Layer 7: Source Address, Source Address Hash

Layer 4: Same as Layer 7, plus Source Address-Port Hash

Source Address, Source Address Hash, Source Address-Port Hash, HTTP Header Hash, HTTP Request Hash, Cookie Hash, Persistent Cookie, Insert Cookie, Embedded Cookie, Rewrite Cookie, Passive Cookie

Same as HTTP, plus SSL Session ID

Source Address

RADIUS attribute

Source Address, Source Address Hash, Source Address-Port Hash

Source Address, Source Address Hash, Source Address-Port Hash, SSL Session ID

Source Address, Source Address Hash, Source Address-Port Hash

Source Address, Source Address Hash, Source Address-Port Hash

Not supported yet.

Source Address, Source Address Hash

Source Address, Source Address Hash

N/A

Source Address, Source Address Hash

N/A

Source Address.

DIAMETER Session ID (default)

N/A

N/A

Source Address, Source Address Hash

Origin Host—Blank

Origin Realm—Blank

Vendor ID—0

Product Name—Blank

Idle Timeout—300 (seconds) (Note: This refers to the built-in session ID persistence timeout.)

Server Close Propagation—OFF (Note: This means that the connection on the client side stays open when the server closes any connection on its side.)

Client SSL—Off

Timeout TCP Session—100

Timeout TCP Session after FIN—100

IP Reputation—Disabled

Geo IP block list—None

Geo IP Allowlist—None

Timeout UDP Session—100

IP Reputation—Disabled

Stateless—Disabled

Geo IP block list—None

Geo IP Allowlist—None

Client Timeout—50

Server Timeout—50

Connect Timeout—5

Queue Timeout—5

HTTP Request Timeout—50

HTTP Keepalive Timeout—50

Client Address—Disabled

X-Forwarded-For—Disabled

X-Forwarded-For Header—Blank

IP Reputation—Disabled

HTTP Mode—Keep Alive

Compression—None.

Decompression—None

Caching—None

Geo IP Block List—None

Geo IP Allowlist—None

Geo IP Redirect URL—http://

HTTP Send Timeout—5

HTTP2—None

Client Timeout—50

Server Timeout—50

Connect Timeout—5

Queue Timeout—5

HTTP Request Timeout—50

HTTP Keepalive Timeout—50

Buffer Pool—Enabled

Client Address—Disabled

X-Forwarded-For—Disabled

X-Forwarded-For Header—None

IP Reputation—Disabled

HTTP Mode—Server Close

Customized SSL Ciphers Flag—Disabled

Compression—None

Decompression—None

Caching—None

Geo IP Block List—None

Geo IP Allowlist—None

Geo IP Redirect URL—http://

HTTP Send Timeout—0

HTTP2—None

Timeout TCP Session—100

Timeout TCP Session after FIN—100

IP Reputation—Disabled

Geo IP Block List—None

Geo IP Allowlist—None

Timeout TCP Session—100

Timeout TCP Session after FIN—100

IP Reputation—Disabled

Geo IP Block List—None

Geo IP Allowlist—None

Client Address—Off

Security Mode—None

Client Address—Off

Source Port—Off

Dynamic Auth—Disable

RADIUS Session—300

Geo IP Block List—None

Geo IP Allowlist—None

SIP Max Size—65535

Server Keepalive Timeout—30

Server Keepalive—Enabled

Client Keepalive—Disabled

Client Protocol—UDP

Server Protocol—None

Failed Client Type—Drop

Failed Server Type—Drop

Insert Client IP—Disabled

Geo IP Block List—None

Geo IP Allowlist—None

Client Address—Off

Media Address—0.0.0.0

Client Timeout—50

Server Timeout—50

Connect Timeout—5

Queue Timeout—5

Source Address—Disabled

IP Reputation—Disabled

Geo IP Block List—None

Geo IP Allowlist—None

IP Reputation—Disabled

Geo IP Block List—None

Geo IP Allowlist—None

Timeout IP Session—100

Client Address—Off

DNS Cache Flag—Enabled

DNS Cache Ageout Time—3600

DNS Cache Size—10

DNS Cache Entry Size—512

DNS Cache Response Type—All Records

DNS Malform Query Action—Drop

DNA Max Query Length—512

DNS Authentication Flag—Disabled

Client Timeout—50

Server Timeout—50

Connect Timeout—5

Queue Timeout—5

Client Address—Disabled

IP Reputation—Disabled

Geo IP block list—None

Client Timeout—50

Server Timeout—50

Connect Timeout—5

Queue Timeout—5

HTTP Request Timeout—50

HTTP Keepalive Timeout—50

Client Address—Disabled

X-Forwarded-For—Disabled

X-Forwarded-For Header—None

IP Reputation—Disabled

HTTP Mode—Keep Alive

SSL Proxy Mode—Disabled

Compression—None

Decompression—None

Caching—None

Geo IP Block List—None

Geo IP Allowlist—None

Geo IP Redirect URL—http://

HTTP Send Timeout—0

HTTP2—None

Client Timeout—50

Server Timeout—50

Connect Timeout—5

Queue Timeout—5

HTTP Request Timeout—50

HTTP Keepalive Timeout—50

Client Address—Disabled

X-Forwarded-For—Disabled

X-Forwarded-For Header—None

IP Reputation—Disabled

HTTP Mode—Server Close

Compression—None

Decompression—None

Caching—None

Geo IP Block List—None

Geo IP Allowlist—None

Geo IP Redirect URL—http://

HTTP Send Timeout—0

HTTP2—None

Starttls Active Mode—require

Forbidden Command—expn, turn, vrfy

Local Certificate Group—LOCAL_CERT_GROUP

Client Address—Disable

Forbidden Command Status—Enable

Domain Name—default.com

Geo IP Block List—None

Geo IP Allowlist—None

Max Header Size—Default is 4096. Valid values range from 2048 to 65536.

Client Address—Disabled by default. When enabled, FortiADC will use the client address to connect to the server pool.

Client Address—Disabled by default. When enabled, FortiADC will use the client address to connect to the server pool.

Client Timeout—50

Server Timeout—50

Connect Timeout—5

Queue Timeout—5

HTTP Send Timeout—0

HTTP Request Timeout—50

HTTP Keepalive Timeout—50

Client Address—Disabled

X-Forwarded-For—Disabled

IP Reputation—Disabled

HTTP Mode—Keep Alive

Compression—None

Decompression—None

HTTP2—LB_HTTP2_PROFILE_DEFAULT

Caching—None

Geo IP Block List—None

Geo IP Allow list—None

Geo IP Redirect URL—http://

Tune Buffer Size—17418

Max HTTP Headers—200

Response Half Closed Connection—Disabled

Client Timeout—50

Server Timeout—50

Connect Timeout—5

Queue Timeout—5

HTTP Send Timeout—0

HTTP Request Timeout—50

HTTP Keepalive Timeout—50

Client Address—Disabled

X-Forwarded-For—Disabled

IP Reputation—Disabled

HTTP Mode—Keep Alive

Compression—None

Decompression—None

HTTP2—LB_HTTP2_PROFILE_DEFAULT

Caching—None

Geo IP Block List—None

Geo IP Allowlist—None

Geo IP Redirect URL—http://

Tune Buffer Size—17418

Max HTTP Headers—200

Response Half Closed Connection—Disabled

Client Timeout—50

Server Timeout—50

Connect Timeout—5

Queue Timeout—5

HTTP Request Timeout—50

HTTP Keepalive Timeout—50

X-Forwarded-For—Disabled

HTTP Mode—Keep Alive

HTTP3—LB_HTTP3_PROFILE_DEFAULT

Tune Buffer Size—32768

Max HTTP Headers—200

Timeout TCP Session—100

Message Encode Type—ASCII

Length Indicator Type—binary

Length Indicator Shift—0

Length Indicator Size—2

Optional Header Length—2

Optional Trailer Hex—None

Geo IP Block List—None

Geo IP Allowlist—None

Client Timeout—50

Server Timeout—50

Connect Timeout—50

Queue Timeout—50

HTTP Send Timeout—0

HTTP Request Timeout—50

HTTP Keepalive Timeout—50

Client Address—Disabled

X-Forwarded-For—Disabled

X-Forwarded-For Header—None

IP Reputation—Disabled

HTTP Mode—Keep Alive

Decompression—None

Geo IP Block List—None

Geo IP Allowlist—None

Geo IP Redirect URL—http://

Tune Buffer Size—8030

Max HTTP Headers—100

Response Half Closed Connection—Disabled

Specify the profile type. After you have specified the type, the CLI commands are constrained to the ones that are applicable to the specified type, not all of the settings described in this table.

set type tcp

Client-side timeout for connections where the client has not sent a FIN signal, but the connection has been idle. The default is 100 seconds. The valid range is 1 to 86,400.

Client-side connection timeout. The default is 100 seconds. The valid range is 1 to 86,400.

Enable to send TCP RST to the client and real server when the TCP session expires. This is disabled by default.

Note: This function is supported for both IPv4 and IPv6 in L4 and L2 virtual servers. For L4 virtual servers, timeout_send_rst is supported for DNAT/FullNAT/NAT46/NAT64 packet forwarding methods.

Enable to apply the FortiGuard IP reputation service.

Select a Geo IP block list configuration object.

Select an allowlist configuration object.

set type ip

Enable to apply the FortiGuard IP reputation service.

Select a Geo IP block list configuration object.

Select an allowlist configuration object.

Client-side session timeout. The default is 100 seconds. The valid range is 1 to 86,400.

set type dns

Enable/disable to use the original client IP address as the source address when connecting to the real server.

Enable/disable the cache for the DNS virtual server.

Specify the cache age-out time (in seconds). The default is 3,600. The valid range is 0 to 65,535.

Specify the maximum cache size (in Megabytes). The default is 10. The valid range is 1 to 100.

Specify the maximum cache entry size. The default is 512. The valid range is 256 to 4,096.

Select either of the following cache response types:

• single

• round-robin

Select either of the following reactions for the malformed requests:

• drop

• forward

Specify the maximum query length. The default is 512. The valid range is 256 to 4,096.

Enable/disable to authenticate client by redirecting UDP query to TCP.

Enable to apply the UDP stateless function.

Client-side session timeout. The default is 100 seconds. The valid range is 1 to 86,400.

Enable to apply the FortiGuard IP reputation service.

Select a Geo IP block list configuration object.

Select an allowlist configuration object.

set type rtsp

Specify the maximum size of RTSP packets, which can range from 16 to 65, 536.

Enable/disable to use the original client IP address as the source address when connecting to the real server.

set type rtmp

Enable/disable to use the original client IP address as the source address when connecting to the real server.

set type ftp

Client-side timeout for connections where the client has not sent a FIN signal, but the connection has been idle. The default is 100 seconds. The valid range is 1 to 86,400.

Client-side connection timeout. The default is 100 seconds. The valid range is 1 to 86,400.

Enable to apply the FortiGuard IP reputation service.

Specify a Geo IP block list configuration object.

Specify a Geo IP allowlist configuration object.

Select either of the following:

• none

• explicit

• implicit

set type http and set type https

Specify the buffer size for a session when buffer-pool is enabled. Specify lower values to allow more sessions to coexist in the same amount of RAM, and higher values for traffic with larger HTTP body content. The default is 8,030 bytes. The valid range is 128 to 2,147,483,647.

Note:

The tune-bufsize factors into the total allowable size for an HTTP request. The default maximum length of an HTTP request is calculated as tune-bufsize <integer> - tune-maxrewrite <integer>.

For example, tune-bufsize 8030 - tune-maxrewrite 1024 = 7006 bytes is the maximum for the HTTP request.

Specify the name of the caching configuration object.

Use the original client IP address as the source address in the connection to the real server.

Client-side TCP connection timeout. The default is 50 seconds. The valid range is from 1 to 3,600.

Specify a compression configuration object.

Multiplexed server-side TCP connection timeout. Usually less than the client-side timeout. The default is 5 seconds. The valid range is 1 to 3,600.

The default is 50 seconds. The valid range is 1 to 3,600.

• KeepAlive. Do not close the connection to the real server after each HTTP transaction. Instead, keep the connection between FortiADC and the real server open until the client-side connection is closed. This option is required for applications like Microsoft SharePoint.
• OnceOnly. An HTTP transaction can consist of multiple HTTP requests (separate requests for an HTML page and the images contained therein, for example). To improve performance, the "once only" flag instructs the FortiADC to evaluate only the first set of headers in a connection. Subsequent requests belonging to the connection are not load balanced, but sent to the same server as the first request.
• ServerClose. Close the connection to the real server after each HTTP transaction.

Client-side HTTP request timeout. The default is 50 seconds. The valid range is 1 to 3,600.

Enable this option to append the client IP address found in IP layer packets to the HTTP header, for example, X-forwarded-for: 192.168.161.100.

The default header name is X-forwarded-for. If you prefer a different name, use http-x-forwarded-for-header to define a custom name.

Specify a custom name for the HTTP header which carries the client IP address. Do not include the 'X-' prefix. Examples: Forwarded-For, Real-IP, or True-IP.

Specifies how long connection requests to a backend server remain in a queue if the server has reached its maximum number of connections. If the timeout period expires before the client can connect, FortiADC drops the connection and sends a 503 error to the client. The default is 5 seconds. The valid range is 1 to 3,600.

Server-side IP session timeout. The default is 50 seconds. The valid range is 1 to 3,600.

Specify the buffer space reserved for content rewriting. The default is 1,024 bytes. The valid range is 128 to 2,147,483,647.

Note:

The tune-maxrewrite factors into the total allowable size for an HTTP request. The default maximum length of an HTTP request is calculated as tune-bufsize <integer> - tune-maxrewrite <integer>.

For example, tune-bufsize 8030 - tune-maxrewrite 1024 = 7006 bytes is the maximum for the HTTP request.

Enable to apply the FortiGuard IP reputation service.

Specify a Geo IP block list configuration object.

For HTTP/HTTPS, if you have configured a Geo IP redirect action, specify a redirect URL.

Specify a Geo IP allowlist configuration object.

The http3-profile option is only available if type is https.

Specify an HTTP3 Profile configuration object. See config load-balance http3-profile.

set type radius

The default is 300 seconds. The valid range is 1 to 3,600.

Enable/disable RADIUS dynamic authorization (CoA, Disconnect messages).

Dynamic auth port.

Enable/disable the use of a client IP as the source IP to connect to the real server.

Specify a Geo IP block list configuration object.

Specify a Geo IP allowlist configuration object.

Client-side TCP connection timeout. The default is 50 seconds. The valid range is 1 to 3,600.

Server-side IP session timeout. The default is 50 seconds. The valid range is 1 to 3,600.

Multiplexed server-side TCP connection timeout. Usually less than the client-side timeout. The default is 5 seconds. The valid range is 1 to 3,600.

Specifies how long connection requests to a backend server remain in a queue if the server has reached its maximum number of connections. If the timeout period expires before the client can connect, FortiADC drops the connection and sends a 503 error to the client. The default is 5 seconds. The valid range is 1 to 3,600.

Use the original client IP address as the source address in the connection to the real server.

Enable to apply the FortiGuard IP reputation service.

Specify a Geo IP block list configuration object.

Specify a Geo IP allowlist configuration object.

set type tcps

Client-side TCP connection timeout. The default is 50 seconds. The valid range is 1 to 3,600.

Server-side IP session timeout. The default is 50 seconds. The valid range is 1 to 3,600.

Multiplexed server-side TCP connection timeout. Usually less than the client-side timeout. The default is 5 seconds. The valid range is 1 to 3,600.

Specifies how long connection requests to a backend server remain in a queue if the server has reached its maximum number of connections. If the timeout period expires before the client can connect, FortiADC drops the connection and sends a 503 error to the client. The default is 5 seconds. The valid range is 1 to 3,600.

Use the original client IP address as the source address in the connection to the real server.

Enable to apply the FortiGuard IP reputation service.

Specify a Geo IP block list configuration object.

Specify a Geo IP allowlist configuration object.

set type turbohttp

Client-side timeout for connections where the client has not sent a FIN signal, but the connection has been idle. The default is 100 seconds. The valid range is 1 to 86,400.

Client-side connection timeout. The default is 100 seconds. The valid range is 1 to 86,400.

Enable to apply the FortiGuard IP reputation service.

Specify a Geo IP block list configuration object.

Specify a Geo IP allowlist configuration object.

Client-side transport protocol:

• tcp
• udp (default)

Action when the SIP client cannot be reached:

• drop—Drop the connection.
• send—Drop the connection and send a message, for example, a status code and error message.

Message string. Use double-quotation marks for strings with spaces.

Action when the SIP server cannot be reached:

• drop—Drop the connection.
• send—Drop the connection and send a message, for example, a status code and error message.

Message string. Use double-quotation marks for strings with spaces. For example:

"404 Not Found"

Server-side transport protocol.

• tcp
• udp

Default is "unset", so the client-side protocol determines the server-side protocol.

Caching name.

Use client address to connect to pool.

The maximum inactivity time on the client side.

The maximum time to wait for a connection attempt to a server to succeed.

The decompression name.

The geography IP block list.

Redirect URL for IP geography.

The maximum allowed time to wait for a new HTTP request to appear.

The maximum allowed time to wait for a complete HTTP request.

The timeout (in seconds) of HTTP send out all the buffered data.

Insert X-Forwarded-For header to request.

Change X-Forwarded-For header name.

Use IP Reputation

Max HTTP headers limit.

Note: If enlarge this limit, you may meet parse failure because the buffer size limit.

The maximum time to wait in the queue for a connection slot to be free.

If enabled, FortiADC will continue serving the request in half closed connection until the response completes.

The maximum inactivity time on the server side.

Specify the buffer size for a session when buffer-pool is enabled. Specify lower values to allow more sessions to coexist in the same amount of RAM, and higher values for traffic with larger HTTP body content. The default is 8,030 bytes. The valid range is 128 to 2,147,483,647.

Note:

The tune-bufsize factors into the total allowable size for an HTTP request. The default maximum length of an HTTP request is calculated as tune-bufsize <integer> - tune-maxrewrite <integer>.

For example, tune-bufsize 8030 - tune-maxrewrite 1024 = 7006 bytes is the maximum for the HTTP request.

Specify the buffer space reserved for content rewriting. The default is 1,024 bytes. The valid range is 128 to 2,147,483,647.

Note:

The tune-maxrewrite factors into the total allowable size for an HTTP request. The default maximum length of an HTTP request is calculated as tune-bufsize <integer> - tune-maxrewrite <integer>.

For example, tune-bufsize 8030 - tune-maxrewrite 1024 = 7006 bytes is the maximum for the HTTP request.

The geography IP allowlist.

• all—Parse all headers for a match.
• first—Parse the first header for a match.

• append-always—Append after the last header.
• append-if-not-exist—Append only if the header is not present.
• insert-always—Insert before the first header even if the header is already present.
• insert-if-not-exist—Insert before the first header only if the header is not already present.

• all
• first

• append-always
• append-if-not-exist
• insert-always
• insert-if-not-exist

• all
• first

• append-always
• append-if-not-exist
• insert-always
• insert-if-not-exist

• all
• first

• append-always
• append-if-not-exist
• insert-always
• insert-if-not-exist

Sets the value of Diameter AVP 264. This AVP can be a character string and specifies the identity of the originating host for Diameter messages.

ADC will modify the origin-host avp on client request with the setting value, then transfer it to RS.

ADC will modify the origin-host avp on server response with the setting value, then transfer it to the client.

Specify the identity in the following format: vs.realm

The host is a string unique to the client. The realm is the Diameter realm, specified by the Realm option (described below).

If origin-host is set with an empty value (nothing), ADC will not change the value of the origin-host in the client or server when it transfers them.

The default is empty value.

Sets the value of Diameter AVP 296. This AVP can be a character string and specifies the Diameter realm from which Diameter messages, including requests, are originated.

ADC will modify the origin-realm avp on client request with the setting value, then transfer it to RS.

ADC will modify the origin-realm avp on server response with the setting value, then transfer it to the client.

If origin-realm is set with an empty value(nothing), ADC will not change the value of the origin-realm in the client or server when it transfers them.

The default is empty value.

Sets the value of Diameter AVP 269. This AVP can be a character string and specifies the product; for example, “fortiadc”.

ADC will modify the Product-Name avp on client request with the setting value, then transfer it to RS.

ADC will modify the Product-Name avp on server response with the setting value, then transfer it to the client.

If product-name is set with an empty value(nothing), ADC will not change the value of the origin-realm in the client or server when it transfers them.

The default is empty value.

Sets the value of Diameter AVP 266. This AVP can be a character string and specifies the vendor; for example, “156”.

ADC will modify the vendor-id avp on client request with the setting value, then transfer it to RS.

ADC will modify the vendor-id avp on server response with the setting value, then transfer it to the client.

If vendor-ide is set to 0, ADC will not change the value of vendor-id in the client or server when it transfers them.

The default is 0. The valid range is 0-4294967295.

Default, for different requests with the same session_id avp, if their interval is less than idle-timeout, ADC will dispatch them to the same RS.

The default is 300 seconds. The valid range is 1-86400.

When this parameter is set, ADC will act in proxy mode.

When transferring diameter traffic with server-close-propagation enabled, if one of the servers resets or sends DPR to ADC, ADC will close connection with the client and other servers at the same time.

When transferring diameter traffic with server-close-propagation disabled, if one of the servers resets or sends DPR to ADC, ADC will transfer the requests from the client to the other servers.

Disabled by default.

set type iso8583

Client-side timeout for connections where the client has not sent a FIN signal, but the connection has been idle. The default is 100 seconds. The valid range is 1 to 86,400 seconds.

set type mssql

This timeout is counted as the amount of time when the client did not send a complete request HTTP header to the FortiADC after the client connected to the FortiADC. If this timeout expires, FortiADC will send a 408 message to client and close the connection to the client. The default is 50 seconds. The valid range is 1 to 86,400 seconds.

Specify the maximum inactivity time for MS SQL server on the server side. The default is 600 seconds. The valid range is 1 to 86,400 seconds.

Specify the maximum connections that can connect to the MS SQL server on the server side. The default is 10,000. The valid range is 1 to 30,000.

set type smtp

Enable/disable to use the original client IP address as the source address when connecting to the real server.

Note: When using the NAT Source Pool for SMTP VS, ensure the SMTP application profile is disabled for Client Address. When the SMTP is enabled for Client Address, it will use the original client IP address as the source address when connecting to the real server, which cannot be done when the NAT source pool is used at the same time.

Select one of the following:

• allow—The client can either use or not use the STARTTLS command.

• require—The STARTTLS command must be used to encrypt the connection first.

• none—The STARTTLS command is NOT supported.

Enable/disable to forbid the command(s) selected in forbidden-command.

Select any, all, or none of the commands (i.e., expn, turn, vrfy). If selected, the command or commands will be rejected by FortiADC; otherwise, the command or commands will be accepted and forwarded to the back end.

Specify the domain name.

Note: The system does not provide default MyQSL profiles as it does with the other protocols.

Select either of the following MySQL modes:

• single-primary — The profile will use the single-primary mode. You will then need to specify and configure the primary server and secondary servers.

• sharding— The profile will use the sharding mode to load-balance MySQL traffic.

set type l7-tcp

Client-side timeout for connections where the client has not sent a FIN signal, but the connection has been idle. The default is 100 seconds. The valid range is 1 to 86,400.

Enable to apply the FortiGuard IP reputation service.

Select a Geo IP block list configuration object.

Select an allowlist configuration object.

Client-side session timeout. The default is 100 seconds. The valid range is 1 to 86,400.

Enable to apply the FortiGuard IP reputation service.

Select a Geo IP block list configuration object.