Several system-wide options that determine how FortiWeb scans traffic and caches server responses are configurable on System > Config > Advanced.
|You can also configure the size of FortiWeb’s scan buffers. For details, see
Enable to analyze the identification (ID) field in IP packet headers in order to distinguish source IP addresses that are actually Internet connections shared by multiple clients, not single clients. For an example, see Example: Setting a separate rate limit for shared Internet connections.
You can configure the ID difference threshold that triggers shared IP detection. For details, see
Tip: To improve performance and reduce memory consumption, if all source IP addresses should receive the same rate limit regardless of the number of clients sharing each connection, disable this option.
|Recursive URL Decoding||
Encoded URLs can be legitimately used for non-English URLs, but can also be used to avoid detection of attacks that use special characters. FortiWeb can decode encoded URLs to scan for these types of attacks. Several encoding types are supported, including IIS-specific Unicode encoding.
Disable to decode only one level, if the URL is encoded.
|Maximum Body Cache Size||
Valid values range from 32 to 1,024. The default value is 64.
|Maximum DLP Cache Size||
Valid values vary by Maximum Body Cache Size.
The small ice cream shop Tiny Treats might have only one network-connected smart cash register. Any request from that public IP likely comes, therefore, from that single client (unless they have not secured their WiFi network...). There is a 1:1 ratio of clients to source IP addresses from FortiWeb’s perspective.
Down the street, Giant Gelato, which distributes ice cream to eight provinces, might have a LAN for the entire staff of 250 people, each with one or more computers. Requests that come from the Giants Gelato office’s public IP therefore may actually originate from many possible clients, and therefore normally could be much more frequent. However, like many offices, the LAN uses source IP network address translation (SNAT) at the point that it links to the Internet. As a result, from FortiWeb’s perspective, the private network address of each client is impossible to know: it only knows the single public IP address of Giant Gelato’s router. So there is a single source IP address for Giant Gelato. However, there is a 250:1 ratio of clients to the source IP address.
This is a big proportionate difference. While a low rate limit might seem generous to Tiny Treats, Giant Gelato would be unhappy if you applied the same rate limit to its IP address.
40 requests per second then might be more than adequate for Tiny Treats: the clerk could page through the inventory twice every second, if she wanted to.
But for Giant Gelato, its clients would frequently see completely or half-broken views: some images or CSS would be missing, or page requests denied the first or second time, because some other clients on Giant Gelato’s LAN had already consumed the 40 requests allowed to it per second of time. Normal use would be impossible.
To be practical, then, you would not base your rate limiting solely on the source IP address of requests. Instead, you would want dual thresholds:
You could enable Shared IP so that FortiWeb could know to permit more requests per second from Giant Gelato than from Tiny Treats. Because Giant Gelato’s ID fields would not usually be continuous as a single client’s usually would be, FortiWeb could then apply a different, higher limit.
Open topic with navigation