Select which action the FortiWeb appliance will take when it detects a violation of the rule:

• Alert — Accept the connection and generate an alert email and/or log message.

• Alert & Deny — Block the request (reset the connection) and generate an alert and/or log message.

  You can customize the web page that FortiWeb returns to the client with the HTTP status code. See Customizing error and authentication pages (replacement messages).

• Period Block — Block subsequent requests from the client for a number of seconds. Also configure Block Period.

  You can customize the web page that FortiWeb returns to the client with the HTTP status code. See Customizing error and authentication pages (replacement messages).

  Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you must also define an X-header that indicates the original client’s IP (see Defining your proxies, clients, & X-headers). Failure to do so may cause FortiWeb to block all connections when it detects a violation of this type.

• Redirect — Redirect the request to the URL that you specify in the protection profile orURL Pattern and generate an alert and/or log message. Also configure either URL Pattern, or Redirect URL and Redirect URL With Reason.
• Send 403 Forbidden — Reply with an HTTP 403 Access Forbidden error message and generate an alert and/or log message.

The default value is Alert.

Note: This setting will be ignored if Monitor Mode is enabled.

Note: Logging and/or alert email will occur only if enabled and configured. See Logging and Alert email.

Note: If you will use this rule set with auto-learning, you should select Alert. If Action is Alert & Deny, or any other option that causes the FortiWeb appliance to terminate or modify the request or reply when it detects an attack attempt, the interruption will cause incomplete session information for auto-learning.

Type the number of seconds that you want to block subsequent requests from the client after the FortiWeb appliance detects that the client has violated the rule.

This setting is available only if Action is set to Period Block. The valid range is from 1 to 3,600 (1 hour). The default value is 1. See also Monitoring currently blocked IPs.

When rule violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level the FortiWeb appliance will use when it logs a violation of the rule:

• Low
• Medium
• High

The default value is Low.

Select which protected host names entry (either a web host name or IP address) that the Host: field of the HTTP request must be in to match a valid start page.

This option is available only if Host Status is enabled.

Select whether URL Pattern is a Simple String (that is, a literal URL such as /index.html) or a Regular Expression.

Note: If Default is Yes, you must select Simple String and provide the exact redirect/session initiation URL in URL Pattern. (A regular expression does not specify a single definite destination, and therefore is not a valid configuration in that case.)

If Action is Redirect, for requests that either:

• do not specify any URL (such as requesting http://www.example.com/ instead of http://www.example.com/index.php), and therefore neither explicitly match nor violate the rule
• violate the start page rule (applies only if you have selected Redirect from Action)

select Yes if you want FortiWeb to redirect the client to this page, indicated in URL Pattern. (i.e., This URL will be treated as the web site’s default/home page.) Otherwise, select No and configure the redirect URL separately from this rule, in the protection profile’s Redirect URL.

To prevent the redirect from having more than one possible destination, only one URL in the start page rule can be configured as the “default” at a given time.