Specify a unique name for the virtual server configuration object. Valid characters are A-Z, a-z, 0-9, _, and -. No space is allowed. This name appears in reports and in logs as the SLB “policy”.

Note: Once saved, the name of a virtual server configuration cannot be changed

Select an application from the list menu:

• Microsoft SharePoint Application
• Microsoft Exchange Server Application
• IIS
• Apache
• Windows Remote Desktop
• HTTPS H2
• HTTPS H2C
• HTTP(S)
• TCPS
• HTTP Turbo
• RADIUS
• DNS
• SIP
• TCP
• UDP
• FTP
• IP
• RTSP
• RTMP
• SMTP
• DIAMETER
• ISO8583
• L7 TCP
• L7 UDP

Specify the IP address provisioned for the virtual server.

Accept the default port number (80) or specify a port , ports, or a range of ports of your preference.

Note: The virtual server will use the specified port or ports to listen for client requests. You can specify up to eight ports or port ranges separated by space. Valid values are from 0 to 65535. Port 0 applies to Layer-4 virtual servers only,

Select a network interface from the list menu, or specify a new one.

Select a real server pool (if you have one already configured) or create a new one.

Applicable to HTTP(S) applications only.

Note: SSL is disabled by default, you must check the check box to enable it. Once SSL is enabled, you must select an profile from the Client SSL Profile drop-down menu below.

Note: This setting applies to HTTPS, TCPS, HTTP2 H2, and SMTP applications only. In the case of HTTPS, it becomes available only when SSL is enabled.

Select a client SSL profile from the drop-down menu.

Note: This setting becomes available only when Application is set to IP.

Enter up to eight numeric values or value ranges corresponding to the protocols you'd like to use, separated by space.

Basic

Enter a unique name for the virtual server. Valid characters are A-Z, a-z, 0-9, _, and -. No space is allowed. This name appears in reports and in logs as the SLB “policy”.

Note: Once you have saved the configuration, you cannot edit the virtual server name.

• Enable—The virtual server can receive new sessions.
• Disable—The server does not receive new sessions and closes any current sessions as soon as possible.
• Maintain—The server does not receive new sessions, but maintains its current connections.

• Layer 7—Persistence, load balancing, and routing are based on Layer-7 objects, such as HTTP headers, cookies, and so on.
• Layer 4—Persistence, load balancing, and network address translation are based on Layer-4 objects, such as source and destination IP addresses.
• Layer 2—This feature is useful when the request’s destination IP is unknown and you need to load-balance connections among multiple next-hop gateways.

• IPv4
• IPv6

Note: IPv6 is not supported for FTP, HTTP Turbo, RDP, or SIP profiles.

A string used to describe the purpose of the configuration

Select the traffic group of your choice if you have one already configured, or create a new one by clicking Create New.

Note: FortiADC will use the "default" if you do not choose or create a traffic group of your own.

Note: Some of the settings in this part of the GUI apply to both Layer-7 and Layer-4 virtual servers, and some apply to Layer-7 virtual servers only, but none of them applies to Layer-2 virtual servers.

OFF (disabled) by default. Click the button to enable it.

Available only when Schedule Pool is enabled. (See above). Follow the instructions onscreen to:

1. Select the schedule pool(s).
2. Arrange them in a desired order.

OFF (disabled) by default. Click the button to enable it.
Note:

• When content routing is enabled, FortiADC will route packets to backend servers based on IP address (Layer-4 content) or HTTP header (Layer-7 content).
• Content-routing rules override static or policy routes.
• This option does NOT apply to SIP profiles.

Available only when Content Routing is enabled. Follow the instructions onscreen to:

1. Select the content-routing rules.
2. Arrange them in a desired order.

Note: You can select multiple content routing rules in virtual server configuration. Rules that you add are checked from top to bottom. The first rule to match is applied. If the traffic does not match any of the content-routing rule conditions specified in the virtual server configuration, the system will show some unexpected behaviors. Therefore, it is important that you create a “catch-all” rule that has no match conditions. In the virtual server configuration, this rule should be ordered last so it can be used to forward traffic to a default pool.

See Configuring content routes.

OFF (disabled) by default. Click the button to enable it.

Note:

• This option applies to Layer-7 only.
• This option does NOT apply to SIP profiles.

Available only when Content Rewriting is enabled. Follow the instructions onscreen to

1. Select the content rewriting rules.
2. Arrange them in a desired order.

Note: You can select multiple content rewriting rules in the virtual server configuration. Rules that you add are consulted from top to bottom. The first rule to match is applied. If the traffic does not match any of the content rewriting rule conditions, the header is not rewritten.

See Using content rewriting rules.

Note: This setting applies to Layer-7 virtual servers only. It is not supported for HTTP Turbo profiles.

Set a limit to the number of HTTP requests per second that the virtual server can process. Valid values are from 0 to 1,048,567. The default is 0 (disabled).

The system counts each client HTTP request against the limit. When the HTTP request rate exceeds the limit, the virtual server sends an HTTP 503 error response to the client.

Note: This setting applies to Layer-4 virtual servers only.

Select one of the following packet forwarding methods:

• Direct Routing—Forwards the source and destination IP addresses with no changes.

Note: For FTP profiles, when Direct Routing is selected, you must also configure a persistence method.

• DNAT—Replaces the destination IP address with the IP address of the backend server selected by the load balancer.

The destination IP address of the initial request is the IP address of the virtual server. Be sure to configure FortiADC as the default gateway on the backend server so that the reply goes through FortiADC and can also be translated.

• Full NAT—Replaces both the destination and source IP addresses. IPv4 to IPv4 or IPv6 to IPv6 translation.
• Tunneling—(For Layer-4 IPv4 virtual servers) Allows FortiADC to send client requests to real servers through Layer-4 IP tunnels. See Layer-4 Virtual server IP tunneling.
• NAT46—(If Address Tpye is IPv4) Replaces both the destination and source IP addresses, translating IPv4 addresses to IPv6 addresses.
• NAT64—(If Address Type is IPv6) Replaces both the destination and source IP addresses, translating IPv6 addresses to IPv4 addresses.

For Full NAT, NAT46, and NAT64, the source IP address is replaced by an IP address from the pool you specify. The destination IP address is replaced with the IP address of the backend server selected by the load balancer

If you are configuring a Layer 4 virtual server and enable Full NAT or NAT46, select one or more source pool configuration objects. See Using source pools.

General

Configuration

Enter the IP address provisioned of the virtual server.

Note: You do not specify an IP address for a Layer 2 virtual server. A Layer 2 virtual server is not aware of IP addresses. Instead of routing data for a specific destination, this type of server simply forwards data from the specified network interface and port.

Accept the default port or specify a port, ports, or port ranges of your preference.

Note: The virtual server will use the specified port or ports to listen for client requests. You can specify up to eight ports or port ranges separated by space. Valid values are from 0 to 65535. Port 0 applies to Layer-4 virtual servers only,

The port range option is useful in deployments where it is desirable to have a virtual IP address with a large number of virtual ports, such as data centers or web hosting companies that use port number to identify their specific customers.

Statistics and configurations are applied to the virtual port range as a whole and not to the individual ports within the specified port range.

Note: If a Layer 2 virtual server is assigned a network interface that uses port 80 or 443, ensure that the HTTPS and HTTP administrative access options are not enabled for the interface. Setting a port range is not supported for FTP, HTTP Turbo, RADIUS, or Layer 2 TCP profiles.

Set a limit to the number of concurrent connections. The default is 0 (disabled). Valid values are from 1 to 100,000,000.

You can apply a connection limit per real server and per virtual server. Both limits are enforced. Attempted connections that are dropped by security rules are not counted.

Note: This feature is NOT supported for FTP or SIP profiles.

With Layer 4 profiles, and with the Layer-2 TCP profile, you can limit the number of new connections per second. The default is 0 (disabled). Valid values are from 1 to 86,400.

You can apply a connection rate limit per real server and per virtual server. Both limits are enforced. Attempted connections that are dropped by security rules are not counted.

Note: Not supported for FTP profiles.

Network interface that receives client traffic for this virtual server.

Resources

Select a predefined or user-defined profile configuration object. See Configuring Application profiles.

Select a predefined or user-defined persistence configuration object. See Configuring persistence rules.

Note: The persistence rule with Match Across Virtual Servers enabled works only with L4 virtual servers or the L7 virtual server whose profile is LB_PROF_RADIUS.

Select a predefined or user-defined method configuration object. See .

Select a real server pool configuration object. See Configuring real server pools.

Select a configuration object. See Configuring a clone pool.

Select an authentication policy configuration object. HTTP/HTTPS only.

See Configuring authentication policies.

Available only when Scripting is enabled. Follow the instructions on screen to:

1. Select the scripting object
2. Arrange them in desired order

Note: FortiADC allows you to combine multiple individual scripts into one combined script so that you can execute them all at once. In that situation, you can set the order in which the scripts are executed by assigning the scripts with different priorities. For more information, see Support for multiple scripts.

Select an exception configuration object. Layer 2 HTTPS/TCPS only. See Configuring an L2 exception list.

Note: This field is only available when Type is set to Layer 2.

This option becomes available when an HTTPS server load-balancing profile is selected. It's disabled by default. Click the button to enable.

Note: If enabled, it opens HTTP service on an HTTPS virtual server which redirects traffic to an HTTP virtual server.

This option becomes available when HTTP Redirect to HTTPS is enabled for an HTTPS type of server load-balancing profile, as described above.

You can either accept the default port (80), or specify up to eight ports or ranges of ports of your preference.

Error Page

Select an error page configuration object. See Configuring error pages.

Note: Not supported for SIP profiles.

If you do not use an error page, you can enter an error message to be returned to clients in the event no server is available. Maximum 1023 bytes.

Note: Not supported for SIP profiles.

FortiGSLB

IPv4 or IPv6

Set the Public IP type for the virtual server.

Virtual server public IP address.

FortiGSLB One Click GSLB server

The hostname part of the FQDN, such as www.

Note: You can specify the @ symbol to denote the zone root. The value substitute for @ is the preceding $ORIGIN directive.

The domain name must end with a period. e.g. example.com.

Select a WAF profile configuration object or create a new one. See Configuring a WAF Profile.

Select an existing AV profile from the drop-down menu or create a new one. See Creating an AV profile.

Select a DoS protection profile configuration object or create a new one. See Configuring DoS Protection Profile.

Select a Captcha configuration object. See Configuring Captcha.

Application Optimization

Select a page speed optimization profile.

Monitoring

Enable to record traffic logs for this virtual server.

Note: Local logging is constrained by available disk space. We recommend that if you enable traffic logs, you monitor your disk space closely. We also recommend that you use local logging during evaluation and verification of your initial deployment, and then configure remote logging to send logs to a log management repository.

Enable the view virtual server from FortiView