not allowed by the RFC. These illegal characters are usually non-printable ASCII characters or other special characters.
enable web-socket-protocolcheck {enable | disable}
Enable to detect traffic that uses the WebSocket TCP-based protocol.
disable
Because FortiWeb acts as a pure socket proxy for
WebSocket traffic, it cannot apply security features to it.
<parameter_name>-check
{enable | disable}
Specifies whether FortiWeb includes the specified constraint when it applies this set of constraints.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
427
waf http-protocol-parameter-restriction config
428
Variable
<parameter_name>-action
{alert | alert_deny | block-period}
Description
Select one of the following actions that the FortiWeb appliance will perform when an HTTP request violates one of the rules: l alert
— Accept the request and generate an alert email and/or log message.
l alert_deny
— Block the request (or reset the connection) and generate an alert email and/or log message.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
.
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
<parameter_name>-block-period <seconds_int> .
Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you
must also define an X-header that indicates the original client’s IP (see
). Failure to do so may cause
FortiWeb to block all connections when it detects a violation of this type.
Caution: This setting is ignored when the value of
monitor-mode {enable | disable}
is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See
and
.
Note: If you select an auto-learning profile with this rule, you should select alert. If the action is alert_deny
, for example, the FortiWeb appliance will block the request or reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For more information on auto-learning requirements, see
config waf web-protection-profile autolearning-profile
.
Note: This is not a single setting. Configure the action setting for each violation type. The number of action settings equals the number of violation types.
For example, for maximum HTTP header length violations, you might type the accompanying setting: set max-http-header-length-action alert
Note: Available actions vary depending on operating mode and protocol parameter.
Default
alert
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf http-protocol-parameter-restriction
Variable
<parameter_name>severity {High |
Medium | Low}
Description
Select the severity level to use in logs and reports generated when a violation of the rule occurs.
Note: This is not a single setting. Configure the severity setting for each violation type. The number of severity settings equals the number of violation types.
For example, for maximum HTTP header length violations, you might type the accompanying setting: set max-http-header-length-severity
High
<parameter_name>-trigger
<trigger-policy_name>
Type the name of the trigger to apply when this rule is violated (see
). The maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
Note: This is not a single setting. Configure the trigger setting for each violation type. The number of trigger settings equals the number of violation types.
For example, for maximum HTTP header length violations, you might type accompanying setting: set max-http-header-length-trigger trigger-policy1
<parameter_name>-blockperiod <seconds_int> exception_name <httpexception_name>
Default
Medium
No default.
If action is block-period, type the number of seconds that the connection will be blocked. The valid range is from 1 to 3,600 seconds.
0
Type the name of an exceptions to existing HTTP protocol parameter constraints (see
config server-policy custom-application application-policy
).
No default.
Example
This example limits the total size of the HTTP header, including all lines, to 2,048 bytes. If the HTTP header length exceeds 2,048 bytes, the FortiWeb appliance takes an action to create a log message (alert), identifying the violation as medium severity, and sends an email to the administrators defined within the trigger policy email-admin
.
config waf http-protocol-parameter-restriction edit "http-constraint1" set max-http-header-length 2048 end set max-http-header-length-action alert set max-http-header-length-severity Medium set max-http-header-length-trigger email-admin next
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
429
waf http-request-flood-prevention-rule config
Related topics
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile offline-protection
l
l
config server-policy custom-application application-policy
l
diagnose debug application http
l
waf http-request-flood-prevention-rule
Use this command to limit the maximum number of HTTP requests per second coming from any client to a specific URL on one of your protected servers.
The FortiWeb appliance tracks the requests using a session cookie. If the count exceeds the request limit,
FortiWeb performs the specified action.
To apply this rule, include it in an application-layer DoS-prevention policy. This feature is effective only when http-session-management is enabled in the inline protection profile that uses the parent DoS-prevention policy.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf http-request-flood-prevention-rule edit
set
access-limit-in-http-session <limit_int>
set set set set end set next
action {alert | alert_deny | block-period} real-browser-enforcement {enable | disable}
severity {High | Medium | Low} trigger-policy <trigger-policy_name>
Variable
<rule_name> access-limit-in-httpsession <limit_int>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Type the maximum number of HTTP connections allowed per second from the same client. The valid range is from 0 to 4,096.
0
Default
No default.
430 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf http-request-flood-prevention-rule
Variable
action {alert | alert_ deny | block-period}
Description Default
Select one of the following actions that the FortiWeb appliance will perform when the count exceeds the limit: l alert
— Accept the request and generate an alert email and/or log message.
l alert_deny
— Block the request (or reset the connection) and generate an alert email and/or log message.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
alert
Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you
must also define an X-header that indicates the original client’s IP (see
). Failure to do so may cause FortiWeb to
block
all connections when it detects a violation of this type.
Caution: This setting will be ignored if
is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See
and
Note: If you select an auto-learning profile with this rule, you should select alert. If the action is alert_deny, for example, the FortiWeb appliance will block the request or reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For more information on auto-learning requirements, see
config waf web-protectionprofile autolearning-profile
real-browser-enforcement
{enable | disable}
Enable to return a JavaScript to the client to test whether it is a web browser or automated tool when it exceeds the rate limit.
If the client either fails the test or does not return results before the timeout specified by validationtimeout
, FortiWeb applies the specified action. If the client appears to be a web browser, FortiWeb allows the client to exceed the rate limit.
Disable this option to apply the rate limit regardless of whether the client is a web browser (for example, Firefox) or an automated tool (for example, wget).
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
431
waf input-rule
Variable
block-period <seconds_ int>
Description
If action is block-period, type the number of seconds that the connection will be blocked.
This setting applies only if action is block-period.
The valid is from 0 to 10,000 seconds.
severity {High | Medium
| Low}
Select the severity level to use in logs and reports generated when a violation of the rule occurs.
trigger-policy <triggerpolicy_name>
Type the name of the trigger to apply when this rule is violated (see
maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
validation-timeout
<timeout_int>
Specifies the maximum amount of time that FortiWeb waits for results from the client for Real Browser Enforcement.
Default
0
Medium
No default.
config
Example
This example illustrates a rule that imposes a two-minute blocking period on clients that exceed the set request limit.
config waf http-request-flood-prevention-rule edit "Web Portal HTTP Request Limit" set access-limit-in-http-session 10 set action block-period end set block-period 120 set severity Medium set trigger-policy "Server_Policy_Trigger" next
Related topics
l
l
config waf application-layer-dos-prevention
waf input-rule
Use this command to configure input rules.
Input rules define whether or not parameters are required, and sets their maximum allowed length, for HTTP requests matching the host and URL defined in the input rule.
Each input rule contains one or more individual rules. This enables you to define, within one input rule, all parameter restrictions that apply to HTTP requests matching that URL and host name.
432 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf input-rule
For example, one web page might have multiple inputs: a user name, password, and a preference for whether or not to remember the login. Within the input rule for that web page, you could define separate rules for each parameter in the HTTP request: one rule for the user name parameter, one rule for the password parameter, and one rule for the preference parameter.
To apply input rules, select them within a parameter validation rule. For details, see
config waf parameter-validation-rule
Before you configure an input rule, if you want to apply it only to HTTP requests for a specific real or virtual host, you must first define the web host in a protected hosts group. For details, see
config server-policy allow-hosts
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf input-rule edit
set
action {alert | alert_deny | redirect | send_403_forbidden | blockperiod} block-period <seconds_int>
set set set set set set set
host-status {enable | disable} request-file <url_str> request-type {plain | regular}
analyzer-policy <fortianalyzer-policy_name> analyzer-policy <fortianalyzer-policy_name>
config rule-list edit
set
type-checked (enable | disable}
set
argument-type <custom-data-type | data-type | regularexpression}
set set set set set set set end next end next
argument-name-type {plain | regular} argument-name <input_name> argument-expression <regex_pattern>
custom-data-type <custom-data-type_name> data-type <predefined_name>
is-essential {yes | no} max-length <limit_int>
Variable
<input-rule_name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
433
waf input-rule
Variable
block-period <seconds_ int>
Description
Type the number of seconds to block the source IP. The valid range is from 0 to 3,600 seconds.
This setting applies only if action is block-period.
Default
action {alert | alert_ deny | redirect | send_
403_forbidden | blockperiod}
Select one of the following actions that the FortiWeb appliance will perform when an HTTP request violates one of the input rules in the entry: l alert
— Accept the request and generate an alert email and/or log message.
l alert_deny
— Block the request (or reset the connection) and generate an alert email and/or log message.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
l redirect
— Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message. Also configure
and
.
l send_403_forbidden
— Reply to the client with an
HTTP 403 Access Forbidden error message and generate an alert email and/or log message.
Caution: This setting will be ignored if
is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See
and
Note: If you select an auto-learning profile with this rule, you should select alert. If the action is alert_ deny
, for example, the FortiWeb appliance will block the request or reset the connection when it detects an attack, resulting in incomplete session information for the autolearning feature. For more information on auto-learning requirements, see
config waf web-protectionprofile autolearning-profile
alert
60 host <protected-host_ name>
Type the name of a protected host that the Host: field of an HTTP request must be in order to match the rule.
The maximum length is 255 characters.
This setting applies only if host-status is enable.
No default.
config
434 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf input-rule
Variable
host-status {enable | disable}
Description
Enable to apply this input rule only to HTTP requests for specific web hosts. Also configure
.
Disable to match the input rule based upon the other criteria, such as the URL, but regardless of the Host: field.
request-file <url_str> request-type
{plain | regular} severity {High |
Medium | Low}
Depending on your selection in
{plain | regular} , type either:
l the literal URL, such as /index.php, that the HTTP request must contain in order to match the input rule. The
URL must begin with a slash ( / ).
l a regular expression, such as ^/*.php, matching all and only the URLs to which the input rule should apply. The pattern is not required to begin with a slash ( / ). However, it must at least match URLs that begin with a slash, such as
/index.cfm
.
Do not include the name of the web host, such as www.example.com
, which is configured separately in
host <protected-host_name> . The maximum length is
255 characters.
Note: Regular expressions beginning with an exclamation point ( ! ) are not supported. For information on language and regular expression matching, see the
FortiWeb Administration Guide
.
Select whether
will contain a literal URL
(plain), or a regular expression designed to match multiple
URLs (regular).
Select the severity level to use in logs and reports generated when a violation of the rule occurs.
trigger <trigger-policy_ name>
Type the name of the trigger to apply when this rule is violated (see
maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
Default
disable
No default.
plain
Low
No default.
<entry_index>
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
435
waf input-rule
Variable
is-essential {yes | no} max-length <limit_int>
Description
Select yes if the parameter is required for HTTP requests to this combination of Host: field and URL. Otherwise, select no
.
Type the maximum allowed length of the parameter value.
The valid range is from 0 to 1,024 characters. To disable the length limit, type 0.
Default
no type-checked (enable | disable}
Enable to use predefined or configured data types when validating parameters. Also configure data-type, custom-data-type
, or argument-expression.
Disable to ignore data-type and custom-datatype settings.
enable argument-type <customdata-type | data-type | regular-expression} argument-name-type
{plain | regular}
Specify the type of argument.
Specify one of the following options: l plain
— argument-name is the name attribute of the parameter’s input tag exactly as it appears in the form on the web page.
l regular
— argument-name is a regular expression designed to match the name attribute of the parameter’s input tag.
No default.
argument-name <input_ name> argument-expression
<regex_pattern>
If argument-name-type is plain, specify the name of the input as it appears in the HTTP content, such as username. The maximum length is 35 characters.
If argument-name-type is regular, specify a regular expression designed to match the name attribute of the parameter’s input tag.
Type a regular expression that matches all valid values, and no invalid values, for this input.
The maximum length is 2,071 characters.
Note: Regular expressions beginning with an exclamation point ( ! ) are not supported.
0
No default.
config
436 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
custom-data-type
<custom-data-type_name> data-type <predefined_ name>
Description
Type the name of a custom data type, if any. The maximum length is 35 characters.
To display the list of custom data types, type: set custom-data-type ?
This setting applies only if type-checked is enable.
Select one of the predefined data types, if the input matches one of them (available options vary by
FortiGuard updates).
To display available options, type: set data type ?
For match descriptions of each option, see
config server-policy pattern data-type-group
Alternatively, configure
argument-type <custom-datatype | data-type | regular-expression} . This option is
ignored if you configure
argument-type <custom-datatype | data-type | regular-expression} , which also defines
parameters to which the input rule applies, but supersedes this option.
waf input-rule
Default
No default.
No default.
Example
This example blocks and logs requests for the file named login.php that do not include a user name and password, both of which are required, or whose user name and password exceed the 64-character limit.
config waf input-rule edit "input_rule1" set action alert_deny set request-file "/login.php?*" request-type regular config rule-list edit 1 set argument-name "username" set argument-type data-type set data-type Email set is-essential yes set max-length 64 next edit 2 set argument-name "password" set data-type String set is-essential yes end end next set max-length 64 next
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
437
waf ip-intelligence config
Related topics
l
config server-policy allow-hosts
l
config waf parameter-validation-rule
waf ip-intelligence
Use this command to configure reputation-based source IP blacklisting.
Clients with suspicious behaviors or poor reputations include spammers, phishers, botnets, and anonymizing proxy users. If you have purchased a subscription for the FortiGuard IP Reputation service, your FortiWeb can periodically download an updated blacklist to keep your appliance current with changes in dynamic IPs, spreading virus infections, and spammers changing service providers.
IP intelligence settings apply globally, to all policies that use this feature.
Before or after using this command, use
config waf ip-intelligence-exception
to configure any exemptions that you want to apply. To apply IP reputation-based blocking, configuring these category settings first, then enable
ip-intelligence {enable | disable}
in the server policy’s protection profile.
Alternatively, you can block sets of many clients based upon their geographical origin (see
) or manually by specific IPs (see
config server-policy custom-application application-policy
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf ip-intelligence edit
set
action {alert | alert_deny | redirect | send_403_forbidden | blockperiod} block-period <seconds_int>
set set set set set end next
severity {Low | Medium | High}
status {enable | disable} trigger <trigger-policy_name>
Variable
<entry_index>
Description
Type the index number of the individual entry in the table entry in the table.
Default
No default.
438 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf ip-intelligence
Variable
action {alert | alert_ deny | redirect | send_
403_forbidden | blockperiod} block-period <seconds_ int>
Description Default
Select one of the following actions that the FortiWeb appliance performs when a client’s source IP matches the blacklist category: l alert
— Accept the request and generate an alert email and/or log message.
l alert_deny
— Block the request (or reset the connection) and generate an alert email and/or log message.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
l redirect
— Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message. Also configure
and
rdt-reason {enable | disable} .
l send_403_forbidden
— Reply to the client with an HTTP
403 Access Forbidden error message and generate an alert email and/or log message.
Caution: FortiWeb ignores this setting when
monitormode {enable | disable}
is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See
and
Note: If you select an auto-learning profile with this rule, you should select alert. If the action is alert_deny, for example, the FortiWeb appliance will block the request or reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For more information on auto-learning requirements, see
config waf web-protectionprofile autolearning-profile
alert
Type the number of seconds to block the source IP. The valid range is from 0 to 3,600 seconds.
This setting applies only if action is block-period.
60
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
439
waf ip-intelligence
Variable
status {enable | disable}
Description
category <category_name>
Type the name of an existing IP intelligence category, such as "Anonymous Proxy" or Botnet. If the category name contains a space, you must surround the name in double quotes. The maximum length is 35 characters.
Category names vary by the version number of your
FortiGuard IRIS package.
Default
Enable to block clients whose source IP belongs to this category according to the FortiGuard IRIS service.
enable severity {Low | Medium |
High}
When rule violations are recorded in the attack log, each log message contains a Severity Level (severity_ level
) field. Select which severity level the FortiWeb appliance uses when a blacklisted IP address attempts to connect to your web servers: l
Low l
Medium l
High
Low trigger <trigger-policy_ name>
Select which trigger, if any, that the FortiWeb appliance uses when it logs and/or sends an alert email about a blacklisted IP address’s attempt to connect to your web servers (see
). The maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
No default.
config
Example
The following command blacklists clients whose source IPs are currently known by Fortinet to be members of a botnet. In the FortiGuard IRIS package for this example, “Botnet” is the first item in the list of categories.
When a botnet member makes a request, FortiWeb blocks the connection and continues to block it without reevaluating it for the next 6 minutes (360 seconds). FortiWeb logs the event with a high severity level and sends notifications to the Syslog and email servers specified in notification-servers1.
config waf ip-intelligence edit 1 set status enable set action period_block set block-period 360 set severity High set trigger-policy notification-servers1 end next
440 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf ip-intelligence-exception
Related topics
l
config waf ip-intelligence-exception
l
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile offline-protection
l
l
config server-policy custom-application application-policy
l
waf ip-intelligence-exception
Use this command to exempt IP addresses from reputation-based blocking. The settings apply globally, to all policies that use this feature.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf ip-intelligence-exception edit
set set end next
status {enable | disable} ip <client_ipv4>
Variable
<entry_index> status {enable | disable} ip <client_ipv4>
Description Default
Type the index number of the individual entry in the table entry in the table. The valid range is from 1 to
9,999,999,999,999,999,999.
No default.
disable
Enable to exempt clients from IP reputation-based blocking.
Type the client’s source IP address.
No default.
Example
See
Related topics
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
441
waf ip-list config
waf ip-list
Use this command to define which source IP addresses are trusted clients, undetermined, or distrusted.
l l l
Trusted IPs — Almost always allowed to access to your protected web servers. Trusted IPs are exempt from many
(but not all) of the restrictions that would otherwise be applied by a server policy. To determine skipped scans, see
Neither — If a source IP address is neither explicitly blacklisted or trusted by an IP list policy, the client can access your web servers, unless it is blocked by any of your other configured, subsequent web protection scan techniques
(see
).
Blacklisted IPs — Blocked and prevented from accessing your protected web servers. Requests from blacklisted
IP addresses receive a warning message in response. The warning message page includes
ID: 70007, which is the
ID of all attack log messages about requests from blacklisted IPs.
Because FortiWeb evaluates trusted and blacklisted IP policies before many other techniques, defining these IP addresses can improve performance.
Alternatively, you can block sets of many clients based upon their reputation (see
).
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf ip-list edit
config members edit
set
set set
type {trust-ip | black-ip} severity {Low | Medium | High} trigger-policy <trigger-policy_name>
end end next set next
Variable
<ip-list_name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Default
No default.
442 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf ip-list
Variable
<entry_index> ip <client_ip>
Description
Type the index number of the individual entry in the table entry in the table. The valid range is from 1 to
9,999,999,999,999,999,999.
Enter one of the following values: l
A single IP address that a client source IP must match, such as a trusted private network IP address (e.g. an administrator’s computer, 172.16.1.20).
l
A range or addresses (for example, 172.22.14.1-
172.22.14.255
or 10:200::10:1-
10:200:10:100
).
Default
No default.
No default.
type {trust-ip | black-ip}
Select either: l l trust-ip
— The source IP address is trusted and allowed to access your web servers,
unless it fails a previous scan (see
).
black-ip
— The source IP address that is
distrusted, and is permanently blocked (blacklisted) from accessing your web servers, even if it would normally pass all other scans.
Note: If multiple clients share the same source IP address, such as when a group of clients is behind a firewall or router performing network address translation (NAT), blacklisting the source IP address could block innocent clients that share the same source IP address with an offending client.
trustip
No default.
severity {Low | Medium |
High}
When rule violations are recorded in the attack log, each log message contains a Severity Level (severity_ level
) field. Select which severity level the FortiWeb appliance will use when a blacklisted IP address attempts to connect to your web servers: l
Low l
Medium l
High trigger-policy <triggerpolicy_name>
Select which trigger, if any, that the FortiWeb appliance will use when it logs and/or sends an alert email about a blacklisted IP address’s attempt to connect to your web servers (see
). The maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
443
waf layer4-access-limit-rule config
Example
The following shows the configuration for a trusted host of 192.0.2.0 followed by a blacklisted client of 192.0.2.1.
config waf ip-list edit "IP-List-Policy1" config members edit 1 set ip 192.0.2.0
next edit 2 set type black-ip set ip 192.0.2.1
set severity Medium end end next set trigger-policy "TriggerActionPolicy1" next
Related topics
l
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile offline-protection
l
l
l
waf layer4-access-limit-rule
Use this command to limit the number of HTTP requests per second from any IP address to your web server. The
FortiWeb appliance tracks the number of requests. If the count of HTTP GET or POST requests exceeds the request limit, FortiWeb performs the action you specified.
To apply this rule, include it in an application-layer DoS-prevention policy (see
config waf applicationlayer-dos-prevention
) and include that policy in an inline protection profile.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf layer4-access-limit-rule edit
set
access-limit-standalone-ip <limit_int>
set
access-limit-share-ip <limit_int>
set
action {alert | alert_deny | block-period}
set set
real-browser-enforcement {enable | disable} block-period <seconds_int>
set
severity {High | Medium | Low}
444 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf layer4-access-limit-rule set set
trigger-policy <trigger-policy_name> validation-timeout <timeout_int>
end next
Variable
<rule_name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
access-limit-standaloneip <limit_int>
Type the maximum number of HTTP requests allowed per second from any source IP address representing a single client.
The valid range is from 0 to 65,536.
0 access-limit-share-ip
<limit_int>
Type the maximum number of HTTP requests allowed per second from any source IP address shared by multiple clients behind a network address translation (NAT) device, such as a firewall or router. The valid range is from 0 to 65,536.
0
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
445
waf layer4-access-limit-rule
Variable
action {alert | alert_ deny | block-period}
Description
Select one of the following actions that the FortiWeb appliance will perform when the count exceeds either threshold limit: l alert
— Accept the request and generate an alert email and/or log message.
l alert_deny
— Block the request (or reset the connection) and generate an alert email and/or log message.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
Default
Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you
must also define an X-header that indicates the original client’s IP (see
). Failure to do so may cause FortiWeb to
block all connections when it detects a violation of this type.
Caution: This setting will be ignored if
is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See
and
Note: If you select an auto-learning profile with this rule, you should select alert. If the action is alert_deny, for example, the FortiWeb appliance will block the request or reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For more information on auto-learning requirements, see
config waf web-protectionprofile autolearning-profile
alert config
446 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf layer4-access-limit-rule
Variable Description
real-browser-enforcement
{enable | disable}
Enable to return a JavaScript to the client to test whether it is a web browser or automated tool when it exceeds the rate limit.
If the client either fails the test or does not return results before the timeout specified by validationtimeout
, FortiWeb applies the specified action. If the client appears to be a web browser, FortiWeb allows the client to exceed the rate limit.
Disable this option to apply the rate limit regardless of whether the client is a web browser (for example, Firefox) or an automated tool (for example, wget).
block-period <seconds_ int> severity {High |
Medium | Low}
Default
disable
Type the number of seconds to block access to the client. This applies only when the action setting is block-period. The valid range is from 0 to 10,000.
0
Select the severity level to use in logs and reports generated when a violation of the rule occurs.
Medium trigger-policy <triggerpolicy_name>
Type the name of the trigger to apply when this rule is violated (see
maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
No default.
validation-timeout
<timeout_int>
Specifies the maximum amount of time that FortiWeb waits for results from the client for Real Browser Enforcement.
Example
This examples includes two rules. One blocks connections for two minutes while the other creates an alert and denies the connection.
config waf layer4-access-limit-rule edit "Web Portal HTTP Request Limit" set access-limit-share-ip 10 set access-limit-standalone-ip 10 set action block-period set block-period 120 set severity Medium set trigger-policy "Web_Protection_Trigger" next edit "Online Store HTTP Request Limit" set access-limit-share-ip 5 set access-limit-standalone-ip 5 set action alert_deny set severity High set trigger-policy "Web_Protection_Trigger"
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
447
waf layer4-connection-flood-check-rule end next
Related topics
l
l
config waf application-layer-dos-prevention
l
config waf layer4-connection-flood-check-rule
config
waf layer4-connection-flood-check-rule
Use this command to limit the number of fully-formed TCP connections per source IP address. This effectively prevents TCP flood-style denial-of-service (DoS) attacks.
TCP flood attacks exploit the fact that servers must consume memory to maintain the state of the open connection until either the timeout, or the client or server closes the connection. This consumes some memory even if the client is not currently sending any HTTP requests.
Normally, a legitimate client forms a single TCP connection, through which they may make several HTTP requests. As a result, each client consumes a negligible amount of memory to track the state of the TCP connection. However, an attacker opens many connections with perhaps zero or one request each, until the server is exhausted and has no memory left to track the TCP states of new connections with legitimate clients.
This feature is similar to
config waf http-connection-flood-check-rule
counts TCP connections per IP, while the other command counts TCP connections per session cookie.
It is also similar to syncookie in
. However, this feature counts fully-
formed TCP connections, while the anti-SYN flood feature counts partially-formed TCP connections.
To apply this rule, include it in an application-layer DoS-prevention policy (see
config waf applicationlayer-dos-prevention
) and include that policy in an inline protection profile.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf layer4-connection-flood-check-rule edit
set
layer4-connection-threshold <limit_int>
set
action {alert | alert_deny | block-period}
set
set set
severity {High | Medium | Low} trigger-policy <trigger-policy_name>
end next
448 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf layer4-connection-flood-check-rule
Variable
<rule_name> layer4-connectionthreshold <limit_int> action {alert | alert_ deny | block-period} block-period <seconds_ int> severity {High |
Medium | Low}
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Type enter the maximum number of TCP connections allowed from the same IP address. The valid range is from 0 to 65,536.
0
Default
No default.
Select one of the following actions that the FortiWeb appliance will perform when the count exceeds the rate limit: l alert
— Accept the connection and generate an alert email and/or log message.
l alert_deny
— Block the connection and generate an alert email and/or log message.
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
Caution: This setting will be ignored if
is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See
and
Note: If an auto-learning profile will be selected in the policy with offline protection profiles that use this rule, you should select alert. If the action is alert_deny, the
FortiWeb appliance will reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For more information on auto-learning requirements, see
config waf web-protection-profile autolearningprofile
alert
Type the length of time for which the FortiWeb appliance will block additional requests after a source IP address exceeds the rate threshold.
The block period is shared by all clients whose traffic originates from the source IP address. The valid range is from 1 to 3,600 seconds (1 hour).
Select the severity level to use in logs and reports generated when a violation of the rule occurs.
1
Medium
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
449
waf padding-oracle
Variable Description
trigger-policy <triggerpolicy_name>
Type the name of the trigger to apply when this rule is violated (see
maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
Default
No default.
config
Example
This example illustrates a basic TCP flood check rule.
config waf layer4-connection-flood-check-rule edit "Web Portal Network Connect Limit" set action alert_deny set layer4-connection-threshold 10 set severity Medium set trigger-policy "Server_Policy_Trigger" end next
Related topics
l
l
config waf application-layer-dos-prevention
l
config waf layer4-access-limit-rule
waf padding-oracle
Use this command to create a policy that protects vulnerable block cipher implementations for web applications that selectively encrypt inputs without using HTTPS.
To apply this policy, include it in an inline web or offline protection profile. For details, see
config waf webprotection-profile inline-protection
or
config waf web-protection-profile offline-protection
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf padding-oracle edit
set action
{alert | alert_deny | block-period}
set block-period set severity
set trigger
config protected-url-list edit
450 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config end end next set
host-status {enable | disable}
set host
set url-type
set protected-url set target
Variable
<padding-oracle_rule_name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing policies, type: edit ?
waf padding-oracle
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
451
waf padding-oracle
Variable
{alert | alert_deny | block-period}
<block-period_int> config
Description
Specify the action that FortiWeb takes when a request violates the rule: l l l alert
— Accept the request and generate an alert email and/or log message.
alert_deny
— Block the request (reset the connection) and generate an alert and/or log message.
block-period
— Block subsequent requests from the client for a number of seconds. Also configure block-period
.
Default
Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, define an X-header that indicates the original client’s IP (see
cause FortiWeb to block all connections when it detects a violation of this type.
Attack log messages contain Padding Oracle
Attack when this feature detects a possible attack.
Because this attack involves some repeated brute force, the attack log may not appear immediately, but should occur within 2 minutes, depending on your configured
DoS alert interval.
Caution: This setting is ignored if the value of monitor-mode is enabled. See
.
Note: Logging and/or alert email occur only when the these features are enabled and configured. See
and
Note: To use this rule set with auto-learning, select alert
. If action is alert_deny or any other option that causes the FortiWeb appliance to terminate or modify the request or reply when it detects an attack attempt, the session information for auto-learning will be incomplete.
Type the number of seconds that FortiWeb blocks subsequent requests from the client after it detects that the client has violated the rule.
This setting is available only if action is blockperiod
.
The valid range is from 1 to 4,294,967,295.
alert
1
452 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
{High | Medium | Low}
<trigger-policy_name>
<entry_index> host-status {enable | disable}
<host_str>
{plain | regular} waf padding-oracle
Description Default
When rule violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field.
Specify the severity level FortiWeb uses when it logs a violation of this rule.
Medium
No default.
Type the name of the trigger policy, if any, that the
FortiWeb appliance uses when it logs and/or sends an alert email about a violation of the rule. See
.
To display the list of existing triggers, type: set trigger ?
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
Specify enable to apply this rule only to HTTP requests for specific web hosts. Also specify host.
Specify disable to match the rule based on the other criteria, such as the URL, but regardless of the Host: field.
disable
Specify which protected host names entry (either a web host name or IP address) that the Host: field of the
HTTP request must be in to match the rule.
This option is available only if the value of hoststatus is enabled.
Maximum length is 255 characters.
Specify how the value of protected-url is specified: l plain
— A literal URL.
l regular
— A regular expression designed to match multiple URLs.
No default.
plain
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
453
waf padding-oracle
Variable
<protected-url_str>
{cookie parameter url} config
Description
If the value of url-type is plain, specify the literal
URL that HTTP requests that match the rule contain.
For example:
/profile.jsp
The URL must begin with a backslash ( / ).
If the value of url-type is regular, specify a regular expression matching all and only the URLs to which the rule should apply.
For example:
^/*\.jsp\?uid\=(.*)
The pattern does not require a slash ( / ).; however, it must at least match URLs that begin with a slash, such as
/profile.cfm
.
Do not include the domain name, such as www.example.com
, which is specified by host.
Regular expressions beginning with an exclamation point
( ! ) are not supported. For information on language and regular expression matching, see the
FortiWeb
Administration Guide
.
Specify which parts of the client’s requests FortiWeb examines for padding attack attempts: l url
— A URL (for example, the parameter
/user/0000012FE03BC2 is embedded in the URL).
l parameter
— A parameter (for example, the parameter
/index.php?user=0000012FE03BC2 appended to a traditional GET or POST body).
l cookie
— A cookie.
Default
No default.
parameter
Example
This example illustrates a padding oracle rule that blocks requests to the host www.example.com when a parameter appended in a traditional GET URL parameter or POST body matches the specified regular expression. When a request matches the expression, FortiWeb logs or sends a high-severity message as specified in the notification-servers1 trigger policy.
config waf padding-oracle edit padding-oracle1 set action block-period set block-period 3600 set severity High set trigger notification-servers1 config protected-url-list
454 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config edit 1 set host-status enable set host www.example.com
set url-type regular set protected-url \/profile\.jsp\?uid\=(.*) set target parameter end
Related topics
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile offline-protection
waf page-access-rule
waf page-access-rule
Use this command to configure page access rules.
Page access rules define URLs that can be accessed only in a
specific order, such as to enforce the business logic of a web application. Requests for other, non-ordered URLs may interleave ordered URLs during the client’s session. Page access rules may be specific to a web host.
For example, an e-commerce application might be designed to work properly in this order:
1. A client begins a session by adding an item to a shopping cart. (/addToCart.do?*)
2. The client either views and adds additional items to the shopping cart, or proceeds directly to the checkout.
3. The client confirms the items that he or she wants to purchase. (/checkout.do)
4. The client provides shipping information. (/shipment.do)
5. The client pays for the items and shipment, completing the transaction. (/payment.do)
Sessions that begin at the shipping or payment stage should therefore be invalid. If the web application does not enforce this rule itself, it could be open to cross-site request forgery (CSRF) attacks on the payment feature. To prevent such abuse, the FortiWeb appliance could enforce the rule itself using a page access rule set with the following order:
1. /addToCart.do?item=*
2. /checkout.do?login=*
3. /shipment.do
4. /payment.do
Attempts to request /payment.do before those other URLs during a session would be denied, and generate an alert and attack log message (see
To apply page access rules, select them within an inline protection profile. For details, see
config waf webprotection-profile inline-protection
Before you configure a page access rule, if you want to apply it only to HTTP requests for a specific real or virtual host, you must first define the web host in a protected hosts group. For details, see
config server-policy allow-hosts
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
455
waf page-access-rule config
You can use SNMP traps to notify you when a page access rule is enforced. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
In order for page access rules to be enforced, you must also enable
http-sessionmanagement {enable | disable}
in the inline protection profile.
Syntax
config waf page-access-rule edit
config page-access-list edit
set
set set
host-status {enable | disable} request-file <url_str> request-type {plain | regular}
end end next set next
Variable
<page-access-rule_name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
<entry_index> host <protected-hosts_ name>
Type the index number of the individual entry in the table.
The valid range is from 1 to 9,999,999,999,999,999,999.
Page access rules should be added to the set in the order which clients will be permitted to access them.
For example, if a client must access /login.asp
before /account.asp, add the rule for /login.asp
first.
Type the name of a protected host that the Host: field of an HTTP request must be in order to match the page access rule. The maximum length is 255 characters.
This setting applies only if host-status is enable.
Default
No default.
No default.
No default.
456 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf page-access-rule
Variable
host-status {enable | disable} request-file <url_str> request-type {plain | regular}
Description
Enable to apply this page access rule only to HTTP requests for specific web hosts. Also configure
.
Disable to match the page access rule based upon the other criteria, such as the URL, but regardless of the
Host: field.
Default
disable
Depending on your selection in
request-type {plain | regular} , type either:
l the literal URL, such as /cart.php, that the HTTP request must contain in order to match the page access rule. The
URL must begin with a slash ( / ).
l a regular expression, such as ^/*.php, matching all and only the URLs to which the page access rule should apply.
The pattern is not required to begin with a slash ( / ).
However, it must at least match URLs that begin with a slash, such as /cart.cfm.
Do not include the name of the web host, such as www.example.com
, which is configured separately in
. The maximum length is
255 characters.
Note: Regular expressions beginning with an exclamation point ( ! ) are not supported. For information on language and regular expression matching, see the
FortiWeb Administration Guide
.
No default.
Select whether
will contain a literal URL
(plain), or a regular expression designed to match multiple
URLs (regular).
plain
Example
This example allows any request to www.example.com, as long as it follows the expected sequence within a session for the four key shopping cart URLs (/addToCart.do, /checkout.do, /shipment.do, then
/payment.do
).
config waf page-access-rule edit "page-access-rule1" config page-access-list edit 1 set host "www.example.com" set host-status enable set request-file "/addToCart.do?item=*" set request-type regular next edit 2 set host "www.example.com"
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
457
waf parameter-validation-rule set host-status enable set request-file "/checkout.do?login=*" set request-type regular next edit 3 set host "www.example.com" set host-status enable set request-file "/shipment.do" set request-type plain next edit 4 set host "www.example.com" set host-status enable set request-file "/payment.do" set request-type plain end next end next
Related topics
l
config server-policy allow-hosts
l
l
config waf web-protection-profile inline-protection
config
waf parameter-validation-rule
Use this command to configure parameter validation rules, each of which is a group of input rule entries.
To apply parameter validation rules, select them within an inline or offline protection profile. For details, see
config waf web-protection-profile inline-protection
or
config waf webprotection-profile offline-protection
Before you can configure parameter validation rules, you must first configure one or more input rules. For details, see
You can use SNMP traps to notify you when a parameter validation rule is enforced. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf parameter-validation-rule edit
config input-rule-list edit
set
end next next
458 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf signature end
Variable
<rule_name>
<entry_index> input-rule <input-rule_ name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
Type the name of an input rule to use in the parameter validation rule. The maximum length is 35 characters.
To display the list of existing input rules, type: set input-rule ?
Default
No default.
No default.
No default.
Example
This example configures a parameter validation rule that applies two input rules.
config waf parameter-validation-rule edit "parameter_validator1" config input-rule-list edit 1 set input-rule "input_rule1" next edit 2 set input-rule "input_rule2" next end end next
Related topics
l
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile offline-protection
waf signature
Use this command to configure server protection rules.
There are several security features specifically designed to protect web servers from known attacks. You can configure defenses against:
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
459
waf signature config l l l l l l l l l l l l l l cross-site scripting (XSS)
SQL injection and many other code injection styles generic attacks known exploits trojans/viruses information disclosure bad robots credit card data leaks
FortiWeb scans:
HTTP headers parameters in the URL of HTTP GET requests parameters in the body of HTTP POST requests
XML in the body of HTTP POST requests (if
xml-protocol-detection {enable | disable}
is enabled) cookies
In addition to scanning standard requests, signatures can also scan action message format 3.0 (AMF3) binary inputs used by Adobe Flash clients to communicate with server-side software and XML. For more information, see
amf3-protocol-detection {enable | disable}
and
malformed-xml-check {enable | disable}
(for inline protection profiles) or
amf3-protocol-detection {enable | disable}
(for offline protection profiles).
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Updating signatures
Known attack signatures can be updated. For information on uploading a new set of attack definitions, see the
FortiWeb Administration Guide
. You can also create your own. See
config waf custom-protectionrule
Configuring signatures
Before configuring a server protection rule, if you want to configure your own attack or data leak signatures, you must also configure custom server protection rules. For details, see
config waf custom-protectiongroup
Each server protection rule can be configured with the severity and notification settings (“trigger”) that, in combination with the action, determines how FortiWeb handles each violation.
For example, attacks categorized as cross-site scripting and SQL injection could have the action set to alert_deny
, the severity set to High, and a trigger set to deliver an alert email each time these rule violations are detected. Specific signatures in those categories, however, might be disabled, set to log/alert instead, or exempt requests to specific host names/URLs.
Alternatively, you can automatically configure a server protection rule that detects all attack types by generating a default auto-learning profile. For details, see the
FortiWeb Administration Guide
.
460 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf signature
Threat scoring
The threat scoring feature allows you to configure your signature policy to take action based on multiple signature violations by a client, instead of a single signature violation. When a client violates a signature in a threat scoring category, it contributes to a combined threat score. When the combined threat score exceeds a maximum value you specify, FortiWeb takes action.
For an overview of the threat scoring mechanism, see the
FortiWeb Administration Guide
.
Overriding signature category configuration
To override category-wide actions for a specific signature, configure: l l l l
— Disable a specific signature ID (e.g. 040000007), even if the category in general
(e.g.
SQL Injection (Extended)) is enabled.
— Disable a subcategory of signatures (e.g.
Session Fixation), even if the category in general (e.g.
General Attacks) is enabled.
— Only log/alert when detecting the attack, even if the category in general is configured to block.
— Exempt specific host name and/or URL combinations from scanning with this signature.
Applying signature policies
To apply server protection rules, select them within an inline or offline protection profile. For details, see
config waf web-protection-profile inline-protection
or
config waf web-protectionprofile offline-protection
You can use SNMP traps to notify you when an attack or data leak has been detected. For details, see
Syntax
config waf signature edit
set set
Security | High-Security | Critical-Security}
set set
scoring-scope {HTTP-Transaction | TCP-Session | HTTP-Session}
scoring-action {alert | alert_deny | redirect | block-period | send_ http_response}
set set set set
[set
] config main_class_list edit
{010000000 | 020000000 | 030000000 | 040000000 | 050000000 |
060000000 | 070000000 | 080000000 | 090000000 | 100000000 |
110000000 | 120000000} fpm-status {enable | disable}
set set set
scoring-status {enable | disable}
action {alert |alert_deny | block-period |only_erase | send_http_ response | alert_erase | redirect}
set set
block-period <seconds_int> severity {Low | Medium | High}
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
461
waf signature config end set next
config signature_disable_list edit
end next config sub_class_disable_list edit
{010000000 | 020000000 | 030000000 | 040000000 | 050000000 |
060000000 | 070000000 | 080000000 | 090000000 | 100000000 |
end next config alert_only_list edit
<alert-only-list_signature-id_str>
end next config fpm_disable_list edit
<fpm-disable-list_signature-id_str>
end next config scoring_override_disable_list edit
<scoring-override-disable-list_signature-id_str>
end next config score_grade_list edit
<score-grade-list_signature-id_str>
set
scoring-grade {Information | Low | Medium | High | Critical}
end next config filter_list edit
set
signature_id <signature-id_str>
set
match-target {HTTP_METHOD | CLIENT_IP | HOST | URI| FULL_URL |
set set
operator {STRING_MATCH | REGEXP_MATCH | EQ | NE| INCLUDE |
EXCLUDE} http-method {get post head options trace connect delete put others}
set set set set set
set next
end end next
462 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf signature
Variable
<signature-set_name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Default
No default.
threat-scoring_mode
{enable | disable}
Specifies whether threat scoring is enabled.
The threat scoring feature allows you to configure your signature policy to trigger an action based on attack or leak detection by multiple signatures, instead of a single signature.
disable scoring-threshold
{Information-Security |
Low-Security | Medium-
Security | High-
Security | Critical-
Security}
Specifies the maximum combined threat score to exceed before FortiWeb takes the specified action.
l
Information-Security
– 10 l
Low-Security
– 7 l
Medium-Security
– 5 l
High-Security
– 4 l
Critical-Security
– 2
Available only when threat-scoring_mode is enable
.
Medium-
Security scoring-scope {HTTP-
Transaction | TCP-
Session | HTTP-Session}
Specifies how FortiWeb calculates the combined threat score before it compares it to the scoringthreshold value.
l
HTTP-Transaction
– FortiWeb compares the score for each transaction to the scoring-threshold value.
l
TCP-Session
– FortiWeb compares the score for each session to the scoring-threshold value. The score can include multiple transactions.
l
HTTP-Session
– FortiWeb compares the score for sessions associated with a specific client to the scoring-threshold value. This option requires http-session-management in the appropriate protection profile to be enable .
Available only when threat-scoring_mode is enable
.
TCP-
Session
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
463
waf signature
Variable Description Default
scoring-action {alert | alert_deny | redirect | block-period | send_ http_response}
Select which action the FortiWeb appliance takes when the combined threat score exceeds the specified threshold.
l alert
— Accept the request and generate an alert email, a log message, or both.
Note: Does not cloak, except for removing sensitive headers. (Sensitive information in the body remains unaltered.) l alert_deny
— Block the request (or reset the connection) and generate an alert email, a log message, or both.
alert
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
l redirect
— Redirect the request to the URL that you specify in the protection profile and generate an alert email, a log message, or both. Also configure
and
.
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you must also define an
X-header that indicates the original client’s IP (see
may cause FortiWeb to block
all connections when it detects a violation of this type.
l send_http_response
— Block and reply to the client with an HTTP error message, and generate an alert email, a log message, or both.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
Caution: FortiWeb ignores this setting if
monitormode {enable | disable}
is enabled.
Available only when threat-scoring_mode is enable
.
config
464 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
scoring-block-period
<seconds_int>
Description
Specifies the number of seconds that FortiWeb blocks subsequent requests from the client after it detects that the client has exceeded the threat score threshold.
The valid range is from 1 to 3,600. The setting is applicable only if scoring-action is periodblock
.
scoring-severity {High
| Medium | Low}
Specifies the severity level value to use when
FortiWeb records threat scoring violations in the attack log, each log message contains a
Severity Level
(severity_level) field.
l
Low l
Medium l
High
Available only when threat-scoring_mode is enable
.
scoring-trigger
Specifies the trigger, if any, that FortiWeb applies when a threat scoring threshold is exceeded (see
length is 35 characters.
To display the list of existing triggers, type: set scoring-trigger ?
Available only when threat-scoring_mode is enable
.
credit-card-detectionthreshold <instances_ int>
Type the number of credit cards that triggers the credit card number detection feature.
For example, to ignore web pages with only one credit card number, but to detect when a web page containing two or more credit cards, enter 2.
The valid range is from 1 to 128 instances.
custom-protection-group
<group_name>
Type the name of the custom signature group to be used, if any. The maximum length is 35 characters.
To display the list of existing custom signature groups, type: set custom-protection-group ?
Default
60 waf signature
Medium
No default.
1
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
465
waf signature
Variable Description
{010000000 |
020000000 | 030000000 |
040000000 | 050000000 |
060000000 | 070000000 |
080000000 | 090000000 |
100000000 | 110000000 |
120000000}
Type the ID of a signature class (or, for subclass overrides, the subclass ID).
To display the list of signature classes, type: edit ?
fpm-status {enable | disable}
For signatures that identify SQL injection attacks, specifies whether FortiWeb performs additional SQL syntax validation.
When this option is enabled and the validation is successful, FortiWeb takes the specified action. If it fails, FortiWeb takes no action.
scoring-status {enable
| disable}
Specifies whether violations of signatures in this category contribute to the combined threat score for the signature policy instead of triggering the specified action.
Available only when threat-scoring_mode is enable
.
Default
No default.
enable disable config
466 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
action {alert |alert_ deny | block-period |only_ erase | send_http_ response | alert_ erase | redirect}
Description
Select which action the FortiWeb appliance will take when it detects a signature match.
Note: This is not a single setting. Available actions may vary slightly, depending on what is possible for each specific type of attack/information disclosure.
l alert
— Accept the request and generate an alert email and/or log message.
Note: Does not cloak, except for removing sensitive headers. (Sensitive information in the body remains unaltered.) l alert_deny
— Block the request (or reset the connection) and generate an alert email and/or log message.
Default
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you
must also define an
X-header that indicates the original client’s IP (see
may cause FortiWeb to block all connections when it detects a violation of this type.
alert l only_erase
— Hide sensitive information in replies from the web server (sometimes called “cloaking”). Block the request or remove the sensitive information, but do not generate an alert email and/or log message.
Caution: This option is not supported in offline protection mode.
l send_http_response
— Block and reply to the client with an HTTP error message, and generate an alert email, a log message, or both l alert_erase
— Hide replies with sensitive information
(sometimes called “cloaking”). Block the reply (or reset the connection) or remove the sensitive information, and generate an alert email and/or log message.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Note: This option is not fully supported in offline protection mode. Effects will be identical to alert; sensitive information will not be blocked or erased.
waf signature
467
waf signature
Variable Description
l redirect
— Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message. Also configure
and
rdt-reason {enable | disable} .
Caution: FortiWeb ignores this setting if
monitormode {enable | disable}
is enabled.
Note: Actions that generate log messages alert email actions require the features to be enabled and configured. See
and
Note: If you select an auto-learning profile in the policy with offline protection profiles that use this rule, select alert
. If the action is alert_deny, the FortiWeb appliance resets the connection when it detects an attack and the session information for the autolearning feature will be incomplete. For more information on auto-learning requirements, see
config waf web-protection-profile autolearning-profile
Default
block-period <seconds_ int>
Type the number of seconds that you want to block subsequent requests from the client after the FortiWeb appliance detects that the client has violated the rule.
The valid range is from 1 to 3,600. The setting is applicable only if action is period-block.
Note: This is not a single setting. You can configure the block period separately for each signature category.
severity {Low |
Medium | High}
When rule violations are recorded in the attack log, each log message contains a
Severity Level
(severity_level) field. Select which severity level the FortiWeb appliance will use when it logs a violation of the rule: l
Low l
Medium l
High
Note: This is not a single setting. You can configure the severity separately for each signature category.
60
Medium config
468 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
trigger <triggerpolicy_name>
<signature-id_str>
Description
Type the name of the trigger, if any, to apply when a protection rule is violated (see
characters.
To display the list of existing triggers, type: set trigger ?
Note: This is not a single setting. You can configure a different trigger for each signature category.
Type the ID of a specific signature that you want to disable.
Some signatures often cause false positives and are disabled by default. To display a list, type: edit ?
<alert-only-list_ signature-id_str>
<fpm-disable-list_ signature-id_str>
Type the ID of a specific signature that generates logs or alert email only and does not block matching requests.
Type the ID of a specific signature for which false positive mitigation is disabled.
The false positive mitigation feature performs additional lexical and syntax analysis after a SQL injection signature matches a request.
<scoring-overridedisable-list_signatureid_str>
Type the ID of a specific signature that is not affected by the threat score settings. When traffic violates this signature, FortiWeb takes the action specified for that signature immediately.
Available only when threat-scoring_mode is enable
.
<score-grade-list_ signature-id_str>
Type the ID of a specific signature that has a custom threat score.
Also specify scoring-grade.
Available only when threat-scoring_mode is enable
.
Default
waf signature
No default.
No default.
No default.
No default.
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
469
waf signature
Variable
scoring-grade
{Information | Low |
Medium | High |
Critical}
Description
Specifies the threat score that the signature adds to the combined threat score for the signature policy.
l
Information
– 1 l
Low
– 2 l
Medium
– 3 l
High
– 4 l
Critical
– 5
Available only when threat-scoring_mode is enable
.
Default
No default.
<entry_index> signature_id
<signature-id_str>
Type the index number of the individual entry in the table.
The valid range is from 1 to 32.
Type the ID of a specific signature that you want to disable when the request matches the specified object.
No default.
No default.
match-target {HTTP_
METHOD | CLIENT_IP |
HOST | URI| FULL_URL |
PARAMETER| COOKIE}
Type the type of object that FortiWeb examines for matching values: l
HTTP_METHOD
— One or more HTTP methods specified by http-method.
l
CLIENT_IP
— The IP address specified by ip.
l
HOST
— The Host: field value specified by value.
l
URI
— The URL value specified by value. The value does not include parameters.
l
FULL_URL
— The URL value specified by value. The value includes parameters to match.
l
PARAMETER
— A parameter specified by name. To match a specific parameter value, enable valuecheck
, and then specify value.
l
COOKIE
— A cookie specified by name. To match a specific cookie value, enable value-check, and then specify value.
config
470 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf signature
Variable Description
operator {STRING_MATCH
| REGEXP_MATCH | EQ |
NE| INCLUDE | EXCLUDE}
Type the type of values to match. The matchtarget value determines which types are available.
l
STRING_MATCH
— value is a literal value (for example, a literal host name).
l
REGEXP_MATCH
— value is a regular expression that matches the object the exception applies to.
l
EQ
— When match-target is CLIENT_IP,
FortiWeb only performs a signature scan for requests with a client IP address that matches the value of ip.
l
NE
— When match-target is CLIENT_IP,
FortiWeb does not perform a signature scan for requests with a client IP address that matches the value of ip.
l
INCLUDE
— When match-target is HTTP_
METHOD
, FortiWeb does not perform a signature scan for requests that include the HTTP methods specified by http-method
.
l
EXCLUDE
— When match-target is HTTP_
METHOD
, FortiWeb only performs a signature scan for requests that include the HTTP methods specified by http-method
.
Default
http-method {get post head options trace connect delete put others} ip {<ipv4> | <ipv6>}
When match-target is HTTP_METHOD, specifies one or more HTTP methods to match.
When match-target is CLIENT_IP, specifies the
IP address to match.
name {name_str | name_ pattern]
Type the name of a parameter or cookie to match.
Whether the value is a literal value or a regular expression is determined by the value of operator.
Available when match-target is PARAMETER or COOKIE.
No default.
No default.
No default.
value-check {enable | disable} value {value_str | value_pattern
Specifies whether matching requests match a specified parameter or cookie value as well as the specified parameter or cookie name.
Type the value to match (for example, a Host: field value). Whether the value is a literal value or a regular expression is determined by the value of operator.
disable
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
471
waf signature
Variable Description Default
concatenate-type {AND |
OR} l
AND
— A matching request matches this entry in addition to other entries in the list.
l
OR
—A matching request matches this entry or other entries in the list.
AND comment "<comment_str>" Type a description or other comment.
No default.
config
Example
This example enables both the Trojans (070000000) and XSS (010000000) classes of signatures, setting them to result in attack logs with a severity_level field of High, and using the email and SNMP settings defined in notification-servers1. It also enables use of custom attack and data leak signatures in the set named custom-signature-group1.
This example disables by ID a signature that is known to cause false positives (080200001). It also makes an exception (config filter_list) by ID for a specific signature (070000001) for a URL (/virus-sampleupload
) on a host (www.example.com) that is used by security researchers to receive virus samples.
config waf signature edit "attack-signatures1" set custom-protection-group "custom-signature-group1" config main_class_list edit "010000000" set severity High set trigger "notification-servers1" next edit "070000000" set severity High set trigger "notification-servers1" end next config signature_disable_list edit "080200001" end next config filter_list edit 1 set signature_id "070000001" set match-target HOST set value "www.example.com" next edit 2 set signature_id "070000001" set match-target URI set value "/virus-sample-upload" end next end next
472 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf site-publish-helper authentication-server-pool
Related topics
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile offline-protection
l
l
config waf custom-protection-group
l
waf site-publish-helper authentication-server-pool
Use this command to create a pool of authentication server connections for use with a site publishing rule.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
config waf site-publish-helper authentication-server-pool edit
<authentication-server-pool_name>
edit
set
set
set
radius-server <radius-query_name>
set
rsa-securid {enable | disable}
end end next
Variable
<authentication-serverpool_name>
Description
Type the name of a new or existing authentication server pool. The maximum length is 35 characters.
To display the list of existing pools, type: edit ?
Default
No default.
<entry_index>
Type the index number of a new or existing server entry in the authentication server pool.
No default.
server-type {ldap | radius}
Set the server type to the server entry <entry_index>.
Type ldap for a LDAP server or radius for a RADIUS server.
ldap ldap-server <ldap-query_ name>
Set the name of the LDAP query to the server entry <entry_ index> if you set the server entry as LDAP. See the
.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
473
waf site-publish-helper keytab_file config
Variable
radius-server <radiusquery_name> rsa-securid {enable | disable}
Description
Set the name of the RADIUS query to the server entry
<entry_index> if you set the server entry as RADIUS. See the
Default
No default.
Specify whether FortiWeb authenticates clients using a username and a RSA SecurID authentication code only.
Users are not required to enter a password.
When this option is enabled, the authentication delegation options in the site publish rule are not available.
Available only if
is radius and
client-auth-method {html-form-auth | http-auth | client-cert-auth}
is html-form-auth.
disable
Example
For an example, see
config waf site-publish-helper rule
.
Related topics
l
config waf site-publish-helper rule
waf site-publish-helper keytab_file
Use this command to group together web applications that you want to publish.
waf site-publish-helper policy
Use this command to group together web applications that you want to publish.
Before you configure site publishing policies, you must first define the individual sites that will be a part of the group. For details, see
config waf site-publish-helper rule
To apply this policy, include it in an inline web protection profile. See
config waf web-protectionprofile inline-protection
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf site-publish-helper policy edit
set
account-lockout {enable | disable}
474 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf site-publish-helper policy set
lockout-threshold <lockout-threshold_int>
set
account-block-period <account-block-period_int>
set
config rule edit
set
rule-name <site-publish-rule_name>
end next end next
Variable
<site-publish-policy_ name>
Description
Type the name of a new or existing policy. The maximum length is 35 characters.
To display the list of existing policies, type: edit ?
Default
No default.
account-lockout {enable
| disable}
Enable or disable Account Lockout to prevent account cracking by locking an account out after several failures logging into
FortiWeb.
disable lockout-threshold
<lockout-threshold_int>
Set the threshold of login failure. FortiWeb will trigger lockout to the account if number of login failure exceeds the threshold
during the specified time period ( reset-time <resettime_int>
).
5 account-block-period
<account-block-period_ int>
Set the time period (in minutes) that FortiWeb locks out an account for. No more login is accepted for the locked account during the period.
reset-time <reset-time_ int>
Set the time period (in minutes) for FortiWeb counting the login failures and judging lockout to accounts. Count of login failure of an account will be reset when the time period is up.
60
3
<entry_index>
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
rule-name <site-publishrule_name>
Type the name of an existing rule.
No default.
Example
For an example, see
config waf site-publish-helper rule
.
Related topics
l
config waf site-publish-helper rule
l
config waf web-protection-profile inline-protection
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
475
waf site-publish-helper rule
waf site-publish-helper rule
Use this command to configure access control, authentication, and, optionally, SSO for your web applications.
If: l l your users access multiple web applications on your domain, and you have defined accounts centrally on an LDAP (such as Microsoft Active Directory) or RADIUS server you may want to configure single sign-on (SSO) and combination access control and authentication (called “site publishing” in the GUI) instead of configuring simple HTTP authentication rules. SSO provides a benefit over
HTTP authentication rules: your users do not need to authenticate each time they access separate web applications in your domain. When FortiWeb receives the first request, it will return (depending on your configuration) an HTML authentication form or HTTP WWW-Authenticate: code to the client.
config
476
FortiWeb sends the client’s credentials in a query to the authentication server. Once the client is successfully authenticated, if the web application supports HTTP authentication and you have configured delegation,
FortiWeb forwards the credentials to the web application. The server’s response is returned to the client. Until the session expires, subsequent requests from the client to the same or other web applications in the same domain do not require the client to authenticate..
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf site-publish-helper rule
For example, you may prefer SSO if you are using FortiWeb to replace your discontinued Microsoft Threat
Management Gateway, using it as a portal for multiple applications such as SharePoint, Outlook Web
Application, and/or IIS. Your users will only need to authenticate once while using those resources.
Before you configure site publishing, you must first define the queries to your authentication server. For details, see
or
config server-policy custom-application applicationpolicy
FortiWeb supports the following additional site publishing options: l l l
RADIUS authentication that requires users to provide a secondary password, PIN, or token code in addition to a username and password (two-factor authentication)
RADIUS authentication that allows users to authenticate using their username and RSA SecurID token code only
(no password)
Regular Kerberos authentication delegation and Kerberos constrained delegation
For more information on these options, see the descriptions of the individual site publishing rule settings and the
FortiWeb Administration Guide
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf site-publish-helper rule edit
set set
status {enable | disable} req-type {plain | regular}
set set
set
client-auth-method {html-form-auth | http-auth | client-cert-auth}
[set
logoff-path-type {plain | regular}
[set set
Published-Server-Logoff-Path <url_str> cookie-timeout <timeout_int>
set
auth-server-pool <authentication-server-pool_name>
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
477
waf site-publish-helper rule config set
auth-delegation {http-basic | kerberos | kerberos-constraineddelegation | no-delegation}
set set set set set
field-name {subject | SAN} attribution-name {email | UPN}
delegated-spn <delegated-spn_str> keytab-file <keytab_file> delegator-spn <delegator-spn_str>
set set
prefix-support {enable | disable} prefix-domain <prefix-domain_str>
set set
alert-type {all | fail | none | success} sso-support {enable | disable}
end set
set
exchage-activesync {enable | disable}
next
Variable
<site-publish-rule_ name> status {enable | disable} req-type {plain | regular} published-site <host_ fqdn>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Default
No default.
Enable to activate this rule.
This can be used to temporarily deactivate access to a single web application without removing it from a site publishing policy.
enable
Select whether
contains a literal FQDN (plain), or a regular expression designed to match multiple host names or fully qualified domain names
(regular).
plain
Depending on your selection in
, type either: l the literal Host: name, such as sharepoint.example.com
, that the HTTP request must contain in order to match the rule.
l a regular expression, such as ^*\.example\.edu, matching all and only the host names to which the rule should apply.
The maximum length is 255 characters.
Note: Regular expressions beginning with an exclamation point ( ! ) are not supported. For information on language and regular expression matching, see the
FortiWeb Administration Guide
.
No default.
478 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf site-publish-helper rule
Variable
path <url_str>
Description
Type the URL of the request for the web application, such as /owa. It must begin with a forward slash ( / ).
Default
No default.
client-auth-method
{html-form-auth | httpauth | client-certauth}
Specify one of the following options: l html-form-auth
— FortiWeb authenticates clients by presenting an HTML web page with an authentication form l http-auth
— FortiWeb authenticates clients by providing an HTTP AUTH code so that the browser displays its own dialog.return an HTTP AUTH code so that the browser displays its own dialog.
l client-cert-auth
— FortiWeb validates the HTTP client’s personal certificate using the certificate verifier specified in the associated server policy or server pool configuration.
Used when
auth-delegation {http-basic | kerberos | kerberos-constrained-delegation | no-delegation}
is kerberos or no-delegation.
If exchage-activesync is enable, only http_ auth is allowed here.
Note: This option requires you to select a value for
sslclient-verify <verifier_name>
in the server policy or
certificate-verify <verifier_name>
in the server pool configuration.
html-formauth logoff-path-type
{plain | regular}
Specify whether Published-Server-Logoff-Path contains a literal URL (plain), or a regular expression designed to match multiple URLs (regular).
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
479
waf site-publish-helper rule
Variable
Published-Server-
Logoff-Path <url_str> cookie-timeout
<timeout_int>
Description
This setting appears only if
client-auth-method {htmlform-auth | http-auth | client-cert-auth}
is htmlform-auth
.
Depending on the value of logoff-path-type, enter one of the following values: l the literal URL of the request that a client sends to log out of the application (for example,
/owa/auth/logoff.aspx
.
l a regular expression that matches the request that a client sends to log out of the application.
Ensure that the value is a sub-path of the path value. For example, if path is /owa ,
/owa/auth/logoff.aspx
is a valid value.
When a client logs out of the web application,
FortiWeb redirects the client to its authentication dialog.
Note:Regular expressions beginning with an exclamation point ( ! ) are not supported. For information on language and regular expression matching, see the
FortiWeb Administration Guide
.
Specify the length of time that passes before the cookie that the site publish rule adds expires and the client must re-authenticate.
Valid values are from 0 to 3600 hours.
If exchage-activesync is enable, this must be
0
.
To configure the cookie with no expiration, specify 0
(the default). The browser only deletes the cookie when the user closes all browser windows.
Default
No default.
0 auth-server-pool
<authentication-serverpool_name>
Enter the name of the pool of servers that FortiWeb uses to authenticate clients. See the
waf site-publish-helper authentication-server-pool
.
No default.
config
480 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf site-publish-helper rule
Variable
auth-delegation {httpbasic | kerberos | kerberos-constraineddelegation | nodelegation}
Description Default
Specify one of the following options: l http-basic
— Use HTTP Authorization: headers with Base64 encoding to forward the client’s credentials to the web application. Typically, you should select this option if the web application supports HTTP
protocolbased authentication.
nodelegation
Available only if
client-auth-method {html-form-auth | http-auth | client-cert-auth}
is html-form-auth or http-auth
.
l kerberos
— After it authenticates the client via the
HTTP form or HTTP basic method, FortiWeb obtains a
Kerberos service ticket for the specified web application on behalf of the client. It adds the ticket to the HTTP
Authorization: header of the client request with
Base64 encoding.
Available only if
client-auth-method {html-form-auth | http-auth | client-cert-auth}
is html-form-auth or http-auth
.
l kerberos-constrained-delegation
— After it authenticates the client’s certificate, FortiWeb obtains a
Kerberos service ticket for the specified web application on behalf of the client. It adds the ticket to the HTTP
Authorization: header of the client request with
Base64 encoding.
Available only if
client-auth-method {html-form-auth | http-auth | client-cert-auth}
is client-cert-auth.
l no-delegation
— FortiWeb does not send the client’s credentials to the web application.
Select this option when the web application has no authentication of its own or uses HTML form-based authentication.
Note: If the web application uses HTML form-based authentication, the client is required to authenticate twice: once with FortiWeb and once with the web application’s form.
If exchage-activesync is enable, only no_ delegation or http-basic is allowed here.
Not available when
is enable
.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
481
waf site-publish-helper rule
Variable
field-name {subject |
SAN} attribution-name
{email | UPN}
Description
Use one of the following options to specify the certificate information that FortiWeb uses to determines the client username: l subject
— The email address value in the certificate’s
Subject information.
Default
For
attribution-name {email | UPN} , select email.
l
SAN
— The certificate’s subjectAltName (Subject
Alternative Name or SAN) and either the User Principal
Name (UPN) or the email address value in the certificate’s
Subject information.
SAN
For
attribution-name {email | UPN} , select UPN or email.
In certificates issued in a Windows environment, the certificate’s SAN and UPN contain the username. For example: username@domain
Available only when
auth-delegation {http-basic | kerberos | kerberos-constrained-delegation | nodelegation}
is kerberos-constraineddelegation
.
Use one of the following options to specify the certificate information that FortiWeb uses to determines the client username: l email
— The email address value in the certificate’s Subject information.
l
For
, specify subject or
SAN
.
UPN
— The User Principal Name (UPN) value.
UPN
For
, specify SAN.
Note: Because the email value can be an alias rather than the real DC (domain controller) domain, the most reliable method for determining the username is SAN and UPN.
Available only when
auth-delegation {http-basic | kerberos | kerberos-constrained-delegation | nodelegation}
is kerberos-constraineddelegation
.
config
482 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
delegated-spn
<delegated-spn_str> keytab-file <keytab_ file> delegator-spn
<delegator-spn_str>
Description
Specify the Service Principal Name (SPN) for the web application that clients access using this site publish rule.
A service principal name uses the following format:
<service_type >/<instance_ name>:<port_number>/
<service_name>
For example, for an Exchange server that belongs to the domain dc1.com and has the hostname
USER-U3LOJFPLH1
, the SPN is http/USER-
.
Available only when
auth-delegation {http-basic | kerberos | kerberos-constrained-delegation | nodelegation}
is kerberos or kerberosconstrained-delegation
.
Specify the keytab file configuration for the AD user that FortiWeb uses to obtain Kerberos service tickets for clients.
See
config waf site-publish-helper keytab_file
Available only when
auth-delegation {http-basic | kerberos | kerberos-constrained-delegation | nodelegation}
is kerberos-constraineddelegation
.
Specify the Service Principal Name (SPN) that you used to generate the keytab specified by
This is the SPN of the AD user that FortiWeb uses to obtain a Kerberos service tickets for clients.
Available only when
auth-delegation {http-basic | kerberos | kerberos-constrained-delegation | nodelegation}
is kerberos-constraineddelegation
.
waf site-publish-helper rule
Default
No default.
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
483
waf site-publish-helper rule
Variable
prefix-support
{enable | disable}
Description
Enable to allow users in environments that require users to log in using both a domain and username to log in with just a username. Also specify
prefixdomain <prefix-domain_str>
In some environments, the domain controller requires users to log in with the username format domain\username
. For example, if the domain is example.com
and the username is user1, the user enters EXAMPLE\user1.
Alternatively, enable this option and enter EXAMPLE for
prefix-domain <prefix-domain_str>
. The user enters user1 for the username value and FortiWeb automatically adds EXAMPLE\ to the HTTP
Authorization: header before it forwards it to the web application.
Available only when
auth-delegation {http-basic | kerberos | kerberos-constrained-delegation | nodelegation}
is http-basic or kerberos.
Default
enable prefix-domain <prefixdomain_str>
Enter a domain name that FortiWeb adds to the HTTP
Authorization: header before it forwards it to the web application.
Available only when
prefix-support {enable | disable}
is enabled.
If auth-delegation is kerberos, ensure that the string is the full domain name (for example, example.com
).
No default.
sso-domain <domain_str> Type the domain suffix of Host: names that will be allowed to share this rule’s authentication sessions, such as
.example.com
. Include the period ( . ) that precedes the host’s name.
No default.
config
484 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
sso-support {enable | disable} alert-type {all | fail | none | success}
Description
Enable for single sign-on support.
For example, if this web site is www1.example.com
and the SSO domain is .example.com, once a client has authenticated with that site, it can access www2.example.com
without authenticating a second time.
Site publishing SSO sessions exist on FortiWeb only; they are not synchronized to the authentication and/or accounting server, and therefore SSO is not shared with non-web applications. For SSO with other protocols, consult the documentation for your
FortiGate or other firewall.
If exchage-activesync is enable, this must be disable
.
Select which site publishing-related authentication events the FortiWeb appliance will log and/or send an alert email about.
l all l fail l success l none
Event log messages contain the user name, authentication type, success or failure, and source address (for example, User jdoe [Site
Publish] login successful from
172.0.2.5
) when an end-user successfully authenticates. A similar message is recorded if the authentication fails (for example, User hackers
[Site Publish] login failed from
172.0.2.5
).
Note: Logging and/or alert email occurs only if it is enabled and configured. See
and
waf site-publish-helper rule
Default
disable none
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
485
waf site-publish-helper rule
Variable
exchage-activesync
{enable | disable}
Description
Enable to allow Android clients to access to Microsoft
Exchange servers through Exchange ActiveSync protocol.
Note: If this is enabled, the restrictions are as followings: l only http_auth is allowed for client-authmethod l l l sso-support must be disable cookie-timeout must be 0 only no_delegation or http-basic is allowed for auth-delegation
Default
disable config
Example
This example configures a site publisher with SSO for both Outlook and Sharepoint on the example.com domain.
config waf site-publish-helper authentication-server-pool edit "LDAP server pool" edit 1 set server-type ldap end set ldap-server "LDAP query 1" end next config waf site-publish-helper authentication-server-pool edit "RADIUS server pool" edit 1 set server-type radius end set ldap-server "RADIUS query 1" end next config waf site-publish-helper rule edit "Outlook" set published-site ^*\.example\.edu
set auth-server-pool "LDAP server pool" set auth-delegation http-basic set sso-support enable set sso-domain .example.edu
set path /owa set alert-type fail set Published-Server-Logoff-Path /owa/auth/logoff.aspx?Cmd=logoff next edit "Sharepoint" set published-site ^*\\.example\\.edu
set req-type regular set auth-server-pool "RADIUS server pool" set auth-delegation http-basic set sso-support enable set sso-domain .example.edu
486 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config set path /sharepoint set alert-type fail end next config waf site-publish-helper policy edit "example_com_apps" config rule edit 1 set rule-name Outlook next edit 2 end end next set rule-name Sharepoint next
Related topics
l
config waf site-publish-helper policy
l
config waf site-publish-helper authentication-server-pool
l
l
config server-policy allow-hosts
l
config waf web-protection-profile inline-protection
waf start-pages
waf start-pages
Use this command to configure start page rules.
When a start page group is selected in the inline protection profile, HTTP clients must begin from a valid start page in order to initiate a valid session.
For example, you may wish to specify that HTTP clients of an e-commerce web site must begin their session from either an item view or the first stage of the shopping cart checkout, and cannot begin a valid session from the third stage of the shopping cart checkout.
To apply start pages, select them within an inline protection profile. For details, see
config waf webprotection-profile inline-protection
Before you configure a start page rule, if you want to apply it only to HTTP requests for a specific real or virtual host, you must first define the web host in a protected hosts group. For details, see
config server-policy allow-hosts
You can use SNMP traps to notify you when a start page rule is enforced. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf start-pages edit
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
487
waf start-pages config set
action {alert | alert_deny | block-period | redirect | send_403_ forbidden}
set set set
severity {Low | Medium | High} trigger <trigger-policy_name>
config start-page-list edit
set set set set set end next end next
host <protected-hosts_name> host-status {enable | disable} request-file <url_str>
request-type {plain | regular} default {yes | no}
Variable
<start-page-rule_name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Default
No default.
488 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf start-pages
Variable
action {alert | alert_ deny | block-period | redirect | send_403_ forbidden} block-period <seconds_ int>
Description
Select one of the following actions that the FortiWeb appliance will perform when an HTTP request that initiates a session does not begin with one of the allowed start pages.
l alert
— Accept the request and generate an alert email and/or log message.
l alert_deny
— Block the request (or reset the connection) and generate an alert email and/or log message.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
l block-period
— Block subsequent requests from the client for a number of seconds. Also configure
Default
Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you
must also define an X-header that indicates the original client’s IP (see
). Failure to do so may cause FortiWeb to
block all connections when it detects a violation of this type.
l redirect
— Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message. Also configure
and
.
l send_403_forbidden
— Reply to the client with an
HTTP 403 Access Forbidden error message and generate an alert email and/or log message.
Caution: This setting will be ignored if
is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See
and
Note: If you select an auto-learning profile with this rule, you should select alert. If the action is alert_ deny
, for example, the FortiWeb appliance will block the request or reset the connection when it detects an attack, resulting in incomplete session information for the autolearning feature. For more information on auto-learning requirements, see
config waf web-protectionprofile autolearning-profile
No default.
If action is block-period, type, specify the number of seconds that the connection will be blocked. The valid range is from 1 to 3,600 seconds.
1
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
489
waf start-pages
Variable Description
severity {Low | Medium |
High}
Select the severity level to use in logs and reports generated when a violation of the rule occurs.
trigger <trigger-policy_ name>
Type the name of the trigger to apply when this rule is violated (see
maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
<entry_index> host <protected-hosts_ name> host-status {enable | disable} request-file <url_str>
Default
Low
No default.
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
Type the name of a protected host that the Host: field of an HTTP request must be in order to match the start page rule. The maximum length is 255 characters.
This setting applies only if host-status is enable.
No default.
Enable to apply this start page rule only to HTTP requests for specific web hosts. Also configure
.
Disable to match the start page rule based upon the other criteria, such as the URL, but regardless of the Host: field.
disable
Depending on your selection in
request-type {plain | regular} , type either:
l the literal URL, such as /index.php, that the HTTP request must contain in order to match the start page rule.
The URL must begin with a slash ( / ).
l a regular expression, such as ^/*.php, matching all and only the URLs to which the start page rule should apply. The pattern is not required to begin with a slash ( / ). However, it must at least match URLs that begin with a slash, such as
/index.cfm
.
Do not include the name of the web host, such as www.example.com
, which is configured separately in
. The maximum length is
255 characters.
Note: Regular expressions beginning with an exclamation point ( ! ) are not supported. For information on language and regular expression matching, see the
FortiWeb Administration Guide
.
No default.
config
490 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf url-access url-access-policy
Variable
request-type {plain | regular} default {yes | no}
Description
Select whether
will contain a literal URL
(plain), or a regular expression designed to match multiple
URLs (regular).
Default
plain
Type yes to use the page as the default for HTTP requests that either: l l do not specify a URL do not specify the URL of a valid start page (only if you have selected redirect from action)
Otherwise, type no.
no
Example
This example redirects clients to the default start page, /index.html, if clients request a page that is not one of the valid start pages (/index.html or /cart/login.jsp). Redirection will occur only if the request is destined for one of the virtual or real hosts defined in the protected hosts group named example_com_hosts.
config waf start-pages edit "start-page-rule1" edit 1 set host "example_com" set host-status enable set request-file "/index.html" set default yes next edit 2 set host "example_com_hosts" set host-status enable set request-file "/cart/login.jsp" set default no next end next
Related topics
l
l
config server-policy allow-hosts
l
config waf web-protection-profile inline-protection
l
waf url-access url-access-policy
Use this command to configure a set of URL access rules that define HTTP requests that are allowed or denied.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
491
waf url-access url-access-policy config
Before using this command, you must first define your URL access rules (see
config waf url-access url-access-rule
To apply URL access policies, select them within an inline or offline protection profile. For details see
config waf web-protection-profile inline-protection
or
config waf web-protectionprofile offline-protection
You can use SNMP traps to notify you when a URL access rule is enforced. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf url-access url-access-policy edit
config rule edit
set
url-access-rule-name <url-access-rule_name>
end next end next
Variable Description
<url-access-policy_name>
Type the name of the new or existing URL access policy.
The maximum length is 35 characters.
To display the list of existing policies, type: edit ?
<entry_index> url-access-rule-name
<url-access-rule_name>
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
Type the name of the existing URL access rule to add to the policy. The maximum length is 35 characters.
Default
No default.
No default.
No default.
Example
This example adds two rules to the policy, with the first one set to priority level 0, and the second one set to priority level 1. The rule with priority 0 would be applied first.
config waf url-access url-access-policy edit "URL-access-set2" config rule edit 1 set url-access-rule-name "URL Access Rule 1" next edit 2 set url-access-rule-name "Blocked URL" next next
492 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config end
Related topics
l
config waf url-access url-access-rule
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile offline-protection
waf url-access url-access-rule
waf url-access url-access-rule
Use this command to configure URL access rules that define the HTTP requests that are allowed or denied based on their host name and URL.
Typically, for example, access to administrative panels for your web application should only be allowed if the client’s source IP address is an administrator’s computer on your private management network. Unauthenticated access from unknown locations increases risk of compromise. Best practice dictates that such risk should be minimized.
To apply URL access rules, first group them within a URL access policy. For details see,
config waf urlaccess url-access-policy
You can use SNMP traps to notify you when a URL access rule is enforced. For details, see
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf url-access url-access-rule edit
<url-access-rule_name> action {alert_deny | continue | pass}
set set set set set
host-status {enable | disable} severity {Low | Medium | High} trigger <trigger-policy_name>
config match-condition edit
set set end next end next set set set set set set set set
sip-address-check {enable | disable} sip-address-type {sip | sdomain | source-domain}
reg-exp <object_pattern> reverse-match {yes | no}
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
493
waf url-access url-access-rule
Variable
<url-access-rule_name> action {alert_deny | continue | pass} host <protected-hosts_ name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Default
No default.
Select which action the FortiWeb appliance will take when a request matches the URL access rule.
l alert_deny
— Block the request (or reset the connection) and generate an alert email and/or log message.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb
Administration Guide
or
l continue
— Generate an alert and/or log message, then continue by evaluating any subsequent rules defined in the web protection profile (see
). If no other rules are violated, allow the request. If
multiple rules are violated, a single request will generate multiple attack log messages.
l pass
— Allow the request. Do not generate an alert and/or log message.
Caution: This setting will be ignored if
is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See
and
Note: If an auto-learning profile will be selected in the policy with offline protection profiles that use this rule, you should select pass. If the action is alert_deny, the FortiWeb appliance will reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For more information on auto-learning requirements, see
config waf web-protection-profile autolearningprofile
alert
Type the name of a protected host that the Host: field of an HTTP request must be in order to match the rule.
The maximum length is 255 characters.
This setting is used only if host-status is enable.
No default.
config
494 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf url-access url-access-rule
Variable
host-status {enable | disable}
Description
Enable to require that the Host: field of the HTTP request match a protected hosts entry in order to match the rule. Also configure
.
severity {Low | Medium |
High}
When rule violations are recorded in the attack log, each log message contains a Severity Level (severity_ level
) field. Select which severity level the FortiWeb appliance will use when a blacklisted IP address attempts to connect to your web servers: l
Low l
Medium l
High
Default
disable
No default.
trigger <trigger-policy_ name>
Select which trigger, if any, that the FortiWeb appliance will use when it logs and/or sends an alert email about a blacklisted IP address’s attempt to connect to your web servers (see
). The maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
No default.
<entry_index>
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
sip-address-check
{enable | disable}
Enable to add the client’s source IP address as a criteria for matching the URL access rule. Also configure
{sip | sdomain | source-domain}
and the specific settings for each source address type.
disable sip-address-type {sip | sdomain | source-domain} l sip
— Configure
sip-address-value <client_ip> .
l sdomain
— Configure
and
sipaddress-domain <fqdn_str> .
l source-domain
— Configure
{simple-string | regex-expression}
and
.
sip
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
495
waf url-access url-access-rule
Variable
sip-address-value
<client_ip> sdomain-type {ipv4 | ipv6}
Description
Enter one of the following values: l
A single IP address that a client source IP must match, such as a trusted private network IP address (e.g. an administrator’s computer, 172.16.1.20).
l
A range or addresses (for example, 172.22.14.1-
172.22.14.255
or 10:200::10:1-
10:200:10:100
).
Available only if
sip-address-type {sip | sdomain | sourcedomain}
is sip.
Specifies the type of IP address FortiWeb retrieves from the DNS lookup of the domain specified by
sipaddress-domain <fqdn_str> .
Available only if
sip-address-type {sip | sdomain | sourcedomain}
is sdomain.
Default
0.0.0.0
No default.
sip-address-domain
<fqdn_str>
Specifies the domain to match the client source IP after
DNS lookup.
Available only if
sip-address-type {sip | sdomain | sourcedomain}
is sdomain.
No default.
source-domain-type
{simple-string | regexexpression} l simple-string
— source-domain specifies a literal domain.
l regex-expression
— source-domain specifies a regular expression that is designed to match multiple URLs.
Available only if
sip-address-type {sip | sdomain | sourcedomain}
is source-domain.
simplestring source-domain <sourcedomain_str>
Enter a literal domain or a regular expression that is designed to match multiple URLs.
Available only if
sip-address-type {sip | sdomain | sourcedomain}
is sdomain.
No default.
type {regex-expression | simple-string}
Select how to use the text in
to determine whether or not a request URL meets the conditions for this rule.
l simple-string
— The text is a string that request URLs must match exactly.
l regular-expression
— The text is a regular expression that defines a set of matching URLs.
No default.
config
496 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf url-access url-access-rule
Variable Description
reg-exp <object_pattern>
Depending on your selection in
type {regex-expression | simple-string}
and
, type a regular expression that defines either all matching or all nonmatching URLs. Then, also configure reverse-match
{yes | no}
.
For example, for the URL access rule to match all URLs that begin with /wordpress, you could enter
^/wordpress
, then, in reverse-match
{yes | no}
, select no.
The pattern is not required to begin with a slash ( / ). The maximum length is 255 characters.
Note: Regular expressions beginning with an exclamation point ( ! ) are not supported. Instead, use reverse-match {yes | no}
.
reverse-match {yes | no}
Indicate how to use
when determining whether or not this rule’s condition has been met.
l no
— If the simple string or regular expression
does match the request URL, the condition is met.
l yes
— If the simple string or regular expression does
not
match the request URL, the condition is met.
The effect is equivalent to preceding a regular expression with an exclamation point ( ! ).
Default
No default.
no
Example
This example defines two sets of URL access rules.
The first set, Blocked URL, defines two URL match conditions: one uses a simple string to match an administrative page, and the other uses a regular expression to match a set of dynamic URLs for statistics pages.
The second set, Allowed URL, defines a single match condition that uses a regular expression to match all dynamic forms of the index page.
Actual blocking or allowing of the URLs, however, would not occur until a policy applies these URL access rules, and sets an action that the FortiWeb appliance will perform when an HTTP request matches either rule set.
config waf url-access url-access-rule edit "Blocked URL" config match-condition edit 1 set type simple-string set reg-exp "/admin.php" next edit 2 set type regular-expression set reverse-match no
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
497
waf url-rewrite url-rewrite-policy end next set reg-exp "statistics.php*" next edit "Allowed URL" config match-condition edit 1 end end next set type regular-expression set reverse-match no set reg-exp "index.php*" next
Related topics
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile offline-protection
l
config waf url-access url-access-policy
config
waf url-rewrite url-rewrite-policy
Use this command to group URL rewrite rules.
Before you can configure a URL rewrite group, you must first configure any URL rewriting rules that you want to include. For details, see
config waf url-rewrite url-rewrite-rule
To apply a URL rewriting group, select it in an inline protection profile. For details, see
config waf webprotection-profile inline-protection
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf url-rewrite url-rewrite-policy edit
config rule edit
set
url-rewrite-rule-name <url-rewrite-rule_name>
next end end next
498 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf url-rewrite url-rewrite-rule
Variable Description
<url-rewrite-group_name>
Type the name of the URL rewriting rule group. The maximum length is 35 characters.
To display the list of existing group, type: edit ?
<entry_index> url-rewrite-rule-name
<url-rewrite-rule_name>
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
Type the name of an existing URL rewriting rule that you want to include in the group. The maximum length is 35 characters.
Default
No default.
No default.
No default.
Related topics
l
config waf url-rewrite url-rewrite-rule
l
config waf web-protection-profile inline-protection
waf url-rewrite url-rewrite-rule
Use this command to configure URL rewrite rules or to redirect requests.
Rewriting or redirecting HTTP requests and responses is popular, and can be done for many reasons.
Similar to error message cloaking, URL rewriting can prevent the disclosure of underlying technology or web site structures to HTTP clients.
For example, when visiting a blog web page, its URL might be: http://www.example.com/wordpress/?feed=rss2
Simply knowing the file name, that the blog uses PHP, its compatible database types, and the names of parameters via the URL could help an attacker to craft an appropriate attack for that platform. By rewriting the
URL to something more human-readable and less platform-specific, the details can be hidden: http://www.example.com/rss2
Aside from for security, rewriting and redirects can be for aesthetics or business reasons. Financial institutions can transparently redirect customers that accidentally request HTTP: http://bank.example.com/login to authenticate and do transactions on their secured HTTPS site: http s://bank.example.com/login
Additional uses could include: l l
During maintenance windows, requests can be redirected to a read-only server.
International customers can use global URLs, with no need to configure the back-end web servers to respond to additional HTTP virtual host names.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
499
waf url-rewrite url-rewrite-rule config l
Shorter URLs with easy-to-remember phrases and formatting are easier for customers to understand, remember, and return to.
Much more than their name implies, “URL rewriting rules” can do all of those things, and more: l l l l l l l l redirect HTTP requests to HTTPS rewrite the URL line in the header of an HTTP request rewrite the Host: field in the header of an HTTP request rewrite the Referer: field in the header of an HTTP request redirect requests to another web site send a 403 Forbidden response to a matching HTTP requests rewrite the HTTP location line in the header of a matching redirect response from the web server rewrite the body of an HTTP response from the web server
Rewrites/redirects are not supported in all modes. See the
FortiWeb Administration
Guide
.
To use a URL rewriting rule, add it to a policy. For details, see
config waf url-rewrite url-rewritepolicy
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf url-rewrite url-rewrite-rule edit
set
set
set
header-status {enable | disable}
set
header-value <header-value_str>
set
host {<server_fqdn> | <server_ipv4> | <host_pattern>} host-status {enable | disable}
set set set set set set set set set set
referer-status {enable | disable} referer <referer-url_str> referer-use-pserver {enable | disable}
analyzer-policy <fortianalyzer-policy_name>
config match-condition edit
set
content-filter {enable | disable}
set set
set
set
object {http-host | http-reference | http-url}
500 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf url-rewrite url-rewrite-rule end end next set set set next
protocol-filter {enable | disable}
reg-exp <object_pattern> reverse-match {yes | no}
Variable Description
<url-rewrite-rule_name>
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type: edit ?
Default
No default.
action {403-forbidden | redirect | redirect-301 | http-body-rewrite | http-header-rewrite | location-rewrite}
Specify one of the following values: l
403-forbidden
— Send a 403 (Forbidden) response to the client.
l redirect
— Send a 302 (Moved Temporarily) response to the client, with a new Location: field in the
HTTP header.
l redirect-301
— Send a 301 (Moved Permanently) response to the client, with a new Location: field in the
HTTP header.
l http-body-rewrite
— Replace the specific HTTP content in the body of responses.
l http-header-rewrite
— Rewrite the host, referer and request URL fields in HTTP header.
l location-rewrite
— Rewrite the location string in a 302 redirect.
httpheaderrewrite header-name <header-name_ str>
Type the name of the header field that you want to insert to a request, such as "Myheader".
header-status {enable | disable}
Enable to insert the specified header and value to the matched
HTTP requests. Specifies the header name and header value through header-name and header-value respectively.
No default.
disable header-value <header-value_ str>
Type the value of the header field that you specified in header-name
, such as "123". Then, the customized header
Myheader: 123 will be inserted to the matched HTTP requests.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
501
waf url-rewrite url-rewrite-rule
Variable
host {<server_fqdn> |
<server_ipv4> | <host_ pattern>} host-status {enable | disable}
Description
Type the FQDN of the host, such as store.example.com
, to which the request will be redirected. The maximum length is 255 characters.
This option is available only when host-status is enabled and action is http-header-rewrite.
This field supports back references such as $0 to the parts of the original request that matched any capture groups that you entered in
for each object in the condition table. (A capture group is a regular expression, or part of one, surrounded in parentheses.)
Use $
n (0 <= n <= 9) to invoke a substring, where n is the order of appearance of the regular expression, from left to right, from outside to inside, then from top to bottom.
For example, regular expressions in the condition table in this order:
(a)(b)(c(d))(e)
(f) would result in invokable variables with the following values: l
$0
— a l
$1
— b l
$2
— cd l
$3
— d l
$4
— e l
$5
— f
Enable to rewrite the Host: field or host name part of the
Referer: field.
When disabled, the FortiWeb appliance preserves the value from the client’s request when rewriting it.
This option is available only when action is httpheader-rewrite
.
Default
No default.
disable config
502 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf url-rewrite url-rewrite-rule
Variable
host-use-pserver
{enable | disable} url <replacement-url_ str> url-status
{enable | disable}
Description
Enable this when you have a server farm for server balance or content routing. In this case you do not know which server in the server farm the FortiWeb appliance will use. When FortiWeb processes the request, it sets the value for the actual host.
This option is available only when host-status is enabled and action is http-header-rewrite. Any setting you make for host is ignored.
Type the string, such as /catalog/item1, that will replace the request URL. The maximum length is 255 characters.
This option is available only when url-status is enabled and action is http-header-rewrite.
Do not include the name of the web host, such as www.example.com
, nor the protocol, which are configured separately in
host {<server_fqdn> | <server_ ipv4> | <host_pattern>}
.
Like host, this field supports back references such as $0 to the parts
for each object in the condition table.
For an example, see the
FortiWeb Administration Guide
.
Enable to rewrite the URL part of the request URL.
If you disable this option, the FortiWeb appliance preserves the value from the client’s request when it rewrites it.
This option is available only when action is httpheader-rewrite
.
location <location_str> Enter the replacement value for the Location: field in the HTTP header for the 302 response. The maximum length is 255 characters.
This option is available only when action is redirect.
location_replace
<location_str>
Type the URL string that provides a location for use in a
302 HTTP redirect response from a web server connected to FortiWeb. The maximum length is 255 characters.
This option is available only when action is location-rewrite
.
Default
disable
No default.
disable
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
503
waf url-rewrite url-rewrite-rule
Variable Description Default
referer-status {enable | disable}
Enable to rewrite the Referer: field in the HTML header.
Also configure
and
.
disable referer <referer-url_ str>
Type the replacement value for the Referer: field in the
HTML header. The maximum length is 255 characters.
This option is available only when referer-status is enabled.
No default.
referer-use-pserver
{enable | disable}
Enable this when you have a server farm for server balance or content routing. In this case you do not know which server in the server farm the FortiWeb appliance will use. When FortiWeb processes the request, it sets the value for the actual referrer.
This option is available only when referer-status is enabled and action is http-header-rewrite. Any setting you make for referer is ignored.
disable body_replace
<replacement_str>
<entry_index>
Type the value that will replace matching HTTP content in the body of responses. The maximum is 255 characters.
For an example, see the
FortiWeb Administration Guide
.
This option is available only when action is httpbody-rewrite
.
No default.
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
content-filter {enable | disable}
Enable if you want to match this condition only for specific
HTTP content types (also called Internet or MIME file types) such as text/html, as indicated in the Content-Type:
HTTP header. Also configure
.
content-type-set
{text/html text/plain text/javascript application/xml(or) text/xml application/javascript application/soap+xml application/xjavascript}
Type the HTTP content types that you want to match in a space-delimited list, such as: set content-type-set text/html text/plain disable
No default.
config
504 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf url-rewrite url-rewrite-rule
Default Variable
HTTP-protocol {http | https}
Description
Select which protocol will match this condition, either
HTTP or HTTPS.
This option is applicable only if protocol-filter is set to enable.
is-essential {yes | no}
Select what to do if there is no Referer: field, either: l no
— Meet this condition.
l yes
— Do not meet this condition.
Requests can lack a Referer: field for several reasons, such as if the user manually types the URL, and the request does not result from a hyperlink from another web site, or if the URL resulted from an HTTPS connection.
(See the
RFC 2616 section on the Referer: field.) In those cases, the field cannot be tested for a matching value.
This option appears only if object is httpreference
.
object {http-host | http-reference | httpurl}
Select which part of the HTTP request to test for a match: l http-host l http-url l http-reference
(the Referer: field)
If the request must match multiple conditions (for example, it must contain both a matching Host: field and a matching URL), add each object match condition to the condition table separately.
protocol-filter
{enable | disable}
Enable if you want to match this condition only for either
HTTP or HTTPS. Also configure
.
For example, you could redirect clients that accidentally request the login page by HTTP to a more secure HTTPS channel — but the redirect is not necessary for HTTPS requests.
As another example, if URLs in HTTPS requests should be exempt from rewriting, you could configure the rewriting rule to apply only to HTTP requests.
http yes httphost disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
505
waf user-tracking policy
Variable Description
reg-exp <object_pattern>
Depending on your selection in
object {http-host | httpreference | http-url}
and reverse-match
{yes | no}
, type a regular expression that defines either all matching or all non-matching Host: fields,
URLs, or Referer: fields. Then, also configure reverse-match {yes | no}
.
For example, for the URL rewriting rule to match all URLs that begin with /wordpress, you could enter
^/wordpress
, then, in reverse-match
{yes | no}
, select no.
The pattern is not required to begin with a slash ( / ). The maximum length is 255 characters.
Note: Regular expressions beginning with an exclamation point ( ! ) are not supported. Instead, use reversematch {yes | no}
.
Default
No default.
reverse-match {yes | no}
Indicate how to use
when determining whether or not this URL rewriting condition has been met.
l no
— If the regular expression
does match the request object, the condition is met.
l yes
— If the regular expression does not match the request object, the condition is met.
The effect is equivalent to preceding a regular expression with an exclamation point ( ! ).
If all conditions are met, the FortiWeb appliance will do your selected action.
no config
Related topics
l
config waf url-rewrite url-rewrite-policy
waf user-tracking policy
Use this command to group user tracking rules, which track sessions by user and capture a username to reference in traffic and attack log messages.
Before you configure a user-tracking policy, define the rules to add (see
To apply a user tracking policy, you select it in an inline or offline protection profile. For details, see
config waf web-protection-profile inline-protection
or
config waf web-protection-profile offline-protection
506 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf user-tracking rule
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf user-tracking policy edit
config input-rule-list edit
set
end next end next
Variable
<user-tracking-policy_ name>
Description
Type the name of a new or existing policy. The maximum length is 35 characters.
To display the list of existing policies, type: edit ?
<entry_index>
Type the index number of the individual entry in the table.
input-rule <input-rule_ name>
Type the name of an existing rule.
Default
No default.
No default.
No default.
waf user-tracking rule
Use this command to configure FortiWeb to track sessions by user and capture a username to reference in traffic and attack log messages.
When FortiWeb detects users that match the criteria that you specify in a user tracking policy, it stores the session ID and username.
To apply a user tracking rule, add it to a user tracking policy that you can select in an inline or offline protection profile. See
config waf user-tracking policy
.
You can apply a user tracking policy using either an inline or offline protection profile. However, in offline protection mode, session-fixation-protection, session-timeout-enforcement, and the deny, redirect and period block actions are not supported.
You can also use the user tracking feature to create a filter in a custom rule that matches specific users. This type of custom rule requires you to create a user tracking policy and apply it to the protection profile that uses the custom rule. See
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
507
waf user-tracking rule config
Syntax
config waf user-tracking rule edit
set
set set set set set set set set set set set set set set set
session-timeout <timeout_int> session-frozen-time <frozen-time_int>
config match-condition edit
<entry_index> authentication-result-type { failed | success}
set set set set end next
end next
Variable
<rule_name>
Description
Enter a name that identifies the rule.
hostname-ip <hostnameip_str> host-status { enable | disable} authentication-url <url_ str>
Enter the URL to match in authorization requests.
Ensure that the value begins with a forward slash ( / ).
username-parameter
<username_str>
Enter the username field value to match in authorization requests.
password-parameter
<password_str>
Enter the password field value to match in authorization requests.
Default
No default.
No default.
No default.
No default.
No default.
No default.
508 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf user-tracking rule
Variable
session-id-name
<session-id_str>
Description
Type the name of the session ID that is used to identify each session.
Examples of session ID names are sid, PHPSESSID, and
JSESSIONID
Default
No default.
Optionally, enter the URL of the request that a client sends to log out of the application.
logoff-path <logoff_str>
When the client sends this URL, FortiWeb stops tracking the user session.
Ensure that the value begins with a forward slash ( / ).
session-fixationprotection { enable | disable}
No default.
Enter enable to configure FortiWeb to erase session IDs from the cookie and argument fields of a matching login request.
FortiWeb erases the IDs for non-authenticated sessions only.
For web applications that do not renew the session cookie when a user logs in, it is possible for an attacker to trick a user into authenticating with a session ID that the attacker acquired earlier. This feature prevents the attacker from accessing the web app in an authenticated session.
When this feature removes session IDs, FortiWeb does not generate a log message because it is very common for a legitimate user to access a web application using an existing cookie. For example, a client who leaves his or her web browser open between sessions presents the cookie from an earlier session.
Caution: This option is not supported in offline protection mode.
disable session-timeoutenforcement { enable | disable}
Enter enable to configure FortiWeb to remove the session
ID for user sessions that are idle for longer than the length of time specified by session-timeout. When a session is reset, the client has to log in again to access the back-end server.
If a session exceeds the timeout threshold, instead of tracking subsequent matching sessions by user, FortiWeb takes the specified action, for a length of time specified by sessionfrozen-time
.
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
509
waf user-tracking rule
Variable
session-timeout
<timeout_int> session-frozen-time
<frozen-time_int>
Description Default
Enter the length of time in minutes that FortiWeb waits before it stops tracking an inactive user session.
30
Valid values are from 1 to 14400.
Enter the length of time after a session exceeds the timeout threshold that FortiWeb takes the specified action against requests with the ID of the timed-out session.
After the freeze time has elapsed, FortiWeb removes the session ID for idle sessions but no longer takes the specified action.
Available only when session-timeout-enforcement is enable.
30 config
510 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf user-tracking rule
Variable Description
session-frozen-action { alert | alert_deny | redirect | block-period}
Enter the action that FortiWeb takes against requests with the ID of a timed-out session during the specified time period: l l alert
— Accept the request and generate an alert email and/or log message.
alert_deny
— Block the request and generate an alert email and/or log message.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb Administration Guide
or
Note: In offline protection mode, because the deny action is not supported, this option has the same effect as alert.
l redirect
— Redirect the request to the URL that you specify in the protection profile and generate an alert and/or log message. Also configure redirect-url
<redirect_fqdn> and rdt-reason {enable | disable}
.
Default
alert session-frozen-blockperiod <block-period_ int> l
Caution: This option is not supported in offline protection mode block-period
— Block subsequent requests from the client for a specified number of seconds.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. See the
FortiWeb Administration Guide
or
Caution: This option is not supported in offline protection mode
When the action generates a log message, the message field value is Session Timeout Enforcement: triggered by user <username>
.
Available only when session-timeoutenforcement is enable.
Type the number of seconds to block requests with the ID of a timed-out session.
This setting is available only if action is blockperiod
. The valid range is from 1 to 3,600 (1 hour).
60
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
511
waf user-tracking rule
Variable
session-frozen-severity
{ High | Medium | Low}
Description
When the session timeout settings generate an attack log, each log message contains a
Severity Level
(severity_level) field. Select which severity level
FortiWeb uses when it takes the specified action: l
Low l
Medium l
High
Available only when session-timeoutenforcement is enable.
session-frozen-trigger
<trigger-policy_name> default-action { failed
| success}
Type the name of the trigger, if any, to apply when
FortiWeb detects requests with the ID of a timed-out session (see
maximum length is 35 characters.
To display the list of existing triggers, type: set trigger ?
Enter the authentication result that FortiWeb associates with requests that match the criteria but do not match an entry in the Authentication Result Condition Table.
When the login result is successful, FortiWeb tracks the session using the session ID and username values.
Default
Low
No default.
failed
<entry_index> Type the index number of the individual entry in the table.
No default.
authentication-resulttype { failed | success}
Specify the status FortiWeb assigns to user logins that match this table item: failed or successful.
FortiWeb tracks sessions by user only when the status is successful
.
If the request does not match any rules in this table, FortiWeb uses the value specified by default-action.
success
HTTP-match-target { return-code | responsebody | redirect-url} value-type { plain | regular}
Select the location of the value to match with the string or regular expression specified in this table item: returncode
, response-body, redirect-url.
Indicate whether value is a simple string (plain) or a regular expression (regular).
returncode plain value <value-str>
Enter the value to match.
No default.
config
512 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf user-tracking rule
Example
This example matches requests from clients using the URL "/login2" with the parameters "user" and "pass" and a session ID specified by "jsessionid." FortiWeb tracks matching sessions by user and stops tracking if the client logs out using the URL "/logout2".
FortiWeb tracks only requests with the return code 200, which it classifies as successful. It does not track requests with a response body that matches the regular expression "deny". In addition, because the rule uses the default value for the default authentication result, it does not track requests that do not match an item in the list of match conditions.
The rule enables both session fixation protection and session timeout enforcement for tracked sessions. If a session is idle longer than the default session timeout, FortiWeb blocks requests from clients that use the session
ID that has timed out for the default period block time. It performs this action for 30 minutes after the session times out (the default session freeze time).
config waf user-tracking edit "rule1" set authentication-url /login2 set username-parameter user set password-parameter pass set session-id-name jsessionid set logoff-path /logout2 set session-fixation-protection enable set timeout-enforcement enable set session-frozen-action period-block set session-frozen-severity High set session-frozen-trigger "trigger1" config match-condition edit 1 set authentication-result-type success set HTTP-match-target return-code set value-type plain set value 200 set value-type regular set value deny end next end next next edit 2 set authentication-result-type failed set HTTP-match-target return
Related topics
l
config server-policy allow-hosts
l
config waf web-protection-profile inline-protection
l
config waf web-protection-profile offline-protection
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
513
waf web-cache-exception config
waf web-cache-exception
Use this command to configure FortiWeb to cache responses from your servers.
Use web-cache-exception to cache all URLs except for a few. To cache only a few URLs, see
To apply this policy, include it in an inline protection profile. For details, see
config waf web-protectionprofile inline-protection
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf web-cache-exception edit
<web-cache-exception_rule_name>
config exception-list edit
set
host-status {enable | disable}
set host
set url-type
set url-pattern
set cookie-name
end end next
Variable
<web-cache-exception_ rule_name>
<entry_index> host-status {enable | disable}
<host_str>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing policies, type: edit ?
Default
No default.
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
Specify enable to require that the Host: field of the
HTTP request match a protected host names entry in order to match the exception. Also specify a value for host.
disable
Specify which protected host names entry (either a web host name or IP address) that the Host: field of the
HTTP request must be in to match the exception.
Maximum length is 255 characters.
This option is available only if the value of hoststatus is enabled.
No default.
514 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
{plain | regular}
<url-pattern_str>
<cookie-name_str> waf web-cache-exception
Description
Specify the type of value that is used for urlpattern
: l plain
— A literal URL.
l regular
— A regular expression designed to match multiple URLs.
If the value of url-type is plain, specify the literal
URL, such as /index.php, that the HTTP request must contain in order to match the rule. The URL must begin with a slash ( / ).
If the value of url-type is regular, specify a regular expression, such as ^/*.php, that matches all and only the URLs that the rule applies to. The pattern does not require a slash ( / ); however, it must match
URLs that begin with a slash, such as /index.cfm.
Do not include the domain name, such as www.example.com
, which is specified by host.
Maximum length is 255 characters.
Tip: Generally, URLs that require autolearning adapters do not work well with caching either. Do not cache dynamic URLs that contain variables such as user names
(e.g. older versions of Microsoft OWA) or volatile data such as parameters. Because FortiWeb is unlikely to receive identical subsequent requests for them, dynamic
URLs can rapidly consume cache without improving performance.
Specify the name of the cookie, such as sessionid, as it appears in the Cookie: HTTP header.
Maximum length is 127 characters.
Tip: Content that is unique to a user, such as personalized pages that appear after a person has logged in, usually should not be cached. If the web application’s authentication is cookie-based, configure this setting with the name of the authentication cookie. Otherwise, if it is parameter-based, configure the exception with a URL pattern that matches the authentication ID parameter.
Default
plain
No default.
No default.
Related topics
l
l
config waf web-protection-profile inline-protection
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
515
waf web-cache-policy config
waf web-cache-policy
Use this command to configure FortiWeb to cache responses from your servers.
Use web-cache-policy to cache only a few URLs. To cache all URLs except for a few, see
config waf web-cache-exception
To apply this policy, include it in an inline protection profile. For details, see
config waf web-protectionprofile inline-protection
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf web-cache-policy edit
set cache-buffer-size
set max-cached-page-size
set default-cache-timeout set exception
config url-match-list edit
set
host-status {enable | disable}
set host
set url-type
set url-pattern
end end next
Variable
<web-cache-policy_rule_ name>
Description
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing policies, type: edit ?
Default
No default.
516 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
<cache-size_int>
<page-size_int> waf web-cache-policy
Description
Specify the maximum amount of RAM to allocate to caching content, in MB (megabytes).
You cannot store cached content on FortiWeb’s hard disk.
The FortiWeb model determines the valid range of values: l
FortiWeb 400C, FortiWeb-VM (2-4 GB RAM) — 1-100 MB l
FortiWeb 1000C, FortiWeb-VM (4-8 GB RAM) — 1-200 MB l
FortiWeb 3000C, FortiWeb 3000C/CFsx, FortiWeb-VM (8-
16 GB RAM)— 1-400 MB l
FortiWeb 4000C — 1-600 MB l
FortiWeb 1000D — 1-800 MB l
FortiWeb-VM (16+ GB RAM) — 1-1024 MB l
FortiWeb 3000D/DFsx — 1-1200 MB l
FortiWeb 4000D — 1-2048 MB
If administrative domains (ADOMs) are enabled, the maximums apply to the total RAM allotted to all ADOMs.
For example, a FortiWeb 1000D has two ADOMs. If the cache-buffer-size value for the first ADOM is
600
, the valid range for cache-buffer-size for the second ADOM is 1-200.
Tip: For improved performance, adjust this setting until it is as small as possible yet FortiWeb can still fit most graphics and server processing-intensive pages into its cache. This allows FortiWeb to allocate more RAM to other features that also affect throughput, such as scanning for attacks.
Specify the maximum size of each URL that FortiWeb caches, in kilobytes (KB). FortiWeb does not cache objects such as high-resolution images, movies, or music that are larger than this value.
Valid range is 1 to 10,240.
Tip: For improved performance, adjust this setting until
FortiWeb can fit most graphics and server processingintensive pages into its cache.
Default
100
2048
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
517
waf web-cache-policy
Variable
<cache-timeout_int>
<web-cache-exception_ name>
<entry_index> host-status {enable | disable}
<host_str>
{plain | regular}
<url-pattern_str>
Description
Specify the time to live for each entry in the cache.
FortiWeb removes expired entries.
Valid range is 0 to 7200.
When it receives a subsequent request for the URL,
FortiWeb forwards the request to the server and refreshes the cached response. Any additional requests receive the new cached response until the URL’s cache timeout expires.
Specify the name of a list of exceptions.
See
config waf web-cache-exception
Default
1440
No default.
Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999.
No default.
Specify enable to require that the Host: field of the
HTTP request match a protected host names entry in order to match the policy. Also specify a value for host.
disable
Specify which protected host names entry (either a web host name or IP address) that the Host: field of the
HTTP request must be in to match the policy.
This option is available only if the value of hoststatus is enabled.
Specify the type of value that is used for urlpattern
: plain
— A literal URL.
regular
— A regular expression designed to match multiple URLs.
If the value of url-type is plain, specify the literal
URL, such as /index.php, that the HTTP request must contain in order to match the rule. The URL must begin with a slash ( / ).
If the value of url-type is regular, specify a regular expression, such as ^/*.php, that matches all and only the URLs that the rule applies to. The pattern does not require a slash ( / ); however, it must match
URLs that begin with a slash, such as /index.cfm.
Do not include the domain name, such as www.example.com
, which is specified by host.
No default.
plain
No default.
config
518 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf web-protection-profile autolearning-profile
Related topics
l
config waf web-cache-exception
l
config waf web-protection-profile inline-protection
waf web-protection-profile autolearning-profile
Use this command to configure auto-learning profiles.
Auto-learning profiles are useful when you want to collect information about the HTTP sessions on your unique network in order to design inline or offline protection profiles suited for them. This reduces much of the research and guesswork about what HTTP request methods, data types, and other types of content that your web sites and web applications use when designing an appropriate defense.
Auto-learning profiles track your web servers’ response to each request, such as 401 Unauthorized or
500 Internal Server Error
, to learn about whether the request is legitimate or a potential attack attempt. Such data is used for auto-learning reports, and can serve as the basis for generating inline protection or offline protection profiles.
Auto-learning profiles are designed to be used in conjunction with a protection or detection profile, which is used to detect attacks. Only if attacks are detected can the auto-learning profile accumulate auto-learning data and generate its report. As a result, auto-learning profiles require that you also select a protection or detection profile in the same policy.
Use auto-learning profiles with profiles whose action is alert.
If action is alert_deny, the FortiWeb appliance will reset the connection, preventing the auto-learning feature from gathering complete data on the session.
To apply auto-learning profiles, select them within a policy. For details, see
config waf web-protectionprofile offline-protection
. Once applied in a policy, the FortiWeb appliance will collect data and
generate a report from it. For details, see the
FortiWeb Administration Guide
.
Before configuring an auto-learning profile, first configure any of the following that you want to include in the profile: l l l a data type group (see
config server-policy pattern data-type-group
a suspicious URL rule group (see
config server-policy pattern suspicious-url-rule
a URL interpreter (see
config server-policy custom-application application-policy
Alternatively, you could generate an auto-learning profile and its required components, and then modify them. For details, see the
FortiWeb Administration Guide
.
You must also disable any globally whitelisted objects. (These will be exempt from scans and autolearning data.)
See
config server-policy pattern custom-global-white-list-group
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
519
waf web-protection-profile autolearning-profile config
To use this command, your administrator account’s access control profile must have either w or rw permission to the learngrp area. For more information, see
Syntax
config waf web-protection-profile autolearning-profile edit
set
data-type-group <data-type-group_name>
set
suspicious-url-rule <suspicious-url-rule-group_name>
set set
attack-count-threshold <count_int> attack-percent-range <percent_int>
analyzer-policy <fortianalyzer-policy_name>
end set next
Variable
<auto-learning-profile_ name> data-type-group <datatype-group_name> suspicious-url-rule
<suspicious-url-rulegroup_name>
Description
Type the name of the auto-learning profile. The maximum length is 35 characters.
To display the list of existing profile, type: edit ?
Type the name of the data type group for the profile to use.
See
config server-policy pattern datatype-group
. The maximum length is 35 characters.
To display the list of existing groups, type: set data-type-group ?
The auto-learning profile will learn about the names, length, and required presence of these types of parameter inputs as described in the data type group.
Type the name of a suspicious URL rule group to use. See
config server-policy pattern suspiciousurl-rule
. The maximum length is 35 characters.
To display the list of existing groups, type: set suspicious-url-rule ?
The auto-learning profile will learn about attempts to access URLs that are typically used for web server or web application administrator logins, such as admin.php.
Requests from clients for these types of URLs are considered to be a possible attempt at either vulnerability scanning or administrative login attacks, and therefore potentially malicious.
Default
No default.
No default.
No default.
520 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf web-protection-profile inline-protection
Variable
attack-count-threshold
<count_int> attack-percent-range
<percent_int> application-policy
<policy_name>
Description Default
Type the integer representing the threshold over which the autolearning profile adds the attack to the server protection rules.
The valid range is from 1 to 2,147,483,647.
100
Type the integer representing the threshold of the percentage of attacks to total hits over which the auto-learning profile adds the attack to the server protection exceptions. The valid range is from 1 to 10,000.
5
Type the name of a custom application policy to use. See
config server-policy custom-application application-policy
characters.
To display the list of existing application policies, type: set application-policy ?
No default.
Related topics
l
config server-policy pattern custom-global-white-list-group
l
config server-policy pattern data-type-group
l
config server-policy pattern suspicious-url-rule
l
config waf web-protection-profile inline-protection
l
l
waf web-protection-profile inline-protection
Use this command to configure inline protection profiles.
Inline protection profiles are a set of attack protection settings. The FortiWeb appliance applies the profile when a connection matches a server policy that includes the protection profile. You can use inline protection profiles in server policies for any mode except offline protection.
To apply protection profiles, select them within a server policy. For details, see
Before configuring an inline protection profile, first configure any of the following that you want to include in the profile: l l l l l a parameter validation rule (see
config waf parameter-validation-rule
) start pages (see
)
caching of back-end server responses (see
a URL access policy (see
config waf url-access url-access-policy
a hidden field rule group (see
config waf hidden-fields-protection
)
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
521
waf web-protection-profile inline-protection config l l l l l l l l l l l l l l l l l a parameter restriction constraint (see
config waf http-protocol-parameter-restriction
an authentication policy and/or site publisher (see
config waf http-authen http-authen-policy
or
config waf site-publish-helper policy
a brute force login attack sensor (see
an allowed method exception (see
config waf allow-method-exceptions
a list of manually trusted and black-listed IPs, FortiGuard IP reputation category-based blacklisted IPs, and/or a geographically-based IP blacklist (see
,
config server-policy custom-application application-policy
and
) a page order rule (see
) attack signatures (see
) a file upload restriction policy (see
config server-policy custom-application applicationpolicy
a URL rewriting policy (see
config waf url-rewrite url-rewrite-policy
a DoS protection policy (see
config waf application-layer-dos-prevention
compression rules (see
)
decompression rules ( config waf file-uncompress-rule
) a policy that protects vulnerable block cipher implementations for web applications that selectively encrypt inputs
without using HTTPS ( config waf padding-oracle
) a FortiGate that provides a list of quarantined source IPs (
config system fortigate-integration
a cross-site request forgery (CSRF) protection rule (see
) a cookie security policy (see
) a user tracking policy (see
config waf user-tracking policy
)
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
set set set set set set set set set set set set set set set set config waf web-protection-profile inline-protection edit
<inline-protection-profile_name>
set
http-session-management {enable | disable}
set set set
http-session-timeout <seconds_int> x-forwarded-for-rule <x-forwarded-for_name>
signature-rule {"High Level Security" | "Medium Level Security" |
522 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf web-protection-profile inline-protection set set set set set set set set end next set set set set set set set set set set set set set set set set set
cookie-security-policy <cookie-security_name>
set
parameter-validation-rule <rule_name>
set
hidden-fields-protection <group_name>
set
file-upload-policy <policy_name>
set set
site-publisher-helper <policy_name> file-compress-rule <rule_name>
file-uncompress-rule <rule_name>
web-cache-policy <web-cache-policy_name> user-tracking-policy <user-tracking-policy_name>
Variable
<inline-protectionprofile_name>
Description
Type the name of the inline protection profile. The maximum length is 35 characters.
To display the list of existing profile, type: edit ?
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
523
waf web-protection-profile inline-protection
Variable Description
http-session-management
{enable | disable}
Enable to add an implementation of HTTP sessions, and track their states, using a cookie such as cookiesession1
. Also configure
http-sessiontimeout <seconds_int>
Although HTTP has no inherent support for sessions, a notion of individual HTTP client sessions, rather than simply the source IP address and/or timestamp, is required by some features.
For example, you might want to require that a client’s first
HTTP request always be a login page: the rest of the web pages should be inaccessible if they have not authenticated. Out-of-order requests could represent an attempt to bypass the web application’s native authentication mechanism. How can FortiWeb know if a request is the client’s first HTTP request? If FortiWeb were to treat each request independently, without knowledge of anything previous, it could not, by definition, enforce page order. Therefore FortiWeb must keep some record of the first request from that client (the session initiation). It also must record their previous
HTTP request(s), until a span of time (the session timeout) has elapsed during which there were no more subsequent requests, after which it would require that the session be initiated again.
The session management feature provides such
FortiWeb session support.
This feature requires that the client support cookies.
Note: You must enable this option: l to enforce the start page rule, page access rule, and hidden fields rule, if any of those are selected.
l if you want to include this profile’s traffic in the traffic log, in addition to enabling traffic logs in general. For more information, see
and .
Default
disable http-session-timeout
<seconds_int>
Type the HTTP session timeout in seconds. The valid range is from 20 to 3,600 seconds.
This setting is available only if http-sessionmanagement is enabled.
1200 x-forwarded-for-rule <xforwarded-for_name>
Specify the name of a rule that configures FortiWeb’s use of X-
Forwarded-For: and X-Real-IP (see
No default.
config
524 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf web-protection-profile inline-protection
Variable
signature-rule {"High
Level Security" |
"Medium Level
Security" | "Alert
Only" | <signature-set_ name>}
Description
Specify a signature policy to include in the profile (see
The maximum length is 35 characters.
To display the list of existing rules, type: set server-protection-rule ?
amf3-protocol-detection
{enable | disable}
Enable to scan requests that use action message format
3.0 (AMF3) for l l l cross-site scripting (XSS) attacks
SQL injection attacks common exploits if you have enabled those in the signature set specified by
signature-rule {"High Level Security" | "Medium Level
Security" | "Alert Only" | <signature-set_name>}
.
AMF3 is a binary format that Adobe Flash clients can use to send input to server-side software.
Caution: To scan for attacks or enforce input rules on
AMF3, you
must enable this option. Failure to enable the option will make the FortiWeb appliance unable to scan
AMF3 requests for attacks.
xml-protocol-detection
{enable | disable} malformed-xml-check
{enable | disable}
Enable to scan for matches with attack and data leak signatures in Web 2.0 (XML AJAX) and other XML submitted by clients in the bodies of HTTP POST requests.
Enable to validate that XML elements and attributes in the request’s body conforms to the
W3C XML 1.1
and/or
XML 2.0
standards.Malformed XML, such as without the final > or with multiple >> in the closing tag, is often an attempt to exploit an unhandled error condition in a web application’s XHTML or XML parser.
This feature is applicable only when xml-protocoldetection is enable. Attack log messages contain
Illegal XML Format when this feature detects malformed XML.
Default
No default.
disable disable disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
525
waf web-protection-profile inline-protection
Variable
malformed-xml-checkaction {alert | alert_ deny | block-period}
Description
Specify the action that FortiWeb takes when it detects a request that contains malformed XML: l alert
— Accept the request and generate an alert email, a log message, or both.
l alert_deny
— Block the request and generate an alert email, a log message, or both.
l block-period
— Block the XML traffic for a number of seconds. Also configure
malformed-xml-blockperiod <block-period_int>
Default
alert malformed-xml-blockperiod <block-period_ int>
Type the length of time that FortiWeb blocks XML traffic that contains malformed XML, in seconds.
The valid range is from 1 to 3,600 seconds.
Select the severity level to use in logs and reports generated when illegal XML formats are detected.
60 malformed-xml-checkseverity {High | Low |
Medium}
High malformed-xml-checktrigger <trigger-policy_ name>
Type the name of the trigger to apply when illegal XML formats are detected (see
The maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
json-protocol-detection
{enable | disable}
Enter enable to scan for matches with attack and data leak signatures in JSON data submitted by clients in HTTP requests with Content-Type: values application/json or text/json.
No default.
disable malformed-json-check
{enable | disable} malformed-json-checkaction {alert | alert_ deny | block-period}
Enter enable to scan for illegal formatting in JSON data.
disable
Specify the action that FortiWeb takes when it detects a request that contains malformed JSON content: l alert
— Accept the request and generate an alert email, a log message, or both.
l alert_deny
— Block the request and generate an alert email, a log message, or both.
l block-period
— Block the JSON traffic for a number of seconds. Also configure malformed-json-blockperiod
.
No default.
config
526 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf web-protection-profile inline-protection
Variable
malformed-json-blockperiod <block-period_ int>
Description
Type the length of time that FortiWeb blocks traffic that contains malformed JSON content, in seconds.
The valid range is from 1 to 3,600 seconds.
Default
60 malformed-json-checkseverity {High |
Medium | Low}
Select the severity level to use in logs and reports that
FortiWeb generates when it detects malformed JSON content.
malformed-json-checktrigger <trigger-policy_ name>
Type the name of the trigger to apply when FortiWeb detects malformed JSON content.
The maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
custom-access-policy
<combo-access_name>
High
No default.
No default.
Type the name of a custom access policy. See
config waf custom-access policy
is 35 characters.
To display the list of existing policies, type: set custom-access-policy ?
padding-oracle <rule_ name> csrf-protection <rule_ name>
Type the name of a padding oracle protection rule. See
length is 35 characters.
To display the list of existing rule, type:
set padding-oracle ?
cookie-security-policy <cookiesecurity_name> parameter-validationrule <rule_name>
Type the name of a parameter validation rule. See
config waf parameter-validation-rule
maximum length is 35 characters.
To display the list of existing rules, type: set parameter-validation-rule ?
No default.
No default.
Available only when http-session-management is enabled
.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
527
waf web-protection-profile inline-protection
Variable Description
hidden-fields-protection
<group_name>
Type the name of a hidden field rule group that you want to apply, if any. See
config waf hidden-fieldsprotection
. The maximum length is 35 characters.
To display the list of existing group, type: set hidden-fields-protection ?
file-upload-policy
<policy_name>
Type the name of a file upload restriction policy to use, if any. See
config server-policy customapplication application-policy
maximum length is 35 characters.
To display the list of existing policies, type: set file-upload-policy ?
http-protocol-parameterrestriction <constraint_ name>
Type the name of an HTTP protocol constraint that you want to apply, if any. See
config waf httpprotocol-parameter-restriction
maximum length is 35 characters.
To display the list of existing profile, type: set http-protocol-parameter-restriction
?
brute-force-login
<sensor_name>
Type the name of a brute force login attack sensor. See
length is 35 characters.
To display the list of existing sensors, type: set brute-force-login ?
url-access-policy
<policy_name> page-access-rule <rule_ name>
Type the name of a url access policy. See
config waf url-access url-access-policy
length is 35 characters.
To display the list of existing policy, type: set url-access-policy ?
Type the name of a page order rule. See
The maximum length is 35 characters.
To display the list of existing rule, type: set page-access-rule ?
Default
No default.
No default.
No default.
No default.
No default.
No default.
config
528 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf web-protection-profile inline-protection
Variable
start-pages <rule_name> allow-method-policy
<policy_name>
Description
Type the name of a start page rule. See
. The maximum length is 35 characters.
To display the list of existing rule, type: set start-pages ?
This setting is available only if http-sessionmanagement is enabled.
Type the name of an allowed method policy. See
config server-policy custom-application application-policy
characters.
To display the list of existing policies, type: set allow-method-policy ?
Default
No default.
No default.
ip-list-policy <policy_ name> geo-block-list-policy
<policy_name>
Type the name of a trusted IP or blacklisted IP policy. See
config server-policy custom-application application-policy
characters.
To display the list of existing policy, type: set ip-list-policy ?
Type the name of a geographically-based client IP black list that you want to apply, if any. See
characters.
To display the list of existing group, type: set geo-block-list-policy ?
No default.
No default.
application-layer-dosprevention <policy_name>
Type the name of an existing DoS protection policy to use with this profile, if any. See
config waf application-layer-dos-prevention
maximum length is 35 characters.
To display the list of existing profile, type: set application-layer-dos-prevention ?
ip-intelligence
{enable | disable}
No default.
Enable to apply intelligence about the reputation of the client’s source IP. Blocking and logging behavior is configured in
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
529
waf web-protection-profile inline-protection
Variable
fortigate-quarantinedips {enable | disable} quarantined-ip-action
{alert | alert_deny}
Description
Enable to detect source IP addresses that a FortiGate unit is currently preventing from interacting with the network and protected systems.
To configure communication between the FortiGate and
FortiWeb, see
config system fortigateintegration
Specify the action that FortiWeb takes if it detects a quarantined IP address: l l alert
— Accept the request and generate an alert email, log message, or both.
alert_deny
— Block the request and generate an alert, log message, or both.
quarantined-ip-severity
{High | Medium | Low}
Specify the severity that FortiWeb assigns to quarantined
IP log messages.
quarantined-ip-trigger
<trigger-policy_name>
Type the name of the trigger to apply when FortiWeb detects a quarantined IP (see
To display the list of existing trigger policies, type: set trigger ?
Default
disable alert
High
No default.
config
530 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config
Variable
known-search-engine
{enable | disable} url-rewrite-policy
<group_name> http-authen-policy
<policy_name> waf web-protection-profile inline-protection
Description
Enable to allow or block predefined search engines, robots, spiders, and web crawlers according to your settings in the global list.
Enable to exempt popular search engines’ robots, spiders, and web crawlers from DoS sensors, brute force login sensors, HTTP protocol constraints, and combination rate & access control (called “advanced protection” and “custom policies” in the web UI).
This option improves access for search engines. Rapid access rates, unusual HTTP usage, and other characteristics that may be suspicious for web browsers are often normal with search engines. If you block them, your web sites’ rankings and visibility may be affected.
By default, this option allows all popular predefined search engines. Known search engine indexer source IPs are updated via FortiGuard Security Service. To specify which search engines will be exempt, enable or disable each search engine in
config server-policy pattern custom-global-white-list-group
Note: X-header-derived client source IPs (see
not support this feature in this release. If FortiWeb is deployed behind a load balancer or other web proxy that applies source NAT, this feature will not work.
Type the name of a URL rewriting rule set, if any, that will be applied to matching HTTP requests. The maximum length is 35 characters.
To display the list of existing policy, type: set url-rewrite-policy ?
See
config waf url-access url-accesspolicy
Type the name of an HTTP authentication policy, if any, that will be applied to matching HTTP requests. See
config waf http-authen http-authenpolicy
. The maximum length is 35 characters.
To display the list of existing profile, type: set http-authen-policy ?
If the HTTP client fails to authenticate, it will receive an
HTTP 403 (Access Forbidden) error message.
Default
disable
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
531
waf web-protection-profile inline-protection
Variable
site-publisher-helper
<policy_name> file-compress-rule
<rule_name> file-uncompress-rule
<rule_name> web-cache-policy <webcache-policy_name> user-tracking-policy
<user-tracking-policy_ name>
Description
Type the name of a site publishing policy, if any, that will be applied to matching HTTP requests. See
config waf site-publish-helper policy
maximum length is 35 characters.
To display the list of existing profile, type: set site-publisher-policy ?
If the HTTP client fails to authenticate, it will receive an
HTTP 403 (Access Forbidden) error message.
Type the name of an existing file compression rule to use with this profile, if any. See
characters.
To display the list of existing rule, type: set file-compress-rule ?
Type the name of an existing file uncompression rule to use with this profile, if any. See
config waf fileuncompress-rule
characters.
To display the list of existing rule, type: set file-uncompress-rule ?
Type the name of content caching policy. See
characters.
To display the list of existing policies, type: set web-cache-policy ?
Enter the name of a user tracking policy. See
config waf user-tracking policy
Default
No default.
No default.
No default.
No default.
No default.
config
532 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf web-protection-profile inline-protection
Variable
redirect-url <redirect_ fqdn>
Description
Type a URL including the FQDN/IP and path, if any, to which an HTTP client will be redirected if their HTTP request violates any of the rules in this profile.
For example, you could enter www.example.com/products/
.
If you do
not enter a URL, depending on the type of violation and the configuration, the FortiWeb appliance will log the violation, may attempt to remove the offending parts, and could either reset the connection or return an HTTP 403 (Access Forbidden) or 404 (File Not
Found) error message.
The maximum length is 255 characters.
Default
No default.
rdt-reason {enable | disable} data-analysis {enable | disable} comment "<comment_str>"
Enable to include the reason for URL redirection as a parameter in the URL, such as reason=DETECT_
PARAM_RULE_FAILED
, when traffic has been redirected using
redirect-url <redirect_fqdn> . The
FortiWeb appliance also adds fortiwaf=1 to the URL to detect and cancel a redirect loop (when the redirect action recursively triggers an attack event).
Caution: If you specify a redirect URL that is protected by the FortiWeb appliance, you should enable this option to prevent infinite redirect loops.
No default.
Enable this to collect data for servers covered by this profile.
To view the statistics for collected data, in the web UI, go to
Log&Report > Monitor > Data Analytics.
disable
Type a description or other comment. If the comment contains more than one word or contains an apostrophe, surround the comment in double quotes ( " ). The maximum length is 199 characters.
No default.
Related topics
l
l
config server-policy pattern custom-global-white-list-group
l
l
l
l
l
l
config waf parameter-validation-rule
l
config waf http-protocol-parameter-restriction
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
533
waf web-protection-profile offline-protection l
config waf url-access url-access-policy
l
config waf allow-method-exceptions
l
config waf application-layer-dos-prevention
l
l
config waf file-uncompress-rule
l
l
l
config waf hidden-fields-protection
l
config waf http-authen http-authen-policy
l
config waf http-protocol-parameter-restriction
l
l
config server-policy custom-application application-policy
l
config waf web-cache-exception
l
config
waf web-protection-profile offline-protection
Use this command to configure offline protection profiles.
Detection profiles are useful when you want to preview the effects of some web protection features without affecting traffic, or without affecting your network topology.
Unlike protection profiles, a detection profile is designed for use in offline protection mode. Detection profiles cannot be guaranteed to block attacks. They attempt to reset the connection, but due to variable speeds of different routing paths, the reset request may arrive after the attack has been completed. Their primary purpose is to detect attacks, especially for use in conjunction with auto-learning profiles. In fact, if used in conjunction with auto-learning profiles, you should configure the detection profile to log only and not block attacks in order to gather complete session statistics for the auto-learning feature. As a result, detection profiles can only be selected in policies whose deployment-mode is offline-detection, and those policies will only be used by the FortiWeb appliance when its operation mode is offline-detection.
Unlike inline protection profiles, offline protection profiles do not support HTTP conversion, cookie poisoning detection, start page rules, and page access rules.
To apply detection profiles, select them within a server policy. For details, see
Before configuring an offline protection profile, first configure any of the following that you want to include in the profile: l l l l l a file upload restriction policy (see
config server-policy custom-application applicationpolicy
a server protection rule (see
) a list of manually trusted and black-listed IPs, FortiGuard IRIS category-based blacklisted IPs, and/or a geographically-based IP blacklist (see
,
config server-policy custom-application application-policy
and
) a parameter validation rule (see
config waf parameter-validation-rule
) a URL access policy (see
config waf url-access url-access-policy
534 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf web-protection-profile offline-protection l l l l l l l an allowed method exception (see
config waf allow-method-exceptions
a hidden field rule group (see
config waf hidden-fields-protection
) a parameter restriction constraint (see
config waf http-protocol-parameter-restriction
a brute force login attack sensor (see
a decompression rule (see
config waf file-uncompress-rule
) a policy that protects vulnerable block cipher implementations for web applications that selectively encrypt inputs
without using HTTPS ( config waf padding-oracle
) a user tracking policy (see
config waf user-tracking policy
)
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see
Syntax
config waf web-protection-profile offline-protection edit
<offline-protection-profile_name>
set
http-session-management {enable | disable}
set
http-session-timeout <seconds_int>
set
x-forwarded-for-rule <x-forwarded-for_name>
set set
http-session-keyword <key_str> signature-rule {"High Level Security" | "Medium Level Security" |
set set set set end next set set set set set set set set set set set set set set set set set set set set set set set set set set
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
535
waf web-protection-profile offline-protection
Variable
<offline-protectionprofile_name>
Description
Type the name of the offline protection profile. The maximum length is 35 characters.
To display the list of existing profile, type: edit ?
http-session-management
{enable | disable} http-session-timeout
<seconds_int>
Enable to track the states of HTTP sessions. Also configure
http-session-timeout <seconds_ int>
Although HTTP has no inherent support for sessions, a notion of individual HTTP client sessions, rather than simply the source IP address and/or timestamp, is required by some features.
For example, you might want to require that a client’s first
HTTP request always be a login page: the rest of the web pages should be inaccessible if they have not authenticated. Out-of-order requests could represent an attempt to bypass the web application’s native authentication mechanism. How can FortiWeb know if a request is the client’s first HTTP request? If FortiWeb were to treat each request independently, without knowledge of anything previous, it could not, by definition, enforce page order. Therefore FortiWeb must keep some record of the first request from that client (the session initiation). It also must record their previous
HTTP request(s), until a span of time (the session timeout) has elapsed during which there were no more subsequent requests, after which it would require that the session be initiated again.
The session management feature provides such
FortiWeb session support.
Note: This feature requires that the client support cookies.
Note: You must enable this option if you want to include this profile’s traffic in the traffic log, in addition to enabling traffic logs in general. For more information, see
and .
Type the HTTP session timeout in seconds. The valid range is from 20 to 3,600 seconds.
This setting is available only if http-sessionmanagement is enabled.
Default
No default.
disable
1200 config
536 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf web-protection-profile offline-protection
Variable Description Default
x-forwarded-for-rule <xforwarded-for_name>
Specify the name of a rule that configures FortiWeb’s use of X-
Forwarded-For: and X-Real-IP (see
No default.
http-session-keyword
<key_str>
No default.
If you want to use an HTTP header other than Session-
Id: to track separate HTTP sessions, enter the key portion of the HTTP header that you want to use, such as
Session-Num
.
The maximum length is 35 characters.
signature-rule {"High
Level Security" |
"Medium Level
Security" | "Alert
Only" | <signature-set_ name>}
Specify a signature policy to include in the profile (see
The maximum length is 35 characters.
To display the list of existing rules, type: set server-protection-rule ?
amf3-protocol-detection
{enable | disable} xml-protocol-detection
{enable | disable}
Enable to be able to scan requests that use action message format 3.0 (AMF3) for l l l cross-site scripting (XSS) attacks
SQL injection attacks common exploits if you have enabled those in the set of signatures specified by
signature-rule {"High Level Security" |
"Medium Level Security" | "Alert Only" | <signature-set_ name>} .
AMF3 is a binary format that can be used by Adobe Flash clients to send input to server-side software.
Caution: To scan for attacks or enforce input rules on
AMF3, you must enable this option. Failure to enable the option makes the FortiWeb appliance unable to scan
AMF3 requests for attacks.
Enable to scan for matches with attack and data leak signatures in Web 2.0 (XML AJAX) and other XML submitted by clients in the bodies of HTTP POST requests.
No default.
disable disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
537
waf web-protection-profile offline-protection
Variable
malformed-xml-check
{enable | disable}
Description
Enable to validate that XML elements and attributes in the request’s body conforms to the W3C XML 1.1
and/or
XML 2.0
standards.Malformed XML, such as without the final > or with multiple >> in the closing tag, is often an attempt to exploit an unhandled error condition in a web application’s XHTML or XML parser.
This feature is applicable only when xml-protocoldetection is enable. Attack log messages contain
Illegal XML Format when this feature detects malformed XML.
Default
disable malformed-xml-checkaction {alert | alert_ deny | block-period}
Specify the action that FortiWeb takes when it detects a request that contains malformed XML: l alert
— Accept the request and generate an alert email, a log message, or both.
l alert_deny
— Block the request and generate an alert email, a log message, or both.
l block-period
— Block the XML traffic for a number of seconds. Also configure
malformed-xml-block-period <blockperiod_int> .
alert
60 malformed-xml-blockperiod <block-period_ int>
Type the length of time that FortiWeb blocks XML traffic that contains malformed XML, in seconds.
The valid range is from 1 to 3,600 seconds.
malformed-xml-checkseverity {High | Low |
Medium}
Select the severity level to use in logs and reports generated when illegal XML formats are detected.
malformed-xml-checktrigger <trigger-policy_ name>
Type the name of the trigger to apply when illegal XML formats are detected (see
The maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
High
No default.
json-protocol-detection
{enable | disable} malformed-json-check
{enable | disable}
Enter enable to scan for matches with attack and data leak signatures in JSON data submitted by clients in HTTP requests with Content-Type: values application/json or text/json.
disable
Enter enable to scan for illegal formatting in JSON data.
disable config
538 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf web-protection-profile offline-protection
Variable
malformed-json-checkaction {alert | alert_ deny | block-period}
Description Default
Specify the action that FortiWeb takes when it detects a request that contains malformed JSON content: l alert
— Accept the request and generate an alert email, a log message, or both.
l alert_deny
— Block the request and generate an alert email, a log message, or both.
l block-period
— Block the JSON traffic for a number of seconds. Also configure malformed-json-blockperiod
.
No default.
malformed-json-blockperiod <block-period_ int>
Type the length of time that FortiWeb blocks traffic that contains malformed JSON content, in seconds.
The valid range is from 1 to 3,600 seconds.
60 malformed-json-checkseverity {High |
Medium | Low}
Select the severity level to use in logs and reports that
FortiWeb generates when it detects malformed JSON content.
malformed-json-checktrigger <trigger-policy_ name>
Type the name of the trigger to apply when FortiWeb detects malformed JSON content.
The maximum length is 35 characters.
To display the list of existing trigger policies, type: set trigger ?
High
No default.
custom-access-policy
<combo-access_name> padding-oracle <rule_ name> parameter-validationrule <rule_name>
Type the name of a custom access policy. See
config waf custom-access policy
is 35 characters.
To display the list of existing policies, type: set custom-access-policy ?
Type the name of a padding oracle protection rule. See
The maximum length is 35 characters.
To display the list of existing rule, type: set padding-oracle ?
Type the name of a parameter validation rule. See config waf parameter-validation-rule
maximum length is 35 characters.
To display the list of existing rule, type: set parameter-validation-rule ?
No default.
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
539
waf web-protection-profile offline-protection
Variable Description
hidden-fields-protection
<group_name>
Type the name of a hidden field rule group that you want to apply, if any. See
config waf hidden-fieldsprotection
. The maximum length is 35 characters.
To display the list of existing group, type: set hidden-fields-protection ?
file-upload-policy
<policy_name>
Type the name of a file upload restriction policy. See
config server-policy custom-application application-policy
characters.
To display the list of existing policy, type: set file-upload-policy ?
http-protocol-parameterrestriction <constraint_ name>
Type the name of an HTTP protocol constraint that you want to apply, if any. See
config waf httpprotocol-parameter-restriction
maximum length is 35 characters.
To display the list of existing constraint, type: set http-protocol-parameter-restriction
?
url-access-policy
<policy_name>
Type the name of a URL access policy. See
config waf url-access url-access-policy
maximum length is 35 characters.
To display the list of existing policy, type: set url-access-policy ?
allow-method-policy
<policy_name> brute-force-login
<sensor_name>
Type the name of an allowed method policy. See
config server-policy custom-application application-policy
characters.
To display the list of existing policies, type: set allow-method-policy ?
Type the name of a brute force login attack sensor. See
length is 35 characters.
To display the list of existing sensor, type: edit ?
Default
No default.
No default.
No default.
No default.
No default.
No default.
config
540 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf web-protection-profile offline-protection
Variable
ip-list-policy <policy_ name>
Description
Type the name of a trusted IP or blacklisted IP policy. See
config server-policy custom-application application-policy
characters.
To display the list of existing policy, type: set ip-list-policy ?
Default
No default.
geo-block-list-policy
<policy_name>
Type the name of a geographically-based client IP black list that you want to apply, if any. See
characters.
To display the list of existing group, type: set geo-block-list-policy ?
No default.
ip-intelligence
{enable | disable} known-search-engine
{enable | disable} file-uncompress-rule
<rule_name>
Enable to apply intelligence about the reputation of the client’s source IP. Blocking and logging behavior is configured in
disable
Enable to allow or block predefined search engines, robots, spiders, and web crawlers according to your settings in the global list.
disable
Type the name of an existing file decompression rule to use with this profile, if any. See
config waf fileuncompress-rule
characters.
To display the list of existing rule, type: set file-uncompress-rule ?
No default.
user-tracking-policy
<user-tracking-policy_ name> data-analysis {enable | disable}
Enter the name of a user tracking policy. See
No default.
comment "<comment_str>"
Enable this to collect data for servers covered by this profile.
To view the statistics for collected data, in the web UI, go to
Log&Report > Monitor > Data Analytics.
disable
Type a description or other comment. If the comment contains more than one word or contains an apostrophe, surround the comment in double quotes ( " ). The maximum length is 199 characters.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
541
waf x-forwarded-for config
Related topics
l
l
l
l
config waf parameter-validation-rule
l
config waf url-access url-access-rule
l
config waf allow-method-exceptions
l
l
config waf file-uncompress-rule
l
l
l
config waf hidden-fields-protection
l
config waf http-protocol-parameter-restriction
l
l
config server-policy custom-application application-policy
waf x-forwarded-for
Use this command to configure FortiWeb’s use of X-Forwarded-For: and X-Real-IP:.
For behavior of this feature and requirements, see the
the wafgrp area. For more information, see
Syntax
config waf x-forwarded-for edit
set
block-based-on-original-ip {enable | disable}
set set
ip-location {left | right} original-ip-header <http-header-key_str>
set set set set
tracing-original-ip {enable | disable}
x-forwarded-proto {enable | disable}
x-forwarded-for-support {enable | disable} x-real-ip {enable | disable}
config ip-list edit
set
end next end next
542 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf x-forwarded-for
Variable
<x-forwarded-for_name>
Description
Type the name of the new or existing group. The maximum length is 63 characters.
To display the list of existing groups, type: edit ?
block-based-on-originalip {enable | disable}
Enable to be able to block requests that violate your policies by using the original client’s IP derived from this
HTTP X-header.
When disabled, only attack logs and reports will use the original client’s IP.
ip-location {left | right} original-ip-header
<http-header-key_str>
Select whether to extract the original client’s IP from either the left or right end of the HTTP X-header line.
Most proxies put the request’s origin at the left end, which is the default setting. Some proxies, however, place it on the right end.
Type the key such as X-Forwarded-For X-Real-IP,
without the colon ( : ), of the X-header that contains the original source IP address of the client. Also configure
tracing-original-ip {enable | disable}
and, for security reasons,
Maximum length is 255 characters.
tracing-original-ip
{enable | disable}
If FortiWeb is deployed behind a device that applies NAT, enable this option to derive the original client’s source IP address from an HTTP X-header,
instead of the SRC field in the IP layer. Also configure
and, for security reasons,
This HTTP header is often X-Forwarded-For: when traveling through a web proxy, but can vary. For example, the Akamai service uses True-Client-IP:.
For deployment guidelines and mechanism details, see the
FortiWeb Administration Guide
.
Caution: To combat forgery, configure the IP addresses of load balancers and proxies that are trusted providers of this header. Also configure those proxies/load balancers to reject fraudulent headers, rather than passing them to
FortiWeb.
Default
No default.
disable left
No default.
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
543
waf x-forwarded-for
Variable
x-forwarded-proto
{enable | disable}
Description
Enable to add an X-Forwarded-Proto: header that indicates the protocol used in the client’s original request.
Requires reverse proxy mode or true transparent proxy.
Default
disable x-forwarded-for-support
{enable | disable}
Enable to include the X-Forwarded-For: HTTP header on requests forwarded to your web servers.
Behavior varies by the header already provided by the
HTTP client or web proxy, if any.
l
Header absent — Add the header, using the source IP address of the connection.
l
Header present — Verify that the source IP address of the connection is present in this header’s list of IP addresses. If it is not, append it.
This option can be useful for web servers that log or analyze clients’ IP addresses, and support the X-
Forwarded-For: header. When this option is disabled, from the web server’s perspective, all connections appear to be coming from the FortiWeb appliance, which performs network address translation
(NAT). But when enabled, the web server can instead analyze this header to determine the source and path of the original client connection.
This option applies only when FortiWeb is operating in reverse proxy mode or true transparent proxy.
disable x-real-ip {enable | disable}
Enable to include the X-Real-IP: HTTP header on requests forwarded to your web servers. Behavior varies by the header already provided by the HTTP client or web proxy, if any (see
x-forwarded-for-support {enable | disable}
).
Like X-Forwarded-For:, this header is also used by some proxies and web servers to trace the path, log, or analyze based upon the packet’s original source IP address.
This option applies only when FortiWeb is operating in reverse proxy mode or true transparent proxy.
disable config
544 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config waf x-forwarded-for
Variable
x-forwarded-proto
{enable | disable}
<entry_index> ip <load-balancer_ip>
Description
Enable to add an HTTP header that indicates the service used in the client’s original request.
Usually if your FortiWeb is receiving HTTPS requests from clients, and it is operating in reverse proxy mode,
SSL/TLS is being offloaded. FortiWeb has terminated the
SSL/TLS connection and the second segment of the request, where it forwards to the back-end servers, is clear text HTTP. In some cases, your back-end server may need to know that the original request was, in fact, encrypted HTTPS, not HTTP.
Type the index number of the individual entry in the table.
The valid range is from 1 to 9,223,372,036,854,775,807.
Each list can contain a maximum of 256 IP addresses.
Type the IP address of a load balancer or proxy that is in front of the FortiWeb appliance (between the client and
FortiWeb).
To apply anti-spoofing measures and improve security,
FortiWeb trusts the contents of the HTTP header that you specify in
original-ip-header <http-header-key_str>
only if the packet arrived from one of the IP addresses you specify here. It regards
original-ip-header <http-headerkey_str>
from other IP addresses as potentially spoofed.
For packets from other IP addresses, FortiWeb ignores the X-Forwarded-For: header and uses the source
IP address in the IP header as the client source address.
This IP address is displayed in the attack log message.
Default
disable
No default.
No default.
Example
The following example defines a X-Forwarded-For rule that adds X-Forwarded-For: , X-Real-IP:, and
X-Forwarded-Proto: headers to traffic that FortiWeb forwards to a back-end server. It enables FortiWeb to use the HTTP X-Header to identify and block the original client's IP. To protect against XFF spoofing, it also specifies the trusted load-balancer 192.168.1.105 in the X-Forwarded-For IP list.
config waf x-forwarded-for edit "load-balancer1" set x-forwarded-for-support enable set tracing-original-ip enable set original-ip-header X-FORWARDED-FOR set x-real-ip enable set x-forwarded-proto enable config ip-list edit 1 set ip 192.168.1.105
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
545
wvs policy end end next set block-based-on-original-ip enable next config
wvs policy
Use this command to define a web vulnerability scan policy. The policy enables you to set the frequency of the vulnerability scan, schedule the scan, and choose a format for the scan report. The policy also enables you to select an email policy that determines who receives the scan report.
Before you can complete a web vulnerability scan policy, you must first configure a scan profile using the
FortiWeb web UI and a scan schedule using either the web UI or the command
To use this command, your administrator account’s access control profile must have either w or rw permission to the wvsgrp area. For more information, see
Syntax
config wvs policy edit
set set set set set set end next
Variable
<wvs-policy_name> type {runonce | schedule}
Description
Type the name of a new or existing web vulnerability scan policy. The maximum length is 35 characters.
To display the list of existing policies, type: edit ?
Select either: l runonce
— Run the scan immediately after you complete the policy.
l schedule
— Run the scan on a schedule. Also configure
analyzer-policy <fortianalyzer-policy_name>
.
Default
No default.
runonce
546 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config wvs policy
Variable
schedule <wvs-schedule_ name>
Description
Type the name of an existing web vulnerability scan schedule. See
maximum length is 35 characters.
To display the list of existing schedules, type: set schedule ?
This setting is applicable only if type is schedule.
profile <wvs-profile_ name>
Type the name of an existing web vulnerability scan profile.
email <email-policy_ name>
Type the name of an existing email policy. See
. When the scan completes, the
FortiWeb appliance will send email in the specified format to the email addresses in the policy. The maximum length is 35 characters.
To display the list of existing policy, type: set email ?
report_format {html mht pdf rtf text}
Select one or more file formats of the report to attach when emailing it.
runtime <count_int>
Not configurable.
To reset the value to zero, enter: set runtime 0
Default
No default.
No default.
No default.
html
No default.
Example
The following example defines a recurring vulnerability scan with email report output in RTF and text format.
config wvs policy edit "wvs-policy1" set type schedule set schedule "wvs-schedule1" set report_format rtf text set profile "wvs-profile1" set email "EmailPolicy1" end next
Related topics
l
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
547
wvs profile config
wvs profile
Use this command to display the names of web vulnerability scan profiles.
This command can only be used to display the names of the profiles. It cannot configure the profiles. To create a web vulnerability scan profile, you must use the web
UI.
A web vulnerability scan (WVS) profile defines the web server to scan, as well as the specific vulnerabilities to scan for. The WVS profiles are associated with WVS policies, which determine when to perform the scan and how to publish the results of the scan defined by the profile.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wvsgrp area. For more information, see
Syntax
config wvs profile get end show
Example
This example displays the names of all configured web vulnerability scan profiles.
config wvs profile get
Output:
== [ WVS-Profile1 ] name: WVS-Profile1
== [ WVS-Profile2 ] name: WVS-Profile2
Example
This example displays the names of all configured web vulnerability scan profiles, using configuration file syntax.
config wvs profile show
Output: config wvs profile edit "WVS-Profile1" next edit "WVS-Profile2" next end
548 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
config wvs schedule
Related topics
l
l
wvs schedule
Use this command to schedule a web vulnerability scan.
Vulnerability scanning can detect known vulnerabilities on your web servers and web applications, helping you to design protection profiles. Vulnerability scans start from an initial directory, then scan for vulnerabilities in web pages located in the same directory or subdirectory as the initial URL.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wvsgrp area. For more information, see
Syntax
config wvs schedule edit
set
set
set
set
wday {Sunday Monday Tuesday Wednesday Thursday Friday Saturday}
end next
Variable
<schedule_name>
Default
No default.
type {recurring | onetime}
Description
Type the name of new or existing WVS schedule. The maximum length is 35 characters.
To display the list of existing schedule, type: edit ?
Select either: l onetime
— Run the scan only when an administrator manually initiates it. Also configure
.
l recurring
— Run the scan periodically, on a schedule.
Also configure
and
Tuesday Wednesday Thursday Friday Saturday}
.
onetime
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
549
wvs schedule
Variable
date <time_str> <date_ str> time <time_str> wday {Sunday Monday
Tuesday Wednesday
Thursday Friday
Saturday}
Description
For a one-time web vulnerability scan, enter the time and date for the scan to run.
The time format is hh:mm and the date format is yyyy/mm/dd
, where: l hh is the hour according to a 24-hour clock l mm is the minute l yyyy is the year l mm is the month l dd is the day
Year range is 2001-2050.
This only applies if type is onetime.
Specify the time the vulnerability scan is to be performed.
The time format is hh:mm, where: l hh is the hour according to a 24-hour clock l mm is the minute
This only applies if type is recurring.
For a recurring scan only, enter one or more days of the week the scan is to be performed.
This setting only applies if type is recurring.
Default
No default.
No default.
No default.
Example
The following example schedules a recurring vulnerability scan to run every Sunday and Thursday at 1:00 AM.
config wvs schedule edit "WVS-schedule1" set type recurring set time 01:00 end set wday Sunday Thursday next
Related topics
l
l
config
550 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose
diagnose
The diagnose commands display diagnostic information that help you troubleshoot problems. These commands do not have an equivalent in the web UI.
This chapter describes the following commands:
diagnose debug application autolearn
diagnose debug application detect diagnose debug application dssl
diagnose debug application fds
diagnose debug application hasync
diagnose debug application hatalk
diagnose debug application http
diagnose debug application miglogd
diagnose debug application mulpattern
diagnose debug application proxy
diagnose debug application ustack
diagnose debug application waf-fdsupdate
diagnose debug application proxyerror
diagnose debug application snmp diagnose debug application ssl
diagnose debug application sysmon
diagnose debug console timestamp
diagnose debug crashlog diagnose debug dnsproxy list
diagnose debug emerglog diagnose debug flow filter
diagnose debug flow filter module-detail
diagnose debug flow trace diagnose debug flow trace
diagnose hardware logdisk info
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
551
debug diagnose
diagnose system ha status diagnose system ha sync-stat
debug
Use this command to turn debug log output on or off.
Debug logging can be very resource intensive. To minimize the performance impact on your FortiWeb appliance, use packet capture only during periods of minimal traffic, with a local console CLI connection rather than a Telnet or SSH CLI connection, and be sure to stop the command when you are finished.
By default, the most verbose logging that is available from the web UI for any log type is the
Information severity level. Due to their usually unnecessary nature, logs at the severity level of
Debug are disabled and hidden. They can only be enabled and viewed from the CLI. Typically this is done only if your configuration seems to be correct, you cannot diagnose the problem without more information, and possibly suspect that you may have found either a hardware failure or software bug.
To generate debug logs, you must:
1. Set the verbosity level for the specific module whose debugging information you want to view, via a debug log command such as: debug application
hasync [{-1 | 0 | 1 | 2 | 4 | 8}]
2. If necessary configure any filters specific to the module whose debugging information you are viewing, such as: debug flow filter server-ip 10.0.0.10
3. If necessary start debugging specific to the module, such as: debug flow trace start
4. Enable debug logs overall. To do this, enter:
enable
5. View the debug logs. For convenience, debugging logs are immediately output to your local console display or terminal emulator, but debug log files can also be uploaded to a server. For more complex issues or bugs, this
552 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose debug may be required in order to send debug information to Fortinet Technical Support . To do this, use the command: debug upload
Debug logs will be generated only if the application is running. To verify this, use
. Otherwise, use
instead.
6. The CLI will display debug logs as they occur until you either: l
Disable it by either typing: diagnose debug disable or setting all modules’ debug log verbosity back to 0. To reset all verbosity levels simultaneously, you can use the command: diagnose debug reset l l l
Close your terminal emulator, thereby ending your administrative session.
Send a termination signal to the console by pressing Ctrl+C.
Reboot the appliance. To do this, you can use the command: execute reboot
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose
Variable Description
debug {enable | disable} Select whether to enable or disable recording of logs at the debug severity level.
Default
disable
Related topics
l
diagnose debug application autolearn
l
diagnose debug application detect
l
diagnose debug application dssl
l
diagnose debug application fds
l
diagnose debug application hasync
l
diagnose debug application hatalk
l
diagnose debug application http
l
diagnose debug application miglogd
l
diagnose debug application mulpattern
l
diagnose debug application proxy
l
diagnose debug application proxy-error
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
553
debug application autolearn l
diagnose debug application snmp
l
diagnose debug application ssl
l
diagnose debug application sysmon
l
diagnose debug application ustack
l
diagnose debug application waf-fds-update
l
l
l
l
l
diagnose
debug application autolearn
Use this command to view and set the verbosity level of debug logs for auto-learning.
Before you can see any debug logs, you must first enable debug log output using the command
.
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug application
Variable
autolearn [{autolearn_ int}]
Description
Specifies the verbosity level to output to the CLI display after the command executes.
Valid range is 0 to 7, where 0 disables debug logs for autolearning and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level. For example: autolearn debug level is 0
Default
0
Related topics
l
l
diagnose debug console timestamp
l
l
l
554 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose debug application detect
debug application detect
Use this command to set the verbosity level of debug logs for intrusion detection.
Before you can see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug application
Variable
detect [{0-7}]
Description
Optionally, type the number that specifies the verbosity level to output to the CLI display after the command executes.
Valid range is 0 to 7, where 0 disables debug logs for intrusion detection and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level: detect debug level is 0
Default
0
Related topics
l
l
diagnose debug console timestamp
l
l
l
debug application dssl
Use this command to set the verbosity level of debug logs for SSL inspection (temporary decryption in order to enforce policies). SSL inspection is used only when FortiWeb is operating in a mode that supports it, such as transparent inspection mode or offline protection mode.
Before you will be able to see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
555
debug application fds diagnose
Syntax
diagnose debug application
Variable
dssl [{0-7}]
Description
Optionally, type the number that specifies the verbosity level to output to the CLI display after the command executes.
Valid range is 0 to 7, where 0 disables debug logs for SSL inspection and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level. For example: dssl debug level is 0
Default
0
Related topics
l
l
diagnose debug console timestamp
l
l
l
debug application fds
Use this command to set the verbosity level of debug logs for update requests to the Fortinet Distribution Network
(FDN).
Before you will be able to see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug application
556 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose
Variable
fds [{0-7}] debug application hasync
Description
Optionally, type the number that specifies the verbosity level to output to the CLI display after the command executes.
Valid range is 0 to 7, where 0 disables debug logs for FDN updates and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level. For example: fds debug level is 0
Default
0
Related topics
l
l
diagnose debug console timestamp
l
l
l
debug application hasync
Use this command to set the verbosity level and type of debug logs for HA synchronization.
Before you will be able to see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug application
hasync [{-1 | 0 | 1 | 2 | 4 | 8}]
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
557
debug application hasync
Variable
hasync [{-1 | 0 | 1 |
2 | 4 | 8}]
Description Default
Optionally, type the number indicating the verbosity level and type of debugging messages to output to the CLI display after the command executes.
l
-1 — Display all messages.
l
0 — Do not display messages.
l
1 — Display application messages such as MD5 checksums for the configuration, and confirmation that the standby appliance received the synchronized data.
l
2 — Display network transmission messages, such as ARP broadcasts and bridge down/up status changes.
l
4 — Display packet transmission messages.
l
8 — Display messages about configuration file (fwb_ system.conf) merges.
If you omit the number, the CLI displays the current verbosity level: hasync debug level is 0
0 diagnose
Example
This example enables diagnostic debug logging in general, then specifically enables packet transmission logging of the HA synchronization daemon, hasyncd.
diagnose debug enable diagnose debug application hasync level 4
The CLI displays output such as the following until the command is terminated:
FortiWeb # (ha_sync.c : 624) : No element in ha send queue
(ha_send_queue.c : 184) : add request to ha sendqueue success
(ha_send_queue.c : 184) : add request to ha sendqueue success
(ha_send_queue.c : 242) : read send request from local, len = 447
(ha_send_queue.c : 242) : read send request from local, len = 450
(ha_sync.c : 637) : Got an element from ha send queue
(ha_sync.c : 454) : msglen : 23, msgbuf : config system dns end
(ha_sync_send.c : 475) : total cnt : 1, cur cnt : 0
(ha_sync_send.c : 357) : send buf len = 171
(ha_sync_send.c : 383) : sent conf(0) return 171 bytes
(ha_sync_send.c : 406) : Send conf success from [hbdev], and got reply
(ha_sync.c : 637) : Got an element from ha send queue
(ha_sync.c : 454) : msglen : 26, msgbuf : config system global end
(ha_sync_send.c : 475) : total cnt : 1, cur cnt : 0
(ha_sync_send.c : 357) : send buf len = 174
(ha_sync_send.c : 383) : sent conf(0) return 174 bytes
(ha_sync_send.c : 406) : Send conf success from [hbdev], and got reply
(ha_sync.c : 624) : No element in ha send queue
558 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose debug application hasync
(ha_sync.c : 624) : No element in ha send queue
(ha_sync.c : 624) : No element in ha send queue
(ha_send_queue.c : 184) : add request to ha sendqueue success
(ha_send_queue.c : 242) : read send request from local, len = 424
(ha_sync.c : 637) : Got an element from ha send queue
(ha_sync_send.c : 475) : total cnt : 1, cur cnt : 0
(ha_sync_send.c : 357) : send buf len = 178
(ha_sync_send.c : 383) : sent conf(0) return 178 bytes
(ha_sync_send.c : 406) : Send conf success from [hbdev], and got reply
(ha_sync.c : 624) : No element in ha send queue
(ha_sync.c : 624) : No element in ha send queue
(ha_sync_recv.c : 362) : Got an valid packet, len = 180
(ha_sync_recv.c : 759) : Enter Fun : sync_recv_msg
(ha_sync_recv.c : 248) : Enter Fun : _sync_packet_check_msg, buflen = 180
(ha_sync_recv.c : 262) : msg body ssid : AC6C02
(ha_sync_recv.c : 285) : add new pkt_ss_id to last_pkt_ss_id[8]
(ha_sync_recv.c : 780) : We recved an valid SYNC_MSG(29) packet
(ha_send_queue.c : 184) : add request to ha sendqueue success
(ha_send_queue.c : 242) : read send request from local, len = 440
(ha_send_queue.c : 184) : add request to ha sendqueue success
(ha_send_queue.c : 242) : read send request from local, len = 424
(ha_sync.c : 637) : Got an element from ha send queue
(ha_sync.c : 454) : msglen : 16, msgbuf : 2â¢O
(ha_sync_send.c : 475) : total cnt : 1, cur cnt : 0
(ha_sync_send.c : 357) : send buf len = 164
(ha_sync_send.c : 383) : sent conf(0) return 164 bytes
(ha_sync_send.c : 406) : Send conf success from [hbdev], and got reply
(ha_sync.c : 637) : Got an element from ha send queue
(ha_sync_send.c : 475) : total cnt : 1, cur cnt : 0
(ha_sync_send.c : 357) : send buf len = 178
(ha_sync_send.c : 383) : sent conf(0) return 178 bytes
(ha_sync_send.c : 406) : Send conf success from [hbdev], and got reply
The results indicate that, initially, the MD5 configuration hash did not indicate any configuration changes (No element in ha send queue
). But then an administrator changed the configuration, perhaps through the web UI, and the appliance detected changes to its DNS (msgbuf : config system dns) and global
(msgbuf : config system global) settings. The active appliance then sent the changes to the standby appliance (Send conf success from [hbdev], and got reply); causes of success or failure is detailed by other debugging messages, such as the number of items in the synchronization queue (total cnt
: 1, cur cnt : 0
), and the number of bytes transferred from the synchronization buffer (send buf len
= 178
).
Related topics
l
l
diagnose debug console timestamp
l
l
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
559
debug application hatalk diagnose
debug application hatalk
Use this command to set the verbosity level and type of debug logs for HA heartbeats.
Before you will be able to see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug application hatalk
Variable
[{-1 | 0 | 1 | 2}]
Description
Optionally, type the number indicating the verbosity level and type of debugging messages to output to the CLI display after the command executes.
l
-1 — Display all messages.
l
0 — Do not display messages.
l
1 — Display application messages such as MD5 checksums for the configuration, and confirmation that the standby appliance received the synchronized data.
l
2 — Display network transmission messages, such as ARP broadcasts and bridge down/up status changes.
If you omit the number, the CLI displays the current verbosity level: hatalk debug level is 0
Default
0
Example
This example enables diagnostic debug logging in general, then specifically enables complete debug logging of the HA heartbeat daemon, hatalkd.
diagnose debug enable diagnose debug application hatalk -1
The CLI displays output such as the following until the command is terminated:
FortiWeb # (ha_hb.c : 176) : mem-table[0]:
(ha_hb.c : 61) : member name : wasp
(ha_hb.c : 62) : member pcnt : 0
(ha_hb.c : 63) : member pri : 5
(ha_hb.c : 64) : member sn : FV-1KC3R11700136
(ha_hb.c : 65) : member age : 11209
(ha_hb.c : 66) : member role : 1
(intf_check.c : 273) : clicfg->monitor_count : 1, count : 1
(ha_hb_send.c : 85) : sock : 26, sendlen : 264(head: 88, mem(2) 88)
560 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose debug application http
(ha_hb_send.c : 104) : Send HB buf success.
(ha_hb.c : 83) : Enter Function : get_master_sn
(ha_hb.c : 756) : -------------------------
(ha_hb.c : 760) : ==> HB..., I'am (Master) master is : FV-1KC3R11700094
(ha_hb.c : 637) : update my status info : FV-1KC3R11700094
(ha_hb.c : 871) : Enter Fun : hb_packet_check
(ha_hb.c : 897) : mysn : FV-1KC3R11700094(0), comesn : FV-1KC3R11700136(1)
(ha_hb_recv.c : 446) : Got an valid HB packet(port3), len : 176
(ha_hb_recv.c : 451) : come from : FV-1KC3R11700136
(ha_hb_recv.c : 104) : fill ha member to local
(ha_hb_recv.c : 251) : slave (FV-1KC3R11700136) arrived ...
(ha_hb_recv.c : 342) : An exist slave device arrive...
(ha_hb_recv.c : 512) : sockfd1 : 200(UP), sockfd2 : 0(DOWN)
(ha_hb.c : 159) : Enter Function : print_member_tab
(ha_hb.c : 166) : total cnt : 2
(output truncated)
(main.c : 1005) : send short cli msg to :
FV-1KC3R11700136
(main.c : 1349) : switch MASTER -> SLAVE
(main.c : 1350) : block ARP
(main.c : 1219) : HA device into Slave mode
(main.c : 1220) : device block ARP
(main.c : 1121) : Get BrgInfo, my brgCnt = 0
The results indicate that the HA cluster is named wasp (group ID 0, HA link over port3). It is formed by the active appliance FV-1KC3R11700094 (device priority 5) and the standby appliance FV-1KC3R11700136. The two appliances then switched rules — that is, a failover occurred.
Related topics
l
l
diagnose debug console timestamp
l
l
l
debug application http
Use this command to set the verbosity level of debug logs for the HTTP protocol parser. This parser module dissects the HTTP headers and content body for analysis by other modules such as rewriting, HTTP protocol constraints, server information disclosure, and attack signature matching.
If the debug logs indicate that the HTTP protocol parser may be encountering an error condition, you can temporarily disable it and allow packets to bypass it to verify if this is the case. See
in
.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
561
debug application miglogd diagnose
Before you will be able to see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug application
Variable Description
http [{0-7}]
Optionally, type the number that specifies the verbosity level to output to the CLI display after the command executes.
Valid range is 0 to 7, where 0 disables debug logs for the
HTTP protocol parser and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level. For example: http debug level is 0
Default
0
Related topics
l
l
diagnose debug console timestamp
l
l
l
l
debug application miglogd
Use this command to set the verbosity level of debug logs for the log daemon, miglogd.
Before you will be able to see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug application
562 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose
Variable
miglogd [{0-7}] debug application mulpattern
Description
Optionally, type the number that specifies the verbosity level to output to the CLI display after the command executes.
Valid range is 0 to 7, where 0 disables debug logs for the log daemon and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level. For example: miglogd debug level is 0
Default
0
Related topics
l
l
diagnose debug console timestamp
l
l
l
l
debug application mulpattern
Use this command to set the verbosity level of debug logs for the pattern matching module.
Before you will be able to see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug application
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
563
debug application proxy
Variable
mulpattern [{0-7}]
Description
Optionally, type the number that specifies the verbosity level to output to the CLI display after the command executes.
Valid range is 0 to 7, where 0 disables debug logs for the pattern matching module and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level. For example: mulpattern debug level is 0 diagnose
Default
0
Related topics
l
l
diagnose debug console timestamp
l
l
l
debug application proxy
Use this command to set the verbosity level of debug logs for flow through the XML application proxy.
Before you will be able to see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug application
Variable Description
proxy [{0-7}] Optionally, type the number that specifies the verbosity level to output to the CLI display after the command executes.
Valid range is 0 to 7, where 0 disables debug logs for the
XML application proxy flow and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level. For example: proxy debug level is 0
Default
0
564 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose debug application proxy-error
Related topics
l
l
diagnose debug console timestamp
l
l
l
debug application proxy-error
Use this command to set the verbosity level of debug logs for errors in the XML application proxy.
Before you will be able to see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug application
Variable Description
proxy-error [{-1 | 0}]
Optionally, type the number that specifies the verbosity level to output to the CLI display after the command executes.
Valid range is 0 to 7, where 0 disables debug logs for XML application proxy errors and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level. For example: proxy-error debug level is 0
Default
0
Related topics
l
l
diagnose debug console timestamp
l
l
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
565
debug application snmp diagnose
debug application snmp
Use this command to debug the SNMP daemon.
Syntax
diagnose debug application
Variable
snmp <snmp_int>
Description
Specifies the verbosity level to output to the CLI display after the command executes.
Valid range is 0 to 7, where 0 disables SNMP debugging and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level: snmp debug level is 0
Default
0
Related topics
l
l
diagnose debug console timestamp
l
l
l
debug application ssl
Use this command to set the verbosity level of debug logging for SSL/TLS offloading. SSL offloading is supported only when the FortiWeb appliance is operating in reverse proxy mode or true transparent proxy mode.
Before you will be able to see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug application
566 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose
Variable
ssl [{0-7}]
Description
Specifies the verbosity level to output to the CLI display after the command executes.
Valid range is 0 to 7, where 0 disables debug logging of
SSL/TLS offloading and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level. For example: ssl debug level is 0 debug application sysmon
Default
0
Example
This example enables diagnostic debug logging overall, then specifically enables debug logging for SSL in reverse proxy mode.
diagnose debug enable diagnose debug application ssl
Related topics
l
l
diagnose debug console timestamp
l
l
l
debug application sysmon
Use this command to debug the system monitor.
Syntax
diagnose debug application
Variable
sysmon <sysmon_int>
Description
Specifies the Sysmon debug level.
Valid range is 0 to 7, where 0 disables system monitor debugging and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level. For example: sysmon debug level is 0
Default
0
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
567
debug application ustack diagnose
Related topics
l
l
diagnose debug console timestamp
l
l
l
debug application ustack
Use this command to set the verbosity level of debug logs for the user-space TCP/IP connectivity stack.
Before you will be able to see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug application
Variable
ustack [{0-7}]
Description
Specifies the verbosity level to output to the CLI display after the command executes.
Valid range is 0 to 7, where 0 disables debug logging of the user-space TCP/IP connectivity stack and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level. For example: ustack debug level is 0
Default
0
Related topics
l
l
diagnose debug console timestamp
l
l
l
568 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose debug application waf-fds-update
debug application waf-fds-update
Use this command to debug the FortiGuard service update processs.
Syntax
diagnose debug application
waf-fds-update <fds-update_int>
Variable
waf-fds-update <fdsupdate_int>
Description
Specifies the verbosity level to output to the CLI display after the command executes.
Valid range is 0 to 7, where 0 disables FortiGuard
Distribution Server (FDS) update debugging and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level. For example: waf-fds-update debug level is 0
Default
0
Related topics
l
l
diagnose debug console timestamp
l
l
l
debug cli
Use this command to set the debug level for the command line interface (CLI).
Before you will be able to see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
569
debug cmdb
Variable
cli [{0-7}]
Description
Optionally, type the number that specifies the verbosity level to output to the CLI display after the command executes.
Valid range is 0 to 7, where 0 disables debug logs for the
CLI and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level. For example: cli debug level is 0 diagnose
Default
3
Related topics
l
l
diagnose debug console timestamp
l
l
l
debug cmdb
Use this command to enable the debug log for the configuration management database (CMDB).
Before you will be able to see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug cmdb
Related topics
l
l
diagnose debug console timestamp
l
l
l
570 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose debug comlog
debug comlog
Use this command to enable or disable saving to disk of kernel or daemon core dump logs when you press the
NMI button on the appliance. This button is not available on all models. For details, see the
FortiWeb NMI &
COMlog Technical Note
and your model’s QuickStart Guide.
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug comlog daemon enable diagnose debug comlog kernel enable diagnose debug comlog daemon show diagnose debug comlog kernel show diagnose debug comlog daemon clear diagnose debug comlog kernel clear diagnose debug comlog info
Related topics
l
l
debug console timestamp
Use this command to enable or disable the timestamp in debug logs.
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug console
timestamp [{enable | disable}]
Variable
timestamp [{enable | disable}]
Description
Type enable to add timestamps to debug output or disable to remove them.
If you omit the selection, the CLI displays the current timestamp status: console timestamp is disabled.
Default
disable
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
571
debug crashlog diagnose
Related topics
l
l
debug crashlog
Use this command to show crash logs from application proxies that have call back traces, segmentation faults, or memory register dumps, or to delete the crash log.
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug crashlog show diagnose debug crashlog clear
Example
diagnose debug crashlog show
Output similar to the following appears in the CLI:
2011-02-08 06:20:46 <18632> firmware FortiWeb-1000B 4.20,build0403,110131
2011-02-08 06:20:46 <18632> application proxy
2011-02-08 06:20:46 <18632> *** signal 11 (Segmentation fault) received ***
2011-02-08 06:20:46 <18632> Register dump:
2011-02-08 06:20:46 <18632> RAX: 00000000 RBX: 00000001 RCX: 00000001 RDX:
00000001
2011-02-08 06:20:46 <18632> RSI: 008d91a4 RDI: 00000000 RBP: 2b8f90ee2b10 RSP:
0072af60
2011-02-08 06:20:46 <18632> RIP: 008d8660 EFLAGS: 2b8f9aaa0010
2011-02-08 06:20:46 <18632> CS: 86b0 FS: 0000 GS: 008d
2011-02-08 06:20:46 <18632> Trap: 7fff26859ee0 Error: 008d8710 OldMask:
00440f90
2011-02-08 06:20:46 <18632> CR2: 00010202
2011-02-08 06:20:46 <18632> Backtrace:
2011-02-08 06:20:46 <18632> [0x008d8660] => /bin/xmlproxy (g_proxy+0x00000000)
2011-02-08 06:20:46 proxy received SEGV signal - 11
debug dnsproxy list
Use this command to display the DNS cache that stores the results of resolving all fully qualified domain names in the server pools.
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
572 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose debug emerglog
Syntax
diagnose debug dnsproxy list
Example
diagnose debug dnsproxy list
If the domain specified for the server pool member is www.example.org and has resolved to 10.20.5.12, output similar to the following is displayed: www.example.org
10.20.5.12
10:20::5:12
Related topics
l
debug emerglog
Use this command to view or erase disk read-only error logs.
Syntax
diagnose debug emerglog
Variable Description
{show | clear} Type show to view disk read-only error logs.
Type clear to delete error logs.
Default
No default
debug flow filter
Use these commands to generate only packet flow debug logs that match your filter criteria, such as a specific destination IP address. You can also use these commands to delete the packet flow debug log filter, so that all packet flow debug logs are generated.
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug flow filter reset diagnose debug flow filter
client-ip <source_ipv4 | source_ipv6>
diagnose debug flow filter
server-ip <destination_ipv4 | destination_ipv6>
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
573
debug flow filter module-detail diagnose
Variable
client-ip <source_ipv4 | source_ipv6>
Description
Type the source (SRC) IP address of connections.
This will generate only packet flow debug log messages involving that source IP address.
Note: This filter operates at the IP layer, not the
HTTP layer.
If a load balancer or other web proxy is deployed in front of FortiWeb, and therefore all connections for
HTTP requests appear to originate from this IP address, configuring this filter will have no effect.
Similarly, if multiple clients share an Internet connection via NAT or explicit web proxy, configuring this filter will only isolate connections that share this IP address. It will
not be able to filter out a single client based on individual HTTP sessions from that IP.
server-ip <destination_ipv4
| destination_ipv6>
Type the destination (DST) IP address of the connection, either the: l virtual server on FortiWeb (if FortiWeb is operating in reverse proxy mode) l protected web server on the back end (all other operation modes)
This will generate only packet flow debug log messages involving that server IP address.
Default
No default.
No default.
Related topics
l
debug flow filter module-detail
Use this command to include or exclude debug logs from each FortiWeb feature module as the packet is processed when generating packet flow debug logs. This can be useful if you suspect that a module is encountering errors, or need to know which module is dropping the packet.
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug flow filter
574 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose debug flow reset
Variable
module-detail {on | off}
Description
Select whether to include (on) or exclude (off) details from each module that processes the packet.
Default
No default.
Related topics
l
l
debug flow reset
Use this command to reset the configuration of packet flow debug log messages.
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug flow reset
Related topics
l
l
diagnose debug flow filter module-detail
debug flow trace
Use this command to trace the flow of packets through the FortiWeb appliance’s processing modules and network stack.
Before you can see any debug logs, you must first enable debug log output using the command
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug flow
Variable Description
trace {start | stop} Select whether to enable (start) or disable (stop) the recording of packet flow trace debug log messages.
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
575
debug flow trace diagnose
Example
This example configures a filter based on the packet destination IP 172.120.20.48, enables messages from each packet processing module, enables packet flow traces, then finally begins generating the debug logs that are enabled for output (in this case, only packet trace debug logs).
Because the filters are configured before debug logging is enabled, the administrator can type the filter without being interrupted by debug log output to the CLI.
diagnose debug flow filter server-ip 172.20.120.48
diagnose debug flow flow module-detail on diagnose debug flow trace start diagnose debug enable
Output:
FortiWeb # session_id=251 packet_id=0 policy_name=policy1 msg=" Receive packet from client
172.20.120.225:49428 " session_id=251 packet_id=0 msg=" HTTP parsing client packet success " session_id=251 packet_id=0 policy_name="policy1" msg="
Module name:WAF_IP_LIST_CHECK, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_X_FORWARD_FOR_PROCESS, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_GEO_BLOCK_LIST, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_PROTECTED_SERVER_CHECK, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_ALLOW_METHOD_PROCESS, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_HTTP_ACTIVE_SCRIPT, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_HTTP_SESSION_MANAGEMENT, Execution:4, Process error:1 , Action:ACCEPT
Module name:WAF_HTTP_DOS_PREVENTION, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_LAYER4_DOS_PREVENTION, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_HTTP_AUTHENTICATION, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_GLOBAL_WHITE_LIST, Execution:4 , Process error:0, Action:ACCEPT
Module name:WAF_URL_ACCESS_POLICY, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_BRUCE_FORCE_LOGIN, Execution:3, Process error:0, Action:ACCEPT
Module name:HTTP_CONSTRAINTS, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_COOKIE_POISON, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_START_PAGES, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_PAGE_ACCESS_RULE, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_FILE_UPLOAD_RESTRICTION_POLICY, Execution:3, Process error:0,
Action:ACCEPT
Module name:ROBOT_CONTROL_PROCESS, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_PARAMETWER_VALIDATION_PROCESS, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_CHUNK_DECODE, Execution:3, Process error:2, Action:ACCEPT
Module name:WAF_FILE_UNCOMPRESS, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_SIG_DETECT_PROCESS, Execution:4, Process error:1, Action:ACCEPT
Module name:WAF_HIDDEN_FIELD_PROCESS, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_URL_REWRITING, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_FILE_COMPRESS, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_CERTIFICATE_FORWARD, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_AUTOLEARN, Execution:4, Process error:0, Action:ACCEPT
Module name:WAF_HTTP_STATISTIC, Execution:3, Process error:0, Action:ACCEPT
" session_id=502 packet_id=0 policy_name=policy1 msg="Receive packet from client
172.20.120.225:49429" session_id=502 packet_id=0 msg="HTTP parsing client packet success" session_id=502 packet_id=0 policy_name="policy1" msg="
Module name:WAF_IP_LIST_CHECK, Execution:3, Process error:0, Action:ACCEPT
576 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose debug flow trace
Module name:WAF_X_FORWARD_FOR_PROCESS, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_GEO_BLOCK_LIST, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_PROTECTED_SERVER_CHECK, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_ALLOW_METHOD_PROCESS, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_HTTP_ACTIVE_SCRIPT, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_HTTP_SESSION_MANAGEMENT, Execution:4, Process error:1, Action:ACCEPT
Module name:WAF_HTTP_DOS_PREVENTION, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_LAYER4_DOS_PREVENTION, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_HTTP_AUTHENTICATION, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_GLOBAL_WHITE_LIST, Execution:4, Process error:1, Action:ACCEPT
Module name:WAF_URL_ACCESS_POLICY, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_BRUCE_FORCE_LOGIN, Execution:1 , Process error:0, Action:ACCEPT
Module name:HTTP_CONSTRAINTS, Execution:1, Process error:0, Action:ACCEPT
Module name:WAF_COOKIE_POISON, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_START_PAGES, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_PAGE_ACCESS_RULE, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_FILE_UPLOAD_RESTRICTION_POLICY, Execution:3, Process error:0,
Action:ACCEPT
Module name:ROBOT_CONTROL_PROCESS, Execution:1 , Process error:0, Action:ACCEPT
Module name:WAF_PARAMETWER_VALIDATION_PROCESS, Execution:1, Process error:0, Action:ACCEPT
Module name:WAF_CHUNK_DECODE, Execution:3, Process error:2 , Action:ACCEPT
Module name:WAF_FILE_UNCOMPRESS, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_SIG_DETECT_PROCESS, Execution:1, Process error:0, Action:ACCEPT
Module name:WAF_HIDDEN_FIELD_PROCESS, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_URL_REWRITING, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_FILE_COMPRESS, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_CERTIFICATE_FORWARD, Execution:3, Process error:0, Action:ACCEPT
Module name:WAF_AUTOLEARN, Execution:4, Process error:0, Action:ACCEPT
Module name:WAF_HTTP_STATISTIC, Execution:3, Process error:0, Action:ACCEPT
" session_id=0 packet_id=0 policy_name=policy1 msg="Receive packet from client
172.20.120.48:47368" session_id=1 packet_id=0 policy_name=policy1 msg="Receive packet from client
172.20.120.48:59682" session_id=252 packet_id=0 policy_name=policy1 msg="Receive packet from client
172.20.120.48:47376" session_id=503 packet_id=0 policy_name=policy1 msg="Receive packet from client
172.20.120.48:59687" session_id=754 packet_id=0 policy_name=policy1 msg="Receive packet from client
172.20.120.48:47382" session_id=2 packet_id=0 policy_name=policy1 msg="Receive packet from client
172.20.120.48:47385" session_id=253 packet_id=0 policy_name=policy1 msg="Receive packet from client
172.20.120.48:47387" diag debug disable
FortiWeb #
Session lines contain the name of the matching server policy (policy_name), the packet identifier (packet_
ID
), and TCP session ID (session_id), as well as a log message (msg) indicating one or more of the following: l l the source IP address and port number of the packet (e.g. Receive packet from client
172.20.120.225:49428
) the success or failure of FortiWeb’s HTTP parser’s attempt to analyze the HTTP headers and payload of the packet into pieces that can be scanned or modified by modules (e.g. HTTP parsing client packet success or
Packet dropped by detection module,and module number=11
)
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
577
debug info diagnose
If the debug logs indicate that the HTTP protocol parser may be encountering an error condition, you can temporarily disable it and allow packets to bypass it to verify if this is the case. See
in
.
If enabled, module lines contain messages from each FortiWeb feature module as it processes the packet (e.g.
Module name:WAF_PROTECTED_SERVER_CHECK for the feature that tests for an allowed Host: name in the request). The module logs are displayed in their order of execution (for details, see the
FortiWeb
Administration Guide
). These messages indicate: l l l whether or not the module executed, and if not, the reason (e.g. Execution:1) processing errors, if any (e.g. Process error:0) whether a module has allowed or blocked the packet (e.g. Action:ACCEPT or Action:FOLLOWUP_ACCEP)
For non-execution reasons, possible status codes are: l l l l
Execution:1
— The module is disabled, and therefore is being skipped.
Execution:2
— The module is not supported in the current deployment mode, and therefore is being skipped.
Execution:3
— The client IP address is whitelisted, and therefore the module is being skipped.
Execution:4
— URL access policy has caused the module to be skipped.
Related topics
l
l
config server-policy server-pool
l
config server-policy custom-application application-policy
l
config waf url-access url-access-rule
l
l
diagnose debug application http
l
l
diagnose debug flow filter module-detail
l
debug info
Use this command to display a list of debug log settings.
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug info
Example
diagnose debug application ssl 8 diagnose debug application dssl 8
578 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose diagnose debug application ustack 8 diagnose debug info
Output similar to the following appears in the CLI: debug output: disable console timestamp: disable ssl debug level: 8 ustack debug level: 8 dssl debug level: 8
CLI debug level: 3
If you have not modified any verbosity levels, only this default output appears:
FortiWeb # diagnose debug info debug output: disable console timestamp: disable
CLI debug level: 3
Related topics
l
l
l
diagnose debug console timestamp
l
diagnose debug application autolearn
l
diagnose debug application detect
l
diagnose debug application dssl
l
diagnose debug application fds
l
diagnose debug application hasync
l
diagnose debug application hatalk
l
diagnose debug application http
l
diagnose debug application miglogd
l
diagnose debug application mulpattern
l
diagnose debug application proxy
l
diagnose debug application proxy-error
l
diagnose debug application ssl
l
diagnose debug application ustack
l
debug init
Syntax
diagnose debug
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
debug init
579
debug reset
Variable
init [{enable | disable}]
Description
Select whether to enable (start) or disable (stop) the recording of packet flow trace debug log messages.
If you omit the selection, the CLI displays the current timestamp status: init output: disabled diagnose
Default
No default.
debug reset
Use this command to reset all debug log settings to default settings for the currently installed firmware version. If you have not upgraded or downgraded the firmware, this restores the factory default settings.
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug reset
Related topics
l
l
diagnose debug console timestamp
l
diagnose debug application autolearn
l
diagnose debug application detect
l
diagnose debug application dssl
l
diagnose debug application fds
l
diagnose debug application hasync
l
diagnose debug application hatalk
l
diagnose debug application http
l
diagnose debug application miglogd
l
diagnose debug application mulpattern
l
diagnose debug application proxy
l
diagnose debug application proxy-error
l
diagnose debug application ssl
l
diagnose debug application ustack
l
580 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose debug upload
debug upload
Use this command to upload debug logs to an FTP server. This can be used if you want to view logs outside of the CLI, or if you need to provide debug log files to Fortinet Technical Support .
To use this command, your administrator account’s access control profile requires only r permission in any profile area.
Syntax
diagnose debug upload
<delay_int> <delay_int> <delay_int> <delay_int>
Variable
<ftp_ipv4>
<user_str>
<password_str>
<upload-dir_str>
Description
Enter the IP address or domain name of the FTP server.
Enter a valid user account name to log in to the FTP server.
Enter the password for the user account.
Enter the directory path on the FTP server where FortiWeb will upload files.
Default
No default.
No default.
No default.
No default.
Example
diagnose debug upload 10.1.1.5 user1 1passw0Rd C:/uploads
Related topics
l
l
hardware check
Use this command to check the appliance hardware for errors. (In the case of FortiWeb-VM, this command checks virtual hardware — the vCPUs.)
For example, to troubleshoot a logging problem, use the following command to check the log disk for errors: diagnose hardware check logdisk
If the disk does not pass the check, it is likely the source of the problem.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
581
hardware cpu
Syntax
diagnose hardware check
{all |cp8 |cpu |logdisk | memory |nic}
Variable Description
{all |cp8 |cpu |logdisk | memory
|nic}
Enter the type of hardware to check, or enter all to check all hardware.
For FortiWeb-VM versions, the cp8 option is not available.
Example
The following command checks the log disk: diagnose hardware check logdisk
Output similar to the following appears in the CLI: logdisk check Pass size Pass 1952 disk-number Pass 2 raid-level Pass raid1 diagnose
Default
No default.
hardware cpu
Use this command to display a list of hardware specifications on the FortiWeb appliance for CPUs. (In the case of
FortiWeb-VM, this command displays virtual hardware information — the vCPUs.)
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
diagnose hardware cpu [list]
Example
diagnose hardware cpu list
Output similar to the following appears in the CLI: processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 23 model name : Intel(R) Xeon(R) CPU E5405 @ 2.00GHz
stepping : 10 cpu MHz : 1995.056
cache size : 6144 KB physical id : 0
582 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose hardware fail-open siblings : 4 core id : 0 cpu cores : 4 fpu : yes fpu_exception : yes cpuid level : 13 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitor ds_ cpl vmx tm2 cx16 xtpr lahf_lm bogomips : 3994.51
clflush size : 64 cache_alignment : 64 address sizes : 38 bits physical, 48 bits virtual power management:
Related topics
l
l
l
hardware fail-open
Fail-to-wire/bypass behavior is available for specific models only. See
.
hardware harddisk
Use this command to display a list of hard disks and their capacity in megabytes (MB) in the FortiWeb appliance.
(In the case of FortiWeb-VM, this will instead be for virtual hardware.)
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
diagnose hardware harddisk [list]
Example
diagnose hardware harddisk list
Output similar to the following appears in the CLI: name size(M) sda 625.56
sdb 32212.25
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
583
hardware interrupts diagnose
On a FortiWeb 1000C with a single properly functioning internal hard disk plus its internal flash disk, this command should show two file systems: name size(M) sda 1000204.89
sdb 1971.32
where sda, the larger file system, is from the hard disk used to store non-configuration/firmware data. If it does not appear, you can reboot and attempt to run a file system check to fix the file system and mount it.
Similarly FortiWeb 3000D shows: name size(M) sda 1999844.15
sdb 2055.21
Related topics
l
diagnose hardware logdisk info
l
l
l
l
hardware interrupts
Use this command to display input/output (I/O) interrupt requests (IRQs) on the FortiWeb appliance. (In the case of FortiWeb-VM, this will instead be for virtual hardware.)
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
diagnose hardware interrupts [list]
Example
diagnose hardware interrupts list
Output similar to the following appears in the CLI:
CPU0
0: 225 IO-APIC-edge timer
1: 597 IO-APIC-edge i8042
2: 0 XT-PIC-XT-PIC cascade
12: 6 IO-APIC-edge i8042
14: 0 IO-APIC-edge ide0
15: 0 IO-APIC-edge ide1
16: 151462 IO-APIC-fasteoi vmxnet ether
17: 1080446 IO-APIC-fasteoi ioc0, vmxnet ether
18: 357613 IO-APIC-fasteoi vmxnet ether
19: 150107 IO-APIC-fasteoi vmxnet ether
584 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose
NMI: 0 Non-maskable interrupts
LOC: 103791489 Local timer interrupts
SPU: 0 Spurious interrupts
PMI: 0 Performance monitoring interrupts
IWI: 0 IRQ work interrupts
RES: 0 Rescheduling interrupts
CAL: 0 Function call interrupts
TLB: 0 TLB shootdowns
MCE: 0 Machine check exceptions
MCP: 346 Machine check polls
ERR: 0
MIS: 0
Related topics
l
hardware logdisk info
hardware logdisk info
Use this command to display the capacity, partitions, mount status, and RAID level (if any) of the hard disk
FortiWeb uses to store logs and other data. For FortiWeb-VM, information for virtual hardware (the vDisk) is displayed.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
diagnose hardware logdisk info
Example
This example shows normal output for a FortiWeb-VM installation: there is no RAID, and it has been allocated a
40 GB vDisk. If the disk were mounted as read-only, this would indicate that the disk had failed to mount normally, and would be the cause if no new log messages were being recorded.
diagnose hardware logdisk info
The CLI displays output that is similar to the following: disk number: 1 disk[0] size: 31.46GB
raid level: no raid exists partition number: 1 mount status: read-write
Related topics
l
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
585
hardware mem l
l
diagnose
hardware mem
Use this command to display the usage statistics of ephemeral memory (RAM), including swap pages and shared memory (Shmem), on the FortiWeb appliance. (In the case of FortiWeb-VM, this will instead be for virtual hardware — the vRAM.)
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
diagnose hardware mem [list]
Example
diagnose hardware mem list
Output similar to the following appears in the CLI:
MemTotal: 1026808 kB
MemFree: 397056 kB
Buffers: 121248 kB
Cached: 86112 kB
SwapCached: 0 kB
Active: 324664 kB
Inactive: 66608 kB
Active(anon): 186544 kB
Inactive(anon): 8856 kB
Active(file): 138120 kB
Inactive(file): 57752 kB
Unevictable: 46008 kB
Mlocked: 46008 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 1564 kB
Writeback: 0 kB
AnonPages: 229920 kB
Mapped: 12632 kB
Shmem: 11488 kB
Slab: 36564 kB
SReclaimable: 6552 kB
SUnreclaim: 30012 kB
KernelStack: 640 kB
PageTables: 8820 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 513404 kB
Committed_AS: 1216900 kB
VmallocTotal: 34359738367 kB
586 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose
VmallocUsed: 38960 kB
VmallocChunk: 34359682723 kB
DirectMap4k: 8192 kB
DirectMap2M: 1040384 kB
Related topics
l
l
l
l
hardware nic
hardware nic
Use this command to display a list of hardware specifications for the network interface card (NIC) physical ports on the FortiWeb appliance. (In the case of FortiWeb-VM, this will instead be for virtual hardware — the vNICs — and therefore the driver will be a virtual driver such as vmxnet, and the interrupt will be a virtual IRQ address.)
If the FortiWeb’s network hardware has failed, this command can help to detect it. For example, if you know that the network cable is good and the configuration is correct, but this command displays Link detected: no), the physical network port may be broken.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
diagnose hardware nic [list
]
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
587
hardware nic
Variable
[<interface_name>]
Example
diagnose hardware nic list
Output similar to the following appears in the CLI: driver vmxnet version 2.0.9.0
firmware-version N/A bus-info 0000:00:11.0
Supported ports TP
Supported link modes 1000baseT/Full
Supports auto-negotiation: No
Advertised link modes: Not reported
Advertised auto-negotiation: No
Speed: 1000Mb/s
Duplex: Full
Port: Twisted Pair
PHYAD 0
Transceiver: internal
Auto-negotiation off
Link detected yes
Link encap Ethernet
HWaddr 00:0C:29:FE:2B:47
INET addr 10.1.1.221
Bcast 10.1.1.221
588 diagnose
Description
Optionally, type the name of a physical network interface, such as port1, to display its link status, configuration, hardware information, status, and connectivity statistics such as collision errors.
If you omit the name of a NIC port, the CLI returns a list of all physical network interfaces, as well as the loopback interface (lo): lo port1 port2 port3 port4
Note: The detected physical link status from this command is
not the same as its configured administrative status.
For example, even though you have used
to configure port1 with set status down, if the cable is physically plugged in, diagnose hardware nic list port1 will indicate correctly that the link is up
(Link detected: yes).
Default
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose
Mask 255.255.255.255
FLAG UP BROADCAST RUNNING MULTICAST
MTU 1500
MEtric 1
Outfill 0
Keepalive 6846704
Interrupt 18
Base address 0x1400
RX packets 171487
RX errors 167784
RX dropped 0
RX overruns 0
RX frame 0
TX packets 202724
TX errors 0
TX dropped 0
TX overruns 0
TX carrier 0
TX collisions 0
TX queuelen 1000
RX bytes 72772373 (69.4 Mb)
TX bytes 32288070 (30.7 Mb)
Related topics
l
l
diagnose debug application ustack
l
l
l
l
l
l
l
l
hardware raid list
hardware raid list
Use this command to run a diagnostic test of each hard disk in the RAID array that FortiWeb has. It also displays the capacity and RAID level. (Because FortiWeb-VM has no RAID, this command is not applicable to it.)
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
diagnose hardware raid list
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
589
index diagnose
Example
diagnose hardware raid list
Output similar to the following (from a FortiWeb 3000D) appears in the CLI window: disk-number size(M) level
0(OK),1(OK), 1877274 raid1
Related topics
l
l
l
l
l
l
index
Use this command to view (list) or clear logs, or to examine (show) or configure logs.
To use this command, your administrator account’s access control profile must have rw or w permission to the loggrp area. For more information, see
.
Syntax
diagnose index all show diagnose index all clear diagnose diagnose
index {alog | dlog | elog | tlog}
clear
index {alog | dlog | elog | tlog} list <index_int>
diagnose diagnose
index {alog | dlog | elog | tlog} set <queue_int> index {alog | dlog | elog | tlog}
show
Variable
index {alog | dlog | elog | tlog}
Description
Select which log files to view or affect: l l l l alog
— Attack logs.
dlog
— Debug logs.
elog
— Event logs.
tlog
— Traffic logs.
list <index_int> set <queue_int>
Type the number of most recent logs to display.
Type the maximum length of the log before it is flushed and written to disk. The valid range is from 0 to 32768.
Default
No default.
No default.
No default.
590 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose log
Example
This example displays a list of logs processed.
diagnose index all show
Related topics
l
l
l
l
l
diagnose hardware logdisk info
log
Use this command to view (list) or clear log messages, or to examine (show) or configure logging queues.
To use this command, your administrator account’s access control profile must have rw or w permission to the loggrp area. For more information, see
.
Syntax
diagnose
log {all | alog | dlog | elog | tlog} [show | start | stop]
Variable Description Default
No default.
log {all | alog | dlog | elog | tlog}
Select which log files to view: l all
— All logs.
l alog
— Attack logs.
l dlog
— Debug logs.
l elog
— Event logs.
l tlog
— Traffic logs.
[show | start | stop]
Displays the log messages or specifies a time to start or stop logging.
Example
This example sets a time to start the display of log messages, displays log information starting at that time, and stops the display of log messages. The appliance’s responses are displayed in
bold.
FortiWeb # dia log all start
start tracking log
FortiWeb # dia log all show
time span starts from 2014-07-31 18:31:53.000000
Total time span is 10.754097 seconds
Time spent on waiting is 10.527346 seconds
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
591
network arp
Time spent on preprocessing is 0.000000 seconds event log processed: 0 traffic log processed: 0 attack log processed: 0
FortiWeb # dia log all stop
stop tracking log
Related topics
l
l
l
l
l
diagnose hardware logdisk info
diagnose
network arp
Use this command to add or delete an address resolution protocol (ARP) table entry, or to display the ARP table.
The ARP table is used to resolve the IP addresses that correspond to a network interface card’s physical MAC address, thereby determining which IP addresses can be reached directly through a link.
To use this command, your administrator account’s access control profile must have rw or w permission to the sysgrp area. For more information, see
.
Syntax
diagnose network arp add
<delay_int> <delay_int> <delay_int>
diagnose network arp delete
<delay_int> <delay_int> <delay_int>
diagnose network arp list
Variable
<interface_name>
Description
Type the name of the interface to add or delete from the ARP table.
{<interface_ipv4> | interface_ipv6>}
<mac-address_hex>
Type the IP address of the interface.
Type the MAC address of the interface.
Default
No default.
No default.
No default.
Example
This example displays a list of ARP table entries and then deletes one.
diagnose network arp list
IP address HW type Flags HW address Mask Device
172.20.120.29 0x1 0x2 00:13:72:38:72:21 * port1
172.20.120.26 0x1 0x2 00:26:2D:24:B7:D3 * port2 diagnose network arp delete port2 172.20.120.26 00:26:2D:24:B7:D3
592 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose network ip
Related topics
l
l
l
l
network ip
Use these commands to add or delete a network interface, loopback interface, or virtual server (which functions somewhat like a virtual network interface) IP address, or to list the table of network interface IPs.
Back up the configuration before deleting a network interface table entry (see
). FortiWeb presents no confirmation message,
and in some cases such as the loopback interface, provides no undelete mechanism.
To use this command, your administrator account’s access control profile must have rw or w permission to the sysgrp area. For more information, see
.
Syntax
diagnose network ip add
<interface_name> {<interface_ipv4> | interface_ipv6}
{<interface_ipv4mask> |<interface_v6mask>}
diagnose network ip delete diagnose network ip list
<interface_name> {<interface_ipv4> | interface_ipv6}
Variable
<interface_name>
{<interface_ipv4> | interface_ipv6}
{<interface_ ipv4mask> |<interface_ v6mask>}
Description
Type the name of the interface to add or delete from the network interface table.
Type the IP address of the network interface.
Type the subnet mask.
Default
No default.
No default.
No default.
Example
This example displays a list of enabled network interfaces, including the loopback (lo) diagnose network ip list
Output:
1 IP 127.0.0.1/255.255.255.0 lo
2 IP 172.20.120.47/255.255.255.0 port1
2 IP 10.1.1.221/255.255.255.255 port1
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
593
network route
4 IP 192.168.1.27/255.255.255.0 port3
Example
This example deletes the IP of a virtual server on port2.
diagnose network ip delete port1 10.1.1.221
Related topics
l
l
l
diagnose
network route
Use this command to add or delete a route in the routing table, or to list the routing table.
Unlike
router all , this command displays
all individual entries, including automatically configured routes for the loopback interface (127.0.0.1) and VLANs, and also displays each route’s priority. Unlike
, it displays all known routes, regardless of whether they have been recently used.
Do not delete routes unless you are sure. FortiWeb does not ask you to confirm the deletion, and there is no undelete mechanism. For example, if you accidentally delete a loopback interface route, you must recreate it manually.
To use this command, your administrator account’s access control profile must have rw or w permission to the sysgrp area. For more information, see
.
Syntax
diagnose network route add
{<source_ipv4mask> | <source_ipv6mask>} <delay_int>
{<destination_ipv4mask> | <destination_ipv6mask>} <delay_int> <delay_
diagnose network route delete
{<source_ipv4mask> | <source_ipv6mask>} <delay_int>
{<destination_ipv4mask> | <destination_ipv6mask>} <delay_int> <delay_int>
Variable
{<source_ipv4mask> |
<source_ipv6mask>}
<interface_name>
{<destination_ ipv4mask> |
<destination_ipv6mask>}
Description Default
Type the IP address and network mask of the source, separated by a space.
No default.
Type the name of the interface to add or delete from the routing table.
No default.
Type the IP address and network mask of the source, separated by a space.
No default.
594 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose
Variable
{<gateway_ipv4> |
<gateway_ipv6>}
<priority_int> network route
Description Default
Enter the IP address of the next hop router (sometimes called a gateway) to which this route sends packets.
No default.
Enter the priority of the route in the routing table. The lower the number the higher the priority. The value can be an integer from
1 to 255.
0
Example
This example displays the routing table.
tab=255 0.0.0.0/0.0.0.0/0->192.168.1.0/32/4 gwy=0.0.0.0 prio=0 prefsrc=192.168.1.27 type=3 scope=fd proto=2 tab=255 0.0.0.0/0.0.0.0/0->172.20.120.0/32/2 gwy=0.0.0.0 prio=0 prefsrc=172.20.120.47
type=3 scope=fd proto=2 tab=255 0.0.0.0/0.0.0.0/0->10.1.1.221/32/2 gwy=0.0.0.0 prio=0 prefsrc=10.1.1.221 type=2 scope=fe proto=2 tab=255 0.0.0.0/0.0.0.0/0->10.1.1.221/32/2 gwy=0.0.0.0 prio=0 prefsrc=10.1.1.221 type=3 scope=fd proto=2 tab=255 0.0.0.0/0.0.0.0/0->127.0.0.255/32/1 gwy=0.0.0.0 prio=0 prefsrc=127.0.0.1 type=3 scope=fd proto=2 tab=255 0.0.0.0/0.0.0.0/0->192.168.1.255/32/4 gwy=0.0.0.0 prio=0 prefsrc=192.168.1.27
type=3 scope=fd proto=2 tab=255 0.0.0.0/0.0.0.0/0->192.168.1.27/32/4 gwy=0.0.0.0 prio=0 prefsrc=192.168.1.27
type=2 scope=fe proto=2 tab=255 0.0.0.0/0.0.0.0/0->172.20.120.255/32/2 gwy=0.0.0.0 prio=0 prefsrc=172.20.120.47
type=3 scope=fd proto=2 tab=255 0.0.0.0/0.0.0.0/0->172.20.120.47/32/2 gwy=0.0.0.0 prio=0 prefsrc=172.20.120.47
type=2 scope=fe proto=2 tab=255 0.0.0.0/0.0.0.0/0->127.0.0.0/32/1 gwy=0.0.0.0 prio=0 prefsrc=127.0.0.1 type=3 scope=fd proto=2 tab=255 0.0.0.0/0.0.0.0/0->127.0.0.1/32/1 gwy=0.0.0.0 prio=0 prefsrc=127.0.0.1 type=2 scope=fe proto=2 tab=255 0.0.0.0/0.0.0.0/0->127.0.0.0/24/1 gwy=0.0.0.0 prio=0 prefsrc=127.0.0.1 type=2 scope=fe proto=2 tab=254 0.0.0.0/0.0.0.0/0->192.168.1.0/24/4 gwy=0.0.0.0 prio=0 prefsrc=192.168.1.27 type=1 scope=fd proto=2 tab=254 0.0.0.0/0.0.0.0/0->172.20.120.0/24/2 gwy=0.0.0.0 prio=0 prefsrc=172.20.120.47
type=1 scope=fd proto=2 tab=254 0.0.0.0/0.0.0.0/0->0.0.0.0/0/2 gwy=172.20.120.2 prio=2 prefsrc=0.0.0.0 type=1 scope=00 proto=14
Example
This example adds a route to the routing table.
diagnose network route add 10::/64 port1 10:200::1/64 port1 10::1 0
Related topics
l
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
595
network rtcache l
l
l
l
diagnose
network rtcache
Use this command to display the routing cache.
Unlike
, this command displays the cache of the most recently used routes,
not
necessarily the entire configuration. (You may have configured many routes, and these configurations will be saved to disk and appear in
, but rarely used ones will not usually appear in the route cache, which keeps recently used routes in RAM for performance reasons.)
To use this command, your administrator account’s access control profile must have rw or w permission to the sysgrp area. For more information, see
.
Syntax
diagnose network rtcache list
Example
This example displays the ARP cache.
172.20.120.52(port1)->255.255.255.255(lo) via 0.0.0.0, pri 0 prot 0 scope 0, ref 0 lastuse
3181 expires 0 error 0 used 855
172.20.120.100(port3)->172.20.120.255(lo) via 0.0.0.0, pri 0 prot 0 scope 0, ref 0 lastuse
434 expires 0 error 0 used 0
172.20.120.230(port1)->255.255.255.255(lo) via 0.0.0.0, pri 0 prot 0 scope 0, ref 0 lastuse 47386 expires 0 error 0 used 7
10.0.1.1(none)->10.0.1.1(lo) via 0.0.0.0, pri 0 prot 0 scope 0, ref 0 lastuse 223 expires
0 error 0 used 29551
0.0.0.0(none)->10.0.1.1(lo) via 0.0.0.0, pri 0 prot 0 scope 0, ref 0 lastuse 223 expires 0 error 0 used 7387
::(none)->::1(lo) via ::, pri 0 prot 0 scope 0 ref 1 lastuse 155845 expires 0 error 0 used
417
::(none)->2607:f0b0:f:420:20c:29ff:fe4d:3ad3(lo) via ::, pri 0 prot 0 scope 0 ref 1 lastuse 354923 expires 0 error 0 used 1
::(none)->2607:f0b0:f:420:20c:29ff:fe4d:3ae7(lo) via ::, pri 0 prot 0 scope 0 ref 1 lastuse 2590615 expires 0 error 0 used 0
::(none)->2607:f0b0:f:420:20c:29ff:fe4d:3af1(lo) via ::, pri 0 prot 0 scope 0 ref 1 lastuse 2590615 expires 0 error 0 used 0
::(none)->2607:f0b0:f:420::(port1) via ::, pri 256 prot 0 scope 0 ref 0 lastuse 2590616 expires 214715722 error 0 used 0
::(none)->ff00::(port4) via ::, pri 256 prot 0 scope 0 ref 0 lastuse 2590615 expires 0 error 0 used 0
::(none)->ff00::(lo) via ::, pri -1 prot 0 scope 0 ref 1 lastuse 449431651 expires 0 error
-101 used 1
Example
This example adds a route to the routing table.
596 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose network sniffer diagnose network route add vlan2 160.1.12.0 255.0.0.0 172.20.01.169 32 3 verify
Related topics
l
l
l
l
l
l
network sniffer
Use this command to perform a packet trace on one or more network interfaces.
Packet capture, also known as sniffing or packet analysis, records some or all of the packets seen by a network interface (that is, the network interface is used in promiscuous mode). By recording packets, you can trace connection states to the exact point at which they fail, which may help you to diagnose some types of problems that are otherwise difficult to detect.
FortiWeb appliances have a built-in sniffer. Packet capture on FortiWeb appliances is similar to that of FortiGate appliances. Packet capture output appears on your CLI display until you stop it by pressing Ctrl+C, or until it reaches the number of packets that you have specified to capture.
Packet capture can be very resource intensive. To minimize the performance impact on your FortiWeb appliance, use packet capture only during periods of minimal traffic, with a local console CLI connection rather than a Telnet or SSH CLI connection, and be sure to stop the command when you are finished.
If your FortiWeb model uses Data Plane Development Kit (DPDK) for packet processing (for example, models 3000E, 3010E and 4000E) and is operating in offline protection mode, you cannot use this command with ports that are configured as data capture ports. To use the command with this type of port, disable the corresponding server policy or configure the policy with a different data capture port.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
diagnose network sniffer [
{any | <interface_name>} [ {none | '<filter_str>'}
]]]]
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
597
network sniffer
Variable Description
{any | <interface_name>}
Type the name of a network interface whose packets you want to capture, such as port1, or type any to capture packets on all network interfaces.
If you omit this and the following parameters for the command, the command captures all packets on all network interfaces.
{none | str>'}
'<filter_
Type either none to capture all packets, or type a filter that specifies which protocols and port numbers that you do or do not want to capture, such as 'tcp port 25'.
Surround the filter string in quotes ( ' ).
Filters use tcpdump syntax:
'[[src|dst] host {<host1_fqdn> | <host1_ ipv4>}] [and|or] [[src|dst] host
{<host2_fqdn> | <host2_ipv4>}] [and|or]
[[arp|ip|gre|esp|udp|tcp] port <port1_ int>] [and|or] [[arp|ip|gre|esp|udp|tcp] port <port2_int>]'
To display only the traffic between two hosts, specify the
IP addresses of both hosts. To display only forward or reply packets, indicate which host is the source, and which is the destination.
For example, to display UDP port 1812 traffic between
1.example.com and either 2.example.com or
3.example.com, you would enter:
'udp and port 1812 and src host
1.example.com and dst \( 2.example.com
or 2.example.com \)'
Default
No default.
none diagnose
598 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose network sniffer
Variable
{1 | 2 | 3}
<packets_int>
Description
Type one of the following integers indicating the depth of packet headers and payloads to capture: l
1
— Display the packet capture timestamp, plus basic fields of the IP header: the source IP address, the destination IP address, protocol name, and destination port number.
Default
1
Does
not display all fields of the IP header; it omits:
• IP version number bits
• Internet header length (ihl)
• type of service/differentiated services code point (tos)
• explicit congestion notification
• total packet or fragment length
• packet ID
• IP header checksum
• time to live (TTL)
• fragment offset
• options bits l
2
— All of the output from 1, plus the packet payload in both hexadecimal and ASCII.
l
3
— All of the output from 2, plus the the link layer (Ethernet) header.
For troubleshooting purposes, Fortinet Technical Support may request the most verbose level (3).
Type the number of packets to capture before stopping.
If you do not specify a number, the command will continue to capture packets until you press Ctrl+C.
Packet capture continues until you press
Ctrl + C.
Example
The following example captures three packets of traffic from any port number or protocol and between any source and destination (a filter of none), which passes through the network interface named port1. The capture uses a
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
599
network sniffer diagnose low level of verbosity (indicated by 1).
Commands that you would type are highlighted in bold; responses from the FortiWeb appliance are not bolded.
FortiWeb#
diagnose network sniffer port1 none 1 3
filters=[none]
0.918957 192.168.0.1.36701 -> 192.168.0.2
.22: ack 2598697710
0.919024 192.168.0.2
.22 -> 192.168.0.1.36701: psh 2598697710 ack 2587945850
0.919061 192.168.0.2
.22 -> 192.168.0.1.36701: psh 2598697826 ack 2587945850
If you are familiar with the TCP protocol, you may notice that the packets are from the middle of a TCP connection. Because port 22 is used (highlighted above in bold), which is the standard port number for SSH, the packets might be from an SSH session.
Example
The following example captures packets traffic on TCP port 80 (typically HTTP) between two hosts, 192.168.0.1
and 192.168.0.2. The capture uses a low level of verbosity (indicated by 1). Because the filter does not specify either host as the source or destination in the IP header (src or dst), the sniffer captures both forward and reply traffic.
Commands that you would type are highlighted in bold; responses from the FortiWeb appliance are not bolded.
FortiWeb#
diagnose network sniffer packet port1 'host 192.168.0.2 or host 192.168.0.1 and tcp port 80' 1
A specific number of packets to capture is not specified. As a result, the packet capture continues until the administrator presses Ctrl+C. The sniffer then confirms that five packets were seen by that network interface.
Below is a sample output.
192.168.0.2.3625 -> 192.168.0.1.80: syn 2057246590
192.168.0.1.80 -> 192.168.0.2.3625: syn 3291168205 ack 2057246591
192.168.0.2.3625 -> 192.168.0.1.80: ack 3291168206
192.168.0.2.3625 -> 192.168.0.1.80: psh 2057246591 ack 3291168206
192.168.0.1.80 -> 192.168.0.2.3625: ack 2057247265
5 packets received by filter
0 packets dropped by kernel
Example
The following example captures TCP port 443 (typically HTTPS) traffic occurring through port1, regardless of its source or destination IP address. The capture uses a high level of verbosity (indicated by 3).
The number of packets to capture is not specified, so the packet capture continues until the administrator presses
Ctrl+C. The sniffer then states how many packets were seen by that network interface.
Verbose output can be very long. As a result, output shown below is truncated after only one packet.
Commands that you would type are highlighted in bold; responses from the FortiWeb appliance are not bolded.
FortiWeb#
diagnose network sniffer packet port1 'tcp port 443' 3
interfaces=[port1] filters=[tcp port 443]
10.651905 192.168.0.1.50242 -> 192.168.0.2.443: syn 761714898
0x0000 0009 0f09 0001 0009 0f89 2914 0800 4500 ..........)...E.
0x0010 003c 73d1 4000 4006 3bc6 d157 fede ac16 .<s.@.@.;..W....
0x0020 0ed8 c442 01bb 2d66 d8d2 0000 0000 a002 ...B..-f........
600 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose network sniffer
0x0030 16d0 4f72 0000 0204 05b4 0402 080a 03ab ..Or............
Instead of reading packet capture output directly in your CLI display, you usually should save the output to a plain text file using your CLI client. Saving the output provides several advantages. Packets can arrive more rapidly than you may be able to read them in the buffer of your CLI display, and many protocols transfer data using encodings other than US-ASCII. It is often, but not always, preferable to analyze the output by loading it into in a network protocol analyzer application such as Wireshark ( http://www.wireshark.org/ ).
For example, you could use PuTTY or Microsoft HyperTerminal to save the sniffer output to a file. Methods may vary. See the documentation for your CLI client.
Requirements
l l l l terminal emulation software such as
PuTTY a plain text editor such as Notepad a
Perl interpreter network protocol analyzer software such as Wireshark
To view packet capture output using PuTTY and Wireshark
1. On your management computer, start PuTTY.
2. Use PuTTY to connect to the FortiWeb appliance using either a local console, SSH, or Telnet connection. For details, see
Connecting to the CLI on page 67
.
3. Type the packet capture command, such as: diag network sniffer packet port1 'tcp port 443' 3 100 but do not press Enter yet.
4. In the upper left corner of the window, click the PuTTY icon to open its drop-down menu, then select
Change Settings.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
601
network sniffer diagnose
602
A dialog appears where you can configure PuTTY to save output to a plain text file.
5. In the Category tree on the left, go to Session > Logging.
6. In Session logging, select Printable output.
7. In Log file name, click the Browse button, then choose a directory path and file name such as
C:\Users\MyAccount\packet_capture.txt
to save the packet capture to a plain text file. (You do not need to save it with the .log file extension.)
8. Click Apply.
9. Press Enter to send the CLI command to the FortiMail appliance, beginning packet capture.
10. If you have not specified a number of packets to capture, when you have captured all packets that you want to analyze, press Ctrl + C to stop the capture.
11. Close the PuTTY window.
12. Open the packet capture file using a plain text editor such as Notepad.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose network sniffer
13. Delete the first and last lines, which look like this:
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2017/2/17.07.25 11:34:40 =~=~=~=~=~=~=~=~=~=~=~=
FortiWeb-2000 #
These lines are a PuTTY timestamp and a command prompt, which are not part of the packet capture. If you do not delete them, they could interfere with the script in the next step.
14. Convert the plain text file to a format recognizable by your network protocol analyzer application.
You can convert the plain text file to a format (.pcap) recognizable by Wireshark (formerly called Ethereal) using the fgt2eth.pl Perl script. To download fgt2eth.pl, see the Fortinet Knowledge Base article
Using the
FortiOS built-in packet sniffer
.
The fgt2eth.pl script is provided as-is, without any implied warranty or technical support, and requires that you first install a Perl module compatible with your operating system.
To use fgt2eth.pl, open a command prompt, then enter a command such as the following:
Methods to open a command prompt vary by operating system.
On Windows XP, go to
Start > Run and enter cmd.
On Windows 7, click the Start (Windows logo) menu to open it, then enter cmd.
fgt2eth.pl -in packet_capture.txt -out packet_capture.pcap
where: l l l fgt2eth.pl
is the name of the conversion script; include the path relative to the current directory, which is indicated by the command prompt packet_capture.txt
is the name of the packet capture’s output file; include the directory path relative to your current directory packet_capture.pcap
is the name of the conversion script’s output file; include the directory path relative to your current directory where you want the converted output to be saved
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
603
network sniffer
Converting sniffer output to .pcap format
15. Open the converted file in your network protocol analyzer application. For further instructions, see the documentation for that application.
Viewing sniffer output in Wireshark
diagnose
604
For additional information on packet capture, see the Fortinet Knowledge Base article Using the FortiOS built-in packet sniffer
.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose network tcp list
network tcp list
Use this command to view a list of TCP raw socket details, including: l l l l l l l l l l sl
— Kernel socket hash slot.
local_address
— IP address and port number pair of the local FortiWeb network interface in hexadecimal, such as DD01010A:0050.
rem_address
— Remote host’s network interface and port number pair. If not connected, this will contain
00000000:0000
.
st
— TCP state code (e.g. OA for listening, 01 for established, or 06 for timeout wait) tx_queue
— Kernel memory usage by the transmission queue.
rx_queue
— Kernel memory usage by the retransmission queues.
tr
, tm-> when, retrnsmt — Kernel socket state debugging information.
uid
— User ID of the socket’s creator (on FortiWeb, always 0).
timeout
— Connection timeout.
inode
— Pseudo-file system i-node of the process.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
diagnose network tcp list
Example
diagnose network tcp list sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
0: DD01010A:0050 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 333597 1 ffff88003b825880 299 0 0 2 -1
1: 2F7814AC:0050 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 228018 1 ffff88003b824680 299 0 0 2 -1
2: 1B01A8C0:0050 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 2692 1 ffff88003b6ec6c0 299 0 0 2 -1
3: 0100007F:0050 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 2691 1 ffff88003b6eccc0 299 0 0 2 -1
4: 00000000:0016 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 2433 1 ffff88003b489280 299 0 0 2 -1
5: 00000000:0017 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 2400 1 ffff88003b489880 299 0 0 2 -1
6: 0100007F:22B8 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 2687 1 ffff88003b488680 299 0 0 2 -1
7: DD01010A:01BB 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 333598 1 ffff88003bbf3940 299 0 0 2 -1
8: 2F7814AC:01BB 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 228017 1 ffff88003b824080 299 0 0 2 -1
9: 1B01A8C0:01BB 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 2689 1 ffff88003b6ed8c0 299 0 0 2 -1
10: 0100007F:01BB 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 2688 1 ffff88003b488080 299 0 0 2 -1
11: 00000000:208D 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 2441 1 ffff88003b488c80 299 0 0 2 -1
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
605
network udp list diagnose
12: 2F7814AC:0016 E17814AC:FEF2 01 00000000:00000000 02:000909FE 00000000 0 0 272209 4 ffff88003bbf2d40 20 3 1 5 -1
Related topics
l
l
l
diagnose debug application ustack
network udp list
Use this command to view a list of UDP raw socket details, including: l l l l l l l l l l l sl
— Kernel socket hash slot.
local_address
— IP address and port number pair of the local FortiWeb network interface in hexadecimal, such as DD01010A:0050.
rem_address
— Remote host’s network interface and port number pair. If not connected, this will contain
00000000:0000
.
st
— TCP state code in hexadecimal (e.g. 0A for listening, 01 for connection established, or 06 for waiting for data) tx_queue
— Kernel memory usage by the transmission (Tx) queue.
rx_queue
— Kernel memory usage by the retransmission (Rx) queues. (This is not used by UDP, since the protocol itself does not support retransmission.) tr
, tm-> when, retrnsmt — Kernel socket state debugging information. (These are not used by UDP, since the protocol itself does not support retransmission.) uid
— User ID of the socket’s creator (on FortiWeb, always 0).
timeout
— Connection timeout.
inode
— Pseudo-file system inode of the process.
ref
, pointer — Pseudo-file system references.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
diagnose network udp list
Example
diagnose network udp list sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode ref pointer drops
307: 00000000:00A1 00000000:0000 07 00000000:00000000 00:00000000 00000000 0 0 2498 2 ffff88003acba080 0
447: 00000000:3F2D 00000000:0000 07 00000000:00000000 00:00000000 00000000 0 0 2874 2 ffff88003acbac80 0
606 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose
Related topics
l
l
l
diagnose debug application ustack
policy
Use this command to view the process ID, live sessions, and traffic statistics associated with a server policy.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
diagnose policy diagnose policy diagnose policy diagnose policy diagnose policy diagnose policy
Variable
pserver list
<policy_ name> session {list <policy_ name>} traffic {list <policy_ name>} period-blockip {list
<policy_name>} period-blockip {delete
<policy_name>}{ipv4 | ipv6}
<policy_name>
Description
Displays the status of physical servers covered by the policy.
Displays IP session information for TCP and UDP connections.
Displays traffic throughput (bandwidth usage) information.
Displays client IP addresses whose requests are temporarily blocked because the client violated a rule in the specified policy with an Action value of Period Block.
No default.
Unblocks the specified client IP address that FortiWeb has blocked because it violated a rule in the specified policy with an
Action value of Period Block. (FortiWeb can still block the address because it violates a rule in a different policy.)
No default.
Type the name of an existing server policy.
No default.
Default
No default.
No default.
No default.
policy
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
607
system flash diagnose
Example
This example shows the output of the pserver list command. The alive value indicates the status of the server health check:
Server health check (alive) values
Integer
0
1
2
Health check status
failed passed disabled
Health Check Status icon in Policy Status dashboard
red green grey diagnose policy pserver list Policy1 policy(Policy1) server-pool(FWB_server_pool): total = 1 server[0] id: 1 ip: 10.20.1.22
port: 80 alive: 2 session: 0 status: 1
Related topics
l
l
l
l
system flash
Use this command to change the currently active firmware partition or to display partition information stored on the flash drive.
FortiWeb appliances have 2 partitions that each contain a firmware image: one is the primary and one is the backup. If the FortiWeb appliance is unable to successfully boot using the primary firmware partition, it may boot using the alternative firmware partition. The second partition can contain another version of the firmware.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
diagnose system flash default
608 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose system ha file-stat diagnose system flash list
Variable
<partition_int>
Description Default
Type the number of the partition that will be used as the primary firmware partition during the next reboot or startup. The other partition will become the backup firmware partition.
No default.
Example
This example lists the partition settings.
diagnose system flash list
Below is a sample output.
Image# Version TotalSize(KB) Used(KB) Use% Active
1 FV-1KB-4.30-FW-build0521-110120 38733 33125 86% No
2 FV-1KB-4.30-FW-build0522-110112 38733 33125 86% Yes
3 836612 16980 2 % No
Related topics
l
l
system ha file-stat
Use this command to display the current status of FortiGuard subscription services files and the MD5 checksum for system and configuration files.
Syntax
diagnose system ha file-stat
Example
Below is a sample output.
FortiWeb Security Service:
2021-01-03
Last Update Time: 2017-02-17 Method: Scheduled
Signature Build Number-0.00177
FortiWeb Antivirus Service:
2021-01-03
Last Update Time: 2017-02-17 Method: Scheduled
Regular Virus Database Version-42.00885
Extended Virus Database Version-42.00814
FortiWeb IP Reputation Service:
2021-01-03
Last Update Time: 2017-02-17 Method: Scheduled
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
609
system ha mac
Signature Build Number-3.00315
System files MD5SUM: 5660BD9FA1F6C86E8A31B2A139045F17
CLI files MD5SUM: 71BF206315679018536D9E19B37CBEAE
Related topics
l
l
l
l
l
diagnose
system ha mac
Use this command to display the virtual MAC addresses and link statuses of each network interface of appliances in the HA group.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
diagnose system ha mac
Example
This example indicates that the links are “up” (linkfail=0) for port1 and port3 on the currently active appliance in the HA pair. While operating in HA, the network interfaces are using a Layer 1 data link (MAC) address that begins with the hexadecimal string 00:09:0F:09:00:.
diagnose system ha mac
Below is a sample output.
HA mac msg name=port1, phyindex=0, 00:09:0F:09:00:01, linkfail=0 name=port2, phyindex=1, 00:09:0F:09:00:02, linkfail=1 name=port3, phyindex=2, 00:09:0F:09:00:03, linkfail=0 name=port4, phyindex=3, 00:09:0F:09:00:04, linkfail=1
Related topics
l
l
l
l
l
610 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose system ha status
system ha status
Use this command to display the HA group ID, as well as the serial number, role (active or standby), and device priority of each appliance belonging to the HA cluster.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
diagnose system ha status
Example
This example lists the HA group ID, serial numbers, and device priorities.
diagnose system ha status
Below is a sample output.
HA information
Model=FV-1KD-5.30-FW-build0431, Mode=a-p Group=2 Debug=0
HA group member information: is_manage_master=1.
FV-1KD3A13800012, Master, 4, 0, 196417
FV-1KD3A13800091, Slave, 6, 0, 185787
In this example, in the information for FV-1KD3A13800012, 4 is the priority of the appliance and 0 is the number of ports that have been down.
If the value of the priority or ports down is 100, the parameter is “invalid”. For example, if the appliance has not yet joined the HA cluster.
Related topics
l
l
l
l
l
system ha sync-stat
Use this command to display the status of the high availability (HA) synchronization process.
Syntax
diagnose system ha sync-stat
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
611
system kill diagnose
Status
INIT
SENDING
SUCCESS
SEND_TIMEOUT
Description
Initiation. Last synchronization completed and system is ready and waiting for next synchronization.
Synchronization is in process; data is sending.
Success in data sending; synchronization is complete.
Data sending timeout; synchronization is incomplete.
Example
This example lists the HA synchronization status.
diagnose system ha sync-stat
Below is a sample output.
Image INIT
Config INIT
System INIT
CLI INIT
Signature SUCCESS
GeoDB SUCCESS
AV SUCCESS
IpReputation SUCCESS
HarvestCredentials SUCCESS
Related topics
l
l
l
l
l
system kill
Use this command to terminate a process currently running on FortiWeb, or send another signal from the
FortiWeb OS to the process.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
diagnose system kill
612 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose
Variable
<signal_int>
<pid_int> system mount
Description
Type the ID of the signal to send to the process. This in an integer between 1 and 32. Some common signals are: l
1 — Varies by the process’s interpretation, such as re-read configuration files or re-initialize (hang up; SIGHUP).
Default
No default.
For example, the FortiWeb web UI verifies its configuration files, then restarts gracefully.
l
2 — Request termination by simulating the pressing of the interrupt keys, such as Ctrl + C (interrupt; SIGINT).
l
3 — Force termination immediately and do a core dump (quit;
SIGQUIT
).
l
9 — Force termination immediately (kill; SIGKILL).
l
15 — Request termination by inter-process communication
(terminate; SIGTERM).
Type the process ID where the signal is sent to.
To list all current process IDs, use
.
No default.
Related topics
l
l
l
l
system mount
Use this command to display a list of mounted file systems, including their available disk space, disk usage, and mount locations.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
diagnose system mount list
Example
diagnose system mount list
Output from a FortiWeb 3000D:
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
613
system top
Filesystem 1M-blocks Used Available Use% Mounted on
/dev/ram0 97 87 10 89% / none 4823 0 4823 0% /tmp none 16077 0 16077 0% /dev/shm
/dev/sdb1 189 45 134 25% /data
/dev/sdb3 961 17 895 1% /home
/dev/sda1 1877275 271 1781644 0% /var/log
Related topics
l
diagnose hardware logdisk info
l
diagnose
system top
Use this command to view a list of the most system-intensive processes and to change the refresh rate.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
]]
Variable
<delay_int>
<max-lines>
Description
Type the process list refresh interval in seconds.
Set the maximum number of top processes to display.
Default
5
All processes are shown.
Once you execute this command, it continues to run and display in the CLI window until you enter q (quit).
While the command is running, you can press Shift + P to sort the five columns of data by CPU usage (the default) or Shift + M to sort by memory usage.
Example
This example displays a list of the top FortiWeb processes and sets the update interval at 10 seconds.
diagnose system top 10
Below is a sample output.
Run Time: 0 days, 0 hours and 48 minutes
0U, 0S, 100I; 1002T, 496F xmlproxy 152 S 1.3 4.7
updated 54 S 0.1 0.3
monitord 57 S 0.1 0.3
sys_monito 58 S 0.1 0.3
614 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose system update info xmlproxy 56 S 0.0 8.2
alertmail 76 S 0.0 4.6
cli 396 S 0.0 1.2
cli 301 S 0.0 1.2
cmdbsvr 43 S 0.0 1.0
httpsd 147 S 0.0 1.0
cli 403 R 0.0 0.9
data_analy 60 S 0.0 0.6
httpsd 308 S 0.0 0.6
cli 379 S 0.0 0.5
hasync 63 S 0.0 0.4
hatalk 62 S 0.0 0.4
synconf 64 S 0.0 0.4
al_daemon 59 S 0.0 0.3
miglogd 53 S 0.0 0.3
The first line indicates the up time. The second line lists the processor and memory usage, where the parameters from left to right mean: l l l l l
U — Percent of user CPU usage (in this case 0%)
S — Percent of system CPU usage (in this case 0%)
I — Percentage of CPU idle (in this case 100%)
T — Total memory in kilobytes (in this case 2008 KB)
F — Available memory in kilobytes (in this case 445 KB)
The five columns of data provide the process name (such as updated), the process ID (pid), the running status, the CPU usage, and the memory usage. The status values are: l l l l l
S — Sleeping (idle)
R — Running
Z — Zombie (crashed)
< — High priority
N — Low priority
Related topics
l
l
l
l
system update info
Use this command to display recent error messages and the following information about FortiGuard signatures,
IP lists, and engine packages and the geography-to-IP mapping database: l l l l
Current version
Time of last update
Next scheduled update time
Previous version history
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
615
system update info
Syntax
diagnose system update info
Example
FortiWeb signature
----------
Version: 0.00146
Expiry Date: Thu Jan 01 1970
Last Update Date: Sat Dec 05 11:00:46 2015
Next Update Date: Wed Jan 13 11:00:00 2016
Historical versions
----------
0.00146
0.00144
0.00144
0.00144
0.00139
FortiWeb GEODB
----------
Version: GEO-533LITE 20141104
Expiry Date: N/A
Last Update Date: Tue Dec 01 10:53:35 2015
Next Update Date: N/A
Historical versions
----------
GEO-533LITE 20141007
N/A
Regular Antivirus
----------
Version: 30.00946
Expiry Date: Thu Mar 13 2014
Last Update Date: Sat Dec 05 11:03:30 2015
Next Update Date: Wed Jan 13 11:00:00 2016
Historical versions
----------
30.00859
30.00785
30.00698
29.00326
29.00302
29.00279
29.00256
14.00922
Extended Antivirus
----------
Version: 30.00871
Expiry Date: Thu Mar 13 2014
Last Update Date: Sat Dec 05 11:03:30 2015
Next Update Date: Wed Jan 13 11:00:00 2016
616 diagnose
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
diagnose system update info
Historical versions
----------
30.00708
30.00540
29.00219
14.00922
IP Reputation
----------
Version: 2.00649
Expiry Date: Thu Jan 01 1970
Last Update Date: Sat Dec 05 11:00:46 2015
Next Update Date: Wed Jan 13 11:00:00 2016
Historical versions
----------
2.00642
2.00635
2.00628
2.00596
2.00594
2.00592
2.00590
1.00020
Latest errors
----------
Wed Jan 13 10:04:02 2016 Failed to establish connection with 192.168.100.205:443 when install anti-virus packages.
Wed Jan 13 10:03:02 2016 Failed to establish connection with 192.168.100.205:443 when install essential packages.
Wed Jan 13 10:02:00 2016 Failed to establish connection with 192.168.100.205:443 when install anti-virus packages.
Wed Jan 13 10:01:00 2016 Failed to establish connection with 192.168.100.205:443 when install essential packages.
Wed Jan 13 09:04:06 2016 Failed to establish connection with 192.168.100.205:443 when install anti-virus packages.
Wed Jan 13 09:03:06 2016 Failed to establish connection with 192.168.100.205:443 when install essential packages.
Wed Jan 13 09:02:04 2016 Failed to establish connection with 192.168.100.205:443 when install anti-virus packages.
Wed Jan 13 09:01:04 2016 Failed to establish connection with 192.168.100.205:443 when install essential packages.
Wed Jan 13 08:04:07 2016 Failed to establish connection with 192.168.100.205:443 when install anti-virus packages.
Wed Jan 13 08:03:07 2016 Failed to establish connection with 192.168.100.205:443 when install essential packages.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
617
execute
execute
backup cli-config
execute date execute db rebuild
The execute command has an immediate and decisive effect on your FortiWeb appliance and, for that reason, should be used with care. Unlike config commands, most execute commands do not result in any configuration change.
This chapter describes the following commands:
execute erasedisk execute factoryreset execute factoryreset
execute formatlogdisk execute ha disconnect
execute ha md5sum execute ha synchronize
execute restore secondary-image
execute shutdown execute telnet
backup cli-config
Use this command to manually back up the configuration file to a TFTP server.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
618
backup cli-config execute
This method does not include uploaded files such as: l private keys l certificates l error pages l
WSDL files l
W3C Schema l vulnerability scan settings
If your configuration has these files, use either a full TFTP or FTP/SFTP backup instead. See
or
This command does
not include settings that remain at their default values for the currently installed version of the firmware. If you require a backup that includes those settings, instead use
Alternatively, you can back up the configuration to an FTP or SFTP server. See
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute backup cli-config tftp
<filename_str> <tftp_ipv4> {entire | profile}
Variable
<filename_str>
<tftp_ipv4>
{entire | profile}
Description Default
Type the name of the file to be used for the backup file, such as
FortiWeb_backup.conf
.
No default.
Type the IP address of the TFTP server.
No default.
Select either: l entire
— Back up the core configuration file only.
Note: This is not literally the entire configuration. It only contains the core configuration file, comprised of a CLI script.
It does
not include uploaded files such as error pages and private keys.
l profile
— Back up only the web protection profiles.
619 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute
Variable
[<password_str>]
Description
Type a password for use when encrypting the backup file using 128-bit AES.
If you do not provide a password, the backup file will be stored as clear text.
Caution: Remember the password or keep it in a secure location. You will be required to enter the same password when restoring an encrypted backup file. If you forget or lose the password, you will not be able to use that encrypted backup file.
backup full-config
Default
No default.
Example
This example uploads the FortiWeb appliance’s system configuration to a file named fweb.cfg on a TFTP server at IP address 192.168.1.23. The file will not be password-encrypted.
execute backup cli-config tftp fweb.cfg 192.168.1.23 entire
Related topics
l
l
l
backup full-config
Use this command to manually back up the entire configuration file,
including those settings that remain at their default values, to a TFTP server.
Fortinet strongly recommends that you password-encrypt this backup, and store it in a secure location. This backup method includes sensitive data such as your HTTPS certificates’ private keys. Unauthorized access to private keys compromises the security of all HTTPS requests using those certificates.
Alternatively, you can back up the configuration to an FTP or SFTP server. See
This backup includes settings that remain at their default values increases the file size of the backup, but may be useful in some cases, such as when you want to compare the default settings with settings that you have configured.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute backup full-config tftp
<filename_str> <tftp_ipv4> [<password_str>]
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
620
certificate ca
Variable
<filename_str>
<tftp_ipv4>
[<password_str>]
Description Default
Type the name of the file to be used for the backup file, such as
FortiWeb_backup.conf
.
No default.
Type the IP address of the TFTP server.
No default.
Type a password for use when encrypting the backup file using 128-bit AES.
If you do not provide a password, the backup file will be stored as clear text.
Caution: Remember the password or keep it in a secure location. You will be required to enter the same password when restoring an encrypted backup file. If you forget or lose the password, you will not be able to use that encrypted backup file.
No default.
execute
Example
This example uploads the FortiWeb appliance’s entire configuration, including uploaded error page and HTTPS certificate files, to a file named fweb.cfg on a TFTP server at IP address 192.168.1.23. The file is encrypted with the password P@ssword1.
execute backup full-config tftp fweb.cfg 192.168.1.23 P@ssword1
Related topics
l
l
certificate ca
Use this command to upload a trusted CA certificate.
Certificate authorities (CAs) validate and sign others’ certificates. FortiWeb determines whether a client or device’s certificate is genuine by comparing the CA’s signature and the copy of the CA certificate that you have uploaded. If they are made by the same private key, the CA’s signature is genuine, and therefore the client or device’s certificate is legitimate.
Syntax
execute certificate ca import
{tftp | auto} {<vdom_name> | root} <cert_name>
]
621 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute certificate crl
Variable
{tftp | auto}
{<vdom_name> | root}
<cert_name>
{<tftp_ipv4> | <scep_ url>}
<ca_id>
Description
Use one of the following options to specify the location of the
CA certificate:
• tftp — From a TFTP server.
• auto — From a SCEP (Simple Certificate Enrollment
Protocol) server.
Default
No default.
Specifies the administrative domain (ADOM) that the certificate applies to.
No default.
If ADOMs are not enabled, specify root.
If the certificate is located on a TFTP server, the name of the certificate file.
If the certificate is located on a TFTP server, the IP address of the server.
If the source of the certificate is a SCEP server, the URL of the server.
Optionally, if the source of the certificate is a SCEP server, you can use a CA identifier to specify a specific CA.
No default.
No default.
No default.
Example
This example uploads the trusted CA certificate file ca.cer from the TFTP server 192.168.1.23.
execute certificate ca import tftp root ca.cer 192.168.1.23
This example uploads the trusted CA certificate file from the SCAEP server at http://10.0.0.31/certsrv/mscep/mscep.dll
.
Related topics
l
l
l
l
certificate crl
Use this command to install a Certificate Revocation List (CRL).
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
622
certificate crl execute
To ensure that your FortiWeb appliance validates only certificates that have not been revoked, you should periodically upload a current certificate revocation list (CRL), which may be provided by certificate authorities
(CA).
Syntax
execute certificate crl import
{tftp | auto | http} {<vdom_name> | root} <crl_name>
{<tftp_ipv4> | <scep_url> | <http_url>}
Variable
{tftp | auto | http}
{<vdom_name> | root}
<crl_name>
{<tftp_ipv4> | <scep_ url> | <http_url>}
Description
Use one of the following options to specify the location of the
CRL to upload to FortiWeb:
• tftp — A TFTP server.
• auto — A SCEP (Simple Certificate Enrollment Protocol) server.
• http — An HTTP server.
Default
No default.
Specifies the administrative domain (ADOM) that the CRL applies to.
If ADOMs are not enabled, specify root.
No default.
If the source of the CRL is a TFTP server, the name of the CRL file.
No default.
If the source of the CRL is a TFTP server, the IP address of the server.
If the source of the CRL is a SCEP server, the URL of the server.
If the source of the CRL is an HTTP server, the URL of the server.
No default.
Example
This example uploads the CRL file Cert31.crl from the TFTP server 192.168.1.23.
execute certificate crl import tftp root Cert31.crl 192.168.1.23
This example uploads the CRL file Cert31.crl from the HTTP server 10.0.0.31.
execute certificate crl import http root http://10.0.0.31/certsrv/CertEnroll/Cert31.crl
This example uploads a CRL file from the SCEP server at http://155.229.15.173/cert/scep.
execute certificate crl import auto root http://155.229.15.173/cert/scep
623 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute certificate inter-ca
Related topics
l
l
l
l
certificate inter-ca
Use this command to upload an intermediate CA’s certificate.
If a server certificate is signed by an intermediate (non-root) certificate authority rather than a root CA, before the client trusts the server’s certificate, you must demonstrate a link with trusted root CAs. This mechanism proves that the server’s certificate is genuine. Otherwise, the server certificate may cause the end-user’s web browser to display certificate warnings.
Syntax
execute certificate inter-ca import
{tftp | auto} {<vdom_name> | root} <cert_name>
]
Variable
{tftp | auto}
{<vdom_name> | root}
<cert_name>
{<tftp_ipv4> | <scep_ url>}
<ca_id>
Description
Use one of the following options to specify the location of the certificate to upload to FortiWeb:
• tftp — A TFTP server.
• auto — A SCEP (Simple Certificate Enrollment Protocol) server.
Default
No default.
Specifies the administrative domain (ADOM) that the certificate applies to.
No default.
If ADOMs are not enabled, specify root.
If the certificate is located on a TFTP server, the name of the certificate file.
No default.
If the certificate is located on a TFTP server, the IP address of the server.
If the source of the certificate is a SCEP server, the URL of the server.
Optionally, if the source of the certificate is a SCEP server, you can use a CA identifier to specify a specific CA.
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
624
certificate local execute
Example
This example uploads the certificate file ca.cer from the TFTP server 192.168.1.23.
execute certificate inter-ca import tftp root ca.cer 192.168.1.23
This example uploads the certificate file from the SCEP server at http://10.0.0.31/certsrv/mscep/mscep.dll
.
execute certificate inter-ca import auto root http://10.0.0.31/certsrv/mscep/mscep.dll
Related topics
l
config system certificate intermediate-certificate
l
l
l
certificate local
Use this command to upload a server certificate from a TFTP server. You also use it to upload a client certificate for FortiWeb.
For more information about server certificates, see
config system certificate local
.
Syntax
execute certificate local
import tftp
<cert_name> <key_name> <password_str>
Variable
{cert | pkcs12-cert}
{<vdom_name> | root}
<cert_name>
Description Default
Use one of the following options to specify the type of certificate file to upload:
No default.
• cert — An unencrypted certificate in PEM format. The key is in a separate file.
• pkcs12-cert — A PKCS #12 encrypted certificate with key.
Specifies the administrative domain (ADOM) that the certificate applies to.
root
If ADOMs are not enabled, specify root.
Specifies the name of the certificate file.
No default.
625 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute create-raid level
Variable
<key_name>
<tftp_ipv4>
<password_str>
Description
If the certificate is unencrypted with the key in a separate file, specifies the key file to upload with the certificate.
Specifies the IP address of the TFTP server.
Default
No default.
No default.
If the certificate is encrypted, specify the password that was used to encrypt the file.
If the certificate is not encrypted, FortiWeb ignores this value.
No default.
Example
This example uploads the certificate file pc40.crt and its key file pc40.key from the TFTP server
192.168.1.23
. The certificate is encrypted using the password fortinet.
execute certificate local cert import tftp root pc40.crt pc40.key 192.168.1.23 fortinet
This example uploads the certificate file frompc31.pfx from the TFTP server 192.168.1.23. The certificate is encrypted using the password fortinet.
execute certificate local pkcs12-cert import tftp root frompc31.pfx 192.168.1.23 fortinet
Related topics
l
config system certificate local
l
l
l
create-raid level
Use the this command to initialize the RAID.
Currently, only RAID level 1 is supported, and only on FortiWeb-1000B, 1000C, 3000C/CFsx, 3000E, and 4000E shipped with FortiWeb 4.0 MR1 or later.
On older appliances that have been upgraded to FortiWeb 4.0 MR1, RAID cannot be activated.
Back up any data before initializing the array.
Back up the data regularly. RAID is not a substitute for regular backups. RAID 1
(mirroring) is designed to improve hardware fault tolerance, but cannot negate all risks.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
626
create-raid rebuild execute
Syntax
execute create-raid
Variable
level {raid1}
Description Default
Type the RAID level. Currently, only RAID level 1 is supported.
raid1
Related topics
l
l
l
create-raid rebuild
Use the this command to rebuild the RAID.
Currently, only RAID level 1 is supported, and only on FortiWeb-1000B, 1000C, 3000C/CFsx, 3000E, and 4000E shipped with FortiWeb 4.0 MR1 or later.
On older appliances that have been upgraded to FortiWeb 4.0 MR1, RAID cannot be activated.
Back up the data regularly. RAID is not a substitute for regular backups. RAID 1
(mirroring) is designed to improve hardware fault tolerance, but cannot negate all risks.
Rebuilding the array due to disk failure may result in some loss of packet log data.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
execute create-raid rebuild
Example
This example rebuilds the RAID array.
execute create-raid rebuild
The CLI displays the following:
This operation will clear all data on disk :0!
Do you want to continue? (y/n)
After you enter y (yes), the CLI displays additional messages.
627 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute
Related topics
l l
date
Use this command to display or set the system date.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
execute
Variable
date [<date_str>]
Description
Type the current date for the FortiWeb appliance’s time zone, using the format yyyy-mm-dd, where: l yyyy is the year. Valid years are 2001 to 2037.
l mm is the month. Valid months are 01 to 12.
l dd is the day of the month. Valid days are 01 to 31.
If you do not specify a date, the command returns the current system date. Shortened values, such as 06 instead of 2006 for the year or 1 instead of 01 for the month or day, are not valid.
Default
No default.
Example
This example sets the date to 17 September 2011: execute date 2011-09-17
Related topics
l
l
db rebuild
U se this command to rebuild the FortiWeb appliance’s internal database that it uses to store log messages.
date
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
628
erase-disk execute
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute db rebuild
Related topics
l
l
diagnose debug application miglogd
l
erase-disk
Use this command to erase the hard disk or flash memory.
This command requires a console connection to the appliance and is available only when Federal Information
Processing Standards (FIPS) and Common Criteria (CC) compliant mode is enabled (see
Syntax
execute erase-disk
[
]
Variable
{ flash | disk }
<erase-times>
Description
Specify whether to erase the flash memory or the hard disk.
Enter the number of times to overwrite the specified memory with random data.
Valid values are 1 to 35.
1
Default
No default.
factoryreset
U se this command to reset the FortiWeb appliance to its default settings for the currently installed firmware version. If you have not upgraded or downgraded the firmware, this restores factory default settings.
Back up your configuration first. This command resets all changes that you have made to the FortiWeb appliance’s configuration file and reverts the system to the default values for the firmware version. Depending on the firmware version, this could include factory default settings for the IP addresses of network interfaces. For information on creating a backup, see
629 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute formatlogdisk
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute factoryreset
Related topics
l
l
l
formatlogdisk
Use this command to clear the logs from the FortiWeb appliance’s hard disk and reformat the disk.
This operation deletes all locally stored log files.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
When you execute this command, the FortiWeb appliance displays the following message:
This operation will clear all data on the log disk and take a few minutes according to the disk size!!
Do you want to continue? (y/n)
Syntax
execute formatlogdisk
Related topics
l
ha disconnect
Use this command to manually force a FortiWeb appliance to leave the HA group, without unplugging any cables. This can be useful, for example, if you need to remove a standby appliance from the HA cluster in order to configure it for standalone operation, and want to do so
without disrupting traffic, and without unplugging cables.
Behavior varies by which appliance you eject: l
Active — Failover occurs. The standby remains as a member of the HA group, and will elect itself as the new active appliance, assuming all of the HA cluster’s configured IP addresses and traffic processing duties.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
630
ha disconnect execute l
Standby — No failover occurs. The active appliance remains actively processing traffic.
To ensure that you can re-connect to the ejected appliance’s GUI or CLI via a remote network connection (not only via its local console), this command requires that you specify an IP address and port name that will become its new management interface. By default, it will be accessible via HTTP, HTTPS, SSH, and telnet. (All other network interfaces on the ejected appliance will be brought down and reset to 0.0.0.0/0.0.0.0. To configure them, you must connect to the ejected appliance’s GUI or CLI.)
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
execute ha
disconnect <serial-number_str> <interface_name> <interface_ipv4mask>
Variable
disconnect <serialnumber_str>
<interface_name>
<interface_ipv4mask>
Description
Type the serial number of the FortiWeb appliance that you want to disconnect from the cluster.
To display the serial number of each appliance in the HA group, type: execute ha disconnect ?
Default
No default.
Type the name of the network interface, such as port1, that will be configured as the ejected appliance’s management interface.
No default.
Type the IP address and netmask that will be configured as the ejected appliance’s management interface.
No default.
Example
This example ejects the standby appliance whose serial number is FV-1KC3R11111111, assigning its port1 to be the web UI/GUI interface, reachable at 10.0.0.1.
execute ha disconnect FV-1KC3R11111111 port1 10.0.0.1/24
After the command completes, to reconfigure the ejected appliance, you could then use either a web browser or
SSH client to connect to 10.0.0.1 in order to reconfigure it for standalone operation.
Related topics
l
l
l
l
l
l
l
631 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute ha manage
ha manage
Use this command to log in to another appliance in the HA group via the HA link. In most cases, you log into a standby appliance (also called the secondary, or slave) from the main (primary or master) appliance, but you can also use a standby appliance to access the main appliance.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
execute ha manage
Variable
<cluster-index>
Description
Specifies an index value that the FortiWeb HA feature assigns to a cluster member based on its serial number.
The cluster member with the highest serial number has a cluster index of 0, the one with the second-highest serial number has a cluster index of 1, and so on.
To display the index numbers of the cluster members, enter the following command: execute ha manage ?
Default
No default.
Example
In this example, you are logged in to the main appliance.
execute ha manage ?
<id> please input peer box index.
<2> Subsidary unit FV-1KD3A12345678
<3> Subsidary unit FV-1KD3A11345678
The cluster index and serial number of the appliance you are currently logged in to is not displayed.
Enter 3 to connect to the standby appliance with serial number FV-1KD3A11345678. The CLI prompt changes to the host name of this unit and the login prompt is displayed.
To return to the primary unit, type exit.
Related topics
l
l
l
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
632
ha md5sum l
l
execute
ha md5sum
Use this command to retrieves the CLI system configuration MD5 from the two appliances in a HA cluster.
This information allows you to confirm whether HA configuration is synchronized.
Syntax
execute ha md5sum
Example
Below is a sample output.
CLI configuration MD5SUM :
[master]:555393AE023104AB41C195F6B1CCD177
[slave ]:555393AE023104AB41C195F6B1CCD177
System configuration MD5SUM :
[master]:39B9A403673ABB7333A5EC6BAD9BEE25
[slave ]:39B9A403673ABB7333A5EC6BAD9BEE25
Related topics
l
l
l
ha synchronize
Use this command to manually control the synchronization of configuration files and FortiGuard service-related packages from the active HA appliance to the standby appliance.
Typically, most HA synchronization happens automatically, whenever changes are made. However, in some cases, you may want to use this command to manually initiate full or partial HA synchronization.
l l l
To delay synchronization to a more convenient time if you are planning to make large batch changes, and therefore delayed synchronization is preferable for network performance reasons
To manually force synchronization of files that are not automatically synchronized
To trigger automatic synchronization if it has been interrupted due to HA link failure, daemon crashes, etc.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
633 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute ha synchronize
Syntax
execute ha execute ha
synchronize {all | avupd | cli | geodb | sys} synchronize {start | stop}
Variable
synchronize {all | avupd | cli | geodb | sys} synchronize {start | stop}
Description Default
Select which part of the configuration and/or FortiGuard servicerelated packages to synchronize.
l all
— Entire configuration, including CLI configuration, system files, and signature databases.
l l avupd
— Only the FortiGuard Antivirus service package, including the virus signatures, scan engine, and proxy.
cli
— Only the core CLI configuration file (fwb_ system.conf). (You can use the show command to view the contents of the configuration file.) l l geodb
— Only the geography-to-IP address mappings.
Similar to firmware, these can be downloaded from the
Fortinet Technical Support web site .
sys
— Only the IP Reputation Database (IRDB) and system files such as X.509 certificates.
Note: This command has no effect if you use the command execute ha synchronize stop. to pause it manually.
No default.
Select whether to start or stop synchronization.
No default.
Example
This example shows how to manually synchronize the virus signature and engine package to the standby appliance.
FortiWeb # execute ha synchronize avupd starting synchronize with HA master...
Related topics
l
l
l
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
634
ping execute
ping
U se this command to perform an ICMP ECHO request (also called a ping) to a host by specifying its fully qualified domain name (FQDN) or IPv4 address, using the options configured by
Pings are often used to test IP-layer connectivity during troubleshooting.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
execute
ping {<host_fqdn> | <host_ipv4>}
Variable
ping {<host_fqdn> |
<host_ipv4>}
Description
Type either the IPv4 address or fully qualified domain name
(FQDN) of the host.
Default
No default.
Example
This example pings a host with the IP address 172.16.1.10.
execute ping 172.16.1.10
The CLI displays the following:
PING 172.16.1.10 (172.16.1.10): 56 data bytes
64 bytes from 172.16.1.10: icmp_seq=0 ttl=128 time=0.5 ms
64 bytes from 172.16.1.10: icmp_seq=1 ttl=128 time=0.2 ms
64 bytes from 172.16.1.10: icmp_seq=2 ttl=128 time=0.2 ms
64 bytes from 172.16.1.10: icmp_seq=3 ttl=128 time=0.2 ms
64 bytes from 172.16.1.10: icmp_seq=4 ttl=128 time=0.2 ms
--- 172.16.1.10 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 0.2/0.2/0.5 ms
The results indicate that a route exists between the FortiWeb appliance and 172.16.1.10. It also indicates that during the sample period, there was no packet loss, and the average response time was 0.2 milliseconds.
Example
This example pings a host with the IP address 10.0.0.1.
execute ping 10.0.0.1
The CLI displays the following:
PING 10.0.0.1 (10.0.0.1): 56 data bytes
After several seconds, no output appears. The administrator halts the ping by pressing Ctrl+C. The CLI displays the following:
--- 10.0.0.1 ping statistics ---
635 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute ping6
5 packets transmitted, 0 packets received, 100% packet loss
The results indicate the host may be down, or there is no route between the FortiWeb appliance and 10.0.0.1. To determine the point of failure along the route, further diagnostic tests are required, such as
Related topics
l
l
l
l
l
l
l
l
l
ping6
U se this command to perform an ICMP ECHO request (also called a ping) to a host by specifying its IPv6 address, using the options configured by
Pings are often used to test IP-layer connectivity during troubleshooting.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
execute
ping6 {<host_fqdn> | <host_ipv6>}
Variable Description
ping6 {<host_fqdn> |
<host_ipv6>}
Type either the IP address or fully qualified domain name
(FQDN) of the host.
Default
No default.
Example
This example pings a host with the IP address 2001:0db8:85a3:::8a2e:0370:7334.
execute ping6 2607:f0b0:f:420::
The CLI displays the following:
PING 2607:f0b0:f:420:: (2607:f0b0:f:420::): 56 data bytes
After several seconds, no output appears. The administrator halts the ping by pressing Ctrl+C. The CLI displays the following:
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
636
ping-options execute
--- 2607:f0b0:f:420:: ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss
The results indicate the host may be down, or there is no route between the FortiWeb appliance and
2607:f0b0:f:420::. To determine the point of failure along the route, further diagnostic tests are required, such as
Related topics
l
l
l
l
l
l
l
l
l
ping-options
Use these commands to configure the behavior of the
command.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
execute ping-options execute ping-options execute ping-options execute ping-options execute ping-options execute ping-options execute ping-options execute ping-options execute ping-options execute ping-options
Variable
data-size <bytes_int>
Description Default
Enter datagram size in bytes.This allows you to send out packets of different sizes for testing the effect of packet size on the connection. If you want to configure the pattern that will be used to buffer small datagrams to reach this size, also configure
.
56
637 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute ping-options
Variable
df-bit {yes | no} pattern <bufferpattern_ hex>
Description
Enter either yes to set the DF bit in the IP header to prevent the ICMP packet from being fragmented, or enter no to allow the ICMP packet to be fragmented.
Default
no
Enter a hexadecimal pattern, such as 00ffaabb, to fill the optional data buffer at the end of the ICMP packet. The size of the buffer is determined by
No default.
repeat-count <repeat_ int> source {auto |
<interface_ipv4>}
Enter the number of times to repeat the ping.
5 timeout <seconds_int> tos {<service_type>} ttl <hops_int> validate-reply
{yes | no}
Select the network interface from which the ping is sent. Enter either auto or a FortiWeb network interface IP address.
auto
Enter the ping response timeout in seconds.
2 default l
Enter the IP type-of-service option value, either: default
— Do not indicate. (That is, set the TOS byte to
0.) l lowcost
— Minimize cost.
l lowdelay
— Minimize delay.
l reliability
— Maximize reliability.
l throughput
— Maximize throughput.
Enter the time-to-live (TTL) value.
Select whether or not to validate ping replies.
64 no view-settings Display the current ping option settings.
No default.
Example
This example sets the number of pings to three and the source IP address to 10.10.10.1, then views the ping options to verify their configuration.
execute ping-option repeat-count 3 execute ping-option source 10.10.10.1
execute ping-option view-settings
The CLI would display the following:
Ping Options:
Repeat Count: 3
Data Size: 56
Timeout: 2
TTL: 64
TOS: 0
DF bit: unset
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
638
ping6-options
Source Address: 10.10.10.1
Pattern:
Pattern Size in Bytes: 0
Validate Reply: no
Related topics
l
l
execute
ping6-options
Use these commands to configure the behavior of the
command.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
execute ping6-options execute ping6-options execute ping6-options execute ping6-options execute ping6-options execute ping6-options execute ping6-options execute ping6-options execute ping6-options
Variable Description
data-size <bytes_int>
Default
Enter datagram size in bytes.This allows you to send out packets of different sizes for testing the effect of packet size on the connection. If you want to configure the pattern that will be used to buffer small datagrams to reach this size, also configure
.
56 pattern <bufferpattern_ hex> repeat-count <repeat_ int>
Enter a hexadecimal pattern, such as 00ffaabb, to fill the optional data buffer at the end of the ICMP packet. The size of the buffer is determined by
No default.
Enter the number of times to repeat the ping.
5 source {auto |
<interface_ipv6>} timeout <seconds_int>
Select the network interface from which the ping is sent. Enter either auto or a FortiWeb network interface IP address.
auto
Enter the ping response timeout in seconds.
2
639 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute
Variable
tos {<service_type>} ttl <hops_int> validate-reply
{yes | no} view-settings
Description
Enter the IP type-of-service option value, either: l default
— Do not indicate. (That is, set the TOS byte to
0.) l lowcost
— Minimize cost.
l lowdelay
— Minimize delay.
l reliability
— Maximize reliability.
l throughput
— Maximize throughput.
Enter the time-to-live (TTL) value.
Select whether or not to validate ping replies.
Display the current ping option settings.
Default
default
64 no
No default.
Example
This example sets the number of pings to 3, then views the ping options to verify their configuration.
execute ping6-option repeat-count 3 execute ping6-option view-settings
The CLI would display the following:
IPV6 Ping Options:
Repeat Count: 3
Data Size: 56
Timeout: 2
Interval: 1
TTL: 64
TOS: 0
Source Address: auto
Pattern:
Pattern Size in Bytes: 0
Validate Reply: no
Related topics
l
l
reboot
U se this command to restart the FortiWeb appliance.
reboot
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
640
restore config execute
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute reboot
Example
This example shows the reboot command in action.
execute reboot
The CLI displays the following:
This operation will reboot the system !
Do you want to continue? (y/n)
After you enter y (yes), the CLI displays the following:
System is rebooting...
If you are connected to the CLI through a local console, the CLI displays messages while the reboot is occurring.
If you are connected to the CLI through the network, the CLI will not display any notification while the reboot is occurring, as this occurs after the network interfaces have been shut down. Instead, you may notice that the connection is terminated. Time required by the reboot varies by many factors, such as whether or not hard disk verification is required, but may be several minutes.
Related topics
l
l
restore config
Use this command to restore the configuration from a configuration backup file on an TFTP server, or to install primary or backup firmware.
Back up the configuration before restoring the configuration. This command restores configuration changes only, and does not affect settings that remain at their default values. Default values may vary by firmware version. For backup commands, see
and
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute restore config tftp
<filename_str> <tftp_ipv4> [<password_str>]
641 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute
Variable
<filename_str>
<tftp_ipv4>
[<password_str>]
Description
Type the name of the backup or firmware image file.
Type the IP address of the TFTP server.
Type the password that was used to encrypt the backup file, if any.
If you do not provide a password, the backup file must have been stored as clear text.
restore image
Default
No default.
No default.
No default.
Example
This example downloads a configuration file named backup.conf from the TFTP server, 192.168.1.23, to the
FortiWeb appliance. The backup file was encrypted with the password P@ssword1.
execute restore config tftp backup.conf 192.168.1.23 P@ssword1
The FortiWeb appliance then applies the configuration backup and reboots.
Related topics
l
l
l
l
execute restore secondary-image
restore image
Use this command to install firmware on the primary partition and reboot.
Back up the configuration before installing new firmware. Installing new firmware can change default settings and reset settings that are incompatible with the new version.
For backup commands, see
and
Unlike installing firmware via TFTP during a boot interrupt, installing firmware using this command will attempt to preserve settings and files, and not necessarily restore the FortiWeb appliance to its firmware/factory default configuration.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute restore image ftp
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
642
restore secondary-image execute restore image tftp
Variable
<filename_str>
Description
Type the name of the firmware image file.
<ftp_ipv4>
<tftp_ipv4>
Type the IP address of the TFTP server.
Type the IP address of the FTP server.
Default
No default.
No default.
No default.
execute
Example
This example installs a firmware file named firmware.out from the TFTP server, 192.168.1.23, to the
FortiWeb appliance.
execute restore image tftp firmware.out 192.168.1.23
The FortiWeb appliance downloads the firmware file, installs it, and reboots.
Related topics
l
l
l
l
execute restore secondary-image
l
l
restore secondary-image
Use this command to install backup firmware on the secondary partition and reboot.
Back up the configuration before installing new firmware. Installing new firmware can change default settings and reset settings that are incompatible with the new version.
For backup commands, see
backup full-config on page 620
and
.
Unlike installing firmware via TFTP during a boot interrupt, installing firmware using this command will attempt to preserve settings and files, and not necessarily restore the FortiWeb appliance to its firmware/factory default configuration.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
643 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute restore vmlicense
Syntax
execute restore secondary-image ftp execute restore secondary-image tftp
Variable
<filename_str>
Description
Type the name of the firmware image file.
<ftp_ipv4>
<tftp_ipv4>
Type the IP address of the FTP server.
Type the IP address of the TFTP server.
Default
No default.
No default.
No default.
Example
This example installs a firmware file named firmware.out from the TFTP server, 192.168.1.23, to the
FortiWeb appliance.
execute restore secondary-image tftp firmware.out 192.168.1.23
The FortiWeb appliance downloads the firmware file, installs it, and reboots.
Related topics
l
l
l
l
l
l
restore vmlicense
Use this command to upload a FortiWeb-VM license file from an FTP or TFTP server.
After you enter the command, FortiWeb prompts you to confirm the upload.
After the license is authenticated successfully, the following message is displayed:
“*ATTENTION*: license registration status changed to 'VALID', please logout and re-login”
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
For more information on FortiWeb-VM licenses, see the
FortiWeb-VM Install Guide
.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
644
session-cleanup execute
Syntax
execute restore vmlicense
{ftp | tftp} <license-file_str>
{
<user_ str> : <password_str> @ <ftp_ipv4> | <tftp_ipv4>
}
Variable
{ftp | tftp}
<license-file_str>
<ftp_ipv4>
<user_str>
<password_str>
<tftp_ipv4>
Description
Specify whether to connect to the server using file transfer protocol (FTP) or trivial file transfer protocol (TFTP).
The name of the license file.
The IP address of the FTP server.
The user name that FortiWeb uses to authenticate with the server.
The password for the account specified by <user_str>.
The IP address of the TFTP server.
Default
No default.
No default.
No default.
No default.
No default.
No default.
Example
This example uploads the license file
FVVM040000010871.lic
from the TFTP server 192.168.1.23 to the FortiWeb appliance.
execute restore vmlicense tftp FVVM040000010871.lic 192.168.1.23
The FortiWeb appliance uploads the file, and then prompts you to log out and log in again.
session-cleanup
Use this command to immediately clean up all sessions.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute session-cleanup
645 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute shutdown
shutdown
Use this command to prepare the FortiWeb appliance to be powered down by halting the software, clearing all buffers, and writing all cached data to disk.
Power off the FortiWeb appliance only after issuing this command. Unplugging or switching off the FortiWeb appliance without issuing this command could result in data loss.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute shutdown
Example
This example shows the reboot command in action.
execute shutdown
The CLI displays the following:
This operation will halt the system
(power-cycle needed to restart)!Do you want to continue? (y/n)
After you enter y (yes), the CLI displays the following:
System is shutting down...(power-cycle needed to restart)
If you are connected to the CLI through a local console, the CLI displays a message when the shutdown is complete.
If you are connected to the CLI through the network, the CLI will not display any notification when the shutdown is complete, as this occurs after the network interfaces have been shut down. Instead, you may notice that the connection times out.
Related topics
l
telnet
Use this command to open a Telnet connection to a server using IPv4 to port 23.
Telnet connections are not secure. Eavesdroppers could easily obtain your administrator password. Only use telnet over a trusted, physically secured network, such as a direct connection between your computer and the appliance.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
646
telnettest execute
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
execute
Variable
telnet <host_ipv4>
Description
Type the IP address of the host.
Default
No default.
Example
This example Telnets to a host with the IP address 172.16.1.10.
execute telnet 172.16.1.10
login: admin
Password: *******
Related topics
l
l
l
telnettest
U se this command to open a Telnet connection to a server using an IPv4 or IPv6 address or fully qualified domain name (FQDN). This command can be useful for troubleshooting (for example, when the server does not support the HTTP versions, methods, headers, and so on, that the client uses).
Telnet connections are not secure. Eavesdroppers could easily obtain your administrator password. Only use Telnet over a trusted, physically secured network, such as a direct connection between your computer and the appliance, and from the appliance to the server.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
execute
telnettest {<host_ipv4> | <host_ipv6> | <host_fqdn>}
647 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute
Variable
telnettest {<host_ ipv4> | <host_ipv6> |
<host_fqdn>}
Description
Type the IP address or fully qualified domain name (FQDN) of the host.
Default
No default.
time
Example
This example Telnets to a host with the IPv4 address 172.16.1.10 on port 80, the IANA standard port for HTTP.
FortiWeb#
exec telnettest 172.16.1.10:80
Connected
GET /
Entering interactive mode. Type CTRL-D to exit.
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>501 Method Not Implemented</title>
</head><body>
<h1>Method Not Implemented</h1>
<p>Get to /index.html not supported.<br />
</p>
<hr>
<address>Apache/2.2.22 (Unix) DAV/2 mod_ssl/2.2.22 OpenSSL/0.9.8x Server at irene.local
Port 80</address>
</body></html>
Connection closed.
Connection status to 172.16.1.10 port 80:
Connecting to remote host succeeded.
Related topics
l
l
l
time
Use this command to display or set the system time.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
execute
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
648
traceroute
Variable
time [<time_str>]
Description
Type the current date for the FortiWeb appliance’s time zone, using the format hh:mm:ss, where: l hh is the hour. Valid hours are 00 to 23.
l mm is the minute. Valid minutes are 00 to 59.
l ss is the second. Valid seconds are 00 to 59.
If you do not specify a time, the command returns the current system time.
Shortened values, such as 1 instead of 01 for the hour, are valid. For example, you could enter either 01:01:01 or
1:1:1
.
Default
No default.
execute
Example
This example sets the system time to 15:31:03: execute time 15:31:03
Related topics
l
l
traceroute
Use this command to use ICMP to test the connection between the FortiWeb appliance and another network device, and display information about the time required for network hops between the device and the FortiWeb appliance.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
execute
traceroute {<host_fqdn> | <host_ipv4>}
Variable
traceroute {<host_ fqdn> | <host_ipv4>}
Description
Type either the IP address or fully qualified domain name
(FQDN) of the host.
Default
No default.
649 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute traceroute
Example
This example tests connectivity between the FortiWeb appliance and docs.fortinet.com. In this example, the trace times out after the first hop, indicating a possible connectivity problem at that point in the network.
FortiWeb#
execute traceroute docs.fortinet.com
traceroute to docs.fortinet.com (65.39.139.196), 30 hops max, 38 byte packets
1 172.16.1.200 (172.16.1.200) 0.324 ms 0.427 ms 0.360 ms
2 * * *
Example
This example tests the availability of a network route to the server example.com.
execute traceroute example.com
The CLI displays the following: traceroute to example.com (192.168.1.10), 32 hops max, 72 byte packets
1 172.16.1.2
0 ms 0 ms 0 ms
2 10.10.10.1 <static.isp.example.net> 2 ms 1 ms 2 ms
3 10.20.20.1 1 ms 5 ms 1 ms
4 10.10.10.2
<core.isp.example.net> 171 ms 186 ms 14 ms
5 10.30.30.1 <isp2.example.net> 10 ms 11 ms 10 ms
6 10.40.40.1 73 ms 74 ms 75 ms
7 192.168.1.1 79 ms 77 ms 79 ms
8 192.168.1.2 73 ms 73 ms 79 ms
9 192.168.1.10 73 ms 73 ms 79 ms
10 192.168.1.10 73 ms 73 ms 79 ms
Example
This example attempts to test connectivity between the FortiWeb appliance and example.com. However, the
FortiWeb appliance could not trace the route, because the primary or secondary DNS server that the FortiWeb appliance is configured to query could not resolve the FQDN example.com into an IP address, and it therefore did not know to which IP address it should connect. As a result, an error message is displayed.
FortiWeb#
execute traceroute example.com
traceroute: unknown host example.com
Command fail. Return code 1
To resolve the error message in order to perform connectivity testing, the administrator would first configure the
FortiWeb appliance with the IP addresses of DNS servers that can resolve the FQDN example.com. For details, see
.
Related topics
l
l
l
l
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
650
update-now execute
update-now
Use this command to initiate an update of the predefined robots, data types, suspicious URLS, and attack signatures used by your FortiWeb appliance.
FortiWeb appliances receive updates from the FortiGuard Distribution Network (FDN). The FDN is a world-wide network of FortiGuard Distribution Servers (FDS). FortiWeb appliances connect to the FDN by connecting to the
FDS nearest to the FortiWeb appliance by its configured time zone.
The time required for the update varies with the availability of the updates, the size of the updates, and the speed of the FortiWeb appliance’s network connection. If event logging is enabled, and the FortiWeb appliance cannot connect successfully, it will log the message update failed, failed to connect any fds servers!
or FortiWeb is unauthorized
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute update-now
651 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
get
get
The get command displays parts of your FortiWeb appliance’s configuration in the form of a list of settings and their values.
Unlike show, get displays
all settings, even if they are still in their default state.
For example, you might get the current DNS settings: get system dns primary : 172.16.95.19
secondary : 0.0.0.0
domain : example.com
Notice that the command displays the setting for the secondary DNS server, even though it has not been configured, or has reverted to its default value.
Also unlike show, unless used from within an object or table, get requires that you specify the object or table whose settings you want to display.
For example, at the root prompt, this command would be valid: get system dns and this command would
not be valid: get
Like show, depending on whether or not you have specified an object, get may display one of two different outputs, either the configuration: l l that you have just entered but not yet saved, or as it currently exists on the flash disk, respectively.
For example, immediately after configuring the secondary DNS server setting but
before saving it, get displays two different outputs (differences highlighted in bold):
FortiWeb# config system dns
FortiWeb (dns)# set secondary 192.168.1.10
FortiWeb (dns)# get
primary : 172.16.95.19
secondary : 192.168.1.10
domain : example.com
FortiWeb (dns)# get system dns
primary : 172.16.95.19
secondary : 0.0.0.0
domain : example.com
The first output from get indicates the value that you have configured but not yet saved; the second output from get indicates the value that was last saved to disk.
If you were to now enter end, saving your setting to disk, get output for both syntactical forms would again match. However, if you were to enter abort at this point and discard your recently entered secondary DNS setting instead of saving it to disk, the FortiWeb appliance’s configuration would therefore match the second output, not the first.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
652
router all
If you have entered settings but cannot remember how they differ from the existing configuration, the two different forms of get, with and without the object name, can be a useful way to remind yourself.
Most get commands, such as get system dns, are used to display configured settings. You can find relevant information about such commands in the corresponding config commands in the config chapter.
Other get commands, such as
, are used to display system information that is
not configurable. This chapter describes this type of get command.
The get commands require at least read (r) permission to applicable administrator profile groups.
This chapter describes the following commands.
get system fortisandboxstatistics
get system loggedusers get system performance
get
Although not explicitly shown in this section, for all
commands, there are related get and
commands which display that part of the configuration. get and show commands use the same syntax as their related config command, unless otherwise mentioned. For syntax examples and descriptions of each configuration object, field, and option, see
When ADOMs are enabled, and if you log in as admin, the top level of the shell changes: the two top level items are get global and get vdom.
l get global displays settings that only admin or other accounts with the
prof_
admin access profile can change.
l get vdom displays each ADOM and its respective settings.
This menu and CLI structure change is not visible to non-global accounts; ADOM administrators’ navigation menus continue to appear similar to when ADOMs are disabled, except that global settings such as network interfaces, HA, and other global settings do not appear.
router all
Use this command to display the list of configured and implied static routes.
Syntax
get router all
653 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
get system fortisandbox-statistics
Example
get router all
Output such as the following appears in the CLI. In this case, only 172.20.120.0 was a static route configured by an administrator using
. The other routes are implied by the IP addresses of the
virtual servers (10.1.1.10 listening on port2) and network interfaces (192.168.1.25 for port3).
IP Mask Gateway Distance Device
172.20.120.0 255.255.255.0 0.0.0.0 0 port1
10.1.1.221 255.255.255.255 0.0.0.0 0 port2
192.168.1.0 255.255.255.0 0.0.0.0 0 port3
Related topics
l
l
system fortisandbox-statistics
Displays a count of uploaded files that FortiSandbox has evaluated in the past 7 days, by evaluation result.
FortiWeb organized the statistics using the following categories: l l l l l detected (total malicious files detected) clean risk-low (total low-risk malicious files detected) risk-medium (total medium-risk malicious files detected) risk-high (total high-risk malicious files detected)
Syntax
get system fortisandbox-statistics
Example
FortiWeb # get system fortisandbox-statistics detected : 0 clean : 0 risk-low : 0 risk-medium : 0 risk-high : 0
Related topics
l
l
config waf file-upload-restriction-policy
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
654
system logged-users
system logged-users
Lists which administrator accounts are currently logged in to the FortiWeb appliance via the local console, web
UI, or CLI (including through the JavaScript-based CLI Console widget of the web UI). It also displays the login time of that administrative session.
For information on allowing only one administrator to be logged in at any given time, see
Syntax
get system logged-users
Example
get system logged-users
Logged in users: 2
INDEX USERNAME TYPE FROM TIME
0 admin cli console Thu Jun 21 14:50:09 2012
1 admin cli ssh(172.20.120.225) Thu Jun 21 15:19:09 2012
Related topics
l
l
system performance
Displays the FortiWeb appliance’s CPU usage, memory usage, average system load, and up time.
Normal idle load varies by hardware platform, firmware, and configured features. To determine your specific baseline for idle, configure your system completely, reboot, then view the system load. After at least 1 week of uptime with typical traffic volume, view the system load again to determine the normal non-idle baseline.
System load is the average of percentages relative to the maximum possible capability of this FortiWeb appliance’s hardware. It includes: l l l l average system load number of HTTP daemon/proxy processes or children memory usage disk swap usage
Syntax
get system performance get
655 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
get
Example
FortiWeb # get system performance
CPU states: 4% used, 96% idle
Memory states: 18% used
System Load: 1
Up: 28 days, 11 hours, 38 minutes
Related topics
l
l
l
l
l
l
l
l
system status
Use this command to display system status information including: l l l l l l
FortiWeb firmware version, build number and date
FortiWeb appliance serial number and boot loader (“Bios”) version log hard disk availability host name operation mode, such as reverse proxy or transparent inspection current HA status for all appliances in the HA cluster (if HA is enabled)
Syntax
get system status
Example
get system status
International Version:FortiWeb-1000C 5.01,build0039,130726
Serial-Number:FV-1KC3R11700094
Bios version:04000002
Log hard disk:Available
Hostname:FortiWeb
Operation Mode:Reverse Proxy
Current HA mode=active-passive, Status=main
HA member :
Serial-Number Priority HA-Role
FV-1KC3R11700136 5 standby
FV-1KC3R11700094 1 main
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
system status
656
waf signature-rules get
Related topics
l
l
l
waf signature-rules
Use this command to list the IDs, names, and descriptions of signature rules.
You specify signatures in the config waf signature command using the signature ID only. This command allows you to view the names and descriptions of the IDs.
Syntax
get waf signature rules
Example
get waf signature rules
This example output is the first four entries that the CLI displays when FortiWeb is configured with the default signatures only.
rule id : 110000009 main class id : 110000000 main class name : Bad Robot sub class id : 000000000 sub class name : Bad Robot rule description : This signature prevents Google Skipfish scanner from exploiting a vulnerability to include an arbitrary remote file with malicious PHP code and executing it in the context of the webserver process.
This attack can be achieved in HTTP request arguments.
rule id : 110000010 main class id : 110000000 main class name : Bad Robot sub class id : 000000000 sub class name : Bad Robot rule description : This signature checks whether the request came from Google Skipfish Web scanner .
The signature check region: user-agent field in http request header.
rule id : 110000011 main class id : 110000000 main class name : Bad Robot sub class id : 000000000 sub class name : Bad Robot
657 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
get waf signature-rules rule description : This signature checks whether the request contains a string of a content scraper, which could be a part of virus.
The signature check region: user-agent field in http request header.
rule id : 110000012 main class id : 110000000 main class name : Bad Robot sub class id : 000000000 sub class name : Bad Robot rule description : This signature checks whether the request came from Acunetix Web
Vulnerability Scanner .
The signature check region: http request url.
Related topics
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
658
show
show
The show command displays parts of your FortiWeb appliance’s configuration in the form of commands that are required to achieve that configuration from the firmware’s default state.
The show commands require at least read (r) permission to applicable administrator profile groups.
Although not explicitly shown in this section, for all
commands, there are related
and show commands which display that part of the configuration. get and show commands use the same syntax as their related config command, unless otherwise mentioned. For syntax examples and descriptions of each configuration object, field, and option, see
.
Unlike get, show does
not display settings that are assumed to remain in their default state.
For example, you might show the current DNS settings:
FortiWeb# show system dns config system dns end set primary 172.16.1.10
set domain "example.com"
Notice that the command does
not display the setting for the secondary DNS server. This indicates that it has not been configured, or has reverted to its default value.
Like get, depending on whether or not you have specified an object, show may display one of two different outputs, either the configuration: l l that you have just entered but not yet saved, or as it currently exists on the flash disk, respectively.
For example, immediately after configuring the secondary DNS server setting but
before saving it, show displays two different outputs (differences highlighted in bold):
FortiWeb# config system dns
FortiWeb (dns)# set secondary 192.168.1.10
FortiWeb (dns)# show
config system dns set primary 172.16.1.10
set secondary 192.168.1.10
end set domain "example.com"
FortiWeb (end)# show system dns
config system dns end set primary 172.16.1.10
set domain "example.com"
The first output from show indicates the value that you have configured but not yet saved; the second output from show indicates the value that was last saved to disk.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
659
show
660 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Copyright© 2017 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet,
Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features, or development, and circumstances may change such that any forward-looking statements herein are not accurate.
Fortinet disclaims in full any covenants, representations,and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.
Download
Advertisement
Key features
Protects web applications from attacks
Includes features for traffic management
Provides security auditing capabilities
Can be deployed in a variety of environments
Supports a wide range of security protocols
Is easy to configure and manage
Frequently asked questions
A WAF is a security application that filters malicious traffic from reaching a web application. It works by inspecting incoming traffic for known attack patterns and blocking or mitigating any threats.
FortiWeb 5.7 provides a wide range of security features, including protection against SQL injection, cross-site scripting (XSS), and brute-force attacks. It also includes features for traffic management, security auditing, and advanced security protocols.
You can configure and manage FortiWeb 5.7 using the command-line interface (CLI) or the web-based interface. The FortiWeb 5.7 CLI Reference Guide provides detailed instructions on how to use the CLI to configure and manage the firewall.