Type the name of the policy. The maximum length is 63 characters.

To display the list of existing policies, type:

edit ?

No default.

Specify the distribution method that FortiWeb uses when it forwards connections accepted by this policy.

No default.

Type the name of a virtual server that provides the IP address and network interface of incoming traffic that FortiWeb routes and to which the policy applies a protection profile. The maximum length is 35 characters.

To display the list of existing virtual servers, type:

edit ?

Available only if the operating mode is reverse proxy.

No default.

Type the name of the bridge that specifies the network interface of the incoming traffic that the policy applies a protection profile to. The maximum length is 15 characters.

To display the list of existing bridges, type:

edit ?

Available only if the operating mode is true transparent proxy or transparent inspection.

No default.

Type the network interface of incoming traffic that the policy attempts to apply a profile to. The IP address is ignored.

Available only if the operating mode is offline inspection.

 

Enable to forward subsequent requests from an identified client connection to the same server pool as the initial connection from the client.

This option allows FortiWeb to improve its performance by skipping the process of matching HTTP header content to content routing policies for connections it has already evaluated and routed.

Available only when deployment-mode is http-content-routing.

 

Type the name of the server pool whose members receive the connections.

To display the list of existing servers, type:

edit ?

This field is applicable only if deployment-mode is server-pool, offline-protection or transparent-servers.

Caution: Multiple virtual servers/policies can forward traffic to the same server pool. If you do this, consider the total maximum load of connections that all virtual servers forward to your server pool. This configuration can multiply traffic forwarded to your server pool, which can overload it and cause dropped connections.

No default.

Type the name of a protected hosts group to allow or reject connections based upon whether the Host: field in the HTTP header is empty or does or does not match the protected hosts group. The maximum length is 35 characters.

To display the list of existing groups, type:

edit ?

If you do not select a protected hosts group, FortiWeb accepts pr blocks requests based upon other criteria in the policy or protection profile, but regardless of the Host: field in the HTTP header.

Note: Unlike HTTP 1.1, HTTP 1.0 does not require the Host: field. The FortiWeb appliance does not block HTTP 1.0 requests because they do not have this field, regardless of whether or not you have selected a protected hosts group.

No default.

Type the number of the physical network interface port that FortiWeb uses to send TCP RST (reset) packets when a request violates the policy. The valid range varies by the number of physical ports on the NIC.

For example, to send TCP RST from port1, type:

set block-port port1

Available only when the operating mode is offline protection.

No default.

Enable to detect TCP SYN flood attacks (see “config system dos-prevention” for additional information).

Available only when the operating mode is true transparent mode.

Enter the maximum number of TCP SYN packets, including retransmission, that FortiWeb allows to be sent per second to a destination address. If this threshold is exceeded, the FortiWeb appliance treats the traffic as a DoS attack and ignores additional traffic from that source address.

The valid range is from 10 to 10,000 packets.

Available only when the operating mode is true transparent mode and syncookie is enabled.

Type the custom or predefined service that defines the port number on which the virtual server receives HTTP traffic. The maximum length is 35 characters.

To display the list of existing services, type:

edit ?

Available only when the operating mode is reverse proxy.

No default.

Type the custom or predefined service that defines the port number on which the virtual server receives HTTPS traffic. The maximum length is 35 characters.

To display the list of existing services, type:

edit ?

Available only when the operating mode is reverse proxy. (For other operation modes, use the server pool configuration to enable SSL inspection instead.)

No default.

Enable to combat MITM attacks on HTTP by injecting the RFC 6797 strict transport security header into the reply, such as:

This header forces the client to use HTTPS for subsequent visits to this domain. If the certificate does not validate, it also causes a fatal connection error: the client’s web browser does not display any dialog that allows the user to override the certificate mismatch error and continue.

Available only if https-service <service_name> is configured.

disable

Type the time to live in seconds for the HSTS header.

Available only if hsts-header {enable | disable} is enabled.

The valid range is from 3600 to 31,536,000.

Type the name of the certificate that FortiWeb uses to encrypt or decrypt SSL-secured connections. The maximum length is 35 characters.

To display the list of existing certificates, type:

edit ?

If sni is enable, FortiWeb uses a Server Name Indication (SNI) configuration instead of or in addition to this server certificate. For more information, see sni {enable | disable}.

This option is used only if https-service <service_name> is configured.

No default.

Type the name of an intermediate certificate authority (CA) group, if any, that FortiWeb uses to validate the CA signing chain in a client’s certificate. The maximum length is 35 characters.

To display the list of existing groups, type:

edit ?

Available only if https-service <service_name> is configured.

No default.

Type the name of a certificate verifier, if any, to use when an HTTP client presents their personal certificate. (If you do not select one, the client is not required to present a personal certificate.)

If the client presents an invalid certificate, the FortiWeb appliance does not allow the connection.

To be valid, a client certificate must:

Personal certificates, sometimes also called user certificates, establish the identity of the person connecting to the web site.

You can require that clients present a certificate alternatively or in addition to HTTP authentication. For more information, see the FortiWeb Administration Guide.

The maximum length is 35 characters.

To display the list of existing verifiers, type:

edit ?

This option is used only if https-service <service_name> is configured.

The client must support SSL 3.0, TLS 1.0, TLS 1.1, or TLS 1.2.

Note: If the connection fails when you have selected a certificate verifier, verify that the certificate meets the web browser’s requirements. Web browsers may have their own certificate validation requirements in addition to FortiWeb requirements. For example, personal certificates for client authentication may be required to either:

If the certificate does not satisfy browser requirements, although it may be installed in the browser, when the FortiWeb appliance requests the client’s certificate, the browser may not display a certificate selection dialog to the user, or the dialog may not contain that certificate. In that case, verification fails. For browser requirements, see your web browser’s documentation.

No default.

Specifies whether FortiWeb uses a URL-based client certificate group to determine whether a client is required to present a personal certificate.

Available only if https-service <service_name> is configured.

Specifies the URL-based client certificate group that determines whether a client is required to present a personal certificate.

If the URL the client requests does not match an entry in the group, the client is not required to present a personal certificate.

For information on creating a group, see “config system certificate urlcert”.

No default.

Specifies the maximum allowed length for an HTTP request with a URL that matches an entry in the URL-based client certificate group, in kilobytes.

FortiWeb blocks any matching requests that exceed the specified size.

This setting prevents a request from exceeding the maximum buffer size.

Valid values are from 16 to 128.

No default.

Enable to include the X.509 personal certificate presented by the client during the SSL/TLS handshake, if any, in an X‑Client‑Cert: HTTP header when forwarding the traffic to the protected web server.

FortiWeb still validates the client certificate itself, but this can be useful if the web server requires the client certificate for the purpose of server-side identity-based functionality.

disable

Enable to use a Server Name Indication (SNI) configuration instead of or in addition to the server certificate specified by certificate <certificate_name>.

The SNI configuration enables FortiWeb to determine which certificate to present on behalf of the members of a pool based on the domain in the client request. See “system certificate sni”.

If you specify both a SNI configuration and a certificate, FortiWeb uses the certificate specified by certificate <certificate_name> when the requested domain does not match a value in the SNI configuration.

If you enable sni-strict {enable | disable}, FortiWeb always ignores the value of certificate <certificate_name>.

Available only if https-service <service_name> is configured.

Select to configure FortiWeb to ignore the value of certificate <certificate_name> when it determines which certificate to present on behalf of server pool members, even if the domain in a client request does not match a value in the specified SNI configuration.

Type the name of the Server Name Indication (SNI) configuration that specifies which certificate FortiWeb uses when encrypting or decrypting SSL-secured connections for a specified domain.

The SNI configuration enables FortiWeb to present different certificates on behalf of the members of a pool according to the requested domain.

If only one certificate is required to encrypt and decrypt traffic that this policy applies to, specify certificate <certificate_name> instead.

Available only if https-service <service_name> is configured.

Specifies whether clients can connect securely to FortiWeb using the SSL 3.0 cryptographic protocol.

Available only if https-service <service_name> is configured.

Specifies whether clients can connect securely to FortiWeb using the TLS 1.0 cryptographic protocol.

Available only if https-service <service_name> is configured.

Specifies whether clients can connect securely to FortiWeb using the TLS 1.1 cryptographic protocol.

Available only if https-service <service_name> is configured.

Specifies whether clients can connect securely to FortiWeb using the TLS 1.2 cryptographic protocol.

Available only if https-service <service_name> is configured.

Specifies whether FortiWeb generates a new public-private key pair when it establishes a secure session with a Diffie–Hellman key exchange.

Perfect forward secrecy (PFS) improves security by ensuring that the key pair for a current session is unrelated to the key for any future sessions.

Available only if https-service <service_name> is configured.

Specify whether the set of cipher suites that FortiWeb allows creates a medium-security or high-security configuration.

For details, see “Supported cipher suites & protocol versions” in the FortiWeb Administration Guide.

Available only if https-service <service_name> is configured.

Specifies whether FortiWeb uses the RC4 cipher when it first attempts to create a secure connection with a client.

This option protects against a BEAST (Browser Exploit Against SSL/TLS) attack, a TLS 1.0 vulnerability.

Enable only when set tls-v10 {enable | disable} is enabled and set ssl-cipher {medium | high} is medium.

Available only if https-service <service_name> is configured.

Specifies whether FortiWeb ignores requests from clients to renegotiate TLS or SSL.

Protects against denial-of-service (DoS) attacks that use TLS/SSL renegotiation to overburden the server.

Available only if https-service <service_name> is configured.

Enter the message that FortiWeb returns to the client when none of the server pool members are available either because their status is Disable or Maintenance or they have failed the configured health check.

Type the name of the web protection or detection profile to apply to connections that this policy accepts. The maximum length is 35 characters.

To display the list of existing profiles, type:

edit ?

No default.

Type the name of the auto-learning profile, if any, to use to discover attacks, URLs, and parameters in your web servers’ HTTP sessions. The maximum length is 35 characters.

To display the list of existing profiles, type:

edit ?

You can view data gathered using an auto-learning profile in an auto-learning report and use it to generate inline or offline protection profiles. For details, see the FortiWeb Administration Guide.

This option appears only if deployment-mode is offline-detection.

No default.

Enable to differentiate uniform resource locators (URLs) according to upper case and lower case letters for features that act upon the URLs in the headers of HTTP requests, such as start page rules, black list rules, white list rules, and page access rules.

For example, when enabled, an HTTP request involving http://www.Example.com/ would not match protection profile features that specify http://www.example.com (difference highlighted in bold).

No default.

Type a description or other comment. If the comment is more than one word or contains special characters, surround the comment with double quotes ( " ). The maximum length is 63 characters.

No default.

Enable to allow the policy to be used when evaluating traffic for a matching policy.

Note: You can use SNMP traps to notify you of changes to the policy’s status. For details, see “config system snmp community”.

No default.

Enable to override deny and redirect actions defined in the server protection rules for the selected policy. This setting enables FortiWeb to log attacks without performing the deny or redirect action, and to collect more information to build an auto learning profile for the attack.

Disable to allow FortiWeb to perform attack deny/redirect actions as defined by the server protection rules.

Enable this option to apply the server policy as a pure proxy, without parsing the content. In this case, the policy allows all traffic to pass through the FortiWeb appliance without applying any protection rules. See also “debug application http” and “debug flow trace”.

This option applies to server policy only when the FortiWeb appliance operates in reverse proxy or true transparent proxy mode.

Caution: Use this only during debugging and for as brief a period as possible. This feature disables many protection features. See also config http-parse-error-output {enable | disable} in “config config log attack-log”.

Enable to accelerate transactions by bundling them inside the same TCP connection, instead of waiting for a response before sending/receiving the next request. This can increase performance when pages containing many images, scripts, and other auxiliary files are all hosted on the same domain, and therefore logically could use the same connection.

Only GET and HEAD methods are supported. Clients must include the Connection: keep-alive HTTP header and use HTTP 1.1 (not 1.0) in order to trigger FortiWeb to allow pipelined requests and send pipelined responses.

This feature is supported only when FortiWeb is operating in reverse proxy or true transparent proxy mode.

disable

Type the index number of the individual entry in the table.

Type the name of a HTTP content routing policy that this server policy uses.

To display the list of existing error pages, type:

edit ?

Type yes to specify that FortiWeb applies the protection profile to any traffic that does not match conditions specified in the HTTP content routing policies.