config firewall profile-protocol-options

Configure protocol options.

config firewall profile-protocol-options

Description: Configure protocol options.

edit <name>

set comment {var-string}

set replacemsg-group {string}

set oversize-log [disable|enable]

set switching-protocols-log [disable|enable]

config http

Description: Configure HTTP protocol options.

set ports {integer}

set status [enable|disable]

set inspect-all [enable|disable]

set options {option1}, {option2}, ...

set comfort-interval {integer}

set comfort-amount {integer}

set range-block [disable|enable]

set strip-x-forwarded-for [disable|enable]

set post-lang {option1}, {option2}, ...

set fortinet-bar [enable|disable]

set fortinet-bar-port {integer}

set streaming-content-bypass [enable|disable]

set switching-protocols [bypass|block]

set oversize-limit {integer}

set uncompressed-oversize-limit {integer}

set uncompressed-nest-limit {integer}

set stream-based-uncompressed-limit {integer}

set scan-bzip2 [enable|disable]

set block-page-status-code {integer}

set retry-count {integer}

set tcp-window-type [system|static|...]

set tcp-window-minimum {integer}

set tcp-window-maximum {integer}

set tcp-window-size {integer}

set ssl-offloaded [no|yes]

end

config ftp

Description: Configure FTP protocol options.

set ports {integer}

set status [enable|disable]

set inspect-all [enable|disable]

set options {option1}, {option2}, ...

set comfort-interval {integer}

set comfort-amount {integer}

set oversize-limit {integer}

set uncompressed-oversize-limit {integer}

set uncompressed-nest-limit {integer}

set scan-bzip2 [enable|disable]

set ssl-offloaded [no|yes]

end

config imap

Description: Configure IMAP protocol options.

set ports {integer}

set status [enable|disable]

set inspect-all [enable|disable]

set options {option1}, {option2}, ...

set oversize-limit {integer}

set uncompressed-oversize-limit {integer}

set uncompressed-nest-limit {integer}

set scan-bzip2 [enable|disable]

set ssl-offloaded [no|yes]

end

config mapi

Description: Configure MAPI protocol options.

set ports {integer}

set status [enable|disable]

set options {option1}, {option2}, ...

set oversize-limit {integer}

set uncompressed-oversize-limit {integer}

set uncompressed-nest-limit {integer}

set scan-bzip2 [enable|disable]

end

config pop3

Description: Configure POP3 protocol options.

set ports {integer}

set status [enable|disable]

set inspect-all [enable|disable]

set options {option1}, {option2}, ...

set oversize-limit {integer}

set uncompressed-oversize-limit {integer}

set uncompressed-nest-limit {integer}

set scan-bzip2 [enable|disable]

set ssl-offloaded [no|yes]

end

config smtp

Description: Configure SMTP protocol options.

set ports {integer}

set status [enable|disable]

set inspect-all [enable|disable]

set options {option1}, {option2}, ...

set oversize-limit {integer}

set uncompressed-oversize-limit {integer}

set uncompressed-nest-limit {integer}

set scan-bzip2 [enable|disable]

set server-busy [enable|disable]

set ssl-offloaded [no|yes]

end

config nntp

Description: Configure NNTP protocol options.

set ports {integer}

set status [enable|disable]

set inspect-all [enable|disable]

set options {option1}, {option2}, ...

set oversize-limit {integer}

set uncompressed-oversize-limit {integer}

set uncompressed-nest-limit {integer}

set scan-bzip2 [enable|disable]

end

config ssh

Description: Configure SFTP and SCP protocol options.

set options {option1}, {option2}, ...

set comfort-interval {integer}

set comfort-amount {integer}

set oversize-limit {integer}

set uncompressed-oversize-limit {integer}

set uncompressed-nest-limit {integer}

set scan-bzip2 [enable|disable]

end

config dns

Description: Configure DNS protocol options.

set ports {integer}

set status [enable|disable]

end

config cifs

Description: Configure CIFS protocol options.

set ports {integer}

set status [enable|disable]

set server-credential-type [none|credential-replication|...]

config server-keytab

Description: Server keytab.

edit <principal>

set keytab {string}

next

end

end

config mail-signature

Description: Configure Mail signature.

set status [disable|enable]

set signature {string}

end

set rpc-over-http [enable|disable]

next

end

config firewall profile-protocol-options

Parameter name

Description

Type

Size

comment

Optional comments.

var-string

Maximum length: 255

replacemsg-group

Name of the replacement message group to be used

string

Maximum length: 35

oversize-log

Enable/disable logging for antivirus oversize file blocking.

option

-

 

Option

Description

disable

Disable logging for antivirus oversize file blocking.

enable

Enable logging for antivirus oversize file blocking.

switching-protocols-log

Enable/disable logging for HTTP/HTTPS switching protocols.

option

-

 

Option

Description

disable

Disable logging for HTTP/HTTPS switching protocols.

enable

Enable logging for HTTP/HTTPS switching protocols.

rpc-over-http

Enable/disable inspection of RPC over HTTP.

option

-

 

Option

Description

enable

Enable inspection of RPC over HTTP.

disable

Disable inspection of RPC over HTTP.

config http

Parameter name

Description

Type

Size

ports

Ports to scan for content (1 - 65535, default = 80).

integer

Minimum value: 1 Maximum value: 65535

status

Enable/disable the active status of scanning for this protocol.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

inspect-all

Enable/disable the inspection of all ports for the protocol.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

options

One or more options that can be applied to the session.

option

-

 

Option

Description

clientcomfort

Prevent client timeout.

servercomfort

Prevent server timeout.

oversize

Block oversized file/email.

chunkedbypass

Bypass chunked transfer encoded sites.

comfort-interval

Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec, default = 10).

integer

Minimum value: 1 Maximum value: 900

comfort-amount

Amount of data to send in a transmission for client comforting (1 - 65535 bytes, default = 1).

integer

Minimum value: 1 Maximum value: 65535

range-block

Enable/disable blocking of partial downloads.

option

-

 

Option

Description

disable

Disable blocking of partial downloads.

enable

Enable blocking of partial downloads.

strip-x-forwarded-for

Enable/disable stripping of HTTP X-Forwarded-For header.

option

-

 

Option

Description

disable

Disable changing of HTTP X-Forwarded-For header.

enable

Enable replacement of X-Forwarded-For value with 1.1.1.1.

post-lang

ID codes for character sets to be used to convert to UTF-8 for banned words and DLP on HTTP posts (maximum of 5 character sets).

option

-

 

Option

Description

jisx0201

Japanese Industrial Standard 0201.

jisx0208

Japanese Industrial Standard 0208.

jisx0212

Japanese Industrial Standard 0212.

gb2312

Guojia Biaozhun 2312 (simplified Chinese).

ksc5601-ex

Wansung Korean standard 5601.

euc-jp

Extended Unicode Japanese.

sjis

Shift Japanese Industrial Standard.

iso2022-jp

ISO 2022 Japanese.

iso2022-jp-1

ISO 2022-1 Japanese.

iso2022-jp-2

ISO 2022-2 Japanese.

euc-cn

Extended Unicode Chinese.

ces-gbk

Extended GB2312 (simplified Chinese).

hz

Hanzi simplified Chinese.

ces-big5

Big-5 traditional Chinese.

euc-kr

Extended Unicode Korean.

iso2022-jp-3

ISO 2022-3 Japanese.

iso8859-1

ISO 8859 Part 1 (Western European).

tis620

Thai Industrial Standard 620.

cp874

Code Page 874 (Thai).

cp1252

Code Page 1252 (Western European Latin).

cp1251

Code Page 1251 (Cyrillic).

fortinet-bar

Enable/disable Fortinet bar on HTML content.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

fortinet-bar-port

Port for use by Fortinet Bar (1 - 65535, default = 8011).

integer

Minimum value: 1 Maximum value: 65535

streaming-content-bypass

Enable/disable bypassing of streaming content from buffering.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

switching-protocols

Bypass from scanning, or block a connection that attempts to switch protocol.

option

-

 

Option

Description

bypass

Bypass connections when switching protocols.

block

Block connections when switching protocols.

oversize-limit

Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10).

integer

Minimum value: 1 Maximum value: 6446

uncompressed-oversize-limit

Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10).

integer

Minimum value: 0 Maximum value: 6446

uncompressed-nest-limit

Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12).

integer

Minimum value: 2 Maximum value: 100

stream-based-uncompressed-limit

Maximum stream-based uncompressed data size that will be scanned (MB, 0 = unlimited (default). Stream-based uncompression used only under certain conditions.).

integer

Minimum value: 0 Maximum value: 4294967295

scan-bzip2

Enable/disable scanning of BZip2 compressed files.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

block-page-status-code

Code number returned for blocked HTTP pages (non-FortiGuard only) (100 - 599, default = 403).

integer

Minimum value: 100 Maximum value: 599

retry-count

Number of attempts to retry HTTP connection (0 - 100, default = 0).

integer

Minimum value: 0 Maximum value: 100

tcp-window-type

Specify type of TCP window to use for this protocol.

option

-

 

Option

Description

system

Use system default TCP window size for this protocol (Default).

static

Manually specify TCP window size.

dynamic

Vary TCP window size based on available memory, within limits.

tcp-window-minimum

Minimum dynamic TCP window size (default = 128KB).

integer

Minimum value: 65536 Maximum value: 1048576

tcp-window-maximum

Maximum dynamic TCP window size (default = 8MB).

integer

Minimum value: 1048576 Maximum value: 33554432

tcp-window-size

Set TCP static window size (default = 256KB).

integer

Minimum value: 65536 Maximum value: 33554432

ssl-offloaded

SSL decryption and encryption performed by an external device.

option

-

 

Option

Description

no

SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.

yes

SSL decryption and encryption performed by an external device.

config ftp

Parameter name

Description

Type

Size

ports

Ports to scan for content (1 - 65535, default = 21).

integer

Minimum value: 1 Maximum value: 65535

status

Enable/disable the active status of scanning for this protocol.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

inspect-all

Enable/disable the inspection of all ports for the protocol.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

options

One or more options that can be applied to the session.

option

-

 

Option

Description

clientcomfort

Prevent client timeout.

oversize

Block oversized file/email.

splice

Enable splice mode.

bypass-rest-command

Bypass REST command.

bypass-mode-command

Bypass MODE command.

comfort-interval

Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec, default = 10).

integer

Minimum value: 1 Maximum value: 900

comfort-amount

Amount of data to send in a transmission for client comforting (1 - 65535 bytes, default = 1).

integer

Minimum value: 1 Maximum value: 65535

oversize-limit

Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10).

integer

Minimum value: 1 Maximum value: 6446

uncompressed-oversize-limit

Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10).

integer

Minimum value: 0 Maximum value: 6446

uncompressed-nest-limit

Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12).

integer

Minimum value: 2 Maximum value: 100

scan-bzip2

Enable/disable scanning of BZip2 compressed files.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

ssl-offloaded

SSL decryption and encryption performed by an external device.

option

-

 

Option

Description

no

SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.

yes

SSL decryption and encryption performed by an external device.

config imap

Parameter name

Description

Type

Size

ports

Ports to scan for content (1 - 65535, default = 143).

integer

Minimum value: 1 Maximum value: 65535

status

Enable/disable the active status of scanning for this protocol.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

inspect-all

Enable/disable the inspection of all ports for the protocol.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

options

One or more options that can be applied to the session.

option

-

 

Option

Description

fragmail

Pass fragmented email.

oversize

Block oversized file/email.

oversize-limit

Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10).

integer

Minimum value: 1 Maximum value: 6446

uncompressed-oversize-limit

Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10).

integer

Minimum value: 0 Maximum value: 6446

uncompressed-nest-limit

Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12).

integer

Minimum value: 2 Maximum value: 100

scan-bzip2

Enable/disable scanning of BZip2 compressed files.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

ssl-offloaded

SSL decryption and encryption performed by an external device.

option

-

 

Option

Description

no

SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.

yes

SSL decryption and encryption performed by an external device.

config mapi

Parameter name

Description

Type

Size

ports

Ports to scan for content (1 - 65535, default = 135).

integer

Minimum value: 1 Maximum value: 65535

status

Enable/disable the active status of scanning for this protocol.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

options

One or more options that can be applied to the session.

option

-

 

Option

Description

fragmail

Pass fragmented email.

oversize

Block oversized file/email.

oversize-limit

Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10).

integer

Minimum value: 1 Maximum value: 6446

uncompressed-oversize-limit

Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10).

integer

Minimum value: 0 Maximum value: 6446

uncompressed-nest-limit

Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12).

integer

Minimum value: 2 Maximum value: 100

scan-bzip2

Enable/disable scanning of BZip2 compressed files.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

config pop3

Parameter name

Description

Type

Size

ports

Ports to scan for content (1 - 65535, default = 110).

integer

Minimum value: 1 Maximum value: 65535

status

Enable/disable the active status of scanning for this protocol.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

inspect-all

Enable/disable the inspection of all ports for the protocol.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

options

One or more options that can be applied to the session.

option

-

 

Option

Description

fragmail

Pass fragmented email.

oversize

Block oversized file/email.

oversize-limit

Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10).

integer

Minimum value: 1 Maximum value: 6446

uncompressed-oversize-limit

Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10).

integer

Minimum value: 0 Maximum value: 6446

uncompressed-nest-limit

Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12).

integer

Minimum value: 2 Maximum value: 100

scan-bzip2

Enable/disable scanning of BZip2 compressed files.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

ssl-offloaded

SSL decryption and encryption performed by an external device.

option

-

 

Option

Description

no

SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.

yes

SSL decryption and encryption performed by an external device.

config smtp

Parameter name

Description

Type

Size

ports

Ports to scan for content (1 - 65535, default = 25).

integer

Minimum value: 1 Maximum value: 65535

status

Enable/disable the active status of scanning for this protocol.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

inspect-all

Enable/disable the inspection of all ports for the protocol.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

options

One or more options that can be applied to the session.

option

-

 

Option

Description

fragmail

Pass fragmented email.

oversize

Block oversized file/email.

splice

Enable splice mode.

oversize-limit

Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10).

integer

Minimum value: 1 Maximum value: 6446

uncompressed-oversize-limit

Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10).

integer

Minimum value: 0 Maximum value: 6446

uncompressed-nest-limit

Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12).

integer

Minimum value: 2 Maximum value: 100

scan-bzip2

Enable/disable scanning of BZip2 compressed files.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

server-busy

Enable/disable SMTP server busy when server not available.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

ssl-offloaded

SSL decryption and encryption performed by an external device.

option

-

 

Option

Description

no

SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.

yes

SSL decryption and encryption performed by an external device.

config nntp

Parameter name

Description

Type

Size

ports

Ports to scan for content (1 - 65535, default = 119).

integer

Minimum value: 1 Maximum value: 65535

status

Enable/disable the active status of scanning for this protocol.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

inspect-all

Enable/disable the inspection of all ports for the protocol.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

options

One or more options that can be applied to the session.

option

-

 

Option

Description

oversize

Block oversized file/email.

splice

Enable splice mode.

oversize-limit

Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10).

integer

Minimum value: 1 Maximum value: 6446

uncompressed-oversize-limit

Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10).

integer

Minimum value: 0 Maximum value: 6446

uncompressed-nest-limit

Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12).

integer

Minimum value: 2 Maximum value: 100

scan-bzip2

Enable/disable scanning of BZip2 compressed files.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

config ssh

Parameter name

Description

Type

Size

options

One or more options that can be applied to the session.

option

-

 

Option

Description

oversize

Block oversized file/email.

clientcomfort

Prevent client timeout.

servercomfort

Prevent server timeout.

comfort-interval

Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec, default = 10).

integer

Minimum value: 1 Maximum value: 900

comfort-amount

Amount of data to send in a transmission for client comforting (1 - 65535 bytes, default = 1).

integer

Minimum value: 1 Maximum value: 65535

oversize-limit

Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10).

integer

Minimum value: 1 Maximum value: 6446

uncompressed-oversize-limit

Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10).

integer

Minimum value: 0 Maximum value: 6446

uncompressed-nest-limit