Configuring an Advanced Protection policy
The Advanced Protection policy includes the following rules:
-
Content Scraping—Checks HTTP response header. If the traffic matches the occurrence limit and is over the specified percentage match, it detects web scraping, then executes the relevant actions for the traffic.
-
HTTP Response Code—Checks HTTP response code. If the traffic matches the occurrence limit and is over the specified percentage match, it detects web scraping, then executes the relevant actions for the traffic.
To configure an Advanced Protection policy:
- Go to Web Application Firewall>Common Attacks Detection.
- Click the Advanced Protection tab.
- Click Create New to display the configuration editor.
-
Complete the configuration as described in Advanced Protection configuration.
If you want to drop a large number of packets when traffic match the rules, you should set action to “block” instead of “deny."
- Save the configuration.
| Settings | Guidelines |
|---|---|
|
Name |
Enter a unique Advanced Protection policy name. Valid characters are Note: Once saved, the name of an Advanced Protection policy cannot be changed. |
|
Content Scraping |
|
|
Content Type |
Specify a Content Type for the Content Scraping rule:
|
|
Occurrence Limit |
Sets the condition for the limit of the number of responses received from the specified type. If the number of responses received within the time frame (set in Occurrence Within) from the specified type is above this limit, this condition is fulfilled. |
|
Occurrence Within |
Sets the time span during which to count how many times a response is received from the specified type. |
|
Percentage Match |
Sets the condition for what percentage of the traffic received is from the specified type, during the given time frame. If the specified type, compared to all traffic, is received above this Percentage Match, this condition is fulfilled. Default is 0, indicating that this condition is disabled by default. |
|
Action |
Select which action profile that you want to apply. See Configuring WAF Action objects. The default value is Alert. |
|
Severity |
When FortiADC records violations of this rule in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiADC uses when using Advanced Protection:
The default value is Low. |
|
HTTP Response Code |
|
|
Response Code |
Specify a Response Code for the HTTP Response Code rule. |
|
Occurrence Limit |
Sets the condition for the limit of the number of responses received from the specified type. If the number of responses received within the time frame (set in Occurrence Within) from the specified type is above this limit, this condition is fulfilled. |
|
Occurrence Within |
Sets the time span during which to count how many times a response is received from the specified type. |
|
Percentage Match |
Sets the condition for what percentage of the traffic received is from the specified type, during the given time frame. If the specified type, compared to all traffic, is received above this Percentage Match, this condition is fulfilled. Default is 0, indicating that this condition is disabled by default. |
|
Action |
Select which action profile that you want to apply. See Configuring WAF Action objects. The default value is Alert. |
|
Severity |
The default is low. |